{ pkgs, config, lib, ... }:

let
  cfg = config.my.cli.sudo;
in {
  options.my.cli.sudo = {
    insults.enable = lib.mkEnableOption null;
  };

  config = lib.mkMerge [
    (lib.mkIf cfg.insults.enable {
      security.sudo = {
        package = pkgs.sudo.override {withInsults = true;};
        extraConfig = ''
          Defaults insults
        '';
      };
    })
    {
      security.pam.services.sudo = {
        fprintAuth = false;
      };
    }
  ];
}