(enzo) set up password system

1 files changed, 15 insertions, 0 deletions

diff --git a/profiles/desktop.nix b/profiles/desktop.nix
index f7f40df..6d7d465 100644
--- a/profiles/desktop.nix
+++ b/profiles/desktop.nix
@@ -72,6 +72,10 @@
   # from the portal above, which Firefox honors for both chrome and web content.
   programs.firefox = {
     enable = true;
+    # Let Firefox reach KeePassXC's browser-integration proxy. This installs the
+    # native-messaging manifest system-wide; the matching toggle is enabled in
+    # the app via the stowed keepassxc.ini (Settings → Browser Integration).
+    nativeMessagingHosts.packages = [ pkgs.keepassxc ];
     preferencesStatus = "default";
     preferences = {
       "browser.startup.homepage" = "about:blank";
@@ -111,6 +115,16 @@
       # engine is named "Wikipedia (en)" in the en-US locale.
       Order = [ "DuckDuckGo" "Searx" "Wikipedia (en)" "eBay" "Google" ];
     };
+
+    # KeePassXC-Browser: autofill + passkeys, talking to the local app over the
+    # native-messaging host above. normal_installed = installed but the user can
+    # still disable/remove it (force_installed would lock it in).
+    policies.ExtensionSettings = {
+      "keepassxc-browser@keepassxc.org" = {
+        install_url = "https://addons.mozilla.org/firefox/downloads/latest/keepassxc-browser/latest.xpi";
+        installation_mode = "normal_installed";
+      };
+    };
   };
 
   # --- Common desktop tools (system-wide to stay username-agnostic) ---
@@ -123,6 +137,7 @@
     libnotify # notify-send
     gnupg # gpg
     pinentry-gnome3 # passphrase prompt for the gpg agent
+    keepassxc # offline password manager + software passkeys
   ];
 
   # --- Fonts (base) ---