1 files changed, 14 insertions, 0 deletions
diff --git a/modules/workstation/hardware/yubikey/default.nix b/modules/workstation/hardware/yubikey/default.nix
new file mode 100644
index 000000000000..0f2d63e742b9
--- /dev/null
+++ b/modules/workstation/hardware/yubikey/default.nix
@@ -0,0 +1,14 @@
+{ pkgs, ... }:
+
+{
+  services.udev.packages = with pkgs; [ yubikey-personalization ];
+
+  security.pam.services.sudo.u2fAuth = true;
+  security.sudo.extraConfig = ''
+    Defaults timestamp_timeout=0
+  '';
+
+  security.pam.u2f.appId = "pam://qyliss.net";
+  security.pam.u2f.cue = true;
+  security.pam.u2f.authFile = pkgs.copyPathToStore ./u2f_keys;
+}