TAI/TA-ProxMenu
2
0
Fork 0
Code Pull Requests Actions Activity

update

Browse Source
This commit is contained in:
voltron
2026-07-25 19:56:08 -05:00
parent 76af8116da
commit 747e984da6
3 changed files with 171 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
defaults.inc
+1 -1
View File
@@ -3,7 +3,7 @@
action="${1:-}" action="${1:-}"
FOLDER='/opt/idssys/ta-proxmenu' FOLDER='/opt/idssys/ta-proxmenu'
VERS='2026.7.25-46' VERS='2026.7.25-47'
noupdate=' ' noupdate=' '
inc/deploy-pulse-lxc.sh
+161 -49
View File
@@ -22,6 +22,14 @@ TAPM_PULSE_VALID_HOSTNAME() {
[[ "${1:-}" =~ ^[A-Za-z0-9][A-Za-z0-9.-]{0,62}$ ]] [[ "${1:-}" =~ ^[A-Za-z0-9][A-Za-z0-9.-]{0,62}$ ]]
} }
TAPM_PULSE_VALID_POSITIVE_INTEGER() {
[[ "${1:-}" =~ ^[1-9][0-9]*$ ]]
}
TAPM_PULSE_VALID_PORT() {
[[ "${1:-}" =~ ^[0-9]+$ ]] && (( 10#$1 >= 1 && 10#$1 <= 65535 ))
}
TAPM_PULSE_VALID_IPV4_CIDR() { TAPM_PULSE_VALID_IPV4_CIDR() {
local value="${1:-}" local value="${1:-}"
local address prefix octet local address prefix octet
@@ -98,9 +106,14 @@ TAPM_PULSE_SELECT_BRIDGE() {
bridges+=("$bridge") bridges+=("$bridge")
[[ "$bridge" == "$default_bridge" ]] && default_found=1 [[ "$bridge" == "$default_bridge" ]] && default_found=1
done < <( done < <(
for bridge_path in /sys/class/net/*/bridge; do {
[[ -d "$bridge_path" ]] && basename "$(dirname "$bridge_path")" for bridge_path in /sys/class/net/*/bridge; do
done | sort -V [[ -d "$bridge_path" ]] && basename "$(dirname "$bridge_path")"
done
if command -v ovs-vsctl >/dev/null 2>&1; then
ovs-vsctl list-br 2>/dev/null || true
fi
} | sort -Vu
) )
(( ${#bridges[@]} > 0 )) || (( ${#bridges[@]} > 0 )) ||
@@ -138,6 +151,21 @@ raise SystemExit(0 if str(value).lower() in {"1", "true", "yes"} else 1)
' '
} }
TAPM_PULSE_HA_STATUS_ENABLED() {
local status="${1:-}"
grep -q '^quorum OK' <<<"$status" &&
grep -Eq '^master[[:space:]].*\(active,' <<<"$status"
}
TAPM_PULSE_CLUSTER_HA_ENABLED() {
local status
command -v ha-manager >/dev/null 2>&1 || return 1
status="$(ha-manager status 2>/dev/null)" || return 1
TAPM_PULSE_HA_STATUS_ENABLED "$status"
}
TAPM_PULSE_VERIFY_SIGNATURE() { TAPM_PULSE_VERIFY_SIGNATURE() {
local target_path="$1" local target_path="$1"
local signature_path="$2" local signature_path="$2"
@@ -176,12 +204,26 @@ TAPM_PULSE_REMOVE_PARTIAL_LXC() {
TAPM_DEPLOY_PULSE_LXC() { TAPM_DEPLOY_PULSE_LXC() {
local release="${PULSE_RELEASE:-v6.1.1}" local release="${PULSE_RELEASE:-v6.1.1}"
local pulse_port="${PULSE_PORT:-7655}" local pulse_port="${PULSE_PORT:-7655}" auto_update_flag='--disable-auto-updates'
local ctid default_ctid hostname bridge address_cidr gateway vlan_id local ctid default_ctid hostname bridge address_cidr gateway vlan_id
local root_storage default_root_storage template_storage template_name template_path local root_storage default_root_storage template_storage template_name template_path
local arch archive_name base_url installer archive signature installer_signature local arch archive_name base_url installer archive signature installer_signature
