fix(runner): Re-Review-Nits — irreführenden Validator-Kommentar korrigiert, EOF-Abbruch in Prompt-Loop

Reviewed-on: #4

README.md

@@ -9,6 +9,7 @@ Inspired by [community-scripts/ProxmoxVE](https://github.com/community-scripts/P
 | App | Description | One-liner |
 |-----|-------------|-----------|
 | [devpi](ct/devpi.sh) | Private PyPI cache / mirror — saves time on CUDA/torch rebuilds | `bash -c "$(curl -fsSL https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/ct/devpi.sh)"` |
+| [webapp](ct/webapp.sh) | Next.js site with deploy-as-code via a self-hosted Gitea Actions runner (host mode, no inbound port) | `bash -c "$(curl -fsSL https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/ct/webapp.sh)"` |
 
 ## Usage
 

ct/authentik.sh

@@ -0,0 +1,107 @@
+#!/usr/bin/env bash
+# Authentik — zentraler Homelab-IdP (nexus ADR-0003)
+#
+# Creates an unprivileged Debian 12 LXC with nesting enabled that runs the
+# official Authentik docker-compose stack (server, worker, postgres, redis).
+#
+# Automation-friendly by design (nexus-hub K-102):
+#   - bootstrap admin password AND API token are generated headlessly
+#     (-> /root/authentik.credentials) so an agent can apply blueprints via
+#     API without ever touching the UI
+#   - optional dedicated SSH public key for agent access (Claude Code)
+#   - blueprints dir mounted at /opt/authentik/blueprints (compose override)
+#
+# Manual steps that remain AFTER this script (by design):
+#   1. NPMplus: proxy host auth.<domain> -> http://<LXC-IP>:9000
+#      (WebSockets ON; the auth domain is PERMANENT — WebAuthn RP-ID!)
+#   2. Passkey enrollment of the human admin account
+#
+# Run on a Proxmox VE host:
+#   bash -c "$(curl -fsSL https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/ct/authentik.sh)"
+
+set -euo pipefail
+
+APP="authentik"
+APP_DESCRIPTION="Authentik IdP (Docker-Compose) — Passkeys, TOTP, OIDC für nexus & Homelab"
+APP_PORT="${APP_PORT:-9000}"
+
+LIB_URL="${LIB_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/lib}"
+INSTALL_SCRIPT_URL="${INSTALL_SCRIPT_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/install/authentik-install.sh}"
+
+source <(curl -fsSL "$LIB_URL/build.func")
+
+# LXC defaults (server+worker+postgres+redis brauchen Luft)
+DEFAULT_HOSTNAME="authentik"
+DEFAULT_DISK="20"
+DEFAULT_CORES="2"
+DEFAULT_RAM="4096"
+
+prompt_app_config() {
+  echo
+  echo "── Authentik configuration ─────────────────────────────────"
+  if [[ -z "${AUTH_DOMAIN:-}" ]]; then
+    read -rp "Auth-Domain (dauerhaft! WebAuthn-RP-ID), z. B. auth.luki-net.org: " AUTH_DOMAIN
+  fi
+  [[ -n "${AUTH_DOMAIN:-}" ]] || { msg_err "AUTH_DOMAIN ist Pflicht"; exit 1; }
+  if [[ -z "${CLAUDE_SSH_PUBKEY:-}" ]]; then
+    read -rp "SSH-Public-Key für Agent-Zugang (leer = überspringen): " CLAUDE_SSH_PUBKEY || true
+  fi
+  # Authentik-Version: leer = Default des offiziellen Compose-Files
+  AUTHENTIK_TAG="${AUTHENTIK_TAG:-}"
+  echo "  → domain: $AUTH_DOMAIN   port: $APP_PORT   tag: ${AUTHENTIK_TAG:-compose-default}"
+}
+
+push_app_config() {
+  msg_info "Pushing config into container..."
+  local tmpf; tmpf=$(mktemp)
+  cat >"$tmpf" <<EOF
+AUTH_DOMAIN='$AUTH_DOMAIN'
+APP_PORT='$APP_PORT'
+AUTHENTIK_TAG='$AUTHENTIK_TAG'
+CLAUDE_SSH_PUBKEY='${CLAUDE_SSH_PUBKEY:-}'
+EOF
+  pct push "$CTID" "$tmpf" /root/authentik.deploy.env --perms 600
+  rm -f "$tmpf"
+}
+
+# Docker im unprivilegierten LXC braucht nesting+keyctl — vor dem Bootstrap setzen.
+enable_nesting() {
+  msg_info "Enabling nesting+keyctl features (Docker in unprivileged LXC)..."
+  pct set "$CTID" --features nesting=1,keyctl=1
+  pct reboot "$CTID"
+  # warten bis der Container wieder antwortet
+  for _ in $(seq 1 30); do
+    pct exec "$CTID" -- true >/dev/null 2>&1 && break
+    sleep 2
+  done
+  msg_ok "Container restarted with nesting enabled"
+}
+
+print_app_summary() {
+  cat <<EOF
+  Authentik:            http://$IP_CT:$APP_PORT  (UI nach erstem Start, dauert 1–2 min)
+  Credentials/API-Token: /root/authentik.credentials  (im LXC; akadmin + Bootstrap-Token)
+  Blueprints:           /opt/authentik/blueprints  (gemountet; Agent legt YAMLs ab,
+                        Quelle versioniert in nexus-hub infra/authentik/)
+
+  ⚠️  JETZT MANUELL (dauerhaft — WebAuthn-RP-ID):
+    NPMplus: Proxy Host  $AUTH_DOMAIN  →  http://$IP_CT:$APP_PORT   (WebSockets: ON)
+
+  Danach: Agent (Claude Code) per SSH übernimmt Blueprints/OIDC-Provider;
+  zuletzt Passkey-Enrollment des menschlichen Admin-Accounts über $AUTH_DOMAIN.
+
+  Logs:                 pct exec $CTID -- docker compose -f /opt/authentik/docker-compose.yml logs -f
+EOF
+}
+
+trap _on_error ERR
+preflight_pve
+show_header "$APP" "$APP_DESCRIPTION"
+prompt_lxc_config
+prompt_app_config
+resolve_debian_template
+create_lxc
+enable_nesting
+push_app_config
+bootstrap_install_script "$INSTALL_SCRIPT_URL"
+print_summary

ct/nexus-db.sh

@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+# nexus-db — PostgreSQL 16 (+pgvector) for nexus (Family Knowledge Hub)
+#
+# Creates an unprivileged Debian 12 LXC that:
+#   - runs PostgreSQL 16 from the PGDG repo with the pgvector extension
+#   - hosts database `nexus` owned by a least-privilege role `nexus`
+#   - accepts connections ONLY from the nexus app LXC (pg_hba allowlist);
+#     every other host is rejected
+#
+# Companion card: nexus-hub K-102. Run on a Proxmox VE host:
+#   bash -c "$(curl -fsSL https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/ct/nexus-db.sh)"
+
+set -euo pipefail
+
+APP="nexus-db"
+APP_DESCRIPTION="PostgreSQL 16 + pgvector for nexus (access restricted to the nexus LXC)"
+
+LIB_URL="${LIB_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/lib}"
+INSTALL_SCRIPT_URL="${INSTALL_SCRIPT_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/install/nexus-db-install.sh}"
+
+# LXC defaults (DB only: small CPU, RAM matters for shared_buffers/cache)
+DEFAULT_HOSTNAME="nexus-db"
+DEFAULT_DISK="16"
+DEFAULT_CORES="2"
+DEFAULT_RAM="4096"
+
+DEFAULT_DB_NAME="nexus"
+DEFAULT_DB_USER="nexus"
+DEFAULT_DB_PORT="5432"
+
+source <(curl -fsSL "$LIB_URL/build.func")
+
+# ── app-specific prompts (host TTY; each skipped if the var is preset) ───────
+prompt_app_config() {
+  echo
+  echo "── nexus-db configuration ───────────────────────────────────"
+  # The ONLY host that may connect (pg_hba allowlist) — the nexus app LXC.
+  if [[ -z "${NEXUS_APP_IP:-}" ]]; then
+    read -rp "IP of the nexus app LXC (sole allowed client): " NEXUS_APP_IP
+  fi
+  [[ -n "${NEXUS_APP_IP:-}" ]] || { msg_err "NEXUS_APP_IP is required (pg_hba allowlist)"; exit 1; }
+
+  DB_NAME="${DB_NAME:-$DEFAULT_DB_NAME}"
+  DB_USER="${DB_USER:-$DEFAULT_DB_USER}"
+  DB_PORT="${DB_PORT:-$DEFAULT_DB_PORT}"
+
+  echo "  → database: $DB_NAME   role: $DB_USER   port: $DB_PORT"
+  echo "  → allowed client: $NEXUS_APP_IP/32 (everything else is rejected)"
+}
+
+# ── push gathered config into the container for the installer to consume ─────
+push_app_config() {
+  msg_info "Pushing db config into container..."
+  local tmpf; tmpf=$(mktemp)
+  cat >"$tmpf" <<EOF
+NEXUS_APP_IP='$NEXUS_APP_IP'
+DB_NAME='$DB_NAME'
+DB_USER='$DB_USER'
+DB_PORT='$DB_PORT'
+EOF
+  pct push "$CTID" "$tmpf" /root/nexus-db.deploy.env --perms 600
+  rm -f "$tmpf"
+}
+
+# ── trailing summary ─────────────────────────────────────────────────────────
+print_app_summary() {
+  local pg_state
+  pg_state=$(pct exec "$CTID" -- systemctl is-active postgresql 2>/dev/null | tr -d '\r\n')
+  cat <<EOF
+  PostgreSQL 16:        $IP_CT:$DB_PORT  — $pg_state
+    Database:           $DB_NAME (owner: $DB_USER, extension: vector)
+    Allowed client:     $NEXUS_APP_IP/32 — all other hosts are rejected
+    Credentials + DSN:  /root/nexus-db.credentials (inside the LXC)
+
+  Smoke test FROM THE NEXUS LXC (uses the DSN from the credentials file):
+    psql "postgresql://$DB_USER:<password>@$IP_CT:$DB_PORT/$DB_NAME" -c "SELECT extname FROM pg_extension;"
+
+  Negative test from any OTHER host (must fail):
+    psql "postgresql://$DB_USER:<password>@$IP_CT:$DB_PORT/$DB_NAME" -c "SELECT 1;"
+
+  Logs:                 pct exec $CTID -- journalctl -u postgresql -f
+EOF
+}
+
+# ── orchestrate ───────────────────────────────────────────────────────────────
+trap _on_error ERR
+preflight_pve
+show_header "$APP" "$APP_DESCRIPTION"
+prompt_lxc_config
+prompt_app_config
+resolve_debian_template
+create_lxc
+push_app_config
+bootstrap_install_script "$INSTALL_SCRIPT_URL"
+print_summary

