customer-installer/install.sh

#!/usr/bin/env bash
set -Eeuo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
source "${SCRIPT_DIR}/libsupabase.sh"
setup_traps

usage() {
  cat >&2 <<'EOF'
Usage:
  bash install.sh [options]

Core options:
  --ctid <id>                 Force CTID (optional)
  --cores <n>                 (default: 2)
  --memory <mb>               (default: 4096)
  --swap <mb>                 (default: 512)
  --disk <gb>                 (default: 50)
  --bridge <vmbrX>            (default: vmbr0)
  --storage <storage>         (default: local-zfs)
  --ip <dhcp|CIDR>            (default: dhcp)
  --vlan <id>                 (default: 90)  (empty/0 disables tagging)
  --domain <domain>           (default: userman.de) -> FQDN=sb-<unix>.DOMAIN
  --privileged                Create privileged CT (default: unprivileged)
  --help                      Show help
EOF
}

# Defaults
CTID=""
CORES="2"
MEMORY="4096"
SWAP="512"
DISK="50"
BRIDGE="vmbr0"
STORAGE="local-zfs"
IPCFG="dhcp"
VLAN="90"
DOMAIN="userman.de"
UNPRIV="1"

# ---------------------------
# Arg parsing
# ---------------------------
while [[ $# -gt 0 ]]; do
  case "$1" in
    --ctid)     CTID="${2:-}"; shift 2 ;;
    --cores)    CORES="${2:-}"; shift 2 ;;
    --memory)   MEMORY="${2:-}"; shift 2 ;;
    --swap)     SWAP="${2:-}"; shift 2 ;;
    --disk)     DISK="${2:-}"; shift 2 ;;
    --bridge)   BRIDGE="${2:-}"; shift 2 ;;
    --storage)  STORAGE="${2:-}"; shift 2 ;;
    --ip)       IPCFG="${2:-}"; shift 2 ;;
    --vlan)     VLAN="${2:-}"; shift 2 ;;
    --domain)   DOMAIN="${2:-}"; shift 2 ;;
    --privileged) UNPRIV="0"; shift 1 ;;
    --help|-h)  usage; exit 0 ;;
    *) die "Unknown option: $1 (use --help)" ;;
  esac
done

# Basic validation
[[ "$CORES"  =~ ^[0-9]+$ ]] || die "--cores must be integer"
[[ "$MEMORY" =~ ^[0-9]+$ ]] || die "--memory must be integer"
[[ "$SWAP"   =~ ^[0-9]+$ ]] || die "--swap must be integer"
[[ "$DISK"   =~ ^[0-9]+$ ]] || die "--disk must be integer"
[[ "$UNPRIV" == "0" || "$UNPRIV" == "1" ]] || die "internal: UNPRIV invalid"

if [[ "$IPCFG" != "dhcp" ]]; then
  [[ "$IPCFG" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}/[0-9]{1,2}$ ]] || die "--ip must be dhcp or CIDR (e.g. 192.168.45.171/24)"
fi

if [[ -n "${VLAN}" && "${VLAN}" != "0" ]]; then
  [[ "${VLAN}" =~ ^[0-9]+$ ]] || die "--vlan must be integer or 0"
else
  VLAN=""
fi

[[ -n "${DOMAIN}" ]] || die "--domain must not be empty"

info "Argument-Parsing OK"

# ---------------------------
# Preflight Proxmox
# ---------------------------
need_cmd pct pvesm pveam pvesh grep date awk ip openssl

pve_storage_exists "$STORAGE" || die "Storage not found: $STORAGE"
pve_bridge_exists "$BRIDGE" || die "Bridge not found: $BRIDGE"

TEMPLATE="$(pve_template_ensure_debian12 "$STORAGE")"
info "Template OK: ${TEMPLATE}"

