Commit `92c59455168d`

Vincent Demeester <vincent@sbr.pm>

2026-06-18 11:32:59

fix(ssh): guard sshAuthSock init at parent level

Assigning sshAuthSock.initialization.bash under lib.mkIf isAomi still defined the parent initialization attrset on every host, activating the upstream module config block which reads bash/fish/nushell with no defaults. This broke evaluation on all non-aomi hosts and stalled the aarch64 harmonia cache builder for days. Move the guard to the initialization level so non-aomi hosts contribute no definition.

main

1 parent 527501d

Changed files (1)

home

common

shell

openssh.nix

@@ -84,9 +84,16 @@ in
 
   # Override the sshAuthSock module's shell initialization so all shells
   # (bash, zsh, fish) point at the TPM agent socket, not the plain ssh-agent.
-  sshAuthSock.initialization.bash = lib.mkIf isAomi (
-    lib.mkForce ''export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/ssh-tpm-agent.sock"''
-  );
+  #
+  # The guard must sit at the `initialization` level, not the `.bash` leaf:
+  # assigning `sshAuthSock.initialization.bash = lib.mkIf isAomi ...` still
+  # defines the parent `initialization` as a non-null attrset on every host,
+  # which activates the upstream module's config block and forces a read of
+  # `.bash`/`.fish`/`.nushell` (no defaults) -> eval failure on non-aomi hosts.
+  # On aomi, services.ssh-agent supplies fish/nushell; we only override bash.
+  sshAuthSock.initialization = lib.mkIf isAomi {
+    bash = lib.mkForce ''export SSH_AUTH_SOCK="$XDG_RUNTIME_DIR/ssh-tpm-agent.sock"'';
+  };
 
   # GUI terminals spawned under niri inherit the systemd user manager
   # environment, so set SSH_AUTH_SOCK there too via environment.d.

Commit 92c59455168d

Commit `92c59455168d`