fix(nexus-db): address codex review — early encoding guard, robust helpers

- assert encoding BEFORE role/password mutation on re-run, so an old
  SQL_ASCII DB aborts with no side effects (codex finding 1)
- ensure_utf8_locale_active honours its locale argument consistently in
  match, locale.gen line and export (codex finding 2)
- assert_db_encoding_utf8 uses argv-clean runuser psql with :'db' literal
  binding instead of nested su -c shell; docs keep su - postgres -c
  (codex finding 3)

.gitea/workflows/ci.yml

@@ -1,7 +1,8 @@
 name: CI
 
 # K-114 (nexus-hub): Mini-CI für proxmox-scripts — Syntax, build.func-Source-
-# Pflicht und Validierungs-Unit-Tests. Läuft auf dem nexus-Runner (Host-Mode).
+# Pflicht und Validierungs-Unit-Tests. Läuft auf dem instanzweiten Runner
+# (Label homelab, ohne Deploy-Rechte — PR #6 / ct/runner.sh).
 
 on:
   push:
@@ -11,7 +12,7 @@ on:
 jobs:
   lint:
     name: Shell-Lint (bash -n, source-check, Validierungs-Tests)
-    runs-on: nexus
+    runs-on: homelab
     steps:
       - name: Checkout
         uses: actions/checkout@v4

README.md

@@ -1,53 +1,87 @@
 # luki-net / proxmox-scripts
 
-Community-script-style installers for LXC services in my Proxmox VE homelab. Each script creates an unprivileged Debian 12 LXC and installs one specific app, with sensible defaults and interactive prompts.
+Community-script-style installers for LXC services in the luki-net Proxmox VE homelab. Each script creates an unprivileged Debian 12 LXC and installs one specific app — sensible defaults, interactive prompts, env-overridable for non-interactive runs.
 
-Inspired by [community-scripts/ProxmoxVE](https://github.com/community-scripts/ProxmoxVE), but minimal, self-hosted and tailored to my stack.
+Inspired by [community-scripts/ProxmoxVE](https://github.com/community-scripts/ProxmoxVE), but minimal, self-hosted and tailored to this stack.
 
-## Available scripts
+## Script catalog
 
-| App | Description | One-liner |
-|-----|-------------|-----------|
-| [devpi](ct/devpi.sh) | Private PyPI cache / mirror — saves time on CUDA/torch rebuilds | `bash -c "$(curl -fsSL https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/ct/devpi.sh)"` |
-| [webapp](ct/webapp.sh) | Next.js site with deploy-as-code via a self-hosted Gitea Actions runner (host mode, no inbound port) | `bash -c "$(curl -fsSL https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/ct/webapp.sh)"` |
+| App | What it provisions | Status |
+|-----|--------------------|--------|
+| [devpi](ct/devpi.sh) | Private PyPI cache/mirror — saves time on CUDA/torch rebuilds | ✅ stable |
+| [webapp](ct/webapp.sh) | Next.js site with deploy-as-code via a repo-scoped Gitea Actions runner (host mode, no inbound port) | ✅ stable |
+| [nexus](ct/nexus.sh) | App LXC for [nexus](https://gitea.luki-net.org/l.kirchner/nexus-hub) (Family Knowledge Hub): host-mode runner (label `nexus`, CI + deploy), service skeleton, `/opt/nexus` layout. Runtime is provisioned/extended via [`install/nexus-runtime.sh`](install/nexus-runtime.sh) (idempotent, re-runnable) | ✅ in production |
+| [nexus-db](ct/nexus-db.sh) | PostgreSQL 16 + pgvector for nexus — least-privilege role, pg_hba allowlist (only the nexus LXC), DSN handed over via credentials file | ✅ in production |
+| [authentik](ct/authentik.sh) | Central homelab IdP (official Docker Compose via LXC nesting) — headless bootstrap admin **and** API token for agent-driven blueprint configuration, blueprints mount, permanent auth domain (WebAuthn RP-ID) | ✅ in production |
+| [runner](ct/runner.sh) | General **instance-wide** Gitea Actions runner (label `homelab`) — Docker for throwaway CI test containers, deliberately **no** sudoers/deploy rights | ✅ in production |
+
+Run any one-liner on a Proxmox VE host as root:
+
+```bash
+bash -c "$(curl -fsSL https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/ct/<app>.sh)"
+```
 
 ## Usage
 
-Run any one-liner on a Proxmox VE host as root (Web UI → Node → Shell works fine). You'll be prompted for CTID, hostname, disk, RAM, CPU, bridge, storage and IP. Defaults are sane.
-
-Non-interactive override via env vars:
+Interactive prompts cover CTID, hostname, disk, RAM, CPU, bridge/VLAN, storage, IP/gateway/DNS — plus app-specific values. Defaults are sane. Non-interactive override via env vars:
 
 ```bash
 CTID=200 HOSTNAME=devpi DISK_SIZE=30 RAM=4096 CORES=4 IPCFG=dhcp \
   bash -c "$(curl -fsSL https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/ct/devpi.sh)"
 ```
 
-All defaults (`DEFAULT_HOSTNAME`, `DEFAULT_DISK`, …) are settable per-call via env vars as well.
+All defaults (`DEFAULT_HOSTNAME`, `DEFAULT_DISK`, …) and app config values are settable per call via env vars.
 
-## Contributing (verbindlich seit K-114)
+Every input is validated (digits-only for CTID/disk/cores/RAM/VLAN, IP/CIDR/gateway format, hostname/storage charsets). Invalid interactive input re-prompts — including pasted values with invisible control/non-ASCII bytes, which are rejected rather than silently stripped. Env-provided values are validated too and abort the run when malformed (no re-prompt loop in non-interactive use).
 
-**Alle Änderungen laufen als PR mit Cross-Review** — keine Direkt-Commits auf `main`. Hintergrund: Der „`build.func` nicht gesourct"-Bug hat es einmal bis in die Produktion geschafft (authentik-Anlage), während dieselbe Fehlerklasse im nexus-db-PR vom Review gefangen wurde. Die CI (`.gitea/workflows/ci.yml`, Runner-Label `nexus`) erzwingt zusätzlich: `bash -n` über alle Scripts, „jedes `ct/*.sh` sourct `build.func`" (`tests/check_ct_source.sh`) und die Validierungs-Unit-Tests (`tests/test_validation.sh`).
+## The pattern
 
