# Commits are signed with each machine's ~/.ssh/id_ed25519 through the ssh
# agent. gitea verifies them against the account keys; allowed_signers gives
# the local git the same trust, so `git log --show-signature` resolves too.

{
  config,
  lib,
  pkgs,
  ...
}:

let
  email = "aaron@0x29a.ch";
  signingKeys = [
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHRhwzo1oxaT3fEySSmILKNnu9v30cfjx5G7FKpmfqeX aaron@argon"
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGDkhvvTUcBSQdtXjX+Mw2Bp8HHhtiBm8aJi4ZxiBgZR aaron@neon"
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB5BI+rirjPHZwqgBzO3xOi3m0+07zY0uEou7NSCFh0+ aaron@krypton"
  ];
in
{
  xdg.configFile."git/allowed_signers".text = lib.concatMapStrings (
    key: "${email} ${key}\n"
  ) signingKeys;

  programs.git = {
    enable = true;
    lfs.enable = true;
    settings = {
      push.autoSetupRemote = true;
      user = {
        name = "aaron";
        inherit email;
      };
      gpg.ssh.allowedSignersFile = "${config.xdg.configHome}/git/allowed_signers";
    };
    signing = {
      format = "ssh";
      # the public key makes ssh-keygen sign through the agent
      key = "${config.home.homeDirectory}/.ssh/id_ed25519.pub";
      signer = "${pkgs.openssh}/bin/ssh-keygen";
      signByDefault = true;
    };
  };
}