diff --git a/core/installer/schema.go b/core/installer/schema.go
index c7f7196..b48217f 100644
--- a/core/installer/schema.go
+++ b/core/installer/schema.go
@@ -25,6 +25,7 @@
 	KindPort              = 9
 	KindVPNAuthKey        = 11
 	KindCluster           = 12
+	KindPassword          = 13
 )
 
 type Field struct {
@@ -305,7 +306,10 @@
 	}
 	switch v.IncompleteKind() {
 	case cue.StringKind:
-		if role == "vpnauthkey" {
+		if role == "password" {
+			// TODO(gio): implement configurable requirements such as min-length, ...
+			return basicSchema{name, KindPassword, false, nil}, nil
+		} else if role == "vpnauthkey" {
 			meta := map[string]string{}
 			usernameFieldAttr := v.Attribute("usernameField")
 			if usernameFieldAttr.Err() == nil {