From 27d0ab06e1a0e0368631ab287f534298f9cf835a Mon Sep 17 00:00:00 2001
From: Syed Daanish <me@syedm.dev>
Date: Tue, 7 Jul 2026 20:58:48 +0100
Subject: [PATCH] Add gpg signing

---
 home/default.nix               |  10 ++++++++++
 hosts/common.nix               |   1 +
 hosts/tardis/default.nix       |   3 ++-
 modules/secrets/default.nix    |  13 +++++++++++++
 modules/secrets/gpg-public.asc |  30 ++++++++++++++++++++++++++++++
 modules/secrets/gpg.age        | Bin 0 -> 3824 bytes
 modules/secrets/locker.sh      |  15 ++++++++++++++-
 7 files changed, 70 insertions(+), 2 deletions(-)
 create mode 100644 modules/secrets/gpg-public.asc
 create mode 100644 modules/secrets/gpg.age

diff --git a/home/default.nix b/home/default.nix
index a016a60..1b566e5 100644
--- a/home/default.nix
+++ b/home/default.nix
@@ -18,8 +18,18 @@
 
   programs.git = {
     enable = true;
+
     settings.user.name = "Syed Daanish";
     settings.user.email = "me@syedm.dev";
+
+    signing = {
+      format = "openpgp";
+      key = "9988BF5D83DCEC880D69A3DA4786C50E6037E76A";
+      signByDefault = true;
+      signer = "${pkgs.writeShellScriptBin "gpg-secrets" ''
+        exec ${pkgs.gnupg}/bin/gpg --homedir /run/secrets/gpg "$@"
+      ''}/bin/gpg-secrets";
+    };
   };
 
   xsession = {
diff --git a/hosts/common.nix b/hosts/common.nix
index d64cf49..50a9ef4 100644
--- a/hosts/common.nix
+++ b/hosts/common.nix
@@ -55,6 +55,7 @@
   environment.systemPackages = with pkgs; [
     libinput
     nodejs
+    gnupg
     age
     eza
     yazi
diff --git a/hosts/tardis/default.nix b/hosts/tardis/default.nix
index 3ca1a89..34057ce 100644
--- a/hosts/tardis/default.nix
+++ b/hosts/tardis/default.nix
@@ -66,6 +66,7 @@
     extraPortals = [
       pkgs.xdg-desktop-portal-gtk
     ];
+    config.common.default = "*";
   };
 
   security.rtkit.enable = true;
@@ -78,7 +79,7 @@
     jack.enable = true;
   };
 
-  hardware.pulseaudio.enable = false;
+  services.pulseaudio.enable = false;
 
   services.power-profiles-daemon.enable = true;
 
