beatzaplenty/debian-configuration
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

setup-admin-sudo: add nix to NOPASSWD list

Browse Source 
Single-user Nix on PVE nodes is owned by root. Add the fixed Nix binary
path (/nix/var/nix/profiles/default/bin/nix) to the NOPASSWD sudoers
rule so non-root SSH users can run nix build from create-proxmox-resource.sh.
Gracefully skips with a warning if Nix isn't installed yet (run after
codex-setup.sh bootstraps the node).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
beatzaplenty
2026-07-23 09:49:53 +10:00
co-authored by Claude Sonnet 4.6
parent 2d5472a59d
commit c832418aed
1 changed files with 15 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/setup-admin-sudo.sh
+15 -3
View File
@@ -1,7 +1,11 @@
#!/bin/bash #!/bin/bash
# Grant a named admin user passwordless sudo for Proxmox management tools # Grant a named admin user passwordless sudo for Proxmox management tools
# (pvesh, qm, pct) so that scripts in the nixos flake repo can run these # (pvesh, qm, pct) and the Nix package manager so that scripts in the
# over non-interactive SSH without a TTY for password entry. # nixos flake repo can run these over non-interactive SSH without a TTY.
#
# Nix is included because single-user Nix installations (common on PVE
# hosts bootstrapped via codex-setup.sh) are owned by root; non-root
# users can't touch the Nix store lock without sudo.
# #
# Idempotent - safe to re-run (rewrites if paths have changed). Run as # Idempotent - safe to re-run (rewrites if paths have changed). Run as
# root on the PVE host. # root on the PVE host.
@@ -31,9 +35,17 @@ resolve_bin() {
PVESH="$(resolve_bin pvesh)" PVESH="$(resolve_bin pvesh)"
QM="$(resolve_bin qm)" QM="$(resolve_bin qm)"
PCT="$(resolve_bin pct)" PCT="$(resolve_bin pct)"
# Nix installs to a fixed path regardless of which user bootstrapped it.
NIX_BIN="/nix/var/nix/profiles/default/bin/nix"
if [ ! -x "$NIX_BIN" ]; then
echo "WARNING: $NIX_BIN not found -- Nix may not be installed yet." >&2
echo " Re-run this script after running codex-setup.sh on the node." >&2
NIX_BIN=""
fi
SUDOERS_FILE="/etc/sudoers.d/${USERNAME}-proxmox" SUDOERS_FILE="/etc/sudoers.d/${USERNAME}-proxmox"
CONTENT="${USERNAME} ALL=(root) NOPASSWD: ${PVESH}, ${QM}, ${PCT}" NIX_ENTRY="${NIX_BIN:+, ${NIX_BIN}}"
CONTENT="${USERNAME} ALL=(root) NOPASSWD: ${PVESH}, ${QM}, ${PCT}${NIX_ENTRY}"
write_if_changed "$SUDOERS_FILE" "$CONTENT" write_if_changed "$SUDOERS_FILE" "$CONTENT"