local network_config choice add_ha='no' container_ip timezone temp_dir local memory disk cores cpulimit swap onboot firewall unprivileged nameserver startup
local network_config choice add_ha='no' auto_updates='yes' container_ip timezone temp_dir
local default_bridge
local container_created=0 local container_created=0
local -a create_args=()
memory=2048
disk=4
cores=2
cpulimit=2
swap=256
onboot=1
firewall=1
unprivileged=1
startup=99
auto_update_flag='--enable-auto-updates'
echo echo
echo -e "${idsCL[LightCyan]}Deploy Pulse monitoring in a dedicated LXC${idsCL[Default]}" echo -e "${idsCL[LightCyan]}Deploy Pulse monitoring in a dedicated LXC${idsCL[Default]}"
@@ -199,6 +241,8 @@ TAPM_DEPLOY_PULSE_LXC() {
done done
TAPM_PULSE_VALID_RELEASE "$release" || TAPM_PULSE_VALID_RELEASE "$release" ||
{ TAPM_PULSE_FAIL "Configured Pulse release '${release}' is invalid."; return 1; } { TAPM_PULSE_FAIL "Configured Pulse release '${release}' is invalid."; return 1; }
TAPM_PULSE_VALID_PORT "$pulse_port" ||
{ TAPM_PULSE_FAIL "Configured Pulse port '${pulse_port}' is invalid."; return 1; }
default_ctid="$(pvesh get /cluster/nextid 2>/dev/null || true)" default_ctid="$(pvesh get /cluster/nextid 2>/dev/null || true)"
TAPM_PULSE_PROMPT ctid "Container ID" "$default_ctid" TAPM_PULSE_PROMPT ctid "Container ID" "$default_ctid"
@@ -209,10 +253,36 @@ TAPM_DEPLOY_PULSE_LXC() {
return 1 return 1
fi fi
TAPM_PULSE_PROMPT hostname "Container hostname" "pulse" TAPM_PULSE_PROMPT hostname "Container hostname" "Pulse-Monitor"
TAPM_PULSE_VALID_HOSTNAME "$hostname" || TAPM_PULSE_VALID_HOSTNAME "$hostname" ||
{ TAPM_PULSE_FAIL "The hostname is invalid."; return 1; } { TAPM_PULSE_FAIL "The hostname is invalid."; return 1; }
TAPM_PULSE_SELECT_BRIDGE bridge vmbr0 || return 1
read -r -p " Customize CPU, memory, disk, or swap? [y/N] " choice
if [[ "$choice" =~ ^[Yy]$ ]]; then
TAPM_PULSE_PROMPT memory "Memory in MiB" "$memory"
TAPM_PULSE_VALID_POSITIVE_INTEGER "$memory" ||
{ TAPM_PULSE_FAIL "Memory must be a positive whole number."; return 1; }
TAPM_PULSE_PROMPT disk "Root disk size in GiB" "$disk"
TAPM_PULSE_VALID_POSITIVE_INTEGER "$disk" ||
{ TAPM_PULSE_FAIL "Disk size must be a positive whole number."; return 1; }
TAPM_PULSE_PROMPT cores "CPU cores" "$cores"
TAPM_PULSE_VALID_POSITIVE_INTEGER "$cores" ||
{ TAPM_PULSE_FAIL "CPU cores must be a positive whole number."; return 1; }
TAPM_PULSE_PROMPT cpulimit "CPU limit (0 for unlimited)" "$cpulimit"
[[ "$cpulimit" =~ ^[0-9]+$ ]] ||
{ TAPM_PULSE_FAIL "CPU limit must be zero or a positive whole number."; return 1; }
TAPM_PULSE_PROMPT swap "Swap in MiB" "$swap"
[[ "$swap" =~ ^[0-9]+$ ]] ||
{ TAPM_PULSE_FAIL "Swap must be zero or a positive whole number."; return 1; }
fi
echo
default_bridge="$(
ip route 2>/dev/null |
awk '/^default/ { print $5; exit }'
)"
[[ -n "$default_bridge" ]] || default_bridge='vmbr0'
