Add to your configuration.nix

security.pam.services.<user>.googleAuthenticator.enable = true; security.pam.services.gdm-password.text = '' auth required ${pkgs.google-authenticator}/lib/security/pam_google_authenticator.so '';

Then do a

nixos-rebuild switch

And from the user shell

google-authenticator