{pkgs, ...}: {
  # nitrokey
  services.udev.packages = [pkgs.nitrokey-udev-rules];

  # smartcard daemon
  services.pcscd.enable = true;

  # authenticate using hw key
  security.pam = {
    services.jade.u2fAuth = true;
    u2f = {
      enable = true;
      cue = true;
      control = "sufficient";
      authFile = "/home/jade/.ssh/u2f_keys";
    };
  };

  programs.i3lock.u2fSupport = true;
}