refactor(viridian): improve remote deployment security

- Remove passwordless sudo for wheel group
- Update deploy command to use -S flag for sudo password prompt
- Maintain secure remote access while enabling deployments

home-manager/sajenim/viridian.nix

@@ -1,13 +1,14 @@
 {...}: {
   imports = [
     ./global
+    ./features/cli
   ];
 
   programs.tmux = {
     enable = true;
     extraConfig = ''
       set -g default-terminal "tmux-256color"
-      set -g status on
+      set -g status off
     '';
   };
 }

justfile

@@ -8,5 +8,4 @@ switch *ARGS:
   sudo nixos-rebuild switch --flake .#{{ARGS}}
 
 deploy *ARGS:
-  nixos-rebuild switch --flake .#{{ARGS}} --target-host {{ARGS}} --use-remote-sudo
-
+  nixos-rebuild switch -S --flake .#{{ARGS}} --target-host {{ARGS}}

nixos/viridian/configuration.nix

@@ -49,9 +49,6 @@
     oci-containers.backend = "docker";
   };
 
-  # Required for smooth remote deployments
-  security.sudo.wheelNeedsPassword = false;
-
   # https://nixos.wiki/wiki/FAQ/When_do_I_update_stateVersion
   system.stateVersion = "24.05";
 }

nixos/viridian/services/inspircd/default.nix

@@ -4,6 +4,9 @@
     config = builtins.readFile ./inspircd.conf;
   };
 
+  # Ensure log directory exists
+  systemd.services.inspircd.serviceConfig.LogsDirectory = "inspircd";
+
   environment.etc = {
     "inspircd/inspircd.motd".source = ./inspircd.motd;
   };

nixos/viridian/services/inspircd/inspircd.conf

@@ -589,7 +589,7 @@
 # The following log tag is highly default and uncustomised. It is recommended you
 # sort out your own log tags. This is just here so you get some output.
 
-<log method="file" type="* -USERINPUT -USEROUTPUT" level="default" target="ircd.log">
+<log method="file" type="* -USERINPUT -USEROUTPUT" level="default" target="/var/log/inspircd/ircd.log">
 
 #-#-#-#-#-#-#-#-#-#-#-#-#-  WHOWAS OPTIONS   -#-#-#-#-#-#-#-#-#-#-#-#-#
 #                                                                     #