How do I append text to a /etc/… configuration file in NixOS?

Question

[disclosure: I asked about this earlier on the NixOS channel but didn't get an answer after 30 minutes and it's a busy channel. If I get one there, I'll replicate it here]

I'm trying to add some lines to a configuration file in NixOS (for example /etc/pam.d/sudo). The configuration options available in pam.nix do not include the line I want to add (in this case, account requisite pam_time.so), and it does not include an extraConfig option either.

I know I can create new configuration files using environement.etc.filename.text so I went with that, but sudo nixos-rebuild switch then complains that it has two sources for the configuration file, the official one and mine (mismatched duplicate entry /nix/… <-> /nix/…):

environment.etc."pam.d/sudo".text = ''blah'';

Is there a general way to append to a /etc/ configuration file (or to patch it) in NixOS?

Or is the only way to modify the system .nix files (e.g. modifying pam.nix, which I'm reluctant to do as it will collide with future updates)?

Answer 1

You can add lines to the default value of security.pam.services.sudo.text using mkOverride or the shortcut mkDefault to give your value the same priority as the default. You can control the order with mkOrder or the shortcuts mkBefore and mkAfter. So to append, you could do:

security.pam.services.sudo.text = pkgs.lib.mkDefault( pkgs.lib.mkAfter "# hi" );

When there are multiple values for an option, only the values with the lowest priority are kept. If there are still multiple values, they are sorted and merged. mkOverride and mkOrder create special values that the code in modules.nix recognizes when it is doing this. Ordinary values have the default priority (100) and sort order (1000). pam.nix uses mkDefault for the value it creates for the text option, which makes the priority 1000, thus ordinary values will replace it instead of being merged.

The NixOS manual section on Modularity explains a bit more.

I don't think you can do this generically for environment.etc because the target file doesn't have to match the attribute name, and pam.nix in particular does not name any of its entries in environment.etc. It is more like a list of instructions that are processed in sequence. See etc.nix and make-etc.sh