TAPM_PULSE_SELECT_BRIDGE bridge "$default_bridge" || return 1
TAPM_PULSE_PROMPT address_cidr \ TAPM_PULSE_PROMPT address_cidr \
"Static IPv4 address with prefix (leave blank for DHCP)" "Static IPv4 address with prefix (leave blank for DHCP)"
if [[ -n "$address_cidr" ]]; then if [[ -n "$address_cidr" ]]; then
@@ -222,6 +292,8 @@ TAPM_DEPLOY_PULSE_LXC() {
TAPM_PULSE_VALID_IPV4_CIDR "${gateway}/32" || TAPM_PULSE_VALID_IPV4_CIDR "${gateway}/32" ||
{ TAPM_PULSE_FAIL "The IPv4 gateway is invalid."; return 1; } { TAPM_PULSE_FAIL "The IPv4 gateway is invalid."; return 1; }
fi fi
TAPM_PULSE_PROMPT nameserver \
"DNS servers, space-separated (leave blank to inherit host settings)"
TAPM_PULSE_PROMPT vlan_id "VLAN ID (leave blank for untagged)" TAPM_PULSE_PROMPT vlan_id "VLAN ID (leave blank for untagged)"
if [[ -n "$vlan_id" ]] && if [[ -n "$vlan_id" ]] &&
{ [[ ! "$vlan_id" =~ ^[0-9]+$ ]] || (( vlan_id < 1 || vlan_id > 4094 )); }; then { [[ ! "$vlan_id" =~ ^[0-9]+$ ]] || (( vlan_id < 1 || vlan_id > 4094 )); }; then
@@ -229,12 +301,26 @@ TAPM_DEPLOY_PULSE_LXC() {
return 1 return 1
fi fi
TAPM_PULSE_CLUSTER_HA_ENABLED && add_ha='yes'
default_root_storage="$( default_root_storage="$(
pvesm status --content rootdir 2>/dev/null | pvesm status --content rootdir 2>/dev/null |
awk 'NR > 1 && $3 == "active" { print $1; exit }' awk 'NR > 1 && $3 == "active" { print $1; exit }'
)" )"
[[ -n "$default_root_storage" ]] || [[ -n "$default_root_storage" ]] ||
{ TAPM_PULSE_FAIL "No active storage supports LXC volumes."; return 1; } { TAPM_PULSE_FAIL "No active storage supports LXC volumes."; return 1; }
if [[ "$add_ha" == 'yes' ]]; then
while read -r choice; do
[[ -n "$choice" ]] || continue
if TAPM_PULSE_STORAGE_IS_SHARED "$choice"; then
default_root_storage="$choice"
break
fi
done < <(
pvesm status --content rootdir 2>/dev/null |
awk 'NR > 1 && $3 == "active" { print $1 }'
)
fi
TAPM_ISO_NFS_SELECT_STORAGE root_storage \ TAPM_ISO_NFS_SELECT_STORAGE root_storage \
"Pulse root filesystem storage" "$default_root_storage" || return 1 "Pulse root filesystem storage" "$default_root_storage" || return 1
@@ -246,10 +332,11 @@ TAPM_DEPLOY_PULSE_LXC() {
{ TAPM_PULSE_FAIL "No active storage supports container templates."; return 1; } { TAPM_PULSE_FAIL "No active storage supports container templates."; return 1; }
template_storage="$default_root_storage" template_storage="$default_root_storage"
if TAPM_PULSE_STORAGE_IS_SHARED "$root_storage" && if [[ "$add_ha" == 'yes' ]] &&
command -v ha-manager >/dev/null 2>&1; then ! TAPM_PULSE_STORAGE_IS_SHARED "$root_storage"; then
read -r -p " Add the Pulse LXC to Proxmox HA after installation? [Y/n] " choice echo -e "${idsCL[LightYellow]}Warning: HA is active, but '${root_storage}' is not marked shared.${idsCL[Default]}"
[[ ! "$choice" =~ ^[Nn]$ ]] && add_ha='yes' echo " The LXC will still be added to HA as requested, but automatic failover"
echo " requires shared storage or separately configured storage replication."
