summaryrefslogtreecommitdiffstats
path: root/lass/2configs/yubikey.nix
diff options
context:
space:
mode:
authortv <tv@krebsco.de>2023-02-02 17:03:15 +0100
committertv <tv@krebsco.de>2023-02-02 17:03:15 +0100
commit3c1a1f0f09e1789ebda529e597c1bb8b7bc7d0c4 (patch)
treee041536cd96726fb87adc15fbe95f1eabd280ba9 /lass/2configs/yubikey.nix
parentfc00990f712663688e5aea85624cb9317e9f4128 (diff)
parent46ae6fc00c3e1aee5bc5db846ec91e30c430f0f1 (diff)
Merge remote-tracking branch 'prism/master' into head
Diffstat (limited to 'lass/2configs/yubikey.nix')
-rw-r--r--lass/2configs/yubikey.nix10
1 files changed, 9 insertions, 1 deletions
diff --git a/lass/2configs/yubikey.nix b/lass/2configs/yubikey.nix
index a37752d5e..bf6a587af 100644
--- a/lass/2configs/yubikey.nix
+++ b/lass/2configs/yubikey.nix
@@ -3,6 +3,7 @@
environment.systemPackages = with pkgs; [
yubikey-personalization
yubikey-manager
+ pinentry-curses pinentry-qt
];
services.udev.packages = with pkgs; [ yubikey-personalization ];
@@ -11,6 +12,7 @@
services.pcscd.enable = true;
systemd.user.services.gpg-agent.serviceConfig.ExecStartPre = pkgs.writers.writeDash "init_gpg" ''
set -x
+ mkdir -p $HOME/.gnupg
${pkgs.coreutils}/bin/ln -sf ${pkgs.writeText "scdaemon.conf" ''
disable-ccid
pcsc-driver ${pkgs.pcsclite.out}/lib/libpcsclite.so.1
@@ -25,6 +27,10 @@
reader-port Yubico YubiKey
''} $HOME/.gnupg/scdaemon.conf
'';
+ systemd.user.services.gpg-agent.serviceConfig.ExecStartPost = pkgs.writers.writeDash "init_gpg" ''
+ ${pkgs.gnupg}/bin/gpg --import ${../../kartei/lass/pgp/yubikey.pgp} >/dev/null
+ echo -e '5\ny\n' | gpg --command-fd 0 --expert --edit-key DBCD757846069B392EA9401D6657BE8A8D1EE807 trust >/dev/null || :
+ '';
security.polkit.extraConfig = ''
polkit.addRule(function(action, subject) {
@@ -38,13 +44,14 @@
}
});
polkit.addRule(function(action, subject) {
- polkit.log("subject: " + subject + " action: " + action);
+ polkit.log("subject: " + subject + " action: " + action);
});
'';
environment.shellInit = ''
if [ "$UID" -eq 1337 ] && [ -z "$SSH_CONNECTION" ]; then
export GPG_TTY="$(tty)"
+ mkdir -p $HOME/.gnupg
gpg-connect-agent --quiet updatestartuptty /bye > /dev/null
export SSH_AUTH_SOCK="/run/user/$UID/gnupg/S.gpg-agent.ssh"
if [ -z "$SSH_AUTH_SOCK" ]; then
@@ -61,6 +68,7 @@
ssh.startAgent = false;
gnupg.agent = {
enable = true;
+ pinentryFlavor = "qt";
# enableSSHSupport = true;
};
};