Merge pull request 'security: version the CIS Tier-A hardening pass' (#11) from security/cis-tierA-hardening into main

Reviewed-on: #11

.gitea/workflows/ci.yml

@@ -0,0 +1,47 @@
+name: CI
+
+# K-114 (nexus-hub): Mini-CI für proxmox-scripts — Syntax, build.func-Source-
+# Pflicht und Validierungs-Unit-Tests. Läuft auf dem instanzweiten Runner
+# (Label homelab, ohne Deploy-Rechte — PR #6 / ct/runner.sh).
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  lint:
+    name: Shell-Lint (bash -n, source-check, Validierungs-Tests)
+    runs-on: homelab
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: bash -n über alle Scripts
+        run: |
+          status=0
+          for f in ct/*.sh install/*.sh lib/*.func tests/*.sh; do
+            if bash -n "$f"; then
+              echo "ok     $f"
+            else
+              echo "SYNTAX $f" >&2
+              status=1
+            fi
+          done
+          exit "$status"
+
+      - name: build.func-Source-Check (jedes ct/*.sh)
+        run: bash tests/check_ct_source.sh
+
+      - name: Validierungs-Unit-Tests (lib/build.func)
+        run: bash tests/test_validation.sh
+
+      - name: shellcheck (falls auf dem Runner installiert)
+        run: |
+          if command -v shellcheck >/dev/null 2>&1; then
+            # -S warning: Style-Hinweise nicht blockierend; externe Sources
+            # (curl|source) kann shellcheck nicht folgen.
+            shellcheck -S warning -e SC1090,SC1091 ct/*.sh install/*.sh tests/*.sh
+          else
+            echo "shellcheck nicht installiert — übersprungen (dokumentiert, K-114)"
+          fi

README.md

@@ -1,47 +1,106 @@
 # luki-net / proxmox-scripts
 
-Community-script-style installers for LXC services in my Proxmox VE homelab. Each script creates an unprivileged Debian 12 LXC and installs one specific app, with sensible defaults and interactive prompts.
+Community-script-style installers for LXC services in the luki-net Proxmox VE homelab. Each script creates an unprivileged Debian 12 LXC and installs one specific app — sensible defaults, interactive prompts, env-overridable for non-interactive runs.
 
-Inspired by [community-scripts/ProxmoxVE](https://github.com/community-scripts/ProxmoxVE), but minimal, self-hosted and tailored to my stack.
+Inspired by [community-scripts/ProxmoxVE](https://github.com/community-scripts/ProxmoxVE), but minimal, self-hosted and tailored to this stack.
 
-## Available scripts
+## Script catalog
 
-| App | Description | One-liner |
+| App | What it provisions | Status |
-|-----|-------------|-----------|
+|-----|--------------------|--------|
-| [devpi](ct/devpi.sh) | Private PyPI cache / mirror — saves time on CUDA/torch rebuilds | `bash -c "$(curl -fsSL https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/ct/devpi.sh)"` |
+| [devpi](ct/devpi.sh) | Private PyPI cache/mirror — saves time on CUDA/torch rebuilds | ✅ stable |
-| [webapp](ct/webapp.sh) | Next.js site with deploy-as-code via a self-hosted Gitea Actions runner (host mode, no inbound port) | `bash -c "$(curl -fsSL https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/ct/webapp.sh)"` |
+| [webapp](ct/webapp.sh) | Next.js site with deploy-as-code via a repo-scoped Gitea Actions runner (host mode, no inbound port) | ✅ stable |
+| [nexus](ct/nexus.sh) | App LXC for [nexus](https://gitea.luki-net.org/l.kirchner/nexus-hub) (Family Knowledge Hub): host-mode runner (label `nexus`, CI + deploy), service skeleton, `/opt/nexus` layout. Runtime is provisioned/extended via [`install/nexus-runtime.sh`](install/nexus-runtime.sh) (idempotent, re-runnable) | ✅ in production |
+| [nexus-db](ct/nexus-db.sh) | PostgreSQL 16 + pgvector for nexus — least-privilege role, pg_hba allowlist (only the nexus LXC), DSN handed over via credentials file | ✅ in production |
+| [authentik](ct/authentik.sh) | Central homelab IdP (official Docker Compose via LXC nesting) — headless bootstrap admin **and** API token for agent-driven blueprint configuration, blueprints mount, permanent auth domain (WebAuthn RP-ID) | ✅ in production |
+| [runner](ct/runner.sh) | General **instance-wide** Gitea Actions runner (label `homelab`) — Docker for throwaway CI test containers, deliberately **no** sudoers/deploy rights | ✅ in production |
+
+Run any one-liner on a Proxmox VE host as root:
+
+```bash
+bash -c "$(curl -fsSL https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/ct/<app>.sh)"
+```
 
 ## Usage
 
-Run any one-liner on a Proxmox VE host as root (Web UI → Node → Shell works fine). You'll be prompted for CTID, hostname, disk, RAM, CPU, bridge, storage and IP. Defaults are sane.
+Interactive prompts cover CTID, hostname, disk, RAM, CPU, bridge/VLAN, storage, IP/gateway/DNS — plus app-specific values. Defaults are sane. Non-interactive override via env vars:
-
-Non-interactive override via env vars:
 
 ```bash
 CTID=200 HOSTNAME=devpi DISK_SIZE=30 RAM=4096 CORES=4 IPCFG=dhcp \
   bash -c "$(curl -fsSL https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/ct/devpi.sh)"
 ```
 
-All defaults (`DEFAULT_HOSTNAME`, `DEFAULT_DISK`, …) are settable per-call via env vars as well.
+All defaults (`DEFAULT_HOSTNAME`, `DEFAULT_DISK`, …) and app config values are settable per call via env vars.
+
+Every input is validated (digits-only for CTID/disk/cores/RAM/VLAN, IP/CIDR/gateway format, hostname/storage charsets). Invalid interactive input re-prompts — including pasted values with invisible control/non-ASCII bytes, which are rejected rather than silently stripped. Env-provided values are validated too and abort the run when malformed (no re-prompt loop in non-interactive use).
+
+## The pattern
+
+Two files per app, both sourcing the shared libs via `curl`:
+
+- **`ct/<app>.sh`** runs on the PVE host: prompts → unprivileged LXC → pushes a config env file into the container → bootstraps the installer. Apps that need Docker (authentik, runner) enable `nesting+keyctl` automatically. The standard prompts include an **SSH root login choice** (`SSH_ROOT_LOGIN`, default yes for homelab convenience; `no` keeps the Debian key-only default) — applied inside the container as an sshd drop-in by `configure_ssh_root_login`.
+- **`install/<app>-install.sh`** runs inside the LXC: packages, unprivileged app user, secrets generated on-host (never printed), systemd units, a `/root/<app>.credentials` notes file — then shreds the bootstrap env. Idempotent where it matters: re-runs skip what exists. `setup_base_apt` also fixes the bare-template **locale situation**: `C.UTF-8` is exported up front (glibc built-in, covers the first apt run without perl warnings), then `en_US.UTF-8` is generated and set as the system default.
+
+**DB installers** carry one extra rule: a PostgreSQL cluster/database freezes its encoding at initdb / `CREATE DATABASE` time and it can never be changed afterwards. A C (non-UTF-8) locale yields a `SQL_ASCII` cluster — psycopg3 then hands text back as bytes and SQLAlchemy crashes. So the pattern (helpers `ensure_utf8_locale_active` + `assert_db_encoding_utf8` in `lib/install.func`) is: make a UTF-8 locale **active** before the server package runs initdb, create the database **explicitly** with `TEMPLATE template0 ENCODING 'UTF8' LC_COLLATE/LC_CTYPE 'en_US.UTF-8'` (never inherit the cluster default), and **verify** `pg_encoding_to_char` returns `UTF8` before finishing — a wrong encoding aborts the install (it's DB damage, see wiki → Lessons). Maintenance examples use `su - postgres -c …`, not `sudo` — these minimal LXCs have no sudo.
+
+Shared libs: [`lib/build.func`](lib/build.func) (host-side: prompts, LXC create, bootstrap) and [`lib/install.func`](lib/install.func) (in-container: apt, users, systemd, http-wait).
+
+## Security conventions
+
+- Unprivileged LXCs only; app processes run as dedicated system users.
+- Least privilege everywhere: narrow sudoers (exact-match commands — sudoers compares **verbatim incl. arguments**), DB allowlists, LAN-only binds for inference ports.
+- Secrets are generated on the target host and live in `0600` files — never in the repo, the wiki or chat logs.
+- **Runner separation:** the nexus runner is repo-scoped and lives on the production LXC *because* it holds deploy rights; the general `runner` LXC is instance-wide *because* it holds none. Don't mix these scopes.
+
+### CIS Tier-A hardening
+
+[`install/cis-tierA.sh`](install/cis-tierA.sh) applies the Tier-A baseline to an existing Debian 12 LXC: SSH drop-in, `login.defs` aging + YESCRYPT, pwquality/faillock, PAM (pwquality, pwhistory, faillock, `nullok` removed) and auditd rules. It is idempotent, backs everything up to `/root/cis-hardening-backup-<ts>/`, gates the SSH restart on `sshd -t` and rolls PAM back if a referenced module is missing.
+
+```bash
+pct push <id> install/cis-tierA.sh /root/cis-tierA.sh
+pct exec <id> -- bash /root/cis-tierA.sh
+```
+
+Applied to authentik first (2026-07-24), then to 11 further containers. The PVE hosts and the Wazuh manager VM stay unhardened on purpose — they are the break-glass foundation.
+
+Two things worth knowing before touching it:
+
+- **Section 1 rewrites `99-cis-hardening.conf` wholesale on every run.** Host-specific exceptions belong in a separate drop-in that sorts *after* it (e.g. `99-zz-local-forward.conf`), never in that file. A `Match` block extends until the next `Match` — across `Include` file boundaries — so such a drop-in has to stay alphabetically last.
+- **Forwarding is denied per option, not via `DisableForwarding`.** Both are equivalent in effect, but `DisableForwarding` overrides every other forwarding option *and* does not appear in `sshd -T` output. A denied port-forward then reports `administratively prohibited` while `sshd -T` cheerfully claims `allowtcpforwarding yes`, which costs hours to diagnose.
+
+Caveat: auditd is a no-op in unprivileged LXCs (the host owns the audit subsystem); the script probes for it and removes the package again if it cannot load rules. Together with the Section-1 partition/kernel checks that are equally N/A in a container, the achievable SCA score stays well below 100 %.
+
+## Contributing
+
+**All changes go through a pull request with cross-review** (Claude Code ↔ Codex, or a human) — no direct pushes to `main`. This rule exists because of two real incidents: a pasted VLAN tag carrying an invisible non-UTF-8 byte broke `pct create` mid-run, and the "missing `source build.func`" bug shipped twice — caught in review on the nexus-db PR, but reaching production via an un-reviewed authentik commit (see wiki → Lessons).
+
+CI (`.gitea/workflows/ci.yml`, instance-wide `homelab` runner from [ct/runner.sh](ct/runner.sh)) enforces on every PR: `bash -n` over all scripts, the "every `ct/*.sh` sources `build.func`" check ([tests/check_ct_source.sh](tests/check_ct_source.sh)) and the validation unit tests ([tests/test_validation.sh](tests/test_validation.sh)); shellcheck runs when available on the runner.
+
+Build new app prompts on `prompt_validated`/`require_valid` from `lib/build.func` instead of bare `read`. How to add a script: [docs/adding-a-script.md](docs/adding-a-script.md).
 
