40 lines
1.4 KiB
Nix
40 lines
1.4 KiB
Nix
{ config, lib, pkgs, inputs, ... }:
|
|
|
|
let
|
|
email = "aaron@0x29a.ch";
|
|
|
|
# public half of every machine's ~/.ssh/id_ed25519, each one verified as a
|
|
# signing key in gitea. the key a host signs with is picked up from the key
|
|
# file itself, this list only tells the local git which machines to trust
|
|
signingKeys = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHRhwzo1oxaT3fEySSmILKNnu9v30cfjx5G7FKpmfqeX aaron@argon"
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGDkhvvTUcBSQdtXjX+Mw2Bp8HHhtiBm8aJi4ZxiBgZR aaron@neon"
|
|
];
|
|
in
|
|
{
|
|
# gitea verifies signatures against the account keys, this teaches the local
|
|
# git the same trust so `git log --show-signature` resolves as well
|
|
xdg.configFile."git/allowed_signers".text =
|
|
lib.concatMapStrings (key: "${email} ${key}\n") signingKeys;
|
|
|
|
programs.git = {
|
|
enable = true;
|
|
settings = {
|
|
push = { autoSetupRemote = true; };
|
|
user = {
|
|
name = "aaron";
|
|
email = email;
|
|
};
|
|
gpg.ssh.allowedSignersFile = "${config.xdg.configHome}/git/allowed_signers";
|
|
};
|
|
signing = {
|
|
format = "ssh";
|
|
# point at the *public* key so ssh-keygen signs through the ssh agent
|
|
# instead of reading the passphrase protected private key from disk
|
|
key = "${config.home.homeDirectory}/.ssh/id_ed25519.pub";
|
|
signer = "${pkgs.openssh}/bin/ssh-keygen";
|
|
signByDefault = true;
|
|
};
|
|
};
|
|
}
|