From ced2182322cf1045b5490606498b8c93d07f228d Mon Sep 17 00:00:00 2001 From: Jon Chery Date: Fri, 7 Aug 2026 11:29:56 +0000 Subject: [PATCH] fix(P20): system user consistency (REQ-135, F23) ---ci--- project: orca phase: 20 milestone: v0.12 status: execute ---/ci--- Proxmox bootstrap now creates a nologin system user (-r -s /usr/sbin/nologin), matching peer-setup. Previously it created a login user (-m -s /bin/bash) with more privilege. Build + tests green. --- internal/proxmox/bootstrap.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/proxmox/bootstrap.go b/internal/proxmox/bootstrap.go index 7e9f857..ca75b10 100644 --- a/internal/proxmox/bootstrap.go +++ b/internal/proxmox/bootstrap.go @@ -392,7 +392,7 @@ func deployPubKey(user, pubLine string) error { // createLinuxUser creates the orca system user if it doesn't already // exist. Idempotent: `id -u` check before `useradd`. func createLinuxUser(user string) error { - cmd := fmt.Sprintf("id -u %s 2>/dev/null || useradd -m -s /bin/bash %s", user, user) + cmd := fmt.Sprintf("id -u %s 2>/dev/null || useradd -r -s /usr/sbin/nologin %s", user, user) if _, err := runRemote(cmd); err != nil { return err }