K-114: set up locales in setup_base_apt (C.UTF-8 during install, en_US.UTF-8 default)

LXC templates ship without a configured locale, so every apt/perl run
warned 'Setting locale failed'. setup_base_apt now exports C.UTF-8 for
the install run itself, installs the locales package, generates
en_US.UTF-8 and sets it as the system default via update-locale.

.gitea/workflows/ci.yml

@@ -0,0 +1,47 @@
+name: CI
+
+# K-114 (nexus-hub): Mini-CI für proxmox-scripts — Syntax, build.func-Source-
+# Pflicht und Validierungs-Unit-Tests. Läuft auf dem instanzweiten Runner
+# (Label homelab, ohne Deploy-Rechte — PR #6 / ct/runner.sh).
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  lint:
+    name: Shell-Lint (bash -n, source-check, Validierungs-Tests)
+    runs-on: homelab
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: bash -n über alle Scripts
+        run: |
+          status=0
+          for f in ct/*.sh install/*.sh lib/*.func tests/*.sh; do
+            if bash -n "$f"; then
+              echo "ok     $f"
+            else
+              echo "SYNTAX $f" >&2
+              status=1
+            fi
+          done
+          exit "$status"
+
+      - name: build.func-Source-Check (jedes ct/*.sh)
+        run: bash tests/check_ct_source.sh
+
+      - name: Validierungs-Unit-Tests (lib/build.func)
+        run: bash tests/test_validation.sh
+
+      - name: shellcheck (falls auf dem Runner installiert)
+        run: |
+          if command -v shellcheck >/dev/null 2>&1; then
+            # -S warning: Style-Hinweise nicht blockierend; externe Sources
+            # (curl|source) kann shellcheck nicht folgen.
+            shellcheck -S warning -e SC1090,SC1091 ct/*.sh install/*.sh tests/*.sh
+          else
+            echo "shellcheck nicht installiert — übersprungen (dokumentiert, K-114)"
+          fi

README.md

@@ -24,6 +24,12 @@ CTID=200 HOSTNAME=devpi DISK_SIZE=30 RAM=4096 CORES=4 IPCFG=dhcp \
 
 All defaults (`DEFAULT_HOSTNAME`, `DEFAULT_DISK`, …) are settable per-call via env vars as well.
 
+## Contributing (verbindlich seit K-114)
+
+**Alle Änderungen laufen als PR mit Cross-Review** — keine Direkt-Commits auf `main`. Hintergrund: Der „`build.func` nicht gesourct"-Bug hat es einmal bis in die Produktion geschafft (authentik-Anlage), während dieselbe Fehlerklasse im nexus-db-PR vom Review gefangen wurde. Die CI (`.gitea/workflows/ci.yml`, Runner-Label `homelab` — instanzweiter Runner aus `ct/runner.sh`) erzwingt zusätzlich: `bash -n` über alle Scripts, „jedes `ct/*.sh` sourct `build.func`" (`tests/check_ct_source.sh`) und die Validierungs-Unit-Tests (`tests/test_validation.sh`).
+
+Eingaben in `prompt_lxc_config` sind validiert (Ziffern-Checks, IP/CIDR/Gateway-Format, Re-Prompt bei unsichtbaren Steuer-/Non-ASCII-Zeichen — Lesson vom 2026-06-11). Neue App-Prompts bitte über `prompt_validated`/`require_valid` aus `lib/build.func` bauen statt nacktem `read`.
+
 ## Repo layout
 
 ```

ct/authentik.sh

@@ -0,0 +1,107 @@
+#!/usr/bin/env bash
+# Authentik — zentraler Homelab-IdP (nexus ADR-0003)
+#
+# Creates an unprivileged Debian 12 LXC with nesting enabled that runs the
+# official Authentik docker-compose stack (server, worker, postgres, redis).
+#
+# Automation-friendly by design (nexus-hub K-102):
+#   - bootstrap admin password AND API token are generated headlessly
+#     (-> /root/authentik.credentials) so an agent can apply blueprints via
+#     API without ever touching the UI
+#   - optional dedicated SSH public key for agent access (Claude Code)
+#   - blueprints dir mounted at /opt/authentik/blueprints (compose override)
+#
+# Manual steps that remain AFTER this script (by design):
+#   1. NPMplus: proxy host auth.<domain> -> http://<LXC-IP>:9000
+#      (WebSockets ON; the auth domain is PERMANENT — WebAuthn RP-ID!)
+#   2. Passkey enrollment of the human admin account
+#
+# Run on a Proxmox VE host:
+#   bash -c "$(curl -fsSL https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/ct/authentik.sh)"
+
+set -euo pipefail
+
+APP="authentik"
+APP_DESCRIPTION="Authentik IdP (Docker-Compose) — Passkeys, TOTP, OIDC für nexus & Homelab"
+APP_PORT="${APP_PORT:-9000}"
+
+LIB_URL="${LIB_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/lib}"
+INSTALL_SCRIPT_URL="${INSTALL_SCRIPT_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/install/authentik-install.sh}"
+
+source <(curl -fsSL "$LIB_URL/build.func")
+
+# LXC defaults (server+worker+postgres+redis brauchen Luft)
+DEFAULT_HOSTNAME="authentik"
+DEFAULT_DISK="20"
+DEFAULT_CORES="2"
+DEFAULT_RAM="4096"
+
+prompt_app_config() {
+  echo
+  echo "── Authentik configuration ─────────────────────────────────"
+  if [[ -z "${AUTH_DOMAIN:-}" ]]; then
+    read -rp "Auth-Domain (dauerhaft! WebAuthn-RP-ID), z. B. auth.luki-net.org: " AUTH_DOMAIN
+  fi
+  [[ -n "${AUTH_DOMAIN:-}" ]] || { msg_err "AUTH_DOMAIN ist Pflicht"; exit 1; }
+  if [[ -z "${CLAUDE_SSH_PUBKEY:-}" ]]; then
+    read -rp "SSH-Public-Key für Agent-Zugang (leer = überspringen): " CLAUDE_SSH_PUBKEY || true
+  fi
+  # Authentik-Version: leer = Default des offiziellen Compose-Files
+  AUTHENTIK_TAG="${AUTHENTIK_TAG:-}"
+  echo "  → domain: $AUTH_DOMAIN   port: $APP_PORT   tag: ${AUTHENTIK_TAG:-compose-default}"
+}
+
+push_app_config() {
+  msg_info "Pushing config into container..."
+  local tmpf; tmpf=$(mktemp)
+  cat >"$tmpf" <<EOF
+AUTH_DOMAIN='$AUTH_DOMAIN'
+APP_PORT='$APP_PORT'
+AUTHENTIK_TAG='$AUTHENTIK_TAG'
+CLAUDE_SSH_PUBKEY='${CLAUDE_SSH_PUBKEY:-}'
+EOF
+  pct push "$CTID" "$tmpf" /root/authentik.deploy.env --perms 600
+  rm -f "$tmpf"
+}
+
+# Docker im unprivilegierten LXC braucht nesting+keyctl — vor dem Bootstrap setzen.
+enable_nesting() {
+  msg_info "Enabling nesting+keyctl features (Docker in unprivileged LXC)..."
+  pct set "$CTID" --features nesting=1,keyctl=1
+  pct reboot "$CTID"
+  # warten bis der Container wieder antwortet
+  for _ in $(seq 1 30); do
+    pct exec "$CTID" -- true >/dev/null 2>&1 && break
+    sleep 2
+  done
+  msg_ok "Container restarted with nesting enabled"
+}
+
+print_app_summary() {
+  cat <<EOF
+  Authentik:            http://$IP_CT:$APP_PORT  (UI nach erstem Start, dauert 1–2 min)
+  Credentials/API-Token: /root/authentik.credentials  (im LXC; akadmin + Bootstrap-Token)
+  Blueprints:           /opt/authentik/blueprints  (gemountet; Agent legt YAMLs ab,
+                        Quelle versioniert in nexus-hub infra/authentik/)
+
+  ⚠️  JETZT MANUELL (dauerhaft — WebAuthn-RP-ID):
+    NPMplus: Proxy Host  $AUTH_DOMAIN  →  http://$IP_CT:$APP_PORT   (WebSockets: ON)
+
+  Danach: Agent (Claude Code) per SSH übernimmt Blueprints/OIDC-Provider;
+  zuletzt Passkey-Enrollment des menschlichen Admin-Accounts über $AUTH_DOMAIN.
