fix(nix): trust @wheel so remote deploy can push unsigned closures

2026-07-12 23:17:21 +02:00
parent 9db059df5a
commit 1f5728b7ee
1 changed files with 4 additions and 0 deletions
@@ -19,6 +19,10 @@
  # hardware-configuration.nix) or stage-1 can't mount root and the box panics.
  boot.initrd.availableKernelModules = [ "mmc_block" "sdhci_pci" "sdhci_acpi" ];

+  # Trust wheel users so `nixos-rebuild --target-host darman@…` can push a
+  # laptop-built (unsigned) closure without a signature error.
+  nix.settings.trusted-users = [ "root" "@wheel" ];
+
  # ---- NAS data array ----
  # Existing ext4 on the mdadm RAID0 over sda+sdb (md0, 29.1T).
  # Mounted, NOT formatted; kept out of disko so it is never wiped.