hosts/asus-gl553vd/configs/boot.nix

@@ -1,12 +1,9 @@
 {
-  boot.loader = {
-    timeout = 1;
-    grub = {
-      enable = true;
-      device = "nodev";
-      efiSupport = true;
-      efiInstallAsRemovable = true;
-      enableCryptodisk = true;
-    };
+  boot.loader.grub = {
+    enable = true;
+    device = "nodev";
+    efiSupport = true;
+    efiInstallAsRemovable = true;
+    enableCryptodisk = true;
   };
 }

hosts/asus-gl553vd/configuration.nix

@@ -7,11 +7,7 @@
     ./users
   ];
 
-  local.yubikey = {
-    enable = true;
-    serial = "28058247";
-    unplug.enable = true;
-  };
+  local.yubikey.enable = true;
 
   ################################################################################
   # Services

modules/nixos/configs/lockscreen/i3lock.nix

@@ -11,7 +11,7 @@ in
   config = lib.mkIf cfg.enable {
     programs.i3lock = {
       enable = true;
-      u2fSupport = lib.mkDefault config.security.pam.u2f.enable;
+      u2fSupport = lib.mkDefault config.local.yubikey.enable;
     };
 
     programs.xss-lock.enable = true;

modules/nixos/configs/yubikey.nix

@@ -1,71 +1,32 @@
 { config, lib, pkgs, ... }:
 
-let
-  cfg = config.local.yubikey;
-
-  control = if cfg.multi-factor.enable then "required" else "sufficient";
-in
+let cfg = config.local.yubikey; in
 {
   options.local.yubikey = with lib; {
     enable = mkEnableOption "yubikey";
-
-    serial = mkOption {
-      type = types.nullOr types.str;
-      default = null;
-    };
-
-    multi-factor.enable = mkEnableOption "multi-factor" // { default = true; };
-
-    unplug = {
-      enable = mkEnableOption "Do action when a Yubikey is unplugged";
-      model = mkOption {
-        type = types.str;
-        default = "407";
-      };
-      command = mkOption {
-        type = types.str;
-        default = "${pkgs.systemd}/bin/loginctl lock-sessions";
-      };
-    };
   };
 
   config = lib.mkIf cfg.enable {
     environment.systemPackages = [ pkgs.yubikey-manager pkgs.yubikey-personalization ];
 
-    security.pam =
-      if cfg.serial == null then
-        {
-          u2f = {
-            enable = true;
-            inherit control;
-            cue = lib.mkDefault true;
-          };
-
-          services = {
-            login.u2fAuth = lib.mkDefault true;
-            sudo.u2fAuth = lib.mkDefault true;
-          };
-        }
-      else
-        {
-          yubico = {
-            enable = true;
-            inherit control;
-            mode = "challenge-response";
-            id = [ cfg.serial ];
-          };
-        };
-
-    services.pcscd.enable = cfg.serial != null;
-
-    services.udev = {
-      packages = [ pkgs.yubikey-personalization ];
-      extraRules = lib.mkIf cfg.unplug.enable ''
-        ACTION=="remove",\
-         ENV{DEVTYPE}=="usb_device",\
-         ENV{PRODUCT}=="1050/${cfg.unplug.model}/543",\
-         RUN+="${cfg.unplug.command}"
-      '';
+    security.pam.u2f = {
+      enable = true;
+      control = "required";
+      cue = lib.mkDefault true;
     };
+
+    services.udev.packages = [ pkgs.yubikey-personalization ];
+    security.pam.services = {
+      login.u2fAuth = true;
+      sudo.u2fAuth = true;
+    };
+    services.pcscd.enable = true;
+
+    services.udev.extraRules = lib.mkIf config.programs.xss-lock.enable ''
+      ACTION=="remove",\
+       ENV{DEVTYPE}=="usb_device",\
+       ENV{PRODUCT}=="1050/402/543",\
+       RUN+="${pkgs.systemd}/bin/loginctl lock-sessions"
+    '';
   };
 }