# Hostname based on unix time
UNIX_TS="$(date +%s)"
CT_HOSTNAME="sb-${UNIX_TS}"
FQDN="${CT_HOSTNAME}.${DOMAIN}"

# CTID selection
if [[ -n "$CTID" ]]; then
  [[ "$CTID" =~ ^[0-9]+$ ]] || die "--ctid must be integer"
else
  CTID="$(pve_select_customer_ctid)"
fi

info "CTID selected: ${CTID}"
info "SCRIPT_DIR=${SCRIPT_DIR}"
info "CT_HOSTNAME=${CT_HOSTNAME}"
info "FQDN=${FQDN}"
info "cores=${CORES} memory=${MEMORY}MB swap=${SWAP}MB disk=${DISK}GB"
info "bridge=${BRIDGE} storage=${STORAGE} ip=${IPCFG} vlan=${VLAN:-none} unprivileged=${UNPRIV}"

# ---------------------------
# Step 5: Create CT
# ---------------------------
NET0="$(pve_build_net0 "$BRIDGE" "$IPCFG" "$VLAN")"
ROOTFS="${STORAGE}:${DISK}"
FEATURES="nesting=1,keyctl=1,fuse=1"

info "Step 5: Create CT"
info "Creating CT ${CTID} (${CT_HOSTNAME}) from ${TEMPLATE}"
pct create "${CTID}" "${TEMPLATE}" \
  --hostname "${CT_HOSTNAME}" \
  --cores "${CORES}" \
  --memory "${MEMORY}" \
  --swap "${SWAP}" \
  --net0 "${NET0}" \
  --rootfs "${ROOTFS}" \
  --unprivileged "${UNPRIV}" \
  --features "${FEATURES}" \
  --start 0

info "CT created (not started). Next step: start CT + wait for IP"
info "Starting CT ${CTID}"
pct start "${CTID}"

CT_IP="$(pct_wait_for_ip "${CTID}" || true)"
[[ -n "${CT_IP}" ]] || die "Could not determine CT IP after start"

info "Step 5 OK: LXC erstellt + IP ermittelt"
info "CT_HOSTNAME=${CT_HOSTNAME}"
info "CT_IP=${CT_IP}"

# ---------------------------
# Step 6: Provision inside CT (Docker + Locales + Base)
# ---------------------------
info "Step 6: Provisioning im CT (Docker + Locales + Base)"

# Base packages
pct_exec "${CTID}" "export DEBIAN_FRONTEND=noninteractive; apt-get update -y"
pct_exec "${CTID}" "export DEBIAN_FRONTEND=noninteractive; apt-get install -y ca-certificates curl gnupg lsb-release locales"

# Locales (German default, but keep system stable)
pct_exec "${CTID}" "sed -i 's/^# *de_DE.UTF-8 UTF-8/de_DE.UTF-8 UTF-8/; s/^# *en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen"
pct_exec "${CTID}" "locale-gen >/dev/null || true"
pct_exec "${CTID}" "printf 'LANG=de_DE.UTF-8\nLC_ALL=de_DE.UTF-8\n' > /etc/default/locale || true"
pct_exec "${CTID}" "update-locale LANG=de_DE.UTF-8 LC_ALL=de_DE.UTF-8 || true"

# Docker official repo (Debian 12 / bookworm)
pct_exec "${CTID}" "install -m 0755 -d /etc/apt/keyrings"
pct_exec "${CTID}" "curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg"
pct_exec "${CTID}" "chmod a+r /etc/apt/keyrings/docker.gpg"
pct_exec "${CTID}" "echo \"deb [arch=\$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian \$(. /etc/os-release && echo \$VERSION_CODENAME) stable\" > /etc/apt/sources.list.d/docker.list"
pct_exec "${CTID}" "export DEBIAN_FRONTEND=noninteractive; apt-get update -y"
pct_exec "${CTID}" "export DEBIAN_FRONTEND=noninteractive; apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin"

# Create stack directories
pct_exec "${CTID}" "mkdir -p /opt/customer-stack/volumes /opt/customer-stack/sql"

info "Step 6 OK: Docker + Compose Plugin installiert, Locales gesetzt, Basis-Verzeichnisse erstellt"
info "Next: Schritt 7 (finales docker-compose + Secrets + n8n/supabase up + Healthchecks)"

