# Generic GPG tooling: agent + pinentry + XDG-relocated homedir. No keys and no
# signing identity — those are personal (→ inventory). Enabling this alone is
# harmless: a user with no key just has an idle agent.

{ config, pkgs, ... }:

{
  programs.gpg = {
    enable = true;
    # Keep GnuPG out of ~/.gnupg (XDG maxim). Secret keys are imported into this
    # homedir out-of-band — mutable, NEVER in the nix store.
    homedir = "${config.xdg.dataHome}/gnupg";
    settings = {
      no-comments = true;
      keyid-format = "0xlong";
      with-fingerprint = true;
    };
  };

  services.gpg-agent = {
    enable = true;
    # GUI pinentry → pops on the Wayland session even when signing is triggered
    # non-interactively (e.g. an agent-run `git commit`). Qt is already pulled in
    # by keepassxc, so this is cheap.
    pinentry.package = pkgs.pinentry-qt;
    # sk-based ssh keys use the normal ssh-agent; don't let gpg-agent hijack
    # SSH_AUTH_SOCK.
    enableSshSupport = false;
    defaultCacheTtl = 1800;   # 30 min
    maxCacheTtl = 7200;       # 2 h
  };
}