fix: add yubikey gpg keygrips to avoid having to call gpg --card-status each boot

users/myuser/default.nix

@@ -28,6 +28,12 @@ in
       mode = "640";
     };
 
+    age.secrets."my-gpg-yubikey-keygrip.tar" = {
+      rekeyFile = ./secrets/gpg-keygrip.tar.age;
+      group = myuser;
+      mode = "640";
+    };
+
     home-manager.users.${myuser} = {
       imports = [
         ../config

users/myuser/gpg.nix

@@ -1,8 +1,16 @@
 {
+  lib,
   nixosConfig,
   pkgs,
   ...
 }: {
+  # Make sure the keygrips exist, otherwise we'd need to run `gpg --card-status`
+  # before being able to use the yubikey.
+  home.activation.installKeygrips = lib.hm.dag.entryAfter ["writeBoundary"] ''
+    run mkdir -p "$HOME/.gnupg/private-keys-v1.d"
+    run ${lib.getExe pkgs.gnutar} xvf ${lib.escapeShellArg nixosConfig.age.secrets."my-gpg-yubikey-keygrip.tar".path} -C "$HOME/.gnupg/private-keys-v1.d/"
+  '';
+
   programs.gpg = {
     enable = true;
     scdaemonSettings.disable-ccid = true;