+
+  Logs:                 pct exec $CTID -- docker compose -f /opt/authentik/docker-compose.yml logs -f
+EOF
+}
+
+trap _on_error ERR
+preflight_pve
+show_header "$APP" "$APP_DESCRIPTION"
+prompt_lxc_config
+prompt_app_config
+resolve_debian_template
+create_lxc
+enable_nesting
+push_app_config
+bootstrap_install_script "$INSTALL_SCRIPT_URL"
+print_summary

ct/nexus-db.sh

@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+# nexus-db — PostgreSQL 16 (+pgvector) for nexus (Family Knowledge Hub)
+#
+# Creates an unprivileged Debian 12 LXC that:
+#   - runs PostgreSQL 16 from the PGDG repo with the pgvector extension
+#   - hosts database `nexus` owned by a least-privilege role `nexus`
+#   - accepts connections ONLY from the nexus app LXC (pg_hba allowlist);
+#     every other host is rejected
+#
+# Companion card: nexus-hub K-102. Run on a Proxmox VE host:
+#   bash -c "$(curl -fsSL https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/ct/nexus-db.sh)"
+
+set -euo pipefail
+
+APP="nexus-db"
+APP_DESCRIPTION="PostgreSQL 16 + pgvector for nexus (access restricted to the nexus LXC)"
+
+LIB_URL="${LIB_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/lib}"
+INSTALL_SCRIPT_URL="${INSTALL_SCRIPT_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/install/nexus-db-install.sh}"
+
+# LXC defaults (DB only: small CPU, RAM matters for shared_buffers/cache)
+DEFAULT_HOSTNAME="nexus-db"
+DEFAULT_DISK="16"
+DEFAULT_CORES="2"
+DEFAULT_RAM="4096"
+
+DEFAULT_DB_NAME="nexus"
+DEFAULT_DB_USER="nexus"
+DEFAULT_DB_PORT="5432"
+
+source <(curl -fsSL "$LIB_URL/build.func")
+
+# ── app-specific prompts (host TTY; each skipped if the var is preset) ───────
+prompt_app_config() {
+  echo
+  echo "── nexus-db configuration ───────────────────────────────────"
+  # The ONLY host that may connect (pg_hba allowlist) — the nexus app LXC.
+  if [[ -z "${NEXUS_APP_IP:-}" ]]; then
+    read -rp "IP of the nexus app LXC (sole allowed client): " NEXUS_APP_IP
+  fi
+  [[ -n "${NEXUS_APP_IP:-}" ]] || { msg_err "NEXUS_APP_IP is required (pg_hba allowlist)"; exit 1; }
+
+  DB_NAME="${DB_NAME:-$DEFAULT_DB_NAME}"
+  DB_USER="${DB_USER:-$DEFAULT_DB_USER}"
+  DB_PORT="${DB_PORT:-$DEFAULT_DB_PORT}"
+
+  echo "  → database: $DB_NAME   role: $DB_USER   port: $DB_PORT"
+  echo "  → allowed client: $NEXUS_APP_IP/32 (everything else is rejected)"
+}
+
+# ── push gathered config into the container for the installer to consume ─────
+push_app_config() {
+  msg_info "Pushing db config into container..."
+  local tmpf; tmpf=$(mktemp)
+  cat >"$tmpf" <<EOF
+NEXUS_APP_IP='$NEXUS_APP_IP'
+DB_NAME='$DB_NAME'
+DB_USER='$DB_USER'
+DB_PORT='$DB_PORT'
+EOF
+  pct push "$CTID" "$tmpf" /root/nexus-db.deploy.env --perms 600
+  rm -f "$tmpf"
+}
+
+# ── trailing summary ─────────────────────────────────────────────────────────
+print_app_summary() {
+  local pg_state
+  pg_state=$(pct exec "$CTID" -- systemctl is-active postgresql 2>/dev/null | tr -d '\r\n')
+  cat <<EOF
+  PostgreSQL 16:        $IP_CT:$DB_PORT  — $pg_state
+    Database:           $DB_NAME (owner: $DB_USER, extension: vector)
+    Allowed client:     $NEXUS_APP_IP/32 — all other hosts are rejected
+    Credentials + DSN:  /root/nexus-db.credentials (inside the LXC)
+
+  Smoke test FROM THE NEXUS LXC (uses the DSN from the credentials file):
+    psql "postgresql://$DB_USER:<password>@$IP_CT:$DB_PORT/$DB_NAME" -c "SELECT extname FROM pg_extension;"
+
+  Negative test from any OTHER host (must fail):
+    psql "postgresql://$DB_USER:<password>@$IP_CT:$DB_PORT/$DB_NAME" -c "SELECT 1;"
+
+  Logs:                 pct exec $CTID -- journalctl -u postgresql -f
+EOF
+}
+
+# ── orchestrate ───────────────────────────────────────────────────────────────
+trap _on_error ERR
+preflight_pve
+show_header "$APP" "$APP_DESCRIPTION"
+prompt_lxc_config
+prompt_app_config
+resolve_debian_template
+create_lxc
+push_app_config
+bootstrap_install_script "$INSTALL_SCRIPT_URL"
+print_summary

install/authentik-install.sh

@@ -0,0 +1,140 @@
+#!/usr/bin/env bash
+# Authentik installer — runs inside the LXC, called by ct/authentik.sh
+#
+# Installs Docker + the official Authentik docker-compose stack, headless:
+#   - secrets generated on-host (PG_PASS, AUTHENTIK_SECRET_KEY) — never printed
+#   - bootstrap admin (akadmin) password + API token generated so that an
+#     agent can configure everything via API/blueprints without the UI
+#   - blueprints dir mounted via docker-compose.override.yml
+#   - optional dedicated SSH key for agent access appended to authorized_keys
+#
+# Idempotent: re-running keeps existing secrets/.env and only updates images.
+
+set -euo pipefail
+
+LIB_URL="${LIB_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/lib}"
+source <(curl -fsSL "$LIB_URL/install.func")
+
+[[ "$EUID" -eq 0 ]] || { msg_err "Must run as root"; exit 1; }
+
+CONF="/root/authentik.deploy.env"
+[[ -f "$CONF" ]] || { msg_err "$CONF not found (host bootstrap incomplete)"; exit 1; }
+set -a; . "$CONF"; set +a
+: "${AUTH_DOMAIN:?missing AUTH_DOMAIN}"
+APP_PORT="${APP_PORT:-9000}"
+
+AK_DIR="/opt/authentik"
+ENV_FILE="$AK_DIR/.env"
+CRED_FILE="/root/authentik.credentials"
+
+# ── base packages + Docker ────────────────────────────────────────────────────
+setup_base_apt ca-certificates curl
+configure_ssh_root_login
+if ! command -v docker >/dev/null 2>&1; then
+  msg_info "Installing Docker (get.docker.com)..."
+  curl -fsSL https://get.docker.com | sh >/dev/null
+  msg_ok "Docker $(docker --version | awk '{print $3}' | tr -d ',')"
+else
+  msg_warn "Docker already present, skipping"
+fi
+
+# ── optional: dedicated agent SSH key ────────────────────────────────────────
+if [[ -n "${CLAUDE_SSH_PUBKEY:-}" ]]; then
+  mkdir -p /root/.ssh && chmod 700 /root/.ssh
+  touch /root/.ssh/authorized_keys && chmod 600 /root/.ssh/authorized_keys
+  if ! grep -qF "$CLAUDE_SSH_PUBKEY" /root/.ssh/authorized_keys; then
+    echo "$CLAUDE_SSH_PUBKEY" >> /root/.ssh/authorized_keys
+    msg_ok "Agent SSH key installed"
+  else
+    msg_warn "Agent SSH key already present"
+  fi
+fi
+
+# ── compose stack ─────────────────────────────────────────────────────────────
+mkdir -p "$AK_DIR/blueprints" "$AK_DIR/media" "$AK_DIR/custom-templates" "$AK_DIR/certs"
+cd "$AK_DIR"
+
+if [[ ! -f docker-compose.yml ]]; then
+  msg_info "Fetching official Authentik compose file..."
+  curl -fsSL -o docker-compose.yml https://goauthentik.io/docker-compose.yml
+  msg_ok "docker-compose.yml fetched"
+else
+  msg_warn "docker-compose.yml exists, keeping (idempotent)"
+fi
+
+# Override: Blueprints in server+worker mounten, Port-Bind nur auf LXC-Netz nötig?
+# Authentik bleibt im LAN hinter NPMplus — Standard-Bind reicht; Blueprints-Mount ergänzen.
+if [[ ! -f docker-compose.override.yml ]]; then
+  cat > docker-compose.override.yml <<EOF
+services:
+  server:
+    volumes:
+      - ./blueprints:/blueprints/custom:ro
+  worker:
+    volumes:
+      - ./blueprints:/blueprints/custom:ro
+EOF
+  msg_ok "compose override (custom blueprints mount) written"
+fi
+
+# ── secrets / env (idempotent: vorhandene .env bleibt) ────────────────────────
+if [[ ! -f "$ENV_FILE" ]]; then
+  msg_info "Generating secrets (.env)..."
+  PG_PASS="$(openssl rand -base64 36 | tr -d '\n=/+' | cut -c1-32)"
+  AK_SECRET="$(openssl rand -base64 60 | tr -d '\n')"
+  AK_BOOT_PW="$(openssl rand -base64 24 | tr -d '\n=/+' | cut -c1-20)"
+  AK_BOOT_TOKEN="$(openssl rand -hex 32)"
+  cat >"$ENV_FILE" <<EOF
+PG_PASS=$PG_PASS
+AUTHENTIK_SECRET_KEY=$AK_SECRET
+AUTHENTIK_BOOTSTRAP_PASSWORD=$AK_BOOT_PW
+AUTHENTIK_BOOTSTRAP_TOKEN=$AK_BOOT_TOKEN
+AUTHENTIK_BOOTSTRAP_EMAIL=admin@$AUTH_DOMAIN
+COMPOSE_PORT_HTTP=$APP_PORT
+${AUTHENTIK_TAG:+AUTHENTIK_TAG=$AUTHENTIK_TAG}
+# E-Mail-Versand bewusst unkonfiguriert (Familien-Setup; bei Bedarf nachziehen):
+# AUTHENTIK_EMAIL__HOST=...