-Eingaben in `prompt_lxc_config` sind validiert (Ziffern-Checks, IP/CIDR/Gateway-Format, Re-Prompt bei unsichtbaren Steuer-/Non-ASCII-Zeichen — Lesson vom 2026-06-11). Neue App-Prompts bitte über `prompt_validated`/`require_valid` aus `lib/build.func` bauen statt nacktem `read`.
+Two files per app, both sourcing the shared libs via `curl`:
+
+- **`ct/<app>.sh`** runs on the PVE host: prompts → unprivileged LXC → pushes a config env file into the container → bootstraps the installer. Apps that need Docker (authentik, runner) enable `nesting+keyctl` automatically. The standard prompts include an **SSH root login choice** (`SSH_ROOT_LOGIN`, default yes for homelab convenience; `no` keeps the Debian key-only default) — applied inside the container as an sshd drop-in by `configure_ssh_root_login`.
+- **`install/<app>-install.sh`** runs inside the LXC: packages, unprivileged app user, secrets generated on-host (never printed), systemd units, a `/root/<app>.credentials` notes file — then shreds the bootstrap env. Idempotent where it matters: re-runs skip what exists. `setup_base_apt` also fixes the bare-template **locale situation**: `C.UTF-8` is exported up front (glibc built-in, covers the first apt run without perl warnings), then `en_US.UTF-8` is generated and set as the system default.
+
+**DB installers** carry one extra rule: a PostgreSQL cluster/database freezes its encoding at initdb / `CREATE DATABASE` time and it can never be changed afterwards. A C (non-UTF-8) locale yields a `SQL_ASCII` cluster — psycopg3 then hands text back as bytes and SQLAlchemy crashes. So the pattern (helpers `ensure_utf8_locale_active` + `assert_db_encoding_utf8` in `lib/install.func`) is: make a UTF-8 locale **active** before the server package runs initdb, create the database **explicitly** with `TEMPLATE template0 ENCODING 'UTF8' LC_COLLATE/LC_CTYPE 'en_US.UTF-8'` (never inherit the cluster default), and **verify** `pg_encoding_to_char` returns `UTF8` before finishing — a wrong encoding aborts the install (it's DB damage, see wiki → Lessons). Maintenance examples use `su - postgres -c …`, not `sudo` — these minimal LXCs have no sudo.
+
+Shared libs: [`lib/build.func`](lib/build.func) (host-side: prompts, LXC create, bootstrap) and [`lib/install.func`](lib/install.func) (in-container: apt, users, systemd, http-wait).
+
+## Security conventions
+
+- Unprivileged LXCs only; app processes run as dedicated system users.
+- Least privilege everywhere: narrow sudoers (exact-match commands — sudoers compares **verbatim incl. arguments**), DB allowlists, LAN-only binds for inference ports.
+- Secrets are generated on the target host and live in `0600` files — never in the repo, the wiki or chat logs.
+- **Runner separation:** the nexus runner is repo-scoped and lives on the production LXC *because* it holds deploy rights; the general `runner` LXC is instance-wide *because* it holds none. Don't mix these scopes.
+
+## Contributing
+
+**All changes go through a pull request with cross-review** (Claude Code ↔ Codex, or a human) — no direct pushes to `main`. This rule exists because of two real incidents: a pasted VLAN tag carrying an invisible non-UTF-8 byte broke `pct create` mid-run, and the "missing `source build.func`" bug shipped twice — caught in review on the nexus-db PR, but reaching production via an un-reviewed authentik commit (see wiki → Lessons).
+
+CI (`.gitea/workflows/ci.yml`, instance-wide `homelab` runner from [ct/runner.sh](ct/runner.sh)) enforces on every PR: `bash -n` over all scripts, the "every `ct/*.sh` sources `build.func`" check ([tests/check_ct_source.sh](tests/check_ct_source.sh)) and the validation unit tests ([tests/test_validation.sh](tests/test_validation.sh)); shellcheck runs when available on the runner.
+
+Build new app prompts on `prompt_validated`/`require_valid` from `lib/build.func` instead of bare `read`. How to add a script: [docs/adding-a-script.md](docs/adding-a-script.md).
 
 ## Repo layout
 
 ```
 .
 ├── ct/                 # Host-side scripts, one per app
-├── install/            # In-container installers, one per app
+├── install/            # In-container installers (+ nexus-runtime.sh re-provisioner)
 ├── lib/
 │   ├── build.func      # Shared host-side helpers (prompts, LXC create, bootstrap)
 │   └── install.func    # Shared in-container helpers (apt, systemd, users, http-wait)
+├── tests/
+│   ├── test_validation.sh   # Unit tests for the input validation helpers
+│   └── check_ct_source.sh   # Every ct/*.sh must source build.func
 ├── docs/
 │   └── adding-a-script.md
 ├── README.md
 └── LICENSE
 ```
 
-## Adding a new script
+## Related
 
-See [docs/adding-a-script.md](docs/adding-a-script.md). Two files per app, both source the shared libs via `curl`.
+- [nexus-hub](https://gitea.luki-net.org/l.kirchner/nexus-hub) — Family Knowledge Hub (main consumer of nexus/nexus-db/authentik/runner)
+- [Wiki](https://gitea.luki-net.org/luki-net/proxmox-scripts/wiki) — per-app runbook pointers, conventions, lessons learned
 
