more work

modules/nixos/system/security/default.nix

@@ -0,0 +1,23 @@
+{ config, namespace, inputs, ... }:
+let
+  cfg = config.${namespace}.system.security;
+in
+{
+  options.${namespace}.system.security = {};
+
+  config = {
+    security = {
+      acme.acceptTerms = true;
+      polkit.enable = true;
+
+      pam = {
+        u2f = {
+          enable = true;
+          settings.cue = true;
+        };
+      };
+    };
+
+    programs.gnupg.agent.enable = true;
+  };
+}