diff --git a/yubikey-installer.nix b/yubikey-installer.nix index 2127c90..e301fb1 100644 --- a/yubikey-installer.nix +++ b/yubikey-installer.nix @@ -1,7 +1,11 @@ let - configuration = { config, lib, pkgs, ... }: - with pkgs; - let + configuration = { + config, + lib, + pkgs, + ... + }: + with pkgs; let src = fetchGit "https://github.com/drduh/YubiKey-Guide"; guide = "${src}/README.md"; @@ -14,14 +18,14 @@ let xserverCfg = config.services.xserver; - pinentryFlavour = if xserverCfg.desktopManager.lxqt.enable || xserverCfg.desktopManager.plasma5.enable then - "qt" - else if xserverCfg.desktopManager.xfce.enable then - "gtk2" - else if xserverCfg.enable || config.programs.sway.enable then - "gnome3" - else - "curses"; + pinentryFlavour = + if xserverCfg.desktopManager.lxqt.enable || xserverCfg.desktopManager.plasma5.enable + then "qt" + else if xserverCfg.desktopManager.xfce.enable + then "gtk2" + else if xserverCfg.enable || config.programs.sway.enable + then "gnome3" + else "curses"; # Instead of hard-coding the pinentry program, chose the appropriate one # based on the environment of the image the user has chosen to build. @@ -44,30 +48,29 @@ let desktopName = "drduh's YubiKey Guide"; genericName = "Guide to using YubiKey for GPG and SSH"; comment = "Open the guide in a reader program"; - categories = [ "Documentation" ]; + categories = ["Documentation"]; exec = "${view-yubikey-guide}/bin/view-yubikey-guide"; }; yubikey-guide = symlinkJoin { name = "yubikey-guide"; - paths = [ view-yubikey-guide shortcut ]; + paths = [view-yubikey-guide shortcut]; }; - in { - nixpkgs.config = { allowBroken = true; }; + nixpkgs.config = {allowBroken = true;}; isoImage.isoBaseName = lib.mkForce "nixos-yubikey"; boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages; # Always copytoram so that, if the image is booted from, e.g., a # USB stick, nothing is mistakenly written to persistent storage. - boot.kernelParams = [ "copytoram" ]; + boot.kernelParams = ["copytoram"]; # Secure defaults boot.cleanTmpDir = true; - boot.kernel.sysctl = { "kernel.unprivileged_bpf_disabled" = 1; }; + boot.kernel.sysctl = {"kernel.unprivileged_bpf_disabled" = 1;}; services.pcscd.enable = true; - services.udev.packages = [ yubikey-personalization ]; + services.udev.packages = [yubikey-personalization]; programs = { ssh.startAgent = false; @@ -108,12 +111,12 @@ let # in a non-graphical environment). yubikey-guide - # motiejus addons - rage - sops - tmux - ssh-to-age - age-plugin-yubikey + # motiejus addons + rage + sops + tmux + ssh-to-age + age-plugin-yubikey ]; # Disable networking so the system is air-gapped @@ -162,14 +165,13 @@ let nixos = import { inherit configuration; - supportedSystems = [ "x86_64-linux" ]; + supportedSystems = ["x86_64-linux"]; }; # Choose the one you like: #nixos-yubikey = nixos.iso_minimal; # No graphical environment #nixos-yubikey = nixos.iso_gnome; nixos-yubikey = nixos.iso_plasma5; - in { inherit nixos-yubikey; }