From ee651b16cb7df93895acea99be018f063e2c117b Mon Sep 17 00:00:00 2001
From: Benjamin Staffin <benley@gmail.com>
Date: Mon, 14 Jul 2025 12:39:17 -0400
Subject: [PATCH] nixos/yubikey-manager: init

Fixes #424484
---
 .../manual/release-notes/rl-2511.section.md   |  2 ++
 nixos/modules/module-list.nix                 |  1 +
 nixos/modules/programs/yubikey-manager.nix    | 29 +++++++++++++++++++
 3 files changed, 32 insertions(+)
 create mode 100644 nixos/modules/programs/yubikey-manager.nix

diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index 40d4ec599c74..d176a850962f 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -62,6 +62,8 @@
 
 - [TuneD](https://tuned-project.org/), a system tuning service for Linux. Available as [services.tuned](#opt-services.tuned.enable).
 
+- [yubikey-manager](https://github.com/Yubico/yubikey-manager), a tool for configuring YubiKey devices. Available as [programs.yubikey-manager](#opt-programs.yubikey-manager.enable).
+
 - [Draupnir](https://github.com/the-draupnir-project/draupnir), a Matrix moderation bot. Available as [services.draupnir](#opt-services.draupnir.enable).
 
 - [postfix-tlspol](https://github.com/Zuplu/postfix-tlspol), MTA-STS and DANE resolver and TLS policy server for Postfix. Available as [services.postfix-tlspol](#opt-services.postfix-tlspol.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index d65241265b31..6390837ca4cb 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -362,6 +362,7 @@
   ./programs/xwayland.nix
   ./programs/yazi.nix
   ./programs/ydotool.nix
+  ./programs/yubikey-manager.nix
   ./programs/yubikey-touch-detector.nix
   ./programs/zmap.nix
   ./programs/zoom-us.nix
diff --git a/nixos/modules/programs/yubikey-manager.nix b/nixos/modules/programs/yubikey-manager.nix
new file mode 100644
index 000000000000..1dc2b15e202c
--- /dev/null
+++ b/nixos/modules/programs/yubikey-manager.nix
@@ -0,0 +1,29 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.programs.yubikey-manager;
+in
+{
+  options = {
+    programs.yubikey-manager = {
+      enable = lib.mkEnableOption "yubikey-manager";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    services = {
+      pcscd.enable = true;
+
+      # The udev rules we want aren't included in the yubikey-manager package, but
+      # we can get them from yubikey-personalization.
+      udev.packages = [ pkgs.yubikey-personalization ];
+    };
+  };
+}