swarsel/.dotfiles
1
0
Fork 0
mirror of https://github.com/Swarsel/.dotfiles.git synced 2026-04-14 13:19:09 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix[client,work]: fix yubikey scdaemon/pcscd issue
Some checks failed
Build and Deploy / build (push) Has been cancelled
Details
Flake check / Check flake (push) Has been cancelled
Details
Build and Deploy / deploy (push) Has been cancelled
Details

Browse source
This commit is contained in:
Leon Schwarzäugl 2026-03-23 21:00:18 +01:00
parent adf28e4a14
commit 83e10e2d51
Signed by: swarsel
GPG key ID: 26A54C31F2A4FD84
3 changed files with 60 additions and 54 deletions
Download patch file Download diff file Expand all files Collapse all files

109
SwarselSystems.org
View file

@ -10738,7 +10738,7 @@ Also, since I use a GPG key in sops, it seems that scdaemon creates an instance
config = lib.mkIf config.swarselmodules.yubikey { config = lib.mkIf config.swarselmodules.yubikey {
programs.ssh.startAgent = false; programs.ssh.startAgent = false;
services.pcscd.enable = false; services.pcscd.enable = true;
hardware.gpgSmartcards.enable = true; hardware.gpgSmartcards.enable = true;
@ -25620,61 +25620,64 @@ When setting up a new machine:
#+end_src #+end_src
#+begin_src nix-ts :tangle modules/home/common/gpg-agent.nix #+begin_src nix-ts :tangle modules/home/common/gpg-agent.nix
{ self, lib, config, pkgs, ... }: { self, lib, config, pkgs, ... }:
let let
inherit (config.swarselsystems) mainUser homeDir; inherit (config.swarselsystems) mainUser homeDir;
in in
{ {
options.swarselmodules.gpgagent = lib.mkEnableOption "gpg agent settings"; options.swarselmodules.gpgagent = lib.mkEnableOption "gpg agent settings";
config = lib.mkIf config.swarselmodules.gpgagent { config = lib.mkIf config.swarselmodules.gpgagent {
services.gpg-agent = { services.gpg-agent = {
enable = true; enable = true;
verbose = true; verbose = true;
enableZshIntegration = true; enableZshIntegration = true;
enableScDaemon = true; enableScDaemon = true;
enableSshSupport = true; enableSshSupport = true;
enableExtraSocket = true; enableExtraSocket = true;
pinentry.package = pkgs.wayprompt; pinentry.package = pkgs.wayprompt;
pinentry.program = "pinentry-wayprompt"; pinentry.program = "pinentry-wayprompt";
# pinentry.package = pkgs.pinentry.gtk2; # pinentry.package = pkgs.pinentry.gtk2;
defaultCacheTtl = 600; defaultCacheTtl = 600;
maxCacheTtl = 7200; maxCacheTtl = 7200;
extraConfig = '' extraConfig = ''
allow-loopback-pinentry allow-loopback-pinentry
allow-emacs-pinentry allow-emacs-pinentry
''; '';
sshKeys = [ sshKeys = [
"4BE7925262289B476DBBC17B76FD3810215AE097" "4BE7925262289B476DBBC17B76FD3810215AE097"
]; ];
}; };
programs.gpg = { programs.gpg = {
enable = true; enable = true;
publicKeys = [ scdaemonSettings = {
{ disable-ccid = true; # prevent conflicts between pcscd and scdameon
source = "${self}/secrets/public/gpg/gpg-public-key-0x76FD3810215AE097.asc";
trust = 5;
}
];
};
systemd.user.tmpfiles.rules = [
"d ${homeDir}/.gnupg 0700 ${mainUser} users - -"
];
# assure correct permissions
# systemd.user.tmpfiles.settings."30-gpgagent".rules = {
# "${homeDir}/.gnupg" = {
# d = {
# group = "users";
# user = mainUser;
# mode = "0700";
# };
# };
# };
}; };
publicKeys = [
{
source = "${self}/secrets/public/gpg/gpg-public-key-0x76FD3810215AE097.asc";
trust = 5;
}
];
};
} systemd.user.tmpfiles.rules = [
"d ${homeDir}/.gnupg 0700 ${mainUser} users - -"
];
# assure correct permissions
# systemd.user.tmpfiles.settings."30-gpgagent".rules = {
# "${homeDir}/.gnupg" = {
# d = {
# group = "users";
# user = mainUser;
# mode = "0700";
# };
# };
# };
};
}
#+end_src #+end_src
**** gammastep **** gammastep

3
modules/home/common/gpg-agent.nix
View file

@ -28,6 +28,9 @@ in
programs.gpg = { programs.gpg = {
enable = true; enable = true;
scdaemonSettings = {
disable-ccid = true; # prevent conflicts between pcscd and scdameon
};
publicKeys = [ publicKeys = [
{ {
source = "${self}/secrets/public/gpg/gpg-public-key-0x76FD3810215AE097.asc"; source = "${self}/secrets/public/gpg/gpg-public-key-0x76FD3810215AE097.asc";

2
modules/nixos/client/hardwarecompatibility-yubikey.nix
View file

@ -8,7 +8,7 @@ in
config = lib.mkIf config.swarselmodules.yubikey { config = lib.mkIf config.swarselmodules.yubikey {
programs.ssh.startAgent = false; programs.ssh.startAgent = false;
services.pcscd.enable = false; services.pcscd.enable = true;
hardware.gpgSmartcards.enable = true; hardware.gpgSmartcards.enable = true;