From 95968f6b477e84064df0690816380ce293064d89 Mon Sep 17 00:00:00 2001 From: Simon Gardling Date: Thu, 30 Apr 2026 00:46:05 -0400 Subject: [PATCH] oo7-daemon: unlock the Login keyring via systemd credential oo7-daemon was running but its 'Login' keyring stayed locked because nothing supplied a master password, so libsecret clients (flare in particular) blocked indefinitely on keyring.unlock(). The upstream user unit declares ImportCredential=oo7.keyring-encryption-password which picks up matching credentials from systemd's per-service credential machinery. Wire LoadCredential=oo7.keyring-encryption-password to the agenix-decrypted secret so the daemon unlocks at session start without any prompt. The password itself is a fresh 64-byte urandom value encrypted to all desktop recipients (admin SSH key + mreow + yarn TPM identities); it's opaque to the user and never typed manually. Owner is primary so the user-scope unit's LoadCredential read works without elevating. Verified the activation script chowns the decrypted file primary:users mode 0400, the user unit override carries the LoadCredential line, and the resulting drv builds clean. --- modules/desktop-age-secrets.nix | 10 ++++++++++ modules/desktop-oo7-daemon.nix | 9 +++++++++ secrets/desktop/oo7-keyring-password.age | Bin 0 -> 785 bytes secrets/secrets.nix | Bin 3359 -> 3419 bytes 4 files changed, 19 insertions(+) create mode 100644 secrets/desktop/oo7-keyring-password.age diff --git a/modules/desktop-age-secrets.nix b/modules/desktop-age-secrets.nix index c54bc76..dec1391 100644 --- a/modules/desktop-age-secrets.nix +++ b/modules/desktop-age-secrets.nix @@ -66,5 +66,15 @@ in group = "root"; }; + # Master password for oo7-daemon's 'Login' keyring; the unit consumes it + # via systemd's ImportCredential machinery (see desktop-oo7-daemon.nix). + # Owner is `primary` so the user-scope systemd unit can LoadCredential it. + oo7-keyring-password = { + file = ../secrets/desktop/oo7-keyring-password.age; + mode = "0400"; + owner = "primary"; + group = "users"; + }; + }; } diff --git a/modules/desktop-oo7-daemon.nix b/modules/desktop-oo7-daemon.nix index f5c44c3..90d42a9 100644 --- a/modules/desktop-oo7-daemon.nix +++ b/modules/desktop-oo7-daemon.nix @@ -31,5 +31,14 @@ systemd.user.services.oo7-daemon = { wantedBy = [ "default.target" ]; aliases = [ "dbus-org.freedesktop.secrets.service" ]; + # Feed the keyring master password through systemd's credential + # machinery. The upstream unit declares + # `ImportCredential=oo7.keyring-encryption-password`, which picks up + # whatever LoadCredential leaves under $CREDENTIALS_DIRECTORY. agenix + # decrypts the secret to /run/agenix/oo7-keyring-password as the + # `primary` user, who is also the user this user-scope unit runs as. + serviceConfig.LoadCredential = [ + "oo7.keyring-encryption-password:/run/agenix/oo7-keyring-password" + ]; }; } diff --git a/secrets/desktop/oo7-keyring-password.age b/secrets/desktop/oo7-keyring-password.age new file mode 100644 index 0000000000000000000000000000000000000000..1347efd741477476700a8b50b32893e8998e877a GIT binary patch literal 785 zcmZQ@_Y83kiVO&0xDjV{=x*QN<=^d(pNtJQwNPt5=X;BH$-X)Vx80{db>4qpvHau_ zPN5yg<4TT|hA$C+7qQMdQ&Sl zT&O#pTJZG6@x=8HjuebzS#W#ou11F8mE}DOkxr2i+I81@!S*Phh!|Ne%4 zfqzcER%P|&Yd+l46yjr>#AL0rWmlucf*pa^uc>`|?|NM7{-XPWKiZ$&PT4l+S>>CF za}2MiUeiyXFmsJ{`i1*9_ek5A5qlD7@^vZMVg~6|3JSF3*3g<`EFCrxmxa{;VhU!@Af#iZe^*8r+8Of#OIaIGPuv{y)=^c*($x`hQ|Ek?p#Gl z^Ve+oC)}ufkvrebc5A#&dv;1wnd|cB9N*phdvpGL-|*+DGJi^?W$5RdOY;R>q$^af zUyu}dwbI?|k;opW%9!6=#tXmxvz+DmS@rF&OX@vsSrNKTCJ!`Lp1nvB8;#p?Mb~Nhr0=G?XgOX%7)Ma?`tzbX&x9sMv zEs~s5kJpvGe&pe~O7{C?q3nkq-*`Ou zbX)DC*E4u79gF&TC)h7eYu}WQ(GDhjAA|WMtG|A;ZDIA$aO}EzK>l}fy!X<&`FCG0 z%damrSbXy5!Nl_{z5TD2WUh-|+v?GGZ^7%YpU(fi6WC~5^rlo|Qiwsb%p(2AdzK5_ z_cipGKGVi-p39DUr+Zz03%33HTpe=sPS*dafA*%w$L~9N^6O879cfJ0mq;7){N2#~ H<5@TW_WYub literal 0 HcmV?d00001 diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 2eec575aafe3150c198b331ea69d2f174ce72590..886c5e264e75a1e6d13bc3b0d0640b87817a4e8f 100644 GIT binary patch literal 3419 zcmZQ@_Y83kiVO&0Q0*(*wTHh&=Kkuatr_RuO?=Ck^-h5Cs%FcC8Abm6DqgK6rP-Z) zO04nES151z^YV$X_LO@C2Xe3cVA(&Z&Z)NU7^k}U6uuuFr#F1`J-u<};Zz3AUt6B1 zxR?HqZ+Q0hP~&~CRDldD^KFU+ESjxKRbfq+pJX?L{|&hjd{4ym)#c1-b_-u?D^0w` z`|HYnx!BsE24UF;FJ!OHO!~$CaPQt#&!*pd^K@5m$OK_?UzPne$&XL5h7?M(*tE<( zdG7VA6O9|!