This repository has no description
931 B
34 lines
1{
2 pkgs,
3 lib,
4 ...
5}:
6{
7 environment.systemPackages = with pkgs; [
8 yubikey-personalization
9 yubikey-manager
10 pinentry-curses
11 pinentry-qt
12 ];
13
14 services.udev.packages = with pkgs; [ yubikey-personalization ];
15
16 services.pcscd.enable = true;
17
18 programs.gnupg.agent = {
19 enable = true;
20 # Sets up the gpg-agent-ssh.socket unit so gpg-agent (running in
21 # --supervised mode) actually receives an ssh listen fd. The module
22 # also exports SSH_AUTH_SOCK in environment.extraInit (only if unset),
23 # which we don't want as the system-wide default — undo exactly that
24 # export below, leaving other agents (tpm2.nix) alone; users opt in via:
25 # SSH_AUTH_SOCK="$(gpgconf --list-dirs agent-ssh-socket)" ssh ...
26 enableSSHSupport = true;
27 };
28
29 environment.extraInit = lib.mkAfter ''
30 case "''${SSH_AUTH_SOCK:-}" in
31 */gnupg/S.gpg-agent.ssh) unset SSH_AUTH_SOCK ;;
32 esac
33 '';
34}