diff --git a/modules/secrets/default.nix b/modules/secrets/default.nix
index b83f5ab..8a947f6 100644
--- a/modules/secrets/default.nix
+++ b/modules/secrets/default.nix
@@ -7,8 +7,21 @@ let
     #!${pkgs.bash}/bin/bash
     set -euo pipefail
     if [[ -f "${thisDir}/secrets.age" && -f "${config.users.users."me".home}/.ssh/id_ed25519" ]]; then
+      install -m 600 /dev/null /run/secrets.env
       ${pkgs.age}/bin/age -d -i "${config.users.users."me".home}/.ssh/id_ed25519" "${thisDir}/secrets.age" > /run/secrets.env
     fi
+
+    mkdir -p /run/secrets/gpg
+
+    if [[ -f "${thisDir}/gpg.age" ]]; then
+      ${pkgs.age}/bin/age -d \
+        -i "${config.users.users."me".home}/.ssh/id_ed25519" \
+        "${thisDir}/gpg.age" | \
+        ${pkgs.gnupg}/bin/gpg --homedir /run/secrets/gpg --import
+    fi
+
+    chown -R me:users /run/secrets/gpg
+    chmod -R 700 /run/secrets/gpg
   '';
 in
 {
diff --git a/modules/secrets/gpg-public.asc b/modules/secrets/gpg-public.asc
new file mode 100644
index 0000000..02dd940
--- /dev/null
+++ b/modules/secrets/gpg-public.asc
@@ -0,0 +1,30 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQENBGpFs8UBCADjPGL7oAC2akkJsAjc2ViXf4z1/gJzvDAMiivpAd9a5RIKGuPd
+35SX3wyw5gC9nyS/0wjMe9h0afgvW52ko4j5JVKJmpt2nt55HMM6xYRcRq7tQcd3
+X6RtPPHdi2a187OB31MkFqKhbVLzKM9LEYWV7SoHzbHrdKQIATrg2OR/012avA27
+f1rkIHjk0y0pr9SEtPKgujQHUz0QKAXWpdaI5bRd5GSLMU53BxLUVIZVsfqIfmtJ
+xeYK/8/0jzmExAroCdtcgJLEAZjeuwy9S6mfCW21cSVlKTu6icmYirBcjmVPqbHA
+gJDYrTGVqpQJH7bPqKd26waU2u61N1iHmvENABEBAAG0G0RhYW5pc2ggU3llZCA8
+bWVAc3llZG0uZGV2PokBTgQTAQoAOBYhBJmIv12D3OyIDWmj2keGxQ5gN+dqBQJq
+RbPFAhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJEEeGxQ5gN+dqtvkIAN7i
+SXAqnyiWscZfEF32WowzmcagjixOAj02VIZJ9chkgqXtRp61OELC9yj6HO3oC8I3
+zMvp1jDA/0VqWgdr5FszVwWaQxvm2cWrkf8qMp2ydJtwqK3KFhZjrsCRSdLyA96o
+WHchO2xMgIXWqFNCUlLIWDeL0GmHbFwSulqGh6IvGc/Qf6R8rciR9Xw5AIaWLt6I
+uPOS73X8v/UKlihp4BWEZhFR4hlUVNeA4fH1UqMQi6L/H0u5wh8/OgyQfLoUtTk8
+NOns9C2BkUUfdSH/fQx3DjQvzCk6xajW/Tv3Lu6S/AFGNfGaagag9IXLPSbyO54G
+bhLVFaZHkskdoSYJZoq5AQ0EakWzxQEIANK4ZcQp0uyS7+YYxyYl9JQKTSgjXvNw
+HVCoKPY1tdJ/1yVd4wc9ggjuaifYhK3kjkVpRf78BagD59j8NptHLHX2GPIbjGbp
+LwgW4N2jXW6khmL4I0aiVuyQcieUI0R+0rdSsfl+J8uIRYdVpalJeqgZ0d+Vktv1
