From 555d908dd2eceb9ef39b292cc1202122dd626f6c Mon Sep 17 00:00:00 2001
From: Wolfgang <metzw@metz.tech>
Date: Sun, 11 Jan 2026 15:03:55 +0100
Subject: [PATCH] Prototype2.3-fix_ostemplate

---
 install.sh     | 123 +++++++++++++----------
 libsupabase.sh | 261 ++++++++++++++++---------------------------------
 2 files changed, 153 insertions(+), 231 deletions(-)

diff --git a/install.sh b/install.sh
index d8e8e95..a23da27 100755
--- a/install.sh
+++ b/install.sh
@@ -11,19 +11,22 @@ Usage:
   bash install.sh [options]
 
 Core options:
-  --ctid <id>                 Force CT ID (optional). If omitted, a customer-safe CTID is generated.
+  --ctid <id>                 Force CT ID (optional). If omitted, customer-safe CTID is generated (epoch-1000000000).
   --cores <n>                 (default: 2)
   --memory <mb>               (default: 4096)
   --swap <mb>                 (default: 512)
   --disk <gb>                 (default: 50)
   --bridge <vmbrX>            (default: vmbr0)
-  --vlan <id>                 VLAN tag on net0 (default: 90)
   --storage <storage>         (default: local-zfs)
   --ip <dhcp|CIDR>            (default: dhcp)
+  --vlan <id>                 VLAN tag for net0 (default: 90)
+  --domain <domain>           Base domain for FQDN (default: userman.de)
   --privileged                Create privileged CT (default: unprivileged)
-  --fqdn-suffix <domain>      (default: userman.de) -> FQDN becomes sb-<time>.<domain>
   --help                      Show help
 
+Examples:
+  bash install.sh
+  bash install.sh --storage local-zfs --bridge vmbr0 --ip dhcp --vlan 90
 EOF
 }
 
@@ -34,11 +37,11 @@ MEMORY="4096"
 SWAP="512"
 DISK="50"
 BRIDGE="vmbr0"
-VLAN="90"
 STORAGE="local-zfs"
 IPCFG="dhcp"
+VLAN="90"
+DOMAIN="userman.de"
 UNPRIV="1"
-FQDN_SUFFIX="userman.de"
 
 # ---------------------------
 # Arg parsing
@@ -51,23 +54,24 @@ while [[ $# -gt 0 ]]; do
     --swap) SWAP="${2:-}"; shift 2 ;;
     --disk) DISK="${2:-}"; shift 2 ;;
     --bridge) BRIDGE="${2:-}"; shift 2 ;;
-    --vlan) VLAN="${2:-}"; shift 2 ;;
     --storage) STORAGE="${2:-}"; shift 2 ;;
     --ip) IPCFG="${2:-}"; shift 2 ;;
-    --fqdn-suffix) FQDN_SUFFIX="${2:-}"; shift 2 ;;
+    --vlan) VLAN="${2:-}"; shift 2 ;;
+    --domain) DOMAIN="${2:-}"; shift 2 ;;
     --privileged) UNPRIV="0"; shift 1 ;;
     --help|-h) usage; exit 0 ;;
     *) die "Unknown option: $1 (use --help)" ;;
   esac
 done
 
-# Validation
+# Basic validation
 [[ "$CORES" =~ ^[0-9]+$ ]] || die "--cores must be integer"
 [[ "$MEMORY" =~ ^[0-9]+$ ]] || die "--memory must be integer"
 [[ "$SWAP" =~ ^[0-9]+$ ]] || die "--swap must be integer"
 [[ "$DISK" =~ ^[0-9]+$ ]] || die "--disk must be integer"
 [[ "$UNPRIV" == "0" || "$UNPRIV" == "1" ]] || die "internal: UNPRIV invalid"
-[[ "$VLAN" =~ ^[0-9]+$ ]] || die "--vlan must be integer"
+[[ "$VLAN" =~ ^[0-9]+$ ]] || die "--vlan must be integer (e.g. 90)"
+[[ -n "$DOMAIN" ]] || die "--domain must not be empty"
 
