Secret Service - Revision history

Axka: Minor wording changes

2026-10-05T18:47:40Z

Minor wording changes

← Older revision		Revision as of 18:47, 5 October 2026
Line 40:		Line 40:
	=== KeePassXC ===		=== KeePassXC ===

	KeePassXC's Secret Service integration can be enabled by going into ~~the~~ '''Tools > Settings''', opening the ''Secret Service Integration'' tab and enabling it.		KeePassXC's Secret Service integration can be enabled by going into '''Tools > Settings''', opening the ''Secret Service Integration'' tab and enabling it.

	This can be configured automatically by [[Home Manager]] configuration:{{file\|\|\|<nowiki>		This can also be configured automatically using [[Home Manager]] with the following configuration:{{file\|\|\|<nowiki>
	~~{ pkgs, ... }:~~
	{		{
	programs.keepassxc = {		programs.keepassxc = {
Line 54:		Line 53:
	};		};

	xdg.autostart.enable = true; # Enable creation of XDG autostart entries.		#xdg.autostart.enable = true; # Enable creation of XDG autostart entries if desired.
	}		}
	</nowiki>\|name=home.nix\|lang=nix}}		</nowiki>\|name=home.nix\|lang=nix}}

	Databases ~~needs~~ to be configured for Secret Service integration by opening ~~their settings~~ '''Database > Database Settings...''', opening the ''Secret Service Integration'' tab and selecting a group for Secret Service entries.		Databases need to be configured for Secret Service integration by opening '''Database > Database Settings...''', opening the ''Secret Service Integration'' tab and selecting a group for Secret Service entries.

	{{Warning\|"Another secret service is running (...). Please stop/remove it before re-enabling the Secret Service Integration."}}		{{Warning\|"Another secret service is running (...). Please stop/remove it before re-enabling the Secret Service Integration."}}

	If you see a warning like above, you ~~need to find out which~~ other service is ~~currently registered~~:<syntaxhighlight lang="shell">		If you see a warning like above, you should look for the other service to disable it. Here is a command to look for it:<syntaxhighlight lang="shell">
	busctl --user status org.freedesktop.secrets		busctl --user status org.freedesktop.secrets
	</syntaxhighlight>If it's the ~~Gnome~~ Keyring ~~Daemon~~, ~~then~~ it can be disabled ~~by this~~ configuration ~~below~~:{{file\|\|\|<nowiki>		</syntaxhighlight>If it's the GNOME Keyring daemon, it can be disabled using the following NixOS configuration module:{{file\|\|\|<nowiki>
	~~{ config, pkgs, lib, ... }:~~
	{		{
	services.gnome.gnome-keyring.enable = lib.mkForce false;		services.gnome.gnome-keyring.enable = lib.mkForce false;

Axka: Undid revision 29358 by Pamplemousse (talk): KeePassXC database settings and application settings are separate

2026-10-05T18:42:25Z

Undid revision 29358 by Pamplemousse (talk): KeePassXC database settings and application settings are separate

← Older revision		Revision as of 18:42, 5 October 2026
Line 58:		Line 58:
	</nowiki>\|name=home.nix\|lang=nix}}		</nowiki>\|name=home.nix\|lang=nix}}

	~~If not using the `settings.FdoSecrets.Enabled = true;` one~~ needs to ~~configure~~ for Secret Service integration by opening their settings '''Database > Database Settings...''', opening the ''Secret Service Integration'' tab and selecting a group for Secret Service entries.		Databases needs to be configured for Secret Service integration by opening their settings '''Database > Database Settings...''', opening the ''Secret Service Integration'' tab and selecting a group for Secret Service entries.

	{{Warning\|"Another secret service is running (...). Please stop/remove it before re-enabling the Secret Service Integration."}}		{{Warning\|"Another secret service is running (...). Please stop/remove it before re-enabling the Secret Service Integration."}}

Axka: Undid revision 29359 by Pamplemousse (talk): not a NixOS option

2026-10-05T18:38:27Z

Undid revision 29359 by Pamplemousse (talk): not a NixOS option

← Older revision		Revision as of 18:38, 5 October 2026
Line 58:		Line 58:
	</nowiki>\|name=home.nix\|lang=nix}}		</nowiki>\|name=home.nix\|lang=nix}}

	If not using the ~~{{Nixos:option\|2=~~settings.FdoSecrets.Enabled = true}} one needs to configure for Secret Service integration by opening their settings '''Database > Database Settings...''', opening the ''Secret Service Integration'' tab and selecting a group for Secret Service entries.		If not using the `settings.FdoSecrets.Enabled = true;` one needs to configure for Secret Service integration by opening their settings '''Database > Database Settings...''', opening the ''Secret Service Integration'' tab and selecting a group for Secret Service entries.