+=yTOj_snLyVj?Yt#0BEmi(S{{=3PwBa@o1-Vwj}S)60*$|-Mkc%{-r zdqZ|uK6)r1aS_dwDY*=%Cn+ngP8A(F#9}8YDVUW4&?7a5MyesM6IezVP zL=<>df68ch(X`yIbECt$6@SGVZP4!mmYya#y=is3X7UBM@(!m$q_*IqHXTExK=y=hQy^Nt!Cr-{=B)?9>$COWo zlj&zEZ+2ef`wCXo&5SMO1^S0hWHZScbE>3AM>RbR+4U*lj~n0DiJFHdCv*jfcsy8i zzWrp@k}SiTsR?4w?ygmB{>k-BsNX}TP4jemh2Wu_%a^Zg`BofV?D3#A`7VQStZfX# z72OZ>@1-1eEPJ(NiKgG~pLdf#&UU#|mS_G-;=wG-c_-%I7ISEyyM8IxWU-I+z7^a( z^`}&fnrFAM8~ivHln}7*PkU8L^*>hqJ5zSc%x!F`Qc+%6&8jMLVI{v*PxO&9(Z6LG zb&_t(Y@GMRT7GN(QfHoZPV-K!4f8#-r1DMD*~*s70$z15d)t|o8_i9LwVZ&m5xqwyArjX7iC=3-|BOGMeO~zF|Lno6^_1aO%Ry9*!QdM z+pMiW7ASn5_ebr=d9$0`b1v-^^qa$>x|D541Pl2 z7X5V;|IJmnX1_$XS%FdN_0`+?!jyv4&X@DsZj;(RcX~?EokjZtC10QP3CM~4-6a2Y zQ^LW+2c|22e171;-NNb#?mIW{ow#Ug#M&GB>f37idukX3OGVZ(Y%TxDvZX5j1G~P) zMF&rhnF+nB<<}P}rQO;6pnLIwQ#*th9hdPnS9`8F6=YrC&&{B2zsAsl&t#o=%fXwa z=XNb=xciCMtyZl)q(0!?`z3Wc65D1Uc=0xKo095e+e6`UK_0vhv{F_(Pnzsiu(%g3YGpfcsOTUxTxXx?Hp2zwTjoAvs=eu8~yn89a*>83%A8>&F9-K z(dlgD@=A1zyZ5}xWXaN9&8yxgE?OmSl6zyV?bU-?fAhV4>kfJ^OP}>AL_+V=58btf zxzkoP9N9AM!J^W~X}9XNcA4?%6)8sed}RF4;dtVe^^`)@73VLr9r$@etgIPhh;BV#VBCy8UsXgVoxOqf4iKb+FvXo7w)1 zsr<31sKB`fs{@yf(q08dYUXJB-nDPv5@U8&^*$fZg)2QPnvQbG)OuYvEb*;2J9Pf# z29rp=otp#}O#QHTiq!0!4Rs%9#3Y)PIL%}<6Vy6*P%-tL;q(13m8P7zC@{5tMA4+izuaJ5J9SUjob;!Rjd9lvO5N^Vxie3z!pERv^{#&(reBb6RchK$%;R zEsu=LcJBT?cgMWI5Y>)JZXCUHlO$id&iX5LU=zt@rB@@* zcJFw&&C_gGOq?@K%SM@W9*J=-cjx$Kwk!sapLtl=uV$gdnPu(tf$ zk7zDdzSjX)x|g?POE*qPu{zpNBKhZB*k(QTKUQ;im-^j)7!=F-dsa=((R;E}gY-Vz z?Gc%*9_1PQ>4J9E&Xno1#hq7|>x5i8@Hh0zHh+ojcUm5KthaTVtHg6C;@-qVe{b&k zG^}-qB zisXVtKenkWm!3G)XOVJKrDLs;`;Gf`@4|YNwpga!y|dEYV$rYIe#I3L46_a9YX7AAI10G-}HBe>6$!^3Fgyo+<9fvka;okjHiTD=DC+4 zQWKI7#h38aUVUxLnJpk{yUjFwwi3?_>)-ErUu>QuUcR#;aff`6yl3cvS2j}1S~D|l zpJr2KZ?FGx$B~z>Tl;qZr5Y~2*U~rVPuqIs$*Hh2+@e834>O|8v%gHbceX-h&67or z=lgRQx1RE9uRgickb6#wNq60aSCRX(=TF}FeeZEro$c;>yJmd7uxS2M`R==3=PQp_ zn6Tdp^5?cpn(-`xfzQSBp!v7@X+JaO$ogmSOMP2Dfh!^G^?#R$V&A{p++`E}m%yVgObeKY1 zx&<`qeokCnswZdXrNH#D)N6rjLwax5j?B;BwEiy0+;VX81n=AWYt;X+zFm|STDwPW z#i}m{vgH{TPV!i_sA09?nU=ojgtkn}Zw{B^`wSJ&`F?q~_C7=9qA&YW^b9w1o_=p~ z;={TfpZTW$x{>>j!>W0@Ytt6xO}z&~YyAvV76o}Ma}njARsZ{uR9MHyEe<~AEI(Wl z6d}&j<-G!(@$sg=Nblftvr2rqRwRXhO?^k@5XL>P=C+y z>G{*s<~8|zwdgF#*sQs5Mef_TAJhHT^_B-|7|o9r?v?D(t&dd4S)e`1)?_qq+c0#g`RpIG}AFuaWtGPk-BI zlRwezRJ2;p`>NQO63>8$!f6ZZBQ;;MG+QoNY%lTRkiFBIs~xhTLRU18?_QvP{K*{= zueG-S=6#s|^_X9DKL4v96F(fuFDeu*oTK=rT_rIiL&DW literal 3359 zcmZQ@_Y83kiVO&0*b(*AXQF~}wbB3bXGg5^Bu}j}co*JPR+e&3C^FbKct&NC+uFJB zYz}c%Tnf6tQ{Ry#ZcS!ua0nzNNxcGJfA`5V&zuF(nZ zXgxUP>NJbolOHxLf3#Cqchaf<)j^CurZ@avZudM$V$lZQiuShFbk8rnMtxfgw_VX) z;VNtrEx*25;wz7O?d7;7y_16`>9BoWIPaCN+J;bhy6REqd%j`@yvO2at}f3xrS_ ztJa(d)c-$8@n48&gu-RVi^i=n@zX?V1gh3OuISC(Fg4=KvJX1~*0V(Thox3;n>O2_ z!Y3;-$I5tpEdRUMokuUv3y!