Starting gpg-agent with specific options

Question

I have an application, run as a service by a system user, which uses GPG (using libgpgme in C). This user has no home directory and I would like to eliminate password caching.

Therefore I'd like gpg-agent to be started with --homedir=/opt/myapp/.gnupg --default-cache-ttl 0.

gpg-agent(1) says:

The agent is automatically started on demand by gpg, gpgsm, gpgconf, or gpg-connect-agent. Thus there is no reason to start it manually.

This leads me to a few of questions:

1. How should one start gpg-agent for a specific home-dir with specific command-line options?
2. If gpg-agent is already running, is it possible to change the homedir/default-cache-ttl or should I kill the existing agent?
3. Will killing the existing gpg-agent affect other (non-system) users?

---

For question1: gpg-connect-agent --homedir /opt/myapp/.gnupg /bye creates a new gpg-agent with that homedir, but any other agents continue to run. Which gpg-agent will be used when we sign?

For question 2: I tried the following. However, homedir does not appear as an option in --list-options gpg-agent and while I saw the new values refresh during --list-options, I was still able to sign files without a password.

echo "default-cache-ttl::0" | gpgconf --change-options gpg-agent
echo "max-cache-ttl::0" | gpgconf --change-options gpg-agent

Answer 1

How should one start gpg-agent for a specific home-dir with specific command-line options?

In the service file use Environment=GNUPGHOME=/opt/myapp/.gnupg. gpg-agent is started automatically when calling gpg (or using necessary functions in libgpgme). By setting $GNUPGHOME, the gpg/gpgme calls will connect to an existing gpg-agent with --homedir=/opt/myapp/.gnupg or spawn a new gpg-agent if a suitable one doesn't exist already.

If gpg-agent is already running, is it possible to change the [...]default-cache-ttl or should I kill the existing agent?

From gpgconf(1): "The gpgconf is a utility to automatically and reasonable safely query and modify configuration files in the ‘.gnupg’ home directory. It is designed not to be invoked manually by the user..."

All you really need to do to set the default-cache-ttl is ensure that $GNUPGHOME/gpg-agent.conf exists and contains default-cache-ttl 0. Note that this needs to exist before the new instance of gpg-agent is created. Therefore either ensure this file is installed with the application, or since this is a service use ExecStartPre= to run something that sets this.

Will killing the existing gpg-agent affect other (non-system) users?

There should be no need to kill gpg-agent. Since this is run in a service, any spawned gpg-agents are isolated to the service's cgroup. When the service is stopped, spawned gpg-agents will be killed by systemd.

Note: I am only reasonably sure about the paragraph above. I noticed that when I was testing gpg-connect-agent in ExecStartPre= systemd gave a warning that gpg-agent still existed in the cgroup and was killed.