Skip to content

fix: add PAM integration for GPG passphrase persistence across reboots #874

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shunkakinoki merged 5 commits into from
Feb 20, 2026
Merged

fix: add PAM integration for GPG passphrase persistence across reboots #874

Changes from 4 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
649abd9
fix: add PAM integration for GPG passphrase persistence across reboots
claude Feb 20, 2026
51cacfa
chore: update
shunkakinoki Feb 20, 2026
c7cdc29
chore: update
shunkakinoki Feb 20, 2026
d2cec42
chore: update
shunkakinoki Feb 20, 2026
5fec16d
fix: enable Docker daemon and group for docker-postgres service
shunkakinoki Feb 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 14 additions & 1 deletion named-hosts/matic/default.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,14 +62,21 @@ inputs.nixpkgs.lib.nixosSystem {
"networkmanager"

@cubic-dev-ai cubic-dev-ai Bot Feb 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: pinentry-tty only prompts on a controlling TTY, so GUI apps in this Hyprland session won’t be able to unlock keys and GPG prompts will fail. Use a GUI pinentry (e.g., pinentry-gnome3) for a graphical login.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At named-hosts/matic/default.nix, line 403:

<comment>pinentry-tty only prompts on a controlling TTY, so GUI apps in this Hyprland session won’t be able to unlock keys and GPG prompts will fail. Use a GUI pinentry (e.g., pinentry-gnome3) for a graphical login.</comment>

<file context>
@@ -403,17 +400,11 @@ inputs.nixpkgs.lib.nixosSystem {
             enable = true;
             enableSshSupport = false;
-            pinentry.package = pkgs.pinentry-gnome3;
+            pinentry.package = pkgs.pinentry-tty;
             defaultCacheTtl = 94608000; # 3 years
             maxCacheTtl = 94608000; # 3 years
</file context>
Suggested change
"networkmanager"
pinentry.package = pkgs.pinentry-gnome3;
Fix with Cubic

"input"
"video"
"docker"
];
home = "/home/${username}";
shell = pkgs.fish;
initialPassword = "changemeow"; # Change this after first login with: passwd
};

# Docker
virtualisation.docker.enable = true;

security.sudo.wheelNeedsPassword = false;

# PAM integration for GNOME Keyring auto-unlock on login

Copilot AI Feb 20, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider extending the comment to capture the key assumption for auto-unlock: PAM can only unlock the login keyring when a secret is available from the authentication flow (typically a password-based login). This helps future readers understand why this might not work with passwordless/auto-login greetd setups.

Suggested change
# PAM integration for GNOME Keyring auto-unlock on login
# PAM integration for GNOME Keyring auto-unlock on login.
# Note: PAM can only unlock the login keyring when a secret is available
# from the authentication flow (typically a password-based login). With
# passwordless or auto-login greetd setups, no such secret may be provided,
# so auto-unlock of the GNOME Keyring might not work as expected.

Copilot uses AI. Check for mistakes.
security.pam.services.greetd.enableGnomeKeyring = true;

# Keyd configuration (Linux desktop only)
services.keyd.enable = true;
users.groups.keyd = { };
Expand Down Expand Up @@ -396,11 +403,17 @@ inputs.nixpkgs.lib.nixosSystem {
services.gpg-agent = {
enable = true;
enableSshSupport = false;
pinentry.package = pkgs.pinentry-tty;
pinentry.package = pkgs.pinentry-gnome3;
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Resolved

Copilot AI Feb 20, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If this services.gpg-agent block is from Home Manager, the pinentry option is commonly services.gpg-agent.pinentryPackage, not a nested pinentry.package. Since this line is being edited, it’s a good point to align with the module’s expected option name to avoid an unknown-option evaluation failure.

Suggested change
pinentry.package = pkgs.pinentry-gnome3;
pinentryPackage = pkgs.pinentry-gnome3;

Copilot uses AI. Check for mistakes.
defaultCacheTtl = 94608000; # 3 years
maxCacheTtl = 94608000; # 3 years
};

# GNOME Keyring for persistent GPG passphrase storage across reboots
services.gnome-keyring = {
enable = true;
components = [ "secrets" ];

@gemini-code-assist gemini-code-assist Bot Feb 20, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Since you're enabling the GNOME Keyring for GPG, you could also leverage it for SSH agent functionality. By adding the ssh component, your SSH key passphrases can also be stored in the keyring and unlocked automatically on login. This would provide a consistent experience for both GPG and SSH, and is a common practice when using gnome-keyring.

            components = [ "secrets" "ssh" ];

};

Copilot AI Feb 20, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

services.gnome-keyring is typically a Home Manager option; on NixOS the GNOME Keyring module is usually namespaced under services.gnome.gnome-keyring. As written, this is likely to fail Nix evaluation with an “option does not exist” error; switch to the NixOS option path (or move this block into the Home Manager user config if that’s the intended scope).

Copilot uses AI. Check for mistakes.

# GPG_TTY is set in fish shell init instead of sessionVariables
# because it needs to be evaluated dynamically per shell session
programs.fish.interactiveShellInit = lib.mkAfter ''
Expand Down
Loading