customer-installer/install.sh

#!/usr/bin/env bash
set -Eeuo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
source "${SCRIPT_DIR}/libsupabase.sh"
setup_traps

usage() {
  cat >&2 <<'EOF'
Usage:
  bash install.sh [options]

Core options:
  --ctid <id>                 Force CT ID (optional). If omitted, a customer-safe CTID is generated.
  --cores <n>                 (default: 2)
  --memory <mb>               (default: 4096)
  --swap <mb>                 (default: 512)
  --disk <gb>                 (default: 50)
  --bridge <vmbrX>            (default: vmbr0)
  --storage <storage>         (default: local-zfs)
  --ip <dhcp|CIDR>            (default: dhcp)
  --privileged                Create privileged CT (default: unprivileged)
  --tg-token <token>          Telegram bot token (optional)
  --tg-chat <id>              Telegram chat id (optional)
  --help                      Show help
EOF
}

# Defaults
CTID=""
CORES="2"
MEMORY="4096"
SWAP="512"
DISK="50"
BRIDGE="vmbr0"
STORAGE="local-zfs"
IPCFG="dhcp"
UNPRIV="1"
TG_TOKEN=""
TG_CHAT=""

# ---------------------------
# Arg parsing
# ---------------------------
while [[ $# -gt 0 ]]; do
  case "$1" in
    --ctid) CTID="${2:-}"; shift 2 ;;
    --cores) CORES="${2:-}"; shift 2 ;;
    --memory) MEMORY="${2:-}"; shift 2 ;;
    --swap) SWAP="${2:-}"; shift 2 ;;
    --disk) DISK="${2:-}"; shift 2 ;;
    --bridge) BRIDGE="${2:-}"; shift 2 ;;
    --storage) STORAGE="${2:-}"; shift 2 ;;
    --ip) IPCFG="${2:-}"; shift 2 ;;
    --privileged) UNPRIV="0"; shift 1 ;;
    --tg-token) TG_TOKEN="${2:-}"; shift 2 ;;
    --tg-chat) TG_CHAT="${2:-}"; shift 2 ;;
    --help|-h) usage; exit 0 ;;
    *) die "Unknown option: $1 (use --help)" ;;
  esac
done

# Basic validation
[[ "$CORES" =~ ^[0-9]+$ ]] || die "--cores must be integer"
[[ "$MEMORY" =~ ^[0-9]+$ ]] || die "--memory must be integer"
[[ "$SWAP" =~ ^[0-9]+$ ]] || die "--swap must be integer"
[[ "$DISK" =~ ^[0-9]+$ ]] || die "--disk must be integer"
[[ "$UNPRIV" == "0" || "$UNPRIV" == "1" ]] || die "internal: UNPRIV invalid"

if [[ "$IPCFG" != "dhcp" ]]; then
  [[ "$IPCFG" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}/[0-9]{1,2}$ ]] || die "--ip must be dhcp or CIDR (e.g. 192.168.45.171/24)"
fi

info "Argument-Parsing OK"

# ---------------------------
# Preflight Proxmox
# ---------------------------
need_cmd pct pvesm pveam pvesh grep sed awk sort date

pve_storage_exists "$STORAGE" || die "Storage not found: $STORAGE"
pve_bridge_exists "$BRIDGE" || die "Bridge not found: $BRIDGE"

TEMPLATE="$(pve_template_ensure_debian12 "$STORAGE")"
info "Template OK: ${TEMPLATE}"

# Hostname based on unix time
CT_HOSTNAME="sb-$(date +%s)"

# CTID selection
if [[ -n "$CTID" ]]; then
  [[ "$CTID" =~ ^[0-9]+$ ]] || die "--ctid must be integer"
  if pve_vmid_exists_cluster "$CTID"; then
    die "Forced CTID=${CTID} already exists in cluster"
  fi
else
  CTID="$(pve_select_customer_ctid)"
fi

info "CTID selected: ${CTID}"
info "SCRIPT_DIR=${SCRIPT_DIR}"
info "CT_HOSTNAME=${CT_HOSTNAME}"
info "cores=${CORES} memory=${MEMORY}MB swap=${SWAP}MB disk=${DISK}GB"
info "bridge=${BRIDGE} storage=${STORAGE} ip=${IPCFG} unprivileged=${UNPRIV}"

if [[ -n "$TG_TOKEN" && -n "$TG_CHAT" ]]; then
  info "Telegram enabled (chat=${TG_CHAT})"
else
  info "Telegram disabled"
fi

