{ user ? throw "user argument is required" }: { pkgs, ... }:

{
  home-manager.users."${user.name}" = {
    services.gpg-agent = {
      enable = true;
      defaultCacheTtl = 31536000;
      maxCacheTtl = 31536000;
    };

    systemd.user = {
      services.gpg-agent-import = let
        init = pkgs.writeShellScriptBin "import-gpg-keys" ''
          for keyfile in "${user.home}"/.config/sops-nix/secrets/gpg-agent/*.key; do
            passfile="''${keyfile%.key}.pass"

            if [ -f "$passfile" ]; then
              gpg --batch --yes --pinentry-mode loopback --passphrase-file "$passfile" --import "$keyfile"
            else
              gpg --batch --yes --import "$keyfile"
            fi

            gpg --with-colons --import-options show-only --import "$keyfile" | grep '^fpr' | cut -d: -f10 | while read -r KEY_ID; do
              echo "$KEY_ID:6:" >> "${user.home}"/.gnupg/otrust.txt
            done
          done

          gpg --import-ownertrust "${user.home}"/.gnupg/otrust.txt
          rm "${user.home}"/.gnupg/otrust.txt
        '';
      in {
        Unit = {
          Description = "Auto-import GPG keys";
          Requires = [ "sops-nix.service" "gpg-agent.socket" ];
          After = [ "sops-nix.service" "gpg-agent.socket" ];
        };

        Service = {
          Type = "oneshot";
          ExecStart = "${init}/bin/import-gpg-keys";
        };

        Install = { WantedBy = [ "default.target" ]; };
      };

      tmpfiles.rules = [ "d ${user.home}/.gnupg 0700 ${user.name} users -" ];
    };
  };
}