How to drop 1Password for KeepassXC

1Password has started donating to Dark Web crypto-fascists and that sucks. KeePassXC is a really nice password manager, but has no network sync out of the box.

This guide should result in a syncronized DB across a Linux machine and an IOS machine. The Linux machine will instantly show changes while the IOS machine will require reopening the DB. If you have a server you can make it accessible over the net, otherwise it will be private network only. A local only network means sync will happen at home and whilst out of range, Keepassium will prompt you to use the local copy.

Expected experience for this: Linux command line. If you are wanting to run this for family or friends, you probably want to have a server running with persistent file storage.

On the host Linux machine

Install dependencies

sudo apt install chezdav apache2-utils keepassxc

Setup authentication

Run the following. The username is "share" and the password is your own. You will need them for Keepassium authentication.

htdigest -c ~/httpd-pwd-file share share

Add port to firewall

Now is the time to select a port. I picked 5556. If you are using nftables, allow the port by running the following bash commands.

sudo sed -i'' "/chain input/a \
  \ \t\ttcp dport 5556 accept" /etc/nftables.conf
sudo nft -f /etc/nftables.conf

Start Webdav

chezdav -P ~/wevdav-share/ -p 5556 --public -d ~/httpd-pwd-file --realm share

If you want this to start on boot, we can create a systemd service with the following bash commands.

cat <<SRVC | sudo tee /usr/local/bin/webdav-5556
#! /usr/bin/env sh
chezdav -P ~/webdav-share/ -v -p 5556 --public -d ~/httpd-pwd-file
SRVC

cat <<SRVC | sudo tee /etc/systemd/system/webdav.service
[Unit]
Description=Runs WebDAV file sharing server on port 5556
Wants=network.target
After=syslog.target network-online.target
[Service]
ExecStart=/usr/local/bin/webdav-5556
Restart=on-failure
RestartSec=20
[Install]
WantedBy=multi-user.target
SRVC 

sudo systemctl start webdav
sudo systemctl enable webdav

Import the 1password database

Open 1Password and export the original database.

Open KeePassXC and go "Database" -> "Import" -> "1password export". Then select the file to import.

Share the database

ln -s -T {/path/to/db.kdbx} ~/webdav-share/db.kdbx

The phone client: Keepassium

Install Keepassium, go to "Connect to server", select WebDav, fill out the connection info, and open the database.

Other KeePassXC clients

I have not done this yet, but there are webdav filesystem mount programs that might work. I will update this page once I have done this.

keepassxc-cli

KeePassXC has its' own cli: keepassxc-cli. That should be able to replace the op cli. There is also dmenu integration and browser integration.