update to new post-install script

README.md

@@ -41,8 +41,8 @@ rmm          Install the ConnectWise RMM agent
 omsa         Install legacy Dell OMSA on supported PowerEdge x30/x40 hosts
 glances      Install Glances
 acronis      Install the Acronis agent
-post-install Run the ProxMenux post-install configuration
+post-install Open the native TAPM host configuration menu
-proxmenux     Install or open ProxMenux
+proxmenux     Open TAPM host configuration for migration compatibility
 virtio       Download current VirtIO drivers
 sentinelone  Install the SentinelOne agent
 screenconnect Install the ScreenConnect agent
@@ -85,6 +85,21 @@ CPU compatibility detection previews cluster-wide QEMU VM and template
 changes before applying the ProxCLMC recommendation through the Proxmox CLI.
 Running VMs are not restarted automatically.
 
+The native TAPM host configuration workflow replaces the former ProxMenux
+post-install dependency. It can audit a host, apply the recommended PVE 9
+profile, customize individual items, migrate recognized ProxMenux
+configurations, repair ProxMenux's system gzip replacement, and remove
+ProxMenux after validation. Every mutating run first creates a timestamped
+backup under `/var/backups/ta-proxmenu/post-install`.
+
+The recommended profile installs only missing diagnostic utilities, preserves
+the configured timezone and NTP servers, enables conservative kernel and
+network safeguards, retains up to 1 GiB or 30 days of persistent journal
+history, verifies logrotate, and uses Proxmox's native pigz support without
+replacing `/bin/gzip`. APT remains dual-stack by default; its conditional IPv4
+compatibility check is optional. Global vzdump bandwidth and I/O-priority
+changes are available through a separate explicit menu.
+
 VirtIO downloads are managed from a dedicated submenu. The stable release is
 checked only when that submenu is opened, and curated compatibility ISOs are
 available for Windows Server 2008, 2008 R2, 2012/R2, and 2016. Downloads are
@@ -105,6 +120,7 @@ Run the local validation suite with Bash 4.3 or newer:
 
 The suite checks Bash syntax and Git whitespace, runs ShellCheck when it is
 installed, and exercises Git update states, LXC input/storage selection,
-maintenance evacuation routing, HA affinity parsing, and VirtIO filename
+maintenance evacuation routing, HA affinity parsing, host-profile migration
-validation. Tests use temporary files and mocked Proxmox output; they do not
+signatures and backups, and VirtIO filename validation. Tests use temporary
-download installers or change a Proxmox host.
+files and mocked Proxmox output; they do not download installers or change a
+Proxmox host.

defaults.inc

@@ -3,7 +3,7 @@
 
 action="${1:-}"
 FOLDER='/opt/idssys/ta-proxmenu'
-VERS='2026.7.25-69'
+VERS='2026.7.26-1'
 
 noupdate=' '
 

proxmenu-scripts.sh

@@ -7,6 +7,7 @@ source /opt/idssys/defaults/default.inc
 source /opt/idssys/ta-proxmenu/defaults.inc
 source /opt/idssys/ta-proxmenu/inc/git-update.inc
 source /opt/idssys/ta-proxmenu/inc/ha-status.inc
+source /opt/idssys/ta-proxmenu/inc/post-install.inc
 source /opt/idssys/ta-proxmenu/inc/deploy-iso-nfs-lxc.sh
 source /opt/idssys/ta-proxmenu/inc/deploy-pulse-lxc.sh
 source /opt/idssys/ta-proxmenu/inc/virtio-helpers.inc
@@ -280,97 +281,6 @@ INSTALL_ACRONIS() {
 	FINISH_ACTION
 }
 
