{ config, lib, pkgs, ... }:

{
  home-manager = {
    sharedModules = [{
      services.gpg-agent = {
        enable = true;
        defaultCacheTtl = 31536000;
        maxCacheTtl = 31536000;
      };

      systemd.user.services.gpg-agent-import = let
        init = pkgs.writeShellScriptBin "import-gpg-keys" ''
          for keyfile in "$HOME"/.config/sops-nix/secrets/gpg-agent/*.key; do
            passfile="''${keyfile%.key}.pass"

            if [ -f "$passfile" ]; then
              gpg --batch --yes --pinentry-mode loopback --passphrase-file "$passfile" --import "$keyfile"
            else
              gpg --batch --yes --import "$keyfile"
            fi

            gpg --with-colons --import-options show-only --import "$keyfile" | grep '^fpr' | cut -d: -f10 | while read -r KEY_ID; do
              echo "$KEY_ID:6:" >> "$HOME"/.gnupg/otrust.txt
            done
          done

          gpg --import-ownertrust "$HOME"/.gnupg/otrust.txt
          rm "$HOME"/.gnupg/otrust.txt
        '';
      in
      {
        Unit = {
          Description = "Auto-import GPG keys";
          Requires = [ "sops-nix.service" "gpg-agent.socket" ];
          After = [ "sops-nix.service" "gpg-agent.socket" ];
        };

        Service = {
          Type = "oneshot";
          ExecStart = "${init}/bin/import-gpg-keys";
        };

        Install = { WantedBy = [ "default.target" ]; };
      };
    }];

    users = lib.attrsets.mapAttrs (user: config: ({
      systemd.user.tmpfiles.rules = [ "d ${config.home}/.gnupg 0700 ${user} users -" ];
    })) (lib.attrsets.filterAttrs (name: config: config.isNormalUser) config.users.users);
  };
}