system/modules/nixos/programs/pass.nix

{ config, pkgs, lib, ... }:

let
  cfg = config.local.programs.pass;

  pass = pkgs.pass.withExtensions (ext: [
    ext.pass-audit
    ext.pass-update
    ext.pass-otp
  ]);
in
{
  options.local.programs.pass.enable = lib.mkEnableOption "pass";

  config = lib.mkIf cfg.enable {
    environment.systemPackages = [ pass ];

    services.passSecretService.enable = true;
  };
}