asxpi/nixOS
asxpi/nixOS
1
0
Fork 0
Code Issues Pull requests Activity

id-card: enable Estonian eID smart card stack

Browse source 
Add opensc (PKCS#11) and pcsc-tools, enable pcscd, and add a udev rule
granting access to the built-in reader (2ce3:9563), which the shipped
CCID rules miss (pcscd hit LIBUSB_ERROR_ACCESS). Configure Firefox to
load the OpenSC PKCS#11 module for TLS client-cert auth and force-install
the Web eID extension.
This commit is contained in:
Sergei Poljanski 2026-06-02 14:07:00 +03:00
commit 97d2fd6096
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
2 changed files with 20 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
modules/packages.nix
View file

@ -116,6 +116,8 @@
# Estonian ID / digital signature
qdigidoc
web-eid-app
opensc # PKCS#11 driver + opensc-tool / pkcs11-tool
pcsc-tools # pcsc_scan for debugging the reader
# CLI utilities
tmux
@ -133,4 +135,13 @@
# GNOME extensions
gnomeExtensions.tlp-profile-switcher
];
# PC/SC daemon — middleware for the smart card reader (Estonian ID)
services.pcscd.enable = true;
# The built-in reader (2ce3:9563 "Generic EMV Smartcard Reader") is not in
# the shipped CCID udev rules, so pcscd hit LIBUSB_ERROR_ACCESS. Grant access.
services.udev.extraRules = ''
SUBSYSTEM=="usb", ATTR{idVendor}=="2ce3", ATTR{idProduct}=="9563", ENV{ID_SMARTCARD_READER}="1", TAG+="uaccess", MODE="0660", GROUP="pcscd"
'';
}

10
modules/xray.nix
View file

@ -110,6 +110,14 @@ in
programs.firefox = {
enable = true;
package = pkgs.firefox-devedition;
policies = {};
policies = {
# Estonian ID: load OpenSC PKCS#11 for TLS client-cert auth,
# and force-install the Web eID extension (talks to web-eid-app host).
SecurityDevices.OpenSC = "${pkgs.opensc}/lib/opensc-pkcs11.so";
ExtensionSettings."{e68418bc-f2b0-4459-a9ea-1a5d2b75d8e9}" = {
install_url = "https://addons.mozilla.org/firefox/downloads/latest/web-eid-webextension/latest.xpi";
installation_mode = "force_installed";
};
};
};
}