This repository has no description
1.6 kB
57 lines
1{
2 self,
3 pkgs,
4 ...
5}:
6{
7 environment.systemPackages = with pkgs; [
8 yubikey-personalization
9 yubikey-manager
10 pinentry-curses
11 pinentry-qt
12 # fix polkit rules
13 # https://github.com/NixOS/nixpkgs/issues/280826
14 pcscliteWithPolkit.out
15 ];
16
17 services.udev.packages = with pkgs; [ yubikey-personalization ];
18 systemd.user.sockets.gpg-agent-ssh.wantedBy = [ "sockets.target" ];
19
20 services.pcscd.enable = true;
21 systemd.user.services.gpg-agent.serviceConfig.ExecStartPre = pkgs.writers.writeDash "init_gpg" ''
22 set -x
23 mkdir -p $HOME/.gnupg
24 rm -f $HOME/.gnupg/scdaemon.conf
25 '';
26 systemd.user.services.gpg-agent.serviceConfig.ExecStartPost = pkgs.writers.writeDash "init_gpg" ''
27 ${pkgs.gnupg}/bin/gpg --import ${self.keys.pgp.yubi_pgp.key} &>/dev/null
28 echo '${self.keys.pgp.yubi_pgp.id}:6:' | ${pkgs.gnupg}/bin/gpg --import-ownertrust &>/dev/null
29 '';
30
31 security.polkit.extraConfig = ''
32 polkit.addRule(function(action, subject) {
33 if (
34 (
35 action.id == "org.debian.pcsc-lite.access_pcsc" ||
36 action.id == "org.debian.pcsc-lite.access_card"
37 ) && subject.user == "lass"
38 ) {
39 return polkit.Result.YES;
40 }
41 });
42 polkit.addRule(function(action, subject) {
43 polkit.log("subject: " + subject + " action: " + action);
44 });
45 '';
46
47 # allow nix to acces remote builders via yubikey
48 systemd.services.nix-daemon.environment.SSH_AUTH_SOCK = "/run/user/1337/gnupg/S.gpg-agent.ssh";
49
50 programs = {
51 ssh.startAgent = false;
52 gnupg.agent = {
53 enable = true;
54 enableSSHSupport = true;
55 };
56 };
57}