feat(gopass-ssh-load): moved the gopass-ssh-load into modules/scripts

- Maintaining the format of the rest of the codebase moving
  gopass-ssh-load into its own script in modules/scripts instead of
writing it directly in modules/security/gopass/default.nix

1 files changed, 33 insertions, 0 deletions

diff --git a/modules/scripts/gopass-ssh-load/script.sh b/modules/scripts/gopass-ssh-load/script.sh
new file mode 100644
index 0000000..e8bc0ee
--- /dev/null
+++ b/modules/scripts/gopass-ssh-load/script.sh
@@ -0,0 +1,33 @@
+export SSH_AUTH_SOCK="$(gpgconf --list-dirs agent-ssh-socket)"
+
+if [ -z "$SSH_AUTH_SOCK" ] || [ ! -S "$SSH_AUTH_SOCK" ]; then
+  echo "Error: SSH_AUTH_SOCK is not set or valid." >&2
+  exit 1
+fi
+
+if ssh-add -l 2>/dev/null | grep -qE "(ED25519|RSA|ECDSA)"; then
+  exit 0
+fi
+
+for key in github gitlab bitbucket codeberg sourcehut; do
+  if gopass cat "ssh/$key" > /dev/null 2>&1; then
+    tmpdir=$(mktemp -d)
+    keyfile="$tmpdir/key"
+    gopass cat "ssh/$key" > "$keyfile" 2>/dev/null
+    chmod 600 "$keyfile"
+
+    if ! ssh-add "$keyfile" 2>/dev/null; then
+      passphrase=$(gopass cat "ssh/$key/passphrase" 2>/dev/null)
+      if [ -n "$passphrase" ]; then
+        tmpcopy=$(mktemp)
+        cp "$keyfile" "$tmpcopy"
+        chmod 600 "$tmpcopy"
+        if ssh-keygen -p -P "$passphrase" -N "" -f "$tmpcopy" 2>/dev/null; then
+          ssh-add "$tmpcopy" 2>/dev/null
+        fi
+        rm -f "$tmpcopy"
+      fi
+    fi
+    rm -rf "$tmpdir"
+  fi
+done