fi fi
echo echo
@@ -262,11 +349,13 @@ TAPM_DEPLOY_PULSE_LXC() {
echo " Network: DHCP on ${bridge}" echo " Network: DHCP on ${bridge}"
fi fi
[[ -n "$vlan_id" ]] && echo " VLAN: ${vlan_id}" [[ -n "$vlan_id" ]] && echo " VLAN: ${vlan_id}"
echo " Resources: 2 vCPU, 2048 MiB RAM, 512 MiB swap, 100 CPU units" [[ -n "$nameserver" ]] && echo " DNS servers: ${nameserver}"
echo " Root volume: ${root_storage}:8 GiB" echo " Resources: ${cores} vCPU (limit ${cpulimit}), ${memory} MiB RAM, ${swap} MiB swap"
echo " Root volume: ${root_storage}:${disk} GiB"
echo " Pulse port: ${pulse_port}" echo " Pulse port: ${pulse_port}"
echo " Start at boot: yes" echo " Start at boot: yes, order ${startup}"
echo " Automatic update: enabled" echo " Firewall: enabled"
echo " Automatic update: ${auto_updates}"
echo " Proxmox HA: ${add_ha}" echo " Proxmox HA: ${add_ha}"
echo echo
read -r -p " Create this Pulse container (type yes to continue)? " choice read -r -p " Create this Pulse container (type yes to continue)? " choice
@@ -303,26 +392,30 @@ TAPM_DEPLOY_PULSE_LXC() {
fi fi
echo -e "\n${idsCL[LightCyan]}Locating a Debian container template...${idsCL[Default]}" echo -e "\n${idsCL[LightCyan]}Locating a Debian container template...${idsCL[Default]}"
if ! pveam update; then template_path="$(
TAPM_CLEAN_TEMP_DIR "$temp_dir" pveam list "$template_storage" 2>/dev/null |
TAPM_PULSE_FAIL "Could not refresh the container template catalog." awk 'NR > 1 && $1 ~ /:vztmpl\/debian-(13|12)-standard_/ { print $1 }' |
return 1
fi
template_name="$(
pveam available --section system |
awk '$2 ~ /^debian-(13|12)-standard_/ { print $2 }' |
sort -V | sort -V |
tail -1 tail -1
)" )"
if [[ -z "$template_name" ]]; then if [[ -z "$template_path" ]]; then
TAPM_CLEAN_TEMP_DIR "$temp_dir" if ! pveam update; then
TAPM_PULSE_FAIL "No supported Debian 12/13 standard template was found." TAPM_CLEAN_TEMP_DIR "$temp_dir"
return 1 TAPM_PULSE_FAIL "Could not refresh the container template catalog."
fi return 1
template_path="${template_storage}:vztmpl/${template_name}" fi
if ! pveam list "$template_storage" 2>/dev/null | template_name="$(
awk 'NR > 1 { print $1 }' | pveam available --section system |
grep -Fxq -- "$template_path"; then awk '$2 ~ /^debian-(13|12)-standard_/ { print $2 }' |
sort -V |
tail -1
)"
if [[ -z "$template_name" ]]; then
TAPM_CLEAN_TEMP_DIR "$temp_dir"
TAPM_PULSE_FAIL "No supported Debian 12/13 standard template was found."
return 1
fi
template_path="${template_storage}:vztmpl/${template_name}"
if ! pveam download "$template_storage" "$template_name"; then if ! pveam download "$template_storage" "$template_name"; then
TAPM_CLEAN_TEMP_DIR "$temp_dir" TAPM_CLEAN_TEMP_DIR "$temp_dir"
TAPM_PULSE_FAIL "The Debian template download failed." TAPM_PULSE_FAIL "The Debian template download failed."