ct/nexus.sh

@@ -0,0 +1,121 @@
+#!/usr/bin/env bash
+# nexus — Family Knowledge Hub deployed via a self-hosted Gitea Actions runner
+#
+# Creates an unprivileged Debian 12 LXC that:
+#   - installs Node.js + a Gitea act_runner in HOST mode (no Docker, no inbound port)
+#   - prepares /opt/nexus/current as the live copy and a (placeholder) nexus.service
+#   - lets the repo's .gitea/workflows/ci.yml and deploy.yml build, test & deploy
+#     on every push (deploy-as-code; the runner polls Gitea outbound)
+#
+# NOTE: The nexus tech stack is not yet decided (nexus-hub Project Brief, open
+# point 2). This template provisions the stable parts: runner, user, dirs,
+# sudoers, service skeleton. The stack-introducing SDD card extends the
+# RUNTIME section of install/nexus-install.sh and replaces the service unit.
+#
+# Run on a Proxmox VE host:
+#   bash -c "$(curl -fsSL https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/ct/nexus.sh)"
+
+set -euo pipefail
+
+APP="nexus"
+APP_DESCRIPTION="nexus (Family Knowledge Hub) deployed via a self-hosted Gitea Actions runner (deploy-as-code)"
+APP_PORT="${APP_PORT:-8080}"
+
+LIB_URL="${LIB_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/lib}"
+INSTALL_SCRIPT_URL="${INSTALL_SCRIPT_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/install/nexus-install.sh}"
+
+# LXC defaults (CI builds + future API/worker need headroom; DBs live elsewhere)
+DEFAULT_HOSTNAME="nexus"
+DEFAULT_DISK="40"
+DEFAULT_CORES="4"
+DEFAULT_RAM="8192"
+
+# App / runner defaults (all overridable via env)
+DEFAULT_GITEA_INSTANCE_URL="https://gitea.luki-net.org"
+DEFAULT_REPO_URL="https://gitea.luki-net.org/l.kirchner/nexus-hub.git"
+DEFAULT_NODE_MAJOR="22"
+DEFAULT_RUNNER_VERSION="0.2.13"
+DEFAULT_RUNNER_LABELS="nexus:host"
+
+source <(curl -fsSL "$LIB_URL/build.func")
+
+# ── app-specific prompts (host TTY; each skipped if the var is preset) ───────
+prompt_app_config() {
+  echo
+  echo "── App / runner configuration ───────────────────────────────"
+  if [[ -z "${GITEA_INSTANCE_URL:-}" ]]; then
+    read -rp "Gitea instance URL [$DEFAULT_GITEA_INSTANCE_URL]: " GITEA_INSTANCE_URL
+    GITEA_INSTANCE_URL="${GITEA_INSTANCE_URL:-$DEFAULT_GITEA_INSTANCE_URL}"
+  fi
+  # Repo → Settings → Actions → Runners → "Create new runner" gives this token.
+  if [[ -z "${RUNNER_TOKEN:-}" ]]; then
+    read -rsp "Gitea runner registration token: " RUNNER_TOKEN; echo
+  fi
+  [[ -n "${RUNNER_TOKEN:-}" ]] || { msg_err "RUNNER_TOKEN is required (Repo → Settings → Actions → Runners)"; exit 1; }
+  if [[ -z "${REPO_URL:-}" ]]; then
+    read -rp "nexus repo URL (informational) [$DEFAULT_REPO_URL]: " REPO_URL
+    REPO_URL="${REPO_URL:-$DEFAULT_REPO_URL}"
+  fi
+
+  NODE_MAJOR="${NODE_MAJOR:-$DEFAULT_NODE_MAJOR}"
+  RUNNER_VERSION="${RUNNER_VERSION:-$DEFAULT_RUNNER_VERSION}"
+  RUNNER_LABELS="${RUNNER_LABELS:-$DEFAULT_RUNNER_LABELS}"
+  RUNNER_NAME="${RUNNER_NAME:-$CT_HOSTNAME}"
+
+  echo "  → instance: $GITEA_INSTANCE_URL"
+  echo "  → runner:   $RUNNER_NAME   labels: $RUNNER_LABELS   (act_runner $RUNNER_VERSION, host mode)"
+  echo "  → node:     $NODE_MAJOR   app port: $APP_PORT"
+}
+
+# ── push gathered config into the container for the installer to consume ─────
+push_app_config() {
+  msg_info "Pushing deploy config into container..."
+  local tmpf; tmpf=$(mktemp)
+  cat >"$tmpf" <<EOF
+GITEA_INSTANCE_URL='$GITEA_INSTANCE_URL'
+RUNNER_TOKEN='$RUNNER_TOKEN'
+RUNNER_NAME='$RUNNER_NAME'
+RUNNER_LABELS='$RUNNER_LABELS'
+RUNNER_VERSION='$RUNNER_VERSION'
+REPO_URL='$REPO_URL'
+APP_PORT='$APP_PORT'
+NODE_MAJOR='$NODE_MAJOR'
+EOF
+  pct push "$CTID" "$tmpf" /root/nexus.deploy.env --perms 600
+  rm -f "$tmpf"
+}
+
+# ── trailing summary ──────────────────────────────────────────────────────────
+print_app_summary() {
+  local runner_state
+  runner_state=$(pct exec "$CTID" -- systemctl is-active nexus-runner.service 2>/dev/null | tr -d '\r\n')
+  cat <<EOF
+  nexus API:            http://$IP_CT:$APP_PORT   (live after the first deploy;
+    service unit is a skeleton until the stack-introducing card lands)
+    → point your existing reverse proxy at this address when ready
+
+  Gitea Actions runner: $RUNNER_NAME  [$RUNNER_LABELS]  — $runner_state
+    Instance:           $GITEA_INSTANCE_URL
+    Mode:               host (no Docker, outbound poll — no inbound port)
+    Verify:             $GITEA_INSTANCE_URL → repo/Settings → Actions → Runners
+
+  Deploy-as-code — already in the nexus-hub repo:
+    .gitea/workflows/ci.yml       (runs-on: ${RUNNER_LABELS%%:*})
+    .gitea/workflows/deploy.yml   (runs-on: ${RUNNER_LABELS%%:*}, manual until stack lands)
+
+  Logs:                 pct exec $CTID -- journalctl -u nexus -u nexus-runner -f
+  Notes file:           /root/nexus.credentials (inside the LXC)
+EOF
+}
+
+# ── orchestrate (custom: inject app config + standard bootstrap) ─────────────
+trap _on_error ERR
+preflight_pve
+show_header "$APP" "$APP_DESCRIPTION"
+prompt_lxc_config
+prompt_app_config
+resolve_debian_template
+create_lxc
+push_app_config
+bootstrap_install_script "$INSTALL_SCRIPT_URL"
+print_summary

ct/runner.sh

@@ -0,0 +1,155 @@
+#!/usr/bin/env bash
+# Allgemeiner Gitea-Actions-Runner — instanzweit, OHNE Deploy-Rechte
+#
+# Motivation (nexus K-114-Blocker): Der nexus-Runner läuft auf dem
+# Produktions-LXC und besitzt sudoers-Deploy-Rechte — er darf deshalb NICHT
+# instanzweit registriert werden (jedes Repo könnte sonst Workflows auf der
+# Produktionsmaschine ausführen). Dieser LXC ist die saubere Trennung:
+#   - instanzweite Registrierung (Site Administration → Actions → Runners)
+#   - Label "homelab:host" (Deploy-Jobs bleiben auf "nexus")
+#   - KEINE sudoers-Regeln, kein Zugriff auf Produktions-Verzeichnisse
+#   - Docker via Nesting für Wegwerf-Test-Container (z. B. pgvector in CI)
+#
+# Sicherheitsmodell: siehe Kopfkommentar in install/runner-install.sh —
+# instanzweit + docker-Gruppe heißt: jedes Repo der Instanz kann diesen LXC
+# kontrollieren. Akzeptiert, WEIL er nichts besitzt. Nicht auf privilegierte
+# LXCs übertragen.
+#
+# Run on a Proxmox VE host:
+#   bash -c "$(curl -fsSL https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/ct/runner.sh)"
+
+set -euo pipefail
+
+APP="runner"
+APP_DESCRIPTION="Allgemeiner Gitea-Actions-Runner (instanzweit, Label homelab, Docker, ohne Deploy-Rechte)"
+
+LIB_URL="${LIB_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/lib}"
+INSTALL_SCRIPT_URL="${INSTALL_SCRIPT_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/install/runner-install.sh}"
+
+source <(curl -fsSL "$LIB_URL/build.func")
+
+DEFAULT_HOSTNAME="runner"
+DEFAULT_DISK="30"
+DEFAULT_CORES="4"
+DEFAULT_RAM="6144"
+
+# ── Validierung (Review-Finding 80): Werte wandern in die Deploy-Env und in
+#    systemd/argv — strikte Zeichenklassen, Re-Prompt statt Abbruch.
+#    Bewusst LOKALE Validatoren: die Libs werden zur Laufzeit von main geladen,
+#    dieses Script muss aber unabhängig vom Merge-Stand der K-114-Helfer
+#    (prompt_validated/require_valid) funktionieren. Semantik ist identisch;
+#    Konsolidierung auf die build.func-Helfer ist als Follow-up notiert. ──────
+_valid_url()   { [[ "$1" =~ ^https?://[A-Za-z0-9.-]+(:[0-9]{1,5})?$ ]]; }
+_valid_token() { [[ "$1" =~ ^[A-Za-z0-9_-]{16,128}$ ]]; }
+_valid_word()  { [[ "$1" =~ ^[A-Za-z0-9._:,-]+$ ]]; }
+
+_prompt_until_valid() { # var prompt default validator secret(0|1)
+  local __var="$1" __prompt="$2" __default="$3" __validator="$4" __secret="${5:-0}" __val
+  while true; do
+    if [[ "$__secret" == "1" ]]; then
+      read -rsp "$__prompt" __val || { echo; msg_err "Eingabe abgebrochen (EOF)"; exit 1; }
+      echo
+    else
+      read -rp "$__prompt" __val || { echo; msg_err "Eingabe abgebrochen (EOF)"; exit 1; }
+    fi
+    __val="${__val:-$__default}"
+    if [[ -n "$__val" ]] && "$__validator" "$__val"; then
+      printf -v "$__var" '%s' "$__val"
+      return 0
+    fi
+    msg_warn "Ungültige Eingabe — bitte erneut (kein Paste mit Sonderzeichen)."
+  done
+}
+
+prompt_app_config() {
+  echo
+  echo "── Runner configuration ─────────────────────────────────────"
+  # env-präsetzte Werte werden validiert (Abbruch bei ungültig — K-114-Konvention),
+  # interaktive Eingaben re-prompten bis gültig.
+  if [[ -n "${GITEA_INSTANCE_URL:-}" ]]; then
+    _valid_url "$GITEA_INSTANCE_URL" || { msg_err "GITEA_INSTANCE_URL (env) ungültig"; exit 1; }
+  else
+    _prompt_until_valid GITEA_INSTANCE_URL \
+      "Gitea instance URL [https://gitea.luki-net.org]: " \
+      "https://gitea.luki-net.org" _valid_url 0
+  fi
+  # WICHTIG: den INSTANZWEITEN Token verwenden
+  # (Site Administration → Actions → Runners → Create new runner),
+  # NICHT den Repo-Token — sonst wiederholt sich der K-114-Scope-Blocker.
+  if [[ -n "${RUNNER_TOKEN:-}" ]]; then
+    _valid_token "$RUNNER_TOKEN" || { msg_err "RUNNER_TOKEN (env) ungültig (16–128 Zeichen [A-Za-z0-9_-])"; exit 1; }
+  else
+    _prompt_until_valid RUNNER_TOKEN \
+      "INSTANZWEITER Runner-Registration-Token: " \
+      "" _valid_token 1
+  fi
+  RUNNER_NAME="${RUNNER_NAME:-$CT_HOSTNAME}"
+  RUNNER_LABELS="${RUNNER_LABELS:-homelab:host}"
+  RUNNER_VERSION="${RUNNER_VERSION:-0.2.13}"
+  NODE_MAJOR="${NODE_MAJOR:-22}"
+  _valid_word "$RUNNER_NAME"   || { msg_err "RUNNER_NAME ungültig"; exit 1; }
+  _valid_word "$RUNNER_LABELS" || { msg_err "RUNNER_LABELS ungültig"; exit 1; }
+  [[ "$RUNNER_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || { msg_err "RUNNER_VERSION ungültig"; exit 1; }
+  [[ "$NODE_MAJOR" =~ ^[0-9]+$ ]] || { msg_err "NODE_MAJOR ungültig"; exit 1; }
+  echo "  → instance: $GITEA_INSTANCE_URL"
+  echo "  → runner:   $RUNNER_NAME   labels: $RUNNER_LABELS   (act_runner $RUNNER_VERSION, host mode, scope: INSTANZ)"
+}
+
+push_app_config() {
+  msg_info "Pushing runner config into container..."
+  local tmpf; tmpf=$(mktemp)
+  # Werte sind oben strikt validiert (keine Quotes/Whitespace möglich) —
+  # damit ist die env-Datei frei von Quoting-/Injection-Fallen (vgl. Finding 76).
+  cat >"$tmpf" <<EOF
+GITEA_INSTANCE_URL=$GITEA_INSTANCE_URL
+RUNNER_TOKEN=$RUNNER_TOKEN
+RUNNER_NAME=$RUNNER_NAME
+RUNNER_LABELS=$RUNNER_LABELS
+RUNNER_VERSION=$RUNNER_VERSION
+NODE_MAJOR=$NODE_MAJOR
+EOF
+  pct push "$CTID" "$tmpf" /root/runner.deploy.env --perms 600
+  rm -f "$tmpf"
+}
+
+# Docker im unprivilegierten LXC braucht nesting+keyctl (Test-Container in CI).
+enable_nesting() {
+  msg_info "Enabling nesting+keyctl features (Docker für CI-Test-Container)..."
+  pct set "$CTID" --features nesting=1,keyctl=1
+  pct reboot "$CTID"
+  for _ in $(seq 1 30); do
+    pct exec "$CTID" -- true >/dev/null 2>&1 && break
+    sleep 2
+  done
+  msg_ok "Container restarted with nesting enabled"
+}
+
+print_app_summary() {
+  local runner_state
+  runner_state=$(pct exec "$CTID" -- systemctl is-active act-runner.service 2>/dev/null | tr -d '\r\n')
+  cat <<EOF
+  Gitea-Actions-Runner: $RUNNER_NAME  [$RUNNER_LABELS]  — $runner_state
+    Scope:              INSTANZWEIT — bedient alle Repos der Instanz
+    Mode:               host (Docker verfügbar für Test-Container)
+    Sicherheit:         kein sudoers, keine Deploy-Rechte, keine Produktions-Mounts
+                        (Modell: siehe install/runner-install.sh Kopfkommentar)
+    Verify:             $GITEA_INSTANCE_URL → Site Administration → Actions → Runners
+
+  Workflows anderer Repos nutzen:  runs-on: ${RUNNER_LABELS%%:*}
+  (Deploy-Jobs von nexus bleiben auf dem nexus-LXC-Runner, Label "nexus".)
+
+  Logs:                 pct exec $CTID -- journalctl -u act-runner -f
+EOF
+}
+
+trap _on_error ERR
+preflight_pve
+show_header "$APP" "$APP_DESCRIPTION"
+prompt_lxc_config
+prompt_app_config
+resolve_debian_template
+create_lxc
+enable_nesting
+push_app_config
+bootstrap_install_script "$INSTALL_SCRIPT_URL"
+print_summary

