bernardo/Nomarchy
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(keys): SSH + GPG agent via gpg-agent, pinentry-qt

Browse Source 
Add modules/home/keys.nix (nomarchy.keys.enable, default on): one agent —
services.gpg-agent with enableSshSupport fronts SSH, so a single pinentry
handles every passphrase (GPG signing/decryption and SSH key unlocks).
pinentry-qt for a reliable native-Wayland prompt under Hyprland, themed by
Stylix's Qt config. Cache TTLs 30 min / 2 h.

SSH_AUTH_SOCK is exported by the agent's zsh integration (terminal git/ssh
is the supported path). gnome-keyring stays the Secret Service — modern
versions run no SSH agent, so there's no socket contention; screen lock
doesn't flush the agent cache.

nix flake check passes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Bernardo Magri
2026-06-13 20:50:45 +01:00
parent 05d995f8e0
commit 3757e7d66f
5 changed files with 55 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
README.md
View File

@@ -350,13 +350,15 @@ close · `SUPER+1..9` workspaces · `Print` region screenshot.
also locks hyprlock, so the user types a password twice. Lock only on
suspend (not hibernate), or skip the hyprlock prompt when resuming from
a LUKS-encrypted hibernate — see `modules/home/idle.nix`.
- **Key agents & pinentry:** no SSH/GPG agent ships yet, so signing/auth
prompts have nowhere to go. Wire up an agent + a Wayland-native graphical
pinentry: `services.ssh-agent` (or gpg-agent's `enableSshSupport`),
`programs.gnupg.agent` with `pinentry-gnome3`/`pinentry-qt`, `SSH_AUTH_SOCK`
exported, and the pinentry styled from the palette where it can be. Decide
one-agent (gpg-agent fronting SSH) vs. two, and confirm it cooperates with
hyprlock/hypridle on unlock.
- ✓ **Key agents & pinentry:** ships `modules/home/keys.nix`
(`nomarchy.keys.enable`): one agent — `services.gpg-agent` with
`enableSshSupport` fronts SSH, so a single `pinentry-qt` (native-Wayland,
Stylix-themed Qt) handles GPG and SSH passphrases alike. `SSH_AUTH_SOCK`
comes from the agent's zsh integration; cache TTLs (30 min / 2 h) govern
re-prompting. gnome-keyring stays the Secret Service (modern versions run
no SSH agent, so no socket contention); screen lock doesn't flush the
cache. Remaining (optional): a session-level `SSH_AUTH_SOCK` export so GUI
clients launched outside a shell also see the agent.
## Known issues & follow-ups
- ✓ **Yazi TOML parse error on startup:** yazi 26.x made fetchers'