* Update tools.func
- Add _TOOLS_FUNC_LOADED guard to prevent double-sourcing
- Remove duplicate is_alpine() (core.func version is more robust)
- Fix end_timer: now actually outputs duration (was silent)
- Fix SQL injection in setup_mariadb_db: escape single quotes in identifiers
- Fix SQL injection in setup_postgresql_db: escape single quotes in identifiers
- Fix sed injection in edit_yaml_config: escape | and & in value
- Fix command injection in curl_with_retry: use array instead of string eval
- Fix command injection in curl_api_with_retry: use array instead of string eval
* Update misc/tools.func
Co-authored-by: Sam Heinz <sam@samheinz.com>
---------
Co-authored-by: Sam Heinz <sam@samheinz.com>
Ensure cleanup runs from `/opt/babybuddy` before deleting old files, add `--` to the removal command for safer argument handling, and run `manage.py makemigrations` before `migrate` so database updates are applied reliably during upgrades.
Ensure Node module setup runs non-interactively by exporting COREPACK_ENABLE_DOWNLOAD_PROMPT=0, then handle corepack first when requested (including versioned specs). pnpm/yarn are now provisioned through corepack when enabled to avoid shim EEXIST collisions, with corepack modules skipped in the generic npm loop and conflicting shims cleaned only for npm-global installs. Also replace the global pnpm dangerouslyAllowAllBuilds setting with strictDepBuilds=false to avoid project-level config conflicts while keeping installs usable.
During the container update check, a failing 'docker pull' (local-only images, registry or permission errors) aborted the whole script under errexit. Ignore pull failures and skip containers whose digest could not be resolved.
SECRET_KEY_BASE_DUMMY forced Rails to write tmp/local_secret.txt, which failed with EACCES during update and aborted db:migrate. Drop the dummy flag so the real SECRET_KEY_BASE from .env is used, and ensure tmp exists.
* fix(degoog): restore bun symlinks after curl-impersonate update
The curl-impersonate CLEAN_INSTALL wipes /usr/local/bin, which removed the bun/bunx symlinks during update. Re-create them after the release deploy.
* clean install curl-impersonate
* sorting
- Trim whitespace, skip empty tokens and reject non-numeric input so a
malformed selection no longer feeds garbage into `sed -n "<index>p"`.
- Reject reversed ranges (start greater than end) with a clear message.
- Replace `grep | wc -l` with `grep -c` (ShellCheck SC2126).
- Replace the array-style exclude check (`${excluded_containers[@]}` on a
plain string) with an explicit per-VMID loop, resolving the ShellCheck
SC2199/SC2076 errors and avoiding accidental substring matches.
- Abort cleanly when the checklist dialog is cancelled instead of relying
on an unreachable `$?` test under `set -eEuo pipefail`.
- Exit gracefully on a declined confirmation prompt.
- Use `pct exec ... -- hostname` for consistent argument handling.
- AMD: download directly to "$microcode" instead of a convoluted, unquoted
basename of the full URL (fixes ShellCheck SC2046) and pin to https.
- Quote dpkg install and cleanup paths (SC2086) and use rm -f.
- Normalize the Debian pool URLs (drop the stray double/triple slashes).
- Define color variables directly instead of via $(echo ...) (SC2116/SC2028).
* Reduce IP-Tag resource usage and clean up ShellCheck findings
Performance / resource fixes in the generated service:
- VM IP detection only queries the QEMU guest agent when it is actually
enabled in the VM config. Previously every VM without an agent stalled
the loop for the full `qm guest cmd` timeout on each cycle; the timeout
is also lowered from 8s to 5s.
- Skip the ARP/ping fallback for VMs entirely when the guest agent already
returned addresses, avoiding needless ping probes every run.
- Snapshot `ip neighbor show` once per host instead of invoking it per MAC
in the VM and LXC lookups.
- Lower ping verification to a 1s timeout (`-W 1`).
ShellCheck cleanup in the installer:
- Define color variables directly instead of via $(echo ...) (SC2116/SC2028).
- Use `read -rp` everywhere (SC2162).
