From 88327eb3879bfc40ef9b339e11f5ed7307f5421d Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Tue, 13 Jan 2026 22:40:46 +0300
Subject: [PATCH] nixos/plasma-login-manager: init

---
 nixos/modules/module-list.nix                 |   1 +
 .../display-managers/plasma-login-manager.nix | 123 ++++++++++++++++++
 nixos/modules/services/x11/xserver.nix        |   1 +
 3 files changed, 125 insertions(+)
 create mode 100644 nixos/modules/services/display-managers/plasma-login-manager.nix

diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index e4313e029e8a..d18909171a7f 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -619,6 +619,7 @@
   ./services/display-managers/greetd.nix
   ./services/display-managers/lemurs.nix
   ./services/display-managers/ly.nix
+  ./services/display-managers/plasma-login-manager.nix
   ./services/display-managers/sddm.nix
   ./services/editors/emacs.nix
   ./services/editors/haste.nix
diff --git a/nixos/modules/services/display-managers/plasma-login-manager.nix b/nixos/modules/services/display-managers/plasma-login-manager.nix
new file mode 100644
index 000000000000..2101873bad93
--- /dev/null
+++ b/nixos/modules/services/display-managers/plasma-login-manager.nix
@@ -0,0 +1,123 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    mkIf
+    mkEnableOption
+    mkOption
+    mkPackageOption
+    optionalAttrs
+    ;
+
+  cfg = config.services.displayManager.plasma-login-manager;
+  xcfg = config.services.xserver;
+  dmcfg = config.services.displayManager;
+
+  iniFmt = pkgs.formats.ini { };
+
+  defaultConfig =
+    optionalAttrs xcfg.enable {
+      X11.ServerPath = xcfg.displayManager.xserverBin;
+    }
+    // optionalAttrs dmcfg.autoLogin.enable {
+      Autologin = {
+        User = dmcfg.autoLogin.user;
+        Session = "${dmcfg.sessionData.autologinSession}.desktop";
+      };
+    };
+
+  defaultConfigFile = iniFmt.generate "00-nixos-defaults.conf" defaultConfig;
+  userConfigFile = iniFmt.generate "99-user.conf" cfg.settings;
+in
+{
+  options.services.displayManager.plasma-login-manager = {
+    enable = mkEnableOption "Plasma Login Manager";
+    package = mkPackageOption pkgs [
+      "kdePackages"
+      "plasma-login-manager"
+    ] { };
+
+    settings = mkOption {
+      type = iniFmt.type;
+      default = { };
+      example = {
+        Users.ReuseSession = false;
+      };
+      description = "Additional settings for Plasma Login Manager (see `man plasmalogin.conf`)";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.displayManager.enable = true;
+
+    environment.systemPackages = [ cfg.package ];
+    systemd.packages = [ cfg.package ];
+    systemd.tmpfiles.packages = [ cfg.package ];
+    services.dbus.packages = [ cfg.package ];
+
+    systemd.services.plasmalogin = {
+      aliases = [ "display-manager.service" ];
+      path = [ cfg.package ];
+      wantedBy = [ "graphical.target" ];
+      restartIfChanged = false;
+    };
+
+    systemd.defaultUnit = "graphical.target";
+
+    environment.etc."plasmalogin.conf.d/00-nixos-defaults.conf".source = defaultConfigFile;
+    environment.etc."plasmalogin.conf.d/99-user.conf".source = userConfigFile;
+
+    security.pam.services = {
+      plasmalogin.text = ''
+        auth      substack      login
+        account   include       login
+        password  substack      login
+        session   include       login
+      '';
+
+      plasmalogin-autologin.text = ''
+        auth     requisite pam_nologin.so
+        auth     required  pam_permit.so
+
+        account  include   plasmalogin
+        password include   plasmalogin
+        session  include   plasmalogin
+      '';
+
+      plasmalogin-greeter.text = ''
+        # Load environment from /etc/environment and ~/.pam_environment
+        auth		required pam_env.so conffile=/etc/pam/environment readenv=0
+
+        # Always let the greeter start without authentication
+        auth		required pam_permit.so
+
+        # No action required for account management
+        account		required pam_permit.so
+
+        # Can't change password
+        password	required pam_deny.so
+
+        # Setup session
+        session		required pam_unix.so
+        session		optional ${config.systemd.package}/lib/security/pam_systemd.so
+      '';
+    };
+
+    # FIXME: use upstream sysusers
+    users = {
+      users.plasmalogin = {
+        name = "plasmalogin";
+        isSystemUser = true;
+        group = "plasmalogin";
+        description = "Plasma Login Manager greeter user";
+        home = "/var/lib/plasmalogin";
+      };
+      groups.plasmalogin = { };
+    };
+  };
+}
diff --git a/nixos/modules/services/x11/xserver.nix b/nixos/modules/services/x11/xserver.nix
index d04d02660528..89174b6b9d98 100644
--- a/nixos/modules/services/x11/xserver.nix
+++ b/nixos/modules/services/x11/xserver.nix
@@ -823,6 +823,7 @@ in
             || config.services.greetd.enable
             || config.services.displayManager.ly.enable
             || config.services.displayManager.lemurs.enable
+            || config.services.displayManager.plasma-login-manager.enable
           );
       in
       mkIf default (mkDefault true);