ct/webapp.sh

@@ -0,0 +1,143 @@
+#!/usr/bin/env bash
+# webapp — Next.js site deployed via a self-hosted Gitea Actions runner
+#
+# Creates an unprivileged Debian 12 LXC that:
+#   - installs Node.js + a Gitea act_runner in HOST mode (no Docker, no inbound port)
+#   - serves the built site with `next start` on :APP_PORT (behind your proxy)
+#   - lets the repo's .gitea/workflows/deploy.yml build & deploy on every push
+#     (deploy-as-code; the runner polls Gitea outbound, so nothing is exposed)
+#
+# Run on a Proxmox VE host:
+#   bash -c "$(curl -fsSL https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/ct/webapp.sh)"
+
+set -euo pipefail
+
+APP="webapp"
+APP_DESCRIPTION="Next.js site deployed via a self-hosted Gitea Actions runner (deploy-as-code)"
+APP_PORT="${APP_PORT:-3000}"
+
+LIB_URL="${LIB_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/lib}"
+INSTALL_SCRIPT_URL="${INSTALL_SCRIPT_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/install/webapp-install.sh}"
+
+# LXC defaults (Next build is memory-hungry; runner workspace + live copy need disk)
+DEFAULT_HOSTNAME="web"
+DEFAULT_DISK="30"
+DEFAULT_CORES="2"
+DEFAULT_RAM="4096"
+
+# App / runner defaults (all overridable via env)
+DEFAULT_GITEA_INSTANCE_URL="https://gitea.luki-net.org"
+DEFAULT_REPO_URL="https://gitea.luki-net.org/l.kirchner/Redesign-ad2b.git"
+DEFAULT_SITE_URL="https://sichere-wirtschaft.de"
+DEFAULT_SANITY_DATASET="production"
+DEFAULT_SANITY_API_VERSION="2026-06-02"
+DEFAULT_NODE_MAJOR="22"
+DEFAULT_RUNNER_VERSION="0.2.13"
+DEFAULT_RUNNER_LABELS="webapp:host"
+
+source <(curl -fsSL "$LIB_URL/build.func")
+
+# ── app-specific prompts (host TTY; each skipped if the var is preset) ───────
+prompt_app_config() {
+  echo
+  echo "── App / runner configuration ───────────────────────────────"
+  if [[ -z "${GITEA_INSTANCE_URL:-}" ]]; then
+    read -rp "Gitea instance URL [$DEFAULT_GITEA_INSTANCE_URL]: " GITEA_INSTANCE_URL
+    GITEA_INSTANCE_URL="${GITEA_INSTANCE_URL:-$DEFAULT_GITEA_INSTANCE_URL}"
+  fi
+  # Repo → Settings → Actions → Runners → "Create new runner" gives this token.
+  if [[ -z "${RUNNER_TOKEN:-}" ]]; then
+    read -rsp "Gitea runner registration token: " RUNNER_TOKEN; echo
+  fi
+  [[ -n "${RUNNER_TOKEN:-}" ]] || { msg_err "RUNNER_TOKEN is required (Repo → Settings → Actions → Runners)"; exit 1; }
+  if [[ -z "${REPO_URL:-}" ]]; then
+    read -rp "Website repo URL (informational) [$DEFAULT_REPO_URL]: " REPO_URL
+    REPO_URL="${REPO_URL:-$DEFAULT_REPO_URL}"
+  fi
+
+  if [[ -z "${NEXT_PUBLIC_SITE_URL:-}" ]]; then
+    read -rp "Public site URL [$DEFAULT_SITE_URL]: " NEXT_PUBLIC_SITE_URL
+    NEXT_PUBLIC_SITE_URL="${NEXT_PUBLIC_SITE_URL:-$DEFAULT_SITE_URL}"
+  fi
+  if [[ -z "${NEXT_PUBLIC_SANITY_PROJECT_ID:-}" ]]; then
+    read -rp "Sanity project ID: " NEXT_PUBLIC_SANITY_PROJECT_ID
+  fi
+  if [[ -z "${NEXT_PUBLIC_SANITY_DATASET:-}" ]]; then
+    read -rp "Sanity dataset [$DEFAULT_SANITY_DATASET]: " NEXT_PUBLIC_SANITY_DATASET
+    NEXT_PUBLIC_SANITY_DATASET="${NEXT_PUBLIC_SANITY_DATASET:-$DEFAULT_SANITY_DATASET}"
+  fi
+  if [[ -z "${NEXT_PUBLIC_SANITY_API_VERSION:-}" ]]; then
+    read -rp "Sanity API version [$DEFAULT_SANITY_API_VERSION]: " NEXT_PUBLIC_SANITY_API_VERSION
+    NEXT_PUBLIC_SANITY_API_VERSION="${NEXT_PUBLIC_SANITY_API_VERSION:-$DEFAULT_SANITY_API_VERSION}"
+  fi
+  if [[ -z "${NEXT_PUBLIC_CALENDLY_URL+x}" ]]; then
+    read -rp "Calendly URL (optional, empty for none): " NEXT_PUBLIC_CALENDLY_URL
+  fi
+
+  NODE_MAJOR="${NODE_MAJOR:-$DEFAULT_NODE_MAJOR}"
+  RUNNER_VERSION="${RUNNER_VERSION:-$DEFAULT_RUNNER_VERSION}"
+  RUNNER_LABELS="${RUNNER_LABELS:-$DEFAULT_RUNNER_LABELS}"
+  RUNNER_NAME="${RUNNER_NAME:-$CT_HOSTNAME}"
+
+  echo "  → instance: $GITEA_INSTANCE_URL"
+  echo "  → runner:   $RUNNER_NAME   labels: $RUNNER_LABELS   (act_runner $RUNNER_VERSION, host mode)"
+  echo "  → node:     $NODE_MAJOR   app port: $APP_PORT"
+}
+
+# ── push gathered config into the container for the installer to consume ─────
+push_app_config() {
+  msg_info "Pushing deploy config into container..."
+  local tmpf; tmpf=$(mktemp)
+  cat >"$tmpf" <<EOF
+GITEA_INSTANCE_URL='$GITEA_INSTANCE_URL'
+RUNNER_TOKEN='$RUNNER_TOKEN'
+RUNNER_NAME='$RUNNER_NAME'
+RUNNER_LABELS='$RUNNER_LABELS'
+RUNNER_VERSION='$RUNNER_VERSION'
+REPO_URL='$REPO_URL'
+APP_PORT='$APP_PORT'
+NODE_MAJOR='$NODE_MAJOR'
+NEXT_PUBLIC_SITE_URL='$NEXT_PUBLIC_SITE_URL'
+NEXT_PUBLIC_SANITY_PROJECT_ID='${NEXT_PUBLIC_SANITY_PROJECT_ID:-}'
+NEXT_PUBLIC_SANITY_DATASET='$NEXT_PUBLIC_SANITY_DATASET'
+NEXT_PUBLIC_SANITY_API_VERSION='$NEXT_PUBLIC_SANITY_API_VERSION'
+NEXT_PUBLIC_CALENDLY_URL='${NEXT_PUBLIC_CALENDLY_URL:-}'
+EOF
+  pct push "$CTID" "$tmpf" /root/webapp.deploy.env --perms 600
+  rm -f "$tmpf"
+}
+
+# ── trailing summary ─────────────────────────────────────────────────────────
+print_app_summary() {
+  local runner_state
+  runner_state=$(pct exec "$CTID" -- systemctl is-active webapp-runner.service 2>/dev/null | tr -d '\r\n')
+  cat <<EOF
+  Site (Next.js):       http://$IP_CT:$APP_PORT   (live after the first deploy)
+    → point your existing reverse proxy at this address
+
+  Gitea Actions runner: $RUNNER_NAME  [$RUNNER_LABELS]  — $runner_state
+    Instance:           $GITEA_INSTANCE_URL
+    Mode:               host (no Docker, outbound poll — no inbound port)
+    Verify:             $GITEA_INSTANCE_URL → repo/Settings → Actions → Runners
+
+  Deploy-as-code — commit this to the website repo:
+    .gitea/workflows/deploy.yml   (runs-on: ${RUNNER_LABELS%%:*})
+
+  First deploy:         push to the repo, or run the workflow manually
+                        (repo → Actions → deploy → "Run workflow")
+  Logs:                 pct exec $CTID -- journalctl -u webapp -u webapp-runner -f
+  Notes file:           /root/webapp.credentials (inside the LXC)
+EOF
+}
+
+# ── orchestrate (custom: inject app config + standard bootstrap) ─────────────
+trap _on_error ERR
+preflight_pve
+show_header "$APP" "$APP_DESCRIPTION"
+prompt_lxc_config
+prompt_app_config
+resolve_debian_template
+create_lxc
+push_app_config
+bootstrap_install_script "$INSTALL_SCRIPT_URL"
+print_summary