- Replace Unicode quotes with ASCII in a status message (SC1111).
* Cut IP-Tag CPU usage by avoiding per-guest pct/qm status calls
The periodic check spawned one `pct status` per container and one
`qm status` per VM each cycle. Both are heavy Perl tools (~hundreds of ms
CPU per invocation), so on hosts with many guests the 5-minute run caused
a noticeable CPU spike.
- Derive LXC status from the single `pct list` call that is already made
for enumeration.
- Add one `qm list` call to collect all VM statuses at once.
- Store both in a per-cycle STATUS_CACHE and read from it instead of
calling `pct status` / `qm status` per guest (with a fallback for direct
calls outside the cycle).
* trek: update install and upgrade workflow
Remove the hardcoded release tag and fetch the latest TREK release. Consolidate builds to npm workspaces (shared, client, server), copy client dist into server/public, and install/prune server deps for production. Add libkitinerary dependency and ensure dependencies during upgrade. Implement backup/restore during upgrades and add migration logic that detects the old systemd ExecStart; when present, rewrite trek.service to run the compiled dist via node --require tsconfig-paths/register, add XDG_CACHE_HOME and QT_QPA_PLATFORM env vars, and switch to network-online.target. Installer changes also create data/uploads directories, set additional .env defaults (TZ, LOG_LEVEL, DEFAULT_LANGUAGE, ALLOWED_ORIGINS), and adjust workspace setup steps.
* add proxy env
Updated the request script template for Proxmox VE Helper-Scripts to improve clarity and structure, including changes to input fields and validation requirements.
* fix(tools): improve error diagnostics and actionable hints across install functions
- Add _diagnose_deb_failure() helper: extracts package metadata from failed .deb installs,
detects PostgreSQL version conflicts (e.g., postgresql-16-vchord with PG17 active),
lists unmet dependencies, and provides specific actionable hints
- Replace all 4 generic 'Both apt and dpkg installation failed' messages in
fetch_and_deploy_{codeberg,gh,gl}_release and fetch_and_deploy_from_url with
_diagnose_deb_failure() for targeted diagnostics
- install_packages_with_retry: on failure, check which packages are missing from
configured repos and name them with a distribution-specific hint
- upgrade_packages_with_retry: add hint about held-back packages / apt-cache policy
- setup_postgresql: when PGDG repo is unavailable for trixie/forky/sid, show which
distro PG version will be installed and warn that extension packages must match
- setup_deb822_repo: include GPG key URL and firewall hint in download failure message
- curl_download: add network/DNS hint to the failure message
- error_handler: add log-pattern analysis block after Node.js OOM detection that
scans the last 60 log lines for 5 common failure patterns and emits msg_warn hints:
* APT/dpkg dependency conflict (generic + PostgreSQL version mismatch)
* APT GPG/signature verification failure (sqv, KEYEXPIRED, NO_PUBKEY)
* Network/DNS failure (Could not resolve, Failed to fetch)
* APT lock held by another process
* Disk space exhaustion (ENOSPC)
* fix(tools): consolidate OS detection, add error hints, sort setup functions
- Replace all 13 manual /etc/os-release reads with get_os_info() across
prepare_repository_setup, setup_hwaccel, setup_java, setup_mysql,
setup_php, setup_postgresql, setup_clickhouse, install_packages_with_retry
- Add actionable Hint messages to 16 download/network failure paths:
adminer, composer, ffmpeg (x2), go, ghostscript, imagemagick, rbenv,
ruby-build, meilisearch-config, uv, yq, rust, apt-lock timeout,
mongodb GPG, php keyring
- Replace 6 silent 'apt install || true' with msg_warn for optional packages:
3x postgresql modules, ruby build deps, ssl-cert, docker-compose
- Sort all 'function setup_*' declarations into alphabetical order:
clickhouse moved to after adminer, docker moved to after composer,
meilisearch moved to after mariadb_db
* style(tools): unify all function declarations to name() { style
Remove 'function' keyword from 30 declarations to match the project convention
used in core.func, error_handler.func, and all other .func files (POSIX-compatible name() { syntax)
CanbiZ (MickLesk)
