harald/nixcfg
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

feat(darwin): enable launchd ssh-agent with FIDO/SK support

Browse source 
Apple's built-in ssh-agent has no sk-api/libfido2 support and refuses
signing operations for ed25519-sk / ecdsa-sk hardware keys. Enable the
existing metacfg.security.ssh module (which runs pkgs.openssh's
ssh-agent under launchd) via the common darwin suite, and export
SSH_AUTH_SOCK from environment.shellInit so bash, zsh, and fish (via
/etc/fish/foreign-env/shellInit) all point at the nix-managed socket.
This commit is contained in:
Harald Hoyer 2026-05-18 12:18:22 +02:00
parent 0990389464
commit b185a6159f
2 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

6
modules/darwin/security/ssh/default.nix
View file

@ -20,9 +20,9 @@ in
config = mkIf cfg.enable { config = mkIf cfg.enable {
environment.systemPackages = with pkgs; [ openssh ]; environment.systemPackages = with pkgs; [ openssh ];
#environment.shellInit = '' environment.shellInit = ''
# export SSH_AUTH_SOCK="$HOME/.ssh/ssh-agent.sock" export SSH_AUTH_SOCK="$HOME/.ssh/ssh-agent.sock"
#''; '';
launchd.user.agents.ssh-agent.serviceConfig = { launchd.user.agents.ssh-agent.serviceConfig = {
Label = "ssh-agent"; Label = "ssh-agent";

2
modules/darwin/suites/common/default.nix
View file

@ -32,7 +32,7 @@ in
security = { security = {
gpg = enabled; gpg = enabled;
#ssh = enabled; ssh = enabled;
}; };
}; };
}; };