Deploy without sudo password

modules/misc/common/default.nix

@@ -113,15 +113,29 @@
   };
 
   security.sudo = {
-    extraRules = [
+    extraRules =
+      let
+        storePrefix = "/nix/store/*";
+        systemName = "nixos-system-${config.networking.hostName}-*";
+      in
+      [
         {
-        users = [ "%wheel" ];
           commands = [
             {
-            command = "ALL";
+              command = "${storePrefix}-nix-*/bin/nix-env -p /nix/var/nix/profiles/system --set ${storePrefix}-${systemName}";
-            options = [ "SETENV" "NOPASSWD" ];
+              options = [ "NOPASSWD" ];
             }
           ];
+          groups = [ "wheel" ];
+        }
+        {
+          commands = [
+            {
+              command = "${storePrefix}-${systemName}/bin/switch-to-configuration";
+              options = [ "NOPASSWD" ];
+            }
+          ];
+          groups = [ "wheel" ];
         }
       ];
   };