From 56cf8f875f96469d652cbb5ac6f9fafd0a8fed55 Mon Sep 17 00:00:00 2001
From: ahmza <hamza@ahmza.com>
Date: Wed, 5 Aug 2026 21:51:26 +0100
Subject: [PATCH] allow passwordless sudo for ahmza

adds security.sudo.extraRules with NOPASSWD: ALL. the rule is emitted after the default %wheel SETENV rule and sudoers is last-match-wins, so it takes precedence. lives in the shared user module, so it applies to both shadow and t480.
---
 modules/system/core/user.nix | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/modules/system/core/user.nix b/modules/system/core/user.nix
index 6c0d4e7..e829ced 100644
--- a/modules/system/core/user.nix
+++ b/modules/system/core/user.nix
@@ -16,6 +16,18 @@
       # repoPath defaults to /home/ahmza/dot
     };
 
+    security.sudo.extraRules = [
+      {
+        users = ["ahmza"];
+        commands = [
+          {
+            command = "ALL";
+            options = ["NOPASSWD"];
+          }
+        ];
+      }
+    ];
+
     users.users.ahmza = {
       isNormalUser = true;
       initialPassword = "qwer";