luki-net/proxmox-scripts
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
55 Commits 8 Branches 0 Tags
main
Commit Graph
37 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
l.kirchner dbd215a4fb feat(runner): zstd installieren, damit der Actions-Cache nicht einkernig gzippt wird (#12)
CI / Shell-Lint (bash -n, source-check, Validierungs-Tests) (push) Successful in 2s
Details
2026-09-03 01:44:19 +02:00
l.kirchner 0ec6738217 Merge pull request 'security: version the CIS Tier-A hardening pass' (#11) from security/cis-tierA-hardening into main
CI / Shell-Lint (bash -n, source-check, Validierungs-Tests) (push) Successful in 2s
Details 
Reviewed-on: #11
 2026-08-19 11:08:14 +02:00
l.kirchner 0ab4f98f4e feat(runner): install the build toolchain compiled languages need (#10)
CI / Shell-Lint (bash -n, source-check, Validierungs-Tests) (push) Successful in 2s
Details
2026-08-18 23:02:16 +02:00
l.kirchner 6fadb27080 Merge pull request 'fix(nexus-db): UTF8-Encoding zur Installationszeit erzwingen (#8)' (#9) from fix/nexus-db-utf8-encoding into main
CI / Shell-Lint (bash -n, source-check, Validierungs-Tests) (push) Successful in 1s
Details 
fix(nexus-db): UTF-8-Encoding erzwingen + Post-Install-Check (PR #9, Closes #8) — Locale aktiv zum initdb-Zeitpunkt, Re-Run-Guard, su-statt-sudo-Doku
 2026-06-13 14:38:58 +02:00
l.kirchner 553b923445 Merge pull request 'docs: README-Dedup — Contributing konsolidiert, Stand aktualisiert' (#7) from chore/readme-dedup into main
CI / Shell-Lint (bash -n, source-check, Validierungs-Tests) (push) Successful in 2s
Details 
docs: README-Dedup nach K-114-Merge (PR #7) — ein Contributing-Abschnitt, Status/CI aktuell
 2026-06-12 19:42:48 +02:00
l.kirchner a397ade6e1 Merge pull request 'K-114: Input-Validierung in build.func + Mini-CI' (#5) from k114/input-validierung-mini-ci into main
CI / Shell-Lint (bash -n, source-check, Validierungs-Tests) (push) Successful in 1s
Details 
K-114: Input-Validierung in build.func + Mini-CI (PR #5) — SSH-Root-Login-Prompt, locale-Fix, runs-on homelab
 2026-06-12 16:40:37 +02:00
l.kirchner e5cbf3f60e Merge pull request 'feat: allgemeiner instanzweiter Actions-Runner-LXC (Label homelab, ohne Deploy-Rechte)' (#6) from feature/runner-lxc into main 
feat: allgemeiner instanzweiter Actions-Runner-LXC (PR #6) — Label homelab, ohne Deploy-Rechte; Review-Findings 90/88/82/80/85 adressiert
 2026-06-12 16:28:07 +02:00
l.kirchner 43c19f2cce fix(runner): Re-Review-Nits — irreführenden Validator-Kommentar korrigiert, EOF-Abbruch in Prompt-Loop 2026-06-12 15:27:45 +02:00
l.kirchner 63a735e697 fix(runner): Re-Review-Finding 85 — run_user wechselt via env -C ins RUNNER_DIR (.runner landet sonst in /) 2026-06-12 15:26:53 +02:00
l.kirchner ebdd3f5eac fix(runner): Review-Finding 80 — validierte Prompts mit Re-Prompt, env-Werte geprüft; Quoting-Falle (76) durch Charset-Validierung entschärft 2026-06-12 15:05:57 +02:00
l.kirchner f06e873118 fix(runner): Review-Findings 90/88/82/80 (+70) — Re-Run ohne deploy.env, Sicherheitsmodell dokumentiert, Requires=docker, strikte Input-Validierung, argv statt Shell-Interpolation, Unit-Härtung 2026-06-12 15:04:57 +02:00
l.kirchner 360db12cc9 docs: README neu strukturiert — vollständiger Katalog, Pattern, Security-Konventionen, PR-Pflicht 2026-06-12 14:58:49 +02:00
l.kirchner ad04edec5b feat(runner): Installer — act_runner instanzweit als unprivilegierter User, Docker, ohne sudoers 2026-06-12 13:25:42 +02:00
l.kirchner 2941afa53f feat(runner): allgemeiner instanzweiter Actions-Runner-LXC (Label homelab, ohne Deploy-Rechte) 2026-06-12 13:25:10 +02:00
l.kirchner cad741a97c fix(authentik): fehlendes source von build.func ergänzt (gleicher Bug wie Codex-Finding 96 in nexus-db) 2026-06-11 17:06:41 +02:00
l.kirchner 828e3d1aad feat(authentik): Installer — Docker, offizielles Compose, headless Bootstrap-Credentials + API-Token, Blueprints-Mount 2026-06-11 17:02:47 +02:00
l.kirchner ab0354bc22 feat(authentik): LXC-Vorlage — Nesting, Agent-SSH-Key, automatisierungsfreundlich (nexus ADR-0003/K-102) 2026-06-11 17:02:10 +02:00
l.kirchner e8bace387d Merge pull request 'feat(nexus-db): PostgreSQL 16 + pgvector LXC template (nexus-hub K-102)' (#4) from k102/nexus-db into main 
Reviewed-on: #4
 2026-06-11 16:36:30 +02:00
