From a15b55192dbac9958d1167ba4cce576cba9c1f25 Mon Sep 17 00:00:00 2001 From: Igor Camilo <11697241+igorcamilo@users.noreply.github.com> Date: Mon, 27 Jul 2026 11:47:02 +0200 Subject: [PATCH 1/2] Update KeePassXC integration and documentation Clarify KeePassXC's role as a Secret Service provider, noting that it can be enabled via GUI settings. Adjust comments to reflect the behavior of NetworkManager regarding secret storage, ensuring users understand the implications of the integration. --- docs/architecture.md | 2 +- home.nix | 17 +++++++++++------ 2 files changed, 12 insertions(+), 7 deletions(-) diff --git a/docs/architecture.md b/docs/architecture.md index a53745c..849ef81 100644 --- a/docs/architecture.md +++ b/docs/architecture.md @@ -168,7 +168,7 @@ Home Manager owns: | --- | --- | | Hyprland and Quickshell files | Installs the user's desktop files | | Quickshell lock service | Gives every lock request one idempotent service | -| KeePassXC | Starts automatically and provides the Secret Service API | +| KeePassXC | Starts automatically; can provide the Secret Service API once enabled in its settings | | Ghostty | Provides the configured terminal | | hypridle | Locks after 5 minutes and blanks displays 30 seconds later | diff --git a/home.nix b/home.nix index 1f74440..5a3a7a5 100644 --- a/home.nix +++ b/home.nix @@ -69,15 +69,20 @@ }; programs = { - # Secret Service integration: lets applications, including - # NetworkManager, store and retrieve secrets through KeePassXC instead - # of gnome-keyring or KWallet. See README.md. + # Stands in for gnome-keyring or KWallet as the Secret Service provider, + # for applications that call that D-Bus API themselves. NetworkManager + # does not: it reaches a Secret Service only through a NetworkManager + # secret agent, which this session deliberately does not run, so Wi-Fi + # passphrases stay in /etc/NetworkManager/system-connections on the + # encrypted root rather than in a vault. + # + # Secret Service is left as a first-run GUI toggle instead of a declared + # setting: home-manager links keepassxc.ini read-only into the store + # whenever `settings` is non-empty, which would also stop KeePassXC from + # recording which database to reopen on autostart. keepassxc = { enable = true; autostart = true; - settings = { - FdoSecrets.Enabled = true; - }; }; ghostty = { From a8ec7c405d6414bf7a52ab8df4df5aec02d7c995 Mon Sep 17 00:00:00 2001 From: Igor Camilo <11697241+igorcamilo@users.noreply.github.com> Date: Mon, 27 Jul 2026 12:23:20 +0200 Subject: [PATCH 2/2] Refactor greetd config and update documentation Replace custom Hyprland+Quickshell greeter with agreety, greetd's bundled text greeter, to streamline the login process on real hardware. Update related documentation to reflect changes in the greeter setup and recovery instructions. Ensure that session management remains consistent with the new greeter implementation. --- configuration.nix | 24 ++++++++---------------- docs/architecture.md | 30 +++++++++++++----------------- docs/recovery.md | 19 ++++++++----------- home.nix | 3 --- 4 files changed, 29 insertions(+), 47 deletions(-) diff --git a/configuration.nix b/configuration.nix index 05af8bd..ccfcb03 100644 --- a/configuration.nix +++ b/configuration.nix @@ -70,21 +70,15 @@ fwupd.enable = true; - # greetd runs a throwaway Hyprland+Quickshell "greeter" session (see - # dotfiles/hypr/greeter.lua and dotfiles/quickshell/greeter) that - # authenticates over greetd's own IPC protocol, then hands off to the - # user's normal session below. The greeter runs as its own system - # user (created automatically by this module), so its files are - # published system-wide via environment.etc below rather than - # home-manager. + # agreety, greetd's own bundled text greeter, replaces a custom + # Hyprland+Quickshell greeter session while Hyprland itself is still + # being brought up on real hardware. On successful login it hands off + # to the user's Hyprland session below via start-hyprland, the same + # target the custom greeter used. greetd = { enable = true; - settings.default_session = { - # Preserve compositor and greeter output after their runtime directory - # disappears. Read it with: journalctl -b -t greetd-greeter - command = "${pkgs.systemd}/bin/systemd-cat --identifier=greetd-greeter -- start-hyprland -- --config /etc/greetd/hyprland.lua"; - user = "greeter"; - }; + useTextGreeter = true; + settings.default_session.command = "${pkgs.greetd}/bin/agreety --cmd start-hyprland"; }; udisks2.enable = true; @@ -142,10 +136,8 @@ pkgs.quickshell ]; etc = { + # Also read directly by the lock screen; see dotfiles/quickshell/lockscreen. "wallpaper.jpg".source = ./wallpapers/weic2216b.jpg; - "greetd/hyprland.lua".source = ./dotfiles/hypr/greeter.lua; - # Keep the greeter and its ../shared QML import in one Nix store tree. - "greetd/quickshell".source = ./dotfiles/quickshell; }; }; diff --git a/docs/architecture.md b/docs/architecture.md index 849ef81..b24881a 100644 --- a/docs/architecture.md +++ b/docs/architecture.md @@ -259,27 +259,24 @@ The graphical path is: flowchart TD boot["boot"] --> unlock["Plymouth and LUKS unlock"] unlock --> greetd["greetd"] - greetd --> greeter["temporary Hyprland greeter session"] - greeter --> loginui["Quickshell login UI"] - loginui --> session["normal Hyprland user session"] + greetd --> agreety["agreety