Archived
beatzaplentyandClaude Sonnet 4.6
2d5472a59d
The nixos flake's create-proxmox-resource.sh runs pvesh/qm/pct over non-interactive SSH, which requires NOPASSWD sudo for those binaries. pvesh moved from /usr/sbin to /usr/bin in PVE 8.x, so the script resolves paths at runtime rather than hardcoding them, preventing the silent NOPASSWD-miss that caused ipcc_send_rec errors. - scripts/setup-admin-sudo.sh: new script, takes username, writes /etc/sudoers.d/<user>-proxmox with correct resolved paths and validates it with visudo -c before leaving it in place - scripts/bootstrap.sh: add setup-admin-sudo.sh to post-steps list - scripts/audit.sh: check that a *-proxmox sudoers file exists with NOPASSWD for all three tools Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
50 lines
1.5 KiB
Bash
Executable File
50 lines
1.5 KiB
Bash
Executable File
#!/bin/bash
|
|
# Grant a named admin user passwordless sudo for Proxmox management tools
|
|
# (pvesh, qm, pct) so that scripts in the nixos flake repo can run these
|
|
# over non-interactive SSH without a TTY for password entry.
|
|
#
|
|
# Idempotent - safe to re-run (rewrites if paths have changed). Run as
|
|
# root on the PVE host.
|
|
#
|
|
# Usage: ./setup-admin-sudo.sh <username>
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
# shellcheck source=lib/common.sh
|
|
source "${SCRIPT_DIR}/lib/common.sh"
|
|
require_root
|
|
|
|
USERNAME="${1:-}"
|
|
if [ -z "$USERNAME" ]; then
|
|
echo "Usage: $0 <username>" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Resolve actual binary paths at script time -- they differ across Proxmox
|
|
# versions (pvesh moved from /usr/sbin to /usr/bin in PVE 8.x) and the
|
|
# sudoers rule must match the real path or sudo will fall back to
|
|
# prompting for a password.
|
|
resolve_bin() {
|
|
command -v "$1" 2>/dev/null || { echo "ERROR: $1 not found on PATH" >&2; exit 1; }
|
|
}
|
|
|
|
PVESH="$(resolve_bin pvesh)"
|
|
QM="$(resolve_bin qm)"
|
|
PCT="$(resolve_bin pct)"
|
|
|
|
SUDOERS_FILE="/etc/sudoers.d/${USERNAME}-proxmox"
|
|
CONTENT="${USERNAME} ALL=(root) NOPASSWD: ${PVESH}, ${QM}, ${PCT}"
|
|
|
|
write_if_changed "$SUDOERS_FILE" "$CONTENT"
|
|
|
|
# visudo -c validates the file we just wrote before we walk away.
|
|
if visudo -c -f "$SUDOERS_FILE" >/dev/null 2>&1; then
|
|
chmod 0440 "$SUDOERS_FILE"
|
|
echo "Sudoers rule for ${USERNAME} is valid and in place."
|
|
echo " ${CONTENT}"
|
|
else
|
|
echo "ERROR: sudoers validation failed -- removing bad file." >&2
|
|
rm -f "$SUDOERS_FILE"
|
|
exit 1
|
|
fi
|