From e62354452eb795228ec84d2e2992ace645158b27 Mon Sep 17 00:00:00 2001
From: Julio Merino <julio@meroh.net>
Date: Wed, 4 Feb 2026 10:08:39 -0800
Subject: [PATCH] ssh-agent-switcher: init at 1.0.1

---
 nixos/modules/module-list.nix                 |  1 +
 .../services/security/ssh-agent-switcher.nix  | 43 ++++++++++++
 .../by-name/ss/ssh-agent-switcher/package.nix | 65 +++++++++++++++++++
 3 files changed, 109 insertions(+)
 create mode 100644 nixos/modules/services/security/ssh-agent-switcher.nix
 create mode 100644 pkgs/by-name/ss/ssh-agent-switcher/package.nix

diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index cdd258e5b176..8bac3c9ff7f5 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1511,6 +1511,7 @@
   ./services/security/reaction.nix
   ./services/security/shibboleth-sp.nix
   ./services/security/sks.nix
+  ./services/security/ssh-agent-switcher.nix
   ./services/security/sshguard.nix
   ./services/security/sslmate-agent.nix
   ./services/security/step-ca.nix
diff --git a/nixos/modules/services/security/ssh-agent-switcher.nix b/nixos/modules/services/security/ssh-agent-switcher.nix
new file mode 100644
index 000000000000..ed180d63be94
--- /dev/null
+++ b/nixos/modules/services/security/ssh-agent-switcher.nix
@@ -0,0 +1,43 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.ssh-agent-switcher;
+in
+{
+  meta.maintainers = [ lib.maintainers.jmmv ];
+
+  options = {
+    services.ssh-agent-switcher = {
+      enable = lib.mkEnableOption "ssh-agent-switcher daemon" // {
+        description = ''
+          Whether to enable ssh-agent-switcher, a daemon that proxies SSH agent
+          connections to forwarded agents. This allows tmux/screen sessions to
+          access SSH agents across reconnections.
+
+          This is a per-user service that automatically starts when you log in
+          via SSH and sets SSH_AUTH_SOCK to point to a stable socket location.
+
+          Note: This only activates for SSH sessions, not graphical or console logins.
+        '';
+      };
+
+      package = lib.mkPackageOption pkgs "ssh-agent-switcher" { };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    environment.loginShellInit = ''
+      if [ -n "$SSH_CONNECTION" ]; then
+        mkdir -p "''${XDG_RUNTIME_DIR:-/run/user/$(id -u)}"
+        export SSH_AUTH_SOCK="''${XDG_RUNTIME_DIR:-/run/user/$(id -u)}/ssh-agent-switcher.sock"
+        ${lib.getExe cfg.package} --daemon --socket-path="$SSH_AUTH_SOCK" 2>/dev/null || true
+      fi
+    '';
+  };
+}
diff --git a/pkgs/by-name/ss/ssh-agent-switcher/package.nix b/pkgs/by-name/ss/ssh-agent-switcher/package.nix
new file mode 100644
index 000000000000..cb4892fee7de
--- /dev/null
+++ b/pkgs/by-name/ss/ssh-agent-switcher/package.nix
@@ -0,0 +1,65 @@
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  fetchFromGitHub,
+  installShellFiles,
+  openssh,
+  shtk,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "ssh-agent-switcher";
+  version = "1.0.1";
+
+  src = fetchFromGitHub {
+    owner = "jmmv";
+    repo = "ssh-agent-switcher";
+    tag = "ssh-agent-switcher-${version}";
+    hash = "sha256-p9W0H25pWDB+GCrwLwuVruX9p8b8kICpp+6I11ym1aw=";
+  };
+
+  cargoHash = "sha256-WioA/RjXOAHM9QWl/lxnb7gqzcp76rus7Rv+IfCYceg=";
+
+  nativeBuildInputs = [
+    installShellFiles
+    shtk.dev
+  ];
+
+  nativeCheckInputs = [ openssh ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    cargoCheckHook
+
+    shtk build -m shtk_unittest_main -o inttest inttest.sh
+    MODE="${stdenv.hostPlatform.rust.rustcTarget}/release" ./inttest
+
+    runHook postCheck
+  '';
+
+  postInstall = ''
+    installManPage ssh-agent-switcher.1
+
+    install -Dm644 README.md -t $out/share/doc/ssh-agent-switcher/
+    install -Dm644 NEWS.md -t $out/share/doc/ssh-agent-switcher/
+    install -Dm644 COPYING -t $out/share/doc/ssh-agent-switcher/
+  '';
+
+  meta = {
+    description = "SSH agent forwarding and tmux done right";
+    longDescription = ''
+      ssh-agent-switcher is a daemon that proxies SSH agent connections to any
+      valid forwarded agent provided by sshd. This allows long-lived processes
+      such as terminal multiplexers like tmux or screen to access the
+      connection-specific forwarded agents.
+    '';
+    homepage = "https://github.com/jmmv/ssh-agent-switcher";
+    changelog = "https://github.com/jmmv/ssh-agent-switcher/blob/ssh-agent-switcher-${version}/NEWS.md";
+    license = lib.licenses.bsd3;
+    maintainers = [ lib.maintainers.jmmv ];
+    mainProgram = "ssh-agent-switcher";
+    platforms = lib.platforms.unix;
+  };
+}