install/authentik-install.sh

@@ -0,0 +1,139 @@
+#!/usr/bin/env bash
+# Authentik installer — runs inside the LXC, called by ct/authentik.sh
+#
+# Installs Docker + the official Authentik docker-compose stack, headless:
+#   - secrets generated on-host (PG_PASS, AUTHENTIK_SECRET_KEY) — never printed
+#   - bootstrap admin (akadmin) password + API token generated so that an
+#     agent can configure everything via API/blueprints without the UI
+#   - blueprints dir mounted via docker-compose.override.yml
+#   - optional dedicated SSH key for agent access appended to authorized_keys
+#
+# Idempotent: re-running keeps existing secrets/.env and only updates images.
+
+set -euo pipefail
+
+LIB_URL="${LIB_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/lib}"
+source <(curl -fsSL "$LIB_URL/install.func")
+
+[[ "$EUID" -eq 0 ]] || { msg_err "Must run as root"; exit 1; }
+
+CONF="/root/authentik.deploy.env"
+[[ -f "$CONF" ]] || { msg_err "$CONF not found (host bootstrap incomplete)"; exit 1; }
+set -a; . "$CONF"; set +a
+: "${AUTH_DOMAIN:?missing AUTH_DOMAIN}"
+APP_PORT="${APP_PORT:-9000}"
+
+AK_DIR="/opt/authentik"
+ENV_FILE="$AK_DIR/.env"
+CRED_FILE="/root/authentik.credentials"
+
+# ── base packages + Docker ────────────────────────────────────────────────────
+setup_base_apt ca-certificates curl
+if ! command -v docker >/dev/null 2>&1; then
+  msg_info "Installing Docker (get.docker.com)..."
+  curl -fsSL https://get.docker.com | sh >/dev/null
+  msg_ok "Docker $(docker --version | awk '{print $3}' | tr -d ',')"
+else
+  msg_warn "Docker already present, skipping"
+fi
+
+# ── optional: dedicated agent SSH key ────────────────────────────────────────
+if [[ -n "${CLAUDE_SSH_PUBKEY:-}" ]]; then
+  mkdir -p /root/.ssh && chmod 700 /root/.ssh
+  touch /root/.ssh/authorized_keys && chmod 600 /root/.ssh/authorized_keys
+  if ! grep -qF "$CLAUDE_SSH_PUBKEY" /root/.ssh/authorized_keys; then
+    echo "$CLAUDE_SSH_PUBKEY" >> /root/.ssh/authorized_keys
+    msg_ok "Agent SSH key installed"
+  else
+    msg_warn "Agent SSH key already present"
+  fi
+fi
+
+# ── compose stack ─────────────────────────────────────────────────────────────
+mkdir -p "$AK_DIR/blueprints" "$AK_DIR/media" "$AK_DIR/custom-templates" "$AK_DIR/certs"
+cd "$AK_DIR"
+
+if [[ ! -f docker-compose.yml ]]; then
+  msg_info "Fetching official Authentik compose file..."
+  curl -fsSL -o docker-compose.yml https://goauthentik.io/docker-compose.yml
+  msg_ok "docker-compose.yml fetched"
+else
+  msg_warn "docker-compose.yml exists, keeping (idempotent)"
+fi
+
+# Override: Blueprints in server+worker mounten, Port-Bind nur auf LXC-Netz nötig?
+# Authentik bleibt im LAN hinter NPMplus — Standard-Bind reicht; Blueprints-Mount ergänzen.
+if [[ ! -f docker-compose.override.yml ]]; then
+  cat > docker-compose.override.yml <<EOF
+services:
+  server:
+    volumes:
+      - ./blueprints:/blueprints/custom:ro
+  worker:
+    volumes:
+      - ./blueprints:/blueprints/custom:ro
+EOF
+  msg_ok "compose override (custom blueprints mount) written"
+fi
+
+# ── secrets / env (idempotent: vorhandene .env bleibt) ────────────────────────
+if [[ ! -f "$ENV_FILE" ]]; then
+  msg_info "Generating secrets (.env)..."
+  PG_PASS="$(openssl rand -base64 36 | tr -d '\n=/+' | cut -c1-32)"
+  AK_SECRET="$(openssl rand -base64 60 | tr -d '\n')"
+  AK_BOOT_PW="$(openssl rand -base64 24 | tr -d '\n=/+' | cut -c1-20)"
+  AK_BOOT_TOKEN="$(openssl rand -hex 32)"
+  cat >"$ENV_FILE" <<EOF
+PG_PASS=$PG_PASS
+AUTHENTIK_SECRET_KEY=$AK_SECRET
+AUTHENTIK_BOOTSTRAP_PASSWORD=$AK_BOOT_PW
+AUTHENTIK_BOOTSTRAP_TOKEN=$AK_BOOT_TOKEN
+AUTHENTIK_BOOTSTRAP_EMAIL=admin@$AUTH_DOMAIN
+COMPOSE_PORT_HTTP=$APP_PORT
+${AUTHENTIK_TAG:+AUTHENTIK_TAG=$AUTHENTIK_TAG}
+# E-Mail-Versand bewusst unkonfiguriert (Familien-Setup; bei Bedarf nachziehen):
+# AUTHENTIK_EMAIL__HOST=...
+EOF
+  chmod 600 "$ENV_FILE"
+
+  cat >"$CRED_FILE" <<EOF
+Authentik — zentraler Homelab-IdP (nexus ADR-0003)
+
+URL (LAN):        http://$(hostname -I | awk '{print $1}'):$APP_PORT
+URL (final):      https://$AUTH_DOMAIN   (nach NPMplus-Eintrag; Domain ist DAUERHAFT)
+
+Bootstrap-Admin:  akadmin
+Passwort:         $AK_BOOT_PW
+API-Token:        $AK_BOOT_TOKEN
+  -> für Agent-Automation (Blueprints/OIDC via API). Nach Abschluss der
+     Einrichtung rotieren oder widerrufen; menschlicher Admin nutzt eigenen
+     Account mit Passkey, NICHT akadmin.
+
+Blueprints:       $AK_DIR/blueprints  (Quelle: nexus-hub infra/authentik/)
+Stack:            cd $AK_DIR && docker compose ps|logs|pull
+EOF
+  chmod 600 "$CRED_FILE"
+  msg_ok "Secrets + credentials written ($CRED_FILE)"
+else
+  msg_warn ".env exists — keeping existing secrets (idempotent)"
+fi
+
+# ── start ─────────────────────────────────────────────────────────────────────
+msg_info "Pulling images & starting Authentik (first start takes 1–2 min)..."
+docker compose pull -q
+docker compose up -d
+
+# Warten bis der Server antwortet (Healthcheck)
+for _ in $(seq 1 60); do
+  if curl -fsS "http://127.0.0.1:$APP_PORT/-/health/live/" >/dev/null 2>&1; then
+    msg_ok "Authentik is up (http://127.0.0.1:$APP_PORT)"
+    break
+  fi
+  sleep 5
+done
+curl -fsS "http://127.0.0.1:$APP_PORT/-/health/live/" >/dev/null 2>&1 || \
+  msg_warn "Authentik antwortet noch nicht — 'docker compose logs -f' prüfen (Migrationslauf kann dauern)"
+
+shred -u "$CONF" 2>/dev/null || rm -f "$CONF"
+apt_cleanup
+msg_ok "authentik installation finished"

install/nexus-db-install.sh

@@ -0,0 +1,154 @@
+#!/usr/bin/env bash
+# nexus-db installer — runs inside the LXC, called by ct/nexus-db.sh
+#
+# PostgreSQL 16 from the PGDG repo, pgvector extension, database `nexus`
+# with a least-privilege role, network access restricted to the nexus app
+# LXC via pg_hba. Idempotent: safe to re-run (existing role/db/extension
+# are kept, the password is NOT rotated on re-run).
+
+set -euo pipefail
+
+APP="nexus-db"
+LIB_URL="${LIB_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/lib}"
+source <(curl -fsSL "$LIB_URL/install.func")
+
+[[ "$EUID" -eq 0 ]] || { msg_err "Must run as root"; exit 1; }
+
+# ── load config pushed in by the host script ─────────────────────────────────
+CONF="/root/nexus-db.deploy.env"
+[[ -f "$CONF" ]] || { msg_err "$CONF not found (host bootstrap incomplete)"; exit 1; }
+set -a; . "$CONF"; set +a
+
+: "${NEXUS_APP_IP:?missing NEXUS_APP_IP}"
+DB_NAME="${DB_NAME:-nexus}"
+DB_USER="${DB_USER:-nexus}"
+DB_PORT="${DB_PORT:-5432}"
+
+# Values land verbatim in SQL and pg_hba.conf — accept only safe shapes.
+[[ "$DB_NAME" =~ ^[a-z_][a-z0-9_]*$ ]] || { msg_err "DB_NAME must be a plain lowercase identifier: $DB_NAME"; exit 1; }
+[[ "$DB_USER" =~ ^[a-z_][a-z0-9_]*$ ]] || { msg_err "DB_USER must be a plain lowercase identifier: $DB_USER"; exit 1; }
+[[ "$DB_PORT" =~ ^[0-9]{2,5}$ ]] || { msg_err "DB_PORT must be numeric: $DB_PORT"; exit 1; }
+[[ "$NEXUS_APP_IP" =~ ^[0-9]{1,3}(\.[0-9]{1,3}){3}$ || "$NEXUS_APP_IP" =~ ^[0-9a-fA-F:]+$ ]] \
+  || { msg_err "NEXUS_APP_IP must be a single host IP: $NEXUS_APP_IP"; exit 1; }
+
+PG_MAJOR=16
+CRED_FILE="/root/nexus-db.credentials"
+
+# ── packages: PGDG repo + PostgreSQL 16 + pgvector ────────────────────────────
+setup_base_apt curl ca-certificates gnupg lsb-release
+
+if [[ ! -f /etc/apt/sources.list.d/pgdg.sources ]] && [[ ! -f /etc/apt/sources.list.d/pgdg.list ]]; then
+  msg_info "Adding PGDG apt repo..."
+  apt-get install -y -qq postgresql-common >/dev/null
+  /usr/share/postgresql-common/pgdg/apt.postgresql.org.sh -y >/dev/null
+  msg_ok "PGDG repo added"
+else
+  msg_warn "PGDG repo already present, skipping"
+fi
+
+msg_info "Installing PostgreSQL $PG_MAJOR + pgvector..."
+apt-get install -y -qq "postgresql-$PG_MAJOR" "postgresql-$PG_MAJOR-pgvector" >/dev/null
+msg_ok "PostgreSQL $(psql --version | awk '{print $3}') installed"
+
+PG_CONF_DIR="/etc/postgresql/$PG_MAJOR/main"
+PG_CONF="$PG_CONF_DIR/postgresql.conf"
+PG_HBA="$PG_CONF_DIR/pg_hba.conf"
+
+# ── network exposure: listen on all interfaces, gate via pg_hba ───────────────
+if ! grep -q "^listen_addresses = '\*'" "$PG_CONF"; then
+  msg_info "Configuring listen_addresses + port $DB_PORT..."
+  sed -i "s/^#\?listen_addresses\s*=.*/listen_addresses = '*'/" "$PG_CONF"
+  sed -i "s/^#\?port\s*=.*/port = $DB_PORT/" "$PG_CONF"
+  msg_ok "postgresql.conf updated"
+else
+  msg_warn "listen_addresses already configured, skipping"
+fi
+
+# ── pg_hba: ONLY the nexus LXC may connect over the network ──────────────────
+# Strategy: replace the default file with an explicit allowlist. Local
+# UNIX-socket access stays peer-authenticated for the postgres superuser
+# (maintenance), the nexus role may connect from exactly one IP, everyone
+# else hits the final reject rule (defense-in-depth on top of "no other
+# rule matches").
+HBA_MARKER="# managed by nexus-db-install.sh"
+if ! grep -q "$HBA_MARKER" "$PG_HBA"; then
+  msg_info "Writing restrictive pg_hba.conf..."
+  cp -a "$PG_HBA" "$PG_HBA.dist"
+  cat >"$PG_HBA" <<EOF
+$HBA_MARKER — change via card, not by hand (nexus-hub K-102)
+# TYPE  DATABASE  USER      ADDRESS             METHOD
+local   all       postgres                      peer
+local   all       all                           peer
+host    $DB_NAME  $DB_USER  $NEXUS_APP_IP/32    scram-sha-256
+host    all       all       0.0.0.0/0           reject
+host    all       all       ::/0                reject
+EOF
+  msg_ok "pg_hba.conf restricted to $NEXUS_APP_IP/32"
+else
+  msg_warn "pg_hba.conf already managed, skipping"
+fi
+
+systemctl enable postgresql >/dev/null 2>&1
+systemctl restart postgresql
+
+# ── role + database + extension (idempotent, password kept on re-run) ─────────
+run_psql() { runuser -u postgres -- psql -v ON_ERROR_STOP=1 -qAt "$@"; }
+
+if [[ "$(run_psql -c "SELECT 1 FROM pg_roles WHERE rolname='$DB_USER'")" != "1" ]]; then
+  msg_info "Creating role $DB_USER + database $DB_NAME..."
+  DB_PASS="$(openssl rand -base64 32 | tr -d '/+=' | head -c 32)"
+  run_psql -c "CREATE ROLE $DB_USER LOGIN PASSWORD '$DB_PASS' NOSUPERUSER NOCREATEDB NOCREATEROLE"
+  msg_ok "Role $DB_USER created (least privilege)"
+elif [[ ! -f "$CRED_FILE" ]]; then
+  # Recovery: role exists but the generated password was never persisted
+  # (first run died between CREATE ROLE and credentials write). Rotate so
+  # the credentials file is authoritative again.
+  msg_warn "Role $DB_USER exists but $CRED_FILE is missing — rotating password"
+  DB_PASS="$(openssl rand -base64 32 | tr -d '/+=' | head -c 32)"
+  run_psql -c "ALTER ROLE $DB_USER PASSWORD '$DB_PASS'"
+  msg_ok "Password rotated"
+else
+  DB_PASS=""
+  msg_warn "Role $DB_USER already exists, password unchanged"
+fi
+
+if [[ "$(run_psql -c "SELECT 1 FROM pg_database WHERE datname='$DB_NAME'")" != "1" ]]; then
+  run_psql -c "CREATE DATABASE $DB_NAME OWNER $DB_USER"
+  # Only the owner may connect — no PUBLIC access.
+  run_psql -c "REVOKE CONNECT ON DATABASE $DB_NAME FROM PUBLIC"
+  msg_ok "Database $DB_NAME created (owner $DB_USER, PUBLIC revoked)"
+else
+  msg_warn "Database $DB_NAME already exists, skipping"
+fi
+
+# pgvector: CREATE EXTENSION needs superuser; installed now (per ADR-0002:
+# "Extension ab Tag 1 installiert, ungenutzt bis Phase 2").
+run_psql -d "$DB_NAME" -c "CREATE EXTENSION IF NOT EXISTS vector" >/dev/null
+msg_ok "Extension vector available in $DB_NAME"
+
+# ── credentials / DSN summary ─────────────────────────────────────────────────
+IP_SELF="$(hostname -I | awk '{print $1}')"
+if [[ -n "$DB_PASS" ]]; then
+  cat >"$CRED_FILE" <<EOF
+nexus-db — PostgreSQL $PG_MAJOR for nexus (Family Knowledge Hub)
+
+Host:     $IP_SELF:$DB_PORT
+Database: $DB_NAME
+Role:     $DB_USER (NOSUPERUSER NOCREATEDB NOCREATEROLE, sole owner)
+Password: $DB_PASS
+
+DSN for /etc/nexus/env on the nexus LXC (NEXUS_DATABASE_URL):
+  postgresql+psycopg://$DB_USER:$DB_PASS@$IP_SELF:$DB_PORT/$DB_NAME
+
+Access policy (pg_hba): only $NEXUS_APP_IP/32 may connect; all other
+hosts are rejected. Local socket stays peer-auth for maintenance:
+  pct exec <CTID> -- runuser -u postgres -- psql -d $DB_NAME
+EOF
+  chmod 600 "$CRED_FILE"
+  msg_ok "Credentials written to $CRED_FILE (chmod 600)"
+else
+  msg_warn "Re-run detected: $CRED_FILE untouched (password not rotated)"
+fi
+
+apt_cleanup
+msg_ok "$APP installation finished"

