vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

restic/ana-ml2: fix verification snippet to run inside sudo shell

Browse Source 
Original used `sudo env \$(cat /etc/restic/restic.env) …` but the `cat`
in command substitution runs as the login user, not root. Since the
env-file is root:600, the substitution silently yielded an empty
RESTIC_REPOSITORY and restic errored with "Please specify repository
location".

Wrap the whole dance in `sudo bash -c "…"` so the env-file read and
the restic call both happen as root.
This commit is contained in:
vh
2026-04-20 23:15:02 -07:00
parent 445aa87cb7
commit f5703550fb
1 changed files with 11 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
configs/restic/ana-ml2/README.md
+11 -4
View File
@@ -61,13 +61,20 @@ EOF
### 2. Verify creds against the existing repo ### 2. Verify creds against the existing repo
Before deploying the profile, prove the secrets are correct: Before deploying the profile, prove the secrets are correct. The
`/etc/restic/restic.env` and `/etc/restic/password` files are root:600,
so the env-file read AND the restic invocation both need to run inside
the same sudo shell — otherwise `$(cat …)` runs as the login user,
fails silently, and restic complains about a missing repository:
```bash ```bash
ssh -t ana-ml2 ' ssh -t ana-ml2 '
sudo env $(cat /etc/restic/restic.env) \ sudo bash -c "
RESTIC_PASSWORD_FILE=/etc/restic/password \ set -a
restic snapshots . /etc/restic/restic.env
set +a
RESTIC_PASSWORD_FILE=/etc/restic/password restic snapshots
"
' '
``` ```