From 171c30e79fe34ce2dcf411b9db0f9cf64616a0c7 Mon Sep 17 00:00:00 2001
From: Arpit Chakladar <arpitchakladar+git@gmail.com>
Date: Wed, 2 Sep 2026 19:08:01 +0530
Subject: feat(security/gopass): auto initialize git sync repo for gopass on
 build

---
 modules/security/gopass/default.nix | 34 +++++++++++++++++++++++++++++++---
 1 file changed, 31 insertions(+), 3 deletions(-)

(limited to 'modules/security/gopass/default.nix')

diff --git a/modules/security/gopass/default.nix b/modules/security/gopass/default.nix
index 5650c4b..341c901 100644
--- a/modules/security/gopass/default.nix
+++ b/modules/security/gopass/default.nix
@@ -96,9 +96,15 @@ in
               gpgSign = false;
             };
           }
-          // lib.optionalAttrs (config.security.gopass.sync.credential.passwordGopassPath != null) {
-            credential.helper = "!f() { echo username=${lib.escapeShellArg config.security.gopass.sync.credential.username}; echo password=\"$(${config.security.gopass.package}/bin/gopass show -o ${lib.escapeShellArg config.security.gopass.sync.credential.passwordGopassPath})\"; }; f";
-          };
+          //
+            lib.optionalAttrs
+              (
+                config.security.gopass.sync.enable
+                && config.security.gopass.sync.credential.passwordGopassPath != null
+              )
+              {
+                credential.helper = "!f() { echo username=${lib.escapeShellArg config.security.gopass.sync.credential.username}; echo password=\"$(${config.security.gopass.package}/bin/gopass show -o ${lib.escapeShellArg config.security.gopass.sync.credential.passwordGopassPath})\"; }; f";
+              };
         }
       ];
 
@@ -120,8 +126,30 @@ in
         type = "Application";
       };
     })
+
     (lib.mkIf config.security.gopass.ssh-agent.enable {
       home.packages = [ config.security.gopass.ssh-agent.package ];
     })
+
+    (lib.mkIf config.security.gopass.sync.enable {
+      home.activation.gopassSyncInit =
+        let
+          gopassSyncInit = pkgs.writeShellApplication {
+            name = "gopass-sync-init";
+            runtimeInputs = [
+              pkgs.bash
+              config.development.git.package
+            ];
+            text =
+              builtins.replaceStrings
+                [ "@@PASSWORD_STORE_DIR@@" "@@REMOTE_REPO_URL@@" ]
+                [ config.programs.password-store.settings.PASSWORD_STORE_DIR config.security.gopass.sync.remote ]
+                (builtins.readFile ./gopass-sync-init.sh);
+          };
+        in
+        lib.hm.dag.entryAfter [ "writeBoundary" ] ''
+          run ${lib.getExe gopassSyncInit} || true
+        '';
+    })
   ];
 }
-- 
cgit v1.2.3