 ## Repo layout
 
 ```
 .
 ├── ct/                 # Host-side scripts, one per app
-├── install/            # In-container installers, one per app
+├── install/            # In-container installers (+ nexus-runtime.sh re-provisioner,
+│                       #   cis-tierA.sh hardening pass)
 ├── lib/
 │   ├── build.func      # Shared host-side helpers (prompts, LXC create, bootstrap)
 │   └── install.func    # Shared in-container helpers (apt, systemd, users, http-wait)
+├── tests/
+│   ├── test_validation.sh   # Unit tests for the input validation helpers
+│   └── check_ct_source.sh   # Every ct/*.sh must source build.func
 ├── docs/
 │   └── adding-a-script.md
 ├── README.md
 └── LICENSE
 ```
 
-## Adding a new script
+## Related
 
-See [docs/adding-a-script.md](docs/adding-a-script.md). Two files per app, both source the shared libs via `curl`.
+- [nexus-hub](https://gitea.luki-net.org/l.kirchner/nexus-hub) — Family Knowledge Hub (main consumer of nexus/nexus-db/authentik/runner)
+- [Wiki](https://gitea.luki-net.org/luki-net/proxmox-scripts/wiki) — per-app runbook pointers, conventions, lessons learned
 
 ## License
 

install/authentik-install.sh

@@ -29,6 +29,7 @@ CRED_FILE="/root/authentik.credentials"
 
 # ── base packages + Docker ────────────────────────────────────────────────────
 setup_base_apt ca-certificates curl
+configure_ssh_root_login
 if ! command -v docker >/dev/null 2>&1; then
   msg_info "Installing Docker (get.docker.com)..."
   curl -fsSL https://get.docker.com | sh >/dev/null