 if [[ "$IPCFG" != "dhcp" ]]; then
   [[ "$IPCFG" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}/[0-9]{1,2}$ ]] || die "--ip must be dhcp or CIDR (e.g. 192.168.45.171/24)"
@@ -78,7 +82,7 @@ info "Argument-Parsing OK"
 # ---------------------------
 # Preflight Proxmox
 # ---------------------------
-need_cmd pct pvesm pveam pvesh python3 grep date
+need_cmd pct pvesm pveam pvesh grep date openssl
 
 pve_storage_exists "$STORAGE" || die "Storage not found: $STORAGE"
 pve_bridge_exists "$BRIDGE" || die "Bridge not found: $BRIDGE"
@@ -86,9 +90,13 @@ pve_bridge_exists "$BRIDGE" || die "Bridge not found: $BRIDGE"
 TEMPLATE="$(pve_template_ensure_debian12 "$STORAGE")"
 info "Template OK: ${TEMPLATE}"
 
-# Hostname based on unix time (agreed)
-CT_HOSTNAME="sb-$(date +%s)"
-FQDN="${CT_HOSTNAME}.${FQDN_SUFFIX}"
+# Hostname based on unix time (as agreed)
+EPOCH="$(date +%s)"
+CT_HOSTNAME="sb-${EPOCH}"
+FQDN="${CT_HOSTNAME}.${DOMAIN}"
+info "SCRIPT_DIR=${SCRIPT_DIR}"
+info "CT_HOSTNAME=${CT_HOSTNAME}"
+info "FQDN=${FQDN}"
 
 # CTID selection
 if [[ -n "$CTID" ]]; then
@@ -100,10 +108,9 @@ else
   CTID="$(pve_select_customer_ctid)"
 fi
 
+[[ -n "$CTID" ]] || die "CTID selection failed (empty)"
 info "CTID selected: ${CTID}"
-info "SCRIPT_DIR=${SCRIPT_DIR}"
-info "CT_HOSTNAME=${CT_HOSTNAME}"
-info "FQDN=${FQDN}"
+
 info "cores=${CORES} memory=${MEMORY}MB swap=${SWAP}MB disk=${DISK}GB"
 info "bridge=${BRIDGE} storage=${STORAGE} ip=${IPCFG} vlan=${VLAN} unprivileged=${UNPRIV}"
 
@@ -135,7 +142,6 @@ CT_IP="$(pct_wait_for_ip "${CTID}" || true)"
 [[ -n "${CT_IP}" ]] || die "Could not determine CT IP after start"
 
 info "Step 5 OK: LXC erstellt + IP ermittelt"
-info "CT_HOSTNAME=${CT_HOSTNAME}"
 info "CT_IP=${CT_IP}"
 
 # ---------------------------
@@ -146,10 +152,9 @@ info "Step 6: Provisioning im CT (Docker + Locales + Base)"
 pct_exec "${CTID}" "export DEBIAN_FRONTEND=noninteractive; apt-get update -y"
 pct_exec "${CTID}" "export DEBIAN_FRONTEND=noninteractive; apt-get install -y ca-certificates curl gnupg lsb-release locales"
 
-# Ensure locale exists (de_DE + en_US to be safe), then set default locale file.
-pct_exec "${CTID}" "sed -i 's/^# \\(de_DE.UTF-8\\)/\\1/' /etc/locale.gen || true"
-pct_exec "${CTID}" "sed -i 's/^# \\(en_US.UTF-8\\)/\\1/' /etc/locale.gen || true"
-pct_exec "${CTID}" "locale-gen >/dev/null || true"
+# Locales (fix warning + set DE)
+pct_exec "${CTID}" "sed -i 's/^# *de_DE.UTF-8 UTF-8/de_DE.UTF-8 UTF-8/; s/^# *en_US.UTF-8 UTF-8/en_US.UTF-8 UTF-8/' /etc/locale.gen || true"
+pct_exec "${CTID}" "locale-gen >/dev/null 2>&1 || true"
 pct_exec "${CTID}" "update-locale LANG=de_DE.UTF-8 LC_ALL=de_DE.UTF-8 || true"
 