+EOF
+  chmod 600 "$ENV_FILE"
+
+  cat >"$CRED_FILE" <<EOF
+Authentik — zentraler Homelab-IdP (nexus ADR-0003)
+
+URL (LAN):        http://$(hostname -I | awk '{print $1}'):$APP_PORT
+URL (final):      https://$AUTH_DOMAIN   (nach NPMplus-Eintrag; Domain ist DAUERHAFT)
+
+Bootstrap-Admin:  akadmin
+Passwort:         $AK_BOOT_PW
+API-Token:        $AK_BOOT_TOKEN
+  -> für Agent-Automation (Blueprints/OIDC via API). Nach Abschluss der
+     Einrichtung rotieren oder widerrufen; menschlicher Admin nutzt eigenen
+     Account mit Passkey, NICHT akadmin.
+
+Blueprints:       $AK_DIR/blueprints  (Quelle: nexus-hub infra/authentik/)
+Stack:            cd $AK_DIR && docker compose ps|logs|pull
+EOF
+  chmod 600 "$CRED_FILE"
+  msg_ok "Secrets + credentials written ($CRED_FILE)"
+else
+  msg_warn ".env exists — keeping existing secrets (idempotent)"
+fi
+
+# ── start ─────────────────────────────────────────────────────────────────────
+msg_info "Pulling images & starting Authentik (first start takes 1–2 min)..."
+docker compose pull -q
+docker compose up -d
+
+# Warten bis der Server antwortet (Healthcheck)
+for _ in $(seq 1 60); do
+  if curl -fsS "http://127.0.0.1:$APP_PORT/-/health/live/" >/dev/null 2>&1; then
+    msg_ok "Authentik is up (http://127.0.0.1:$APP_PORT)"
+    break
+  fi
+  sleep 5
+done
+curl -fsS "http://127.0.0.1:$APP_PORT/-/health/live/" >/dev/null 2>&1 || \
+  msg_warn "Authentik antwortet noch nicht — 'docker compose logs -f' prüfen (Migrationslauf kann dauern)"
+
+shred -u "$CONF" 2>/dev/null || rm -f "$CONF"
+apt_cleanup
+msg_ok "authentik installation finished"

install/devpi-install.sh

@@ -19,6 +19,7 @@ DEVPI_PORT="3141"
 
 # ── packages + user + dirs ───────────────────────────────────────────────────
 setup_base_apt python3 python3-venv python3-pip
+configure_ssh_root_login
 
 create_system_user "$DEVPI_USER" "$DEVPI_HOME"
 mkdir -p "$DEVPI_DATA"

install/nexus-db-install.sh

@@ -0,0 +1,155 @@
+#!/usr/bin/env bash
+# nexus-db installer — runs inside the LXC, called by ct/nexus-db.sh
+#
+# PostgreSQL 16 from the PGDG repo, pgvector extension, database `nexus`
+# with a least-privilege role, network access restricted to the nexus app
+# LXC via pg_hba. Idempotent: safe to re-run (existing role/db/extension
+# are kept, the password is NOT rotated on re-run).
+
+set -euo pipefail
+
+APP="nexus-db"
+LIB_URL="${LIB_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/lib}"
+source <(curl -fsSL "$LIB_URL/install.func")
+
+[[ "$EUID" -eq 0 ]] || { msg_err "Must run as root"; exit 1; }
+
+# ── load config pushed in by the host script ─────────────────────────────────
+CONF="/root/nexus-db.deploy.env"
+[[ -f "$CONF" ]] || { msg_err "$CONF not found (host bootstrap incomplete)"; exit 1; }
+set -a; . "$CONF"; set +a
+
+: "${NEXUS_APP_IP:?missing NEXUS_APP_IP}"
+DB_NAME="${DB_NAME:-nexus}"
+DB_USER="${DB_USER:-nexus}"
+DB_PORT="${DB_PORT:-5432}"
+
+# Values land verbatim in SQL and pg_hba.conf — accept only safe shapes.
+[[ "$DB_NAME" =~ ^[a-z_][a-z0-9_]*$ ]] || { msg_err "DB_NAME must be a plain lowercase identifier: $DB_NAME"; exit 1; }
+[[ "$DB_USER" =~ ^[a-z_][a-z0-9_]*$ ]] || { msg_err "DB_USER must be a plain lowercase identifier: $DB_USER"; exit 1; }
+[[ "$DB_PORT" =~ ^[0-9]{2,5}$ ]] || { msg_err "DB_PORT must be numeric: $DB_PORT"; exit 1; }
+[[ "$NEXUS_APP_IP" =~ ^[0-9]{1,3}(\.[0-9]{1,3}){3}$ || "$NEXUS_APP_IP" =~ ^[0-9a-fA-F:]+$ ]] \
+  || { msg_err "NEXUS_APP_IP must be a single host IP: $NEXUS_APP_IP"; exit 1; }
+
+PG_MAJOR=16
+CRED_FILE="/root/nexus-db.credentials"
+
+# ── packages: PGDG repo + PostgreSQL 16 + pgvector ────────────────────────────
+setup_base_apt curl ca-certificates gnupg lsb-release
+configure_ssh_root_login
+
+if [[ ! -f /etc/apt/sources.list.d/pgdg.sources ]] && [[ ! -f /etc/apt/sources.list.d/pgdg.list ]]; then
+  msg_info "Adding PGDG apt repo..."
+  apt-get install -y -qq postgresql-common >/dev/null
+  /usr/share/postgresql-common/pgdg/apt.postgresql.org.sh -y >/dev/null
+  msg_ok "PGDG repo added"
+else
+  msg_warn "PGDG repo already present, skipping"
+fi
+
+msg_info "Installing PostgreSQL $PG_MAJOR + pgvector..."
+apt-get install -y -qq "postgresql-$PG_MAJOR" "postgresql-$PG_MAJOR-pgvector" >/dev/null
+msg_ok "PostgreSQL $(psql --version | awk '{print $3}') installed"
+
+PG_CONF_DIR="/etc/postgresql/$PG_MAJOR/main"
+PG_CONF="$PG_CONF_DIR/postgresql.conf"
+PG_HBA="$PG_CONF_DIR/pg_hba.conf"
+
+# ── network exposure: listen on all interfaces, gate via pg_hba ───────────────
+if ! grep -q "^listen_addresses = '\*'" "$PG_CONF"; then
+  msg_info "Configuring listen_addresses + port $DB_PORT..."
+  sed -i "s/^#\?listen_addresses\s*=.*/listen_addresses = '*'/" "$PG_CONF"
+  sed -i "s/^#\?port\s*=.*/port = $DB_PORT/" "$PG_CONF"
+  msg_ok "postgresql.conf updated"
+else
+  msg_warn "listen_addresses already configured, skipping"
+fi
+
+# ── pg_hba: ONLY the nexus LXC may connect over the network ──────────────────
+# Strategy: replace the default file with an explicit allowlist. Local
+# UNIX-socket access stays peer-authenticated for the postgres superuser
+# (maintenance), the nexus role may connect from exactly one IP, everyone
+# else hits the final reject rule (defense-in-depth on top of "no other
+# rule matches").
+HBA_MARKER="# managed by nexus-db-install.sh"
+if ! grep -q "$HBA_MARKER" "$PG_HBA"; then
+  msg_info "Writing restrictive pg_hba.conf..."
+  cp -a "$PG_HBA" "$PG_HBA.dist"
+  cat >"$PG_HBA" <<EOF
+$HBA_MARKER — change via card, not by hand (nexus-hub K-102)
+# TYPE  DATABASE  USER      ADDRESS             METHOD
+local   all       postgres                      peer
+local   all       all                           peer
+host    $DB_NAME  $DB_USER  $NEXUS_APP_IP/32    scram-sha-256
+host    all       all       0.0.0.0/0           reject
+host    all       all       ::/0                reject
+EOF
+  msg_ok "pg_hba.conf restricted to $NEXUS_APP_IP/32"
+else
+  msg_warn "pg_hba.conf already managed, skipping"
+fi
+
+systemctl enable postgresql >/dev/null 2>&1
+systemctl restart postgresql
+
+# ── role + database + extension (idempotent, password kept on re-run) ─────────
+run_psql() { runuser -u postgres -- psql -v ON_ERROR_STOP=1 -qAt "$@"; }
+
+if [[ "$(run_psql -c "SELECT 1 FROM pg_roles WHERE rolname='$DB_USER'")" != "1" ]]; then
+  msg_info "Creating role $DB_USER + database $DB_NAME..."
+  DB_PASS="$(openssl rand -base64 32 | tr -d '/+=' | head -c 32)"
+  run_psql -c "CREATE ROLE $DB_USER LOGIN PASSWORD '$DB_PASS' NOSUPERUSER NOCREATEDB NOCREATEROLE"
+  msg_ok "Role $DB_USER created (least privilege)"
+elif [[ ! -f "$CRED_FILE" ]]; then
+  # Recovery: role exists but the generated password was never persisted
+  # (first run died between CREATE ROLE and credentials write). Rotate so
+  # the credentials file is authoritative again.
