modules/security.nix

{
  security.pam.services = {
    login.u2fAuth = true;
    sudo.u2fAuth = true;
  };

  security.pam.u2f.authFile = ../keys/u2f_mappings;

  security.sudo.extraRules = [
    {
      users = [ "minion" ];
      commands = [{ command = "ALL"; options = [ "NOPASSWD" ]; }];
    }
  ];
}