fix: power buttons via systemctl, single greeter window (v0.8.7)

Reboot/shutdown buttons always failed: power.rs called `loginctl
reboot|poweroff`, but loginctl has no such verbs (systemd 260) — those
belong to systemctl. moonlock/moonset already used systemctl; moongreet
was the outlier. Switch to `systemctl --no-ask-password reboot|poweroff`.

The multi-monitor greeter gave Exclusive keyboard only to the first
monitor's window, so a user focused on any other output could not type
the password. Drop the per-monitor loop + hotplug; create one window on
the focused output (no set_monitor) with Exclusive keyboard.

Polkit rule kept as a harmless safety net (it was never the blocker;
CanReboot returns yes). The missing journal errors were not a logging
bug — they were lost to a hard power-cut before journald synced.

src/greeter.rs

@@ -189,7 +189,7 @@ fn render_blurred_texture(
 }
 
 /// Create a Picture widget for the wallpaper background, optionally with GPU blur.
-/// Uses `blur_cache` to compute the blurred texture only once across all monitors.
+/// Uses `blur_cache` to compute the blurred texture only once and reuse it.
 fn create_background_picture(
     texture: &gdk::Texture,
     blur_radius: Option<f32>,

src/main.rs

@@ -1,5 +1,5 @@
 // ABOUTME: Entry point for Moongreet — greetd greeter for Wayland.
-// ABOUTME: Sets up GTK Application, Layer Shell, CSS, and multi-monitor windows.
+// ABOUTME: Sets up GTK Application, Layer Shell, CSS, and a single greeter window.
 
 mod config;
 mod fingerprint;
@@ -11,11 +11,9 @@ mod sessions;
 mod users;
 
 use gdk4 as gdk;
-use glib::clone;
 use gtk4::prelude::*;
 use gtk4::{self as gtk, gio};
 use gtk4_layer_shell::LayerShell;
-use std::rc::Rc;
 fn load_css(display: &gdk::Display) {
     let css_provider = gtk::CssProvider::new();
     css_provider.load_from_resource("/dev/moonarch/moongreet/style.css");
@@ -26,13 +24,11 @@ fn load_css(display: &gdk::Display) {
     );
 }
 
-fn setup_layer_shell(window: &gtk::ApplicationWindow, keyboard: bool, layer: gtk4_layer_shell::Layer) {
+fn setup_layer_shell(window: &gtk::ApplicationWindow, layer: gtk4_layer_shell::Layer) {
     window.init_layer_shell();
     window.set_layer(layer);
     window.set_exclusive_zone(-1);
-    if keyboard {
-        window.set_keyboard_mode(gtk4_layer_shell::KeyboardMode::Exclusive);
-    }
+    window.set_keyboard_mode(gtk4_layer_shell::KeyboardMode::Exclusive);
     // Anchor to all edges for fullscreen
     window.set_anchor(gtk4_layer_shell::Edge::Top, true);
     window.set_anchor(gtk4_layer_shell::Edge::Bottom, true);
@@ -66,49 +62,15 @@ fn activate(app: &gtk::Application) {
     log::debug!("Layer shell: {use_layer_shell}");
 
     if use_layer_shell {
-        // One greeter window per monitor — only the first gets keyboard input
-        let monitors = display.monitors();
-        log::debug!("Monitor count: {}", monitors.n_items());
-        let mut first = true;
-        for i in 0..monitors.n_items() {
-            if let Some(monitor) = monitors
-                .item(i)
-                .and_then(|obj| obj.downcast::<gdk::Monitor>().ok())
-            {
-                let window = greeter::create_greeter_window(bg_texture.as_ref(), &config, &blur_cache, app);
-                setup_layer_shell(&window, first, gtk4_layer_shell::Layer::Top);
-                window.set_monitor(Some(&monitor));
-                window.present();
-                first = false;
-            }
-        }
-
-        // Handle monitor hotplug — create greeter windows for newly added monitors
-        // (without keyboard, since the primary monitor already has it)
-        let bg_texture = Rc::new(bg_texture);
-        let config = Rc::new(config);
-        monitors.connect_items_changed(clone!(
-            #[weak]
-            app,
-            #[strong]
-            blur_cache,
-            move |list, position, _removed, added| {
-                for i in position..position + added {
-                    if let Some(monitor) = list
-                        .item(i)
-                        .and_then(|obj| obj.downcast::<gdk::Monitor>().ok())
-                    {
-                        log::debug!("Monitor hotplug: creating greeter window");
-                        let window = greeter::create_greeter_window(
-                            bg_texture.as_ref().as_ref(), &config, &blur_cache, &app,
-                        );
-                        setup_layer_shell(&window, false, gtk4_layer_shell::Layer::Top);
-                        window.set_monitor(Some(&monitor));
-                        window.present();
-                    }
-                }
-            }
-        ));
+        // Single greeter window. No set_monitor — the compositor places it on the
+        // focused output (same as moonset). Exclusive keyboard binds input to this
+        // surface regardless of pointer position; the mouse may wander to other
+        // outputs but typing always reaches the greeter. The previous per-monitor
+        // approach gave keyboard only to the first monitor's window, so a user on
+        // any other output could not type the password.
+        let window = greeter::create_greeter_window(bg_texture.as_ref(), &config, &blur_cache, app);
+        setup_layer_shell(&window, gtk4_layer_shell::Layer::Top);
+        window.present();
     } else {
         // No layer shell — single window for development
         let greeter_window = greeter::create_greeter_window(bg_texture.as_ref(), &config, &blur_cache, app);

src/power.rs

@@ -1,4 +1,4 @@
-// ABOUTME: Power actions — reboot and shutdown via loginctl.
+// ABOUTME: Power actions — reboot and shutdown via systemctl.
 // ABOUTME: Wrappers around system commands for the greeter UI.
 
 use std::fmt;
@@ -99,14 +99,21 @@ fn run_command(action: &'static str, program: &str, args: &[&str]) -> Result<(),
     }
 }
 
-/// Reboot the system via loginctl.
+/// Reboot the system via systemctl.
+///
+/// `--no-ask-password` keeps systemctl from spawning an interactive askpass
+/// agent — the greeter session has none, so without it a denied authorization
+/// would hang instead of failing fast.
 pub fn reboot() -> Result<(), PowerError> {
-    run_command("reboot", "/usr/bin/loginctl", &["reboot"])
+    run_command("reboot", "/usr/bin/systemctl", &["--no-ask-password", "reboot"])
 }
 
-/// Shut down the system via loginctl.
+/// Shut down the system via systemctl.
+///
+/// `--no-ask-password` for the same reason as [`reboot`] — the agent-less
+/// greeter session has nothing to answer an authorization challenge.
 pub fn shutdown() -> Result<(), PowerError> {
-    run_command("shutdown", "/usr/bin/loginctl", &["poweroff"])
+    run_command("shutdown", "/usr/bin/systemctl", &["--no-ask-password", "poweroff"])
 }
 
 #[cfg(test)]