Commit 7ae853b54fb9

@@ -157,84 +157,56 @@ in
     # Generated configs for all machines (hostname, user, forwardAgent)
     // libx.sshConfigs globals.machines
     # Forges: pin to TPM key on TPM hosts to avoid touch-prompt spam.
-    # Non-TPM hosts fall through to extraConfig IdentityFile order.
-    // lib.optionalAttrs hasTPMAgent {
-      "github.com" = {
-        hostname = "github.com";
-        user = "git";
-        identityFile = "~/.ssh/id_tpm_ecdsa.pub";
-        identitiesOnly = true;
-        controlMaster = "auto";
-        controlPersist = "360";
-      };
-      "gitlab.com" = {
-        hostname = "gitlab.com";
-        user = "git";
-        identityFile = "~/.ssh/id_tpm_ecdsa.pub";
-        identitiesOnly = true;
-        controlMaster = "auto";
-        controlPersist = "360";
-      };
-      "codeberg.org" = {
-        hostname = "codeberg.org";
-        user = "git";
-        identityFile = "~/.ssh/id_tpm_ecdsa.pub";
-        identitiesOnly = true;
-        controlMaster = "auto";
-        controlPersist = "360";
-      };
-      "git.sr.ht" = {
-        hostname = "git.sr.ht";
-        user = "git";
-        identityFile = "~/.ssh/id_tpm_ecdsa.pub";
-        identitiesOnly = true;
-        controlMaster = "auto";
-        controlPersist = "360";
-      };
-      "*.redhat.com" = {
-        user = "vdemeest";
-        identityFile = "~/.ssh/id_tpm_ecdsa.pub";
-        identitiesOnly = true;
-      };
-    }
-    # Forges on non-TPM hosts (no identity pinning, agent/extraConfig fallback)
-    // lib.optionalAttrs (!hasTPMAgent) {
-      "github.com" = {
-        hostname = "github.com";
-        user = "git";
-        controlMaster = "auto";
-        controlPersist = "360";
-      };
-      "gitlab.com" = {
-        hostname = "gitlab.com";
-        user = "git";
-        controlMaster = "auto";
-        controlPersist = "360";
-      };
-      "codeberg.org" = {
-        hostname = "codeberg.org";
-        user = "git";
-        controlMaster = "auto";
-        controlPersist = "360";
-      };
-      "git.sr.ht" = {
-        hostname = "git.sr.ht";
-        user = "git";
-        controlMaster = "auto";
-        controlPersist = "360";
-      };
-      "*.redhat.com" = {
-        user = "vdemeest";
-      };
-    }
+    # Non-TPM hosts fall through to agent/extraConfig fallback.
+    // (
+      let
+        tpmIdentity = lib.optionalAttrs hasTPMAgent {
+          identityFile = "~/.ssh/id_tpm_ecdsa.pub";
+          identitiesOnly = true;
+        };
+        forgeDefaults = {
+          controlMaster = "auto";
+          controlPersist = "360";
+        };
+      in
+      {
+        "github.com" = {
+          hostname = "github.com";
+          user = "git";
+        }
+        // forgeDefaults
+        // tpmIdentity;
+        "gitlab.com" = {
+          hostname = "gitlab.com";
+          user = "git";
+        }
+        // forgeDefaults
+        // tpmIdentity;
+        "codeberg.org" = {
+          hostname = "codeberg.org";
+          user = "git";
+        }
+        // forgeDefaults
+        // tpmIdentity;
+        "git.sr.ht" = {
+          hostname = "git.sr.ht";
+          user = "git";
+        }
+        // forgeDefaults
+        // tpmIdentity;
+        "tangled.org" = {
+          hostname = "tangled.org";
+          user = "git";
+        }
+        // forgeDefaults
+        // tpmIdentity;
+        "*.redhat.com" = {
+          user = "vdemeest";
+        }
+        // tpmIdentity;
+      }
+    )
     // {
-      "tangled.org" = {
-        hostname = "tangled.org";
-        user = "git";
-        identityFile = "~/.ssh/id_personal_sk";
-        controlMaster = "auto";
-        controlPersist = "360";
-      };
       "bootstrap.ospqa.com" = {
         forwardAgent = true;
       };
@@ -271,7 +243,6 @@ in
       StrictHostKeyChecking yes
       PreferredAuthentications publickey,password
       StreamLocalBindUnlink yes
-      ${lib.optionalString isOkinawa "IdentityFile ~/.ssh/id_ed25519_sk"}
     '';
   };
   # Fedora hosts have no NixOS openssh.authorizedKeys; manage via home-manager.