pyrox.dev
1{ config, lib, pkgs, ... }:
2
3with lib;
4
5let
6
7 cfg = config.programs.gnupg;
8
9 xserverCfg = config.services.xserver;
10
11 defaultPinentryFlavor =
12 if xserverCfg.desktopManager.lxqt.enable
13 || xserverCfg.desktopManager.plasma5.enable then
14 "qt"
15 else if xserverCfg.desktopManager.xfce.enable then
16 "gtk2"
17 else if xserverCfg.enable || config.programs.sway.enable then
18 "gnome3"
19 else
20 null;
21
22in
23
24{
25
26 options.programs.gnupg = {
27 package = mkOption {
28 type = types.package;
29 default = pkgs.gnupg;
30 defaultText = literalExpression "pkgs.gnupg";
31 description = ''
32 The gpg package that should be used.
33 '';
34 };
35
36 agent.enable = mkOption {
37 type = types.bool;
38 default = false;
39 description = ''
40 Enables GnuPG agent with socket-activation for every user session.
41 '';
42 };
43
44 agent.enableSSHSupport = mkOption {
45 type = types.bool;
46 default = false;
47 description = ''
48 Enable SSH agent support in GnuPG agent. Also sets SSH_AUTH_SOCK
49 environment variable correctly. This will disable socket-activation
50 and thus always start a GnuPG agent per user session.
51 '';
52 };
53
54 agent.enableExtraSocket = mkOption {
55 type = types.bool;
56 default = false;
57 description = ''
58 Enable extra socket for GnuPG agent.
59 '';
60 };
61
62 agent.enableBrowserSocket = mkOption {
63 type = types.bool;
64 default = false;
65 description = ''
66 Enable browser socket for GnuPG agent.
67 '';
68 };
69
70 agent.pinentryFlavor = mkOption {
71 type = types.nullOr (types.enum pkgs.pinentry.flavors);
72 example = "gnome3";
73 default = defaultPinentryFlavor;
74 description = ''
75 Which pinentry interface to use. If not null, the path to the
76 pinentry binary will be passed to gpg-agent via commandline and
77 thus overrides the pinentry option in gpg-agent.conf in the user's
78 home directory.
79 If not set at all, it'll pick an appropriate flavor depending on the
80 system configuration (qt flavor for lxqt and plasma5, gtk2 for xfce
81 4.12, gnome3 on all other systems with X enabled, ncurses otherwise).
82 '';
83 };
84
85 dirmngr.enable = mkOption {
86 type = types.bool;
87 default = false;
88 description = ''
89 Enables GnuPG network certificate management daemon with socket-activation for every user session.
90 '';
91 };
92 };
93
94 config = mkIf cfg.agent.enable {
95 # This overrides the systemd user unit shipped with the gnupg package
96 systemd.user.services.gpg-agent = mkIf (cfg.agent.pinentryFlavor != null) {
97 serviceConfig.ExecStart = [ "" ''
98 ${cfg.package}/bin/gpg-agent --supervised \
99 --pinentry-program ${pkgs.pinentry.${cfg.agent.pinentryFlavor}}/bin/pinentry
100 '' ];
101 };
102
103 systemd.user.sockets.gpg-agent = {
104 wantedBy = [ "sockets.target" ];
105 };
106
107 systemd.user.sockets.gpg-agent-ssh = mkIf cfg.agent.enableSSHSupport {
108 wantedBy = [ "sockets.target" ];
109 };
110
111 systemd.user.sockets.gpg-agent-extra = mkIf cfg.agent.enableExtraSocket {
112 wantedBy = [ "sockets.target" ];
113 };
114
115 systemd.user.sockets.gpg-agent-browser = mkIf cfg.agent.enableBrowserSocket {
116 wantedBy = [ "sockets.target" ];
117 };
118
119 systemd.user.sockets.dirmngr = mkIf cfg.dirmngr.enable {
120 wantedBy = [ "sockets.target" ];
121 };
122
123 services.dbus.packages = mkIf (cfg.agent.pinentryFlavor == "gnome3") [ pkgs.gcr ];
124
125 environment.systemPackages = with pkgs; [ cfg.package ];
126 systemd.packages = [ cfg.package ];
127
128 environment.interactiveShellInit = ''
129 # Bind gpg-agent to this TTY if gpg commands are used.
130 export GPG_TTY=$(tty)
131
132 '' + (optionalString cfg.agent.enableSSHSupport ''
133 # SSH agent protocol doesn't support changing TTYs, so bind the agent
134 # to every new TTY.
135 ${cfg.package}/bin/gpg-connect-agent --quiet updatestartuptty /bye > /dev/null
136 '');
137
138 environment.extraInit = mkIf cfg.agent.enableSSHSupport ''
139 if [ -z "$SSH_AUTH_SOCK" ]; then
140 export SSH_AUTH_SOCK=$(${cfg.package}/bin/gpgconf --list-dirs agent-ssh-socket)
141 fi
142 '';
143
144 assertions = [
145 { assertion = cfg.agent.enableSSHSupport -> !config.programs.ssh.startAgent;
146 message = "You can't use ssh-agent and GnuPG agent with SSH support enabled at the same time!";
147 }
148 ];
149 };
150
151}