(enzo) set up password system

2 files changed, 19 insertions, 3 deletions

diff --git a/machines/enzo/default.nix b/machines/enzo/default.nix
index 7247a3e..a999620 100644
--- a/machines/enzo/default.nix
+++ b/machines/enzo/default.nix
@@ -32,14 +32,15 @@
       git
       tmux
       neovim
-      btop
-      ripgrep
-      unzip
+      # TODO figure out
+      #ripgrep
       xclip
       bc
       psmisc
       usbutils
       stow
+
+      claude-code
     ];
   };
 
diff --git a/profiles/desktop.nix b/profiles/desktop.nix
index f7f40df..6d7d465 100644
--- a/profiles/desktop.nix
+++ b/profiles/desktop.nix
@@ -72,6 +72,10 @@
   # from the portal above, which Firefox honors for both chrome and web content.
   programs.firefox = {
     enable = true;
+    # Let Firefox reach KeePassXC's browser-integration proxy. This installs the
+    # native-messaging manifest system-wide; the matching toggle is enabled in
+    # the app via the stowed keepassxc.ini (Settings → Browser Integration).
+    nativeMessagingHosts.packages = [ pkgs.keepassxc ];
     preferencesStatus = "default";
     preferences = {
       "browser.startup.homepage" = "about:blank";
@@ -111,6 +115,16 @@
       # engine is named "Wikipedia (en)" in the en-US locale.
       Order = [ "DuckDuckGo" "Searx" "Wikipedia (en)" "eBay" "Google" ];
     };
+
+    # KeePassXC-Browser: autofill + passkeys, talking to the local app over the
+    # native-messaging host above. normal_installed = installed but the user can
+    # still disable/remove it (force_installed would lock it in).
+    policies.ExtensionSettings = {
+      "keepassxc-browser@keepassxc.org" = {
+        install_url = "https://addons.mozilla.org/firefox/downloads/latest/keepassxc-browser/latest.xpi";
+        installation_mode = "normal_installed";
+      };
+    };
   };
 
   # --- Common desktop tools (system-wide to stay username-agnostic) ---
@@ -123,6 +137,7 @@
     libnotify # notify-send
     gnupg # gpg
     pinentry-gnome3 # passphrase prompt for the gpg agent
+    keepassxc # offline password manager + software passkeys
   ];
 
   # --- Fonts (base) ---