darman/homelab
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

deploy: prompt for the sudo password on switch/boot/test

Browse Source 
common.nix now sets security.sudo.wheelNeedsPassword = true, but
--use-remote-sudo is deprecated and only prefixes commands with sudo --
it never prompts, so every remote rebuild failed. --ask-sudo-password is
the alias for --elevate=sudo --ask-elevate-password, which asks once and
feeds it via sudo --stdin.

This should have gone in with the wheelNeedsPassword change itself.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
darman
2026-07-20 19:41:39 +02:00
co-authored by Claude Opus 4.8
parent 82122a964d
commit 8aa3dac4de
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/deploy
+5 -1
View File
@@ -91,10 +91,14 @@ case "$cmd" in
{ [ -n "$config" ] && [ -n "$host" ]; } || die "usage: ./deploy $cmd <config> <host>" { [ -n "$config" ] && [ -n "$host" ]; } || die "usage: ./deploy $cmd <config> <host>"
echo ">> nixos-rebuild $cmd .#$config on darman@$host" echo ">> nixos-rebuild $cmd .#$config on darman@$host"
# --ask-sudo-password, not the deprecated --use-remote-sudo: common.nix sets
# security.sudo.wheelNeedsPassword = true, and --use-remote-sudo only
# prefixes with sudo without ever prompting. Asks for darman's password
# (the darman_password hash in each host's sops file).
nix run nixpkgs#nixos-rebuild -- "$cmd" \ nix run nixpkgs#nixos-rebuild -- "$cmd" \
--flake ".#$config" \ --flake ".#$config" \
--target-host "darman@$host" \ --target-host "darman@$host" \
--use-remote-sudo --ask-sudo-password
;; ;;
image|flash) image|flash)