dotfiles/home/git.nix at 5a048663dd9625df08fe2008568477bc4769b964 · ixxq/dotfiles · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
{
  config,
  lib,
  pkgs,
  ...
}:
let
  gitVersion = "2.55.0";

  userEmail = "83203852+lemtoc@users.noreply.github.com";

  # ローカルで `git log --show-signature` を通すための信頼済み公開鍵。
  # 鍵の実体は不要なので、そのホストに存在しない鍵も載せてよい。
  # 新しい鍵を作ったらここに追記する。ローカルで過去のコミットを検証するため、
  # 退役鍵は削除せず、必要なら `valid-before` で有効期間を制限する。
  # ローテーション手順は docs/secure-enclave-signing.md を参照。
  allowedSignerKeys = [
    # 1Password (M4Air / 移行前の M4Pro) — SHA256:G/X9g4PrQznsy2+Qx5MUbI7X1e3ZT1G6KT2CTMP3m3k
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF+zJB91Fifv36IetC+AhWcBE+a9poI/U+A6MlLfABoa"
    # Secure Enclave (M4Pro) — SHA256:AsbsNi30tI7r4kUqNSHew9DI86raUYeHeYP3MLCjpck
    "sk-ecdsa-sha2-nistp256@openssh.com AAAAInNrLWVjZHNhLXNoYTItbmlzdHAyNTZAb3BlbnNzaC5jb20AAAAIbmlzdHAyNTYAAABBBE3fdVRsCoAJtcjjG+is4FILynjzM42+czwaeQfBiuP+8Kr/8YGe/zh/6pYG2v7ARKrywp+XHcv+d7Y1+E7wSOIAAAAEc3NoOg=="
  ];
  allowedSignersFile = "${config.home.homeDirectory}/.ssh/allowed_signers";
in
{
  home.file.".ssh/allowed_signers".text = lib.concatMapStrings (
    key: "${userEmail} ${key}\n"
  ) allowedSignerKeys;

  programs.git = {
    enable = true;
    package = pkgs.git.overrideAttrs (oldAttrs: {
      version = gitVersion;
      src = pkgs.fetchurl {
        url = "https://www.kernel.org/pub/software/scm/git/git-${gitVersion}.tar.xz";
        hash = "sha256-RX/bBNyHKOAH1GiGleaRLm9oByeSDypAvxHqzBdQU1c=";
      };
      patches = builtins.filter (
        patch:
        !(pkgs.lib.hasInfix "expect-gui--askyesno-failure-in-t1517.patch" "${patch}")
        && !(pkgs.lib.hasInfix "osxkeychain-link-rust_lib.patch" "${patch}")
      ) oldAttrs.patches;
      meta = oldAttrs.meta // {
        changelog = "https://github.com/git/git/blob/v${gitVersion}/Documentation/RelNotes/${gitVersion}.adoc";
      };
    });

    # 既定は 1Password の SSH agent。Secure Enclave に移行済みのホストは
    # hosts/<hostname>/default.nix で key/signer を上書きする。
    # 詳細は docs/secure-enclave-signing.md
    signing = {
      key = lib.mkDefault "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF+zJB91Fifv36IetC+AhWcBE+a9poI/U+A6MlLfABoa";
      signByDefault = true;
      format = "ssh";
      signer = lib.mkDefault "/Applications/1Password.app/Contents/MacOS/op-ssh-sign";
    };

    settings = {
      user = {
        name = "lemtoc";
        email = userEmail;
      };
      gpg.ssh.allowedSignersFile = allowedSignersFile;
      init.defaultBranch = "main";
      pull.ff = "only";
      push.autoSetupRemote = true;
      wt = {
        basedir = "../{gitroot}-worktrees";
        copyignored = true;
        copyuntracked = true;
        copymodified = true;
        hook = "ni";
      };
    };

    ignores = [
      ".DS_Store"
      "*.log"
      "node_modules/"
      "dist/"
      "*.swp"
      "**/.claude/settings.local.json"
      "**/.codex/"
      "**/CLAUDE.local.md"
      "**/.serena/"
      "**/.review/"
      "**/.docs/"
      "**/.env.stg"
      "**/.env.dev"
      "**/.pnpm-store/"
      "**/.envrc"
      "**/.playwright-mcp/"
      "**/mise.local.toml"
    ];
  };
}