openbao,gitea-runner: use shared ensure_template_present, gitea-runner parity fixes

openbao: removed its now-duplicate ensure_template_present() definition,
using the one factored into lib/common.sh (call site unchanged).

gitea-runner: replaced its ad-hoc template-download check (which skipped
`pveam update`, risking a stale cached template list now that the template
is auto-detected) with a call to the shared ensure_template_present().
Also added ca-certificates to exec_in_lxc's apk add, matching openbao, and
added require_root() to the inside-LXC dispatch path in main(), which
openbao already does but gitea-runner was missing.

gitea-runner/install.sh

@@ -17,7 +17,10 @@ RAM="${RAM:-2048}"
 DISK="${DISK:-8}"
 BRIDGE="${BRIDGE:-vmbr0}"
 LXC_TAG="${LXC_TAG:-gitea-runner}"                # stable identifier for the container
-SCRIPT_URL="https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/gitea-runner/install.sh"
+# SCRIPT_URL is what the host-side flow pipes into the LXC. Override it when
+# testing from a non-main branch, e.g.
+#   SCRIPT_URL="https://gitea.arnodo.fr/.../branch/chore/standardize-lxc-scripts/gitea-runner/install.sh"
+SCRIPT_URL="${SCRIPT_URL:-https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/gitea-runner/install.sh}"
 GITEA_HOSTNAME="${GITEA_HOSTNAME:-gitea.taila5ad8.ts.net}"
 GITEA_API="https://gitea.com/api/v1/repos/gitea/act_runner/releases"
 VERSION_FILE="/opt/gitea-runner_version.txt"
@@ -28,9 +31,10 @@ GREEN='\033[0;32m'
 YELLOW='\033[1;33m'
 NC='\033[0m'
 
-log_info()  { echo -e "${GREEN}[INFO]${NC} $1"; }
+# Logs go to stderr so callers can safely use $(fn) without capturing log noise.
-log_warn()  { echo -e "${YELLOW}[WARN]${NC} $1"; }
+log_info()  { echo -e "${GREEN}[INFO]${NC} $1" >&2; }
-log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
+log_warn()  { echo -e "${YELLOW}[WARN]${NC} $1" >&2; }
+log_error() { echo -e "${RED}[ERROR]${NC} $1" >&2; }
 
 require_root() {
   if [[ "$(id -u)" -ne 0 ]]; then
@@ -53,10 +57,20 @@ require_root() {
 # failure mode.
 # ============================================================
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-.}")" 2>/dev/null && pwd || true)"
+LIB_COMMON_URL="$(dirname "$(dirname "$SCRIPT_URL")")/lib/common.sh"
 if [[ -n "$SCRIPT_DIR" && -f "${SCRIPT_DIR}/../lib/common.sh" ]]; then
   source "${SCRIPT_DIR}/../lib/common.sh"
 else
-  source <(curl -fsSL "$(dirname "$(dirname "$SCRIPT_URL")")/lib/common.sh")
+  source <(curl -fsSL "$LIB_COMMON_URL")
+fi
+
+# `source <(curl ...)` swallows curl failures: an empty stream still makes
+# `source` return 0, so a 404/network error would otherwise only surface
+# later as a confusing "command not found" for detect_latest_alpine_template
+# et al. Fail loudly here instead, with the URL that was tried.
+if ! declare -F detect_latest_alpine_template >/dev/null; then
+  log_error "Failed to load lib/common.sh (tried: ${LIB_COMMON_URL})."
+  exit 1
 fi
 
 # --- Helpers ---
@@ -103,7 +117,7 @@ exec_in_lxc() {
   local ctid="$1"
   local mode="$2"   # --install or --update
 
-  pct exec "$ctid" -- sh -c "apk add --no-cache bash curl jq > /dev/null 2>&1"
+  pct exec "$ctid" -- sh -c "apk add --no-cache bash curl jq ca-certificates > /dev/null 2>&1"
   curl -fsSL "$SCRIPT_URL" \
     | pct exec "$ctid" -- env \
         SCRIPT_URL="$SCRIPT_URL" \
@@ -130,11 +144,7 @@ create_lxc() {
     log_info "Auto-selected CTID: $CTID"
   fi
 