 # Docker official repo (Debian 12 / bookworm)
@@ -160,36 +165,36 @@ pct_exec "${CTID}" "echo \"deb [arch=\$(dpkg --print-architecture) signed-by=/et
 pct_exec "${CTID}" "export DEBIAN_FRONTEND=noninteractive; apt-get update -y"
 pct_exec "${CTID}" "export DEBIAN_FRONTEND=noninteractive; apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin"
 
-# Base directories
-pct_exec "${CTID}" "mkdir -p /opt/customer-stack/volumes /opt/customer-stack/sql"
+# Base dirs
+pct_exec "${CTID}" "mkdir -p /opt/customer-stack /opt/customer-stack/volumes /opt/customer-stack/sql"
 
 info "Step 6 OK: Docker + Compose Plugin installiert, Locales gesetzt, Basis-Verzeichnisse erstellt"
+info "Next: Schritt 7 (finales docker-compose + Secrets + n8n/supabase up + Healthchecks)"
 
 # ---------------------------
 # Step 7: Stack finalisieren + Secrets + Up + Checks
 # ---------------------------
 info "Step 7: Stack finalisieren + Secrets + Up + Checks"
 
-# Generate secrets on host (safe, deterministic output), then write .env inside CT.
+# Secrets (host-side generation, no broken pipelines)
 PG_DB="customer"
 PG_USER="customer"
-PG_PASSWORD="$(_rand_b64url 24)"
-N8N_ENCRYPTION_KEY="$(_rand_hex 32)"
-
+PG_PASSWORD="$(rand_pw_32)"
 N8N_PORT="5678"
 N8N_PROTOCOL="http"
 N8N_HOST="${CT_IP}"
 N8N_EDITOR_BASE_URL="https://${FQDN}/"
 WEBHOOK_URL="https://${FQDN}/"
 N8N_SECURE_COOKIE="false"
+N8N_ENCRYPTION_KEY="$(rand_hex_32)"
 
-# Telemetry / background calls off
+# Telemetry off (as you want)
 N8N_DIAGNOSTICS_ENABLED="false"
 N8N_VERSION_NOTIFICATIONS_ENABLED="false"
 N8N_TEMPLATES_ENABLED="false"
 
-# Write env
-pct exec "${CTID}" -- bash -lc "cat > /opt/customer-stack/.env <<'ENV'
+# Write .env
+pct_exec "${CTID}" "cat > /opt/customer-stack/.env <<'ENV'
 PG_DB=${PG_DB}
 PG_USER=${PG_USER}
 PG_PASSWORD=${PG_PASSWORD}
@@ -209,14 +214,14 @@ N8N_VERSION_NOTIFICATIONS_ENABLED=${N8N_VERSION_NOTIFICATIONS_ENABLED}
 N8N_TEMPLATES_ENABLED=${N8N_TEMPLATES_ENABLED}
 ENV"
 
-# Write init SQL (pgvector)
-pct exec "${CTID}" -- bash -lc "cat > /opt/customer-stack/sql/init_pgvector.sql <<'SQL'
+# SQL init for pgvector
+pct_exec "${CTID}" "cat > /opt/customer-stack/sql/init_pgvector.sql <<'SQL'
 CREATE EXTENSION IF NOT EXISTS vector;
 CREATE EXTENSION IF NOT EXISTS pgcrypto;
 SQL"
 
