feat(gopass-ssh-load): moved the gopass-ssh-load into modules/scripts

- Maintaining the format of the rest of the codebase moving
  gopass-ssh-load into its own script in modules/scripts instead of
writing it directly in modules/security/gopass/default.nix

5 files changed, 60 insertions, 51 deletions

diff --git a/modules/scripts/default.nix b/modules/scripts/default.nix
index 90b7c9c..2a86ca4 100644
--- a/modules/scripts/default.nix
+++ b/modules/scripts/default.nix
@@ -6,6 +6,7 @@
 {
   imports = [
     ./deep-clean
+    ./gopass-ssh-load
     ./neomutt-sync
     ./screen-recording
     ./system-monitor
diff --git a/modules/scripts/gopass-ssh-load/default.nix b/modules/scripts/gopass-ssh-load/default.nix
new file mode 100644
index 0000000..002a4ac
--- /dev/null
+++ b/modules/scripts/gopass-ssh-load/default.nix
@@ -0,0 +1,24 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit ((import ../lib.nix { inherit lib pkgs; })) mkScriptModule;
+  base = mkScriptModule {
+    name = "gopass-ssh-load";
+    path = ./script.sh;
+    description = "Load SSH keys from gopass password store";
+    deps = with pkgs; [
+      config.security.gopass.package
+      gnupg
+      openssh
+    ];
+    inherit config;
+  };
+in
+{
+  options = base.options;
+  config = base.moduleConfig;
+}
diff --git a/modules/scripts/gopass-ssh-load/script.sh b/modules/scripts/gopass-ssh-load/script.sh
new file mode 100644
index 0000000..e8bc0ee
--- /dev/null
+++ b/modules/scripts/gopass-ssh-load/script.sh
@@ -0,0 +1,33 @@
+export SSH_AUTH_SOCK="$(gpgconf --list-dirs agent-ssh-socket)"
+
+if [ -z "$SSH_AUTH_SOCK" ] || [ ! -S "$SSH_AUTH_SOCK" ]; then
+  echo "Error: SSH_AUTH_SOCK is not set or valid." >&2
+  exit 1
+fi
+
+if ssh-add -l 2>/dev/null | grep -qE "(ED25519|RSA|ECDSA)"; then
+  exit 0
+fi
+
+for key in github gitlab bitbucket codeberg sourcehut; do
+  if gopass cat "ssh/$key" > /dev/null 2>&1; then
+    tmpdir=$(mktemp -d)
+    keyfile="$tmpdir/key"
+    gopass cat "ssh/$key" > "$keyfile" 2>/dev/null
+    chmod 600 "$keyfile"
+
+    if ! ssh-add "$keyfile" 2>/dev/null; then
+      passphrase=$(gopass cat "ssh/$key/passphrase" 2>/dev/null)
+      if [ -n "$passphrase" ]; then
+        tmpcopy=$(mktemp)
+        cp "$keyfile" "$tmpcopy"
+        chmod 600 "$tmpcopy"
+        if ssh-keygen -p -P "$passphrase" -N "" -f "$tmpcopy" 2>/dev/null; then
+          ssh-add "$tmpcopy" 2>/dev/null
+        fi
+        rm -f "$tmpcopy"
+      fi
+    fi
+    rm -rf "$tmpdir"
+  fi
+done
diff --git a/modules/security/gopass/default.nix b/modules/security/gopass/default.nix
index d6848d8..f9bdf14 100644
--- a/modules/security/gopass/default.nix
+++ b/modules/security/gopass/default.nix
@@ -5,43 +5,6 @@
   pkgs,
   ...
 }:
-let
-  gopass-ssh-load = pkgs.writeShellScriptBin "gopass-ssh-load" ''
-    export SSH_AUTH_SOCK="$(${pkgs.gnupg}/bin/gpgconf --list-dirs agent-ssh-socket)"
-
-    if [ -z "$SSH_AUTH_SOCK" ] || [ ! -S "$SSH_AUTH_SOCK" ]; then
-      echo "Error: SSH_AUTH_SOCK is not set or valid." >&2
-      exit 1
-    fi
-
-    if ${pkgs.openssh}/bin/ssh-add -l 2>/dev/null | grep -qE "(ED25519|RSA|ECDSA)"; then
-      exit 0
-    fi
-
-    for key in github gitlab bitbucket codeberg sourcehut; do
-      if ${config.security.gopass.package}/bin/gopass cat "ssh/$key" > /dev/null 2>&1; then
-        tmpdir=$(mktemp -d)
-        keyfile="$tmpdir/key"
-        ${config.security.gopass.package}/bin/gopass cat "ssh/$key" > "$keyfile" 2>/dev/null
-        chmod 600 "$keyfile"
-
-        if ! ${pkgs.openssh}/bin/ssh-add "$keyfile" 2>/dev/null; then
-          passphrase=$(${config.security.gopass.package}/bin/gopass cat "ssh/$key/passphrase" 2>/dev/null)
-          if [ -n "$passphrase" ]; then
-            tmpcopy=$(mktemp)
-            cp "$keyfile" "$tmpcopy"
-            chmod 600 "$tmpcopy"
-            if ${pkgs.openssh}/bin/ssh-keygen -p -P "$passphrase" -N "" -f "$tmpcopy" 2>/dev/null; then
-              ${pkgs.openssh}/bin/ssh-add "$tmpcopy" 2>/dev/null
-            fi
-            rm -f "$tmpcopy"
-          fi
-        fi
-        rm -rf "$tmpdir"
-      fi
-    done
-  '';
-in
 {
   options.security.gopass = {
     enable = lib.mkEnableOption "Enables gopass.";
@@ -51,18 +14,10 @@ in
       defaultText = lib.literalExpression "pkgs.gopass.override { passAlias = true; }";
       description = "The gopass package to use.";
     };
-    ssh-agent = {
-      enable = lib.mkEnableOption "gopass-backed SSH keys for git";
-      script = lib.mkOption {
-        type = lib.types.package;
-        description = "The package containing the gopass-ssh-load script.";
-      };
-    };
+    ssh-agent.enable = lib.mkEnableOption "gopass-backed SSH keys for git";
   };
 
   config = lib.mkIf config.security.gopass.enable {
-    security.gopass.ssh-agent.script = gopass-ssh-load;
-
     programs.password-store = {
       enable = true;
       package = config.security.gopass.package;
@@ -74,9 +29,5 @@ in
     home.sessionVariables = {
       PASSWORD_STORE_DIR = config.programs.password-store.settings.PASSWORD_STORE_DIR;
     };
-
-    home.packages = lib.mkIf config.security.gopass.ssh-agent.enable [
-      config.security.gopass.ssh-agent.script
-    ];
   };
 }
diff --git a/modules/security/ssh/default.nix b/modules/security/ssh/default.nix
index 62186c4..f9e56bd 100644
--- a/modules/security/ssh/default.nix
+++ b/modules/security/ssh/default.nix
@@ -24,7 +24,7 @@
             buildInputs = [ pkgs.makeWrapper ];
             postBuild = ''
               wrapProgram $out/bin/ssh \
-                --run "${config.security.gopass.ssh-agent.script}/bin/gopass-ssh-load"
+                --run "${lib.getExe config.scripts.gopass-ssh-load.package}"
             '';
           }
         else