feat(direnv): add age plugin

common/home-manager/direnv/age.sh

@@ -0,0 +1,15 @@
+: "${AGE_DOTENV_IDENTITY:=}"
+
+# load_age_dotenv decrypts `file` and exports its variables into the direnv environment.
+# `identity` must be an age plugin identity string (AGE-PLUGIN-NAME-1...); age invokes the
+# corresponding plugin binary to perform decryption, so key material never passes through this shell.
+load_age_dotenv() {
+  local file="${1:-.env.age}"
+  local identity="${2:-$AGE_DOTENV_IDENTITY}"
+
+  watch_file "$file"
+  [[ -f "$file" ]] || return 0
+  [[ -n "$identity" ]] || { echo "load_age_dotenv: no identity — set AGE_DOTENV_IDENTITY or pass as second argument" >&2; return 1; }
+
+  eval "$(age --decrypt --identity <(echo "$identity") "$file" | direnv dotenv bash /dev/stdin)"
+}

common/home-manager/direnv/default.nix

@@ -0,0 +1,3 @@
+{ ... }: {
+  xdg.configFile."direnv/lib/age.sh".source = ./age.sh;
+}

flake.lock

@@ -26,7 +26,7 @@
         ]
       },
       "locked": {
-        "narHash": "sha256-b0DWHnbcWNcGDH7hifkIBwnwt1phCzUt4WIJY5pJ/hU=",
+        "narHash": "sha256-Zrn52YtWB3+0o3PxmHXPSVCNrrot46rv0gCLEs5qd4E=",
         "path": "/home/adriano/git/age-plugin-gopass",
         "type": "path"
       },

systems/zw/home/adriano.nix

@@ -17,6 +17,7 @@ in {
     ../../../common/accounts/calendars.nix
     ../../../common/applications/run-in-mux.nix
     ../../../common/home-manager/ai-agents
+    ../../../common/home-manager/direnv
     ../../../common/home-manager/helix
     ../../../common/home-manager/jira
     ../../../common/home-manager/nyxt