{ config, pkgs, inputs, ... }:

let
  # public half of ~/.ssh/id_ed25519, registered and verified as a signing key
  # in gitea
  signingKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHRhwzo1oxaT3fEySSmILKNnu9v30cfjx5G7FKpmfqeX aaron@argon";
in
{
  # gitea verifies signatures against the account key, this teaches the local
  # git the same trust so `git log --show-signature` resolves as well
  xdg.configFile."git/allowed_signers".text = ''
    aaron@0x29a.ch ${signingKey}
  '';

  programs.git = {
    enable = true;
    settings = {
      push = { autoSetupRemote = true; };
      user = {
        name  = "aaron";
        email = "aaron@0x29a.ch";
      };
      gpg.ssh.allowedSignersFile = "${config.xdg.configHome}/git/allowed_signers";
    };
    signing = {
      format = "ssh";
      # point at the *public* key so ssh-keygen signs through the ssh agent
      # instead of reading the passphrase protected private key from disk
      key = "${config.home.homeDirectory}/.ssh/id_ed25519.pub";
      signer = "${pkgs.openssh}/bin/ssh-keygen";
      signByDefault = true;
    };
  };
}