From 76f5b40db74732b9afe73e1ff97a8575dfd6c972 Mon Sep 17 00:00:00 2001
From: Colin Hooper <chopper2000uk@gmail.com>
Date: Tue, 3 Jun 2025 16:20:28 +0100
Subject: [PATCH] nixos/pam: add zfs.mountRecursively option

---
 nixos/modules/security/pam.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/nixos/modules/security/pam.nix b/nixos/modules/security/pam.nix
index ad4e32e82561..c1b134717d4f 100644
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@@ -994,6 +994,7 @@ let
                       modulePath = "${config.boot.zfs.package}/lib/security/pam_zfs_key.so";
                       settings = {
                         inherit (config.security.pam.zfs) homes;
+                        mount_recursively = config.security.pam.zfs.mountRecursively;
                       };
                     }
                     {
@@ -1183,6 +1184,7 @@ let
                 modulePath = "${config.boot.zfs.package}/lib/security/pam_zfs_key.so";
                 settings = {
                   inherit (config.security.pam.zfs) homes;
+                  mount_recursively = config.security.pam.zfs.mountRecursively;
                 };
               }
               {
@@ -1343,6 +1345,7 @@ let
                 settings = {
                   inherit (config.security.pam.zfs) homes;
                   nounmount = config.security.pam.zfs.noUnmount;
+                  mount_recursively = config.security.pam.zfs.mountRecursively;
                 };
               }
               {
@@ -2176,6 +2179,14 @@ in
           Do not unmount home dataset on logout.
         '';
       };
+
+      mountRecursively = lib.mkOption {
+        default = false;
+        type = lib.types.bool;
+        description = ''
+          Mount child datasets of home dataset.
+        '';
+      };
     };
 
     security.pam.enableEcryptfs = lib.mkEnableOption "eCryptfs PAM module (mounting ecryptfs home directory on login)";