fix(edaas): restore passwordless wheel under sudo-rs #102

Merged

lyrathorpe merged 2 commits from fix/edaas-passwordless-sudo-rs into main

2026-08-24 13:29:40 +01:00

Author	SHA1	Message	Date
Emma Thorpe	4ac9d1108b	docs(shell): record the EDaaS passwordless-wheel exception CI / flake (push) Skipped CI / flake (pull_request) Successful in 4m10s Details The sudo-rs section claimed the whole fleet runs the stock "wheel, with a password" policy, which is no longer true for the WSL host. Explain why the NixOS-WSL default does not survive the sudo-rs swap, and mark the difference in the per-host table.	2026-08-24 11:16:15 +01:00
Emma Thorpe	0c151943de	fix(edaas): restore passwordless wheel under sudo-rs NixOS-WSL sets `security.sudo.wheelNeedsPassword = false`, but that option belongs to the `security.sudo` module and does not carry over to the sudo-rs swap in modules/common-nixos.nix, whose equivalent option defaults to true. Since that swap landed, sudo on this host prompts for the account password -- which WSL set during install and nobody knows -- so escalation only worked through `wsl -u root`. Set `security.sudo-rs.wheelNeedsPassword = false` on the host to match the NixOS-WSL default. Other NixOS hosts are unaffected and keep the prompt.	2026-08-24 11:16:12 +01:00

Author

SHA1

Message

Date

Emma Thorpe

4ac9d1108b

docs(shell): record the EDaaS passwordless-wheel exception

CI / flake (push) Skipped

CI / flake (pull_request) Successful in 4m10s

Details

The sudo-rs section claimed the whole fleet runs the stock "wheel, with a
password" policy, which is no longer true for the WSL host. Explain why the
NixOS-WSL default does not survive the sudo-rs swap, and mark the difference in
the per-host table.

2026-08-24 11:16:15 +01:00

Emma Thorpe

0c151943de

fix(edaas): restore passwordless wheel under sudo-rs

NixOS-WSL sets `security.sudo.wheelNeedsPassword = false`, but that option
belongs to the `security.sudo` module and does not carry over to the sudo-rs
swap in modules/common-nixos.nix, whose equivalent option defaults to true.
Since that swap landed, sudo on this host prompts for the account password --
which WSL set during install and nobody knows -- so escalation only worked
through `wsl -u root`.

Set `security.sudo-rs.wheelNeedsPassword = false` on the host to match the
NixOS-WSL default. Other NixOS hosts are unaffected and keep the prompt.

2026-08-24 11:16:12 +01:00