pyrox.dev
1{ config, lib, pkgs, ... }:
2
3with lib;
4
5let
6
7 cfg = config.programs.gnupg;
8
9 xserverCfg = config.services.xserver;
10
11 defaultPinentryFlavor =
12 if xserverCfg.desktopManager.lxqt.enable
13 || xserverCfg.desktopManager.plasma5.enable
14 || xserverCfg.desktopManager.deepin.enable then
15 "qt"
16 else if xserverCfg.desktopManager.xfce.enable then
17 "gtk2"
18 else if xserverCfg.enable || config.programs.sway.enable then
19 "gnome3"
20 else
21 "curses";
22
23in
24
25{
26
27 options.programs.gnupg = {
28 package = mkOption {
29 type = types.package;
30 default = pkgs.gnupg;
31 defaultText = literalExpression "pkgs.gnupg";
32 description = lib.mdDoc ''
33 The gpg package that should be used.
34 '';
35 };
36
37 agent.enable = mkOption {
38 type = types.bool;
39 default = false;
40 description = lib.mdDoc ''
41 Enables GnuPG agent with socket-activation for every user session.
42 '';
43 };
44
45 agent.enableSSHSupport = mkOption {
46 type = types.bool;
47 default = false;
48 description = lib.mdDoc ''
49 Enable SSH agent support in GnuPG agent. Also sets SSH_AUTH_SOCK
50 environment variable correctly. This will disable socket-activation
51 and thus always start a GnuPG agent per user session.
52 '';
53 };
54
55 agent.enableExtraSocket = mkOption {
56 type = types.bool;
57 default = false;
58 description = lib.mdDoc ''
59 Enable extra socket for GnuPG agent.
60 '';
61 };
62
63 agent.enableBrowserSocket = mkOption {
64 type = types.bool;
65 default = false;
66 description = lib.mdDoc ''
67 Enable browser socket for GnuPG agent.
68 '';
69 };
70
71 agent.pinentryFlavor = mkOption {
72 type = types.nullOr (types.enum pkgs.pinentry.flavors);
73 example = "gnome3";
74 default = defaultPinentryFlavor;
75 defaultText = literalMD ''matching the configured desktop environment'';
76 description = lib.mdDoc ''
77 Which pinentry interface to use. If not null, the path to the
78 pinentry binary will be passed to gpg-agent via commandline and
79 thus overrides the pinentry option in gpg-agent.conf in the user's
80 home directory.
81 If not set at all, it'll pick an appropriate flavor depending on the
82 system configuration (qt flavor for lxqt and plasma5, gtk2 for xfce
83 4.12, gnome3 on all other systems with X enabled, ncurses otherwise).
84 '';
85 };
86
87 dirmngr.enable = mkOption {
88 type = types.bool;
89 default = false;
90 description = lib.mdDoc ''
91 Enables GnuPG network certificate management daemon with socket-activation for every user session.
92 '';
93 };
94 };
95
96 config = mkIf cfg.agent.enable {
97 # This overrides the systemd user unit shipped with the gnupg package
98 systemd.user.services.gpg-agent = mkIf (cfg.agent.pinentryFlavor != null) {
99 serviceConfig.ExecStart = [ "" ''
100 ${cfg.package}/bin/gpg-agent --supervised \
101 --pinentry-program ${pkgs.pinentry.${cfg.agent.pinentryFlavor}}/bin/pinentry
102 '' ];
103 };
104
105 systemd.user.sockets.gpg-agent = {
106 wantedBy = [ "sockets.target" ];
107 };
108
109 systemd.user.sockets.gpg-agent-ssh = mkIf cfg.agent.enableSSHSupport {
110 wantedBy = [ "sockets.target" ];
111 };
112
113 systemd.user.sockets.gpg-agent-extra = mkIf cfg.agent.enableExtraSocket {
114 wantedBy = [ "sockets.target" ];
115 };
116
117 systemd.user.sockets.gpg-agent-browser = mkIf cfg.agent.enableBrowserSocket {
118 wantedBy = [ "sockets.target" ];
119 };
120
121 systemd.user.sockets.dirmngr = mkIf cfg.dirmngr.enable {
122 wantedBy = [ "sockets.target" ];
123 };
124
125 services.dbus.packages = mkIf (cfg.agent.pinentryFlavor == "gnome3") [ pkgs.gcr ];
126
127 environment.systemPackages = with pkgs; [ cfg.package ];
128 systemd.packages = [ cfg.package ];
129
130 environment.interactiveShellInit = ''
131 # Bind gpg-agent to this TTY if gpg commands are used.
132 export GPG_TTY=$(tty)
133 '';
134
135 programs.ssh.extraConfig = optionalString cfg.agent.enableSSHSupport ''
136 # The SSH agent protocol doesn't have support for changing TTYs; however we
137 # can simulate this with the `exec` feature of openssh (see ssh_config(5))
138 # that hooks a command to the shell currently running the ssh program.
139 Match host * exec "${pkgs.runtimeShell} -c '${cfg.package}/bin/gpg-connect-agent --quiet updatestartuptty /bye >/dev/null 2>&1'"
140 '';
141
142 environment.extraInit = mkIf cfg.agent.enableSSHSupport ''
143 if [ -z "$SSH_AUTH_SOCK" ]; then
144 export SSH_AUTH_SOCK=$(${cfg.package}/bin/gpgconf --list-dirs agent-ssh-socket)
145 fi
146 '';
147
148 assertions = [
149 { assertion = cfg.agent.enableSSHSupport -> !config.programs.ssh.startAgent;
150 message = "You can't use ssh-agent and GnuPG agent with SSH support enabled at the same time!";
151 }
152 ];
153 };
154
155 # uses attributes of the linked package
156 meta.buildDocsInSandbox = false;
157}