ultima/modules/nixos/hardware/security/default.nix

{ pkgs, lib, config, userName, True, False, ... }:

with lib;

let cfg = config.module.hardware.security;
in {
  options = { module.hardware.security = { enable = mkEnableOption ""; }; };

  config = mkIf cfg.enable {
    security = {
      sudo = False;
      sudo-rs = True // { # TOP
        execWheelOnly = true;
        wheelNeedsPassword = true;
        extraRules = [{
          users = [ userName ];
          commands = with pkgs; [
            {
              command = "${light}/bin/light";
              options = [ "NOPASSWD" ];
            }
            {
              command = "${uutils-coreutils-noprefix}/bin/tee";
              options = [ "NOPASSWD" ];
            }
          ];
        }];
      };
    };
  };
}