nixos/pam: rename updateWtmp to lastlog.enable, add silent option

nixos/modules/programs/shadow.nix

@@ -254,7 +254,7 @@ in
           startSession = true;
           allowNullPassword = true;
           showMotd = true;
-          updateWtmp = true;
+          lastlog.enable = true;
         };
         chpasswd.rootOK = true;
       };

nixos/modules/security/pam.nix

@@ -137,6 +137,7 @@ let
       imports = [
         (lib.mkRenamedOptionModule [ "enableKwallet" ] [ "kwallet" "enable" ])
         (lib.mkRenamedOptionModule [ "u2fAuth" ] [ "u2f" "enable" ])
+        (lib.mkRenamedOptionModule [ "updateWtmp" ] [ "lastlog" "enable" ])
       ];
 
       options = {
@@ -583,10 +584,21 @@ let
           '';
         };
 
-        updateWtmp = lib.mkOption {
-          default = false;
-          type = lib.types.bool;
-          description = "Whether to update {file}`/var/log/wtmp`.";
+        lastlog = {
+          enable = lib.mkOption {
+            default = false;
+            type = lib.types.bool;
+            description = "Whether to update {file}`/var/log/wtmp`.";
+          };
+
+          silent = lib.mkOption {
+            default = true;
+            example = false;
+            type = lib.types.bool;
+            description = ''
+              Whether to suppress the message showing the last login date.
+            '';
+          };
         };
 
         logFailures = lib.mkOption {
@@ -1521,11 +1533,11 @@ let
               }
               {
                 name = "lastlog";
-                enable = cfg.updateWtmp;
+                enable = cfg.lastlog.enable;
                 control = "required";
                 modulePath = "${pkgs.util-linux.lastlog}/lib/security/pam_lastlog2.so";
                 settings = {
-                  silent = true;
+                  inherit (cfg.lastlog) silent;
                 };
               }
               # Work around https://github.com/systemd/systemd/issues/8598
@@ -2549,7 +2561,7 @@ in
     environment.etc = lib.mapAttrs' makePAMService enabledServices;
 
     systemd =
-      lib.mkIf (lib.any (service: service.updateWtmp) (lib.attrValues config.security.pam.services))
+      lib.mkIf (lib.any (service: service.lastlog.enable) (lib.attrValues config.security.pam.services))
         {
           tmpfiles.packages = [ pkgs.util-linux.lastlog ]; # /lib/tmpfiles.d/lastlog2-tmpfiles.conf
           services.lastlog2-import = {

nixos/tests/pam/pam-lastlog.nix

@@ -8,7 +8,7 @@
     {
       # we abuse run0 for a quick login as root as to not require setting up accounts and passwords
       security.pam.services.systemd-run0 = {
-        updateWtmp = true; # enable lastlog
+        lastlog.enable = true;
       };
     };