55 lines
1.8 KiB
Nix
55 lines
1.8 KiB
Nix
{ config, pkgs, ... }:
|
||
{
|
||
# Password store (gpg-backed)
|
||
programs.password-store = {
|
||
enable = true;
|
||
settings = {
|
||
# Default password store path
|
||
PASSWORD_STORE_DIR = "$HOME/.password-store";
|
||
PASSWORD_STORE_GIT = "git+https://git.iscg.dev/mikl/password-store.git";
|
||
PASSWORD_STORE_X_SELECTION_TIMEOUT = 5;
|
||
# extensions
|
||
extensions = [ "otp" ];
|
||
};
|
||
};
|
||
|
||
# Activation: ensure GPG key is available
|
||
# This is a best-effort setup that downloads from forgejo if needed
|
||
home.activation.passSetup = {
|
||
data = ''
|
||
# 1. Check if GPG has any keys
|
||
if ! ${pkgs.gnupg}/bin/gpg --list-secret-keys michaotic@iscg.dev >/dev/null 2>&1; then
|
||
echo "⚠️ GPG key for michaotic@iscg.dev not found."
|
||
echo ""
|
||
echo "Options:"
|
||
echo " 1. Import existing key:"
|
||
echo " gpg --import /path/to/private-key.asc"
|
||
echo ""
|
||
echo " 2. Generate new key:"
|
||
echo " gpg --full-gen-key"
|
||
echo ""
|
||
echo " 3. Clone from forgejo (if you have access):"
|
||
echo " git clone https://git.iscg.dev/mikl/gpg-secrets.git /tmp/gpg-setup"
|
||
echo " gpg --import /tmp/gpg-setup/gpg-private.asc"
|
||
echo " rm -rf /tmp/gpg-setup"
|
||
echo ""
|
||
fi
|
||
|
||
# 2. Initialize pass git remote if needed
|
||
if [ ! -d "$HOME/.password-store/.git" ] && [ -d "$HOME/.password-store" ]; then
|
||
cd "$HOME/.password-store"
|
||
${pkgs.git}/bin/git init -q
|
||
${pkgs.git}/bin/git remote add origin "https://git.iscg.dev/mikl/password-store.git" 2>/dev/null || true
|
||
cd - >/dev/null
|
||
fi
|
||
'';
|
||
};
|
||
|
||
# GPG agent settings
|
||
services.gpg-agent = {
|
||
enable = true;
|
||
defaultCacheTtl = 3600;
|
||
enableSshSupport = true;
|
||
pinentryFlavor = "default";
|
||
};
|
||
}
|