greetd: add autolock option

This option can be referenced by window managers to determine if they
should automatically lock. For example, this can add an extra layer of
security on a system that automatically decrypts the boot drive, but
still offers the advantages of auto-login, such as automatic starting of
user programs.

home/sessions/hyprland/default.nix

@@ -81,6 +81,20 @@ in
       example = true;
       description = "Whether to enable hyprland.";
     };
+
+    autolock = lib.mkOption {
+      description = ''
+        Whether to automatically lock Hyprland upon logging in. This is useful
+        on a system with auto-login enabled, so that user programs can start
+        automatically with the system, but there is still an added layer of
+        security. This can be configured system-wide via
+        nixfiles.greetd.settings.autolock.
+      '';
+      type = lib.types.bool;
+      default = osConfig.nixfiles.greetd.settings.autolock or false;
+      defaultText = "osConfig.nixfiles.greetd.settings.autolock or false";
+      example = true;
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -114,7 +128,7 @@ in
         # Execute your favorite apps at launch
         # exec-once = waybar & hyprpaper & firefox
 
-        exec-once = [
+        exec-once = (lib.optional cfg.autolock lock-cmd) ++ [
           wallpaper-cmd
           notifydaemon
           polkit-agent

system/programs/greetd.nix

@@ -125,6 +125,15 @@ in
         default = null;
         example = "username";
       };
+      autolock = lib.mkOption {
+        description = ''
+          Whether to indicate to a window manager that it should immediately
+          lock. This needs to be implemented on a per window manager basis.
+        '';
+        type = bool;
+        default = false;
+        example = true;
+      };
     };
     presets.tuigreet.enable = lib.mkOption {
       description = "tuigreet greetd configuration";