# ---------------------------
# Step 5: Create CT
# ---------------------------
NET0="$(pve_build_net0 "$BRIDGE" "$IPCFG")"
ROOTFS="${STORAGE}:${DISK}"
FEATURES="nesting=1,keyctl=1,fuse=1"

info "Step 5: Create CT"
info "Creating CT ${CTID} (${CT_HOSTNAME}) from ${TEMPLATE}"

pct create "${CTID}" "${TEMPLATE}" \
  --hostname "${CT_HOSTNAME}" \
  --cores "${CORES}" \
  --memory "${MEMORY}" \
  --swap "${SWAP}" \
  --net0 "${NET0}" \
  --rootfs "${ROOTFS}" \
  --unprivileged "${UNPRIV}" \
  --features "${FEATURES}" \
  --start 0

info "CT created (not started). Next step: start CT + wait for IP"
info "Starting CT ${CTID}"
pct start "${CTID}"

CT_IP="$(pct_wait_for_ip "${CTID}" || true)"
[[ -n "${CT_IP}" ]] || die "Could not determine CT IP after start"

info "Step 5 OK: LXC erstellt + IP ermittelt"
info "CT_HOSTNAME=${CT_HOSTNAME}"
info "CT_IP=${CT_IP}"

# ---------------------------
# Step 6: Provision inside CT (Locales + Docker + base stack folder)
# ---------------------------
info "Step 6: Provisioning im CT (Locales + Docker + Stack)"

# 6.0 Fix locales early (prevents perl/locale warnings during installs)
pct_exec "${CTID}" "export DEBIAN_FRONTEND=noninteractive; apt-get update -y"
pct_exec "${CTID}" "export DEBIAN_FRONTEND=noninteractive; apt-get install -y locales"

# Generate both (safe), set default to de_DE.UTF-8 (matches your /etc/default/locale goal)
pct_exec "${CTID}" "sed -i 's/^# *\\(de_DE.UTF-8 UTF-8\\)/\\1/' /etc/locale.gen"
pct_exec "${CTID}" "sed -i 's/^# *\\(en_US.UTF-8 UTF-8\\)/\\1/' /etc/locale.gen"
pct_exec "${CTID}" "locale-gen >/dev/null"
pct_exec "${CTID}" "update-locale LANG=de_DE.UTF-8 LC_ALL=de_DE.UTF-8"

# 6.1 Minimal base packages
pct_exec "${CTID}" "export DEBIAN_FRONTEND=noninteractive; apt-get install -y ca-certificates curl gnupg lsb-release"

# 6.2 Docker official repo (Debian 12 / bookworm)
pct_exec "${CTID}" "install -m 0755 -d /etc/apt/keyrings"
pct_exec "${CTID}" "curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg"
pct_exec "${CTID}" "chmod a+r /etc/apt/keyrings/docker.gpg"
pct_exec "${CTID}" "echo \"deb [arch=\$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian \$(. /etc/os-release && echo \$VERSION_CODENAME) stable\" > /etc/apt/sources.list.d/docker.list"
pct_exec "${CTID}" "export DEBIAN_FRONTEND=noninteractive; apt-get update -y"

pct_exec "${CTID}" "export DEBIAN_FRONTEND=noninteractive; apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin"

# Enable docker service
pct_exec "${CTID}" "systemctl enable --now docker >/dev/null || true"

# 6.3 Create stack directories
pct_exec "${CTID}" "mkdir -p /opt/customer-stack /opt/customer-stack/volumes"

# 6.4 Copy placeholder compose if present (will be replaced in later steps)
if [[ -f "${SCRIPT_DIR}/templates/docker-compose.yml" ]]; then
  pct exec "${CTID}" -- bash -lc "cat > /opt/customer-stack/docker-compose.yml <<'YML'
$(cat "${SCRIPT_DIR}/templates/docker-compose.yml")
YML"
fi

info "Step 6 OK: Docker + Compose Plugin installiert, Locales gesetzt, Basis-Verzeichnisse erstellt"
info "Next: Schritt 7 (finales docker-compose + Secrets + n8n/supabase up + Healthchecks)"


# ---------------------------
# Step 7: Finalize stack + secrets + up + checks
# ---------------------------
info "Step 7: Stack finalisieren + Secrets + Up + Checks"

# ---- Host/IP für URL bauen
# Wenn du später Reverse Proxy nutzt, werden diese Werte angepasst.
STACK_DIR="/opt/customer-stack"