install/cis-tierA.sh

@@ -0,0 +1,163 @@
+#!/bin/bash
+# CIS Tier-A hardening for a Debian 12 LXC. Idempotent, backs up everything,
+# gates the SSH restart on `sshd -t`, auto-rolls-back PAM on sanity failure.
+# Recovery path if anything breaks: `pct exec <id> -- bash` from the PVE host.
+#
+# Rollout: copy into the target LXC and run as root, e.g.
+#   pct push <id> install/cis-tierA.sh /root/cis-tierA.sh
+#   pct exec <id> -- bash /root/cis-tierA.sh
+# First applied to authentik on 2026-07-24, then to 11 further containers.
+#
+# NOT hardened on purpose (break-glass foundation): the PVE hosts pve-gamer /
+# pve-i5 and the Wazuh manager VM. See the wiki for the break-glass chain.
+#
+# SSH: section 1 rewrites /etc/ssh/sshd_config.d/99-cis-hardening.conf WHOLESALE
+# on every run. Host-specific exceptions therefore do NOT belong in that file —
+# put them in a separate drop-in that sorts AFTER it, e.g.
+# 99-zz-local-forward.conf. Mind that a Match block extends until the next
+# Match, across Include file boundaries, so such a drop-in must stay last.
+#
+# Forwarding is denied per option (AllowTcpForwarding / AllowAgentForwarding /
+# AllowStreamLocalForwarding / X11Forwarding), not via DisableForwarding. Both
+# are equivalent in effect, but DisableForwarding overrides every other
+# forwarding option AND is invisible in `sshd -T` output — which makes a denied
+# port-forward practically undiagnosable. See the wiki entry on that.
+set -u
+TS=$(date +%Y%m%d-%H%M%S)
+BK=/root/cis-hardening-backup-$TS
+mkdir -p "$BK"
+export DEBIAN_FRONTEND=noninteractive
+say(){ echo "[cis] $*"; }
+
+########## 1. SSH hardening (drop-in, validated) ##########
+SSHD=/etc/ssh/sshd_config.d/99-cis-hardening.conf
+grep -q "Include /etc/ssh/sshd_config.d" /etc/ssh/sshd_config || echo "Include /etc/ssh/sshd_config.d/*.conf" > /tmp/_noinc
+[ -f "$SSHD" ] && cp "$SSHD" "$BK/" 2>/dev/null
+printf '%s\n' "Warning: Authorized access only. All activity is monitored." > /etc/issue.net
+cat > "$SSHD" <<'EOF'
+PermitRootLogin prohibit-password
+MaxAuthTries 4
+LoginGraceTime 60
+ClientAliveInterval 15
+ClientAliveCountMax 3
+Banner /etc/issue.net
+MaxStartups 10:30:60
+AllowTcpForwarding no
+AllowAgentForwarding no
+AllowStreamLocalForwarding no
+X11Forwarding no
+Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
+MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com
+KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512
+EOF
+if sshd -t 2>/tmp/sshderr; then
+  systemctl restart ssh 2>/dev/null || systemctl restart sshd 2>/dev/null
+  say "SSH: drop-in applied + restarted (sshd -t OK, active=$(systemctl is-active ssh 2>/dev/null || systemctl is-active sshd 2>/dev/null))"
+else
+  rm -f "$SSHD"; say "SSH: sshd -t FAILED -> reverted ($(cat /tmp/sshderr))"
+fi
+
+########## 2. login.defs (password aging + hashing) ##########
+cp /etc/login.defs "$BK/"
+setdef(){ if grep -qE "^\s*$1\b" /etc/login.defs; then sed -i -E "s|^\s*$1\b.*|$1 $2|" /etc/login.defs; else echo "$1 $2" >> /etc/login.defs; fi; }
+setdef PASS_MAX_DAYS 365
+setdef PASS_MIN_DAYS 1
+setdef PASS_WARN_AGE 7
+setdef ENCRYPT_METHOD YESCRYPT
+useradd -D -f 30 2>/dev/null
+say "login.defs: aging + YESCRYPT set"
+
+########## 3. pwquality ##########
+apt-get install -y libpam-pwquality >/dev/null 2>&1
+[ -f /etc/security/pwquality.conf ] && cp /etc/security/pwquality.conf "$BK/"
+cat > /etc/security/pwquality.conf <<'EOF'
+minlen = 14
+minclass = 4
+maxrepeat = 3
+dictcheck = 1
+enforcing = 1
+EOF
+[ -f /etc/security/faillock.conf ] && cp /etc/security/faillock.conf "$BK/"
+cat > /etc/security/faillock.conf <<'EOF'
+deny = 5
+unlock_time = 900
+fail_interval = 900
+EOF
+say "pwquality.conf + faillock.conf written"
+
+########## 4. PAM module enablement (backup + sanity + rollback) ##########
+CA=/etc/pam.d/common-auth
+CP=/etc/pam.d/common-password
+cp "$CA" "$BK/"; cp "$CP" "$BK/"
+
+# 5.3.3.4.1 remove nullok
+sed -i 's/[[:space:]]*nullok//g' "$CA" "$CP"
+
+# common-password: full, correctly-formed pwquality + pwhistory lines before pam_unix
+grep -q pam_pwquality.so "$CP" || sed -i '0,/^password[[:space:]].*pam_unix.so/s//password requisite pam_pwquality.so retry=3\n&/' "$CP"
+grep -q pam_pwhistory.so "$CP" || sed -i '0,/^password[[:space:]].*pam_unix.so/s//password required pam_pwhistory.so remember=5 use_authtok\n&/' "$CP"
+grep -qE 'pam_unix.so.*use_authtok' "$CP" || sed -i -E 's/(^password[[:space:]].*pam_unix.so.*)/\1 use_authtok/' "$CP"
+
+# common-auth: faillock preauth/authfail/authsucc (full lines, idempotent)
+if ! grep -q pam_faillock.so "$CA"; then
+  sed -i '1i auth required pam_faillock.so preauth' "$CA"
+  awk 'BEGIN{d=0}{print} (/pam_unix.so/ && d==0){print "auth [default=die] pam_faillock.so authfail"; print "auth sufficient pam_faillock.so authsucc"; d=1}' "$CA" > "$CA.tmp" && mv "$CA.tmp" "$CA"
+fi
+
+# sanity: every referenced module must exist; pam_unix + pam_deny must remain
+MODDIR=$(dirname "$(find /lib /usr/lib -name pam_unix.so 2>/dev/null | head -1)")
+ok=1
+for m in $(grep -hoE 'pam_[a-z_]+\.so' "$CA" "$CP" | sort -u); do
+  [ -f "$MODDIR/$m" ] || { say "PAM sanity: missing $m"; ok=0; }
+done
+grep -q pam_unix.so "$CA" && grep -q pam_unix.so "$CP" || ok=0
+if [ "$ok" != "1" ]; then
+  cp "$BK/common-auth" "$CA"; cp "$BK/common-password" "$CP"
+  say "PAM: sanity FAILED -> rolled back common-auth/common-password"
+else
+  say "PAM: pwquality/pwhistory/faillock enabled, nullok removed (sanity OK)"
+fi
+
+########## 5. auditd (probe LXC support) ##########
+apt-get install -y auditd audispd-plugins >/dev/null 2>&1
+AUOK=0
+if auditctl -l >/dev/null 2>&1 && auditctl -a always,exit -F arch=b64 -S adjtimex -k _probe 2>/dev/null; then
+  auditctl -d always,exit -F arch=b64 -S adjtimex -k _probe 2>/dev/null; AUOK=1
+fi
+if [ "$AUOK" = "1" ]; then
+  cp -n /etc/audit/rules.d/audit.rules "$BK/" 2>/dev/null
+  cat > /etc/audit/rules.d/cis.rules <<'EOF'
+-w /etc/group -p wa -k identity
+-w /etc/passwd -p wa -k identity
+-w /etc/shadow -p wa -k identity
+-w /etc/gshadow -p wa -k identity
+-w /etc/security/opasswd -p wa -k identity
+-w /etc/sudoers -p wa -k scope
+-w /etc/sudoers.d/ -p wa -k scope
+-w /var/log/sudo.log -p wa -k sudo_log
+-a always,exit -F arch=b64 -S adjtimex,settimeofday,clock_settime -k time-change
+-a always,exit -F arch=b64 -S sethostname,setdomainname -k system-locale
+-w /etc/hosts -p wa -k system-locale
+-w /etc/network/ -p wa -k system-locale
+-w /var/log/wtmp -p wa -k session
+-w /var/log/btmp -p wa -k session
+-w /var/run/utmp -p wa -k session
+-w /var/log/lastlog -p wa -k logins
+-w /var/run/faillock/ -p wa -k logins
+-a always,exit -F arch=b64 -S mount -F auid>=1000 -F auid!=4294967295 -k mounts
+-a always,exit -F arch=b64 -S unlink,unlinkat,rename,renameat -F auid>=1000 -F auid!=4294967295 -k delete
+-a always,exit -F arch=b64 -S chmod,fchmod,fchmodat,chown,fchown,fchownat,lchown -F auid>=1000 -F auid!=4294967295 -k perm_mod
+-a always,exit -F arch=b64 -S init_module,delete_module,finit_module -k modules
+-w /usr/sbin/usermod -p x -k usermod
+EOF
+  systemctl enable auditd >/dev/null 2>&1
+  augenrules --load >/dev/null 2>&1
+  systemctl restart auditd 2>/dev/null || service auditd restart 2>/dev/null
+  say "auditd: FUNCTIONAL in this LXC -> CIS rules loaded ($(auditctl -l 2>/dev/null | wc -l) rules)"
+else
+  systemctl disable --now auditd >/dev/null 2>&1
+  apt-get purge -y auditd audispd-plugins >/dev/null 2>&1
+  say "auditd: NOT supported in this LXC (host owns audit subsystem) -> N/A, removed"
+fi
+
+say "DONE. Backup: $BK"

install/devpi-install.sh

@@ -19,6 +19,7 @@ DEVPI_PORT="3141"
 
 # ── packages + user + dirs ───────────────────────────────────────────────────
 setup_base_apt python3 python3-venv python3-pip
+configure_ssh_root_login
 
 create_system_user "$DEVPI_USER" "$DEVPI_HOME"
 mkdir -p "$DEVPI_DATA"

install/nexus-db-install.sh

@@ -36,6 +36,7 @@ CRED_FILE="/root/nexus-db.credentials"
 
 # ── packages: PGDG repo + PostgreSQL 16 + pgvector ────────────────────────────
 setup_base_apt curl ca-certificates gnupg lsb-release
+configure_ssh_root_login
 
 if [[ ! -f /etc/apt/sources.list.d/pgdg.sources ]] && [[ ! -f /etc/apt/sources.list.d/pgdg.list ]]; then
   msg_info "Adding PGDG apt repo..."
@@ -46,6 +47,12 @@ else
   msg_warn "PGDG repo already present, skipping"
 fi
 
+# The server package runs initdb for the `main` cluster on install — its
+# encoding is frozen there. Make a UTF-8 locale active for THIS process first
+# so the cluster is never created as SQL_ASCII (issue #8: a pre-fix LXC was
+# provisioned under LANG=C and ended up SQL_ASCII).
+ensure_utf8_locale_active en_US.UTF-8
+
 msg_info "Installing PostgreSQL $PG_MAJOR + pgvector..."
 apt-get install -y -qq "postgresql-$PG_MAJOR" "postgresql-$PG_MAJOR-pgvector" >/dev/null
 msg_ok "PostgreSQL $(psql --version | awk '{print $3}') installed"
@@ -94,6 +101,13 @@ systemctl restart postgresql
 # ── role + database + extension (idempotent, password kept on re-run) ─────────
 run_psql() { runuser -u postgres -- psql -v ON_ERROR_STOP=1 -qAt "$@"; }
 
+# Re-run safety (issue #8): if the database already exists, verify its
+# encoding BEFORE touching roles/passwords. An old SQL_ASCII database must
+# abort the run with NO side effects — not after rotating credentials.
+if [[ "$(run_psql -c "SELECT 1 FROM pg_database WHERE datname='$DB_NAME'")" == "1" ]]; then
+  assert_db_encoding_utf8 "$DB_NAME"
+fi
+
 if [[ "$(run_psql -c "SELECT 1 FROM pg_roles WHERE rolname='$DB_USER'")" != "1" ]]; then
   msg_info "Creating role $DB_USER + database $DB_NAME..."
   DB_PASS="$(openssl rand -base64 32 | tr -d '/+=' | head -c 32)"
@@ -113,12 +127,18 @@ else
 fi
 
 if [[ "$(run_psql -c "SELECT 1 FROM pg_database WHERE datname='$DB_NAME'")" != "1" ]]; then
-  run_psql -c "CREATE DATABASE $DB_NAME OWNER $DB_USER"
+  # Explicit encoding/collation from template0 — never inherit the cluster
+  # default, which may be SQL_ASCII if initdb ran under a broken locale
+  # (issue #8). template0 is required to override LC_COLLATE/LC_CTYPE.
+  run_psql -c "CREATE DATABASE $DB_NAME OWNER $DB_USER ENCODING 'UTF8' LC_COLLATE 'en_US.UTF-8' LC_CTYPE 'en_US.UTF-8' TEMPLATE template0"
   # Only the owner may connect — no PUBLIC access.
   run_psql -c "REVOKE CONNECT ON DATABASE $DB_NAME FROM PUBLIC"
-  msg_ok "Database $DB_NAME created (owner $DB_USER, PUBLIC revoked)"
+  # Verify what we just created (the pre-existing case was already checked
+  # before the role block, issue #8).
+  assert_db_encoding_utf8 "$DB_NAME"
+  msg_ok "Database $DB_NAME created (UTF8, owner $DB_USER, PUBLIC revoked)"
 else
-  msg_warn "Database $DB_NAME already exists, skipping"
+  msg_warn "Database $DB_NAME already exists, skipping creation"
 fi
 
