From 07543d7d56427ecbd16c3cfe7a9006274e00ccf9 Mon Sep 17 00:00:00 2001
From: beatzaplenty <wayne.bennett@live.com>
Date: Tue, 28 Jul 2026 23:24:01 +1000
Subject: [PATCH] fix(ha/cluster-init): add drbdmeta to PATH and remove openssl
 dependency
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

drbdmeta lives in the same Nix store dir as drbdadm but sudo doesn't
inherit the full PATH, so drbdmeta was not found (exit 127) even though
drbdadm was.  Resolve drbdmeta's directory from drbdadm's location and
prepend it to PATH.

Replace openssl rand for UUID generation with /proc/sys/kernel/random/uuid
— openssl is not guaranteed to be on PATH in a minimal NixOS root
environment, but /proc/sys/kernel/random/uuid is always present.

Apply the same PATH fix on NODE2 inline in the bash -c invocations that
call drbdmeta over SSH.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 scripts/ha/cluster-init.sh | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/scripts/ha/cluster-init.sh b/scripts/ha/cluster-init.sh
index a2c7d2c..d2aa74b 100755
--- a/scripts/ha/cluster-init.sh
+++ b/scripts/ha/cluster-init.sh
@@ -72,6 +72,18 @@ if ! command -v mkfs.xfs &>/dev/null; then
     || die "mkfs.xfs not found — add xfsprogs to ha-server.nix environment.systemPackages and rebuild"
 fi
 
+# drbdmeta lives alongside drbdadm but may not be in PATH when run via sudo.
+if ! command -v drbdmeta &>/dev/null; then
+  _drbd_bin=$(dirname "$(command -v drbdadm)" 2>/dev/null || true)
+  [[ -n "$_drbd_bin" ]] && export PATH="$_drbd_bin:$PATH" \
+    || die "drbdmeta not found — is drbd-utils in ha-server environment.systemPackages?"
+fi
+
+# Portable 16-hex-char UUID generator (no openssl required).
+_rand_uuid() {
+  cat /proc/sys/kernel/random/uuid 2>/dev/null | tr -d '-' | cut -c1-16 | tr '[:lower:]' '[:upper:]'
+}
+
 # Inter-node SSH/SCP helpers — abstract over root-to-root vs nixos+sudo.
 _SSH_OPTS="-o StrictHostKeyChecking=no -o ConnectTimeout=10"
 [[ -n "$HA_KEY" ]] && _SSH_OPTS="-i $HA_KEY $_SSH_OPTS"
@@ -172,16 +184,17 @@ log "Initialising DRBD metadata on $NODE1..."
 # Calling drbdmeta --force directly bypasses the exclusive-open confirmation on
 # both steps without needing a TTY, regardless of whether the device is busy.
 if ! drbdadm dstate ha-data 2>/dev/null | grep -q "UpToDate"; then
-  UUID1=$(openssl rand -hex 8 2>/dev/null | tr '[:lower:]' '[:upper:]')
+  UUID1=$(_rand_uuid)
   drbdmeta --force 0 v08 /dev/sdb internal create-md
   drbdmeta --force 0 v08 /dev/sdb internal write-dev-uuid "$UUID1"
 fi
 
 log "Initialising DRBD metadata on $NODE2..."
 if ! n2_ssh "drbdadm dstate ha-data 2>/dev/null | grep -q UpToDate" 2>/dev/null; then
-  UUID2=$(openssl rand -hex 8 2>/dev/null | tr '[:lower:]' '[:upper:]')
-  n2_ssh "drbdmeta --force 0 v08 /dev/sdb internal create-md"
-  n2_ssh "drbdmeta --force 0 v08 /dev/sdb internal write-dev-uuid '${UUID2}'"
+  UUID2=$(n2_ssh "cat /proc/sys/kernel/random/uuid 2>/dev/null | tr -d '-' | cut -c1-16 | tr '[:lower:]' '[:upper:]'")
+  # PATH on NODE2 may not include drbdmeta when run via sudo; resolve via drbdadm's directory.
+  n2_ssh "bash -c 'export PATH=\"\$(dirname \"\$(command -v drbdadm)\"):\$PATH\"; drbdmeta --force 0 v08 /dev/sdb internal create-md'"
+  n2_ssh "bash -c 'export PATH=\"\$(dirname \"\$(command -v drbdadm)\"):\$PATH\"; drbdmeta --force 0 v08 /dev/sdb internal write-dev-uuid \"${UUID2}\"'"
 fi
 
 log "Bringing up DRBD on both nodes..."