This repository has no description
2.7 kB
73 lines
1{ self, lib, pkgs, ... }:
2let
3 # pcsclite workaround until https://github.com/NixOS/nixpkgs/pull/308884 is in unstable
4 pcsclite = pkgs.pcsclite.overrideAttrs (old: {
5 postPatch = old.postPatch + (lib.optionalString (!(lib.strings.hasInfix ''--replace-fail "libpcsclite_real.so.1"'' old.postPatch)) ''
6 substituteInPlace src/libredirect.c src/spy/libpcscspy.c \
7 --replace-fail "libpcsclite_real.so.1" "$lib/lib/libpcsclite_real.so.1"
8 '');
9 });
10in
11{
12 environment.systemPackages = with pkgs; [
13 yubikey-personalization
14 yubikey-manager
15 pinentry-curses pinentry-qt
16 # fix polkit rules
17 # https://github.com/NixOS/nixpkgs/issues/280826
18 pcscliteWithPolkit.out
19 ];
20
21 services.udev.packages = with pkgs; [ yubikey-personalization ];
22 systemd.user.sockets.gpg-agent-ssh.wantedBy = [ "sockets.target" ];
23
24 services.pcscd.enable = true;
25 systemd.user.services.gpg-agent.serviceConfig.ExecStartPre = pkgs.writers.writeDash "init_gpg" ''
26 set -x
27 mkdir -p $HOME/.gnupg
28 ${pkgs.coreutils}/bin/ln -sf ${pkgs.writeText "scdaemon.conf" ''
29 disable-ccid
30 pcsc-driver ${pcsclite.lib}/lib/libpcsclite.so.1
31 card-timeout 1
32
33 # Always try to use yubikey as the first reader
34 # even when other smart card readers are connected
35 # Name of the reader can be found using the pcsc_scan command
36 # If you have problems with gpg not recognizing the Yubikey
37 # then make sure that the string here matches exacly pcsc_scan
38 # command output. Also check journalctl -f for errors.
39 reader-port Yubico YubiKey
40 ''} $HOME/.gnupg/scdaemon.conf
41 '';
42 systemd.user.services.gpg-agent.serviceConfig.ExecStartPost = pkgs.writers.writeDash "init_gpg" ''
43 ${pkgs.gnupg}/bin/gpg --import ${self.inputs.stockholm.outPath + "/kartei/lass/pgp/yubikey.pgp"} >/dev/null
44 echo -e '5\ny\n' | ${pkgs.gnupg}/bin/gpg --command-fd 0 --expert --edit-key DBCD757846069B392EA9401D6657BE8A8D1EE807 trust >/dev/null || :
45 '';
46
47 security.polkit.extraConfig = ''
48 polkit.addRule(function(action, subject) {
49 if (
50 (
51 action.id == "org.debian.pcsc-lite.access_pcsc" ||
52 action.id == "org.debian.pcsc-lite.access_card"
53 ) && subject.user == "lass"
54 ) {
55 return polkit.Result.YES;
56 }
57 });
58 polkit.addRule(function(action, subject) {
59 polkit.log("subject: " + subject + " action: " + action);
60 });
61 '';
62
63 # allow nix to acces remote builders via yubikey
64 systemd.services.nix-daemon.environment.SSH_AUTH_SOCK = "/run/user/1337/gnupg/S.gpg-agent.ssh";
65
66 programs = {
67 ssh.startAgent = false;
68 gnupg.agent = {
69 enable = true;
70 enableSSHSupport = true;
71 };
72 };
73}