KeePassXC fully integrated: passwords, browser integration, ssh, & service

modules/default.nix

@@ -22,6 +22,7 @@ allModules
       self.nixosModules.starship
       self.nixosModules.git
       self.nixosModules.gpg
+      self.nixosModules.keepassxc
       self.nixosModules.zsh
       self.nixosModules.helix
       self.nixosModules.zen-browser

modules/git.nix

@@ -6,6 +6,9 @@
   ...
 }:
 
+let
+  useSshSigning = userVars ? sshKey && userVars.sshKey != "";
+in
 {
   home-manager.users."${userVars.username}" = {
     programs.git = {
@@ -16,10 +19,13 @@
           email = userVars.email;
         };
         commit.gpgsign = true;
+      } // (if useSshSigning then {
+        gpg.format = "ssh";
+      } else {
         gpg.program = "gpg";
-      };
+      });
       signing = {
-        key = userVars.gpgKey;
+        key = if useSshSigning then userVars.sshKey else userVars.gpgKey;
         signByDefault = true;
       };
     };

modules/gpg.nix

@@ -10,7 +10,7 @@
   environment.systemPackages = with pkgs; [
     gnupg
     pass
-    pinentry-gnome3
+    # pinentry-gnome3
   ];
 
   home-manager.users."${userVars.username}" = {
@@ -20,8 +20,8 @@
       defaultCacheTtlSsh = 7200;
       maxCacheTtl = 28800;
       maxCacheTtlSsh = 28800;
-      enableSshSupport = true;
+      enableSshSupport = false;
-      pinentry.package = pkgs.pinentry-gnome3;
+      # pinentry.package = pkgs.pinentry-gnome3;
     };
   };
 }

modules/keepassxc.nix

@@ -0,0 +1,53 @@
+{
+  config,
+  lib,
+  pkgs,
+  userVars,
+  ...
+}:
+{
+  # Install KeePassXC globally.
+  environment.systemPackages = with pkgs; [
+    keepassxc
+  ];
+
+  # Disable GNOME Keyring to prevent it from conflicting with KeePassXC's Secret Service Integration.
+  services.gnome.gnome-keyring.enable = false;
+
+  # Enable the standard system-level SSH agent.
+  programs.ssh.startAgent = true;
+
+  home-manager.users."${userVars.username}" = {
+    # Disable GNOME Keyring in Home Manager as well.
+    services.gnome-keyring.enable = false;
+
+    # Disable automatic keys addition to standard SSH agent using the modern settings option.
+    programs.ssh = {
+      enable = true;
+      enableDefaultConfig = false;
+      settings = {
+        "*" = {
+          AddKeysToAgent = "no";
+        };
+      };
+    };
+    # Configure KeePassXC native messaging hosts for Firefox and Zen Browser.
+    # This enables the browser extension to communicate with KeePassXC.
+    home.file = {
+      # ".mozilla/native-messaging-hosts/org.keepassxc.keepassxc_browser.json".text = builtins.toJSON {
+      #   allowed_extensions = [ "keepassxc-browser@keepassxc.org" ];
+      #   description = "KeePassXC integration with Mozilla Firefox";
+      #   name = "org.keepassxc.keepassxc_browser";
+      #   path = "${pkgs.keepassxc}/bin/keepassxc-proxy";
+      #   type = "stdio";
+      # };
+      # ".config/zen/native-messaging-hosts/org.keepassxc.keepassxc_browser.json".text = builtins.toJSON {
+      #   allowed_extensions = [ "keepassxc-browser@keepassxc.org" ];
+      #   description = "KeePassXC integration with Zen Browser";
+      #   name = "org.keepassxc.keepassxc_browser";
+      #   path = "${pkgs.keepassxc}/bin/keepassxc-proxy";
+      #   type = "stdio";
+      # };
+    };
+  };
+}

modules/zen-browser.nix

@@ -29,6 +29,11 @@
             installation_mode = "force_installed";
             install_url = "https://addons.mozilla.org/firefox/downloads/latest/vimium-ff/latest.xpi";
           };
+          # KeePassXC-Browser
+          "keepassxc-browser@keepassxc.org" = {
+            installation_mode = "force_installed";
+            install_url = "https://addons.mozilla.org/firefox/downloads/latest/keepassxc-browser/latest.xpi";
+          };
         };
       };
 

modules/zsh.nix

@@ -21,9 +21,6 @@
       dotDir = "/home/${userVars.username}/.config/zsh";
 
       initContent = ''
-        # -- GPG / SSH Configuration --
-        export SSH_AUTH_SOCK="$(gpgconf --list-dirs agent-ssh-socket)"
-
         # Import Wayland environment to systemd for GUI tools (like pinentry-gnome3)
         if [ -n "$WAYLAND_DISPLAY" ]; then
           systemctl --user import-environment WAYLAND_DISPLAY DISPLAY DBUS_SESSION_BUS_ADDRESS 2>/dev/null

vars.nix

@@ -3,4 +3,5 @@
   email = "semere.meharena1@gmail.com";
   fullName = "Semere M. Mebrahtom";
   gpgKey = "451054EEC0D2AFD1741D4E6A7FC937214DF30488";
+  sshKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAhf7NEWRLK1+kNVl7hwH8+qth16C+XWJYQ5A/umCtcV semere@nabro";
 }