From 0d4163b9bfad8d45c98351e83d4dfb37b2a30616 Mon Sep 17 00:00:00 2001
From: Nils Pukropp <nils@narl.io>
Date: Wed, 30 Sep 2026 19:01:50 +0200
Subject: [PATCH] fix(service): start with the graphical session, not
 default.target (#24)

default.target is reached before the desktop exports DISPLAY/WAYLAND_DISPLAY
to the user manager, so After=graphical-session.target never applied. The
daemon's first keyring call D-Bus-activated the Secret Service without a
display; on KDE ksecretd aborted, the first start failed, and every login
left a coredump.

Install into graphical-session.target instead, and use reenable when the
front-ends enable the unit so existing default.target.wants links are
replaced rather than kept alongside the new one.

Fixes #23
---
 crates/pdfs-core/src/service.rs | 13 ++++++++++---
 docs/INSTALL.md                 |  8 ++++++++
 packaging/proton-drive.service  |  8 +++++++-
 3 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/crates/pdfs-core/src/service.rs b/crates/pdfs-core/src/service.rs
index 745e07f..c7f090e 100644
--- a/crates/pdfs-core/src/service.rs
+++ b/crates/pdfs-core/src/service.rs
@@ -55,9 +55,10 @@ fn systemctl_query(args: &[&str]) -> bool {
 /// keyring checks). `--now` is a no-op on an active unit, so the daemon would
 /// keep sleeping and the mount would not appear until the next poll fired.
 /// Restarting makes the new session take effect immediately, and starts the
-/// unit when it is not running at all.
+/// unit when it is not running at all. `reenable` for the reason given on
+/// [`enable`].
 pub fn enable_start() -> bool {
-    let enabled = systemctl(&["enable"]);
+    let enabled = systemctl(&["reenable"]);
     systemctl(&["restart"]) && enabled
 }
 
@@ -97,8 +98,14 @@ pub fn is_enabled() -> bool {
 /// Enable the service so it auto-starts on future logins, without necessarily
 /// starting it now beyond what `enable` does. Used by the Settings "Start on
 /// login" switch; pairs with [`disable`](disable).
+///
+/// `reenable` rather than `enable`: older installs were enabled
+/// into `default.target.wants`, and a plain `enable` would add the new
+/// `graphical-session.target.wants` link while leaving the old one to start the
+/// unit too early. `reenable` drops every existing link and recreates them from
+/// the current `[Install]` section.
 pub fn enable() -> bool {
-    systemctl(&["enable"])
+    systemctl(&["reenable"])
 }
 
 /// Disable auto-start without stopping the running mount. Used by the Settings
diff --git a/docs/INSTALL.md b/docs/INSTALL.md
index ce12ee3..425cfda 100644
--- a/docs/INSTALL.md
+++ b/docs/INSTALL.md
@@ -215,6 +215,14 @@ starts; to switch at once:
 systemctl --user restart proton-drive.service
 ```
 
+Coming from 2.8.0 or older, re-enable the service once. Those releases hooked it into
+`default.target`, which starts it before the desktop session is ready; on KDE that crashes
+`ksecretd` at every login. Signing in again or toggling "Start on login" does this as well:
+
+```bash
+systemctl --user reenable proton-drive.service
+```
+
 Database migrations run automatically and only move forward. A database written by a newer
 release refuses to open in an older one, so downgrading means clearing the local database (see
 [Troubleshooting](TROUBLESHOOTING.md#start-over-with-a-clean-local-state)).
diff --git a/packaging/proton-drive.service b/packaging/proton-drive.service
index 94d5517..eddceae 100644
--- a/packaging/proton-drive.service
+++ b/packaging/proton-drive.service
@@ -32,4 +32,10 @@ MemoryMax=6G
 TimeoutStopSec=15
 
 [Install]
-WantedBy=default.target
+# Not default.target: that is reached before the desktop has exported DISPLAY /
+# WAYLAND_DISPLAY to the user manager, so After= above never orders anything
+# (the two targets are not in the same start transaction). The daemon's first
+# keyring call then D-Bus-activates the Secret Service without a display —
+# on KDE ksecretd aborts, the start fails, and every login leaves a coredump.
+# Being pulled in by the graphical session starts it only once that is up.
+WantedBy=graphical-session.target