* Add host CA inheritance for container builds
Introduces `var_inherit_host_ca` (default `auto`) across variable loading, validation, defaults, and persisted app vars. The advanced settings flow now includes a dedicated Host CA Inheritance step and surfaces the selection in the final summary.
Adds `_apply_host_ca_certs_in_container()` to copy host certificates from `/usr/local/share/ca-certificates/*.crt` into the container and refresh trust with `update-ca-certificates` when available. This runs during container setup after proxy configuration, with safe no-op behavior when no host certs exist or inheritance is disabled.
* Warn when host CA inheritance is disabled
Changes the log level from info to warning when host CA inheritance is skipped by configuration, and includes the number of host certificates detected. This makes intentional skips more visible while still showing useful context.
* core: make host CA inheritance opt-in (default no)
Addresses review feedback: default to 'no' instead of 'auto' so certs are
only inherited when explicitly enabled in advanced mode, preserving LXC
isolation by default.
---------
Co-authored-by: michel.roegl-brunner@htl-braunau.at <michel.roegl-brunner@htl-braunau.at>
* Harden remote func bootstrapping
Replace bare `source <(curl ...)` calls with a `_bootstrap_source` helper that validates both the download exit code and the presence of a probe function after sourcing. This prevents silent failures when DNS is not yet available in a freshly booted container or when a download fails mid-stream. Applies to build.func, install.func, and alpine-install.func. Also adds retry flags and a connect timeout to curl/wget.
* Refactor bootstrap error handling with helper
Extract repeated fatal-error logic into a `_bootstrap_die` helper across alpine-install.func, build.func, and install.func. The helper uses `msg_error` when available, falling back to stderr, then exits with code 115. Inline error blocks are replaced with cleaner one-liner `|| _bootstrap_die` calls.
Clarify the upgrade prompt options in `create_lxc_container`, treat empty or unrecognized input as ignore instead of implicit cancel, and explicitly abort container creation when the user chooses Cancel.
* core: add OS mismatch guard for container updates
Introduces `check_container_os_guard()` to compare the container's `/etc/os-release` against the script's recommended `var_os`/`var_version` before running updates. On mismatch, interactive runs now prompt to continue (default no), while silent/headless runs abort to avoid partial breakage on unsupported bases. A bypass flag (`var_ignore_os_mismatch=1|yes|true|on`) was added, and the guard is wired into all update entry paths in `start()`.
* Refine OS mismatch update guidance
Updates the OS version mismatch prompts in `check_container_os_guard()` to recommend upgrading the existing container OS to the target release before rerunning the update, instead of recreating the container. The skip/error path now uses the same guidance while still documenting `var_ignore_os_mismatch=1` as an override.
* Add persistent OS mismatch bypass option
Enhances `check_container_os_guard` to support a persistent opt-out for OS version mismatch checks. The prompt now uses a 3-option whiptail menu (cancel, continue once, continue and remember), and stores ignored targets in `/root/.helper-scripts-ignoreOSupdate` so users are re-prompted when a newer recommended OS appears. Messaging was also tightened to explicitly warn that bypassing may break updates and is unsupported.
* switch to /usr/local
read -t returns >128 on a real timeout, but a lower/plain error code
on a genuine read failure (e.g. broken/closed stdin, I/O error) -
these were treated identically as "no response", so a user whose
keystroke failed to be captured (e.g. a transient stdin I/O error)
got their container silently destroyed instead of kept. Only
auto-remove on an actual timeout; on a hard read failure, keep the
container (reversible) and tell the user how to remove it manually.
Overhaul the telemetry system to enforce a single-reporter model where only the HOST sends terminal statuses (success/failed/aborted) to the API. Containers now write local artifact files (.failed flag + .errinfo) that the host picks up after lxc-attach returns, preventing the race condition where a metadata-less container payload would win over the full host payload.
