sudo -> doas

host/nix.nix

@@ -13,6 +13,5 @@
     trusted-users = [ "root" ];
     auto-optimise-store = true;
   };
-
   nixpkgs.config.allowUnfree = false;
 }

host/roam/default.nix

@@ -9,6 +9,13 @@
     ./services.nix
   ];
 
+  security = {
+    acme = {
+      acceptTerms = true;
+      defaults.email = "acme@henri-dohmen.de";
+    };
+  };
+
   # ====== DON'T CHANGE ======
   system.stateVersion = "24.11";
 }

host/roam/security.nix

@@ -1,9 +0,0 @@
-{ ... }:
-{
-  security = {
-    acme = {
-      acceptTerms = true;
-      defaults.email = "acme@henri-dohmen.de";
-    };
-  };
-}

mod/desktop/default.nix

@@ -15,9 +15,10 @@ in
     ./fonts.nix
     ./gpg.nix
     ./network.nix
+    ./security.nix
     ./services.nix
-    ./window-manager.nix
     ./software
+    ./window-manager.nix
     inputs.nixos-config-hidden.nixosModules.pc
     inputs.home-manager.nixosModules.home-manager
     {
@@ -45,6 +46,7 @@ in
       fonts.enable = true;
       gpg.enable = true;
       network.enable = true;
+      security.enable = true;
       services.enable = true;
       software.enable = true;
       wm.enable = true;
@@ -70,7 +72,5 @@ in
       home.stateVersion = config.system.stateVersion;
       imports = [ ../../mod-hm ];
     };
-
-    security.protectKernelImage = true;
   };
 }

mod/desktop/security.nix

@@ -0,0 +1,28 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.desktop.security;
+  inherit (lib) mkEnableOption mkIf;
+in
+{
+  options.desktop.security.enable = mkEnableOption "Security";
+  config = mkIf cfg.enable {
+    security.protectKernelImage = true;
+
+    security.sudo.enable = false;
+    security.doas = {
+      enable = true;
+      extraRules = [
+        {
+          groups = [ "wheel" ];
+          persist = true;
+          keepEnv = true;
+        }
+      ];
+    };
+  };
+}