{ config, pkgs, ... }:
{
  # Password store (gpg-backed)
  programs.password-store = {
    enable = true;
    settings = {
      # Default password store path
      PASSWORD_STORE_DIR = "$HOME/.password-store";
      PASSWORD_STORE_GIT = "git+https://git.iscg.dev/mikl/password-store.git";
      PASSWORD_STORE_X_SELECTION_TIMEOUT = 5;
      PASSWORD_STORE_CLIP_TIME = 45;
      # extensions
      extensions = [ "otp" ];
    };
  };

  # Activation: ensure GPG key is available
  # This is a best-effort setup that downloads from forgejo if needed
  home.activation.passSetup = {
    data = ''
      # 1. Check if GPG has any keys
      if ! ${pkgs.gnupg}/bin/gpg --list-secret-keys michaotic@iscg.dev >/dev/null 2>&1; then
        echo "⚠️  GPG key for michaotic@iscg.dev not found."
        echo ""
        echo "Options:"
        echo "  1. Import existing key:"
        echo "     gpg --import /path/to/private-key.asc"
        echo ""
        echo "  2. Generate new key:"
        echo "     gpg --full-gen-key"
        echo ""
        echo "  3. Clone from forgejo (if you have access):"
        echo "     git clone https://git.iscg.dev/mikl/gpg-secrets.git /tmp/gpg-setup"
        echo "     gpg --import /tmp/gpg-setup/gpg-private.asc"
        echo "     rm -rf /tmp/gpg-setup"
        echo ""
      fi
      
      # 2. Initialize pass git remote if needed
      if [ ! -d "$HOME/.password-store/.git" ] && [ -d "$HOME/.password-store" ]; then
        cd "$HOME/.password-store"
        ${pkgs.git}/bin/git init -q
        ${pkgs.git}/bin/git remote add origin "https://git.iscg.dev/mikl/password-store.git" 2>/dev/null || true
        cd - >/dev/null
      fi
    '';
  };

  # GPG agent settings
  services.gpg-agent = {
    enable = true;
    defaultCacheTtl = 3600;
    enableSshSupport = true;
  };
}