nanuqsaurus/modules/system/security.nix

{ lib, pkgs, ... }:

{
  security.sudo = {
    enable = lib.mkDefault true;
    wheelNeedsPassword = lib.mkForce false;
  };

  security.rtkit.enable = true;

  users.users.root = lib.mkDefault {
    shell = pkgs.zsh;
    extraGroups = [
      "networkmanager"
      "wheel"
    ];
    hashedPassword = lib.mkDefault "!";
    initialHashedPassword = lib.mkDefault "!";
  };
}