 # pgvector: CREATE EXTENSION needs superuser; installed now (per ADR-0002:
@@ -140,9 +160,12 @@ Password: $DB_PASS
 DSN for /etc/nexus/env on the nexus LXC (NEXUS_DATABASE_URL):
   postgresql+psycopg://$DB_USER:$DB_PASS@$IP_SELF:$DB_PORT/$DB_NAME
 
+Encoding: UTF8 (LC_COLLATE/LC_CTYPE en_US.UTF-8) — verified at install time.
+
 Access policy (pg_hba): only $NEXUS_APP_IP/32 may connect; all other
-hosts are rejected. Local socket stays peer-auth for maintenance:
+hosts are rejected. Local socket stays peer-auth for maintenance (these
-  pct exec <CTID> -- runuser -u postgres -- psql -d $DB_NAME
+minimal LXCs have no sudo — use su, not sudo):
+  pct exec <CTID> -- su - postgres -c "psql -d $DB_NAME"
 EOF
   chmod 600 "$CRED_FILE"
   msg_ok "Credentials written to $CRED_FILE (chmod 600)"

install/nexus-install.sh

@@ -46,6 +46,7 @@ run_user() { runuser -u "$APP_USER" -- env HOME="$APP_HOME" "$@"; }
 
 # ── packages: git + rsync + sudo ; Node.js via NodeSource ─────────────────────
 setup_base_apt git rsync sudo
+configure_ssh_root_login
 
 NODE_HAVE="$(command -v node >/dev/null 2>&1 && node -v | sed -E 's/^v([0-9]+).*/\1/' || echo 0)"
 if [[ "$NODE_HAVE" != "$NODE_MAJOR" ]]; then

install/runner-install.sh

@@ -63,8 +63,34 @@ valid_token_word "$RUNNER_LABELS" || { msg_err "RUNNER_LABELS enthält unzuläss
 # der unprivilegierte User darf dort nicht schreiben.
 run_user() { runuser -u "$APP_USER" -- env -C "$RUNNER_DIR" HOME="$APP_HOME" "$@"; }
 
-# ── Pakete: git/rsync, Node (checkout-Action), Docker (Test-Container) ────────
+# ── Pakete: git/rsync, Node (checkout-Action), Docker (Test-Container),
-setup_base_apt git rsync ca-certificates curl
+#    Build-Werkzeuge (Compiler-Sprachen in CI) ─────────────────────────────────
+#
+# make/gcc/protobuf: Der Runner faehrt Host-Mode, also gibt es kein Image, das
+# Werkzeuge mitbringt — was hier nicht liegt, hat kein Job. Konkret gemessen an
+# l.kirchner/patchmgr (Go):
+#   make                 "make: command not found" in jedem Gate-Job
+#   gcc                  ohne gefundenen C-Compiler bleibt cgo aus (go env
+#                        meldet dann CGO_ENABLED=0), und "go test -race" ist
+#                        nicht baubar
+#   protobuf-compiler    protoc fuer die Codegenerierung
+#   libprotobuf-dev      liefert /usr/include/google/protobuf/*.proto; ohne die
+#                        Includes scheitert protoc trotz vorhandenem Binary
+#
+# ACHTUNG protoc: Das bindet jedes Repo der Instanz an die protoc-Fassung der
+# Distribution (Debian 12: 3.21.x). Anders als make/gcc ist protoc ein
+# Codegenerator — ein Distro-Upgrade aendert erzeugten Code fuer alle Nutzer
+# gleichzeitig. Wer eine eigene Fassung braucht, pinnt sie im Projekt
+# (Release-Tarball, buf, oder Docker — der Runner hat Docker) statt sie hier
+# zu heben.
+#
+# Bewusst NICHT installiert: sudo. Ein Workflow soll auf diesem Runner nichts
+# nachinstallieren koennen — was gebraucht wird, steht hier.
+#
+# Go selbst gehoert nicht hierher: Projekte holen es ueber actions/setup-go,
+# weil CI-Matrizen mehrere Fassungen fahren.
+setup_base_apt git rsync ca-certificates curl \
+  make gcc protobuf-compiler libprotobuf-dev
 
 NODE_HAVE="$(command -v node >/dev/null 2>&1 && node -v | sed -E 's/^v([0-9]+).*/\1/' || echo 0)"
 if [[ "$NODE_HAVE" != "$NODE_MAJOR" ]]; then

install/webapp-install.sh

@@ -44,6 +44,7 @@ run_user() { runuser -u "$APP_USER" -- env HOME="$APP_HOME" "$@"; }
 
 # ── packages: git + rsync + sudo ; Node.js via NodeSource ────────────────────
 setup_base_apt git rsync sudo
+configure_ssh_root_login
 
 NODE_HAVE="$(command -v node >/dev/null 2>&1 && node -v | sed -E 's/^v([0-9]+).*/\1/' || echo 0)"
 if [[ "$NODE_HAVE" != "$NODE_MAJOR" ]]; then

