sudo -> doas

mod/desktop/default.nix

@@ -15,9 +15,10 @@ in
     ./fonts.nix
     ./gpg.nix
     ./network.nix
+    ./security.nix
     ./services.nix
-    ./window-manager.nix
     ./software
+    ./window-manager.nix
     inputs.nixos-config-hidden.nixosModules.pc
     inputs.home-manager.nixosModules.home-manager
     {
@@ -45,6 +46,7 @@ in
       fonts.enable = true;
       gpg.enable = true;
       network.enable = true;
+      security.enable = true;
       services.enable = true;
       software.enable = true;
       wm.enable = true;
@@ -70,7 +72,5 @@ in
       home.stateVersion = config.system.stateVersion;
       imports = [ ../../mod-hm ];
     };
-
-    security.protectKernelImage = true;
   };
 }

mod/desktop/security.nix

@@ -0,0 +1,28 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.desktop.security;
+  inherit (lib) mkEnableOption mkIf;
+in
+{
+  options.desktop.security.enable = mkEnableOption "Security";
+  config = mkIf cfg.enable {
+    security.protectKernelImage = true;
+
+    security.sudo.enable = false;
+    security.doas = {
+      enable = true;
+      extraRules = [
+        {
+          groups = [ "wheel" ];
+          persist = true;
+          keepEnv = true;
+        }
+      ];
+    };
+  };
+}