modules/common/security.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

_: {
  security = {
    sudo = {
      enable = true;
      execWheelOnly = true;
      wheelNeedsPassword = false;
      extraConfig = ''
        Defaults lecture=never
      '';
    };

    polkit = {
      enable = true;
      extraConfig = ''
        /*
         * Allow members of the wheel group to execute any actions
         * without password authentication, similar to "sudo NOPASSWD:".
         *
         * https://wiki.archlinux.org/title/Polkit#Bypass_password_prompt
         */
        polkit.addRule(function(action, subject) {
          if (subject.isInGroup('wheel'))
            return polkit.Result.YES;
        });
      '';
    };

    # Pretty much used only for PipeWire.
    rtkit.enable = true;
  };
}