-INSTALL_PROXMENUX() {
-	local installer
-	local temp_dir
-
-	if ! TAPM_CREATE_TEMP_DIR proxmenux; then
-		FINISH_FAILED_ACTION
-		return
-	fi
-	temp_dir="$TAPM_TEMP_DIR"
-	installer="${temp_dir}/install.sh"
-
-	if ! TAPM_DOWNLOAD_HTTPS \
-		'https://raw.githubusercontent.com/MacRimi/ProxMenux/main/install_proxmenux.sh' \
-		"$installer" 'ProxMenux installer' ||
-		! bash "$installer" ||
-		[[ ! -x /usr/local/bin/menu ]]; then
-		TAPM_CLEAN_TEMP_DIR "$temp_dir"
-		echo -e "${idsCL[LightRed]}ProxMenux installation failed or could not be verified.${idsCL[Default]}"
-		FINISH_FAILED_ACTION
-		return
-	fi
-
-	TAPM_CLEAN_TEMP_DIR "$temp_dir"
-	/usr/local/bin/menu
-}
-
-PROXMENUX_POST_INSTALL() {
-	local backup_dir='/var/backups/ta-proxmenu'
-	local backup_file=''
-	local post_install_dir='/usr/local/share/proxmenux/scripts/post_install'
-	local post_install_script="${post_install_dir}/customizable_post_install.sh"
-	local timestamp
-
-	if [[ ! -f "$post_install_script" ]]; then
-		INSTALL_PROXMENUX
-		[[ -f "$post_install_script" ]] || return 1
-	fi
-
-	if ! bash "$post_install_script"; then
-		echo -e "${idsCL[LightRed]}The ProxMenux post-install script failed. A completion marker was not created.${idsCL[Default]}"
-		FINISH_FAILED_ACTION
-		return
-	fi
-
-	if [[ -e /etc/apt/sources.list && ! -f /etc/apt/sources.list ]]; then
-		echo -e "${idsCL[LightRed]}/etc/apt/sources.list is not a regular file and was not changed.${idsCL[Default]}"
-		FINISH_FAILED_ACTION
-		return
-	fi
-
-	if [[ -s /etc/apt/sources.list ]]; then
-		timestamp="$(date +%Y%m%d-%H%M%S)"
-		if ! install -d -m 0700 "$backup_dir" ||
-			! backup_file="$(mktemp "${backup_dir}/sources.list.proxmenux.${timestamp}.XXXXXX")" ||
-			! install -m 0600 /etc/apt/sources.list "$backup_file"; then
-			[[ -n "$backup_file" ]] && rm -f -- "$backup_file"
-			echo -e "${idsCL[LightRed]}Could not back up /etc/apt/sources.list; it was not cleared.${idsCL[Default]}"
-			FINISH_FAILED_ACTION
-			return
-		fi
-	fi
-
-	if ! : >/etc/apt/sources.list ||
-		! chmod 0644 /etc/apt/sources.list; then
-		echo -e "${idsCL[LightRed]}Could not enforce an empty /etc/apt/sources.list.${idsCL[Default]}"
-		[[ -n "$backup_file" ]] &&
-			echo "Backup retained at: ${backup_file}"
-		FINISH_FAILED_ACTION
-		return
-	fi
-
-	if ! apt-get update; then
-		echo -e "${idsCL[LightRed]}APT repository validation failed after ProxMenux post-install.${idsCL[Default]}"
-		[[ -n "$backup_file" ]] &&
-			echo "Removed sources were retained at: ${backup_file}"
-		FINISH_FAILED_ACTION
-		return
-	fi
-
-	if ! touch /opt/.PROXMENUX_POST_INSTALL; then
-		echo -e "${idsCL[LightRed]}Post-install succeeded, but the completion marker could not be created.${idsCL[Default]}"
-		FINISH_FAILED_ACTION
-		return
-	fi
-
-	echo -e "\n${idsCL[Green]}ProxMenux post-install completed and APT sources were validated.${idsCL[Default]}"
-	[[ -n "$backup_file" ]] &&
-		echo "ProxMenux additions to sources.list were saved at: ${backup_file}"
-	FINISH_ACTION
-}
-
 INSTALL_GLANCES() {
 	echo
 	if ! DEBIAN_FRONTEND=noninteractive apt-get install glances -y ||
@@ -1860,6 +1770,389 @@ SELECT_MENU() {
 	done
 }
 
