updated sops keys

scripts/ha/cluster-init.sh

@@ -135,6 +135,15 @@ for i in $(seq 1 30); do
 done
 
 # ── 2. DRBD initialisation ────────────────────────────────────────────────
+# Down DRBD first on both nodes before (re-)initialising metadata.
+# This ensures /dev/sdb is not held open by the kernel module, which would
+# trigger a drbdmeta TTY-confirmation prompt ("stdin not a TTY, not waiting
+# for confirmation") during the write-dev-uuid step even when --force is set.
+log "Detaching DRBD on $NODE1 (idempotent pre-init clean-up)..."
+drbdadm down ha-data 2>/dev/null || true
+log "Detaching DRBD on $NODE2 (idempotent pre-init clean-up)..."
+n2_ssh "drbdadm down ha-data 2>/dev/null || true"
+
 log "Initialising DRBD metadata on $NODE1..."
 if ! drbdadm dstate ha-data 2>/dev/null | grep -q "UpToDate\|Inconsistent\|Diskless"; then
   drbdadm create-md ha-data --force
@@ -223,7 +232,7 @@ log "Unmounting ${XFS_MOUNT} — Pacemaker manages it..."
 umount "${XFS_MOUNT}" || { sync; umount -l "${XFS_MOUNT}"; }
 
 log "Demoting DRBD to Secondary — Pacemaker manages primary role..."
-[[ "$(drbdadm role ha-data 2>/dev/null)" == "Primary/Secondary" ]] && drbdadm secondary ha-data || true
+drbdadm role ha-data 2>/dev/null | grep -q "^Primary" && drbdadm secondary ha-data || true
 
 # ── 7. Pacemaker resources ────────────────────────────────────────────────
 log "Configuring Pacemaker cluster properties..."