From 0c151943de8b2e6be9bc9d2f5b75956057294175 Mon Sep 17 00:00:00 2001 From: Emma Thorpe Date: Mon, 24 Aug 2026 11:16:12 +0100 Subject: [PATCH 1/2] fix(edaas): restore passwordless wheel under sudo-rs NixOS-WSL sets `security.sudo.wheelNeedsPassword = false`, but that option belongs to the `security.sudo` module and does not carry over to the sudo-rs swap in modules/common-nixos.nix, whose equivalent option defaults to true. Since that swap landed, sudo on this host prompts for the account password -- which WSL set during install and nobody knows -- so escalation only worked through `wsl -u root`. Set `security.sudo-rs.wheelNeedsPassword = false` on the host to match the NixOS-WSL default. Other NixOS hosts are unaffected and keep the prompt. --- hosts/EDaaS/configuration.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/hosts/EDaaS/configuration.nix b/hosts/EDaaS/configuration.nix index 89da4eb..946621a 100644 --- a/hosts/EDaaS/configuration.nix +++ b/hosts/EDaaS/configuration.nix @@ -60,6 +60,11 @@ ## patch the script systemd.services.docker-desktop-proxy.script = lib.mkForce ''${config.wsl.wslConf.automount.root}/wsl/docker-desktop/docker-desktop-user-distro proxy --docker-desktop-root ${config.wsl.wslConf.automount.root}/wsl/docker-desktop "C:\Program Files\Docker\Docker\resources"''; + # NixOS-WSL's passwordless wheel default only covers `security.sudo`; the + # sudo-rs swap in common-nixos.nix needs it set again. No console login here, + # and no account password anyone knows. + security.sudo-rs.wheelNeedsPassword = false; + features.swayDesktop.enable = false; # NOTE: this user's systemd --user lingering -- so the home-manager renovate From 4ac9d1108bbdbb23d8b8cc729302872056f63ce6 Mon Sep 17 00:00:00 2001 From: Emma Thorpe Date: Mon, 24 Aug 2026 11:16:15 +0100 Subject: [PATCH 2/2] docs(shell): record the EDaaS passwordless-wheel exception The sudo-rs section claimed the whole fleet runs the stock "wheel, with a password" policy, which is no longer true for the WSL host. Explain why the NixOS-WSL default does not survive the sudo-rs swap, and mark the difference in the per-host table. --- docs/shell.md | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-) diff --git a/docs/shell.md b/docs/shell.md index f180852..5c5de3e 100644 --- a/docs/shell.md +++ b/docs/shell.md @@ -186,6 +186,14 @@ fleet's stock "wheel, with a password" policy. What it does **not** implement: host aliases, LDAP/SSSD sudoers, `sudoreplay`, and most `Defaults` settings. Needing any of those means reverting to `security.sudo`. +One exception to the password: the EDaaS box sets +`security.sudo-rs.wheelNeedsPassword = false`. NixOS-WSL ships that default for +`security.sudo` — WSL has no console login, so the trust boundary is the Windows +session and the Linux account password is never one the user chose — and the +option does not carry across to the `security.sudo-rs` module, which defaults to +requiring one. Without the explicit setting, `sudo` on that host prompts for a +password nobody knows. + If a host ever refuses to escalate, get a root shell that does not go through sudo (`wsl -u root -d NixOS` on the work box; the console or a serial/HDMI login elsewhere) and roll back with `nixos-rebuild switch --rollback`, or pick the @@ -349,12 +357,12 @@ Claude to route new memories there. ## Per-host differences -| | Personal Linux (sway) | macOS | Work WSL (EDaaS) | -| --------------------------- | --------------------- | --------------------- | --------------------------- | -| Auto-tmux | yes (foot/TTY) | yes (iTerm2) | yes (WSL shell) | -| `kubectl` → kubecolor | no (no kubectl) | no | yes (work module) | -| `sudo` implementation | sudo-rs | Apple sudo + Touch ID | sudo-rs | -| git email | `iam@emmathe.dev` | `iam@emmathe.dev` | `…@citrix.com` (work) | -| ssh config managed | yes | yes | no (keeps corporate config) | -| ssh-agent | yes | launchd | yes (work module) | -| GUI / theming (desktop.nix) | yes | no | no | +| | Personal Linux (sway) | macOS | Work WSL (EDaaS) | +| --------------------------- | --------------------- | --------------------- | ---------------------------- | +| Auto-tmux | yes (foot/TTY) | yes (iTerm2) | yes (WSL shell) | +| `kubectl` → kubecolor | no (no kubectl) | no | yes (work module) | +| `sudo` implementation | sudo-rs (password) | Apple sudo + Touch ID | sudo-rs (passwordless wheel) | +| git email | `iam@emmathe.dev` | `iam@emmathe.dev` | `…@citrix.com` (work) | +| ssh config managed | yes | yes | no (keeps corporate config) | +| ssh-agent | yes | launchd | yes (work module) | +| GUI / theming (desktop.nix) | yes | no | no |