Commit 7315f671cfc1

@@ -58,6 +58,22 @@ in
     };
   };
 
+  # Override the home-manager set-SSH_AUTH_SOCK service so it points at the
+  # ssh-tpm-agent socket instead of the plain ssh-agent one.  The original
+  # service runs dbus-update-activation-environment --systemd SSH_AUTH_SOCK
+  # which overwrites environment.d values in the systemd user manager env.
+  systemd.user.services.set-SSH_AUTH_SOCK = lib.mkIf isAomi {
+    Service.ExecStart = lib.mkForce (
+      pkgs.writeScript "set-SSH_AUTH_SOCK" ''
+        #!/bin/sh
+        if [ -z "$SSH_AUTH_SOCK" -o -z "$SSH_CONNECTION" ]; then
+          export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/ssh-tpm-agent.sock"
+        fi
+        ${pkgs.dbus}/bin/dbus-update-activation-environment --systemd SSH_AUTH_SOCK
+      ''
+    );
+  };
+
   # FIDO2 sk-keys spawn ssh-sk-helper which needs an askpass for the PIN.
   home.sessionVariables = lib.mkIf isAomi {
     SSH_ASKPASS = "${pkgs.openssh-askpass}/libexec/gtk-ssh-askpass";
@@ -66,9 +82,14 @@ in
     SSH_AUTH_SOCK = lib.mkForce "$XDG_RUNTIME_DIR/ssh-tpm-agent.sock";
   };
 
-  # The hm-session-vars export above only affects login shells. GUI terminals
-  # spawned under niri inherit the systemd user manager environment, so set
-  # SSH_AUTH_SOCK there too via environment.d (read by the user manager at login).
+  # Override the sshAuthSock module's shell initialization so all shells
+  # (bash, zsh, fish) point at the TPM agent socket, not the plain ssh-agent.
+  sshAuthSock.initialization.bash = lib.mkIf isAomi (
+    lib.mkForce ''export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/ssh-tpm-agent.sock"''
+  );
+
+  # GUI terminals spawned under niri inherit the systemd user manager
+  # environment, so set SSH_AUTH_SOCK there too via environment.d.
   xdg.configFile = lib.mkIf isAomi {
     "environment.d/95-ssh-auth-sock.conf".text = ''
       SSH_AUTH_SOCK=''${XDG_RUNTIME_DIR}/ssh-tpm-agent.sock
@@ -190,6 +211,7 @@ in
                           builtins.head machine.net.ips
                         else
                           id;
+                      user = "vincent";
                       # Use critical infra key for critical hosts, homelab key for others
                       identityFile = if isCriticalInfra id then "~/.ssh/id_critical_infra_sk" else "~/.ssh/id_homelab_sk";
                       identitiesOnly = true;

@@ -155,6 +155,7 @@ let
               else
                 # .sbr.pm uses the hostname directly (DNS resolution)
                 x;
+            user = "vincent";
             forwardAgent = false;
             # Use FIDO2 homelab key for all homelab hosts
             identityFile = "~/.ssh/id_homelab_sk";