feat: password change (+)

This works, however there's still stuff to do.

The configuration.nix pam stack is broken, still defaults back to
pam_unix.so if this fails.

The code is now a small mess, I need to make `Client` structs and more
separation.

And I still have to fully understand keycloak and properly use the
clients or configure them.

tests/nixos/configuration.nix

@@ -104,6 +104,11 @@ in
     groups.keycloak-login = { };
   };
 
+  environment.systemPackages = with pkgs; [
+    croc
+    neovim
+  ];
+
   services.keycloak = {
     enable = true;
     initialAdminPassword = "dontchangeme";
@@ -133,31 +138,60 @@ in
 
   security.pam.services =
     let
-      keycloakReplacesUnix = {
-        rules.auth.keycloak-pam = {
-          order = config.security.pam.services.login.rules.auth.unix.order - 10;
-          control = "sufficient";
-          modulePath = "${packages.keycloak-pam}/lib/libkeycloak_pam.so";
-          settings = {
-            debug = true;
+      modulePath = "${packages.keycloak-pam}/lib/libkeycloak_pam.so";
 
-            config = builtins.toFile "keycloak-pam.json" ''
-              {
-                "base_url": "http://127.0.0.1:${toString config.services.keycloak.settings.http-port}",
-                "default_realm": "master",
-                "client_id": "account",
-                "client_secret": "7bsrMrRuNKpqsxcOOJavWjEqek12ZCkj",
-                "unix_group": "keycloak-login"
-              }
-            '';
-          };
+      keycloakPamConfig = builtins.toFile "keycloak-pam.json" (
+        builtins.toJSON {
+          base_url = "http://127.0.0.1:${toString config.services.keycloak.settings.http-port}";
+          default_realm = "master";
+          client_id = "account";
+          client_secret = "7bsrMrRuNKpqsxcOOJavWjEqek12ZCkj";
+          unix_group = "keycloak-login";
+          admin_username = "admin";
+          admin_password = "dontchangeme";
+        }
+      );
+
+      type = {
+        auth = {
+          type = "auth";
+          control = "sufficient";
+        };
+        password = {
+          type = "password";
+          control = "sufficient";
         };
       };
+
+      settings = {
+        debug = true;
+        config = keycloakPamConfig;
+      };
+
+      mkRuleBeforeUnix =
+        { type, control }:
+        service: {
+          "${type}".keycloak-pam = {
+            order = config.security.pam.services."${service}".rules."${type}".unix.order - 10;
+            inherit modulePath settings control;
+          };
+        };
+      mkRulesBeforeUnix =
+        types: service: builtins.foldl' (rules: type: rules // mkRuleBeforeUnix type service) { } types;
+
+      mkServicesWith =
+        withfn: builtins.foldl' (attrs: service: attrs // { "${service}".rules = withfn service; }) { };
+      mkAuths = mkServicesWith (mkRuleBeforeUnix type.auth);
+      mkPasswds = mkServicesWith (mkRulesBeforeUnix [
+        type.auth
+        type.password
+      ]);
     in
-    builtins.foldl' (attrs: service: attrs // { "${service}" = keycloakReplacesUnix; }) { } [
+    mkAuths [
       "login"
-      "passwd"
       "su"
       "sudo"
-    ];
+      "passwd"
+    ]
+    // mkPasswds [ "passwd" ];
 }