add support for providing sudo passwords via environemnt variables

Author: Mic92

docs/cli.md

@@ -20,7 +20,9 @@ Options:
   print full build logs
 * --env-password
   set a password used by ssh-copy-id, the password should be set by
-  the environment variable SSHPASS
+  the environment variable SSHPASS. Additionally, sudo password can be set
+  via SUDO_PASSWORD environment variable for remote sudo operations 
+  (only supported with sudo, not doas)
 * -s, --store-paths <disko-script> <nixos-system>
   set the store paths to the disko-script and nixos-system directly
   if this is given, flake is not needed

docs/quickstart.md

@@ -120,7 +120,9 @@ example uses a local directory on the source machine.
 If your SSH key is not found, you will be asked for your password. If you are
 using a non-root user, you must have access to sudo without a password. To avoid
 SSH password prompts, set the `SSHPASS` environment variable to your password
-and add `--env-password` to the `nixos-anywhere` command. If providing a
+and add `--env-password` to the `nixos-anywhere` command. Additionally, if your
+target machine requires a sudo password, you can set the `SUDO_PASSWORD`
+environment variable (only supported with sudo, not doas). If providing a
 specific SSH key through `-i` (identity_file), this key will then be used for
 the installation and no temporary SSH key will be created.
 

docs/reference.md

@@ -41,7 +41,9 @@ Options:
   print full build logs
 * --env-password
   set a password used by ssh-copy-id, the password should be set by
-  the environment variable SSHPASS
+  the environment variable SSHPASS. Additionally, sudo password can be set
+  via SUDO_PASSWORD environment variable for remote sudo operations 
+  (only supported with sudo, not doas)
 * -s, --store-paths <disko-script> <nixos-system>
   set the store paths to the disko-script and nixos-system directly
   if this is given, flake is not needed

src/get-facts.sh

@@ -16,6 +16,7 @@ hasTar=$(has tar)
 hasCpio=$(has cpio)
 hasSudo=$(has sudo)
 hasDoas=$(has doas)
+hasPasswordlessSudo=$(if [ "$(has sudo)" = "y" ] && sudo -n true >/dev/null 2>&1; then echo "y"; else echo "n"; fi)
 hasWget=$(has wget)
 hasCurl=$(has curl)
 hasSetsid=$(has setsid)

src/nixos-anywhere.sh

@@ -21,6 +21,7 @@ nixOptions=(
   "--no-write-lock-file"
 )
 SSH_PRIVATE_KEY=${SSH_PRIVATE_KEY-}
+SUDO_PASSWORD=${SUDO_PASSWORD-}
 
 declare -A phases
 phases[kexec]=1
@@ -53,6 +54,7 @@ hasTar=
 hasCpio=
 hasSudo=
 hasDoas=
+hasPasswordlessSudo=
 hasWget=
 hasCurl=
 hasSetsid=
@@ -91,7 +93,9 @@ Options:
   print full build logs
 * --env-password
   set a password used by ssh-copy-id, the password should be set by
-  the environment variable SSHPASS
+  the environment variable SSHPASS. Additionally, sudo password can be set
+  via SUDO_PASSWORD environment variable for remote sudo operations
+  (only supported with sudo, not doas).
 * -s, --store-paths <disko-script> <nixos-system>
   set the store paths to the disko-script and nixos-system directly
   if this is given, flake is not needed
@@ -247,6 +251,10 @@ parseArgs() {
       ;;
     --debug)
       enableDebug="-x"
+      if [[ ${SUDO_PASSWORD} != "" ]]; then
+        echo "WARNING: Debug mode enabled with SUDO_PASSWORD. Password authentication may interfere with debug output." >&2
+        sleep 2
+      fi
       printBuildLogs=y
       set -x
       ;;
@@ -420,6 +428,106 @@ runSsh() {
   ssh "$sshTtyParam" "${sshArgs[@]}" "$sshConnection" "$@"
 }
 