+o3FtPblw17s449VCF0Jl3Z4Ok6YrinsU7b+zy9PpPPgpa4zpcra0uy13Bd6FRDwu
+8U8KASvwGUwk8zcIAahql091Uzn7w52vkwHWS9wqOokKQkD4NhzsHJ5oLUflK4OG
+y5gpLPD4ZbidyeHsPorbdsbpzevrBy84CX+nTW4XhBTWC5MUJFyahW0AEQEAAYkB
+NgQYAQoAIBYhBJmIv12D3OyIDWmj2keGxQ5gN+dqBQJqRbPFAhsMAAoJEEeGxQ5g
+N+dqVpoH/jIx/DYPBrtstQmxtaNUJzVgXoanJIROVR/xY3e9WjQN4rzfAx20/ZV+
+COcfTn7V5rSLz/X6T6DN+IIlMCd83aaaBjMmTJVSGpaexu+Mf4YLaj8Wv6hHkF9H
+/UizZl18eUmMubcdfG/Th53DV7T5PwtR7hJtM/bJTpN2JI+r0yl1kirXq4xCtrKp
+LQRp0VdWE93G2TZ4aX0Ive31r4C9ZhkJKednDni1IhG358/molgf1T2D9+yTW0sQ
+Iq69uLH6MtZkPF1kZijk1o9vfLGjaV3Pu8Fx5mp5ZV8Wu1yX4uocqkBrQFP97Otk
+qtouGFMNuoZrweW2ch7+L9QzBERv6Js=
+=E+ag
+-----END PGP PUBLIC KEY BLOCK-----
diff --git a/modules/secrets/gpg.age b/modules/secrets/gpg.age
new file mode 100644
index 0000000000000000000000000000000000000000..d3f02cb92761042bc024f93ef13b994d74ed2419
GIT binary patch
literal 3824
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCTS@-|2hELSMdHqJNl
z%*pUBO!x85^9oEa^$jRCEzC*vNh?jW%*ZRv_s+=oj4;VGPUmtl3GvF#jC9G4@-X%)
zC{M}A3=8#iNli`34)FCgiZb+!3dxG9^bT+~G(oq`Im^qjC|x1d#kAbn&8#rd%c&$H
zJIBzu(!|28#4kN6KQXgVKQJ-3D9zQ$B+b|($Cb+>SU=Cr(6c<p%e>6RDXqjQEwnt;
z+$pEbCs;q%P2VlE#H-3E$iqA$EtyMKS69K^$2ZC}Ke5Wu!z|C!(BG{*Ak94_-8@6z
z(KI7O-!VVQGEdvp)7`(+IF##(SGl%^XWtcP;UiOjJqU0xZRy;@f9+#6gObJnfIU58
z0vu&GZr^Nvb;{G;O7vIY$&w{+n#F4t{PR2iYirrI2L}A-r~4bb+<asdT=;2U%=sKv
zG1tBu_O0#mCx5U!s5z{%?w8J+d$Mo&w4FL1nMj_fb?Jy(#Fd|ape3&0_q=`O?bg$@
z^i=J`ZpB|M-TYAaT5rzJOA`bRy<YQIZmml8I-c)qm)yJeNz|Q7=1udp56kxYt+Kqd
z$LEvo&$`X0B4pCEZ{5gl+{$tDw518}t*0HSFK=)>-ZOot?vF$4dkn$^9Sq_RT71d)
zd}#44-bt_a&3WkD{CoZVoa?G(Pit?oO*#Ipzxhpo(VE`hhWGQ`<nHIK7D#y$mHXYr
zaJL}ujOELI2$)a)em}W<`{5mjzgMcCk)FE3++q3grN?G;iN!FiZ4b9A4LG87aLVfA
zLi1J!DBW>7Ft2tcgZGnFpJ!X_lK7=|E#_iNOGSr$;{553Ar~%vc<189s1%a2hkvGN
ztnO2-{tX{8`7ZiKCc3G-wCL9|;cl{2bYgwozTs5YGLC4Ct**rm=0!7B6kcC*Mk%K)
z<hz!<kl?E*#_y)e*QUJrv|?TwPyXSnOmq00@7)di5*}L}UMGKj<BPB7@742Yd1ndl
z5Wau*(V7gU3G%-Uon{_zo~O;{zWPef!KlrSTMw=~8f<^?)VC#Btc-C1B5L1)8Dyfa
zZQNwyS9~m0x@(t^cU?o?t?h4x_pB<pKP}`R-)~>3WU;!(0zc2r+PyARciU;tOTLoL
zD|C%AU4`=-eGaip-mY-F*f2?8aSmVW?M{ocrp6&|;tl5(hgzkGBqXjfx^r_=O^MW;
z+fVgwN0+|#{QOKu%qsu=j5iiq+y+@oIo0_R*T0|imm~Vl3*Y!PHD~WxR@`}7vnrR@
z@Oee2w(Sbn;76A-PVTL5=bAKIO=oLnxBa7KJ5Dg|zRhbFF}E(_-iy<g!fRG;u;{qv
