# Next Steps - 2026-05-21

##  Immediate (Post-Reboot - Password Management Migration)

> Gnome-keyring + Bitwarden migration applied 2026-05-21. Verifying PAM unlock + D-Bus secrets service after reboot.

### Verification Checklist

- [ ] **Gnome-keyring auto-start**: `systemctl --user is-active gnome-keyring-daemon.service` → `active`
- [ ] **Rbw vault access**: `rbw unlocked && rbw list | head -5`
- [ ] **GK secret lookups work**:
  ```bash
  secret-tool lookup application ssh-agent service ssh ssh-key /home/mw/.ssh/id_ed25519
  secret-tool lookup application git service gitlab.satware.com
  secret-tool lookup application nextcloud service cloud.satware.com user mw
  ```

### Manual Steps Required After Reboot

**1. himalaya IMAP passwords** — Were NOT in KWallet, need manual entry.
Look up each password in https://bitwarden.jantec.xyz/ then store in GK:

```bash
# MW account (mw@satware.com)
echo "<PASSWORD>" | secret-tool store --label="IMAP MW" email mw@satware.com application himalaya
# JA account (ja@satware.ai)
echo "<PASSWORD>" | secret-tool store --label="IMAP JA" email ja@satware.ai application himalaya
# JA Gmail (ja.satware@gmail.com)
echo "<PASSWORD>" | secret-tool store --label="IMAP JA Gmail" email ja.satware@gmail.com application himalaya
# Michael Gmail (ironmikechw@gmail.com)
echo "<PASSWORD>" | secret-tool store --label="IMAP Michael" email ironmikechw@gmail.com application himalaya
```

**2. GitHub CLI** — Re-auth if token is stale:

```bash
gh auth login --hostname github.com
```

Then store token in GK

```bash
rbw get "GitHub Personal Token" --full | secret-tool store --label="GitHub Token" application gh-cli service github.com
```

### Verification Tests

| Area | Test Command | Expected Result |
|------|-------------|-----------------|
| Gnome-keyring | `systemctl --user is-active gnome-keyring-daemon.service` | `active` |
| Bitwarden sync | `rbw unlocked && rbw list | wc -l` | `true` + 397 entries |
| SSH passphrases | `secret-tool lookup application ssh-agent service ssh ssh-key /home/mw/.ssh/id_ed25519` | Returns "SSH gitlab.satware.com" |
| GitLab PAT | `secret-tool lookup application git service gitlab.satware.com` | Returns PAT |
| GitHub CLI | `gh auth status -h github.com` | Valid token (or needs re-auth) |
| himalaya | `himalaya -a mw check` | SMTP/IMAP OK |
| Git remotes | `git fetch` on any tracked repo | No password prompt |
| JetBrains IDEs | Open CLion/WebStorm/IDEA | No credential prompts (auto-detects D-Bus secrets) |

### Cleanup (After All Verified Working)

```bash
sudo pacman -Rns kwallet kwalletmanager
rm -rf ~/.local/share/kwalletd/
```

---
*Last updated: 2026-05-21 | Password management migration complete. Post-reboot verification pending.*

---

## Short Term (Non-Reboot)

- [ ] Verify that `archlinux-keyring-wkd-sync.service` failure is resolved or investigate further.
- [ ] Evaluate if `systemd-oomd` is aggressive enough for interactive desktop use; if not, consider testing `earlyoom` as an alternative.
- [ ] Automate periodic S.M.A.R.T. checks via a systemd timer (currently manual).
- [ ] Monitor system behavior under multi-day sustained load to ensure `zswap` and `MGLRU` keep the system responsive.

## Infrastructure

- [ ] Consolidate Ansible variables for Docker memory limits into `ansible/vars/main.yml`.
- [ ] Extend `scripts/maintenance.sh` to include a summary of the last 24h OOM events (if any).
- [ ] Verify that `archlinux-keyring-wkd-sync.service` failure is resolved or investigate further.

---
*See `docs/product/passwords-migration-checklist.md` for detailed post-reboot actions.*
*See `docs/product/passwords.md` for the password management architecture overview.*
*See `docs/adr/password-management-migration.md` for the Architecture Decision Record.*