From f5703550fbdc74d1c4662292b962622c01e56547 Mon Sep 17 00:00:00 2001
From: Vuong Hoang <vh@phasefinal.com>
Date: Mon, 20 Apr 2026 23:15:02 -0700
Subject: [PATCH] restic/ana-ml2: fix verification snippet to run inside sudo
 shell
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Original used `sudo env \$(cat /etc/restic/restic.env) …` but the `cat`
in command substitution runs as the login user, not root. Since the
env-file is root:600, the substitution silently yielded an empty
RESTIC_REPOSITORY and restic errored with "Please specify repository
location".

Wrap the whole dance in `sudo bash -c "…"` so the env-file read and
the restic call both happen as root.
---
 configs/restic/ana-ml2/README.md | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/configs/restic/ana-ml2/README.md b/configs/restic/ana-ml2/README.md
index e0f856f..15fe275 100644
--- a/configs/restic/ana-ml2/README.md
+++ b/configs/restic/ana-ml2/README.md
@@ -61,13 +61,20 @@ EOF
 
 ### 2. Verify creds against the existing repo
 
-Before deploying the profile, prove the secrets are correct:
+Before deploying the profile, prove the secrets are correct. The
+`/etc/restic/restic.env` and `/etc/restic/password` files are root:600,
+so the env-file read AND the restic invocation both need to run inside
+the same sudo shell — otherwise `$(cat …)` runs as the login user,
+fails silently, and restic complains about a missing repository:
 
 ```bash
 ssh -t ana-ml2 '
-  sudo env $(cat /etc/restic/restic.env) \
-       RESTIC_PASSWORD_FILE=/etc/restic/password \
-       restic snapshots
+  sudo bash -c "
+    set -a
+    . /etc/restic/restic.env
+    set +a
+    RESTIC_PASSWORD_FILE=/etc/restic/password restic snapshots
+  "
 '
 ```