62 lines
2.3 KiB
Nix
62 lines
2.3 KiB
Nix
# KeePassXC replaces KWallet as the org.freedesktop.secrets provider so the
|
|
# vault can be unlocked with a YubiKey (HMAC-SHA1 challenge-response on OTP
|
|
# slot 2) instead of the login password. KWallet's only unattended-unlock
|
|
# path is pam_kwallet inheriting the login password, which passwordless
|
|
# YubiKey login (module.yubikey.nix) never supplies -- KeePassXC is the only
|
|
# one of the two with native hardware-key support.
|
|
#
|
|
# Database creation is manual/interactive (GUI wizard), not declared here:
|
|
# the .kdbx is mutable state, and the Secret Service "exposed group" setting
|
|
# lives inside the database file itself with no Nix-level equivalent. See
|
|
# yubikey-chalresp (caesium.home.nix) for programming the shared
|
|
# challenge-response secret onto each key first.
|
|
{
|
|
lib,
|
|
...
|
|
}:
|
|
|
|
{
|
|
xdg.autostart.enable = true;
|
|
|
|
programs.keepassxc = {
|
|
enable = true;
|
|
autostart = true;
|
|
settings = {
|
|
FdoSecrets.Enabled = true;
|
|
FdoSecrets.ConfirmDeleteItem = true;
|
|
|
|
# Required, not cosmetic: this home-manager module installs its own
|
|
# browser native-messaging manifest. Leaving KeePassXC's own updater on
|
|
# collides with it and throws an error dialog on every launch.
|
|
Browser.UpdateBinaryPath = false;
|
|
|
|
GUI.ShowTrayIcon = true;
|
|
GUI.MinimizeToTray = true;
|
|
|
|
General.MinimizeAfterUnlock = true;
|
|
General.BackupBeforeSave = true;
|
|
|
|
Security.LockDatabaseIdle = true;
|
|
Security.LockDatabaseIdleSeconds = 900;
|
|
};
|
|
};
|
|
|
|
# Non-empty `programs.keepassxc.settings` links keepassxc.ini read-only into
|
|
# the Nix store; KeePassXC will report a config-write error at startup
|
|
# because it also persists runtime state (last-opened DB, window geometry)
|
|
# there. Expected and harmless -- see nix-community/home-manager#8257. If
|
|
# the dialog proves intolerable, drop `settings` above, install the package
|
|
# via home.packages instead, and seed a mutable keepassxc.ini with a
|
|
# home.activation script (module.evolution.nix uses the same technique for
|
|
# EDS *.source files).
|
|
|
|
# Disable KWallet outright so nothing fights KeePassXC for the
|
|
# org.freedesktop.secrets D-Bus name. Linked read-only on purpose: it stops
|
|
# Plasma silently re-enabling the wallet from System Settings.
|
|
xdg.configFile."kwalletrc".text = lib.generators.toINI { } {
|
|
Wallet = {
|
|
Enabled = false;
|
|
};
|
|
};
|
|
}
|