Initial commit for yubikey.
This commit is contained in:
parent
1e81adac73
commit
650cfe1724
|
@ -34,7 +34,10 @@
|
||||||
(modulesPath + "/installer/scan/not-detected.nix")
|
(modulesPath + "/installer/scan/not-detected.nix")
|
||||||
];
|
];
|
||||||
|
|
||||||
this.systems.zfs.enable = true;
|
this.systems = {
|
||||||
|
zfs.enable = true;
|
||||||
|
yubikey.enable = true;
|
||||||
|
};
|
||||||
|
|
||||||
networking = {
|
networking = {
|
||||||
# This is required for the zfs module as well. Must be unique. Run the following head -c4 /dev/urandom | od -A none -t x4
|
# This is required for the zfs module as well. Must be unique. Run the following head -c4 /dev/urandom | od -A none -t x4
|
||||||
|
|
|
@ -8,6 +8,7 @@
|
||||||
./gtk.nix
|
./gtk.nix
|
||||||
./power.nix
|
./power.nix
|
||||||
./xdg.nix
|
./xdg.nix
|
||||||
|
./yubikey.nix
|
||||||
./zfs.nix
|
./zfs.nix
|
||||||
];
|
];
|
||||||
}
|
}
|
||||||
|
|
53
modules/system/yubikey.nix
Normal file
53
modules/system/yubikey.nix
Normal file
|
@ -0,0 +1,53 @@
|
||||||
|
{ config, lib, pkgs, ... }:
|
||||||
|
let
|
||||||
|
cfg = config.this.systems.yubikey;
|
||||||
|
graphical = config.this.graphical;
|
||||||
|
in with lib; {
|
||||||
|
options.this.systems.yubikey.enable = mkEnableOption "Yubikey";
|
||||||
|
|
||||||
|
config = mkIf cfg.enable {
|
||||||
|
services.udev.packages = with pkgs; [ yubikey-personalization ];
|
||||||
|
|
||||||
|
environment.shellInit = ''
|
||||||
|
export GPG_TTY="$(tty)"
|
||||||
|
gpg-connect-agent /bye
|
||||||
|
export SSH_AUTH_SOCK="/run/user/$UID/gnupg/S.gpg-agent.ssh"
|
||||||
|
'';
|
||||||
|
|
||||||
|
programs = {
|
||||||
|
ssh.startAgent = false;
|
||||||
|
gnupg.agent = {
|
||||||
|
enable = true;
|
||||||
|
enableSSHSupport = true;
|
||||||
|
pinentryFlavor = if graphical.enable then "gnome3" else "curses";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# security.pam = {
|
||||||
|
# yubico = {
|
||||||
|
# enable = true;
|
||||||
|
# mode = "challenge-response";
|
||||||
|
# control = "required"; # oh boy.
|
||||||
|
# };
|
||||||
|
# };
|
||||||
|
|
||||||
|
environment.systemPackages = with pkgs;
|
||||||
|
[ yubioath-desktop pinentry-curses ]
|
||||||
|
++ optionals (graphical.enable) [ pinentry-gnome ];
|
||||||
|
|
||||||
|
home-manager.users.james.home = {
|
||||||
|
packages = with pkgs;
|
||||||
|
[ yubikey-manager yubikey-personalization ]
|
||||||
|
++ optionals (graphical.enable) [
|
||||||
|
yubikey-manager-qt
|
||||||
|
yubikey-personalization-gui
|
||||||
|
];
|
||||||
|
file.".gnupg/gpg-agent.config" = {
|
||||||
|
text = if graphical.enable then
|
||||||
|
"pinentry-program ${pkgs.pinentry-gnome}/bin/pinentry"
|
||||||
|
else
|
||||||
|
"pinentry-program ${pkgs.pinentry-curses}/bin/pinentry";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
Reference in New Issue
Block a user