pinwheel: set ASKPASS

And cache the git signing key

hosts/pinwheel/modules/ssh/default.nix

@@ -13,6 +13,20 @@
       components = [ "secrets" ];
     };
 
+    home.sessionVariables = {
+      # gnome-keyring's PAM hooks export SSH_AUTH_SOCK pointing at a dead gcr
+      # socket (gcr-ssh-agent is disabled above), which shadows openssh's own
+      # agent and silently breaks passphrase caching. Force it back to the
+      # openssh agent started by `programs.ssh.startAgent`.
+      SSH_AUTH_SOCK = "$XDG_RUNTIME_DIR/ssh-agent";
+
+      # Route passphrase prompts through seahorse's GUI askpass instead of the
+      # terminal. `prefer` uses the GUI even when a tty is attached (ssh only
+      # falls back to askpass with no controlling terminal otherwise).
+      SSH_ASKPASS = "${pkgs.seahorse}/libexec/seahorse/ssh-askpass";
+      SSH_ASKPASS_REQUIRE = "prefer";
+    };
+
     programs.ssh = {
       enable = true;
       enableDefaultConfig = false;