feature(gpg): add more signing-keys to the config to enable my laptop as well

Reviewed-on: #73

flake.lock

@@ -8,11 +8,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1782949081,
+        "lastModified": 1787559586,
-        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
+        "narHash": "sha256-onL0VLf9vPllmT0H/OlURIU5r5t5WIEl7t4tVNKT0Nw=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
+        "rev": "9d0d87172c374f89da73c1cfe6d81ae62feac1f1",
         "type": "github"
       },
       "original": {
@@ -28,11 +28,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784546264,
+        "lastModified": 1787797243,
-        "narHash": "sha256-jxVr5EHMYAOkFvS2k0abIvt6NqyshyWmiHHzV17sT2g=",
+        "narHash": "sha256-8+Q7NOB7RPajRjA4pbCDLzqH+MTjnG9x6LUPLfL2joA=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "e3dea8e4792b09a6c0eb5836b0284ad05b1acba0",
+        "rev": "99c9ec63390f1d8c14d95d9e8b17cc29cfbd4e11",
         "type": "github"
       },
       "original": {
@@ -43,11 +43,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1784497964,
+        "lastModified": 1787900134,
-        "narHash": "sha256-vlHUuqAcbcH2RKmHbPiuQzbv1pnzzavXnI62RD0bqCU=",
+        "narHash": "sha256-VYXO0XZlgj06dxJZRhrD3WoSsvq/c7+/Akyoa22pefw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "241313f4e8e508cb9b13278c2b0fa25b9ca27163",
+        "rev": "83199d0d373dd3ac2b9a1996b1d0263f76ab7a4c",
         "type": "github"
       },
       "original": {
@@ -66,11 +66,11 @@
         "systems": "systems"
       },
       "locked": {
-        "lastModified": 1784057377,
+        "lastModified": 1787862710,
-        "narHash": "sha256-yycNej5//EsRbV10moBoh+/63vXEwZD1ZFEiRm6C9rQ=",
+        "narHash": "sha256-dL1Tv7LekaTWUJxHRckjbupWczDdc3QOgRuVCM+WAvQ=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "07180a087e4a00720dc0731cbcd8dec796974381",
+        "rev": "8c096abcf376137527c134da4ee210332b08ccc0",
         "type": "github"
       },
       "original": {
@@ -86,11 +86,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1784556533,
+        "lastModified": 1788099672,
-        "narHash": "sha256-tlcP2x7d+ldS3BypTcInqrsOhi6BPuSSTeubfBMmm8Y=",
+        "narHash": "sha256-t4Rw5OeULK/WA2Jh9ja615sCs2AmvahkAUx/ymdf2YQ=",
         "owner": "noctalia-dev",
         "repo": "noctalia-shell",
-        "rev": "815635cf7dc810616c9e6ecf4b9b4f4c54e69905",
+        "rev": "d891007c022a3a1d4484495fe8b350a00deafae9",
         "type": "github"
       },
       "original": {
@@ -108,6 +108,7 @@
       }
     },
     "systems": {
+      "flake": false,
       "locked": {
         "lastModified": 1774449309,
         "narHash": "sha256-brhZ8DmuGtzkCYHJg4HEd602amKm89Y9ytsFZ5uWD1w=",

hosts/argon/configuration.nix

@@ -2,6 +2,7 @@
 
 {
   imports = [
+    ../../modules/nixos/appimage.nix
     ../../modules/nixos/astro.nix
     ../../modules/nixos/audio.nix
     ../../modules/nixos/bootloader.nix
@@ -25,6 +26,7 @@
     ../../modules/nixos/steam.nix
     ../../modules/nixos/thunar.nix
     ../../modules/nixos/users.nix
+    ../../modules/nixos/vial.nix
   ];
 
   # set hostname

hosts/neon/configuration.nix

@@ -2,6 +2,7 @@
 
 {
   imports = [
+    ../../modules/nixos/appimage.nix
     ../../modules/nixos/astro.nix
     ../../modules/nixos/audio.nix
     ../../modules/nixos/bootloader.nix
@@ -21,6 +22,7 @@
     ../../modules/nixos/settings.nix
     ../../modules/nixos/steam.nix
     ../../modules/nixos/users.nix
+    ../../modules/nixos/vial.nix
   ];
 
   # set hostname

modules/home-manager/git.nix

@@ -1,17 +1,38 @@
-{ config, pkgs, inputs, ... }:
+{ config, lib, pkgs, inputs, ... }:
 
