mw-pfeddersheim-workstation/docs/product/passwords-migration-checklist.md

Password Management - Migration Checklist

Pre-Reboot Status (2026-05-21)

• gnome-keyring installed (1:50.0-1)
• rbw installed (1.15.0)
• gnome-keyring-daemon.socket + service enabled + active
• rbw configured: bitwarden.jantec.xyz, ironmikechw+bitwarden@gmail.com
• 397 entries synced from Bitwarden vault
• 45 entries migrated from KWallet → BW + GK
• Duplicate BW entries cleaned (22 removed)
• Git credential helper: libsecret
• himalaya configs using secret-tool lookup email <addr>
• GitHub token stored in BW + GK
• GitLab PAT stored in BW + GK
• SSH passphrases stored in BW + GK
• Browser safe storage (Chrome/Brave/Chromium) in BW + GK
• Remmina passwords (5) in BW + GK
• Nextcloud passwords (3) in BW + GK
• QGIS Master Password in BW + GK
• JetBrains AI Token in BW + GK
• Documentation written: docs/product/passwords.md + docs/adr/password-management-migration.md
• AGENTS.md updated with secrets management reference
• KDE Wallet data file backed up (not deleted)
• KDE Wallet packages removal (post-verify)

Post-Reboot Actions

Immediate Checks

# 1. Verify gnome-keyring started
systemctl --user is-active gnome-keyring-daemon.service

# 2. Verify rbw can access vault
rbw list | head -5

# 3. Verify GK entries
secret-tool lookup application ssh-agent service ssh ssh-key /home/mw/.ssh/id_ed25519
secret-tool lookup application git service gitlab.satware.com
secret-tool lookup application nextcloud service cloud.satware.com user mw

# 4. Check himalaya
himalaya account list
himalaya -a mw check 2>&1  # tests IMAP auth

Manual Steps Required

1. himalaya passwords — 4 accounts need passwords re-entered into GK:

   for addr in mw@satware.com ja@satware.ai ja.satware@gmail.com ironmikechw@gmail.com; do
       echo "$(rbw get "$addr" | head -1)" | secret-tool store --label="IMAP $addr" email "$addr" application himalaya
   done
   

   (Or manually look up passwords from BW web UI and enter them)

2. GitHub CLI — Re-login if token stale:

   gh auth login --hostname github.com --with-token
   

   Then store in GK:

   rbw get "GitHub Personal Token" | secret-tool store --label="GitHub Token" application gh-cli service github.com
   

KDE Wallet Cleanup (After Confirmation)

# Only after everything works:
sudo pacman -Rns kwallet kwalletmanager
rm -rf ~/.local/share/kwalletd/

Rollback (If Needed)

If gnome-keyring + rbw doesn't work properly after reboot:

# Restore git credential helper
git config --global credential.helper store

# Kill gnome-keyring
systemctl --user stop gnome-keyring-daemon.socket

# Restore KWallet (if removed)
sudo pacman -S kwallet kwalletmanager

Notes

• All migration data preserved in ~/.local/share/kwalletd/ (not deleted yet)
• KWallet PAM refs were already commented out in /etc/pam.d/*
• JetBrains IDEs will auto-detect org.freedesktop.secrets from gnome-keyring; no config change needed
• Browser safe storage keys migrated — browsers will use them automatically