install/nexus-install.sh

@@ -0,0 +1,209 @@
+#!/usr/bin/env bash
+# nexus installer — runs inside the LXC, called by ct/nexus.sh
+#
+# Sets up the deploy target for nexus (Family Knowledge Hub):
+#   - Node.js (NodeSource) + git + rsync + sudo  (Node also needed by checkout action in host mode)
+#   - act_runner in HOST mode (no Docker), registered to the Gitea instance,
+#     running as the unprivileged `nexus` user and polling Gitea outbound
+#   - a SKELETON systemd service (nexus.service) — the stack-introducing SDD
+#     card in nexus-hub provides /opt/nexus/current/start.sh and may extend
+#     the RUNTIME section below (DB clients, Python/uv, etc.)
+#   - a narrow sudoers rule so the runner may only restart that one service
+#
+# The actual build/test/deploy logic lives in the nexus-hub repo workflows
+# (.gitea/workflows/ci.yml + deploy.yml) — deploy-as-code.
+
+set -euo pipefail
+
+APP="nexus"
+LIB_URL="${LIB_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/lib}"
+source <(curl -fsSL "$LIB_URL/install.func")
+
+[[ "$EUID" -eq 0 ]] || { msg_err "Must run as root"; exit 1; }
+
+# ── load deploy config pushed in by the host script ──────────────────────────
+CONF="/root/nexus.deploy.env"
+[[ -f "$CONF" ]] || { msg_err "$CONF not found (host bootstrap incomplete)"; exit 1; }
+set -a; . "$CONF"; set +a
+
+: "${GITEA_INSTANCE_URL:?missing GITEA_INSTANCE_URL}"
+: "${RUNNER_TOKEN:?missing RUNNER_TOKEN}"
+APP_PORT="${APP_PORT:-8080}"
+NODE_MAJOR="${NODE_MAJOR:-22}"
+RUNNER_VERSION="${RUNNER_VERSION:-0.2.13}"
+RUNNER_LABELS="${RUNNER_LABELS:-nexus:host}"
+RUNNER_NAME="${RUNNER_NAME:-$(hostname)}"
+
+APP_USER="nexus"
+APP_HOME="/opt/nexus"
+RUNNER_DIR="$APP_HOME/runner"
+CURRENT_DIR="$APP_HOME/current"
+DATA_DIR="$APP_HOME/data"
+CONF_DIR="/etc/nexus"
+ENV_FILE="$CONF_DIR/env"
+
+run_user() { runuser -u "$APP_USER" -- env HOME="$APP_HOME" "$@"; }
+
+# ── packages: git + rsync + sudo ; Node.js via NodeSource ─────────────────────
+setup_base_apt git rsync sudo
+
+NODE_HAVE="$(command -v node >/dev/null 2>&1 && node -v | sed -E 's/^v([0-9]+).*/\1/' || echo 0)"
+if [[ "$NODE_HAVE" != "$NODE_MAJOR" ]]; then
+  msg_info "Installing Node.js ${NODE_MAJOR}.x (NodeSource)..."
+  curl -fsSL "https://deb.nodesource.com/setup_${NODE_MAJOR}.x" | bash - >/dev/null
+  apt-get install -y -qq nodejs >/dev/null
+  msg_ok "Node $(node -v) installed"
+else
+  msg_warn "Node $(node -v) already present, skipping"
+fi
+
+# ── RUNTIME ───────────────────────────────────────────────────────────────────
+# Stack decided (nexus-hub ADR-0002, card K-101): Python 3.12 via uv, tesseract
+# deu+eng, nexus-worker.service + sudoers extension. Provisioned by
+# install/nexus-runtime.sh, invoked at the END of this script (it extends the
+# sudoers rule and systemd units written below, so order matters). Commands are
+# documented in nexus-hub docs/05_AGENT_RULES.md → Projekt-Kommandos.
+
+# ── act_runner binary ─────────────────────────────────────────────────────────
+if [[ ! -x /usr/local/bin/act_runner ]]; then
+  ARCH="$(dpkg --print-architecture)"
+  case "$ARCH" in amd64|arm64) ;; *) msg_err "unsupported arch: $ARCH"; exit 1 ;; esac
+  msg_info "Downloading act_runner $RUNNER_VERSION ($ARCH)..."
+  curl -fsSL "https://dl.gitea.com/act_runner/${RUNNER_VERSION}/act_runner-${RUNNER_VERSION}-linux-${ARCH}" \
+    -o /usr/local/bin/act_runner
+  chmod +x /usr/local/bin/act_runner
+  msg_ok "act_runner $(/usr/local/bin/act_runner --version 2>/dev/null | head -n1)"
+else
+  msg_warn "act_runner already present, skipping download"
+fi
+
+# ── user + dirs ───────────────────────────────────────────────────────────────
+create_system_user "$APP_USER" "$APP_HOME"
+mkdir -p "$RUNNER_DIR" "$CURRENT_DIR" "$DATA_DIR" "$CONF_DIR"
+chown -R "$APP_USER:$APP_USER" "$APP_HOME"
+
+# ── env file (runtime config; populated further by the stack card) ────────────
+cat >"$ENV_FILE" <<EOF
+NEXUS_ENV=production
+NEXUS_PORT=$APP_PORT
+NEXUS_DATA_DIR=$DATA_DIR
+EOF
+chown root:"$APP_USER" "$ENV_FILE"
+chmod 640 "$ENV_FILE"
+
+# ── register the runner (idempotent) ──────────────────────────────────────────
+if [[ ! -f "$RUNNER_DIR/.runner" ]]; then
+  msg_info "Registering runner '$RUNNER_NAME' [$RUNNER_LABELS] with $GITEA_INSTANCE_URL..."
+  run_user bash -c "cd '$RUNNER_DIR' && /usr/local/bin/act_runner register \
+    --no-interactive \
+    --instance '$GITEA_INSTANCE_URL' \
+    --token '$RUNNER_TOKEN' \
+    --name '$RUNNER_NAME' \
+    --labels '$RUNNER_LABELS'"
+  chown -R "$APP_USER:$APP_USER" "$RUNNER_DIR"
+  msg_ok "Runner registered"
+else
+  msg_warn "Runner already registered (.runner exists), skipping"
+fi
+
+# ── narrow sudoers: runner may ONLY (re)start/stop/status nexus.service ───────
+cat >/etc/sudoers.d/nexus-deploy <<EOF
+$APP_USER ALL=(root) NOPASSWD: /usr/bin/systemctl restart nexus.service, /usr/bin/systemctl start nexus.service, /usr/bin/systemctl stop nexus.service, /usr/bin/systemctl status nexus.service
+EOF
+chmod 440 /etc/sudoers.d/nexus-deploy
+visudo -cf /etc/sudoers.d/nexus-deploy >/dev/null
+
+# ── systemd units ─────────────────────────────────────────────────────────────
+# nexus.service: SKELETON. The deploy workflow populates /opt/nexus/current and
+# the stack card provides current/start.sh. Enabled (starts on boot) but not
+# started now — first successful deploy starts it via the sudoers-allowed restart.
+cat >/etc/systemd/system/nexus.service <<EOF
+[Unit]
+Description=nexus — Family Knowledge Hub
+After=network-online.target
+Wants=network-online.target
+# Skeleton-safe: only startable once the first deploy shipped the artifact
+# (otherwise a reboot before first deploy leaves the unit in failed state).
+ConditionPathExists=$CURRENT_DIR/start.sh
+
+[Service]
+Type=simple
+User=$APP_USER
+Group=$APP_USER
+WorkingDirectory=$CURRENT_DIR
+EnvironmentFile=$ENV_FILE
+ExecStart=$CURRENT_DIR/start.sh
+Restart=on-failure
+RestartSec=5
+NoNewPrivileges=true
+ProtectSystem=full
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+cat >/etc/systemd/system/nexus-runner.service <<EOF
+[Unit]
+Description=nexus — Gitea Actions runner (host mode, CI + deploy)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=$APP_USER
+Group=$APP_USER
+WorkingDirectory=$RUNNER_DIR
+Environment=HOME=$APP_HOME
+Environment=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+ExecStart=/usr/local/bin/act_runner daemon
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+systemctl daemon-reload
+systemctl enable nexus.service >/dev/null 2>&1
+systemctl enable --now nexus-runner.service
+msg_ok "systemd units installed (runner started; nexus.service enabled, starts on first deploy)"
+
+# ── RUNTIME provisioning (K-101): uv/Python 3.12, tesseract, worker unit ──────
+# Runs LAST on purpose: it extends the sudoers rule and unit set from above.
+# Idempotent — the same script retrofits an existing LXC:
+#   curl -fsSL .../install/nexus-runtime.sh | bash
+bash <(curl -fsSL "${LIB_URL%/lib}/install/nexus-runtime.sh")
+
+# ── notes / summary file ──────────────────────────────────────────────────────
+CRED_FILE="/root/nexus.credentials"
+cat >"$CRED_FILE" <<EOF
+nexus — Family Knowledge Hub deployed via a self-hosted Gitea Actions runner
+
+Repo (informational):  ${REPO_URL:-https://gitea.luki-net.org/l.kirchner/nexus-hub.git}
+Gitea instance:        $GITEA_INSTANCE_URL
+Runner name / labels:  $RUNNER_NAME  [$RUNNER_LABELS]   (act_runner $RUNNER_VERSION, host mode)
+API (local):           http://127.0.0.1:$APP_PORT   (live after first deploy + stack card)
+Live copy:             $CURRENT_DIR
+Data dir:              $DATA_DIR
+Runtime env:           $ENV_FILE
+
+CI + deploy are driven by the repo workflows .gitea/workflows/{ci,deploy}.yml
+nexus.service is a SKELETON — ExecStart expects $CURRENT_DIR/start.sh, which
+the stack-introducing SDD card provides. Until then only ci.yml is functional.
+
+Manual restart:        sudo systemctl restart nexus.service
+Logs:                  journalctl -u nexus -u nexus-runner -f
+
+Prerequisites on the Gitea side:
+  - Actions enabled on the instance and on the repo (repo -> Settings -> Actions)
+  - The LXC needs outbound HTTPS to $GITEA_INSTANCE_URL and to github.com
+    (the latter only to fetch actions/checkout, unless you self-host actions)
+EOF
+chmod 600 "$CRED_FILE"
+
+# registration token already consumed → drop the bootstrap env file
+shred -u "$CONF" 2>/dev/null || rm -f "$CONF"
+
+apt_cleanup
+msg_ok "$APP installation finished"

