From 97ad497ca18f4896740632759e983f56f47e5855 Mon Sep 17 00:00:00 2001 From: Kerstin Humm Date: Tue, 5 May 2026 15:12:06 +0200 Subject: [PATCH 1/2] passless: init at 0.12.0 --- pkgs/by-name/pa/passless/package.nix | 56 ++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100644 pkgs/by-name/pa/passless/package.nix diff --git a/pkgs/by-name/pa/passless/package.nix b/pkgs/by-name/pa/passless/package.nix new file mode 100644 index 000000000000..844a9ba6652d --- /dev/null +++ b/pkgs/by-name/pa/passless/package.nix @@ -0,0 +1,56 @@ +{ + lib, + stdenv, + rustPlatform, + fetchFromGitHub, + pkg-config, + installShellFiles, + udev, +}: + +rustPlatform.buildRustPackage (finalAttrs: { + pname = "passless"; + version = "0.12.0"; + + __structuredAttrs = true; + + src = fetchFromGitHub { + owner = "pando85"; + repo = "passless"; + tag = "v${finalAttrs.version}"; + hash = "sha256-tPlCiXokONUswwEDB2e23gR/NU6G+VYHgqfE+RyRsxw="; + }; + + cargoHash = "sha256-cNVmzK/W1jER6eK33JgFVnAN/6vGY4gw3GHB/H5DbIQ="; + + nativeBuildInputs = [ + pkg-config + installShellFiles + ]; + + buildInputs = [ + udev + ]; + + postInstall = '' + install -Dm644 contrib/udev/* $out/etc/udev/rules.d + + export COMPLETIONS="target/${stdenv.targetPlatform.config}/$cargoBuildType/build/passless-rs-*/out/completions" + + installShellCompletion --cmd passless \ + --bash $COMPLETIONS/passless.bash \ + --fish $COMPLETIONS/passless.fish \ + --zsh $COMPLETIONS/_passless + ''; + + meta = { + homepage = "https://github.com/pando85/passless"; + description = "Virtual FIDO2 device and client FIDO 2 utility"; + changelog = "https://github.com/pando85/passless/blob/${finalAttrs.src.tag}/CHANGELOG.md"; + license = lib.licenses.gpl3Only; + mainProgram = "passless"; + maintainers = [ lib.maintainers.erictapen ]; + platforms = lib.platforms.linux; + }; + +}) From 71e8d361473aa848f78e24e84d643546ff09f94f Mon Sep 17 00:00:00 2001 From: Kerstin Humm Date: Tue, 5 May 2026 15:41:21 +0200 Subject: [PATCH 2/2] nixos/passless: init --- .../manual/release-notes/rl-2605.section.md | 2 + nixos/modules/module-list.nix | 1 + nixos/modules/programs/passless.nix | 134 ++++++++++++++++++ 3 files changed, 137 insertions(+) create mode 100644 nixos/modules/programs/passless.nix diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md index 0da2ba935bcc..8cdd2f9b64d6 100644 --- a/nixos/doc/manual/release-notes/rl-2605.section.md +++ b/nixos/doc/manual/release-notes/rl-2605.section.md @@ -110,6 +110,8 @@ - [clevis-luks-askpass](https://github.com/latchset/clevis), automatic LUKS unlocking in initrd using clevis token bindings stored in LUKS headers. Available as [boot.initrd.clevisLuksAskpass](#opt-boot.initrd.clevisLuksAskpass.enable). +- [passless](https://github.com/pando85/passless), a daemon for using Webauthn Passkeys backed by password-store. + - [bentopdf](https://github.com/alam00000/bentopdf), a privacy-first PDF toolkit running completely in-browser. Available as [services.bentopdf](#opt-services.bentopdf.enable). - [hyprwhspr-rs](https://github.com/better-slop/hyprwhspr-rs), a keybind activated speech-to-text voice dictation utility built for use with Hyprland. Available as [services.hyprwhspr-rs](#opt-services.hyprwhspr-rs.enable). diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index 5c360229753f..ea0a206a0cc3 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -295,6 +295,7 @@ ./programs/opengamepadui.nix ./programs/openvpn3.nix ./programs/partition-manager.nix + ./programs/passless.nix ./programs/pay-respects.nix ./programs/plotinus.nix ./programs/pmount.nix diff --git a/nixos/modules/programs/passless.nix b/nixos/modules/programs/passless.nix new file mode 100644 index 000000000000..b25b2bd3d15d --- /dev/null +++ b/nixos/modules/programs/passless.nix @@ -0,0 +1,134 @@ +{ + config, + lib, + pkgs, + ... +}: +let + cfg = config.programs.passless; + settingsFormat = pkgs.formats.toml { }; + settingsFile = settingsFormat.generate "passless.toml" cfg.settings; +in +{ + + options.programs.passless = { + enable = lib.mkEnableOption "passless"; + + package = lib.mkPackageOption pkgs "passless" { }; + + users = lib.options.mkOption { + type = with lib.types; listOf str; + description = '' + Users that intend to use passless and should be added to the fido group. + ''; + default = [ ]; + example = [ "alice" ]; + }; + + settings = lib.mkOption { + inherit (settingsFormat) type; + default = { }; + example = { + pass.store-path = "/home/alice/.local/share/password-store"; + }; + description = '' + Configuration included in `config.toml`. + + See for documentation or run `passless config print` to see default configuration. + ''; + }; + }; + + config = lib.mkIf config.programs.passless.enable { + users.groups.fido.members = cfg.users; + + boot.kernelModules = [ "uhid" ]; + + services.udev.extraRules = '' + KERNEL=="uhid", GROUP="fido", MODE="0660" + ''; + + # From https://github.com/pando85/passless/blob/master/contrib/systemd/passless.service + systemd.user.services.passless = { + description = "Passless FIDO2 Software Authenticator"; + documentation = [ "https://github.com/pando85/passless" ]; + after = [ "network-online.target" ]; + wants = [ "network-online.target" ]; + wantedBy = [ "default.target" ]; + path = [ config.programs.gnupg.package ]; + serviceConfig = { + Type = "simple"; + ExecStart = "${lib.getExe cfg.package} --config-path ${settingsFile}"; + Restart = "on-failure"; + RestartSec = "5s"; + # Security hardening + # The application already handles its own memory locking and core dump prevention + # but we can add additional systemd protections + NoNewPrivileges = true; + LimitMEMLOCK = "2M"; + SyslogIdentifier = "passless"; + + # Found with shh + ProtectSystem = "strict"; + PrivateTmp = "disconnected"; + PrivateMounts = "true"; + ProtectKernelTunables = "true"; + ProtectKernelModules = true; + ProtectKernelLogs = true; + LockPersonality = true; + RestrictRealtime = true; + ProtectClock = true; + MemoryDenyWriteExecute = true; + RestrictAddressFamilies = "AF_UNIX"; + SocketBindDeny = [ + "ipv4:tcp" + "ipv4:udp" + "ipv6:tcp" + "ipv6:udp" + ]; + CapabilityBoundingSet = [ + "~CAP_BLOCK_SUSPEND" + "CAP_BPF" + "CAP_CHOWN" + "CAP_MKNOD" + "CAP_NET_RAW" + "CAP_PERFMON" + "CAP_SYS_BOOT" + "CAP_SYS_CHROOT" + "CAP_SYS_MODULE" + "CAP_SYS_NICE" + "CAP_SYS_PACCT" + "CAP_SYS_PTRACE" + "CAP_SYS_TIME" + "CAP_SYSLOG" + "CAP_WAKE_ALARM" + ]; + SystemCallFilter = [ + "~@aio:EPERM" + "@chown:EPERM" + "@clock:EPERM" + "@cpu-emulation:EPERM" + "@debug:EPERM" + "@ipc:EPERM" + "@keyring:EPERM" + "@module:EPERM" + "@mount:EPERM" + "@obsolete:EPERM" + "@pkey:EPERM" + "@privileged:EPERM" + "@raw-io:EPERM" + "@reboot:EPERM" + "@resources:EPERM" + "@sandbox:EPERM" + "@setuid:EPERM" + "@swap:EPERM" + "@sync:EPERM" + ]; + + }; + }; + }; + + meta.maintainers = with lib.maintainers; [ erictapen ]; + +}