roam/azospass.org

azos/pass

• azos/pass
  • Format
  • Conventions
  • Path Mappings
  • Pending
  • Known secret leaked into repo (needs migration)
  • mu4e / mu database gotchas

azos/pass

Password store conventions and path mappings for lauretta.

See root: azos

Format

The store was migrated (2026-07-25) from a nested path scheme to a flat layout. Each entry is domain.com with the password on line 1 and login: on line 2:

<PASSWORD>
login: user@example.com

Conventions

• All passwordCommand fields in Nix/mbsync configs must pipe through | head -1 to extract only the password line
• pass-git-helper handles multi-line entries natively — no head -1 needed there
• mbsync app passwords live under the mbsync/ namespace to keep them separate from account passwords
• Emacs' generic auth-source-search (used by any package supporting auth-source, e.g. lichess.el, gptel, mu4e, tramp) is wired to pass via auth-source-pass-enable in azos-core/features/base/emacs/config.org (added 2026-09-15). Store the secret under a pass entry matching the bare hostname the package searches on (e.g. lichess.org) — no per-package glue code needed, unlike the caldav/mbsync shell-command-to-string "pass ... | head -1" pattern.

Path Mappings

Service	pass path	Config location
Gmail mbsync	mbsync/anerisgreat@gmail.com	features/mail/default.nix
BGU mbsync	mbsync/anerz@post.bgu.ac.il	features/mail/default.nix
Zakobar mail (privateemail.com)	privateemail.com	features/mail/default.nix
Nextcloud / caldav	zakobar.com	features/lauretta/emacs/config.org
Nextcloud webdav mount (password, reuses caldav entry)	zakobar.com	features/nextcloud/default.nix
Nextcloud webdav mount (uid, differs from login name)	nextcloud-username/aner	features/nextcloud/default.nix
Git credentials (zakobar.com)	zakobar.com	features/git-config/pass-git-mapping.ini
Lichess API token	lichess.org (via auth-source-pass)	azos-core/features/base/emacs/config.org

Pending

• mbsync/anerisgreat@gmail.com and mbsync/anerz@post.bgu.ac.il entries not yet created in the store — mail sync will fail until these are added via pass insert
• lichess.org entry not yet created — needed for lichess.el AI challenges/moves to authenticate (scopes: board:play, challenge:write, optionally follow:read)

Known secret leaked into repo (needs migration)

features/lauretta/emacs/config.org hardcodes a live-looking Groq API key in plaintext (gptel-make-openai "Groq" :key "gsk_..."), committed to git history. Should migrate to pass + the new auth-source-pass wiring (gptel's :key slot accepts a function; gptel ships gptel-api-key-from-auth-source for exactly this). Flagged 2026-09-15, not yet fixed — user hasn't confirmed whether to rotate/migrate.

mu4e / mu database gotchas

• home.activation.muInit in features/mail/default.nix only runs mu init if ~/.cache/mu doesn't already exist — changing the --maildir path in that script (e.g. the 2026-09-07 ~/Mail → ~/Maildir fix) has no effect on machines where the cache dir already exists. The activation script is init-only, not a resync-on-config-change mechanism.
• Symptom of a corrupted Xapian index: mu4e fails with "Mu server process ended with exit code 1" / "error in process sentinel"; mu info or mu server directly report "error: failed to read database". Tell-tale sign in ~/.cache/mu/xapian/: the small metadata files (iamglass, flintlock) have a much newer mtime than the bulk data files (docdata.glass, position.glass, postlist.glass, termlist.glass) — indicates a crashed/interrupted index run left the glass DB inconsistent.
• Fix: mv ~/.cache/mu ~/.cache/mu.bak-$(date +%s) (reversible backup, not delete), then mu init --maildir"$HOME/Maildir" –my-address=… [repeat for all addresses]=, then mu index. Reindexing ~16k messages from local Maildir takes under a minute — safe to just do this rather than trying to repair the Xapian DB in place.