Commit 63a9bd439df2

Vincent Demeester <vincent@sbr.pm>
2026-06-10 22:27:22
fix(swayidle): use system swaylock on non-NixOS hosts
The nix-built swaylock is not setuid and lacks the PAM unix_chkpwd plumbing on Fedora, so password validation failed (getpwuid failed) and the lock screen stayed red and could not be unlocked. Used the system /usr/bin/swaylock on non-NixOS and excluded the nix swaylock from home.packages there to keep it out of PATH.
main
1 parent 08d5ef2
Changed files (1)
home
common
desktop
sway
swayidle.nix
home/common/desktop/sway/swayidle.nix
@@ -1,5 +1,6 @@
 {
   pkgs,
+  lib,
   desktop,
   ...
 }:
@@ -37,17 +38,27 @@ let
       "${niriPowerOnScript}"
     else
       ''${pkgs.sway}/bin/swaymsg "output * power on"'';
+  # On NixOS, the swaylock wrapper is setuid and wired into PAM. On non-NixOS
+  # (Fedora CSB), the nix-built swaylock is NOT setuid and cannot validate the
+  # password against /etc/shadow, resulting in a red screen that never unlocks.
+  # Use the system-provided swaylock there instead.
+  swaylockCmd =
+    if builtins.pathExists "/etc/NIXOS" then "${pkgs.swaylock}/bin/swaylock" else "/usr/bin/swaylock";
 in
 {
-  home.packages = with pkgs; [
-    swaylock
-    swayidle
-  ];
+  home.packages =
+    with pkgs;
+    [
+      swayidle
+    ]
+    # On non-NixOS (Fedora CSB), use the system swaylock (setuid + PAM-wired);
+    # the nix-built one can't validate passwords and shows a red lock screen.
+    ++ lib.optionals (builtins.pathExists "/etc/NIXOS") [ swaylock ];
   services.swayidle = {
     enable = true;
     events = {
-      before-sleep = "${pkgs.swaylock}/bin/swaylock --daemonize -i $HOME/desktop/pictures/lockscreen";
-      lock = "${pkgs.swaylock}/bin/swaylock --daemonize -i $HOME/desktop/pictures/lockscreen";
+      before-sleep = "${swaylockCmd} --daemonize -i $HOME/desktop/pictures/lockscreen";
+      lock = "${swaylockCmd} --daemonize -i $HOME/desktop/pictures/lockscreen";
     };
     timeouts = [
       {