{ pkgs, ... }:

{
  environment.systemPackages = with pkgs; [
    gnupg
    yubioath-flutter
  ];

  programs.gnupg.agent.enable = true;

  security = {
    pam = {
      services = {
        gdm-fingerprint.text = ''
          auth       required                    pam_shells.so
          auth       requisite                   pam_nologin.so
          auth       requisite                   pam_faillock.so      preauth
          auth       required                    ${pkgs.fprintd}/lib/security/pam_fprintd.so
          auth       optional                    pam_permit.so
          auth       required                    pam_env.so
          auth       [success=ok default=1]      ${pkgs.gdm}/lib/security/pam_gdm.so
          auth       optional                    ${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so

          account    include                     login

          password   required                    pam_deny.so

          session    include                     login
          session    optional                    ${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so auto_start
        '';
        login = {
          fprintAuth = false;
          u2fAuth = false; # U2F and password
        };
        sudo.u2fAuth = true; # U2F or password
      };
      u2f = {
        enable = true;
        settings = {
          cue = true; # Prompt: Please touch the device
          interactive = false; # Prompt: Insert your U2F device, then press ENTER.
        };
      };
    };
  };

  # Start the driver at boot
  systemd.services.fprintd = {
    wantedBy = [ "multi-user.target" ];
    serviceConfig.Type = "simple";
  };

  # Install the driver
  services.fprintd = {
    enable = true;
    tod.driver = pkgs.libfprint-2-tod1-goodix-550a; # Goodix 550a driver (from Lenovo)
  };

  # however for focaltech 2808:a658, use fprintd with overidden package (without tod)
  # services.fprintd.package = pkgs.fprintd.override {
  #   libfprint = pkgs.libfprint-focaltech-2808-a658;
  # };

  services = {
    pcscd.enable = true; # Required for Yubikey
    udev.packages = with pkgs; [ yubikey-personalization ];
  };
}