+TAPM_POST_PROFILE_SUMMARY() {
+	echo
+	echo -e " ${idsCL[LightCyan]}Recommended TAPM host profile${idsCL[Default]}"
+	echo
+	echo " [x] System utilities and CPU-appropriate microcode"
+	echo " [x] Chrony time synchronization (existing timezone preserved)"
+	echo " [x] Kernel panic recovery (30 seconds)"
+	echo " [x] Conservative inotify limits"
+	echo " [x] Persistent journald (1 GiB / 30 days)"
+	echo " [x] Verify and repair log rotation"
+	echo " [x] Host memory behavior (swappiness 10)"
+	echo " [x] Network safeguards"
+	echo " [x] BBR and TCP Fast Open"
+	echo " [x] Native parallel gzip support for vzdump"
+	echo " [ ] APT network compatibility / conditional IPv4 (optional)"
+	echo
+	echo " Global vzdump bandwidth and I/O-priority overrides are not applied."
+}
+
+TAPM_POST_FAILURE_RECOVERY() {
+	local backup_dir="$1"
+	local mode="$2"
+	local -a labels=(
+		"Retry the selected profile"
+		"Restore the pre-change backup"
+		"Stop and return to the menu"
+	)
+	local -a values=(retry restore stop)
+
+	while true; do
+		echo
+		[[ -n "$backup_dir" ]] && echo " Pre-change backup: ${backup_dir}"
+		SELECT_MENU "Host Configuration Recovery" labels values
+		case "$MENU_SELECTION" in
+			retry)
+				if TAPM_POST_APPLY_PROFILE "$mode"; then
+					echo -e "\n${idsCL[Green]}The profile retry completed successfully.${idsCL[Default]}"
+					echo " New backup: ${TAPM_POST_LAST_BACKUP}"
+					return 0
+				fi
+				echo -e "\n${idsCL[LightRed]}${TAPM_POST_LAST_ERROR:-The retry failed.}${idsCL[Default]}"
+				;;
+			restore)
+				if [[ -n "$backup_dir" ]] &&
+					TAPM_POST_RESTORE_BACKUP "$backup_dir"; then
+					echo -e "\n${idsCL[Green]}The pre-change configuration was restored.${idsCL[Default]}"
+					return 0
+				fi
+				echo -e "\n${idsCL[LightRed]}The pre-change backup could not be restored.${idsCL[Default]}"
+				;;
+			stop|back) return 1 ;;
+			quit) EXIT1; exit 0 ;;
+		esac
+	done
+}
+
+TAPM_POST_APPLY_RECOMMENDED() {
+	local backup_dir
+	local confirmation
+
+	TAPM_POST_DEFAULT_SELECTIONS
+	TAPM_POST_PROFILE_SUMMARY
+	read -r -p " Apply this profile to the current host (type yes to continue)? " \
+		confirmation
+	[[ "${confirmation,,}" == yes ]] || return
+
+	if TAPM_POST_APPLY_PROFILE apply; then
+		echo -e "\n${idsCL[Green]}The TAPM host profile was applied and verified.${idsCL[Default]}"
+		echo " Backup: ${TAPM_POST_LAST_BACKUP}"
+		FINISH_ACTION
+		return
+	fi
+	echo -e "\n${idsCL[LightRed]}${TAPM_POST_LAST_ERROR:-Host profile application failed.}${idsCL[Default]}"
+	backup_dir="$TAPM_POST_LAST_BACKUP"
+	if TAPM_POST_FAILURE_RECOVERY "$backup_dir" apply; then
+		FINISH_ACTION
+	else
+		FINISH_FAILED_ACTION
+	fi
+}
+
+TAPM_POST_MIGRATE_PROXMENUX() {
+	local backup_dir
+	local confirmation
+
+	if ! TAPM_POST_PROXMENUX_DETECTED; then
+		echo -e "\n${idsCL[LightYellow]}No ProxMenux installation or recognized artifacts were detected.${idsCL[Default]}"
+		FINISH_FAILED_ACTION
+		return
+	fi
+	TAPM_POST_DEFAULT_SELECTIONS
+	TAPM_POST_PROFILE_SUMMARY
+	TAPM_POST_MIGRATION_PLAN
+	echo
+	echo -e " ${idsCL[LightYellow]}Migration will repair recognized ProxMenux settings, restore gzip,"
+	echo -e " apply the TAPM profile, and then remove ProxMenux itself.${idsCL[Default]}"
+	echo " Shared packages such as dialog, jq, curl, Git, and Python are retained."
