This seems pretty reasonable to me. How about you @Ma27?

Man, this PAM config sure is a mess..

I'm pretty sure this option here isn't strictly needed actually, the module system itself should allow you to set text = mkDefault "some extra text" which should concatenate with the default specified there. It would probably even make more sense to change the PAM module to not use mkDefault there such that you don't need a mkDefault to add to it, oh well. Note that you might need mkAfter to control the ordering of it, so text = mkDefault (mkAfter "some extra text after the default definition") should work.

Looking for a way to achieve the effect of #30333 for my system, it turned out there is no way to enumerate all PAM services without depending on config (and thus causing infinite recursion), making it impossible to append all their configuration files with desired changes.

Trying to replicate it in each pam module doesn't look like it be possible without evaluating the config in a separate instance.

You can do it with this:

{
  options.security.pam.services = mkOption {
    type = types.loaOf (types.submodule {
      config.text = mkDefault (mkAfter "Some text after everything else");
    });
  };
}

I guess it's hard to figure this out though.

Ah, that makes sense! Thanks a lot, I guess that obviates this PR then.