lib/build.func

@@ -97,55 +97,204 @@ apply_network_profile() {
   return 0
 }
 
+# ── input validation (K-114) ─────────────────────────────────────────────────
+# Real incident 2026-06-11: a pasted VLAN tag carried an invisible non-UTF-8
+# byte and broke `pct create` deep in the run. Policy: trim CR/edge whitespace,
+# but NEVER silently strip junk inside a value — embedded control/non-ASCII
+# bytes fail validation and trigger a visible re-prompt.
+
+# Trim \r and leading/trailing whitespace (edges only).
+sanitize_input() {
+  local s="${1-}"
+  s="${s//$'\r'/}"
+  s="${s#"${s%%[![:space:]]*}"}"
+  s="${s%"${s##*[![:space:]]}"}"
+  printf '%s' "$s"
+}
+
+# True if the value contains only printable ASCII (no control/non-ASCII
+# bytes). Byte-exact via tr: delete all printable ASCII — anything left
+# over is junk.
+is_clean_ascii() {
+  # Newline/Tab zuerst explizit ablehnen — $(…) strippt trailing newlines,
+  # die der tr-Pfad sonst übersehen würde (Review-Finding K-114).
+  [[ "$1" == *$'\n'* || "$1" == *$'\t'* ]] && return 1
+  local leftover
+  leftover="$(printf '%s' "$1" | LC_ALL=C tr -d '\40-\176')"
+  [[ -z "$leftover" ]]
+}
+
+is_uint()     { is_clean_ascii "$1" && [[ "$1" =~ ^[0-9]+$ ]]; }
+# 10#: führende Nullen nicht als Oktal werten ("08" wäre sonst ein
+# Arithmetik-Fehler statt einer sauberen Ablehnung/Annahme).
+is_vlan_tag() { is_uint "$1" && (( 10#$1 >= 1 && 10#$1 <= 4094 )); }
+is_token()    { is_clean_ascii "$1" && [[ "$1" =~ ^[A-Za-z0-9._-]+$ ]]; }
+is_hostname() { is_clean_ascii "$1" && [[ "$1" =~ ^[A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?$ ]]; }
+
+is_ipv4() {
+  is_clean_ascii "$1" && [[ "$1" =~ ^([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})$ ]] || return 1
+  local o
+  for o in "${BASH_REMATCH[@]:1:4}"; do (( 10#$o <= 255 )) || return 1; done
+  return 0
+}
+
+is_cidr() {
+  [[ "$1" =~ ^([0-9.]+)/([0-9]{1,2})$ ]] || return 1
+  # BASH_REMATCH retten — is_ipv4 nutzt selbst =~ und überschreibt es.
+  local _ip="${BASH_REMATCH[1]}" _prefix="${BASH_REMATCH[2]}"
+  is_ipv4 "$_ip" && (( 10#$_prefix >= 1 && 10#$_prefix <= 32 ))
+}
+
+is_ipcfg() { [[ "$1" == "dhcp" ]] || is_cidr "$1"; }
+
+# Ja/Nein-Antworten (Prompts wie "… erlauben? [Y/n]"). Akzeptiert
+# deutsch/englisch, normalize_yesno macht daraus kanonisch yes|no.
+is_yesno() { is_clean_ascii "$1" && [[ "${1,,}" =~ ^(y|yes|j|ja|n|no|nein)$ ]]; }
+normalize_yesno() {
+  case "${1,,}" in
+    y|yes|j|ja) printf 'yes' ;;
+    *)          printf 'no' ;;
+  esac
+}
+
+# Space/comma-separated list of IPv4s (DNS prompt). Gesamtstring zuerst
+# prüfen — die Wort-Splittung würde eingebettete Newlines sonst verstecken.
+is_ipv4_list() {
+  is_clean_ascii "$1" || return 1
+  local item
+  for item in ${1//,/ }; do is_ipv4 "$item" || return 1; done
+  [[ -n "$1" ]]
+}
+
+# prompt_validated VARNAME PROMPT VALIDATOR [DEFAULT] [allow_empty]
+# Reads into VARNAME (nameref, no subshell), sanitizes, applies the default on
+# empty input and re-prompts until the validator passes. allow_empty=yes lets
+# an empty value through (e.g. "no VLAN").
+prompt_validated() {
+  # Schutz vor zirkulärem nameref (Review-Finding): interne Namen tabu.
+  [[ "$1" == _pv_* || "$1" == _rv_* ]] && { msg_err "prompt_validated: reserved variable name '$1'"; return 2; }
+  local -n _pv_ref="$1"
+  local _pv_prompt="$2" _pv_validator="$3" _pv_default="${4-}" _pv_allow_empty="${5:-no}"
+  local _pv_value
+  while true; do
+    if ! read -rp "$_pv_prompt" _pv_value; then
+      # EOF (kein TTY / stdin erschöpft): kein Endlos-Loop, sauber raus —
+      # unter set -e bricht der Caller damit kontrolliert ab.
+      msg_err "No input available for prompt: ${_pv_prompt%% *}"
+      return 1
+    fi
+    _pv_value="$(sanitize_input "$_pv_value")"
+    if [[ -z "$_pv_value" && -n "$_pv_default" ]]; then
+      _pv_value="$_pv_default"
+    fi
+    if [[ -z "$_pv_value" ]]; then
+      if [[ "$_pv_allow_empty" == "yes" ]]; then _pv_ref=""; return 0; fi
+      msg_warn "A value is required."
+      continue
+    fi
+    if "$_pv_validator" "$_pv_value"; then
+      _pv_ref="$_pv_value"
+      return 0
+    fi
+    if ! is_clean_ascii "$_pv_value"; then
+      msg_warn "Input contains invisible/non-ASCII characters — please re-type (do not paste)."
+    else
+      msg_warn "Invalid value: '$_pv_value' — please retry."
+    fi
+  done
+}
+
+# Validate an env-provided value (non-interactive: abort instead of re-prompt).
+require_valid() {
+  [[ "$1" == _pv_* || "$1" == _rv_* ]] && { msg_err "require_valid: reserved variable name '$1'"; return 2; }
+  local -n _rv_ref="$1"
+  local _rv_validator="$2" _rv_label="$3"
+  _rv_ref="$(sanitize_input "$_rv_ref")"
+  "$_rv_validator" "$_rv_ref" || { msg_err "$_rv_label invalid: '$_rv_ref'"; exit 1; }
+}
+
 # ── prompts ──────────────────────────────────────────────────────────────────
-# Each prompt is skipped if the corresponding variable is already set in env.
+# Each prompt is skipped if the corresponding variable is already set in env
+# (env values are still validated — abort on invalid, no silent use).
 # VLAN_TAG and NAMESERVER use ${VAR+x} so that explicitly setting them to ""
 # via env skips the prompt (= "no VLAN" / "inherit DNS from host").
 prompt_lxc_config() {
   if [[ -z "${CTID:-}" ]]; then
-    read -rp "Container ID [auto]: " CTID
+    # Eigener Loop statt prompt_validated: leer = auto (pvesh nextid),
-    [[ -z "${CTID:-}" ]] && CTID=$(pvesh get /cluster/nextid)
+    # ungültig = Re-Prompt (Review-Finding: vorher Abbruch statt Re-Prompt).
+    while true; do
+      if ! read -rp "Container ID [auto]: " CTID; then
+        msg_err "No input available for prompt: Container ID"
+        return 1
+      fi
+      CTID="$(sanitize_input "$CTID")"
+      if [[ -z "$CTID" ]]; then
+        CTID=$(pvesh get /cluster/nextid)
+        break
+      fi
+      is_uint "$CTID" && break
+      msg_warn "Invalid value: '$CTID' — please retry (digits only)."
+    done
+  else
+    require_valid CTID is_uint "Container ID"
   fi
   echo "  → CTID: $CTID"
 
   if [[ -z "${CT_HOSTNAME:-}" ]]; then
-    read -rp "Hostname [$DEFAULT_HOSTNAME]: " CT_HOSTNAME
+    prompt_validated CT_HOSTNAME "Hostname [$DEFAULT_HOSTNAME]: " is_hostname "$DEFAULT_HOSTNAME"
-    CT_HOSTNAME="${CT_HOSTNAME:-$DEFAULT_HOSTNAME}"
+  else
+    require_valid CT_HOSTNAME is_hostname "Hostname"
   fi
   if [[ -z "${DISK_SIZE:-}" ]]; then
-    read -rp "Disk size in GB [$DEFAULT_DISK]: " DISK_SIZE
+    prompt_validated DISK_SIZE "Disk size in GB [$DEFAULT_DISK]: " is_uint "$DEFAULT_DISK"
-    DISK_SIZE="${DISK_SIZE:-$DEFAULT_DISK}"
+  else
+    require_valid DISK_SIZE is_uint "Disk size"
   fi
   if [[ -z "${CORES:-}" ]]; then
-    read -rp "vCPU cores [$DEFAULT_CORES]: " CORES
+    prompt_validated CORES "vCPU cores [$DEFAULT_CORES]: " is_uint "$DEFAULT_CORES"
-    CORES="${CORES:-$DEFAULT_CORES}"
+  else
+    require_valid CORES is_uint "vCPU cores"
   fi
   if [[ -z "${RAM:-}" ]]; then
-    read -rp "RAM in MB [$DEFAULT_RAM]: " RAM
+    prompt_validated RAM "RAM in MB [$DEFAULT_RAM]: " is_uint "$DEFAULT_RAM"
-    RAM="${RAM:-$DEFAULT_RAM}"
+  else
+    require_valid RAM is_uint "RAM"
   fi
   if [[ -z "${BRIDGE:-}" ]]; then
-    read -rp "Bridge [$DEFAULT_BRIDGE]: " BRIDGE
+    prompt_validated BRIDGE "Bridge [$DEFAULT_BRIDGE]: " is_token "$DEFAULT_BRIDGE"
-    BRIDGE="${BRIDGE:-$DEFAULT_BRIDGE}"
+  else
+    require_valid BRIDGE is_token "Bridge"
   fi
   if [[ -z "${VLAN_TAG+x}" ]]; then
-    read -rp "VLAN tag (empty for none): " VLAN_TAG
+    # The 2026-06-11 incident prompt: junk bytes re-prompt, empty = no VLAN.
+    prompt_validated VLAN_TAG "VLAN tag (empty for none): " is_vlan_tag "" yes
+  elif [[ -n "${VLAN_TAG:-}" ]]; then
+    require_valid VLAN_TAG is_vlan_tag "VLAN tag"
   fi
   if [[ -z "${TEMPLATE_STORAGE:-}" ]]; then
-    read -rp "Template storage [$DEFAULT_TEMPLATE_STORAGE]: " TEMPLATE_STORAGE
+    prompt_validated TEMPLATE_STORAGE \
-    TEMPLATE_STORAGE="${TEMPLATE_STORAGE:-$DEFAULT_TEMPLATE_STORAGE}"
+      "Template storage [$DEFAULT_TEMPLATE_STORAGE]: " is_token "$DEFAULT_TEMPLATE_STORAGE"
+  else
+    require_valid TEMPLATE_STORAGE is_token "Template storage"
   fi
   if [[ -z "${ROOTFS_STORAGE:-}" ]]; then
-    read -rp "Rootfs storage [$DEFAULT_ROOTFS_STORAGE]: " ROOTFS_STORAGE
+    prompt_validated ROOTFS_STORAGE \
-    ROOTFS_STORAGE="${ROOTFS_STORAGE:-$DEFAULT_ROOTFS_STORAGE}"
+      "Rootfs storage [$DEFAULT_ROOTFS_STORAGE]: " is_token "$DEFAULT_ROOTFS_STORAGE"
+  else
+    require_valid ROOTFS_STORAGE is_token "Rootfs storage"
   fi
   if [[ -z "${IPCFG:-}" ]]; then
-    read -rp "Network: IP/CIDR or 'dhcp' [dhcp]: " IPCFG
+    prompt_validated IPCFG "Network: IP/CIDR or 'dhcp' [dhcp]: " is_ipcfg "dhcp"
-    IPCFG="${IPCFG:-dhcp}"
+  else
+    require_valid IPCFG is_ipcfg "Network (IP/CIDR or dhcp)"
   fi
   GATEWAY="${GATEWAY:-}"
-  if [[ "$IPCFG" != "dhcp" && -z "$GATEWAY" ]]; then
+  if [[ "$IPCFG" != "dhcp" ]]; then
-    read -rp "Gateway: " GATEWAY
+    if [[ -z "$GATEWAY" ]]; then
+      prompt_validated GATEWAY "Gateway: " is_ipv4
+    else
+      require_valid GATEWAY is_ipv4 "Gateway"
+    fi
   fi
   # DNS is driven by the VLAN tag via the network profile (lib/networks.conf),
   # so the right resolvers get set even with DHCP. Precedence:
@@ -155,17 +304,34 @@ prompt_lxc_config() {
   #   4. DHCP, no profile                                  → inherit from host
   apply_network_profile
   if [[ -n "${NAMESERVER+x}" ]]; then
-    :  # explicit override from env, leave untouched
+    # Explizites Override aus env: "" = inherit bleibt erlaubt, aber ein
+    # gesetzter Wert wird validiert (Review-Finding: lief vorher ungeprüft
+    # bis in pct create).
+    if [[ -n "${NAMESERVER:-}" ]]; then
+      require_valid NAMESERVER is_ipv4_list "DNS server"
+    fi
   elif [[ -n "$PROFILE_DNS" ]]; then
     NAMESERVER="$PROFILE_DNS"
     msg_info "DNS for VLAN ${VLAN_TAG:-none} (${PROFILE_SUBNET:-?}): $NAMESERVER"
   elif [[ "$IPCFG" != "dhcp" ]]; then
     local default_ns="${DEFAULT_NAMESERVER:-$GATEWAY}"
-    read -rp "DNS server [$default_ns] (empty = inherit from PVE host): " NAMESERVER
+    prompt_validated NAMESERVER \
-    NAMESERVER="${NAMESERVER:-$default_ns}"
+      "DNS server [$default_ns] (empty = inherit from PVE host): " \
+      is_ipv4_list "$default_ns" yes
   else
     msg_warn "No network profile for VLAN ${VLAN_TAG:-none}; DHCP DNS will be inherited."
   fi
+
+  # SSH-Root-Login (Default: ja, Homelab-Komfort). Umgesetzt wird das im
+  # Install-Pfad per sshd-Drop-in (configure_ssh_root_login, lib/install.func);
+  # bootstrap_install_script reicht den normalisierten Wert in den Container.
+  if [[ -z "${SSH_ROOT_LOGIN:-}" ]]; then
+    prompt_validated SSH_ROOT_LOGIN "SSH-Root-Login erlauben? [Y/n]: " is_yesno "y"
+  else
+    require_valid SSH_ROOT_LOGIN is_yesno "SSH root login (y/n)"
+  fi
+  SSH_ROOT_LOGIN="$(normalize_yesno "$SSH_ROOT_LOGIN")"
+  echo "  → SSH root login: $SSH_ROOT_LOGIN"
 }
 
