28 lines
911 B
Nix
28 lines
911 B
Nix
{ config, pkgs, ... }:
|
|
{
|
|
# Password store (gpg-backed) with pass-otp extension
|
|
programs.password-store = {
|
|
enable = true;
|
|
package = pkgs.pass.withExtensions (exts: [ exts.pass-otp ]);
|
|
settings = {
|
|
PASSWORD_STORE_DIR = "$HOME/.password-store";
|
|
PASSWORD_STORE_GIT = "ssh://git@git.iscg.dev:2222/mikl/pass.git";
|
|
PASSWORD_STORE_X_SELECTION_TIMEOUT = "5";
|
|
PASSWORD_STORE_CLIP_TIME = "45";
|
|
PASSWORD_STORE_GENERATED_LENGTH = "25";
|
|
};
|
|
};
|
|
|
|
# GPG agent settings (only for GPG/pass, NOT for SSH)
|
|
services.gpg-agent = {
|
|
enable = true;
|
|
# Require a typed passphrase for the personal store on every decrypt.
|
|
# pinentry-mac can silently retrieve it from Keychain even with TTL=0.
|
|
defaultCacheTtl = 0;
|
|
maxCacheTtl = 0;
|
|
extraConfig = ''
|
|
no-allow-external-cache
|
|
pinentry-program ${pkgs.pinentry-curses}/bin/pinentry-curses
|
|
'';
|
|
};
|
|
}
|