system/modules/nixos/configs/yubikey.nix

72 lines
1.7 KiB
Nix
Raw Normal View History

2024-05-18 15:42:44 +03:00
{ config, lib, pkgs, ... }:
let
cfg = config.local.yubikey;
control = if cfg.multi-factor.enable then "required" else "sufficient";
in
2024-05-18 15:42:44 +03:00
{
options.local.yubikey = with lib; {
enable = mkEnableOption "yubikey";
serial = mkOption {
type = types.nullOr types.str;
default = null;
};
multi-factor.enable = mkEnableOption "multi-factor" // { default = true; };
unplug = {
enable = mkEnableOption "Do action when a Yubikey is unplugged";
model = mkOption {
type = types.str;
default = "407";
};
command = mkOption {
type = types.str;
default = "${pkgs.systemd}/bin/loginctl lock-sessions";
};
};
2024-05-18 15:42:44 +03:00
};
config = lib.mkIf cfg.enable {
environment.systemPackages = [ pkgs.yubikey-manager pkgs.yubikey-personalization ];
security.pam =
if cfg.serial == null then
{
u2f = {
enable = true;
inherit control;
cue = lib.mkDefault true;
};
services = {
login.u2fAuth = lib.mkDefault true;
sudo.u2fAuth = lib.mkDefault true;
};
}
else
{
yubico = {
enable = true;
inherit control;
mode = "challenge-response";
id = [ cfg.serial ];
};
};
services.pcscd.enable = cfg.serial != null;
services.udev = {
packages = [ pkgs.yubikey-personalization ];
extraRules = lib.mkIf cfg.unplug.enable ''
ACTION=="remove",\
ENV{DEVTYPE}=="usb_device",\
ENV{PRODUCT}=="1050/${cfg.unplug.model}/543",\
RUN+="${cfg.unplug.command}"
'';
2024-05-18 15:42:44 +03:00
};
};
}