aner
1d661943cf
pam_u2f is set up as a sufficient factor ahead of password for sudo and login (which greetd/tuigreet substacks), so touching the key logs in without typing a password while leaving password as fallback. Fingerprint was investigated too but lauretta's reader is an unsupported match-on-chip sensor, documented in the feature instead of wired up. Also flip kubectl, qutebrowser-config, and snx-rs to disabled by default since they're unused. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
62 lines
1.6 KiB
Nix
62 lines
1.6 KiB
Nix
{...}: {
|
|
config.flake.modules.homeManager.snx-rs = {
|
|
lib,
|
|
config,
|
|
pkgs,
|
|
...
|
|
}: let
|
|
cfg = config.azos.snx-rs;
|
|
in {
|
|
options.azos.snx-rs = {
|
|
enable = lib.mkOption {
|
|
default = false;
|
|
type = lib.types.bool;
|
|
};
|
|
server = lib.mkOption {
|
|
default = "vpn.bgu.ac.il";
|
|
type = lib.types.str;
|
|
description = "VPN server address";
|
|
};
|
|
username = lib.mkOption {
|
|
default = "anerz@vpn";
|
|
type = lib.types.str;
|
|
description = "VPN username";
|
|
};
|
|
loginType = lib.mkOption {
|
|
default = "vpn";
|
|
type = lib.types.str;
|
|
description = "Login type";
|
|
};
|
|
ignoreServerCert = lib.mkOption {
|
|
default = true;
|
|
type = lib.types.bool;
|
|
description = "Ignore server certificate validation";
|
|
};
|
|
};
|
|
config = lib.mkIf cfg.enable {
|
|
home.packages = with pkgs; [
|
|
snx-rs
|
|
(pkgs.writeShellScriptBin "snx-connect" ''
|
|
#!/bin/sh
|
|
sudo ${pkgs.snx-rs}/bin/snx-rs -m command &
|
|
sleep 1
|
|
${pkgs.snx-rs}/bin/snxctl connect
|
|
'')
|
|
(pkgs.writeShellScriptBin "snx-disconnect" ''
|
|
#!/bin/sh
|
|
${pkgs.snx-rs}/bin/snxctl disconnect
|
|
pkill -x snx-rs 2>/dev/null || true
|
|
'')
|
|
];
|
|
home.file.".config/snx-rs/snx-rs.conf" = {
|
|
text = ''
|
|
server ${cfg.server}
|
|
username ${cfg.username}
|
|
login-type ${cfg.loginType}
|
|
ignore-server-cert ${lib.boolToString cfg.ignoreServerCert}
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
}
|