Archived
beatzaplentyandClaude Sonnet 4.6
2909db5d04
All existing content moved from repo root into proxmox/ to make room for other Debian machine configs. Adds pihole/ with: - config/pihole.toml — snapshot of current Pi-hole v6 config - config/dnsmasq.d/99-ipxe-chainload.conf — custom PXE DHCP rules (EFI/BIOS iPXE chainload, fixed tag-specificity bug for UEFI boot) - pull-config.sh <source-host> <dest-dir> — pull live config to disk - apply-config.sh <source-dir> <dest-host> — push config to a Pi-hole Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XRzqNDrbnYR22ZgZj1Bg3s
62 lines
2.1 KiB
Bash
Executable File
62 lines
2.1 KiB
Bash
Executable File
#!/bin/bash
|
|
# Grant a named admin user passwordless sudo for Proxmox management tools
|
|
# (pvesh, qm, pct) and the Nix package manager so that scripts in the
|
|
# nixos flake repo can run these over non-interactive SSH without a TTY.
|
|
#
|
|
# Nix is included because single-user Nix installations (common on PVE
|
|
# hosts bootstrapped via codex-setup.sh) are owned by root; non-root
|
|
# users can't touch the Nix store lock without sudo.
|
|
#
|
|
# Idempotent - safe to re-run (rewrites if paths have changed). Run as
|
|
# root on the PVE host.
|
|
#
|
|
# Usage: ./setup-admin-sudo.sh <username>
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
# shellcheck source=lib/common.sh
|
|
source "${SCRIPT_DIR}/lib/common.sh"
|
|
require_root
|
|
|
|
USERNAME="${1:-}"
|
|
if [ -z "$USERNAME" ]; then
|
|
echo "Usage: $0 <username>" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Resolve actual binary paths at script time -- they differ across Proxmox
|
|
# versions (pvesh moved from /usr/sbin to /usr/bin in PVE 8.x) and the
|
|
# sudoers rule must match the real path or sudo will fall back to
|
|
# prompting for a password.
|
|
resolve_bin() {
|
|
command -v "$1" 2>/dev/null || { echo "ERROR: $1 not found on PATH" >&2; exit 1; }
|
|
}
|
|
|
|
PVESH="$(resolve_bin pvesh)"
|
|
QM="$(resolve_bin qm)"
|
|
PCT="$(resolve_bin pct)"
|
|
# Nix installs to a fixed path regardless of which user bootstrapped it.
|
|
NIX_BIN="/nix/var/nix/profiles/default/bin/nix"
|
|
if [ ! -x "$NIX_BIN" ]; then
|
|
echo "WARNING: $NIX_BIN not found -- Nix may not be installed yet." >&2
|
|
echo " Re-run this script after running codex-setup.sh on the node." >&2
|
|
NIX_BIN=""
|
|
fi
|
|
|
|
SUDOERS_FILE="/etc/sudoers.d/${USERNAME}-proxmox"
|
|
NIX_ENTRY="${NIX_BIN:+, ${NIX_BIN}}"
|
|
CONTENT="${USERNAME} ALL=(root) NOPASSWD: ${PVESH}, ${QM}, ${PCT}${NIX_ENTRY}"
|
|
|
|
write_if_changed "$SUDOERS_FILE" "$CONTENT"
|
|
|
|
# visudo -c validates the file we just wrote before we walk away.
|
|
if visudo -c -f "$SUDOERS_FILE" >/dev/null 2>&1; then
|
|
chmod 0440 "$SUDOERS_FILE"
|
|
echo "Sudoers rule for ${USERNAME} is valid and in place."
|
|
echo " ${CONTENT}"
|
|
else
|
|
echo "ERROR: sudoers validation failed -- removing bad file." >&2
|
|
rm -f "$SUDOERS_FILE"
|
|
exit 1
|
|
fi
|