{ config, lib, pkgs, ... }:

let
  inherit (lib) mkIf mkEnableOption;

  cfg = config.snowhawk.sudo-rules;
in
{
  options.snowhawk.sudo-rules = {
    enable = mkEnableOption "sudo-rules nixos module";
  };

  config = mkIf cfg.enable {
    security.sudo.extraRules = lib.mkIf false [
      {
        users = [ "ravenshade" ];
        commands = [{
          command = "${pkgs.nixos-rebuild}/bin/nixos-rebuild";
          options = [ "SETENV" "NOPASSWD" ];
        }];
      }
    ];
  };
}