 ## License
 

ct/runner.sh

@@ -0,0 +1,155 @@
+#!/usr/bin/env bash
+# Allgemeiner Gitea-Actions-Runner — instanzweit, OHNE Deploy-Rechte
+#
+# Motivation (nexus K-114-Blocker): Der nexus-Runner läuft auf dem
+# Produktions-LXC und besitzt sudoers-Deploy-Rechte — er darf deshalb NICHT
+# instanzweit registriert werden (jedes Repo könnte sonst Workflows auf der
+# Produktionsmaschine ausführen). Dieser LXC ist die saubere Trennung:
+#   - instanzweite Registrierung (Site Administration → Actions → Runners)
+#   - Label "homelab:host" (Deploy-Jobs bleiben auf "nexus")
+#   - KEINE sudoers-Regeln, kein Zugriff auf Produktions-Verzeichnisse
+#   - Docker via Nesting für Wegwerf-Test-Container (z. B. pgvector in CI)
+#
+# Sicherheitsmodell: siehe Kopfkommentar in install/runner-install.sh —
+# instanzweit + docker-Gruppe heißt: jedes Repo der Instanz kann diesen LXC
+# kontrollieren. Akzeptiert, WEIL er nichts besitzt. Nicht auf privilegierte
+# LXCs übertragen.
+#
+# Run on a Proxmox VE host:
+#   bash -c "$(curl -fsSL https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/ct/runner.sh)"
+
+set -euo pipefail
+
+APP="runner"
+APP_DESCRIPTION="Allgemeiner Gitea-Actions-Runner (instanzweit, Label homelab, Docker, ohne Deploy-Rechte)"
+
+LIB_URL="${LIB_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/lib}"
+INSTALL_SCRIPT_URL="${INSTALL_SCRIPT_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/install/runner-install.sh}"
+
+source <(curl -fsSL "$LIB_URL/build.func")
+
+DEFAULT_HOSTNAME="runner"
+DEFAULT_DISK="30"
+DEFAULT_CORES="4"
+DEFAULT_RAM="6144"
+
+# ── Validierung (Review-Finding 80): Werte wandern in die Deploy-Env und in
+#    systemd/argv — strikte Zeichenklassen, Re-Prompt statt Abbruch.
+#    Bewusst LOKALE Validatoren: die Libs werden zur Laufzeit von main geladen,
+#    dieses Script muss aber unabhängig vom Merge-Stand der K-114-Helfer
+#    (prompt_validated/require_valid) funktionieren. Semantik ist identisch;
+#    Konsolidierung auf die build.func-Helfer ist als Follow-up notiert. ──────
+_valid_url()   { [[ "$1" =~ ^https?://[A-Za-z0-9.-]+(:[0-9]{1,5})?$ ]]; }
+_valid_token() { [[ "$1" =~ ^[A-Za-z0-9_-]{16,128}$ ]]; }
+_valid_word()  { [[ "$1" =~ ^[A-Za-z0-9._:,-]+$ ]]; }
+
+_prompt_until_valid() { # var prompt default validator secret(0|1)
+  local __var="$1" __prompt="$2" __default="$3" __validator="$4" __secret="${5:-0}" __val
+  while true; do
+    if [[ "$__secret" == "1" ]]; then
+      read -rsp "$__prompt" __val || { echo; msg_err "Eingabe abgebrochen (EOF)"; exit 1; }
+      echo
+    else
+      read -rp "$__prompt" __val || { echo; msg_err "Eingabe abgebrochen (EOF)"; exit 1; }
+    fi
+    __val="${__val:-$__default}"
+    if [[ -n "$__val" ]] && "$__validator" "$__val"; then
+      printf -v "$__var" '%s' "$__val"
+      return 0
+    fi
+    msg_warn "Ungültige Eingabe — bitte erneut (kein Paste mit Sonderzeichen)."
+  done
+}
+
+prompt_app_config() {
+  echo
+  echo "── Runner configuration ─────────────────────────────────────"
+  # env-präsetzte Werte werden validiert (Abbruch bei ungültig — K-114-Konvention),
+  # interaktive Eingaben re-prompten bis gültig.
+  if [[ -n "${GITEA_INSTANCE_URL:-}" ]]; then
+    _valid_url "$GITEA_INSTANCE_URL" || { msg_err "GITEA_INSTANCE_URL (env) ungültig"; exit 1; }
+  else
+    _prompt_until_valid GITEA_INSTANCE_URL \
+      "Gitea instance URL [https://gitea.luki-net.org]: " \
+      "https://gitea.luki-net.org" _valid_url 0
+  fi
+  # WICHTIG: den INSTANZWEITEN Token verwenden
+  # (Site Administration → Actions → Runners → Create new runner),
+  # NICHT den Repo-Token — sonst wiederholt sich der K-114-Scope-Blocker.
+  if [[ -n "${RUNNER_TOKEN:-}" ]]; then
+    _valid_token "$RUNNER_TOKEN" || { msg_err "RUNNER_TOKEN (env) ungültig (16–128 Zeichen [A-Za-z0-9_-])"; exit 1; }
+  else
+    _prompt_until_valid RUNNER_TOKEN \
+      "INSTANZWEITER Runner-Registration-Token: " \
+      "" _valid_token 1
+  fi
+  RUNNER_NAME="${RUNNER_NAME:-$CT_HOSTNAME}"
+  RUNNER_LABELS="${RUNNER_LABELS:-homelab:host}"
+  RUNNER_VERSION="${RUNNER_VERSION:-0.2.13}"
+  NODE_MAJOR="${NODE_MAJOR:-22}"
+  _valid_word "$RUNNER_NAME"   || { msg_err "RUNNER_NAME ungültig"; exit 1; }
+  _valid_word "$RUNNER_LABELS" || { msg_err "RUNNER_LABELS ungültig"; exit 1; }
+  [[ "$RUNNER_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || { msg_err "RUNNER_VERSION ungültig"; exit 1; }
+  [[ "$NODE_MAJOR" =~ ^[0-9]+$ ]] || { msg_err "NODE_MAJOR ungültig"; exit 1; }
+  echo "  → instance: $GITEA_INSTANCE_URL"
+  echo "  → runner:   $RUNNER_NAME   labels: $RUNNER_LABELS   (act_runner $RUNNER_VERSION, host mode, scope: INSTANZ)"
+}
+
+push_app_config() {
+  msg_info "Pushing runner config into container..."
+  local tmpf; tmpf=$(mktemp)
+  # Werte sind oben strikt validiert (keine Quotes/Whitespace möglich) —
+  # damit ist die env-Datei frei von Quoting-/Injection-Fallen (vgl. Finding 76).
+  cat >"$tmpf" <<EOF
+GITEA_INSTANCE_URL=$GITEA_INSTANCE_URL
+RUNNER_TOKEN=$RUNNER_TOKEN
+RUNNER_NAME=$RUNNER_NAME
+RUNNER_LABELS=$RUNNER_LABELS
+RUNNER_VERSION=$RUNNER_VERSION
+NODE_MAJOR=$NODE_MAJOR
+EOF
+  pct push "$CTID" "$tmpf" /root/runner.deploy.env --perms 600
+  rm -f "$tmpf"
+}
+
+# Docker im unprivilegierten LXC braucht nesting+keyctl (Test-Container in CI).
+enable_nesting() {
+  msg_info "Enabling nesting+keyctl features (Docker für CI-Test-Container)..."
+  pct set "$CTID" --features nesting=1,keyctl=1
+  pct reboot "$CTID"
+  for _ in $(seq 1 30); do
+    pct exec "$CTID" -- true >/dev/null 2>&1 && break
+    sleep 2
+  done
+  msg_ok "Container restarted with nesting enabled"
+}
+
+print_app_summary() {
+  local runner_state
+  runner_state=$(pct exec "$CTID" -- systemctl is-active act-runner.service 2>/dev/null | tr -d '\r\n')
+  cat <<EOF
+  Gitea-Actions-Runner: $RUNNER_NAME  [$RUNNER_LABELS]  — $runner_state
+    Scope:              INSTANZWEIT — bedient alle Repos der Instanz
+    Mode:               host (Docker verfügbar für Test-Container)
+    Sicherheit:         kein sudoers, keine Deploy-Rechte, keine Produktions-Mounts
+                        (Modell: siehe install/runner-install.sh Kopfkommentar)
+    Verify:             $GITEA_INSTANCE_URL → Site Administration → Actions → Runners
+
+  Workflows anderer Repos nutzen:  runs-on: ${RUNNER_LABELS%%:*}
+  (Deploy-Jobs von nexus bleiben auf dem nexus-LXC-Runner, Label "nexus".)
+
+  Logs:                 pct exec $CTID -- journalctl -u act-runner -f
+EOF
+}
+
+trap _on_error ERR
+preflight_pve
+show_header "$APP" "$APP_DESCRIPTION"
+prompt_lxc_config
+prompt_app_config
+resolve_debian_template
+create_lxc
+enable_nesting
+push_app_config
+bootstrap_install_script "$INSTALL_SCRIPT_URL"
+print_summary

install/authentik-install.sh

@@ -29,6 +29,7 @@ CRED_FILE="/root/authentik.credentials"
 
