This repository has no description
yubikey: remove gpg specific config
author
lassulus
date
(Nov 23, 2025, 8:29 PM +0700)
commit
41b9a69b
41b9a69b788a46fb6d3cf4372c39ae022fe23db8
parent
789a9407
789a94079157d28aadd52f62aaf17a1d94288942
-41
-41
2configs/yubikey.nix
-41
2configs/yubikey.nix
···
1
1
{
2
-
self,
3
2
pkgs,
4
3
...
5
4
}:
···
9
8
yubikey-manager
10
9
pinentry-curses
11
10
pinentry-qt
12
-
# fix polkit rules
13
-
# https://github.com/NixOS/nixpkgs/issues/280826
14
-
pcscliteWithPolkit.out
15
11
];
16
12
17
13
services.udev.packages = with pkgs; [ yubikey-personalization ];
18
-
systemd.user.sockets.gpg-agent-ssh.wantedBy = [ "sockets.target" ];
19
14
20
15
services.pcscd.enable = true;
21
-
systemd.user.services.gpg-agent.serviceConfig.ExecStartPre = pkgs.writers.writeDash "init_gpg" ''
22
-
set -x
23
-
mkdir -p $HOME/.gnupg
24
-
rm -f $HOME/.gnupg/scdaemon.conf
25
-
'';
26
-
systemd.user.services.gpg-agent.serviceConfig.ExecStartPost = pkgs.writers.writeDash "init_gpg" ''
27
-
${pkgs.gnupg}/bin/gpg --import ${self.keys.pgp.yubi_pgp.key} &>/dev/null
28
-
echo '${self.keys.pgp.yubi_pgp.id}:6:' | ${pkgs.gnupg}/bin/gpg --import-ownertrust &>/dev/null
29
-
'';
30
-
31
-
security.polkit.extraConfig = ''
32
-
polkit.addRule(function(action, subject) {
33
-
if (
34
-
(
35
-
action.id == "org.debian.pcsc-lite.access_pcsc" ||
36
-
action.id == "org.debian.pcsc-lite.access_card"
37
-
) && subject.user == "lass"
38
-
) {
39
-
return polkit.Result.YES;
40
-
}
41
-
});
42
-
polkit.addRule(function(action, subject) {
43
-
polkit.log("subject: " + subject + " action: " + action);
44
-
});
45
-
'';
46
-
47
-
# allow nix to acces remote builders via yubikey
48
-
systemd.services.nix-daemon.environment.SSH_AUTH_SOCK = "/run/user/1337/gnupg/S.gpg-agent.ssh";
49
-
50
-
programs = {
51
-
ssh.startAgent = false;
52
-
gnupg.agent = {
53
-
enable = true;
54
-
enableSSHSupport = true;
55
-
};
56
-
};
57
16
}