This repository has no description
2.8 kB
86 lines
1{
2 self,
3 lib,
4 pkgs,
5 ...
6}:
7let
8 # pcsclite workaround until https://github.com/NixOS/nixpkgs/pull/308884 is in unstable
9 pcsclite = pkgs.pcsclite.overrideAttrs (old: {
10 postPatch =
11 old.postPatch
12 + (lib.optionalString
13 (!(lib.strings.hasInfix ''--replace-fail "libpcsclite_real.so.1"'' old.postPatch))
14 ''
15 substituteInPlace src/libredirect.c src/spy/libpcscspy.c \
16 --replace-fail "libpcsclite_real.so.1" "$lib/lib/libpcsclite_real.so.1"
17 ''
18 );
19 });
20in
21{
22 environment.systemPackages = with pkgs; [
23 yubikey-personalization
24 yubikey-manager
25 pinentry-curses
26 pinentry-qt
27 # fix polkit rules
28 # https://github.com/NixOS/nixpkgs/issues/280826
29 pcscliteWithPolkit.out
30 ];
31
32 services.udev.packages = with pkgs; [ yubikey-personalization ];
33 systemd.user.sockets.gpg-agent-ssh.wantedBy = [ "sockets.target" ];
34
35 services.pcscd.enable = true;
36 systemd.user.services.gpg-agent.serviceConfig.ExecStartPre = pkgs.writers.writeDash "init_gpg" ''
37 set -x
38 mkdir -p $HOME/.gnupg
39 ${pkgs.coreutils}/bin/ln -sf ${pkgs.writeText "scdaemon.conf" ''
40 disable-ccid
41 pcsc-driver ${pcsclite.lib}/lib/libpcsclite.so.1
42 card-timeout 1
43
44 # Always try to use yubikey as the first reader
45 # even when other smart card readers are connected
46 # Name of the reader can be found using the pcsc_scan command
47 # If you have problems with gpg not recognizing the Yubikey
48 # then make sure that the string here matches exacly pcsc_scan
49 # command output. Also check journalctl -f for errors.
50 reader-port Yubico YubiKey
51 ''} $HOME/.gnupg/scdaemon.conf
52 '';
53 systemd.user.services.gpg-agent.serviceConfig.ExecStartPost = pkgs.writers.writeDash "init_gpg" ''
54 ${pkgs.gnupg}/bin/gpg --import ${
55 self.inputs.stockholm.outPath + "/kartei/lass/pgp/yubikey.pgp"
56 } >/dev/null
57 echo -e '5\ny\n' | ${pkgs.gnupg}/bin/gpg --command-fd 0 --expert --edit-key DBCD757846069B392EA9401D6657BE8A8D1EE807 trust >/dev/null || :
58 '';
59
60 security.polkit.extraConfig = ''
61 polkit.addRule(function(action, subject) {
62 if (
63 (
64 action.id == "org.debian.pcsc-lite.access_pcsc" ||
65 action.id == "org.debian.pcsc-lite.access_card"
66 ) && subject.user == "lass"
67 ) {
68 return polkit.Result.YES;
69 }
70 });
71 polkit.addRule(function(action, subject) {
72 polkit.log("subject: " + subject + " action: " + action);
73 });
74 '';
75
76 # allow nix to acces remote builders via yubikey
77 systemd.services.nix-daemon.environment.SSH_AUTH_SOCK = "/run/user/1337/gnupg/S.gpg-agent.ssh";
78
79 programs = {
80 ssh.startAgent = false;
81 gnupg.agent = {
82 enable = true;
83 enableSSHSupport = true;
84 };
85 };
86}