 # ── base packages + Docker ────────────────────────────────────────────────────
 setup_base_apt ca-certificates curl
+configure_ssh_root_login
 if ! command -v docker >/dev/null 2>&1; then
   msg_info "Installing Docker (get.docker.com)..."
   curl -fsSL https://get.docker.com | sh >/dev/null

install/devpi-install.sh

@@ -19,6 +19,7 @@ DEVPI_PORT="3141"
 
 # ── packages + user + dirs ───────────────────────────────────────────────────
 setup_base_apt python3 python3-venv python3-pip
+configure_ssh_root_login
 
 create_system_user "$DEVPI_USER" "$DEVPI_HOME"
 mkdir -p "$DEVPI_DATA"

install/nexus-db-install.sh

@@ -36,6 +36,7 @@ CRED_FILE="/root/nexus-db.credentials"
 
 # ── packages: PGDG repo + PostgreSQL 16 + pgvector ────────────────────────────
 setup_base_apt curl ca-certificates gnupg lsb-release
+configure_ssh_root_login
 
 if [[ ! -f /etc/apt/sources.list.d/pgdg.sources ]] && [[ ! -f /etc/apt/sources.list.d/pgdg.list ]]; then
   msg_info "Adding PGDG apt repo..."
@@ -46,6 +47,12 @@ else
   msg_warn "PGDG repo already present, skipping"
 fi
 
+# The server package runs initdb for the `main` cluster on install — its
+# encoding is frozen there. Make a UTF-8 locale active for THIS process first
+# so the cluster is never created as SQL_ASCII (issue #8: a pre-fix LXC was
+# provisioned under LANG=C and ended up SQL_ASCII).
+ensure_utf8_locale_active en_US.UTF-8
+
 msg_info "Installing PostgreSQL $PG_MAJOR + pgvector..."
 apt-get install -y -qq "postgresql-$PG_MAJOR" "postgresql-$PG_MAJOR-pgvector" >/dev/null
 msg_ok "PostgreSQL $(psql --version | awk '{print $3}') installed"
@@ -94,6 +101,13 @@ systemctl restart postgresql
 # ── role + database + extension (idempotent, password kept on re-run) ─────────
 run_psql() { runuser -u postgres -- psql -v ON_ERROR_STOP=1 -qAt "$@"; }
 
+# Re-run safety (issue #8): if the database already exists, verify its
+# encoding BEFORE touching roles/passwords. An old SQL_ASCII database must
+# abort the run with NO side effects — not after rotating credentials.
+if [[ "$(run_psql -c "SELECT 1 FROM pg_database WHERE datname='$DB_NAME'")" == "1" ]]; then
+  assert_db_encoding_utf8 "$DB_NAME"
+fi
+
 if [[ "$(run_psql -c "SELECT 1 FROM pg_roles WHERE rolname='$DB_USER'")" != "1" ]]; then
   msg_info "Creating role $DB_USER + database $DB_NAME..."
   DB_PASS="$(openssl rand -base64 32 | tr -d '/+=' | head -c 32)"
@@ -113,12 +127,18 @@ else
 fi
 
 if [[ "$(run_psql -c "SELECT 1 FROM pg_database WHERE datname='$DB_NAME'")" != "1" ]]; then
-  run_psql -c "CREATE DATABASE $DB_NAME OWNER $DB_USER"
+  # Explicit encoding/collation from template0 — never inherit the cluster
+  # default, which may be SQL_ASCII if initdb ran under a broken locale
+  # (issue #8). template0 is required to override LC_COLLATE/LC_CTYPE.
+  run_psql -c "CREATE DATABASE $DB_NAME OWNER $DB_USER ENCODING 'UTF8' LC_COLLATE 'en_US.UTF-8' LC_CTYPE 'en_US.UTF-8' TEMPLATE template0"
   # Only the owner may connect — no PUBLIC access.
   run_psql -c "REVOKE CONNECT ON DATABASE $DB_NAME FROM PUBLIC"
-  msg_ok "Database $DB_NAME created (owner $DB_USER, PUBLIC revoked)"
+  # Verify what we just created (the pre-existing case was already checked
+  # before the role block, issue #8).
+  assert_db_encoding_utf8 "$DB_NAME"
+  msg_ok "Database $DB_NAME created (UTF8, owner $DB_USER, PUBLIC revoked)"
 else
-  msg_warn "Database $DB_NAME already exists, skipping"
+  msg_warn "Database $DB_NAME already exists, skipping creation"
 fi
 
 # pgvector: CREATE EXTENSION needs superuser; installed now (per ADR-0002:
@@ -140,9 +160,12 @@ Password: $DB_PASS
 DSN for /etc/nexus/env on the nexus LXC (NEXUS_DATABASE_URL):
   postgresql+psycopg://$DB_USER:$DB_PASS@$IP_SELF:$DB_PORT/$DB_NAME
 
+Encoding: UTF8 (LC_COLLATE/LC_CTYPE en_US.UTF-8) — verified at install time.
+
 Access policy (pg_hba): only $NEXUS_APP_IP/32 may connect; all other
-hosts are rejected. Local socket stays peer-auth for maintenance:
-  pct exec <CTID> -- runuser -u postgres -- psql -d $DB_NAME
+hosts are rejected. Local socket stays peer-auth for maintenance (these
+minimal LXCs have no sudo — use su, not sudo):
+  pct exec <CTID> -- su - postgres -c "psql -d $DB_NAME"
 EOF
   chmod 600 "$CRED_FILE"
   msg_ok "Credentials written to $CRED_FILE (chmod 600)"

install/nexus-install.sh

@@ -46,6 +46,7 @@ run_user() { runuser -u "$APP_USER" -- env HOME="$APP_HOME" "$@"; }
 
 # ── packages: git + rsync + sudo ; Node.js via NodeSource ─────────────────────
 setup_base_apt git rsync sudo
+configure_ssh_root_login
 
