b185a6159f
Apple's built-in ssh-agent has no sk-api/libfido2 support and refuses signing operations for ed25519-sk / ecdsa-sk hardware keys. Enable the existing metacfg.security.ssh module (which runs pkgs.openssh's ssh-agent under launchd) via the common darwin suite, and export SSH_AUTH_SOCK from environment.shellInit so bash, zsh, and fish (via /etc/fish/foreign-env/shellInit) all point at the nix-managed socket.
40 lines
850 B
Nix
40 lines
850 B
Nix
{
|
|
lib,
|
|
config,
|
|
pkgs,
|
|
inputs,
|
|
...
|
|
}:
|
|
|
|
let
|
|
inherit (lib) types mkEnableOption mkIf;
|
|
inherit (lib.metacfg) mkOpt;
|
|
|
|
cfg = config.metacfg.security.ssh;
|
|
in
|
|
{
|
|
options.metacfg.security.ssh = {
|
|
enable = mkEnableOption "SSH";
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
environment.systemPackages = with pkgs; [ openssh ];
|
|
|
|
environment.shellInit = ''
|
|
export SSH_AUTH_SOCK="$HOME/.ssh/ssh-agent.sock"
|
|
'';
|
|
|
|
launchd.user.agents.ssh-agent.serviceConfig = {
|
|
Label = "ssh-agent";
|
|
EnvironmentVariables.SSH_AUTH_SOCK = "/Users/${config.metacfg.user.name}/.ssh/ssh-agent.sock";
|
|
ProgramArguments = [
|
|
"${pkgs.openssh}/bin/ssh-agent"
|
|
"-a"
|
|
"/Users/${config.metacfg.user.name}/.ssh/ssh-agent.sock"
|
|
"-D"
|
|
];
|
|
RunAtLoad = true;
|
|
KeepAlive.SuccessfulExit = true;
|
|
};
|
|
};
|
|
}
|