37 lines
861 B
Nix
37 lines
861 B
Nix
{pkgs, ...}:
|
|
|
|
{
|
|
programs.gnupg.agent = {
|
|
enable = true;
|
|
enableSSHSupport = true;
|
|
pinentryPackage = pkgs.pinentry-qt;
|
|
};
|
|
services.pcscd.enable = true;
|
|
services.udev.packages = [ pkgs.yubikey-personalization ];
|
|
security = {
|
|
sudo.execWheelOnly = true;
|
|
polkit.enable = true;
|
|
protectKernelImage = true;
|
|
#pam.yubico = {
|
|
# enable = true;
|
|
# debug = true;
|
|
# mode = "challenge-response";
|
|
# id = [ "19694730" ];
|
|
#};
|
|
tpm2 = {
|
|
enable = true;
|
|
pkcs11.enable = true;
|
|
tctiEnvironment.enable = true;
|
|
};
|
|
};
|
|
system.autoUpgrade = {
|
|
enable = true;
|
|
flake = "git+https://git.k3t.dev/k3t/nixconf.git";
|
|
operation = "switch";
|
|
runGarbageCollection = true;
|
|
randomizedDelaySec = "2hr";
|
|
allowReboot = true;
|
|
rebootWindow = { lower = "04:00"; upper = "08:00"; };
|
|
};
|
|
}
|