Merge pull request 'fix(ha): prefix qm commands with sudo for non-root Proxmox SSH user' (#104) from worktree-partitioned-swimming-pizza into main

Reviewed-on: #104

scripts/gc-hosts.sh

@@ -71,47 +71,42 @@ _add_host "nixos" "${NIXOS_USER}@nixos" "nixos"
 _add_host "pve1" "${PVE1_SSH_USER}@${PVE1_HOST}" "nix"
 
 # 3. Dynamically discover running NixOS guests on pve1
-#
-# create-proxmox-resource.sh names every guest after its NixOS hostname:
-#   pct create ... --hostname <nixos-hostname>  (LXC)
-#   qm  create ... --name    <nixos-hostname>   (VM)
-# So pct/qm list output already contains the NixOS hostname directly.
-# We validate against the flake to filter out non-NixOS guests on pve1
-# (e.g. FreeIPA, Proxmox Backup Server) that share the same Proxmox node.
 echo "Discovering running guests on ${PVE1_HOST}..."
 
-# Eval the flake once to get the set of hostnames that are actually NixOS.
-# Values are NixOS hostnames (e.g. "docker"); keys are flake targets ("lxc-docker").
-nixos_hostnames=""
-nixos_hostnames="$(
+# Evaluate the full flake hostname map in one shot.
+hostname_map="{}"
+if ! hostname_map="$(
   nix eval --json "${NIX_EVAL_FLAGS[@]}" .#nixosConfigurations \
-    --apply 'cfgs: builtins.attrValues (builtins.mapAttrs (_: cfg: cfg.config.networking.hostName) cfgs)' \
-    2>/dev/null | jq -r '.[]' | sort -u
-)" || { echo "  warning: flake eval failed — non-NixOS guests will not be filtered" >&2; }
+    --apply 'cfgs: builtins.mapAttrs (_: cfg: cfg.config.networking.hostName) cfgs' \
+    2>/dev/null
+)"; then
+  echo "  warning: flake eval failed — skipping dynamic host discovery" >&2
+fi
 
-# SSH_QUERY_OPTS (no BatchMode) so sudo can prompt if needed for pct/qm.
+# SSH_QUERY_OPTS (no BatchMode) so sudo can prompt if wayne's sudo needs a password.
 if ssh "${SSH_QUERY_OPTS[@]}" "${PVE1_SSH_USER}@${PVE1_HOST}" "true" 2>/dev/null; then
   running_guests="$(
-    ssh "${SSH_QUERY_OPTS[@]}" "${PVE1_SSH_USER}@${PVE1_HOST}" bash -s <<'DISCOVER'
-sudo pct list 2>/dev/null | awk 'NR>1 && $2=="running" { print $NF }'
-sudo qm  list 2>/dev/null | awk 'NR>1 && $3=="running" { print $2  }'
-DISCOVER
+    ssh "${SSH_QUERY_OPTS[@]}" "${PVE1_SSH_USER}@${PVE1_HOST}" bash <<'REMOTE'
+      { sudo pct list 2>/dev/null | awk 'NR>1 && $2=="running" { print $NF }';
+        sudo qm  list 2>/dev/null | awk 'NR>1 && $3=="running" { print $2  }'; } | sort -u
+REMOTE
   )" || running_guests=""
 
-  while IFS= read -r hostname; do
+  while IFS= read -r guest; do
+    [[ -z "$guest" ]] && continue
+
+    # Resolve flake target name → NixOS hostname.
+    hostname="$(printf '%s' "$hostname_map" \
+      | jq -r --arg g "$guest" '.[$g] // empty' 2>/dev/null || true)"
     [[ -z "$hostname" ]] && continue
-    # Exclude nix-cache.
-    case "$hostname" in *nix-cache*) continue ;; esac
-    # Skip if not a flake-managed NixOS host (filters non-NixOS pve1 guests).
-    if [[ -n "$nixos_hostnames" ]] && ! grep -qxF "$hostname" <<< "$nixos_hostnames"; then
-      continue
-    fi
-    # Skip if already in the list (e.g. a proxmox-gui guest whose hostname is nixos).
+
+    # Exclude nix-cache and any hostname already in the list.
+    case "$hostname" in nix-cache) continue ;; esac
     if [[ -n "${_SEEN_HOSTNAMES[$hostname]+_}" ]]; then continue; fi
 
