# Generic GPG tooling: agent + pinentry + XDG-relocated homedir. No keys and no
# signing identity — those are personal (→ inventory). Enabling this alone is
# harmless: a user with no key just has an idle agent.

{ config, lib, pkgs, ... }:

{
  programs.gpg = {
    enable = true;
    # Keep GnuPG out of ~/.gnupg (XDG maxim). Secret keys are imported into this
    # homedir out-of-band — mutable, NEVER in the nix store.
    homedir = "${config.xdg.dataHome}/gnupg";
    settings = {
      no-comments = true;
      keyid-format = "0xlong";
      with-fingerprint = true;
    };
  };

  services.gpg-agent = {
    enable = true;
    # GUI pinentry → pops on the Wayland session even when signing is triggered
    # non-interactively (e.g. an agent-run `git commit`). Qt is already pulled in
    # by keepassxc, so this is cheap.
    pinentry.package = pkgs.pinentry-qt;
    # sk-based ssh keys use the normal ssh-agent; don't let gpg-agent hijack
    # SSH_AUTH_SOCK.
    enableSshSupport = false;
    # Idle timer, reset on every use. The hard cap runs from the unlock and
    # never resets, so a machine in continuous use still re-asks once a workday —
    # otherwise an unattended unlocked session signs forever.
    # mkDefault so an inventory can dial these per machine with a plain
    # `services.gpg-agent.defaultCacheTtl = …;` and no mkForce.
    defaultCacheTtl = lib.mkDefault 3600;   # 1 h idle
    maxCacheTtl = lib.mkDefault 28800;      # 8 h absolute
  };
}