33 lines
1.1 KiB
Nix
33 lines
1.1 KiB
Nix
# Generic GPG tooling: agent + pinentry + XDG-relocated homedir. No keys and no
|
|
# signing identity — those are personal (→ inventory). Enabling this alone is
|
|
# harmless: a user with no key just has an idle agent.
|
|
|
|
{ config, pkgs, ... }:
|
|
|
|
{
|
|
programs.gpg = {
|
|
enable = true;
|
|
# Keep GnuPG out of ~/.gnupg (XDG maxim). Secret keys are imported into this
|
|
# homedir out-of-band — mutable, NEVER in the nix store.
|
|
homedir = "${config.xdg.dataHome}/gnupg";
|
|
settings = {
|
|
no-comments = true;
|
|
keyid-format = "0xlong";
|
|
with-fingerprint = true;
|
|
};
|
|
};
|
|
|
|
services.gpg-agent = {
|
|
enable = true;
|
|
# GUI pinentry → pops on the Wayland session even when signing is triggered
|
|
# non-interactively (e.g. an agent-run `git commit`). Qt is already pulled in
|
|
# by keepassxc, so this is cheap.
|
|
pinentry.package = pkgs.pinentry-qt;
|
|
# sk-based ssh keys use the normal ssh-agent; don't let gpg-agent hijack
|
|
# SSH_AUTH_SOCK.
|
|
enableSshSupport = false;
|
|
defaultCacheTtl = 1800; # 30 min
|
|
maxCacheTtl = 7200; # 2 h
|
|
};
|
|
}
|