This repository has no description
1.7 kB
59 lines
1{
2 self,
3 pkgs,
4 ...
5}:
6{
7 environment.systemPackages = with pkgs; [
8 yubikey-personalization
9 yubikey-manager
10 pinentry-curses
11 pinentry-qt
12 # fix polkit rules
13 # https://github.com/NixOS/nixpkgs/issues/280826
14 pcscliteWithPolkit.out
15 ];
16
17 services.udev.packages = with pkgs; [ yubikey-personalization ];
18 systemd.user.sockets.gpg-agent-ssh.wantedBy = [ "sockets.target" ];
19
20 services.pcscd.enable = true;
21 systemd.user.services.gpg-agent.serviceConfig.ExecStartPre = pkgs.writers.writeDash "init_gpg" ''
22 set -x
23 mkdir -p $HOME/.gnupg
24 rm -f $HOME/.gnupg/scdaemon.conf
25 '';
26 systemd.user.services.gpg-agent.serviceConfig.ExecStartPost = pkgs.writers.writeDash "init_gpg" ''
27 ${pkgs.gnupg}/bin/gpg --import ${
28 self.inputs.stockholm.outPath + "/kartei/lass/pgp/yubikey.pgp"
29 } >/dev/null
30 echo -e '5\ny\n' | ${pkgs.gnupg}/bin/gpg --command-fd 0 --expert --edit-key DBCD757846069B392EA9401D6657BE8A8D1EE807 trust >/dev/null || :
31 '';
32
33 security.polkit.extraConfig = ''
34 polkit.addRule(function(action, subject) {
35 if (
36 (
37 action.id == "org.debian.pcsc-lite.access_pcsc" ||
38 action.id == "org.debian.pcsc-lite.access_card"
39 ) && subject.user == "lass"
40 ) {
41 return polkit.Result.YES;
42 }
43 });
44 polkit.addRule(function(action, subject) {
45 polkit.log("subject: " + subject + " action: " + action);
46 });
47 '';
48
49 # allow nix to acces remote builders via yubikey
50 systemd.services.nix-daemon.environment.SSH_AUTH_SOCK = "/run/user/1337/gnupg/S.gpg-agent.ssh";
51
52 programs = {
53 ssh.startAgent = false;
54 gnupg.agent = {
55 enable = true;
56 enableSSHSupport = true;
57 };
58 };
59}