From 41ea0a1af86eaab61620d2cab6d4fd4cf658f4b4 Mon Sep 17 00:00:00 2001
From: michael <operations@dangerousthings.com>
Date: Mon, 27 Apr 2026 17:29:15 -0700
Subject: [PATCH] feat(pkg): authforge-pam postinst calls pam-auth-update
 --package

---
 debian/authforge-pam.postinst | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100755 debian/authforge-pam.postinst

diff --git a/debian/authforge-pam.postinst b/debian/authforge-pam.postinst
new file mode 100755
index 0000000..0b44cce
--- /dev/null
+++ b/debian/authforge-pam.postinst
@@ -0,0 +1,24 @@
+#!/bin/sh
+# Registers /usr/share/pam-configs/authforge via pam-auth-update on first
+# install and reconfigure events. The profile ships Default: no, so this
+# is a no-op for fresh installs — the metapackage's debconf flow flips it
+# on if the admin opted in. Idempotent: safe to call repeatedly.
+set -e
+
+case "$1" in
+    configure)
+        if [ -x /usr/sbin/pam-auth-update ]; then
+            pam-auth-update --package
+        fi
+        ;;
+    abort-upgrade|abort-remove|abort-deconfigure)
+        ;;
+    *)
+        echo "postinst called with unknown argument \`$1'" >&2
+        exit 1
+        ;;
+esac
+
+#DEBHELPER#
+
+exit 0