From a26f420d4a8fc309b72718ccbe96a642eaf8832f Mon Sep 17 00:00:00 2001
From: juvdiaz <juvenal.diaz@oracle.com>
Date: Mon, 29 Jun 2026 13:24:01 -0600
Subject: [PATCH] Require confirmation for direct nuke

---
 jeannie | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/jeannie b/jeannie
index 21d42ac..3659a17 100755
--- a/jeannie
+++ b/jeannie
@@ -4083,7 +4083,7 @@ rebuild_cluster() {
     jeannie_step_plan 10
 
     run_step "Preflight" homelab_preflight
-    run_step "Nuke existing cluster state" nuke
+    run_step "Nuke existing cluster state" nuke_for_rebuild
     run_step "Pimox provisioning and workers" run_pimox_pipeline
     run_step "OpenWrt VM" run_openwrt_pipeline
     run_step "Worker var file" ensure_cluster_worker_var_file
@@ -4097,6 +4097,10 @@ rebuild_cluster() {
     echo "Log: ${JEANNIE_LOG_FILE}"
 }
 
+nuke_for_rebuild() {
+    LAB_NUKE_SKIP_CONFIRM=true nuke
+}
+
 cluster_worker_targets() {
     local worker_ssh_targets="${WORKER_SSH_TARGETS-}"
     local var_file="${REPO_ROOT}/.lab/cluster-workers.auto.tfvars.json"
@@ -4971,6 +4975,14 @@ nuke() {
 
     require_debian_server "nuke"
 
+    if ! truthy "${LAB_NUKE_SKIP_CONFIRM:-false}" && [[ "${LAB_CONFIRM_NUKE:-}" != "homelab" ]]; then
+        cat >&2 <<'EOF'
+nuke destroys Kubernetes state and Pimox worker VMs.
+Rerun with LAB_CONFIRM_NUKE=homelab when that destructive action is intended.
+EOF
+        exit 1
+    fi
+
     echo "Brutally nuking the homelab infrastructure..."
     cluster_worker_targets