added stuff

nyx/hosts/erebus/default.nix

@@ -0,0 +1,11 @@
+{
+  imports = [
+    ./system # system configuration
+    ./virtualization.nix # configure virtual machine
+    ./yubikey.nix # configure yubikey toolkit
+  ];
+
+  config = {
+    system.stateVersion = "23.11";
+  };
+}

nyx/hosts/erebus/system/default.nix

@@ -0,0 +1,56 @@
+# NixOS livesystem to generate yubikeys in an air-gapped manner
+# $ nix build .#images.erebus
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: {
+  # Secure defaults
+  nixpkgs.config = {allowBroken = false;}; # false breaks zfs kernel - but we don't care about zfs
+
+  # Always copytoram so that, if the image is booted from, e.g., a
+  # USB stick, nothing is mistakenly written to persistent storage.
+  boot = {
+    kernelParams = ["copytoram"];
+    tmp.cleanOnBoot = true;
+    kernel.sysctl = {"kernel.unprivileged_bpf_disabled" = 1;};
+  };
+
+  # make sure we are air-gapped
+  networking = {
+    wireless.enable = false;
+    dhcpcd.enable = false;
+  };
+
+  services.getty.helpLine = "The 'root' account has an empty password.";
+
+  isoImage.isoBaseName = lib.mkForce config.networking.hostName;
+
+  # words cannot express how much I hate zfs
+  boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
+
+  environment = {
+    # needed for i3blocks
+    pathsToLink = ["/libexec"];
+    # fix an annoying warning
+    etc."mdadm.conf".text = ''
+      MAILADDR root
+    '';
+  };
+
+  fonts = {
+    fontDir = {
+      enable = true;
+      decompressFonts = true;
+    };
+
+    fontconfig.enable = true;
+
+    packages = with pkgs; [
+      noto-fonts
+      noto-fonts-cjk
+      noto-fonts-color-emoji
+    ];
+  };
+}

nyx/hosts/erebus/system/desktop.nix

@@ -0,0 +1,46 @@
+{pkgs, ...}: {
+  security.sudo.wheelNeedsPassword = false;
+
+  users.users.yubikey = {
+    isNormalUser = true;
+    extraGroups = ["wheel"];
+    shell = pkgs.zsh;
+  };
+
+  programs.dconf.enable = true;
+
+  services = {
+    gvfs.enable = true;
+
+    autorandr.enable = true;
+
+    xserver = {
+      enable = true;
+      layout = "tr";
+      displayManager = {
+        autoLogin.enable = true;
+        autoLogin.user = "yubikey";
+        defaultSession = "none+i3";
+      };
+
+      desktopManager = {
+        xterm.enable = false;
+      };
+
+      # i3 for window management
+      windowManager.i3 = {
+        enable = true;
+        package = pkgs.i3-gaps;
+
+        extraPackages = with pkgs; [
+          st # suckless terminal that sucks, pretty minimal though
+          rofi # alternative to dmenu, usually better
+          dmenu # application launcher most people use
+          i3status # gives you the default i3 status bar
+          i3lock # default i3 screen locker
+          i3blocks # if you are planning on using i3blocks over i3status
+        ];
+      };
+    };
+  };
+}

nyx/hosts/erebus/virtualization.nix

@@ -0,0 +1,9 @@
+{
+  virtualisation.vmVariant = {
+    # let the built VM be more responsive
+    virtualisation = {
+      memorySize = 4096;
+      cores = 3;
+    };
+  };
+}

