caesium: bump

2026-10-17 15:02:53 -04:00
parent 71ae57dd92
commit f41b6186eb
4 changed files with 190 additions and 6 deletions
@@ -0,0 +1,61 @@
+# KeePassXC replaces KWallet as the org.freedesktop.secrets provider so the
+# vault can be unlocked with a YubiKey (HMAC-SHA1 challenge-response on OTP
+# slot 2) instead of the login password. KWallet's only unattended-unlock
+# path is pam_kwallet inheriting the login password, which passwordless
+# YubiKey login (module.yubikey.nix) never supplies -- KeePassXC is the only
+# one of the two with native hardware-key support.
+#
+# Database creation is manual/interactive (GUI wizard), not declared here:
+# the .kdbx is mutable state, and the Secret Service "exposed group" setting
+# lives inside the database file itself with no Nix-level equivalent. See
+# yubikey-chalresp (caesium.home.nix) for programming the shared
+# challenge-response secret onto each key first.
+{
+  lib,
+  ...
+}:
+
+{
+  xdg.autostart.enable = true;
+
+  programs.keepassxc = {
+    enable = true;
+    autostart = true;
+    settings = {
+      FdoSecrets.Enabled = true;
+      FdoSecrets.ConfirmDeleteItem = true;
+
+      # Required, not cosmetic: this home-manager module installs its own
+      # browser native-messaging manifest. Leaving KeePassXC's own updater on
+      # collides with it and throws an error dialog on every launch.
+      Browser.UpdateBinaryPath = false;
+
+      GUI.ShowTrayIcon = true;
+      GUI.MinimizeToTray = true;
+
+      General.MinimizeAfterUnlock = true;
+      General.BackupBeforeSave = true;
+
+      Security.LockDatabaseIdle = true;
+      Security.LockDatabaseIdleSeconds = 900;
+    };
+  };
+
+  # Non-empty `programs.keepassxc.settings` links keepassxc.ini read-only into
+  # the Nix store; KeePassXC will report a config-write error at startup
+  # because it also persists runtime state (last-opened DB, window geometry)
+  # there. Expected and harmless -- see nix-community/home-manager#8257. If
+  # the dialog proves intolerable, drop `settings` above, install the package
+  # via home.packages instead, and seed a mutable keepassxc.ini with a
+  # home.activation script (module.evolution.nix uses the same technique for
+  # EDS *.source files).
+
+  # Disable KWallet outright so nothing fights KeePassXC for the
+  # org.freedesktop.secrets D-Bus name. Linked read-only on purpose: it stops
+  # Plasma silently re-enabling the wallet from System Settings.
+  xdg.configFile."kwalletrc".text = lib.generators.toINI { } {
+    Wallet = {
+      Enabled = false;
+    };
+  };
+}