This repository has no description
1.0 kB
28 lines
1{
2 config,
3 lib,
4 pkgs,
5 ...
6}:
7let
8 sock = "\${XDG_RUNTIME_DIR}/phonetpm/agent.sock";
9in
10{
11 # Use the phonetpm daemon (configs/phonetpm.nix) as the ssh-agent: every
12 # signature asks for a fingerprint on the phone. Only a default: hosts that
13 # also import configs/tpm2.nix keep the TPM agent as SSH_AUTH_SOCK.
14 imports = [ ./phonetpm.nix ];
15
16 environment.sessionVariables.SSH_AUTH_SOCK = lib.mkDefault sock;
17
18 # systemd-launched programs don't source /etc/set-environment; publish the
19 # socket to the user manager like configs/tpm2.nix does, unless another
20 # agent owns SSH_AUTH_SOCK.
21 systemd.user.services.phonetpm.serviceConfig.ExecStartPost = lib.mkIf (
22 config.environment.sessionVariables.SSH_AUTH_SOCK == sock
23 ) "${pkgs.systemd}/bin/systemctl --user set-environment SSH_AUTH_SOCK=%t/phonetpm/agent.sock";
24
25 # gnome-keyring pulls in gcr-ssh-agent, which also sets SSH_AUTH_SOCK in the
26 # user manager and would shadow phonetpm.
27 services.gnome.gcr-ssh-agent.enable = false;
28}