{ config, pkgs, lib, ... }:

{
  services.udev.packages = [ pkgs.yubikey-personalization ];
  environment.systemPackages = with pkgs; [
    fprintd
    yubioath-flutter
    yubikey-manager
    pam_u2f
  ];

  services.pcscd.enable = true;
  programs.gnupg.agent = { enable = true; };

  services.fprintd.enable = true;
  security.pam.services.sudo.fprintAuth = true;
  security.pam.services.login.fprintAuth = lib.mkForce true;
  security.polkit.enable = true;
}