-# Write docker-compose.yml (final)
-pct exec "${CTID}" -- bash -lc "cat > /opt/customer-stack/docker-compose.yml <<'YML'
+# docker-compose.yml
+pct_exec "${CTID}" "cat > /opt/customer-stack/docker-compose.yml <<'YML'
 services:
   postgres:
     image: pgvector/pgvector:pg16
@@ -246,7 +251,6 @@ services:
         condition: service_healthy
     ports:
       - \"\${N8N_PORT}:5678\"
-    user: \"1000:1000\"
     environment:
       N8N_PORT: 5678
       N8N_PROTOCOL: \${N8N_PROTOCOL}
@@ -267,11 +271,10 @@ services:
 
       N8N_ENCRYPTION_KEY: \${N8N_ENCRYPTION_KEY}
 
-      # Telemetry/Template/Versionschecks aus
+      # Telemetry / background calls off
       N8N_DIAGNOSTICS_ENABLED: \${N8N_DIAGNOSTICS_ENABLED}
       N8N_VERSION_NOTIFICATIONS_ENABLED: \${N8N_VERSION_NOTIFICATIONS_ENABLED}
       N8N_TEMPLATES_ENABLED: \${N8N_TEMPLATES_ENABLED}
-
     volumes:
       - ./volumes/n8n-data:/home/node/.n8n
     networks:
@@ -282,31 +285,43 @@ networks:
     driver: bridge
 YML"
 
-# ---- IMPORTANT FIX: permissions BEFORE up ----
+# Permissions fix to prevent n8n restart loop (EACCES on /home/node/.n8n/config)
 pct_exec "${CTID}" "mkdir -p /opt/customer-stack/volumes/n8n-data /opt/customer-stack/volumes/postgres/data"
 pct_exec "${CTID}" "chown -R 1000:1000 /opt/customer-stack/volumes/n8n-data"
-pct_exec "${CTID}" "chown -R 999:999 /opt/customer-stack/volumes/postgres/data || true"
 
-# Pull + up
+# Deploy
 pct_exec "${CTID}" "cd /opt/customer-stack && docker compose pull"
 pct_exec "${CTID}" "cd /opt/customer-stack && docker compose up -d"
 pct_exec "${CTID}" "cd /opt/customer-stack && docker compose ps"
 
 info "Step 7 OK: Stack deployed"
-info "n8n intern: http://${CT_IP}:5678/"
+info "n8n intern: http://${CT_IP}:${N8N_PORT}/"
 info "n8n extern (geplant via OPNsense): https://${FQDN}"
 info "Hinweis: Telemetrie/Template/Versionschecks sind deaktiviert (n8n docs)."
 
-# Emit machine-readable JSON for automation (n8n can parse this)
-emit_result_json \
-  "CTID=${CTID}" \
-  "CT_HOSTNAME=${CT_HOSTNAME}" \
-  "CT_IP=${CT_IP}" \
-  "VLAN=${VLAN}" \
-  "FQDN=${FQDN}" \
-  "N8N_INTERNAL_URL=http://${CT_IP}:5678/" \
-  "N8N_EXTERNAL_URL=https://${FQDN}/" \
-  "PG_DB=${PG_DB}" \
-  "PG_USER=${PG_USER}" \
-  "PG_PASSWORD=${PG_PASSWORD}" \
-  "N8N_ENCRYPTION_KEY=${N8N_ENCRYPTION_KEY}"
+# ---------------------------
+# FINAL OUTPUT: JSON (STDOUT)
+# ---------------------------
+# This MUST be machine-readable: no logs here.
+cat <<JSON
+{
+  "ctid": ${CTID},
+  "hostname": "${CT_HOSTNAME}",
+  "fqdn": "${FQDN}",
+  "ip": "${CT_IP}",
+  "vlan": ${VLAN},
+  "n8n": {
+    "internal_url": "http://${CT_IP}:${N8N_PORT}/",
+    "external_url": "https://${FQDN}",
+    "port": ${N8N_PORT},
+    "encryption_key": "${N8N_ENCRYPTION_KEY}"
+  },
+  "postgres": {
+    "db": "${PG_DB}",
+    "user": "${PG_USER}",
+    "password": "${PG_PASSWORD}",
+    "host_in_docker": "postgres",
+    "port": 5432
+  }
+}
+JSON
diff --git a/libsupabase.sh b/libsupabase.sh
index 522c79f..bca10bb 100755
--- a/libsupabase.sh
+++ b/libsupabase.sh
@@ -1,34 +1,18 @@
 #!/usr/bin/env bash
 set -Eeuo pipefail
 
