55 lines
1.2 KiB
Nix
55 lines
1.2 KiB
Nix
{
|
|
pkgs,
|
|
config,
|
|
lib,
|
|
...
|
|
}:
|
|
|
|
let
|
|
service = "yubikey";
|
|
cfg = config.system.${service};
|
|
sec = config.sops.secrets;
|
|
homelab = config.homelab;
|
|
in
|
|
{
|
|
options.system.${service} = {
|
|
enable = lib.mkEnableOption "enables ${service}";
|
|
mode = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "u2f";
|
|
description = "weather to run pam in u2f or challenge-response)";
|
|
};
|
|
lock_on_remove = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = false;
|
|
description = "enable automatic locking of device upon removal of yubikey";
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
|
|
security.pam.services = lib.mkIf (cfg.mode == "u2f") {
|
|
login.u2fAuth = true;
|
|
sudo.u2fAuth = true;
|
|
};
|
|
|
|
security.pam.yubico = lib.mkIf (cfg.mode == "challenge-response") {
|
|
enable = true;
|
|
debug = true;
|
|
mode = "challenge-response";
|
|
id = [ "<placeholder>" ];
|
|
};
|
|
|
|
services.udev.extraRules = lib.mkIf (cfg.lock_on_remove == true) ''
|
|
ACTION=="remove",\
|
|
ENV{ID_BUS}=="usb",\
|
|
ENV{ID_MODEL_ID}=="0407",\
|
|
ENV{ID_VENDOR_ID}=="1050",\
|
|
ENV{ID_VENDOR}=="Yubico",\
|
|
RUN+="${pkgs.systemd}/bin/loginctl lock-sessions"
|
|
'';
|
|
|
|
};
|
|
|
|
}
|