nixos-rebuild: support sudo + --target-host #71143
Conversation
This adds support for deploying to remote hosts without being root: sudo nixos-rebuild --target-host non-root@host Without this change, only root@host is able to deploy. The idea is that if the local command is run with sudo, so should the remote one, thus there is no need for adding any CLI options.
bjornfor
added
0.kind: enhancement
ofborg
bot
added
8.has: module (update)
| @@ -111,17 +115,17 @@ buildHostCmd() { | |||
| if [ -z "$buildHost" ]; then | |||
| "$@" | |||
| elif [ -n "$remoteNix" ]; then | |||
| ssh $SSHOPTS "$buildHost" env PATH="$remoteNix:$PATH" "$@" | |||
| ssh $SSHOPTS "$buildHost" env PATH="$remoteNix:$PATH" "$maybeSudo$@" | |||
There was a problem hiding this comment.
Good point. At least this works well with NixOS, I tested with my setup:
security.sudo = {
enable = true;
wheelNeedsPassword = false;
};
(I don't want to do change how PATH is handled here, as I feel it's orthogonal to this PR.)
|
I plan to merge this in 2 days (monday evening), if no other comments. |
|
I just find the assumption a bit weird, why would I want to use sudo remotely because it was used locally and the other way around? |
|
I did it because of simplicity. But I agree there are use cases for local sudo != remote sudo. I initially wanted to have a flag like --nixos-rebuild-path="sudo nixos-rebuild" (this matches rsync and borg), but nixos-rebuild doesn't call itself on the remote side, it calls nix-build, nix-env etc. How about --use-sudo=0/1 that is only accepted when --target-host is set? |
|
@bjornfor that sounds like a plan. |
|
I opened a revert PR: #71788 so we don't forget to change that. |
Motivation for this change
This adds support for deploying to remote hosts without being root:
Without this change, only root@host is able to deploy.
The idea is that if the local command is run with sudo, so should the
remote one, thus there is no need for adding any CLI options.
Things done
sandboxinnix.confon non-NixOS)nix-build ./nixos/tests/installer.nixpassesnix-shell -p nix-review --run "nix-review wip"./result/bin/)nix path-info -Sbefore and after)Notify maintainers
cc @jtojnar @matthewbauer @LnL7 @Mic92 (last few people to touch nixos-rebuild)