fix(ha): wrap crm-fence-peer.sh to set PATH for kernel UMH callout

When the DRBD kernel module invokes fence-peer via the User Mode Helper
mechanism it provides a minimal PATH that omits /run/current-system/sw/bin.
crm-fence-peer.sh calls cibadmin, crm_mon etc.; without those in PATH a
pipeline breaks with SIGPIPE.  A signal-killed process has WEXITSTATUS()==0,
so the kernel sees exit code 0, logs "fence-peer helper broken, returned 0",
and retries forever — blocking Pacemaker failover completely.

Fix: use pkgs.writeShellScript to create thin PATH-fixing wrappers in the
Nix store.  The wrappers prepend /run/current-system/sw/bin before exec-ing
the real crm-fence-peer.sh / crm-unfence-peer.sh, giving them a working
Pacemaker toolchain regardless of what PATH the kernel provides.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

modules/ha/cluster-config.nix

@@ -21,7 +21,26 @@
 #   STONITH device during the testing phase.  Switch to resource-and-stonith
 #   once the fence_pve_ssh STONITH resource is active (see
 #   scripts/ha/cluster-enable-stonith.sh).
-{ lib, vars, ... }:
+#
+#   PATH wrapper: when the DRBD kernel module invokes the fence-peer handler
+#   via the UMH (User Mode Helper) mechanism it provides a minimal PATH that
+#   omits /run/current-system/sw/bin.  crm-fence-peer.sh calls cibadmin,
+#   crm_mon etc.; if those aren't found a pipeline in the script breaks with
+#   SIGPIPE.  A process killed by signal has WEXITSTATUS() == 0, so the kernel
+#   sees exit code 0 and logs "fence-peer helper broken, returned 0", looping
+#   forever.  The writeShellScript wrappers below prepend the NixOS sw path
+#   before exec-ing the real handler, giving it a working Pacemaker toolchain.
+{ lib, pkgs, vars, ... }:
+let
+  fencePeerWrapper = pkgs.writeShellScript "drbd-fence-peer" ''
+    export PATH="/run/current-system/sw/bin:/run/current-system/sw/sbin:$PATH"
+    exec /run/current-system/sw/lib/drbd/crm-fence-peer.sh "$@"
+  '';
+  unfencePeerWrapper = pkgs.writeShellScript "drbd-unfence-peer" ''
+    export PATH="/run/current-system/sw/bin:/run/current-system/sw/sbin:$PATH"
+    exec /run/current-system/sw/lib/drbd/crm-unfence-peer.sh "$@"
+  '';
+in
 {
   # Root SSH access — same key set as nixos user so all admin keys can reach root.
   users.users.root.openssh.authorizedKeys.keys = [
@@ -62,8 +81,8 @@
           fencing resource-only;
         }
         handlers {
-          fence-peer   "/run/current-system/sw/lib/drbd/crm-fence-peer.sh";
-          unfence-peer "/run/current-system/sw/lib/drbd/crm-unfence-peer.sh";
+          fence-peer   "${fencePeerWrapper}";
+          unfence-peer "${unfencePeerWrapper}";
         }
       }
 

