From 97d2fd6096be9cdfe59790b89bc5507232bc83e6 Mon Sep 17 00:00:00 2001
From: Sergei Poljanski <me@asxp.io>
Date: Tue, 2 Jun 2026 14:07:00 +0300
Subject: [PATCH] id-card: enable Estonian eID smart card stack

Add opensc (PKCS#11) and pcsc-tools, enable pcscd, and add a udev rule
granting access to the built-in reader (2ce3:9563), which the shipped
CCID rules miss (pcscd hit LIBUSB_ERROR_ACCESS). Configure Firefox to
load the OpenSC PKCS#11 module for TLS client-cert auth and force-install
the Web eID extension.
---
 modules/packages.nix | 11 +++++++++++
 modules/xray.nix     | 10 +++++++++-
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/modules/packages.nix b/modules/packages.nix
index 34a9e3a..ad56e06 100644
--- a/modules/packages.nix
+++ b/modules/packages.nix
@@ -116,6 +116,8 @@
     # Estonian ID / digital signature
     qdigidoc
     web-eid-app
+    opensc          # PKCS#11 driver + opensc-tool / pkcs11-tool
+    pcsc-tools      # pcsc_scan for debugging the reader
 
     # CLI utilities
     tmux
@@ -133,4 +135,13 @@
     # GNOME extensions
     gnomeExtensions.tlp-profile-switcher
   ];
+
+  # PC/SC daemon — middleware for the smart card reader (Estonian ID)
+  services.pcscd.enable = true;
+
+  # The built-in reader (2ce3:9563 "Generic EMV Smartcard Reader") is not in
+  # the shipped CCID udev rules, so pcscd hit LIBUSB_ERROR_ACCESS. Grant access.
+  services.udev.extraRules = ''
+    SUBSYSTEM=="usb", ATTR{idVendor}=="2ce3", ATTR{idProduct}=="9563", ENV{ID_SMARTCARD_READER}="1", TAG+="uaccess", MODE="0660", GROUP="pcscd"
+  '';
 }
diff --git a/modules/xray.nix b/modules/xray.nix
index ffff68c..a9e925c 100644
--- a/modules/xray.nix
+++ b/modules/xray.nix
@@ -110,6 +110,14 @@ in
   programs.firefox = {
     enable = true;
     package = pkgs.firefox-devedition;
-    policies = {};
+    policies = {
+      # Estonian ID: load OpenSC PKCS#11 for TLS client-cert auth,
+      # and force-install the Web eID extension (talks to web-eid-app host).
+      SecurityDevices.OpenSC = "${pkgs.opensc}/lib/opensc-pkcs11.so";
+      ExtensionSettings."{e68418bc-f2b0-4459-a9ea-1a5d2b75d8e9}" = {
+        install_url = "https://addons.mozilla.org/firefox/downloads/latest/web-eid-webextension/latest.xpi";
+        installation_mode = "force_installed";
+      };
+    };
   };
 }