fix(home): allowlist Signing Key item so git commit signing works

1 files changed, 9 insertions, 0 deletions

diff --git a/modules/home/onepassword.nix b/modules/home/onepassword.nix
index a9ce718..5cccc1b 100644
--- a/modules/home/onepassword.nix
+++ b/modules/home/onepassword.nix
@@ -5,11 +5,20 @@
   # agent exposes every SSH key in every vault, and servers drop the connection
   # after ~6 failed offers before reaching the right one. Order is the order
   # the agent offers them in, so the default key goes first.
+  #
+  # Git commit signing also runs through this agent: op-ssh-sign asks it for
+  # signing.key from git.nix (SHA256:bJijYfOAsuLQBTfz9P8ncrp0Uft3+wyRov4a8VqcVkE).
+  # Dropping the item that holds that key breaks signing, silently until the
+  # next commit. Verify with `ssh-add -l` after changing this list.
   home.file.".config/1Password/ssh/agent.toml".text = ''
     [[ssh-keys]]
     item = "Default"
 
     [[ssh-keys]]
     item = "jp-gitlab"
+
+    # Git commit signing (git.nix signing.key)
+    [[ssh-keys]]
+    item = "Signing Key"
   '';
 }