From 2811bd995f44f9ea9f0a9e1a2076051a4a1b634c Mon Sep 17 00:00:00 2001
From: Alejandro Angulo <iam@alejandr0angul0.dev>
Date: Thu, 22 Sep 2022 20:21:12 -0700
Subject: [PATCH] Made yubikey config reusable

---
 common/yubikey.nix              | 24 ++++++++++++++++++++++++
 flake.nix                       |  2 ++
 system/carbon/configuration.nix | 17 -----------------
 users/alejandro/gpg.nix         |  4 ++++
 4 files changed, 30 insertions(+), 17 deletions(-)
 create mode 100644 common/yubikey.nix

diff --git a/common/yubikey.nix b/common/yubikey.nix
new file mode 100644
index 0000000..9f62e9a
--- /dev/null
+++ b/common/yubikey.nix
@@ -0,0 +1,24 @@
+{
+  config,
+  pkgs,
+  ...
+}: {
+  environment.systemPackages = with pkgs; [
+    yubikey-manager
+    yubikey-agent
+    yubico-pam
+  ];
+
+  services.pcscd.enable = true;
+
+  security.pam.yubico = {
+    enable = true;
+    #debug = true;
+    mode = "challenge-response";
+    # Uncomment below for 2FA
+    #control = "required";
+  };
+  # To set up, need to run (might need to run as root)
+  # ykman otp chalresp --touch --generate 2
+  # ykpamcfg -2 -v
+}
diff --git a/flake.nix b/flake.nix
index bd42f8f..d4bf63a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -51,6 +51,7 @@
 
         modules = [
           ./system/carbon/configuration.nix
+          ./common/yubikey.nix
         ];
       };
 
@@ -59,6 +60,7 @@
 
         modules = [
           ./system/gospel/configuration.nix
+          ./common/yubikey.nix
         ];
       };
     };
diff --git a/system/carbon/configuration.nix b/system/carbon/configuration.nix
index d096e50..5d94b83 100644
--- a/system/carbon/configuration.nix
+++ b/system/carbon/configuration.nix
@@ -109,10 +109,6 @@
     wireguard-tools
 
     prusa-slicer
-
-    yubikey-manager
-    yubikey-agent
-    yubico-pam
   ];
 
   # Some programs need SUID wrappers, can be configured further or are
@@ -165,19 +161,6 @@
     pulse.enable = true;
   };
 
-  services.pcscd.enable = true;
-
-  security.pam.yubico = {
-    enable = true;
-    #debug = true;
-    mode = "challenge-response";
-    # Uncomment below for 2FA
-    #control = "required";
-  };
-  # To set up, need to run (might need to run as root)
-  # ykman otp chalresp --touch --generate 2
-  # ykpamcfg -2 -v
-
   # Open ports in the firewall.
   # networking.firewall.allowedTCPPorts = [ ... ];
   # networking.firewall.allowedUDPPorts = [ ... ];
diff --git a/users/alejandro/gpg.nix b/users/alejandro/gpg.nix
index c548a86..25395a1 100644
--- a/users/alejandro/gpg.nix
+++ b/users/alejandro/gpg.nix
@@ -10,6 +10,10 @@
 
   programs.gpg = {
     enable = true;
+    scdaemonSettings = {
+      # Fix conflicts with config in common/yubikey.nix
+      disable-ccid = true;
+    };
   };
 
   services.gpg-agent = {