secrets/ha-corosync-authkey

@@ -1,22 +1,22 @@
 {
-	"data": "ENC[AES256_GCM,data:YajGibHC9pHqIF2pWd+DuHLXAy0syL+82TquEe45rZCYIp6ddmo4yo7MeaN/qyHaFKKKuQGluWJ48uyKzDJ3MsOihfUTB88tGDsE0aXtXjv52+tnhrS4AhfmyipGaq+AkKjwhrA9n9x0ap6mHvzxAt7xK7LOFpzfedtKIqaCuzbcoqIcy7G/D+X+1kFq0iE78NCjujfkCOXpDNfdQs4Tk/7+6uEr1wkYxNrQRA5K12Ni/Bqm5AfuteLPi5u3lRDnqOkqSGX7sOsV7rQIqy9+r+wrQLctmi33dEzKU4hZBJyxyccNyPEJa/8dDC57koGFvBrCPd/qO94iymH9nRAkqQ==,iv:wx4C7IUaf5zlUneNLKrQ3+xYfe0tdC+AJ6k8kRUnbwA=,tag:yldyFrDVFdCjGFAYel7JIg==,type:str]",
+	"data": "ENC[AES256_GCM,data:ePLME5cokqR9hNA3nlCzLuOc0ykalnBD7qD3krkUn2Sq3KrlM4ytbx+su9zz3TActsmRUOBDMfTllgtk63brw6IJE7KTF63VVGbg8tZq8JLLhTbzfUkV2u8AR0ILKdx/ic02x5dBdbyTemyJP2rsaqW2z2Iojw8UdBx5rg7+T9uZnav2hVXQyTm5OuyZCIgZlxp9qPFg7L0Z9pN9Cch/7lqnt2l311C4K7xaYlDDd0pCoH/UsqrUyBHVTsXJzAlIjru8vb/dGf9OoYBN91NrvxIxT1RrWTar/C4ErUcy/wLqWq4O2ktlmK0Zlt9S5GuVfT2zvHdudbC0wYnfr8bChg==,iv:FELIArqUxYs1XH0oKa+TItiOKi5pCnG+GVGL+vnHk34=,tag:DSDOZvYEQKYlS7CsOkVP6Q==,type:str]",
 	"sops": {
 		"age": [
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGaURiU3hMWmVHQ0JYZkxU\nRlRGV2ljckNyZHBlMWdJeDZHK3RBTC9HOVJjCmtiSlRXUFBpbFN5VDVHN1Q2N2dZ\ncHJTd0FQSUNpS2w4Q0tSV3phK0dNZkUKLS0tIEJZNnhPZWJGTXp3Qkl6MlFZekxl\nbW9jclZmV09yZWQwV2U4WFRzV3ZOT2MKi8lObEjaX/JLMU/U4BNt5o+GVKP9GBDa\nBqHL2xtkRIbe9MFp0hto+1qDGEek0Dj4sRAyiA1UBLm4cZjk3Np0CQ==\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAySGJmSkRVdnRnVWY0MktP\nR2RDdmlHTXBra2NvOTByOXZ5WDlGRHZTWWpFCnQxaldqMzFxWStmd0VzODNFdG8v\nZkN3Q2tUZW10bWVPTUxqWkJ5djF0LzgKLS0tIHVUR0R6L0ZlNzZyK0hrUkRWQXdY\naU1UTGlOUytnbWxoWGFPdW1pRmxWdnMKtz5kp/BvpGFxbx0z6N/GX9UMz/xKwtEQ\neqUAj8eMbZfJblpkTds0he8kjp0Z7jKvMMbKWiRaUixr/ZpufPAbgQ==\n-----END AGE ENCRYPTED FILE-----\n",
 				"recipient": "age1njap586hc0q43kr03g6c8eqhdsmk8zcafkl3f83xwlc2gqhlmfgs4tmwad"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrZkdsdlN3Q2docFZhaHdQ\nTlJjenVEQ2E0UHpOZ0YrelNYNkwvOFY4dDNJClk5Ymx3TllSQ2VPd3NGVGJQM0NZ\nY1dXaVRLZTlhRnBSYzJYbk4vdFZ0bm8KLS0tIG1pOWU4SVFrR25PZlEycmZYSGt1\nSlVNcFJUUFNZamppTjhKMlYrVThKQm8Ke2DwvBnDTKoCNrE6WX0KtPjMNd31uQxt\