wyswort/host/misc/security.nix

{ ... }: {
  security = {
    sudo = { # FUCKING CRAP
      enable = true;
    };
    doas = { # VERY TOP
      enable = true;
      wheelNeedsPassword = true;
      extraRules = [{
        users = [ "megamozg" ];
        keepEnv = true;
        persist = true;
      }];
      extraConfig =
        "	permit nopass megamozg as root cmd light\n	permit nopass megamozg as root cmd tee\n";
    };
    pam = { # SOMTHING WITH FPRINT
      services = { swaylock.fprintAuth = true; };
    };
    polkit = { enable = true; };
  };
}