32 lines
1.0 KiB
Nix
32 lines
1.0 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
{
|
|
# enable gnupg agent
|
|
programs.gnupg.agent = {
|
|
enable = true;
|
|
# a graphical pinentry never grabs the tty, so a passphrase prompt can no
|
|
# longer take over a terminal that a coding agent is driving
|
|
pinentryPackage = pkgs.pinentry-qt;
|
|
settings = {
|
|
# keep the key unlocked for a full working day instead of 10 minutes,
|
|
# so signing commits asks at most once per session
|
|
default-cache-ttl = 86400;
|
|
max-cache-ttl = 86400;
|
|
# fail an unattended signature instead of blocking on a prompt forever
|
|
pinentry-timeout = 120;
|
|
};
|
|
};
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
gnupg
|
|
pinentry-qt
|
|
# fallback for sessions without a display, switch pinentryPackage to use it
|
|
pinentry-curses
|
|
# prime the passphrase cache on demand, e.g. before an agent session
|
|
(writeShellScriptBin "gpg-unlock" ''
|
|
echo | ${config.programs.gnupg.package}/bin/gpg --clearsign --output /dev/null
|
|
echo "gpg key unlocked"
|
|
'')
|
|
];
|
|
}
|