feat(ssh): lazy-loading ssh keys from gopass

- Loading ssh keys from gopass only when ssh command runs for the first
  time

1 files changed, 15 insertions, 1 deletions

diff --git a/modules/security/ssh/default.nix b/modules/security/ssh/default.nix
index 4b4180f..62186c4 100644
--- a/modules/security/ssh/default.nix
+++ b/modules/security/ssh/default.nix
@@ -15,7 +15,21 @@
   config = lib.mkIf config.security.ssh.enable {
     programs.ssh = {
       enable = true;
-      package = pkgs.openssh;
+
+      package =
+        if (config.security.gopass.enable or false && config.security.gopass.ssh-agent.enable or false) then
+          pkgs.symlinkJoin {
+            name = "openssh-gopass-wrapper";
+            paths = [ pkgs.openssh ];
+            buildInputs = [ pkgs.makeWrapper ];
+            postBuild = ''
+              wrapProgram $out/bin/ssh \
+                --run "${config.security.gopass.ssh-agent.script}/bin/gopass-ssh-load"
+            '';
+          }
+        else
+          pkgs.openssh;
+
       enableDefaultConfig = false;
       extraOptionOverrides = {
         AddKeysToAgent = "yes";