+	echo
+	read -r -p " Migrate this host and remove ProxMenux (type yes to continue)? " \
+		confirmation
+	[[ "${confirmation,,}" == yes ]] || return
+
+	if TAPM_POST_APPLY_PROFILE migrate; then
+		echo -e "\n${idsCL[Green]}The host was migrated to the TAPM profile and ProxMenux was removed.${idsCL[Default]}"
+		echo " Backup: ${TAPM_POST_LAST_BACKUP}"
+		FINISH_ACTION
+		return
+	fi
+	echo -e "\n${idsCL[LightRed]}${TAPM_POST_LAST_ERROR:-ProxMenux migration failed.}${idsCL[Default]}"
+	echo " ProxMenux removal is the final migration step; earlier failures leave it installed."
+	backup_dir="$TAPM_POST_LAST_BACKUP"
+	if TAPM_POST_FAILURE_RECOVERY "$backup_dir" migrate; then
+		FINISH_ACTION
+	else
+		FINISH_FAILED_ACTION
+	fi
+}
+
+TAPM_POST_FLAG_LABEL() {
+	local value="$1"
+	local label="$2"
+
+	(( value == 1 )) && printf '[x] %s' "$label" || printf '[ ] %s' "$label"
+}
+
+TAPM_POST_TOGGLE_FLAG() {
+	local variable_name="$1"
+	local current_value="${!variable_name}"
+
+	(( current_value == 1 )) &&
+		printf -v "$variable_name" '%d' 0 ||
+		printf -v "$variable_name" '%d' 1
+}
+
+TAPM_POST_CUSTOMIZE() {
+	local -a labels
+	local -a values
+
+	TAPM_POST_DEFAULT_SELECTIONS
+	while true; do
+		labels=(
+			"$(TAPM_POST_FLAG_LABEL "$TAPM_POST_DO_UTILITIES" "System utilities")"
+			"$(TAPM_POST_FLAG_LABEL "$TAPM_POST_DO_TIME" "Time synchronization")"
+			"$(TAPM_POST_FLAG_LABEL "$TAPM_POST_DO_PANIC" "Kernel panic recovery")"
+			"$(TAPM_POST_FLAG_LABEL "$TAPM_POST_DO_LIMITS" "Conservative inotify limits")"
+			"$(TAPM_POST_FLAG_LABEL "$TAPM_POST_DO_JOURNALD" "Journald — 1 GiB / 30 days")"
+			"$(TAPM_POST_FLAG_LABEL "$TAPM_POST_DO_LOGROTATE" "Verify and repair log rotation")"
+			"$(TAPM_POST_FLAG_LABEL "$TAPM_POST_DO_MEMORY" "Host memory behavior")"
+			"$(TAPM_POST_FLAG_LABEL "$TAPM_POST_DO_NETWORK" "Network safeguards")"
+			"$(TAPM_POST_FLAG_LABEL "$TAPM_POST_DO_BBR" "BBR and TCP Fast Open")"
+			"$(TAPM_POST_FLAG_LABEL "$TAPM_POST_DO_PIGZ" "Native parallel gzip for vzdump")"
+			"$(TAPM_POST_FLAG_LABEL "$TAPM_POST_DO_APT_NETWORK" "APT network compatibility check")"
+			"Apply selected profile"
+		)
+		values=(
+			utilities time panic limits journald logrotate memory network bbr pigz
+			apt_network apply
+		)
+		SELECT_MENU "Customize TAPM Host Profile" labels values
+		case "$MENU_SELECTION" in
+			utilities) TAPM_POST_TOGGLE_FLAG TAPM_POST_DO_UTILITIES ;;
+			time) TAPM_POST_TOGGLE_FLAG TAPM_POST_DO_TIME ;;
+			panic) TAPM_POST_TOGGLE_FLAG TAPM_POST_DO_PANIC ;;
+			limits) TAPM_POST_TOGGLE_FLAG TAPM_POST_DO_LIMITS ;;
+			journald) TAPM_POST_TOGGLE_FLAG TAPM_POST_DO_JOURNALD ;;
+			logrotate) TAPM_POST_TOGGLE_FLAG TAPM_POST_DO_LOGROTATE ;;
+			memory) TAPM_POST_TOGGLE_FLAG TAPM_POST_DO_MEMORY ;;
+			network) TAPM_POST_TOGGLE_FLAG TAPM_POST_DO_NETWORK ;;
+			bbr) TAPM_POST_TOGGLE_FLAG TAPM_POST_DO_BBR ;;
+			pigz) TAPM_POST_TOGGLE_FLAG TAPM_POST_DO_PIGZ ;;
+			apt_network) TAPM_POST_TOGGLE_FLAG TAPM_POST_DO_APT_NETWORK ;;
+			apply)
+				local backup_dir
+				local confirmation
+				echo
+				read -r -p " Apply the selected profile (type yes to continue)? " \
+					confirmation
+				[[ "${confirmation,,}" == yes ]] || continue
+				if TAPM_POST_APPLY_PROFILE custom; then
+					echo -e "\n${idsCL[Green]}The custom TAPM profile was applied.${idsCL[Default]}"
