feat(sudo): add sane rules

2026-06-17 15:24:39 +02:00 · 2026-05-28 10:24:22 +02:00
parent 38d8c0118f
commit 5e794db02a
1 changed files with 37 additions and 4 deletions
@@ -1,9 +1,42 @@
 { currentSystemUser, ... }:
+let
+  swBin = "/run/current-system/sw/bin";
+  wrappersBin = "/run/wrappers/bin";
+in
 {
-  security.sudo.extraConfig = ''
-    		Defaults pwfeedback
-        		Defaults timestamp_timeout=120
-    	'';
+  security.sudo = {
+    extraConfig = ''
+      Defaults pwfeedback
+      Defaults timestamp_timeout=120
+    '';
+    extraRules = [
+      {
+        groups = [ "wheel" ];
+        commands = [
+          {
+            command = "${swBin}/shutdown";
+            options = [ "NOPASSWD" ];
+          }
+          {
+            command = "${swBin}/reboot";
+            options = [ "NOPASSWD" ];
+          }
+          {
+            command = "${swBin}/poweroff";
+            options = [ "NOPASSWD" ];
+          }
+          {
+            command = "${wrappersBin}/mount";
+            options = [ "NOPASSWD" ];
+          }
+          {
+            command = "${wrappersBin}/umount";
+            options = [ "NOPASSWD" ];
+          }
+        ];
+      }
+    ];
+  };
  sops = {
    age.sshKeyPaths = [
      "/etc/ssh/ssh_host_ed25519_key"