From 3512472551b5480e7aefa863c279dbb2438cd77d Mon Sep 17 00:00:00 2001
From: David Schroeder <david@schroedercity.com>
Date: Sat, 25 Jul 2026 09:35:05 -0500
Subject: [PATCH] Update deploy-proxmox-keepalived.sh

---
 inc/deploy-proxmox-keepalived.sh | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/inc/deploy-proxmox-keepalived.sh b/inc/deploy-proxmox-keepalived.sh
index ac07dc1..389d0be 100644
--- a/inc/deploy-proxmox-keepalived.sh
+++ b/inc/deploy-proxmox-keepalived.sh
@@ -3,9 +3,9 @@ set -Eeuo pipefail
 
 # -----------------------------------------------------------------------------
 # Proxmox cluster Keepalived deployment
-# Version 1.5.0
+# Version 1.5.2
 #
-# - Discovers cluster members with `pvecm nodes`
+# - Discovers real Proxmox cluster members from /etc/pve/.members (QDevice-safe)
 # - Prompts for the floating VIP/CIDR unless supplied on the command line
 # - Discovers local Linux bridges and prompts the user to select one unless
 #   supplied on the command line
@@ -21,7 +21,7 @@ set -Eeuo pipefail
 # Run this from any healthy, quorate Proxmox cluster node as root.
 # -----------------------------------------------------------------------------
 
-SCRIPT_VERSION="1.5.1"
+SCRIPT_VERSION="1.5.2"
 VIP_CIDR=""
 INTERFACE=""
 PRIORITY_BASE=200
@@ -545,7 +545,11 @@ HEALTH
   # Test the staged script before touching the live health-check path. This is
   # important on a redeploy: an already-running Keepalived instance may be
   # executing the live script every few seconds.
-  remote_exec "$node" "$remote_health" \
+  # /run is commonly mounted noexec on hardened systems. Execute the staged
+  # script through Bash so preflight validation works even when the staging
+  # filesystem itself does not permit execve(2). The final installed script is
+  # still executed directly from /usr/local/sbin by Keepalived.
+  remote_exec "$node" "bash '$remote_health'" \
     || die "Staged health check failed on ${node}. No live Keepalived files have been replaced."
 
   config_file="$TMPDIR/keepalived-${node}.conf"
@@ -651,7 +655,7 @@ done
 log "Installing validated health checks on all nodes."
 for node in "${NODES[@]}"; do
   remote_exec "$node" \
-    "if [[ -f /usr/local/sbin/check-proxmox-keepalived.sh ]]; then cp -a /usr/local/sbin/check-proxmox-keepalived.sh /usr/local/sbin/check-proxmox-keepalived.sh.pre-proxmox-vip.${DEPLOY_TAG}; fi; install -o root -g root -m 0750 '$STAGE_DIR/check-proxmox-keepalived.sh' /usr/local/sbin/check-proxmox-keepalived.sh" \
+    "if [ -f /usr/local/sbin/check-proxmox-keepalived.sh ]; then cp -a /usr/local/sbin/check-proxmox-keepalived.sh /usr/local/sbin/check-proxmox-keepalived.sh.pre-proxmox-vip.${DEPLOY_TAG}; fi; install -o root -g root -m 0750 '$STAGE_DIR/check-proxmox-keepalived.sh' /usr/local/sbin/check-proxmox-keepalived.sh" \
     || activation_die "Failed to install the health check on ${node}."
 done
 
@@ -666,7 +670,7 @@ done
 log "Installing validated Keepalived configs on all nodes."
 for node in "${NODES[@]}"; do
   remote_exec "$node" \
-    "if [[ -f /etc/keepalived/keepalived.conf ]]; then cp -a /etc/keepalived/keepalived.conf /etc/keepalived/keepalived.conf.pre-proxmox-vip.${DEPLOY_TAG}; fi; install -o root -g root -m 0644 '$STAGE_DIR/keepalived.conf' /etc/keepalived/keepalived.conf; systemctl enable keepalived >/dev/null" \
+    "if [ -f /etc/keepalived/keepalived.conf ]; then cp -a /etc/keepalived/keepalived.conf /etc/keepalived/keepalived.conf.pre-proxmox-vip.${DEPLOY_TAG}; fi; install -o root -g root -m 0644 '$STAGE_DIR/keepalived.conf' /etc/keepalived/keepalived.conf; systemctl enable keepalived >/dev/null" \
     || activation_die "Failed to install the Keepalived configuration on ${node}."
 done