{ user ? throw "user argument is required" }: { config, lib, pkgs, ... }:

let
  hmConfig = config.home-manager.users."${user.name}";
  gpgPath = "${hmConfig.xdg.dataHome}/gnupg";
in
{
  home-manager.users."${user.name}" = {
    programs.gpg = {
      enable = true;
      homedir = gpgPath;
    };

    services.gpg-agent = {
      enable = true;
      defaultCacheTtl = 31536000;
      maxCacheTtl = 31536000;
    };

    systemd.user = {
      services.gpg-agent-import = let
        init = pkgs.writeShellScriptBin "import-gpg-keys" ''
          export GNUPGHOME=${gpgPath}

          for keyfile in "${user.home}"/.config/sops-nix/secrets/gpg-agent/*.key; do
            passfile="''${keyfile%.key}.pass"

            if [ -f "$passfile" ]; then
              ${pkgs.gnupg}/bin/gpg2 --batch --yes --pinentry-mode loopback --passphrase-file "$passfile" --import "$keyfile"
            else
              ${pkgs.gnupg}/bin/gpg2 --batch --yes --import "$keyfile"
            fi

            ${pkgs.gnupg}/bin/gpg2 --with-colons --import-options show-only --import "$keyfile" | grep '^fpr' | cut -d: -f10 | while read -r KEY_ID; do
              echo "$KEY_ID:6:" >> "${gpgPath}"/otrust.txt
            done
          done

          ${pkgs.gnupg}/bin/gpg2 --import-ownertrust "${gpgPath}"/otrust.txt
          rm "${gpgPath}"/otrust.txt
        '';
      in {
        Unit = {
          Description = "Auto-import GPG keys";
          Requires = [ "sops-nix.service" "gpg-agent.socket" ];
          After = [ "sops-nix.service" "gpg-agent.socket" ];
        };

        Service = {
          Type = "oneshot";
          ExecStart = "${init}/bin/import-gpg-keys";
        };

        Install = { WantedBy = [ "default.target" ]; };
      };

      tmpfiles.rules = [ "d ${hmConfig.xdg.dataHome}/gnupg 0700 ${user.name} users -" ];
    };

    sops.secrets = {
      "gpg-agent/pgp.key" = { };
      "gpg-agent/pgp.pass" = { };
    };
  };
}