From 8b5e5079e5fd00eadf2e3926c104e4ecf99a5779 Mon Sep 17 00:00:00 2001
From: Fuwn <contact@fuwn.me>
Date: Wed, 4 Sep 2024 19:57:20 -0700
Subject: refac

---
 modules/security/sudo.nix | 76 ++++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 72 insertions(+), 4 deletions(-)

(limited to 'modules/security/sudo.nix')

diff --git a/modules/security/sudo.nix b/modules/security/sudo.nix
index 5c79eaf..6623b71 100644
--- a/modules/security/sudo.nix
+++ b/modules/security/sudo.nix
@@ -1,7 +1,75 @@
+{ pkgs, lib, ... }:
+let
+  inherit (lib.modules) mkForce;
+in
 {
-  security.sudo = {
-    enable = true;
-    execWheelOnly = true;
-    wheelNeedsPassword = false;
+  security = {
+    sudo-rs.enable = mkForce false;
+
+    sudo = {
+      enable = true;
+      execWheelOnly = mkForce true;
+      wheelNeedsPassword = lib.modules.mkDefault false;
+
+      extraConfig = ''
+        Defaults lecture = never
+        Defaults pwfeedback
+        Defaults env_keep += "EDITOR PATH DISPLAY"
+        Defaults timestamp_timeout = 300
+      '';
+
+      extraRules = [
+        {
+          groups = [ "wheel" ];
+          commands =
+            map
+              (rule: {
+                command = lib.meta.getExe' rule.package rule.command;
+                options = [ "NOPASSWD" ];
+              })
+              (
+                with pkgs;
+                [
+                  {
+                    package = coreutils;
+                    command = "sync";
+                  }
+                  {
+                    package = hdparm;
+                    command = "hdparm";
+                  }
+                  {
+                    package = nixos-rebuild;
+                    command = "nixos-rebuild";
+                  }
+                  {
+                    package = nvme-cli;
+                    command = "nvme";
+                  }
+                  {
+                    package = systemd;
+                    command = "poweroff";
+                  }
+                  {
+                    package = systemd;
+                    command = "reboot";
+                  }
+                  {
+                    package = systemd;
+                    command = "shutdown";
+                  }
+                  {
+                    package = systemd;
+                    command = "systemctl";
+                  }
+                  {
+                    package = util-linux;
+                    command = "dmesg";
+                  }
+                ]
+              );
+        }
+      ];
+    };
   };
 }
-- 
cgit v1.2.3