{ config, pkgs, ... }:
{
  # Password store (gpg-backed) with pass-otp extension
  programs.password-store = {
    enable = true;
    package = pkgs.pass.withExtensions (exts: [ exts.pass-otp ]);
    settings = {
      PASSWORD_STORE_DIR = "$HOME/.password-store";
      PASSWORD_STORE_GIT = "ssh://git@git.iscg.dev:2222/mikl/pass.git";
      PASSWORD_STORE_X_SELECTION_TIMEOUT = "5";
      PASSWORD_STORE_CLIP_TIME = "45";
      PASSWORD_STORE_GENERATED_LENGTH = "25";
    };
  };

  # GPG agent settings (only for GPG/pass, NOT for SSH)
  services.gpg-agent = {
    enable = true;
    # Neither gpg-agent nor pinentry-mac/Keychain may cache passphrases.
    defaultCacheTtl = 0;
    maxCacheTtl = 0;
    extraConfig = "no-allow-external-cache";
  };
}