From 0c151943de8b2e6be9bc9d2f5b75956057294175 Mon Sep 17 00:00:00 2001 From: Emma Thorpe Date: Mon, 24 Aug 2026 11:16:12 +0100 Subject: [PATCH] fix(edaas): restore passwordless wheel under sudo-rs NixOS-WSL sets `security.sudo.wheelNeedsPassword = false`, but that option belongs to the `security.sudo` module and does not carry over to the sudo-rs swap in modules/common-nixos.nix, whose equivalent option defaults to true. Since that swap landed, sudo on this host prompts for the account password -- which WSL set during install and nobody knows -- so escalation only worked through `wsl -u root`. Set `security.sudo-rs.wheelNeedsPassword = false` on the host to match the NixOS-WSL default. Other NixOS hosts are unaffected and keep the prompt. --- hosts/EDaaS/configuration.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/hosts/EDaaS/configuration.nix b/hosts/EDaaS/configuration.nix index 89da4eb..946621a 100644 --- a/hosts/EDaaS/configuration.nix +++ b/hosts/EDaaS/configuration.nix @@ -60,6 +60,11 @@ ## patch the script systemd.services.docker-desktop-proxy.script = lib.mkForce ''${config.wsl.wslConf.automount.root}/wsl/docker-desktop/docker-desktop-user-distro proxy --docker-desktop-root ${config.wsl.wslConf.automount.root}/wsl/docker-desktop "C:\Program Files\Docker\Docker\resources"''; + # NixOS-WSL's passwordless wheel default only covers `security.sudo`; the + # sudo-rs swap in common-nixos.nix needs it set again. No console login here, + # and no account password anyone knows. + security.sudo-rs.wheelNeedsPassword = false; + features.swayDesktop.enable = false; # NOTE: this user's systemd --user lingering -- so the home-manager renovate