KeePassXC (extras/keepassxc.sh)

SYNOPSIS

wrenctl install keepassxc                     install it (switches a full build to the minimal one)
wrenctl remove keepassxc                      remove it (your .kdbx files stay)
wrenctl manual keepassxc                      print the manual steps below

keepassxc                                     start it (or Super+d, then keepassxc)
  Ctrl+C on an entry copies its password: paste it into the page

KeePassXC is a password manager that keeps all your passwords, and two-factor codes (TOTP) if you like, in one encrypted file you control. Wren Linux installs Debian's minimal build, keepassxc-minimal: no browser integration and no KeePassXC-Browser add-on for Firefox, so no web page, and not the sandboxed Firefox either, has a way to talk to it. You copy and paste a password, or use auto-type. qtwayland5 lets it run on Wayland. On a computer with the full build (keepassxc-full, with webext-keepassxc-browser), the script switches to the minimal one. Whenever the screen locks (Super+Escape, the idle lock, the lid, before sleep), it locks its open databases too: an on-lock program, ~/.config/wren/on-lock.d/keepassxc, runs keepassxc --lock. It doesn't open at login by itself: add it to your list in the Wren menu's Settings > Startup programs (wren-autostart edit) if you want it.

LIMITS

• Unlocked, while you use the computer, its passwords are one window away from anything running as you. Its own settings can lock it sooner: Settings, Security, lock databases after a few minutes of inactivity.

• Anything running as you can read the database file, watch the clipboard and log your master password as you type it.

• A copied password stays on the clipboard until something replaces it.

• While the database is open, its contents are in memory; lock it when you step away.

• A weak or lost master password, or a lost file (back it up), can't be helped by it.

MANUAL INSTALL

# Take out the full build and its Firefox add-on, if they are there
sudo apt purge keepassxc-full keepassxc webext-keepassxc-browser
# The minimal build, and Qt's Wayland support so it runs without XWayland
sudo apt install --no-install-recommends keepassxc-minimal qtwayland5
# Locked whenever the screen locks: an on-lock program (Wren Linux runs these at every lock)
mkdir -p ~/.config/wren/on-lock.d
printf '%s\n' '#!/bin/sh' 'pgrep -x -u "$(id -u)" keepassxc >/dev/null || exit 0' 'exec keepassxc --lock' >~/.config/wren/on-lock.d/keepassxc
chmod 755 ~/.config/wren/on-lock.d/keepassxc
# Optional, if you want it: on workspace 2 at every login
# (with Wren Linux's parts/autostart.sh; or add the line to the file by hand)
wren-autostart add 2 keepassxc
keepassxc

To undo (your password databases, .kdbx files, stay where they are):

# Remove KeePassXC, its on-lock program and its start at login
rm -f ~/.config/wren/on-lock.d/keepassxc
wren-autostart remove keepassxc
sudo apt purge keepassxc-minimal
sudo apt autoremove --purge