WSL/WSL2 Integration with 1Password SSH

wsl-1password-integration.md

On Windows Side

Enable 1Password's SSH Agent.

Using Powershell, install npiperelay via the scoop package manager.

Set-ExecutionPolicy RemoteSigned -Scope CurrentUser # Optional: Needed to run a remote script the first time
irm get.scoop.sh | iex  # install scoop
scoop bucket add extras
scoop install npiperelay  # install npiperelay

wsl-install.md

On WSL Side

sudo apt update
sudo apt install socat

Add the following to your ~/.bashrc file

export SSH_AUTH_SOCK="$HOME/.ssh/agent.sock"
(
  set -eu
  piperelay=(setsid socat "UNIX-LISTEN:$SSH_AUTH_SOCK,fork" "EXEC:npiperelay.exe -ei -s //./pipe/openssh-ssh-agent,nofork")
  if ! pgrep --full --exact --uid=${UID} "${piperelay[*]}" >/dev/null
  then
    rm -f "$SSH_AUTH_SOCK"
    ("${piperelay[@]}" &) >/dev/null
  fi
)

Test 1Password SSH Agent

source ~/.bashrc
ssh -T git@github.com

Many thanks for this, the nix ssh is simply more efficient to use with its persistent connections.

The Bash part can be simplified/hardened:

export SSH_AUTH_SOCK="$HOME/.ssh/agent.sock"
(
  set -eu
  piperelay=(setsid socat "UNIX-LISTEN:$SSH_AUTH_SOCK,fork" "EXEC:npiperelay.exe -ei -s //./pipe/openssh-ssh-agent,nofork")
  if ! pgrep "-fxU$UID" "${piperelay[*]}" >/dev/null; then
    rm -f "$SSH_AUTH_SOCK"
    ("${piperelay[@]}" &) >/dev/null
  fi
)

Many thanks for this, the nix ssh is simply more efficient to use with its persistent connections.

The Bash part can be simplified/hardened:

export SSH_AUTH_SOCK="$HOME/.ssh/agent.sock"
(
  set -eu
  piperelay=(setsid socat "UNIX-LISTEN:$SSH_AUTH_SOCK,fork" "EXEC:npiperelay.exe -ei -s //./pipe/openssh-ssh-agent,nofork")
  if ! pgrep "-fxU$UID" "${piperelay[*]}" >/dev/null; then
    rm -f "$SSH_AUTH_SOCK"
    ("${piperelay[@]}" &) >/dev/null
  fi
)

The fact that setsid is in piperelay fails the pgrep.
I fixed by moving the setsid outside.

  export SSH_AUTH_SOCK="$HOME/.ssh/agent.sock"
  (
    set -eu
    piperelay=(socat "UNIX-LISTEN:${SSH_AUTH_SOCK},fork" "EXEC:npiperelay.exe -ei -s //./pipe/openssh-ssh-agent,nofork")
    if ! pgrep --full --exact --uid=${UID} "${piperelay[*]}" >/dev/null
    then
      rm -f "${SSH_AUTH_SOCK}"
      (setsid "${piperelay[@]}" &) >/dev/null
    fi
  )

thanks for these recommendations! updated the gist 👌