test: unify valkey.sh/alpine-valkey.sh, msg_menu OS choice

ct/patchmon.sh

@@ -76,15 +76,7 @@ EOF
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "PatchMon" "PatchMon/PatchMon" "singlefile" "latest" "/opt/patchmon" "patchmon-server-linux-$(arch_resolve)"
     mv /opt/patchmon/PatchMon /opt/patchmon/patchmon-server
-
-    msg_info "Updating SCAP Content"
-    RELEASE=$(get_latest_github_release "ComplianceAsCode/content")
-    curl_with_retry "https://github.com/ComplianceAsCode/content/releases/download/v${RELEASE}/scap-security-guide-${RELEASE}.tar.gz" "/tmp/ssg.tar.gz"
-    mkdir -p /opt/patchmon/ssg-content
-    find /opt/patchmon/ssg-content -mindepth 1 -delete
-    tar -xzf /tmp/ssg.tar.gz -C /opt/patchmon/ssg-content --strip-components=1 --wildcards '*/ssg-*-ds.xml'
-    rm -f /tmp/ssg.tar.gz
-    msg_ok "Updated SCAP Content"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "ssg-content" "ComplianceAsCode/content" "prebuild" "latest" "/opt/patchmon/ssg-content" "scap-security-guide-*.tar.gz"
 
     restore_backup
 

ct/valkey.sh

@@ -8,13 +8,23 @@ source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxV
 APP="Valkey"
 var_tags="${var_tags:-database}"
 var_cpu="${var_cpu:-1}"
-var_ram="${var_ram:-1024}"
-var_disk="${var_disk:-4}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 
+if [[ -z "${var_os:-}" ]]; then
+  var_os=$(msg_menu "Choose the container OS" "debian" "Debian 13 (TLS supported)" "alpine" "Alpine 3.24 (smaller, no TLS)")
+fi
+
+if [[ "$var_os" == "alpine" ]]; then
+  var_ram="${var_ram:-256}"
+  var_disk="${var_disk:-1}"
+  var_version="${var_version:-3.24}"
+else
+  var_ram="${var_ram:-1024}"
+  var_disk="${var_disk:-4}"
+  var_version="${var_version:-13}"
+fi
+
 header_info "$APP"
 variables
 color
@@ -24,16 +34,66 @@ function update_script() {
     header_info
     check_container_storage
     check_container_resources
-    if [[ ! -f /lib/systemd/system/valkey-server.service ]]; then
-        msg_error "No Valkey Installation Found!"
-        exit
+
+    IS_ALPINE=0
+    [[ -f /etc/alpine-release ]] && IS_ALPINE=1
+
+    if [[ "$IS_ALPINE" == "1" ]]; then
+        if [[ ! -f /etc/init.d/valkey ]]; then
+            msg_error "No Valkey Installation Found!"
+            exit
+        fi
+    else
+        if [[ ! -f /lib/systemd/system/valkey-server.service ]]; then
+            msg_error "No Valkey Installation Found!"
+            exit
+        fi
     fi
-    msg_info "Updating Valkey LXC"
-    $STD apt update
-    $STD apt -y upgrade
-    msg_ok "Updated Valkey LXC"
-    msg_ok "Updated successfully!"
-    exit
+
+    LXCIP=$(ip a s dev eth0 | awk '/inet / {print $2}' | cut -d/ -f1)
+
+    CHOICE=$(msg_menu "Valkey Management" \
+        "1" "Update Valkey" \
+        "2" "Allow 0.0.0.0 for listening" \
+        "3" "Allow only ${LXCIP} for listening")
+
+    case $CHOICE in
+    1)
+        msg_info "Updating Valkey"
+        if [[ "$IS_ALPINE" == "1" ]]; then
+            apk update && apk upgrade valkey
+            rc-service valkey restart
+        else
+            $STD apt update
+            $STD apt -y upgrade
+        fi
+        msg_ok "Updated Valkey"
+        msg_ok "Updated successfully!"
+        exit
+        ;;
+    2)
+        msg_info "Setting Valkey to listen on all interfaces"
+        sed -i 's/^bind .*/bind 0.0.0.0/' /etc/valkey/valkey.conf
+        if [[ "$IS_ALPINE" == "1" ]]; then
+            rc-service valkey restart
+        else
+            systemctl restart valkey-server
+        fi
+        msg_ok "Valkey now listens on all interfaces!"
+        exit
+        ;;
+    3)
+        msg_info "Setting Valkey to listen only on ${LXCIP}"
+        sed -i "s/^bind .*/bind ${LXCIP}/" /etc/valkey/valkey.conf
+        if [[ "$IS_ALPINE" == "1" ]]; then
+            rc-service valkey restart
+        else
+            systemctl restart valkey-server
+        fi
+        msg_ok "Valkey now listens only on ${LXCIP}!"
+        exit
+        ;;
+    esac
 }
 
