58 lines
4.1 KiB
Org Mode
58 lines
4.1 KiB
Org Mode
:PROPERTIES:
|
|
:ID: 09ae970c-2995-43d9-a597-47bb904c98de
|
|
:END:
|
|
|
|
#+title: azos/pass
|
|
#+filetags: :project: :knowledge: :pass:
|
|
|
|
* azos/pass
|
|
|
|
Password store conventions and path mappings for lauretta.
|
|
|
|
See root: [[id:bf4dde56-0967-4374-94ed-771301e47c66][azos]]
|
|
|
|
** Format
|
|
|
|
The store was migrated (2026-07-25) from a nested path scheme to a flat layout.
|
|
Each entry is =domain.com= with the password on line 1 and =login:= on line 2:
|
|
|
|
#+begin_example
|
|
<PASSWORD>
|
|
login: user@example.com
|
|
#+end_example
|
|
|
|
** Conventions
|
|
|
|
- All =passwordCommand= fields in Nix/mbsync configs must pipe through =| head -1= to extract only the password line
|
|
- =pass-git-helper= handles multi-line entries natively — no =head -1= needed there
|
|
- mbsync app passwords live under the =mbsync/= namespace to keep them separate from account passwords
|
|
- Emacs' generic =auth-source-search= (used by any package supporting auth-source, e.g. lichess.el, gptel, mu4e, tramp) is wired to =pass= via =auth-source-pass-enable= in =azos-core/features/base/emacs/config.org= (added 2026-09-15). Store the secret under a pass entry matching the bare hostname the package searches on (e.g. =lichess.org=) — no per-package glue code needed, unlike the caldav/mbsync =shell-command-to-string "pass ... | head -1"= pattern.
|
|
|
|
** Path Mappings
|
|
|
|
| Service | pass path | Config location |
|
|
|---------+-----------+-----------------|
|
|
| Gmail mbsync | =mbsync/anerisgreat@gmail.com= | =features/mail/default.nix= |
|
|
| BGU mbsync | =mbsync/anerz@post.bgu.ac.il= | =features/mail/default.nix= |
|
|
| Zakobar mail (privateemail.com) | =privateemail.com= | =features/mail/default.nix= |
|
|
| Nextcloud / caldav | =zakobar.com= | =features/lauretta/emacs/config.org= |
|
|
| Nextcloud webdav mount (password, reuses caldav entry) | =zakobar.com= | =features/nextcloud/default.nix= |
|
|
| Nextcloud webdav mount (uid, differs from login name) | =nextcloud-username/aner= | =features/nextcloud/default.nix= |
|
|
| Git credentials (zakobar.com) | =zakobar.com= | =features/git-config/pass-git-mapping.ini= |
|
|
| Lichess API token | =lichess.org= (via auth-source-pass) | =azos-core/features/base/emacs/config.org= |
|
|
|
|
** Pending
|
|
|
|
- =mbsync/anerisgreat@gmail.com= and =mbsync/anerz@post.bgu.ac.il= entries not yet created in the store — mail sync will fail until these are added via =pass insert=
|
|
- =lichess.org= entry not yet created — needed for lichess.el AI challenges/moves to authenticate (scopes: =board:play=, =challenge:write=, optionally =follow:read=)
|
|
|
|
** Known secret leaked into repo (needs migration)
|
|
|
|
=features/lauretta/emacs/config.org= hardcodes a live-looking Groq API key in plaintext (=gptel-make-openai "Groq" :key "gsk_..."=), committed to git history. Should migrate to =pass= + the new auth-source-pass wiring (gptel's =:key= slot accepts a function; gptel ships =gptel-api-key-from-auth-source= for exactly this). Flagged 2026-09-15, not yet fixed — user hasn't confirmed whether to rotate/migrate.
|
|
|
|
** mu4e / mu database gotchas
|
|
|
|
- =home.activation.muInit= in =features/mail/default.nix= only runs =mu init= if =~/.cache/mu= doesn't already exist — changing the =--maildir= path in that script (e.g. the 2026-09-07 =~/Mail= → =~/Maildir= fix) has no effect on machines where the cache dir already exists. The activation script is init-only, not a resync-on-config-change mechanism.
|
|
- Symptom of a corrupted Xapian index: mu4e fails with "Mu server process ended with exit code 1" / "error in process sentinel"; =mu info= or =mu server= directly report "error: failed to read database". Tell-tale sign in =~/.cache/mu/xapian/=: the small metadata files (=iamglass=, =flintlock=) have a much newer mtime than the bulk data files (=docdata.glass=, =position.glass=, =postlist.glass=, =termlist.glass=) — indicates a crashed/interrupted index run left the glass DB inconsistent.
|
|
- Fix: =mv ~/.cache/mu ~/.cache/mu.bak-$(date +%s)= (reversible backup, not delete), then =mu init --maildir="$HOME/Maildir" --my-address=... [repeat for all addresses]=, then =mu index=. Reindexing ~16k messages from local Maildir takes under a minute — safe to just do this rather than trying to repair the Xapian DB in place.
|