first commit

README.md

@@ -0,0 +1,71 @@
+# NixOS dotfiles
+
+## Structure des fichiers
+
++ hosts
+|   |
+|   + generic <- Iso minimal pour nixos-anywhere
+|   |
+|   + myhost <- Tout ce qui est unique à une machine vient ici
+|
++ modules
+|   |
+|   + core <- Modules partagés entre toutes les machines
+|   |
+|   + optionnal <- Modules pour au moins deux machines
+|
++ flake.nix
+|
++ custom.iso
+
+Si un seul fichier nix, pas de sous dossier (openfortivpn)
+Si plusieurs fihchiers nix, un sous dossier (ex desktop)
+
+## Workflow
+
+1. Création d'une iso (push en ligne pour kexec)
+2. Copie de l'iso sur le repo
+3. nixos-anywhere (pour déployer une install minimale)
+4. copie du disk-config.nix et du hardware-config.nix dans le dossier host qui va bien
+5. deploy-rs pour push une config sur une image generic ou maj existant.
+
+## Création d'une iso
+
+```
+nixos-generate --format iso --configuration ./customiso.nix -o ~/Downloads/nixos.iso
+```
+
+si on veut utiliser kexec, il faut pousser l'iso en ligne pour que le serveur cible puisse la télécharger.
+
+## Nixos anywhere
+
+On ajoute à `~/.ssh/config`
+
+```
+nixos-anywhere --flake .#generic --target-host root@192.168.122.204 -i ~/.ssh/id_ed25519_beastie --generate-hardware-config nixos-generate-config ./hosts/generic/hardware-configuration.nix
+```
+
+si l'installation est en local, on peux créer le partitionnement avec la commande suivante :
+```
+sudo nix --experimental-features "nix-command flakes" run github:nix-community/disko/latest -- --yes-wipe-all-disks --mode destroy,format,mount ./disko.nix
+```
+et faire une installation standard.
+Le mieux est de download le repo et de faire un nixos-anywhere en ssh sur localhost ou depuis un autre pc
+
+Une fois la manipulation finie, on copie `hosts/generic` dans `hosts/hostname`. Ainsi, on garde le bon `disk-config.nix` et `hardware-configuration.nix`
+
+## déployer la bonne configuration
+
+Avant de déployer la configuration, il faut ajouter la clé sops-nix
+
+```
+
+```
+
+On édite `hosts/hostname/default.nix` et on inclus les bons modules.
+
+On lance le rebuild :
+
+```
+nixos-rebuild switch --flake ~/dev#test-kvm --target-host beastie@192.168.122.204 --sudo
+```

flake.lock

@@ -0,0 +1,88 @@
+{
+  "nodes": {
+    "disko": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1752718651,
+        "narHash": "sha256-PkaR0qmyP9q/MDN3uYa+RLeBA0PjvEQiM0rTDDBXkL8=",
+        "owner": "nix-community",
+        "repo": "disko",
+        "rev": "d5ad4485e6f2edcc06751df65c5e16572877db88",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "disko",
+        "type": "github"
+      }
+    },
+    "mysecrets": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1753141577,
+        "narHash": "sha256-MNbm7KCEqML5l72GppVoxXX03UtVGIzUsgaW+A+FBDQ=",
+        "ref": "main",
+        "rev": "c1edf4983cba959f93daa9c7ef0c1acbd958c755",
+        "shallow": true,
+        "type": "git",
+        "url": "ssh://gitea@git.unixyourbrain.org/beastie/nixos-secrets.git"
+      },
+      "original": {
+        "ref": "main",
+        "shallow": true,
+        "type": "git",
+        "url": "ssh://gitea@git.unixyourbrain.org/beastie/nixos-secrets.git"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1752364307,
+        "narHash": "sha256-o0Cm4fhz/ukV/excbnwkRB2sqknenkb/0T4pcgXjrp0=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "b6071be3c0d9404113988e5e253eb6d71d1ddbef",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "disko": "disko",
+        "mysecrets": "mysecrets",
+        "nixpkgs": "nixpkgs",
+        "sops-nix": "sops-nix"
+      }
+    },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1752544651,
+        "narHash": "sha256-GllP7cmQu7zLZTs9z0J2gIL42IZHa9CBEXwBY9szT0U=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "2c8def626f54708a9c38a5861866660395bb3461",
+        "type": "github"
+      },
+      "original": {
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,56 @@
+{
+  description = "A very basic flake";
+
+  inputs = {
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
+
+    disko = {
+      url = "github:nix-community/disko";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    sops-nix = {
+      url = "github:Mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
+    mysecrets = {
+      url = "git+ssh://gitea@git.unixyourbrain.org/beastie/nixos-secrets.git?ref=main&shallow=1";
+      flake = false;
+    };
+  };
+
+  outputs =
+    { ... }@inputs:
+    let
+      mkSystem =
+        pkgs: system: hostname: username:
+        pkgs.lib.nixosSystem {
+          # inherit system;
+          pkgs = import pkgs {
+            inherit system;
+            config.allowUnfree = true;
+          };
+          specialArgs = {
+            inherit hostname username inputs;
+          };
+          modules = [
+            # General configuration, for all machines
+            inputs.sops-nix.nixosModules.sops
+            inputs.disko.nixosModules.disko
+            ./hosts/${hostname}
+          ];
+        };
+
+    in
+    {
+      nixosConfigurations = {
+        #nixos-anywhere -- --flake './#generic' --generate-hardware-config nixos-generate-config ./hosts/generic/hardware-configuration.nix --target-host beastie@192.168.122.204
+        generic = mkSystem inputs.nixpkgs "x86_64-linux" "generic" "beastie";
+        test-kvm = mkSystem inputs.nixpkgs "x86_64-linux" "test-kvm" "beastie";
+        # live-usb = mkSystem inputs.nixpkgs "x86_64-linux" "live-usb" "beastie";
+        #nixos-rebuild switch --flake ./#home-nix --sudo
+        #home-nix = mkSystem inputs.nixpkgs "x86_64-linux" "home-nix" "beastie";
+      };
+    };
+}

