l.kirchner
0ee7ceae55
webapp-pattern ct/install pair: PGDG repo, database nexus with least-privilege owner role, pg_hba allowlist restricted to the nexus app LXC (explicit reject for everything else), pgvector created by the installer, credentials/DSN summary in /root/nexus-db.credentials. Idempotent re-runs keep role/db and do not rotate the password.
luki-net / proxmox-scripts
Community-script-style installers for LXC services in my Proxmox VE homelab. Each script creates an unprivileged Debian 12 LXC and installs one specific app, with sensible defaults and interactive prompts.
Inspired by community-scripts/ProxmoxVE, but minimal, self-hosted and tailored to my stack.
Available scripts
| App | Description | One-liner |
|---|---|---|
| devpi | Private PyPI cache / mirror — saves time on CUDA/torch rebuilds | bash -c "$(curl -fsSL https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/ct/devpi.sh)" |
| webapp | Next.js site with deploy-as-code via a self-hosted Gitea Actions runner (host mode, no inbound port) | bash -c "$(curl -fsSL https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/ct/webapp.sh)" |
Usage
Run any one-liner on a Proxmox VE host as root (Web UI → Node → Shell works fine). You'll be prompted for CTID, hostname, disk, RAM, CPU, bridge, storage and IP. Defaults are sane.
Non-interactive override via env vars:
CTID=200 HOSTNAME=devpi DISK_SIZE=30 RAM=4096 CORES=4 IPCFG=dhcp \
bash -c "$(curl -fsSL https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/ct/devpi.sh)"
All defaults (DEFAULT_HOSTNAME, DEFAULT_DISK, …) are settable per-call via env vars as well.
Repo layout
.
├── ct/ # Host-side scripts, one per app
├── install/ # In-container installers, one per app
├── lib/
│ ├── build.func # Shared host-side helpers (prompts, LXC create, bootstrap)
│ └── install.func # Shared in-container helpers (apt, systemd, users, http-wait)
├── docs/
│ └── adding-a-script.md
├── README.md
└── LICENSE
Adding a new script
See docs/adding-a-script.md. Two files per app, both source the shared libs via curl.
License
MIT