-# ---------------------------
-# Logging / trap helpers
-# ---------------------------
-
+# ----------------------------
+# Logging (ALLES nach STDERR!)
+# ----------------------------
 _ts() { date '+%F %T'; }
 
-_is_tty() { [[ -t 1 ]]; }
-
-_color() {
-  local code="$1"; shift
-  if _is_tty; then printf "\033[%sm%s\033[0m" "$code" "$*"; else printf "%s" "$*"; fi
-}
-
-log()  { echo "[$(_ts)] $*"; }
-info() { log "$(_color '36' 'INFO:') $*"; }
-warn() { log "$(_color '33' 'WARN:') $*"; }
-err()  { log "$(_color '31' 'ERROR:') $*"; }
-
-die() { err "$*"; exit 1; }
-
-on_error() {
-  local lineno="$1" cmd="$2" code="$3"
-  err "Failed at line ${lineno}: ${cmd} (exit=${code})"
-  exit 1
-}
+log()  { echo "[$(_ts)] $*" >&2; }
+info() { log "INFO: $*"; }
+warn() { log "WARN: $*"; }
+die()  { log "ERROR: $*"; exit 1; }
 
 setup_traps() {
-  trap 'on_error "$LINENO" "$BASH_COMMAND" "$?"' ERR
+  trap 'die "Failed at line ${LINENO}: ${BASH_COMMAND} (exit=$?)"' ERR
 }
 
 need_cmd() {
@@ -38,10 +22,9 @@ need_cmd() {
   done
 }
 
-# ---------------------------
+# ----------------------------
 # Proxmox helpers
-# ---------------------------
-
+# ----------------------------
 pve_storage_exists() {
   local st="$1"
   pvesm status --storage "$st" >/dev/null 2>&1
@@ -52,193 +35,117 @@ pve_bridge_exists() {
   [[ -d "/sys/class/net/${br}/bridge" ]]
 }
 
-# Ensure Debian 12 template. Return "storage:vztmpl/xxx.tar.zst"
+# Return list of all VMIDs in the cluster (CT + VM), one per line.
+# No pipelines to "tail" etc. in-script -> avoids broken pipe.
+pve_cluster_vmids() {
+  need_cmd pvesh python3
+  local json
+  json="$(pvesh get /cluster/resources --type vm --output-format json 2>/dev/null || true)"
+  [[ -n "$json" ]] || return 0
+
+  python3 - <<'PY' <<<"$json"
+import json, sys
+try:
+    data = json.loads(sys.stdin.read())
+except Exception:
+    sys.exit(0)
+for r in data:
+    vmid = r.get("vmid")
+    if isinstance(vmid, int):
+        print(vmid)
+PY
+}
+
+pve_vmid_exists_cluster() {
+  local vmid="$1"
+  [[ "$vmid" =~ ^[0-9]+$ ]] || return 1
+  pve_cluster_vmids | awk -v id="$vmid" '$1==id{found=1} END{exit found?0:1}'
+}
+
+# Customer-safe CTID:
+# epoch - 1000000000  => e.g. 1768138201 -> 768138201
+pve_select_customer_ctid() {
+  need_cmd date
+  local base
+  base="$(date +%s)"
+  local ctid=$((base - 1000000000))
+
+  # ensure integer + not used
+  while pve_vmid_exists_cluster "$ctid"; do
+    ctid=$((ctid + 1))
+  done
+  echo "$ctid"
+}
+
+# Ensure Debian 12 template exists and return "storage:vztmpl/<file>" on STDOUT ONLY.
 pve_template_ensure_debian12() {
-  local store="$1"
-  local tpl="debian-12-standard_12.12-1_amd64.tar.zst"
-
   need_cmd pveam awk grep
+  local preferred_store="$1"
+  local tpl="debian-12-standard_12.12-1_amd64.tar.zst"
+  local store="$preferred_store"
 