hosts/generic/default.nix

@@ -0,0 +1,88 @@
+{
+  pkgs,
+  username,
+  hostname,
+  ...
+}:
+{
+  imports = [
+    ./disk-config.nix
+    ./hardware-configuration.nix
+    ../../modules/core/grub.nix
+    ../../modules/optionnal/sops-desktop.nix
+  ];
+
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+
+  time.timeZone = "Europe/Paris";
+
+  nix = {
+    settings = {
+      ## Enable flakes
+      experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
+      ## Users trusted to use flake command
+      trusted-users = [
+        "root"
+        "${username}"
+      ];
+    };
+  };
+
+  users.users = {
+    ${username} = {
+      isNormalUser = true;
+      createHome = true;
+      description = "Admin account";
+      extraGroups = [
+        "wheel"
+      ];
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAKMJ3TkEmRQcX7RQijNa2km6a2xXJk6M6FERh7C9nTJ"
+      ];
+    };
+    root = {
+      password = null;
+    };
+  };
+
+  system.activationScripts.setup-ssh-keys = {
+    text = ''
+      mkdir -p /home/${username}/.ssh
+      chown ${username}:users /home/${username}/.ssh
+      chmod 700 /home/${username}/.ssh
+    '';
+  };
+
+  security.sudo = {
+    enable = true;
+    extraRules = [
+      {
+        users = [ "${username}" ];
+        host = "ALL";
+        runAs = "ALL:ALL";
+        commands = [
+          {
+            command = "ALL";
+            options = [ "NOPASSWD" ];
+          }
+        ];
+      }
+    ];
+    #extraConfig = "#includedir /etc/sudoers.d";
+  };
+  environment.systemPackages = [
+    pkgs.neovim
+    pkgs.git
+    pkgs.curl
+    pkgs.nixos-anywhere
+    pkgs.nixos-generators
+  ];
+
+  services.openssh.enable = true;
+
+  networking.hostName = "${hostname}";
+  system.stateVersion = "25.11";
+}

hosts/generic/disk-config.nix

@@ -0,0 +1,36 @@
+{
+  ...
+}:
+{
+  disko.devices = {
+    disk = {
+      main = {
+        type = "disk";
+        device = "/dev/vda";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "512M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+              };
+            };
+            root = {
+              size = "100%";
+              type = "8300";
+              content = {
+                type = "filesystem";
+                format = "btrfs";
+                mountpoint = "/";
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/generic/hardware-configuration.nix

