d7e2c0a924
Will this ever change? No like likely, but I do think that this is the correct way to do this.
56 lines
1.5 KiB
Nix
56 lines
1.5 KiB
Nix
{ config, lib, pkgs, user, ... }:
|
|
let
|
|
this = config.my.system.yubikey;
|
|
graphical = config.my.graphical;
|
|
in
|
|
with lib; {
|
|
options.my.system.yubikey.enable = mkEnableOption "Yubikey";
|
|
|
|
config = mkIf this.enable {
|
|
services.udev.packages = with pkgs; [ yubikey-personalization ];
|
|
|
|
environment.shellInit = ''
|
|
export GPG_TTY="$(tty)"
|
|
gpg-connect-agent /bye
|
|
export SSH_AUTH_SOCK="/run/user/$UID/gnupg/S.gpg-agent.ssh"
|
|
'';
|
|
|
|
programs = {
|
|
ssh.startAgent = false;
|
|
gnupg.agent = {
|
|
enable = true;
|
|
enableSSHSupport = true;
|
|
pinentryFlavor = if graphical.enable then "gnome3" else "curses";
|
|
};
|
|
};
|
|
|
|
# security.pam = {
|
|
# yubico = {
|
|
# enable = true;
|
|
# mode = "challenge-response";
|
|
# control = "required"; # oh boy.
|
|
# };
|
|
# };
|
|
|
|
environment.systemPackages = with pkgs;
|
|
[ yubioath-desktop pinentry-curses ]
|
|
++ optionals (graphical.enable) [ pinentry-gnome ];
|
|
|
|
home-manager.users."${user.name}".home = {
|
|
packages = with pkgs;
|
|
[ yubikey-manager yubikey-personalization ]
|
|
++ optionals (graphical.enable) [
|
|
yubikey-manager-qt
|
|
yubikey-personalization-gui
|
|
];
|
|
file.".gnupg/gpg-agent.config" = {
|
|
text =
|
|
if graphical.enable then
|
|
"pinentry-program ${pkgs.pinentry-gnome}/bin/pinentry"
|
|
else
|
|
"pinentry-program ${pkgs.pinentry-curses}/bin/pinentry";
|
|
};
|
|
};
|
|
};
|
|
}
|