yubikey-agent: init service module (#6446)

modules/modules.nix

@@ -424,6 +424,7 @@ let
     ./services/xscreensaver.nix
     ./services/xsettingsd.nix
     ./services/xsuspender.nix
+    ./services/yubikey-agent.nix
     ./systemd.nix
     ./targets/darwin
     ./targets/generic-linux.nix

modules/services/yubikey-agent.nix

@@ -0,0 +1,92 @@
+{ config, lib, pkgs, ... }:
+
+let
+  inherit (lib) mkIf;
+  cfg = config.services.yubikey-agent;
+
+in {
+  meta.maintainers = [ lib.maintainers.cmacrae ];
+
+  options.services.yubikey-agent = {
+    enable = lib.mkEnableOption "Seamless ssh-agent for YubiKeys";
+
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.yubikey-agent;
+      defaultText = lib.literalExpression "pkgs.yubikey-agent";
+      description = "The yubikey-agent package to use.";
+    };
+  };
+
+  config = mkIf cfg.enable (lib.mkMerge [
+    { home.packages = [ cfg.package ]; }
+
+    (mkIf pkgs.stdenv.isLinux {
+      systemd.user.services.yubikey-agent = {
+        Unit = {
+          Description = "Seamless ssh-agent for YubiKeys";
+          Documentation = "https://github.com/FiloSottile/yubikey-agent";
+          Requires = "yubikey-agent.socket";
+          After = "yubikey-agent.socket";
+          RefuseManualStart = true;
+        };
+
+        Service = {
+          ExecStart =
+            "${cfg.package}/bin/yubikey-agent -l %t/yubikey-agent/yubikey-agent.sock";
+          Type = "simple";
+          # /run/user/$UID for the socket
+          ReadWritePaths = [ "%t" ];
+        };
+      };
+
+      systemd.user.sockets.yubikey-agent = {
+        Unit = {
+          Description = "Unix domain socket for Yubikey SSH agent";
+          Documentation = "https://github.com/FiloSottile/yubikey-agent";
+        };
+
+        Socket = {
+          ListenStream = "%t/yubikey-agent/yubikey-agent.sock";
+          RuntimeDirectory = "yubikey-agent";
+          SocketMode = "0600";
+          DirectoryMode = "0700";
+        };
+
+        Install = { WantedBy = [ "sockets.target" ]; };
+      };
+
+      home.sessionVariables = {
+        SSH_AUTH_SOCK =
+          "\${XDG_RUNTIME_DIR:-/run/user/$UID}/yubikey-agent/yubikey-agent.sock";
+      };
+    })
+
+    (mkIf pkgs.stdenv.isDarwin {
+      launchd.agents.yubikey-agent = {
+        enable = true;
+        config = {
+          ProgramArguments = [
+            "${cfg.package}/bin/yubikey-agent"
+            "-l"
+            "/tmp/yubikey-agent.sock"
+          ];
+
+          KeepAlive = {
+            Crashed = true;
+            SuccessfulExit = false;
+          };
+          ProcessType = "Background";
+          Sockets = {
+            Listener = {
+              SockPathName = "/tmp/yubikey-agent.sock";
+              SockPathMode = 384; # 0600 in decimal
+            };
+          };
+        };
+      };
+
+      home.sessionVariables = { SSH_AUTH_SOCK = "/tmp/yubikey-agent.sock"; };
+    })
+  ]);
+}