{ config, lib, ... }:
let
  account = config.facts.account;
  mkScope =
    config: scope:
    let
      email = account.emails.${scope}.address;
      key = config.facts.machine.sshKeys.${scope} or null;
      hasSigningKey = key != null;
      privateKeyPath =
        if hasSigningKey && key.privateKeyPath != null then key.privateKeyPath else "~/.ssh/id_${scope}";
    in
    {
      allowedSigners = lib.optional hasSigningKey "${email} ${key.publicKey}";
      git = {
        user = {
          name = account.realName;
          inherit email;
        }
        // lib.optionalAttrs hasSigningKey {
          signingKey = "${privateKeyPath}.pub";
        };
      }
      // lib.optionalAttrs hasSigningKey {
        core.sshCommand = "ssh -i ${privateKeyPath} -o IdentitiesOnly=yes";
        gpg.ssh.allowedSignersFile = "${config.xdg.configHome}/git/allowed_signers";
      };
    };
in
{
  flake.modules.homeManager.git =
    { config, ... }:
    let
      personal = mkScope config "personal";
    in
    {
      xdg.configFile."git/allowed_signers".text = lib.concatStringsSep "\n" personal.allowedSigners;

      programs.git = {
        enable = true;
        signing.format = "ssh";
        ignores = [
          ".claude/"
          ".codex"
        ];
        settings = {
          init.defaultBranch = "main";
          user = {
            name = account.realName;
            email = account.emails.personal.address;
          };
        };
        includes =
          map
            (path: {
              condition = "gitdir:${path}/";
              contents = personal.git;
            })
            [
              account.nixosConfigurationPath
              "${config.xdg.userDirs.projects}/own"
              "${config.xdg.userDirs.projects}/ext"
              "${config.xdg.userDirs.projects}/forks"
            ];
      };

      programs.gh = {
        enable = true;
        settings.git_protocol = "ssh";
      };
    };

  flake.modules.homeManager.work-git =
    { config, pkgs, ... }:
    let
      work = mkScope config "work";
      githubTokenFile = "${config.xdg.configHome}/yookr/github-read-only.token";
      gh = pkgs.symlinkJoin {
        name = "gh-with-read-only-token-${pkgs.gh.version}";
        paths = [ pkgs.gh ];
        nativeBuildInputs = [ pkgs.makeWrapper ];
        meta.mainProgram = "gh";
        postBuild = ''
          wrapProgram "$out/bin/gh" \
            --run 'if [[ -z "''${GH_TOKEN:-}" && -r "${githubTokenFile}" ]]; then export GH_TOKEN="$(< "${githubTokenFile}")"; fi'
        '';
      };
    in
    {
      xdg.configFile."git/allowed_signers".text = lib.mkAfter (
        lib.concatStringsSep "\n" work.allowedSigners
      );
      programs.git.includes = [
        {
          condition = "gitdir:${config.home.homeDirectory}/yookr/";
          contents = work.git;
        }
      ];
      programs.gh.package = gh;
    };
}