 NODE_HAVE="$(command -v node >/dev/null 2>&1 && node -v | sed -E 's/^v([0-9]+).*/\1/' || echo 0)"
 if [[ "$NODE_HAVE" != "$NODE_MAJOR" ]]; then

install/runner-install.sh

@@ -0,0 +1,196 @@
+#!/usr/bin/env bash
+# Runner installer — runs inside the LXC, called by ct/runner.sh
+#
+# Allgemeiner, INSTANZWEITER Gitea-Actions-Runner ohne Deploy-Rechte:
+#   - Node.js (für actions/checkout im Host-Mode) + git + rsync
+#   - Docker (für Wegwerf-Test-Container in CI, z. B. pgvector)
+#   - act_runner als unprivilegierter User "runner" in der docker-Gruppe
+#   - systemd-Unit act-runner.service (Requires=docker.service)
+#
+# SICHERHEITSMODELL (Review-Finding 88, bewusst akzeptiert & dokumentiert):
+# docker-Gruppe == de-facto root IN DIESEM LXC. Da der Runner instanzweit
+# ist, kann jedes Repo der Gitea-Instanz via Workflow den Runner-Container
+# vollständig kontrollieren. Das ist hier akzeptiert, weil (a) alle Repos
+# der Instanz vom selben Admin (Lutz) stammen — kein Multi-Tenant — und
+# (b) dieser LXC GENAU DESHALB nichts besitzt: keine sudoers, keine
+# Produktions-Mounts, keine Secrets außer dem (geshredderten) Reg-Token.
+# Bei Öffnung der Instanz für Dritte: Docker rootless oder eigener Runner
+# pro Vertrauenszone. NICHT auf LXCs mit Deploy-Rechten übertragen.
+#
+# Idempotent: erneuter Lauf (auch OHNE /root/runner.deploy.env) überspringt
+# Vorhandenes und provisioniert nur nach — Registrierung braucht die env-Datei
+# nur beim Erstlauf (Finding 90).
+
+set -euo pipefail
+
+LIB_URL="${LIB_URL:-https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/lib}"
+source <(curl -fsSL "$LIB_URL/install.func")
+
+[[ "$EUID" -eq 0 ]] || { msg_err "Must run as root"; exit 1; }
+
+APP_USER="runner"
+APP_HOME="/opt/runner"
+RUNNER_DIR="$APP_HOME/data"
+
+# ── Konfiguration laden (optional bei Re-Run, Finding 90) ─────────────────────
+CONF="/root/runner.deploy.env"
+if [[ -f "$CONF" ]]; then
+  set -a; . "$CONF"; set +a
+fi
+RUNNER_NAME="${RUNNER_NAME:-$(hostname)}"
+RUNNER_LABELS="${RUNNER_LABELS:-homelab:host}"
+RUNNER_VERSION="${RUNNER_VERSION:-0.2.13}"
+NODE_MAJOR="${NODE_MAJOR:-22}"
+
+# ── Validierung (Finding 80): Werte landen in Shell-Fragmenten/systemd —
+#    strikte Zeichenklassen statt Vertrauen. Re-Runs ohne CONF validieren
+#    nur, was gesetzt ist; Registrierungs-Pflichtwerte prüft der Reg-Block. ──
+valid_url()    { [[ "$1" =~ ^https?://[A-Za-z0-9.-]+(:[0-9]{1,5})?$ ]]; }
+valid_token()  { [[ "$1" =~ ^[A-Za-z0-9_-]{16,128}$ ]]; }
+valid_token_word() { [[ "$1" =~ ^[A-Za-z0-9._:,-]+$ ]]; }
+
+[[ -z "${GITEA_INSTANCE_URL:-}" ]] || valid_url "$GITEA_INSTANCE_URL" \
+  || { msg_err "GITEA_INSTANCE_URL ungültig: nur http(s)://host[:port]"; exit 1; }
+[[ -z "${RUNNER_TOKEN:-}" ]] || valid_token "$RUNNER_TOKEN" \
+  || { msg_err "RUNNER_TOKEN ungültig (erwartet 16–128 Zeichen [A-Za-z0-9_-])"; exit 1; }
+valid_token_word "$RUNNER_NAME"   || { msg_err "RUNNER_NAME enthält unzulässige Zeichen"; exit 1; }
+valid_token_word "$RUNNER_LABELS" || { msg_err "RUNNER_LABELS enthält unzulässige Zeichen"; exit 1; }
+[[ "$RUNNER_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || { msg_err "RUNNER_VERSION ungültig"; exit 1; }
+[[ "$NODE_MAJOR" =~ ^[0-9]+$ ]] || { msg_err "NODE_MAJOR ungültig"; exit 1; }
+
+# Finding 85 (Re-Review): act_runner schreibt .runner ins CWD — run_user wechselt
+# deshalb hart ins RUNNER_DIR (env -C), sonst landet die Registrierung in / und
+# der unprivilegierte User darf dort nicht schreiben.
+run_user() { runuser -u "$APP_USER" -- env -C "$RUNNER_DIR" HOME="$APP_HOME" "$@"; }
+
+# ── Pakete: git/rsync, Node (checkout-Action), Docker (Test-Container) ────────
+setup_base_apt git rsync ca-certificates curl
+
+NODE_HAVE="$(command -v node >/dev/null 2>&1 && node -v | sed -E 's/^v([0-9]+).*/\1/' || echo 0)"
+if [[ "$NODE_HAVE" != "$NODE_MAJOR" ]]; then
+  msg_info "Installing Node.js ${NODE_MAJOR}.x (NodeSource)..."
+  curl -fsSL "https://deb.nodesource.com/setup_${NODE_MAJOR}.x" | bash - >/dev/null
+  apt-get install -y -qq nodejs >/dev/null
+  msg_ok "Node $(node -v) installed"
+else
+  msg_warn "Node $(node -v) already present, skipping"
+fi
+
+if ! command -v docker >/dev/null 2>&1; then
+  msg_info "Installing Docker (get.docker.com)..."
+  curl -fsSL https://get.docker.com | sh >/dev/null
+  msg_ok "Docker $(docker --version | awk '{print $3}' | tr -d ',')"
+else
+  msg_warn "Docker already present, skipping"
+fi
+
+# ── act_runner binary ─────────────────────────────────────────────────────────
+if [[ ! -x /usr/local/bin/act_runner ]]; then
+  ARCH="$(dpkg --print-architecture)"
+  case "$ARCH" in amd64|arm64) ;; *) msg_err "unsupported arch: $ARCH"; exit 1 ;; esac
+  msg_info "Downloading act_runner $RUNNER_VERSION ($ARCH)..."
+  curl -fsSL "https://dl.gitea.com/act_runner/${RUNNER_VERSION}/act_runner-${RUNNER_VERSION}-linux-${ARCH}" \
+    -o /usr/local/bin/act_runner
+  chmod +x /usr/local/bin/act_runner
+  msg_ok "act_runner $(/usr/local/bin/act_runner --version 2>/dev/null | head -n1)"
+else
+  msg_warn "act_runner already present, skipping download"
+fi
+
+# ── User (docker-Gruppe VOR dem Daemon-Start — Lesson aus nexus K-103:
+#    Gruppenmitgliedschaften werden beim Prozessstart eingefroren) ─────────────
+create_system_user "$APP_USER" "$APP_HOME"
+usermod -aG docker "$APP_USER"
+mkdir -p "$RUNNER_DIR"
+chown -R "$APP_USER:$APP_USER" "$APP_HOME"
+
+# ── Registrierung (idempotent; braucht CONF-Werte nur beim Erstlauf) ──────────
+if [[ ! -f "$RUNNER_DIR/.runner" ]]; then
+  : "${GITEA_INSTANCE_URL:?missing GITEA_INSTANCE_URL (Erstlauf braucht /root/runner.deploy.env)}"
+  : "${RUNNER_TOKEN:?missing RUNNER_TOKEN (Erstlauf braucht /root/runner.deploy.env)}"
+  msg_info "Registering runner '$RUNNER_NAME' [$RUNNER_LABELS] with $GITEA_INSTANCE_URL (instance scope)..."
+  # Werte sind oben strikt validiert (keine Quotes/Whitespace möglich) —
+  # Übergabe als argv an runuser, keine erneute Shell-Interpolation (vgl. Finding 76).
+  # CWD = RUNNER_DIR via run_user (Finding 85).
+  run_user /usr/local/bin/act_runner register \
+    --no-interactive \
+    --config /dev/null \
+    --instance "$GITEA_INSTANCE_URL" \
+    --token "$RUNNER_TOKEN" \
+    --name "$RUNNER_NAME" \
+    --labels "$RUNNER_LABELS" \
+    2>&1 | sed "s#$RUNNER_TOKEN#<redacted>#g" || { msg_err "Registrierung fehlgeschlagen"; exit 1; }
+  # Belt-and-suspenders: falls eine künftige act_runner-Version doch ins HOME schreibt
+  if [[ -f "$APP_HOME/.runner" && ! -f "$RUNNER_DIR/.runner" ]]; then
+    mv "$APP_HOME/.runner" "$RUNNER_DIR/.runner"
+  fi
+  [[ -f "$RUNNER_DIR/.runner" ]] || { msg_err ".runner nach Registrierung nicht gefunden"; exit 1; }
+  chown -R "$APP_USER:$APP_USER" "$RUNNER_DIR"
+  msg_ok "Runner registered"
+else
+  msg_warn "Runner already registered (.runner exists), skipping"
+fi
+
+# ── SSH-Root-Login-Policy anwenden, falls vom Host-Script übergeben
+#    (Funktion existiert in install.func ab K-114/PR #5 — guarded Aufruf,
+#     damit dieser Branch vor und nach dem Merge funktioniert) ────────────────
+if declare -F configure_ssh_root_login >/dev/null 2>&1; then
+  configure_ssh_root_login
+fi
+
+# ── systemd-Unit (bewusst KEINE sudoers-Datei; Findings 82 + 70) ──────────────
+cat >/etc/systemd/system/act-runner.service <<EOF
+[Unit]
+Description=Gitea Actions runner (instance-wide, label ${RUNNER_LABELS%%:*}, no deploy rights)
+After=network-online.target docker.service
+Wants=network-online.target
+# Finding 82: ohne Docker keine Jobs annehmen — harte Kopplung
+Requires=docker.service
+
+[Service]
+Type=simple
+User=$APP_USER
+Group=$APP_USER
+WorkingDirectory=$RUNNER_DIR
+Environment=HOME=$APP_HOME
+Environment=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+ExecStart=/usr/local/bin/act_runner daemon
+Restart=on-failure
+RestartSec=5
+# Finding 70: Basis-Härtung (docker-CLI über Socket bleibt funktional)
+NoNewPrivileges=true
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+systemctl daemon-reload
+systemctl enable --now act-runner.service
+msg_ok "act-runner.service installed + started"
+
+CRED_FILE="/root/runner.credentials"
+cat >"$CRED_FILE" <<EOF
+Allgemeiner Gitea-Actions-Runner (instanzweit)
+
+Instance:   ${GITEA_INSTANCE_URL:-<bestehende Registrierung, siehe $RUNNER_DIR/.runner>}
+Name/Label: $RUNNER_NAME  [$RUNNER_LABELS]
+User:       $APP_USER (docker-Gruppe, KEIN sudo)
+Workdir:    $RUNNER_DIR
+Logs:       journalctl -u act-runner -f
+
+Repos nutzen ihn mit:  runs-on: ${RUNNER_LABELS%%:*}
+
+SICHERHEITSMODELL: docker-Gruppe == de-facto root in DIESEM LXC; instanzweit
+heißt: jedes Repo der Instanz kann den Runner-LXC kontrollieren. Akzeptiert,
+weil Single-Admin-Instanz und dieser LXC nichts besitzt (keine sudoers, keine
+Produktions-Mounts). Deploy-Jobs gehören NICHT hierher — die bleiben auf dem
+repo-scoped nexus-Runner. Trennung beibehalten.
+EOF
+chmod 600 "$CRED_FILE"
+
+if [[ -f "$CONF" ]]; then
+  shred -u "$CONF" 2>/dev/null || rm -f "$CONF"
+fi
+apt_cleanup
+msg_ok "runner installation finished"

