lyrathorpe/nixfiles
1
0
Fork 0
Code Issues 6 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

fix(edaas): restore passwordless wheel under sudo-rs #102

Merged
lyrathorpe merged 2 commits from fix/edaas-passwordless-sudo-rs into main 2026-08-24 13:29:40 +01:00
Conversation 0 Commits 2 Files Changed 2
+22 -9
2 changed files with 22 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/shell.md
+10 -2
View File
@@ -186,6 +186,14 @@ fleet's stock "wheel, with a password" policy. What it does **not** implement:
host aliases, LDAP/SSSD sudoers, `sudoreplay`, and most `Defaults` settings. host aliases, LDAP/SSSD sudoers, `sudoreplay`, and most `Defaults` settings.
Needing any of those means reverting to `security.sudo`. Needing any of those means reverting to `security.sudo`.
One exception to the password: the EDaaS box sets
`security.sudo-rs.wheelNeedsPassword = false`. NixOS-WSL ships that default for
`security.sudo` — WSL has no console login, so the trust boundary is the Windows
session and the Linux account password is never one the user chose — and the
option does not carry across to the `security.sudo-rs` module, which defaults to
requiring one. Without the explicit setting, `sudo` on that host prompts for a
password nobody knows.
If a host ever refuses to escalate, get a root shell that does not go through If a host ever refuses to escalate, get a root shell that does not go through
sudo (`wsl -u root -d NixOS` on the work box; the console or a serial/HDMI login sudo (`wsl -u root -d NixOS` on the work box; the console or a serial/HDMI login
elsewhere) and roll back with `nixos-rebuild switch --rollback`, or pick the elsewhere) and roll back with `nixos-rebuild switch --rollback`, or pick the
@@ -350,10 +358,10 @@ Claude to route new memories there.
## Per-host differences ## Per-host differences
| | Personal Linux (sway) | macOS | Work WSL (EDaaS) | | | Personal Linux (sway) | macOS | Work WSL (EDaaS) |
| --------------------------- | --------------------- | --------------------- | --------------------------- | | --------------------------- | --------------------- | --------------------- | ---------------------------- |
| Auto-tmux | yes (foot/TTY) | yes (iTerm2) | yes (WSL shell) | | Auto-tmux | yes (foot/TTY) | yes (iTerm2) | yes (WSL shell) |
| `kubectl` → kubecolor | no (no kubectl) | no | yes (work module) | | `kubectl` → kubecolor | no (no kubectl) | no | yes (work module) |
| `sudo` implementation | sudo-rs | Apple sudo + Touch ID | sudo-rs | | `sudo` implementation | sudo-rs (password) | Apple sudo + Touch ID | sudo-rs (passwordless wheel) |
| git email | `iam@emmathe.dev` | `iam@emmathe.dev` | `…@citrix.com` (work) | | git email | `iam@emmathe.dev` | `iam@emmathe.dev` | `…@citrix.com` (work) |
| ssh config managed | yes | yes | no (keeps corporate config) | | ssh config managed | yes | yes | no (keeps corporate config) |
| ssh-agent | yes | launchd | yes (work module) | | ssh-agent | yes | launchd | yes (work module) |
hosts/EDaaS/configuration.nix
+5
View File
@@ -60,6 +60,11 @@
## patch the script ## patch the script
systemd.services.docker-desktop-proxy.script = lib.mkForce ''${config.wsl.wslConf.automount.root}/wsl/docker-desktop/docker-desktop-user-distro proxy --docker-desktop-root ${config.wsl.wslConf.automount.root}/wsl/docker-desktop "C:\Program Files\Docker\Docker\resources"''; systemd.services.docker-desktop-proxy.script = lib.mkForce ''${config.wsl.wslConf.automount.root}/wsl/docker-desktop/docker-desktop-user-distro proxy --docker-desktop-root ${config.wsl.wslConf.automount.root}/wsl/docker-desktop "C:\Program Files\Docker\Docker\resources"'';
# NixOS-WSL's passwordless wheel default only covers `security.sudo`; the
# sudo-rs swap in common-nixos.nix needs it set again. No console login here,
# and no account password anyone knows.
security.sudo-rs.wheelNeedsPassword = false;
features.swayDesktop.enable = false; features.swayDesktop.enable = false;
# NOTE: this user's systemd --user lingering -- so the home-manager renovate # NOTE: this user's systemd --user lingering -- so the home-manager renovate