2 files changed, 42 insertions, 13 deletions
diff --git a/modules/scripts/gopass-ssh-load/default.nix b/modules/scripts/gopass-ssh-load/default.nix
index 002a4ac..e0a4615 100644
--- a/modules/scripts/gopass-ssh-load/default.nix
+++ b/modules/scripts/gopass-ssh-load/default.nix
@@ -6,10 +6,26 @@
 }:
 let
   inherit ((import ../lib.nix { inherit lib pkgs; })) mkScriptModule;
+
+  gitPlatformKeys = [
+    "github"
+    "gitlab"
+    "bitbucket"
+    "codeberg"
+    "srht"
+  ];
+
+  gopassKeys =
+    lib.optionals config.development.git.useSSH gitPlatformKeys ++ config.security.ssh.extraGopassKeys;
+
   base = mkScriptModule {
     name = "gopass-ssh-load";
     path = ./script.sh;
     description = "Load SSH keys from gopass password store";
+    env = {
+      GNUPGHOME = config.home.sessionVariables.GNUPGHOME;
+      GOPASS_SSH_KEYS = lib.concatStringsSep " " gopassKeys;
+    };
     deps = with pkgs; [
       config.security.gopass.package
       gnupg
diff --git a/modules/scripts/gopass-ssh-load/script.sh b/modules/scripts/gopass-ssh-load/script.sh
index e8bc0ee..43c83b0 100644
--- a/modules/scripts/gopass-ssh-load/script.sh
+++ b/modules/scripts/gopass-ssh-load/script.sh
@@ -1,5 +1,12 @@
-export SSH_AUTH_SOCK="$(gpgconf --list-dirs agent-ssh-socket)"
+set -o errexit
+set -o nounset
+set -o pipefail
 
+# Load SSH keys from gopass password store
+export GNUPGHOME="${GNUPGHOME:-$HOME/.local/share/gnupg}"
+
+SSH_AUTH_SOCK="$(gpgconf --list-dirs agent-ssh-socket)"
+export SSH_AUTH_SOCK
 if [ -z "$SSH_AUTH_SOCK" ] || [ ! -S "$SSH_AUTH_SOCK" ]; then
   echo "Error: SSH_AUTH_SOCK is not set or valid." >&2
   exit 1
@@ -9,25 +16,31 @@ if ssh-add -l 2>/dev/null | grep -qE "(ED25519|RSA|ECDSA)"; then
   exit 0
 fi
 
-for key in github gitlab bitbucket codeberg sourcehut; do
+# GOPASS_SSH_KEYS: space-separated list of gopass entry names under ssh/
+# e.g. GOPASS_SSH_KEYS="github gitlab work-server"
+if [ -z "${GOPASS_SSH_KEYS:-}" ]; then
+  echo "Error: GOPASS_SSH_KEYS is not set. Example: GOPASS_SSH_KEYS=\"github gitlab\"" >&2
+  exit 1
+fi
+
+# shellcheck disable=SC2086
+read -r -a keys <<< "$GOPASS_SSH_KEYS"
+
+for key in "${keys[@]}"; do
   if gopass cat "ssh/$key" > /dev/null 2>&1; then
     tmpdir=$(mktemp -d)
     keyfile="$tmpdir/key"
     gopass cat "ssh/$key" > "$keyfile" 2>/dev/null
     chmod 600 "$keyfile"
 
-    if ! ssh-add "$keyfile" 2>/dev/null; then
-      passphrase=$(gopass cat "ssh/$key/passphrase" 2>/dev/null)
-      if [ -n "$passphrase" ]; then
-        tmpcopy=$(mktemp)
-        cp "$keyfile" "$tmpcopy"
-        chmod 600 "$tmpcopy"
-        if ssh-keygen -p -P "$passphrase" -N "" -f "$tmpcopy" 2>/dev/null; then
-          ssh-add "$tmpcopy" 2>/dev/null
-        fi
-        rm -f "$tmpcopy"
-      fi
+    passphrase=$(gopass cat "ssh/$key/passphrase" 2>/dev/null || true)
+    if [ -n "$passphrase" ]; then
+      ssh-keygen -p -P "$passphrase" -N "" -f "$keyfile" 2>/dev/null
     fi
+
+    ssh-add "$keyfile" 2>/dev/null
     rm -rf "$tmpdir"
+  else
+    echo "Warning: no gopass entry ssh/$key" >&2
   fi
 done