From 33ab0a191e70b0baa51560c2a0680ae5a1a870c4 Mon Sep 17 00:00:00 2001
From: Taliyah Webb <taliyahmail@proton.me>
Date: Mon, 23 Jun 2025 11:08:06 +0200
Subject: [PATCH] nixos/netbox: don't force use of sudo in netbox-manage

---
 nixos/doc/manual/release-notes/rl-2511.section.md | 2 ++
 nixos/modules/services/web-apps/netbox.nix        | 9 ++++++++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index 02a7cbec7087..f5a1a6b075b0 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -54,6 +54,8 @@
 
 - The `services.siproxd` module has been removed as `siproxd` is unmaintained and broken with libosip 5.x.
 
+- `netbox-manage` script created by the `netbox` module no longer uses `sudo -u netbox` internally. It can be run as root and will change it's user to `netbox` using `runuser`
+
 - `services.dwm-status.extraConfig` was replaced by [RFC0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md)-compliant [](#opt-services.dwm-status.settings), which is used to generate the config file. `services.dwm-status.order` is now moved to [](#opt-services.dwm-status.settings.order), as it's a part of the config file.
 
 - `gitversion` was updated to 6.3.0, which includes a number of breaking changes, old configurations may need updating or they will cause the tool to fail to run.
diff --git a/nixos/modules/services/web-apps/netbox.nix b/nixos/modules/services/web-apps/netbox.nix
index 73581b56d62c..d29d11d9ab3c 100644
--- a/nixos/modules/services/web-apps/netbox.nix
+++ b/nixos/modules/services/web-apps/netbox.nix
@@ -39,7 +39,14 @@ let
     (writeScriptBin "netbox-manage" ''
       #!${stdenv.shell}
       export PYTHONPATH=${pkg.pythonPath}
-      sudo -u netbox ${pkg}/bin/netbox "$@"
+      case "$(whoami)" in
+      "root")
+        ${util-linux}/bin/runuser -u netbox -- ${pkg}/bin/netbox "$@";;
+      "netbox")
+        ${pkg}/bin/netbox "$@";;
+      *)
+        echo "This must be run by either by root 'netbox' user"
+      esac
     '');
 
 in