feat: improve yubikey related setting

Swarsel · Dec 18, 2024 · ffb331f · ffb331f
1 parent 6fbc165
commit ffb331f
Show file tree

Hide file tree

Showing 4 changed files with 45 additions and 4 deletions.
diff --git a/SwarselSystems.org b/SwarselSystems.org
@@ -8027,6 +8027,7 @@ I use sops-nix to handle secrets that I want to have available on my machines at
         leon = { path = "/run/user/1000/secrets/leon"; };
         swarselmail = { path = "/run/user/1000/secrets/swarselmail"; };
         github_notif = { path = "/run/user/1000/secrets/github_notif"; };
+        u2f_keys = { path = "${config.home.homeDirectory}/.config/Yubico/u2f_keys"; };
       };
     };
   }
@@ -10295,7 +10296,7 @@ Currently, I am too lazy to explain every option here, but most of it is very se
 Settinfs that are needed for the gpg-agent. Also we are enabling emacs support for unlocking my Yubikey here.
 
 #+begin_src nix :tangle profiles/common/home/gpg-agent.nix
-  { pkgs, ... }:
+  { self, pkgs, ... }:
   {
     services.gpg-agent = {
       enable = true;
@@ -10308,7 +10309,26 @@ Settinfs that are needed for the gpg-agent. Also we are enabling emacs support f
         allow-loopback-pinentry
         allow-emacs-pinentry
       '';
+      sshKeys = [
+        "4BE7925262289B476DBBC17B76FD3810215AE097"
+      ];
+    };
+
+    programs.gpg = {
+      enable = true;
+      publicKeys = [
+        {
+          source = "${self}/secrets/keys/gpg/gpg-public-key-0x76FD3810215AE097.asc";
+          trust = 5;
+        }
+      ];
     };
+
+    # assure correct permissions
+    systemd.user.tmpfiles.rules = [
+      "d /home/swarsel/.gnupg 700 swarsel users"
+    ];
+
   }
 #+end_src
 