-  # Some storages (like local-zfs) don't support templates in pveam
+  # Some storages (e.g. local-zfs) don't support templates in pveam.
   if ! pveam list "$store" >/dev/null 2>&1; then
-    warn "pveam storage '${store}' not available for templates; falling back to 'local'"
+    warn "pveam storage '$store' not available for templates; falling back to 'local'"
     store="local"
   fi
 
-  pveam update >/dev/null
-
-  # If not available locally, download
-  if ! pveam list "$store" | awk '{print $2}' | grep -qx "$tpl"; then
+  # Make sure template exists; download if missing
+  if ! pveam list "$store" 2>/dev/null | awk '{print $2}' | grep -qx "$tpl"; then
     info "Downloading CT template to ${store}: ${tpl}"
+    pveam update >/dev/null 2>&1 || true
     pveam download "$store" "$tpl" >/dev/null
   fi
 
+  # IMPORTANT: only echo the template ref on STDOUT
   echo "${store}:vztmpl/${tpl}"
 }
 
-# Build net0 string with optional VLAN tag
+# Build net0 string, supports VLAN tag
 pve_build_net0() {
   local bridge="$1"
-  local ip="$2"
+  local ipcfg="$2"
   local vlan="${3:-}"
 
-  if [[ "$ip" == "dhcp" ]]; then
-    if [[ -n "$vlan" ]]; then
-      echo "name=eth0,bridge=${bridge},ip=dhcp,tag=${vlan}"
-    else
-      echo "name=eth0,bridge=${bridge},ip=dhcp"
-    fi
+  local base="name=eth0,bridge=${bridge},ip=${ipcfg}"
+  if [[ -n "$vlan" ]]; then
+    echo "${base},tag=${vlan}"
   else
-    # static CIDR
-    if [[ -n "$vlan" ]]; then
-      echo "name=eth0,bridge=${bridge},ip=${ip},tag=${vlan}"
-    else
-      echo "name=eth0,bridge=${bridge},ip=${ip}"
-    fi
+    echo "${base}"
   fi
 }
 
-pct_exec() {
-  local ctid="$1"; shift
-  # run a command inside CT with bash -lc
-  pct exec "$ctid" -- bash -lc "$*"
-}
-
-# Wait until CT has an IPv4 on eth0. Returns IP or empty.
+# Wait for IPv4 on eth0
 pct_wait_for_ip() {
+  need_cmd pct awk cut head sleep
   local ctid="$1"
   local tries="${2:-60}"
-  local delay="${3:-1}"
 
-  local ip=""
-  while (( tries > 0 )); do
+  local i ip
+  for i in $(seq 1 "$tries"); do
     ip="$(pct exec "$ctid" -- bash -lc "ip -4 -o addr show dev eth0 2>/dev/null | awk '{print \$4}' | cut -d/ -f1 | head -n1" 2>/dev/null || true)"
     if [[ -n "$ip" ]]; then
       echo "$ip"
       return 0
     fi
-    sleep "$delay"
-    ((tries--))
+    sleep 1
   done
-  echo ""
   return 1
 }
 