@@ -331,27 +424,31 @@ TAPM_DEPLOY_PULSE_LXC() {
fi fi
if [[ -n "$address_cidr" ]]; then if [[ -n "$address_cidr" ]]; then
network_config="name=eth0,bridge=${bridge},ip=${address_cidr},gw=${gateway},firewall=1,type=veth" network_config="name=eth0,bridge=${bridge},ip=${address_cidr},gw=${gateway},firewall=${firewall},type=veth"
else else
network_config="name=eth0,bridge=${bridge},ip=dhcp,firewall=1,type=veth" network_config="name=eth0,bridge=${bridge},ip=dhcp,firewall=${firewall},type=veth"
fi fi
[[ -n "$vlan_id" ]] && network_config+=",tag=${vlan_id}" [[ -n "$vlan_id" ]] && network_config+=",tag=${vlan_id}"
echo -e "\n${idsCL[LightCyan]}Creating and starting LXC ${ctid}...${idsCL[Default]}" echo -e "\n${idsCL[LightCyan]}Creating and starting LXC ${ctid}...${idsCL[Default]}"
if ! pct create "$ctid" "$template_path" \ create_args=(
--hostname "$hostname" \ pct create "$ctid" "$template_path"
--ostype debian \ --hostname "$hostname"
--unprivileged 1 \ --ostype debian
--features nesting=1 \ --unprivileged "$unprivileged"
--cores 2 \ --features nesting=1
--cpunits 100 \ --cores "$cores"
--memory 2048 \ --memory "$memory"
--swap 512 \ --swap "$swap"
--rootfs "${root_storage}:8" \ --rootfs "${root_storage}:${disk}"
--net0 "$network_config" \ --net0 "$network_config"
--onboot 1 \ --onboot "$onboot"
--startup order=10 \ --startup "order=${startup}"
--tags 'tapm;pulse'; then --tags 'tapm;pulse'
)
[[ "$cpulimit" != 0 ]] && create_args+=(--cpulimit "$cpulimit")
[[ -n "$nameserver" ]] && create_args+=(--nameserver "$nameserver")
if ! "${create_args[@]}"; then
TAPM_CLEAN_TEMP_DIR "$temp_dir" TAPM_CLEAN_TEMP_DIR "$temp_dir"
TAPM_PULSE_FAIL "Container creation failed." TAPM_PULSE_FAIL "Container creation failed."
return 1 return 1
@@ -379,7 +476,7 @@ TAPM_DEPLOY_PULSE_LXC() {
--in-container \ --in-container \
--version "$release" \ --version "$release" \
--archive "/tmp/${archive_name}" \ --archive "/tmp/${archive_name}" \
--enable-auto-updates || "$auto_update_flag" ||
! pct exec "$ctid" -- systemctl is-active --quiet pulse; then ! pct exec "$ctid" -- systemctl is-active --quiet pulse; then
(( container_created == 1 )) && TAPM_PULSE_REMOVE_PARTIAL_LXC "$ctid" (( container_created == 1 )) && TAPM_PULSE_REMOVE_PARTIAL_LXC "$ctid"
TAPM_CLEAN_TEMP_DIR "$temp_dir" TAPM_CLEAN_TEMP_DIR "$temp_dir"
@@ -391,6 +488,21 @@ TAPM_DEPLOY_PULSE_LXC() {
pct exec "$ctid" -- hostname -I 2>/dev/null | pct exec "$ctid" -- hostname -I 2>/dev/null |
awk '{ print $1; exit }' awk '{ print $1; exit }'
)" )"
if [[ -n "$container_ip" ]]; then
echo -e "\n${idsCL[LightCyan]}Registering the Proxmox cluster with Pulse...${idsCL[Default]}"
(
trap 'rm -f /tmp/pulse-auto-register-request.json /tmp/pulse-auto-register-response.json' EXIT
