Every deploy stopped at a password prompt. pass-cli is installed, so read
the passwords from the HomeLab vault instead, per command:
switch/boot/test darman@<config> -> nixos-rebuild's sudo prompt
kexec/install root@<host> -> the target's ssh password
nixos-rebuild prompts via getpass(), which reads /dev/tty and ignores a
piped stdin, so that one runs under setsid: no controlling terminal means
getpass falls back to stdin. kexec wraps the master ssh in `sshpass -e`
(scp rides the control socket) and pins password auth so a key can't fall
through into a second prompt; install uses nixos-anywhere's own
--env-password.
Missing pass-cli, a logged-out session, or an absent item all yield an
empty string and the original interactive prompt -- nothing becomes
mandatory. Passwords never reach a command line.
common.nix now sets security.sudo.wheelNeedsPassword = true, but
--use-remote-sudo is deprecated and only prefixes commands with sudo --
it never prompts, so every remote rebuild failed. --ask-sudo-password is
the alias for --elevate=sudo --ask-elevate-password, which asks once and
feeds it via sudo --stdin.
This should have gone in with the wheelNeedsPassword change itself.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Pi's vfat partition isn't mounted at runtime (u-boot reads it pre-boot), so
/boot/firmware doesn't exist -> keyFile moved to the always-mounted root fs.
deploy flash now drops it on the ext4 root partition.
- after dd, if ~/.config/homelab/<config>/age.txt exists, mount the FAT boot
partition and drop it as sops-age.txt (mercury). Key stays off-repo + out of
the store + out of the image; no manual mount step.
darman
