This repository has no description
configs.phonetpm-ssh: init, use on ignavia, icarus and shodan
author
lassulus
date
(Oct 11, 2026, 10:31 AM CEST)
commit
60f8229a
60f8229a517edca83cf52c4a514c5c25837eff94
parent
3097d0a2
3097d0a235f02d80b6daebeec67a29d91d65086c
+33
-3
+28
configs/phonetpm-ssh.nix
+28
configs/phonetpm-ssh.nix
···
1
+
{
2
+
config,
3
+
lib,
4
+
pkgs,
5
+
...
6
+
}:
7
+
let
8
+
sock = "\${XDG_RUNTIME_DIR}/phonetpm/agent.sock";
9
+
in
10
+
{
11
+
# Use the phonetpm daemon (configs/phonetpm.nix) as the ssh-agent: every
12
+
# signature asks for a fingerprint on the phone. Only a default: hosts that
13
+
# also import configs/tpm2.nix keep the TPM agent as SSH_AUTH_SOCK.
14
+
imports = [ ./phonetpm.nix ];
15
+
16
+
environment.sessionVariables.SSH_AUTH_SOCK = lib.mkDefault sock;
17
+
18
+
# systemd-launched programs don't source /etc/set-environment; publish the
19
+
# socket to the user manager like configs/tpm2.nix does, unless another
20
+
# agent owns SSH_AUTH_SOCK.
21
+
systemd.user.services.phonetpm.serviceConfig.ExecStartPost = lib.mkIf (
22
+
config.environment.sessionVariables.SSH_AUTH_SOCK == sock
23
+
) "${pkgs.systemd}/bin/systemctl --user set-environment SSH_AUTH_SOCK=%t/phonetpm/agent.sock";
24
+
25
+
# gnome-keyring pulls in gcr-ssh-agent, which also sets SSH_AUTH_SOCK in the
26
+
# user manager and would shadow phonetpm.
27
+
services.gnome.gcr-ssh-agent.enable = false;
28
+
}
+2
-2
configs/phonetpm.nix
+2
-2
configs/phonetpm.nix
···
9
9
{
10
10
# Phone-backed ssh-agent / age plugin (https://github.com/Lassulus/phonetpm).
11
11
# The daemon serves %t/phonetpm/{agent,control}.sock; age-plugin-phone finds
12
-
# the control socket on its own. SSH_AUTH_SOCK is intentionally left on the
13
-
# TPM agent for now (configs/tpm2.nix).
12
+
# the control socket on its own. configs/phonetpm-ssh.nix makes it the
13
+
# SSH_AUTH_SOCK.
14
14
environment.systemPackages = [ phonetpm ];
15
15
16
16
systemd.user.services.phonetpm = {
+1
machines/icarus/config.nix
+1
machines/icarus/config.nix