From ae26faebc2ca3d684edd092ac0933b5bd1893253 Mon Sep 17 00:00:00 2001
From: Gabriel Fontes <hi@m7.rs>
Date: Tue, 27 Jun 2023 17:04:00 -0300
Subject: [PATCH] add setup-gpg script to website

---
 hosts/alcyone/services/website/default.nix    | 18 ++-----
 .../services/website/scripts/nix-installer.sh | 12 +++++
 .../services/website/scripts/setup-gpg.sh     | 47 +++++++++++++++++++
 3 files changed, 63 insertions(+), 14 deletions(-)
 create mode 100644 hosts/alcyone/services/website/scripts/nix-installer.sh
 create mode 100644 hosts/alcyone/services/website/scripts/setup-gpg.sh

diff --git a/hosts/alcyone/services/website/default.nix b/hosts/alcyone/services/website/default.nix
index ff30abcb..7b9e428c 100644
--- a/hosts/alcyone/services/website/default.nix
+++ b/hosts/alcyone/services/website/default.nix
@@ -30,21 +30,11 @@ in
 
         "=/nix" = {
           # Script to download static nix
-          # Sadly only works on linux
-          alias = pkgs.writeText "nix" ''
-            #/bin/sh
+          alias = ./scripts/nix-installer.sh;
+        };
 
-            arch="$(uname -m)"
-            job="https://hydra.nixos.org/job/nix/master/buildStatic.$arch-linux/latest/download-by-type/file/binary-dist"
-            echo "Downloading from: $job"
-
-            mkdir -p "$HOME/.local/bin"
-            curl -L "$job" -o "$HOME/.local/bin/nix"
-            chmod +x "$HOME/.local/bin/nix"
-
-            mkdir -p "$HOME/.config/nix"
-            echo "experimental-features = nix-command flakes" >> "$HOME/.config/nix/nix.conf"
-          '';
+        "=/setup-gpg" = {
+          alias = ./scripts/setup-gpg.sh;
         };
 
         "=/7088C7421873E0DB97FF17C2245CAB70B4C225E9.asc".alias = pgpKey;
diff --git a/hosts/alcyone/services/website/scripts/nix-installer.sh b/hosts/alcyone/services/website/scripts/nix-installer.sh
new file mode 100644
index 00000000..31e5be86
--- /dev/null
+++ b/hosts/alcyone/services/website/scripts/nix-installer.sh
@@ -0,0 +1,12 @@
+#!/bin/sh
+
+arch="$(uname -m)"
+job="https://hydra.nixos.org/job/nix/master/buildStatic.$arch-linux/latest/download-by-type/file/binary-dist"
+echo "Downloading from: $job"
+
+mkdir -p "$HOME/.local/bin"
+curl -L "$job" -o "$HOME/.local/bin/nix"
+chmod +x "$HOME/.local/bin/nix"
+
+mkdir -p "$HOME/.config/nix"
+echo "experimental-features = nix-command flakes" >> "$HOME/.config/nix/nix.conf"
diff --git a/hosts/alcyone/services/website/scripts/setup-gpg.sh b/hosts/alcyone/services/website/scripts/setup-gpg.sh
new file mode 100644
index 00000000..9fcba7b4
--- /dev/null
+++ b/hosts/alcyone/services/website/scripts/setup-gpg.sh
@@ -0,0 +1,47 @@
+#!/bin/sh
+
+pgp_id="7088C7421873E0DB97FF17C2245CAB70B4C225E9"
+ssh_keygrip="149F16412997785363112F3DBD713BC91D51B831"
+
+set -eu
+
+check_bin() {
+  if ! which "$1" > /dev/null; then
+      echo "'$1' is not available" >&2
+      exit 1
+  fi
+}
+
+check_bin gpg
+check_bin pinentry
+echo "GPG and Pinentry located" >&2
+
+if ! gpg -k "$pgp_id" > /dev/null 2> /dev/null; then
+  echo "Downloading public key" >&2
+  gpg --receive-keys "$pgp_id"
+fi
+if ! gpg -K "$pgp_id" > /dev/null 2> /dev/null; then
+  echo "Searching card for private keystubs" >&2
+  gpg --card-status
+fi
+
+if ! grep -q "pinentry-program" ~/.gnupg/gpg-agent.conf 2>/dev/null; then
+  echo "pinentry-program $(readlink -f "$(which pinentry)")" >> ~/.gnupg/gpg-agent.conf
+fi
+if ! grep -q "enable-ssh-support" ~/.gnupg/gpg-agent.conf 2>/dev/null; then
+  echo "enable-ssh-support" >> ~/.gnupg/gpg-agent.conf
+fi
+if ! grep -q "$ssh_keygrip" ~/.gnupg/sshcontrol 2>/dev/null; then
+  echo "$ssh_keygrip" >> ~/.gnupg/sshcontrol
+fi
+
+echo "GPG configured" >&2
+
+GPG_TTY="$(tty)"
+export GPG_TTY
+
+gpgconf --kill gpg-agent
+gpgconf --launch gpg-agent
+gpg-connect-agent updatestartuptty /bye
+
+echo "GPG Agent restarted" >&2