os/core/security.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

{ config, lib, pkgs, ... }:
let
  cfg = config.sys.core.security;
in
{
  options.sys.core.security.enable = lib.mkEnableOption "core security services";
  config = lib.mkIf cfg.enable {
    services.gnome.gnome-keyring.enable = true;

    security = {
      polkit.enable = true;
      rtkit.enable = true;
    };

    programs.gnupg.agent = {
      enable = true;
      enableSSHSupport = true;
      pinentryPackage = pkgs.pinentry-curses;
    };

    systemd.user.services.polkit-gnome-authentication-agent-1 = {
      description = "gnome-polkit-authentication-agent-1";
      wantedBy = [ "graphical-session.target" ];
      serviceConfig = {
        Type = "simple";
        ExecStart = "${pkgs.polkit_gnome}/libexec/polkit-gnome-authentication-agent-1";
        Restart = "on-failure";
        RestartSec = 1;
        TimeoutStopSec = 10;
      };
    };

    environment.systemPackages = with pkgs; [
      veracrypt
      bitwarden-desktop
    ];
  };
}