overhaul gnupg/trezor setup
13 files changed, 15 insertions(+), 126 deletions(-)
M system/prefect.nix → system/prefect.nix
@@ -15,11 +15,11 @@ ./settings/hardware/systemd-boot.nix ./settings/hardware/nvidia-gpu.nix ./settings/hardware/keyboard.nix ./settings/hardware/keyboard-lofree.nix + ./settings/hardware/trezor.nix ./settings/services/syncthing.nix ./settings/services/virtualisation.nix ./settings/user-interface.nix ./settings/programs/base.nix - ./settings/programs/gnupg.nix ./settings/programs/kde.nix ./settings/programs/shell.nix ./settings/programs/docker.nix
M system/settings/hardware/trezor.nix → system/settings/hardware/trezor.nix
@@ -5,13 +5,7 @@ , ... }: { services.trezord.enable = true; environment.systemPackages = with pkgs; [ - gnupg - pinentry (python3.withPackages (ps: with ps; [ trezor_agent wheel ])) trezor-suite ]; - programs.gnupg.agent = { - enable = lib.mkForce false; - enableSSHSupport = lib.mkForce false; - }; }
D system/settings/programs/gnupg.nix
@@ -1,12 +0,0 @@ -{ config -, pkgs -, lib -, ... -}: { - environment.systemPackages = with pkgs; [ - gnupg - pinentry - (python3.withPackages (ps: with ps; [ trezor_agent wheel ])) - ]; - environment.variables.GNUPGHOME = "$HOME/.gnupg/trezor/"; -}
D user/gnupg/dirmngr.conf
@@ -1,3 +0,0 @@ -keyserver hkps://keys.openpgp.org -# keyserver hkp://zkaan2xfbuxia2wpf7ofnkbz6r5zdbbvxbunvp5g2iebopbfc4iqmbad.onion -# use-tor
D user/gnupg/gpa.conf
@@ -1,2 +0,0 @@ -default-key 5FA779613E2AB0EEFC6DD3056A56F2A314E23293 -detailed-view
D user/gnupg/gpg-agent.conf
@@ -1,3 +0,0 @@ -enable-ssh-support -default-cache-ttl 600 -max-cache-ttl 7200
D user/gnupg/gpg.conf
@@ -1,83 +0,0 @@ -# -# This is an implementation of the Riseup OpenPGP Best Practices -# https://help.riseup.net/en/security/message-security/openpgp/best-practices -# - -#----------------------------- -# default key -#----------------------------- - -# The default key to sign with. If this option is not used, the default key is -# the first key found in the secret keyring - -# default-key - -#----------------------------- -# behavior -#----------------------------- - -# Disable inclusion of the version string in ASCII armored output -no-emit-version - -# Disable comment string in clear text signatures and ASCII armored messages -no-comments - -# Display long key IDs -keyid-format 0xlong - -# List all keys (or the specified ones) along with their fingerprints -with-fingerprint - -# Display the calculated validity of user IDs during key listings -list-options show-uid-validity -verify-options show-uid-validity - -# Try to use the GnuPG-Agent. With this option, GnuPG first tries to connect to -# the agent before it asks for a passphrase. -use-agent - -#----------------------------- -# keyserver -#----------------------------- - -# This is the server that --recv-keys, --send-keys, and --search-keys will -# communicate with to receive keys from, send keys to, and search for keys on -keyserver hkps://keys.openpgp.org - -# Provide a certificate store to override the system default -# Get this from https://sks-keyservers.net/sks-keyservers.netCA.pem -# keyserver-options ca-cert-file=.gnupg/sks-keyservers.netCA.pem - -# Set the proxy to use for HTTP and HKP keyservers - default to the standard -# local Tor socks proxy -# It is encouraged to use Tor for improved anonymity. Preferrably use either a -# dedicated SOCKSPort for GnuPG and/or enable IsolateDestPort and -# IsolateDestAddr -# keyserver-options http-proxy=socks5-hostname://127.0.0.1:9050 - -# When using --refresh-keys, if the key in question has a preferred keyserver -# URL, then disable use of that preferred keyserver to refresh the key from -keyserver-options no-honor-keyserver-url -# When searching for a key with --search-keys, include keys that are marked on -# the keyserver as revoked -keyserver-options include-revoked - - -#----------------------------- -# algorithm and ciphers -#----------------------------- - -# list of personal digest preferences. When multiple digests are supported by -# all recipients, choose the strongest one -personal-cipher-preferences AES256 AES192 AES CAST5 - -# list of personal digest preferences. When multiple ciphers are supported by -# all recipients, choose the strongest one -personal-digest-preferences SHA512 SHA384 SHA256 SHA224 - -# message digest algorithm used when signing a key -cert-digest-algo SHA512 - -# This preference list is used for new keys and becomes the default for -# "setpref" in the edit menu -default-preference-list SHA512 SHA384 SHA256 SHA224 AES256 AES192 AES CAST5 ZLIB BZIP2 ZIP Uncompressed
M user/prefect.nix → user/prefect.nix
@@ -19,7 +19,6 @@ ./settings/nixos.nix ./settings/passwords.nix ./settings/ssh.nix ./settings/tabnine.nix - ./settings/trezor.nix ./settings/user-interface.nix ./settings/xresources.nix <private>
M user/settings/base.nix → user/settings/base.nix
@@ -27,7 +27,6 @@ { EMAIL = "alan@alanpearce.eu"; MANPAGER = "bat -l man -p"; ABDUCO_SOCKET_DIR = "${state}/abduco"; - GNUPGHOME = "${data}/gnupg"; SOLARGRAPH_CACHE = "${cache}/solargraph"; ELECTRUMDIR = "${data}/electrum"; DOCKER_CONFIG = "${conf}/docker";
M user/settings/gnupg.nix → user/settings/gnupg.nix
@@ -2,8 +2,18 @@ { config , pkgs , ... }: { - home.file.".gnupg" = { - recursive = true; - source = ../gnupg; + programs.gpg = { + enable = true; + homedir = "${config.xdg.dataHome}/gnupg"; + settings = { + keyserver = "hkps://keys.openpgp.org"; + }; + }; + services.gpg-agent = { + enable = true; + pinentryPackage = with pkgs; + if stdenv.isDarwin + then pinentry_mac + else pinentry-qt; }; }
D user/settings/trezor.nix
@@ -1,10 +0,0 @@ -{ config -, pkgs -, ... -}: { - home.file.".ssh/agent.config" = { - text = '' - ecdsa-curve-name = ed25519 - ''; - }; -}
M user/settings/user-interface.nix → user/settings/user-interface.nix
@@ -51,6 +51,7 @@ falkon mu beeper kdePackages.neochat + kdePackages.kleopatra ]); services.lorri.enableNotifications = true; }