From 4f8c735bc7e86c1c3cd692c7120a61f0e04af161 Mon Sep 17 00:00:00 2001
From: "Simen A. W. Olsen" <hello@simenandre.no>
Date: Sun, 30 Aug 2026 10:51:16 +0200
Subject: feat(home): limit 1Password SSH agent to Default and jp-gitlab keys

---
 modules/home/default.nix     |  1 +
 modules/home/onepassword.nix | 15 +++++++++++++++
 2 files changed, 16 insertions(+)
 create mode 100644 modules/home/onepassword.nix

(limited to 'modules/home')

diff --git a/modules/home/default.nix b/modules/home/default.nix
index 918f0c0..baa366e 100644
--- a/modules/home/default.nix
+++ b/modules/home/default.nix
@@ -6,6 +6,7 @@
     ./git.nix
     ./ghostty.nix
     ./herdr.nix
+    ./onepassword.nix
     ./starship.nix
     ./tmux.nix
     ./lazygit.nix
diff --git a/modules/home/onepassword.nix b/modules/home/onepassword.nix
new file mode 100644
index 0000000..a9ce718
--- /dev/null
+++ b/modules/home/onepassword.nix
@@ -0,0 +1,15 @@
+{ ... }:
+
+{
+  # Limits which keys the 1Password SSH agent offers. Without this file the
+  # agent exposes every SSH key in every vault, and servers drop the connection
+  # after ~6 failed offers before reaching the right one. Order is the order
+  # the agent offers them in, so the default key goes first.
+  home.file.".config/1Password/ssh/agent.toml".text = ''
+    [[ssh-keys]]
+    item = "Default"
+
+    [[ssh-keys]]
+    item = "jp-gitlab"
+  '';
+}
-- 
cgit v1.3.1