# ---------------------------
# Step 7: Stack finalisieren + Secrets + Up + Checks
# ---------------------------
info "Step 7: Stack finalisieren + Secrets + Up + Checks"

# Secrets (NO tr pipes)
PG_DB="customer"
PG_USER="customer"
PG_PASSWORD="$(gen_hex 16)"
N8N_ENCRYPTION_KEY="$(gen_hex 32)"

# Owner account (as requested)
N8N_USER_MANAGEMENT_DISABLED="false"
N8N_DEFAULT_USER_EMAIL="admin@${DOMAIN}"
N8N_DEFAULT_USER_PASSWORD="$(gen_hex 12)"  # hex => safe, no special chars issues

# URLs
N8N_PORT="5678"
N8N_PROTOCOL="http"
N8N_HOST="${CT_IP}"
N8N_EDITOR_BASE_URL="https://${FQDN}/"
WEBHOOK_URL="https://${FQDN}/"
N8N_SECURE_COOKIE="false"

# Telemetry/background calls off (n8n docs)
N8N_DIAGNOSTICS_ENABLED="false"
N8N_VERSION_NOTIFICATIONS_ENABLED="false"
N8N_TEMPLATES_ENABLED="false"

# Write .env inside CT
pct_exec "${CTID}" "cat > /opt/customer-stack/.env <<'ENV'
PG_DB=${PG_DB}
PG_USER=${PG_USER}
PG_PASSWORD=${PG_PASSWORD}

N8N_PORT=${N8N_PORT}
N8N_PROTOCOL=${N8N_PROTOCOL}
N8N_HOST=${N8N_HOST}
N8N_EDITOR_BASE_URL=${N8N_EDITOR_BASE_URL}
WEBHOOK_URL=${WEBHOOK_URL}
N8N_SECURE_COOKIE=${N8N_SECURE_COOKIE}

N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}

# Owner bootstrap
N8N_USER_MANAGEMENT_DISABLED=${N8N_USER_MANAGEMENT_DISABLED}
N8N_DEFAULT_USER_EMAIL=${N8N_DEFAULT_USER_EMAIL}
N8N_DEFAULT_USER_PASSWORD=${N8N_DEFAULT_USER_PASSWORD}

# Telemetrie/Background Calls aus
N8N_DIAGNOSTICS_ENABLED=${N8N_DIAGNOSTICS_ENABLED}
N8N_VERSION_NOTIFICATIONS_ENABLED=${N8N_VERSION_NOTIFICATIONS_ENABLED}
N8N_TEMPLATES_ENABLED=${N8N_TEMPLATES_ENABLED}
ENV"

# docker-compose.yml inside CT
pct_exec "${CTID}" "cat > /opt/customer-stack/docker-compose.yml <<'YML'
services:
  postgres:
    image: pgvector/pgvector:pg16
    container_name: customer-postgres
    restart: unless-stopped
    environment:
      POSTGRES_DB: \${PG_DB}
      POSTGRES_USER: \${PG_USER}
      POSTGRES_PASSWORD: \${PG_PASSWORD}
    volumes:
      - ./volumes/postgres/data:/var/lib/postgresql/data
      - ./sql:/docker-entrypoint-initdb.d:ro
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U \${PG_USER} -d \${PG_DB} || exit 1']
      interval: 10s
      timeout: 5s
      retries: 20
    networks:
      - customer-net

  n8n:
    image: n8nio/n8n:latest
    container_name: n8n
    restart: unless-stopped
    depends_on:
      postgres:
        condition: service_healthy
    ports:
      - '\${N8N_PORT}:5678'
    environment:
      N8N_PORT: 5678
      N8N_PROTOCOL: \${N8N_PROTOCOL}
      N8N_HOST: \${N8N_HOST}
      N8N_EDITOR_BASE_URL: \${N8N_EDITOR_BASE_URL}
      WEBHOOK_URL: \${WEBHOOK_URL}
      N8N_SECURE_COOKIE: \${N8N_SECURE_COOKIE}

