l.kirchner
80e2ec04ff
- validation helpers: sanitize_input trims CR/edge whitespace only; embedded control/non-ASCII bytes FAIL validation and re-prompt with a hint (2026-06-11 incident: invisible byte in a pasted VLAN tag broke pct create mid-run) - never silently stripped - prompt_lxc_config: every prompt validated (uint for CTID/disk/cores/ RAM, VLAN 1-4094, hostname/token formats, IP/CIDR/gateway, DNS list); env-provided values are sanitized + validated too (abort, no re-prompt loop in non-interactive use); helpers reusable for app prompts - tests/test_validation.sh: 34 cases incl. the 2<0x80>0 repro, re-prompt simulation, BASH_REMATCH clobbering regression (is_cidr), env dry-run of prompt_lxc_config without PVE/TTY - tests/check_ct_source.sh: every ct/*.sh must source build.func (bug shipped twice); negative proof via prepared fixture in the test suite - .gitea/workflows/ci.yml: bash -n over all scripts, source-check, validation tests, shellcheck if present (documented skip otherwise) - README: contributions via PR with cross-review (binding)
luki-net / proxmox-scripts
Community-script-style installers for LXC services in my Proxmox VE homelab. Each script creates an unprivileged Debian 12 LXC and installs one specific app, with sensible defaults and interactive prompts.
Inspired by community-scripts/ProxmoxVE, but minimal, self-hosted and tailored to my stack.
Available scripts
| App | Description | One-liner |
|---|---|---|
| devpi | Private PyPI cache / mirror — saves time on CUDA/torch rebuilds | bash -c "$(curl -fsSL https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/ct/devpi.sh)" |
| webapp | Next.js site with deploy-as-code via a self-hosted Gitea Actions runner (host mode, no inbound port) | bash -c "$(curl -fsSL https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/ct/webapp.sh)" |
Usage
Run any one-liner on a Proxmox VE host as root (Web UI → Node → Shell works fine). You'll be prompted for CTID, hostname, disk, RAM, CPU, bridge, storage and IP. Defaults are sane.
Non-interactive override via env vars:
CTID=200 HOSTNAME=devpi DISK_SIZE=30 RAM=4096 CORES=4 IPCFG=dhcp \
bash -c "$(curl -fsSL https://gitea.luki-net.org/luki-net/proxmox-scripts/raw/branch/main/ct/devpi.sh)"
All defaults (DEFAULT_HOSTNAME, DEFAULT_DISK, …) are settable per-call via env vars as well.
Contributing (verbindlich seit K-114)
Alle Änderungen laufen als PR mit Cross-Review — keine Direkt-Commits auf main. Hintergrund: Der „build.func nicht gesourct"-Bug hat es einmal bis in die Produktion geschafft (authentik-Anlage), während dieselbe Fehlerklasse im nexus-db-PR vom Review gefangen wurde. Die CI (.gitea/workflows/ci.yml, Runner-Label nexus) erzwingt zusätzlich: bash -n über alle Scripts, „jedes ct/*.sh sourct build.func" (tests/check_ct_source.sh) und die Validierungs-Unit-Tests (tests/test_validation.sh).
Eingaben in prompt_lxc_config sind validiert (Ziffern-Checks, IP/CIDR/Gateway-Format, Re-Prompt bei unsichtbaren Steuer-/Non-ASCII-Zeichen — Lesson vom 2026-06-11). Neue App-Prompts bitte über prompt_validated/require_valid aus lib/build.func bauen statt nacktem read.
Repo layout
.
├── ct/ # Host-side scripts, one per app
├── install/ # In-container installers, one per app
├── lib/
│ ├── build.func # Shared host-side helpers (prompts, LXC create, bootstrap)
│ └── install.func # Shared in-container helpers (apt, systemd, users, http-wait)
├── docs/
│ └── adding-a-script.md
├── README.md
└── LICENSE
Adding a new script
See docs/adding-a-script.md. Two files per app, both source the shared libs via curl.
License
MIT