From f4752f0cf338b89084cbf917b2de88113aeac9f7 Mon Sep 17 00:00:00 2001 From: Arpit Chakladar Date: Wed, 2 Sep 2026 17:37:43 +0530 Subject: feat(development/git): removed the useSSH option - development.git.useSSH was a pretty pointless option, if ssh needs to be used we will use the ssh url or http url depending on needs --- modules/development/git/default.nix | 10 ---------- 1 file changed, 10 deletions(-) (limited to 'modules/development/git/default.nix') diff --git a/modules/development/git/default.nix b/modules/development/git/default.nix index a62f866..abfbf43 100644 --- a/modules/development/git/default.nix +++ b/modules/development/git/default.nix @@ -30,8 +30,6 @@ description = "Git email."; }; - useSSH = lib.mkEnableOption "Use SSH instead of HTTPS for common git platforms."; - signing = { key = lib.mkOption { type = lib.types.nullOr lib.types.str; @@ -64,14 +62,6 @@ pull.rebase = true; } - (lib.optionalAttrs config.development.git.useSSH { - url."git@github.com:".insteadOf = "https://github.com/"; - url."git@gitlab.com:".insteadOf = "https://gitlab.com/"; - url."git@bitbucket.org:".insteadOf = "https://bitbucket.org/"; - url."git@codeberg.org:".insteadOf = "https://codeberg.org/"; - url."git@git.sr.ht:".insteadOf = "https://git.sr.ht/"; - }) - (lib.optionalAttrs config.development.delta.enable { core.pager = "delta"; interactive.diffFilter = "delta --color-only"; -- cgit v1.2.3 From 5ac48b36e56d652d55272b77a6752558e630b3c7 Mon Sep 17 00:00:00 2001 From: Arpit Chakladar Date: Wed, 2 Sep 2026 22:07:14 +0530 Subject: feat(security/gopass): manage SSH keys from the gopass store --- modules/development/git/default.nix | 1 + modules/security/gopass/default.nix | 8 ++++---- modules/security/gopass/gopass-ssh-load.sh | 23 ++++++++++++++++++++++- modules/security/gopass/gopass-sync-init.sh | 9 +++++++++ users/arpit.nix | 2 +- 5 files changed, 37 insertions(+), 6 deletions(-) (limited to 'modules/development/git/default.nix') diff --git a/modules/development/git/default.nix b/modules/development/git/default.nix index abfbf43..ce92674 100644 --- a/modules/development/git/default.nix +++ b/modules/development/git/default.nix @@ -60,6 +60,7 @@ }; log.showSignature = true; pull.rebase = true; + init.defaultBranch = "master"; } (lib.optionalAttrs config.development.delta.enable { diff --git a/modules/security/gopass/default.nix b/modules/security/gopass/default.nix index 341c901..e543c03 100644 --- a/modules/security/gopass/default.nix +++ b/modules/security/gopass/default.nix @@ -10,11 +10,11 @@ let gopassSshLoadScript = pkgs.writeShellApplication { name = "gopass-ssh-load"; - runtimeInputs = with pkgs; [ + runtimeInputs = [ config.security.gopass.package - gnupg - openssh - bash + config.security.gpg.package + config.security.ssh.package + pkgs.bash ]; text = builtins.replaceStrings diff --git a/modules/security/gopass/gopass-ssh-load.sh b/modules/security/gopass/gopass-ssh-load.sh index e974713..b9a06e9 100644 --- a/modules/security/gopass/gopass-ssh-load.sh +++ b/modules/security/gopass/gopass-ssh-load.sh @@ -1,9 +1,30 @@ #!/usr/bin/env bash + +# gopass-ssh-load +# +# Load SSH keys into the SSH agent from the gopass password store. +# +# This script reads private keys and (optionally) their passphrases from gopass +# entries under the `ssh/` directory and adds them to the SSH agent served by +# gpg-agent. It is meant to be run manually whenever a key is imported into or +# rotated within the gopass store, so the SSH agent picks up the change. +# +# Behaviour: +# * It first verifies that a usable SSH agent socket exists and bails out if +# not. +# * It exits early (without doing anything) when the agent already has at +# least one Ed25519/RSA/ECDSA identity loaded, to avoid useless work and +# unnecessary gpg passphrase prompts. +# * For each key listed in GOPASS_SSH_KEYS it writes the corresponding +# `ssh/` entry to a temporary file, strips the passphrase using the +# `ssh//passphrase` entry, and registers the key with `ssh-add`. +# +# Temporary key files are written with mode 600 and removed afterwards. + set -o errexit set -o nounset set -o pipefail -# Load SSH keys from gopass password store export GNUPGHOME="@@GNUPGHOME@@" export GOPASS_SSH_KEYS="@@GOPASS_SSH_KEYS@@" diff --git a/modules/security/gopass/gopass-sync-init.sh b/modules/security/gopass/gopass-sync-init.sh index 6fe4f8a..c7767f9 100644 --- a/modules/security/gopass/gopass-sync-init.sh +++ b/modules/security/gopass/gopass-sync-init.sh @@ -1,5 +1,14 @@ #!/usr/bin/env bash +# gopass-sync-init +# +# Prepare the gopass password store directory for git-backed syncing. +# +# This runs during home-manager activation. It ensures the store directory +# exists, initializes it as a git repository if it is not already one, and adds +# the configured git remote as `origin` if no remote is set yet. It is a no-op +# (and thus safe to rerun) when the store is already set up. + STORE_DIR="@@PASSWORD_STORE_DIR@@" mkdir -p "$STORE_DIR" diff --git a/users/arpit.nix b/users/arpit.nix index 2c288b1..837d2bf 100644 --- a/users/arpit.nix +++ b/users/arpit.nix @@ -68,7 +68,7 @@ # Security security.gopass.enable = true; - security.gopass.ssh-agent.enable = false; + security.gopass.ssh-agent.enable = true; security.gopass.sync.enable = true; security.gpg.enable = true; security.gpg.backup.enable = true; -- cgit v1.2.3