Add gpg signing

home/default.nix

@@ -18,8 +18,18 @@
 
   programs.git = {
     enable = true;
+
     settings.user.name = "Syed Daanish";
     settings.user.email = "me@syedm.dev";
+
+    signing = {
+      format = "openpgp";
+      key = "9988BF5D83DCEC880D69A3DA4786C50E6037E76A";
+      signByDefault = true;
+      signer = "${pkgs.writeShellScriptBin "gpg-secrets" ''
+        exec ${pkgs.gnupg}/bin/gpg --homedir /run/secrets/gpg "$@"
+      ''}/bin/gpg-secrets";
+    };
   };
 
   xsession = {

hosts/common.nix

@@ -55,6 +55,7 @@
   environment.systemPackages = with pkgs; [
     libinput
     nodejs
+    gnupg
     age
     eza
     yazi

hosts/tardis/default.nix

@@ -66,6 +66,7 @@
     extraPortals = [
       pkgs.xdg-desktop-portal-gtk
     ];
+    config.common.default = "*";
   };
 
   security.rtkit.enable = true;
@@ -78,7 +79,7 @@
     jack.enable = true;
   };
 
-  hardware.pulseaudio.enable = false;
+  services.pulseaudio.enable = false;
 
   services.power-profiles-daemon.enable = true;
 

modules/secrets/default.nix

@@ -7,8 +7,21 @@ let
     #!${pkgs.bash}/bin/bash
     set -euo pipefail
     if [[ -f "${thisDir}/secrets.age" && -f "${config.users.users."me".home}/.ssh/id_ed25519" ]]; then
+      install -m 600 /dev/null /run/secrets.env
       ${pkgs.age}/bin/age -d -i "${config.users.users."me".home}/.ssh/id_ed25519" "${thisDir}/secrets.age" > /run/secrets.env
     fi
+
+    mkdir -p /run/secrets/gpg
+
+    if [[ -f "${thisDir}/gpg.age" ]]; then
+      ${pkgs.age}/bin/age -d \
+        -i "${config.users.users."me".home}/.ssh/id_ed25519" \
+        "${thisDir}/gpg.age" | \
+        ${pkgs.gnupg}/bin/gpg --homedir /run/secrets/gpg --import
+    fi
+
+    chown -R me:users /run/secrets/gpg
+    chmod -R 700 /run/secrets/gpg
   '';
 in
 {

modules/secrets/gpg-public.asc

@@ -0,0 +1,30 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQENBGpFs8UBCADjPGL7oAC2akkJsAjc2ViXf4z1/gJzvDAMiivpAd9a5RIKGuPd
+35SX3wyw5gC9nyS/0wjMe9h0afgvW52ko4j5JVKJmpt2nt55HMM6xYRcRq7tQcd3
+X6RtPPHdi2a187OB31MkFqKhbVLzKM9LEYWV7SoHzbHrdKQIATrg2OR/012avA27
+f1rkIHjk0y0pr9SEtPKgujQHUz0QKAXWpdaI5bRd5GSLMU53BxLUVIZVsfqIfmtJ
+xeYK/8/0jzmExAroCdtcgJLEAZjeuwy9S6mfCW21cSVlKTu6icmYirBcjmVPqbHA
+gJDYrTGVqpQJH7bPqKd26waU2u61N1iHmvENABEBAAG0G0RhYW5pc2ggU3llZCA8
+bWVAc3llZG0uZGV2PokBTgQTAQoAOBYhBJmIv12D3OyIDWmj2keGxQ5gN+dqBQJq
+RbPFAhsDBQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJEEeGxQ5gN+dqtvkIAN7i
+SXAqnyiWscZfEF32WowzmcagjixOAj02VIZJ9chkgqXtRp61OELC9yj6HO3oC8I3
+zMvp1jDA/0VqWgdr5FszVwWaQxvm2cWrkf8qMp2ydJtwqK3KFhZjrsCRSdLyA96o
+WHchO2xMgIXWqFNCUlLIWDeL0GmHbFwSulqGh6IvGc/Qf6R8rciR9Xw5AIaWLt6I
+uPOS73X8v/UKlihp4BWEZhFR4hlUVNeA4fH1UqMQi6L/H0u5wh8/OgyQfLoUtTk8
+NOns9C2BkUUfdSH/fQx3DjQvzCk6xajW/Tv3Lu6S/AFGNfGaagag9IXLPSbyO54G
+bhLVFaZHkskdoSYJZoq5AQ0EakWzxQEIANK4ZcQp0uyS7+YYxyYl9JQKTSgjXvNw
+HVCoKPY1tdJ/1yVd4wc9ggjuaifYhK3kjkVpRf78BagD59j8NptHLHX2GPIbjGbp
+LwgW4N2jXW6khmL4I0aiVuyQcieUI0R+0rdSsfl+J8uIRYdVpalJeqgZ0d+Vktv1
+o3FtPblw17s449VCF0Jl3Z4Ok6YrinsU7b+zy9PpPPgpa4zpcra0uy13Bd6FRDwu
+8U8KASvwGUwk8zcIAahql091Uzn7w52vkwHWS9wqOokKQkD4NhzsHJ5oLUflK4OG
+y5gpLPD4ZbidyeHsPorbdsbpzevrBy84CX+nTW4XhBTWC5MUJFyahW0AEQEAAYkB
+NgQYAQoAIBYhBJmIv12D3OyIDWmj2keGxQ5gN+dqBQJqRbPFAhsMAAoJEEeGxQ5g
+N+dqVpoH/jIx/DYPBrtstQmxtaNUJzVgXoanJIROVR/xY3e9WjQN4rzfAx20/ZV+
+COcfTn7V5rSLz/X6T6DN+IIlMCd83aaaBjMmTJVSGpaexu+Mf4YLaj8Wv6hHkF9H
+/UizZl18eUmMubcdfG/Th53DV7T5PwtR7hJtM/bJTpN2JI+r0yl1kirXq4xCtrKp
+LQRp0VdWE93G2TZ4aX0Ive31r4C9ZhkJKednDni1IhG358/molgf1T2D9+yTW0sQ
+Iq69uLH6MtZkPF1kZijk1o9vfLGjaV3Pu8Fx5mp5ZV8Wu1yX4uocqkBrQFP97Otk
+qtouGFMNuoZrweW2ch7+L9QzBERv6Js=
+=E+ag
+-----END PGP PUBLIC KEY BLOCK-----

modules/secrets/locker.sh

@@ -4,8 +4,21 @@ set -euo pipefail
 
 AGE_PRIVATE_KEY="$HOME/.ssh/id_ed25519"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+case "${1:-}" in
+  env)
+    ENCRYPTED_FILE="$SCRIPT_DIR/secrets.age"
+    ;;
+  gpg)
+    ENCRYPTED_FILE="$SCRIPT_DIR/gpg.age"
+    ;;
+  *)
+    echo "Usage: $0 {env|gpg}"
+    exit 1
+    ;;
+esac
+
 RECIPIENTS_FILE="$SCRIPT_DIR/recipients.txt"
-ENCRYPTED_FILE="$SCRIPT_DIR/secrets.age"
 
 TMP_FILE=$(mktemp)