motiejus
/
config
1
Fork 0
Code Releases Activity

fmt

compress-drv-tests
Motiejus Jakštys 2023-04-08 18:06:03 +03:00
parent a828ba26b6
commit 8fc44ea817
1 changed files with 28 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

54
yubikey-installer.nix
View File

@ -1,7 +1,11 @@
let
configuration = { config, lib, pkgs, ... }:
with pkgs;
let
configuration = {
config,
lib,
pkgs,
...
}:
with pkgs; let
src = fetchGit "https://github.com/drduh/YubiKey-Guide";
guide = "${src}/README.md";
@ -14,14 +18,14 @@ let
xserverCfg = config.services.xserver;
pinentryFlavour = if xserverCfg.desktopManager.lxqt.enable || xserverCfg.desktopManager.plasma5.enable then
"qt"
else if xserverCfg.desktopManager.xfce.enable then
"gtk2"
else if xserverCfg.enable || config.programs.sway.enable then
"gnome3"
else
"curses";
pinentryFlavour =
if xserverCfg.desktopManager.lxqt.enable || xserverCfg.desktopManager.plasma5.enable
then "qt"
else if xserverCfg.desktopManager.xfce.enable
then "gtk2"
else if xserverCfg.enable || config.programs.sway.enable
then "gnome3"
else "curses";
# Instead of hard-coding the pinentry program, chose the appropriate one
# based on the environment of the image the user has chosen to build.
@ -44,30 +48,29 @@ let
desktopName = "drduh's YubiKey Guide";
genericName = "Guide to using YubiKey for GPG and SSH";
comment = "Open the guide in a reader program";
categories = [ "Documentation" ];
categories = ["Documentation"];
exec = "${view-yubikey-guide}/bin/view-yubikey-guide";
};
yubikey-guide = symlinkJoin {
name = "yubikey-guide";
paths = [ view-yubikey-guide shortcut ];
paths = [view-yubikey-guide shortcut];
};
in {
nixpkgs.config = { allowBroken = true; };
nixpkgs.config = {allowBroken = true;};
isoImage.isoBaseName = lib.mkForce "nixos-yubikey";
boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
# Always copytoram so that, if the image is booted from, e.g., a
# USB stick, nothing is mistakenly written to persistent storage.
boot.kernelParams = [ "copytoram" ];
boot.kernelParams = ["copytoram"];
# Secure defaults
boot.cleanTmpDir = true;
boot.kernel.sysctl = { "kernel.unprivileged_bpf_disabled" = 1; };
boot.kernel.sysctl = {"kernel.unprivileged_bpf_disabled" = 1;};
services.pcscd.enable = true;
services.udev.packages = [ yubikey-personalization ];
services.udev.packages = [yubikey-personalization];
programs = {
ssh.startAgent = false;
@ -108,12 +111,12 @@ let
# in a non-graphical environment).
yubikey-guide
# motiejus addons
rage
sops
tmux
ssh-to-age
age-plugin-yubikey
# motiejus addons
rage
sops
tmux
ssh-to-age
age-plugin-yubikey
];
# Disable networking so the system is air-gapped
@ -162,14 +165,13 @@ let
nixos = import <nixpkgs/nixos/release.nix> {
inherit configuration;
supportedSystems = [ "x86_64-linux" ];
supportedSystems = ["x86_64-linux"];
};
# Choose the one you like:
#nixos-yubikey = nixos.iso_minimal; # No graphical environment
#nixos-yubikey = nixos.iso_gnome;
nixos-yubikey = nixos.iso_plasma5;
in {
inherit nixos-yubikey;
}