45 lines
1.2 KiB
Nix
45 lines
1.2 KiB
Nix
# Commits are signed with each machine's ~/.ssh/id_ed25519 through the ssh
|
|
# agent. gitea verifies them against the account keys; allowed_signers gives
|
|
# the local git the same trust, so `git log --show-signature` resolves too.
|
|
|
|
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
|
|
let
|
|
email = "aaron@0x29a.ch";
|
|
signingKeys = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHRhwzo1oxaT3fEySSmILKNnu9v30cfjx5G7FKpmfqeX aaron@argon"
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGDkhvvTUcBSQdtXjX+Mw2Bp8HHhtiBm8aJi4ZxiBgZR aaron@neon"
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB5BI+rirjPHZwqgBzO3xOi3m0+07zY0uEou7NSCFh0+ aaron@krypton"
|
|
];
|
|
in
|
|
{
|
|
xdg.configFile."git/allowed_signers".text = lib.concatMapStrings (
|
|
key: "${email} ${key}\n"
|
|
) signingKeys;
|
|
|
|
programs.git = {
|
|
enable = true;
|
|
lfs.enable = true;
|
|
settings = {
|
|
push.autoSetupRemote = true;
|
|
user = {
|
|
name = "aaron";
|
|
inherit email;
|
|
};
|
|
gpg.ssh.allowedSignersFile = "${config.xdg.configHome}/git/allowed_signers";
|
|
};
|
|
signing = {
|
|
format = "ssh";
|
|
# the public key makes ssh-keygen sign through the agent
|
|
key = "${config.home.homeDirectory}/.ssh/id_ed25519.pub";
|
|
signer = "${pkgs.openssh}/bin/ssh-keygen";
|
|
signByDefault = true;
|
|
};
|
|
};
|
|
}
|