From 3dc6f43776ddc601450933d021da5ce994108a40 Mon Sep 17 00:00:00 2001
From: mwiegand <martin.wiegand@seibert.group>
Date: Tue, 4 Aug 2026 22:02:09 +0200
Subject: [PATCH] agents: SSH-User-Gate + geteilter Session-Agent + Git-Signing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Agent-Sessions nutzen mwiegand-agent über den geteilten ssh-agent
(~/.ssh/isac-agent.sock, befüllt von agent-env) und signieren Commits
per GIT_CONFIG_* mit dem Agent-Key statt op-ssh-sign.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012aD7fG6BpN1HchyHeNXZb4
---
 agents/.env.agents | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/agents/.env.agents b/agents/.env.agents
index 9dcad27..654889d 100644
--- a/agents/.env.agents
+++ b/agents/.env.agents
@@ -1,3 +1,17 @@
+export USE_AGENT_SSH_USER=1
+export BW_SSH_ARGS="-o User=mwiegand-agent -o IdentitiesOnly=yes -i /Users/mwiegand/.ssh/id_mwiegand_agent.pub -o IdentityAgent=/Users/mwiegand/.ssh/isac-agent.sock"
+export BW_SCP_ARGS="$BW_SSH_ARGS"
+
+# Git-Signing in Agent-Sessions: mit dem Agent-Key über den geteilten
+# Session-Agent (isac-agent.sock via SSH_AUTH_SOCK aus agent-env) statt
+# op-ssh-sign/persönlichem Signing-Key. GIT_CONFIG_* schlägt lokale und
+# globale git-Configs.
+export GIT_CONFIG_COUNT=2
+export GIT_CONFIG_KEY_0="user.signingkey"
+export GIT_CONFIG_VALUE_0="ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDeU8FKtjN1+VjhxKZTzyvJ51GzPevrScXgou08hFmjb"
+export GIT_CONFIG_KEY_1="gpg.ssh.program"
+export GIT_CONFIG_VALUE_1="ssh-keygen"
+
 # influxdb
 export INFLUXDB_READ_TOKEN="op://24ylu7osc22gtdcoic6rgjsp2m/mdrtosjm42btdrhejoo4eg4mmu/password"
 export INFLUXDB_URL="op://24ylu7osc22gtdcoic6rgjsp2m/mdrtosjm42btdrhejoo4eg4mmu/url"