{pkgs, ...}:
{
  security.tpm2.enable = true;
  security.tpm2.pkcs11.enable = true;  # expose /run/current-system/sw/lib/libtpm2_pkcs11.so
  security.tpm2.tctiEnvironment.enable = true;  # TPM2TOOLS_TCTI and TPM2_PKCS11_TCTI env variables
  security.tpm2.abrmd.enable = true;
  users.users.yaroslav.extraGroups = [ "tss" ];  # tss group has access to TPM devices
  environment.systemPackages = [
    pkgs.tpm2-tss
  ];
}