home-manager/profiles/gnupg.nix

   1 { pkgs, lib, config, nixosConfig, ... }:
   2 {
   3   /*
   4     home.activation.gnupg = lib.hm.dag.entryAfter ["writeBoundary"] ''
   5     install -d -m700 ${lib.escapeShellArg config.programs.gpg.homedir}
   6     '';
   7   */
   8   services.gpg-agent = {
   9     enable = true;
  10     enableSshSupport = true;
  11     enableExtraSocket = true;
  12     pinentryFlavor = lib.mkDefault (if nixosConfig.services.xserver.enable then "gtk2" else "curses");
  13     #pinentryPackage = lib.mkDefault (if nixosConfig.services.xserver.enable then pkgs.pinentry-gtk2 else pkgs.pinentry-curses);
  14   };
  15   programs.gpg.enable = true;
  16   programs.gpg.settings = {
  17     #auto-key-locate = "keyserver";
  18     auto-key-locate = false;
  19     cert-digest-algo = "SHA512";
  20     charset = "utf-8";
  21     default-keyring = false;
  22     default-preference-list = "SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 TWOFISH BZIP2 ZLIB ZIP Uncompressed";
  23     emit-version = false;
  24     fixed-list-mode = true;
  25     keyid-format = "0xlong";
  26     keyserver-options = "no-honor-keyserver-url";
  27     personal-cipher-preferences = "AES256 AES CAST5";
  28     personal-digest-preferences = "SHA512";
  29     quiet = true;
  30     s2k-cipher-algo = "AES256";
  31     s2k-count = "65536";
  32     s2k-digest-algo = "SHA512";
  33     s2k-mode = "3";
  34     tofu-default-policy = "unknown";
  35     trust-model = "tofu+pgp";
  36     #with-fingerprint = [ true true ];
  37     use-agent = true;
  38     utf8-strings = true;
  39   };
  40   home.file."${config.programs.gpg.homedir}/dirmngr.conf".text = ''
  41     allow-ocsp
  42     keyserver hkps://keys.openpgp.org
  43     #use-tor
  44     #log-file dirmngr.log
  45     #standard-resolver
  46   '';
  47   home.packages = lib.mkIf config.programs.gpg.enable [
  48     (pkgs.pass.withExtensions (ext: with ext; [
  49       pass-audit
  50       pass-checkup
  51       #pass-file
  52       pass-genphrase
  53       pass-import
  54       pass-otp
  55       pass-tomb
  56       pass-update
  57     ]))
  58   ];
  59 }