added back stable branch, broken though because cerulean no support channel overrides

groups/servers/default.nix

@@ -0,0 +1,17 @@
+{ ... }: {
+  nix.settings = {
+    trusted-users = ["root" "@wheel"];
+  };
+
+  security = {
+    sudo = {
+      enable = true;
+      wheelNeedsPassword = true;
+    };
+
+    pam = {
+      sshAgentAuth.enable = true;
+      services.sudo.sshAgentAuth = true; # pam_ssh_agent_auth module
+    };
+  };
+}