gnupg fix, add yubikey support

modules/sys/rc/openssh.nix

@@ -1,10 +1,10 @@
 {config, ...}:
 
 {
-  programs.ssh = {
-    startAgent = true;
-    agentPKCS11Whitelist = "${config.security.tpm2.pkcs11.package}/lib/*,/run/current-system/sw/lib/*";
-  };
+  #programs.ssh = {
+  #  startAgent = true;
+  #  agentPKCS11Whitelist = "${config.security.tpm2.pkcs11.package}/lib/*,/run/current-system/sw/lib/*";
+  #};
   services.openssh = {
     enable = true;
     settings.PasswordAuthentication = true;

modules/sys/security.nix

@@ -1,8 +1,20 @@
 {
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+  };
+  services.pcscd.enable = true;
+  services.udev.packages = [ pkgs.yubikey-personalization ];
   security = {
     sudo.execWheelOnly = true;
     polkit.enable = true;
     protectKernelImage = true;
+    pam.yubico = {
+       enable = true;
+       debug = true;
+       mode = "challenge-response";
+       id = [ "19694730" ];
+    };
     tpm2 = {
       enable = true;
       pkcs11.enable = true;