rework and fix some hardware key stuff

hosts/catbook-j/configuration.nix

@@ -19,6 +19,7 @@
     ./modules
   ];
   jade = {
+    hwKey.pamAuth.enable = true;
     desktop = {
       dm.autoLogin = {
         enable = true;

modules/hardware/hardware_key.nix

@@ -1,4 +1,16 @@
-{pkgs, ...}: {
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: let
+  cfg = config.jade.hwKey;
+in
+  with lib; {
+    options.jade.hwKey = {
+      pamAuth.enable = mkEnableOption "Enable PAM authentication with hardware keys";
+    };
+    config = {
       # nitrokey
       services.udev.packages = [pkgs.nitrokey-udev-rules];
 
@@ -7,14 +19,17 @@
 
       # authenticate using hw key
       security.pam = {
-    services.jade.u2fAuth = true;
+        services.jade.u2fAuth = cfg.pamAuth.enable;
         u2f = {
           enable = true;
-      cue = true;
           control = "sufficient";
+          settings = {
+            cue = true;
             authFile = "/home/jade/.ssh/u2f_keys";
           };
         };
+      };
 
       programs.i3lock.u2fSupport = true;
+    };
   }