Power off system on LUKS decryption timeout

[brutalsam96]

I have faced an issue where my laptop was left powered on for 6 hours stuck in the drive decryption password screen. Fortunately, the device did not suffer any known damages to the hardware, but it's vital to have a flow where after a certain amount of time, the password prompt times out and automatically shuts down the device to prevent thermal stress, battery drain, or panel burn-in.

I have fixed this issue with two methods. One was patching the legacy encrypt hook, which was not the best or cleanest solution. The other, better method was replacing encrypt with the native sd-encrypt hook and utilizing its built-in methods to handle the timeout. Additionally, I added a custom companion hook that automatically shuts down the device instead of dropping it into systemd's default emergency mode—which was causing the system to freeze in an infinite loop due to a locked root account.

Here are exact steps i took to implement these changes:

1. The Custom Hook File (usr/lib/initcpio/install/timeout-shutdown)

#!/bin/bash

build() {
    add_symlink /usr/lib/systemd/system/emergency.target poweroff.target
    add_file /usr/lib/systemd/system/poweroff.target
    add_file /usr/lib/systemd/system/systemd-poweroff.service
}

help() {
    cat <<HELPEOF
Redirects systemd emergency.target to poweroff.target inside the initramfs.
Prevents unauthenticated freezing loops on systems with locked root accounts.
HELPEOF
}

2. The Updated Hooks Array Configuration (/etc/mkinitcpio.conf.d/omarchy_hooks.conf)

HOOKS=(base microcode autodetect modconf kms systemd plymouth sd-vconsole block sd-encrypt timeout-shutdown filesystems btrfs-overlayfs)

3. Target Kernel Boot Parameters (/etc/default/limine)

Added these two kernel_cmdline, replaced cryptdevice paramater with rd.luks.name, luks uuid(not partuuid)
rd.luks.name=LUKS_UUID=root rd.luks.options=timeout=30s root=/dev/mapper/root rootflags=subvol=@,x-systemd.device-timeout=30s

@dhh @ryanrhughes
Let me know if you want me to spin this up into a formal Pull Request!