pyrox.dev
1{ config, lib, pkgs, ... }:
2
3with lib;
4
5let
6
7 cfg = config.programs.gnupg;
8
9 xserverCfg = config.services.xserver;
10
11 defaultPinentryFlavor =
12 if xserverCfg.desktopManager.lxqt.enable
13 || xserverCfg.desktopManager.plasma5.enable then
14 "qt"
15 else if xserverCfg.desktopManager.xfce.enable then
16 "gtk2"
17 else if xserverCfg.enable || config.programs.sway.enable then
18 "gnome3"
19 else
20 "curses";
21
22in
23
24{
25
26 options.programs.gnupg = {
27 package = mkOption {
28 type = types.package;
29 default = pkgs.gnupg;
30 defaultText = literalExpression "pkgs.gnupg";
31 description = lib.mdDoc ''
32 The gpg package that should be used.
33 '';
34 };
35
36 agent.enable = mkOption {
37 type = types.bool;
38 default = false;
39 description = lib.mdDoc ''
40 Enables GnuPG agent with socket-activation for every user session.
41 '';
42 };
43
44 agent.enableSSHSupport = mkOption {
45 type = types.bool;
46 default = false;
47 description = lib.mdDoc ''
48 Enable SSH agent support in GnuPG agent. Also sets SSH_AUTH_SOCK
49 environment variable correctly. This will disable socket-activation
50 and thus always start a GnuPG agent per user session.
51 '';
52 };
53
54 agent.enableExtraSocket = mkOption {
55 type = types.bool;
56 default = false;
57 description = lib.mdDoc ''
58 Enable extra socket for GnuPG agent.
59 '';
60 };
61
62 agent.enableBrowserSocket = mkOption {
63 type = types.bool;
64 default = false;
65 description = lib.mdDoc ''
66 Enable browser socket for GnuPG agent.
67 '';
68 };
69
70 agent.pinentryFlavor = mkOption {
71 type = types.nullOr (types.enum pkgs.pinentry.flavors);
72 example = "gnome3";
73 default = defaultPinentryFlavor;
74 defaultText = literalMD ''matching the configured desktop environment'';
75 description = lib.mdDoc ''
76 Which pinentry interface to use. If not null, the path to the
77 pinentry binary will be passed to gpg-agent via commandline and
78 thus overrides the pinentry option in gpg-agent.conf in the user's
79 home directory.
80 If not set at all, it'll pick an appropriate flavor depending on the
81 system configuration (qt flavor for lxqt and plasma5, gtk2 for xfce
82 4.12, gnome3 on all other systems with X enabled, ncurses otherwise).
83 '';
84 };
85
86 dirmngr.enable = mkOption {
87 type = types.bool;
88 default = false;
89 description = lib.mdDoc ''
90 Enables GnuPG network certificate management daemon with socket-activation for every user session.
91 '';
92 };
93 };
94
95 config = mkIf cfg.agent.enable {
96 # This overrides the systemd user unit shipped with the gnupg package
97 systemd.user.services.gpg-agent = mkIf (cfg.agent.pinentryFlavor != null) {
98 serviceConfig.ExecStart = [ "" ''
99 ${cfg.package}/bin/gpg-agent --supervised \
100 --pinentry-program ${pkgs.pinentry.${cfg.agent.pinentryFlavor}}/bin/pinentry
101 '' ];
102 };
103
104 systemd.user.sockets.gpg-agent = {
105 wantedBy = [ "sockets.target" ];
106 };
107
108 systemd.user.sockets.gpg-agent-ssh = mkIf cfg.agent.enableSSHSupport {
109 wantedBy = [ "sockets.target" ];
110 };
111
112 systemd.user.sockets.gpg-agent-extra = mkIf cfg.agent.enableExtraSocket {
113 wantedBy = [ "sockets.target" ];
114 };
115
116 systemd.user.sockets.gpg-agent-browser = mkIf cfg.agent.enableBrowserSocket {
117 wantedBy = [ "sockets.target" ];
118 };
119
120 systemd.user.sockets.dirmngr = mkIf cfg.dirmngr.enable {
121 wantedBy = [ "sockets.target" ];
122 };
123
124 services.dbus.packages = mkIf (cfg.agent.pinentryFlavor == "gnome3") [ pkgs.gcr ];
125
126 environment.systemPackages = with pkgs; [ cfg.package ];
127 systemd.packages = [ cfg.package ];
128
129 environment.interactiveShellInit = ''
130 # Bind gpg-agent to this TTY if gpg commands are used.
131 export GPG_TTY=$(tty)
132 '';
133
134 programs.ssh.extraConfig = optionalString cfg.agent.enableSSHSupport ''
135 # The SSH agent protocol doesn't have support for changing TTYs; however we
136 # can simulate this with the `exec` feature of openssh (see ssh_config(5))
137 # that hooks a command to the shell currently running the ssh program.
138 Match host * exec "${cfg.package}/bin/gpg-connect-agent --quiet updatestartuptty /bye >/dev/null 2>&1"
139 '';
140
141 environment.extraInit = mkIf cfg.agent.enableSSHSupport ''
142 if [ -z "$SSH_AUTH_SOCK" ]; then
143 export SSH_AUTH_SOCK=$(${cfg.package}/bin/gpgconf --list-dirs agent-ssh-socket)
144 fi
145 '';
146
147 assertions = [
148 { assertion = cfg.agent.enableSSHSupport -> !config.programs.ssh.startAgent;
149 message = "You can't use ssh-agent and GnuPG agent with SSH support enabled at the same time!";
150 }
151 ];
152 };
153
154 # uses attributes of the linked package
155 meta.buildDocsInSandbox = false;
156}