feat(darwin): yubikey support

flake.nix

@@ -131,6 +131,7 @@
                   ./modules/ghostty
                   ./modules/tmux
                   ./modules/neovim
+                  ./modules/yubikey.nix
                   ./modules/gpg.nix
                   ./modules/git.nix
                   ./modules/gh
@@ -141,7 +142,6 @@
                   ./modules/charm.nix
                   ./modules/hammerspoon
                   inputs.caarlos0-nur.homeManagerModules.default
-                  # ./modules/yubikey.nix
                   nix-index-database.hmModules.nix-index
                 ];
               };

modules/yubikey.nix

@@ -1,11 +1,27 @@
-{ pkgs, ... }: {
-  # TODO: set things up
-  home.packages = with pkgs; [
-    yubikey-agent
-    yubikey-manager
-    # yubico-yubikey-manager
-  ];
+{ pkgs, ... }:
+let
+  sockPath = "/tmp/yubikey-agent.sock";
+in
+{
+  home.packages = with pkgs; [ yubikey-manager ];
+  home.sessionVariables.SSH_AUTH_SOCK = sockPath;
+  home.activation.yubikey = ''
+    $DRY_RUN_CMD ln -sf ${sockPath} $HOME/.ssh/ssh_auth_sock
+  '';
 
-  # TODO: path?
-  home.sessionVariables = { SSH_AUTH_SOCK = "/tmp/yubikey-agent.sock"; };
+  launchd.agents = {
+    yubikey-agent = {
+      enable = true;
+      config = {
+        Label = "localhost.yubikey-agent";
+        ProgramArguments = [ "${pkgs.yubikey-agent}/bin/yubikey-agent" "-l" sockPath ];
+        RunAtLoad = true;
+        KeepAlive = {
+          Crashed = true;
+          SuccessfulExit = false;
+        };
+        ProcessType = "Background";
+      };
+    };
+  };
 }