mw-pfeddersheim-workstation/docs/plans/NEXT_STEPS.md

Next Steps - 2026-05-21

Immediate (Post-Reboot - Password Management Migration)

Gnome-keyring + Bitwarden migration applied 2026-05-21. Verifying PAM unlock + D-Bus secrets service after reboot.

Verification Checklist

• Gnome-keyring auto-start: systemctl --user is-active gnome-keyring-daemon.service → active
• Rbw vault access: rbw unlocked && rbw list | head -5
• GK secret lookups work:

  secret-tool lookup application ssh-agent service ssh ssh-key /home/mw/.ssh/id_ed25519
  secret-tool lookup application git service gitlab.satware.com
  secret-tool lookup application nextcloud service cloud.satware.com user mw
  

Manual Steps Required After Reboot

1. himalaya IMAP passwords — Were NOT in KWallet, need manual entry. Look up each password in https://bitwarden.jantec.xyz/ then store in GK:

# MW account (mw@satware.com)
echo "<PASSWORD>" | secret-tool store --label="IMAP MW" email mw@satware.com application himalaya
# JA account (ja@satware.ai)
echo "<PASSWORD>" | secret-tool store --label="IMAP JA" email ja@satware.ai application himalaya
# JA Gmail (ja.satware@gmail.com)
echo "<PASSWORD>" | secret-tool store --label="IMAP JA Gmail" email ja.satware@gmail.com application himalaya
# Michael Gmail (ironmikechw@gmail.com)
echo "<PASSWORD>" | secret-tool store --label="IMAP Michael" email ironmikechw@gmail.com application himalaya

2. GitHub CLI — Re-auth if token is stale:

gh auth login --hostname github.com

Then store token in GK

rbw get "GitHub Personal Token" --full | secret-tool store --label="GitHub Token" application gh-cli service github.com

Verification Tests

Area	Test Command	Expected Result
Gnome-keyring	systemctl --user is-active gnome-keyring-daemon.service	active
Bitwarden sync	`rbw unlocked && rbw list	wc -l`
SSH passphrases	secret-tool lookup application ssh-agent service ssh ssh-key /home/mw/.ssh/id_ed25519	Returns "SSH gitlab.satware.com"
GitLab PAT	secret-tool lookup application git service gitlab.satware.com	Returns PAT
GitHub CLI	gh auth status -h github.com	Valid token (or needs re-auth)
himalaya	himalaya -a mw check	SMTP/IMAP OK
Git remotes	git fetch on any tracked repo	No password prompt
JetBrains IDEs	Open CLion/WebStorm/IDEA	No credential prompts (auto-detects D-Bus secrets)

Cleanup (After All Verified Working)

sudo pacman -Rns kwallet kwalletmanager
rm -rf ~/.local/share/kwalletd/

---

Last updated: 2026-05-21 | Password management migration complete. Post-reboot verification pending.

---

Short Term (Non-Reboot)

• Verify that archlinux-keyring-wkd-sync.service failure is resolved or investigate further.
• Evaluate if systemd-oomd is aggressive enough for interactive desktop use; if not, consider testing earlyoom as an alternative.
• Automate periodic S.M.A.R.T. checks via a systemd timer (currently manual).
• Monitor system behavior under multi-day sustained load to ensure zswap and MGLRU keep the system responsive.

Infrastructure

• Consolidate Ansible variables for Docker memory limits into ansible/vars/main.yml.
• Extend scripts/maintenance.sh to include a summary of the last 24h OOM events (if any).
• Verify that archlinux-keyring-wkd-sync.service failure is resolved or investigate further.

---

See docs/product/passwords-migration-checklist.md for detailed post-reboot actions. See docs/product/passwords.md for the password management architecture overview. See docs/adr/password-management-migration.md for the Architecture Decision Record.