From 238528f961f523c7b05bb41e74238e9d44900c73 Mon Sep 17 00:00:00 2001 From: Daniel Fainberg Date: Tue, 7 Jul 2026 08:18:59 +0200 Subject: [PATCH] feat(desktop): provide Secret Service via gnome-keyring Bare Wayland session ships no `org.freedesktop.secrets` provider, so libsecret/qtkeychain apps can't persist credentials. Run gnome-keyring and unlock it at the greetd login via PAM. Co-Authored-By: Claude Opus 4.8 --- modules/home.nix | 4 ++++ modules/nixos.nix | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/modules/home.nix b/modules/home.nix index 0113230..17664d2 100644 --- a/modules/home.nix +++ b/modules/home.nix @@ -353,6 +353,10 @@ in # Notification daemon. notify-send clients (e.g. imv's info/delete toasts in # modules/media.nix, gpg-agent errors) need a running server on the bus. # Minimal to match the desktop: Nerd Font, no rounding, square border. + # Secret Service provider (freedesktop org.freedesktop.secrets). Bare Wayland + # session has none otherwise; apps using libsecret/qtkeychain need it. + services.gnome-keyring.enable = true; + services.mako = { enable = true; settings = { diff --git a/modules/nixos.nix b/modules/nixos.nix index e36db55..babfb31 100644 --- a/modules/nixos.nix +++ b/modules/nixos.nix @@ -92,6 +92,10 @@ }; }; + # Unlock the login keyring with the login password at the greetd prompt, + # so the Secret Service is open without a second passphrase. + security.pam.services.greetd.enableGnomeKeyring = true; + # XDG portals (screen sharing, file pickers, and so on). xdg.portal = { enable = true;