Single-user Nix on PVE nodes is owned by root. Add the fixed Nix binary
path (/nix/var/nix/profiles/default/bin/nix) to the NOPASSWD sudoers
rule so non-root SSH users can run nix build from create-proxmox-resource.sh.
Gracefully skips with a warning if Nix isn't installed yet (run after
codex-setup.sh bootstraps the node).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The nixos flake's create-proxmox-resource.sh runs pvesh/qm/pct over
non-interactive SSH, which requires NOPASSWD sudo for those binaries.
pvesh moved from /usr/sbin to /usr/bin in PVE 8.x, so the script
resolves paths at runtime rather than hardcoding them, preventing the
silent NOPASSWD-miss that caused ipcc_send_rec errors.
- scripts/setup-admin-sudo.sh: new script, takes username, writes
/etc/sudoers.d/<user>-proxmox with correct resolved paths and
validates it with visudo -c before leaving it in place
- scripts/bootstrap.sh: add setup-admin-sudo.sh to post-steps list
- scripts/audit.sh: check that a *-proxmox sudoers file exists with
NOPASSWD for all three tools
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
beatzaplentyandClaude Sonnet 4.6