{ config, pkgs, ... }:
{
  # Password store (gpg-backed) with pass-otp extension
  programs.password-store = {
    enable = true;
    package = pkgs.pass.withExtensions (exts: [ exts.pass-otp ]);
    settings = {
      PASSWORD_STORE_DIR = "$HOME/.password-store";
      PASSWORD_STORE_GIT = "ssh://git@git.iscg.dev:2222/mikl/password-store.git";
      PASSWORD_STORE_X_SELECTION_TIMEOUT = "5";
      PASSWORD_STORE_CLIP_TIME = "45";
      PASSWORD_STORE_GENERATED_LENGTH = "25";
    };
  };

  # GPG agent settings
  services.gpg-agent = {
    enable = true;
    defaultCacheTtl = 3600;
    enableSshSupport = true;
  };

  # Activation: setup pass git origins (forgejo + github + sol.moe)
  # Uses pkgs.writeShellScript to avoid home.activation.data string issues
  home.activation.passOrigins = {
    data = let
      setupScript = pkgs.writeShellScript "pass-origins-setup" ''
        set -e
        
        # Initialize pass if not yet
        if [ ! -d "$HOME/.password-store" ]; then
          echo "Initializing pass store..."
          mkdir -p "$HOME/.password-store"
        fi
        
        # Initialize git if not yet
        if [ ! -d "$HOME/.password-store/.git" ]; then
          cd "$HOME/.password-store"
          ${pkgs.git}/bin/git init -q
        fi
        
        cd "$HOME/.password-store"
        
        # Add origin (forgejo) if not present
        if ! ${pkgs.git}/bin/git remote get-url origin >/dev/null 2>&1; then
          ${pkgs.git}/bin/git remote add origin "ssh://git@git.iscg.dev:2222/mikl/password-store.git"
        fi
        
        # Add github remote if not present
        if ! ${pkgs.git}/bin/git remote get-url github >/dev/null 2>&1; then
          ${pkgs.git}/bin/git remote add github "git@github.com:isogonalconjugate/password-store.git"
        fi
        
        # Add git.sol.moe remote if not present
        if ! ${pkgs.git}/bin/git remote get-url git.sol.moe >/dev/null 2>&1; then
          ${pkgs.git}/bin/git remote add "git.sol.moe" "git@git.sol.moe:mikl/password-store.git"
        fi
        
        cd - >/dev/null
      '';
    in builtins.toFile "pass-origins.sh" ''
      ${setupScript}
    '';
  };
}