{
  pkgs,
  lib,
  config,
  ...
}:
let
  enabled = config.mod.git.enable;

  # Wrapper around `ssh-keygen` used as git's SSH signing program. Before a
  # signing operation it ensures the passphrase-protected signing key is loaded
  # into the agent — `ssh-keygen -Y sign` reads the key from disk and re-prompts
  # every commit otherwise, since `AddKeysToAgent` only ever caches auth keys.
  # Loading it once (through the GUI askpass) lets later commits reuse the
  # cached key from the agent. Verification and every other op pass straight
  # through to the real ssh-keygen untouched.
  sshSignWrapper = pkgs.writeShellApplication {
    name = "git-ssh-sign";
    runtimeInputs = [
      pkgs.openssh
      pkgs.gawk
      pkgs.gnugrep
    ];
    text = ''
      key="${config.age.secrets."alex.pinwheel-github.com-signing".path}"

      case " $* " in
        *" -Y sign "*)
          fp=""
          fp="$(ssh-keygen -lf "$key.pub" 2>/dev/null | awk '{print $2}')" || true
          if [ -n "$fp" ] && ! ssh-add -l 2>/dev/null | grep -qF "$fp"; then
            # </dev/null detaches stdin so ssh-add uses SSH_ASKPASS (the GUI).
            ssh-add "$key" </dev/null || true
          fi
          ;;
      esac

      exec ssh-keygen "$@"
    '';
  };
in
{
  options = {
    mod.git = {
      enable = lib.mkEnableOption "enable git module";
    };
  };

  config = lib.mkIf enabled {
    home-manager.users.alex = { lib, ... }: {
      programs.git = {
        enable = true;

        includes = [
          { path = ./gitconfig; }
        ];

        signing = {
          key = config.age.secrets."alex.pinwheel-github.com-signing.pub".path;
          signByDefault = true;
        };

        settings = {
          rerere.enable = true;

          # Tells Git to use SSH instead of the default GPG
          gpg.format = "ssh";

          # Sign via a wrapper that loads the signing key into the agent on
          # first use, so subsequent signed commits reuse the cached key
          # instead of re-prompting for the passphrase every time.
          gpg.ssh.program = "${sshSignWrapper}/bin/git-ssh-sign";
        };
      };

      home.file.".ssh/config".target = ".ssh/config_source";

      home.activation.sshConfig = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
        run cat ~/.ssh/config_source > ~/.ssh/config
        run chmod 600 ~/.ssh/config
      '';

      home.packages = [ pkgs.tig ];

      home.file.".tigrc".text = ''
        set main-view-line-number = yes
        set main-view-line-number-interval = 1
      '';
    };

    age.secrets = {
      "alex.pinwheel-github.com-signing" = {
        file = ../../../../secrets/pinwheel/alex.pinwheel-github.com-signing.age;
        path = "/home/alex/.ssh/alex.pinwheel-github.com-signing";
        owner = "alex";
        group = "users";
      };
      "alex.pinwheel-github.com-signing.pub" = {
        file = ../../../../secrets/pinwheel/alex.pinwheel-github.com-signing.pub.age;
        path = "/home/alex/.ssh/alex.pinwheel-github.com-signing.pub";
        owner = "alex";
        group = "users";
      };
    };
  };
}