install/webapp-install.sh

@@ -44,6 +44,7 @@ run_user() { runuser -u "$APP_USER" -- env HOME="$APP_HOME" "$@"; }
 
 # ── packages: git + rsync + sudo ; Node.js via NodeSource ────────────────────
 setup_base_apt git rsync sudo
+configure_ssh_root_login
 
 NODE_HAVE="$(command -v node >/dev/null 2>&1 && node -v | sed -E 's/^v([0-9]+).*/\1/' || echo 0)"
 if [[ "$NODE_HAVE" != "$NODE_MAJOR" ]]; then

lib/build.func

@@ -147,6 +147,16 @@ is_cidr() {
 
 is_ipcfg() { [[ "$1" == "dhcp" ]] || is_cidr "$1"; }
 
+# Ja/Nein-Antworten (Prompts wie "… erlauben? [Y/n]"). Akzeptiert
+# deutsch/englisch, normalize_yesno macht daraus kanonisch yes|no.
+is_yesno() { is_clean_ascii "$1" && [[ "${1,,}" =~ ^(y|yes|j|ja|n|no|nein)$ ]]; }
+normalize_yesno() {
+  case "${1,,}" in
+    y|yes|j|ja) printf 'yes' ;;
+    *)          printf 'no' ;;
+  esac
+}
+
 # Space/comma-separated list of IPv4s (DNS prompt). Gesamtstring zuerst
 # prüfen — die Wort-Splittung würde eingebettete Newlines sonst verstecken.
 is_ipv4_list() {
@@ -311,6 +321,17 @@ prompt_lxc_config() {
   else
     msg_warn "No network profile for VLAN ${VLAN_TAG:-none}; DHCP DNS will be inherited."
   fi
+
+  # SSH-Root-Login (Default: ja, Homelab-Komfort). Umgesetzt wird das im
+  # Install-Pfad per sshd-Drop-in (configure_ssh_root_login, lib/install.func);
+  # bootstrap_install_script reicht den normalisierten Wert in den Container.
+  if [[ -z "${SSH_ROOT_LOGIN:-}" ]]; then
+    prompt_validated SSH_ROOT_LOGIN "SSH-Root-Login erlauben? [Y/n]: " is_yesno "y"
+  else
+    require_valid SSH_ROOT_LOGIN is_yesno "SSH root login (y/n)"
+  fi
+  SSH_ROOT_LOGIN="$(normalize_yesno "$SSH_ROOT_LOGIN")"
+  echo "  → SSH root login: $SSH_ROOT_LOGIN"
 }
 
