From b5c49ffa7971b9107c3521d602decd34b26e6a10 Mon Sep 17 00:00:00 2001
From: moons <moons@moons14.com>
Date: Tue, 14 Jul 2026 19:28:47 +0900
Subject: [PATCH] swaylock

---
 modules/applications/default.nix          |  1 +
 modules/applications/niri/home.nix        |  8 ++--
 modules/applications/noctalia/home.nix    |  4 ++
 modules/applications/swayidle.nix         | 17 ++------
 modules/applications/swaylock/default.nix | 23 +++++++++++
 modules/applications/swaylock/home.nix    | 48 +++++++++++++++++++++++
 modules/applications/swaylock/system.nix  | 21 ++++++++++
 modules/features/gui/desktop.nix          |  1 +
 modules/system/fingerprint.nix            |  2 +-
 9 files changed, 106 insertions(+), 19 deletions(-)
 create mode 100644 modules/applications/swaylock/default.nix
 create mode 100644 modules/applications/swaylock/home.nix
 create mode 100644 modules/applications/swaylock/system.nix

diff --git a/modules/applications/default.nix b/modules/applications/default.nix
index 3028075..020d24d 100644
--- a/modules/applications/default.nix
+++ b/modules/applications/default.nix
@@ -31,6 +31,7 @@
     ./slack.nix
     ./ssh
     ./swayidle.nix
+    ./swaylock
     ./tailscale.nix
     ./vicinae.nix
     ./vim
diff --git a/modules/applications/niri/home.nix b/modules/applications/niri/home.nix
index e969764..cd93c13 100644
--- a/modules/applications/niri/home.nix
+++ b/modules/applications/niri/home.nix
@@ -123,12 +123,10 @@ in
             };
             "Mod+L" = {
               action.spawn = [
-                "noctalia"
-                "msg"
-                "session"
-                "lock"
+                (lib.getExe' pkgs.systemd "loginctl")
+                "lock-session"
               ];
-              hotkey-overlay.title = "Lock the Screen: noctalia";
+              hotkey-overlay.title = "Lock the Screen";
             };
             "Mod+V" = {
               action.spawn = [
diff --git a/modules/applications/noctalia/home.nix b/modules/applications/noctalia/home.nix
index 01ba8b2..bf58137 100644
--- a/modules/applications/noctalia/home.nix
+++ b/modules/applications/noctalia/home.nix
@@ -54,6 +54,10 @@ in
               };
             };
             desktop_widgets.enabled = false;
+            lockscreen = {
+              enabled = false;
+              fingerprint = false;
+            };
             widget = {
               cpu = {
                 type = "sysmon";
diff --git a/modules/applications/swayidle.nix b/modules/applications/swayidle.nix
index f044052..b59fec6 100644
--- a/modules/applications/swayidle.nix
+++ b/modules/applications/swayidle.nix
@@ -2,25 +2,18 @@
   pkgs,
   lib,
   config,
-  inputs,
   ...
 }:
 let
   cfg = config.my.applications.swayidle;
 
-  noctaliaPkg = inputs.noctalia.packages.${pkgs.stdenv.hostPlatform.system}.default;
-
-  noctalia = lib.getExe noctaliaPkg;
   brightnessctl = lib.getExe pkgs.brightnessctl;
   niri = lib.getExe pkgs.niri;
   rm = "${pkgs.coreutils}/bin/rm";
+  systemctl = lib.getExe' pkgs.systemd "systemctl";
 
   brightnessState = "$XDG_RUNTIME_DIR/swayidle-brightness";
 
-  noctaliaMsg = command: "${noctalia} msg ${command}";
-
-  lockCmd = noctaliaMsg "session lock";
-
   # AC 接続中は何もしない。
   # つまり、以下のアイドル処理をバッテリー駆動時のみにする。
   skipIfOnAC = ''
@@ -49,10 +42,10 @@ let
     fi
   '';
 
-  lockAndSuspend = pkgs.writeShellScript "swayidle-lock-and-suspend" ''
+  suspendOnBattery = pkgs.writeShellScript "swayidle-suspend-on-battery" ''
     ${skipIfOnAC}
 
