{ config, lib, ... }:
let
  account = config.facts.account;
in
{
  flake.modules.homeManager.git =
    {
      config,
      pkgs,
      ...
    }:
    let
      machine = config.facts.machine;
      allowedSignersFile = "${config.xdg.configHome}/git/allowed_signers";
      githubTokenFile = "${config.xdg.configHome}/yookr/github-read-only.token";

      gh = pkgs.symlinkJoin {
        name = "gh-with-read-only-token-${pkgs.gh.version}";
        paths = [ pkgs.gh ];
        nativeBuildInputs = [ pkgs.makeWrapper ];
        meta.mainProgram = "gh";
        postBuild = ''
          wrapProgram "$out/bin/gh" \
            --run 'if [[ -z "''${GH_TOKEN:-}" && -r "${githubTokenFile}" ]]; then export GH_TOKEN="$(< "${githubTokenFile}")"; fi'
        '';
      };

      mkScope =
        scope:
        let
          email = account.emails.${scope}.address;
          key = machine.sshKeys.${scope} or null;
          hasSigningKey = key != null;
          privateKeyPath =
            if hasSigningKey && key.privateKeyPath != null then key.privateKeyPath else "~/.ssh/id_${scope}";
        in
        {
          allowedSigners = lib.optional hasSigningKey "${email} ${key.publicKey}";
          git = {
            user = {
              name = account.realName;
              inherit email;
            }
            // lib.optionalAttrs hasSigningKey {
              signingKey = "${privateKeyPath}.pub";
            };
          }
          // lib.optionalAttrs hasSigningKey {
            core.sshCommand = "ssh -i ${privateKeyPath} -o IdentitiesOnly=yes";
            gpg.ssh.allowedSignersFile = allowedSignersFile;
          };
        };

      personal = mkScope "personal";
      work = mkScope "work";
    in
    {
      xdg.configFile."git/allowed_signers".text = lib.concatStringsSep "\n" (
        personal.allowedSigners ++ work.allowedSigners ++ [ "" ]
      );

      programs.git = {
        enable = true;
        signing.format = "ssh";
        ignores = [
          ".claude/"
          ".codex"
        ];
        settings = {
          init.defaultBranch = "main";
          user = {
            name = account.realName;
            email = account.emails.personal.address;
          };
        };
        includes = [
          {
            condition = "gitdir:${account.nixosConfigurationPath}/";
            contents = personal.git;
          }
          {
            condition = "gitdir:${config.xdg.userDirs.projects}/work/";
            contents = work.git;
          }
          {
            condition = "gitdir:${config.xdg.userDirs.projects}/own/";
            contents = personal.git;
          }
          {
            condition = "gitdir:${config.xdg.userDirs.projects}/ext/";
            contents = personal.git;
          }
          {
            condition = "gitdir:${config.xdg.userDirs.projects}/forks/";
            contents = personal.git;
          }
        ];
      };

      programs.gh = {
        enable = true;
        package = gh;
        settings.git_protocol = "ssh";
      };
    };
}