moons-14/dotfiles
1
0
Fork 0
mirror of https://github.com/moons-14/dotfiles.git synced 2026-10-06 06:28:11 +09:00
Code Issues Actions 1 Packages Projects Releases 4 Wiki Activity

1password

Browse Source
This commit is contained in:
moons-14
2026-06-26 17:50:34 +09:00
parent 4f59060cce
commit bb827d9ace
9 changed files with 83 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/applications/git/home.nix
+44 -6
View File
@@ -1,4 +1,5 @@
{
pkgs,
lib,
config,
...
@@ -6,15 +7,48 @@
let
cfg = config.my.applications.git;
hmCfg = config.my.applications.git.homeManager;
signingKeyPath = ".ssh/1password-git-signing.pub";
signingKeyFile = "~/${signingKeyPath}";
gitSshSign = pkgs.writeShellScript "git-ssh-sign" ''
one_password_sock="$HOME/.1password/agent.sock"
if { [ -n "''${SSH_CONNECTION:-}" ] || [ -n "''${SSH_CLIENT:-}" ]; } \
&& [ -n "''${SSH_AUTH_SOCK:-}" ] \
&& [ -S "$SSH_AUTH_SOCK" ]; then
exec ${pkgs.openssh}/bin/ssh-keygen "$@"
fi
if [ -S "$one_password_sock" ]; then
export SSH_AUTH_SOCK="$one_password_sock"
exec ${pkgs.openssh}/bin/ssh-keygen "$@"
fi
if [ -n "''${SSH_AUTH_SOCK:-}" ] && [ -S "$SSH_AUTH_SOCK" ]; then
exec ${pkgs.openssh}/bin/ssh-keygen "$@"
fi
echo "git ssh signing failed: no forwarded SSH agent or 1Password agent socket found" >&2
echo "expected: forwarded SSH_AUTH_SOCK or $one_password_sock" >&2
exit 1
'';
in
{
options.my.applications.git.homeManager = {
enable = lib.mkEnableOption "git home-manager configuration";
signingPublicKey = lib.mkOption {
type = lib.types.nullOr lib.types.singleLineStr;
default = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPLwReAiwhXoO34S2+MrvqUhi8IWp4IzUq4OSp3niJdq 1password-git-signing";
example = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPLwReAiwhXoO34S2+MrvqUhi8IWp4IzUq4OSp3niJdq 1password-git-signing";
description = "SSH public key copied from the 1Password SSH key item used for Git signing.";
};
signingKey = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = "~/.ssh/id_ed25519_sk_rk.pub";
example = "~/.ssh/id_ed25519.pub";
type = lib.types.str;
default = signingKeyFile;
readOnly = true;
description = "SSH public key path used for Git commit and tag signing.";
};
};
@@ -22,13 +56,15 @@ in
config = lib.mkIf hmCfg.enable {
assertions = [
{
assertion = hmCfg.signingKey != null;
message = "my.applications.git.homeManager.signingKey must be set per host.";
assertion = hmCfg.signingPublicKey != null && hmCfg.signingPublicKey != "";
message = "my.applications.git.homeManager.signingPublicKey must be set to the public key copied from 1Password.";
}
];
home-manager.sharedModules = [
{
home.file.${signingKeyPath}.text = hmCfg.signingPublicKey + "\n";
programs.git = {
enable = true;
@@ -44,7 +80,7 @@ in
signByDefault = true;
};
settings = {
extraConfig = {
user.name = cfg.userName;
user.email = cfg.userEmail;
@@ -55,6 +91,8 @@ in
log.date = "iso";
merge.conflictStyle = "diff3";
gpg.ssh.program = "${gitSshSign}";
alias = {
br = "branch --sort=-committerdate";
co = "checkout";