fix(ha/cluster-init): add drbdmeta to PATH and remove openssl dependency

drbdmeta lives in the same Nix store dir as drbdadm but sudo doesn't
inherit the full PATH, so drbdmeta was not found (exit 127) even though
drbdadm was.  Resolve drbdmeta's directory from drbdadm's location and
prepend it to PATH.

Replace openssl rand for UUID generation with /proc/sys/kernel/random/uuid
— openssl is not guaranteed to be on PATH in a minimal NixOS root
environment, but /proc/sys/kernel/random/uuid is always present.

Apply the same PATH fix on NODE2 inline in the bash -c invocations that
call drbdmeta over SSH.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/ha/cluster-init.sh

@@ -72,6 +72,18 @@ if ! command -v mkfs.xfs &>/dev/null; then
     || die "mkfs.xfs not found — add xfsprogs to ha-server.nix environment.systemPackages and rebuild"
 fi
 
+# drbdmeta lives alongside drbdadm but may not be in PATH when run via sudo.
+if ! command -v drbdmeta &>/dev/null; then
+  _drbd_bin=$(dirname "$(command -v drbdadm)" 2>/dev/null || true)
+  [[ -n "$_drbd_bin" ]] && export PATH="$_drbd_bin:$PATH" \
+    || die "drbdmeta not found — is drbd-utils in ha-server environment.systemPackages?"
+fi
+
+# Portable 16-hex-char UUID generator (no openssl required).
+_rand_uuid() {
+  cat /proc/sys/kernel/random/uuid 2>/dev/null | tr -d '-' | cut -c1-16 | tr '[:lower:]' '[:upper:]'
+}
+
 # Inter-node SSH/SCP helpers — abstract over root-to-root vs nixos+sudo.
 _SSH_OPTS="-o StrictHostKeyChecking=no -o ConnectTimeout=10"
 [[ -n "$HA_KEY" ]] && _SSH_OPTS="-i $HA_KEY $_SSH_OPTS"
@@ -172,16 +184,17 @@ log "Initialising DRBD metadata on $NODE1..."
 # Calling drbdmeta --force directly bypasses the exclusive-open confirmation on
 # both steps without needing a TTY, regardless of whether the device is busy.
 if ! drbdadm dstate ha-data 2>/dev/null | grep -q "UpToDate"; then
-  UUID1=$(openssl rand -hex 8 2>/dev/null | tr '[:lower:]' '[:upper:]')
+  UUID1=$(_rand_uuid)
   drbdmeta --force 0 v08 /dev/sdb internal create-md
   drbdmeta --force 0 v08 /dev/sdb internal write-dev-uuid "$UUID1"
 fi
 
 log "Initialising DRBD metadata on $NODE2..."
 if ! n2_ssh "drbdadm dstate ha-data 2>/dev/null | grep -q UpToDate" 2>/dev/null; then
-  UUID2=$(openssl rand -hex 8 2>/dev/null | tr '[:lower:]' '[:upper:]')
+  UUID2=$(n2_ssh "cat /proc/sys/kernel/random/uuid 2>/dev/null | tr -d '-' | cut -c1-16 | tr '[:lower:]' '[:upper:]'")
-  n2_ssh "drbdmeta --force 0 v08 /dev/sdb internal create-md"
+  # PATH on NODE2 may not include drbdmeta when run via sudo; resolve via drbdadm's directory.
-  n2_ssh "drbdmeta --force 0 v08 /dev/sdb internal write-dev-uuid '${UUID2}'"
+  n2_ssh "bash -c 'export PATH=\"\$(dirname \"\$(command -v drbdadm)\"):\$PATH\"; drbdmeta --force 0 v08 /dev/sdb internal create-md'"
+  n2_ssh "bash -c 'export PATH=\"\$(dirname \"\$(command -v drbdadm)\"):\$PATH\"; drbdmeta --force 0 v08 /dev/sdb internal write-dev-uuid \"${UUID2}\"'"
 fi
 
 log "Bringing up DRBD on both nodes..."