Move to a secure greeter

desktop-environment/config.nix

@@ -1,49 +1,52 @@
 { pkgs, ... }:
 let
-    profile = import ../profile.nix;
+  profile = import ../profile.nix;
 in
 {
 
-    imports  = [
-        ./browser.nix
-        ./planner.nix
-        ./window-manager.nix
-        ../applications/matrix.nix
-    ];
+  imports = [
+    ./browser.nix
+    ./planner.nix
+    ./window-manager.nix
+    ../applications/matrix.nix
+  ];
 
-    environment.systemPackages = with pkgs; [
-        kitty
-        pamixer
-        nemo-with-extensions
-    ];
+  environment.systemPackages = with pkgs; [
+    kitty
+    pamixer
+    nemo-with-extensions
+  ];
 
-    services.dbus.enable = true;
-    programs.dconf.enable = true;
-    hardware.graphics.enable = true;
+  services.dbus.enable = true;
+  programs.dconf.enable = true;
+  hardware.graphics.enable = true;
 
-    services.greetd = {
-      enable = true;
-      settings = {
-        default_session = {
-          command = "Hyprland";
-          user = profile.username;
-        };
+  programs.regreet = {
+    enable = true;
+  };
+
+  services.greetd = {
+    enable = true;
+    settings = {
+      default_session = {
+        command = "${pkgs.cage}/bin/cage -s -- ${pkgs.regreet}/bin/regreet";
       };
     };
+  };
 
-    xdg.portal = {
-        enable = true;
-        extraPortals = [ pkgs.xdg-desktop-portal-hyprland ];
-    };
+  xdg.portal = {
+    enable = true;
+    extraPortals = [ pkgs.xdg-desktop-portal-hyprland ];
+  };
 
-    hardware.nvidia = {
-      modesetting.enable = true;
-      powerManagement.enable = false;
-      open = false;
-    };
+  hardware.nvidia = {
+    modesetting.enable = true;
+    powerManagement.enable = false;
+    open = false;
+  };
 
-    systemd.targets.sleep.enable = false;
-    systemd.targets.suspend.enable = false;
-    systemd.targets.hibernate.enable = false;
-    systemd.targets.hybrid-sleep.enable = false;
+  systemd.targets.sleep.enable = false;
+  systemd.targets.suspend.enable = false;
+  systemd.targets.hibernate.enable = false;
+  systemd.targets.hybrid-sleep.enable = false;
 }