Changed bootloader mount point from /boot/efi to /boot & added yubikey.nix config

nixos/bootloader.nix

@@ -4,7 +4,7 @@
   # Bootloader.
   boot.loader.systemd-boot.enable = true;
   boot.loader.efi.canTouchEfiVariables = true;
-  boot.loader.efi.efiSysMountPoint = "/boot/efi";
+  boot.loader.efi.efiSysMountPoint = "/boot";
   boot.loader.timeout = 2;
   boot.initrd.enable = true;
   boot.initrd.systemd.enable = true;

nixos/flake.nix

@@ -14,6 +14,7 @@
         ./configuration.nix
         ./hardware-configuration.nix
         # ./fingerprint-scanner.nix
+        ./yubikey.nix
         ./sound.nix
         ./usb.nix
         ./time.nix
@@ -51,6 +52,7 @@
         ./info-fetchers.nix
         ./utils.nix
         ./terminal-utils.nix
+        ./work.nix
       ];
     };
   };

nixos/yubikey.nix

@@ -0,0 +1,29 @@
+{ pkgs, ...}:
+
+{
+  services.udev.packages = [ pkgs.yubikey-personalization ];
+
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+  };
+
+  security.pam.services = {
+    login.u2fAuth = true;
+    sudo.u2fAuth = true;
+  };
+
+  # FIXME Replace [your_yubikey_model_id] with the actual model ID of your YubiKey. You can find the model ID using the `lsusb` command, typically available as a part of the `usbutils` package
+  services.udev.extraRules = ''
+      ACTION=="remove",\
+       ENV{ID_BUS}=="usb",\
+       ENV{ID_MODEL_ID}=="your_yubikey_model_id",\
+       ENV{ID_VENDOR_ID}=="1050",\
+       ENV{ID_VENDOR}=="Yubico",\
+       RUN+="${pkgs.systemd}/bin/loginctl lock-sessions"
+  '';
+
+  environment.systemPackages = with pkgs; [
+    pam_u2f
+  ];
+}