1password

modules/applications/git/default.nix

@@ -14,15 +14,17 @@ in
 
   options.my.applications.git = {
     enable = lib.mkEnableOption "git version control";
+
     userName = lib.mkOption {
-      type = lib.types.str;
-      default = "moons-14";
-      description = "Git user name";
+      type = lib.types.singleLineStr;
+      default = "moons";
+      description = "Default Git user.name.";
     };
+
     userEmail = lib.mkOption {
-      type = lib.types.str;
+      type = lib.types.singleLineStr;
       default = "moons@moons14.com";
-      description = "Git user email";
+      description = "Default Git user.email.";
     };
   };
 

modules/applications/git/home.nix

@@ -1,4 +1,5 @@
 {
+  pkgs,
   lib,
   config,
   ...
@@ -6,15 +7,48 @@
 let
   cfg = config.my.applications.git;
   hmCfg = config.my.applications.git.homeManager;
+
+  signingKeyPath = ".ssh/1password-git-signing.pub";
+  signingKeyFile = "~/${signingKeyPath}";
+
+  gitSshSign = pkgs.writeShellScript "git-ssh-sign" ''
+    one_password_sock="$HOME/.1password/agent.sock"
+
+    if { [ -n "''${SSH_CONNECTION:-}" ] || [ -n "''${SSH_CLIENT:-}" ]; } \
+      && [ -n "''${SSH_AUTH_SOCK:-}" ] \
+      && [ -S "$SSH_AUTH_SOCK" ]; then
+      exec ${pkgs.openssh}/bin/ssh-keygen "$@"
+    fi
+
+    if [ -S "$one_password_sock" ]; then
+      export SSH_AUTH_SOCK="$one_password_sock"
+      exec ${pkgs.openssh}/bin/ssh-keygen "$@"
+    fi
+
+    if [ -n "''${SSH_AUTH_SOCK:-}" ] && [ -S "$SSH_AUTH_SOCK" ]; then
+      exec ${pkgs.openssh}/bin/ssh-keygen "$@"
+    fi
+
+    echo "git ssh signing failed: no forwarded SSH agent or 1Password agent socket found" >&2
+    echo "expected: forwarded SSH_AUTH_SOCK or $one_password_sock" >&2
+    exit 1
+  '';
 in
 {
   options.my.applications.git.homeManager = {
     enable = lib.mkEnableOption "git home-manager configuration";
 
+    signingPublicKey = lib.mkOption {
+      type = lib.types.nullOr lib.types.singleLineStr;
+      default = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPLwReAiwhXoO34S2+MrvqUhi8IWp4IzUq4OSp3niJdq 1password-git-signing";
+      example = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPLwReAiwhXoO34S2+MrvqUhi8IWp4IzUq4OSp3niJdq 1password-git-signing";
+      description = "SSH public key copied from the 1Password SSH key item used for Git signing.";
+    };
+
     signingKey = lib.mkOption {
-      type = lib.types.nullOr lib.types.str;
-      default = "~/.ssh/id_ed25519_sk_rk.pub";
-      example = "~/.ssh/id_ed25519.pub";
+      type = lib.types.str;
+      default = signingKeyFile;
+      readOnly = true;
       description = "SSH public key path used for Git commit and tag signing.";
     };
   };
@@ -22,13 +56,15 @@ in
   config = lib.mkIf hmCfg.enable {
     assertions = [
       {
-        assertion = hmCfg.signingKey != null;
-        message = "my.applications.git.homeManager.signingKey must be set per host.";
+        assertion = hmCfg.signingPublicKey != null && hmCfg.signingPublicKey != "";
+        message = "my.applications.git.homeManager.signingPublicKey must be set to the public key copied from 1Password.";
       }
     ];
 
     home-manager.sharedModules = [
       {
+        home.file.${signingKeyPath}.text = hmCfg.signingPublicKey + "\n";
+
         programs.git = {
           enable = true;
 
@@ -44,7 +80,7 @@ in
             signByDefault = true;
           };
 
-          settings = {
+          extraConfig = {
             user.name = cfg.userName;
             user.email = cfg.userEmail;
 
@@ -55,6 +91,8 @@ in
             log.date = "iso";
             merge.conflictStyle = "diff3";
 
+            gpg.ssh.program = "${gitSshSign}";
+
             alias = {
               br = "branch --sort=-committerdate";
               co = "checkout";