Emma ThorpeandClaude Opus 5
10f713103c
CI / flake (push) Skipped
CI / flake (pull_request) Successful in 3m57s
gcx stores its OAuth access and refresh tokens in the system keychain unconditionally -- its config file keeps only opaque `keychain:gcx:v2:...` handles -- and exposes no plaintext fallback. With nothing owning org.freedesktop.secrets on this headless WSL box, `gcx login` authenticates against Grafana and then dies writing its config: "The name is not activatable". Add services.headlessSecretService: gnome-keyring as a systemd --user service, unlocking the login keyring at start. home-manager's own services.gnome-keyring does not fit here on two counts -- it is WantedBy graphical-session-pre.target, which never activates without a desktop session, and it passes no --unlock, so writes would block on a GUI prompter that does not exist. Only the secrets component is started. The ssh component is deliberately off: it would claim SSH_AUTH_SOCK and displace services.ssh-agent, breaking SSH auth and signed commits. The unlock password defaults to a random one generated on first activation under $XDG_DATA_HOME. The passwordFile option is the seam for supplying it from an agenix secret instead, once that lands. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
38 lines
1.6 KiB
Nix
38 lines
1.6 KiB
Nix
# Base home-manager profile, shared by every host (graphical or headless).
|
|
# Graphical hosts additionally import ./desktop.nix; the work host imports
|
|
# ./work.nix. See the host table in flake.nix.
|
|
{ ... }:
|
|
{
|
|
imports = [
|
|
./shell.nix
|
|
./git.nix
|
|
./editor.nix
|
|
./claude.nix
|
|
# Declares services.headlessSecretService; opt-in, off by default. Graphical
|
|
# hosts should prefer home-manager's own services.gnome-keyring.
|
|
./secret-service.nix
|
|
];
|
|
|
|
# Manage the XDG base-directory layout and ~/.config files. Tools above
|
|
# (bat themes, gh config, ...) write under xdg.configHome; enabling this
|
|
# makes the paths explicit and consistent across hosts. No regression: the
|
|
# defaults match the conventional ~/.config, ~/.cache, ~/.local/share.
|
|
xdg.enable = true;
|
|
|
|
# Editor ($EDITOR and $VISUAL) comes from nixvim's defaultEditor (editor.nix).
|
|
# Round out the rest of the standard env. desktop.nix adds its own Wayland
|
|
# session vars; home-manager merges the two attrsets, so these do not clash.
|
|
home.sessionVariables = {
|
|
PAGER = "less -FRX"; # -F quit-if-one-screen, -R raw colour, -X no clear
|
|
# Render man pages through bat (themed): col strips backspace overstrike,
|
|
# bat -l man -p highlights without its own pager decorations.
|
|
MANPAGER = "sh -c 'col -bx | bat -l man -p'";
|
|
};
|
|
|
|
# Pinned to the release first installed on these hosts, NOT the current
|
|
# nixpkgs (26.05). stateVersion freezes stateful defaults (file locations,
|
|
# service data formats) to that release; bumping it silently migrates that
|
|
# state and can break it. Leave it -- it is intentional, not stale.
|
|
home.stateVersion = "25.05";
|
|
}
|