feature: age-plugin-yubikey support

.envrc

@@ -0,0 +1 @@
+use nix

README.md

@@ -183,6 +183,34 @@ randomness in `age`'s encryption algorithms, the files always change
 when rekeyed, even if the identities do not. (This eventually could be
 improved upon by reading the identities from the age file.)
 
+## YubiKey Support
+
+There is now a rage plugin to allow for encrypting age files with a YubiKey.
+Agenix offers preliminary support for this use case.
+
+For ease of use, the required `age-plugin-yubikey` binary is included in the
+agenix devshell.
+
+Be sure to setup your YubiKey as outlined in the official
+[plugin instructions][yk-plugin].
+
+#### Warning
+> A pin policy of 'never' may be used to avoid being asked for a PIN at
+> activation time. However, this will give anyone with physical access to your
+> yubikey the power to decrypt your secrets without a PIN.
+
+Once you have a proper key generated, run `age-plugin-yubikey -i > yubi_id`
+to save the identity for the key. Consider the `recipient` as the public key,
+set it accordingly in `secrets.nix`, and invoke agenix as
+`agenix -i yubi_id # ...` to target the yubikey identity.
+
+To decrypt secrets properly at activation time, be sure to also set:
+```nix
+{
+  age.sshKeyPaths = [ "${self}/path/to/age-plugin-yubikey-identity" ];
+}
+```
+
 ## Threat model/Warnings
 
 This project has not be audited by a security professional.
@@ -201,3 +229,5 @@ out for simplicity in `age`.
 ## Acknowledgements
 
 This project is based off of [sops-nix](https://github.com/Mic92/sops-nix) created Mic92. Thank you to Mic92 for inspiration and advice.
+
+[yk-plugin]: https://github.com/str4d/age-plugin-yubikey#configuration

flake.nix

@@ -2,29 +2,51 @@
   description = "Secret management with age";
 
   outputs = { self, nixpkgs }:
-  let
-    agenix = system: nixpkgs.legacyPackages.${system}.callPackage ./pkgs/agenix.nix {};
-  in {
-
-    nixosModules.age = import ./modules/age.nix;
-
-    overlay = import ./overlay.nix;
-
-    packages."aarch64-linux".agenix = agenix "aarch64-linux";
-    defaultPackage."aarch64-linux" = self.packages."aarch64-linux".agenix;
-
-    packages."i686-linux".agenix = agenix "i686-linux";
-    defaultPackage."i686-linux" = self.packages."i686-linux".agenix;
-
-    packages."x86_64-darwin".agenix = agenix "x86_64-darwin";
-    defaultPackage."x86_64-darwin" = self.packages."x86_64-darwin".agenix;
-
-    packages."x86_64-linux".agenix = agenix "x86_64-linux";
-    defaultPackage."x86_64-linux" = self.packages."x86_64-linux".agenix;
-    checks."x86_64-linux".integration = import ./test/integration.nix {
-      inherit nixpkgs; pkgs = nixpkgs.legacyPackages."x86_64-linux"; system = "x86_64-linux";
+    let
+      agenix = system:
+        nixpkgs.legacyPackages.${system}.callPackage ./pkgs/agenix.nix { };
+      age-plugin-yubikey = system:
+        nixpkgs.legacyPackages.${system}.callPackage
+          ./pkgs/age-plugin-yubikey.nix
+          { };
+    in
+    {
+
+      nixosModules.age = import ./modules/age.nix;
+
+      overlay = import ./overlay.nix;
+
+      packages."aarch64-linux".agenix = agenix "aarch64-linux";
+      defaultPackage."aarch64-linux" = self.packages."aarch64-linux".agenix;
+
+      packages."i686-linux".agenix = agenix "i686-linux";
+      defaultPackage."i686-linux" = self.packages."i686-linux".agenix;
+
+      packages."x86_64-darwin".agenix = agenix "x86_64-darwin";
+      defaultPackage."x86_64-darwin" = self.packages."x86_64-darwin".agenix;
+
+      packages."x86_64-linux".agenix = agenix "x86_64-linux";
+      defaultPackage."x86_64-linux" = self.packages."x86_64-linux".agenix;
+      checks."x86_64-linux".integration = import ./test/integration.nix {
+        inherit nixpkgs;
+        pkgs = nixpkgs.legacyPackages."x86_64-linux";
+        system = "x86_64-linux";
+      };
+
+      devShell."aarch64-linux" = import ./shell.nix {
+        pkgs = nixpkgs.legacyPackages."aarch64-linux";
+      };
+
+      devShell."i686-linux" = import ./shell.nix {
+        pkgs = nixpkgs.legacyPackages."i686-linux";
+      };
+
+      devShell."x86_64-darwin" = import ./shell.nix {
+        pkgs = nixpkgs.legacyPackages."x86_64-darwin";
+      };
+
+      devShell."x86_64-linux" = import ./shell.nix {
+        pkgs = nixpkgs.legacyPackages."x86_64-linux";
+      };
     };
-
-  };
-
 }

modules/age.nix

@@ -5,12 +5,13 @@ with lib;
 let
   cfg = config.age;
 