# Reuse the verified release's registration implementation so its
# API contract and least-privilege role handling stay in sync.
# shellcheck disable=SC1090
source "$installer"
IN_CONTAINER=false
wait_for_pulse_ready "http://${container_ip}:${pulse_port}" 120 1 || true
auto_register_pve_node "$ctid" "$container_ip" "$pulse_port"
) || echo -e "${idsCL[LightYellow]}Pulse is installed, but automatic Proxmox registration did not complete.${idsCL[Default]}"
fi
if [[ "$add_ha" == 'yes' ]] && if [[ "$add_ha" == 'yes' ]] &&
! ha-manager add "ct:${ctid}" --state started; then ! ha-manager add "ct:${ctid}" --state started; then
echo -e "${idsCL[LightYellow]}Pulse is running, but it could not be added to HA.${idsCL[Default]}" echo -e "${idsCL[LightYellow]}Pulse is running, but it could not be added to HA.${idsCL[Default]}"
tests/test-pulse.sh
+9
View File
@@ -19,6 +19,10 @@ assert_success "valid Pulse CTID" TAPM_PULSE_VALID_CTID 210
assert_failure "invalid Pulse CTID" TAPM_PULSE_VALID_CTID 99 assert_failure "invalid Pulse CTID" TAPM_PULSE_VALID_CTID 99
assert_success "valid Pulse hostname" TAPM_PULSE_VALID_HOSTNAME pulse-monitor assert_success "valid Pulse hostname" TAPM_PULSE_VALID_HOSTNAME pulse-monitor
assert_failure "invalid Pulse hostname" TAPM_PULSE_VALID_HOSTNAME 'pulse monitor' assert_failure "invalid Pulse hostname" TAPM_PULSE_VALID_HOSTNAME 'pulse monitor'
assert_success "valid positive integer" TAPM_PULSE_VALID_POSITIVE_INTEGER 1024
assert_failure "zero is not positive" TAPM_PULSE_VALID_POSITIVE_INTEGER 0
assert_success "valid Pulse port" TAPM_PULSE_VALID_PORT 7655
assert_failure "Pulse port too high" TAPM_PULSE_VALID_PORT 65536
assert_success "valid Pulse IPv4 CIDR" TAPM_PULSE_VALID_IPV4_CIDR 10.10.1.50/24 assert_success "valid Pulse IPv4 CIDR" TAPM_PULSE_VALID_IPV4_CIDR 10.10.1.50/24
assert_failure "invalid Pulse IPv4 CIDR" TAPM_PULSE_VALID_IPV4_CIDR 10.10.1.500/24 assert_failure "invalid Pulse IPv4 CIDR" TAPM_PULSE_VALID_IPV4_CIDR 10.10.1.500/24
@@ -32,4 +36,9 @@ assert_success "legacy Pulse hostname detected" \
assert_failure "unrelated resource not detected" \ assert_failure "unrelated resource not detected" \
TAPM_PULSE_RESOURCE_INSTALLED '[{"type":"qemu","name":"pulse"}]' TAPM_PULSE_RESOURCE_INSTALLED '[{"type":"qemu","name":"pulse"}]'
ha_status=$'quorum OK\nmaster pve1 (active, Sat Jul 25 12:00:00 2026)\nlrm pve1 (active, Sat Jul 25 12:00:00 2026)'
assert_success "active Proxmox HA detected" TAPM_PULSE_HA_STATUS_ENABLED "$ha_status"
assert_failure "inactive Proxmox HA rejected" \
TAPM_PULSE_HA_STATUS_ENABLED $'quorum OK\nmaster pve1 (idle)'
finish_tests finish_tests