+let
+  email = "aaron@0x29a.ch";
+
+  # public half of every machine's ~/.ssh/id_ed25519, each one verified as a
+  # signing key in gitea. the key a host signs with is picked up from the key
+  # file itself, this list only tells the local git which machines to trust
+  signingKeys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHRhwzo1oxaT3fEySSmILKNnu9v30cfjx5G7FKpmfqeX aaron@argon"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGDkhvvTUcBSQdtXjX+Mw2Bp8HHhtiBm8aJi4ZxiBgZR aaron@neon"
+  ];
+in
 {
+  # gitea verifies signatures against the account keys, this teaches the local
+  # git the same trust so `git log --show-signature` resolves as well
+  xdg.configFile."git/allowed_signers".text =
+    lib.concatMapStrings (key: "${email} ${key}\n") signingKeys;
+
   programs.git = {
     enable = true;
     settings = {
       push = { autoSetupRemote = true; };
       user = {
         name  = "aaron";
-        email = "aaron@0x29a.ch";
+        email = email;
       };
+      gpg.ssh.allowedSignersFile = "${config.xdg.configHome}/git/allowed_signers";
     };
     signing = {
-      key = "7A830180A05DAC59CDE43B0677D2F5DB48184456";
+      format = "ssh";
+      # point at the *public* key so ssh-keygen signs through the ssh agent
+      # instead of reading the passphrase protected private key from disk
+      key = "${config.home.homeDirectory}/.ssh/id_ed25519.pub";
+      signer = "${pkgs.openssh}/bin/ssh-keygen";
       signByDefault = true;
     };
   };

modules/home-manager/tmux.nix

@@ -5,7 +5,7 @@ let
   #
   # Written as escapes rather than literal glyphs. These are Private Use Area
   # codepoints: they render only with a patched font, they survive copy/paste
-  # badly, and when they get stripped the loss is invisible -- the config still
+  # badly, and when they get stripped the loss is invisible, the config still
   # parses, the status bar just quietly loses its separators. Nix has no \u
   # escape of its own, but fromJSON does.
   sep = builtins.fromJSON ''
@@ -19,28 +19,27 @@ let
 in
 {
   programs.tmux = {
+    # defaults
     enable = true;
     prefix = "C-a";
     keyMode = "vi";
     mouse = true;
 
     # tmux-256color gives truecolor, italics and undercurl in nvim.
-    # screen-256color has none of them. No terminfo gymnastics needed here --
-    # unlike macOS, NixOS ships a current ncurses that has the entry.
     terminal = "tmux-256color";
 
-    # Default is 500ms. That is the lag you feel leaving insert mode in nvim,
+    # Default is 500ms. Causes lag you feel when leaving insert mode in nvim,
     # because tmux is waiting to see whether Esc starts an escape sequence.
     escapeTime = 10;
 
-    # nvim autoread / :checktime react to focus. home-manager defaults to false.
+    # nvim autoread / :checktime react to focus.
     focusEvents = true;
 
-    # Default is 2000.
+    # History limit.
     historyLimit = 50000;
 
-    # Window numbers matching the number row. Behaviour change, so opt in.
+    # Window numbers matching the number row.
-    # baseIndex = 1;
+    baseIndex = 1;
 
     extraConfig = ''
       # Status keys
@@ -49,16 +48,15 @@ in
       # Tell tmux the outer terminal can do 24-bit colour (tmux >= 3.2).
       set -sa terminal-features ",*:RGB"
 
-      # --- Shift+Enter / extended keys -----------------------------------
+      # Shift+Enter / extended keys
-      # Still the open topic; uncommenting these makes tmux forward CSI-u
+      # These make tmux forward CSI-u sequences unconditionally.
-      # sequences unconditionally. Needs tmux >= 3.5 for the format option,
+      # Needs tmux >= 3.5 for the format option,
-      # and a `tmux kill-server` afterwards -- a config reload is not enough.
+      set -s extended-keys always
-      #set -s extended-keys always
+      set -s extended-keys-format csi-u
-      #set -s extended-keys-format csi-u
+      set -as terminal-features '*:extkeys'
-      #set -as terminal-features '*:extkeys'
 
       # Status bar options
-      set -g status-interval 5   # was 1; the clock only has minute resolution
+      set -g status-interval 5
       set -g status-justify left
 
       # Clock mode
@@ -69,11 +67,9 @@ in
       set -g status-fg white
 
       # Key bindings
-      # Reload configuration. tmux.conf is a read-only symlink into the nix
-      # store, so this only picks up changes after `home-manager switch`.
       bind r source-file ~/.config/tmux/tmux.conf \; display-message "tmux.conf reloaded"
 
-      # Panel split and selection -- new panes/windows inherit the cwd
+      # Panel split and selection, new panes/windows inherit the cwd
       unbind %
       unbind '"'
       bind v split-window -v -c "#{pane_current_path}"
@@ -88,7 +84,7 @@ in
       bind k select-pane -U
       bind l select-pane -R
 
