Login Passwords

Login passwords are kept as hashes in secrets/passwords.yaml; see the Secrets concept for the trust model behind them.

You can set a user’s login password with just set-password. The command prompts for the password, hashes it with mkpasswd, and writes the encrypted value into secrets/passwords.yaml:

just set-password alice

The file maps each user name to that password hash, so it never carries a password in clear text:

secrets/passwords.yaml

alice: $y$j9T$…

You can verify a password against the stored hash, without decrypting it into view, with:

just verify-password alice

To make a host apply these passwords, point passwords.secrets at the file in its configuration. Each user the file names then takes their hash as their users.users.<name>.hashedPasswordFile:

hosts/example/default.nix

passwords.secrets = ../../secrets/passwords.yaml;

Note

By default the stored hash is a user’s initial password, which is applied only when the account is first created. Each user is then free to update their login password with the passwd command, locally. It’s your users’ responsibility to add local changes as edits to passwords.yaml. A NixOS rebuild leaves a live account untouched, courtesy of the users.mutableUsers system setting, which is true by default.

Enforce managed passwords

Set users.mutableUsers = false to make passwords.yaml authoritative. Every rebuild will then re-apply the stored hash, so changes propagate from the repository, and local passwd changes are reverted.