system/modules/nixos/configs/lockscreen/waylock.nix

{ config, lib, pkgs, ... }:

let
  cfg = config.local.lockscreen.waylock;
in
{
  options.local.lockscreen.waylock = with lib; {
    enable = mkEnableOption "waylock";
  };

  config = lib.mkIf cfg.enable {
    environment.systemPackages = [ pkgs.unstable.waylock ];
    security.pam.services.waylock .text = ''
      auth      required  pam_unix.so     try_first_pass nullok
      auth      optional  pam_permit.so
    '';
  };
}