fix(edaas): restore passwordless wheel under sudo-rs

NixOS-WSL sets `security.sudo.wheelNeedsPassword = false`, but that option
belongs to the `security.sudo` module and does not carry over to the sudo-rs
swap in modules/common-nixos.nix, whose equivalent option defaults to true.
Since that swap landed, sudo on this host prompts for the account password --
which WSL set during install and nobody knows -- so escalation only worked
through `wsl -u root`.

Set `security.sudo-rs.wheelNeedsPassword = false` on the host to match the
NixOS-WSL default. Other NixOS hosts are unaffected and keep the prompt.
This commit is contained in:
Emma Thorpe
2026-08-24 11:16:12 +01:00
parent dcb8a5e66a
commit 0c151943de
+5
View File
@@ -60,6 +60,11 @@
## patch the script
systemd.services.docker-desktop-proxy.script = lib.mkForce ''${config.wsl.wslConf.automount.root}/wsl/docker-desktop/docker-desktop-user-distro proxy --docker-desktop-root ${config.wsl.wslConf.automount.root}/wsl/docker-desktop "C:\Program Files\Docker\Docker\resources"'';
# NixOS-WSL's passwordless wheel default only covers `security.sudo`; the
# sudo-rs swap in common-nixos.nix needs it set again. No console login here,
# and no account password anyone knows.
security.sudo-rs.wheelNeedsPassword = false;
features.swayDesktop.enable = false;
# NOTE: this user's systemd --user lingering -- so the home-manager renovate