From 8aa3dac4deb46f9ec58b8102e44d470422942278 Mon Sep 17 00:00:00 2001 From: Erik Simon Date: Mon, 20 Jul 2026 19:41:39 +0200 Subject: [PATCH] deploy: prompt for the sudo password on switch/boot/test common.nix now sets security.sudo.wheelNeedsPassword = true, but --use-remote-sudo is deprecated and only prefixes commands with sudo -- it never prompts, so every remote rebuild failed. --ask-sudo-password is the alias for --elevate=sudo --ask-elevate-password, which asks once and feeds it via sudo --stdin. This should have gone in with the wheelNeedsPassword change itself. Co-Authored-By: Claude Opus 4.8 --- scripts/deploy | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/scripts/deploy b/scripts/deploy index 21dfa92..d891b27 100755 --- a/scripts/deploy +++ b/scripts/deploy @@ -91,10 +91,14 @@ case "$cmd" in { [ -n "$config" ] && [ -n "$host" ]; } || die "usage: ./deploy $cmd " echo ">> nixos-rebuild $cmd .#$config on darman@$host" + # --ask-sudo-password, not the deprecated --use-remote-sudo: common.nix sets + # security.sudo.wheelNeedsPassword = true, and --use-remote-sudo only + # prefixes with sudo without ever prompting. Asks for darman's password + # (the darman_password hash in each host's sops file). nix run nixpkgs#nixos-rebuild -- "$cmd" \ --flake ".#$config" \ --target-host "darman@$host" \ - --use-remote-sudo + --ask-sudo-password ;; image|flash)