infrastructure/mw-pfeddersheim-workstation
2
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

docs(passwords): document git.satware.ai PAT libsecret migration and rotation TODO

Browse Source
This commit is contained in:
mw
2026-06-30 14:13:15 +02:00
parent 07bd3f8699
commit d72e3782e8
1 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/product/passwords.md
+13 -1
View File
@@ -27,6 +27,7 @@
- `himalaya` → IMAP/SMTP passwords via `secret-tool lookup email <addr>` - `himalaya` → IMAP/SMTP passwords via `secret-tool lookup email <addr>`
- `ssh-agent` → SSH key passphrases via `secret-tool lookup ... ssh-key <path>` - `ssh-agent` → SSH key passphrases via `secret-tool lookup ... ssh-key <path>`
- `git-credential-libsecret` → Git passwords via libsecret - `git-credential-libsecret` → Git passwords via libsecret
(github.com via `gh`, gitlab.satware.com via `glab`, **git.satware.ai via libsecret PAT**)
- `JetBrains IDEs` → auto-detect D-Bus secrets service - `JetBrains IDEs` → auto-detect D-Bus secrets service
## Quick Verification ## Quick Verification
@@ -42,6 +43,7 @@ rbw get "SSH Key: id_ed25519" # should return "SSH gitlab.satware.com"
# Can apps read secrets? # Can apps read secrets?
secret-tool lookup application ssh-agent service ssh ssh-key /home/mw/.ssh/id_ed25519 secret-tool lookup application ssh-agent service ssh ssh-key /home/mw/.ssh/id_ed25519
secret-tool lookup application git service gitlab.satware.com secret-tool lookup application git service gitlab.satware.com
secret-tool lookup server git.satware.ai protocol https user mw # Gitea PAT (git-credential-libsecret schema)
secret-tool lookup application nextcloud service cloud.satware.com user mw secret-tool lookup application nextcloud service cloud.satware.com user mw
``` ```
@@ -51,7 +53,7 @@ secret-tool lookup application nextcloud service cloud.satware.com user mw
|----------|---------|---------| |----------|---------|---------|
| **SSH passphrases** | id_ed25519, id_ed25519_ja_manjaro | BW + GK | | **SSH passphrases** | id_ed25519, id_ed25519_ja_manjaro | BW + GK |
| **SSH host passwords** | b0t@192.168.0.141 | BW + GK | | **SSH host passwords** | b0t@192.168.0.141 | BW + GK |
| **Git tokens** | GitLab PAT, GitHub token | BW + GK | | **Git tokens** | GitLab PAT, GitHub token, Gitea PAT (git.satware.ai) | GK (BW pending) |
| **Remmina** | 5 VNC/RDP passwords | BW + GK | | **Remmina** | 5 VNC/RDP passwords | BW + GK |
| **Nextcloud** | 3 instance passwords | BW + GK | | **Nextcloud** | 3 instance passwords | BW + GK |
| **Browser crypto** | Chrome, Brave, Chromium safe storage | BW + GK | | **Browser crypto** | Chrome, Brave, Chromium safe storage | BW + GK |
@@ -114,3 +116,13 @@ systemctl --user restart gnome-keyring-daemon.service # if D-Bus secrets missin
- Data file preserved at `~/.local/share/kwalletd/kdewallet.kwl` (backup) - Data file preserved at `~/.local/share/kwalletd/kdewallet.kwl` (backup)
- PAM references already commented out - PAM references already commented out
- No longer used by any application - No longer used by any application
## Gitea PAT (git.satware.ai)
- Cached in gnome-keyring via `git credential approve` (schema `org.git.Password`, attributes: `protocol=https, server=git.satware.ai, user=mw`)
- Git reads it via `credential.helper=libsecret` (global; no host-specific `store` override)
- tea reads its own copy from `~/.config/tea/config.yml` (tea has no `auth git-credential` subcommand; file hardened to `chmod 600`)
- Scopes: `write:repository`, `read:user`. Token lacks admin scope - **rotation must be done via web UI** at https://git.satware.ai/user/settings/applications
- TODO (rotate): create new PAT with `write:repository, read:user, write:admin`; store in Bitwarden entry `Gitea PAT: git.satware.ai` + keyring + tea; revoke old token via API (now possible with admin scope); update this section
- TODO (Bitwarden): create Bitwarden entry `Gitea PAT: git.satware.ai` (username `mw`, uri `https://git.satware.ai`) - blocked on rbw pinentry not supporting non-interactive password entry; create manually via `rbw add` or Bitwarden web UI
- Tracked in Gitea issue #1: https://git.satware.ai/infrastructure/mw-pfeddersheim-workstation/issues/1