beatzaplenty/nixos
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ha/deploy): use non-sudo SSH for /nix writability check

Browse Source 
pve_check() always uses sudo, so "sudo test -w /nix" passes as root
regardless of whether the SSH user can actually write there.  Use a
direct non-sudo SSH command for the writability probe so the check
reflects wayne's own access, not root's.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HaH1cSGvhogRP5ExoF6nD8
This commit is contained in:
beatzaplenty
2026-07-28 17:15:20 +10:00
co-authored by Claude Sonnet 4.6
parent 1263c7540c
commit 3f9b968a41
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/ha/deploy.sh
+6 -2
View File
@@ -243,11 +243,15 @@ if ! $SKIP_CREATE_VMS && ! $DRY_RUN; then
# Fix /nix ownership if it exists but belongs to a different UID. # Fix /nix ownership if it exists but belongs to a different UID.
# pve1's IPA-enrolled wayne (UID 50002) can't write to a store created by # pve1's IPA-enrolled wayne (UID 50002) can't write to a store created by
# another UID — passwordless sudo corrects it once. # another UID — passwordless sudo corrects it once.
if pve_check "test -d /nix" &>/dev/null && ! pve_check "test -w /nix" &>/dev/null; then # Use direct SSH (no sudo) for the writability check so we test wayne's own
# access, not root's.
local_ssh() { ssh -i ~/.ssh/id_ed25519 "${SSH_USER}@${NODE}" "$*"; }
if local_ssh "test -d /nix" &>/dev/null && ! local_ssh "test -w /nix" &>/dev/null; then
logn "/nix exists but not writable by ${SSH_USER} — fixing ownership with sudo (one-time)..." logn "/nix exists but not writable by ${SSH_USER} — fixing ownership with sudo (one-time)..."
ssh -i ~/.ssh/id_ed25519 "${SSH_USER}@${NODE}" "sudo chown -R ${SSH_USER} /nix" local_ssh "sudo chown -R ${SSH_USER} /nix"
logn "Done." logn "Done."
fi fi
unset -f local_ssh
# Ensure the remote clone is on the correct branch so create-proxmox-resource.sh # Ensure the remote clone is on the correct branch so create-proxmox-resource.sh
# builds from the same commits we're deploying. # builds from the same commits we're deploying.