From c45e9fd973d8112b5cd6fe2923da6c37760c7d04 Mon Sep 17 00:00:00 2001
From: nelind <nel.n.lindberg@gmail.com>
Date: Sat, 30 May 2026 23:27:57 +0200
Subject: [PATCH 1/2] nixos/ly: substack login in PAM

---
 .../modules/services/display-managers/ly.nix  | 34 +++++++++++++++++--
 1 file changed, 31 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/services/display-managers/ly.nix b/nixos/modules/services/display-managers/ly.nix
index 7bc23926db36..c2cecc1d239c 100644
--- a/nixos/modules/services/display-managers/ly.nix
+++ b/nixos/modules/services/display-managers/ly.nix
@@ -100,9 +100,37 @@ in
 
     security.pam.services = {
       ly = {
-        startSession = true;
-        unixAuth = true;
-        enableGnomeKeyring = lib.mkDefault config.services.gnome.gnome-keyring.enable;
+        useDefaultRules = false;
+        rules = {
+          auth = utils.pam.autoOrderRules [
+            {
+              name = "login";
+              control = "substack";
+              modulePath = "login";
+            }
+          ];
+          account = utils.pam.autoOrderRules [
+            {
+              name = "login";
+              control = "include";
+              modulePath = "login";
+            }
+          ];
+          password = utils.pam.autoOrderRules [
+            {
+              name = "login";
+              control = "substack";
+              modulePath = "login";
+            }
+          ];
+          session = utils.pam.autoOrderRules [
+            {
+              name = "login";
+              control = "include";
+              modulePath = "login";
+            }
+          ];
+        };
       };
     }
     // optionalAttrs dmcfg.autoLogin.enable {

From f941d78c5a1853479357a69f4b5f813a2f9075ba Mon Sep 17 00:00:00 2001
From: nelind <nel.n.lindberg@gmail.com>
Date: Sat, 30 May 2026 23:59:05 +0200
Subject: [PATCH 2/2] nixos/greetd: substack login in PAM

---
 .../services/display-managers/greetd.nix      | 35 +++++++++++++++++--
 1 file changed, 32 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/services/display-managers/greetd.nix b/nixos/modules/services/display-managers/greetd.nix
index dd0d6a04effe..2f5746911cd1 100644
--- a/nixos/modules/services/display-managers/greetd.nix
+++ b/nixos/modules/services/display-managers/greetd.nix
@@ -1,6 +1,7 @@
 {
   config,
   lib,
+  utils,
   pkgs,
   ...
 }:
@@ -76,9 +77,37 @@ in
     services.greetd.settings.default_session.user = lib.mkDefault "greeter";
 
     security.pam.services.greetd = {
-      allowNullPassword = true;
-      startSession = true;
-      enableGnomeKeyring = lib.mkDefault config.services.gnome.gnome-keyring.enable;
+      useDefaultRules = false;
+      rules = {
+        auth = utils.pam.autoOrderRules [
+          {
+            name = "login";
+            control = "substack";
+            modulePath = "login";
+          }
+        ];
+        account = utils.pam.autoOrderRules [
+          {
+            name = "login";
+            control = "include";
+            modulePath = "login";
+          }
+        ];
+        password = utils.pam.autoOrderRules [
+          {
+            name = "login";
+            control = "substack";
+            modulePath = "login";
+          }
+        ];
+        session = utils.pam.autoOrderRules [
+          {
+            name = "login";
+            control = "include";
+            modulePath = "login";
+          }
+        ];
+      };
     };
 
     # This prevents nixos-rebuild from killing greetd by activating getty again