{ config, pkgs, ... }:
{
  # Password store (gpg-backed) with pass-otp extension
  programs.password-store = {
    enable = true;
    package = pkgs.pass.withExtensions (exts: [ exts.pass-otp ]);
    settings = {
      PASSWORD_STORE_DIR = "$HOME/.password-store";
      PASSWORD_STORE_GIT = "git+https://git.iscg.dev/mikl/password-store.git";
      PASSWORD_STORE_X_SELECTION_TIMEOUT = "5";
      PASSWORD_STORE_CLIP_TIME = "45";
      PASSWORD_STORE_GENERATED_LENGTH = "25";
    };
  };

  # Activation: ensure GPG key is available
  # TODO: figure out why home.activation.data fails with multi-line strings
  # For now, run pass setup manually after first activation


  # GPG agent settings
  services.gpg-agent = {
    enable = true;
    defaultCacheTtl = 3600;
    enableSshSupport = true;
  };
}