fix(security/ssh): fixed the loading ssh key from gopass

Now on every home-manager switch we run a script that loads the key form
gopass to gpg-agent, then the gpg-agent is responsible for storing it.
Anytime gopass changes the ssh key we must run home-manager switch to
load the ssh key into gpg agent.

2 files changed, 0 insertions, 108 deletions

diff --git a/modules/security/gopass/default.nix b/modules/security/gopass/default.nix
index 4cf9182..e78e595 100644
--- a/modules/security/gopass/default.nix
+++ b/modules/security/gopass/default.nix
@@ -5,30 +5,6 @@
   pkgs,
   ...
 }:
-let
-  gopassKeys = config.security.ssh.gopassKeys;
-
-  gopassSshLoadScript = pkgs.writeShellApplication {
-    name = "gopass-ssh-load";
-    runtimeInputs = [
-      config.security.gopass.package
-      config.security.gpg.package
-      config.security.ssh.package
-      config.terminal.bash.package
-    ];
-    text =
-      builtins.replaceStrings
-        [
-          "@@GOPASS_SSH_KEYS@@"
-          "@@GNUPGHOME@@"
-        ]
-        [
-          (lib.concatStringsSep " " gopassKeys)
-          config.home.sessionVariables.GNUPGHOME
-        ]
-        (builtins.readFile ./gopass-ssh-load.sh);
-  };
-in
 {
   options.security.gopass = {
     enable = lib.mkEnableOption "Enables gopass.";
@@ -38,15 +14,6 @@ in
       default = config.programs.password-store.package;
       description = "The gopass package to use.";
     };
-    ssh-agent = {
-      enable = lib.mkEnableOption "gopass-backed SSH keys for git";
-      package = lib.mkOption {
-        type = lib.types.package;
-        readOnly = true;
-        default = gopassSshLoadScript;
-        description = "The gopass-ssh-load script package.";
-      };
-    };
     sync = {
       enable = lib.mkEnableOption "Enables git-backed syncing of the gopass data directory.";
       remote = lib.mkOption {
@@ -127,10 +94,6 @@ in
       };
     })
 
-    (lib.mkIf config.security.gopass.ssh-agent.enable {
-      home.packages = [ config.security.gopass.ssh-agent.package ];
-    })
-
     (lib.mkIf config.security.gopass.sync.enable {
       home.activation.gopassSyncInit =
         let
diff --git a/modules/security/gopass/gopass-ssh-load.sh b/modules/security/gopass/gopass-ssh-load.sh
deleted file mode 100644
index 8c1b11f..0000000
--- a/modules/security/gopass/gopass-ssh-load.sh
+++ /dev/null
@@ -1,71 +0,0 @@
-#!/usr/bin/env bash
-
-# gopass-ssh-load
-#
-# Load SSH keys into the SSH agent from the gopass password store.
-#
-# This script reads private keys and (optionally) their passphrases from gopass
-# entries under the `ssh/` directory and adds them to the SSH agent served by
-# gpg-agent. It is meant to be run manually whenever a key is imported into or
-# rotated within the gopass store, so the SSH agent picks up the change.
-#
-# Behaviour:
-#   * It first verifies that a usable SSH agent socket exists and bails out if
-#     not.
-#   * It exits early (without doing anything) when the agent already has at
-#     least one Ed25519/RSA/ECDSA identity loaded, to avoid useless work and
-#     unnecessary gpg passphrase prompts.
-#   * For each key listed in GOPASS_SSH_KEYS it writes the corresponding
-#     `ssh/<key>` entry to a temporary file, strips the passphrase using the
-#     `ssh/<key>/passphrase` entry, and registers the key with `ssh-add`.
-#
-# Temporary key files are written with mode 600 and removed afterwards.
-
-set -o errexit
-set -o nounset
-set -o pipefail
-
-export GNUPGHOME="@@GNUPGHOME@@"
-export GOPASS_SSH_KEYS="@@GOPASS_SSH_KEYS@@"
-
-info()  { printf '\033[1;34m==>\033[0m %s\n' "$*"; }
-warn()  { printf '\033[1;33m==> warning:\033[0m %s\n' "$*" >&2; }
-error() { printf '\033[1;31m==> error:\033[0m %s\n' "$*" >&2; }
-die()   { error "$*"; exit 1; }
-
-SSH_AUTH_SOCK="$(gpgconf --list-dirs agent-ssh-socket)"
-export SSH_AUTH_SOCK
-if [ -z "$SSH_AUTH_SOCK" ] || [ ! -S "$SSH_AUTH_SOCK" ]; then
-  die "SSH_AUTH_SOCK is not set or valid."
-fi
-
-if ssh-add -l 2>/dev/null | grep -qE "(ED25519|RSA|ECDSA)"; then
-  exit 0
-fi
-
-# GOPASS_SSH_KEYS holds a space-separated list of gopass entry names under ssh
-if [ -z "${GOPASS_SSH_KEYS:-}" ]; then
-  die "GOPASS_SSH_KEYS is not set. Example: GOPASS_SSH_KEYS=\"github gitlab\""
-fi
-
-# shellcheck disable=SC2086
-read -r -a keys <<< "$GOPASS_SSH_KEYS"
-
-for key in "${keys[@]}"; do
-  if gopass cat "ssh/$key" > /dev/null 2>&1; then
-    tmpdir=$(mktemp -d)
-    keyfile="$tmpdir/key"
-    gopass cat "ssh/$key" > "$keyfile" 2>/dev/null
-    chmod 600 "$keyfile"
-
-    passphrase=$(gopass cat "ssh/$key/passphrase" 2>/dev/null || true)
-    if [ -n "$passphrase" ]; then
-      ssh-keygen -p -P "$passphrase" -N "" -f "$keyfile" 2>/dev/null
-    fi
-
-    ssh-add "$keyfile" 2>/dev/null
-    rm -rf "$tmpdir"
-  else
-    warn "no gopass entry ssh/$key"
-  fi
-done