# Password Management - Migration Checklist

## Pre-Reboot Status (2026-05-21)

- [x] gnome-keyring installed (`1:50.0-1`)
- [x] rbw installed (`1.15.0`)
- [x] gnome-keyring-daemon.socket + service enabled + active
- [x] rbw configured: `bitwarden.jantec.xyz`, `ironmikechw+bitwarden@gmail.com`
- [x] 397 entries synced from Bitwarden vault
- [x] 45 entries migrated from KWallet → BW + GK
- [x] Duplicate BW entries cleaned (22 removed)
- [x] Git credential helper: `libsecret`
- [x] himalaya configs using `secret-tool lookup email <addr>`
- [x] GitHub token stored in BW + GK
- [x] GitLab PAT stored in BW + GK
- [x] SSH passphrases stored in BW + GK
- [x] Browser safe storage (Chrome/Brave/Chromium) in BW + GK
- [x] Remmina passwords (5) in BW + GK
- [x] Nextcloud passwords (3) in BW + GK
- [x] QGIS Master Password in BW + GK
- [x] JetBrains AI Token in BW + GK
- [x] Documentation written: `docs/product/passwords.md` + `docs/adr/password-management-migration.md`
- [x] AGENTS.md updated with secrets management reference
- [x] KDE Wallet data file backed up (not deleted)
- [ ] KDE Wallet packages removal (post-verify)

## Post-Reboot Actions

### Immediate Checks
```bash
# 1. Verify gnome-keyring started
systemctl --user is-active gnome-keyring-daemon.service

# 2. Verify rbw can access vault
rbw list | head -5

# 3. Verify GK entries
secret-tool lookup application ssh-agent service ssh ssh-key /home/mw/.ssh/id_ed25519
secret-tool lookup application git service gitlab.satware.com
secret-tool lookup application nextcloud service cloud.satware.com user mw

# 4. Check himalaya
himalaya account list
himalaya -a mw check 2>&1  # tests IMAP auth
```

### Manual Steps Required
1. **himalaya passwords** — 4 accounts need passwords re-entered into GK:
   ```bash
   for addr in mw@satware.com ja@satware.ai ja.satware@gmail.com ironmikechw@gmail.com; do
       echo "$(rbw get "$addr" | head -1)" | secret-tool store --label="IMAP $addr" email "$addr" application himalaya
   done
   ```
   (Or manually look up passwords from BW web UI and enter them)

2. **GitHub CLI** — Re-login if token stale:
   ```bash
   gh auth login --hostname github.com --with-token
   ```
   Then store in GK:
   ```bash
   rbw get "GitHub Personal Token" | secret-tool store --label="GitHub Token" application gh-cli service github.com
   ```

### KDE Wallet Cleanup (After Confirmation)
```bash
# Only after everything works:
sudo pacman -Rns kwallet kwalletmanager
rm -rf ~/.local/share/kwalletd/
```

## Rollback (If Needed)

If gnome-keyring + rbw doesn't work properly after reboot:
```bash
# Restore git credential helper
git config --global credential.helper store

# Kill gnome-keyring
systemctl --user stop gnome-keyring-daemon.socket

# Restore KWallet (if removed)
sudo pacman -S kwallet kwalletmanager
```

## Notes

- All migration data preserved in `~/.local/share/kwalletd/` (not deleted yet)
- KWallet PAM refs were already commented out in `/etc/pam.d/*`
- JetBrains IDEs will auto-detect `org.freedesktop.secrets` from gnome-keyring; no config change needed
- Browser safe storage keys migrated — browsers will use them automatically