mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-11 17:14:08 +01:00
Krzysztof kuhy Rudnicki
0902a5e1f4
Add "one vault, synced everywhere" for PC + Ubuntu laptop + phone, with an
identical flow and no stored master password. keepass-open prompts the master
password (in memory only), folds in strays, pulls+merges the cloud copy over
WebDAV, opens KeePassXC on ~/Keepass/Passwords.kdbx, and publishes edits on
close. Safety rests on `keepassxc-cli merge` (entry-level union) plus a dufs
?hash compare-and-swap on upload, so concurrent edits merge instead of clobber.
The consolidator enforces exactly one vault per machine: it folds a stray only
if it opens with the same master password, backs up first, never removes the
canonical, and auto-excludes the dufs serve-path (the remote store) — a
data-safety fix after the first real run tried to delete ~/cloud/Keepass.
Only the dufs *server* password (not the vault key) is cached in the keyring.
Single cross-distro installer, no role flag; the phone uses KeePassDX natively.
Verified: shellcheck clean; 8 (reconcile) + 14 (consolidator) + 8 (installer)
assertions on throwaway vaults; real PC apply with live WebDAV GET=200 and
?hash==sha256; a clean keepass-open run ("no strays / already in sync").
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0126QvdMrv2WNeUVShFiLTc3
18 lines
1.7 KiB
JSON
18 lines
1.7 KiB
JSON
{
|
|
"title": "One KeePass vault, synced across all devices",
|
|
"objective": "Give every device (PC, Ubuntu laptop, phone) a single KeePass vault that stays in sync via the dufs cloud, with an identical open flow and without ever storing the vault master password. Success = editing on any device and, on the next open elsewhere, seeing a merged database with no lost entries and exactly one working vault per machine.",
|
|
"acceptance_criteria": [
|
|
"keepass-open prompts the master password (held only in memory), folds in strays, pulls+merges the cloud copy, opens KeePassXC on ~/Keepass/Passwords.kdbx, and publishes edits on close.",
|
|
"keepassxc-cli merge is used so concurrent edits merge (union) rather than clobber; uploads are guarded by a dufs ?hash compare-and-swap.",
|
|
"The consolidator folds a stray only if it opens with the same master password, backs up first, never removes the canonical, and NEVER touches the dufs serve-path (the remote store).",
|
|
"Only the dufs server password (not the vault key) is cached in the keyring; no secret is written to the repo.",
|
|
"Same unified installer + open command on PC and laptop (no role flag)."
|
|
],
|
|
"out_of_scope": [
|
|
"Android app changes (the phone uses KeePassDX natively)",
|
|
"A background/continuous sync daemon (sync rides on open/close by design)",
|
|
"Phases 2-4 (downloads-to-cloud, web gallery, mobile app)"
|
|
],
|
|
"verifier": "shellcheck -x + bash -n on all four scripts; keepass_sync.sh (8) + keepass_consolidate.sh incl. serve-path exclusion (14) + setup_keepass_sync.sh unified (8) assertion suites on throwaway vaults; real PC apply with live WebDAV GET=200 and ?hash==sha256; documented in docs/superpowers/evidence/keepass-multidevice-sync-2026-07-12.json"
|
|
}
|