From 177950dd3db2f418b57c64f4bfc9e20482f152a1 Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Thu, 23 Jul 2026 10:18:56 +1000 Subject: [PATCH] revert: restore sudo for nix build in remote scripts nix on pve1 was installed as root (single-user), so wayne can't access /nix/var/nix/db/big-lock without root -- nix build genuinely needs sudo there. The previous fix to drop sudo_pfx was wrong. The real fix is node config: add nix to wayne's NOPASSWD rules in sudoers on pve1 (see below). pct/qm/pvesh already have NOPASSWD and work fine in non-interactive SSH heredocs; nix was just missing from that list. On pve1 as root: echo 'wayne ALL=(root) NOPASSWD: ALL' | tee /etc/sudoers.d/wayne-nopasswd chmod 440 /etc/sudoers.d/wayne-nopasswd Co-Authored-By: Claude Sonnet 4.6 --- scripts/proxmox/create-proxmox-resource.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/proxmox/create-proxmox-resource.sh b/scripts/proxmox/create-proxmox-resource.sh index 7d43d7e..9683f21 100755 --- a/scripts/proxmox/create-proxmox-resource.sh +++ b/scripts/proxmox/create-proxmox-resource.sh @@ -696,7 +696,7 @@ cd "$repo_dir" # right after a successful install. . scripts/lib/nix-bootstrap.sh ensure_nix_profile -NIXOS_HOST_KEYS_DIR="$(pwd)/host-keys" nix build --impure \ +NIXOS_HOST_KEYS_DIR="$(pwd)/host-keys" $sudo_pfx nix build --impure \ --no-use-registries --no-accept-flake-config "${NIX_OPTS[@]}" \ ".#nixosConfigurations.${target}.config.system.build.tarball" \ --out-link "result-${target}" @@ -736,7 +736,7 @@ declare -a NIX_OPTS=() cd "$repo_dir" . scripts/lib/nix-bootstrap.sh ensure_nix_profile -nix build --no-use-registries --no-accept-flake-config "${NIX_OPTS[@]}" \ +$sudo_pfx nix build --no-use-registries --no-accept-flake-config "${NIX_OPTS[@]}" \ ".#nixosConfigurations.${target}.config.system.build.diskoImagesScript" \ --out-link "result-${target}" $sudo_pfx "./result-${target}" \