Add yubilock quirk and enable kubo service

hosts/fenixpc/default.nix

@@ -15,6 +15,7 @@ in
     quirks [
       "development"
       "steam"
+      "yubilock"
     ]
   );
 
@@ -47,6 +48,7 @@ in
     };
     lact.enable = true;
   };
+
   systemd.services.calibre-web.serviceConfig.environment = lib.mkForce "";
   systemd.services.calibre-web.environment.CACHE_DIR = "/var/cache/calibre-web";
 
@@ -74,6 +76,7 @@ in
         "audio"
         "users"
         "gamemode"
+        config.services.kubo.group
       ];
     });
     groups = {

quirks/yubilock.nix

@@ -0,0 +1,11 @@
+{ pkgs, ... }:
+{
+  services.udev.extraRules = ''
+    ACTION=="remove",\
+    ENV{ID_BUS}=="usb",\
+    ENV{ID_MODEL_ID}=="0407",\
+    ENV{ID_VENDOR_ID}=="1050",\
+    ENV{ID_VENDOR}=="Yubico",\
+    RUN+="${pkgs.systemd}/bin/loginctl lock-sessions"
+  '';
+}

roles/default.nix

@@ -39,6 +39,11 @@
   };
 
   services = {
+    kubo = {
+      enable = lib.mkDefault true;
+      enableGC = lib.mkDefault true;
+    };
+
     openssh = {
       enable = lib.mkDefault true;
       settings = {