Harden deployment, authentication, firewall and media storage failure paths

settings/desktop.nix

@@ -3,28 +3,9 @@
 {
   config = lib.mkIf (lib.elem config.networking.hostName [ "FredOS-Gaming" "FredOS-Macbook" ]) {
     services.xserver.enable = true;
-    # Autologin straight into Hyprland; the quickshell lockscreen engages
-    # immediately (see Lock.qml), so the lock *is* the login prompt.
-    services.greetd = {
-      enable = true;
-      # We handle the plymouth handoff ourselves below — don't wait for
-      # plymouth-quit-wait (that wait is what dropped boot to a console
-      # flash between splash and Hyprland).
-      greeterManagesPlymouth = true;
-      settings.default_session = {
-        # start-hyprland prints an ASCII logo to the VT, which repaints the
-        # console over the retained splash frame — silence it (Hyprland still
-        # logs to $XDG_RUNTIME_DIR/hypr/*/hyprland.log).
-        command = toString (pkgs.writeShellScript "hyprland-session" ''
-          exec ${config.programs.hyprland.package}/bin/start-hyprland >/dev/null 2>&1
-        '');
-        user = "fred";
-      };
-    };
-
     # GDM-style splash→session handoff: nothing else quits plymouth at boot;
     # greetd freezes the last splash frame (--retain-splash) right before it
-    # spawns Hyprland, which then flips straight to the lockscreen.
+    # spawns the isolated greeter compositor.
     systemd.services.plymouth-quit.wantedBy = lib.mkForce [ ];
     # ...and plymouth-quit-wait must go too: greetd is Type=idle, so it defers
     # its ExecStart while any job is pending — and the only pending job is
@@ -44,9 +25,7 @@
     services.flatpak.enable = true;
 
     # Secret Service for Chromium/Electron credential encryption.
-    # Autologin can't unlock the keyring (no password typed), so greetd only
-    # *starts* the daemon; the quickshell lockscreen authenticates against the
-    # "login" PAM service, where pam_gnome_keyring unlocks it on first unlock.
+    # greetd passes the login password to PAM before starting the session.
     services.gnome.gnome-keyring.enable = true;
     security.pam.services.greetd.enableGnomeKeyring = true;
     security.pam.services.login.enableGnomeKeyring = true;