35 lines
1.1 KiB
Nix
35 lines
1.1 KiB
Nix
{ config, pkgs, inputs, ... }:
|
|
|
|
let
|
|
# public half of ~/.ssh/id_ed25519, registered and verified as a signing key
|
|
# in gitea
|
|
signingKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHRhwzo1oxaT3fEySSmILKNnu9v30cfjx5G7FKpmfqeX aaron@argon";
|
|
in
|
|
{
|
|
# gitea verifies signatures against the account key, this teaches the local
|
|
# git the same trust so `git log --show-signature` resolves as well
|
|
xdg.configFile."git/allowed_signers".text = ''
|
|
aaron@0x29a.ch ${signingKey}
|
|
'';
|
|
|
|
programs.git = {
|
|
enable = true;
|
|
settings = {
|
|
push = { autoSetupRemote = true; };
|
|
user = {
|
|
name = "aaron";
|
|
email = "aaron@0x29a.ch";
|
|
};
|
|
gpg.ssh.allowedSignersFile = "${config.xdg.configHome}/git/allowed_signers";
|
|
};
|
|
signing = {
|
|
format = "ssh";
|
|
# point at the *public* key so ssh-keygen signs through the ssh agent
|
|
# instead of reading the passphrase protected private key from disk
|
|
key = "${config.home.homeDirectory}/.ssh/id_ed25519.pub";
|
|
signer = "${pkgs.openssh}/bin/ssh-keygen";
|
|
signByDefault = true;
|
|
};
|
|
};
|
|
}
|