From 3db631695ab6b2d2eadfdfa9f6b8c7545c56c452 Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Sun, 22 Feb 2026 18:16:27 +0000
Subject: [PATCH] nixos-rebuild-ng: add NIX_SUDOOPTS for remote

---
 .../src/nixos_rebuild/process.py              | 11 +++++--
 .../src/tests/test_process.py                 | 33 +++++++++++++++++++
 2 files changed, 42 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
index 8574b43067b8..2449c69cbeae 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/process.py
@@ -150,11 +150,18 @@ def run_wrapper(
             remote_run_args = _prefix_env_cmd_remote(run_args, normalized_env)
 
         if sudo:
+            sudo_args = shlex.split(os.getenv("NIX_SUDOOPTS", ""))
             if remote.sudo_password:
-                remote_run_args = ["sudo", "--prompt=", "--stdin", *remote_run_args]
+                remote_run_args = [
+                    "sudo",
+                    "--prompt=",
+                    "--stdin",
+                    *sudo_args,
+                    *remote_run_args,
+                ]
                 process_input = remote.sudo_password + "\n"
             else:
-                remote_run_args = ["sudo", *remote_run_args]
+                remote_run_args = ["sudo", *sudo_args, *remote_run_args]
 
         ssh_args: list[Arg] = [
             "ssh",
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py
index 58528e81fda8..858850f569a8 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_process.py
@@ -199,3 +199,36 @@ def test_custom_sudo_args(mock_run: Any) -> None:
         text=True,
         errors="surrogateescape",
     )
+
+    with patch.dict(
+        p.os.environ,
+        {"NIX_SUDOOPTS": "--custom foo --args", "PATH": "/path/to/bin"},
+        clear=True,
+    ):
+        p.run_wrapper(
+            ["test"],
+            check=False,
+            sudo=True,
+            remote=m.Remote("user@localhost", [], None),
+        )
+    mock_run.assert_called_with(
+        [
+            "ssh",
+            *p.SSH_DEFAULT_OPTS,
+            "user@localhost",
+            "--",
+            "sudo",
+            "--custom",
+            "foo",
+            "--args",
+            "env",
+            "-i",
+            "PATH=${PATH-}",
+            "test",
+        ],
+        check=False,
+        env=None,
+        input=None,
+        text=True,
+        errors="surrogateescape",
+    )