feat(fingerprint): add fingerscan

host/ThinkPad/configuration.nix

@@ -9,6 +9,7 @@
       ./modules/swap.nix
       ./modules/intel.nix
       ./modules/nvidia.nix
+      ./modules/fingerprint.nix
 
     (import ../modules/common.nix {
       inherit lib;

host/ThinkPad/modules/fingerprint.nix

@@ -0,0 +1,16 @@
+{ config, ... }: {
+  services.fprintd.enable = true;
+
+  security.pam.services.sudo.fprintAuth = true;
+
+  security.polkit.extraConfig = ''
+    polkit.addRule(function(action, subject) {
+      if (action.id == "net.reactivated.fprint.device.enroll" &&
+          subject.isInGroup("fprint")) {
+        return polkit.Result.YES;
+      }
+    });
+  '';
+
+  users.users.kirill.extraGroups = [ "fprint" ];
+}