From aaf17256ccd4abf8568ef5885866b5efe9316d6f Mon Sep 17 00:00:00 2001
From: Phil Pluckthun <phil@kitten.sh>
Date: Sat, 6 Sep 2025 22:37:14 +0100
Subject: [PATCH] Set up signed pushes

---
 home/base/gpg.nix                    |   2 +-
 modules/server/encrypt/gitconfig.age | Bin 0 -> 335 bytes
 modules/server/tangled.nix           |  26 +++++++++++++++++++++++++-
 secrets.nix                          |   1 +
 4 files changed, 27 insertions(+), 2 deletions(-)
 create mode 100644 modules/server/encrypt/gitconfig.age

diff --git a/home/base/gpg.nix b/home/base/gpg.nix
index c4d78df..70ccaae 100644
--- a/home/base/gpg.nix
+++ b/home/base/gpg.nix
@@ -44,7 +44,7 @@ in {
         })
         (helpers.mkIfLinux {
           package = pkgs.pinentry-all;
-          program = "pinentry-qt";
+          program = "pinentry";
         })
       ];
     };
diff --git a/modules/server/encrypt/gitconfig.age b/modules/server/encrypt/gitconfig.age
new file mode 100644
index 0000000000000000000000000000000000000000..dedd85bc1e11d5317cec75d76c972dc25be24f56
GIT binary patch
literal 335
zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCR+EKe#3C|AhK*3K=q
z%+JU)NzF1UFV1tUbWJNx%*b&KH1P>d3oWY%iLmqzcl9@kaO86L@hwWv%C;~JGc}6z
zbxkZX2(<_<GfGPg^+}5e_jF84GW0acbE)*nG2qhG)m1R_O34b&E{=%sOH4ONc8oIg
zGc0m33o|J$E)5ONb&QNOPBk)&3`)%LHQ_Ry_-e6wrnuF1u6YlSzxSTz*Sx>=bNsgF
z5C0i0bMpI<JbCs%zTInf&z64aHmOpv>&N1`dP1KqOkclxcW>^5;&sCJR!@uS&MB?z
zb9^Oi^<W-LV)MsC;)joke4Oz%@%Y7cUK+m*PPMzG9-Vo?E~PA3Af`5Eo8qxEM;I2A
n`3HA<ck42y+Z<W2hI1yj^^fWa7H2lj+>tHKps~q(+RZ2cXDf-3

literal 0
HcmV?d00001

diff --git a/modules/server/tangled.nix b/modules/server/tangled.nix
index 05a4063..f71b4c2 100644
--- a/modules/server/tangled.nix
+++ b/modules/server/tangled.nix
@@ -1,4 +1,4 @@
-{ lib, config, hostname, helpers, ... }:
+{ lib, config, hostname, helpers, pkgs, ... }:
 
 with lib;
 let
@@ -34,5 +34,29 @@ in helpers.linuxAttrs {
         owner = cfg.tangled.owner;
       };
     };
+
+    programs.git = {
+      enable = true;
+      config = {
+        gpg.program = "${pkgs.gnupg}/bin/gpg";
+        receive = {
+          advertisePushOptions = true;
+          denyFastForwards = false;
+          fsckObjects = true;
+          autogc = true;
+        };
+
+        include.path = "/etc/gitconfig.private";
+      };
+    };
+
+    age.secrets."gitconfig.private" = {
+      symlink = false;
+      path = "/etc/gitconfig.private";
+      file = ./encrypt/gitconfig.age;
+      owner = cfg.tangled.owner;
+      group = cfg.tangled.owner;
+      mode = "0444";
+    };
   };
 }
diff --git a/secrets.nix b/secrets.nix
index 0528c2c..cc91df3 100644
--- a/secrets.nix
+++ b/secrets.nix
@@ -9,6 +9,7 @@ in
   "./modules/server/encrypt/tailscale.age".publicKeys = keys;
   "./modules/server/encrypt/rclone.conf.age".publicKeys = keys;
   "./modules/server/encrypt/tangled-knot-ssh.age".publicKeys = keys;
+  "./modules/server/encrypt/gitconfig.age".publicKeys = keys;
 
   "./home/fonts/encrypt/DankMono-Regular.otf.age".publicKeys = keys;
   "./home/fonts/encrypt/DankMono-Bold.otf.age".publicKeys = keys;
-- 
2.51.2