# Generated by chezmoi from home/dot_gitconfig.tmpl -- do not edit by hand.

{{/* 1Password ships the SSH signer at a different path per platform. Signing is
     enabled only where that binary actually exists, so a machine without the
     1Password desktop app (or with only the CLI) gets a working git rather than
     one that fails on every commit. */}}
{{- $signer := "/opt/1Password/op-ssh-sign" -}}
{{- if eq .chezmoi.os "darwin" -}}
{{-   $signer = "/Applications/1Password.app/Contents/MacOS/op-ssh-sign" -}}
{{- end -}}
{{- $canSign := and (stat $signer) (ne .user.signingkey "") -}}

[user]
	name  = {{ .user.name | quote }}
	email = {{ .user.email | quote }}
{{- if $canSign }}
	signingkey = {{ .user.signingkey | quote }}
{{- end }}

[alias]
	br = branch
	cane = commit --amend --no-edit
	co = checkout
	d = diff
	fp = !git fetch --all --prune && git pull --ff-only
	last = log -1 HEAD
	lo = log --oneline -n 10
	pr = pull --rebase
	s = status

[diff]
	noprefix = true

# Remember conflict resolutions and replay them the next time the same conflict
# shows up -- pays for itself on long-lived branches and repeated rebases.
[rerere]
	enabled = true

{{ if $canSign -}}
# Commits are signed with an SSH key held in 1Password. op-ssh-sign talks to the
# desktop app over its agent socket, so the private key never touches disk.
[commit]
	gpgsign = true

[gpg]
	format = ssh

[gpg "ssh"]
	program = {{ $signer | quote }}
	allowedSignersFile = {{ printf "%s/.config/git/allowed_signers" .chezmoi.homeDir | quote }}
{{- else }}
# No 1Password SSH signer found at {{ $signer }} on this machine, so commit
# signing is left off rather than configured to fail.
{{- end }}

{{ if lookPath "git-lfs" -}}
# Written by `git lfs install`; kept here so a fresh machine gets it from the
# same place as everything else. Only asserted where git-lfs is actually
# installed -- these filters abort every checkout if the binary is missing.
[filter "lfs"]
	clean = git-lfs clean -- %f
	smudge = git-lfs smudge -- %f
	process = git-lfs filter-process
	required = true

{{ end -}}
{{ $gh := lookPath "gh" -}}
{{ if $gh -}}
# GitHub auth is delegated to the gh CLI's own token store. The empty `helper`
# first resets any helper inherited from the system config, so the credential
# stack cannot fall back to a keychain entry that has gone stale.
{{ range $host := list "https://github.com" "https://gist.github.com" -}}
[credential {{ $host | quote }}]
	helper =
	helper = {{ printf "!%s auth git-credential" $gh | quote }}
{{ end }}
{{- end -}}
# git.nakama.town credentials come from 1Password at auth time via
# home/dot_local/bin/executable_git-credential-op -- see README.md.
[credential "https://git.nakama.town"]
	helper = "!GIT_CREDENTIAL_OP_REF=op://Private/git.nakama.town {{ .chezmoi.homeDir }}/.local/bin/git-credential-op"