+9 -1

modules/sean.nix

Reviewed

··· 82 82 EDITOR = "hx"; 83 83 VISUAL = "hx"; 84 84 SUDO_EDITOR = "hx"; 85 85 - SSH_AUTH_SOCK = "${config.home.homeDirectory}/.1password/agent.sock"; 86 85 SSH_ASKPASS = "${pkgs.openssh-askpass}/libexec/gtk-ssh-askpass"; 87 86 SSH_ASKPASS_REQUIRE = "prefer"; 88 87 }; 88 88 + 89 89 + # Only point at the local 1Password agent when not inside an SSH 90 90 + # session — otherwise we'd clobber the forwarded agent from `ssh -A` 91 91 + # and lose access to the laptop's YubiKey. 92 92 + home.sessionVariablesExtra = '' 93 93 + if [ -z "$SSH_CONNECTION" ]; then 94 94 + export SSH_AUTH_SOCK="${config.home.homeDirectory}/.1password/agent.sock" 95 95 + fi 96 96 + ''; 89 97 90 98 # SSH allowed signers for commit signature verification 91 99 home.file.".ssh/allowed_signers".text = ''

+6 -2

modules/shell.nix

Reviewed

··· 89 89 }; 90 90 interactiveShellInit = '' 91 91 set fish_greeting 92 92 - # Set 1Password SSH agent socket 93 93 - set -gx SSH_AUTH_SOCK ${config.home.homeDirectory}/.1password/agent.sock 92 92 + # Set 1Password SSH agent socket, but only when not inside an 93 93 + # SSH session — otherwise preserve the forwarded agent from 94 94 + # `ssh -A` so YubiKey signing keeps working on remote hosts. 95 95 + if not set -q SSH_CONNECTION 96 96 + set -gx SSH_AUTH_SOCK ${config.home.homeDirectory}/.1password/agent.sock 97 97 + end 94 98 # Load 1Password CLI plugins 95 99 if test -f ~/.config/op/plugins.sh 96 100 source ~/.config/op/plugins.sh