 # ── template ─────────────────────────────────────────────────────────────────
@@ -408,7 +429,9 @@ bootstrap_install_script() {
   pct exec "$CTID" -- bash -c "apt-get update -qq && apt-get install -y -qq curl ca-certificates >/dev/null"
 
   msg_info "Running installer ($url)..."
-  pct exec "$CTID" -- bash -c "curl -fsSL '$url' -o /root/${APP}-install.sh && bash /root/${APP}-install.sh"
+  # SSH_ROOT_LOGIN ist durch normalize_yesno kanonisch yes|no — als Env in
+  # den Container durchreichen (configure_ssh_root_login wertet es aus).
+  pct exec "$CTID" -- bash -c "curl -fsSL '$url' -o /root/${APP}-install.sh && SSH_ROOT_LOGIN='${SSH_ROOT_LOGIN:-yes}' bash /root/${APP}-install.sh"
 }
 
 # ── summary ──────────────────────────────────────────────────────────────────

lib/install.func

@@ -15,10 +15,14 @@ msg_warn() { echo -e "${YELLOW}[!]${NC} $*"; }
 msg_err()  { echo -e "${RED}[✗]${NC} $*" >&2; }
 
 # ── apt ──────────────────────────────────────────────────────────────────────
-# Always installs: ca-certificates curl openssl tzdata gnupg
+# Always installs: ca-certificates curl openssl tzdata gnupg locales
 # Additional packages can be passed as args.
 setup_base_apt() {
   export DEBIAN_FRONTEND=noninteractive
+  # C.UTF-8 ist in glibc eingebaut und damit schon VOR dem locales-Paket
+  # verfügbar — deckt den ersten apt/dpkg-Lauf ab (keine perl-Warnungen
+  # "Setting locale failed" mehr, LXC-Templates kommen ohne Locale).
+  export LANG=C.UTF-8 LC_ALL=C.UTF-8
   msg_info "Updating apt index..."
   apt-get update -qq
   if [[ $# -gt 0 ]]; then
@@ -27,17 +31,113 @@ setup_base_apt() {
     msg_info "Installing base packages..."
   fi
   apt-get install -y -qq \
-    ca-certificates curl openssl tzdata gnupg \
+    ca-certificates curl openssl tzdata gnupg locales \
     "$@" \
     >/dev/null
+  setup_locales
   msg_ok "apt setup complete"
 }
 
+# en_US.UTF-8 generieren und systemweit als Default setzen; C.UTF-8 braucht
+# keine Generierung (glibc-built-in). Idempotent: sed greift nur auf die
+# auskommentierte Zeile, locale-gen/update-locale sind re-run-sicher.
+setup_locales() {
+  msg_info "Generating locales (en_US.UTF-8; C.UTF-8 built-in)..."
+  sed -i 's/^# *en_US\.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen
+  locale-gen >/dev/null
+  update-locale LANG=en_US.UTF-8
+  msg_ok "Default locale: en_US.UTF-8"
+}
+
 apt_cleanup() {
   apt-get autoremove -y -qq >/dev/null || true
   apt-get autoclean -qq >/dev/null || true
 }
 
+# ── database installers: UTF-8 locale before initdb ──────────────────────────
+# Pattern for every DB installer. A PostgreSQL cluster/database freezes its
+# encoding at initdb / CREATE DATABASE time and it cannot be changed later —
+# a C (non-UTF-8) locale yields a SQL_ASCII cluster. psycopg3 then returns
+# text as bytes and SQLAlchemy crashes on server-version detection; the app
+# reports "db: unreachable". So: GENERATE the UTF-8 locale AND make it active
+# for THIS process before the server package runs its automatic initdb, then
+# fail loudly if it is not actually available (generating alone is not enough
+# — the locale must be active when initdb runs).
+# Generates+activates a UTF-8 locale (default en_US.UTF-8); the argument
+# honours other UTF-8 locales consistently (match, locale.gen line and the
+# exported value all derive from it). Matching normalises case and dashes so
+# the canonical `en_US.UTF-8` matches `locale -a`'s `en_US.utf8`.
+ensure_utf8_locale_active() {
+  local loc="${1:-en_US.UTF-8}"
+  local norm; norm="$(printf '%s' "$loc" | tr 'A-Z' 'a-z' | tr -d '-')"
+  _locale_present() { locale -a 2>/dev/null | tr 'A-Z' 'a-z' | tr -d '-' | grep -qx "$norm"; }
+  msg_info "Ensuring $loc is generated and active (DB encoding is frozen at initdb)..."
+  if ! _locale_present; then
+    # Uncomment the matching `# <loc> UTF-8` line, then generate.
+    sed -i "s/^# *${loc} UTF-8/${loc} UTF-8/" /etc/locale.gen
+    locale-gen >/dev/null
+  fi
+  if ! _locale_present; then
+    msg_err "Locale $loc not available after locale-gen — refusing to continue (initdb would create a SQL_ASCII cluster)"
+    return 1
+  fi
+  # Activate for the current process so any automatic initdb during the
+  # server package install inherits a UTF-8 locale, not the bare-template C.
+  export LANG="$loc" LC_ALL="$loc"
+  msg_ok "Locale active for initdb: LANG=$LANG"
+}
+
+# Post-install guard: a database MUST be UTF8. Encoding is irreversible, so a
+# wrong value is database damage — abort with a clear, actionable message
+# instead of shipping a broken cluster. Uses argv-clean `runuser ... psql`
+# with a quoted :'db' literal binding (robust regardless of caller); the
+# credentials/README docs use `su - postgres -c` for hand maintenance (these
+# minimal LXCs have no sudo).
+assert_db_encoding_utf8() {
+  local db="$1" enc
+  enc="$(runuser -u postgres -- psql -X -qAt -v db="$db" \
+    -c "SELECT pg_encoding_to_char(encoding) FROM pg_database WHERE datname = :'db'")"
+  if [[ "$enc" != "UTF8" ]]; then
+    msg_err "Database '$db' has encoding '${enc:-<not found>}', expected UTF8."
+    msg_err "Encoding is frozen at creation time — this is DB damage, not cosmetic."
+    msg_err "Fix: regenerate the locale (locale-gen en_US.UTF-8) and recreate the DB"
+    msg_err "     with: CREATE DATABASE $db ... TEMPLATE template0 ENCODING 'UTF8'"
+    msg_err "          LC_COLLATE 'en_US.UTF-8' LC_CTYPE 'en_US.UTF-8';"
+    return 1
+  fi
+  msg_ok "Encoding check: database '$db' is UTF8"
+}
+
+# ── ssh ──────────────────────────────────────────────────────────────────────
+# SSH-Root-Login gemäß Host-Prompt (prompt_lxc_config setzt SSH_ROOT_LOGIN,
+# bootstrap_install_script reicht es als Env durch; Default: yes).
+#   yes → PermitRootLogin yes (Passwort-Login mit dem generierten Root-Passwort)
+#   no  → PermitRootLogin prohibit-password (Debian-Default, nur SSH-Key)
+# Umsetzung als Drop-in, damit Paket-Updates von sshd_config nicht kollidieren.
+configure_ssh_root_login() {
+  local choice="${SSH_ROOT_LOGIN:-yes}" value
+  case "$choice" in
+    yes) value="yes" ;;
+    no)  value="prohibit-password" ;;
+    *)   msg_err "SSH_ROOT_LOGIN must be yes|no, got: '$choice'"; return 1 ;;
+  esac
+
+  if [[ ! -d /etc/ssh/sshd_config.d ]]; then
+    if [[ "$choice" == "no" ]]; then
+      msg_warn "openssh-server not installed — nothing to configure (root login stays off)"
+      return 0
+    fi
+    msg_info "Installing openssh-server..."
+    apt-get install -y -qq openssh-server >/dev/null
+  fi
+
+  msg_info "Configuring SSH root login: PermitRootLogin $value"
+  printf 'PermitRootLogin %s\n' "$value" >/etc/ssh/sshd_config.d/zz-root-login.conf
+  systemctl reload ssh 2>/dev/null || systemctl restart ssh 2>/dev/null \
+    || msg_warn "ssh.service not active yet — config applies on first start"
+  msg_ok "SSH root login: $choice"
+}
+
 # ── users / dirs ─────────────────────────────────────────────────────────────
 create_system_user() {
   local user="$1" home="$2"