 # ── template ─────────────────────────────────────────────────────────────────
@@ -263,7 +429,9 @@ bootstrap_install_script() {
   pct exec "$CTID" -- bash -c "apt-get update -qq && apt-get install -y -qq curl ca-certificates >/dev/null"
 
   msg_info "Running installer ($url)..."
-  pct exec "$CTID" -- bash -c "curl -fsSL '$url' -o /root/${APP}-install.sh && bash /root/${APP}-install.sh"
+  # SSH_ROOT_LOGIN ist durch normalize_yesno kanonisch yes|no — als Env in
+  # den Container durchreichen (configure_ssh_root_login wertet es aus).
+  pct exec "$CTID" -- bash -c "curl -fsSL '$url' -o /root/${APP}-install.sh && SSH_ROOT_LOGIN='${SSH_ROOT_LOGIN:-yes}' bash /root/${APP}-install.sh"
 }
 
 # ── summary ──────────────────────────────────────────────────────────────────

lib/install.func

@@ -15,10 +15,14 @@ msg_warn() { echo -e "${YELLOW}[!]${NC} $*"; }
 msg_err()  { echo -e "${RED}[✗]${NC} $*" >&2; }
 
 # ── apt ──────────────────────────────────────────────────────────────────────
-# Always installs: ca-certificates curl openssl tzdata gnupg
+# Always installs: ca-certificates curl openssl tzdata gnupg locales
 # Additional packages can be passed as args.
 setup_base_apt() {
   export DEBIAN_FRONTEND=noninteractive
+  # C.UTF-8 ist in glibc eingebaut und damit schon VOR dem locales-Paket
+  # verfügbar — deckt den ersten apt/dpkg-Lauf ab (keine perl-Warnungen
+  # "Setting locale failed" mehr, LXC-Templates kommen ohne Locale).
+  export LANG=C.UTF-8 LC_ALL=C.UTF-8
   msg_info "Updating apt index..."
   apt-get update -qq
   if [[ $# -gt 0 ]]; then
@@ -27,17 +31,113 @@ setup_base_apt() {
     msg_info "Installing base packages..."
   fi
   apt-get install -y -qq \
-    ca-certificates curl openssl tzdata gnupg \
+    ca-certificates curl openssl tzdata gnupg locales \
     "$@" \
     >/dev/null
+  setup_locales
   msg_ok "apt setup complete"
 }
 
+# en_US.UTF-8 generieren und systemweit als Default setzen; C.UTF-8 braucht
+# keine Generierung (glibc-built-in). Idempotent: sed greift nur auf die
+# auskommentierte Zeile, locale-gen/update-locale sind re-run-sicher.
+setup_locales() {
+  msg_info "Generating locales (en_US.UTF-8; C.UTF-8 built-in)..."
+  sed -i 's/^# *en_US\.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen
+  locale-gen >/dev/null
+  update-locale LANG=en_US.UTF-8
+  msg_ok "Default locale: en_US.UTF-8"
+}
+
 apt_cleanup() {
   apt-get autoremove -y -qq >/dev/null || true
   apt-get autoclean -qq >/dev/null || true
 }
 
