go back to gpg

2026-08-24 10:04:09 -05:00 · 2024-04-15 11:47:23 -03:00
parent 5f00a01033
commit cb896c857f
11 changed files with 168 additions and 26 deletions
@@ -103,6 +103,7 @@ Most relevant user apps daily drivers:
 - qutebrowser
 - neomutt + mbsync
 - khal + khard + todoman + vdirsyncer
+- gpg + pass
 - tailscale
 - podman
 - zathura
@@ -6,6 +6,7 @@
    ./fish.nix
    ./gh.nix
    ./git.nix
+    ./gpg.nix
    ./jujutsu.nix
    ./lyrics.nix
    ./nix-index.nix
@@ -51,12 +51,9 @@ in {
    userEmail = "hi@m7.rs";
    extraConfig = {
      init.defaultBranch = "main";
-
-      gpg = {
-        format = "ssh";
-        ssh.defaultKeyCommand = "sh -c 'echo key::$(ssh-add -L | head -1)'";
-      };
-      commit.gpgsign = true;
+      user.signing.key = "CE707A2C17FAAC97907FF8EF2E54EA7BFE630916";
+      commit.gpgSign = true;
+      gpg.program = "${config.programs.gpg.package}/bin/gpg2";

      merge.conflictStyle = "zdiff3";
      commit.verbose = true;
@@ -0,0 +1,3 @@
+{pkgs, ...}: {
+  isUnlocked = "${pkgs.procps}/bin/pgrep 'gpg-agent' &> /dev/null && ${pkgs.gnupg}/bin/gpg-connect-agent 'scd getinfo card_list' /bye | ${pkgs.gnugrep}/bin/grep SERIALNO -q";
+}
@@ -0,0 +1,68 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: {
+  services.gpg-agent = {
+    enable = true;
+    enableSshSupport = true;
+    sshKeys = ["149F16412997785363112F3DBD713BC91D51B831"];
+    enableExtraSocket = true;
+    pinentryPackage =
+      if config.gtk.enable
+      then pkgs.pinentry-gnome3
+      else pkgs.pinentry-tty;
+  };
+
+  home.packages = lib.optional config.gtk.enable pkgs.gcr;
+
+  programs = let
+    fixGpg =
+      /*
+      bash
+      */
+      ''
+        gpgconf --launch gpg-agent
+      '';
+  in {
+    # Start gpg-agent if it's not running or tunneled in
+    # SSH does not start it automatically, so this is needed to avoid having to use a gpg command at startup
+    # https://www.gnupg.org/faq/whats-new-in-2.1.html#autostart
+    bash.profileExtra = fixGpg;
+    fish.loginShellInit = fixGpg;
+    zsh.loginExtra = fixGpg;
+
+    gpg = {
+      enable = true;
+      settings = {
+        trust-model = "tofu+pgp";
+      };
+      publicKeys = [
+        {
+          source = ../../pgp.asc;
+          trust = 5;
+        }
+      ];
+    };
+  };
+
+  systemd.user.services = {
+    # Link /run/user/$UID/gnupg to ~/.gnupg-sockets
+    # So that SSH config does not have to know the UID
+    link-gnupg-sockets = {
+      Unit = {
+        Description = "link gnupg sockets from /run to /home";
+      };
+      Service = {
+        Type = "oneshot";
+        ExecStart = "${pkgs.coreutils}/bin/ln -Tfs /run/user/%U/gnupg %h/.gnupg-sockets";
+        ExecStop = "${pkgs.coreutils}/bin/rm $HOME/.gnupg-sockets";
+        RemainAfterExit = true;
+      };
+      Install.WantedBy = ["default.target"];
+    };
+  };
+}
+# vim: filetype=nix
+
@@ -1,8 +1,6 @@
 {
  outputs,
  lib,
-  config,
-  pkgs,
  ...
 }: let
  hostnames = builtins.attrNames outputs.nixosConfigurations;
@@ -10,22 +8,23 @@ in {
  programs.ssh = {
    enable = true;
    matchBlocks = {
-      trusted = {
-        host = "m7.rs *.m7.rs *.ts.m7.rs" + (builtins.concatStringsSep " " hostnames);
+      net = {
+        host = builtins.concatStringsSep " " hostnames;
+        forwardAgent = true;
+        remoteForwards = [
+          {
+            bind.address = ''/%d/.gnupg-sockets/S.gpg-agent'';
+            host.address = ''/%d/.gnupg-sockets/S.gpg-agent.extra'';
+          }
+        ];
+      };
+      trusted = lib.hm.dag.entryBefore ["net"] {
+        host = "m7.rs *.m7.rs *.ts.m7.rs";
        forwardAgent = true;
      };
    };
  };
-  services.ssh-agent.enable = true;

