From 3f9b968a419e507446ebcef28c293f511210c2cb Mon Sep 17 00:00:00 2001
From: beatzaplenty <wayne.bennett@live.com>
Date: Tue, 28 Jul 2026 17:15:20 +1000
Subject: [PATCH] fix(ha/deploy): use non-sudo SSH for /nix writability check

pve_check() always uses sudo, so "sudo test -w /nix" passes as root
regardless of whether the SSH user can actually write there.  Use a
direct non-sudo SSH command for the writability probe so the check
reflects wayne's own access, not root's.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HaH1cSGvhogRP5ExoF6nD8
---
 scripts/ha/deploy.sh | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/scripts/ha/deploy.sh b/scripts/ha/deploy.sh
index b47c079..618e5ef 100755
--- a/scripts/ha/deploy.sh
+++ b/scripts/ha/deploy.sh
@@ -243,11 +243,15 @@ if ! $SKIP_CREATE_VMS && ! $DRY_RUN; then
   # Fix /nix ownership if it exists but belongs to a different UID.
   # pve1's IPA-enrolled wayne (UID 50002) can't write to a store created by
   # another UID — passwordless sudo corrects it once.
-  if pve_check "test -d /nix" &>/dev/null && ! pve_check "test -w /nix" &>/dev/null; then
+  # Use direct SSH (no sudo) for the writability check so we test wayne's own
+  # access, not root's.
+  local_ssh() { ssh -i ~/.ssh/id_ed25519 "${SSH_USER}@${NODE}" "$*"; }
+  if local_ssh "test -d /nix" &>/dev/null && ! local_ssh "test -w /nix" &>/dev/null; then
     logn "/nix exists but not writable by ${SSH_USER} — fixing ownership with sudo (one-time)..."
-    ssh -i ~/.ssh/id_ed25519 "${SSH_USER}@${NODE}" "sudo chown -R ${SSH_USER} /nix"
+    local_ssh "sudo chown -R ${SSH_USER} /nix"
     logn "Done."
   fi
+  unset -f local_ssh
 
   # Ensure the remote clone is on the correct branch so create-proxmox-resource.sh
   # builds from the same commits we're deploying.