+# ── database installers: UTF-8 locale before initdb ──────────────────────────
+# Pattern for every DB installer. A PostgreSQL cluster/database freezes its
+# encoding at initdb / CREATE DATABASE time and it cannot be changed later —
+# a C (non-UTF-8) locale yields a SQL_ASCII cluster. psycopg3 then returns
+# text as bytes and SQLAlchemy crashes on server-version detection; the app
+# reports "db: unreachable". So: GENERATE the UTF-8 locale AND make it active
+# for THIS process before the server package runs its automatic initdb, then
+# fail loudly if it is not actually available (generating alone is not enough
+# — the locale must be active when initdb runs).
+# Generates+activates a UTF-8 locale (default en_US.UTF-8); the argument
+# honours other UTF-8 locales consistently (match, locale.gen line and the
+# exported value all derive from it). Matching normalises case and dashes so
+# the canonical `en_US.UTF-8` matches `locale -a`'s `en_US.utf8`.
+ensure_utf8_locale_active() {
+  local loc="${1:-en_US.UTF-8}"
+  local norm; norm="$(printf '%s' "$loc" | tr 'A-Z' 'a-z' | tr -d '-')"
+  _locale_present() { locale -a 2>/dev/null | tr 'A-Z' 'a-z' | tr -d '-' | grep -qx "$norm"; }
+  msg_info "Ensuring $loc is generated and active (DB encoding is frozen at initdb)..."
+  if ! _locale_present; then
+    # Uncomment the matching `# <loc> UTF-8` line, then generate.
+    sed -i "s/^# *${loc} UTF-8/${loc} UTF-8/" /etc/locale.gen
+    locale-gen >/dev/null
+  fi
+  if ! _locale_present; then
+    msg_err "Locale $loc not available after locale-gen — refusing to continue (initdb would create a SQL_ASCII cluster)"
+    return 1
+  fi
+  # Activate for the current process so any automatic initdb during the
+  # server package install inherits a UTF-8 locale, not the bare-template C.
+  export LANG="$loc" LC_ALL="$loc"
+  msg_ok "Locale active for initdb: LANG=$LANG"
+}
+
+# Post-install guard: a database MUST be UTF8. Encoding is irreversible, so a
+# wrong value is database damage — abort with a clear, actionable message
+# instead of shipping a broken cluster. Uses argv-clean `runuser ... psql`
+# with a quoted :'db' literal binding (robust regardless of caller); the
+# credentials/README docs use `su - postgres -c` for hand maintenance (these
+# minimal LXCs have no sudo).
+assert_db_encoding_utf8() {
+  local db="$1" enc
+  enc="$(runuser -u postgres -- psql -X -qAt -v db="$db" \
+    -c "SELECT pg_encoding_to_char(encoding) FROM pg_database WHERE datname = :'db'")"
+  if [[ "$enc" != "UTF8" ]]; then
+    msg_err "Database '$db' has encoding '${enc:-<not found>}', expected UTF8."
+    msg_err "Encoding is frozen at creation time — this is DB damage, not cosmetic."
+    msg_err "Fix: regenerate the locale (locale-gen en_US.UTF-8) and recreate the DB"
+    msg_err "     with: CREATE DATABASE $db ... TEMPLATE template0 ENCODING 'UTF8'"
+    msg_err "          LC_COLLATE 'en_US.UTF-8' LC_CTYPE 'en_US.UTF-8';"
+    return 1
+  fi
+  msg_ok "Encoding check: database '$db' is UTF8"
+}
+
+# ── ssh ──────────────────────────────────────────────────────────────────────
+# SSH-Root-Login gemäß Host-Prompt (prompt_lxc_config setzt SSH_ROOT_LOGIN,
+# bootstrap_install_script reicht es als Env durch; Default: yes).
+#   yes → PermitRootLogin yes (Passwort-Login mit dem generierten Root-Passwort)
+#   no  → PermitRootLogin prohibit-password (Debian-Default, nur SSH-Key)
+# Umsetzung als Drop-in, damit Paket-Updates von sshd_config nicht kollidieren.
+configure_ssh_root_login() {
+  local choice="${SSH_ROOT_LOGIN:-yes}" value
+  case "$choice" in
+    yes) value="yes" ;;
+    no)  value="prohibit-password" ;;
+    *)   msg_err "SSH_ROOT_LOGIN must be yes|no, got: '$choice'"; return 1 ;;
+  esac
+
+  if [[ ! -d /etc/ssh/sshd_config.d ]]; then
+    if [[ "$choice" == "no" ]]; then
+      msg_warn "openssh-server not installed — nothing to configure (root login stays off)"
+      return 0
+    fi
+    msg_info "Installing openssh-server..."
+    apt-get install -y -qq openssh-server >/dev/null
+  fi
+
+  msg_info "Configuring SSH root login: PermitRootLogin $value"
+  printf 'PermitRootLogin %s\n' "$value" >/etc/ssh/sshd_config.d/zz-root-login.conf
+  systemctl reload ssh 2>/dev/null || systemctl restart ssh 2>/dev/null \
+    || msg_warn "ssh.service not active yet — config applies on first start"
+  msg_ok "SSH root login: $choice"
+}
+
 # ── users / dirs ─────────────────────────────────────────────────────────────
 create_system_user() {
   local user="$1" home="$2"

tests/check_ct_source.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# K-114: Jedes ct/*.sh MUSS lib/build.func sourcen — der Bug "Helfer nicht
+# gesourct, Skript stirbt erst mitten im Lauf" ist zweimal real passiert
+# (nexus-db: im Review gefangen; authentik: erst in Produktion).
+# Aufruf: tests/check_ct_source.sh [verzeichnis]  (Default: ct/)
+#
+# Bewusst eng: akzeptiert wird NUR die curl-Prozesssubstitutions-Form
+# `source <(curl ... build.func)` — das ist der Repo-Vertrag für ct/-Scripts
+# (Review-Triage K-114). Lokales Sourcen gehört nicht in ct/*.sh.
+set -euo pipefail
+
+DIR="${1:-$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)/ct}"
+status=0
+
+shopt -s nullglob
+scripts=("$DIR"/*.sh)
+if [[ ${#scripts[@]} -eq 0 ]]; then
+  echo "no scripts found in $DIR" >&2
+  exit 1
+fi
+
+for script in "${scripts[@]}"; do
+  if grep -Eq 'source[[:space:]]+<\(curl[^)]*build\.func' "$script"; then
+    echo "ok     $script"
+  else
+    echo "FEHLT  $script — sourct lib/build.func nicht" >&2
+    status=1
+  fi
+done
+exit "$status"