N8N_PORT="5678"
N8N_PROTOCOL="http"
N8N_HOST="${CT_IP}"
N8N_EDITOR_BASE_URL="${N8N_PROTOCOL}://${N8N_HOST}:${N8N_PORT}/"
WEBHOOK_URL="${N8N_EDITOR_BASE_URL}"

# ---- Secrets generieren (einmalig pro CT)
# Wichtig: nicht jedes Mal neu erzeugen, sonst ist n8n "kaputt" (encryption key ändert sich)
pct_exec "${CTID}" "test -f ${STACK_DIR}/.env || ( \
  umask 077; \
  PG_DB='n8n'; \
  PG_USER='n8n'; \
  PG_PASSWORD=\"\$(tr -dc 'A-Za-z0-9' </dev/urandom | head -c 32)\"; \
  N8N_ENCRYPTION_KEY=\"\$(tr -dc 'A-Za-z0-9' </dev/urandom | head -c 32)\"; \
  N8N_SECURE_COOKIE='false'; \
  N8N_PORT='${N8N_PORT}'; \
  N8N_PROTOCOL='${N8N_PROTOCOL}'; \
  N8N_HOST='${N8N_HOST}'; \
  N8N_EDITOR_BASE_URL='${N8N_EDITOR_BASE_URL}'; \
  WEBHOOK_URL='${WEBHOOK_URL}'; \
  cat > ${STACK_DIR}/.env <<EOF
PG_DB=\${PG_DB}
PG_USER=\${PG_USER}
PG_PASSWORD=\${PG_PASSWORD}
N8N_ENCRYPTION_KEY=\${N8N_ENCRYPTION_KEY}
N8N_SECURE_COOKIE=\${N8N_SECURE_COOKIE}
N8N_PORT=\${N8N_PORT}
N8N_PROTOCOL=\${N8N_PROTOCOL}
N8N_HOST=\${N8N_HOST}
N8N_EDITOR_BASE_URL=\${N8N_EDITOR_BASE_URL}
WEBHOOK_URL=\${WEBHOOK_URL}
EOF
)"

# ---- Dateien rüberkopieren (compose + sql)
# docker-compose.yml
if [[ -f "${SCRIPT_DIR}/templates/docker-compose.yml" ]]; then
  COMPOSE_CONTENT="$(cat "${SCRIPT_DIR}/templates/docker-compose.yml")"
  pct exec "${CTID}" -- bash -lc "cat > ${STACK_DIR}/docker-compose.yml <<'YML'
${COMPOSE_CONTENT}
YML"
else
  die "Missing template: ${SCRIPT_DIR}/templates/docker-compose.yml"
fi

# sql init
pct_exec "${CTID}" "mkdir -p ${STACK_DIR}/sql"
if [[ -f "${SCRIPT_DIR}/sql/init_pgvector.sql" ]]; then
  SQL_CONTENT="$(cat "${SCRIPT_DIR}/sql/init_pgvector.sql")"
  pct exec "${CTID}" -- bash -lc "cat > ${STACK_DIR}/sql/init_pgvector.sql <<'SQL'
${SQL_CONTENT}
SQL"
else
  die "Missing sql file: ${SCRIPT_DIR}/sql/init_pgvector.sql"
fi

# ---- Volumes + Rechte (wichtig!)
pct_exec "${CTID}" "mkdir -p ${STACK_DIR}/volumes/n8n-data ${STACK_DIR}/volumes/postgres/data"
# n8n läuft als node (uid 1000), postgres i.d.R. uid 999
pct_exec "${CTID}" "chown -R 1000:1000 ${STACK_DIR}/volumes/n8n-data"
pct_exec "${CTID}" "chown -R 999:999 ${STACK_DIR}/volumes/postgres/data"

# ---- Start stack
pct_exec "${CTID}" "cd ${STACK_DIR} && docker compose pull"
pct_exec "${CTID}" "cd ${STACK_DIR} && docker compose up -d"

# ---- Minimal Checks
pct_exec "${CTID}" "cd ${STACK_DIR} && docker compose ps"
pct_exec "${CTID}" "cd ${STACK_DIR} && docker logs --tail=30 customer-postgres || true"
pct_exec "${CTID}" "cd ${STACK_DIR} && docker logs --tail=30 n8n || true"

info "Step 7 OK: Stack deployed"
info "n8n: ${N8N_EDITOR_BASE_URL}"
info "Hinweis: Ohne Reverse-Proxy/TLS ist N8N_SECURE_COOKIE=false gesetzt. Später bei HTTPS wieder true."