K-114: SSH root login prompt with sshd drop-in in the install path

prompt_lxc_config asks 'SSH-Root-Login erlauben? [Y/n]' (env-presettable
via SSH_ROOT_LOGIN, validated, normalized to yes|no). The bootstrap passes
the value into the container; configure_ssh_root_login writes
/etc/ssh/sshd_config.d/zz-root-login.conf (yes -> PermitRootLogin yes,
no -> prohibit-password) and reloads sshd.

lib/build.func

@@ -147,6 +147,16 @@ is_cidr() {
 
 is_ipcfg() { [[ "$1" == "dhcp" ]] || is_cidr "$1"; }
 
+# Ja/Nein-Antworten (Prompts wie "… erlauben? [Y/n]"). Akzeptiert
+# deutsch/englisch, normalize_yesno macht daraus kanonisch yes|no.
+is_yesno() { is_clean_ascii "$1" && [[ "${1,,}" =~ ^(y|yes|j|ja|n|no|nein)$ ]]; }
+normalize_yesno() {
+  case "${1,,}" in
+    y|yes|j|ja) printf 'yes' ;;
+    *)          printf 'no' ;;
+  esac
+}
+
 # Space/comma-separated list of IPv4s (DNS prompt). Gesamtstring zuerst
 # prüfen — die Wort-Splittung würde eingebettete Newlines sonst verstecken.
 is_ipv4_list() {
@@ -311,6 +321,17 @@ prompt_lxc_config() {
   else
     msg_warn "No network profile for VLAN ${VLAN_TAG:-none}; DHCP DNS will be inherited."
   fi
+
+  # SSH-Root-Login (Default: ja, Homelab-Komfort). Umgesetzt wird das im
+  # Install-Pfad per sshd-Drop-in (configure_ssh_root_login, lib/install.func);
+  # bootstrap_install_script reicht den normalisierten Wert in den Container.
+  if [[ -z "${SSH_ROOT_LOGIN:-}" ]]; then
+    prompt_validated SSH_ROOT_LOGIN "SSH-Root-Login erlauben? [Y/n]: " is_yesno "y"
+  else
+    require_valid SSH_ROOT_LOGIN is_yesno "SSH root login (y/n)"
+  fi
+  SSH_ROOT_LOGIN="$(normalize_yesno "$SSH_ROOT_LOGIN")"
+  echo "  → SSH root login: $SSH_ROOT_LOGIN"
 }
 
 # ── template ─────────────────────────────────────────────────────────────────
@@ -408,7 +429,9 @@ bootstrap_install_script() {
   pct exec "$CTID" -- bash -c "apt-get update -qq && apt-get install -y -qq curl ca-certificates >/dev/null"
 
   msg_info "Running installer ($url)..."
-  pct exec "$CTID" -- bash -c "curl -fsSL '$url' -o /root/${APP}-install.sh && bash /root/${APP}-install.sh"
+  # SSH_ROOT_LOGIN ist durch normalize_yesno kanonisch yes|no — als Env in
+  # den Container durchreichen (configure_ssh_root_login wertet es aus).
+  pct exec "$CTID" -- bash -c "curl -fsSL '$url' -o /root/${APP}-install.sh && SSH_ROOT_LOGIN='${SSH_ROOT_LOGIN:-yes}' bash /root/${APP}-install.sh"
 }
 
 # ── summary ──────────────────────────────────────────────────────────────────

lib/install.func

@@ -38,6 +38,36 @@ apt_cleanup() {
   apt-get autoclean -qq >/dev/null || true
 }
 
+# ── ssh ──────────────────────────────────────────────────────────────────────
+# SSH-Root-Login gemäß Host-Prompt (prompt_lxc_config setzt SSH_ROOT_LOGIN,
+# bootstrap_install_script reicht es als Env durch; Default: yes).
+#   yes → PermitRootLogin yes (Passwort-Login mit dem generierten Root-Passwort)
+#   no  → PermitRootLogin prohibit-password (Debian-Default, nur SSH-Key)
+# Umsetzung als Drop-in, damit Paket-Updates von sshd_config nicht kollidieren.
+configure_ssh_root_login() {
+  local choice="${SSH_ROOT_LOGIN:-yes}" value
+  case "$choice" in
+    yes) value="yes" ;;
+    no)  value="prohibit-password" ;;
+    *)   msg_err "SSH_ROOT_LOGIN must be yes|no, got: '$choice'"; return 1 ;;
+  esac
+
+  if [[ ! -d /etc/ssh/sshd_config.d ]]; then
+    if [[ "$choice" == "no" ]]; then
+      msg_warn "openssh-server not installed — nothing to configure (root login stays off)"
+      return 0
+    fi
+    msg_info "Installing openssh-server..."
+    apt-get install -y -qq openssh-server >/dev/null
+  fi
+
+  msg_info "Configuring SSH root login: PermitRootLogin $value"
+  printf 'PermitRootLogin %s\n' "$value" >/etc/ssh/sshd_config.d/zz-root-login.conf
+  systemctl reload ssh 2>/dev/null || systemctl restart ssh 2>/dev/null \
+    || msg_warn "ssh.service not active yet — config applies on first start"
+  msg_ok "SSH root login: $choice"
+}
+
 # ── users / dirs ─────────────────────────────────────────────────────────────
 create_system_user() {
   local user="$1" home="$2"