🔒 feat(security): replace sudo with sudo-rs

- Enable `sudo-rs` with wheel-only execution
- Disable legacy `sudo`
- Update AppArmor and U2F configs for `sudo-rs`
- Update Yubikey U2F auth for `sudo-rs`

nixos/security-services.nix

@@ -10,6 +10,11 @@
   # };
 
   # Enable Security Services
+  security.sudo-rs = {
+    enable = true;
+    execWheelOnly = true;
+  };
+  security.sudo.enable = false;
   users.users.root.hashedPassword = "!";
   security.tpm2 = {
     enable = true;
@@ -28,7 +33,7 @@
   security.pam.services = {
     login.enableAppArmor = true;
     sshd.enableAppArmor = true;
-    sudo.enableAppArmor = true;
+    sudo-rs.enableAppArmor = true;
     su.enableAppArmor = true;
     greetd.enableAppArmor = true;
     u2f.enableAppArmor = true;

nixos/terminal-utils.nix

@@ -4,6 +4,7 @@
   environment.systemPackages = with pkgs; [
     file
     upx
+    dotenvx
     git
     lazygit
     delta

nixos/work.nix

@@ -4,12 +4,14 @@
   environment.systemPackages = with pkgs; [
     slack
     aws-sam-cli
+    google-cloud-sdk
     awscli2
     ssm-session-manager-plugin
     cargo-lambda
     gnumake
     cmake
-    redli
     firebase-tools
+    redli
+    android-studio
   ];
 }

nixos/yubikey.nix

@@ -14,7 +14,7 @@
 
   security.pam.services = {
     greetd.u2fAuth = true;
-    sudo.u2fAuth = true;
+    sudo-rs.u2fAuth = true;
     hyprlock.u2fAuth = true;
   };