40 lines
1.4 KiB
Nix
40 lines
1.4 KiB
Nix
{ pkgs, ... }:
|
|
|
|
{
|
|
# Create the plugdev group (required for user-space USB access to YubiKey)
|
|
users.groups.plugdev = {};
|
|
|
|
# Enable PC/SC daemon — required for GPG smartcard (gpg --card-status) and YubiKey
|
|
services.pcscd.enable = true;
|
|
|
|
# udev rules so the YubiKey gets plugdev group ownership and correct permissions
|
|
services.udev.packages = with pkgs; [
|
|
yubikey-personalization
|
|
libu2f-host
|
|
];
|
|
|
|
# Add udev rule for YubiKey CCID interface to be readable by pcscd
|
|
services.udev.extraRules = ''
|
|
# YubiKey FIDO+CCID (0x0406) - ensure CCID interface is accessible
|
|
SUBSYSTEM=="usb", ATTRS{idVendor}=="1050", ATTRS{idProduct}=="0406", MODE="0666"
|
|
SUBSYSTEM=="usb_device", ATTRS{idVendor}=="1050", ATTRS{idProduct}=="0406", MODE="0666"
|
|
'';
|
|
|
|
# CCID driver for smartcard access (required for YubiKey CCID functionality)
|
|
# Set up the PC/SC drivers directory with CCID driver bundle
|
|
system.activationScripts.pcscdSetup = ''
|
|
mkdir -p /var/lib/pcsc/drivers
|
|
# Symlink the entire CCID bundle (or create it if it doesn't exist)
|
|
rm -rf /var/lib/pcsc/drivers/ifd-ccid.bundle 2>/dev/null || true
|
|
ln -sf "${pkgs.ccid}/pcsc/drivers/ifd-ccid.bundle" /var/lib/pcsc/drivers/ifd-ccid.bundle
|
|
'';
|
|
|
|
|
|
# YubiKey management tools
|
|
environment.systemPackages = with pkgs; [
|
|
yubikey-manager # ykman CLI
|
|
yubikey-personalization # ykpers / ykchalresp
|
|
yubico-piv-tool # PIV applet management
|
|
];
|
|
}
|