nix/nixos/common/modules/yubikey-auth.nix

29 lines
611 B
Nix
Raw Normal View History

2024-05-05 08:08:06 +02:00
{ pkgs, ... }: {
2024-05-05 08:07:33 +02:00
security.pam.yubico = {
enable = true;
debug = true;
2024-05-05 09:26:04 +02:00
control = "required";
2024-05-05 08:07:33 +02:00
mode = "challenge-response";
2024-05-05 09:56:47 +02:00
challengeResponsePath = /run/secrets/yubikey/;
2024-05-05 08:07:33 +02:00
id = [ "18550256" ];
};
2024-05-05 09:56:47 +02:00
sops.secrets."yubikey/albert-18550256" = {
owner = "root";
sopsFile = ../../secrets/yubikey.yaml;
};
2024-05-05 09:09:49 +02:00
2024-05-05 09:13:52 +02:00
environment.systemPackages = with pkgs; [
yubico-pam
];
2024-05-05 08:07:33 +02:00
services.udev.extraRules = ''
ACTION=="remove",\
ENV{ID_BUS}=="usb",\
ENV{ID_MODEL_ID}=="0407",\
ENV{ID_VENDOR_ID}=="1050",\
ENV{ID_VENDOR}=="Yubico",\
2024-05-05 09:56:47 +02:00
RUN+="shutdown -h now"
2024-05-05 08:07:33 +02:00
'';
}