 start
@@ -42,5 +102,5 @@ description
 
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:6379${CL}"
+echo -e "${INFO}${YW}Connect to Valkey CLI using the following command:${CL}"
+echo -e "${GATEWAY}${BGN}valkey-cli -h ${IP} -p 6379${CL}"

install/patchmon-install.sh

@@ -86,13 +86,7 @@ for arch in "${AGENT_NAME[@]}"; do
 done
 msg_ok "Fetched PatchMon agent binaries"
 
-msg_info "Fetching SCAP Content"
-RELEASE=$(get_latest_github_release "ComplianceAsCode/content")
-curl_with_retry "https://github.com/ComplianceAsCode/content/releases/download/v${RELEASE}/scap-security-guide-${RELEASE}.tar.gz" "/tmp/ssg.tar.gz"
-mkdir -p /opt/patchmon/ssg-content
-tar -xzf /tmp/ssg.tar.gz -C /opt/patchmon/ssg-content --strip-components=1 --wildcards '*/ssg-*-ds.xml'
-rm -f /tmp/ssg.tar.gz
-msg_ok "Fetched SCAP Content"
+fetch_and_deploy_gh_release "ssg-content" "ComplianceAsCode/content" "prebuild" "latest" "/opt/patchmon/ssg-content" "scap-security-guide-*.tar.gz"
 
 msg_info "Creating service"
 cat <<EOF >/etc/systemd/system/patchmon-server.service

install/valkey-install.sh

@@ -13,12 +13,23 @@ setting_up_container
 network_check
 update_os
 
+IS_ALPINE=0
+[[ -f /etc/alpine-release ]] && IS_ALPINE=1
+
 msg_info "Installing Valkey"
-$STD apt update
-$STD apt install -y valkey openssl
+if [[ "$IS_ALPINE" == "1" ]]; then
+  $STD apk add valkey valkey-openrc valkey-cli
+else
+  $STD apt update
+  $STD apt install -y valkey openssl
+fi
 sed -i 's/^bind .*/bind 0.0.0.0/' /etc/valkey/valkey.conf
 
-PASS="$(openssl rand -base64 48 | tr -dc 'a-zA-Z0-9' | head -c32)"
+if [[ "$IS_ALPINE" == "1" ]]; then
+  PASS="$(head -c 100 /dev/urandom | tr -dc 'a-zA-Z0-9' | head -c32)"
+else
+  PASS="$(openssl rand -base64 48 | tr -dc 'a-zA-Z0-9' | head -c32)"
+fi
 echo "requirepass $PASS" >>/etc/valkey/valkey.conf
 echo "$PASS" >~/valkey.creds
 chmod 600 ~/valkey.creds
@@ -34,9 +45,12 @@ echo "maxmemory-policy allkeys-lru" >>/etc/valkey/valkey.conf
 echo "maxmemory-samples 10" >>/etc/valkey/valkey.conf
 msg_ok "Installed Valkey"
 
