Hello folks 👋

I’m trying to deploy user passwords declaratively with sops-nix, but before moving to sops-nix, I’d like to at least manage user passwords declaratively in a basic way.

I started with something like:

users.users.cris = {
  isNormalUser = true;
  password = "changeme";
};

I can SSH into the machine and then su cris using the "changeme" password without issues.

Later, I change it to:

users.users.cris = {
  isNormalUser = true;
  password = "somethingelse";
};

I deploy using deploy-rs, but when I SSH into the machine and run su cris, the password remains the old "changeme", not the new "somethingelse".

Why does this happen? Is this expected behavior in NixOS? Where does this behavior come from?
Thanks in advance!