{ ... }:

{
  # Limits which keys the 1Password SSH agent offers. Without this file the
  # agent exposes every SSH key in every vault, and servers drop the connection
  # after ~6 failed offers before reaching the right one. Order is the order
  # the agent offers them in, so the default key goes first.
  home.file.".config/1Password/ssh/agent.toml".text = ''
    [[ssh-keys]]
    item = "Default"

    [[ssh-keys]]
    item = "jp-gitlab"
  '';
}