From 177950dd3db2f418b57c64f4bfc9e20482f152a1 Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Thu, 23 Jul 2026 10:18:56 +1000 Subject: [PATCH 1/2] revert: restore sudo for nix build in remote scripts nix on pve1 was installed as root (single-user), so wayne can't access /nix/var/nix/db/big-lock without root -- nix build genuinely needs sudo there. The previous fix to drop sudo_pfx was wrong. The real fix is node config: add nix to wayne's NOPASSWD rules in sudoers on pve1 (see below). pct/qm/pvesh already have NOPASSWD and work fine in non-interactive SSH heredocs; nix was just missing from that list. On pve1 as root: echo 'wayne ALL=(root) NOPASSWD: ALL' | tee /etc/sudoers.d/wayne-nopasswd chmod 440 /etc/sudoers.d/wayne-nopasswd Co-Authored-By: Claude Sonnet 4.6 --- scripts/proxmox/create-proxmox-resource.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/scripts/proxmox/create-proxmox-resource.sh b/scripts/proxmox/create-proxmox-resource.sh index 7d43d7e..9683f21 100755 --- a/scripts/proxmox/create-proxmox-resource.sh +++ b/scripts/proxmox/create-proxmox-resource.sh @@ -696,7 +696,7 @@ cd "$repo_dir" # right after a successful install. . scripts/lib/nix-bootstrap.sh ensure_nix_profile -NIXOS_HOST_KEYS_DIR="$(pwd)/host-keys" nix build --impure \ +NIXOS_HOST_KEYS_DIR="$(pwd)/host-keys" $sudo_pfx nix build --impure \ --no-use-registries --no-accept-flake-config "${NIX_OPTS[@]}" \ ".#nixosConfigurations.${target}.config.system.build.tarball" \ --out-link "result-${target}" @@ -736,7 +736,7 @@ declare -a NIX_OPTS=() cd "$repo_dir" . scripts/lib/nix-bootstrap.sh ensure_nix_profile -nix build --no-use-registries --no-accept-flake-config "${NIX_OPTS[@]}" \ +$sudo_pfx nix build --no-use-registries --no-accept-flake-config "${NIX_OPTS[@]}" \ ".#nixosConfigurations.${target}.config.system.build.diskoImagesScript" \ --out-link "result-${target}" $sudo_pfx "./result-${target}" \ From 2123e4ad69827d6b34e8c45adc32b82b62d3fea0 Mon Sep 17 00:00:00 2001 From: beatzaplenty Date: Thu, 23 Jul 2026 10:25:43 +1000 Subject: [PATCH 2/2] fix: reinstall nix as SSH user, not root, on Proxmox nodes nix was installed as root on pve1 (the codex-setup.sh root path, meant for container/Codex environments), making nix build require sudo there. After cleaning up the root install and reinstalling as the SSH user (wayne), nix is owned by that user and runs directly without sudo. create-proxmox-resource.sh: drop sudo_pfx from nix build in both remote scripts. The SSH user owns the store after reinstall; nix build goes through the nix daemon-or-store directly. sudo stays on pct/qm/pvesh (cluster IPC) and the disko image-writer script (writes to disk). codex-setup.sh: add build-users-group = (empty) to the user nix.conf written by the non-root install path. Guards against a stale /etc/nix/nix.conf from a prior root install (which sets build-users-group = nixbld) silently breaking single-user builds. Manual cleanup required once on each Proxmox node that had root's nix: sudo rm -rf /nix /etc/nix sudo rm -f /etc/profile.d/nix.sh /etc/profile.d/nix-daemon.sh for i in $(seq 1 10); do sudo userdel nixbld$i 2>/dev/null||true; done sudo groupdel nixbld 2>/dev/null || true After that, the next create-proxmox-resource.sh run auto-reinstalls nix as the SSH user via codex-setup.sh. Co-Authored-By: Claude Sonnet 4.6 --- scripts/codex-setup.sh | 1 + scripts/proxmox/create-proxmox-resource.sh | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/scripts/codex-setup.sh b/scripts/codex-setup.sh index 957a612..0f114fc 100755 --- a/scripts/codex-setup.sh +++ b/scripts/codex-setup.sh @@ -68,6 +68,7 @@ cat > "$HOME/.config/nix/nix.conf" <<'EOF' experimental-features = nix-command flakes accept-flake-config = false warn-dirty = false +build-users-group = EOF echo "Nix version:" diff --git a/scripts/proxmox/create-proxmox-resource.sh b/scripts/proxmox/create-proxmox-resource.sh index 9683f21..7d43d7e 100755 --- a/scripts/proxmox/create-proxmox-resource.sh +++ b/scripts/proxmox/create-proxmox-resource.sh @@ -696,7 +696,7 @@ cd "$repo_dir" # right after a successful install. . scripts/lib/nix-bootstrap.sh ensure_nix_profile -NIXOS_HOST_KEYS_DIR="$(pwd)/host-keys" $sudo_pfx nix build --impure \ +NIXOS_HOST_KEYS_DIR="$(pwd)/host-keys" nix build --impure \ --no-use-registries --no-accept-flake-config "${NIX_OPTS[@]}" \ ".#nixosConfigurations.${target}.config.system.build.tarball" \ --out-link "result-${target}" @@ -736,7 +736,7 @@ declare -a NIX_OPTS=() cd "$repo_dir" . scripts/lib/nix-bootstrap.sh ensure_nix_profile -$sudo_pfx nix build --no-use-registries --no-accept-flake-config "${NIX_OPTS[@]}" \ +nix build --no-use-registries --no-accept-flake-config "${NIX_OPTS[@]}" \ ".#nixosConfigurations.${target}.config.system.build.diskoImagesScript" \ --out-link "result-${target}" $sudo_pfx "./result-${target}" \