{
  security.sudo.enable = false;
  security.pam.services.systemd-run0 = {};
}