-  home.sessionVariables = lib.mkIf config.gtk.enable {
-    SSH_ASKPASS_REQUIRE = "prefer";
-    SSH_ASKPASS = "${pkgs.gnome.seahorse}/libexec/seahorse/ssh-askpass";
-  };
-
-  systemd.user.services.ssh-agent.Service.Environment = [
-    "SSH_ASKPASS=${config.home.sessionVariables.SSH_ASKPASS or ""}"
-  ];
  home.persistence = {
    "/persist/home/misterio".directories = [".ssh"];
  };
@@ -91,6 +91,7 @@ in {
          "pulseaudio"
          "battery"
          "custom/unread-mail"
+          "custom/gpg-agent"
        ];

        modules-right = [
@@ -256,6 +257,24 @@ in {
            "syncing" = "󰁪";
          };
        };
+        "custom/gpg-agent" = {
+          interval = 2;
+          return-type = "json";
+          exec = let
+            gpgCmds = import ../../../cli/gpg-commands.nix {inherit pkgs;};
+          in
+            jsonOutput "gpg-agent" {
+              pre = ''status=$(${gpgCmds.isUnlocked} && echo "unlocked" || echo "locked")'';
+              alt = "$status";
+              tooltip = "GPG is $status";
+            };
+          format = "{icon}";
+          format-icons = {
+            "locked" = "";
+            "unlocked" = "";
+          };
+          on-click = "";
+        };
        "custom/gammastep" = {
          interval = 5;
          return-type = "json";
@@ -9,12 +9,17 @@

  common = rec {
    realName = "Gabriel Fontes";
+    gpg = {
+      key = "7088 C742 1873 E0DB 97FF 17C2 245C AB70 B4C2 25E9";
+      signByDefault = true;
+    };
    signature = {
      showSignature = "append";
      text = ''
        ${realName}

        https://gsfontes.com
+        PGP: ${gpg.key}
      '';
    };
  };
@@ -108,4 +113,31 @@ in {

  programs.mbsync.enable = true;
  programs.msmtp.enable = true;
+
+  systemd.user.services.mbsync = {
+    Unit = {
+      Description = "mbsync synchronization";
+    };
+    Service = let
+      gpgCmds = import ../cli/gpg-commands.nix {inherit pkgs;};
+    in {
+      Type = "oneshot";
+      ExecCondition = ''
+        /bin/sh -c "${gpgCmds.isUnlocked}"
+      '';
+      ExecStart = "${mbsync} -a";
+    };
+  };
+  systemd.user.timers.mbsync = {
+    Unit = {
+      Description = "Automatic mbsync synchronization";
+    };
+    Timer = {
+      OnBootSec = "30";
+      OnUnitActiveSec = "5m";
+    };
+    Install = {
+      WantedBy = ["timers.target"];
+    };
+  };
 }
@@ -1,16 +1,11 @@
 {
  pkgs,
+  lib,
  config,
  ...
 }: let
  pass = "${config.programs.password-store.package}/bin/pass";
 in {
-  services.vdirsyncer = {
-    enable = true;
-  };
-  programs.vdirsyncer = {
-    enable = true;
-  };
  home.packages = with pkgs; [vdirsyncer];

  home.persistence = {
@@ -64,4 +59,31 @@ in {
      username = "hi@m7.rs"
      password.fetch = ["command", "${pass}", "mail.m7.rs/hi@m7.rs"]
    '';
+
+  systemd.user.services.vdirsyncer = {
+    Unit = {
+      Description = "vdirsyncer synchronization";
+    };
+    Service = let
+      gpgCmds = import ../cli/gpg-commands.nix {inherit pkgs;};
+    in {
+      Type = "oneshot";
+      ExecCondition = ''
+        /bin/sh -c "${gpgCmds.isUnlocked}"
+      '';
+      ExecStart = "${pkgs.vdirsyncer}/bin/vdirsyncer sync";
+    };
+  };
+  systemd.user.timers.vdirsyncer = {
+    Unit = {
+      Description = "Automatic vdirsyncer synchronization";
+    };
+    Timer = {
+      OnBootSec = "30";
+      OnUnitActiveSec = "5m";
+    };
+    Install = {
+      WantedBy = ["timers.target"];
+    };
+  };
 }
@@ -1,2 +1 @@
 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDci4wJghnRRSqQuX1z2xeaUR+p/muKzac0jw0mgpXE2T/3iVlMJJ3UXJ+tIbySP6ezt0GVmzejNOvUarPAm0tOcW6W0Ejys2Tj+HBRU19rcnUtf4vsKk8r5PW5MnwS8DqZonP5eEbhW2OrX5ZsVyDT+Bqrf39p3kOyWYLXT2wA7y928g8FcXOZjwjTaWGWtA+BxAvbJgXhU9cl/y45kF69rfmc3uOQmeXpKNyOlTk6ipSrOfJkcHgNFFeLnxhJ7rYxpoXnxbObGhaNqn7gc5mt+ek+fwFzZ8j6QSKFsPr0NzwTFG80IbyiyrnC/MeRNh7SQFPAESIEP8LK3PoNx2l1M+MjCQXsb4oIG2oYYMRa2yx8qZ3npUOzMYOkJFY1uI/UEE/j/PlQSzMHfpmWus4o2sijfr8OmVPGeoU/UnVPyINqHhyAd1d3Iji3y3LMVemHtp5wVcuswABC7IRVVKZYrMCXMiycY5n00ch6XTaXBwCY00y8B3Mzkd7Ofq98YHc= hi@m7.rs
-sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAICdJvqfMiqcqDfwonM1s6RI8wFfh9XR0jBMzlBDG/eZEAAAABHNzaDo= hi@m7.rs
@@ -21,6 +21,7 @@

      sops
      ssh-to-age
+      gnupg
      age
    ];
  };