A plain CREATE ROLE ... PASSWORD stores PostgreSQL's native 16-byte SCRAM salt.
DocumentDB has no check_password_hook, so that salt is served verbatim to Mongo
clients, which reject it at SASL step2 with 'invalid salt length of 16'.
Provision the user through documentdb_api.create_user / update_user instead:
DocumentDB builds the SCRAM-SHA-256 verifier with documentdb.scramDefaultSaltLen
(28 bytes) via its own scram_build_secret. create_user only accepts a read-only
role or the clusterAdmin + readWriteAnyDatabase pair, so use the latter for R/W.
- CREATE EXTENSION documentdb now runs before user provisioning so the API
functions exist.
- Spec built with jq (password JSON-escaped) and passed in a $DDB$ dollar-quoted
SQL literal; idempotent via update_user when the role already exists.
- Set password_encryption = 'scram-sha-256' explicitly in postgresql.conf.
A fresh Debian template has not generated the Proxmox host locale that pct exec
forwards (e.g. fr_FR.UTF-8), so apt, perl and apt-listchanges warn on every run.
Export LC_ALL=C.UTF-8 / LANG=C.UTF-8 globally and forward them through pct exec
(base tooling, the piped installer, and the host-side upgrade).
- detect_latest_debian_template now selects the newest debian-12 template only.
Auto-detecting the newest Debian overall picked debian-13, which would pair the
deb12-only DocumentDB extension with a mismatched libicu. Trixie now requires
setting TEMPLATE + DOCUMENTDB_DISTRO explicitly.
- Add preflight_script_url: verify SCRIPT_URL is reachable on the host before
creating the LXC, so a branch/path that 404s fails immediately with guidance
instead of dying mid-install after the container is built.
OpenBao has a working installer and its own README, but the root README
never linked it. Add a row to Available Scripts (grouped with the other
Proxmox installer, gitea-runner) and extend the Proxmox VE Requirements
line so both LXC scripts are mentioned consistently.
Port the working autologin block from openbao/install.sh so both Proxmox
installers behave identically. The previous version assumed agetty was
already installed and relied on a sed pattern that no-ops on fresh Alpine
images; it also never told PID 1 to re-read /etc/inittab, so the change
required a reboot.
- Install agetty (with util-linux fallback) via apk.
- Drop any existing tty1 line and append the autologin line (robust
against inittab layout drift across Alpine releases).
- SIGHUP PID 1 and kill any stale getty so init respawns the new line
immediately — no reboot needed, no first-login "type exit once" wart.
Previously the temporary directory was removed via the RETURN trap
but this could be bypassed if the script exited early. Now we
explicitly clean up the directory in all exit paths.
OpenBao now uses raw architecture names (x86_64, aarch64) instead of
Go-style (amd64, arm64) and publishes .tar.gz archives instead of .zip
files. This commit updates the install script to match the new naming
convention and archive format.
```
Update environment variable table formatting for readability
Fix data directory path formatting in README
Add MOTD with OpenBao status and access information
```
- Add Tailscale installation and service start in install.sh
- Update service dependencies to include tailscale
- Add instructions to connect via Tailscale after installation
The script now uses the ip command instead of hostname -i to reliably
obtain the container's IPv4 address. Service command output is also
redirected to /dev/null to reduce noise in the logs.
- Added new gitea-runner/install.sh script for deploying a Gitea Act
Runner on Alpine LXC in Proxmox
- Updated main README with new script entry and adjusted formatting
- Added multi-OS support note to requirements
- Improved formatting in code examples with proper command separation
- Translated and enhanced gitea-runner/README.md with consistent
terminology
Damien