{pkgs, ...}:

{
  programs.gnupg.agent = {
    enable = true;
    enableSSHSupport = true;
  };
  services.pcscd.enable = true;
  services.udev.packages = [ pkgs.yubikey-personalization ];
  security = {
    sudo.execWheelOnly = true;
    polkit.enable = true;
    protectKernelImage = true;
    pam.yubico = {
       enable = true;
       debug = true;
       mode = "challenge-response";
       id = [ "19694730" ];
    };
    tpm2 = {
      enable = true;
      pkcs11.enable = true;
      tctiEnvironment.enable = true;
    };
  };
  system.autoUpgrade = {
    enable = true;
    flake = "git+https://git.k3t.dev/k3t/nixconf.git";
    operation = "switch";
    runGarbageCollection = true;
    randomizedDelaySec = "2hr";
    allowReboot = true;
    rebootWindow = { lower = "04:00"; upper = "08:00"; };
  };
}