gnome-keyring: simplify the scripts (untested)

hosts/common/programs/gnome-keyring/Default_keyring.keyring

@@ -0,0 +1,4 @@
+[keyring]
+display-name=Default keyring
+lock-on-idle=false
+lock-after=false

hosts/common/programs/gnome-keyring/default

@@ -0,0 +1 @@
+Default_keyring

hosts/common/programs/gnome-keyring/default.nix

@@ -1,10 +1,4 @@
 { config, lib, pkgs, ... }:
-let
-  init-keyring = pkgs.static-nix-shell.mkBash {
-    pname = "init-keyring";
-    src = ./.;
-  };
-in
 {
   sane.programs.gnome-keyring = {
     packageUnwrapped = pkgs.gnome.gnome-keyring;
@@ -13,10 +7,24 @@ in
       ".local/share/keyrings"
     ];
 
+    # TODO: factor into a native sane.fs primitive (i.e. fs.$entry.text = ... with some "no-clobber" option)
+    fs.".local/share/keyrings/Default_keyring.keyring" = {
+      generated.command = [
+        "cp --no-clobber ${./Default_keyring.keyring} /home/colin/.local/share/keyrings/Default_keyring.keyring"
+      ];
+      wantedBy = [ config.sane.fs."${config.sane.persist.stores.private.origin}".unit ];
+      # TODO: move gnome-keyring.service under our control and then i can
+      #       ensure ordering here.
+      wantedBeforeBy = [ ];  # don't create this as part of `multi-user.target`
+    };
     fs.".local/share/keyrings/default" = {
-      generated.command = [ "${init-keyring}/bin/init-keyring" ];
+      generated.command = [
-      # wantedBy = [ config.sane.fs."/home/colin/private".unit ];
+        "cp --no-clobber ${./default} /home/colin/.local/share/keyrings/default"
-      wantedBeforeBy = [ ];  # don't created this as part of `multi-user.target`
+      ];
+      wantedBy = [ config.sane.fs."${config.sane.persist.stores.private.origin}".unit ];
+      # TODO: move gnome-keyring.service under our control and then i can
+      #       ensure ordering here.
+      wantedBeforeBy = [ ];  # don't create this as part of `multi-user.target`
     };
   };
 

hosts/common/programs/gnome-keyring/init-keyring

@@ -1,21 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash
-# initializes the default libsecret keyring (used by gnome-keyring) if not already initialized.
-# this initializes it to be plaintext/unencrypted.
-
-ringdir=~/.local/share/keyrings
-if test -e "$ringdir/default"
-then
-  echo 'gnome-keyring/init-keyring: already initialized: not doing anything'
-else
-  keyring="$ringdir/Default_keyring.keyring"
-
-  echo 'gnome-keyring/init-keyring: initializing default user keyring:' "$keyring.new"
-  echo '[keyring]' > "$keyring.new"
-  echo 'display-name=Default keyring' >> "$keyring.new"
-  echo 'lock-on-idle=false' >> "$keyring.new"
-  echo 'lock-after=false' >> "$keyring.new"
-  chown colin:users "$keyring.new"
-  # closest to an atomic update we can achieve
-  mv "$keyring.new" "$keyring" && echo -n "Default_keyring" > "$ringdir/default"
-fi