sudo.nix: initial config

flake.lock

@@ -786,22 +786,6 @@
         "type": "github"
       }
     },
-    "nixos-hardware": {
-      "locked": {
-        "lastModified": 1724067415,
-        "narHash": "sha256-WJBAEFXAtA41RMpK8mvw0cQ62CJkNMBtzcEeNIJV7b0=",
-        "owner": "NixOS",
-        "repo": "nixos-hardware",
-        "rev": "b09c46430ffcf18d575acf5c339b38ac4e1db5d2",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "master",
-        "repo": "nixos-hardware",
-        "type": "github"
-      }
-    },
     "nixpak": {
       "inputs": {
         "flake-parts": "flake-parts_3",
@@ -2624,7 +2608,6 @@
         "hyprland-plugins": "hyprland-plugins",
         "lix-module": "lix-module",
         "neovim-flake": "neovim-flake",
-        "nixos-hardware": "nixos-hardware",
         "nixpak": "nixpak",
         "nixpkgs": "nixpkgs_5",
         "schizofox": "schizofox",

hosts/vali/hermit/configuration.nix

@@ -1,6 +1,7 @@
 {
-  pkgs,
   config,
+  lib,
+  pkgs,
   ...
 }: {
   # Time Zone
@@ -14,6 +15,7 @@
   programs.dconf.enable = true;
   boot.kernelPackages = pkgs.linuxPackages_xanmod_latest;
   services.thermald.enable = true;
+  services.fstrim.enable = lib.mkDefault true;
 
   modules = {
     system = {

modules/other/system.nix

@@ -28,7 +28,7 @@ in {
 
     users.users.${cfg.username} = {
       isNormalUser = true;
-      extraGroups = ["wheel"];
+      extraGroups = ["wheel" "networking"];
     };
   };
 }

modules/system/default.nix

@@ -5,5 +5,6 @@ _: {
     ./hardware
     ./nix/module.nix
     ./os/networking/module.nix
+    ./os/security/module.nix
   ];
 }

modules/system/os/security/module.nix

@@ -0,0 +1,5 @@
+_: {
+  imports = [
+    ./sudo.nix
+  ];
+}

modules/system/os/security/sudo.nix

@@ -0,0 +1,21 @@
+{
+  lib,
+  pkgs,
+}: let
+  inherit (lib) mkForce mkDefault;
+in {
+  security = {
+    sudo-rs.enable = mkForce false;
+    sudo = {
+      enable = true;
+      # We use the default sudo package
+      package = pkgs.sudo;
+
+      # Wheel user should need the password to execute sudo commands
+      wheelNeedsPassword = mkDefault true;
+
+      # BUT, only wheel users should be able to use sudo.
+      execWheelOnly = mkForce true;
+    };
+  };
+}