-    echo "  + $hostname"
+    echo "  + $guest → $hostname"
     _add_host "$hostname" "${NIXOS_USER}@${hostname}" "nixos"
-  done <<< "$(echo "$running_guests" | sort -u)"
+  done <<< "$running_guests"
 else
   echo "  warning: ${PVE1_HOST} unreachable — skipping dynamic host discovery" >&2
 fi

scripts/ha/resize-data-disk.sh

@@ -30,6 +30,8 @@ DATA_DISK_SLOT="${DATA_DISK_SLOT:-scsi1}"   # Proxmox disk name (scsi1 = data di
 HA_USER="${HA_USER:-nixos}"
 PVE_HOST="${PVE_HOST:-${PVE1_HOST}}"
 PVE_SSH_USER="${PVE_SSH_USER:-${PROXMOX_SSH_USER}}"
+PVE_SUDO=""
+[[ "$PVE_SSH_USER" != "root" ]] && PVE_SUDO="sudo"
 # By-id symlink for the data disk; basename resolves to the raw block device.
 # matches variables.nix's haServerDrbdDisk.
 DATA_DISK_BYID="${DATA_DISK_BYID:-scsi-0QEMU_QEMU_HARDDISK_drive-${DATA_DISK_SLOT}}"
@@ -140,7 +142,7 @@ fi
 echo ""
 echo "Looking up VM IDs on ${PVE_HOST}..."
 
-QM_LIST=$(pve "qm list 2>/dev/null" || true)
+QM_LIST=$(pve "$PVE_SUDO qm list 2>/dev/null" || true)
 VMID1=$(echo "$QM_LIST" | awk -v name="$NODE1" '$0 ~ name {print $1}' | head -1)
 VMID2=$(echo "$QM_LIST" | awk -v name="$NODE2" '$0 ~ name {print $1}' | head -1)
 
@@ -182,12 +184,12 @@ echo "── Phase 1 — Proxmox disk resize (${DATA_DISK_SLOT} ${SIZE} on both
 
 echo "  ${DRY_PREFIX}qm resize $VMID1 ${DATA_DISK_SLOT} ${SIZE}  ($NODE1 on ${PVE_HOST})"
 if ! $DRY_RUN; then
-  pve "qm resize $VMID1 ${DATA_DISK_SLOT} ${SIZE}"
+  pve "$PVE_SUDO qm resize $VMID1 ${DATA_DISK_SLOT} ${SIZE}"
 fi
 
 echo "  ${DRY_PREFIX}qm resize $VMID2 ${DATA_DISK_SLOT} ${SIZE}  ($NODE2 on ${PVE_HOST})"
 if ! $DRY_RUN; then
-  pve "qm resize $VMID2 ${DATA_DISK_SLOT} ${SIZE}"
+  pve "$PVE_SUDO qm resize $VMID2 ${DATA_DISK_SLOT} ${SIZE}"
 fi
 
 echo "  Phase 1 done."

variables.nix

@@ -58,6 +58,7 @@
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBZ9WKKAlP9Z7GQdgaZ1Xgw9C+vja2lqEZO5rJFpVqYN root@ha-server-1"
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEGNKlaaMckd8nLWNGz4B2QokXjnnIvM+rEUv+R6h0sp root@ha-server-2"
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK+XeMco7OxUpjrjZm54HogMs9QB5xlcKmElASRvrmlW root@nixos"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMseQwPpmaa6cgV5U8KhUsiVSYARG85zGa9rho0LJWks wayne@pve1"
   ];
 
   # Admin SSH public key, authorized on the primary user of every host and