Configure 1Password SSH agent

Signed-off-by: Adam Hellberg <[e-mail]>
Change-Id: I9396bc6c70de9e02126f5bb047a275ac6a6a6964

modules/base/passwords/op.nix

···
     };
 
     homeManager =
-      { lib, ... }:
+      {
+        config,
+        lib,
+        ...
+      }:
       let
         sshAuthSock = "$HOME/.1password/agent.sock";
         opPlugins = "$HOME/.config/op/plugins.sh";
         sessionVariables = {
           SSH_AUTH_SOCK = sshAuthSock;
         };
+        sops = config.sops;
       in
       {
         home.sessionVariables = sessionVariables;
         systemd.user.sessionVariables = sessionVariables;
+
+        sops = {
+          secrets = {
+            op-a-family-id = { };
+            op-a-family-v-private-id = { };
+            op-a-work-id = { };
+            op-a-work-v-employee-id = { };
+          };
+
+          templates."op-ssh-agent.toml" = {
+            path = "${config.xdg.configHome}/1Password/ssh/agent.toml";
+            content = ''
+              [[ssh-keys]]
+              account = "${sops.placeholder.op-a-family-id}"
+              vault = "${sops.placeholder.op-a-family-v-private-id}"
+
+              [[ssh-keys]]
+              account = "${sops.placeholder.op-a-work-id}"
+              vault = "${sops.placeholder.op-a-work-v-employee-id}"
+            '';
+          };
+        };
+
+        # xdg.configFile."1Password/ssh/agent.toml".source = sops.templates."op-ssh-agent.toml".path;
 
         programs = {
           ssh = {

modules/users/sharparam/secrets.yaml

···
 nix-access-tokens: ENC[AES256_GCM,data:oNSoiA9GpbWg1HjohBEk0TTxCX+rxMPGDgHgu8hXgQP650kZhIj8xGrSI6jr7COFZwC1yROf2GhWyy+th23p2CMc9rtaYxkM5s2xUV7fUrokoH0d8NL87jPgPIaM3rHDLxM+qYppUL/2+IWFBEh4axh6SM3m/K84,iv:MMW+TmxnO+MzX5fysKhktaRsKnQ+w7WSyyBTVAnLur8=,tag:js42S9re7XYC8IJntZmF3A==,type:str]
+#ENC[AES256_GCM,data:TgaCm6XDCDUBgQ==,iv:IBtDDNovGDhZOb0edkEmIdznfu5WKqiIZnx9R7CpIfs=,tag:R68+WVScIH1rpaSbUb8uKg==,type:comment]
+op-a-family-id: ENC[AES256_GCM,data:yOIrDwy11Wt0eKZAuYbDKgftugRwCos/bCY=,iv:U0W0ZMyqluaqMiHa7JhwREkEzdTmx5Vh+EA2jY2C0Ec=,tag:y0xLVDGGeKMr01EaMcC+0w==,type:str]
+op-a-family-v-private-id: ENC[AES256_GCM,data:cn+acHVNhhrFA8J5tcbIICwWZSTjfhVSVXA=,iv:js6ZZ7y0a1wxP5tNksCB1XbcY272fFgzAPIlkl5gGKk=,tag:gWqDs0WoPJtL7dsdTtHscA==,type:str]
+op-a-work-id: ENC[AES256_GCM,data:hYorDn/yA4wgyB4IV1MUtwLaBjOuM33wxHk=,iv:jZabQcnCyAW5U0vloq8MrYiDqt9NS6zpbEifKka2hnw=,tag:kCgoimUfZnity7tWgtMLTA==,type:str]
+op-a-work-v-employee-id: ENC[AES256_GCM,data:1ipeP+wEeds6mScB0ha8aoUzG4Ki4xo4uUM=,iv:QJenmWACJz4bupaEmMQorD0rgNNPb9kYIuyuUY0R0O4=,tag:wn/w9vqyVqAh3YhB3UGQ1g==,type:str]
 sops:
     age:
         - recipient: age1yubikey1qf2pqf4uhz9nhppcvsg0wl6d24nmrc8wthz6rnthkv0s96th8a9mzqhgul5
···
             bHp6NGUrYk9HeTNqdnNDRDNtL21sVDQKzo9I3v1eE/njlDORRHHxQsWDfNXVfQhC
             iI+yL/SEvw8z2pIAeO8oOS3G888lBepCkbgM1qvx1SQc3lV/WPjn7A==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-03-24T00:27:53Z"
-    mac: ENC[AES256_GCM,data:e/kZiaQTRT/oRXushuaB8nrjWXz7XC7eQfWBxwR+F7tjQZsB4OqcZlK003rBxNq/7zCdErpscwDTPD8Aao6oj5wfLBBtbJaUxDAHHKblJPOub/XHCnGAVu7FKyIKgsM8o+OIB9qTisL1RxNsPejVEVC9GqMC7GGMtAmiq3inUXQ=,iv:m4nVVZlNbJHx2BCI3GrYtiQvUA4uP4YNTlZ5qg4Gh8s=,tag:nlzMDr2YNzENGC+z2zlo/Q==,type:str]
+    lastmodified: "2026-03-29T18:18:14Z"
+    mac: ENC[AES256_GCM,data:nUXdpVpCt7ZphgS3dQsS2lUc3BBjhmBLlYQc0Zx992DLbMgKHx9uB+gxHhMvrNgw84fB5oU9PMUoPD6B+eaduh5cPR1jmBk+ujcVT1vGrBet23dIRpO9YBCKrjH0vym/p7ol/iDsW18/q25JZqYt7AT2ec0G+Ax+HYDcnzvD61E=,iv:8caBsCXyET2j3P66komUfVivdPrerow7C0Y5ptL/AQE=,tag:HSuLQeDeH+rpgIpxF5eUWQ==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.12.1
+    version: 3.12.2

modules/users/sharparam/sops.nix

···
   den.aspects.sharparam.provides.secrets = {
     homeManager = {
       sops.secrets = {
-        nix-access-tokens = {
-          sopsFile = ./secrets.yaml;
-        };
+        nix-access-tokens.sopsFile = ./secrets.yaml;
+        op-a-family-id.sopsFile = ./secrets.yaml;
+        op-a-family-v-private-id.sopsFile = ./secrets.yaml;
+        op-a-work-id.sopsFile = ./secrets.yaml;
+        op-a-work-v-employee-id.sopsFile = ./secrets.yaml;
       };
     };
   };