nix-config

0 Fork 0

mirror of https://github.com/ryan4yin/nix-config.git synced 2026-11-13 12:13:46 +01:00

Files

T

ryan4yin | 二花 71fa928254 feat(canokey): sudo, SSH, LUKS and OpenPGP setup for daily use (#516 )

Use the CanoKey for daily authentication on idols-ai and shoukei, with
the existing passwords, passphrases and per-host SSH keys as fallback.

- sudo: pam_u2f with a shared origin (pam://ryan4yin) and a Nix-store
  authfile built from myvars.canokeyU2fKeys; the primary key is
  registered and touch-to-sudo works on idols-ai.
- SSH: one resident ed25519-sk key (application=ssh:ryan4yin) exported
  to ~/.ssh/id_ed25519_sk; GitHub tries it before the per-host key.
- shoukei LUKS: fido2-device=auto with token-timeout=10s. Update
  nixos-apple-silicon (linux-asahi 7.2.14), whose initrd adds
  thunderbolt_apple and reset_apple_cio so USB-C comes up before unlock.
- GPG: scdaemon disable-ccid so it uses pcscd.
- docs/security-keys.md: setup, PINs, enrollment, backup key and
  recovery; deduplicate the FIDO notes left by #515.

Assisted-by: Claude Code (claude-opus-5-5)

2026-11-04 01:50:21 -06:00

networking

refactor(mihomo): link geodata from nixpkgs instead of seeding it by hand

2026-11-01 11:55:14 -06:00

canokey.nix

feat(canokey): sudo, SSH, LUKS and OpenPGP setup for daily use (#516 )

2026-11-04 01:50:21 -06:00

computer-use.nix

refactor: replace redundant mkForce with plain values and mkDefault

2026-11-01 10:14:27 -06:00

containers.nix

fix(desktop): keep named podman images when pruning (#435 )