{ config, pkgs, lib, ... }:

{
  networking.firewall.enable = true;

  services.udev.packages = [ pkgs.yubikey-personalization ];
  environment.systemPackages = with pkgs; [
    fprintd
    yubioath-flutter
    yubikey-manager
    pam_u2f
  ];

  services.pcscd.enable = true;
  programs.gnupg.agent = { enable = true; };
  services.gnome.gnome-keyring.enable = true;

  security.rtkit.enable = true;
  services.fprintd.enable = true;
  security.pam.services.sudo.fprintAuth = true;
  security.pam.services.login.fprintAuth = lib.mkForce true;
  security.pam.services.sddm.fprintAuth = true; # For login/lock (?)

  security.polkit.enable = true;
}