nixos/yubikey-manager: init

Fixes #424484

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -62,6 +62,8 @@
 
 - [TuneD](https://tuned-project.org/), a system tuning service for Linux. Available as [services.tuned](#opt-services.tuned.enable).
 
+- [yubikey-manager](https://github.com/Yubico/yubikey-manager), a tool for configuring YubiKey devices. Available as [programs.yubikey-manager](#opt-programs.yubikey-manager.enable).
+
 - [Draupnir](https://github.com/the-draupnir-project/draupnir), a Matrix moderation bot. Available as [services.draupnir](#opt-services.draupnir.enable).
 
 - [postfix-tlspol](https://github.com/Zuplu/postfix-tlspol), MTA-STS and DANE resolver and TLS policy server for Postfix. Available as [services.postfix-tlspol](#opt-services.postfix-tlspol.enable).

nixos/modules/module-list.nix

@@ -362,6 +362,7 @@
   ./programs/xwayland.nix
   ./programs/yazi.nix
   ./programs/ydotool.nix
+  ./programs/yubikey-manager.nix
   ./programs/yubikey-touch-detector.nix
   ./programs/zmap.nix
   ./programs/zoom-us.nix

nixos/modules/programs/yubikey-manager.nix

@@ -0,0 +1,29 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.programs.yubikey-manager;
+in
+{
+  options = {
+    programs.yubikey-manager = {
+      enable = lib.mkEnableOption "yubikey-manager";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    services = {
+      pcscd.enable = true;
+
+      # The udev rules we want aren't included in the yubikey-manager package, but
+      # we can get them from yubikey-personalization.
+      udev.packages = [ pkgs.yubikey-personalization ];
+    };
+  };
+}