install/nexus-runtime.sh

@@ -0,0 +1,87 @@
+#!/usr/bin/env bash
+# nexus runtime provisioning — idempotent, runs inside the nexus LXC as root.
+#
+# Added by nexus-hub card K-101 (stack scaffold). Installs everything the
+# decided stack (nexus-hub ADR-0002) needs at runtime ON TOP of the base
+# nexus-install.sh provisioning:
+#   - uv for the `nexus` user (manages Python 3.12 per pyproject.toml)
+#   - tesseract OCR with deu+eng language packs (ingest cards K-107+)
+#   - nexus-worker.service systemd unit (analysis worker, queue with K-105)
+#   - sudoers extension so the Actions runner may also restart the worker
+#
+# Called by install/nexus-install.sh (RUNTIME section) during fresh installs.
+# To retrofit an EXISTING LXC (documented K-101 follow-up step), run inside it:
+#
+#   curl -fsSL https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/install/nexus-runtime.sh | bash
+#
+# Safe to re-run at any time.
+
+set -euo pipefail
+
+LIB_URL="${LIB_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/lib}"
+source <(curl -fsSL "$LIB_URL/install.func")
+
+[[ "$EUID" -eq 0 ]] || { msg_err "Must run as root"; exit 1; }
+
+APP_USER="nexus"
+APP_HOME="/opt/nexus"
+CURRENT_DIR="$APP_HOME/current"
+
+run_user() { runuser -u "$APP_USER" -- env HOME="$APP_HOME" PATH="$APP_HOME/.local/bin:/usr/local/bin:/usr/bin:/bin" "$@"; }
+
+id "$APP_USER" >/dev/null 2>&1 || { msg_err "user $APP_USER missing — run nexus-install.sh first"; exit 1; }
+
+# ── OCR stack (ING-3: tesseract deu+eng) ──────────────────────────────────────
+msg_info "Installing tesseract (deu+eng)..."
+apt-get install -y -qq tesseract-ocr tesseract-ocr-deu tesseract-ocr-eng >/dev/null
+msg_ok "tesseract $(tesseract --version 2>/dev/null | head -n1 | awk '{print $2}')"
+
+# ── uv for the nexus user (provides Python 3.12 via pyproject/uv.lock) ────────
+if [[ ! -x "$APP_HOME/.local/bin/uv" ]]; then
+  msg_info "Installing uv for $APP_USER..."
+  run_user bash -c "curl -LsSf https://astral.sh/uv/install.sh | sh" >/dev/null
+  msg_ok "uv $(run_user "$APP_HOME/.local/bin/uv" --version | awk '{print $2}') installed"
+else
+  msg_warn "uv already present ($(run_user "$APP_HOME/.local/bin/uv" --version | awk '{print $2}')), skipping"
+fi
+run_user "$APP_HOME/.local/bin/uv" python install 3.12 >/dev/null 2>&1 || true
+msg_ok "Python 3.12 toolchain available via uv"
+
+# ── nexus-worker.service ──────────────────────────────────────────────────────
+cat >/etc/systemd/system/nexus-worker.service <<EOF
+[Unit]
+Description=nexus — analysis worker (job queue arrives with K-105)
+After=network-online.target
+Wants=network-online.target
+# Skeleton-safe: only start once the deploy artifact provides the entrypoint.
+ConditionPathExists=$CURRENT_DIR/start-worker.sh
+
+[Service]
+Type=simple
+User=$APP_USER
+Group=$APP_USER
+WorkingDirectory=$CURRENT_DIR
+EnvironmentFile=/etc/nexus/env
+ExecStart=$CURRENT_DIR/start-worker.sh
+Restart=on-failure
+RestartSec=5
+NoNewPrivileges=true
+ProtectSystem=full
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+# ── sudoers: extend the narrow rule to cover the worker service ───────────────
+cat >/etc/sudoers.d/nexus-deploy <<EOF
+$APP_USER ALL=(root) NOPASSWD: /usr/bin/systemctl restart nexus.service, /usr/bin/systemctl start nexus.service, /usr/bin/systemctl stop nexus.service, /usr/bin/systemctl status nexus.service, /usr/bin/systemctl restart nexus-worker.service, /usr/bin/systemctl start nexus-worker.service, /usr/bin/systemctl stop nexus-worker.service, /usr/bin/systemctl status nexus-worker.service
+EOF
+chmod 440 /etc/sudoers.d/nexus-deploy
+visudo -cf /etc/sudoers.d/nexus-deploy >/dev/null
+
+systemctl daemon-reload
+systemctl enable nexus-worker.service >/dev/null 2>&1
+msg_ok "nexus-worker.service installed + enabled (starts once a deploy ships start-worker.sh)"
+
+msg_ok "nexus runtime provisioning finished (idempotent — safe to re-run)"

