The nixos flake's create-proxmox-resource.sh runs pvesh/qm/pct over
non-interactive SSH, which requires NOPASSWD sudo for those binaries.
pvesh moved from /usr/sbin to /usr/bin in PVE 8.x, so the script
resolves paths at runtime rather than hardcoding them, preventing the
silent NOPASSWD-miss that caused ipcc_send_rec errors.
- scripts/setup-admin-sudo.sh: new script, takes username, writes
/etc/sudoers.d/<user>-proxmox with correct resolved paths and
validates it with visudo -c before leaving it in place
- scripts/bootstrap.sh: add setup-admin-sudo.sh to post-steps list
- scripts/audit.sh: check that a *-proxmox sudoers file exists with
NOPASSWD for all three tools
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Splits the repo into Stage 1 (base host config/hardening, applies to any
node) and Stage 2 (future HA/Ceph cluster, deferred - pve1's mini-PC
hardware can't support the assumed split-disk/multi-NIC layout).
Adds the Stage 1 toolset: firewall deploy, named admin user creation,
unattended security upgrades, subscription-nag removal (with an apt hook
so the patch survives package updates), and a read-only audit script.
Fixes switch-to-no-subscription-repo.sh, which only handled the legacy
.list format and silently no-op'd against PVE 9's deb822 .sources files;
it now removes enterprise sources outright rather than commenting them
out. Shared logic (root check, idempotent file writes, backups) factored
into scripts/lib/common.sh.
Ran the full sequence against pve1 via scripts/bootstrap.sh +
create-admin-user.sh; scripts/audit.sh confirms all checks pass.
beatzaplentyandClaude Sonnet 4.6