This repository has no description
2.3 kB
65 lines
1{ self, pkgs, ... }:
2{
3 environment.systemPackages = with pkgs; [
4 yubikey-personalization
5 yubikey-manager
6 pinentry-curses pinentry-qt
7 # fix polkit rules
8 # https://github.com/NixOS/nixpkgs/issues/280826
9 pcscliteWithPolkit.out
10 ];
11
12 services.udev.packages = with pkgs; [ yubikey-personalization ];
13 systemd.user.sockets.gpg-agent-ssh.wantedBy = [ "sockets.target" ];
14
15 services.pcscd.enable = true;
16 systemd.user.services.gpg-agent.serviceConfig.ExecStartPre = pkgs.writers.writeDash "init_gpg" ''
17 set -x
18 mkdir -p $HOME/.gnupg
19 ${pkgs.coreutils}/bin/ln -sf ${pkgs.writeText "scdaemon.conf" ''
20 disable-ccid
21 pcsc-driver ${pkgs.pcsclite.lib}/lib/libpcsclite.so.1
22 card-timeout 1
23
24 # Always try to use yubikey as the first reader
25 # even when other smart card readers are connected
26 # Name of the reader can be found using the pcsc_scan command
27 # If you have problems with gpg not recognizing the Yubikey
28 # then make sure that the string here matches exacly pcsc_scan
29 # command output. Also check journalctl -f for errors.
30 reader-port Yubico YubiKey
31 ''} $HOME/.gnupg/scdaemon.conf
32 '';
33 systemd.user.services.gpg-agent.serviceConfig.ExecStartPost = pkgs.writers.writeDash "init_gpg" ''
34 ${pkgs.gnupg}/bin/gpg --import ${self.inputs.stockholm.outPath + "/kartei/lass/pgp/yubikey.pgp"} >/dev/null
35 echo -e '5\ny\n' | ${pkgs.gnupg}/bin/gpg --command-fd 0 --expert --edit-key DBCD757846069B392EA9401D6657BE8A8D1EE807 trust >/dev/null || :
36 '';
37
38 security.polkit.extraConfig = ''
39 polkit.addRule(function(action, subject) {
40 if (
41 (
42 action.id == "org.debian.pcsc-lite.access_pcsc" ||
43 action.id == "org.debian.pcsc-lite.access_card"
44 ) && subject.user == "lass"
45 ) {
46 return polkit.Result.YES;
47 }
48 });
49 polkit.addRule(function(action, subject) {
50 polkit.log("subject: " + subject + " action: " + action);
51 });
52 '';
53
54 # allow nix to acces remote builders via yubikey
55 systemd.services.nix-daemon.environment.SSH_AUTH_SOCK = "/run/user/1337/gnupg/S.gpg-agent.ssh";
56
57 programs = {
58 ssh.startAgent = false;
59 gnupg.agent = {
60 enable = true;
61 pinentryFlavor = "qt";
62 enableSSHSupport = true;
63 };
64 };
65}