nixos/parts/modules/base/security.nix

{username, ...}: {
  security.sudo.wheelNeedsPassword = false;
  nix.settings.trusted-users = [
    "root"
    "@wheel"
    username
  ];
}