{ pkgs, ... }:

{
  services.gpg-agent = {
    enable = true;
    defaultCacheTtl = 31536000;
    maxCacheTtl = 31536000;
  };

  systemd.user.services.gpg-agent-import = {
    Unit = {
      Description = "Auto-import GPG keys";
      After = [ "gpg-agent.socket" "sops-nix.service" ];
    };

    Service = {
      Type = "oneshot";
      ExecStart = pkgs.writeScript "import-gpg-keys" ''
        #!${pkgs.runtimeShell}

        find "$HOME"/.gnupg -type f -exec chmod 600 {} \;
        find "$HOME"/.gnupg -type d -exec chmod 700 {} \;

        for keyfile in "$HOME"/.config/sops-nix/secrets/gpg-agent/*.key; do
          passfile="''${keyfile%.key}.pass"

          if [ -f "$passfile" ]; then
            gpg --batch --yes --pinentry-mode loopback --passphrase-file "$passfile" --import "$keyfile"
          else
            gpg --batch --yes --import "$keyfile"
          fi

          gpg --with-colons --import-options show-only --import "$keyfile" | grep '^fpr' | cut -d: -f10 | while read -r KEY_ID; do
            echo "$KEY_ID:6:" >> "$HOME"/.gnupg/otrust.txt
          done
        done

        gpg --import-ownertrust "$HOME"/.gnupg/otrust.txt
        rm "$HOME"/.gnupg/otrust.txt
      '';
    };

    Install = { WantedBy = [ "default.target" ]; };
  };
}