sorry but this ones just lots of shit

modules/system/yubikey/default.nix

@@ -4,40 +4,49 @@
   lib,
   ...
 }:
+/*
+# to enroll a yubikey (works like .ssh/known_hosts)
+nix-shell -p pam_u2f
+mkdir -p ~/.config/Yubico
+pamu2fcfg > ~/.config/Yubico/u2f_keys
+pamu2fcfg -n >> ~/.config/Yubico/u2f_keys (to add additional yubikeys)
 
+# to test auth with pam
+nix-shell -p pamtester
+pamtester login <username> authenticate
+pamtester sudo <username> authenticate
+*/
 let
   service = "yubikey";
   cfg = config.system.${service};
   sec = config.sops.secrets;
   homelab = config.homelab;
-in
-{
+in {
   options.system.${service} = {
     enable = lib.mkEnableOption "enables ${service}";
     mode = lib.mkOption {
-        type = lib.types.str;
-        default = "u2f";
-        description = "weather to run pam in u2f or challenge-response)";
+      type = lib.types.str;
+      default = "u2f";
+      description = "weather to run pam in u2f or challenge-response)";
     };
     lock_on_remove = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = "enable automatic locking of device upon removal of yubikey";
+      type = lib.types.bool;
+      default = false;
+      description = "enable automatic locking of device upon removal of yubikey";
     };
   };
 
   config = lib.mkIf cfg.enable {
-
     security.pam.services = lib.mkIf (cfg.mode == "u2f") {
       login.u2fAuth = true;
       sudo.u2fAuth = true;
     };
 
     security.pam.yubico = lib.mkIf (cfg.mode == "challenge-response") {
-       enable = true;
-       debug = true;
-       mode = "challenge-response";
-       id = [ "<placeholder>" ];
+      enable = true;
+      debug = true;
+      mode = "challenge-response";
+      id = ["<placeholder>"];
     };
 
     services.udev.extraRules = lib.mkIf (cfg.lock_on_remove == true) ''
@@ -47,8 +56,6 @@ in
        ENV{ID_VENDOR_ID}=="1050",\
        ENV{ID_VENDOR}=="Yubico",\
        RUN+="${pkgs.systemd}/bin/loginctl lock-sessions"
-  '';
-
+    '';
   };
-
 }