From 7345251aadc69fe06ac7ebe1953372c68225038f Mon Sep 17 00:00:00 2001
From: mikl <mikl@iscg.dev>
Date: Tue, 29 Sep 2026 02:07:15 +0300
Subject: [PATCH] fix(poppy): use terminal pinentry for personal pass store

---
 home/pass.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/home/pass.nix b/home/pass.nix
index 40bf8b0..6ff2f37 100644
--- a/home/pass.nix
+++ b/home/pass.nix
@@ -16,9 +16,13 @@
   # GPG agent settings (only for GPG/pass, NOT for SSH)
   services.gpg-agent = {
     enable = true;
-    # Neither gpg-agent nor pinentry-mac/Keychain may cache passphrases.
+    # Require a typed passphrase for the personal store on every decrypt.
+    # pinentry-mac can silently retrieve it from Keychain even with TTL=0.
     defaultCacheTtl = 0;
     maxCacheTtl = 0;
-    extraConfig = "no-allow-external-cache";
+    extraConfig = ''
+      no-allow-external-cache
+      pinentry-program ${pkgs.pinentry-curses}/bin/pinentry-curses
+    '';
   };
 }