+  msg_warn "Role $DB_USER exists but $CRED_FILE is missing — rotating password"
+  DB_PASS="$(openssl rand -base64 32 | tr -d '/+=' | head -c 32)"
+  run_psql -c "ALTER ROLE $DB_USER PASSWORD '$DB_PASS'"
+  msg_ok "Password rotated"
+else
+  DB_PASS=""
+  msg_warn "Role $DB_USER already exists, password unchanged"
+fi
+
+if [[ "$(run_psql -c "SELECT 1 FROM pg_database WHERE datname='$DB_NAME'")" != "1" ]]; then
+  run_psql -c "CREATE DATABASE $DB_NAME OWNER $DB_USER"
+  # Only the owner may connect — no PUBLIC access.
+  run_psql -c "REVOKE CONNECT ON DATABASE $DB_NAME FROM PUBLIC"
+  msg_ok "Database $DB_NAME created (owner $DB_USER, PUBLIC revoked)"
+else
+  msg_warn "Database $DB_NAME already exists, skipping"
+fi
+
+# pgvector: CREATE EXTENSION needs superuser; installed now (per ADR-0002:
+# "Extension ab Tag 1 installiert, ungenutzt bis Phase 2").
+run_psql -d "$DB_NAME" -c "CREATE EXTENSION IF NOT EXISTS vector" >/dev/null
+msg_ok "Extension vector available in $DB_NAME"
+
+# ── credentials / DSN summary ─────────────────────────────────────────────────
+IP_SELF="$(hostname -I | awk '{print $1}')"
+if [[ -n "$DB_PASS" ]]; then
+  cat >"$CRED_FILE" <<EOF
+nexus-db — PostgreSQL $PG_MAJOR for nexus (Family Knowledge Hub)
+
+Host:     $IP_SELF:$DB_PORT
+Database: $DB_NAME
+Role:     $DB_USER (NOSUPERUSER NOCREATEDB NOCREATEROLE, sole owner)
+Password: $DB_PASS
+
+DSN for /etc/nexus/env on the nexus LXC (NEXUS_DATABASE_URL):
+  postgresql+psycopg://$DB_USER:$DB_PASS@$IP_SELF:$DB_PORT/$DB_NAME
+
+Access policy (pg_hba): only $NEXUS_APP_IP/32 may connect; all other
+hosts are rejected. Local socket stays peer-auth for maintenance:
+  pct exec <CTID> -- runuser -u postgres -- psql -d $DB_NAME
+EOF
+  chmod 600 "$CRED_FILE"
+  msg_ok "Credentials written to $CRED_FILE (chmod 600)"
+else
+  msg_warn "Re-run detected: $CRED_FILE untouched (password not rotated)"
+fi
+
+apt_cleanup
+msg_ok "$APP installation finished"

install/nexus-install.sh

@@ -46,6 +46,7 @@ run_user() { runuser -u "$APP_USER" -- env HOME="$APP_HOME" "$@"; }
 
 # ── packages: git + rsync + sudo ; Node.js via NodeSource ─────────────────────
 setup_base_apt git rsync sudo
+configure_ssh_root_login
 
 NODE_HAVE="$(command -v node >/dev/null 2>&1 && node -v | sed -E 's/^v([0-9]+).*/\1/' || echo 0)"
 if [[ "$NODE_HAVE" != "$NODE_MAJOR" ]]; then
@@ -57,11 +58,12 @@ else
   msg_warn "Node $(node -v) already present, skipping"
 fi
 
-# ── RUNTIME (extended by the stack-introducing SDD card in nexus-hub) ─────────
-# The nexus tech stack is not yet decided (nexus-hub Project Brief, open point 2).
-# When the stack card lands, it adds the runtime here (e.g. Python/uv, DB client
-# libs) AND documents the change in nexus-hub docs/agent-rules.md → Projekt-Kommandos.
-msg_warn "RUNTIME section is a placeholder until the nexus stack decision (see nexus-hub)"
+# ── RUNTIME ───────────────────────────────────────────────────────────────────
+# Stack decided (nexus-hub ADR-0002, card K-101): Python 3.12 via uv, tesseract
+# deu+eng, nexus-worker.service + sudoers extension. Provisioned by
+# install/nexus-runtime.sh, invoked at the END of this script (it extends the
+# sudoers rule and systemd units written below, so order matters). Commands are
+# documented in nexus-hub docs/05_AGENT_RULES.md → Projekt-Kommandos.
 
 # ── act_runner binary ─────────────────────────────────────────────────────────
 if [[ ! -x /usr/local/bin/act_runner ]]; then
@@ -121,6 +123,9 @@ cat >/etc/systemd/system/nexus.service <<EOF
 Description=nexus — Family Knowledge Hub
 After=network-online.target
 Wants=network-online.target
+# Skeleton-safe: only startable once the first deploy shipped the artifact
+# (otherwise a reboot before first deploy leaves the unit in failed state).
+ConditionPathExists=$CURRENT_DIR/start.sh
 
 [Service]
 Type=simple
@@ -165,6 +170,12 @@ systemctl enable nexus.service >/dev/null 2>&1
 systemctl enable --now nexus-runner.service
 msg_ok "systemd units installed (runner started; nexus.service enabled, starts on first deploy)"
 
+# ── RUNTIME provisioning (K-101): uv/Python 3.12, tesseract, worker unit ──────
+# Runs LAST on purpose: it extends the sudoers rule and unit set from above.
+# Idempotent — the same script retrofits an existing LXC:
+#   curl -fsSL .../install/nexus-runtime.sh | bash
+bash <(curl -fsSL "${LIB_URL%/lib}/install/nexus-runtime.sh")
+
 # ── notes / summary file ──────────────────────────────────────────────────────
 CRED_FILE="/root/nexus.credentials"
 cat >"$CRED_FILE" <<EOF

install/nexus-runtime.sh

@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+# nexus runtime provisioning — idempotent, runs inside the nexus LXC as root.
+#
+# Added by nexus-hub card K-101 (stack scaffold). Installs everything the
+# decided stack (nexus-hub ADR-0002) needs at runtime ON TOP of the base
+# nexus-install.sh provisioning:
+#   - uv for the `nexus` user (manages Python 3.12 per pyproject.toml)
+#   - tesseract OCR with deu+eng language packs (ingest cards K-107+)
+#   - nexus-worker.service systemd unit (analysis worker, queue with K-105)
+#   - sudoers extension so the Actions runner may also restart the worker
+#
+# Called by install/nexus-install.sh (RUNTIME section) during fresh installs.
+# To retrofit an EXISTING LXC (documented K-101 follow-up step), run inside it:
+#
+#   curl -fsSL https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/install/nexus-runtime.sh | bash
+#
+# Safe to re-run at any time.
+
+set -euo pipefail
+
+LIB_URL="${LIB_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/lib}"
+source <(curl -fsSL "$LIB_URL/install.func")
+
+[[ "$EUID" -eq 0 ]] || { msg_err "Must run as root"; exit 1; }
+
+APP_USER="nexus"
+APP_HOME="/opt/nexus"
+CURRENT_DIR="$APP_HOME/current"
+
+run_user() { runuser -u "$APP_USER" -- env HOME="$APP_HOME" PATH="$APP_HOME/.local/bin:/usr/local/bin:/usr/bin:/bin" "$@"; }
+
+id "$APP_USER" >/dev/null 2>&1 || { msg_err "user $APP_USER missing — run nexus-install.sh first"; exit 1; }
+
+# ── OCR stack (ING-3: tesseract deu+eng) ──────────────────────────────────────
+msg_info "Installing tesseract (deu+eng)..."
+apt-get install -y -qq tesseract-ocr tesseract-ocr-deu tesseract-ocr-eng >/dev/null
+msg_ok "tesseract $(tesseract --version 2>/dev/null | head -n1 | awk '{print $2}')"
+
+# ── uv for the nexus user (provides Python 3.12 via pyproject/uv.lock) ────────
+if [[ ! -x "$APP_HOME/.local/bin/uv" ]]; then
+  msg_info "Installing uv for $APP_USER..."
+  run_user bash -c "curl -LsSf https://astral.sh/uv/install.sh | sh" >/dev/null
+  msg_ok "uv $(run_user "$APP_HOME/.local/bin/uv" --version | awk '{print $2}') installed"
+else
+  msg_warn "uv already present ($(run_user "$APP_HOME/.local/bin/uv" --version | awk '{print $2}')), skipping"
+fi
+run_user "$APP_HOME/.local/bin/uv" python install 3.12 >/dev/null 2>&1 || true
+msg_ok "Python 3.12 toolchain available via uv"
+
+# ── nexus-worker.service ──────────────────────────────────────────────────────
+cat >/etc/systemd/system/nexus-worker.service <<EOF
+[Unit]
+Description=nexus — analysis worker (job queue arrives with K-105)
+After=network-online.target
+Wants=network-online.target
+# Skeleton-safe: only start once the deploy artifact provides the entrypoint.
