diff options
| author | makefu <github@syntax-fehler.de> | 2023-01-30 23:43:04 +0100 |
|---|---|---|
| committer | makefu <github@syntax-fehler.de> | 2023-01-30 23:43:04 +0100 |
| commit | 369fa6b7eb3f0fa3e1034bcad438eeda017949f8 (patch) | |
| tree | 22f7891595fba32a7e66b755617e0d49b91993f3 /lass/2configs/yubikey.nix | |
| parent | dbc3870841223051e4f617b4c06065c168c69c10 (diff) | |
| parent | c7417c8bc1b50d466dae493ac3619d9f324f34f8 (diff) | |
Merge remote-tracking branch 'lass/master'
Diffstat (limited to 'lass/2configs/yubikey.nix')
| -rw-r--r-- | lass/2configs/yubikey.nix | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/lass/2configs/yubikey.nix b/lass/2configs/yubikey.nix index a37752d5..bf6a587a 100644 --- a/lass/2configs/yubikey.nix +++ b/lass/2configs/yubikey.nix @@ -3,6 +3,7 @@ environment.systemPackages = with pkgs; [ yubikey-personalization yubikey-manager + pinentry-curses pinentry-qt ]; services.udev.packages = with pkgs; [ yubikey-personalization ]; @@ -11,6 +12,7 @@ services.pcscd.enable = true; systemd.user.services.gpg-agent.serviceConfig.ExecStartPre = pkgs.writers.writeDash "init_gpg" '' set -x + mkdir -p $HOME/.gnupg ${pkgs.coreutils}/bin/ln -sf ${pkgs.writeText "scdaemon.conf" '' disable-ccid pcsc-driver ${pkgs.pcsclite.out}/lib/libpcsclite.so.1 @@ -25,6 +27,10 @@ reader-port Yubico YubiKey ''} $HOME/.gnupg/scdaemon.conf ''; + systemd.user.services.gpg-agent.serviceConfig.ExecStartPost = pkgs.writers.writeDash "init_gpg" '' + ${pkgs.gnupg}/bin/gpg --import ${../../kartei/lass/pgp/yubikey.pgp} >/dev/null + echo -e '5\ny\n' | gpg --command-fd 0 --expert --edit-key DBCD757846069B392EA9401D6657BE8A8D1EE807 trust >/dev/null || : + ''; security.polkit.extraConfig = '' polkit.addRule(function(action, subject) { @@ -38,13 +44,14 @@ } }); polkit.addRule(function(action, subject) { - polkit.log("subject: " + subject + " action: " + action); + polkit.log("subject: " + subject + " action: " + action); }); ''; environment.shellInit = '' if [ "$UID" -eq 1337 ] && [ -z "$SSH_CONNECTION" ]; then export GPG_TTY="$(tty)" + mkdir -p $HOME/.gnupg gpg-connect-agent --quiet updatestartuptty /bye > /dev/null export SSH_AUTH_SOCK="/run/user/$UID/gnupg/S.gpg-agent.ssh" if [ -z "$SSH_AUTH_SOCK" ]; then @@ -61,6 +68,7 @@ ssh.startAgent = false; gnupg.agent = { enable = true; + pinentryFlavor = "qt"; # enableSSHSupport = true; }; }; |