From 1f5728b7ee26d7586abd5a39b323912cbb6d73e3 Mon Sep 17 00:00:00 2001
From: erik <erik.simon.me@gmail.com>
Date: Sun, 12 Jul 2026 23:17:21 +0200
Subject: [PATCH] fix(nix): trust @wheel so remote deploy can push unsigned
 closures

---
 jupiter/configuration.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/jupiter/configuration.nix b/jupiter/configuration.nix
index 0164760..fea0d17 100644
--- a/jupiter/configuration.nix
+++ b/jupiter/configuration.nix
@@ -19,6 +19,10 @@
   # hardware-configuration.nix) or stage-1 can't mount root and the box panics.
   boot.initrd.availableKernelModules = [ "mmc_block" "sdhci_pci" "sdhci_acpi" ];
 
+  # Trust wheel users so `nixos-rebuild --target-host darman@…` can push a
+  # laptop-built (unsigned) closure without a signature error.
+  nix.settings.trusted-users = [ "root" "@wheel" ];
+
   # ---- NAS data array ----
   # Existing ext4 on the mdadm RAID0 over sda+sdb (md0, 29.1T).
   # Mounted, NOT formatted; kept out of disko so it is never wiped.