66 lines
1.9 KiB
Nix
66 lines
1.9 KiB
Nix
{ user ? throw "user argument is required" }: { config, lib, pkgs, ... }:
|
|
|
|
let
|
|
hmConfig = config.home-manager.users."${user.name}";
|
|
gpgPath = "${hmConfig.xdg.dataHome}/gnupg";
|
|
in
|
|
{
|
|
home-manager.users."${user.name}" = {
|
|
programs.gpg = {
|
|
enable = true;
|
|
homedir = gpgPath;
|
|
};
|
|
|
|
services.gpg-agent = {
|
|
enable = true;
|
|
defaultCacheTtl = 31536000;
|
|
maxCacheTtl = 31536000;
|
|
};
|
|
|
|
systemd.user = {
|
|
services.gpg-agent-import = let
|
|
init = pkgs.writeShellScriptBin "import-gpg-keys" ''
|
|
export GNUPGHOME=${gpgPath}
|
|
|
|
for keyfile in "${user.home}"/.config/sops-nix/secrets/gpg-agent/*.key; do
|
|
passfile="''${keyfile%.key}.pass"
|
|
|
|
if [ -f "$passfile" ]; then
|
|
${pkgs.gnupg}/bin/gpg2 --batch --yes --pinentry-mode loopback --passphrase-file "$passfile" --import "$keyfile"
|
|
else
|
|
${pkgs.gnupg}/bin/gpg2 --batch --yes --import "$keyfile"
|
|
fi
|
|
|
|
${pkgs.gnupg}/bin/gpg2 --with-colons --import-options show-only --import "$keyfile" | grep '^fpr' | cut -d: -f10 | while read -r KEY_ID; do
|
|
echo "$KEY_ID:6:" >> "${gpgPath}"/otrust.txt
|
|
done
|
|
done
|
|
|
|
${pkgs.gnupg}/bin/gpg2 --import-ownertrust "${gpgPath}"/otrust.txt
|
|
rm "${gpgPath}"/otrust.txt
|
|
'';
|
|
in {
|
|
Unit = {
|
|
Description = "Auto-import GPG keys";
|
|
Requires = [ "sops-nix.service" "gpg-agent.socket" ];
|
|
After = [ "sops-nix.service" "gpg-agent.socket" ];
|
|
};
|
|
|
|
Service = {
|
|
Type = "oneshot";
|
|
ExecStart = "${init}/bin/import-gpg-keys";
|
|
};
|
|
|
|
Install = { WantedBy = [ "default.target" ]; };
|
|
};
|
|
|
|
tmpfiles.rules = [ "d ${hmConfig.xdg.dataHome}/gnupg 0700 ${user.name} users -" ];
|
|
};
|
|
|
|
sops.secrets = {
|
|
"gpg-agent/pgp.key" = { };
|
|
"gpg-agent/pgp.pass" = { };
|
|
};
|
|
};
|
|
}
|