From 7d45fddad385f4fd522e76600b1cb23ed156be40 Mon Sep 17 00:00:00 2001 From: Jarek Krochmalski Date: Sat, 22 Aug 2026 09:09:30 +0200 Subject: [PATCH] proton pass secrets resolve on headless hosts with no system keyring --- src/lib/server/secretproviders/proton.ts | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/lib/server/secretproviders/proton.ts b/src/lib/server/secretproviders/proton.ts index d75a8f0..540e1dc 100644 --- a/src/lib/server/secretproviders/proton.ts +++ b/src/lib/server/secretproviders/proton.ts @@ -87,7 +87,12 @@ function childEnvironment(sessionDir: string, accessToken?: string): NodeJS.Proc HOME: sessionDir, XDG_CONFIG_HOME: sessionDir, PROTON_PASS_SESSION_DIR: sessionDir, - PROTON_PASS_NO_UPDATE_CHECK: '1' + PROTON_PASS_NO_UPDATE_CHECK: '1', + // Dockhand runs headless in a container with no system keyring / D-Bus, where + // pass-cli's default key provider fails with NoStorageAccess before any auth. + // The filesystem provider stores the key under our isolated sessionDir instead. + // An operator with a real keyring can override via the container env (#1440). + PROTON_PASS_KEY_PROVIDER: process.env.PROTON_PASS_KEY_PROVIDER?.trim() || 'fs' }; for (const key of CHILD_ENV_ALLOWLIST) { const value = process.env[key];