From 25079a7f0a1954bf9903532d111f316fc304c166 Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Thu, 23 Jul 2026 09:49:09 +1000 Subject: [PATCH] fix: use sudo for nix build on non-root SSH user Single-user Nix installations are owned by root. When PROXMOX_SSH_USER is not root, prefix the remote nix build command with sudo_prefix, same as the Proxmox tool invocations. Passes sudo_prefix as an extra arg to both the LXC tarball and VM disko image build heredocs. Co-Authored-By: Claude Sonnet 4.6 --- scripts/proxmox/create-proxmox-resource.sh | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/scripts/proxmox/create-proxmox-resource.sh b/scripts/proxmox/create-proxmox-resource.sh index c836c58..9683f21 100755 --- a/scripts/proxmox/create-proxmox-resource.sh +++ b/scripts/proxmox/create-proxmox-resource.sh @@ -683,11 +683,11 @@ if [[ "$image_already_remote" -eq 0 && -z "$local_image" ]]; then # hands the result to the remote shell to re-split, which would # otherwise scatter NIX_EXTRA_OPTS (itself several space-separated, # %q-quoted tokens) across the wrong positional parameters below. - printf -v remote_cmd 'bash -s -- %q %q %q %q %q' \ - "$remote_repo_dir" "$flake_target" "$remote_dir" "$remote_filename" "$NIX_EXTRA_OPTS" + printf -v remote_cmd 'bash -s -- %q %q %q %q %q %q' \ + "$remote_repo_dir" "$flake_target" "$remote_dir" "$remote_filename" "$NIX_EXTRA_OPTS" "$sudo_prefix" ssh "$ssh_target" "$remote_cmd" <<'REMOTE_SCRIPT' set -euo pipefail -repo_dir="$1"; target="$2"; dest_dir="$3"; dest_name="$4"; nix_extra_opts_str="$5" +repo_dir="$1"; target="$2"; dest_dir="$3"; dest_name="$4"; nix_extra_opts_str="$5"; sudo_pfx="$6" declare -a NIX_OPTS=() [[ -n "$nix_extra_opts_str" ]] && eval "NIX_OPTS=(${nix_extra_opts_str})" cd "$repo_dir" @@ -696,7 +696,7 @@ cd "$repo_dir" # right after a successful install. . scripts/lib/nix-bootstrap.sh ensure_nix_profile -NIXOS_HOST_KEYS_DIR="$(pwd)/host-keys" nix build --impure \ +NIXOS_HOST_KEYS_DIR="$(pwd)/host-keys" $sudo_pfx nix build --impure \ --no-use-registries --no-accept-flake-config "${NIX_OPTS[@]}" \ ".#nixosConfigurations.${target}.config.system.build.tarball" \ --out-link "result-${target}" @@ -730,16 +730,16 @@ REMOTE_SCRIPT "$remote_repo_dir" "$flake_target" "$remote_dir" "$remote_filename" "$NIX_EXTRA_OPTS" "$sudo_prefix" ssh "$ssh_target" "$remote_cmd" <<'REMOTE_SCRIPT' set -euo pipefail -repo_dir="$1"; target="$2"; dest_dir="$3"; dest_name="$4"; nix_extra_opts_str="$5"; sudo_prefix="$6" +repo_dir="$1"; target="$2"; dest_dir="$3"; dest_name="$4"; nix_extra_opts_str="$5"; sudo_pfx="$6" declare -a NIX_OPTS=() [[ -n "$nix_extra_opts_str" ]] && eval "NIX_OPTS=(${nix_extra_opts_str})" cd "$repo_dir" . scripts/lib/nix-bootstrap.sh ensure_nix_profile -nix build --no-use-registries --no-accept-flake-config "${NIX_OPTS[@]}" \ +$sudo_pfx nix build --no-use-registries --no-accept-flake-config "${NIX_OPTS[@]}" \ ".#nixosConfigurations.${target}.config.system.build.diskoImagesScript" \ --out-link "result-${target}" -$sudo_prefix "./result-${target}" \ +$sudo_pfx "./result-${target}" \ --pre-format-files "host-keys/${target}_ssh_host_ed25519_key" /etc/ssh/ssh_host_ed25519_key \ --pre-format-files "host-keys/${target}_ssh_host_ed25519_key.pub" /etc/ssh/ssh_host_ed25519_key.pub \ --build-memory 2048