Setup git-crypt for secrets.nix, enables gnupg in nix as well.

.gitattributes

@@ -1,2 +1,5 @@
 # Auto detect text files and perform LF normalization
 * text=auto
+
+# git-crypt
+secrets.nix filter=git-crypt diff=git-crypt

.vscode/settings.json

@@ -1,16 +1,25 @@
 {
-    "explorer.fileNesting.patterns": {
-        ".gitignore": ".gitattributes, .envrc, readme",
-        "flake.nix": "flake.lock, shell.nix, checks.nix"
-    },
     "editor.formatOnSave": true,
     "editor.formatOnSaveMode": "file",
+    "explorer.fileNesting.patterns": {
+        ".gitignore": ".gitattributes, .envrc, readme",
+        "flake.nix": "flake.lock, shell.nix, secrets.nix"
+    },
+    "files.exclude": {
+        ".git-crypt": true
+    },
     "terminal.integrated.defaultProfile.linux": "fish-fhs",
     "terminal.integrated.profiles.linux": {
-        // ...
         "fish-fhs": {
-            "path": "systemd-run",
-            "args": ["--user", "--pty", "--quiet", "--same-dir", "--service-type=exec", "fish"]
+            "args": [
+                "--user",
+                "--pty",
+                "--quiet",
+                "--same-dir",
+                "--service-type=exec",
+                "fish"
+            ],
+            "path": "systemd-run"
         }
     }
-}
+}

hosts/common/core/default.nix

@@ -21,6 +21,9 @@
   # System-wide packages, in case we log in as root
   environment.systemPackages = with pkgs; [
     curl
+    git
+    git-crypt
+    gpg-tui
     micro
     openssh
     ranger

hosts/common/core/gnupg.nix

@@ -0,0 +1,9 @@
+{ pkgs, ... }:
+{
+  # GnuPG
+  programs.gnupg.agent = {
+    enable = true;
+    pinentryPackage = pkgs.pinentry-gnome3;
+  };
+  services.pcscd.enable = true;
+}

shell.nix

@@ -34,6 +34,9 @@ in
 
           # Git for repo management
           git
+          git-crypt
+          gnupg
+          gpg-tui
 
           # Shells
           fish