fix: add gpg-keygrab to not have to run gpg --card-statu

users/common/programs/gpg.nix

@@ -1,4 +1,9 @@
-{pkgs, ...}: {
+{
+  pkgs,
+  lib,
+  nixosConfig,
+  ...
+}: {
   services.gpg-agent = {
     enable = true;
     enableSshSupport = true;
@@ -71,4 +76,10 @@
       #list-options show-unusable-subkeys
     };
   };
+  # Make sure the keygrips exist, otherwise we'd need to run `gpg --card-status`
+  # before being able to use the yubikey.
+  home.activation.installKeygrips = lib.hm.dag.entryAfter ["writeBoundary"] ''
+    run mkdir -p "$HOME/.gnupg/private-keys-v1.d"
+    run ${lib.getExe pkgs.gnutar} xvf ${lib.escapeShellArg nixosConfig.age.secrets."my-gpg-yubikey-keygrip.tar".path} -C "$HOME/.gnupg/private-keys-v1.d/"
+  '';
 }

users/patrick/default.nix

@@ -46,6 +46,12 @@ lib.optionalAttrs (!minimal) {
       rekeyFile = ../../secrets/smb.cred.age;
     };
   };
+  age.secrets."my-gpg-yubikey-keygrip.tar" = {
+    rekeyFile = ./secrets/gpg-keygrip.tar.age;
+    group = "patrick";
+    mode = "640";
+  };
+
   programs.dconf.enable = true;
 
   home-manager.users.patrick = {