Key changes:
- Add TELEMETRY_CONTEXT=container export in install.func/alpine-install.func to mark container context before error handling starts
- Introduce _is_container_context() heuristic and _container_write_failure() artifact writer in error_handler.func
- Refactor api.func: unified _tm_payload() builder (full metadata on every send), _tm_send() curl wrapper, _tm_enabled() gate, telemetry_collect_sysinfo() cached collector
- Add structured .errinfo capture in silent() (core.func) using byte-offset to extract exactly the failing command's output
- Pull .errinfo from container in build.func after lxc-attach for precise error traces
- Add categorize_error(), telemetry_new_attempt(), detect_arm(), REPO_SLUG tracking
- Signal exits (129/130/143) now report as 'aborted' instead of 'failed'
- Remove post_update_to_api_extended() (superseded by unified _tm_payload)
- Export REPO_SOURCE, REPO_SLUG, TELEMETRY_PLATFORM into container environment
Introduce host CA certificate propagation in the shared LXC build flow so containers can trust enterprise/private PKI roots during early package bootstrap. Add an advanced-install toggle with default auto behavior so unattended installs remain seamless while interactive users can explicitly opt out.
Co-authored-by: Michel Roegl-Brunner <michel.roegl-brunner@example.com>
Query PocketBase pinned_version/pin_reason during LXC updates and show an informational message when the installed version matches the pin, so users know not to open issues for missing newer updates.
Allow users to set var_ignore_disable=true to continue past the 'script disabled' guard in runtime_script_status_guard(). A warning is still shown, but execution continues instead of aborting. Deleted scripts remain a hard stop.
* Add runtime script status guard and deleted-script stubs.
Prevent disabled/deleted scripts from running updates with clear user messages, and ensure deleted ct scripts are stubbed automatically so legacy update commands no longer fail with 404.
* Delete ct/ente.sh
* Update booklore.sh
* misc scripts: add support for arm64
* Replace tools.func call that checks arch
* Update misc/build.func
Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com>
* Update misc/build.func
Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com>
* Update misc/build.func
Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com>
* Update misc/build.func
Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com>
* build.func: change back to VE
* build.func: remove arm64 support for focal, bullseye
Legacy support removed since no cts use them anymore.
* Improve arm64 support and arch-specific downloads
Add clearer architecture error messages and gate arm64 usage, plus implement architecture-aware behavior across the toolkit. Changes include: update exit-code messages to reference amd64/arm64, refuse arm64 unless explicitly enabled, show architecture in summaries, and use arch-specific package lists when installing in containers. Make downloads for FFmpeg and yq choose the correct amd64/arm64 binaries, tighten template download error handling and formatting, and clean up minor whitespace/comment issues. These changes aim to make arm64 handling explicit and downloads/installations more robust for non-amd64 systems.
* remove arm64 overlay
* update ifupdown2 source
* Revert "remove arm64 overlay"
This reverts commit 231945dfa7.
* Revert changes from "Improve arm64 support and arch-specific downloads"
* Reapply "Improve arm64 support and arch-specific downloads"
This reapplies commit 7c051fb648.
* Reapply "remove arm64 overlay"
This reverts commit 866b6950c0.
* Redo template name handling
* fix template name handling change
* add ensure_whiptail function
This is required as some arm64 systems will not have whiptail installed, as it is not installed by default.
* add arm64_notice function
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* fix for copilot detected bugs
---------
Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com>
Co-authored-by: CanbiZ (MickLesk) <47820557+MickLesk@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* fix: derive LXC banner OS from os-release
Read os-release at login time for the generated LXC banner so OS display stays accurate after template changes or in-place upgrades. Prefer PRETTY_NAME with safe fallbacks to NAME, template defaults, and Unknown OS while preserving existing banner formatting.
