nix-conf/system/security.nix

{...}: {
  security.doas = {
    enable = true;
    extraRules = [
      {
        groups = ["wheel"];
        persist = true;
      }
      {
        groups = ["wheel"];
        noPass = true;
        cmd = "journalctl";
      }
    ];
  };
  security.polkit.enable = true;
  services.physlock = {
    enable = true;
    allowAnyUser = true;
  };
}