From 8c03fdb04abf3ed09b15eeb091456d8060169369 Mon Sep 17 00:00:00 2001
From: s0me1newithhand7s <git+me@hand7s.org>
Date: Sun, 3 May 2026 15:48:57 +0300
Subject: [PATCH] kyra(hardening): sudo -> sudo-rs

Signed-off-by: s0me1newithhand7s <git+me@hand7s.org>
---
 kyra/security/sudo-rs.nix | 9 +++++++++
 kyra/security/sudo.nix    | 7 +++++++
 2 files changed, 16 insertions(+)
 create mode 100644 kyra/security/sudo-rs.nix
 create mode 100644 kyra/security/sudo.nix

diff --git a/kyra/security/sudo-rs.nix b/kyra/security/sudo-rs.nix
new file mode 100644
index 0000000..4f270c9
--- /dev/null
+++ b/kyra/security/sudo-rs.nix
@@ -0,0 +1,9 @@
+_: {
+  security = {
+    sudo-rs = {
+      enable = true;
+      wheelNeedsPassword = true;
+      execWheelOnly = true;
+    };
+  };
+}
diff --git a/kyra/security/sudo.nix b/kyra/security/sudo.nix
new file mode 100644
index 0000000..393528d
--- /dev/null
+++ b/kyra/security/sudo.nix
@@ -0,0 +1,7 @@
+{lib, ...}: {
+  security = {
+    sudo = {
+      enable = lib.mkDefault false;
+    };
+  };
+}