1
0
Fork 0
mirror of https://github.com/nix-community/home-manager synced 2024-11-14 15:19:45 +01:00
home-manager/modules/services/gpg-agent.nix

246 lines
6.8 KiB
Nix
Raw Normal View History

2017-01-07 19:16:26 +01:00
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.gpg-agent;
2017-08-21 15:01:36 +02:00
gpgInitStr = ''
GPG_TTY="$(tty)"
export GPG_TTY
''
+ optionalString cfg.enableSshSupport
"${pkgs.gnupg}/bin/gpg-connect-agent updatestartuptty /bye > /dev/null";
2017-08-21 15:01:36 +02:00
2017-01-07 19:16:26 +01:00
in
{
meta.maintainers = [ maintainers.rycee ];
2017-01-07 19:16:26 +01:00
options = {
services.gpg-agent = {
enable = mkEnableOption "GnuPG private key agent";
defaultCacheTtl = mkOption {
type = types.nullOr types.int;
default = null;
description = ''
2017-09-24 19:39:41 +02:00
Set the time a cache entry is valid to the given number of
seconds.
'';
};
defaultCacheTtlSsh = mkOption {
type = types.nullOr types.int;
default = null;
description = ''
Set the time a cache entry used for SSH keys is valid to the
given number of seconds.
2017-01-07 19:16:26 +01:00
'';
};
maxCacheTtl = mkOption {
type = types.nullOr types.int;
default = null;
description = ''
Set the maximum time a cache entry is valid to n seconds. After this
time a cache entry will be expired even if it has been accessed
recently or has been set using gpg-preset-passphrase. The default is
2 hours (7200 seconds).
'';
};
maxCacheTtlSsh = mkOption {
type = types.nullOr types.int;
default = null;
description = ''
Set the maximum time a cache entry used for SSH keys is valid to n
seconds. After this time a cache entry will be expired even if it has
been accessed recently or has been set using gpg-preset-passphrase.
The default is 2 hours (7200 seconds).
'';
};
2017-01-07 19:16:26 +01:00
enableSshSupport = mkOption {
type = types.bool;
default = false;
2017-09-24 19:39:41 +02:00
description = ''
Whether to use the GnuPG key agent for SSH keys.
'';
};
enableExtraSocket = mkOption {
type = types.bool;
default = false;
description = ''
Whether to enable extra socket of the GnuPG key agent (useful for GPG
Agent forwarding).
'';
};
verbose = mkOption {
type = types.bool;
default = false;
description = ''
Whether to produce verbose output.
'';
};
2017-09-24 19:39:41 +02:00
grabKeyboardAndMouse = mkOption {
type = types.bool;
default = true;
description = ''
Tell the pinentry to grab the keyboard and mouse. This
option should in general be used to avoid X-sniffing
attacks. When disabled, this option passes
<option>no-grab</option> setting to gpg-agent.
'';
};
enableScDaemon = mkOption {
type = types.bool;
default = true;
description = ''
Make use of the scdaemon tool. This option has the effect of
enabling the ability to do smartcard operations. When
disabled, this option passes
<option>disable-scdaemon</option> setting to gpg-agent.
'';
2017-01-07 19:16:26 +01:00
};
2018-08-18 20:57:09 +02:00
extraConfig = mkOption {
type = types.lines;
default = "";
example = ''
allow-emacs-pinentry
allow-loopback-pinentry
'';
description = ''
Extra configuration lines to append to the gpg-agent
configuration file.
'';
};
2017-01-07 19:16:26 +01:00
};
};
config = mkIf cfg.enable (mkMerge [
{
home.file.".gnupg/gpg-agent.conf".text = concatStringsSep "\n" (
2017-09-24 19:39:41 +02:00
optional (cfg.enableSshSupport) "enable-ssh-support"
++
optional (!cfg.grabKeyboardAndMouse) "no-grab"
++
optional (!cfg.enableScDaemon) "disable-scdaemon"
++
optional (cfg.defaultCacheTtl != null)
"default-cache-ttl ${toString cfg.defaultCacheTtl}"
2017-09-24 19:39:41 +02:00
++
optional (cfg.defaultCacheTtlSsh != null)
"default-cache-ttl-ssh ${toString cfg.defaultCacheTtlSsh}"
++
optional (cfg.maxCacheTtl != null)
"max-cache-ttl ${toString cfg.maxCacheTtl}"
++
optional (cfg.maxCacheTtlSsh != null)
"max-cache-ttl-ssh ${toString cfg.maxCacheTtlSsh}"
2018-08-18 20:57:09 +02:00
++
[ cfg.extraConfig ]
);
home.sessionVariables =
optionalAttrs cfg.enableSshSupport {
SSH_AUTH_SOCK = "$(${pkgs.gnupg}/bin/gpgconf --list-dirs agent-ssh-socket)";
};
2017-08-21 15:01:36 +02:00
programs.bash.initExtra = gpgInitStr;
programs.zsh.initExtra = gpgInitStr;
}
2017-01-07 19:16:26 +01:00
# The systemd units below are direct translations of the
# descriptions in the
#
# ${pkgs.gnupg}/share/doc/gnupg/examples/systemd-user
#
# directory.
{
systemd.user.services.gpg-agent = {
Unit = {
Description = "GnuPG cryptographic agent and passphrase cache";
Documentation = "man:gpg-agent(1)";
Requires = "gpg-agent.socket";
After = "gpg-agent.socket";
# This is a socket-activated service:
RefuseManualStart = true;
};
2017-01-07 19:16:26 +01:00
Service = {
ExecStart = "${pkgs.gnupg}/bin/gpg-agent --supervised"
+ optionalString cfg.verbose " --verbose";
ExecReload = "${pkgs.gnupg}/bin/gpgconf --reload gpg-agent";
};
2017-01-07 19:16:26 +01:00
};
systemd.user.sockets.gpg-agent = {
Unit = {
Description = "GnuPG cryptographic agent and passphrase cache";
Documentation = "man:gpg-agent(1)";
};
Socket = {
ListenStream = "%t/gnupg/S.gpg-agent";
FileDescriptorName = "std";
SocketMode = "0600";
DirectoryMode = "0700";
};
Install = {
WantedBy = [ "sockets.target" ];
};
2017-01-07 19:16:26 +01:00
};
}
2017-01-07 19:16:26 +01:00
(mkIf cfg.enableSshSupport {
systemd.user.sockets.gpg-agent-ssh = {
Unit = {
Description = "GnuPG cryptographic agent (ssh-agent emulation)";
Documentation = "man:gpg-agent(1) man:ssh-add(1) man:ssh-agent(1) man:ssh(1)";
};
Socket = {
ListenStream = "%t/gnupg/S.gpg-agent.ssh";
FileDescriptorName = "ssh";
Service = "gpg-agent.service";
SocketMode = "0600";
DirectoryMode = "0700";
};
Install = {
WantedBy = [ "sockets.target" ];
};
2017-01-07 19:16:26 +01:00
};
})
(mkIf cfg.enableExtraSocket {
systemd.user.sockets.gpg-agent-extra = {
Unit = {
Description = "GnuPG cryptographic agent and passphrase cache (restricted)";
Documentation = "man:gpg-agent(1) man:ssh(1)";
};
Socket = {
ListenStream = "%t/gnupg/S.gpg-agent.extra";
FileDescriptorName = "extra";
Service = "gpg-agent.service";
SocketMode = "0600";
DirectoryMode = "0700";
};
Install = {
WantedBy = [ "sockets.target" ];
};
};
})
]);
2017-01-07 19:16:26 +01:00
}