nyx/hosts/erebus/yubikey.nix

@@ -0,0 +1,127 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  drduhConfig = pkgs.fetchFromGitHub {
+    owner = "drduh";
+    repo = "config";
+    rev = "6bea1fdaa8732ec8625f4bac7022b25e14b15ffe";
+    hash = "sha256-Fto8FCVYeKviMz0VmCiXHrgMT1pVopJGGDHF0s3K4ts=";
+  };
+
+  gpg-conf = "${drduhConfig}/gpg.conf";
+
+  yubico-guide = pkgs.stdenv.mkDerivation {
+    name = "yubikey-guide.html";
+    src = pkgs.fetchFromGitHub {
+      owner = "drduh";
+      repo = "YubiKey-Guide";
+      rev = "fec6e92b8f05c899eccc7f2f2b273d609ed6094e";
+      hash = "sha256-N76e/yhXUoWUK6EQZHGyTs0DcbZqAlI5xtQMf0squR8=";
+    };
+    buildInputs = [pkgs.pandoc];
+    installPhase = "pandoc --highlight-style pygments -s --toc README.md -o $out";
+  };
+
+  guide = "${yubico-guide}/README.md";
+  contrib = "${yubico-guide}/contrib";
+
+  # Instead of hard-coding the pinentry program, chose the appropriate one
+  # based on the environment of the image the user has chosen to build.
+  gpg-agent-conf = pkgs.runCommand "gpg-agent.conf" {} ''
+    sed '/pinentry-program/d' ${drduhConfig}/gpg-agent.conf > $out
+    echo "pinentry-program ${pkgs.pinentry.${pinentryFlavour}}/bin/pinentry" >> $out
+  '';
+
+  xserverCfg = config.services.xserver;
+  pinentryFlavour =
+    if xserverCfg.desktopManager.lxqt.enable || xserverCfg.desktopManager.plasma5.enable
+    then "qt"
+    else if xserverCfg.desktopManager.xfce.enable
+    then "gtk2"
+    else if xserverCfg.enable || config.programs.sway.enable
+    then "gnome3"
+    else "curses";
+
+  view-yubikey-guide = pkgs.writeShellScriptBin "view-yubikey-guide" ''
+    viewer="$(type -P xdg-open || true)"
+    if [ -z "$viewer" ]; then
+      viewer="${pkgs.glow}/bin/glow -p"
+    fi
+    exec $viewer "${guide}"
+  '';
+
+  shortcut = pkgs.makeDesktopItem {
+    name = "yubikey-guide";
+    icon = "${pkgs.yubikey-manager-qt}/share/ykman-gui/icons/ykman.png";
+    desktopName = "drduh's YubiKey Guide";
+    genericName = "Guide to using YubiKey for GPG and SSH";
+    comment = "Open the guide in a reader program";
+    categories = ["Documentation"];
+    exec = "${view-yubikey-guide}/bin/view-yubikey-guide";
+  };
+
+  yubikey-guide = pkgs.symlinkJoin {
+    name = "yubikey-guide";
+    paths = [view-yubikey-guide shortcut];
+  };
+in {
+  environment.interactiveShellInit = ''
+    # unset HISTFILE
+    export GNUPGHOME="/run/user/$(id -u)/gnupg"
+    if [ ! -d "$GNUPGHOME" ]; then
+      echo "Creating \$GNUPGHOME…"
+      install --verbose -m=0700 --directory="$GNUPGHOME"
+    fi
+    [ ! -f "$GNUPGHOME/gpg.conf" ] && cp --verbose ${gpg-conf} "$GNUPGHOME/gpg.conf"
+    [ ! -f "$GNUPGHOME/gpg-agent.conf" ] && cp --verbose ${gpg-agent-conf} "$GNUPGHOME/gpg-agent.conf"
+    echo "\$GNUPGHOME is \"$GNUPGHOME\""
+  '';
+
+  # Yubikey Tooling
+  environment.systemPackages = with pkgs; [
+    yubikey-personalization
+    cryptsetup
+    pwgen
+    midori
+    paperkey
+    gnupg
+    ctmg
+  ];
+
+  services = {
+    udev.packages = with pkgs; [yubikey-personalization];
+    pcscd.enable = true;
+  };
+
+  programs = {
+    ssh.startAgent = false;
+    gnupg.agent = {
+      enable = true;
+      enableSSHSupport = true;
+    };
+  };
+
+  services.xserver.displayManager.sessionCommands = ''
+    ${lib.getExe pkgs.zathura} ${guide} &
+    ${lib.getExe pkgs.kitty} &
+  '';
+
+  # Copy the contents of contrib to the home directory, add a shortcut to
+  # the guide on the desktop, and link to the whole repo in the documents
+  # folder.
+  system.activationScripts.yubikeyGuide = let
+    homeDir = "/home/nixos/";
+    desktopDir = homeDir + "Desktop/";
+    documentsDir = homeDir + "Documents/";
+  in ''
+    mkdir -p ${desktopDir} ${documentsDir}
+    chown nixos ${homeDir} ${desktopDir} ${documentsDir}
+
+    cp -R ${contrib}/* ${homeDir}
+    ln -sf ${yubikey-guide}/share/applications/yubikey-guide.desktop ${desktopDir}
+    ln -sfT ${yubikey-guide} ${documentsDir}/YubiKey-Guide
+  '';
+}