65 lines
2 KiB
Nix
65 lines
2 KiB
Nix
|
# NixOS livesystem to generate yubikeys in an air-gapped manner
|
||
|
|
# screenshot: https://dl.thalheim.io/wmxIqucOEo2xuLk0Ut45fQ/yubikey-live-system.png
|
||
|
|
# $ nixos-generator -f iso -c yubikey-image.nix
|
||
|
|
{ pkgs, ... }: {
|
||
|
|
environment.interactiveShellInit = ''
|
||
|
|
export GNUPGHOME=/run/user/$(id -u)/gnupghome
|
||
|
|
if [ ! -d $GNUPGHOME ]; then
|
||
|
|
mkdir $GNUPGHOME
|
||
|
|
fi
|
||
|
|
cp ${pkgs.fetchurl {
|
||
|
|
url = "https://raw.githubusercontent.com/drduh/config/662c16404eef04f506a6a208f1253fee2f4895d9/gpg.conf";
|
||
|
|
sha256 = "118fmrsn28fz629y7wwwcx7r1wfn59h3mqz1snyhf8b5yh0sb8la";
|
||
|
|
}} "$GNUPGHOME/gpg.conf"
|
||
|
|
echo "\$GNUPGHOME has been set up for you. Generated keys will be in $GNUPGHOME."
|
||
|
|
'';
|
||
|
|
|
||
|
|
environment.systemPackages = with pkgs; [
|
||
|
|
yubikey-personalization
|
||
|
|
cryptsetup
|
||
|
|
pwgen
|
||
|
|
midori
|
||
|
|
paperkey
|
||
|
|
gnupg
|
||
|
|
haskellPackages.hopenpgp-tools
|
||
|
|
ctmg
|
||
|
|
];
|
||
|
|
|
||
|
|
services.udev.packages = with pkgs; [ yubikey-personalization ];
|
||
|
|
services.pcscd.enable = true;
|
||
|
|
users.extraUsers.root.initialHashedPassword = "";
|
||
|
|
|
||
|
|
# make sure we are air-gapped
|
||
|
|
networking.wireless.enable = false;
|
||
|
|
networking.dhcpcd.enable = false;
|
||
|
|
|
||
|
|
services.mingetty.helpLine = "The 'root' account has an empty password.";
|
||
|
|
|
||
|
|
services.xserver = {
|
||
|
|
enable = true;
|
||
|
|
displayManager.auto.enable = true;
|
||
|
|
|
||
|
|
desktopManager = let
|
||
|
|
guide = pkgs.stdenv.mkDerivation {
|
||
|
|
name = "yubikey-guide-2019-01-21.html";
|
||
|
|
src = pkgs.fetchFromGitHub {
|
||
|
|
owner = "drduh";
|
||
|
|
repo = "YubiKey-Guide";
|
||
|
|
rev = "035d98ebbed54a0218ccbf23905054d32f97508e";
|
||
|
|
sha256 = "0rzy06a5xgfjpaklxdgrxml24d0vhk78lb577l3z4x7a2p32dbyq";
|
||
|
|
};
|
||
|
|
buildInputs = [ pkgs.pandoc ];
|
||
|
|
installPhase = "pandoc --highlight-style pygments -s --toc README.md -o $out";
|
||
|
|
};
|
||
|
|
in {
|
||
|
|
default = "xfce";
|
||
|
|
xterm.enable = false;
|
||
|
|
xfce.enable = true;
|
||
|
|
xfce.extraSessionCommands = ''
|
||
|
|
${pkgs.midori}/bin/midori ${guide} &
|
||
|
|
${pkgs.xfce.terminal}/bin/xfce4-terminal &
|
||
|
|
'';
|
||
|
|
};
|
||
|
|
};
|
||
|
|
}
|