modules/security.nix

{
  security.pam.services = {
    login.u2fAuth = true;
    sudo.u2fAuth = true;
  };

  security.pam.u2f.authFile = ../keys/u2f_mappings;
}