diff --git a/profiles/common/home/gpg-agent.nix b/profiles/common/home/gpg-agent.nix
@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ self, pkgs, ... }:
 {
   services.gpg-agent = {
     enable = true;
@@ -11,5 +11,24 @@
       allow-loopback-pinentry
       allow-emacs-pinentry
     '';
+    sshKeys = [
+      "4BE7925262289B476DBBC17B76FD3810215AE097"
+    ];
   };
+
+  programs.gpg = {
+    enable = true;
+    publicKeys = [
+      {
+        source = "${self}/secrets/keys/gpg/gpg-public-key-0x76FD3810215AE097.asc";
+        trust = 5;
+      }
+    ];
+  };
+
+  # assure correct permissions
+  systemd.user.tmpfiles.rules = [
+    "d /home/swarsel/.gnupg 700 swarsel users"
+  ];
+
 }
diff --git a/profiles/common/home/sops.nix b/profiles/common/home/sops.nix
@@ -17,6 +17,7 @@ in
       leon = { path = "/run/user/1000/secrets/leon"; };
       swarselmail = { path = "/run/user/1000/secrets/swarselmail"; };
       github_notif = { path = "/run/user/1000/secrets/github_notif"; };
+      u2f_keys = { path = "${config.home.homeDirectory}/.config/Yubico/u2f_keys"; };
     };
   };
 }
diff --git a/secrets/general/secrets.yaml b/secrets/general/secrets.yaml
@@ -24,6 +24,7 @@ githubforgeuser: ENC[AES256_GCM,data:O3shEkYkq+u/rCy4XQ==,iv:Oq109o5dhbl7bqgbeTx
 githubforgepass: ENC[AES256_GCM,data:CS1ZmDjQQIjGrmaDTzkut/tethQueEyKomc=,iv:k8MK4ItU1jUqXbEx2Ods0YvycWVF8wgLgllTx0PuWj8=,tag:zYdPReSfFF4ar5neys976w==,type:str]
 gitlabforgeuser: ENC[AES256_GCM,data:SrQw69bvtYUcVSePCg==,iv:PlaTHDWJRMtf0HQCG/fVUfw+/91x3ubJKSrcEf+R/Ck=,tag:8E+ZlJE+O+mmcPjhEc/2DA==,type:str]
 gitlabforgepass: ENC[AES256_GCM,data:WvUFqQtBqqlWvUWhF7x46RcjqA3RPnKSgbd3ZIr1kHO+Vmh5zUh+LA==,iv:+n2VPdLdxFFVHlzRdMCi1lyqGLH+U3RRZX/qfs42I0s=,tag:1iBorR1N1HDRtrqcAcSmvA==,type:str]
+u2f_keys: ENC[AES256_GCM,data:jk1IDfO778V3MCQ8fGoO87lCmqj2Dw+vNRfT4JuWXZ6cB/ARYblnGIpEfogciXJbmYWc4MiKHcO2PkXFdCynpniU3pf3stvNYjTV/TdUpNXkAyho1OjBXwisOMFMcqF3I8yI/XpaMr+5aL6tyMLZ4wIsa0tP4FH74BxCt426uhH8YKLCXREaLRy2PFEQS2MVwKL8i41LDhrkVaJIEMZJ34rvHQqsjckjvwEtCHzBh8XVqdJXAKPq1EgR+9gTVhixwvceDsoSAC0/q2RkSfKhqhOFnj6e09GM7i+o1e98INyABHmd3OHxzTydYk6nrcJHFWIBZlushSgVI0qn+JL+e+2CF8NFtshHH7CGI7ws23n1DZz/BkjQtcfjZEnJv5uAZ9oOt4R0hOSpXn0rGQRNgo5JSMGR37ywyJlaDHmRolS6lRk/7pEdO3jCEMSwjjitWK1/iNDSgEExclQZ/cSL2svPZmwiTKrf0wm/+gbGrd+BxzJmHCopFyNG47kweyR7iMcknF/4+iJj9t2Mi+xOxYdqmQB+I6140DOqcMz9sA0tzqV+Ou6Jf4H4w9sqvI10pnw2sK7OuvFZQ442H+iLelRiZLA/ZCzDCieddLJBtqSsmgEJtJpRsiJXUzDn4CzaAFWrNvNaU/MKAAZwsPeJywmwKgjOUSdHz3YKVDhP/TDqvlzvjKYDte7+6baAYKjVNPJpMy4aQ4/m2FnUEcgRdwct3G8JCe1CORIZSFbO9fkgEgJK6WN3XyQn1nAcDGZdmS95O5Ajmj6a1f5nZQ==,iv:B/Nf1lS0gKW43Nq8QuwJD6GCzzvx35LBw1q1OmZMfF8=,tag:gVNKbyq514J1eoM03JoQYg==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -66,8 +67,8 @@ sops:
             RW9nYmdzV3o5YjZRdVVPN0dkMGN6aXMKovEW5hIMX0qQFBszxQQjdO0DtHZ+swJA
             Le4TQXWDW2I0sNK6FySEUf/KS52KuimhV96qKB10D5QZxKJrFYp91g==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-12-16T16:58:01Z"
-    mac: ENC[AES256_GCM,data:lCviR1wZSczhqqjGztecB5XAYjHSh7rEtk0ffKkcAHkiCm8Lefc288MiM8pvxPqLUANHdfick9uMQqdUEgl25fuk7T62IoFOfXSS9gN9xpiOjw0C72gZmomhZ/IOYFtcw77jrS5C2FmXRBjCS/fvaOO41liLg/KYJQdnyT6D0OA=,iv:AOuzPidkMEDBgym8hOimLabQJ6JpxAyggfa6w2I1rWE=,tag:paR5w7yT7vpORfkiMcHgag==,type:str]
+    lastmodified: "2024-12-18T22:08:25Z"
+    mac: ENC[AES256_GCM,data:vU+7/VLEzwDOrScD/HTo9JBf4ixtmcBmjtSUEtaVHwZuPMJ0OpydwcBPYKvhvU6z9xNecCcuiY7beJ5sq7fnv8XY66TOZWq/2tTZPXdJwpfAyHqBhf7uoCiOmSl53tpWzUFbfT8fQQwjKmBO1079Op24WNWzG3w0i9BsoYTYrpY=,iv:9bLlRg28paoitcK1lFc4ipsgMVvr/zECNozwXU2qJTM=,tag:uRviXeIlwUnvJqHwWuoYcA==,type:str]
     pgp:
         - created_at: "2024-12-18T00:16:17Z"
           enc: |-