nixos/config/security.nix

{
  config,
  lib,
  ...
}:
with lib;
  mkIf (elem "security" config.machine.conffiles) {
    security = {
      audit.enable = true;
      auditd.enable = true;
    };
  }