@@ -0,0 +1,17 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sr_mod" "virtio_blk" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

hosts/test-kvm/default.nix

@@ -0,0 +1,44 @@
+{
+  pkgs,
+  username,
+  hostname,
+  modulesPath,
+  inputs,
+  ...
+}:
+let
+in
+{
+  imports = builtins.trace "${inputs.mysecrets}" [
+    (modulesPath + "/installer/scan/not-detected.nix")
+    ./disk-config.nix
+    ./hardware-configuration.nix
+    ../../modules/core
+    ../../modules/optionnal/hosts/${hostname}.nix
+  ];
+
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+
+  time.timeZone = "Europe/Paris";
+
+  nix = {
+    settings = {
+      ## Enable flakes
+      experimental-features = [
+        "nix-command"
+        "flakes"
+      ];
+      ## Users trusted to use flake command
+      trusted-users = [
+        "root"
+        "${username}"
+      ];
+    };
+  };
+
+  services.openssh.enable = true;
+
+  networking.hostName = "${hostname}";
+
+  system.stateVersion = "25.11";
+}

hosts/test-kvm/disk-config.nix

@@ -0,0 +1,36 @@
+{
+  ...
+}:
+{
+  disko.devices = {
+    disk = {
+      main = {
+        type = "disk";
+        device = "/dev/vda";
+        content = {
+          type = "gpt";
+          partitions = {
+            ESP = {
+              size = "512M";
+              type = "EF00";
+              content = {
+                type = "filesystem";
+                format = "vfat";
+                mountpoint = "/boot";
+              };
+            };
+            root = {
+              size = "100%";
+              type = "8300";
+              content = {
+                type = "filesystem";
+                format = "btrfs";
+                mountpoint = "/";
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/test-kvm/hardware-configuration.nix

@@ -0,0 +1,29 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}:
+
+{
+  imports = [
+    (modulesPath + "/profiles/qemu-guest.nix")
+  ];
+
+  boot.initrd.availableKernelModules = [
+    "ahci"
+    "xhci_pci"
+    "virtio_pci"
+    "sr_mod"
+    "virtio_blk"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

iso/config/nvim/init.lua

@@ -0,0 +1,102 @@
+vim.g.mapleader = " "
+vim.opt.title = true
+vim.opt.mouse = ""
+vim.opt.wrap = true
+vim.opt.fileencoding = "utf-8"
+vim.opt.clipboard = "unnamedplus"
+vim.opt.completeopt = { "menu", "menuone", "preview", "noselect" }
+vim.opt.termguicolors = false
+vim.opt.laststatus = 3
+--- Search
+vim.opt.ignorecase = true
+vim.opt.smartcase = true
+--- Numbers
+vim.opt.number = true
+vim.opt.relativenumber = true
+--- Tab Options
+vim.opt.smartindent = true
+vim.opt.smarttab = true
+vim.opt.expandtab = true
+vim.opt.tabstop = 2
+vim.opt.shiftwidth = 2
+vim.opt.softtabstop = 2
+vim.opt.showtabline = 2
+--- Explorer
+vim.g.netrw_banner = 0
+vim.g.netrw_browse_split = 4
+vim.g.netrw_altv = 1
+vim.g.netrw_liststyle = 3
+vim.g.netrw_winsize = 20
+vim.opt.scrolloff = 6
+vim.opt.sidescrolloff = 8
+--- Swapfile
+vim.opt.swapfile = false
+vim.opt.backup = false
+--- Keymap
+-- Resource
+vim.keymap.set("n", "<leader>r", ":source ~/.config/nvim/init.lua<cr>")
+-- Explorer
+vim.keymap.set("n", "<C-e>", ":Lexplore<cr>")
+-- Windows
+vim.keymap.set("n", "<C-Left>", "<C-w>h")
+vim.keymap.set("n", "<C-Right>", "<C-w>l")
+vim.keymap.set("n", "<C-Up>", "<C-w>k")
+vim.keymap.set("n", "<C-Down>", "<C-w>j")
+-- Resize
+vim.keymap.set("n", "-", ":vertical resize -3<cr>")
+vim.keymap.set("n", "+", ":vertical resize +3<cr>")
+-- Buffer
+vim.keymap.set("n", "<Tab>", ":buffer ")
+-- Tabs
+vim.keymap.set("n", "<leader>tn", ":tabnew<cr>")
+vim.keymap.set("n", "<leader>tc", ":tabclose<cr>")
+vim.keymap.set("n", "<S-Tab>", ":tabnext<cr>")
+-- Cheatsheet
+vim.keymap.set("n", "<C-s>", ":terminal ~/.config/nvim/nvim_help.sh<cr>i")
+-- No highlight
+vim.keymap.set("n", "<leader>nh", ":nohl<cr>")
+
+--- Automaticly close brackets
+vim.keymap.set("i", "'", "''<Left>")
+vim.keymap.set("i", "\"", "\"\"<Left>")
+vim.keymap.set("i", "(", "()<Left>")
+vim.keymap.set("i", "{", "{}<Left>")
+vim.keymap.set("i", "[", "[]<Left>")
+
+--- Statusline
+vim.cmd("highlight StatusNormal ctermbg=blue ctermfg=black")
+vim.cmd("highlight StatusModified ctermbg=red ctermfg=black")
+vim.cmd("highlight StatusGitBranch ctermbg=yellow ctermfg=black")
+vim.cmd("highlight StatusGitDiffAdd ctermbg=green ctermfg=black")
+vim.cmd("highlight StatusGitdiffRemove ctermbg=red ctermfg=black")
+
+local function command(cmd)
+  local handle = io.popen(cmd)
+  local result = handle:read()
+  handle:close()
+  return result or ""
+end
+
+vim.o.statusline = "%#StatusNormal# "
+    .. "%#StatusGitBranch#"
+    .. command("git branch 2> /dev/null | sed -e 's/..//'")
+    .. "%#StatusNormal# "
+    .. "%#StatusGitDiffAdd#"
+    .. command("git diff --numstat | awk '{print \"+\"$1}'")
+    .. "%#StatusNormal# "
+    .. "%#StatusGitDiffRemove#"
+    .. command("git diff --numstat | awk '{print \"-\"$2}'")
+    .. "%#StatusNormal# "
+    .. ">>"
+    .. " %F "
+    .. "%#StatusModified#"
+    .. "%M"
+    .. "%#StatusNormal#"
+    .. " >>"
+    .. "%="
+    .. "<<"
+    .. " %Y "
+    .. "<<"
+    .. " %l,%c "
+    .. "<<"
+    .. " %p%% "

