migrate secrets management from KWallet to gnome-keyring + Bitwarden

Architecture: Bitwarden (central vault) → rbw CLI → gnome-keyring (local cache via org.freedesktop.secrets D-Bus). All apps (himalaya, git, ssh-agent, JetBrains IDEs, browsers) now read secrets via libsecret/secret-tool through gnome-keyring. Changes: - Install gnome-keyring + rbw, enable as systemd user service - Configure rbw → bitwarden.jantec.xyz (ironmikechw+bitwarden@gmail.com) - Migrate 45 meaningful entries from KWallet → BW + GK - Switch git credential.helper from store to libsecret - Document: one-pager, ADR, migration checklist, NEXT_STEPS update - Skill: devops/secrets-migration for reuse Post-reboot manual: himalaya IMAP passwords (4 accounts, were not in KWallet) and GitHub CLI token re-auth. See docs/product/passwords.md for the full guide.
2026-05-21 12:58:38 +02:00
parent a9bc934543
commit d746d76530
7 changed files with 835 additions and 20 deletions
@@ -0,0 +1,91 @@
+# Password Management - Migration Checklist
+
+## Pre-Reboot Status (2026-05-21)
+
+- [x] gnome-keyring installed (`1:50.0-1`)
+- [x] rbw installed (`1.15.0`)
+- [x] gnome-keyring-daemon.socket + service enabled + active
+- [x] rbw configured: `bitwarden.jantec.xyz`, `ironmikechw+bitwarden@gmail.com`
+- [x] 397 entries synced from Bitwarden vault
+- [x] 45 entries migrated from KWallet → BW + GK
+- [x] Duplicate BW entries cleaned (22 removed)
+- [x] Git credential helper: `libsecret`
+- [x] himalaya configs using `secret-tool lookup email <addr>`
+- [x] GitHub token stored in BW + GK
+- [x] GitLab PAT stored in BW + GK
+- [x] SSH passphrases stored in BW + GK
+- [x] Browser safe storage (Chrome/Brave/Chromium) in BW + GK
+- [x] Remmina passwords (5) in BW + GK
+- [x] Nextcloud passwords (3) in BW + GK
+- [x] QGIS Master Password in BW + GK
+- [x] JetBrains AI Token in BW + GK
+- [x] Documentation written: `docs/product/passwords.md` + `docs/adr/password-management-migration.md`
+- [x] AGENTS.md updated with secrets management reference
+- [x] KDE Wallet data file backed up (not deleted)
+- [ ] KDE Wallet packages removal (post-verify)
+
+## Post-Reboot Actions
+
+### Immediate Checks
+```bash
+# 1. Verify gnome-keyring started
+systemctl --user is-active gnome-keyring-daemon.service
+
+# 2. Verify rbw can access vault
+rbw list | head -5
+
+# 3. Verify GK entries
+secret-tool lookup application ssh-agent service ssh ssh-key /home/mw/.ssh/id_ed25519
+secret-tool lookup application git service gitlab.satware.com
+secret-tool lookup application nextcloud service cloud.satware.com user mw
+
+# 4. Check himalaya
+himalaya account list
+himalaya -a mw check 2>&1  # tests IMAP auth
+```
+
+### Manual Steps Required
+1. **himalaya passwords** — 4 accounts need passwords re-entered into GK:
+   ```bash
+   for addr in mw@satware.com ja@satware.ai ja.satware@gmail.com ironmikechw@gmail.com; do
+       echo "$(rbw get "$addr" | head -1)" | secret-tool store --label="IMAP $addr" email "$addr" application himalaya
+   done
+   ```
+   (Or manually look up passwords from BW web UI and enter them)
+
+2. **GitHub CLI** — Re-login if token stale:
+   ```bash
+   gh auth login --hostname github.com --with-token
+   ```
+   Then store in GK:
+   ```bash
+   rbw get "GitHub Personal Token" | secret-tool store --label="GitHub Token" application gh-cli service github.com
+   ```
+
+### KDE Wallet Cleanup (After Confirmation)
+```bash
+# Only after everything works:
+sudo pacman -Rns kwallet kwalletmanager
+rm -rf ~/.local/share/kwalletd/
+```
+
+## Rollback (If Needed)
+
+If gnome-keyring + rbw doesn't work properly after reboot:
+```bash
+# Restore git credential helper
+git config --global credential.helper store
+
+# Kill gnome-keyring
+systemctl --user stop gnome-keyring-daemon.socket
+
+# Restore KWallet (if removed)
+sudo pacman -S kwallet kwalletmanager
+```
+
+## Notes
+
+- All migration data preserved in `~/.local/share/kwalletd/` (not deleted yet)
+- KWallet PAM refs were already commented out in `/etc/pam.d/*`
+- JetBrains IDEs will auto-detect `org.freedesktop.secrets` from gnome-keyring; no config change needed
+- Browser safe storage keys migrated — browsers will use them automatically