For a while, I’ve used users.users.*.hashedPasswordFile with users.mutableUsers = true to minimize configuration drift. However, as far as I could tell, no one had created a convenient way to set or change these passwords, so I wrote a quick and dirty script and called it a day.
More recently, I was reworking this script and realized I could decouple it completely from my config, spin it off into its own project, and polish it up so other people could benefit from it.
The result is hpf-passwd. Currently, it’s a single script that mainly just lets you change the password of a given user account, provided it has users.users.<username>.hashedPasswordFile set.
Befitting its name, it tries to mimic passwd’s semantics to try to be intuitive. However, it can never be a 1:1 drop-in replacement. As far as I am aware, there is no way to set things like expiration dates for passwords managed like this.
I plan to eventually add some more features, like a chpasswd-style script, and features that ensure all the users with hashedPasswordFile have a password set to help with bootstrapping, but it’s currently pretty barebones. However, it is enough for my personal needs at the moment and so I figure it is a good time to get some more eyes on it.