feat: add gpg agent

This commit is contained in:
Peritia 2025-09-29 16:24:57 +02:00
parent 7baca262a6
commit 4bdd918479
2 changed files with 65 additions and 0 deletions

View file

@ -7,5 +7,6 @@
imports = [
./flatpak.nix
./wireshark.nix
./gpg.nix
];
}

View file

@ -0,0 +1,64 @@
# GPG (System Module)
#
# Provides:
# - GnuPG installation (gpg, pinentry)
# - gpg-agent system service (with optional SSH support)
# - Desktop secrets integration (gnome-keyring, seahorse)
#
# Options:
# - enable -> Enable GnuPG system module
# - enableSSHSupport -> Enable SSH agent emulation in gpg-agent
# - enableSeahorse -> Enable Seahorse (GUI key manager)
# - pinentry.package -> Pinentry package (default: pkgs.pinentry-all)
#
{ config, lib, pkgs, ... }:
let
cfg = config.nyx-module.system.gpg;
in {
options.nyx-module.system.gpg = {
enable = lib.mkEnableOption "Enable GnuPG (system module)";
enableSSHSupport = lib.mkOption {
type = lib.types.bool;
default = false;
description = ''
Enable SSH agent emulation support in gpg-agent.
This allows you to use your GPG keys for SSH authentication.
'';
};
enableSeahorse = lib.mkEnableOption "Enable Seahorse (GUI key manager)";
pinentry.package = lib.mkOption {
type = lib.types.package;
default = pkgs.pinentry-all;
description = ''
The pinentry package to use.
By default, `pkgs.pinentry-all` is installed, which includes
all common backends (tty, curses, gtk2, qt, gnome3).
'';
};
};
config = lib.mkIf cfg.enable {
# Enable gpg-agent with optional SSH support
programs.gnupg.agent = {
enable = true;
enableSSHSupport = cfg.enableSSHSupport;
};
# Enable gnome-keyring (for desktop secret storage)
services.gnome.gnome-keyring.enable = true;
# Optional GUI for secrets management
programs.seahorse.enable = cfg.enableSeahorse;
# Base packages + user-supplied pinentry
environment.systemPackages = with pkgs; [
gnupg
gnome-keyring
cfg.pinentry.package
];
};
}