Co-authored-by: Cursor <cursoragent@cursor.com>
* refactor: simplify dynamic LXC banner OS resolution
Reduce banner OS rendering to a minimal runtime os-release read with PRETTY_NAME/NAME fallbacks and Unknown OS default. Remove redundant OS rewrites from update_motd_ip now that OS display is resolved dynamically at login.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* feat(update-apps): add var_continue_on_error and TERM=dumb fix
- Add var_continue_on_error=yes to skip failed containers instead
of aborting all remaining updates. Useful for cron/unattended runs
where one disabled or broken script should not stop others.
Containers with backup still attempt restore on failure regardless.
- Set TERM=dumb when running pct exec to prevent whiptail from
hanging when no TTY is available (e.g. cron jobs redirecting
stdout/stderr). This causes whiptail to fail-fast instead of
blocking indefinitely.
- Add var_continue_on_error to export_config_json, --help output,
and usage examples (cron-style invocation example added).
* feat(update-apps): add var_dry_run to check updates without applying
Adds dry-run mode (var_dry_run=yes) that reports available updates for
all selected containers without modifying anything:
- Extracts GitHub source repo from the ct script header (# Source:)
- Resolves the version file name from check_for_gh_release app arg
- Reads current installed version from ~/.appname inside the container
- Queries GitHub API /releases/latest for comparison
- Outputs color-coded status: up-to-date (green), update available (yellow),
or unknown (blue/yellow with reason)
Non-GitHub sources (Codeberg, custom URLs) are skipped with a notice.
Resource scaling is suppressed entirely during dry-run.
Example usage:
var_container=all_running var_skip_confirm=yes var_dry_run=yes \
bash -c "$(curl -fsSL .../update-apps.sh)"
* fix(update-apps): dry-run uses check_for_gh_release args, not Source header
The # Source: header can point to a different repo than what
check_for_gh_release actually queries (e.g. RustDesk uses
lejianwen fork, not official rustdesk repo).
Now parse both app name and source repo directly from the
check_for_gh_release call in the ct script:
check_for_gh_release "appname" "owner/repo"
Also fix $HOME/.appname path expansion in pct exec context.
* fix issue on clear()
* feat(update-apps): add no-op clear wrapper to PATH for update scripts
Co-authored-by: Copilot <copilot@github.com>
* feat(update-apps): enhance error handling for unattended mode in resource checks
Co-authored-by: Copilot <copilot@github.com>
* feat(update-apps): implement structured logging and summary report for updates
Co-authored-by: Copilot <copilot@github.com>
* fix log issue
Co-authored-by: Copilot <copilot@github.com>
* feat(update-apps): enhance dry-run functionality and logging for container updates
Co-authored-by: Copilot <copilot@github.com>
* feat(update-apps): add dry-run completion message for better user feedback
Co-authored-by: Copilot <copilot@github.com>
---------
Co-authored-by: Copilot <copilot@github.com>
* fix(lxc-stack): use dist-upgrade and improve recovery prompt
When the host LXC stack is too old for a template, upgrading only
pve-container/lxc-pve can leave the Proxmox stack in an inconsistent state.
Use a full dist-upgrade instead.
Also refine the recovery prompt:
- [1] Upgrade LXC stack now
- [2] Older template fallback only when actually available
- [3] Ignore
- [4] Cancel
Do not auto-fallback to an older template after ignore/failure; honor the
user's explicit choice and stop with a clear error instead.
* chore(lxc-stack-prompt): clarify host dist-upgrade action in option 1
* Update build.func
* fix(lxc-stack): use host upgrade instead of dist-upgrade in recovery flow
* Enhance upgrade prompt with warning message
Added a warning message to inform users about the implications of running the host upgrade.
---------
Co-authored-by: Michel Roegl-Brunner <73236783+michelroegl-brunner@users.noreply.github.com>
When PHS_SILENT and PHS_VERBOSE are both set, stop falling back to interactive mode. Changes prefer silent mode to keep automation safe and avoid blocking unattended/non-TTY updates. Only show a whiptail warning when both stdin/stdout are TTYs and whiptail is present, and ignore any whiptail errors. Added a brief comment and adjusted the fallback message accordingly.
CanbiZ (MickLesk)