l.kirchner abc62f5704 Merge pull request 'feat(nexus): runtime provisioning for the decided stack (nexus-hub K-101)' (#3) from k101/nexus-runtime into main 2026-06-11 15:18:14 +02:00
l.kirchner 34ac5a05f6 feat: nexus installer — Host-Mode-Runner, App-User, Service-Skeleton, enge sudoers 2026-06-10 23:42:38 +02:00
l.kirchner 5379586545 feat: nexus LXC template — Host-Mode-Runner + Deploy-as-Code (Skeleton bis Stack-Entscheidung) 2026-06-10 23:41:57 +02:00
l.kirchner 3012245c93 Merge pull request 'Set container DNS from the VLAN tag via a network profile (incl. DHCP)' (#2) from network-profiles into main 
Reviewed-on: #2
 2026-06-07 21:25:27 +02:00
l.kirchner 953ef3001e build.func: set DNS from VLAN tag via network profile (incl. DHCP) 
Adds apply_network_profile(), which looks up DNS servers for the entered
VLAN tag in lib/networks.conf and sets --nameserver accordingly — even
when IP is DHCP. Precedence: explicit env NAMESERVER > profile > static
prompt > inherit. Comma-separated DNS is normalised to spaces for pct.
 2026-06-07 21:22:19 +02:00
l.kirchner 3a805b8bda Add network profiles file (VLAN tag → DNS servers) 
Data file mapping a VLAN tag to its DNS servers and subnet, so build.func
can set the right resolvers from the tag entered at install time — even
with DHCP. New networks are a one-line addition here.
 2026-06-07 21:21:05 +02:00
l.kirchner 1d6a15c962 Merge pull request 'Add webapp: Next.js LXC with deploy-as-code via Gitea Actions runner' (#1) from add-webapp into main 
Reviewed-on: #1
 2026-06-05 02:33:37 +02:00
l.kirchner ab839b0e85 README: add webapp to the available scripts table 2026-06-05 02:29:35 +02:00
l.kirchner 601abeef4c Add webapp in-container installer (Node + act_runner host mode) 
Installs Node.js and act_runner in host mode, registers the runner as
the unprivileged webapp user, and wires up systemd units for the runner
and the next-start service. A narrow sudoers rule lets the runner restart
only webapp.service; the build/deploy itself is driven by the repo workflow.
 2026-06-05 02:29:15 +02:00
l.kirchner ddd22b175e Add webapp installer: Next.js site via self-hosted Gitea Actions runner 
Host-side script that creates an unprivileged Debian 12 LXC, installs
Node.js + act_runner in host mode, and registers it against the Gitea
instance. Deploy logic lives in the repo's .gitea/workflows/deploy.yml
(deploy-as-code); the runner polls outbound, so no inbound port.
 2026-06-05 02:28:20 +02:00
l.kirchner 42aad8a117 fix(build): add DNS server prompt for static IPs + better network diagnostics 
For DHCP setups DNS is delivered with the lease, but with a static IP the
container inherits /etc/resolv.conf from the PVE host - which is often
unreachable from the container's VLAN.

Changes:
- New NAMESERVER prompt (only shown for static IPs, defaults to gateway)
- pct create now passes --nameserver when set
- Network wait loop tests L3 and DNS separately so failures point at the
  actual cause (no route to gateway vs. bad DNS server)
- Refactored pct create args into an array for cleaner conditional flags
 2026-05-22 00:11:49 +02:00
l.kirchner b93ec8b553 fix(build): rename HOSTNAME -> CT_HOSTNAME (shadowed bash builtin), add VLAN_TAG prompt, fail fast on network timeout 
HOSTNAME is a bash built-in always containing the host's name, so the
"-z HOSTNAME" check never fired and the prompt was silently skipped —
containers ended up named after the Proxmox host.

Also added an optional VLAN tag prompt (empty = no tag), and the network
wait loop now exits with an error if the network never comes up instead
of silently proceeding to a guaranteed-broken apt-get update.
 2026-05-21 23:32:12 +02:00
l.kirchner 7343501b25 Add docs/adding-a-script.md 2026-05-21 23:05:38 +02:00
l.kirchner 3614475402 Add install/devpi-install.sh: in-container installer for devpi 2026-05-21 23:05:15 +02:00
l.kirchner 87d68d9aba Add ct/devpi.sh: host-side installer for devpi 2026-05-21 23:03:38 +02:00
l.kirchner bf5afc7d26 Add lib/install.func: shared in-container helpers 2026-05-21 23:03:26 +02:00
l.kirchner 9a57d30433 Add lib/build.func: shared host-side helpers 2026-05-21 23:02:02 +02:00
l.kirchner d5b9f56535 Add MIT license 2026-05-21 23:01:20 +02:00
l.kirchner 2b4f08c5eb Initial commit: README 2026-05-21 23:00:07 +02:00