nEWyz/Bn8/TnilUQJambjGJ3vO/lxVcT0h/TLmTjbGFQ/HF0UAA150w==\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkcWdXQ0RqUFk0N2JpUDBZ\nbXFYU0FMYWVGbW5yUDFYemhPeGcyTFM4OTFrCm1pM2U1WExmYkF5VTIxdk51anpB\nNVhsck5sSnlDTFdzSDlUNllzN3dtZTgKLS0tIEJRQjdmUktkREVHQTZhZDRvRjhQ\nTHNzeVlMWDVkUFgvTVhjejM4Y2FqQU0K4Zbcc8hJObX/S5OnBwh/AJbTYTXzbYsB\n0P9jSaQj2nuoJoJvvLJHr0bA+LpvxGq6sAJBfiMkT/GLAB6PMawwmQ==\n-----END AGE ENCRYPTED FILE-----\n",
 				"recipient": "age1k73g8x47hs93wcv7qh92n3htz8pl295g49hyvlrf3570mts0hgys5g04d6"
 			},
 			{
-				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxaEd4ajk5K1NKRkpOM1R5\nZ0t6dGYrbjhBbUh2WWF6NkwzNER3OURRWXlNCnMvOHFxUVNEVXpRbTVxWlY0Q2RC\nTUtOR0taMVhvR3lrZ08zSzVkRjJJK00KLS0tIHVUalV1cEsvMVp0NE84SEJjcFgw\nVmVRZUZiOUFhYXB3a3B5UzZxNG9xemcKeSuBschizNg/3KSkrQHARhQ6Vp8Yiofn\ngdnrXx6Ojb6lrlP1GalQqOck+CLclWU+lScsf91+dmaVm8cGVvZlgg==\n-----END AGE ENCRYPTED FILE-----\n",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWdGViZkVweHYxeWp2M1Ro\ncDZuVElkZVRwQ1o3SzI2RFNhWUw4YWJmSXg0CkwzaEdLa2JjYVNrVnFOQ05YUXlE\nK1cybGM3RkxnUFFEU1ZKVk5lQjRoNVUKLS0tICtIS3ZsbndFajJnRW9SZVdiRmps\nMks3amJSZ3BqQlRUME1pRGZmUmhJTUkKHU6UXlgN4dAyJS9nweOoEG1XaMOUja2C\nbjOrq3t//L3Ftg3wWpXeAtzzDvjIkQtLo8vv4fPBqC9nYI0AR5O02w==\n-----END AGE ENCRYPTED FILE-----\n",
 				"recipient": "age1fefy6dk8zn5c3edwmrs9vwx79quftnt784m628t9e34q3ft3cehqz8u72r"
 			}
 		],
-		"lastmodified": "2026-07-28T14:40:11Z",
-		"mac": "ENC[AES256_GCM,data:vm/cI0+z26VBe35ExS1Ak0XWGaNoFGWMBi0GfRWt9A+CH6rosBMQ+NXvdf8s1LP8ggUh00BPA8PwBzcq36N5N6vssm5XcDw0BWnqV4lCoK2v88E0i8WPmfOJ2b+3WTZc0CmdVBz9kHpA9rGMCleIhZa424AjY5Cbk1CV7fmLKg0=,iv:TiKMtsa/rns4Neiws61YQDH5KWbVxCQU/d65MkUm+xE=,tag:CsQOKi/XZVGjhYcHUgRrlA==,type:str]",
+		"lastmodified": "2026-07-28T15:11:23Z",
+		"mac": "ENC[AES256_GCM,data:5hMLSLf6vynndO/pDH7OxKwsuP2hCcaKxRUUMqnM8W4jLPHnu1zCkfaADw6bRESzzBdcRM+jwKyg5DsNYgqgFU+c9EThDtMUiC5sjx3KRWPRt+Y4ebDxfkEKUiay14fWp0I6WWEF5qjF4Pl8gkzDtaBxW3vnHrn7cg0RlLKtqEw=,iv:pX0++fkhQ4gAydJUrc7Br4zT3lylWk2QFSxAv8RxTX0=,tag:jbMIEfAorHf8Cg8732K8mg==,type:str]",
 		"version": "3.13.3"
 	}
 }