{ self, config, lib, ... }: let
  inherit (lib) mkIf types;
in {
  options.age-rekey = {
    enable = lib.mkEnableOption "age-rekey";
    hostPubkey = lib.mkOption {
      type = types.str;
      example = "ssh-ed25519 ...";
      description = "Host public key for rekeying";
    };
    # TODO(1/2): Per OS type handling. Probably better to not use an option.
    typeOf = lib.mkOption {
      type = types.str;
      example = "linux";
      description = "OS type (linux|darwin) for age identity paths";
    };
  };
  config = mkIf config.age-rekey.enable {
    # TODO(2/2): Per OS type.
    age.identityPaths = [ "/root/.ssh/id" ];
    age.rekey = {
      hostPubkey       = config.age-rekey.hostPubkey;
      masterIdentities = [ (self + /yubikey.pub) ];
      localStorageDir  = self + "/secrets/rekeyed/${config.networking.hostName}";
      storageMode      = "local";
    };
  };
}

  config.flake.modules.homeModules.yubikey =

  config.flake.modules.hjem.yubikey =

  config.flake.modules.nixosModules.yubikey =

  config.flake.modules.nixos.yubikey =

  config.flake.modules.darwinModules.yubikey =

  config.flake.modules.darwin.yubikey =

{ self, inputs, ... }:
{
  config.flake.agenix-rekey = inputs.age-rekey.configure {
    userFlake = self;
    inherit (self) nixosConfigurations;
  };
  config.flake.modules.nixos.secret-manager =
    { config, ... }:
    {
      imports = [
        inputs.age.nixosModules.default
        inputs.age-rekey.nixosModules.default
      ];
      config.age.rekey = {
        storageMode = "local";
        masterIdentities = [ ../yubikey.pub ];
        localStorageDir = ../secrets/rekeyed/${config.networking.hostName};
      };
    };
  config.flake.modules.darwin.secret-manager = {
    imports = [
      inputs.age.darwinModules.default
    ];
  };
}

  inherit (lib) mkIf;
in {
  age.identityPaths = [
    (if config.isLinux then
    else
  ];
}
  environment.systemPackages = mkIf config.isDesktop [
    pkgs.agenix
    pkgs.age-plugin-yubikey
  ];
    inputs.agenix-rekey.packages.${pkgs.stdenv.hostPlatform.system}.default
      "${config.users.users.${config.system.primaryUser}.home}/.ssh/id")
      "${config.users.users.root.home}/.ssh/id"
{ inputs, config, lib, pkgs, ... }: let

{ pkgs, lib, config, ... }: let
  inherit (lib) mkIf enabled;
in mkIf config.isDesktop {
  services.pcscd                  = enabled;
  programs.yubikey-manager        = enabled;
  programs.yubikey-touch-detector = enabled {
    libnotify = true;
  };
  security.pam.services = {
    sudo.u2fAuth  = true;
  };
}
  environment.systemPackages = [
    pkgs.yubikey-personalization
    pkgs.yubioath-flutter
    pkgs.age-plugin-yubikey
  ];
  services.udev.packages = [
    pkgs.yubikey-personalization
  ];
    su.u2fAuth    = true;
    sshd.u2fAuth  = true;
    login = {
      u2fAuth            = true;
      enableGnomeKeyring = true;
    };