greetd's PAM stack included system-login, whose own pam_u2f line runs
before the password stack — combined with greetd's own trailing
pam_u2f line, ReGreet prompted FIDO, then password, then FIDO again.
Spell out system-login's auth phase minus that stray line so FIDO is
asked once, after the password, matching hyprlock's order.
Also add setup/tools/set-regreet-background.sh to pin a specific image
as the greeter background, independent of the wallpaper-sync unit.
Replace the Xorg lightdm-gtk-greeter with a wlroots-native greetd + ReGreet
greeter (inside a cage kiosk), fixing three issues rooted in running an X
greeter on a multi-monitor / HiDPI / Wayland box: a blank output, tiny
scaling, and the Xorg->Wayland VT/seat handover race that left the Hyprland
session with dead keyboard/mouse.
- etc-greetd/: greetd config, ReGreet config (cyberqueer GTK4 theme, larger
font, wallpaper background), cage session launcher, and a password + FIDO
PAM stack (no securetty/OATH, which a graphical greeter cannot drive).
- greetd-regreet.sh: install/enable module, mutually exclusive with the
lightdm and ly greeter modules.
- Greeter background tracks the desktop wallpaper: a root systemd .path unit
mirrors the picker's choice to a greeter-readable path (the user's home is
0700, so the unprivileged greeter cannot read it directly).
The LightDM path is kept as a dormant alternative and hardened en route:
pam_u2f (FIDO) added to its PAM stack, a HiDPI + multi-monitor
display-setup.sh, a larger greeter font, and the same wallpaper-sync units.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Amir Alexander Abdelbaki