{ config, lib, pkgs, ... }:

{
  # enable gnupg agent
  programs.gnupg.agent = {
    enable = true;
    # a graphical pinentry never grabs the tty, so a passphrase prompt can no
    # longer take over a terminal that a coding agent is driving
    pinentryPackage = pkgs.pinentry-qt;
    settings = {
      # keep the key unlocked for a full working day instead of 10 minutes,
      # so signing commits asks at most once per session
      default-cache-ttl = 86400;
      max-cache-ttl = 86400;
      # fail an unattended signature instead of blocking on a prompt forever
      pinentry-timeout = 120;
    };
  };

  environment.systemPackages = with pkgs; [
    gnupg
    pinentry-qt
    # fallback for sessions without a display, switch pinentryPackage to use it
    pinentry-curses
    # prime the passphrase cache on demand, e.g. before an agent session
    (writeShellScriptBin "gpg-unlock" ''
      echo | ${config.programs.gnupg.package}/bin/gpg --clearsign --output /dev/null
      echo "gpg key unlocked"
    '')
  ];
}