tests/test_validation.sh

@@ -0,0 +1,200 @@
+#!/usr/bin/env bash
+# K-114: Unit-Tests für die Input-Validierung in lib/build.func.
+# Läuft ohne PVE (sourct nur die Helfer). Aufruf: bash tests/test_validation.sh
+set -u
+
+REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+# shellcheck source=/dev/null
+source "$REPO_ROOT/lib/build.func"
+
+PASS=0
+FAIL=0
+
+ok() { PASS=$((PASS + 1)); echo "ok     - $1"; }
+nok() { FAIL=$((FAIL + 1)); echo "NOT OK - $1"; }
+
+assert_true() {  # assert_true "desc" cmd args...
+  local desc="$1"; shift
+  if "$@"; then ok "$desc"; else nok "$desc"; fi
+}
+assert_false() {
+  local desc="$1"; shift
+  if "$@"; then nok "$desc"; else ok "$desc"; fi
+}
+
+# ── Repro des Vorfalls vom 2026-06-11: VLAN-Tag mit unsichtbarem Byte ────────
+JUNK_VLAN="$(printf '2\x800')"   # "20" mit eingebettetem Non-UTF-8-Byte
+assert_false "VLAN-Repro: '2<0x80>0' wird abgelehnt (kein silent strip)" is_vlan_tag "$JUNK_VLAN"
+assert_false "is_clean_ascii erkennt eingebettetes Junk-Byte" is_clean_ascii "$JUNK_VLAN"
+
+# Re-Prompt-Verhalten: erste Eingabe ist der Junk-Wert, zweite ist sauber —
+# prompt_validated muss die zweite liefern (AC: Re-Prompt statt pct-Fehler).
+reprompt_result="$(
+  printf '%s\n20\n' "$JUNK_VLAN" | {
+    VLAN=""
+    prompt_validated VLAN "VLAN tag (empty for none): " is_vlan_tag "" yes >/dev/null 2>&1
+    printf '%s' "$VLAN"
+  }
+)"
+if [[ "$reprompt_result" == "20" ]]; then
+  ok "prompt_validated re-promptet bei Junk und akzeptiert dann '20'"
+else
+  nok "prompt_validated re-promptet bei Junk (got: '$reprompt_result')"
+fi
+
+# ── sanitize_input: CR + Rand-Whitespace weg, Inhalt unangetastet ─────────────
+[[ "$(sanitize_input $'  42\r\n')" == "42" ]] && ok "sanitize_input trimmt CR/Whitespace" \
+  || nok "sanitize_input trimmt CR/Whitespace"
+[[ "$(sanitize_input "$JUNK_VLAN")" == "$JUNK_VLAN" ]] && ok "sanitize_input strippt KEIN eingebettetes Junk (Validator soll es sehen)" \
+  || nok "sanitize_input lässt eingebettetes Junk unangetastet"
+
+# ── numerische Validatoren ────────────────────────────────────────────────────
+assert_true  "is_uint akzeptiert 8"            is_uint "8"
+assert_false "is_uint lehnt '8 ' mit Junk ab"  is_uint "$(printf '8\x01')"
+assert_false "is_uint lehnt 'abc' ab"          is_uint "abc"
+assert_false "is_uint lehnt leeren Wert ab"    is_uint ""
+assert_true  "is_vlan_tag akzeptiert 20"       is_vlan_tag "20"
+assert_false "is_vlan_tag lehnt 0 ab"          is_vlan_tag "0"
+assert_false "is_vlan_tag lehnt 5000 ab"       is_vlan_tag "5000"
+
+# ── Netz-Validatoren ──────────────────────────────────────────────────────────
+assert_true  "is_ipv4 akzeptiert 10.11.20.66"      is_ipv4 "10.11.20.66"
+assert_false "is_ipv4 lehnt 10.11.20.666 ab"       is_ipv4 "10.11.20.666"
+assert_false "is_ipv4 lehnt 10.11.20 ab"           is_ipv4 "10.11.20"
+assert_true  "is_cidr akzeptiert 10.11.20.5/24"    is_cidr "10.11.20.5/24"
+assert_false "is_cidr lehnt 10.11.20.5/33 ab"      is_cidr "10.11.20.5/33"
+assert_false "is_cidr lehnt 10.11.20.5 ohne Maske" is_cidr "10.11.20.5"
+assert_true  "is_ipcfg akzeptiert dhcp"            is_ipcfg "dhcp"
+assert_true  "is_ipcfg akzeptiert CIDR"            is_ipcfg "192.168.0.7/24"
+assert_false "is_ipcfg lehnt 'static' ab"          is_ipcfg "static"
+assert_true  "is_ipv4_list akzeptiert Liste"       is_ipv4_list "1.1.1.1, 8.8.8.8"
+assert_false "is_ipv4_list lehnt Hostnamen ab"     is_ipv4_list "dns.local"
+
+# ── Namen/Token ───────────────────────────────────────────────────────────────
+assert_true  "is_hostname akzeptiert nexus-db"     is_hostname "nexus-db"
+assert_false "is_hostname lehnt '-bad' ab"         is_hostname "-bad"
+assert_false "is_hostname lehnt 'a b' ab"          is_hostname "a b"
+assert_true  "is_token akzeptiert local-lvm"       is_token "local-lvm"
+assert_false "is_token lehnt 'a;b' ab"             is_token "a;b"
+
+# ── Ja/Nein (SSH-Root-Login-Prompt) ──────────────────────────────────────────
+assert_true  "is_yesno akzeptiert y"               is_yesno "y"
+assert_true  "is_yesno akzeptiert Ja"              is_yesno "Ja"
+assert_true  "is_yesno akzeptiert NO"              is_yesno "NO"
+assert_true  "is_yesno akzeptiert nein"            is_yesno "nein"
+assert_false "is_yesno lehnt 'maybe' ab"           is_yesno "maybe"
+assert_false "is_yesno lehnt leeren Wert ab"       is_yesno ""
+[[ "$(normalize_yesno "J")" == "yes" && "$(normalize_yesno "nein")" == "no" ]] \
+  && ok "normalize_yesno kanonisiert J→yes, nein→no" \
+  || nok "normalize_yesno kanonisiert J→yes, nein→no"
+
+# SSH-Root-Login-Prompt: leere Eingabe = Default Y → normalisiert yes;
+# explizites 'n' → no.
+ssh_default="$(
+  printf '\n' | {
+    SSH_ROOT_LOGIN=""
+    prompt_validated SSH_ROOT_LOGIN "SSH-Root-Login erlauben? [Y/n]: " is_yesno "y" >/dev/null 2>&1
+    normalize_yesno "$SSH_ROOT_LOGIN"
+  }
+)"
+[[ "$ssh_default" == "yes" ]] && ok "SSH-Root-Login: leere Eingabe → Default yes" \
+  || nok "SSH-Root-Login Default (got: '$ssh_default')"
+ssh_no="$(
+  printf 'n\n' | {
+    SSH_ROOT_LOGIN=""
+    prompt_validated SSH_ROOT_LOGIN "SSH-Root-Login erlauben? [Y/n]: " is_yesno "y" >/dev/null 2>&1
+    normalize_yesno "$SSH_ROOT_LOGIN"
+  }
+)"
+[[ "$ssh_no" == "no" ]] && ok "SSH-Root-Login: 'n' → no" \
+  || nok "SSH-Root-Login 'n' (got: '$ssh_no')"
+
+# ── require_valid: env-Werte werden sanitisiert + geprüft ────────────────────
+CHECKVAL=$'  7\r'
+require_valid CHECKVAL is_uint "Testwert" && [[ "$CHECKVAL" == "7" ]] \
+  && ok "require_valid sanitisiert env-Wert (CR weg)" \
+  || nok "require_valid sanitisiert env-Wert"
+( CHECKBAD="$JUNK_VLAN"; require_valid CHECKBAD is_uint "Testwert" ) >/dev/null 2>&1 \
+  && nok "require_valid bricht bei Junk-env-Wert ab" \
+  || ok "require_valid bricht bei Junk-env-Wert ab (exit != 0)"
+
+# ── Negativ-Beweis: build.func-Source-Check schlägt bei Präparat an ──────────
+TMPDIR_CT="$(mktemp -d)"
+cat >"$TMPDIR_CT/broken.sh" <<'EOF'
+#!/usr/bin/env bash
+# absichtlich ohne source build.func (Repro des zweimal aufgetretenen Bugs)
+APP="broken"
+prompt_lxc_config
+EOF
+if bash "$REPO_ROOT/tests/check_ct_source.sh" "$TMPDIR_CT" >/dev/null 2>&1; then
+  nok "check_ct_source.sh erkennt fehlendes 'source build.func'"
+else
+  ok "check_ct_source.sh erkennt fehlendes 'source build.func'"
+fi
+rm -rf "$TMPDIR_CT"
+
+# Positiv: das echte ct/-Verzeichnis ist sauber.
+if bash "$REPO_ROOT/tests/check_ct_source.sh" "$REPO_ROOT/ct" >/dev/null 2>&1; then
+  ok "alle ct/*.sh sourcen build.func"
+else
+  nok "alle ct/*.sh sourcen build.func"
+fi
+
+# ── Review-Findings K-114: Oktal, Newline, EOF, Nameref-Guard ────────────────
+assert_true  "is_vlan_tag akzeptiert '08' (kein Oktal-Fehler)"  is_vlan_tag "08"
+assert_true  "is_cidr akzeptiert /08 (kein Oktal-Fehler)"       is_cidr "10.0.0.1/08"
+assert_false "is_clean_ascii lehnt eingebettetes Newline ab"    is_clean_ascii $'1.1.1.1\n8.8.8.8'
+assert_false "is_ipv4_list lehnt Newline-Liste ab"              is_ipv4_list $'1.1.1.1\n8.8.8.8'
+
+# EOF statt Eingabe: prompt_validated darf nicht endlos loopen.
+( printf '' | { V=""; prompt_validated V "Wert: " is_uint; } ) >/dev/null 2>&1
+rc=$?
+[[ "$rc" -ne 0 ]] && ok "prompt_validated bricht bei EOF ab (rc=$rc)" \
+  || nok "prompt_validated bricht bei EOF ab"
+
+# Reservierte Namen → Guard statt zirkulärem nameref.
+( _pv_ref=""; prompt_validated _pv_ref "x: " is_uint ) >/dev/null 2>&1
+[[ $? -eq 2 ]] && ok "prompt_validated weist reservierte Variablennamen ab" \
+  || nok "prompt_validated weist reservierte Variablennamen ab"
+
+# CTID-Re-Prompt: ungültig → erneut fragen, leer wäre auto (hier: gültige Zahl).
+ctid_out="$(
+  printf 'abc\n123\n' | env -u CTID bash -c "
+    source '$REPO_ROOT/lib/build.func'
+    CTID=''
+    while true; do
+      read -rp 'Container ID [auto]: ' CTID || exit 1
+      CTID=\"\$(sanitize_input \"\$CTID\")\"
+      [[ -z \"\$CTID\" ]] && exit 1
+      is_uint \"\$CTID\" && break
+    done
+    printf '%s' \"\$CTID\""
+)"
+[[ "$ctid_out" == "123" ]] && ok "CTID-Loop re-promptet bei 'abc' und nimmt '123'" \
+  || nok "CTID-Loop re-promptet (got: '$ctid_out')"
+
+# ── Dry-Run: prompt_lxc_config komplett aus env, ohne PVE/TTY ────────────────
+smoke_out="$(
+  env CTID=999 CT_HOSTNAME=smoke DISK_SIZE=8 CORES=2 RAM=1024 BRIDGE=vmbr0 \
+    VLAN_TAG=20 TEMPLATE_STORAGE=local ROOTFS_STORAGE=local-lvm \
+    IPCFG=10.11.20.99/24 GATEWAY=10.11.20.1 NAMESERVER="" SSH_ROOT_LOGIN=J \
+    NET_PROFILES_FILE="$REPO_ROOT/lib/networks.conf" \
+    bash -c "source '$REPO_ROOT/lib/build.func' && prompt_lxc_config >/dev/null && echo SMOKE-OK:\$SSH_ROOT_LOGIN"
+)" || true
+[[ "$smoke_out" == *SMOKE-OK:yes* ]] \
+  && ok "prompt_lxc_config Dry-Run mit validen env-Werten läuft durch (SSH_ROOT_LOGIN J→yes)" \
+  || nok "prompt_lxc_config Dry-Run (got: '$smoke_out')"
+
+smoke_bad="$(
+  env CTID="$(printf '9\x809')" CT_HOSTNAME=smoke DISK_SIZE=8 CORES=2 RAM=1024 BRIDGE=vmbr0 \
+    VLAN_TAG=20 TEMPLATE_STORAGE=local ROOTFS_STORAGE=local-lvm IPCFG=dhcp NAMESERVER="" \
+    NET_PROFILES_FILE="$REPO_ROOT/lib/networks.conf" \
+    bash -c "source '$REPO_ROOT/lib/build.func' && prompt_lxc_config >/dev/null && echo SMOKE-OK" 2>/dev/null
+)" || true
+[[ "$smoke_bad" == *SMOKE-OK* ]] \
+  && nok "prompt_lxc_config bricht bei Junk-CTID aus env ab" \
+  || ok "prompt_lxc_config bricht bei Junk-CTID aus env ab"
+
+echo
+echo "passed=$PASS failed=$FAIL"
+[[ "$FAIL" -eq 0 ]]