nixos/config/security.nix

{
  config,
  lib,
  ...
}:
with lib;
mkIf (elem "security" config.machine.conffiles) {
  security = {
    audit.enable = true;
    auditd.enable = true;
  };
}