nixos wsl

Configuring git commit signing with 1Password on NixOS WSL

20 August 2026 Nixos Wsl 1password

After way too long, today I embarked on a journey to properly configure 1Password to integrate with my NixOS WSL instance.

There are a couple of handy guides out there, such as the official documentation, and this one by Mykal Machon.

Armed with this knowledge, this is how I thought it would go:

Install 1Password on Windows
Install 1Password CLI on Windows (via winget)
???
Profit

Instead, step 3 is the absolute nonsense contained in this post. I figured it out though, so please enjoy. If you are the one other person using NixOS WSL & 1Password, I hope you find it useful.

The Journey

Those guides lulled me into a false sense of security. Whilst the bulk of the steps are correct, there are a couple of bits that got in the way, and 2 things that aren’t true:

You don’t need Windows Hello for this to function, but it would improve the experence
You don’t need to map ssh & ssh-add to their .exe counterparts. I found that just manually running them was enough to aide with troubleshooting, but ssh will work just fine.
You will encounter a problem with named pipes.
You will encounter a problem with interop.

We’ll start out easy (and in the order I discovered them), with the named pipes issue.

The Named Pipes Problem

Problem the first: After configuring 1Password correctly, I couldn’t connect to the socket.

Can’t connect to agent socket?

That question mark is most reassuring.

The Named Pipes Solution

Essentially, the named pipes communication isn’t working. This one was actually a quick fix.

scoop install extras/npiperelay

To get npiperelay functioning, we need a systemd service. I cribbed this from Ciffelia on GitHub, which I was able to translate to nix decently.

I heavily used the term onepassword here as I wanted future me to remember what this was for.

You’re welcome, future Andy.

1password-ssh-socket.nix nix

{
  systemd.user.sockets.onepassword-ssh-agent = {
    Unit.Description = "1Password SSH agent socket (Windows named-pipe relay)";
    Socket = {
      ListenStream = "%h/.ssh/onepassword-agent.sock";
      Accept = true;
    };
    Install.WantedBy = [ "sockets.target" ];
  };

  systemd.user.services."onepassword-ssh-agent@" = {
    Unit.Description = "1Password SSH agent relay instance";
    Service = {
      ExecStart = "/mnt/c/Users/<user>/scoop/shims/npiperelay.exe -ei -s -v //./pipe/openssh-ssh-agent";
      Type = "exec";
      StandardInput = "socket";
      StandardOutput = "socket";
      StandardError = "journal";
    };
  };

  home.sessionVariables.SSH_AUTH_SOCK = "$HOME/.ssh/onepassword-agent.sock";
}

Some notes on the above:

1Password runs the agent socket from the user’s home dir. I set this up to not clobber that, just in case 1PW ships better WSL support and I install it in NixOS directly.

The Interop Problem

Problem 2: After setting up the named pipes service, and rebooting, I still couldn’t hit 1Password. My service was throwing a couldn't execute binary file, coupled with an exec format error error.

This turned out to be a bug with WSL Interop registration when using systemd microsoft/WSL#8952, that prevents the interop registration from bootstrapping correctly.

The Interop Solution

There were other workarounds listed in the thread¹, but after a bit of research I learned that NixOS-WSL shipped a good fix ages ago and I never noticed or needed it before, as other things were launching ok.

configuration.nix nix

{
  wsl = {
    interop = {
      enable = true;
      register = true; # <- right here.
    };
  };
}

I flipped it on, ran wsl --shutdown, fired NixOS back up to verify, and everything worked as expected.

Git Config

The last hurdle was getting the git config sorted.

I am using home-manager to manage some of my configuration across multiple hosts, so I have extracted the relevant bits below.

This small change took some time for me to accomplish as I refactored a significant portion of my git config in the process :D

To get commit signing to function, (as per the docs) the gpg "ssh" program to the op-ssh-sign-wsl.exe binary on Windows, and make sure that the relevant signing public key is set, along with all the signing options.

vcs.nix nix

git.settings = {
    # --//-- #

    user.signingKey = "<ssh publicKey>";
    gpg.format = "ssh";
    "gpg \"ssh\"".program = /mnt/c/Users/<username>/AppData/Local/Microsoft/WindowsApps/op-ssh-sign-wsl.exe";
    commit.gpgsign = true;

    # --//-- #
};

TL;DR

Install npiperelay from scoop, & write a sytemd user service & socket config to connect to it.
Discover Interop is/was broken, actually enable it.
Configure Git via Home Manager.
???
Profit.

References

This one was very helpful ↩︎

← Back to blog