+ConditionPathExists=$CURRENT_DIR/start-worker.sh
+
+[Service]
+Type=simple
+User=$APP_USER
+Group=$APP_USER
+WorkingDirectory=$CURRENT_DIR
+EnvironmentFile=/etc/nexus/env
+ExecStart=$CURRENT_DIR/start-worker.sh
+Restart=on-failure
+RestartSec=5
+NoNewPrivileges=true
+ProtectSystem=full
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+# ── sudoers: extend the narrow rule to cover the worker service ───────────────
+cat >/etc/sudoers.d/nexus-deploy <<EOF
+$APP_USER ALL=(root) NOPASSWD: /usr/bin/systemctl restart nexus.service, /usr/bin/systemctl start nexus.service, /usr/bin/systemctl stop nexus.service, /usr/bin/systemctl status nexus.service, /usr/bin/systemctl restart nexus-worker.service, /usr/bin/systemctl start nexus-worker.service, /usr/bin/systemctl stop nexus-worker.service, /usr/bin/systemctl status nexus-worker.service
+EOF
+chmod 440 /etc/sudoers.d/nexus-deploy
+visudo -cf /etc/sudoers.d/nexus-deploy >/dev/null
+
+systemctl daemon-reload
+systemctl enable nexus-worker.service >/dev/null 2>&1
+msg_ok "nexus-worker.service installed + enabled (starts once a deploy ships start-worker.sh)"
+
+msg_ok "nexus runtime provisioning finished (idempotent — safe to re-run)"

install/webapp-install.sh

@@ -44,6 +44,7 @@ run_user() { runuser -u "$APP_USER" -- env HOME="$APP_HOME" "$@"; }
 
 # ── packages: git + rsync + sudo ; Node.js via NodeSource ────────────────────
 setup_base_apt git rsync sudo
+configure_ssh_root_login
 
 NODE_HAVE="$(command -v node >/dev/null 2>&1 && node -v | sed -E 's/^v([0-9]+).*/\1/' || echo 0)"
 if [[ "$NODE_HAVE" != "$NODE_MAJOR" ]]; then

lib/build.func

@@ -97,55 +97,204 @@ apply_network_profile() {
   return 0
 }
 
+# ── input validation (K-114) ─────────────────────────────────────────────────
+# Real incident 2026-06-11: a pasted VLAN tag carried an invisible non-UTF-8
+# byte and broke `pct create` deep in the run. Policy: trim CR/edge whitespace,
+# but NEVER silently strip junk inside a value — embedded control/non-ASCII
+# bytes fail validation and trigger a visible re-prompt.
+
+# Trim \r and leading/trailing whitespace (edges only).
+sanitize_input() {
+  local s="${1-}"
+  s="${s//$'\r'/}"
+  s="${s#"${s%%[![:space:]]*}"}"
+  s="${s%"${s##*[![:space:]]}"}"
+  printf '%s' "$s"
+}
+
+# True if the value contains only printable ASCII (no control/non-ASCII
+# bytes). Byte-exact via tr: delete all printable ASCII — anything left
+# over is junk.
+is_clean_ascii() {
+  # Newline/Tab zuerst explizit ablehnen — $(…) strippt trailing newlines,
+  # die der tr-Pfad sonst übersehen würde (Review-Finding K-114).
+  [[ "$1" == *$'\n'* || "$1" == *$'\t'* ]] && return 1
+  local leftover
+  leftover="$(printf '%s' "$1" | LC_ALL=C tr -d '\40-\176')"
+  [[ -z "$leftover" ]]
+}
+
+is_uint()     { is_clean_ascii "$1" && [[ "$1" =~ ^[0-9]+$ ]]; }
+# 10#: führende Nullen nicht als Oktal werten ("08" wäre sonst ein
+# Arithmetik-Fehler statt einer sauberen Ablehnung/Annahme).
+is_vlan_tag() { is_uint "$1" && (( 10#$1 >= 1 && 10#$1 <= 4094 )); }
+is_token()    { is_clean_ascii "$1" && [[ "$1" =~ ^[A-Za-z0-9._-]+$ ]]; }
+is_hostname() { is_clean_ascii "$1" && [[ "$1" =~ ^[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?$ ]]; }
+
+is_ipv4() {
+  is_clean_ascii "$1" && [[ "$1" =~ ^([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})$ ]] || return 1
+  local o
+  for o in "${BASH_REMATCH[@]:1:4}"; do (( 10#$o <= 255 )) || return 1; done
+  return 0
+}
+
+is_cidr() {
+  [[ "$1" =~ ^([0-9.]+)/([0-9]{1,2})$ ]] || return 1
+  # BASH_REMATCH retten — is_ipv4 nutzt selbst =~ und überschreibt es.
+  local _ip="${BASH_REMATCH[1]}" _prefix="${BASH_REMATCH[2]}"
+  is_ipv4 "$_ip" && (( 10#$_prefix >= 1 && 10#$_prefix <= 32 ))
+}
+
+is_ipcfg() { [[ "$1" == "dhcp" ]] || is_cidr "$1"; }
+
+# Ja/Nein-Antworten (Prompts wie "… erlauben? [Y/n]"). Akzeptiert
+# deutsch/englisch, normalize_yesno macht daraus kanonisch yes|no.
+is_yesno() { is_clean_ascii "$1" && [[ "${1,,}" =~ ^(y|yes|j|ja|n|no|nein)$ ]]; }
+normalize_yesno() {
+  case "${1,,}" in
+    y|yes|j|ja) printf 'yes' ;;
+    *)          printf 'no' ;;
+  esac
+}
+
+# Space/comma-separated list of IPv4s (DNS prompt). Gesamtstring zuerst
+# prüfen — die Wort-Splittung würde eingebettete Newlines sonst verstecken.
+is_ipv4_list() {
+  is_clean_ascii "$1" || return 1
+  local item
+  for item in ${1//,/ }; do is_ipv4 "$item" || return 1; done
+  [[ -n "$1" ]]
+}
+
+# prompt_validated VARNAME PROMPT VALIDATOR [DEFAULT] [allow_empty]
+# Reads into VARNAME (nameref, no subshell), sanitizes, applies the default on
+# empty input and re-prompts until the validator passes. allow_empty=yes lets
+# an empty value through (e.g. "no VLAN").
+prompt_validated() {
+  # Schutz vor zirkulärem nameref (Review-Finding): interne Namen tabu.
+  [[ "$1" == _pv_* || "$1" == _rv_* ]] && { msg_err "prompt_validated: reserved variable name '$1'"; return 2; }
+  local -n _pv_ref="$1"
+  local _pv_prompt="$2" _pv_validator="$3" _pv_default="${4-}" _pv_allow_empty="${5:-no}"
+  local _pv_value
+  while true; do
+    if ! read -rp "$_pv_prompt" _pv_value; then
+      # EOF (kein TTY / stdin erschöpft): kein Endlos-Loop, sauber raus —
+      # unter set -e bricht der Caller damit kontrolliert ab.
+      msg_err "No input available for prompt: ${_pv_prompt%% *}"
+      return 1
+    fi
+    _pv_value="$(sanitize_input "$_pv_value")"
+    if [[ -z "$_pv_value" && -n "$_pv_default" ]]; then
+      _pv_value="$_pv_default"
+    fi
+    if [[ -z "$_pv_value" ]]; then
+      if [[ "$_pv_allow_empty" == "yes" ]]; then _pv_ref=""; return 0; fi
+      msg_warn "A value is required."
+      continue
+    fi
+    if "$_pv_validator" "$_pv_value"; then
+      _pv_ref="$_pv_value"
+      return 0
+    fi
+    if ! is_clean_ascii "$_pv_value"; then
+      msg_warn "Input contains invisible/non-ASCII characters — please re-type (do not paste)."
+    else
+      msg_warn "Invalid value: '$_pv_value' — please retry."
+    fi
+  done
+}
+
+# Validate an env-provided value (non-interactive: abort instead of re-prompt).
+require_valid() {
+  [[ "$1" == _pv_* || "$1" == _rv_* ]] && { msg_err "require_valid: reserved variable name '$1'"; return 2; }
+  local -n _rv_ref="$1"
+  local _rv_validator="$2" _rv_label="$3"
+  _rv_ref="$(sanitize_input "$_rv_ref")"
+  "$_rv_validator" "$_rv_ref" || { msg_err "$_rv_label invalid: '$_rv_ref'"; exit 1; }
+}
+
 # ── prompts ──────────────────────────────────────────────────────────────────
-# Each prompt is skipped if the corresponding variable is already set in env.
+# Each prompt is skipped if the corresponding variable is already set in env
+# (env values are still validated — abort on invalid, no silent use).
 # VLAN_TAG and NAMESERVER use ${VAR+x} so that explicitly setting them to ""
 # via env skips the prompt (= "no VLAN" / "inherit DNS from host").
 prompt_lxc_config() {
   if [[ -z "${CTID:-}" ]]; then
-    read -rp "Container ID [auto]: " CTID
-    [[ -z "${CTID:-}" ]] && CTID=$(pvesh get /cluster/nextid)
+    # Eigener Loop statt prompt_validated: leer = auto (pvesh nextid),
+    # ungültig = Re-Prompt (Review-Finding: vorher Abbruch statt Re-Prompt).
