nixos-configs/hosts/pinwheel/modules/ssh/default.nix

{ pkgs, ... }:
let
  authorizedKeysPath = "/home/alex/.ssh/authorized-keys";
in
{
  # Enable gnome-keyring at system level for PAM integration
  services.gnome.gnome-keyring.enable = true;

  # Use openssh's own ssh-agent — gcr's ssh-agent stalls signing RSA keys.
  services.gnome.gcr-ssh-agent.enable = false;
  programs.ssh.startAgent = true;

  # Create the setuid `fusermount3` wrapper that `sshfs` execs to mount. The
  # `programs.fuse` module used to install this unconditionally; newer nixpkgs
  # gates it behind this option (default off), so opt in explicitly.
  programs.fuse.enable = true;

  home-manager.users.alex = {
    services.gnome-keyring = {
      enable = true;
      components = [ "secrets" ];
    };

    home.sessionVariables = {
      # gnome-keyring's PAM hooks export SSH_AUTH_SOCK pointing at a dead gcr
      # socket (gcr-ssh-agent is disabled above), which shadows openssh's own
      # agent and silently breaks passphrase caching. Force it back to the
      # openssh agent started by `programs.ssh.startAgent`.
      SSH_AUTH_SOCK = "$XDG_RUNTIME_DIR/ssh-agent";

      # Route passphrase prompts through seahorse's GUI askpass instead of the
      # terminal. `prefer` uses the GUI even when a tty is attached (ssh only
      # falls back to askpass with no controlling terminal otherwise).
      SSH_ASKPASS = "${pkgs.seahorse}/libexec/seahorse/ssh-askpass";
      SSH_ASKPASS_REQUIRE = "prefer";
    };

    programs.ssh = {
      enable = true;
      enableDefaultConfig = false;

      settings = {
        "manatee" = {
          HostName = "manatee";
          User = "alex";
          IdentityFile = "/home/alex/.ssh/alex.pinwheel-manatee";
          Port = 1122;
        };

        "backwards" = {
          HostName = "backwards";
          User = "alex";
          IdentityFile = "/home/alex/.ssh/alex.pinwheel-backwards";
          Port = 1122;
        };

        "tadpole" = {
          HostName = "65.21.106.222";
          User = "alex";
          IdentityFile = "/home/alex/.ssh/alex.pinwheel-tadpole";
          Port = 1122;
        };

        "github.com" = {
          HostName = "github.com";
          IdentityFile = "/home/alex/.ssh/alex.pinwheel-github.com";
        };

        "git.ppp.pm" = {
          HostName = "git.ppp.pm";
          IdentityFile = "/home/alex/.ssh/alex.pinwheel-git.ppp.pm";
        };

        "*" = {
          ForwardAgent = false;
          AddKeysToAgent = "yes";
          Compression = false;
          ServerAliveInterval = 0;
          ServerAliveCountMax = 3;
          HashKnownHosts = false;
          UserKnownHostsFile = "~/.ssh/known_hosts";
          ControlMaster = "no";
          ControlPath = "~/.ssh/master-%r@%n:%p";
          ControlPersist = "no";
        };
      };
    };

    home.packages = [
      pkgs.sshfs
      pkgs.seahorse # GUI for managing gnome-keyring
    ];
  };

  age.secrets = {
    "alex.pinwheel-manatee" = {
      file = ../../../../secrets/pinwheel/alex.pinwheel-manatee.age;
      path = "/home/alex/.ssh/alex.pinwheel-manatee";
      owner = "alex";
      group = "users";
    };
    "alex.pinwheel-manatee.pub" = {
      file = ../../../../secrets/pinwheel/alex.pinwheel-manatee.pub.age;
      path = "/home/alex/.ssh/alex.pinwheel-manatee.pub";
      owner = "alex";
      group = "users";
    };

    "alex.pinwheel-backwards" = {
      file = ../../../../secrets/pinwheel/alex.pinwheel-backwards.age;
      path = "/home/alex/.ssh/alex.pinwheel-backwards";
      owner = "alex";
      group = "users";
    };
    "alex.pinwheel-backwards.pub" = {
      file = ../../../../secrets/pinwheel/alex.pinwheel-backwards.pub.age;
      path = "/home/alex/.ssh/alex.pinwheel-backwards.pub";
      owner = "alex";
      group = "users";
    };

    "alex.pinwheel-github.com" = {
      file = ../../../../secrets/pinwheel/alex.pinwheel-github.com.age;
      path = "/home/alex/.ssh/alex.pinwheel-github.com";
      owner = "alex";
      group = "users";
    };
    "alex.pinwheel-github.com.pub" = {
      file = ../../../../secrets/pinwheel/alex.pinwheel-github.com.pub.age;
      path = "/home/alex/.ssh/alex.pinwheel-github.com.pub";
      owner = "alex";
      group = "users";
    };

    "alex.pinwheel-git.ppp.pm" = {
      file = ../../../../secrets/pinwheel/alex.pinwheel-git.ppp.pm.age;
      path = "/home/alex/.ssh/alex.pinwheel-git.ppp.pm";
      owner = "alex";
      group = "users";
    };
    "alex.pinwheel-git.ppp.pm.pub" = {
      file = ../../../../secrets/pinwheel/alex.pinwheel-git.ppp.pm.pub.age;
      path = "/home/alex/.ssh/alex.pinwheel-git.ppp.pm.pub";
      owner = "alex";
      group = "users";
    };

    "alex.pinwheel-tadpole" = {
      file = ../../../../secrets/pinwheel/alex.pinwheel-tadpole.age;
      path = "/home/alex/.ssh/alex.pinwheel-tadpole";
      owner = "alex";
      group = "users";
    };
    "alex.pinwheel-tadpole.pub" = {
      file = ../../../../secrets/pinwheel/alex.pinwheel-tadpole.pub.age;
      path = "/home/alex/.ssh/alex.pinwheel-tadpole.pub";
      owner = "alex";
      group = "users";
    };

    "alex.backwards-pinwheel.pub" = {
      file = ../../../../secrets/backwards/alex.backwards-pinwheel.pub.age;
      path = "${authorizedKeysPath}/alex.backwards-pinwheel.pub";
    };
  };

  environment.etc."ssh/authorized_keys_command" = {
    mode = "0755";
    text = ''
      #!${pkgs.bash}/bin/bash
      for file in ${authorizedKeysPath}/*; do
        ${pkgs.coreutils}/bin/cat "$file"
      done
    '';
  };

  services.openssh = {
    enable = true;
    ports = [ 1122 ];

    hostKeys = [
      {
        path = "/etc/ssh/pinwheel";
        type = "ed25519";
      }
    ];

    authorizedKeysCommand = "/etc/ssh/authorized_keys_command";
    authorizedKeysCommandUser = "root";
  };
}