migrate secrets management from KWallet to gnome-keyring + Bitwarden

Architecture: Bitwarden (central vault) → rbw CLI → gnome-keyring (local cache via org.freedesktop.secrets D-Bus). All apps (himalaya, git, ssh-agent, JetBrains IDEs, browsers) now read secrets via libsecret/secret-tool through gnome-keyring. Changes: - Install gnome-keyring + rbw, enable as systemd user service - Configure rbw → bitwarden.jantec.xyz (ironmikechw+bitwarden@gmail.com) - Migrate 45 meaningful entries from KWallet → BW + GK - Switch git credential.helper from store to libsecret - Document: one-pager, ADR, migration checklist, NEXT_STEPS update - Skill: devops/secrets-migration for reuse Post-reboot manual: himalaya IMAP passwords (4 accounts, were not in KWallet) and GitHub CLI token re-auth. See docs/product/passwords.md for the full guide.
2026-05-21 12:58:38 +02:00
parent a9bc934543
commit d746d76530
7 changed files with 835 additions and 20 deletions
@@ -0,0 +1,116 @@
+# Password Management - System Guide
+
+## Architecture
+
+```
+┌─────────────────────────────────────┐
+│        Bitwarden Vault              │
+│     bitwarden.jantec.xyz            │  ← Central, synced, backed up
+│         (self-hosted)               │
+│                ▲                     │
+│          rbw CLI                    │  ← CLI access, add/list/get/search
+│     (ironmikechw+bitwarden@gmail.com)│
+│                ▲                     │
+│    gnome-keyring (local)            │  ← D-Bus secrets API for apps
+│    org.freedesktop.secrets         │  ← libsecret, secret-tool
+└─────────────────────────────────────
+```
+
+## How It Works After Reboot / Login
+
+1. **greetd/tuigreet login** → PAM auth
+2. **PAM module** → `pam_gnome_keyring.so` unlocks keyring with login password
+3. **gnome-keyring-daemon** starts via socket activation (systemd user service)
+4. **D-Bus** `org.freedesktop.secrets` becomes available on session bus
+5. **rbw** auto-unlocks via pinentry (reads passphrase from gnome-keyring)
+6. **Apps** read secrets via `libsecret` / `secret-tool`:
+   - `himalaya` → IMAP/SMTP passwords via `secret-tool lookup email <addr>`
+   - `ssh-agent` → SSH key passphrases via `secret-tool lookup ... ssh-key <path>`
+   - `git-credential-libsecret` → Git passwords via libsecret
+   - `JetBrains IDEs` → auto-detect D-Bus secrets service
+
+## Quick Verification
+
+```bash
+# Is gnome-keyring running?
+systemctl --user is-active gnome-keyring-daemon.service
+
+# Can rbw access the vault?
+rbw list | head -5
+rbw get "SSH Key: id_ed25519"  # should return "SSH gitlab.satware.com"
+
+# Can apps read secrets?
+secret-tool lookup application ssh-agent service ssh ssh-key /home/mw/.ssh/id_ed25519
+secret-tool lookup application git service gitlab.satware.com
+secret-tool lookup application nextcloud service cloud.satware.com user mw
+```
+
+## Migrated Entries (from KDE Wallet)
+
+| Category | Entries | Storage |
+|----------|---------|---------|
+| **SSH passphrases** | id_ed25519, id_ed25519_ja_manjaro | BW + GK |
+| **SSH host passwords** | b0t@192.168.0.141 | BW + GK |
+| **Git tokens** | GitLab PAT, GitHub token | BW + GK |
+| **Remmina** | 5 VNC/RDP passwords | BW + GK |
+| **Nextcloud** | 3 instance passwords | BW + GK |
+| **Browser crypto** | Chrome, Brave, Chromium safe storage | BW + GK |
+| **JetBrains** | AI token, Account token | BW (AI also in GK) |
+| **QGIS** | Master password | BW + GK |
+
+Total: ~45 entries migrated.
+
+## Known Issues (Post-Reboot)
+
+1. **himalaya email passwords** — Were NOT in KWallet. Need to be re-entered manually:
+   ```bash
+   # Run once per account after reboot
+   rbw get "<entry-name>" | secret-tool store --label="IMAP <name>" email <address> application himalaya
+   ```
+   Accounts: `mw@satware.com`, `ja@satware.ai`, `ja.satware@gmail.com`, `ironmikechw@gmail.com`
+
+2. **GitHub CLI token** — May need re-auth:
+   ```bash
+   gh auth login --hostname github.com
+   gh auth git-credential store --hostname github.com  # saves to GK
+   ```
+
+## Useful Commands
+
+```bash
+# Bitwarden
+rbw list                    # list all entries
+rbw search <term>           # search
+rbw get "<name>"            # get password (truncated display)
+rbw get --full "<name>"     # get full password
+rbw add "<name>"            # add new entry (opens editor)
+rbw sync                    # force sync with server
+rbw unlock                  # unlock vault (prompts for login password)
+
+# Gnome-keyring
+secret-tool lookup key value ...          # lookup by attributes
+secret-tool search key value ...           # search
+secret-tool store --label="X" key value    # store (pipe password via stdin)
+
+# System
+systemctl --user status gnome-keyring-daemon.service
+systemctl --user restart gnome-keyring-daemon.service  # if D-Bus secrets missing
+```
+
+## Troubleshooting
+
+| Symptom | Fix |
+|---------|-----|
+| `secret-tool lookup` returns empty | `systemctl --user restart gnome-keyring-daemon.service` |
+| `rbw list` fails | `rbw unlock` (enter login password) |
+| SSH key asks for passphrase | `secret-tool lookup application ssh-agent service ssh ssh-key /home/mw/.ssh/id_ed25519` — if empty, re-store it |
+| `gh` commands fail | `gh auth login --hostname github.com` |
+| himalaya auth errors | Re-enter IMAP passwords via `secret-tool store` (see Known Issues) |
+| Browser safe storage issues | Browsers recreate their own Safe Storage keys on startup |
+
+## KDE Wallet Status
+
+- Packages still installed (`kwallet`, `kwalletmanager`) — harmless, will be removed after verification
+- Data file preserved at `~/.local/share/kwalletd/kdewallet.kwl` (backup)
+- PAM references already commented out
+- No longer used by any application