programs: add "waylock"

hosts/common/programs/default.nix

@@ -86,6 +86,7 @@
     ./tor-browser.nix
     ./tuba.nix
     ./vlc.nix
+    ./waylock.nix
     ./wike.nix
     ./wine.nix
     ./wireshark.nix

hosts/common/programs/waylock.nix

@@ -0,0 +1,12 @@
+# waylock: <https://codeberg.org/ifreund/waylock>
+# also documented in berbiche NUR: <https://github.com/nix-community/nur-combined/blob/master/repos/berbiche/README.md>
+{ config, lib, ... }:
+let
+  cfg = config.sane.programs.waylock;
+in
+{
+  # without a /etc/pam.d/waylock entry, you may lock but you may never *unlock* ;-)
+  security.pam.services = lib.mkIf cfg.enabled {
+    waylock.unixAuth = true;
+  };
+}