add u2f support

Flake lock file updates:

• Updated input 'nixpkgs':
    'github:nixos/nixpkgs/f4c846aee8e1e29062aa8514d5e0ab270f4ec2f9' (2024-09-08)
  → 'github:nixos/nixpkgs/44a71ff39c182edaf25a7ace5c9454e7cba2c658' (2024-09-10)
• Updated input 'nur':
    'github:nix-community/NUR/d1d1e8640bbcff47c11c5d8f575d6c47be956089' (2024-09-11)
  → 'github:nix-community/NUR/0c3404cce1f91b1582168544584c13c60fb23eb2' (2024-09-13)
• Updated input 'unstable':
    'github:nixos/nixpkgs/574d1eac1c200690e27b8eb4e24887f8df7ac27c' (2024-09-06)
  → 'github:nixos/nixpkgs/4f807e8940284ad7925ebd0a0993d2a1791acb2f' (2024-09-11)
• Updated input 'vpsadminos':
    'github:vpsfreecz/vpsadminos/37c5eb47ca3f11deac83e4ada20a6c21d5487f29' (2024-09-08)
  → 'github:vpsfreecz/vpsadminos/e6e4245dc1e6365a601ddf5022976b14de789e0e' (2024-09-13)

flake.lock

@@ -998,11 +998,11 @@
     },
     "nixpkgs_6": {
       "locked": {
-        "lastModified": 1725826545,
-        "narHash": "sha256-L64N1rpLlXdc94H+F6scnrbuEu+utC03cDDVvvJGOME=",
+        "lastModified": 1725930920,
+        "narHash": "sha256-RVhD9hnlTT2nJzPHlAqrWqCkA7T6CYrP41IoVRkciZM=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "f4c846aee8e1e29062aa8514d5e0ab270f4ec2f9",
+        "rev": "44a71ff39c182edaf25a7ace5c9454e7cba2c658",
         "type": "github"
       },
       "original": {
@@ -1014,11 +1014,11 @@
     },
     "nur": {
       "locked": {
-        "lastModified": 1726022314,
-        "narHash": "sha256-VR7O2VQh5aQ0tEHTWPJNvjGjmdHmfqexu3VoAA/sMLM=",
+        "lastModified": 1726249500,
+        "narHash": "sha256-ykW2dN3jL/UXZMlwBd6OZzY13CkYPkCjS1knkNH7E5M=",
         "owner": "nix-community",
         "repo": "NUR",
-        "rev": "d1d1e8640bbcff47c11c5d8f575d6c47be956089",
+        "rev": "0c3404cce1f91b1582168544584c13c60fb23eb2",
         "type": "github"
       },
       "original": {
@@ -1260,11 +1260,11 @@
     },
     "unstable": {
       "locked": {
-        "lastModified": 1725634671,
-        "narHash": "sha256-v3rIhsJBOMLR8e/RNWxr828tB+WywYIoajrZKFM+0Gg=",
+        "lastModified": 1726062873,
+        "narHash": "sha256-IiA3jfbR7K/B5+9byVi9BZGWTD4VSbWe8VLpp9B/iYk=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "574d1eac1c200690e27b8eb4e24887f8df7ac27c",
+        "rev": "4f807e8940284ad7925ebd0a0993d2a1791acb2f",
         "type": "github"
       },
       "original": {
@@ -1276,11 +1276,11 @@
     },
     "vpsadminos": {
       "locked": {
-        "lastModified": 1725810385,
-        "narHash": "sha256-+6UULi05KMHmLfhlrNGhMdLZUoQeC5Dc1nLFdINyeyI=",
+        "lastModified": 1726208697,
+        "narHash": "sha256-GRcHU1zuJQozu+F3ejHeT+83/nCGIu/evtAPjAGVYfI=",
         "owner": "vpsfreecz",
         "repo": "vpsadminos",
-        "rev": "37c5eb47ca3f11deac83e4ada20a6c21d5487f29",
+        "rev": "e6e4245dc1e6365a601ddf5022976b14de789e0e",
         "type": "github"
       },
       "original": {