iso/customiso.nix

@@ -0,0 +1,87 @@
+{
+  pkgs,
+  modulesPath,
+  lib,
+  ...
+}:
+{
+  imports = [
+    "${modulesPath}/installer/cd-dvd/installation-cd-minimal.nix"
+  ];
+
+  # Use the latest Linux kernel
+  boot.kernelPackages = pkgs.linuxPackages_latest;
+
+  # Create admin user
+  users.users = {
+    nixos = {
+      isNormalUser = true;
+      description = "Admin account";
+      extraGroups = [
+        "wheel"
+      ];
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAKMJ3TkEmRQcX7RQijNa2km6a2xXJk6M6FERh7C9nTJ"
+      ];
+    };
+    root = {
+      password = null;
+      openssh.authorizedKeys.keys = [
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAKMJ3TkEmRQcX7RQijNa2km6a2xXJk6M6FERh7C9nTJ"
+      ];
+    };
+  };
+
+  services.openssh = {
+    enable = true;
+    settings = {
+      PermitRootLogin = "prohibit-password";
+    };
+  };
+
+  # Allow sudo from admin user without password
+  security.sudo = {
+    enable = true;
+    extraRules = [
+      {
+        users = [ "nixos" ];
+        host = "ALL";
+        runAs = "ALL:ALL";
+        commands = [
+          {
+            command = "ALL";
+            options = [ "NOPASSWD" ];
+          }
+        ];
+      }
+    ];
+  };
+
+  # Packages for maintenance mode
+  environment.systemPackages = [
+    pkgs.neovim
+    pkgs.git
+    pkgs.curl
+    pkgs.nixos-anywhere
+    pkgs.nixos-generators
+  ];
+
+  # Needed for https://github.com/NixOS/nixpkgs/issues/58959
+  boot.supportedFilesystems = lib.mkForce [
+    "btrfs"
+    "reiserfs"
+    "vfat"
+    "f2fs"
+    "xfs"
+    "ntfs"
+    "cifs"
+    "nfs"
+  ];
+
+  environment.etc."xdg/nvim/init.lua" = {
+    source = ./config/nvim/init.lua;
+    mode = "0440";
+  };
+}
+
+# Config nvim

modules/core/default.nix

@@ -0,0 +1,10 @@
+{
+  ...
+}:
+{
+  imports = [
+    ./grub.nix
+    ./packages.nix
+    ./users.nix
+  ];
+}

modules/core/grub.nix

@@ -0,0 +1,18 @@
+{
+  ...
+}:
+{
+  ## Configure boot loader
+  boot.loader = {
+    # Use grub without NVRAM
+    grub = {
+      enable = true;
+      efiSupport = true;
+      device = "nodev";
+      efiInstallAsRemovable = true;
+      useOSProber = true;
+    };
+    # Do not edit NVRAM
+    efi.canTouchEfiVariables = false;
+  };
+}

