From e58bb947d3c140ecd3b84bd3cd4c7c770003ad58 Mon Sep 17 00:00:00 2001
From: Hadi <112569860+anotherhadi@users.noreply.github.com>
Date: Fri, 14 Aug 2026 10:43:40 +0200
Subject: [PATCH] Autologin, unlock the keyring with the luks password

Signed-off-by: Hadi <112569860+anotherhadi@users.noreply.github.com>
---
 hosts/laptop/configuration.nix |  1 +
 nixos/autologin.nix            | 27 +++++++++++++++++++++++++++
 2 files changed, 28 insertions(+)
 create mode 100644 nixos/autologin.nix

diff --git a/hosts/laptop/configuration.nix b/hosts/laptop/configuration.nix
index ac2da64a..3187a97c 100644
--- a/hosts/laptop/configuration.nix
+++ b/hosts/laptop/configuration.nix
@@ -9,6 +9,7 @@
     ../../nixos/nix.nix
     ../../nixos/systemd-boot.nix
     ../../nixos/tuigreet.nix
+    ../../nixos/autologin.nix # Skip first TUIGreet login, use LUKS password to unlock the keyring
     ../../nixos/users.nix
     ../../nixos/utils.nix
     ../../nixos/hyprland.nix
diff --git a/nixos/autologin.nix b/nixos/autologin.nix
new file mode 100644
index 00000000..5955b0b2
--- /dev/null
+++ b/nixos/autologin.nix
@@ -0,0 +1,27 @@
+# Autologin at boot: greetd starts your session directly on the first VT
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}: {
+  services.greetd.settings.initial_session = {
+    command = "${pkgs.uwsm}/bin/uwsm start -e -D Hyprland hyprland.desktop";
+    user = config.var.username;
+  };
+
+  # Needed so the LUKS passphrase entered at boot is cached in the kernel
+  # keyring, where pam_fde_boot_pw can retrieve it (see below).
+  boot.initrd.systemd.enable = true;
+
+  security.pam.services.greetd.rules.session.fde_boot_pw = {
+    order = 12550; # kwallet=12500, gnome_keyring=12600: must run in between
+    control = "optional";
+    modulePath = "${pkgs.pam_fde_boot_pw}/lib/security/pam_fde_boot_pw.so";
+    args = ["inject_for=gkr"];
+  };
+
+  security.pam.services.login.enableGnomeKeyring = true;
+
+  systemd.services.greetd.serviceConfig.KeyringMode = lib.mkForce "shared";
+}