Set users.extraUsers.bfo.password = "initialpw"

This is just the *initial* password, used when the user is created for
the first time. Existing users won't get their password updated by a
nixos-rebuild. (At least that's how it works now.)