-  # Download template if needed
+  ensure_template_present "$TEMPLATE"
-  if ! pveam list "$TEMPLATE_STORAGE" 2>/dev/null | grep -q "$TEMPLATE"; then
-    log_info "Downloading template $TEMPLATE..."
-    pveam download "$TEMPLATE_STORAGE" "$TEMPLATE"
-  fi
 
   log_info "Creating LXC $CTID ($HOSTNAME_LXC)..."
   pct create "$CTID" "${TEMPLATE_STORAGE}:vztmpl/${TEMPLATE}" \
@@ -382,13 +392,17 @@ main() {
     else
       create_lxc
     fi
-  elif [[ -f /usr/local/bin/act_runner ]]; then
+  else
+    # Inside a container (no Proxmox tooling)
+    require_root
+    if [[ -f /usr/local/bin/act_runner ]]; then
       # act_runner exists — update mode
       update_runner
     else
       # Fresh LXC — install mode
       install_runner
     fi
+  fi
 }
 
 main "$@"

lib/common.sh

@@ -17,8 +17,10 @@
 #     config`. Reusable as-is by any LXC creator script.
 #   - refresh_os_packages(): Alpine only (apk update && apk upgrade). A
 #     future Debian-based script needs its own apt-get variant.
-
+#
-set -euo pipefail
+# Does not set shell options (set -e/-u/-o pipefail): a sourced file must
+# not impose those on the caller's shell. Both openbao/install.sh and
+# gitea-runner/install.sh already set them before sourcing this file.
 
 # ============================================================
 # #12 - Detect newest Alpine LXC template available from the Proxmox repos.
@@ -65,6 +67,23 @@ enable_tty1_autologin() {
   pkill -KILL -f '(getty|agetty).*tty1' 2>/dev/null || true
 }
 
+# ============================================================
+# #12 - Ensure the given template is downloaded to TEMPLATE_STORAGE, doing a
+# `pveam update` first so a stale local cache doesn't silently settle for an
+# older version than the one detect_latest_alpine_template() just picked.
+# Expects TEMPLATE_STORAGE to be set by the caller.
+# ============================================================
+ensure_template_present() {
+  local tmpl="$1"
+  if ! pveam list "$TEMPLATE_STORAGE" 2>/dev/null | grep -q "$tmpl"; then
+    log_info "Downloading template ${tmpl} to storage ${TEMPLATE_STORAGE}..."
+    pveam update >/dev/null
+    pveam download "$TEMPLATE_STORAGE" "$tmpl"
+  else
+    log_info "Template ${tmpl} already present on ${TEMPLATE_STORAGE}."
+  fi
+}
+
 # ============================================================
 # #15 - Find an existing LXC by tag or hostname (host-side, requires pct).
 # Echoes the CTID on match, returns 1 if none found.
@@ -88,7 +107,12 @@ find_existing_lxc() {
 
 # ============================================================
 # #15 - Refresh OS packages (Alpine: apk update && apk upgrade).
-# Callable both host-side (via pct exec) and inside the LXC.
+# Callable only from inside the LXC: this is a plain bash function in the
+# current process, so it cannot run across a `pct exec ... sh -c` boundary
+# without shipping its definition into the container. Host-side callers
+# (see openbao/install.sh's update_lxc()) invoke apk update/upgrade inline
+# via `pct exec` instead — do not try to dedupe that call site onto this
+# function.
 # ============================================================
 refresh_os_packages() {
   log_info "Refreshing Alpine packages..."

openbao/install.sh

@@ -73,10 +73,20 @@ log_error() { echo -e "${RED}[ERROR]${NC} $1" >&2; }
 # download the bao binary, so this adds no new failure mode.
 # ============================================================
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-.}")" 2>/dev/null && pwd || true)"
+LIB_COMMON_URL="$(dirname "$(dirname "$SCRIPT_URL")")/lib/common.sh"
 if [[ -n "$SCRIPT_DIR" && -f "${SCRIPT_DIR}/../lib/common.sh" ]]; then
   source "${SCRIPT_DIR}/../lib/common.sh"
 else
-  source <(curl -fsSL "$(dirname "$(dirname "$SCRIPT_URL")")/lib/common.sh")
+  source <(curl -fsSL "$LIB_COMMON_URL")
+fi
+
+# `source <(curl ...)` swallows curl failures: an empty stream still makes
+# `source` return 0, so a 404/network error would otherwise only surface
+# later as a confusing "command not found" for detect_latest_alpine_template
+# et al. Fail loudly here instead, with the URL that was tried.
+if ! declare -F detect_latest_alpine_template >/dev/null; then
+  log_error "Failed to load lib/common.sh (tried: ${LIB_COMMON_URL})."
+  exit 1
 fi
 
 # ============================================================
@@ -227,17 +237,6 @@ configure_tailscale_proxy() {
 # Proxmox-host helpers
 # ============================================================
 
-ensure_template_present() {
-  local tmpl="$1"
-  if ! pveam list "$TEMPLATE_STORAGE" 2>/dev/null | grep -q "$tmpl"; then
-    log_info "Downloading template ${tmpl} to storage ${TEMPLATE_STORAGE}..."
-    pveam update >/dev/null
-    pveam download "$TEMPLATE_STORAGE" "$tmpl"
-  else
-    log_info "Template ${tmpl} already present on ${TEMPLATE_STORAGE}."
-  fi
-}
-
 # Pick next available CTID if user did not provide one.
 allocate_ctid() {
   pvesh get /cluster/nextid 2>/dev/null \