NixOS physlock: run command before lock and after unlock

config.nix

{ config, lib, pkgs, ... }:

{
  services.physlock.enable = true;

  systemd.services."physlock".serviceConfig = {
    # Run before physlock starts
    ExecStartPre = "${pkgs.ityntolm}/bin/deny-usb-devices";
    # Run after physlock stops
    ExecStopPost = "${pkgs.ityntolm}/bin/allow-usb-devices";
  };
}