luki-net/proxmox-scripts
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
32 Commits 5 Branches 0 Tags
5f532fe10ac4c2dd8fcce3b8ed9a5cdf92187ab4
Commit Graph
9 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
l.kirchner 5f532fe10a K-114: run mini CI on the instance-wide homelab runner 2026-06-12 14:40:42 +02:00
l.kirchner 490fda2ed1 K-114: address cross-review findings
CI / Shell-Lint (bash -n, source-check, Validierungs-Tests) (pull_request) Has been cancelled
Details 
- CTID prompt re-prompts on invalid interactive input (was: abort)
- env-provided NAMESERVER is validated when non-empty ('' stays inherit)
- prompt_validated handles EOF (no infinite loop, clean abort under -e)
- 10# base forcing in vlan/cidr/ipv4 arithmetic (leading zeros are not
  octal errors); is_clean_ascii rejects embedded newline/tab explicitly
  (command substitution strips trailing newlines); is_ipv4_list checks
  the whole string before word splitting
- nameref guard against reserved variable names in prompt_validated/
  require_valid; source-check pattern documented as the repo contract
- 8 new test cases (41 total)
 2026-06-12 03:20:11 +02:00
l.kirchner 80e2ec04ff K-114: input validation in build.func + mini CI (nexus-hub card) 
- validation helpers: sanitize_input trims CR/edge whitespace only;
  embedded control/non-ASCII bytes FAIL validation and re-prompt with a
  hint (2026-06-11 incident: invisible byte in a pasted VLAN tag broke
  pct create mid-run) - never silently stripped
- prompt_lxc_config: every prompt validated (uint for CTID/disk/cores/
  RAM, VLAN 1-4094, hostname/token formats, IP/CIDR/gateway, DNS list);
  env-provided values are sanitized + validated too (abort, no re-prompt
  loop in non-interactive use); helpers reusable for app prompts
- tests/test_validation.sh: 34 cases incl. the 2<0x80>0 repro, re-prompt
  simulation, BASH_REMATCH clobbering regression (is_cidr), env dry-run
  of prompt_lxc_config without PVE/TTY
- tests/check_ct_source.sh: every ct/*.sh must source build.func (bug
  shipped twice); negative proof via prepared fixture in the test suite
- .gitea/workflows/ci.yml: bash -n over all scripts, source-check,
  validation tests, shellcheck if present (documented skip otherwise)
- README: contributions via PR with cross-review (binding)
 2026-06-12 03:14:32 +02:00
l.kirchner 559ad8dc2d fix(nexus-db): cross-review findings 
- source build.func (script was unrunnable without it)
- validate DB_NAME/DB_USER/DB_PORT/NEXUS_APP_IP before SQL/pg_hba use
- rotate password when role exists but credentials file is missing
 2026-06-11 15:56:05 +02:00
l.kirchner 0ee7ceae55 feat(nexus-db): PostgreSQL 16 + pgvector LXC template (nexus-hub K-102) 
webapp-pattern ct/install pair: PGDG repo, database nexus with
least-privilege owner role, pg_hba allowlist restricted to the nexus
app LXC (explicit reject for everything else), pgvector created by the
installer, credentials/DSN summary in /root/nexus-db.credentials.
Idempotent re-runs keep role/db and do not rotate the password.
 2026-06-11 15:51:04 +02:00
l.kirchner ad36417b30 Merge branch 'fix/nexus-service-condition' 2026-06-11 14:54:47 +02:00
l.kirchner afd0a4ea35 fix(nexus): guard nexus.service with ConditionPathExists 
A reboot before the first deploy would leave the enabled unit in failed
state; the condition keeps it inert until start.sh exists (same guard as
nexus-worker.service).
 2026-06-11 14:54:47 +02:00
l.kirchner 2152683397 Merge branch 'feat/nexus-runtime-k101' 2026-06-11 14:48:53 +02:00
l.kirchner 1dd89e25bc feat(nexus): runtime provisioning for the decided stack (nexus-hub K-101) 
- new install/nexus-runtime.sh (idempotent, re-runnable on an existing
  LXC): uv for the nexus user (manages Python 3.12), tesseract deu+eng,
  nexus-worker.service unit (ConditionPathExists guards the skeleton
  phase), sudoers extended to cover the worker service
- nexus-install.sh: RUNTIME section now invokes nexus-runtime.sh at the
  end of the install (after base sudoers/units, which it extends)
 2026-06-11 14:48:53 +02:00