daniil-berg
e0912f568c
Idle cache 30 min -> 1 h, absolute cap 2 h -> 8 h. Both `lib.mkDefault` so an inventory can set `services.gpg-agent.defaultCacheTtl` without `mkForce`.
38 lines
1.5 KiB
Nix
38 lines
1.5 KiB
Nix
# Generic GPG tooling: agent + pinentry + XDG-relocated homedir. No keys and no
|
|
# signing identity — those are personal (→ inventory). Enabling this alone is
|
|
# harmless: a user with no key just has an idle agent.
|
|
|
|
{ config, lib, pkgs, ... }:
|
|
|
|
{
|
|
programs.gpg = {
|
|
enable = true;
|
|
# Keep GnuPG out of ~/.gnupg (XDG maxim). Secret keys are imported into this
|
|
# homedir out-of-band — mutable, NEVER in the nix store.
|
|
homedir = "${config.xdg.dataHome}/gnupg";
|
|
settings = {
|
|
no-comments = true;
|
|
keyid-format = "0xlong";
|
|
with-fingerprint = true;
|
|
};
|
|
};
|
|
|
|
services.gpg-agent = {
|
|
enable = true;
|
|
# GUI pinentry → pops on the Wayland session even when signing is triggered
|
|
# non-interactively (e.g. an agent-run `git commit`). Qt is already pulled in
|
|
# by keepassxc, so this is cheap.
|
|
pinentry.package = pkgs.pinentry-qt;
|
|
# sk-based ssh keys use the normal ssh-agent; don't let gpg-agent hijack
|
|
# SSH_AUTH_SOCK.
|
|
enableSshSupport = false;
|
|
# Idle timer, reset on every use. The hard cap runs from the unlock and
|
|
# never resets, so a machine in continuous use still re-asks once a workday —
|
|
# otherwise an unattended unlocked session signs forever.
|
|
# mkDefault so an inventory can dial these per machine with a plain
|
|
# `services.gpg-agent.defaultCacheTtl = …;` and no mkForce.
|
|
defaultCacheTtl = lib.mkDefault 3600; # 1 h idle
|
|
maxCacheTtl = lib.mkDefault 28800; # 8 h absolute
|
|
};
|
|
}
|