+7

2configs/tpm2.nix

View file Reviewed

··· 25 25 after = [ "graphical-session.target" ]; 26 26 serviceConfig = { 27 27 ExecStart = "${ssh-tpm-agent}/bin/ssh-tpm-agent -l %t/ssh-tpm-agent.sock --no-cache"; 28 28 + # systemd-launched programs don't source /etc/set-environment; publish 29 29 + # the socket to the user manager like gcr-ssh-agent does. 30 30 + ExecStartPost = "${pkgs.systemd}/bin/systemctl --user set-environment SSH_AUTH_SOCK=%t/ssh-tpm-agent.sock"; 28 31 Environment = [ 29 32 "SSH_ASKPASS=${lib.getExe pinentry-rofi}" 30 33 "SSH_ASKPASS_REQUIRE=force" ··· 32 35 Restart = "on-failure"; 33 36 }; 34 37 }; 38 38 + 39 39 + # gnome-keyring (desktops/lib/wayland.nix) pulls in gcr-ssh-agent, which 40 40 + # also sets SSH_AUTH_SOCK in the user manager and would shadow the TPM agent. 41 41 + services.gnome.gcr-ssh-agent.enable = false; 35 42 36 43 environment.sessionVariables = { 37 44 SSH_AUTH_SOCK = "\${XDG_RUNTIME_DIR}/ssh-tpm-agent.sock";

+6 -3

2configs/yubikey.nix

View file Reviewed

··· 19 19 enable = true; 20 20 # Sets up the gpg-agent-ssh.socket unit so gpg-agent (running in 21 21 # --supervised mode) actually receives an ssh listen fd. The module 22 22 - # also exports SSH_AUTH_SOCK in environment.extraInit, which we 23 23 - # don't want system-wide — unset it again below so users opt in via: 22 22 + # also exports SSH_AUTH_SOCK in environment.extraInit (only if unset), 23 23 + # which we don't want as the system-wide default — undo exactly that 24 24 + # export below, leaving other agents (tpm2.nix) alone; users opt in via: 24 25 # SSH_AUTH_SOCK="$(gpgconf --list-dirs agent-ssh-socket)" ssh ... 25 26 enableSSHSupport = true; 26 27 }; 27 28 28 29 environment.extraInit = lib.mkAfter '' 29 29 - unset SSH_AUTH_SOCK 30 30 + case "''${SSH_AUTH_SOCK:-}" in 31 31 + */gnupg/S.gpg-agent.ssh) unset SSH_AUTH_SOCK ;; 32 32 + esac 30 33 ''; 31 34 }