+# Helper function to authenticate sudo with password if needed
+maybeSudo() {
+  # Early return if no command provided and no sudo password
+  if [[ $# -eq 0 && -z ${SUDO_PASSWORD} ]]; then
+    return
+  fi
+
+  # Use 'true' as default command if none provided but we have sudo password
+  local cmd=("${@:-true}")
+
+  if [[ -n ${SUDO_PASSWORD} ]] && [[ ${maybeSudoCommand} == "sudo" ]]; then
+    # If debug is enabled and we have a sudo password, warn about potential issues
+
+    # Use sudo with password authentication - pipe password to all sudo commands
+    printf "printf %%s %q | sudo -S " "$SUDO_PASSWORD"
+    printf '%q ' "${cmd[@]}"
+  elif [[ -n ${maybeSudoCommand} ]]; then
+    printf '%s ' "${maybeSudoCommand}"
+    printf '%q ' "${cmd[@]}"
+  else
+    # No sudo command needed (e.g., already root after kexec)
+    printf '%q ' "${cmd[@]}"
+  fi
+  echo
+}
+
+# Test and cache sudo password if needed
+testAndCacheSudoPassword() {
+  # Skip if no sudo command available
+  if [[ -z ${maybeSudoCommand} ]]; then
+    return 0
+  fi
+
+  # Skip if using doas (doesn't support password authentication)
+  if [[ ${maybeSudoCommand} == "doas" ]]; then
+    return 0
+  fi
+
+  # Skip if sudo works without password
+  if [[ ${hasPasswordlessSudo} == "y" ]]; then
+    step "Passwordless sudo confirmed"
+    return 0
+  fi
+
+  # If we already have a password supplied, trust it
+  if [[ -n ${SUDO_PASSWORD} ]]; then
+    step "Using supplied sudo password"
+    return 0
+  fi
+
+  # Only prompt for password in interactive sessions
+  if [[ -t 0 ]]; then
+    step "Sudo requires password authentication"
+    local attempts=0
+    local maxAttempts=5
+
+    while [[ $attempts -lt $maxAttempts ]]; do
+      echo -n "Enter sudo password for ${sshConnection}: "
+      read -rs password
+      echo
+
+      # Test the password
+      local testOutput
+      testOutput=$(runSshNoTty "printf '%s' $(printf '%q' "$password") | sudo -S echo 'SUDO_TEST_SUCCESS'" 2>&1)
+      if [[ $testOutput == "SUDO_TEST_SUCCESS" ]]; then
+        SUDO_PASSWORD="$password"
+        step "Sudo password verified and cached"
+        return 0
+      else
+        ((attempts++))
+        if [[ $attempts -lt $maxAttempts ]]; then
+          echo "Invalid password, please try again ($attempts/$maxAttempts)"
+        fi
+      fi
+    done
+
+    abort "Failed to authenticate sudo after $maxAttempts attempts"
+  else
+    # Non-interactive session without working sudo
+    abort "Sudo requires password but running in non-interactive mode. Set SUDO_PASSWORD environment variable or configure passwordless sudo."
+  fi
+}
+
+urlEncode() {
+  local string="${1}"
+  local strlen=${#string}
+  local encoded=""
+  local pos c o
+
+  for ((pos = 0; pos < strlen; pos++)); do
+    c=${string:pos:1}
+    case "$c" in
+    [-_.~a-zA-Z0-9]) o="${c}" ;;
+    *) printf -v o '%%%02x' "'$c" ;;
+    esac
+    encoded+="${o}"
+  done
+  echo "${encoded}"
+}
+
 buildStoreUrl() {
   local storeUrl="$1"
 
@@ -433,11 +541,19 @@ buildStoreUrl() {
   fi
 
   # Add remote-program parameter when sudo is needed
-  if [[ -n ${maybeSudo} ]] && [[ $storeUrl == ssh-ng://* ]]; then
+  if [[ -n ${maybeSudoCommand} ]] && [[ $storeUrl == ssh-ng://* ]]; then
+    local remoteProgram
+    if [[ -n ${SUDO_PASSWORD} ]] && [[ ${maybeSudoCommand} == "sudo" ]]; then
+      # Use password authentication for nix-daemon
+      remoteProgram="sh,-c,$(urlEncode "$(printf %s "$(printf '%q' "$SUDO_PASSWORD")" | sudo -S nix-daemon)")"
+    else
+      remoteProgram="${maybeSudoCommand},nix-daemon"
+    fi
+
     if [[ $storeUrl == *"?"* ]]; then
-      storeUrl="${storeUrl}&remote-program=${maybeSudo} nix-daemon"
+      storeUrl="${storeUrl}&remote-program=${remoteProgram}"
     else
-      storeUrl="${storeUrl}?remote-program=${maybeSudo} nix-daemon"
+      storeUrl="${storeUrl}?remote-program=${remoteProgram}"
     fi
   fi
 
@@ -575,7 +691,7 @@ importFacts() {
   # shellcheck disable=SC2046
   export $(echo "$filteredFacts" | xargs)
 