text login"] + agreety --> session["normal Hyprland user session"] session --> bar["Quickshell bar and wallpaper"] session --> terminal["Ghostty terminal"] session --> keepassxc["KeePassXC Secret Service"] session --> hypridle["hypridle"] --> lock["Quickshell lock service"] ``` -System-owned greeter files are installed by `configuration.nix` under -`/etc/greetd`. The greeter and its shared QML components remain in one store -tree so relative imports work after Nix resolves `/etc` symlinks. User-owned -session files are installed by Home Manager from `home.nix`. +greetd starts agreety, its own bundled text greeter, directly on the console; +neither needs any custom configuration or QML. Session files for the +Hyprland session itself are installed by Home Manager from `home.nix`. -Both transitions into Hyprland use `start-hyprland`, Hyprland's supported -launcher. It prepares the session environment before starting the compositor; -the greeter additionally passes its small system-owned configuration file. -The greeter's compositor and Quickshell output is retained in the system -journal under the `greetd-greeter` identifier. A failed Quickshell startup -leaves its compositor in place instead of repeatedly restarting it; a -successful authenticated handoff exits it normally. +On successful login, greetd starts the user's session with `start-hyprland`, +Hyprland's supported launcher, which prepares the session environment before +starting the compositor. + +agreety stands in for a planned Hyprland+Quickshell greeter, held back until +Hyprland itself has had real-hardware testing (see `docs/recovery.md`). The lock screen is a systemd user service. Starting an already-running service is safe, so keyboard, idle, and suspend events can all request a lock without a @@ -314,8 +311,8 @@ need a real Wayland compositor and its protocols, while an offscreen Qt process has no window-system backend. Starting a nested compositor merely to make that test pass would add infrastructure without reproducing the real login or lock environment. The native system build already proves that the configured -Quickshell package can be produced; actual bar, greeter, and lock-screen -behavior remains a hardware acceptance test. +Quickshell package can be produced; actual bar and lock-screen behavior +remains a hardware acceptance test. Another separate job scans the complete Git history for secrets. @@ -356,7 +353,6 @@ and full Git history. | `modules/boot/` | Shared Secure Boot, measured boot, and graphical splash | | `dotfiles/hypr/` | Hyprland startup and key bindings | | `dotfiles/quickshell/bar/` | User bar and wallpaper | -| `dotfiles/quickshell/greeter/` | Login screen | | `dotfiles/quickshell/lockscreen/` | Lock screen | | `dotfiles/quickshell/shared/` | Reused login and lock components | | `wallpapers/` | Images installed by the shared system configuration | diff --git a/docs/recovery.md b/docs/recovery.md index e5f20ed..8672fbf 100644 --- a/docs/recovery.md +++ b/docs/recovery.md @@ -4,17 +4,13 @@ - Use Ctrl+Alt+F3 (or another free VT) if graphical login fails, and log in as `igor` with the password chosen during installation. -- Greeter runtime directories disappear when a failed greeter session exits, - so `/run/user//hypr/.../hyprland.log` is not a durable log. - Read the retained logs from that VT instead: +- agreety runs directly on the console, so its login prompt and any errors + are visible right there on tty1. greetd's own session decisions (including + failed handoffs to `start-hyprland`) are in the system journal: ```sh - sudo journalctl -b -t greetd-greeter sudo journalctl -b -u greetd ``` - - The first command contains Hyprland and Quickshell output; the second - contains greetd's session decisions. - Select an older NixOS generation from the boot menu after a broken rebuild. - Press Escape while Plymouth is running to reveal boot details or a text prompt; press Escape again to return to the graphical splash. @@ -49,10 +45,11 @@ with `cryptsetup open --test-passphrase`. - The committed hardware module is a generic, architecture-correct placeholder until the first installation commits the real scan. -- The custom Quickshell greeter and lock screen need real-hardware testing. -- The greeter currently targets one interactive surface; multi-monitor - presentation has not been completed. -- QML authentication assumes the default password-only PAM conversation. +- The Hyprland user session and Quickshell lock screen need real-hardware + testing. Login uses agreety, greetd's own bundled text greeter, until a + Hyprland+Quickshell greeter is worth reintroducing. +- Lock screen authentication assumes the default password-only PAM + conversation. - Audio, a graphical polkit agent, notifications, and complete portal integration are follow-up workstation work. diff --git a/home.nix b/home.nix index 5a3a7a5..34200d8 100644 --- a/home.nix +++ b/home.nix @@ -56,9 +56,6 @@ }; # Hyprland session and Quickshell shells (bar, lock screen, launcher). - # The greeter has its own copy of Quickshell's config, published via - # environment.etc in configuration.nix instead of home-manager, since - # it runs as a separate system user with no home directory here. file = { ".config/hypr/hyprland.lua".source = ./dotfiles/hypr/hyprland.lua; ".config/quickshell/shell.qml".source = ./dotfiles/quickshell/bar/shell.qml;