KeePassXC

Description

KeePassXC is a free, open-source, cross-platform password manager that stores credentials in an encrypted local database compatible with the KeePass format.

Overview

This role installs the KeePassXC desktop application on Pacman-based workstations through the system package manager. It is intended for personal-workstation roles in the desktop tier and does not configure databases, browser integrations, or autofill helpers.

Architecture

ARCHITECTURE.md draws KeePassXC from its own metadata: the containers it runs under compose, what changes under swarm, how each volume is backed, and every role it depends on or is depended upon by.

Section	Drawn from
Compose	meta/services.yml
Swarm	meta/services.yml replicas and placement
Volumes	meta/volumes.yml against the NFS decision chain
Dependencies	meta/services.yml and meta/main.yml of every role

Features

• Local-first vault: Keeps the password database on the workstation, with no mandatory cloud sync.

• Pacman integration: Installs the upstream keepassxc package via the standard system package manager.

• Workstation scope: Targets the desktop tier (dsk-*) and stays out of server inventories.

• Minimal footprint: Does not enable services or autostart entries beyond what the package itself provides.

Quick Setup

Development

Clone, set up the workstation, and deploy KeePassXC onto the local stack:

git clone https://github.com/infinito-nexus/core.git
cd core
make onboard
make compose-deploy mode=reinstall apps=dsk-keepassxc full_cycle=false

Production

Install KeePassXC directly onto the target machine: clone the repository, install the OS prerequisites and the repository toolchain, then deploy against localhost over a local connection (no SSH, no container):

git clone https://github.com/infinito-nexus/core.git
cd core
bash scripts/install/package.sh
make install
source scripts/meta/env/load.sh

APP=dsk-keepassxc
DOMAIN="<your-domain>"
TLS_MODE=self_signed
SSH_PUBLIC_KEY="<your-ssh-public-key>"
INVENTORY=inventories/production
infinito administration inventory provision "$INVENTORY" \
  --inventory-file "$INVENTORY/devices.yml" \
  --host localhost \
  --include "$APP" \
  --vars "{\"TLS_MODE\": \"$TLS_MODE\", \"DOMAIN_PRIMARY\": \"$DOMAIN\", \"users\": {\"administrator\": {\"authorized_keys\": [\"$SSH_PUBLIC_KEY\"]}}}"
infinito administration deploy dedicated "$INVENTORY/devices.yml" \
  --password-file "$INVENTORY/.password" \
  --diff -vv

Further Resources

• KeePassXC

• KeePassXC documentation

Credits

Kevin Veen-Birkenbach

Part of the Infinito.Nexus Project and maintained by Kevin Veen-Birkenbach. Licensed under the Infinito.Nexus Community License (Non-Commercial).

That licence covers this role. The software it deploys is a separate grant: GPL-2.0-only OR GPL-3.0-only, under which commercial use is allowed. You owe its authors this much: publish the source of changes you distribute. Permission for one of the two is not permission for the other.