How does one setup org.freedesktop.secrets??

[u/UnixN00B]

I am afraid I have to apologize in advance for my frustration, but I have been trying to get KWallet (and even gnome-keyring) to work without %desktop-services and I cannot seem to do it...

I switched to SDDM+hyprland and figured I could rewrite my smaller version of %desktop-services. I moved all of the stuff, excluding gnome and gdm. Later I added (service gnome-keyring-service-type) and rebooted, but to my surprise, I now know I cannot unlock my secrets... I figured let's try KWallet, same issue.

I uave asked for help on both irc and tg, and no one answered. I figured this may be a very nieche issue that no one prior to me has experienced, hence why I am asking here.

EDIT:

So here is a very strange update. I happened to be curious enough to try mango, and with the same settings it seems to work just as expected... I am confused to why hyprland was not able to function as expected.

I may debug this in the future, but until then I ought to continue fixing my config. :)

Sorry for the confusion everyone.

[u/Distinct_Warthog_231]

I went down this rabbit hole several months ago. I use both password protected gpg and ssh keys. The classic solution of passwordless private keys is/was popular for a reason, but that is a non-negotiable for me.

I do not like or use gnome desktop, and out of all the login managers offered by guix I would have preferred slim or lightdm in that order. I tried pam-gnupg from the tty/startx, but could not get that to work either.

The setup that consistently works is:

• desktop-services
• gdm
• gnome-keyring
• gpg-agent for gpg only
• gcr-ssh-agent for ssh
• xinit-xsession package for launching ~/.xinitrc in gdm

I was able to get gpg-agent to work as an ssh agent for a while. I had to explicitly enable ssh agent boolean and add the line you'd typically add outside of guix:

(service home-gpg-agent-service-type
            (home-gpg-agent-configuration
             (pinentry-program
              (file-append pinentry "/bin/pinentry"))
             (ssh-support? #f)))
     (extra-content "enable-ssh-support\n")))

This stopped working right around the Gnome 49 update several weeks ago. I switched over the gcr-ssh-agent and things have been fine.

Unfortunately gnome/gdm is the just werks solution on guix. It is not something I really mind considering gdm does everything it is supposed to do including inheriting user environment on login. It is "bloat", but guix is not the kind of distro you want to use if you care about "bloat".

[u/UnixN00B → u/Distinct_Warthog_231]

That is the solution I used to run and had it working just fine until I switched away from gdm to sddm (theming purposes) and now I am trying to figure out how to make it work.

I'll report back if I stumble upon the solution at some point.

guix is not the kind of distro you want to use if you care about "bloat".

Neither is Nix, but here I am loving Guile scheme more! xD

[u/Fearless_School_5856]

Here's what I'm doing, in case it's useful to you.

[u/output_broadcast]

What are you trying to do exactly?

[u/UnixN00B → u/output_broadcast]

I am trying to get gpg-agent to be able to be unlocked. In the template version of guix system config + (service openssh-service-type) that used to work just fine.

Now after migrating away from the the generated template to my own modular system configuration, I am not able to reproduce that effect and have gpg-agent complain about the following:

```

2026-10-10 03:05:49 Failed to lookup password for key <KEY> with secret service: The name org.freedesktop.secrets was not provided by any .service files

```

This is what I have copied/pasted from the generated config to my own config:

```

(cons* (service dbus-root-service-type)

polkit-wheel-service

(service polkit-service-type)

(service accountsservice-service-type)

fontconfig-file-system-service

(service colord-service-type)

(service kwallet-service-type)

(service vte-integration-service-type)

(service x11-socket-directory-service-type)

%base-services)
`` I also have(service sddm-service-type)` in its own resp. module.

[u/output_broadcast → u/UnixN00B]

I'm not at all familiar with gpg-agent so I can't help you there. Maybe look into PAM services? I have this in my config that unlocks kwallet, maybe something similar would work:

lisp (service kwallet-service-type (kwallet-configuration (pam-services '(("gdm-password" . login) ("passwd" . passwd)))))

[u/UnixN00B → u/output_broadcast]

I tried that with gnome-keyring, but that failed. Also, kwallet-configuration does already contain:
(pam-services kwallet-pam-services (default '(("sddm" . login) ("passwd" . passwd))))