karaolidis/nix
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Modularize code

Browse Source 
Signed-off-by: Nikolaos Karaolidis <nick@karaolidis.com>
This commit is contained in:
Nick Karaolidis
2024-06-20 11:42:31 +03:00
parent 4e4fb9c86c
commit ea01ac7fe0
17 changed files with 440 additions and 374 deletions
Download Patch File Download Diff File Expand all files Collapse all files

75
users/common/configs/gpg-agent/default.nix
View File

@@ -1,43 +1,52 @@
{ pkgs, ... }:
{ config, lib, pkgs, ... }:
{
services.gpg-agent = {
enable = true;
defaultCacheTtl = 31536000;
maxCacheTtl = 31536000;
};
home-manager = {
sharedModules = [{
services.gpg-agent = {
enable = true;
defaultCacheTtl = 31536000;
maxCacheTtl = 31536000;
};
systemd.user.services.gpg-agent-import = {
Unit = {
Description = "Auto-import GPG keys";
Requires = [ "sops-nix.service" "gpg-agent.socket" ];
After = [ "sops-nix.service" "gpg-agent.socket" ];
};
systemd.user.services.gpg-agent-import = let
init = pkgs.writeShellScriptBin "import-gpg-keys" ''
for keyfile in "$HOME"/.config/sops-nix/secrets/gpg-agent/*.key; do
passfile="''${keyfile%.key}.pass"
Service = {
Type = "oneshot";
ExecStart = pkgs.writeScript "import-gpg-keys" ''
#!${pkgs.runtimeShell}
if [ -f "$passfile" ]; then
gpg --batch --yes --pinentry-mode loopback --passphrase-file "$passfile" --import "$keyfile"
else
gpg --batch --yes --import "$keyfile"
fi
for keyfile in "$HOME"/.config/sops-nix/secrets/gpg-agent/*.key; do
passfile="''${keyfile%.key}.pass"
if [ -f "$passfile" ]; then
gpg --batch --yes --pinentry-mode loopback --passphrase-file "$passfile" --import "$keyfile"
else
gpg --batch --yes --import "$keyfile"
fi
gpg --with-colons --import-options show-only --import "$keyfile" | grep '^fpr' | cut -d: -f10 | while read -r KEY_ID; do
echo "$KEY_ID:6:" >> "$HOME"/.gnupg/otrust.txt
gpg --with-colons --import-options show-only --import "$keyfile" | grep '^fpr' | cut -d: -f10 | while read -r KEY_ID; do
echo "$KEY_ID:6:" >> "$HOME"/.gnupg/otrust.txt
done
done
done
gpg --import-ownertrust "$HOME"/.gnupg/otrust.txt
rm "$HOME"/.gnupg/otrust.txt
'';
};
gpg --import-ownertrust "$HOME"/.gnupg/otrust.txt
rm "$HOME"/.gnupg/otrust.txt
'';
in
{
Unit = {
Description = "Auto-import GPG keys";
Requires = [ "sops-nix.service" "gpg-agent.socket" ];
After = [ "sops-nix.service" "gpg-agent.socket" ];
};
Install = { WantedBy = [ "default.target" ]; };
Service = {
Type = "oneshot";
ExecStart = "${init}/bin/import-gpg-keys";
};
Install = { WantedBy = [ "default.target" ]; };
};
}];
users = lib.attrsets.mapAttrs (user: config: ({
systemd.user.tmpfiles.rules = [ "d ${config.home}/.gnupg 0700 ${user} users -" ];
})) (lib.attrsets.filterAttrs (name: config: config.isNormalUser) config.users.users);
};
}