From 0b7b877e9afcdd7343ee3ec2d0b63c749ca433ae Mon Sep 17 00:00:00 2001
From: Salva <salva.hg01@gmail.com>
Date: Sun, 31 May 2026 23:34:50 -0600
Subject: [PATCH] pam: add support for oo7

---
 nixos/modules/security/pam.nix | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix
index d9ac409599f6..96fce08754c9 100644
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@@ -678,6 +678,14 @@ let
           '';
         };
 
+        oo7 = {
+          enable = lib.mkEnableOption ''
+            automatically unlock the user's default Session Keyring using pam_oo7.
+            If the user's login password does not match their keyring password,
+            oo7 will prompt separately after login.
+          '';
+        };
+
         enableUMask = lib.mkOption {
           default = config.security.pam.enableUMask;
           defaultText = lib.literalExpression "config.security.pam.enableUMask";
@@ -1198,6 +1206,7 @@ let
                       || cfg.pamMount
                       || cfg.kwallet.enable
                       || cfg.enableGnomeKeyring
+                      || cfg.oo7.enable
                       || config.services.intune.enable
                       || cfg.googleAuthenticator.enable
                       || cfg.gnupg.enable
@@ -1261,6 +1270,12 @@ let
                       control = "optional";
                       modulePath = "${pkgs.gnome-keyring}/lib/security/pam_gnome_keyring.so";
                     }
+                    {
+                      name = "oo7";
+                      enable = cfg.oo7.enable;
+                      control = "optional";
+                      modulePath = "${pkgs.oo7-pam}/lib/security/pam_oo7.so";
+                    }
                     {
                       name = "intune";
                       enable = config.services.intune.enable;
@@ -1477,6 +1492,12 @@ let
                   use_authtok = true;
                 };
               }
+              {
+                name = "oo7";
+                enable = cfg.oo7.enable;
+                control = "optional";
+                modulePath = "${pkgs.oo7-pam}/lib/security/pam_oo7.so";
+              }
             ];
 
             session = utils.pam.autoOrderRules [
@@ -1695,6 +1716,15 @@ let
                   auto_start = true;
                 };
               }
+              {
+                name = "oo7";
+                enable = cfg.oo7.enable;
+                control = "optional";
+                modulePath = "${pkgs.oo7-pam}/lib/security/pam_oo7.so";
+                settings = {
+                  auto_start = true;
+                };
+              }
               {
                 name = "gnupg";
                 enable = cfg.gnupg.enable;