bernardo/Nomarchy
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(idle): no double-unlock after an encrypted hibernate resume

Browse Source 
hypridle locks hyprlock before every sleep -- right for suspend, but
redundant for hibernate: the LUKS passphrase entered at boot already gates
the resume, so the user typed a password twice. Add a nomarchy-hibernate-
unlock systemd unit (WantedBy hibernate.target, After systemd-hibernate.service
=> runs post-resume) that dismisses hyprlock, gated on the disk being LUKS-
encrypted. Suspend (and the RAM-resume phase of suspend-then-hibernate) keep
locking -- they have no passphrase gate; an unencrypted hibernate keeps its
lock too. idle.nix gains a pointer comment; roadmap item marked done.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Bernardo Magri
2026-06-14 13:06:10 +01:00
parent e0182ae7dd
commit 8853f6ae49
3 changed files with 31 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
README.md
View File

@@ -386,11 +386,14 @@ close · `SUPER+1..9` workspaces · `Print` region screenshot.
logo/lock/bullet → text, entry/progress-box → surface, progress-bar →
accent. Reads on light and dark; follows the theme as of the last system
rebuild (like the background tint).
- **Hibernate double-unlock:** on resume from hibernate the LUKS
- ✓ **Hibernate double-unlock:** on resume from hibernate the LUKS
passphrase already gates the machine, but hypridle's `before_sleep_cmd`
also locks hyprlock, so the user types a password twice. Lock only on
suspend (not hibernate), or skip the hyprlock prompt when resuming from
a LUKS-encrypted hibernate — see `modules/home/idle.nix`.
also locked hyprlock, so the user typed a password twice. Fixed with a
`nomarchy-hibernate-unlock` systemd unit (`modules/nixos/default.nix`)
that dismisses hyprlock *after* a hibernate resume (`WantedBy
hibernate.target`, `After systemd-hibernate.service` → runs post-resume),
gated on the disk being LUKS-encrypted. Suspend (and the RAM-resume phase
of suspend-then-hibernate) keep locking — they have no passphrase gate.
- ✓ **Key agents & pinentry:** ships `modules/home/keys.nix`
(`nomarchy.keys.enable`): one agent — `services.gpg-agent` with
`enableSshSupport` fronts SSH, so a single `pinentry-qt` (native-Wayland,