+    while true; do
+      if ! read -rp "Container ID [auto]: " CTID; then
+        msg_err "No input available for prompt: Container ID"
+        return 1
+      fi
+      CTID="$(sanitize_input "$CTID")"
+      if [[ -z "$CTID" ]]; then
+        CTID=$(pvesh get /cluster/nextid)
+        break
+      fi
+      is_uint "$CTID" && break
+      msg_warn "Invalid value: '$CTID' — please retry (digits only)."
+    done
+  else
+    require_valid CTID is_uint "Container ID"
   fi
   echo "  → CTID: $CTID"
 
   if [[ -z "${CT_HOSTNAME:-}" ]]; then
-    read -rp "Hostname [$DEFAULT_HOSTNAME]: " CT_HOSTNAME
-    CT_HOSTNAME="${CT_HOSTNAME:-$DEFAULT_HOSTNAME}"
+    prompt_validated CT_HOSTNAME "Hostname [$DEFAULT_HOSTNAME]: " is_hostname "$DEFAULT_HOSTNAME"
+  else
+    require_valid CT_HOSTNAME is_hostname "Hostname"
   fi
   if [[ -z "${DISK_SIZE:-}" ]]; then
-    read -rp "Disk size in GB [$DEFAULT_DISK]: " DISK_SIZE
-    DISK_SIZE="${DISK_SIZE:-$DEFAULT_DISK}"
+    prompt_validated DISK_SIZE "Disk size in GB [$DEFAULT_DISK]: " is_uint "$DEFAULT_DISK"
+  else
+    require_valid DISK_SIZE is_uint "Disk size"
   fi
   if [[ -z "${CORES:-}" ]]; then
-    read -rp "vCPU cores [$DEFAULT_CORES]: " CORES
-    CORES="${CORES:-$DEFAULT_CORES}"
+    prompt_validated CORES "vCPU cores [$DEFAULT_CORES]: " is_uint "$DEFAULT_CORES"
+  else
+    require_valid CORES is_uint "vCPU cores"
   fi
   if [[ -z "${RAM:-}" ]]; then
-    read -rp "RAM in MB [$DEFAULT_RAM]: " RAM
-    RAM="${RAM:-$DEFAULT_RAM}"
+    prompt_validated RAM "RAM in MB [$DEFAULT_RAM]: " is_uint "$DEFAULT_RAM"
+  else
+    require_valid RAM is_uint "RAM"
   fi
   if [[ -z "${BRIDGE:-}" ]]; then
-    read -rp "Bridge [$DEFAULT_BRIDGE]: " BRIDGE
-    BRIDGE="${BRIDGE:-$DEFAULT_BRIDGE}"
+    prompt_validated BRIDGE "Bridge [$DEFAULT_BRIDGE]: " is_token "$DEFAULT_BRIDGE"
+  else
+    require_valid BRIDGE is_token "Bridge"
   fi
   if [[ -z "${VLAN_TAG+x}" ]]; then
-    read -rp "VLAN tag (empty for none): " VLAN_TAG
+    # The 2026-06-11 incident prompt: junk bytes re-prompt, empty = no VLAN.
+    prompt_validated VLAN_TAG "VLAN tag (empty for none): " is_vlan_tag "" yes
+  elif [[ -n "${VLAN_TAG:-}" ]]; then
+    require_valid VLAN_TAG is_vlan_tag "VLAN tag"
   fi
   if [[ -z "${TEMPLATE_STORAGE:-}" ]]; then
-    read -rp "Template storage [$DEFAULT_TEMPLATE_STORAGE]: " TEMPLATE_STORAGE
-    TEMPLATE_STORAGE="${TEMPLATE_STORAGE:-$DEFAULT_TEMPLATE_STORAGE}"
+    prompt_validated TEMPLATE_STORAGE \
+      "Template storage [$DEFAULT_TEMPLATE_STORAGE]: " is_token "$DEFAULT_TEMPLATE_STORAGE"
+  else
+    require_valid TEMPLATE_STORAGE is_token "Template storage"
   fi
   if [[ -z "${ROOTFS_STORAGE:-}" ]]; then
-    read -rp "Rootfs storage [$DEFAULT_ROOTFS_STORAGE]: " ROOTFS_STORAGE
-    ROOTFS_STORAGE="${ROOTFS_STORAGE:-$DEFAULT_ROOTFS_STORAGE}"
+    prompt_validated ROOTFS_STORAGE \
+      "Rootfs storage [$DEFAULT_ROOTFS_STORAGE]: " is_token "$DEFAULT_ROOTFS_STORAGE"
+  else
+    require_valid ROOTFS_STORAGE is_token "Rootfs storage"
   fi
   if [[ -z "${IPCFG:-}" ]]; then
-    read -rp "Network: IP/CIDR or 'dhcp' [dhcp]: " IPCFG
-    IPCFG="${IPCFG:-dhcp}"
+    prompt_validated IPCFG "Network: IP/CIDR or 'dhcp' [dhcp]: " is_ipcfg "dhcp"
+  else
+    require_valid IPCFG is_ipcfg "Network (IP/CIDR or dhcp)"
   fi
   GATEWAY="${GATEWAY:-}"
-  if [[ "$IPCFG" != "dhcp" && -z "$GATEWAY" ]]; then
-    read -rp "Gateway: " GATEWAY
+  if [[ "$IPCFG" != "dhcp" ]]; then
+    if [[ -z "$GATEWAY" ]]; then
+      prompt_validated GATEWAY "Gateway: " is_ipv4
+    else
+      require_valid GATEWAY is_ipv4 "Gateway"
+    fi
   fi
   # DNS is driven by the VLAN tag via the network profile (lib/networks.conf),
   # so the right resolvers get set even with DHCP. Precedence:
@@ -155,17 +304,34 @@ prompt_lxc_config() {
   #   4. DHCP, no profile                                  → inherit from host
   apply_network_profile
   if [[ -n "${NAMESERVER+x}" ]]; then
-    :  # explicit override from env, leave untouched
+    # Explizites Override aus env: "" = inherit bleibt erlaubt, aber ein
+    # gesetzter Wert wird validiert (Review-Finding: lief vorher ungeprüft
+    # bis in pct create).
+    if [[ -n "${NAMESERVER:-}" ]]; then
+      require_valid NAMESERVER is_ipv4_list "DNS server"
+    fi
   elif [[ -n "$PROFILE_DNS" ]]; then
     NAMESERVER="$PROFILE_DNS"
     msg_info "DNS for VLAN ${VLAN_TAG:-none} (${PROFILE_SUBNET:-?}): $NAMESERVER"
   elif [[ "$IPCFG" != "dhcp" ]]; then
     local default_ns="${DEFAULT_NAMESERVER:-$GATEWAY}"
-    read -rp "DNS server [$default_ns] (empty = inherit from PVE host): " NAMESERVER
-    NAMESERVER="${NAMESERVER:-$default_ns}"
+    prompt_validated NAMESERVER \
+      "DNS server [$default_ns] (empty = inherit from PVE host): " \
+      is_ipv4_list "$default_ns" yes
   else
     msg_warn "No network profile for VLAN ${VLAN_TAG:-none}; DHCP DNS will be inherited."
   fi
+
+  # SSH-Root-Login (Default: ja, Homelab-Komfort). Umgesetzt wird das im
+  # Install-Pfad per sshd-Drop-in (configure_ssh_root_login, lib/install.func);
+  # bootstrap_install_script reicht den normalisierten Wert in den Container.
+  if [[ -z "${SSH_ROOT_LOGIN:-}" ]]; then
+    prompt_validated SSH_ROOT_LOGIN "SSH-Root-Login erlauben? [Y/n]: " is_yesno "y"
+  else
+    require_valid SSH_ROOT_LOGIN is_yesno "SSH root login (y/n)"
+  fi
+  SSH_ROOT_LOGIN="$(normalize_yesno "$SSH_ROOT_LOGIN")"
+  echo "  → SSH root login: $SSH_ROOT_LOGIN"
 }
 
 # ── template ─────────────────────────────────────────────────────────────────
@@ -263,7 +429,9 @@ bootstrap_install_script() {
   pct exec "$CTID" -- bash -c "apt-get update -qq && apt-get install -y -qq curl ca-certificates >/dev/null"
 
   msg_info "Running installer ($url)..."
-  pct exec "$CTID" -- bash -c "curl -fsSL '$url' -o /root/${APP}-install.sh && bash /root/${APP}-install.sh"
+  # SSH_ROOT_LOGIN ist durch normalize_yesno kanonisch yes|no — als Env in
+  # den Container durchreichen (configure_ssh_root_login wertet es aus).
+  pct exec "$CTID" -- bash -c "curl -fsSL '$url' -o /root/${APP}-install.sh && SSH_ROOT_LOGIN='${SSH_ROOT_LOGIN:-yes}' bash /root/${APP}-install.sh"
 }
 
 # ── summary ──────────────────────────────────────────────────────────────────

lib/install.func

@@ -15,10 +15,14 @@ msg_warn() { echo -e "${YELLOW}[!]${NC} $*"; }
 msg_err()  { echo -e "${RED}[✗]${NC} $*" >&2; }
 
 # ── apt ──────────────────────────────────────────────────────────────────────
-# Always installs: ca-certificates curl openssl tzdata gnupg
+# Always installs: ca-certificates curl openssl tzdata gnupg locales
 # Additional packages can be passed as args.
 setup_base_apt() {
   export DEBIAN_FRONTEND=noninteractive
+  # C.UTF-8 ist in glibc eingebaut und damit schon VOR dem locales-Paket
+  # verfügbar — deckt den ersten apt/dpkg-Lauf ab (keine perl-Warnungen
+  # "Setting locale failed" mehr, LXC-Templates kommen ohne Locale).
