infrastructure/mw-pfeddersheim-workstation
2
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases Wiki Activity

migrate secrets management from KWallet to gnome-keyring + Bitwarden

Browse Source 
Architecture: Bitwarden (central vault) → rbw CLI → gnome-keyring
(local cache via org.freedesktop.secrets D-Bus). All apps (himalaya,
git, ssh-agent, JetBrains IDEs, browsers) now read secrets via
libsecret/secret-tool through gnome-keyring.

Changes:
- Install gnome-keyring + rbw, enable as systemd user service
- Configure rbw → bitwarden.jantec.xyz (ironmikechw+bitwarden@gmail.com)
- Migrate 45 meaningful entries from KWallet → BW + GK
- Switch git credential.helper from store to libsecret
- Document: one-pager, ADR, migration checklist, NEXT_STEPS update
- Skill: devops/secrets-migration for reuse

Post-reboot manual: himalaya IMAP passwords (4 accounts, were not in
KWallet) and GitHub CLI token re-auth.

See docs/product/passwords.md for the full guide.
This commit is contained in:
ja
2026-05-21 12:58:38 +02:00
parent a9bc934543
commit d746d76530
7 changed files with 835 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/plans/NEXT_STEPS.md
+72 -20
View File
@@ -1,35 +1,87 @@
# Next Steps - 2026-04-02
# Next Steps - 2026-05-21
## Immediate (Post-Reboot - GXA7801Q Firmware Activation)
## Immediate (Post-Reboot - Password Management Migration)
> NVMe firmware GXA7801Q was applied 2026-04-02 but requires reboot to activate.
> Run `sudo reboot` when ready.
> Gnome-keyring + Bitwarden migration applied 2026-05-21. Verifying PAM unlock + D-Bus secrets service after reboot.
- [ ] Reboot workstation to activate NVMe firmware GXA7801Q
- [ ] Verify firmware: `nvme list` should show `GXA7801Q` (was `GXA7401Q`)
- [ ] Check SMART health post-update: `sudo nvme smart-log /dev/nvme0n1`
- [ ] Run post-update fio benchmark (same parameters as pre-update):
### Verification Checklist
- [ ] **Gnome-keyring auto-start**: `systemctl --user is-active gnome-keyring-daemon.service` → `active`
- [ ] **Rbw vault access**: `rbw unlocked && rbw list | head -5`
- [ ] **GK secret lookups work**:
```bash
fio --directory=/tmp --name=seq-read --rw=read --bs=4k --iodepth=32 \
--ioengine=libaio --direct=1 --size=1g --runtime=30 --time_based
secret-tool lookup application ssh-agent service ssh ssh-key /home/mw/.ssh/id_ed25519
secret-tool lookup application git service gitlab.satware.com
secret-tool lookup application nextcloud service cloud.satware.com user mw
```
- [ ] Document before/after comparison in `docs/tech/nvme-benchmark-post-gxa7801q.md`
- [ ] Update `docs/tech/firmware-update-research.md` status from "reboot pending" to "complete"
## Short Term
### Manual Steps Required After Reboot
**1. himalaya IMAP passwords** — Were NOT in KWallet, need manual entry.
Look up each password in https://bitwarden.jantec.xyz/ then store in GK:
```bash
# MW account (mw@satware.com)
echo "<PASSWORD>" | secret-tool store --label="IMAP MW" email mw@satware.com application himalaya
# JA account (ja@satware.ai)
echo "<PASSWORD>" | secret-tool store --label="IMAP JA" email ja@satware.ai application himalaya
# JA Gmail (ja.satware@gmail.com)
echo "<PASSWORD>" | secret-tool store --label="IMAP JA Gmail" email ja.satware@gmail.com application himalaya
# Michael Gmail (ironmikechw@gmail.com)
echo "<PASSWORD>" | secret-tool store --label="IMAP Michael" email ironmikechw@gmail.com application himalaya
```
**2. GitHub CLI** — Re-auth if token is stale:
```bash
gh auth login --hostname github.com
```
Then store token in GK
```bash
rbw get "GitHub Personal Token" --full | secret-tool store --label="GitHub Token" application gh-cli service github.com
```
### Verification Tests
| Area | Test Command | Expected Result |
|------|-------------|-----------------|
| Gnome-keyring | `systemctl --user is-active gnome-keyring-daemon.service` | `active` |
| Bitwarden sync | `rbw unlocked && rbw list | wc -l` | `true` + 397 entries |
| SSH passphrases | `secret-tool lookup application ssh-agent service ssh ssh-key /home/mw/.ssh/id_ed25519` | Returns "SSH gitlab.satware.com" |
| GitLab PAT | `secret-tool lookup application git service gitlab.satware.com` | Returns PAT |
| GitHub CLI | `gh auth status -h github.com` | Valid token (or needs re-auth) |
| himalaya | `himalaya -a mw check` | SMTP/IMAP OK |
| Git remotes | `git fetch` on any tracked repo | No password prompt |
| JetBrains IDEs | Open CLion/WebStorm/IDEA | No credential prompts (auto-detects D-Bus secrets) |
### Cleanup (After All Verified Working)
```bash
sudo pacman -Rns kwallet kwalletmanager
rm -rf ~/.local/share/kwalletd/
```
---
*Last updated: 2026-05-21 | Password management migration complete. Post-reboot verification pending.*
---
## Short Term (Non-Reboot)
- [ ] Update `linux-firmware` and kernel packages: `sudo pacman -Syu linux-firmware`
- [ ] Check NVIDIA driver version: `pacman -Q nvidia`
- [ ] Run `scripts/update-cli-suite.sh` to sync CLI tool suite
- [ ] Monitor system behavior under multi-day sustained load to ensure `zswap` and `MGLRU` keep the system responsive.
- [ ] Verify that `archlinux-keyring-wkd-sync.service` failure is resolved or investigate further.
## Optimization
- [ ] Evaluate if `systemd-oomd` is aggressive enough for interactive desktop use; if not, consider testing `earlyoom` as an alternative.
- [ ] Automate periodic S.M.A.R.T. checks via a systemd timer (currently manual).
- [ ] Monitor system behavior under multi-day sustained load to ensure `zswap` and `MGLRU` keep the system responsive.
## Infrastructure
- [ ] Consolidate Ansible variables for Docker memory limits into `ansible/vars/main.yml`.
- [ ] Extend `scripts/maintenance.sh` to include a summary of the last 24h OOM events (if any).
- [ ] Verify that `archlinux-keyring-wkd-sync.service` failure is resolved or investigate further.
---
*See `docs/product/passwords-migration-checklist.md` for detailed post-reboot actions.*
*See `docs/product/passwords.md` for the password management architecture overview.*
*See `docs/adr/password-management-migration.md` for the Architecture Decision Record.*