Set up signed pushes

home/base/gpg.nix

···
         })
         (helpers.mkIfLinux {
           package = pkgs.pinentry-all;
-          program = "pinentry-qt";
+          program = "pinentry";
         })
       ];
     };

modules/server/tangled.nix

···
-{ lib, config, hostname, helpers, ... }:
+{ lib, config, hostname, helpers, pkgs, ... }:
 
 with lib;
 let
···
         listenAddr = "127.0.0.1:5555";
         owner = cfg.tangled.owner;
       };
+    };
+
+    programs.git = {
+      enable = true;
+      config = {
+        gpg.program = "${pkgs.gnupg}/bin/gpg";
+        receive = {
+          advertisePushOptions = true;
+          denyFastForwards = false;
+          fsckObjects = true;
+          autogc = true;
+        };
+
+        include.path = "/etc/gitconfig.private";
+      };
+    };
+
+    age.secrets."gitconfig.private" = {
+      symlink = false;
+      path = "/etc/gitconfig.private";
+      file = ./encrypt/gitconfig.age;
+      owner = cfg.tangled.owner;
+      group = cfg.tangled.owner;
+      mode = "0444";
     };
   };
 }

secrets.nix

···
   "./modules/server/encrypt/tailscale.age".publicKeys = keys;
   "./modules/server/encrypt/rclone.conf.age".publicKeys = keys;
   "./modules/server/encrypt/tangled-knot-ssh.age".publicKeys = keys;
+  "./modules/server/encrypt/gitconfig.age".publicKeys = keys;
 
   "./home/fonts/encrypt/DankMono-Regular.otf.age".publicKeys = keys;
   "./home/fonts/encrypt/DankMono-Bold.otf.age".publicKeys = keys;