-  for var in isOs isArch isKexec isInstaller isContainer hasIpv6Only hasTar hasCpio hasSudo hasDoas hasWget hasCurl hasSetsid; do
+  for var in isOs isArch isKexec isInstaller isContainer hasIpv6Only hasTar hasCpio hasSudo hasDoas hasPasswordlessSudo hasWget hasCurl hasSetsid; do
     if [[ -z ${!var} ]]; then
       abort "Failed to retrieve fact $var from host"
     fi
@@ -626,20 +742,17 @@ checkBuildLocally() {
 }
 
 generateHardwareConfig() {
-  local maybeSudo="$maybeSudo"
   mkdir -p "$(dirname "$hardwareConfigPath")"
   case "$hardwareConfigBackend" in
   nixos-facter)
     if [[ ${isInstaller} == "y" ]]; then
       if [[ ${hasNixOSFacter} == "n" ]]; then
         abort "nixos-facter is not available in booted installer, use nixos-generate-config. For nixos-facter, you may want to boot an installer image from here instead: https://github.com/nix-community/nixos-images"
       fi
-    else
-      maybeSudo=""
     fi
 
     step "Generating hardware-configuration.nix using nixos-facter"
-    runSshNoTty -o ConnectTimeout=10 ${maybeSudo} "nixos-facter" >"$hardwareConfigPath"
+    runSshNoTty -o ConnectTimeout=10 "$(maybeSudo nixos-facter)" >"$hardwareConfigPath"
     ;;
   nixos-generate-config)
     step "Generating hardware-configuration.nix using nixos-generate-config"
@@ -693,10 +806,10 @@ runKexec() {
   local remoteCommandTemplate
   remoteCommandTemplate="
 set -eu ${enableDebug}
-${maybeSudo} rm -rf /root/kexec
-${maybeSudo} mkdir -p /root/kexec
+$(maybeSudo rm -rf /root/kexec)
+$(maybeSudo mkdir -p /root/kexec)
 %TAR_COMMAND%
-TMPDIR=/root/kexec setsid --wait ${maybeSudo} /root/kexec/kexec/run --kexec-extra-flags $(printf '%q ' "$kexecExtraFlags")
+$(maybeSudo TMPDIR=/root/kexec setsid --wait /root/kexec/kexec/run --kexec-extra-flags "$kexecExtraFlags")
 "
 
   # Define upload commands
@@ -716,16 +829,17 @@ TMPDIR=/root/kexec setsid --wait ${maybeSudo} /root/kexec/kexec/run --kexec-extr
 
   local tarCommand
   local remoteCommands
+
   if [[ ${#localUploadCommand[@]} -eq 0 ]]; then
     # Use remote command for download and execution
-    tarCommand="$(printf '%q ' "${remoteUploadCommand[@]}") | ${maybeSudo} tar -C /root/kexec -xvzf-"
+    tarCommand="$(printf '%q ' "${remoteUploadCommand[@]}") | ${maybeSudoCommand} tar -C /root/kexec -xvzf-"
 
     remoteCommands=${remoteCommandTemplate//'%TAR_COMMAND%'/$tarCommand}
 
     runSsh sh -c "$(printf '%q' "$remoteCommands")"
   else
     # Use local command with pipe to remote
-    tarCommand="${maybeSudo} tar -C /root/kexec -xvzf-"
+    tarCommand="${maybeSudoCommand} tar -C /root/kexec -xvzf-"
     remoteCommands=${remoteCommandTemplate//'%TAR_COMMAND%'/$tarCommand}
 
     "${localUploadCommand[@]}" | runSsh sh -c "$(printf '%q' "$remoteCommands")"
@@ -746,7 +860,7 @@ TMPDIR=/root/kexec setsid --wait ${maybeSudo} /root/kexec/kexec/run --kexec-extr
   # After kexec we explicitly set the user to root@
   sshConnection="root@${sshHost}"
   # After kexec, we're running as root in the NixOS installer, so no need for sudo
-  maybeSudo=""
+  maybeSudoCommand=""
 
   # waiting for machine to become available again
   until runSsh -o ConnectTimeout=10 -- exit 0; do sleep 5; done
@@ -756,7 +870,7 @@ runDisko() {
   local diskoScript=$1
   for path in "${!diskEncryptionKeys[@]}"; do
     step "Uploading ${diskEncryptionKeys[$path]} to $path"
-    runSsh "${maybeSudo} sh -c $(printf '%q' "umask 077; mkdir -p $(dirname "$path"); cat > $path")" <"${diskEncryptionKeys[$path]}"
+    runSsh "$(maybeSudo sh) -c $(printf '%q' "umask 077; mkdir -p $(dirname "$path"); cat > $path")" <"${diskEncryptionKeys[$path]}"
   done
   if [[ -n ${diskoScript} ]]; then
     nixCopy --to "ssh-ng://$sshConnection" "$diskoScript"
@@ -773,7 +887,7 @@ runDisko() {
   fi
 
   step Formatting hard drive with disko
-  runSsh "${maybeSudo} $diskoScript"
+  runSsh "$(maybeSudo "$diskoScript")"
 }
 
 nixosInstall() {
@@ -796,45 +910,46 @@ nixosInstall() {
 
   if [[ -n ${extraFiles} ]]; then
     step Copying extra files
-    tar -C "$extraFiles" -cpf- . | runSsh "${maybeSudo} tar -C /mnt -xf- --no-same-owner"
+    tar -C "$extraFiles" -cpf- . | runSsh "${maybeSudoCommand} tar -C /mnt -xf- --no-same-owner"
 
