Damien
51f2474db6
Both install scripts now source lib/common.sh instead of duplicating detect_latest_alpine_template(), find_existing_lxc(), and the tty1 autologin block. Since these scripts are distributed via curl one-liner and piped into `pct exec` inside the LXC, there is no local checkout to source from in those contexts — lib/common.sh is sourced from disk when a local checkout is available (BASH_SOURCE resolves to a real path), otherwise fetched over HTTP next to SCRIPT_URL. Both scripts already require outbound network to curl themselves and to download their respective binaries, so this adds no new failure mode. openbao/install.sh is a behavioral no-op: same log output, same control flow. One inline apk update/upgrade is intentionally left as-is in update_lxc() — refresh_os_packages() is a bash function in this process and can't run over `pct exec ... sh -c` without shipping the function definition into the container. gitea-runner/install.sh fixes the actual bug: TEMPLATE was hardcoded to a specific dated Alpine release, so create_lxc() would keep trying to provision a stale/absent template. TEMPLATE now defaults to empty and create_lxc() calls detect_latest_alpine_template() when unset, mirroring openbao. Also renamed HOSTNAME -> HOSTNAME_LXC and added LXC_TAG to match openbao's naming, since a follow-up (issue #15) will wire up find_existing_lxc()-based update detection here. Closes #12, Closes #14
infra-scripts
Public infrastructure deployment scripts designed to be executed directly via curl | bash.
Philosophy
These scripts automate the deployment of personal infrastructure components. They are:
- Self-contained: No external dependencies beyond standard Debian packages
- Idempotent-ish: Safe to re-run (where possible)
- Curl-friendly: Designed for one-liner deployment from a fresh server
- Multi-OS: Supports Debian and Alpine-based deployments, chosen per-script based on that service's requirements
- Loopback by default: Services bind to
127.0.0.1; Tailscale handles the reverse proxy and TLS termination - Log hygiene: Every long-running service ships with a
logrotateconfig (no unbounded log files) - Console auto-login: Proxmox LXCs are configured for root auto-login on
tty1(fastpct enterand Web UI shell access) - Keep it simple: One script per service, plain bash, no frameworks — readability over cleverness
Available Scripts
| Script | Description | Usage |
|---|---|---|
proxy/install.sh |
Reverse proxy with Tailscale + Nginx Proxy Manager | curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/proxy/install.sh | bash |
netlab/install.sh |
Network lab with ContainerLab | curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/netlab/install.sh | bash |
gitea-runner/install.sh |
Gitea Act Runner on Alpine LXC (Proxmox) | bash -c "$(curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/gitea-runner/install.sh)" |
openbao/install.sh |
OpenBao secrets manager on Alpine LXC (Proxmox) | bash -c "$(curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/openbao/install.sh)" |
komodo/install.sh |
Komodo (Docker + MongoDB) on Alpine VM | bash -c "$(curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/komodo/install.sh)" |
Requirements
- Fresh Debian 12/13 installation (proxy, netlab) or Proxmox VE host (gitea-runner, openbao) or Alpine VM (komodo)
- User with sudo privileges (do not run as root) — except gitea-runner, openbao, and komodo which run as root
- Internet access