modules/core/packages.nix

@@ -0,0 +1,19 @@
+{
+  pkgs,
+  ...
+}:
+{
+  environment.systemPackages = [
+    pkgs.curl
+    pkgs.pciutils
+    # pkgs.clinfo <- IDC info, move to GPU
+    pkgs.git
+    pkgs.htop
+    pkgs.killall
+    pkgs.bind
+    pkgs.git
+    pkgs.neovim
+    pkgs.unzip
+
+  ];
+}

modules/core/users.nix

@@ -0,0 +1,27 @@
+{
+  config,
+  username,
+  ...
+}:
+{
+  users = {
+    users = {
+      ${username} = {
+        isNormalUser = true;
+        createHome = true;
+        hashedPasswordFile = config.sops.secrets."users_password/beastie".path;
+        description = "Admin account";
+        extraGroups = [
+          "wheel"
+        ];
+        openssh.authorizedKeys.keys = [
+          "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAKMJ3TkEmRQcX7RQijNa2km6a2xXJk6M6FERh7C9nTJ"
+        ];
+      };
+      root = {
+        password = null;
+      };
+    };
+    mutableUsers = false;
+  };
+}

modules/optionnal/hosts/test-kvm.nix

@@ -0,0 +1,9 @@
+{
+  ...
+}:
+{
+  imports = [
+    ../sops-desktop.nix
+    ../sudo-nopasswd.nix
+  ];
+}

modules/optionnal/sops-desktop.nix

@@ -0,0 +1,68 @@
+{
+  inputs,
+  username,
+  ...
+}:
+let
+  secretsPath = builtins.toString inputs.mysecrets;
+in
+{
+  sops = {
+    defaultSopsFile = "${secretsPath}/secrets.yaml";
+    age = {
+      sshKeyPaths = [
+        "/etc/ssh/ssh_host_ed25519_key"
+      ];
+      keyFile = "/var/lib/sops-nix/key.txt";
+      generateKey = true;
+    };
+
+    secrets = {
+      "ldap_password/beastie" = {
+      };
+      "users_password/beastie" = {
+        neededForUsers = true;
+      };
+      "ssh_keys/default_pub" = {
+        owner = "${username}";
+        mode = "0644";
+        path = "/home/${username}/.ssh/id_ed25519.pub";
+      };
+      "ssh_keys/default_priv" = {
+        owner = "${username}";
+        mode = "0600";
+        path = "/home/${username}/.ssh/id_ed25519";
+      };
+      "ssh_keys/ansible_pub" = {
+        owner = "${username}";
+        mode = "0644";
+        path = "/home/${username}/.ssh/id_ed25519_ansible.pub";
+      };
+      "ssh_keys/ansible_priv" = {
+        owner = "${username}";
+        mode = "0600";
+        path = "/home/${username}/.ssh/id_ed25519_ansible";
+      };
+      "ssh_keys/beastie_pub" = {
+        owner = "${username}";
+        mode = "0644";
+        path = "/home/${username}/.ssh/id_ed25519_beastie.pub";
+      };
+      "ssh_keys/beastie_priv" = {
+        owner = "${username}";
+        mode = "0600";
+        path = "/home/${username}/.ssh/id_ed25519_beastie";
+      };
+      "ssh_keys/gitea_semaphore_pub" = {
+        owner = "${username}";
+        mode = "0644";
+        path = "/home/${username}/.ssh/id_ed25519_gitea_semaphore.pub";
+      };
+      "ssh_keys/gitea_semaphore_priv" = {
+        owner = "${username}";
+        mode = "0600";
+        path = "/home/${username}/.ssh/id_ed25519_gitea_semaphore";
+      };
+    };
+  };
+}

modules/optionnal/sudo-nopasswd.nix

@@ -0,0 +1,24 @@
+{
+  username,
+  ...
+}:
+{
+  # https://dev.to/patimapoochai/how-to-edit-the-sudoers-file-in-nixos-with-examples-4k34
+  security.sudo = {
+    enable = true;
+    extraRules = [
+      {
+        users = [ "${username}" ];
+        host = "ALL";
+        runAs = "ALL:ALL";
+        commands = [
+          {
+            command = "ALL";
+            options = [ "NOPASSWD" ];
+          }
+        ];
+      }
+    ];
+    #extraConfig = "#includedir /etc/sudoers.d";
+  };
+}