home-manager/profiles/gnupg.nix

   1 {
   2   pkgs,
   3   lib,
   4   config,
   5   nixosConfig,
   6   ...
   7 }:
   8 {
   9   /*
  10     home.activation.gnupg = lib.hm.dag.entryAfter ["writeBoundary"] ''
  11     install -d -m700 ${lib.escapeShellArg config.programs.gpg.homedir}
  12     '';
  13   */
  14   services.gpg-agent = {
  15     enable = true;
  16     enableSshSupport = true;
  17     enableExtraSocket = true;
  18     pinentryPackage = lib.mkDefault (
  19       if nixosConfig.services.xserver.enable then pkgs.pinentry-gtk2 else pkgs.pinentry-curses
  20     );
  21   };
  22   programs.gpg.enable = true;
  23   programs.gpg.settings = {
  24     #auto-key-locate = "keyserver";
  25     auto-key-locate = false;
  26     cert-digest-algo = "SHA512";
  27     charset = "utf-8";
  28     default-keyring = false;
  29     default-preference-list = "SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 TWOFISH BZIP2 ZLIB ZIP Uncompressed";
  30     emit-version = false;
  31     fixed-list-mode = true;
  32     keyid-format = "0xlong";
  33     keyserver-options = "no-honor-keyserver-url";
  34     personal-cipher-preferences = "AES256 AES CAST5";
  35     personal-digest-preferences = "SHA512";
  36     quiet = true;
  37     s2k-cipher-algo = "AES256";
  38     s2k-count = "65536";
  39     s2k-digest-algo = "SHA512";
  40     s2k-mode = "3";
  41     tofu-default-policy = "unknown";
  42     trust-model = "tofu+pgp";
  43     #with-fingerprint = [ true true ];
  44     use-agent = true;
  45     utf8-strings = true;
  46   };
  47   home.file."${config.programs.gpg.homedir}/dirmngr.conf".text = ''
  48     allow-ocsp
  49     keyserver hkps://keys.openpgp.org
  50     #use-tor
  51     #log-file dirmngr.log
  52     #standard-resolver
  53   '';
  54   home.packages = lib.mkIf config.programs.gpg.enable [
  55     (pkgs.pass.withExtensions (
  56       ext: with ext; [
  57         pass-audit
  58         pass-checkup
  59         #pass-file
  60         pass-genphrase
  61         pass-import
  62         pass-otp
  63         pass-tomb
  64         pass-update
  65       ]
  66     ))
  67   ];
  68 }