77 lines
1.6 KiB
Nix
77 lines
1.6 KiB
Nix
{
|
|
username ? throw "username argument is required",
|
|
}:
|
|
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
userConfig = config.users.users.${username};
|
|
hmConfig = config.home-manager.users.${username};
|
|
gpgPath = "${hmConfig.xdg.dataHome}/gnupg";
|
|
in
|
|
{
|
|
home-manager.users.${username} = {
|
|
programs.gpg = {
|
|
enable = true;
|
|
homedir = gpgPath;
|
|
};
|
|
|
|
services.gpg-agent = {
|
|
enable = true;
|
|
defaultCacheTtl = 31536000;
|
|
maxCacheTtl = 31536000;
|
|
};
|
|
|
|
systemd.user = {
|
|
services.gpg-agent-import =
|
|
let
|
|
init = lib.meta.getExe (
|
|
pkgs.writeShellApplication {
|
|
name = "import-gpg-keys";
|
|
runtimeInputs = with pkgs; [
|
|
coreutils
|
|
gnugrep
|
|
gnupg
|
|
];
|
|
runtimeEnv = {
|
|
GNUPGHOME = gpgPath;
|
|
HOME = userConfig.home;
|
|
};
|
|
text = builtins.readFile ./import-gpg-keys.sh;
|
|
}
|
|
);
|
|
in
|
|
{
|
|
Unit = {
|
|
Description = "Auto-import GPG keys";
|
|
Requires = [
|
|
"sops-nix.service"
|
|
"gpg-agent.socket"
|
|
];
|
|
After = [
|
|
"sops-nix.service"
|
|
"gpg-agent.socket"
|
|
];
|
|
};
|
|
|
|
Service = {
|
|
Type = "oneshot";
|
|
ExecStart = init;
|
|
};
|
|
|
|
Install.WantedBy = [ "default.target" ];
|
|
};
|
|
|
|
tmpfiles.rules = [ "d ${gpgPath} 0700 ${username} users -" ];
|
|
};
|
|
|
|
sops.secrets = {
|
|
"gpg-agent/pgp.key" = { };
|
|
"gpg-agent/pgp.pass" = { };
|
|
};
|
|
};
|
|
}
|