-  # we need at least rage 0.5.0 to support ssh keys
+  # we need at least rage 0.6.0 to support yubikey
   rage =
-    if lib.versionOlder pkgs.rage.version "0.5.0"
+    if lib.versionOlder pkgs.rage.version "0.6.0"
     then pkgs.callPackage ../pkgs/rage.nix { }
     else pkgs.rage;
   ageBin = "${rage}/bin/rage";
+  ykPlugin = pkgs.callPackage ../pkgs/age-plugin-yubikey.nix { };
 
   users = config.users.users;
 
@@ -21,7 +22,7 @@ let
     mkdir -p $(dirname ${secretType.path})
     (
       umask u=r,g=,o=
-      LANG=${config.i18n.defaultLocale} ${ageBin} --decrypt ${identities} -o "$TMP_FILE" "${secretType.file}"
+      PATH=${ykPlugin}/bin:$PATH LANG=${config.i18n.defaultLocale} ${ageBin} --decrypt ${identities} -o "$TMP_FILE" "${secretType.file}"
     )
     chmod ${secretType.mode} "$TMP_FILE"
     chown ${secretType.owner}:${secretType.group} "$TMP_FILE"

overlay.nix

@@ -1,4 +1,5 @@
 final: prev:
 {
   agenix = prev.callPackage ./pkgs/agenix.nix { };
+  age-plugin-yubikey = prev.callPackage ./pkgs/age-plugin-yubikey.nix { };
 }

pkgs/age-plugin-yubikey.nix

@@ -0,0 +1,26 @@
+{ lib, rustPlatform, fetchFromGitHub, pkgconfig, pcsclite }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "age-plugin-yubikey";
+  version = "6042d52";
+
+  src = fetchFromGitHub {
+    owner = "str4d";
+    repo = pname;
+    rev = "6042d5266f94b56d5b0702fe5fae4bbbd631613d";
+    sha256 = "sha256-VaDnaV3sVAIPaPiFToJHvgXDN54MN+f24tHARVZ2liQ=";
+  };
+
+  cargoSha256 = "sha256-0/h8ZaRtxgfrmwr/bUZ8YvE7iBh81E0I3zopTNS4eMM=";
+
+  nativeBuildInputs = [ pkgconfig ];
+  buildInputs = [ pcsclite ];
+
+  meta = with lib; {
+    description = "YubiKey plugin for age";
+    homepage = "https://github.com/str4d/${pname}";
+    changelog = "https://github.com/str4d/${pname}/releases/tag/v${version}";
+    license = with licenses; [ asl20 mit ]; # either at your option
+    maintainers = with maintainers; [ nrdxp ];
+  };
+}

pkgs/agenix.nix

@@ -10,21 +10,24 @@
   diffutils,
 } :
 let
-  # we need at least rage 0.5.0 to support ssh keys
-  rageToUse = if rage.version < "0.5.0"
+  # we need at least rage 0.6.0 to support yubikey
+  rageToUse = if rage.version < "0.6.0"
          then callPackage ./rage.nix {}
          else rage;
   ageBin = "${rageToUse}/bin/rage";
   sedBin = "${gnused}/bin/sed";
   nixInstantiate = "${nix}/bin/nix-instantiate";
   mktempBin = "${mktemp}/bin/mktemp";
   diffBin = "${diffutils}/bin/diff";
+  ykDir = "${callPackage ./age-plugin-yubikey.nix {}}/bin";
 in
 lib.recursiveUpdate (writeShellScriptBin "agenix" ''
 set -Eeuo pipefail
 
 PACKAGE="agenix"
 
+export PATH="${ykDir}:$PATH"
+
 function show_help () {
   echo "$PACKAGE - edit and rekey age secret files"
   echo " "

pkgs/rage.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rage";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "str4d";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-XSDfAsXfwSoe5JMdJtZlC324Sra+4fVJhE3/k2TthEc=";
+    sha256 = "sha256-XHBoJllUf3Qydq7nuVPtftyIaEA5Bnclo9fL+xEhT+0=";
   };
 
-  cargoSha256 = "sha256-GPr5zxeODAjD+ynp/nned9gZUiReYcdzosuEbLIKZSs=";
+  cargoSha256 = "sha256-pSSSm4dLt/nhj+qn6ZlUfhgYddeC/sBXeQVPuxOGTho=";
 
   nativeBuildInputs = [ installShellFiles ];
 

shell.nix

@@ -0,0 +1,6 @@
+{ pkgs ? import <nixpkgs> { }
+, agenix ? pkgs.callPackage ./pkgs/agenix.nix { }
+, age-plugin-yubikey ? pkgs.callPackage ./pkgs/age-plugin-yubikey.nix { }
+, ...
+}:
+pkgs.mkShell { buildInputs = [ agenix age-plugin-yubikey ]; }