install/runner-install.sh

@@ -0,0 +1,196 @@
+#!/usr/bin/env bash
+# Runner installer — runs inside the LXC, called by ct/runner.sh
+#
+# Allgemeiner, INSTANZWEITER Gitea-Actions-Runner ohne Deploy-Rechte:
+#   - Node.js (für actions/checkout im Host-Mode) + git + rsync
+#   - Docker (für Wegwerf-Test-Container in CI, z. B. pgvector)
+#   - act_runner als unprivilegierter User "runner" in der docker-Gruppe
+#   - systemd-Unit act-runner.service (Requires=docker.service)
+#
+# SICHERHEITSMODELL (Review-Finding 88, bewusst akzeptiert & dokumentiert):
+# docker-Gruppe == de-facto root IN DIESEM LXC. Da der Runner instanzweit
+# ist, kann jedes Repo der Gitea-Instanz via Workflow den Runner-Container
+# vollständig kontrollieren. Das ist hier akzeptiert, weil (a) alle Repos
+# der Instanz vom selben Admin (Lutz) stammen — kein Multi-Tenant — und
+# (b) dieser LXC GENAU DESHALB nichts besitzt: keine sudoers, keine
+# Produktions-Mounts, keine Secrets außer dem (geshredderten) Reg-Token.
+# Bei Öffnung der Instanz für Dritte: Docker rootless oder eigener Runner
+# pro Vertrauenszone. NICHT auf LXCs mit Deploy-Rechten übertragen.
+#
+# Idempotent: erneuter Lauf (auch OHNE /root/runner.deploy.env) überspringt
+# Vorhandenes und provisioniert nur nach — Registrierung braucht die env-Datei
+# nur beim Erstlauf (Finding 90).
+
+set -euo pipefail
+
+LIB_URL="${LIB_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/lib}"
+source <(curl -fsSL "$LIB_URL/install.func")
+
+[[ "$EUID" -eq 0 ]] || { msg_err "Must run as root"; exit 1; }
+
+APP_USER="runner"
+APP_HOME="/opt/runner"
+RUNNER_DIR="$APP_HOME/data"
+
+# ── Konfiguration laden (optional bei Re-Run, Finding 90) ─────────────────────
+CONF="/root/runner.deploy.env"
+if [[ -f "$CONF" ]]; then
+  set -a; . "$CONF"; set +a
+fi
+RUNNER_NAME="${RUNNER_NAME:-$(hostname)}"
+RUNNER_LABELS="${RUNNER_LABELS:-homelab:host}"
+RUNNER_VERSION="${RUNNER_VERSION:-0.2.13}"
+NODE_MAJOR="${NODE_MAJOR:-22}"
+
+# ── Validierung (Finding 80): Werte landen in Shell-Fragmenten/systemd —
+#    strikte Zeichenklassen statt Vertrauen. Re-Runs ohne CONF validieren
+#    nur, was gesetzt ist; Registrierungs-Pflichtwerte prüft der Reg-Block. ──
+valid_url()    { [[ "$1" =~ ^https?://[A-Za-z0-9.-]+(:[0-9]{1,5})?$ ]]; }
+valid_token()  { [[ "$1" =~ ^[A-Za-z0-9_-]{16,128}$ ]]; }
+valid_token_word() { [[ "$1" =~ ^[A-Za-z0-9._:,-]+$ ]]; }
+
+[[ -z "${GITEA_INSTANCE_URL:-}" ]] || valid_url "$GITEA_INSTANCE_URL" \
+  || { msg_err "GITEA_INSTANCE_URL ungültig: nur http(s)://host[:port]"; exit 1; }
+[[ -z "${RUNNER_TOKEN:-}" ]] || valid_token "$RUNNER_TOKEN" \
+  || { msg_err "RUNNER_TOKEN ungültig (erwartet 16–128 Zeichen [A-Za-z0-9_-])"; exit 1; }
+valid_token_word "$RUNNER_NAME"   || { msg_err "RUNNER_NAME enthält unzulässige Zeichen"; exit 1; }
+valid_token_word "$RUNNER_LABELS" || { msg_err "RUNNER_LABELS enthält unzulässige Zeichen"; exit 1; }
+[[ "$RUNNER_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || { msg_err "RUNNER_VERSION ungültig"; exit 1; }
+[[ "$NODE_MAJOR" =~ ^[0-9]+$ ]] || { msg_err "NODE_MAJOR ungültig"; exit 1; }
+
+# Finding 85 (Re-Review): act_runner schreibt .runner ins CWD — run_user wechselt
+# deshalb hart ins RUNNER_DIR (env -C), sonst landet die Registrierung in / und
+# der unprivilegierte User darf dort nicht schreiben.
+run_user() { runuser -u "$APP_USER" -- env -C "$RUNNER_DIR" HOME="$APP_HOME" "$@"; }
+
+# ── Pakete: git/rsync, Node (checkout-Action), Docker (Test-Container) ────────
+setup_base_apt git rsync ca-certificates curl
+
+NODE_HAVE="$(command -v node >/dev/null 2>&1 && node -v | sed -E 's/^v([0-9]+).*/\1/' || echo 0)"
+if [[ "$NODE_HAVE" != "$NODE_MAJOR" ]]; then
+  msg_info "Installing Node.js ${NODE_MAJOR}.x (NodeSource)..."
+  curl -fsSL "https://deb.nodesource.com/setup_${NODE_MAJOR}.x" | bash - >/dev/null
+  apt-get install -y -qq nodejs >/dev/null
+  msg_ok "Node $(node -v) installed"
+else
+  msg_warn "Node $(node -v) already present, skipping"
+fi
+
+if ! command -v docker >/dev/null 2>&1; then
+  msg_info "Installing Docker (get.docker.com)..."
+  curl -fsSL https://get.docker.com | sh >/dev/null
+  msg_ok "Docker $(docker --version | awk '{print $3}' | tr -d ',')"
+else
+  msg_warn "Docker already present, skipping"
+fi
+
+# ── act_runner binary ─────────────────────────────────────────────────────────
+if [[ ! -x /usr/local/bin/act_runner ]]; then
+  ARCH="$(dpkg --print-architecture)"
+  case "$ARCH" in amd64|arm64) ;; *) msg_err "unsupported arch: $ARCH"; exit 1 ;; esac
+  msg_info "Downloading act_runner $RUNNER_VERSION ($ARCH)..."
+  curl -fsSL "https://dl.gitea.com/act_runner/${RUNNER_VERSION}/act_runner-${RUNNER_VERSION}-linux-${ARCH}" \
+    -o /usr/local/bin/act_runner
+  chmod +x /usr/local/bin/act_runner
+  msg_ok "act_runner $(/usr/local/bin/act_runner --version 2>/dev/null | head -n1)"
+else
+  msg_warn "act_runner already present, skipping download"
+fi
+
+# ── User (docker-Gruppe VOR dem Daemon-Start — Lesson aus nexus K-103:
+#    Gruppenmitgliedschaften werden beim Prozessstart eingefroren) ─────────────
+create_system_user "$APP_USER" "$APP_HOME"
+usermod -aG docker "$APP_USER"
+mkdir -p "$RUNNER_DIR"
+chown -R "$APP_USER:$APP_USER" "$APP_HOME"
+
+# ── Registrierung (idempotent; braucht CONF-Werte nur beim Erstlauf) ──────────
+if [[ ! -f "$RUNNER_DIR/.runner" ]]; then
+  : "${GITEA_INSTANCE_URL:?missing GITEA_INSTANCE_URL (Erstlauf braucht /root/runner.deploy.env)}"
+  : "${RUNNER_TOKEN:?missing RUNNER_TOKEN (Erstlauf braucht /root/runner.deploy.env)}"
+  msg_info "Registering runner '$RUNNER_NAME' [$RUNNER_LABELS] with $GITEA_INSTANCE_URL (instance scope)..."
+  # Werte sind oben strikt validiert (keine Quotes/Whitespace möglich) —
+  # Übergabe als argv an runuser, keine erneute Shell-Interpolation (vgl. Finding 76).
+  # CWD = RUNNER_DIR via run_user (Finding 85).
+  run_user /usr/local/bin/act_runner register \
+    --no-interactive \
+    --config /dev/null \
+    --instance "$GITEA_INSTANCE_URL" \
+    --token "$RUNNER_TOKEN" \
+    --name "$RUNNER_NAME" \
+    --labels "$RUNNER_LABELS" \
+    2>&1 | sed "s#$RUNNER_TOKEN#<redacted>#g" || { msg_err "Registrierung fehlgeschlagen"; exit 1; }
+  # Belt-and-suspenders: falls eine künftige act_runner-Version doch ins HOME schreibt
+  if [[ -f "$APP_HOME/.runner" && ! -f "$RUNNER_DIR/.runner" ]]; then
+    mv "$APP_HOME/.runner" "$RUNNER_DIR/.runner"
+  fi
+  [[ -f "$RUNNER_DIR/.runner" ]] || { msg_err ".runner nach Registrierung nicht gefunden"; exit 1; }
+  chown -R "$APP_USER:$APP_USER" "$RUNNER_DIR"
+  msg_ok "Runner registered"
+else
+  msg_warn "Runner already registered (.runner exists), skipping"
+fi
+
+# ── SSH-Root-Login-Policy anwenden, falls vom Host-Script übergeben
+#    (Funktion existiert in install.func ab K-114/PR #5 — guarded Aufruf,
+#     damit dieser Branch vor und nach dem Merge funktioniert) ────────────────
+if declare -F configure_ssh_root_login >/dev/null 2>&1; then
+  configure_ssh_root_login
+fi
+
+# ── systemd-Unit (bewusst KEINE sudoers-Datei; Findings 82 + 70) ──────────────
+cat >/etc/systemd/system/act-runner.service <<EOF
+[Unit]
+Description=Gitea Actions runner (instance-wide, label ${RUNNER_LABELS%%:*}, no deploy rights)
+After=network-online.target docker.service
+Wants=network-online.target
+# Finding 82: ohne Docker keine Jobs annehmen — harte Kopplung
+Requires=docker.service
+
+[Service]
+Type=simple
+User=$APP_USER
+Group=$APP_USER
+WorkingDirectory=$RUNNER_DIR
+Environment=HOME=$APP_HOME
+Environment=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+ExecStart=/usr/local/bin/act_runner daemon
+Restart=on-failure
+RestartSec=5
+# Finding 70: Basis-Härtung (docker-CLI über Socket bleibt funktional)
+NoNewPrivileges=true
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+systemctl daemon-reload
+systemctl enable --now act-runner.service
+msg_ok "act-runner.service installed + started"
+
+CRED_FILE="/root/runner.credentials"
+cat >"$CRED_FILE" <<EOF
+Allgemeiner Gitea-Actions-Runner (instanzweit)
+
+Instance:   ${GITEA_INSTANCE_URL:-<bestehende Registrierung, siehe $RUNNER_DIR/.runner>}
+Name/Label: $RUNNER_NAME  [$RUNNER_LABELS]
+User:       $APP_USER (docker-Gruppe, KEIN sudo)
+Workdir:    $RUNNER_DIR
+Logs:       journalctl -u act-runner -f
+
+Repos nutzen ihn mit:  runs-on: ${RUNNER_LABELS%%:*}
+
+SICHERHEITSMODELL: docker-Gruppe == de-facto root in DIESEM LXC; instanzweit
+heißt: jedes Repo der Instanz kann den Runner-LXC kontrollieren. Akzeptiert,
+weil Single-Admin-Instanz und dieser LXC nichts besitzt (keine sudoers, keine
+Produktions-Mounts). Deploy-Jobs gehören NICHT hierher — die bleiben auf dem
+repo-scoped nexus-Runner. Trennung beibehalten.
+EOF
+chmod 600 "$CRED_FILE"
+
+if [[ -f "$CONF" ]]; then
+  shred -u "$CONF" 2>/dev/null || rm -f "$CONF"
+fi
+apt_cleanup
+msg_ok "runner installation finished"