z`<cg}A#HWc=O;3jk56pZZshxDxl-VBxFm;(`|&b9E50j9OjF#wBVrfavtQADR4s&o
zU)y@gN88MZE9!0{Ze2Haq}Zv~PCd%oeC~4E<(CG^+qKvi@lE)&`bm+xfm(ov!7CG^
zZDq4-wX!#{wN@~@p8WdD@9}P?7kA%QG1y+8+w%YH?e)qNmhkG`E4h@k+2g{Zj~BD+
zSfz!QtFcU3RI=MJxAv88o#x!D{-PYZTuy#&x9r->ZE7dW<}71y-7sxmMu>lXg>1rp
z1FhStr({-2<y5K^J{LTCmEnt$f7nmfL*8qmPc;?n`>*cBuRiJUj>n6R$8^{(xK;M3
zB#cjayL5Npw7Ppcr+8%?YMggeJo4wwybpQjjBZ?>lB0H8$=#VdQ2C?6HGaq2!NOns
zz3=yZHq)>=e9Jf9Bgu;Q$nQy?rYEfVbljyT{?{ERo=KbzzP{oS#bz;=r#OC8<CodH
zxrh4}<0MnBJ8^;{R}*R`B>jkde9bjM?x(`B#?voaC8U4OecXECm1@|HS3whFquF1~
z_Op39r(gA5rOU4#1F1?oO}D&_vlA;exgMC+bI;{;fV;!(QzG^4|GjQ!n|_&g`Q;A7
z?lad->s^$q1kN><aX!6v%V}x1oS6ELqs!K;Yq>Y&ERWKjCBF^d6@LiTaJBASKi7Hh
zrmN3Z)^W{Gtqamm=xB5}_F`Mf<T9UoX5SaAN)em#qhtB%i5CN{qi49iD|gTi6x%Fk
zomzTptwE0R`M0msMJ|5ZFZVH_XUp-RXp<{J9>-t4(W}23w8F{${;PAZKChT|%)Zsl
z{)~NDt%98E?JmC1Gq--d5B+gQmene=tZlClXWu?EE=xIM(QH<^Q%^)#j!f#=BN`)m
zX8(;n8+Y9Pv^Qg=JEz}m>F&>~k9Qvb<od|z?pDWR`+d*uz7kN78+<xpo{?|pMfHq}
zE?*<nOOKq6RJ=Q9a+Q7Iy6uZ?F7r*2|5B>SDRkpb+tCQ#YJml7ePok&FH;mW&AyW6
z`JJ;u%0z6t$A^<k=c&xvW1eSP)1`IN>dl*HDqa>%VH;)b<xVkMK3k`3mb5ZFjj7to
zs71m!Uqa)?l<mh`@1?w`sXF%2_=I{B`wFM%lzFiQGlRA7EmCs6I`hLCalXk#G7ZO1
zai9OsR(C1;(CqHq&wBF5QY`YzGvu<EHqM&p_4L(o{(xCkhy1TeJ^FiR*~Nf=u@@GL
zJY$V6|FGTD>G$*9zH-w#nu=ME+gAPSIvLa}eXx3_`XA?auRlj_*w|O__)6pcZ=nwb
z|N75<7c2Th;+x}|^aROelB>C!cfS2}>Yl^Ph@B>RCH#L&fBCuoT;{!U>ZRxI)8jmB
zY@BXgbC^17;|j)yll`-&zW=;tuEG8HKg53dzH6ECqvq&y&$bVnuYaF(I@d+6xVn@>
z>y$teQ}_Rboip_h6?ZDBtqS<_Yv!`{mX$ZUta+X$$*%dNyLpQX*Trk?ZUHA2w!g~X
zZtBe+G26SF(`oqwi$~lkQdLI%$AW8`Ci|)`PW{yXs?c1e<#+gkZ)&r7dNQR`&1xhP
z%x4InX?T9vBB;D|0((N9iv8s^e_fJ&FFe@%aMfgAUkjtDck=jp79Z<tiS|)RyKfw(
z$asQ>BQ8QZ+u3+&jC4_k1Xt^k*FUXezsyvv;&i*f%F^;&+F`N8q~4$FRp;EiXd?2C
zjpvonLF>zrZl+&ii_euxe0eTmp4Ri=@r4<488*h{O+0i}|M1>p>NR=n5BQok{d@fX
z<%iaJJ6#@JzfrKeO6v9nqlkUMEc?^;<?lW||CQ1PwxdTM%@5tEU=Y*({<^ckgx|CG
z&k^tcXt&xTw`ZA?q-L{J+>3h$5;UsYmb=Vne$1(G&dE+@^;wtOEA{T0ru{0qxj2yN
z>A}S;8-HisYMk8PaO9Cx_t#bDI~_g?Z;zWSAUyL)##h@#_7~W#6McgGZp+ke`E7jh
z@Zm{!{yH$WN?tmB^KE!}=ycUU*7ohPw#_p$zxJ+Ze7D;7V9(U6PdFUXIR3t3KPl*$
zoN&1~j%$hO?ZfL$Pr2RUm1uZVugCjOWH;Nx(#><+r})cGk)D?BWW(1GBAC5B=-+Eq
zw&jy@Ws6t!P2cxDTXH9dp5B5?%eh@L?7l^AP6eOcLUv75i|L3qSn#peqMeo9C0hFH
zPP0k(%-`#Lykhg{U2BIK-{i|@tvwIN+&G-4_aOJ-TchXi3jWJ&wwO5o$5yeWW=H$C
