Passwordless sudo with remote nixos-rebuild and SSH keys
In my homelab I now have a few machines that run NixOS. This came to be because I wanted the ability to quickly rebuild machines from scratch without having to fiddle with individual settings. Thanks to NixOS I now have a repository that holds a flake that can build bootable images and perform remote nixos-rebuild switch.
Having the ability to remotely perform nixos-rebuild switch is great. All changes are tracked in git, I can standardize certain aspects via Nix modules and it covers all aspects of a system, something I never really got to work reliably in Ansible. Remote nixos-rebuild switch works by specifying --target-host user@host which will use ssh to perform switch on the other machine. If pubkeys are set up authentication will be automatic. However, if the remote user is not root, and it shouldn’t be, sudo is required via --sudo and that will require password and with -S nixos-rebuild will ask you for the password. Not ideal.