Bernardo Magri
e2de9062d8
All checks were successful
Check / eval (push) Successful in 2m59s
Bernardo tested the lock screen after turning `fingerprint.pam` on: sudo took a finger, hyprlock did nothing. The PAM stack was not the problem — grosshack sits in /etc/pam.d/hyprlock at order 11400 exactly like sudo's. hyprlock just never asks it: its PAM conversation runs only on submit, so a module that wants to prompt *while* polling the reader never gets a turn. hyprlock has its own fprintd-over-D-Bus backend instead, behind `auth:fingerprint:enabled`, which nothing in the distro ever set. So `fingerprint.pam = true` promised "login + sudo" and silently skipped the surface you meet most often. The second half is the one worth having: enabling the backend alone yields a reader that works while the field still reads "password…". $FPRINTPROMPT is the ONLY slot hyprlock renders the ready/scanning/failed messages into, and ours hardcoded the placeholder — proven on hardware, where a test config with the backend on unlocked by finger and said nothing whatsoever. A feature that works and cannot be discovered fails VISION's "discoverable without reading the README" either way, so the placeholder now carries $FPRINTPROMPT and the messages mirror sudo's "Enter Password or Place finger". New `nomarchy.idle.fingerprint` (default false), mirroring `nomarchy.hardware.fingerprint.pam` the way `nomarchy.keyboard.layout` mirrors `services.xserver.xkb.layout`: hyprlock is configured in standalone Home Manager, which has no `osConfig` to derive the NixOS side from. Opt-in rather than implied, because with no reader hyprlock advertises a scan that cannot happen. Documented in the template (SoT for opt-in comments) and README — option-docs caught the missing row, which is the check doing its job. Verified V2: nix flake check --no-build; checks.option-docs passes (failed first with "undocumented option", as it should). V3 pending: Bernardo applies it and confirms the field reads "password… or scan finger" and both factors work — the mechanism itself is already proven on his reader via a test config. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
My Nomarchy machine
This directory is the single source of truth for a Nomarchy machine
flake. nix flake init -t … copies it as-is; nomarchy-install copies
the same files and only patches install-time values (username, hostname,
keyboard, detected hardware, password hash, …). Keep commented opt-ins and
home.packages here — do not invent a second catalog in the installer.
- Overwrite the placeholder hardware config with the real one:
nixos-generate-config --show-hardware-config > hardware-configuration.nix - Set
flake.nixup once (Nomarchy repo URL, your username, optionally ahardwareProfilefrom https://github.com/NixOS/nixos-hardware — an unknown name fails the rebuild with suggestions). After that the flake is never touched again: your machine lives insystem.nix(hostname, services — the login user is created fromusernameautomatically) andhome.nix(your packages). git init && git add -A— flakes only see tracked files, includingtheme-state.json.- System:
sudo nixos-rebuild switch --flake .#default - Desktop:
nix run home-manager -- switch --flake .#me(afterwards justhome-manager switch --flake .#me— it's installed) - Clone/symlink this directory to
~/.nomarchy(or exportNOMARCHY_PATH) sonomarchy-theme-syncknows where the state lives.
Day-to-day:
nomarchy-theme-sync list # 24 shipped presets
nomarchy-theme-sync apply gruvbox # writes state + home-manager switch
nomarchy-theme-sync bg next # cycle wallpapers (instant, no rebuild)
The system layer only needs nixos-rebuild when you change system.nix.