54 lines
1.8 KiB
Nix
54 lines
1.8 KiB
Nix
{ config, pkgs, ... }:
|
|
{
|
|
# Password store (gpg-backed) with pass-otp extension
|
|
programs.password-store = {
|
|
enable = true;
|
|
package = pkgs.pass.withExtensions (exts: [ exts.pass-otp ]);
|
|
settings = {
|
|
PASSWORD_STORE_DIR = "$HOME/.password-store";
|
|
PASSWORD_STORE_GIT = "git+https://git.iscg.dev/mikl/password-store.git";
|
|
PASSWORD_STORE_X_SELECTION_TIMEOUT = "5";
|
|
PASSWORD_STORE_CLIP_TIME = "45";
|
|
PASSWORD_STORE_GENERATED_LENGTH = "25";
|
|
};
|
|
};
|
|
|
|
# Activation: ensure GPG key is available
|
|
# This is a best-effort setup that downloads from forgejo if needed
|
|
home.activation.passSetup = {
|
|
data = ''
|
|
# 1. Check if GPG has any keys
|
|
if ! gpg --list-secret-keys mikl@iscg.dev >/dev/null 2>&1; then
|
|
echo "WARNING: GPG key for mikl@iscg.dev not found."
|
|
echo ""
|
|
echo "Options:"
|
|
echo " 1. Import existing key:"
|
|
echo " gpg --import /path/to/private-key.asc"
|
|
echo ""
|
|
echo " 2. Generate new key:"
|
|
echo " gpg --full-gen-key"
|
|
echo ""
|
|
echo " 3. Clone from forgejo (if you have access):"
|
|
echo " git clone https://git.iscg.dev/mikl/gpg-secrets.git /tmp/gpg-setup"
|
|
echo " gpg --import /tmp/gpg-setup/gpg-private.asc"
|
|
echo " rm -rf /tmp/gpg-setup"
|
|
echo ""
|
|
fi
|
|
|
|
# 2. Initialize pass git remote if needed
|
|
if [ ! -d "$HOME/.password-store/.git" ] && [ -d "$HOME/.password-store" ]; then
|
|
cd "$HOME/.password-store"
|
|
git init -q
|
|
git remote add origin "https://git.iscg.dev/mikl/password-store.git" 2>/dev/null || true
|
|
cd - >/dev/null
|
|
fi
|
|
'';
|
|
};
|
|
|
|
# GPG agent settings
|
|
services.gpg-agent = {
|
|
enable = true;
|
|
defaultCacheTtl = 3600;
|
|
enableSshSupport = true;
|
|
};
|
|
}
|