-echo
-read -r -p "${TAB3}Enable TLS for Valkey (Sentinel mode does not supported)? [y/N]: " prompt
-if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
+if [[ "$IS_ALPINE" == "1" ]]; then
+  msg_info "Skipping TLS (Alpine's valkey package is compiled without TLS support)"
+else
+  echo
+  read -r -p "${TAB3}Enable TLS for Valkey (Sentinel mode does not supported)? [y/N]: " prompt
+  if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
     read -r -p "${TAB3}Use TLS-only mode (disable TCP port 6379)? [y/N]: " tls_only
     msg_info "Configuring TLS for Valkey..."
 
@@ -47,7 +61,7 @@ if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
     chown valkey:valkey "$TLS_CERT" "$TLS_KEY"
 
     if [[ ${tls_only,,} =~ ^(y|yes)$ ]]; then
-        cat <<EOF >/etc/valkey/valkey.conf
+      cat <<EOF >>/etc/valkey/valkey.conf
 
 # TLS configuration generated by Proxmox VE Valkey helper-script
 port 0
@@ -56,9 +70,9 @@ tls-cert-file $TLS_DIR/valkey.crt
 tls-key-file $TLS_DIR/valkey.key
 tls-auth-clients no
 EOF
-        msg_ok "Enabled TLS-only mode on port 6379"
+      msg_ok "Enabled TLS-only mode on port 6379"
     else
-        cat <<EOF >/etc/valkey/valkey.conf
+      cat <<EOF >>/etc/valkey/valkey.conf
 
 # TLS configuration generated by Proxmox VE Valkey helper-script
 tls-port 6380
@@ -66,12 +80,18 @@ tls-cert-file $TLS_DIR/valkey.crt
 tls-key-file $TLS_DIR/valkey.key
 tls-auth-clients no
 EOF
-        msg_ok "Enabled TLS on port 6380 and TCP on 6379"
+      msg_ok "Enabled TLS on port 6380 and TCP on 6379"
     fi
+  fi
 fi
 
-systemctl enable -q --now valkey-server
-systemctl restart valkey-server
+if [[ "$IS_ALPINE" == "1" ]]; then
+  $STD rc-update add valkey default
+  $STD rc-service valkey start
+else
+  systemctl enable -q --now valkey-server
+  systemctl restart valkey-server
+fi
 
 motd_ssh
 customize

misc/tools.func

@@ -2542,7 +2542,7 @@ _deploy_source_tarball() {
 
   mkdir -p "$target"
   if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-    find "${target:?}" -mindepth 1 \( -type d -exec mountpoint -q {} \; -prune \) -o -delete
+    find "${target:?}" -mindepth 1 \( -type d -exec mountpoint -q {} \; -prune \) -o -print0 | xargs -0 rm -rf --
   fi
 
   tar --no-same-owner -xzf "$tarball" -C "$workdir" || {
@@ -2631,7 +2631,7 @@ _deploy_unpacked_archive() {
   # was truncated, the archive was unreadable, or it unpacked to nothing.
   mkdir -p "$target"
   if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-    find "${target:?}" -mindepth 1 \( -type d -exec mountpoint -q {} \; -prune \) -o -delete
+    find "${target:?}" -mindepth 1 \( -type d -exec mountpoint -q {} \; -prune \) -o -print0 | xargs -0 rm -rf --
   fi
 
   if ! cp -r "$source_dir"/* "$target/"; then
@@ -9372,7 +9372,7 @@ fetch_and_deploy_from_url() {
   mkdir -p "$directory"
 
   if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-    find "${directory:?}" -mindepth 1 \( -type d -exec mountpoint -q {} \; -prune \) -o -delete
+    find "${directory:?}" -mindepth 1 \( -type d -exec mountpoint -q {} \; -prune \) -o -print0 | xargs -0 rm -rf --
   fi
 
   local unpack_tmp