Fixes!

features/encryption/default.nix

@@ -31,6 +31,10 @@
         enableSshSupport = true;
         grabKeyboardAndMouse = false;
         pinentry.package = pkgs.pinentry-emacs;
+        extraConfig = ''
+          allow-emacs-pinentry
+          allow-loopback-pinentry
+        '';
       };
       home.file.".ssh/config".source = ./ssh-config;
       home.file.".ssh/gpg-as-ssh.pub".source = ./gpg-as-ssh.pub;

features/lauretta/emacs/_pkg.nix

@@ -16,5 +16,6 @@ orgTrivialBuild {
 
     agent-shell
     org-caldav
+    pinentry
   ];
 }

features/lauretta/emacs/config.org

@@ -34,6 +34,19 @@
    :models '(openai/gpt-oss-120b)))
 #+end_src
 
+** GPG Pinentry
+
+gpg-agent is configured with =pinentry.package = pkgs.pinentry-emacs=, which
+needs a running Emacs-side pinentry service to hand it prompts over a
+loopback socket. Without =pinentry-start=, the pinentry-emacs binary can't
+reach Emacs and falls back to the curses pinentry (visible as a TUI prompt
+when committing from vterm) or hangs entirely (as seen from Magit).
+
+#+begin_src emacs-lisp
+(require 'pinentry)
+(pinentry-start)
+#+end_src
+
 ** Agent Shell
 
 #+begin_src emacs-lisp

nixos/configuration.nix

@@ -119,7 +119,7 @@
         services.greetd.settings = lib.mkForce {
           terminal.vt = 1;
           default_session = {
-            command = "${pkgs.tuigreet}/bin/tuigreet --time --user-menu --cmd '/home/aner/.login.sh'";
+            command = "${pkgs.tuigreet}/bin/tuigreet --time --user-menu --user-menu-min-uid 1000 --user-menu-max-uid 29999 --cmd '/home/aner/.login.sh'";
             user = "greeter";
           };
           initial_session = {