From 8c70372cc47277058b9f9d3f8f05467cf5194366 Mon Sep 17 00:00:00 2001 From: Vuong Hoang Date: Tue, 21 Apr 2026 01:31:01 -0700 Subject: [PATCH] =?UTF-8?q?restic/vm-esh-nas:=20fix=20htpasswd-append=20ex?= =?UTF-8?q?ample=20=E2=80=94=20root=5Fsquash=20awareness?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Anaheim NAS exports /mnt/backup with root_squash, so sudo-as-root on ana-docker becomes nobody on the NFS side and `sudo tee` gets EACCES. The repo tree is owned by lkraven:lkraven precisely because of this — all writes go through the lkraven UID. Drop sudo from the example; plain `>>` append as lkraven works. --- configs/restic/vm-esh-nas/README.md | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/configs/restic/vm-esh-nas/README.md b/configs/restic/vm-esh-nas/README.md index 3ba7e37..d92e48e 100644 --- a/configs/restic/vm-esh-nas/README.md +++ b/configs/restic/vm-esh-nas/README.md @@ -49,18 +49,24 @@ ssh -t vm-esh-nas 'sudo apt update && sudo apt install -y restic' If not already present from an earlier pass: ```bash -# Single ssh invocation — the pipe must stay on the REMOTE side so -# sudo can prompt on the local keyboard. `ssh -t ... | ssh -t ...` -# breaks because sudo's password read conflicts with the pipe contents. -ssh -t ana-docker ' +# The repo dir is on NFS from the Debian NAS (10.250.50.50) exported with +# root_squash, so sudo gets denied writes. It is owned by lkraven:lkraven, +# so append as lkraven directly — no sudo needed. +ssh ana-docker ' docker run --rm httpd:2.4-alpine htpasswd -nbB vm-esh-nas "" \ - | sudo tee -a /mnt/backup/restic/repo/ana/.htpasswd >/dev/null + >> /mnt/backup/restic/repo/ana/.htpasswd ' ``` Heads-up: the password is in your shell history after this runs. Scrub with `history -d ` or `history -c`. +Sanity check the file ownership afterward: +```bash +ssh ana-docker 'ls -la /mnt/backup/restic/repo/ana/.htpasswd' +# expect: -rw------- 1 lkraven lkraven ... +``` + ### 3. Install restic creds on vm-esh-nas ```bash