cleanup nas I think or something

2025-08-27 12:03:53 -05:00
parent 83f8b3543c
commit 6c6d6325c9
23 changed files with 357 additions and 512 deletions
--- a/modules/nixos/security/common/default.nix
+++ b/modules/nixos/security/common/default.nix
@@ -0,0 +1,54 @@
+{ lib, pkgs, ... }:
+{
+  security = {
+    rtkit.enable = lib.mkDefault true;
+
+    pam.u2f = {
+      enable = true;
+      settings.cue = true;
+    };
+
+    # configure sudo
+    sudo.enable = lib.mkDefault false;
+    sudo-rs = {
+      enable = lib.mkDefault true;
+      extraRules = [
+        {
+          commands = [
+            {
+              command = "${pkgs.systemd}/bin/systemctl suspend";
+              options = [ "NOPASSWD" ];
+            }
+            {
+              command = "${pkgs.systemd}/bin/reboot";
+              options = [ "NOPASSWD" ];
+            }
+            {
+              command = "${pkgs.systemd}/bin/poweroff";
+              options = [ "NOPASSWD" ];
+            }
+          ];
+          groups = [ "wheel" ];
+        }
+      ];
+    };
+  };
+
+  environment.systemPackages = with pkgs; [
+    age-plugin-yubikey
+    yubikey-manager
+    yubikey-personalization
+    yubioath-flutter
+  ];
+
+  services = {
+    yubikey-agent.enable = true;
+    pcscd.enable = true;
+  };
+
+  programs = {
+    yubikey-touch-detector = {
+      enable = true;
+    };
+  };
+}