ja
d746d76530
Architecture: Bitwarden (central vault) → rbw CLI → gnome-keyring (local cache via org.freedesktop.secrets D-Bus). All apps (himalaya, git, ssh-agent, JetBrains IDEs, browsers) now read secrets via libsecret/secret-tool through gnome-keyring. Changes: - Install gnome-keyring + rbw, enable as systemd user service - Configure rbw → bitwarden.jantec.xyz (ironmikechw+bitwarden@gmail.com) - Migrate 45 meaningful entries from KWallet → BW + GK - Switch git credential.helper from store to libsecret - Document: one-pager, ADR, migration checklist, NEXT_STEPS update - Skill: devops/secrets-migration for reuse Post-reboot manual: himalaya IMAP passwords (4 accounts, were not in KWallet) and GitHub CLI token re-auth. See docs/product/passwords.md for the full guide.
88 lines
3.7 KiB
Markdown
88 lines
3.7 KiB
Markdown
# Next Steps - 2026-05-21
|
|
|
|
## Immediate (Post-Reboot - Password Management Migration)
|
|
|
|
> Gnome-keyring + Bitwarden migration applied 2026-05-21. Verifying PAM unlock + D-Bus secrets service after reboot.
|
|
|
|
### Verification Checklist
|
|
|
|
- [ ] **Gnome-keyring auto-start**: `systemctl --user is-active gnome-keyring-daemon.service` → `active`
|
|
- [ ] **Rbw vault access**: `rbw unlocked && rbw list | head -5`
|
|
- [ ] **GK secret lookups work**:
|
|
```bash
|
|
secret-tool lookup application ssh-agent service ssh ssh-key /home/mw/.ssh/id_ed25519
|
|
secret-tool lookup application git service gitlab.satware.com
|
|
secret-tool lookup application nextcloud service cloud.satware.com user mw
|
|
```
|
|
|
|
### Manual Steps Required After Reboot
|
|
|
|
**1. himalaya IMAP passwords** — Were NOT in KWallet, need manual entry.
|
|
Look up each password in https://bitwarden.jantec.xyz/ then store in GK:
|
|
|
|
```bash
|
|
# MW account (mw@satware.com)
|
|
echo "<PASSWORD>" | secret-tool store --label="IMAP MW" email mw@satware.com application himalaya
|
|
# JA account (ja@satware.ai)
|
|
echo "<PASSWORD>" | secret-tool store --label="IMAP JA" email ja@satware.ai application himalaya
|
|
# JA Gmail (ja.satware@gmail.com)
|
|
echo "<PASSWORD>" | secret-tool store --label="IMAP JA Gmail" email ja.satware@gmail.com application himalaya
|
|
# Michael Gmail (ironmikechw@gmail.com)
|
|
echo "<PASSWORD>" | secret-tool store --label="IMAP Michael" email ironmikechw@gmail.com application himalaya
|
|
```
|
|
|
|
**2. GitHub CLI** — Re-auth if token is stale:
|
|
|
|
```bash
|
|
gh auth login --hostname github.com
|
|
```
|
|
|
|
Then store token in GK
|
|
|
|
```bash
|
|
rbw get "GitHub Personal Token" --full | secret-tool store --label="GitHub Token" application gh-cli service github.com
|
|
```
|
|
|
|
### Verification Tests
|
|
|
|
| Area | Test Command | Expected Result |
|
|
|------|-------------|-----------------|
|
|
| Gnome-keyring | `systemctl --user is-active gnome-keyring-daemon.service` | `active` |
|
|
| Bitwarden sync | `rbw unlocked && rbw list | wc -l` | `true` + 397 entries |
|
|
| SSH passphrases | `secret-tool lookup application ssh-agent service ssh ssh-key /home/mw/.ssh/id_ed25519` | Returns "SSH gitlab.satware.com" |
|
|
| GitLab PAT | `secret-tool lookup application git service gitlab.satware.com` | Returns PAT |
|
|
| GitHub CLI | `gh auth status -h github.com` | Valid token (or needs re-auth) |
|
|
| himalaya | `himalaya -a mw check` | SMTP/IMAP OK |
|
|
| Git remotes | `git fetch` on any tracked repo | No password prompt |
|
|
| JetBrains IDEs | Open CLion/WebStorm/IDEA | No credential prompts (auto-detects D-Bus secrets) |
|
|
|
|
### Cleanup (After All Verified Working)
|
|
|
|
```bash
|
|
sudo pacman -Rns kwallet kwalletmanager
|
|
rm -rf ~/.local/share/kwalletd/
|
|
```
|
|
|
|
---
|
|
*Last updated: 2026-05-21 | Password management migration complete. Post-reboot verification pending.*
|
|
|
|
---
|
|
|
|
## Short Term (Non-Reboot)
|
|
|
|
- [ ] Verify that `archlinux-keyring-wkd-sync.service` failure is resolved or investigate further.
|
|
- [ ] Evaluate if `systemd-oomd` is aggressive enough for interactive desktop use; if not, consider testing `earlyoom` as an alternative.
|
|
- [ ] Automate periodic S.M.A.R.T. checks via a systemd timer (currently manual).
|
|
- [ ] Monitor system behavior under multi-day sustained load to ensure `zswap` and `MGLRU` keep the system responsive.
|
|
|
|
## Infrastructure
|
|
|
|
- [ ] Consolidate Ansible variables for Docker memory limits into `ansible/vars/main.yml`.
|
|
- [ ] Extend `scripts/maintenance.sh` to include a summary of the last 24h OOM events (if any).
|
|
- [ ] Verify that `archlinux-keyring-wkd-sync.service` failure is resolved or investigate further.
|
|
|
|
---
|
|
*See `docs/product/passwords-migration-checklist.md` for detailed post-reboot actions.*
|
|
*See `docs/product/passwords.md` for the password management architecture overview.*
|
|
*See `docs/adr/password-management-migration.md` for the Architecture Decision Record.*
|