Personal Nix flake
nixos
home-manager
nix
fix: u2f auth file actually works again, now only requires pin for sudo
+36
-11
+4
-2
just/u2f.just
+4
-2
just/u2f.just
···
4
4
mkdir -p ~/.config/Yubico
5
5
[ -e ~/.config/Yubico/u2f_keys ] \
6
6
&& pamu2fcfg \
7
+
--appid="pam://auth" \
7
8
--origin="pam://localhost" \
8
-
--appid="pam://auth" \
9
+
--no-user-presence \
9
10
--nouser \
10
11
>> ~/.config/Yubico/u2f_keys \
11
12
|| pamu2fcfg \
13
+
--appid="pam://auth" \
12
14
--origin="pam://localhost" \
13
-
--appid="pam://auth" \
15
+
--no-user-presence \
14
16
> ~/.config/Yubico/u2f_keys
15
17
16
18
# Clear enrolled security keys, if any
+5
-3
nix/lib/config.nix
+5
-3
nix/lib/config.nix
···
55
55
auto-optimise-store = true;
56
56
extra-experimental-features = "flakes nix-command pipe-operator";
57
57
extra-substituters = [
58
-
# The NixOS and nix-community ones are set by default
58
+
# cache.nixos.org is set by default
59
59
"https://lpchaim.cachix.org"
60
-
"https://hyprland.cachix.org"
60
+
"https://nix-comunity.cachix.org"
61
61
"https://nix-gaming.cachix.org"
62
62
];
63
63
extra-trusted-public-keys = [
64
-
"hyprland.cachix.org-1:a7pgxzMz7+chwVL3/pzj6jIBMioiJM7ypFP8PwtkuGc="
65
64
"lpchaim.cachix.org-1:2xOuvojcUDNhJRzCpvgewQ2DdNZz3QzGVV4Z/7C+Lio="
65
+
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
66
66
"nix-gaming.cachix.org-1:nbjlureqMbRAxR1gJ/f3hxemL9svXaZF/Ees8vCUUs4="
67
67
];
68
+
http-connections = 100;
68
69
keep-derivations = true;
69
70
keep-outputs = true;
70
71
max-jobs = "auto";
72
+
max-substitution-jobs = 100;
71
73
trusted-users = ["root" "@wheel"];
72
74
};
73
75
};
+6
-5
nix/nixos/modules/security/default.nix
+6
-5
nix/nixos/modules/security/default.nix
···
1
1
{
2
2
config,
3
-
inputs,
4
3
lib,
5
4
options,
6
5
pkgs,
7
6
...
8
7
}: let
9
-
inherit (inputs.self.lib.secrets.helpers) mkSecret;
8
+
inherit (config.my.secret.helpers) mkSecret;
10
9
cfg = config.my.security;
11
10
in {
12
11
options.my.security = {
···
35
34
mode = "0440";
36
35
};
37
36
};
37
+
38
38
environment.etc = let
39
39
patch = svc:
40
40
lib.replaceStrings
···
50
50
};
51
51
security.pam = {
52
52
services = {
53
-
login.u2fAuth = false;
54
-
sshd.u2fAuth = true;
53
+
login.u2fAuth = true;
55
54
sudo.u2fAuth = true;
56
55
};
57
56
sshAgentAuth.enable = true;
58
57
u2f = {
59
58
inherit (cfg.u2f) control;
60
59
enable = true;
61
-
settings.authfile = "${config.my.secrets."u2f-mappings".path}";
62
60
settings = {
63
61
cue = true;
64
62
appid = "pam://auth";
65
63
origin = "pam://localhost";
64
+
authfile = "${config.my.secrets."u2f-mappings".path}";
65
