diff --git a/Modules/System/Application/Special-Applications/default.nix b/Modules/System/Application/Special-Applications/default.nix index 942495e..55eed32 100644 --- a/Modules/System/Application/Special-Applications/default.nix +++ b/Modules/System/Application/Special-Applications/default.nix @@ -7,5 +7,6 @@ imports = [ ./flatpak.nix ./wireshark.nix + ./gpg.nix ]; } diff --git a/Modules/System/Application/Special-Applications/gpg.nix b/Modules/System/Application/Special-Applications/gpg.nix new file mode 100644 index 0000000..dc45e6e --- /dev/null +++ b/Modules/System/Application/Special-Applications/gpg.nix @@ -0,0 +1,64 @@ +# GPG (System Module) +# +# Provides: +# - GnuPG installation (gpg, pinentry) +# - gpg-agent system service (with optional SSH support) +# - Desktop secrets integration (gnome-keyring, seahorse) +# +# Options: +# - enable -> Enable GnuPG system module +# - enableSSHSupport -> Enable SSH agent emulation in gpg-agent +# - enableSeahorse -> Enable Seahorse (GUI key manager) +# - pinentry.package -> Pinentry package (default: pkgs.pinentry-all) +# +{ config, lib, pkgs, ... }: + +let + cfg = config.nyx-module.system.gpg; +in { + options.nyx-module.system.gpg = { + enable = lib.mkEnableOption "Enable GnuPG (system module)"; + + enableSSHSupport = lib.mkOption { + type = lib.types.bool; + default = false; + description = '' + Enable SSH agent emulation support in gpg-agent. + This allows you to use your GPG keys for SSH authentication. + ''; + }; + + enableSeahorse = lib.mkEnableOption "Enable Seahorse (GUI key manager)"; + + pinentry.package = lib.mkOption { + type = lib.types.package; + default = pkgs.pinentry-all; + description = '' + The pinentry package to use. + By default, `pkgs.pinentry-all` is installed, which includes + all common backends (tty, curses, gtk2, qt, gnome3). + ''; + }; + }; + + config = lib.mkIf cfg.enable { + # Enable gpg-agent with optional SSH support + programs.gnupg.agent = { + enable = true; + enableSSHSupport = cfg.enableSSHSupport; + }; + + # Enable gnome-keyring (for desktop secret storage) + services.gnome.gnome-keyring.enable = true; + + # Optional GUI for secrets management + programs.seahorse.enable = cfg.enableSeahorse; + + # Base packages + user-supplied pinentry + environment.systemPackages = with pkgs; [ + gnupg + gnome-keyring + cfg.pinentry.package + ]; + }; +}