mirror of
https://github.com/ryan4yin/nix-config.git
synced 2026-11-13 12:13:46 +01:00
ryan4yin | 二花
71fa928254
Use the CanoKey for daily authentication on idols-ai and shoukei, with the existing passwords, passphrases and per-host SSH keys as fallback. - sudo: pam_u2f with a shared origin (pam://ryan4yin) and a Nix-store authfile built from myvars.canokeyU2fKeys; the primary key is registered and touch-to-sudo works on idols-ai. - SSH: one resident ed25519-sk key (application=ssh:ryan4yin) exported to ~/.ssh/id_ed25519_sk; GitHub tries it before the per-host key. - shoukei LUKS: fido2-device=auto with token-timeout=10s. Update nixos-apple-silicon (linux-asahi 7.2.14), whose initrd adds thunderbolt_apple and reset_apple_cio so USB-C comes up before unlock. - GPG: scdaemon disable-ccid so it uses pcscd. - docs/security-keys.md: setup, PINs, enrollment, backup key and recovery; deduplicate the FIDO notes left by #515. Assisted-by: Claude Code (claude-opus-5-5)
60 lines
2.3 KiB
Nix
60 lines
2.3 KiB
Nix
{
|
|
pkgs,
|
|
pkgs-master,
|
|
pkgs-stable,
|
|
pkgs-blender,
|
|
nixpak,
|
|
...
|
|
}:
|
|
let
|
|
callArgs = {
|
|
mkNixPak = nixpak.lib.nixpak {
|
|
inherit (pkgs) lib;
|
|
inherit pkgs;
|
|
};
|
|
};
|
|
wrapper = _pkgs: path: (_pkgs.callPackage path callArgs);
|
|
in
|
|
{
|
|
# FIDO2 hotplug for sandboxed browsers (see modules/fido-bwrap.nix). The
|
|
# directory is created at boot, before udevd starts, so the browser bind
|
|
# succeeds even with no key present. NixOS applies /dev tmpfiles entries only
|
|
# at boot; for a first deploy via switch, see hardening/README.md (Limits).
|
|
# Hard links share the device inode, so logind's uaccess ACLs stay
|
|
# authoritative, and removal on unplug leaves no stale node for a reused
|
|
# hidraw minor. 60-fido-id.rules sets ID_FIDO_TOKEN from the report
|
|
# descriptor, so the CanoKey's keyboard interface is never linked.
|
|
systemd.tmpfiles.rules = [ "d /dev/fido-hidraw 0755 root root -" ];
|
|
services.udev.extraRules = ''
|
|
ACTION=="add", SUBSYSTEM=="hidraw", ENV{ID_FIDO_TOKEN}=="1", RUN+="${pkgs.coreutils}/bin/ln -f /dev/%k /dev/fido-hidraw/%k"
|
|
ACTION=="remove", SUBSYSTEM=="hidraw", RUN+="${pkgs.coreutils}/bin/rm -f /dev/fido-hidraw/%k"
|
|
'';
|
|
|
|
# Add nixpaked Apps into nixpkgs, and reference them in home-manager or other nixos modules
|
|
nixpkgs.overlays = [
|
|
(_: super: {
|
|
nixpaks = {
|
|
qq = wrapper pkgs-master ./qq.nix;
|
|
telegram-desktop = wrapper super ./telegram-desktop.nix;
|
|
firefox = wrapper super ./firefox.nix;
|
|
google-chrome = wrapper super ./google-chrome.nix;
|
|
chromium = wrapper super ./chromium.nix;
|
|
brave-origin = wrapper super ./brave-origin.nix;
|
|
microsoft-edge = wrapper super ./microsoft-edge.nix;
|
|
foliate = wrapper super ./foliate.nix;
|
|
krita = wrapper pkgs-stable ./krita.nix;
|
|
bambu-studio = wrapper pkgs-master ./bambu-studio.nix;
|
|
orca-slicer = wrapper pkgs-master ./orca-slicer.nix;
|
|
zoom = wrapper super ./zoom.nix;
|
|
remmina = wrapper super ./remmina.nix;
|
|
obs-studio = wrapper super ./obs-studio.nix;
|
|
blender = wrapper pkgs-blender ./blender.nix;
|
|
musescore = wrapper pkgs-stable ./musescore.nix;
|
|
mpv = wrapper super ./mpv.nix;
|
|
imv = wrapper super ./imv.nix;
|
|
wechat = wrapper pkgs-master ./wechat.nix;
|
|
};
|
|
})
|
|
];
|
|
}
|