# ADR-00N: Migrate from KDE Wallet to gnome-keyring + Bitwarden

## Status
Implemented 2026-05-21. Post-reboot verification pending.

## Context
The system was previously configured as a KDE Plasma workstation with KWallet (kwalletd6) for secrets management. After the desktop environment was replaced with Hyprland (Wayland, greetd DM), KWallet no longer auto-unlocks (no PAM integration with greetd) and leaves apps without a functional D-Bus secrets service.

Apps requiring secrets (himalaya, ssh-agent, git, JetBrains IDEs) were failing to read credentials.

## Decision

### Architecture

```
┌────────────────────────
│  Bitwarden Vault       │  ← Central, cross-device, backup
│  bitwarden.jantec.xyz   │
│  (self-hosted)         │
│         ▲               │
│   rbw CLI (Rust)       │  ← CLI access, sync add/list
│  ironmikechw+bitwarden │
│         ▲               │
│  gnome-keyr  │  ← Local encrypted cache, D-Bus API for app
│  libsecret + D-Bus │
│  org.freedesktop.  │
│  secrets              │
└────────────────────────┘
```

### Components

| Component | Role | Status |
|-----------|------|--------|
| **gnome-keyring** | Local D-Bus secrets provider. Started via systemd socket, enabled for all user sessions. | `enabled` + `active` |
| **rbw** | Rust Bitwarden CLI. Connects to `https://bitwarden.jantec.xyz`. Uses gnome-keyring as encrypted password store. | `1.15.0`, configured |
| **libsecret** | GTK/GLib secrets API. Used by git (`credential.helper libsecret`), secret-tool, and apps. | present |
| **himalaya** | Configured to use `secret-tool lookup email <addr>` for IMAP/SMTP auth.cmd. | needs password entries |

### What was migrated from KWallet

| Source (kwallet folder) | Entries | Destination |
|------------------------|---------|-------------|
| ksshaskpass (SSH keys) | id_ed25519 passphrase, id_ed25519_ja_manjaro passphrase | BW + GK |
| ksshaskpass (host passwords) | b0t@192.168.0.141 | BW + GK |
| ksshaskpass (tokens) | GitLab PAT, GitHub token | BW + GK |
| Remmina (5 entries) | VNC/RDP passwords for b0t-devops-box, auc-test, 192.168.0.52, ja-manjaro, vagrant | BW + GK |
| Nextcloud (3 entries) | mw@cloud.satware.com, mw@data.satware.com, allvater@cloud.makercloud.de | BW + GK |
| QGIS | Master password | BW + GK |
| JetBrains AI | AI token | BW + GK |
| JetBrains Account | Account token | BW only |
| Browser safe storage | Chrome, Brave, Chromium encryption keys | BW + GK |
| xdg-desktop-portal | Screen sharing tokens (18 binary entries) | skipped (app-generated) |

**Total: ~45 meaningful entries migrated**

### What was NOT migrated

| Item | Reason | Action needed |
|------|--------|--------------|
| himalaya email passwords | Were not stored in KWallet (probably in KDE KWallet but in a different format) | Must be added manually to GK via `secret-tool` |
| GitHub CLI token | Was in KWallet but may be expired | Re-auth with `gh auth login` |
| JetBrains IDE DB/SshConfigPassword | Encrypted app-internal tokens, app-specific | IDEs will re-create via D-Bus on next use |

### Config changes

| File | Change |
|------|--------|
| `~/.config/rbw/config.json` | **new** — rbw config pointing to bitwarden.jantec.xyz |
| `~/.config/systemd/user/default.target.wants/` | gnome-keyring-daemon.service + socket: **enabled** |
| `~/.gitconfig` | `credential.helper = libsecret` (changed from `store`) |
| `~/.config/systemd/user/` | gnome-keyring-daemon.service + socket: **enabled** |

### KDE Wallet cleanup

| State | Status |
|-------|--------|
| `kwallet` pkg (6.26.0) | Installed (will be removed post-verify) |
| `kwalletmanager` pkg (26.04.1) | Installed (will be removed post-verify) |
| `~/.local/share/kwalletd/kdewallet.kwl` | Still exists (backed up) |
| `~/.local/share/kwalletd/kdewallet_attributes.json` | Still exists (backed up)|
| `plasma-kwallet-pam.service` | inactive (static) |

PAM kwallet refs in `/etc/pam.d/*` were already commented out.

## Startup / Unlock flow after reboot

```
1. greetd/tuigreet → user login (PAM auth)
2. gnome-keyring PAM module (pam_gnome_keyring.so) unlocks keyring with login password
3. gnome-keyring-daemon starts via socket activation (systemd user)
4. D-Bus org.freedesktop.secrets becomes available
5. rbw auto-login (via pinentry + gnome-keyring) → vault accessible
6. himalaya can read IMAP passwords via secret-tool
7. ssh-add reads SSH passphrases via GK
8. git-credential-libsecret reads Git creds via GK
9. JetBrains IDEs read secrets via D-Bus auto-detection
```

## Post-reboot verification checklist

- [ ] `systemctl --user is-active gnome-keyring-daemon.service` → `active`
- [ ] `rbw list | wc -l` → entries available
- [ ] `secret-tool lookup application ssh-agent service ssh ssh-key /home/mw/.ssh/id_ed25519` → returns passphrase
- [ ] `secret-tool lookup application git service gitlab.satware.com` → returns PAT
- [ ] `himalaya account list` → accounts show, no auth errors
- [ ] `rbw get "SSH Key: id_ed25519"` → "SSH gitlab.satware.com"
- [ ] `git remote` operations work (libsecret helper)
- [ ] JetBrains IDEs can read DB/Git credentials

## Manual steps after reboot

1. If himalaya shows auth errors, re-enter IMAP passwords:
   ```bash
   # MW account
   echo "<IMAP_PASSWORD>" | secret-tool store --label="IMAP MW" email mw@satware.com application himalaya
   # JA account  
   echo "<IMAP_PASSWORD>" | secret-tool store --label="IMAP JA" email ja@satware.ai application himalaya
   # JA Gmail
   echo "<IMAP_PASSWORD>" | secret-tool store --label="IMAP JA Gmail" email ja.satware@gmail.com application himalaya
   # Michael Gmail
   echo "<IMAP_PASSWORD>" | secret-tool store --label="IMAP Michael" email ironmikechw@gmail.com application himalaya
   ```

2. If GitHub CLI is stale:
   ```bash
   gh auth login --hostname github.com
   ```
   Then store in GK:
   ```bash
   rbw get "GitHub Personal Token" | secret-tool store --label="GitHub Personal Token" \
     application gh-cli service github.com
   ```

3. Remove KDE Wallet packages (after all verified working):
   ```bash
   sudo pacman -Rns kwallet kwalletmanager
   ```

## Consequences

- **Positive**: Clean D-Bus secrets service available to all apps. Central vault syncs across devices. No more KWallet prompt on every login. libsecret works.
- **Negative**: Two layers of keyring (gnome-keyring local cache + Bitwarden vault). If gnome-keyring is corrupted, need `rbw sync`. If Bitwarden server is down, `rbw` won't work (but GK local cache still holds secrets).

## Rollback plan

If the migration fails, restore by:
1. Re-enable `plasma-kwallet-pam.service`
2. Revert `credential.helper` to `store`
3. KWallet data file remains on disk (not deleted)