Encryption with SSH key and ssh-agent?

[old-pigeon]

chezmoi supports encryption with age, however their README states that ssh-agent is not supported.

I will activate SSH agent forwarding, so that the server and my local machines can use the SSH agent from KeePassXC. I want to use the same SSH keys to encrypt/decrypt sensitive data in the repo to avoid entering passwords manually.

What is the best way to achieve that given age doesn't support it?

[twpayne]

Don't use SSH keys. age specifically recommends against it:

When integrating age into a new system, it's recommended that you only support X25519 keys, and not SSH keys. The latter are supported for manual encryption operations. If you need to tie into existing key management infrastructure, you might want to consider implementing your own Recipient and Identity.

Have a look at chezmoi's FAQs on encryption.

[old-pigeon]

If I understand the FAQ entry correctly, it requires me to enter a password every time I need to decrypt the file(s). I want to avoid that.

It would be fine to use an entry from KeePassXC as the password (as stated in the docs), but that doesn't work over the wire on remote SSH servers I guess.

[twpayne]

Consider using https://www.chezmoi.io/user-guide/frequently-asked-questions/encryption/#how-do-i-configure-chezmoi-to-encrypt-files-but-only-request-a-passphrase-the-first-time-chezmoi-init-is-run