	{{Warning\|"Another secret service is running (...). Please stop/remove it before re-enabling the Secret Service Integration."}}		{{Warning\|"Another secret service is running (...). Please stop/remove it before re-enabling the Secret Service Integration."}}

Souheab: /* Troubleshooting */ Add a solution to fix an error where GNOME keyring daemon fails to spawn the SystemPrompter process

2026-03-09T18:15:39Z

Troubleshooting: Add a solution to fix an error where GNOME keyring daemon fails to spawn the SystemPrompter process

← Older revision		Revision as of 18:15, 9 March 2026
Line 111:		Line 111:

	This error happens when the PAM module can't find the daemon's control socket. Very likely it will start a daemon and retry the action which requires a daemon, and stop the daemon when the PAM session closes.		This error happens when the PAM module can't find the daemon's control socket. Very likely it will start a daemon and retry the action which requires a daemon, and stop the daemon when the PAM session closes.

			=== <code>gnome-keyring-daemon: couldn't create system prompt: GDBus.Error:org.freedesktop.DBus.Error.Spawn.ChildExited: Process org.gnome.keyring.SystemPrompter exited with status 1</code> ===
			This error occurs when the GNOME Keyring daemon fails to spawn the SystemPrompter process (provided by the gcr package). This usually occurs due to D-Bus not having knowledge of the user's display environment. To fix this we must update the D-Bus environment once display is available.

			On X11 this can be fixed by setting the following option:

			{{File\|3=services.xserver.updateDbusEnvironment = true;\|name=/etc/nixos/configuration.nix\|lang=nix}}

			OR

			Alternatively the following command can be run on display startup:

			{{Commands\|$ dbus-update-activation-environment --systemd --all}}

	=== <code>discover_other_daemon: 0</code> with <code>--start</code> ===		=== <code>discover_other_daemon: 0</code> with <code>--start</code> ===

Pamplemousse at 13:24, 4 January 2026

2026-01-04T13:24:25Z

← Older revision		Revision as of 13:24, 4 January 2026
Line 58:		Line 58:
	</nowiki>\|name=home.nix\|lang=nix}}		</nowiki>\|name=home.nix\|lang=nix}}

	If not using the `settings.FdoSecrets.Enabled = true;` one needs to configure for Secret Service integration by opening their settings '''Database > Database Settings...''', opening the ''Secret Service Integration'' tab and selecting a group for Secret Service entries.		If not using the {{Nixos:option\|2=settings.FdoSecrets.Enabled = true}} one needs to configure for Secret Service integration by opening their settings '''Database > Database Settings...''', opening the ''Secret Service Integration'' tab and selecting a group for Secret Service entries.

	{{Warning\|"Another secret service is running (...). Please stop/remove it before re-enabling the Secret Service Integration."}}		{{Warning\|"Another secret service is running (...). Please stop/remove it before re-enabling the Secret Service Integration."}}

Pamplemousse at 13:23, 4 January 2026

2026-01-04T13:23:03Z

← Older revision		Revision as of 13:23, 4 January 2026
Line 58:		Line 58:
	</nowiki>\|name=home.nix\|lang=nix}}		</nowiki>\|name=home.nix\|lang=nix}}

	~~Databases~~ needs to ~~be configured~~ for Secret Service integration by opening their settings '''Database > Database Settings...''', opening the ''Secret Service Integration'' tab and selecting a group for Secret Service entries.		If not using the `settings.FdoSecrets.Enabled = true;` one needs to configure for Secret Service integration by opening their settings '''Database > Database Settings...''', opening the ''Secret Service Integration'' tab and selecting a group for Secret Service entries.

	{{Warning\|"Another secret service is running (...). Please stop/remove it before re-enabling the Secret Service Integration."}}		{{Warning\|"Another secret service is running (...). Please stop/remove it before re-enabling the Secret Service Integration."}}

Elvetemedve: Describe how to setup KeepassXC as Secret Service declaratively. Also added note about how to disable conflicting Gnome Keyring Daemon.

2025-11-01T12:50:28Z

Describe how to setup KeepassXC as Secret Service declaratively. Also added note about how to disable conflicting Gnome Keyring Daemon.

@@ Line 40: / Line 40: @@
 === KeePassXC ===
-KeePassXC's Secret Service integration can be enabled by going into the settings, opening the ''Secret Service Integration'' tab and enabling it.
+KeePassXC's Secret Service integration can be enabled by going into the '''Tools > Settings''', opening the ''Secret Service Integration'' tab and enabling it.
-Databases needs to be configured for Secret Service integration by opening their settings, opening the ''Secret Service Integration'' tab and selecting a group for Secret Service entries.
+This can be configured automatically by [[Home Manager]] configuration:{{file|||<nowiki>
-{{Expansion|Missing socket activation instructions.}}
+  xdg.autostart.enable = true; # Enable creation of XDG autostart entries.
 === pass-secret-service ===

Axka at 21:41, 5 April 2025

2025-04-05T21:41:01Z

← Older revision		Revision as of 21:41, 5 April 2025
Line 62:		Line 62:

	== Secret portal ==		== Secret portal ==
	'''[https://flatpak.github.io/xdg-desktop-portal/docs/doc-org.freedesktop.portal.Secret.html Secret portals]''' are portals in the XDG Desktop Portal specification, which allows applications to get a per-application master secret. I ([[User:Axka\|axka]]) don't know of any applications requiring this, and to my knowledge the only provider is GNOME Keyring, which can be added to <code>xdg.portal.extraPortals</code> in Home Manager or NixOS. Adding <code>gnome-keyring</code> will also add XDG autostart definitions, but unless you have <code>gnome-keyring</code> installed on NixOS, they won't be enabled (i.e. <code>/run/wrappers/bin/gnome-keyring-daemon</code> won't work).		'''[https://flatpak.github.io/xdg-desktop-portal/docs/doc-org.freedesktop.portal.Secret.html Secret portals]''' are portals in the XDG Desktop Portal specification, which allows applications to get a per-application master secret. I ([[User:Axka\|axka]]) don't know of any applications requiring this, and to my knowledge the only provider is GNOME Keyring, which can be added to <code>xdg.portal.extraPortals</code> in Home Manager. NixOS enables this automatically when GNOME Keyring is enabled. Adding <code>gnome-keyring</code> will also add XDG autostart definitions, but unless you have <code>gnome-keyring</code> installed on NixOS, they won't be enabled (i.e. <code>/run/wrappers/bin/gnome-keyring-daemon</code> won't work).

	== Auto-decrypt on login ==		== Auto-decrypt on login ==

	The NixOS module for GNOME Keyring enables its PAM module automatically via {{nixos:option\|security.pam.services..enableGnomeKeyring}}. The equivalent for KDE Wallet is {{nixos:option\|security.pam.services..kwallet.enable}}.		The NixOS module for GNOME Keyring enables its PAM module automatically via {{nixos:option\|security.pam.services.*.enableGnomeKeyring}}, however the Home Manager module does not and as such you should add the following code to your NixOS configuration:
			{{file\|/etc/nixos/configuration.nix\|nix\|<nowiki>
			security.pam.services.login.enableGnomeKeyring = true;
			</nowiki>}}

			The equivalent for KDE Wallet is {{nixos:option\|security.pam.services.*.kwallet.enable}}.

	Usually you want to configure the <code>login</code> service, but <code>greetd</code>, <code>su</code> and <code>sshd</code> are also available. GDM and LightDM can be configured with <code>login</code>, while greetd cannot ({{issue\|357201}}).		Usually you want to configure the <code>login</code> service, but <code>greetd</code>, <code>su</code> and <code>sshd</code> are also available. GDM and LightDM can be configured with <code>login</code>, while greetd cannot ({{issue\|357201}}).

Axka at 21:24, 5 April 2025

2025-04-05T21:24:09Z

← Older revision		Revision as of 21:24, 5 April 2025
Line 88:		Line 88:
	=== <code>discover_other_daemon: 1</code> with <code>--start</code> ===		=== <code>discover_other_daemon: 1</code> with <code>--start</code> ===

	This log message gets printed when a <code>gnome-keyring-daemon</code> process with the <code>--start</code> flag ~~either~~ successfully sent <code>GKD_CONTROL_OP_INITIALIZE</code> to a control socket.		This log message gets printed when a <code>gnome-keyring-daemon</code> process with the <code>--start</code> flag successfully sent <code>GKD_CONTROL_OP_INITIALIZE</code> to a control socket.

	[[Category:Desktop]]		[[Category:Desktop]]

Axka: formatting

2025-04-05T21:23:35Z

formatting

← Older revision		Revision as of 21:23, 5 April 2025
Line 84:		Line 84:
	=== <code>discover_other_daemon: 0</code> with <code>--start</code> ===		=== <code>discover_other_daemon: 0</code> with <code>--start</code> ===

	This error happens when a `gnome-keyring-daemon` process with the `--start` flag either could not send `GKD_CONTROL_OP_INITIALIZE` to a control socket or got a failing result.		This error happens when a <code>gnome-keyring-daemon</code> process with the <code>--start</code> flag either could not send <code>GKD_CONTROL_OP_INITIALIZE</code> to a control socket or got a failing result.

	=== <code>discover_other_daemon: 1</code> with <code>--start</code> ===		=== <code>discover_other_daemon: 1</code> with <code>--start</code> ===

	This log message gets printed when a `gnome-keyring-daemon` process with the `--start` flag either successfully sent `GKD_CONTROL_OP_INITIALIZE` to a control socket.		This log message gets printed when a <code>gnome-keyring-daemon</code> process with the <code>--start</code> flag either successfully sent <code>GKD_CONTROL_OP_INITIALIZE</code> to a control socket.

	[[Category:Desktop]]		[[Category:Desktop]]