ssh-tpm-agent: add extraArgs option

modules/services/ssh-tpm-agent.nix

@@ -33,6 +33,16 @@ in
       description = "Path of the directory to look for TPM sealed keys in, defaults to $HOME/.ssh if unset";
       default = null;
     };
+
+    extraArgs = mkOption {
+      type = with types; listOf str;
+      default = [ ];
+      example = [
+        "--no-cache"
+        "-d"
+      ];
+      description = "Extra arguments to be passed to the ssh-tpm-agent executable.";
+    };
   };
 
   config = mkIf cfg.enable {
@@ -86,7 +96,8 @@ in
               in
               (lib.getExe cfg.package)
               + lib.optionalString (cfg.keyDir != null) " --key-dir ${cfg.keyDir}"
-              + lib.optionalString ssh-agent.enable " -A %t/${ssh-agent.socket}";
+              + lib.optionalString ssh-agent.enable " -A %t/${ssh-agent.socket}"
+              + lib.optionalString (cfg.extraArgs != [ ]) " ${lib.escapeShellArgs cfg.extraArgs}";
             SuccessExitStatus = 2;
             Type = "simple";
           };

tests/modules/services/ssh-tpm-agent/default.nix

@@ -2,6 +2,7 @@
 
 lib.optionalAttrs pkgs.stdenv.hostPlatform.isLinux {
   ssh-tpm-agent-as-ssh-agent-proxy = ./as-ssh-agent-proxy.nix;
+  ssh-tpm-agent-extra-args = ./extra-args.nix;
   ssh-tpm-agent-sshAuthSock = ./ssh-auth-sock.nix;
   ssh-tpm-agent-standalone = ./standalone.nix;
 }

tests/modules/services/ssh-tpm-agent/extra-args.nix

@@ -0,0 +1,48 @@
+{ config, ... }:
+
+{
+  services.ssh-tpm-agent = {
+    enable = true;
+    package = config.lib.test.mkStubPackage { outPath = "@ssh-tpm-agent@"; };
+    extraArgs = [
+      "--no-cache"
+      "-d"
+    ];
+  };
+
+  nmt.script = ''
+    serviceFile=home-files/.config/systemd/user/ssh-tpm-agent.service
+    socketFile=home-files/.config/systemd/user/ssh-tpm-agent.socket
+
+    assertFileExists $serviceFile
+    assertFileExists $socketFile
+
+    assertFileContent $serviceFile ${builtins.toFile "expected-service" ''
+      [Service]
+      Environment=SSH_TPM_AUTH_SOCK=%t/ssh-tpm-agent.sock
+      ExecStart=@ssh-tpm-agent@/bin/dummy --no-cache -d
+      SuccessExitStatus=2
+      Type=simple
+
+      [Unit]
+      After=ssh-tpm-agent.socket
+      Description=ssh-tpm-agent service
+      Documentation=https://github.com/Foxboron/ssh-tpm-agent
+      Requires=ssh-tpm-agent.socket
+    ''}
+
+    assertFileContent $socketFile ${builtins.toFile "expected-socket" ''
+      [Install]
+      WantedBy=sockets.target
+
+      [Socket]
+      ListenStream=%t/ssh-tpm-agent.sock
+      Service=ssh-tpm-agent.service
+      SocketMode=0600
+
+      [Unit]
+      Description=SSH TPM agent socket
+      Documentation=https://github.com/Foxboron/ssh-tpm-agent
+    ''}
+  '';
+}