Files

Bernardo Magri 7aae204014

Check / eval (push) Failing after 2m45s

Details

feat(fingerprint): password OR fingerprint in parallel at one prompt

Bernardo promoted the PROPOSED item live: with fingerprint PAM on,
sudo/login should accept whichever factor comes first instead of
pam_fprintd's wait-for-the-reader-then-password. Stock PAM cannot
express parallel factors (linux-pam#301), so this packages
pam-fprint-grosshack v0.3.0 (pkgs/, pinned from GitLab — the
field-standard fprintd fork), source-reviewed before packaging: every
failure path (no reader, no prints, fprintd absent/hung, timeout,
password typed) returns PAM_AUTHINFO_UNAVAIL and falls through; a
typed password is only ferried via PAM_AUTHTOK to the stock
`auth sufficient pam_unix.so … try_first_pass` rule — the module never
validates passwords itself, so it cannot lock out password login.

New option nomarchy.hardware.fingerprint.parallel, default TRUE (the
better UX is what opting into fingerprint PAM buys; false = stock
sequential). Wiring swaps the modulePath of stock fprintd's rule slot
(mkForce) so the sufficient-before-pam_unix ordering is inherited, not
recomputed. README + downstream template rows added.

Verified: V2 — checks.hardware-toggles extended to three nodes, green:
parallel node asserts the grosshack auth line precedes pam_unix in
/etc/pam.d/sudo and that with NO reader a correct password still
passes sudo while a wrong one fails (the lockout-safety invariant);
seqpam node gets stock pam_fprintd and no grosshack; nopam gets
neither. flake check + option-docs + template-sot green.
V3 pending (HARDWARE-QUEUE, AMD dev box): the real type-or-touch race,
fprintd-stopped fallback, hyprlock/greeter after a fingerprint win.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-12 19:03:56 +01:00

flake.nix

feat(install): copy templates/downstream and patch install values

2026-07-09 09:23:50 +01:00

hardware-configuration.nix

feat: nomarchy.lib.mkFlake — one-call downstream wrapper + hardware profiles

2026-06-10 15:39:21 +01:00

home.nix

feat(audio,menu): dock audio auto-follow watcher + docked Display/Audio menu rows

2026-07-12 14:22:49 +01:00

README.md

docs: factual-drift pass + i2c option docs (#47 , #48 )

2026-07-09 19:09:00 +01:00

system.nix

feat(fingerprint): password OR fingerprint in parallel at one prompt

2026-07-12 19:03:56 +01:00

theme-state.json

feat(theme): make Boreal the distro default

2026-07-09 09:57:32 +01:00

README.md

My Nomarchy machine

This directory is the single source of truth for a Nomarchy machine flake. nix flake init -t … copies it as-is; nomarchy-install copies the same files and only patches install-time values (username, hostname, keyboard, detected hardware, password hash, …). Keep commented opt-ins and home.packages here — do not invent a second catalog in the installer.

Overwrite the placeholder hardware config with the real one: nixos-generate-config --show-hardware-config > hardware-configuration.nix
Set flake.nix up once (Nomarchy repo URL, your username, optionally a hardwareProfile from https://github.com/NixOS/nixos-hardware — an unknown name fails the rebuild with suggestions). After that the flake is never touched again: your machine lives in system.nix (hostname, services — the login user is created from username automatically) and home.nix (your packages).
git init && git add -A — flakes only see tracked files, including theme-state.json.
System: sudo nixos-rebuild switch --flake .#default
Desktop: nix run home-manager -- switch --flake .#me (afterwards just home-manager switch --flake .#me — it's installed)
Clone/symlink this directory to ~/.nomarchy (or export NOMARCHY_PATH) so nomarchy-theme-sync knows where the state lives.

Day-to-day:

nomarchy-theme-sync list             # 24 shipped presets
nomarchy-theme-sync apply gruvbox    # writes state + home-manager switch
nomarchy-theme-sync bg next          # cycle wallpapers (instant, no rebuild)

The system layer only needs nixos-rebuild when you change system.nix.