+
pinverification = 1;
66
+
userpresence = 0;
66
67
};
67
68
};
68
69
};
+8
secrets/rekeyed/desktop/256d036f484aaadd21df5bfcff24ca06-u2f-mappings.age
+8
secrets/rekeyed/desktop/256d036f484aaadd21df5bfcff24ca06-u2f-mappings.age
···
1
+
age-encryption.org/v1
2
+
-> ssh-ed25519 RuV4dQ Laqg712sKWtPk33iWboJDGnf6I0YwFte7nKJEV1ZU0Q
3
+
XmKsR6i672JTgrQjHOeqLoTC9Zr6g7e599AB/i+Ougc
4
+
-> T.RK-grease {m42ymI; sw36/
5
+
bOio/L+9SGEPGRI
6
+
--- udYHX08CyTSP1tRtZ4eNCIYlL9+lr4zd8dVxzCL5oek
7
+
�}�
�m�N��(.��e�DW�w����j����L�������f,����
8
+
m�/��
�m�j�i�a���i η�Y�U(^�l��N����fkAO>��FQ$W�/�a�ӮH�)K���Z[5`&8�u*y���.���:���9\��V;Ʈy�>����8���? ���%�^0�I���Y�/���h�s^��+q�Y�]��*3)P���~y�S�Fy���h5�rH�J��c���ɌQ�3�=�Ǯ�D�=.�1rJ�J ������O1�t���V[��O���]����cQbD l�ȓcr�~WH6��BN�NgcH b�~1�M����<%��[i<��7GKx���T��W�+4�#�:�'@����W�Gg�b�RahT�� /j�ra? 6�T����k=�-����@�/�7�=�y�
secrets/rekeyed/desktop/3de6f93d67eced91f4cfe2c09faf04d6-u2f-mappings.age
secrets/rekeyed/desktop/3de6f93d67eced91f4cfe2c09faf04d6-u2f-mappings.age
This is a binary file and will not be displayed.
secrets/rekeyed/laptop/0a2654ce82949ab68784f9891f20c5a1-u2f-mappings.age
secrets/rekeyed/laptop/0a2654ce82949ab68784f9891f20c5a1-u2f-mappings.age
This is a binary file and will not be displayed.
+11
secrets/rekeyed/laptop/7e399c867c57dcabcfa0c8e4194a8a4a-u2f-mappings.age
+11
secrets/rekeyed/laptop/7e399c867c57dcabcfa0c8e4194a8a4a-u2f-mappings.age
···
1
+
age-encryption.org/v1
2
+
-> ssh-ed25519 9M20hg MW6mBCPqJiijZ97nv9Qoo0xZNTJBaxXn54YQsmXhBF4
3
+
j+4TFR7mtuyB6NvfLiPkpQ8hgYqcf56WaR3fKHkM1WY
4
+
-> GP>)l4/j-grease CVrJq6j( F P3Y:bu= 0LJ
5
+
hPKia89d0nhA3v8/kht1lfQh2tJ85KDdYCkpzkSeSsSiR0NfkC0xoBY
6
+
--- EcyGiAjfXjomCvPKM7Sgk4H232GqKX2bQ6clr/bh8c0
7
+
��7foC!bB)�ӓ�U� �Xi�fsπ���¯�4�����f^�u���;�9W5AH�S��#'�`�!�,��3z�Iن:IQ�<�K
8
+
��'C�v�b=z��腕B(���� � � ���+k���L�#�X ��n%�WP�=���5���mlv��
9
+
������LV<��!N��� /x9�t\��<�ߧ��J�k`_�Z����,�_�wA�� � Oc���TPUxq�@������e"���)`�f�w(�
10
+
��w�٫(r |���8�
11
+
���]3P� ��p�pC���#�e�O�F� -�;V�N�2ǜA�¶$������E� k�m��-C���v`� �E?����e@ qF:D�9�� �`����L;��&(gH*����U l
v'��g&�S9 M)I���J��`�
secrets/rekeyed/raspberrypi/2a9039df6bc40c2c1443020e50b868ca-u2f-mappings.age
secrets/rekeyed/raspberrypi/2a9039df6bc40c2c1443020e50b868ca-u2f-mappings.age
This is a binary file and will not be displayed.
secrets/rekeyed/raspberrypi/f042f14639e0c43ecfe76cf43e72f600-u2f-mappings.age
secrets/rekeyed/raspberrypi/f042f14639e0c43ecfe76cf43e72f600-u2f-mappings.age
This is a binary file and will not be displayed.
secrets/u2f-mappings.age
secrets/u2f-mappings.age
This is a binary file and will not be displayed.