-    ${noctaliaMsg "session lock-and-suspend"}
+    exec ${systemctl} suspend
   '';
 
   afterResume = pkgs.writeShellScript "swayidle-after-resume" ''
@@ -83,13 +76,11 @@ in
             }
             {
               timeout = 360;
-              command = "${lockAndSuspend}";
+              command = "${suspendOnBattery}";
             }
           ];
 
           events = {
-            lock = lockCmd;
-            before-sleep = lockCmd;
             after-resume = "${afterResume}";
           };
         };
diff --git a/modules/applications/swaylock/default.nix b/modules/applications/swaylock/default.nix
new file mode 100644
index 0000000..2537b9a
--- /dev/null
+++ b/modules/applications/swaylock/default.nix
@@ -0,0 +1,23 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.swaylock;
+in
+{
+  imports = [
+    ./home.nix
+    ./system.nix
+  ];
+
+  options.my.applications.swaylock = {
+    enable = lib.mkEnableOption "swaylock screen locker";
+  };
+
+  config = lib.mkIf cfg.enable {
+    my.applications.swaylock.system.enable = lib.mkDefault true;
+    my.applications.swaylock.homeManager.enable = lib.mkDefault true;
+  };
+}
diff --git a/modules/applications/swaylock/home.nix b/modules/applications/swaylock/home.nix
new file mode 100644
index 0000000..3f62c5d
--- /dev/null
+++ b/modules/applications/swaylock/home.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.swaylock;
+  hmCfg = config.my.applications.swaylock.homeManager;
+in
+{
+  options.my.applications.swaylock.homeManager = {
+    enable = lib.mkEnableOption "swaylock home-manager configuration";
+  };
+
+  config.home-manager.sharedModules = [
+    (
+      { lib, pkgs, ... }:
+      {
+        config = lib.mkIf (cfg.enable && hmCfg.enable) {
+          home.packages = with pkgs; [
+            swaylock # Wayland screen locker using ext-session-lock-v1
+          ];
+
+          # systemd-lock-handler holds a sleep inhibitor until this service is
+          # ready. swaylock forks only after the compositor confirms the lock.
+          systemd.user.services.swaylock = {
+            Unit = {
+              Description = "Screen locker for Wayland";
+              Documentation = [ "man:swaylock(1)" ];
+              OnSuccess = [ "unlock.target" ];
+              PartOf = [ "lock.target" ];
+              Before = [ "lock.target" ];
+            };
+
+            Service = {
+              Type = "forking";
+              ExecStart = "${lib.getExe pkgs.swaylock} -f";
+              Restart = "on-failure";
+              RestartSec = 0;
+            };
+
+            Install.WantedBy = [ "lock.target" ];
+          };
+        };
+      }
+    )
+  ];
+}
diff --git a/modules/applications/swaylock/system.nix b/modules/applications/swaylock/system.nix
new file mode 100644
index 0000000..eb34a82
--- /dev/null
+++ b/modules/applications/swaylock/system.nix
@@ -0,0 +1,21 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.swaylock.system;
+in
+{
+  options.my.applications.swaylock.system = {
+    enable = lib.mkEnableOption "swaylock system configuration";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.systemd-lock-handler.enable = true;
+
+    # Screen unlocking deliberately uses passwords only. Fingerprints remain
+    # available to explicitly enabled PAM services such as sudo and polkit.
+    security.pam.services.swaylock.fprintAuth = false;
+  };
+}
diff --git a/modules/features/gui/desktop.nix b/modules/features/gui/desktop.nix
index a5c060f..0be64d0 100644
--- a/modules/features/gui/desktop.nix
+++ b/modules/features/gui/desktop.nix
@@ -20,6 +20,7 @@ in
       ly.enable = true;
       noctalia.enable = true;
       swayidle.enable = true;
+      swaylock.enable = true;
       vicinae.enable = true;
     };
     my.system = {
diff --git a/modules/system/fingerprint.nix b/modules/system/fingerprint.nix
index 2671243..c555742 100644
--- a/modules/system/fingerprint.nix
+++ b/modules/system/fingerprint.nix
@@ -19,7 +19,7 @@ in
     security.pam.services.polkit-1.fprintAuth = true;
 
     security.pam.services = {
-      login.fprintAuth = true;
+      login.fprintAuth = false;
       sudo.fprintAuth = true;
       greetd.fprintAuth = lib.mkForce false;
       ly.fprintAuth = lib.mkForce false;