add fingerprint support for login

hosts/lappy-t495/lappy-t495.nix

@@ -11,6 +11,7 @@
     profiles.cross.arm64
     profiles.remoteBuilders
     profiles.chaosInternalWireGuard
+    profiles.fingerprint
 
     ./secrets.nix
   ];

presets/nixos/laptop.nix

@@ -8,6 +8,8 @@
     profiles.tor
   ];
 
+  services.fwupd.enable = true;
+
   # TODO: Better DNS setup
   services.resolved.enable = false;
   environment.etc."resolv.conf".text = ''

profiles/base/access.nix

@@ -1,5 +0,0 @@
-{lib, ...}: let
-  inherit (lib.modules) mkForce;
-in {
-  security.sudo.wheelNeedsPassword = mkForce false;
-}

profiles/base/sudo.nix

@@ -0,0 +1,5 @@
+{lib, ...}: let
+  inherit (lib.modules) mkDefault;
+in {
+  security.sudo.wheelNeedsPassword = mkDefault false;
+}

profiles/fingerprint.nix

@@ -0,0 +1,35 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}: let
+  inherit (lib.modules) mkIf mkForce;
+in {
+  services.fprintd.enable = true;
+
+  security.sudo.wheelNeedsPassword = mkForce true;
+
+  security.pam.services = {
+    sudo.fprintAuth = true;
+    login.fprintAuth = false;
+
+    gdm-fingerprint = mkIf (config.services.xserver.displayManager.gdm.enable) {
+      text = ''
+        auth       required                    pam_shells.so
+        auth       requisite                   pam_nologin.so
+        auth       requisite                   pam_faillock.so      preauth
+        auth       required                    ${pkgs.fprintd}/lib/security/pam_fprintd.so
+        auth       optional                    pam_permit.so
+        auth       required                    pam_env.so
+        auth       [success=ok default=1]      ${pkgs.gnome.gdm}/lib/security/pam_gdm.so
+
+        account    include                     login
+
+        password   required                    pam_deny.so
+
+        session    include                     login
+      '';
+    };
+  };
+}

profiles/gui/environments/gnome/default.nix

@@ -72,5 +72,7 @@ in {
 
   programs.dconf.enable = true;
 
+  services.gnome.gnome-keyring.enable = mkForce false;
+
   services.xserver = {layout = "gb";};
 }