47 lines
1,021 B
Nix
47 lines
1,021 B
Nix
{
|
|
lib,
|
|
config,
|
|
pkgs,
|
|
...
|
|
}: let
|
|
inherit (lib) mkMerge mkIf;
|
|
inherit (config) conf;
|
|
in
|
|
mkMerge [
|
|
(mkIf
|
|
conf.yubikey.enable
|
|
{
|
|
services.udev.packages = [pkgs.yubikey-personalization];
|
|
services.pcscd.enable = true;
|
|
|
|
programs.gnupg.agent = {
|
|
enable = true;
|
|
enableSSHSupport = true;
|
|
};
|
|
|
|
home-manager.users.${conf.username}.home.packages = with pkgs; [
|
|
yubioath-flutter
|
|
];
|
|
})
|
|
(mkIf
|
|
conf.yubikey.login
|
|
{
|
|
security.pam.u2f = {
|
|
enable = true;
|
|
control = "required";
|
|
settings = {
|
|
cue = true;
|
|
};
|
|
};
|
|
|
|
# Lock when removing yubikey
|
|
services.udev.extraRules = ''
|
|
ACTION=="remove",\
|
|
ENV{ID_BUS}=="usb",\
|
|
ENV{ID_MODEL_ID}=="0407",\
|
|
ENV{ID_VENDOR_ID}=="1050",\
|
|
ENV{ID_VENDOR}=="Yubico",\
|
|
RUN+="${pkgs.systemd}/bin/loginctl lock-sessions"
|
|
'';
|
|
})
|
|
]
|