home/platforms/fabian@posixlycorrect/gui/default.nix

@@ -10,10 +10,10 @@
     ./i3.nix
     ./polybar.nix
     ./startx.nix
+    ./picom.nix
   ];
 
   services = {
-    picom.enable = true;
     dunst.enable = true;
     betterlockscreen.enable = true;
   };

home/platforms/fabian@posixlycorrect/gui/picom.nix

@@ -0,0 +1,42 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
+  services.picom = {
+    enable = true;
+    fade = true;
+    fadeSteps = [0.1 0.1];
+    fadeDelta = 10;
+    settings = {
+      animations = [
+        {
+          triggers = [
+            "open"
+            "show"
+          ];
+
+          preset = "appear";
+          duration = "1";
+        }
+        {
+          triggers = [
+            "close"
+            "hide"
+          ];
+
+          preset = "disappear";
+          duration = "1";
+        }
+        {
+          triggers = [
+            "geometry"
+          ];
+          preset = "geometry-change";
+          duration = "1";
+        }
+      ];
+    };
+  };
+}

home/platforms/fabian@posixlycorrect/gui/startx.nix

@@ -7,16 +7,10 @@
 with lib; {
   xsession.enable = true;
 
-  #TODO: why is intel mentioned here? i dont use intel
   home.file.".xinitrc".source = let
-    content =
-      if config.local.nixos
-      then ''
-        exec ~/.xsession
-      ''
-      else ''
-        exec ${pkgs.nixgl.nixGLIntel}/bin/nixGLIntel ~/.xsession
-      '';
+    content = ''
+      exec ~/.xsession
+    '';
   in
     pkgs.writeShellScript "xinitrc" content;
 }

home/platforms/fabian@posixlycorrect/lib/default.nix

@@ -45,6 +45,9 @@
     vlc
     vpsfree-client
     vscodium-fhs
+    yubikey-manager
+    yubico-pam
+    yubikey-personalization
     zip
     zola
     zoom-us

home/platforms/fabian@posixlycorrect/lib/steam/default.nix

@@ -3,7 +3,8 @@
   lib,
   config,
   ...
-}: with lib; {
+}:
+with lib; {
   home.packages = [
     (pkgs.callPackage ./package.nix {})
     pkgs.protonup

pkgs/config/default.nix

@@ -1,5 +1,5 @@
 lib:
 with lib; {
-  android_sdk.accept_license = true;  #TODO: what the fuck is this
+  android_sdk.accept_license = true; #TODO: what the fuck is this
   allowUnfreePredicate = pkg: import ./unfree.nix lib (getName pkg);
 }

sys/platforms/posixlycorrect/default.nix

@@ -10,6 +10,7 @@
   imports = [
     # Include the results of the hardware scan.
     ./hardware-configuration.nix
+    ./yubikey.nix
   ];
 
   # Use the systemd-boot EFI boot loader.
@@ -75,8 +76,6 @@
     extraGroups = ["wheel"];
   };
 
-  nixpkgs.config.allowUnfree = true;
-
   virtualisation.libvirtd.qemu.package = pkgs.qemu_kvm;
   virtualisation.libvirtd.qemu.ovmf.enable = true;
   virtualisation.libvirtd.qemu.ovmf.packages = [pkgs.OVMFFull.fd];

sys/platforms/posixlycorrect/yubikey.nix

@@ -0,0 +1,34 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}: {
+  services = {
+    pcscd.enable = true;
+    udev.packages = [pkgs.yubikey-personalization];
+  };
+
+  environment.etc."pkcs11/modules/ykcs11".text = ''
+    module: ${pkgs.yubico-piv-tool}/lib/libykcs11.so
+  '';
+
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+  };
+
+  security.pam = {
+    services = {
+      login.u2fAuth = true;
+      sudo.u2fAuth = true;
+    };
+
+    u2f = {
+      enable = true;
+      debug = true;
+      cue = true;
+      control = "sufficient";
+    };
+  };
+}