Would it be possible to use a yubikey as the secret key?

[Ninlives]

I'm currently using a ssh key for my sops configuration and I'm wondering if it is possible to use a yubikey instead. Does anyone have a example configuration? Will it work? One thing I'm not sure is that whether the yubikey will be usable during boot.

[Mic92]

You can set up a gnupg home and set it up to import your yubikey there following instructions on the internet.
Than set this in sops: https://github.com/Mic92/sops-nix#use-with-gpg-instead-of-ssh-keys
It is important however that gpg home is owned by root because this is what gnupg expects.
You might want to adjust the touch policy if this should work unintended...
I personally would just encrypt my partition instead, which seems overall less hassle

[NovaViper]

I'm currently using a ssh key for my sops configuration and I'm wondering if it is possible to use a yubikey instead. Does anyone have a example configuration? Will it work? One thing I'm not sure is that whether the yubikey will be usable during boot.

Hey did you figure out how to do it? I'm actually sitting here wondering the same thing, setting the gnupg home to point to my user isn't exactly working because gpg in sudo mode can't read the keys located within the folder

[Mic92]

I would try instead to setup a separate gnupg home just for root.

[NovaViper]

I would try instead to setup a separate gnupg home just for root.

That's the main issue.. I'm unsure how to set it up the same way as I did for the user <_>
This is mainly because Nix doesn't offer any way of configuring the gpg agent like you can with Home Manager

[Mic92]

Is there not also a nixos module for that?

[NovaViper]

Is there not also a nixos module for that?

There is but you can't configure it not nearly as much as you can with the Home Manager module. The HomeManager module lets you configure the scdaemon for gpg but the NixOS module does not

[mairs8]

can this be re-opened. i am trying the same thing and @NovaViper raises some good points.

[Mic92]

We already have #377