This repository has no description
2.2 kB
62 lines
1{ self, config, lib, pkgs, ... }:
2{
3 environment.systemPackages = with pkgs; [
4 yubikey-personalization
5 yubikey-manager
6 pinentry-curses pinentry-qt
7 ];
8
9 services.udev.packages = with pkgs; [ yubikey-personalization ];
10 systemd.user.sockets.gpg-agent-ssh.wantedBy = [ "sockets.target" ];
11
12 services.pcscd.enable = true;
13 systemd.user.services.gpg-agent.serviceConfig.ExecStartPre = pkgs.writers.writeDash "init_gpg" ''
14 set -x
15 mkdir -p $HOME/.gnupg
16 ${pkgs.coreutils}/bin/ln -sf ${pkgs.writeText "scdaemon.conf" ''
17 disable-ccid
18 pcsc-driver ${pkgs.pcsclite.out}/lib/libpcsclite.so.1
19 card-timeout 1
20
21 # Always try to use yubikey as the first reader
22 # even when other smart card readers are connected
23 # Name of the reader can be found using the pcsc_scan command
24 # If you have problems with gpg not recognizing the Yubikey
25 # then make sure that the string here matches exacly pcsc_scan
26 # command output. Also check journalctl -f for errors.
27 reader-port Yubico YubiKey
28 ''} $HOME/.gnupg/scdaemon.conf
29 '';
30 systemd.user.services.gpg-agent.serviceConfig.ExecStartPost = pkgs.writers.writeDash "init_gpg" ''
31 ${pkgs.gnupg}/bin/gpg --import ${self.inputs.stockholm.outPath + "/kartei/lass/pgp/yubikey.pgp"} >/dev/null
32 echo -e '5\ny\n' | gpg --command-fd 0 --expert --edit-key DBCD757846069B392EA9401D6657BE8A8D1EE807 trust >/dev/null || :
33 '';
34
35 security.polkit.extraConfig = ''
36 polkit.addRule(function(action, subject) {
37 if (
38 (
39 action.id == "org.debian.pcsc-lite.access_pcsc" ||
40 action.id == "org.debian.pcsc-lite.access_card"
41 ) && subject.user == "lass"
42 ) {
43 return polkit.Result.YES;
44 }
45 });
46 polkit.addRule(function(action, subject) {
47 polkit.log("subject: " + subject + " action: " + action);
48 });
49 '';
50
51 # allow nix to acces remote builders via yubikey
52 systemd.services.nix-daemon.environment.SSH_AUTH_SOCK = "/run/user/1337/gnupg/S.gpg-agent.ssh";
53
54 programs = {
55 ssh.startAgent = false;
56 gnupg.agent = {
57 enable = true;
58 pinentryFlavor = "qt";
59 enableSSHSupport = true;
60 };
61 };
62}