nixos/config/security.nix

{ config, lib, ... }:

with lib;

mkIf (elem "security" config.machine.conffiles) {
  security = {
    audit.enable = true;
    auditd.enable = true;
    hideProcessInformation = true;
  };
}