depot/cluster/services/idm/policies/soda.nix

{
  services.kanidm.unixSettings = {
    pam_allowed_login_groups = [
      "soda"
      "soda-admins"
    ];
  };
}