From e0912f568c818434e4a206de2e5ab4b2148ddd58 Mon Sep 17 00:00:00 2001
From: Daniel Fainberg <mail@daniel.fainberg.net>
Date: Fri, 18 Sep 2026 14:39:15 +0200
Subject: [PATCH] feat(gpg): raise agent cache TTLs and make them overridable

Idle cache 30 min -> 1 h, absolute cap 2 h -> 8 h. Both `lib.mkDefault` so an
inventory can set `services.gpg-agent.defaultCacheTtl` without `mkForce`.
---
 modules/gpg.nix | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/modules/gpg.nix b/modules/gpg.nix
index 9debde5..ec476bc 100644
--- a/modules/gpg.nix
+++ b/modules/gpg.nix
@@ -2,7 +2,7 @@
 # signing identity — those are personal (→ inventory). Enabling this alone is
 # harmless: a user with no key just has an idle agent.
 
-{ config, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 
 {
   programs.gpg = {
@@ -26,7 +26,12 @@
     # sk-based ssh keys use the normal ssh-agent; don't let gpg-agent hijack
     # SSH_AUTH_SOCK.
     enableSshSupport = false;
-    defaultCacheTtl = 1800;   # 30 min
-    maxCacheTtl = 7200;       # 2 h
+    # Idle timer, reset on every use. The hard cap runs from the unlock and
+    # never resets, so a machine in continuous use still re-asks once a workday —
+    # otherwise an unattended unlocked session signs forever.
+    # mkDefault so an inventory can dial these per machine with a plain
+    # `services.gpg-agent.defaultCacheTtl = …;` and no mkForce.
+    defaultCacheTtl = lib.mkDefault 3600;   # 1 h idle
+    maxCacheTtl = lib.mkDefault 28800;      # 8 h absolute
   };
 }