      # Owner bootstrap
      N8N_USER_MANAGEMENT_DISABLED: \${N8N_USER_MANAGEMENT_DISABLED}
      N8N_DEFAULT_USER_EMAIL: \${N8N_DEFAULT_USER_EMAIL}
      N8N_DEFAULT_USER_PASSWORD: \${N8N_DEFAULT_USER_PASSWORD}

      # Telemetry/background calls off
      N8N_DIAGNOSTICS_ENABLED: \${N8N_DIAGNOSTICS_ENABLED}
      N8N_VERSION_NOTIFICATIONS_ENABLED: \${N8N_VERSION_NOTIFICATIONS_ENABLED}
      N8N_TEMPLATES_ENABLED: \${N8N_TEMPLATES_ENABLED}

      # DB
      DB_TYPE: postgresdb
      DB_POSTGRESDB_HOST: postgres
      DB_POSTGRESDB_PORT: 5432
      DB_POSTGRESDB_DATABASE: \${PG_DB}
      DB_POSTGRESDB_USER: \${PG_USER}
      DB_POSTGRESDB_PASSWORD: \${PG_PASSWORD}

      # TZ
      GENERIC_TIMEZONE: Europe/Berlin
      TZ: Europe/Berlin

      # Encryption
      N8N_ENCRYPTION_KEY: \${N8N_ENCRYPTION_KEY}

    volumes:
      - ./volumes/n8n-data:/home/node/.n8n
    networks:
      - customer-net

networks:
  customer-net:
    driver: bridge
YML"

# Fix permissions for n8n volume (prevents restart loop EACCES)
pct_exec "${CTID}" "mkdir -p /opt/customer-stack/volumes/n8n-data /opt/customer-stack/volumes/postgres/data"
pct_exec "${CTID}" "chown -R 1000:1000 /opt/customer-stack/volumes/n8n-data"

# Bring up stack
pct_exec "${CTID}" "cd /opt/customer-stack && docker compose pull"
pct_exec "${CTID}" "cd /opt/customer-stack && docker compose up -d"
pct_exec "${CTID}" "cd /opt/customer-stack && docker compose ps"

info "Step 7 OK: Stack deployed"
info "n8n intern: http://${CT_IP}:5678/"
info "n8n extern (geplant via OPNsense): https://${FQDN}"
info "Hinweis: Telemetrie/Template/Versionschecks sind deaktiviert (n8n docs)."

# ---------------------------
# FINAL: JSON output for automation
# ---------------------------
# Output on stdout ONLY (so you can capture it cleanly)
cat <<JSON
{
  "ctid": "${CTID}",
  "hostname": "$(json_escape "${CT_HOSTNAME}")",
  "fqdn": "$(json_escape "${FQDN}")",
  "ip": "$(json_escape "${CT_IP}")",
  "network": {
    "bridge": "$(json_escape "${BRIDGE}")",
    "vlan": "$(json_escape "${VLAN:-}")",
    "ipcfg": "$(json_escape "${IPCFG}")"
  },
  "urls": {
    "n8n_internal": "http://$(json_escape "${CT_IP}"):5678/",
    "n8n_external": "https://$(json_escape "${FQDN}")"
  },
  "postgres": {
    "db": "$(json_escape "${PG_DB}")",
    "user": "$(json_escape "${PG_USER}")",
    "password": "$(json_escape "${PG_PASSWORD}")",
    "host": "postgres",
    "port": 5432
  },
  "n8n": {
    "encryption_key": "$(json_escape "${N8N_ENCRYPTION_KEY}")",
    "default_user_email": "$(json_escape "${N8N_DEFAULT_USER_EMAIL}")",
    "default_user_password": "$(json_escape "${N8N_DEFAULT_USER_PASSWORD}")",
    "secure_cookie": "$(json_escape "${N8N_SECURE_COOKIE}")",
    "telemetry_disabled": true
  }
}
JSON