-      # Resize panes -- -r makes them repeatable, hold instead of re-prefixing
+      # Resize panes
       bind -r H resize-pane -L 5
       bind -r J resize-pane -D 5
       bind -r K resize-pane -U 5
@@ -96,7 +92,6 @@ in
 
       # Wayland clipboard integration
       # Copy selection to both clipboard (Ctrl+V / Shift+Insert) and primary (middle-click)
-      # v/C-v added: you had no way to *start* a selection from the keyboard.
       bind -T copy-mode-vi v send-keys -X begin-selection
       bind -T copy-mode-vi C-v send-keys -X rectangle-toggle
       bind -T copy-mode-vi y send-keys -X copy-pipe-and-cancel "wl-copy && wl-copy --primary"
@@ -107,7 +102,6 @@ in
       #set -g set-clipboard on
 
       # Kill commands
-      # Drop the `confirm-before -p "..."` part for the old single keystroke.
       bind q confirm-before -p "kill window #W? (y/n)" kill-window
       bind Q confirm-before -p "kill session #S? (y/n)" kill-session
 

modules/nixos/appimage.nix

@@ -0,0 +1,19 @@
+{ config, lib, pkgs, ... }:
+
+{
+  # AppImages ship a squashfs payload that the bundled runtime mounts through
+  # libfuse.so.2 at startup. nix-ld resolves the ELF interpreter but not that
+  # dlopen, so running one directly dies with "dlopen(): error loading
+  # libfuse.so.2". appimage-run sidesteps the mount entirely: it unpacks the
+  # image and runs the payload inside an FHS sandbox, which the bundled Qt and
+  # electron style binaries need anyway.
+  #
+  # Used for the BitBox02 wallet AppImage, downloaded fresh from
+  # https://bitbox.swiss/download/ rather than installed from nixpkgs.
+  programs.appimage = {
+    enable = true;
+    # register AppImages with binfmt_misc so ./Something.AppImage runs as-is,
+    # no appimage-run prefix to remember.
+    binfmt = true;
+  };
+}

modules/nixos/gnupg.nix

@@ -4,12 +4,28 @@
   # enable gnupg agent
   programs.gnupg.agent = {
     enable = true;
-    enableSSHSupport = true;
+    # a graphical pinentry never grabs the tty, so a passphrase prompt can no
-    pinentryPackage = pkgs.pinentry-curses;
+    # longer take over a terminal that a coding agent is driving
+    pinentryPackage = pkgs.pinentry-qt;
+    settings = {
+      # keep the key unlocked for a full working day instead of 10 minutes,
+      # so signing commits asks at most once per session
+      default-cache-ttl = 86400;
+      max-cache-ttl = 86400;
+      # fail an unattended signature instead of blocking on a prompt forever
+      pinentry-timeout = 120;
+    };
   };
 
-  environment.systemPackages = with pkgs; [ 
+  environment.systemPackages = with pkgs; [
     gnupg
+    pinentry-qt
+    # fallback for sessions without a display, switch pinentryPackage to use it
     pinentry-curses
+    # prime the passphrase cache on demand, e.g. before an agent session
+    (writeShellScriptBin "gpg-unlock" ''
+      echo | ${config.programs.gnupg.package}/bin/gpg --clearsign --output /dev/null
+      echo "gpg key unlocked"
+    '')
   ];
 }

modules/nixos/packages.nix

@@ -35,6 +35,7 @@
     tree
     unzip
     usbutils
+    vial
     vim
     wget
     which

modules/nixos/vial.nix

@@ -0,0 +1,26 @@
+{ config, lib, pkgs, ... }:
+
+{
+  # Vial-capable keyboards (lily58 pro r2g) expose a second, non-keyboard raw
+  # HID interface that vial.rocks drives over WebHID. Its /dev/hidraw* node is
+  # root-only by default, so neither chromium nor the native app can open it.
+  #
+  # This has to ship as a numbered rules file rather than via
+  # services.udev.extraRules: extraRules lands in 99-local.rules, but the
+  # builtin that turns TAG+="uaccess" into an actual ACL is invoked from
+  # systemd's 73-seat-late.rules. A tag set at 99 is set too late to be seen,
+  # so the device ends up correctly tagged and still unreadable. 60- sorts
+  # safely ahead of 73.
+  services.udev.packages = [
+    (pkgs.writeTextFile {
+      name = "vial-udev-rules";
+      destination = "/lib/udev/rules.d/60-vial.rules";
+      # Vial firmware advertises itself through a magic USB serial, so this
+      # matches any vial board rather than just the lily58. uaccess hands the
+      # device to whoever owns the active seat, no group membership needed.
+      text = ''
+        KERNEL=="hidraw*", SUBSYSTEM=="hidraw", ATTRS{serial}=="*vial:f64c2b3c*", TAG+="uaccess"
+      '';
+    })
+  ];
+}