From d42da8a083d004dacdaa2d4b50550d6a9e861992 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Tue, 21 Jul 2026 21:22:14 +0200
Subject: [PATCH] nixos/account-utils: support config file

---
 nixos/modules/security/account-utils.nix | 13 +++++++++++++
 nixos/tests/login-nosuid.nix             | 10 +++++++++-
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/security/account-utils.nix b/nixos/modules/security/account-utils.nix
index bd2bf08f55b2..42daaf188ca6 100644
--- a/nixos/modules/security/account-utils.nix
+++ b/nixos/modules/security/account-utils.nix
@@ -6,6 +6,7 @@
 }:
 let
   cfg = config.security.account-utils;
+  format = pkgs.formats.ini { };
 in
 {
   options.security.account-utils = {
@@ -25,6 +26,16 @@ in
         :::
       '';
     };
+    pwaccessd.settings = lib.mkOption {
+      description = ''
+        Options for pwaccessd.
+        See {manpage}`pwaccessd.conf(5)` for available options.
+      '';
+      type = lib.types.submodule {
+        freeformType = format.type;
+      };
+      default = { };
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -44,6 +55,8 @@ in
     };
 
     environment.systemPackages = [ cfg.package ];
+    environment.etc."account-utils/pwaccessd.conf".source =
+      format.generate "pwaccessd.conf" cfg.pwaccessd.settings;
 
     security.pam.services = {
       pwupd-passwd = { };
diff --git a/nixos/tests/login-nosuid.nix b/nixos/tests/login-nosuid.nix
index 1f00c37d0886..f5582382891f 100644
--- a/nixos/tests/login-nosuid.nix
+++ b/nixos/tests/login-nosuid.nix
@@ -11,7 +11,12 @@
     {
       security.enableWrappers = false;
       systemd.settings.Manager.NoNewPrivileges = true;
-      security.account-utils.enable = true;
+      security.account-utils = {
+        enable = true;
+        pwaccessd.settings = {
+          ExpiredCheck.SpMin = true;
+        };
+      };
       users.mutableUsers = true;
       security.account-utils.extraArgs = [
         "-v"
@@ -46,6 +51,9 @@
         print(f"passwd path is: {passwd_path}")
         assert "account-utils" in passwd_path
 
+    with subtest("config file exists"):
+        machine.succeed("ls /etc/account-utils/pwaccessd.conf")
+
     with subtest("create user"):
         machine.succeed("useradd -m alice")
         machine.succeed("(echo foobar; echo foobar) | passwd alice")