Mic92/stockholm
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

l yubikey: fix initial setup

Browse Source
This commit is contained in:
lassulus 2023-01-25 23:27:16 +01:00
parent 77638b8fe7
commit ad93b27981
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
lass/2configs/yubikey.nix
View File

@ -3,6 +3,7 @@
environment.systemPackages = with pkgs; [ environment.systemPackages = with pkgs; [
yubikey-personalization yubikey-personalization
yubikey-manager yubikey-manager
pinentry-curses pinentry-qt
]; ];
services.udev.packages = with pkgs; [ yubikey-personalization ]; services.udev.packages = with pkgs; [ yubikey-personalization ];
@ -11,6 +12,7 @@
services.pcscd.enable = true; services.pcscd.enable = true;
systemd.user.services.gpg-agent.serviceConfig.ExecStartPre = pkgs.writers.writeDash "init_gpg" '' systemd.user.services.gpg-agent.serviceConfig.ExecStartPre = pkgs.writers.writeDash "init_gpg" ''
set -x set -x
mkdir -p $HOME/.gnupg
${pkgs.coreutils}/bin/ln -sf ${pkgs.writeText "scdaemon.conf" '' ${pkgs.coreutils}/bin/ln -sf ${pkgs.writeText "scdaemon.conf" ''
disable-ccid disable-ccid
pcsc-driver ${pkgs.pcsclite.out}/lib/libpcsclite.so.1 pcsc-driver ${pkgs.pcsclite.out}/lib/libpcsclite.so.1
@ -25,6 +27,10 @@
reader-port Yubico YubiKey reader-port Yubico YubiKey
''} $HOME/.gnupg/scdaemon.conf ''} $HOME/.gnupg/scdaemon.conf
''; '';
systemd.user.services.gpg-agent.serviceConfig.ExecStartPost = pkgs.writers.writeDash "init_gpg" ''
${pkgs.gnupg}/bin/gpg --import ${../../kartei/lass/pgp/yubikey.pgp} >/dev/null
echo -e '5\ny\n' | gpg --command-fd 0 --expert --edit-key DBCD757846069B392EA9401D6657BE8A8D1EE807 trust >/dev/null || :
'';
security.polkit.extraConfig = '' security.polkit.extraConfig = ''
polkit.addRule(function(action, subject) { polkit.addRule(function(action, subject) {
@ -38,13 +44,14 @@
} }
}); });
polkit.addRule(function(action, subject) { polkit.addRule(function(action, subject) {
polkit.log("subject: " + subject + " action: " + action); polkit.log("subject: " + subject + " action: " + action);
}); });
''; '';
environment.shellInit = '' environment.shellInit = ''
if [ "$UID" -eq 1337 ] && [ -z "$SSH_CONNECTION" ]; then if [ "$UID" -eq 1337 ] && [ -z "$SSH_CONNECTION" ]; then
export GPG_TTY="$(tty)" export GPG_TTY="$(tty)"
mkdir -p $HOME/.gnupg
gpg-connect-agent --quiet updatestartuptty /bye > /dev/null gpg-connect-agent --quiet updatestartuptty /bye > /dev/null
export SSH_AUTH_SOCK="/run/user/$UID/gnupg/S.gpg-agent.ssh" export SSH_AUTH_SOCK="/run/user/$UID/gnupg/S.gpg-agent.ssh"
if [ -z "$SSH_AUTH_SOCK" ]; then if [ -z "$SSH_AUTH_SOCK" ]; then
@ -61,6 +68,7 @@
ssh.startAgent = false; ssh.startAgent = false;
gnupg.agent = { gnupg.agent = {
enable = true; enable = true;
pinentryFlavor = "qt";
# enableSSHSupport = true; # enableSSHSupport = true;
}; };
}; };