asxpi/nixOS
asxpi/nixOS
1
0
Fork 0
Code Issues Pull requests Activity

id-card: enable Estonian eID smart card stack

Browse source 
Add opensc (PKCS#11) and pcsc-tools, enable pcscd, and add a udev rule
granting access to the built-in reader (2ce3:9563), which the shipped
CCID rules miss (pcscd hit LIBUSB_ERROR_ACCESS). Configure Firefox to
load the OpenSC PKCS#11 module for TLS client-cert auth and force-install
the Web eID extension.
This commit is contained in:
Sergei Poljanski 2026-06-02 14:07:00 +03:00
commit 97d2fd6096
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
2 changed files with 20 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
modules/packages.nix
View file

@ -116,6 +116,8 @@
# Estonian ID / digital signature
qdigidoc
web-eid-app
opensc # PKCS#11 driver + opensc-tool / pkcs11-tool
pcsc-tools # pcsc_scan for debugging the reader
# CLI utilities
tmux
@ -133,4 +135,13 @@
# GNOME extensions
gnomeExtensions.tlp-profile-switcher
];
# PC/SC daemon — middleware for the smart card reader (Estonian ID)
services.pcscd.enable = true;
# The built-in reader (2ce3:9563 "Generic EMV Smartcard Reader") is not in
# the shipped CCID udev rules, so pcscd hit LIBUSB_ERROR_ACCESS. Grant access.
services.udev.extraRules = ''
SUBSYSTEM=="usb", ATTR{idVendor}=="2ce3", ATTR{idProduct}=="9563", ENV{ID_SMARTCARD_READER}="1", TAG+="uaccess", MODE="0660", GROUP="pcscd"
'';
}