38 lines
1.0 KiB
Nix
38 lines
1.0 KiB
Nix
{
|
|
lib,
|
|
config,
|
|
pkgs,
|
|
...
|
|
}:
|
|
|
|
let
|
|
pinentry-wrapper = pkgs.writeShellScriptBin "pinentry-wrapper" ''
|
|
# ponytail: gpg-agent's env is captured at boot (often on tty1), so SSH_* checks
|
|
# from the agent miss SSH sessions. Fall back to curses when no usable display
|
|
# is available, since rofi needs WAYLAND_DISPLAY/DISPLAY the agent may not have.
|
|
if [ -n "''${SSH_CONNECTION:-}" ] \
|
|
|| [ -n "''${SSH_TTY:-}" ] \
|
|
|| [ -z "''${WAYLAND_DISPLAY:-}" ] && [ -z "''${DISPLAY:-}" ]; then
|
|
exec ${pkgs.pinentry-curses}/bin/pinentry-curses "$@"
|
|
else
|
|
exec ${pkgs.pinentry-rofi}/bin/pinentry-rofi "$@"
|
|
fi
|
|
'';
|
|
in {
|
|
options.custom.pinentry = {
|
|
enable = lib.mkEnableOption "adaptive pinentry: rofi on TTY, curses on SSH";
|
|
};
|
|
|
|
config = lib.mkIf config.custom.pinentry.enable {
|
|
home.packages = [ pinentry-wrapper ];
|
|
|
|
services.gpg-agent = {
|
|
enable = true;
|
|
pinentry.package = pinentry-wrapper;
|
|
enableSshSupport = true;
|
|
defaultCacheTtl = 3600;
|
|
maxCacheTtl = 86400;
|
|
};
|
|
};
|
|
}
|