feat(security/gopass): added templates for gopass creation wizard

5 files changed, 145 insertions, 0 deletions

diff --git a/modules/security/gopass/creation-templates/0-website.yml b/modules/security/gopass/creation-templates/0-website.yml
new file mode 100644
index 0000000..0b80a12
--- /dev/null
+++ b/modules/security/gopass/creation-templates/0-website.yml
@@ -0,0 +1,27 @@
+---
+priority: 0
+name: "Website login"
+prefix: "websites"
+name_from:
+  - "url"
+  - "username"
+welcome: "🌐 Creating Website login"
+attributes:
+  - name: "url"
+    type: "hostname"
+    prompt: "Website URL"
+    min: 1
+    max: 255
+  - name: "username"
+    type: "string"
+    prompt: "Username"
+    min: 1
+  - name: "password"
+    type: "password"
+    prompt: "Password for the Website"
+  - name: "totp"
+    type: "otp"
+    prompt: "TOTP secret / otpauth:// URI (leave blank if no 2FA)"
+  - name: "recovery_codes"
+    type: "string"
+    prompt: "Recovery/backup codes, space-separated (optional)"
diff --git a/modules/security/gopass/creation-templates/1-wifi.yml b/modules/security/gopass/creation-templates/1-wifi.yml
new file mode 100644
index 0000000..416a621
--- /dev/null
+++ b/modules/security/gopass/creation-templates/1-wifi.yml
@@ -0,0 +1,34 @@
+---
+priority: 1
+name: "WiFi network"
+prefix: "wifi"
+name_from:
+  - "location"
+  - "ssid"
+welcome: "Creating WiFi network entry"
+attributes:
+  - name: "location"
+    type: "string"
+    prompt: "Location (e.g. home, work, office, cafe)"
+    min: 1
+    max: 64
+  - name: "ssid"
+    type: "string"
+    prompt: "SSID"
+    min: 1
+    max: 32
+  - name: "username"
+    type: "string"
+    prompt: "Username (leave blank if not Enterprise/802.1X)"
+  - name: "security"
+    type: "string"
+    prompt: "Security (WPA2-Personal, WPA2-Enterprise, WPA3-Personal, WEP, Open)"
+  - name: "eap_method"
+    type: "string"
+    prompt: "EAP-Method (PEAP, TLS, TTLS, PWD) - leave blank unless Enterprise"
+  - name: "phase2_auth"
+    type: "string"
+    prompt: "Phase2-Auth (MSCHAPV2, GTC, etc.) - leave blank unless Enterprise"
+  - name: "password"
+    type: "password"
+    prompt: "Password / PSK for the network"
diff --git a/modules/security/gopass/creation-templates/2-access-token.yml b/modules/security/gopass/creation-templates/2-access-token.yml
new file mode 100644
index 0000000..1671e79
--- /dev/null
+++ b/modules/security/gopass/creation-templates/2-access-token.yml
@@ -0,0 +1,35 @@
+---
+priority: 2
+name: "Website access token"
+prefix: "websites"
+name_from:
+  - "url"
+  - "username"
+  - "token_name"
+welcome: "Creating Website access token"
+attributes:
+  - name: "url"
+    type: "hostname"
+    prompt: "Website URL"
+    min: 1
+    max: 255
+  - name: "username"
+    type: "string"
+    prompt: "Username / account this token belongs to"
+    min: 1
+  - name: "token_name"
+    type: "string"
+    prompt: "Token name (e.g. api-readonly, ci-deploy, personal-access-token)"
+    min: 1
+  - name: "token"
+    type: "password"
+    prompt: "Token value"
+  - name: "scopes"
+    type: "string"
+    prompt: "Scopes/permissions granted (optional)"
+  - name: "expires"
+    type: "string"
+    prompt: "Expiry date, e.g. 2027-01-15 (optional, leave blank if none)"
+  - name: "comment"
+    type: "string"
+    prompt: "Notes (optional)"
diff --git a/modules/security/gopass/creation-templates/3-ssh-key.yml b/modules/security/gopass/creation-templates/3-ssh-key.yml
new file mode 100644
index 0000000..136a22b
--- /dev/null
+++ b/modules/security/gopass/creation-templates/3-ssh-key.yml
@@ -0,0 +1,36 @@
+---
+priority: 3
+name: "SSH login"
+prefix: "ssh"
+name_from:
+  - "host"
+  - "username"
+welcome: "🔐 Creating SSH login"
+attributes:
+  - name: "host"
+    type: "hostname"
+    prompt: "Host machine name (hostname, IP, or alias)"
+    min: 1
+    max: 255
+  - name: "username"
+    type: "string"
+    prompt: "Username"
+    min: 1
+  - name: "password"
+    type: "password"
+    prompt: "Password (leave blank if using key-only auth)"
+  - name: "port"
+    type: "string"
+    prompt: "SSH port (optional, default 22)"
+  - name: "private_key"
+    type: "password"
+    prompt: "Private key (paste full contents, e.g. -----BEGIN OPENSSH PRIVATE KEY-----...)"
+  - name: "public_key"
+    type: "string"
+    prompt: "Public key (paste full contents, e.g. ssh-ed25519 AAAA...)"
+  - name: "key_passphrase"
+    type: "password"
+    prompt: "Private key passphrase (optional)"
+  - name: "comment"
+    type: "string"
+    prompt: "Notes (optional)"
diff --git a/modules/security/gopass/default.nix b/modules/security/gopass/default.nix
index e78e595..123b33f 100644
--- a/modules/security/gopass/default.nix
+++ b/modules/security/gopass/default.nix
@@ -34,6 +34,9 @@
         };
       };
     };
+    creation-templates = {
+      enable = lib.mkEnableOption "Enables gopass entry creation templates. New entry creation templates for gopass new or gopass create commands.";
+    };
   };
 
   config = lib.mkMerge [
@@ -83,6 +86,16 @@
         source = ../../../assets/icons/apps/gopass.svg;
       };
 
+      home.activation.copyCreationTemplatesForGopass =
+        lib.mkIf config.security.gopass.creation-templates.enable
+          (
+            lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+              $DRY_RUN_CMD mkdir -p $VERBOSE_ARG "${config.programs.password-store.settings.PASSWORD_STORE_DIR}/.gopass/create"
+              $DRY_RUN_CMD rm -rf ${config.programs.password-store.settings.PASSWORD_STORE_DIR}/.gopass/create
+              $DRY_RUN_CMD cp -r $VERBOSE_ARG --no-preserve=mode ${./creation-templates} "${config.programs.password-store.settings.PASSWORD_STORE_DIR}/.gopass/create"
+            ''
+          );
+
       xdg.desktopEntries."gopass" = {
         name = "gopass";
         exec = "${lib.getExe config.terminal.kitty.package} --class gopass -e ${lib.getExe config.security.gopass.package}";