My NixOS configs
- Nix 74.4%
- TypeScript 12.7%
- Crystal 8.9%
- Ruby 1.6%
- Shell 1.4%
- Other 1%
| Filename | Latest commit message | Latest commit date |
|---|---|---|
Hermes Agent
0d11d5b16d
Run #316 (`ci: validate deploy key and run ssh -T before deploy`) showed the deploy key itself is now fine — `ssh -T` connected and the forced command ran — but the trigger script's `systemctl start --wait nixos-upgrade.service` was denied: ``` Failed to start nixos-upgrade.service: Access denied as the requested operation requires interactive authentication. However, interactive authentication has not been enabled by the calling program. ``` The forced command runs as the non-interactive `ci-deploy` user, so polkit checks the start request and denies it without a rule. This PR adds a `security.polkit.extraConfig` rule inside `modules/ci-deploy.nix` allowing exactly the `ci-deploy` user to start exactly `nixos-upgrade.service` (polkit is already enabled on freun-dev for the netbird rules; this only adds the scoped rule). Verified: `nix eval` + full `nix build` of `nixosConfigurations.freun-dev.config.system.build.toplevel`; the merged `security.polkit.extraConfig` contains both the netbird rules and the new nixos-upgrade rule; polkit.enable = true. Reviewed-on: #26 |
||
| .forgejo/workflows | ||
| .zed | ||
| modules | ||
| scripts | ||
| secrets | ||
| .envrc | ||
| .gitignore | ||
| .sops.yaml | ||
| AGENTS.md | ||
| flake.lock | ||
| flake.nix | ||
| README.md | ||
My NixOS Configurations
test