Merge pull request 'Worktree ha file server test' (#93) from worktree-ha-file-server-test into main

Reviewed-on: #93

modules/build-types/ha-server.nix

@@ -14,7 +14,7 @@
 #   the Beszel hub) is not set yet — add it to hosts/ha-server-{1,2}/host.nix
 #   under services.beszel.agent.environment.KEY once the hub accepts the
 #   new agents, following the pattern in hosts/server/host.nix.
-{ lib, vars, ... }:
+{ lib, pkgs, vars, ... }:
 
 let
   # Generates /etc/exports lines for all nfsShares data entries. Shared
@@ -33,6 +33,10 @@ in
     ../beszel/enable-agent.nix
   ];
 
+  # xfsprogs: mkfs.xfs/xfs_info needed by cluster-init.sh.
+  # openiscsi: iscsiadm needed by acceptance-tests.sh T4 (iSCSI discovery check).
+  environment.systemPackages = [ pkgs.xfsprogs pkgs.openiscsi ];
+
   services.nfs.server = {
     enable = true;
     exports = mkNfsExports vars.haStorageRoot;

modules/ha/cluster-config.nix

@@ -11,14 +11,32 @@
 #   Both host keys must be registered via sync-host-keys.sh first so both nodes can decrypt it.
 #
 # DRBD fencing:
-#   Production setting is resource-only: DRBD waits for the STONITH fence
-#   agent to confirm the peer is dead before promoting to Primary.  This
-#   requires a working fence_pve_ssh STONITH resource in Pacemaker
-#   (see scripts/ha/cluster-enable-stonith.sh).  On a fresh cluster with
-#   no fence device yet, temporarily change to dont-care and run
-#   cluster-enable-stonith.sh once the fence key is deployed.
+#   resource-only with crm-fence-peer.sh: DRBD calls the Pacemaker-aware
+#   crm-fence-peer.sh handler before promoting.  The handler checks the CIB
+#   to confirm the peer's DRBD resource is stopped and returns 7 (successfully
+#   fenced), allowing safe promotion without requiring power-fencing (STONITH).
+#   The unfence handler crm-unfence-peer.sh clears the outdate flag when the
+#   peer reconnects.  This is the correct setting for Pacemaker+DRBD clusters
+#   with STONITH disabled; crm-fence-peer.sh replaces the need for a separate
+#   STONITH device during the testing phase.  Switch to resource-and-stonith
+#   once the fence_pve_ssh STONITH resource is active (see
+#   scripts/ha/cluster-enable-stonith.sh).
 { lib, vars, ... }:
 {
+  # Root SSH access — same key set as nixos user so all admin keys can reach root.
+  users.users.root.openssh.authorizedKeys.keys = [
+    vars.adminSshKey
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMJhrfFayLBG+gWtO6oAvgambw5nWWgztiTFEaaaVRH debian@surface"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGygkCljN6uKpdJbHTOQtn8ZnH+wKXDLAwrDFbLrE/65 nixos@nixos"
+  ];
+
+  # Passwordless sudo for wheel — operator SSHes as nixos and uses sudo for
+  # cluster management commands (drbdadm, crm*, pcs, etc.)
+  security.sudo.wheelNeedsPassword = lib.mkForce false;
+
+  # DRBD lock-file directory (drbd-utils checks for it; missing → harmless but noisy warnings).
+  systemd.tmpfiles.rules = [ "d /var/lib/drbd 0750 root root -" ];
+
   services.drbd = {
     enable = true;
     config = ''
@@ -37,6 +55,10 @@
         disk {
           fencing resource-only;
         }
+        handlers {
+          fence-peer   "/run/current-system/sw/lib/drbd/crm-fence-peer.sh";
+          unfence-peer "/run/current-system/sw/lib/drbd/crm-unfence-peer.sh";
+        }
       }
 
       resource ha-data {

modules/ha/iscsi-target.nix

@@ -25,7 +25,7 @@
 
 let
   python3 = pkgs.python3.withPackages (ps: [ ps.rtslib-fb ]);
-  targetctl = "${pkgs.targetcli-fb}/bin/targetctl";
+  targetctl = "${python3}/bin/targetctl";
 
   targetctlStop = pkgs.writeScript "targetctl-stop" ''
     #!${python3}/bin/python3