install/webapp-install.sh

@@ -0,0 +1,195 @@
+#!/usr/bin/env bash
+# webapp installer — runs inside the LXC, called by ct/webapp.sh
+#
+# Sets up a Next.js site deployed by a self-hosted Gitea Actions runner:
+#   - Node.js (NodeSource) + git + rsync + sudo
+#   - act_runner in HOST mode (no Docker), registered to the Gitea instance,
+#     running as the unprivileged `webapp` user and polling Gitea outbound
+#   - a systemd service running `next start` from /opt/webapp/current
+#   - a narrow sudoers rule so the runner may only restart that one service
+#
+# The actual build/deploy logic lives in the repo's .gitea/workflows/deploy.yml
+# (deploy-as-code). The runner checks out, builds, syncs the result into
+# /opt/webapp/current and restarts webapp.service.
+
+set -euo pipefail
+
+APP="webapp"
+LIB_URL="${LIB_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/lib}"
+source <(curl -fsSL "$LIB_URL/install.func")
+
+[[ "$EUID" -eq 0 ]] || { msg_err "Must run as root"; exit 1; }
+
+# ── load deploy config pushed in by the host script ──────────────────────────
+CONF="/root/webapp.deploy.env"
+[[ -f "$CONF" ]] || { msg_err "$CONF not found (host bootstrap incomplete)"; exit 1; }
+set -a; . "$CONF"; set +a
+
+: "${GITEA_INSTANCE_URL:?missing GITEA_INSTANCE_URL}"
+: "${RUNNER_TOKEN:?missing RUNNER_TOKEN}"
+APP_PORT="${APP_PORT:-3000}"
+NODE_MAJOR="${NODE_MAJOR:-22}"
+RUNNER_VERSION="${RUNNER_VERSION:-0.2.13}"
+RUNNER_LABELS="${RUNNER_LABELS:-webapp:host}"
+RUNNER_NAME="${RUNNER_NAME:-$(hostname)}"
+
+APP_USER="webapp"
+APP_HOME="/opt/webapp"
+RUNNER_DIR="$APP_HOME/runner"
+CURRENT_DIR="$APP_HOME/current"
+CONF_DIR="/etc/webapp"
+ENV_FILE="$CONF_DIR/env"
+
+run_user() { runuser -u "$APP_USER" -- env HOME="$APP_HOME" "$@"; }
+
+# ── packages: git + rsync + sudo ; Node.js via NodeSource ────────────────────
+setup_base_apt git rsync sudo
+
+NODE_HAVE="$(command -v node >/dev/null 2>&1 && node -v | sed -E 's/^v([0-9]+).*/\1/' || echo 0)"
+if [[ "$NODE_HAVE" != "$NODE_MAJOR" ]]; then
+  msg_info "Installing Node.js ${NODE_MAJOR}.x (NodeSource)..."
+  curl -fsSL "https://deb.nodesource.com/setup_${NODE_MAJOR}.x" | bash - >/dev/null
+  apt-get install -y -qq nodejs >/dev/null
+  msg_ok "Node $(node -v) installed"
+else
+  msg_warn "Node $(node -v) already present, skipping"
+fi
+
+# ── act_runner binary ─────────────────────────────────────────────────────────
+if [[ ! -x /usr/local/bin/act_runner ]]; then
+  ARCH="$(dpkg --print-architecture)"
+  case "$ARCH" in amd64|arm64) ;; *) msg_err "unsupported arch: $ARCH"; exit 1 ;; esac
+  msg_info "Downloading act_runner $RUNNER_VERSION ($ARCH)..."
+  curl -fsSL "https://dl.gitea.com/act_runner/${RUNNER_VERSION}/act_runner-${RUNNER_VERSION}-linux-${ARCH}" \
+    -o /usr/local/bin/act_runner
+  chmod +x /usr/local/bin/act_runner
+  msg_ok "act_runner $(/usr/local/bin/act_runner --version 2>/dev/null | head -n1)"
+else
+  msg_warn "act_runner already present, skipping download"
+fi
+
+# ── user + dirs ──────────────────────────────────────────────────────────────
+create_system_user "$APP_USER" "$APP_HOME"
+mkdir -p "$RUNNER_DIR" "$CURRENT_DIR" "$CONF_DIR"
+chown -R "$APP_USER:$APP_USER" "$APP_HOME"
+
+# ── env file: NEXT_PUBLIC_* are inlined at build time AND read at runtime ────
+# (kept on the host so the repo carries no environment-specific config; the
+#  workflow sources this file before `next build`.)
+cat >"$ENV_FILE" <<EOF
+NODE_ENV=production
+NEXT_TELEMETRY_DISABLED=1
+NEXT_PUBLIC_SITE_URL=$NEXT_PUBLIC_SITE_URL
+NEXT_PUBLIC_SANITY_PROJECT_ID=${NEXT_PUBLIC_SANITY_PROJECT_ID:-}
+NEXT_PUBLIC_SANITY_DATASET=${NEXT_PUBLIC_SANITY_DATASET:-production}
+NEXT_PUBLIC_SANITY_API_VERSION=${NEXT_PUBLIC_SANITY_API_VERSION:-2026-06-02}
+NEXT_PUBLIC_CALENDLY_URL=${NEXT_PUBLIC_CALENDLY_URL:-}
+EOF
+chown root:"$APP_USER" "$ENV_FILE"
+chmod 640 "$ENV_FILE"
+
+# ── register the runner (idempotent) ─────────────────────────────────────────
+if [[ ! -f "$RUNNER_DIR/.runner" ]]; then
+  msg_info "Registering runner '$RUNNER_NAME' [$RUNNER_LABELS] with $GITEA_INSTANCE_URL..."
+  run_user bash -c "cd '$RUNNER_DIR' && /usr/local/bin/act_runner register \
+    --no-interactive \
+    --instance '$GITEA_INSTANCE_URL' \
+    --token '$RUNNER_TOKEN' \
+    --name '$RUNNER_NAME' \
+    --labels '$RUNNER_LABELS'"
+  chown -R "$APP_USER:$APP_USER" "$RUNNER_DIR"
+  msg_ok "Runner registered"
+else
+  msg_warn "Runner already registered (.runner exists), skipping"
+fi
+
+# ── narrow sudoers: runner may ONLY (re)start/stop/status webapp.service ─────
+cat >/etc/sudoers.d/webapp-deploy <<EOF
+$APP_USER ALL=(root) NOPASSWD: /usr/bin/systemctl restart webapp.service, /usr/bin/systemctl start webapp.service, /usr/bin/systemctl stop webapp.service, /usr/bin/systemctl status webapp.service
+EOF
+chmod 440 /etc/sudoers.d/webapp-deploy
+visudo -cf /etc/sudoers.d/webapp-deploy >/dev/null
+
+# ── systemd units ─────────────────────────────────────────────────────────────
+# webapp.service: serves the built site from the live copy. Enabled (so it
+# starts on boot) but not started now — the first workflow run populates
+# /opt/webapp/current and starts it via the sudoers-allowed restart.
+cat >/etc/systemd/system/webapp.service <<EOF
+[Unit]
+Description=webapp — Next.js production server
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=$APP_USER
+Group=$APP_USER
+WorkingDirectory=$CURRENT_DIR
+EnvironmentFile=$ENV_FILE
+ExecStart=/usr/bin/npm run start -- -H 0.0.0.0 -p $APP_PORT
+Restart=on-failure
+RestartSec=5
+NoNewPrivileges=true
+ProtectSystem=full
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+cat >/etc/systemd/system/webapp-runner.service <<EOF
+[Unit]
+Description=webapp — Gitea Actions runner (host mode, deploy)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=$APP_USER
+Group=$APP_USER
+WorkingDirectory=$RUNNER_DIR
+Environment=HOME=$APP_HOME
+Environment=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+ExecStart=/usr/local/bin/act_runner daemon
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+systemctl daemon-reload
+systemctl enable webapp.service >/dev/null 2>&1
+systemctl enable --now webapp-runner.service
+msg_ok "systemd units installed (runner started; webapp.service enabled, starts on first deploy)"
+
+# ── notes / summary file ──────────────────────────────────────────────────────
+CRED_FILE="/root/webapp.credentials"
+cat >"$CRED_FILE" <<EOF
+webapp — Next.js site deployed via a self-hosted Gitea Actions runner
+
+Repo (informational):  ${REPO_URL:-<your website repo>}
+Gitea instance:        $GITEA_INSTANCE_URL
+Runner name / labels:  $RUNNER_NAME  [$RUNNER_LABELS]   (act_runner $RUNNER_VERSION, host mode)
+Site (local):          http://127.0.0.1:$APP_PORT   (live after first deploy)
+Live copy:             $CURRENT_DIR
+Site env (build+run):  $ENV_FILE
+
+Deploy is driven by the repo workflow .gitea/workflows/deploy.yml
+First deploy:          push to the repo, OR repo -> Actions -> deploy -> "Run workflow"
+
+Manual restart:        sudo systemctl restart webapp.service
+Logs:                  journalctl -u webapp -u webapp-runner -f
+
+Prerequisites on the Gitea side:
+  - Actions enabled on the instance and on the repo (repo -> Settings -> Actions)
+  - The LXC needs outbound HTTPS to $GITEA_INSTANCE_URL and to github.com
+    (the latter only to fetch actions/checkout, unless you self-host actions)
+EOF
+chmod 600 "$CRED_FILE"
+
+# registration token already consumed → drop the bootstrap env file
+shred -u "$CONF" 2>/dev/null || rm -f "$CONF"
+
+apt_cleanup
+msg_ok "$APP installation finished"

lib/build.func

@@ -36,6 +36,12 @@ DEFAULT_ROOTFS_STORAGE="${DEFAULT_ROOTFS_STORAGE:-local-lvm}"
 DEFAULT_TEMPLATE_PATTERN="${DEFAULT_TEMPLATE_PATTERN:-debian-12-standard}"
 DEFAULT_NAMESERVER="${DEFAULT_NAMESERVER:-}"
 
+# Network profiles: map a VLAN tag → DNS servers (+ subnet), maintained in
+# lib/networks.conf so adding a network is a one-line change. Applied even for
+# DHCP, so every container gets the right resolvers for its VLAN.
+NET_PROFILES_URL="${NET_PROFILES_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/lib/networks.conf}"
+# Set NET_PROFILES_FILE to a local path to use that instead of the remote file.
+
 # ── error trap ───────────────────────────────────────────────────────────────
 _on_error() {
   local exit_code=$?
@@ -63,6 +69,34 @@ show_header() {
   echo
 }
 
+# ── network profiles ─────────────────────────────────────────────────────────
+# Look up DNS servers for the chosen VLAN tag from lib/networks.conf.
+# Sets PROFILE_DNS (space-separated, ready for pct --nameserver) and
+# PROFILE_SUBNET. Both stay empty if there's no matching profile.
+apply_network_profile() {
+  PROFILE_DNS=""; PROFILE_SUBNET=""
+  local key="${VLAN_TAG:-}"; [[ -z "$key" ]] && key="none"
+
+  local data=""
+  if [[ -n "${NET_PROFILES_FILE:-}" && -r "${NET_PROFILES_FILE:-}" ]]; then
+    data=$(cat "$NET_PROFILES_FILE")
+  else
+    data=$(curl -fsSL "$NET_PROFILES_URL" 2>/dev/null) || data=""
+  fi
+  [[ -n "$data" ]] || { msg_warn "Could not load network profiles ($NET_PROFILES_URL)"; return 0; }
+
+  local t s d _rest
+  while read -r t s d _rest; do
+    [[ -z "$t" || "$t" == \#* ]] && continue          # skip blanks/comments
+    if [[ "$t" == "$key" ]]; then
+      PROFILE_SUBNET="$s"
+      PROFILE_DNS="${d//,/ }"                          # pct wants space-separated
+      return 0
+    fi
+  done <<< "$data"
+  return 0
+}
+
 # ── prompts ──────────────────────────────────────────────────────────────────
 # Each prompt is skipped if the corresponding variable is already set in env.
 # VLAN_TAG and NAMESERVER use ${VAR+x} so that explicitly setting them to ""
@@ -113,12 +147,24 @@ prompt_lxc_config() {
   if [[ "$IPCFG" != "dhcp" && -z "$GATEWAY" ]]; then
     read -rp "Gateway: " GATEWAY
   fi
-  # DNS: only meaningful for static IPs (DHCP gets DNS from the lease).
-  # Default suggestion is the gateway, which doubles as DNS in most homelabs.
-  if [[ "$IPCFG" != "dhcp" && -z "${NAMESERVER+x}" ]]; then
+  # DNS is driven by the VLAN tag via the network profile (lib/networks.conf),
+  # so the right resolvers get set even with DHCP. Precedence:
+  #   1. explicit NAMESERVER from env (even "" = inherit)  → respected as-is
+  #   2. profile match for this VLAN tag                   → use its DNS
+  #   3. static IP, no profile                             → ask
+  #   4. DHCP, no profile                                  → inherit from host
+  apply_network_profile
+  if [[ -n "${NAMESERVER+x}" ]]; then
+    :  # explicit override from env, leave untouched
+  elif [[ -n "$PROFILE_DNS" ]]; then
+    NAMESERVER="$PROFILE_DNS"
+    msg_info "DNS for VLAN ${VLAN_TAG:-none} (${PROFILE_SUBNET:-?}): $NAMESERVER"
+  elif [[ "$IPCFG" != "dhcp" ]]; then
     local default_ns="${DEFAULT_NAMESERVER:-$GATEWAY}"
     read -rp "DNS server [$default_ns] (empty = inherit from PVE host): " NAMESERVER
     NAMESERVER="${NAMESERVER:-$default_ns}"
+  else
+    msg_warn "No network profile for VLAN ${VLAN_TAG:-none}; DHCP DNS will be inherited."
   fi
 }
 
@@ -165,11 +211,11 @@ create_lxc() {
     --ostype debian
     --password "$ROOT_PASSWORD"
   )
-  [[ -n "${NAMESERVER:-}" ]] && pct_args+=(--nameserver "$NAMESERVER")
+  [[ -n "${NAMESERVER:-}" ]] && pct_args+=(--nameserver "${NAMESERVER//,/ }")
 
   msg_info "Creating unprivileged LXC $CTID ($CT_HOSTNAME)..."
   msg_info "  net0: $net_opts"
-  [[ -n "${NAMESERVER:-}" ]] && msg_info "  dns:  $NAMESERVER"
+  [[ -n "${NAMESERVER:-}" ]] && msg_info "  dns:  ${NAMESERVER//,/ }"
   pct create "${pct_args[@]}"
   msg_ok "LXC $CTID created"
 

lib/networks.conf

@@ -0,0 +1,19 @@
+# lib/networks.conf — network profiles for proxmox-scripts
+#
+# Maps a VLAN tag to the DNS servers that network uses, so every LXC gets the
+# right resolvers automatically — even when it pulls its IP via DHCP. This is
+# looked up by lib/build.func from the VLAN tag entered during installation.
+#
+# To add a network, add one line. Columns are whitespace-separated:
+#
+#   tag      VLAN tag entered at install time. Use "none" for the untagged
+#            network (i.e. when the VLAN prompt is left empty).
+#   subnet   CIDR of the network. Informational — shown during install.
+#   dns      DNS servers, comma-separated (no spaces).
+#
+# Precedence note: an explicit NAMESERVER=... passed via env always wins over
+# the profile. The profile only fills in DNS when none was given by hand.
+#
+# tag    subnet            dns
+none     192.168.0.0/24    192.168.0.4,192.168.0.5
+20       10.11.20.0/24     10.11.20.44,10.11.20.55