swaylock

modules/applications/swaylock/default.nix

@@ -0,0 +1,23 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.swaylock;
+in
+{
+  imports = [
+    ./home.nix
+    ./system.nix
+  ];
+
+  options.my.applications.swaylock = {
+    enable = lib.mkEnableOption "swaylock screen locker";
+  };
+
+  config = lib.mkIf cfg.enable {
+    my.applications.swaylock.system.enable = lib.mkDefault true;
+    my.applications.swaylock.homeManager.enable = lib.mkDefault true;
+  };
+}

modules/applications/swaylock/home.nix

@@ -0,0 +1,48 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.swaylock;
+  hmCfg = config.my.applications.swaylock.homeManager;
+in
+{
+  options.my.applications.swaylock.homeManager = {
+    enable = lib.mkEnableOption "swaylock home-manager configuration";
+  };
+
+  config.home-manager.sharedModules = [
+    (
+      { lib, pkgs, ... }:
+      {
+        config = lib.mkIf (cfg.enable && hmCfg.enable) {
+          home.packages = with pkgs; [
+            swaylock # Wayland screen locker using ext-session-lock-v1
+          ];
+
+          # systemd-lock-handler holds a sleep inhibitor until this service is
+          # ready. swaylock forks only after the compositor confirms the lock.
+          systemd.user.services.swaylock = {
+            Unit = {
+              Description = "Screen locker for Wayland";
+              Documentation = [ "man:swaylock(1)" ];
+              OnSuccess = [ "unlock.target" ];
+              PartOf = [ "lock.target" ];
+              Before = [ "lock.target" ];
+            };
+
+            Service = {
+              Type = "forking";
+              ExecStart = "${lib.getExe pkgs.swaylock} -f";
+              Restart = "on-failure";
+              RestartSec = 0;
+            };
+
+            Install.WantedBy = [ "lock.target" ];
+          };
+        };
+      }
+    )
+  ];
+}

modules/applications/swaylock/system.nix

@@ -0,0 +1,21 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.my.applications.swaylock.system;
+in
+{
+  options.my.applications.swaylock.system = {
+    enable = lib.mkEnableOption "swaylock system configuration";
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.systemd-lock-handler.enable = true;
+
+    # Screen unlocking deliberately uses passwords only. Fingerprints remain
+    # available to explicitly enabled PAM services such as sudo and polkit.
+    security.pam.services.swaylock.fprintAuth = false;
+  };
+}