This repository has no description
2configs.yubikey: enable gpg-agent ssh support without exporting SSH_AUTH_SOCK
Set programs.gnupg.agent.enableSSHSupport = true so the
gpg-agent-ssh.socket unit is created and gpg-agent (in --supervised
mode) actually receives the ssh listen fd. The module also exports
SSH_AUTH_SOCK system-wide via environment.extraInit; we don't want
that, so unset it again with mkAfter. Users opt in per command via:
SSH_AUTH_SOCK="$(gpgconf --list-dirs agent-ssh-socket)" ssh ...
author
lassulus
date
(May 1, 2026, 7:57 PM CEST)
commit
811a80e6
811a80e6e6b6371964b11cca8a29e4423d03615a
parent
71dd6cee
71dd6cee5af78ea718cf90a1843361d5b1e5f53a
+10
-6
+10
-6
2configs/yubikey.nix
+10
-6
2configs/yubikey.nix
···
1
1
{
2
2
pkgs,
3
+
lib,
3
4
...
4
5
}:
5
6
{
···
16
17
17
18
programs.gnupg.agent = {
18
19
enable = true;
19
-
# Don't use enableSSHSupport: it would override SSH_AUTH_SOCK system-wide.
20
-
# We still want gpg-agent to expose its ssh socket so it can be used
21
-
# on demand via:
20
+
# Sets up the gpg-agent-ssh.socket unit so gpg-agent (running in
21
+
# --supervised mode) actually receives an ssh listen fd. The module
22
+
# also exports SSH_AUTH_SOCK in environment.extraInit, which we
23
+
# don't want system-wide — unset it again below so users opt in via:
22
24
# SSH_AUTH_SOCK="$(gpgconf --list-dirs agent-ssh-socket)" ssh ...
23
-
# Use "" (not true): gpg-agent treats enable-ssh-support as a flag and
24
-
# rejects any argument; the keyValue formatter renders true as `key true`.
25
-
settings.enable-ssh-support = "";
25
+
enableSSHSupport = true;
26
26
};
27
+
28
+
environment.extraInit = lib.mkAfter ''
29
+
unset SSH_AUTH_SOCK
30
+
'';
27
31
}