Merge pull request 'fix(ha): prefix qm commands with sudo for non-root Proxmox SSH user' (#104 ) from worktree-partitioned-swimming-pizza into main

Reviewed-on: #104
Merge pull request 'fix(gc-hosts): fix pve1 PATH and discovery sudo prompts' (#103 ) from worktree-crispy-churning-kernighan into main
2026-07-29 03:55:28 +00:00 · 2026-07-29 03:53:50 +00:00 · 2026-07-29 13:53:41 +10:00 · 2026-07-29 03:46:05 +00:00 · 2026-07-29 03:36:09 +00:00 · 2026-07-29 03:16:53 +00:00
2 changed files with 6 additions and 3 deletions
@@ -30,6 +30,8 @@ DATA_DISK_SLOT="${DATA_DISK_SLOT:-scsi1}"   # Proxmox disk name (scsi1 = data di
 HA_USER="${HA_USER:-nixos}"
 PVE_HOST="${PVE_HOST:-${PVE1_HOST}}"
 PVE_SSH_USER="${PVE_SSH_USER:-${PROXMOX_SSH_USER}}"
+PVE_SUDO=""
+[[ "$PVE_SSH_USER" != "root" ]] && PVE_SUDO="sudo"
 # By-id symlink for the data disk; basename resolves to the raw block device.
 # matches variables.nix's haServerDrbdDisk.
 DATA_DISK_BYID="${DATA_DISK_BYID:-scsi-0QEMU_QEMU_HARDDISK_drive-${DATA_DISK_SLOT}}"
@@ -140,7 +142,7 @@ fi
 echo ""
 echo "Looking up VM IDs on ${PVE_HOST}..."

-QM_LIST=$(pve "qm list 2>/dev/null" || true)
+QM_LIST=$(pve "$PVE_SUDO qm list 2>/dev/null" || true)
 VMID1=$(echo "$QM_LIST" | awk -v name="$NODE1" '$0 ~ name {print $1}' | head -1)
 VMID2=$(echo "$QM_LIST" | awk -v name="$NODE2" '$0 ~ name {print $1}' | head -1)

@@ -182,12 +184,12 @@ echo "── Phase 1 — Proxmox disk resize (${DATA_DISK_SLOT} ${SIZE} on both

 echo "  ${DRY_PREFIX}qm resize $VMID1 ${DATA_DISK_SLOT} ${SIZE}  ($NODE1 on ${PVE_HOST})"
 if ! $DRY_RUN; then
-  pve "qm resize $VMID1 ${DATA_DISK_SLOT} ${SIZE}"
+  pve "$PVE_SUDO qm resize $VMID1 ${DATA_DISK_SLOT} ${SIZE}"
 fi

 echo "  ${DRY_PREFIX}qm resize $VMID2 ${DATA_DISK_SLOT} ${SIZE}  ($NODE2 on ${PVE_HOST})"
 if ! $DRY_RUN; then
-  pve "qm resize $VMID2 ${DATA_DISK_SLOT} ${SIZE}"
+  pve "$PVE_SUDO qm resize $VMID2 ${DATA_DISK_SLOT} ${SIZE}"
 fi

 echo "  Phase 1 done."
@@ -58,6 +58,7 @@
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBZ9WKKAlP9Z7GQdgaZ1Xgw9C+vja2lqEZO5rJFpVqYN root@ha-server-1"
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEGNKlaaMckd8nLWNGz4B2QokXjnnIvM+rEUv+R6h0sp root@ha-server-2"
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK+XeMco7OxUpjrjZm54HogMs9QB5xlcKmElASRvrmlW root@nixos"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMseQwPpmaa6cgV5U8KhUsiVSYARG85zGa9rho0LJWks wayne@pve1"
  ];

  # Admin SSH public key, authorized on the primary user of every host and
Author	SHA1	Message	Date
beatzaplenty	dc6c37ed2e	Merge pull request 'fix(ha): prefix qm commands with sudo for non-root Proxmox SSH user' (#104 ) from worktree-partitioned-swimming-pizza into main Check NixOS configurations / eval-hosts (push) Failing after 4m22s Details Reviewed-on: #104	2026-07-29 03:55:28 +00:00
beatzaplenty	b5e61d62bd	Merge pull request 'fix(gc-hosts): fix pve1 PATH and discovery sudo prompts' (#103 ) from worktree-crispy-churning-kernighan into main Check NixOS configurations / eval-hosts (push) Successful in 10m23s Details Reviewed-on: #103	2026-07-29 03:53:50 +00:00
beatzaplentyandClaude Sonnet 4.6	ced1657407	fix(ha): prefix qm commands with sudo for non-root Proxmox SSH user Check NixOS configurations / eval-hosts (pull_request) Successful in 10m25s Details qm lives at /usr/sbin/qm, which is not in the default PATH for non-interactive SSH sessions as a non-root user. Add PVE_SUDO (set to "sudo" when PVE_SSH_USER != root, matching create-proxmox-resource.sh's own sudo_prefix pattern) and prepend it to all three qm invocations in the script. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-29 13:53:41 +10:00
beatzaplenty	fdf41c659c	Merge pull request 'Worktree crispy churning kernighan' (#102 ) from worktree-crispy-churning-kernighan into main Check NixOS configurations / eval-hosts (push) Successful in 10m50s Details Reviewed-on: #102	2026-07-29 03:46:05 +00:00
beatzaplenty	7ba603c005	Merge pull request 'feat(scripts): add gc-hosts.sh for parallel nix gc across all live hosts' (#101 ) from worktree-crispy-churning-kernighan into main Check NixOS configurations / eval-hosts (push) Successful in 10m32s Details Reviewed-on: #101	2026-07-29 03:36:09 +00:00
beatzaplenty	4490dfab7d	Merge pull request 'feat(nix-cache): authorize pve1's wayne key as remote builder client' (#100 ) from worktree-pve1-nix-cache-builder into main Check NixOS configurations / eval-hosts (push) Successful in 10m32s Details Reviewed-on: #100	2026-07-29 03:16:53 +00:00
beatzaplentyandClaude Sonnet 4.6	fa163b613d	feat(nix-cache): authorize pve1's wayne key as remote builder client Check NixOS configurations / eval-hosts (pull_request) Successful in 10m31s Details Generated /home/wayne/.ssh/id_ed25519 on pve1 (single-user Nix install owned by wayne, no daemon — builds run as wayne not root). Adds the public key to remoteBuilderAuthorizedKeys so nix-cache accepts it. After deploying nix-cache, re-run configure-nix-cache-client.sh as wayne on pve1 to wire in the builder line and known_hosts entry. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-29 13:16:30 +10:00