5 Commits

Include renames

Author	SHA1	Message	Date
claude-bot	6543fd77d8	fix(nexus-db): address codex review — early encoding guard, robust helpers ... - assert encoding BEFORE role/password mutation on re-run, so an old SQL_ASCII DB aborts with no side effects (codex finding 1) - ensure_utf8_locale_active honours its locale argument consistently in match, locale.gen line and export (codex finding 2) - assert_db_encoding_utf8 uses argv-clean runuser psql with :'db' literal binding instead of nested su -c shell; docs keep su - postgres -c (codex finding 3)	2026-06-13 14:34:35 +02:00
claude-bot	bd4293f53e	fix(nexus-db): enforce UTF8 encoding at install time (issue #8) ... A PostgreSQL cluster/database freezes its encoding at initdb / CREATE DATABASE time; a C (non-UTF-8) locale yields a SQL_ASCII cluster, which makes psycopg3 return bytes and crashes SQLAlchemy. Harden the installer and add a reusable pattern for future DB installers: - ensure_utf8_locale_active: generate AND activate en_US.UTF-8 for the install process before the server package runs initdb; abort if the locale is not actually available - create the database explicitly with TEMPLATE template0 ENCODING 'UTF8' LC_COLLATE/LC_CTYPE 'en_US.UTF-8' instead of inheriting the cluster default - assert_db_encoding_utf8: post-install guard, abort with an actionable message if pg_encoding_to_char is not UTF8 (catches old SQL_ASCII DBs on re-run too) - credentials/README docs use su - postgres -c (minimal LXCs have no sudo)	2026-06-13 14:30:40 +02:00
l.kirchner	aa3ad2f716	K-114: SSH root login prompt with sshd drop-in in the install path ... prompt_lxc_config asks 'SSH-Root-Login erlauben? [Y/n]' (env-presettable via SSH_ROOT_LOGIN, validated, normalized to yes|no). The bootstrap passes the value into the container; configure_ssh_root_login writes /etc/ssh/sshd_config.d/zz-root-login.conf (yes -> PermitRootLogin yes, no -> prohibit-password) and reloads sshd.	2026-06-12 14:41:31 +02:00
l.kirchner	559ad8dc2d	fix(nexus-db): cross-review findings ... - source build.func (script was unrunnable without it) - validate DB_NAME/DB_USER/DB_PORT/NEXUS_APP_IP before SQL/pg_hba use - rotate password when role exists but credentials file is missing	2026-06-11 15:56:05 +02:00
l.kirchner	0ee7ceae55	feat(nexus-db): PostgreSQL 16 + pgvector LXC template (nexus-hub K-102) ... webapp-pattern ct/install pair: PGDG repo, database nexus with least-privilege owner role, pg_hba allowlist restricted to the nexus app LXC (explicit reject for everything else), pgvector created by the installer, credentials/DSN summary in /root/nexus-db.credentials. Idempotent re-runs keep role/db and do not rotate the password.	2026-06-11 15:51:04 +02:00