From 508fe6c3c902a8449d995d402e28acd23a8ad564 Mon Sep 17 00:00:00 2001
From: Henri Dohmen <henridohmen@posteo.com>
Date: Sat, 11 Apr 2026 19:14:27 +0200
Subject: [PATCH] fix doas delay

---
 mod/common/security.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/mod/common/security.nix b/mod/common/security.nix
index 7b12773..7aab402 100644
--- a/mod/common/security.nix
+++ b/mod/common/security.nix
@@ -97,6 +97,11 @@ with lib;
         ];
       };
 
+      # Pam checks wether you have a blank password before prompting your
+      # credentials. This computes yescrypt hash of "" which causes annoying
+      # delay before prompting for the `doas` password.
+      pam.services.doas.allowNullPassword = lib.mkForce false;
+
       pki.certificateFiles = [ ../../pki/ca.cert ];
     };
   };