From 96ec0f89101ea414e764565e022b9bc83a96071c Mon Sep 17 00:00:00 2001
From: Arpit Chakladar <arpitchakladar@gmail.com>
Date: Thu, 10 Sep 2026 04:32:33 +0530
Subject: fix(security/ssh): fixed the loading ssh key from gopass

Now on every home-manager switch we run a script that loads the key form
gopass to gpg-agent, then the gpg-agent is responsible for storing it.
Anytime gopass changes the ssh key we must run home-manager switch to
load the ssh key into gpg agent.
---
 modules/security/gopass/default.nix | 37 -------------------------------------
 1 file changed, 37 deletions(-)

(limited to 'modules/security/gopass/default.nix')

diff --git a/modules/security/gopass/default.nix b/modules/security/gopass/default.nix
index 4cf9182..e78e595 100644
--- a/modules/security/gopass/default.nix
+++ b/modules/security/gopass/default.nix
@@ -5,30 +5,6 @@
   pkgs,
   ...
 }:
-let
-  gopassKeys = config.security.ssh.gopassKeys;
-
-  gopassSshLoadScript = pkgs.writeShellApplication {
-    name = "gopass-ssh-load";
-    runtimeInputs = [
-      config.security.gopass.package
-      config.security.gpg.package
-      config.security.ssh.package
-      config.terminal.bash.package
-    ];
-    text =
-      builtins.replaceStrings
-        [
-          "@@GOPASS_SSH_KEYS@@"
-          "@@GNUPGHOME@@"
-        ]
-        [
-          (lib.concatStringsSep " " gopassKeys)
-          config.home.sessionVariables.GNUPGHOME
-        ]
-        (builtins.readFile ./gopass-ssh-load.sh);
-  };
-in
 {
   options.security.gopass = {
     enable = lib.mkEnableOption "Enables gopass.";
@@ -38,15 +14,6 @@ in
       default = config.programs.password-store.package;
       description = "The gopass package to use.";
     };
-    ssh-agent = {
-      enable = lib.mkEnableOption "gopass-backed SSH keys for git";
-      package = lib.mkOption {
-        type = lib.types.package;
-        readOnly = true;
-        default = gopassSshLoadScript;
-        description = "The gopass-ssh-load script package.";
-      };
-    };
     sync = {
       enable = lib.mkEnableOption "Enables git-backed syncing of the gopass data directory.";
       remote = lib.mkOption {
@@ -127,10 +94,6 @@ in
       };
     })
 
-    (lib.mkIf config.security.gopass.ssh-agent.enable {
-      home.packages = [ config.security.gopass.ssh-agent.package ];
-    })
-
     (lib.mkIf config.security.gopass.sync.enable {
       home.activation.gopassSyncInit =
         let
-- 
cgit v1.2.3