From 1a39cf221e3f647df0767c88d89a54e3813e7019 Mon Sep 17 00:00:00 2001
From: Arpit Chakladar <arpitchakladar+git@gmail.com>
Date: Sat, 29 Aug 2026 03:45:10 +0530
Subject: refactor: adding explicit options to enable scripts

- some scripts that are not critical to the functioning of other
  options, can be enabled/disabled
---
 modules/security/gopass/default.nix | 39 +++++++++++++++--------------
 modules/security/gpg/default.nix    | 50 ++++++++++++++++++++++++++-----------
 2 files changed, 56 insertions(+), 33 deletions(-)

(limited to 'modules/security')

diff --git a/modules/security/gopass/default.nix b/modules/security/gopass/default.nix
index 5fe5b3d..fa5e486 100644
--- a/modules/security/gopass/default.nix
+++ b/modules/security/gopass/default.nix
@@ -6,29 +6,21 @@
   ...
 }:
 let
-  inherit ((import ../../lib/script.nix { inherit lib pkgs; })) mkScriptModule;
-
   gopassKeys = config.security.ssh.gopassKeys;
 
-  gopassSshLoad = mkScriptModule {
-    scope = [
-      "security"
-      "gopass"
-    ];
+  gopassSshLoadScript = pkgs.writeShellApplication {
     name = "gopass-ssh-load";
-    path = ./gopass-ssh-load.sh;
-    description = "Load SSH keys from gopass password store";
-    env = {
-      GNUPGHOME = config.home.sessionVariables.GNUPGHOME;
-      GOPASS_SSH_KEYS = lib.concatStringsSep " " gopassKeys;
-    };
-    deps = with pkgs; [
+    runtimeInputs = with pkgs; [
       config.security.gopass.package
       gnupg
       openssh
       bash
     ];
-    inherit config;
+    text = ''
+      export GNUPGHOME="${config.home.sessionVariables.GNUPGHOME}"
+      export GOPASS_SSH_KEYS="${lib.concatStringsSep " " gopassKeys}"
+      ${builtins.readFile ./gopass-ssh-load.sh}
+    '';
   };
 in
 {
@@ -40,9 +32,16 @@ in
       default = config.programs.password-store.package;
       description = "The gopass package to use.";
     };
-    ssh-agent.enable = lib.mkEnableOption "gopass-backed SSH keys for git";
-  }
-  // gopassSshLoad.options.security.gopass;
+    ssh-agent = {
+      enable = lib.mkEnableOption "gopass-backed SSH keys for git";
+      package = lib.mkOption {
+        type = lib.types.package;
+        readOnly = true;
+        default = gopassSshLoadScript;
+        description = "The gopass-ssh-load script package.";
+      };
+    };
+  };
 
   config = lib.mkMerge [
     (lib.mkIf config.security.gopass.enable {
@@ -72,6 +71,8 @@ in
         type = "Application";
       };
     })
-    gopassSshLoad.config
+    (lib.mkIf config.security.gopass.ssh-agent.enable {
+      home.packages = [ config.security.gopass.ssh-agent.package ];
+    })
   ];
 }
diff --git a/modules/security/gpg/default.nix b/modules/security/gpg/default.nix
index 07d9d4b..ccab0dc 100644
--- a/modules/security/gpg/default.nix
+++ b/modules/security/gpg/default.nix
@@ -6,24 +6,35 @@
   ...
 }:
 let
-  inherit ((import ../../lib/script.nix { inherit lib pkgs; })) mkScriptModule;
-  gpgBackup = mkScriptModule {
-    scope = [
-      "security"
-      "gpg"
-    ];
+  gpgBackupScript = pkgs.writeShellApplication {
     name = "gpg-backup";
-    path = ./gpg-backup.sh;
-    description = "Export/import all GPG keys as a single passphrase-protected file with maximum S2K iteration count\nUsage: gpg-backup export filename.gpg | gpg-backup import filename.gpg";
-    deps = [
+    runtimeInputs = [
       pkgs.bash
       pkgs.gnupg
       pkgs.gnutar
       pkgs.coreutils
       pkgs.findutils
     ];
-    completion.zsh = builtins.readFile ./gpg-backup.zsh;
-    inherit config;
+    text = builtins.readFile ./gpg-backup.sh;
+  };
+
+  gpgBackupCompletion =
+    pkgs.runCommand "gpg-backup-completion"
+      {
+        nativeBuildInputs = [ pkgs.installShellFiles ];
+      }
+      ''
+        mkdir -p $out/share/zsh/site-functions
+        installShellCompletion --zsh --name _gpg-backup ${pkgs.writeText "gpg-backup.zsh" (builtins.readFile ./gpg-backup.zsh)}
+      '';
+
+  gpgBackupScriptPkg = pkgs.symlinkJoin {
+    name = "gpg-backup";
+    paths = [
+      gpgBackupScript
+      gpgBackupCompletion
+    ];
+    meta = gpgBackupScript.meta or { };
   };
 in
 {
@@ -37,8 +48,17 @@ in
       defaultText = lib.literalExpression "config.programs.gpg.package";
       description = "The gpg package to use.";
     };
-  }
-  // gpgBackup.options.security.gpg;
+
+    backup = {
+      enable = lib.mkEnableOption "Enable the gpg-backup script";
+      package = lib.mkOption {
+        type = lib.types.package;
+        readOnly = true;
+        default = gpgBackupScriptPkg;
+        description = "The package for the gpg-backup script";
+      };
+    };
+  };
 
   config = lib.mkMerge [
     (lib.mkIf config.security.gpg.enable {
@@ -60,6 +80,8 @@ in
         pinentry.package = pkgs.pinentry-rofi;
       };
     })
-    gpgBackup.config
+    (lib.mkIf config.security.gpg.backup.enable {
+      home.packages = [ config.security.gpg.backup.package ];
+    })
   ];
 }
-- 
cgit v1.2.3