z#+>;a6ZHA4;r3S-r(a1l)M53`zNF*1TJ~kSP2hu5)ADzjIf~cL6W!|FpZDXglR~JW
z_wN38LTts;rXJjS!)RkedJg{^@uw%tG@LJ=?>BfVvi|;JRrU*;F3c24Tks@H?7Phl
z*U7K^Ep+y`Co-Ka`?+*&Lg1?<bM{0{-qbMH&o^hQ!88T;6kF~*tDNcaXI(_JRrn5n
zsJQ30$fZ!U>z%dQsRz@S#!2WVC>h<q5T39ioU5_=07sGavhZM!`4w}|OQo(6jw$<n
z`{9lG%XBq`ws3voKIj`<^|d=TyXDR7j+AP*d)e+UW?8Cdm_Ie=`2S8nc8&0~97|U7
z-RVyiZ!Cy&D4(o*`pVDPGe7?^Z)_H@zBMcG$D$O?PfwGRU%BeNJ$`&=(%<u<wSV3|
z&|Nzvi(`_J&T{4`cjcT<->-Gd=6Pt7FBN^`$hZ7mzj}K0rY)T&Zg41t`P}ktY(D>2
zX>)9{SaxqoWBjJ~pThlY#jjeHmbjEZ4Epl<y2rjn=Wb|cDXgoTIZbokk~jbJQhDmd
zgV*!uMET482rrY!xp-mD%g5}Wtd{nsM9w(m+Qj(yuK1g%1-7S8wG>yqIMZ$Wi+km>
zmC2DuT2`sPDyqE|tZ=?XH~#C#-)A=*Yi(J-By%S#YwyG#f%-LmR@W5P&i}b{o3ZLO
z;T<;KCtfE;zO0Z^I9a^<@b|~dcit9XIIlPQe*McG@7PmJxq8i(znZX(S6!#{s$Gee
zTA=48lZ;iN0(|kFbyNQ*mcP(badO+Z>Rh*{_2y2K6>@LqeVe-8>}Kh2+xC@jx4*sa
zRp1o=!`18>_nGN?eu=DOik9AU^^oNGT$QRVtIk|L(f?<GoYXv@niH+6ul^|LdMajJ
zpHx!rC~FqZsV7*#`o?Q__JggLGn~HZY)yX8Uv;-A`{<XKZy)WrV%eGbEiG16ZpMU$
z4gVa{qq)wpO%=b}wSVhYJ2ul8As-R{P0q*qde80M{O$4+9qq4O=89=Py|RhHPvtq9
z^|x){db5t#L11NB(%Btf<n9%Gu6nHb$mObqa%eXD$*M;=zP2JkmlKkXoQwV^Eu(wP
zwQ85F#a|8U9htdH49^!ue=z0i2>Sc!`jKNh=KHwaytZbYZ_U0dznLCX3O?#-UAZQ9
zssg9M`s&?P8e&iH%niCD|13|#ePZnGMHTHQ4!%>?*!4@vKwI?Y{K_d240}t$qqDcy
zZMqd}*&5E(tD%~>{d`@tMUaxmXScS;^*Pmrr6LkW8WMjmo+)B>ka;B(z;oiS&$&A)
zXH1Sow|wBqiflD(^6n{5f2`&DLE>Zl6{*MDBo@uS{2|EHPx;Z3vx`JuxV~rEl)fkZ
z<+tk}_t<*N1@SI9V6x%Zd(Y{Q3!4}GUiIYNqjbkUuQkEtt?!g)#Xj{vXZ*ay(rbN}
z%L?U4W#^2zNlfaQe_mejnSMB+`e2+wcvPiqj^n@04koEtrbRoA3=A_)SZtfZTIlD%
zci`@%rpeJ_wVIc@<{fg|a<cF3PiAw+ds`0f@qQjDBBvS86s;AWX{>SZxxC=<_@liy
z<+?9ydz{DK8{E@bdB5n$7oN%wQ%@D;M=KhOo>$?Py%>4E(P!V%nq7{e>)Y?nyZ<r(
E0RI_03IG5A

literal 0
HcmV?d00001

diff --git a/modules/secrets/locker.sh b/modules/secrets/locker.sh
index 1beedcc..2def310 100755
--- a/modules/secrets/locker.sh
+++ b/modules/secrets/locker.sh
@@ -4,8 +4,21 @@ set -euo pipefail
 
 AGE_PRIVATE_KEY="$HOME/.ssh/id_ed25519"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+case "${1:-}" in
+  env)
+    ENCRYPTED_FILE="$SCRIPT_DIR/secrets.age"
+    ;;
+  gpg)
+    ENCRYPTED_FILE="$SCRIPT_DIR/gpg.age"
+    ;;
+  *)
+    echo "Usage: $0 {env|gpg}"
+    exit 1
+    ;;
+esac
+
 RECIPIENTS_FILE="$SCRIPT_DIR/recipients.txt"
-ENCRYPTED_FILE="$SCRIPT_DIR/secrets.age"
 
 TMP_FILE=$(mktemp)