-# ---------------------------
-# CTID strategy (your request)
-# ---------------------------
-# Customer-safe CTID:
-#   CTID = (unix_time - 1000000000)
-# This is stable until 2038 and avoids collisions with typical low VMIDs.
-
-customer_ctid_from_time() {
-  local now
-  now="$(date +%s)"
-  echo $(( now - 1000000000 ))
+pct_exec() {
+  local ctid="$1"; shift
+  pct exec "$ctid" -- bash -lc "$*"
 }
 
-# Check if a VMID exists cluster-wide using pvesh.
-# If pvesh fails (permissions/API), we still have a fallback.
-pve_vmid_exists_cluster() {
-  local vmid="$1"
-  need_cmd pvesh python3
-
-  # pvesh returns JSON; we parse safely in python
-  local json
-  json="$(pvesh get /cluster/resources --type vm --output-format json 2>/dev/null || true)"
-  [[ -n "$json" ]] || return 1
-
-  python3 - "$vmid" <<'PY' 2>/dev/null
-import sys, json
-vmid = int(sys.argv[1])
-data = json.load(sys.stdin)
-for r in data:
-    if int(r.get("vmid", -1)) == vmid:
-        sys.exit(0)
-sys.exit(1)
-PY
+# Generate secrets without pipelines that trigger broken-pipe noise
+rand_hex_32() {
+  need_cmd openssl
+  openssl rand -hex 32
 }
 
-# Select a CTID that does NOT exist cluster-wide.
-pve_select_customer_ctid() {
-  local ctid
-  ctid="$(customer_ctid_from_time)"
-
-  # If cluster check works, avoid collisions.
-  if pve_vmid_exists_cluster "$ctid"; then
-    # extremely unlikely, but add +1..+60 tries
-    local i
-    for i in $(seq 1 60); do
-      if ! pve_vmid_exists_cluster "$((ctid+i))"; then
-        echo "$((ctid+i))"
-        return 0
-      fi
-    done
-    die "CTID selection failed: all candidates busy"
-  fi
-
-  echo "$ctid"
-}
-
-# ---------------------------
-# Secrets (no 'tr: broken pipe')
-# ---------------------------
-
-_rand_hex() {
-  local nbytes="${1:-32}"
-  if command -v openssl >/dev/null 2>&1; then
-    openssl rand -hex "$nbytes"
-    return 0
-  fi
-  if command -v python3 >/dev/null 2>&1; then
-    python3 - <<PY
-import secrets
-print(secrets.token_hex(${nbytes}))
-PY
-    return 0
-  fi
-
-  # last resort: avoid pipefail by disabling locally
-  (
-    set +o pipefail
-    LC_ALL=C tr -dc 'a-f0-9' </dev/urandom | head -c $((nbytes*2))
-  )
-}
-
-_rand_b64url() {
-  local nbytes="${1:-32}"
-  if command -v python3 >/dev/null 2>&1; then
-    python3 - <<PY
-import secrets
-print(secrets.token_urlsafe(${nbytes}))
-PY
-    return 0
-  fi
-  # fallback
-  (
-    set +o pipefail
-    LC_ALL=C tr -dc 'A-Za-z0-9_-'
-  ) </dev/urandom | head -c $((nbytes*2))
-}
-
-json_escape() {
-  python3 - <<'PY'
-import json,sys
-print(json.dumps(sys.stdin.read())[1:-1])
-PY
-}
-
-emit_result_json() {
-  # Arguments are key=value pairs; prints a single JSON object
-  # Example: emit_result_json "CTID=123" "CT_IP=1.2.3.4"
-  python3 - "$@" <<'PY'
-import sys, json
-obj={}
-for kv in sys.argv[1:]:
-    if "=" not in kv: 
-        continue
-    k,v = kv.split("=",1)
-    obj[k]=v
-print(json.dumps(obj, ensure_ascii=False))
-PY
+rand_pw_32() {
+  need_cmd openssl
+  # URL-safe-ish
+  openssl rand -base64 32 | tr -d '\n' | tr '/+' 'Aa' | cut -c1-32
 }