common: clean /tmp on boot by default

base/default.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ pkgs, lib, ... }:
 
 {
   imports = [
@@ -19,6 +19,8 @@
     ./services/thermald.nix
   ];
 
+  boot.tmp.cleanOnBoot = lib.mkDefault true;
+
   time.timeZone = "Europe/Oslo";
 
   i18n.defaultLocale = "en_US.UTF-8";
@@ -45,6 +47,11 @@
 
   programs.zsh.enable = true;
 
+  security.sudo.execWheelOnly = true;
+  security.sudo.extraConfig = ''
+    Defaults lecture = never
+  '';
+
   users.groups."drift".name = "drift";
 
   # Trusted users on the nix builder machines

base/services/openssh.nix

@@ -2,6 +2,7 @@
 {
   services.openssh = {
     enable = true;
+    startWhenNeeded = true;
     extraConfig = ''
       PubkeyAcceptedAlgorithms=+ssh-rsa
       Match Group wheel