Merge pull request 'fix(edaas): restore passwordless wheel under sudo-rs' (#102) from fix/edaas-passwordless-sudo-rs into main

Reviewed-on: #102

docs/shell.md

@@ -186,6 +186,14 @@ fleet's stock "wheel, with a password" policy. What it does **not** implement:
 host aliases, LDAP/SSSD sudoers, `sudoreplay`, and most `Defaults` settings.
 Needing any of those means reverting to `security.sudo`.
 
+One exception to the password: the EDaaS box sets
+`security.sudo-rs.wheelNeedsPassword = false`. NixOS-WSL ships that default for
+`security.sudo` — WSL has no console login, so the trust boundary is the Windows
+session and the Linux account password is never one the user chose — and the
+option does not carry across to the `security.sudo-rs` module, which defaults to
+requiring one. Without the explicit setting, `sudo` on that host prompts for a
+password nobody knows.
+
 If a host ever refuses to escalate, get a root shell that does not go through
 sudo (`wsl -u root -d NixOS` on the work box; the console or a serial/HDMI login
 elsewhere) and roll back with `nixos-rebuild switch --rollback`, or pick the
@@ -349,12 +357,12 @@ Claude to route new memories there.
 
 ## Per-host differences
 
-|                             | Personal Linux (sway) | macOS                 | Work WSL (EDaaS)            |
+|                             | Personal Linux (sway) | macOS                 | Work WSL (EDaaS)             |
-| --------------------------- | --------------------- | --------------------- | --------------------------- |
+| --------------------------- | --------------------- | --------------------- | ---------------------------- |
-| Auto-tmux                   | yes (foot/TTY)        | yes (iTerm2)          | yes (WSL shell)             |
+| Auto-tmux                   | yes (foot/TTY)        | yes (iTerm2)          | yes (WSL shell)              |
-| `kubectl` → kubecolor       | no (no kubectl)       | no                    | yes (work module)           |
+| `kubectl` → kubecolor       | no (no kubectl)       | no                    | yes (work module)            |
-| `sudo` implementation       | sudo-rs               | Apple sudo + Touch ID | sudo-rs                     |
+| `sudo` implementation       | sudo-rs (password)    | Apple sudo + Touch ID | sudo-rs (passwordless wheel) |
-| git email                   | `iam@emmathe.dev`     | `iam@emmathe.dev`     | `…@citrix.com` (work)       |
+| git email                   | `iam@emmathe.dev`     | `iam@emmathe.dev`     | `…@citrix.com` (work)        |
-| ssh config managed          | yes                   | yes                   | no (keeps corporate config) |
+| ssh config managed          | yes                   | yes                   | no (keeps corporate config)  |
-| ssh-agent                   | yes                   | launchd               | yes (work module)           |
+| ssh-agent                   | yes                   | launchd               | yes (work module)            |
-| GUI / theming (desktop.nix) | yes                   | no                    | no                          |
+| GUI / theming (desktop.nix) | yes                   | no                    | no                           |

hosts/EDaaS/configuration.nix

@@ -60,6 +60,11 @@
   ## patch the script
   systemd.services.docker-desktop-proxy.script = lib.mkForce ''${config.wsl.wslConf.automount.root}/wsl/docker-desktop/docker-desktop-user-distro proxy --docker-desktop-root ${config.wsl.wslConf.automount.root}/wsl/docker-desktop "C:\Program Files\Docker\Docker\resources"'';
 
+  # NixOS-WSL's passwordless wheel default only covers `security.sudo`; the
+  # sudo-rs swap in common-nixos.nix needs it set again. No console login here,
+  # and no account password anyone knows.
+  security.sudo-rs.wheelNeedsPassword = false;
+
   features.swayDesktop.enable = false;
 
   # NOTE: this user's systemd --user lingering -- so the home-manager renovate