add yubikey support

home/platforms/fabian@posixlycorrect/lib/default.nix

@@ -45,6 +45,9 @@
     vlc
     vpsfree-client
     vscodium-fhs
+    yubikey-manager
+    yubico-pam
+    yubikey-personalization
     zip
     zola
     zoom-us

sys/platforms/posixlycorrect/default.nix

@@ -10,6 +10,7 @@
   imports = [
     # Include the results of the hardware scan.
     ./hardware-configuration.nix
+    ./yubikey.nix
   ];
 
   # Use the systemd-boot EFI boot loader.

sys/platforms/posixlycorrect/yubikey.nix

@@ -0,0 +1,32 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
+  services = {
+    pcscd.enable = true;
+    udev.packages = [pkgs.yubikey-personalization];
+  };
+
+  environment.etc."pkcs11/modules/ykcs11".text = ''
+    module: ${pkgs.yubico-piv-tool}/lib/libykcs11.so
+  '';
+
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+  };
+
+  security.pam.services = {
+    login.u2fAuth = true;
+    sudo.u2fAuth = true;
+  };
+
+  security.pam.yubico = {
+    enable = true;
+    debug = false;
+    mode = "challenge-response";
+    id = ["27677315"];
+  };
+}