+  export LANG=C.UTF-8 LC_ALL=C.UTF-8
   msg_info "Updating apt index..."
   apt-get update -qq
   if [[ $# -gt 0 ]]; then
@@ -27,17 +31,59 @@ setup_base_apt() {
     msg_info "Installing base packages..."
   fi
   apt-get install -y -qq \
-    ca-certificates curl openssl tzdata gnupg \
+    ca-certificates curl openssl tzdata gnupg locales \
     "$@" \
     >/dev/null
+  setup_locales
   msg_ok "apt setup complete"
 }
 
+# en_US.UTF-8 generieren und systemweit als Default setzen; C.UTF-8 braucht
+# keine Generierung (glibc-built-in). Idempotent: sed greift nur auf die
+# auskommentierte Zeile, locale-gen/update-locale sind re-run-sicher.
+setup_locales() {
+  msg_info "Generating locales (en_US.UTF-8; C.UTF-8 built-in)..."
+  sed -i 's/^# *en_US\.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen
+  locale-gen >/dev/null
+  update-locale LANG=en_US.UTF-8
+  msg_ok "Default locale: en_US.UTF-8"
+}
+
 apt_cleanup() {
   apt-get autoremove -y -qq >/dev/null || true
   apt-get autoclean -qq >/dev/null || true
 }
 
+# ── ssh ──────────────────────────────────────────────────────────────────────
+# SSH-Root-Login gemäß Host-Prompt (prompt_lxc_config setzt SSH_ROOT_LOGIN,
+# bootstrap_install_script reicht es als Env durch; Default: yes).
+#   yes → PermitRootLogin yes (Passwort-Login mit dem generierten Root-Passwort)
+#   no  → PermitRootLogin prohibit-password (Debian-Default, nur SSH-Key)
+# Umsetzung als Drop-in, damit Paket-Updates von sshd_config nicht kollidieren.
+configure_ssh_root_login() {
+  local choice="${SSH_ROOT_LOGIN:-yes}" value
+  case "$choice" in
+    yes) value="yes" ;;
+    no)  value="prohibit-password" ;;
+    *)   msg_err "SSH_ROOT_LOGIN must be yes|no, got: '$choice'"; return 1 ;;
+  esac
+
+  if [[ ! -d /etc/ssh/sshd_config.d ]]; then
+    if [[ "$choice" == "no" ]]; then
+      msg_warn "openssh-server not installed — nothing to configure (root login stays off)"
+      return 0
+    fi
+    msg_info "Installing openssh-server..."
+    apt-get install -y -qq openssh-server >/dev/null
+  fi
+
+  msg_info "Configuring SSH root login: PermitRootLogin $value"
+  printf 'PermitRootLogin %s\n' "$value" >/etc/ssh/sshd_config.d/zz-root-login.conf
+  systemctl reload ssh 2>/dev/null || systemctl restart ssh 2>/dev/null \
+    || msg_warn "ssh.service not active yet — config applies on first start"
+  msg_ok "SSH root login: $choice"
+}
+
 # ── users / dirs ─────────────────────────────────────────────────────────────
 create_system_user() {
   local user="$1" home="$2"

tests/check_ct_source.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# K-114: Jedes ct/*.sh MUSS lib/build.func sourcen — der Bug "Helfer nicht
+# gesourct, Skript stirbt erst mitten im Lauf" ist zweimal real passiert
+# (nexus-db: im Review gefangen; authentik: erst in Produktion).
+# Aufruf: tests/check_ct_source.sh [verzeichnis]  (Default: ct/)
+#
+# Bewusst eng: akzeptiert wird NUR die curl-Prozesssubstitutions-Form
+# `source <(curl ... build.func)` — das ist der Repo-Vertrag für ct/-Scripts
+# (Review-Triage K-114). Lokales Sourcen gehört nicht in ct/*.sh.
+set -euo pipefail
+
+DIR="${1:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/ct}"
+status=0
+
+shopt -s nullglob
+scripts=("$DIR"/*.sh)
+if [[ ${#scripts[@]} -eq 0 ]]; then
+  echo "no scripts found in $DIR" >&2
+  exit 1
+fi
+
+for script in "${scripts[@]}"; do
+  if grep -Eq 'source[[:space:]]+<\(curl[^)]*build\.func' "$script"; then
+    echo "ok     $script"
+  else
+    echo "FEHLT  $script — sourct lib/build.func nicht" >&2
+    status=1
+  fi
+done
+exit "$status"

tests/test_validation.sh

@@ -0,0 +1,200 @@
+#!/usr/bin/env bash
+# K-114: Unit-Tests für die Input-Validierung in lib/build.func.
+# Läuft ohne PVE (sourct nur die Helfer). Aufruf: bash tests/test_validation.sh
+set -u
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# shellcheck source=/dev/null
+source "$REPO_ROOT/lib/build.func"
+
+PASS=0
+FAIL=0
+
+ok() { PASS=$((PASS + 1)); echo "ok     - $1"; }
+nok() { FAIL=$((FAIL + 1)); echo "NOT OK - $1"; }
+
+assert_true() {  # assert_true "desc" cmd args...
+  local desc="$1"; shift
+  if "$@"; then ok "$desc"; else nok "$desc"; fi
+}
+assert_false() {
+  local desc="$1"; shift
+  if "$@"; then nok "$desc"; else ok "$desc"; fi
+}
+
+# ── Repro des Vorfalls vom 2026-06-11: VLAN-Tag mit unsichtbarem Byte ────────
+JUNK_VLAN="$(printf '2\x800')"   # "20" mit eingebettetem Non-UTF-8-Byte
+assert_false "VLAN-Repro: '2<0x80>0' wird abgelehnt (kein silent strip)" is_vlan_tag "$JUNK_VLAN"
+assert_false "is_clean_ascii erkennt eingebettetes Junk-Byte" is_clean_ascii "$JUNK_VLAN"
+
+# Re-Prompt-Verhalten: erste Eingabe ist der Junk-Wert, zweite ist sauber —
+# prompt_validated muss die zweite liefern (AC: Re-Prompt statt pct-Fehler).
+reprompt_result="$(
+  printf '%s\n20\n' "$JUNK_VLAN" | {
+    VLAN=""
+    prompt_validated VLAN "VLAN tag (empty for none): " is_vlan_tag "" yes >/dev/null 2>&1
+    printf '%s' "$VLAN"
+  }
+)"
+if [[ "$reprompt_result" == "20" ]]; then
+  ok "prompt_validated re-promptet bei Junk und akzeptiert dann '20'"
+else
+  nok "prompt_validated re-promptet bei Junk (got: '$reprompt_result')"
+fi
+
+# ── sanitize_input: CR + Rand-Whitespace weg, Inhalt unangetastet ─────────────
+[[ "$(sanitize_input $'  42\r\n')" == "42" ]] && ok "sanitize_input trimmt CR/Whitespace" \
+  || nok "sanitize_input trimmt CR/Whitespace"
+[[ "$(sanitize_input "$JUNK_VLAN")" == "$JUNK_VLAN" ]] && ok "sanitize_input strippt KEIN eingebettetes Junk (Validator soll es sehen)" \
+  || nok "sanitize_input lässt eingebettetes Junk unangetastet"
+
+# ── numerische Validatoren ────────────────────────────────────────────────────
+assert_true  "is_uint akzeptiert 8"            is_uint "8"
+assert_false "is_uint lehnt '8 ' mit Junk ab"  is_uint "$(printf '8\x01')"
+assert_false "is_uint lehnt 'abc' ab"          is_uint "abc"
+assert_false "is_uint lehnt leeren Wert ab"    is_uint ""
+assert_true  "is_vlan_tag akzeptiert 20"       is_vlan_tag "20"
+assert_false "is_vlan_tag lehnt 0 ab"          is_vlan_tag "0"
+assert_false "is_vlan_tag lehnt 5000 ab"       is_vlan_tag "5000"
+
+# ── Netz-Validatoren ──────────────────────────────────────────────────────────
+assert_true  "is_ipv4 akzeptiert 10.11.20.66"      is_ipv4 "10.11.20.66"
+assert_false "is_ipv4 lehnt 10.11.20.666 ab"       is_ipv4 "10.11.20.666"
+assert_false "is_ipv4 lehnt 10.11.20 ab"           is_ipv4 "10.11.20"
+assert_true  "is_cidr akzeptiert 10.11.20.5/24"    is_cidr "10.11.20.5/24"
+assert_false "is_cidr lehnt 10.11.20.5/33 ab"      is_cidr "10.11.20.5/33"
+assert_false "is_cidr lehnt 10.11.20.5 ohne Maske" is_cidr "10.11.20.5"
+assert_true  "is_ipcfg akzeptiert dhcp"            is_ipcfg "dhcp"
+assert_true  "is_ipcfg akzeptiert CIDR"            is_ipcfg "192.168.0.7/24"
+assert_false "is_ipcfg lehnt 'static' ab"          is_ipcfg "static"
+assert_true  "is_ipv4_list akzeptiert Liste"       is_ipv4_list "1.1.1.1, 8.8.8.8"
+assert_false "is_ipv4_list lehnt Hostnamen ab"     is_ipv4_list "dns.local"
+
+# ── Namen/Token ───────────────────────────────────────────────────────────────
+assert_true  "is_hostname akzeptiert nexus-db"     is_hostname "nexus-db"
+assert_false "is_hostname lehnt '-bad' ab"         is_hostname "-bad"
+assert_false "is_hostname lehnt 'a b' ab"          is_hostname "a b"
+assert_true  "is_token akzeptiert local-lvm"       is_token "local-lvm"
+assert_false "is_token lehnt 'a;b' ab"             is_token "a;b"
+
+# ── Ja/Nein (SSH-Root-Login-Prompt) ──────────────────────────────────────────
+assert_true  "is_yesno akzeptiert y"               is_yesno "y"
+assert_true  "is_yesno akzeptiert Ja"              is_yesno "Ja"
+assert_true  "is_yesno akzeptiert NO"              is_yesno "NO"
+assert_true  "is_yesno akzeptiert nein"            is_yesno "nein"
+assert_false "is_yesno lehnt 'maybe' ab"           is_yesno "maybe"
+assert_false "is_yesno lehnt leeren Wert ab"       is_yesno ""
+[[ "$(normalize_yesno "J")" == "yes" && "$(normalize_yesno "nein")" == "no" ]] \
+  && ok "normalize_yesno kanonisiert J→yes, nein→no" \
+  || nok "normalize_yesno kanonisiert J→yes, nein→no"
+
+# SSH-Root-Login-Prompt: leere Eingabe = Default Y → normalisiert yes;
+# explizites 'n' → no.
