nixos/account-utils: support config file

nixos/modules/security/account-utils.nix

@@ -6,6 +6,7 @@
 }:
 let
   cfg = config.security.account-utils;
+  format = pkgs.formats.ini { };
 in
 {
   options.security.account-utils = {
@@ -25,6 +26,16 @@ in
         :::
       '';
     };
+    pwaccessd.settings = lib.mkOption {
+      description = ''
+        Options for pwaccessd.
+        See {manpage}`pwaccessd.conf(5)` for available options.
+      '';
+      type = lib.types.submodule {
+        freeformType = format.type;
+      };
+      default = { };
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -44,6 +55,8 @@ in
     };
 
     environment.systemPackages = [ cfg.package ];
+    environment.etc."account-utils/pwaccessd.conf".source =
+      format.generate "pwaccessd.conf" cfg.pwaccessd.settings;
 
     security.pam.services = {
       pwupd-passwd = { };

nixos/tests/login-nosuid.nix

@@ -11,7 +11,12 @@
     {
       security.enableWrappers = false;
       systemd.settings.Manager.NoNewPrivileges = true;
-      security.account-utils.enable = true;
+      security.account-utils = {
+        enable = true;
+        pwaccessd.settings = {
+          ExpiredCheck.SpMin = true;
+        };
+      };
       users.mutableUsers = true;
       security.account-utils.extraArgs = [
         "-v"
@@ -46,6 +51,9 @@
         print(f"passwd path is: {passwd_path}")
         assert "account-utils" in passwd_path
 
+    with subtest("config file exists"):
+        machine.succeed("ls /etc/account-utils/pwaccessd.conf")
+
     with subtest("create user"):
         machine.succeed("useradd -m alice")
         machine.succeed("(echo foobar; echo foobar) | passwd alice")