tests/test_validation.sh

@@ -77,6 +77,38 @@ assert_false "is_hostname lehnt 'a b' ab"          is_hostname "a b"
 assert_true  "is_token akzeptiert local-lvm"       is_token "local-lvm"
 assert_false "is_token lehnt 'a;b' ab"             is_token "a;b"
 
+# ── Ja/Nein (SSH-Root-Login-Prompt) ──────────────────────────────────────────
+assert_true  "is_yesno akzeptiert y"               is_yesno "y"
+assert_true  "is_yesno akzeptiert Ja"              is_yesno "Ja"
+assert_true  "is_yesno akzeptiert NO"              is_yesno "NO"
+assert_true  "is_yesno akzeptiert nein"            is_yesno "nein"
+assert_false "is_yesno lehnt 'maybe' ab"           is_yesno "maybe"
+assert_false "is_yesno lehnt leeren Wert ab"       is_yesno ""
+[[ "$(normalize_yesno "J")" == "yes" && "$(normalize_yesno "nein")" == "no" ]] \
+  && ok "normalize_yesno kanonisiert J→yes, nein→no" \
+  || nok "normalize_yesno kanonisiert J→yes, nein→no"
+
+# SSH-Root-Login-Prompt: leere Eingabe = Default Y → normalisiert yes;
+# explizites 'n' → no.
+ssh_default="$(
+  printf '\n' | {
+    SSH_ROOT_LOGIN=""
+    prompt_validated SSH_ROOT_LOGIN "SSH-Root-Login erlauben? [Y/n]: " is_yesno "y" >/dev/null 2>&1
+    normalize_yesno "$SSH_ROOT_LOGIN"
+  }
+)"
+[[ "$ssh_default" == "yes" ]] && ok "SSH-Root-Login: leere Eingabe → Default yes" \
+  || nok "SSH-Root-Login Default (got: '$ssh_default')"
+ssh_no="$(
+  printf 'n\n' | {
+    SSH_ROOT_LOGIN=""
+    prompt_validated SSH_ROOT_LOGIN "SSH-Root-Login erlauben? [Y/n]: " is_yesno "y" >/dev/null 2>&1
+    normalize_yesno "$SSH_ROOT_LOGIN"
+  }
+)"
+[[ "$ssh_no" == "no" ]] && ok "SSH-Root-Login: 'n' → no" \
+  || nok "SSH-Root-Login 'n' (got: '$ssh_no')"
+
 # ── require_valid: env-Werte werden sanitisiert + geprüft ────────────────────
 CHECKVAL=$'  7\r'
 require_valid CHECKVAL is_uint "Testwert" && [[ "$CHECKVAL" == "7" ]] \
@@ -145,12 +177,12 @@ ctid_out="$(
 smoke_out="$(
   env CTID=999 CT_HOSTNAME=smoke DISK_SIZE=8 CORES=2 RAM=1024 BRIDGE=vmbr0 \
     VLAN_TAG=20 TEMPLATE_STORAGE=local ROOTFS_STORAGE=local-lvm \
-    IPCFG=10.11.20.99/24 GATEWAY=10.11.20.1 NAMESERVER="" \
+    IPCFG=10.11.20.99/24 GATEWAY=10.11.20.1 NAMESERVER="" SSH_ROOT_LOGIN=J \
     NET_PROFILES_FILE="$REPO_ROOT/lib/networks.conf" \
-    bash -c "source '$REPO_ROOT/lib/build.func' && prompt_lxc_config >/dev/null && echo SMOKE-OK"
+    bash -c "source '$REPO_ROOT/lib/build.func' && prompt_lxc_config >/dev/null && echo SMOKE-OK:\$SSH_ROOT_LOGIN"
 )" || true
-[[ "$smoke_out" == *SMOKE-OK* ]] \
-  && ok "prompt_lxc_config Dry-Run mit validen env-Werten läuft durch" \
+[[ "$smoke_out" == *SMOKE-OK:yes* ]] \
+  && ok "prompt_lxc_config Dry-Run mit validen env-Werten läuft durch (SSH_ROOT_LOGIN J→yes)" \
   || nok "prompt_lxc_config Dry-Run (got: '$smoke_out')"
 
 smoke_bad="$(