From 3341e1e694ad64c12055c42008c4927c327950de Mon Sep 17 00:00:00 2001
From: Dennis Kobert <dennis@kobert.dev>
Date: Tue, 10 Mar 2026 20:39:54 +0100
Subject: Support config file path, add NixOS module with mode option

---
 flake.nix | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

(limited to 'flake.nix')

diff --git a/flake.nix b/flake.nix
index 9daf707..ee980c4 100644
--- a/flake.nix
+++ b/flake.nix
@@ -18,15 +18,21 @@
           cfg = config.security.pam-any;
           pam-any = self.packages.${pkgs.stdenv.hostPlatform.system}.default;
 
-          pamAnyConfig = builtins.toJSON {
-            mode = "One";
+          pamAnyConfigFile = pkgs.writeText "pam-any-config.json" (builtins.toJSON {
+            mode = cfg.mode;
             modules = cfg.modules;
-          };
+          });
         in
         {
           options.security.pam-any = {
             enable = lib.mkEnableOption "pam-any parallel authentication";
 
+            mode = lib.mkOption {
+              type = lib.types.enum [ "One" "All" ];
+              default = "One";
+              description = "\"One\" succeeds if any module succeeds, \"All\" requires all to succeed.";
+            };
+
             modules = lib.mkOption {
               type = lib.types.attrsOf lib.types.str;
               default = {
@@ -64,7 +70,7 @@
                 order = cfg.order;
                 control = "sufficient";
                 modulePath = "${pam-any}/lib/security/pam_any.so";
-                args = [ pamAnyConfig ];
+                args = [ "${pamAnyConfigFile}" ];
               };
             });
           };
-- 
cgit v1.3.1