+ssh_default="$(
+  printf '\n' | {
+    SSH_ROOT_LOGIN=""
+    prompt_validated SSH_ROOT_LOGIN "SSH-Root-Login erlauben? [Y/n]: " is_yesno "y" >/dev/null 2>&1
+    normalize_yesno "$SSH_ROOT_LOGIN"
+  }
+)"
+[[ "$ssh_default" == "yes" ]] && ok "SSH-Root-Login: leere Eingabe → Default yes" \
+  || nok "SSH-Root-Login Default (got: '$ssh_default')"
+ssh_no="$(
+  printf 'n\n' | {
+    SSH_ROOT_LOGIN=""
+    prompt_validated SSH_ROOT_LOGIN "SSH-Root-Login erlauben? [Y/n]: " is_yesno "y" >/dev/null 2>&1
+    normalize_yesno "$SSH_ROOT_LOGIN"
+  }
+)"
+[[ "$ssh_no" == "no" ]] && ok "SSH-Root-Login: 'n' → no" \
+  || nok "SSH-Root-Login 'n' (got: '$ssh_no')"
+
+# ── require_valid: env-Werte werden sanitisiert + geprüft ────────────────────
+CHECKVAL=$'  7\r'
+require_valid CHECKVAL is_uint "Testwert" && [[ "$CHECKVAL" == "7" ]] \
+  && ok "require_valid sanitisiert env-Wert (CR weg)" \
+  || nok "require_valid sanitisiert env-Wert"
+( CHECKBAD="$JUNK_VLAN"; require_valid CHECKBAD is_uint "Testwert" ) >/dev/null 2>&1 \
+  && nok "require_valid bricht bei Junk-env-Wert ab" \
+  || ok "require_valid bricht bei Junk-env-Wert ab (exit != 0)"
+
+# ── Negativ-Beweis: build.func-Source-Check schlägt bei Präparat an ──────────
+TMPDIR_CT="$(mktemp -d)"
+cat >"$TMPDIR_CT/broken.sh" <<'EOF'
+#!/usr/bin/env bash
+# absichtlich ohne source build.func (Repro des zweimal aufgetretenen Bugs)
+APP="broken"
+prompt_lxc_config
+EOF
+if bash "$REPO_ROOT/tests/check_ct_source.sh" "$TMPDIR_CT" >/dev/null 2>&1; then
+  nok "check_ct_source.sh erkennt fehlendes 'source build.func'"
+else
+  ok "check_ct_source.sh erkennt fehlendes 'source build.func'"
+fi
+rm -rf "$TMPDIR_CT"
+
+# Positiv: das echte ct/-Verzeichnis ist sauber.
+if bash "$REPO_ROOT/tests/check_ct_source.sh" "$REPO_ROOT/ct" >/dev/null 2>&1; then
+  ok "alle ct/*.sh sourcen build.func"
+else
+  nok "alle ct/*.sh sourcen build.func"
+fi
+
+# ── Review-Findings K-114: Oktal, Newline, EOF, Nameref-Guard ────────────────
+assert_true  "is_vlan_tag akzeptiert '08' (kein Oktal-Fehler)"  is_vlan_tag "08"
+assert_true  "is_cidr akzeptiert /08 (kein Oktal-Fehler)"       is_cidr "10.0.0.1/08"
+assert_false "is_clean_ascii lehnt eingebettetes Newline ab"    is_clean_ascii $'1.1.1.1\n8.8.8.8'
+assert_false "is_ipv4_list lehnt Newline-Liste ab"              is_ipv4_list $'1.1.1.1\n8.8.8.8'
+
+# EOF statt Eingabe: prompt_validated darf nicht endlos loopen.
+( printf '' | { V=""; prompt_validated V "Wert: " is_uint; } ) >/dev/null 2>&1
+rc=$?
+[[ "$rc" -ne 0 ]] && ok "prompt_validated bricht bei EOF ab (rc=$rc)" \
+  || nok "prompt_validated bricht bei EOF ab"
+
+# Reservierte Namen → Guard statt zirkulärem nameref.
+( _pv_ref=""; prompt_validated _pv_ref "x: " is_uint ) >/dev/null 2>&1
+[[ $? -eq 2 ]] && ok "prompt_validated weist reservierte Variablennamen ab" \
+  || nok "prompt_validated weist reservierte Variablennamen ab"
+
+# CTID-Re-Prompt: ungültig → erneut fragen, leer wäre auto (hier: gültige Zahl).
+ctid_out="$(
+  printf 'abc\n123\n' | env -u CTID bash -c "
+    source '$REPO_ROOT/lib/build.func'
+    CTID=''
+    while true; do
+      read -rp 'Container ID [auto]: ' CTID || exit 1
+      CTID=\"\$(sanitize_input \"\$CTID\")\"
+      [[ -z \"\$CTID\" ]] && exit 1
+      is_uint \"\$CTID\" && break
+    done
+    printf '%s' \"\$CTID\""
+)"
+[[ "$ctid_out" == "123" ]] && ok "CTID-Loop re-promptet bei 'abc' und nimmt '123'" \
+  || nok "CTID-Loop re-promptet (got: '$ctid_out')"
+
+# ── Dry-Run: prompt_lxc_config komplett aus env, ohne PVE/TTY ────────────────
+smoke_out="$(
+  env CTID=999 CT_HOSTNAME=smoke DISK_SIZE=8 CORES=2 RAM=1024 BRIDGE=vmbr0 \
+    VLAN_TAG=20 TEMPLATE_STORAGE=local ROOTFS_STORAGE=local-lvm \
+    IPCFG=10.11.20.99/24 GATEWAY=10.11.20.1 NAMESERVER="" SSH_ROOT_LOGIN=J \
+    NET_PROFILES_FILE="$REPO_ROOT/lib/networks.conf" \
+    bash -c "source '$REPO_ROOT/lib/build.func' && prompt_lxc_config >/dev/null && echo SMOKE-OK:\$SSH_ROOT_LOGIN"
+)" || true
+[[ "$smoke_out" == *SMOKE-OK:yes* ]] \
+  && ok "prompt_lxc_config Dry-Run mit validen env-Werten läuft durch (SSH_ROOT_LOGIN J→yes)" \
+  || nok "prompt_lxc_config Dry-Run (got: '$smoke_out')"
+
+smoke_bad="$(
+  env CTID="$(printf '9\x809')" CT_HOSTNAME=smoke DISK_SIZE=8 CORES=2 RAM=1024 BRIDGE=vmbr0 \
+    VLAN_TAG=20 TEMPLATE_STORAGE=local ROOTFS_STORAGE=local-lvm IPCFG=dhcp NAMESERVER="" \
+    NET_PROFILES_FILE="$REPO_ROOT/lib/networks.conf" \
+    bash -c "source '$REPO_ROOT/lib/build.func' && prompt_lxc_config >/dev/null && echo SMOKE-OK" 2>/dev/null
+)" || true
+[[ "$smoke_bad" == *SMOKE-OK* ]] \
+  && nok "prompt_lxc_config bricht bei Junk-CTID aus env ab" \
+  || ok "prompt_lxc_config bricht bei Junk-CTID aus env ab"
+
+echo
+echo "passed=$PASS failed=$FAIL"
+[[ "$FAIL" -eq 0 ]]