-    runSsh "${maybeSudo} chmod 755 /mnt" # tar also changes permissions of /mnt
+    runSsh "$(maybeSudo chmod 755 /mnt)" # tar also changes permissions of /mnt
   fi
 
   if [[ ${#extraFilesOwnership[@]} -gt 0 ]]; then
     # shellcheck disable=SC2016
-    printf "%s\n" "${!extraFilesOwnership[@]}" "${extraFilesOwnership[@]}" | pr -2t | runSsh 'while read file ownership; do '"${maybeSudo}"' chown -R "$ownership" "/mnt/$file"; done'
+    printf "%s\n" "${!extraFilesOwnership[@]}" "${extraFilesOwnership[@]}" | pr -2t | runSsh 'while read file ownership; do '"$(maybeSudo chown -R \$ownership \"/mnt/\$file\")"'; done'
   fi
 
   step Installing NixOS
+  # shellcheck disable=SC2016
   runSsh sh <<SSH
 set -eu ${enableDebug}
 # when running not in nixos we might miss this directory, but it's needed in the nixos chroot during installation
 export PATH="\$PATH:/run/current-system/sw/bin"
 
 if [ ! -d "/mnt/tmp" ]; then
   # needed for installation if initrd-secrets are used
-  ${maybeSudo} mkdir -p /mnt/tmp
-  ${maybeSudo} chmod 777 /mnt/tmp
+  $(maybeSudo mkdir -p /mnt/tmp)
+  $(maybeSudo chmod 777 /mnt/tmp)
 fi
 
 if [ ${copyHostKeys-n} = "y" ]; then
   # NB we copy host keys that are in turn copied by kexec installer.
-  ${maybeSudo} mkdir -m 755 -p /mnt/etc/ssh
+  $(maybeSudo mkdir -m 755 -p /mnt/etc/ssh)
   for p in /etc/ssh/ssh_host_*; do
     # Skip if the source file does not exist (i.e. glob did not match any files)
     # or the destination already exists (e.g. copied with --extra-files).
     if [ ! -e "\$p" ] || [ -e "/mnt/\$p" ]; then
       continue
     fi
-    ${maybeSudo} cp -a "\$p" "/mnt/\$p"
+    $(maybeSudo cp -a '$p' '/mnt/$p')
   done
 fi
 # https://stackoverflow.com/a/13864829
 if [ ! -z ${NIXOS_NO_CHECK+0} ]; then
   export NIXOS_NO_CHECK
 fi
-${maybeSudo} nixos-install --no-root-passwd --no-channel-copy --system "$nixosSystem"
+$(maybeSudo nixos-install --no-root-passwd --no-channel-copy --system "$nixosSystem")
 SSH
 
 }
@@ -844,11 +959,11 @@ nixosReboot() {
   runSsh sh <<SSH
   if command -v zpool >/dev/null && [ "\$(zpool list)" != "no pools available" ]; then
     # we always want to export the zfs pools so people can boot from it without force import
-    ${maybeSudo} umount -Rv /mnt/
-    ${maybeSudo} swapoff -a
-    ${maybeSudo} zpool export -a || true
+    $(maybeSudo umount -Rv /mnt/)
+    $(maybeSudo swapoff -a)
+    $(maybeSudo zpool export -a || true)
   fi
-  ${maybeSudo} nohup sh -c 'sleep 6 && reboot' >/dev/null &
+  $(maybeSudo nohup sh -c 'sleep 6 && reboot') >/dev/null &
 SSH
 
   step Waiting for the machine to become unreachable due to reboot
@@ -916,13 +1031,19 @@ main() {
     abort "no setsid command found, but required to run the kexec script under a new session"
   fi
 
-  maybeSudo=""
+  maybeSudoCommand=""
   if [[ ${hasSudo-n} == "y" ]]; then
-    maybeSudo="sudo"
+    maybeSudoCommand="sudo"
   elif [[ ${hasDoas-n} == "y" ]]; then
-    maybeSudo="doas"
+    maybeSudoCommand="doas"
+    if [[ -n ${SUDO_PASSWORD} ]]; then
+      abort "SUDO_PASSWORD environment variable is not supported with doas. Please configure passwordless doas or use sudo instead."
+    fi
   fi
 
+  # Test and cache sudo password if needed
+  testAndCacheSudoPassword
+
   if [[ ${isOs} != "Linux" ]]; then
     abort "This script requires Linux as the operating system, but got $isOs"
   fi