~*wSVWry^|yazN-qweU|bl@JcIn@fX-S!D9Bb!up!q z%!ZbkN%jj4%?{hKuS}`jC-!sxl(`P`rastsqjA$h%fsR?`z^F*b(~9#`KTwetLoUZ z&@}~73D!41vU9PO-#`C}F?$iyJfTM?=05tCY*e@C&%tHNGv@kyzp1!>()pl^N1`6q zl{kGUd0zb0+~zT>#1_PHZg<-3%y=*Ou{99I^WFqUe=lhrBV~pGsNaJcIQpW z%iccil=A6U*LkLKaMxcboAFy%tk!7)_mn4Qov)R?Rcv6LS|9t=$z)r_Yu5Huby2WKbq;LOz zJz>XX$*aBJZSJpP{n|cl>#Mb21)f+Wq%ZTfi=Fjj$_{tY3kGs5-@TI~KB#aW{_|(m zhgU)>o>MPIPkxkNbtP}L)*CsmdrrYimOe7wxnth>*sS^4o+Xb?2-5i~|2s`;2X~a;m+h_R zQW*<2ni%r$kDGjSf?sw<)Y2X z>;093{rj7}J!iE}jE`gI(x0i-`1;ZI>juo6Kf>qTzqLSh>Zik=W{1429E%P=6qu(N zv+k&ss6gG~qb%lg)F0Ygl;2&hvgg;Fmm53RUa-+#(-huw!ET;cEK}Ea;s4*Oy;j9s zoAF%fV#PVp50e^#d7k#`a9G)Q39xu{Tl|umE9?auT9q6tYGbbMYyNZw+?7Q;+-OS`U@vHgu z&#$q}Sf%mKhV62J_P4X|(^PhKtg`x0Ab)B`jd=XU`li=$f$@(gOq#U8YH~qQo!KR~ z{K@AQ?%?ac`SQ53wdd2MgTCF8cg|T|&WgtBAF^X+`?lKTB*m`$dEe6dCgZMU?|#KswD0?S{jg5W zj3C`7((`$a&buWtcjGs%nB^P?)h=z8@%p%v)9um4^#?rWH#+vXHC$&_2rjb|eOYL>9M_sQ?V2WRG)uqGl_rasjwIY^%+f?iRvh{!b z^YiOcI?Fv5-h86H<%!WvE2D>@vphd$?K_azX2rF>x+tQw&T#RgRi-kNuUAae_$>YM z#ijLTHqZTZmNu|WHk@^7)w?wde=ya|v9nrz{P5{R8_qoP)sNA9_3~EM&vsrW3JTA6i&WhW!-`tM07S=Fc%1|#N zw48GnkKhyTCeN-X5tF7rUOKDiq2R+6Q>Wb!PhTJNBJpNssM5z@pFV7|_*;|p?p7by zwIwV2@_pYuWZP!d>1>(zEO1l&NgXT6iPn2I9~V*O`L*GcdB?3iD^-NW6E3Eu*!vmW z6lzsEY3H+|qUfR)fANva+GVAeIRpz-El#CwQNCT5W+lAxwN&uF`Rb~yq8It&ULD@) z^z&Q5j9Cl&oc4L@ah{qgJYmJreZLmBx&7EOg}p-|Y4z>ZITG;&N)P)oFMsv4tv+gKl#uT}ZG{&Am^+hB8ar}~2MQzq4`-}U}+KH$M8V7~8nwo60zZDspSkw$lK zUY^ZZ8Yp|6x1v;N!girx3$`^nlD)|lA2tQ_*oiF^-}NAkdo&zcsQ8-3-@PmN9cHvQk8mR)k*jSJ_M$loqHS)tHu##O`p^*ra&-Oc>n zMw^F4>+l@Cf(mpn*LYk3>FyD+#)#_X|tKVM@ z7ft0eWmoSnRL;@4D$xD@)PtD+CY^iZ6w6bWT72V5^PJ`PDc`m7($$vBp}8@d*AH3O z=WTz-cs9eOjk&bprxjzlAlJ_G3)R=>^jb;#UD#Tv^*>Q*-)6@&GuF=w*C(1hd7k|> z{D#wx&$ph0J`{H3y7KSFo1h!=iw~ZV`!;*uPkkwc>#f&UFcxHP-~ML0lY>oe*=3)< z$GDy|HN8HuxXM^LE8*&fjrV0gy{O75Kd)!ls;v{Qb0c0=Z@JwTo8~)n4jJ{Y;r@TM z`nAu?4=YZyEc<81z4A;+Mg0Q(dFh^ugg<;0GMI4e^+X?una7uTET1g${{Hh|r-BQt zQbdY^AKFMaj(ar3*{=W?baj zxn8cc`eM7_J2sCuW#$ zQK?vv!+~@1cdM@c+9=ZK*1N%eW}kJ3S?P`srLDFb^+oR=Y&2HgB$6v@+nDh#VV#c4 zEEhecr-cXF6^;k9mWte-6Tj^V@05F{?gBpPmHXPbPM)fKY~Oc6EL7&4e%XdfyC+-k zOjqRBzpeLw@nxZlU9b4Jtq|J3_u`i=f8CEx@(NvfYvPXv)rek`cI^{t|Caa9={oHE z+s1CSUvG`)m%TRXLM@g%*RO4z8zB5%A0BO@LBdwXHbK~U0SxxerMVeknC&e_K zOFE%^=WSx-B%dvZmUJY1^7wDH`x8%x*SUk&G*3KBQ|Q^UoZs}%k8AO3MLA!&+RhZ# zo6Q;YPt?|Auanc`K=yc