+					echo " Backup: ${TAPM_POST_LAST_BACKUP}"
+					FINISH_ACTION
+					return
+				fi
+				echo -e "\n${idsCL[LightRed]}${TAPM_POST_LAST_ERROR:-Custom profile application failed.}${idsCL[Default]}"
+				backup_dir="$TAPM_POST_LAST_BACKUP"
+				if TAPM_POST_FAILURE_RECOVERY "$backup_dir" custom; then
+					FINISH_ACTION
+				else
+					FINISH_FAILED_ACTION
+				fi
+				return
+				;;
+			back) return ;;
+			quit) EXIT1; exit 0 ;;
+		esac
+	done
+}
+
+TAPM_POST_SHOW_AUDIT() {
+	MENU_HEADER
+	echo
+	TAPM_POST_AUDIT
+	FINISH_ACTION
+}
+
+TAPM_POST_SHOW_REPORT() {
+	local report='/var/lib/ta-proxmenu/post-install/last-report.txt'
+
+	MENU_HEADER
+	echo
+	if [[ -f "$report" ]]; then
+		cat "$report"
+	else
+		echo -e " ${idsCL[LightYellow]}No completed TAPM host configuration report is available.${idsCL[Default]}"
+	fi
+	FINISH_ACTION
+}
+
+TAPM_POST_RESTORE_MENU() {
+	local backup_base='/var/backups/ta-proxmenu/post-install'
+	local -a labels=()
+	local -a values=()
+	local backup_dir
+	local confirmation
+
+	if [[ -d "$backup_base" ]]; then
+		while IFS= read -r backup_dir; do
+			[[ -f "${backup_dir}/manifest.tsv" ]] || continue
+			labels+=("${backup_dir##*/}")
+			values+=("$backup_dir")
+		done < <(find "$backup_base" -mindepth 1 -maxdepth 1 -type d |
+			sort -r)
+	fi
+	if (( ${#labels[@]} == 0 )); then
+		echo -e "\n${idsCL[LightYellow]}No TAPM host configuration backups were found.${idsCL[Default]}"
+		FINISH_FAILED_ACTION
+		return
+	fi
+
+	SELECT_MENU "Restore TAPM Host Configuration Backup" labels values
+	case "$MENU_SELECTION" in
+		back) return ;;
+		quit) EXIT1; exit 0 ;;
+	esac
+	backup_dir="$MENU_SELECTION"
+	echo
+	echo " Selected backup: $backup_dir"
+	echo " Restoring may also reinstate files or services removed during migration."
+	read -r -p " Restore this backup (type restore to continue)? " confirmation
+	[[ "${confirmation,,}" == restore ]] || return
+	if TAPM_POST_RESTORE_BACKUP "$backup_dir"; then
+		echo -e "\n${idsCL[Green]}The selected configuration backup was restored.${idsCL[Default]}"
+		FINISH_ACTION
+		return
+	fi
+	echo -e "\n${idsCL[LightRed]}The selected backup could not be fully restored.${idsCL[Default]}"
+	FINISH_FAILED_ACTION
+}
+
+TAPM_POST_VZDUMP_APPLY() {
+	local mode="$1"
+	local bandwidth="${2:-}"
+	local ionice="${3:-}"
+
+	TAPM_POST_LAST_ERROR=''
+	if ! TAPM_POST_PRECHECK; then
+		echo -e "\n${idsCL[LightRed]}$TAPM_POST_LAST_ERROR${idsCL[Default]}"
+		FINISH_FAILED_ACTION
+		return
+	fi
+	if ! TAPM_POST_BACKUP >/dev/null; then
+		echo -e "\n${idsCL[LightRed]}The vzdump configuration backup failed.${idsCL[Default]}"
+		FINISH_FAILED_ACTION
+		return
+	fi
+	case "$mode" in
+		defaults)
+			TAPM_POST_REMOVE_COLON_KEY /etc/vzdump.conf bwlimit &&
+				TAPM_POST_REMOVE_COLON_KEY /etc/vzdump.conf ionice
+			;;
+		maximum)
+			TAPM_POST_SET_COLON_KEY /etc/vzdump.conf bwlimit 0 &&
+				TAPM_POST_SET_COLON_KEY /etc/vzdump.conf ionice 5
+			;;
+		custom)
+			TAPM_POST_SET_COLON_KEY /etc/vzdump.conf bwlimit "$bandwidth" &&
+				TAPM_POST_SET_COLON_KEY /etc/vzdump.conf ionice "$ionice"
+			;;
+	esac
+	if (( $? == 0 )); then
+		echo -e "\n${idsCL[Green]}vzdump performance settings were updated.${idsCL[Default]}"
+		echo " Backup: ${TAPM_POST_LAST_BACKUP}"
+		FINISH_ACTION
+		return
+	fi
+	echo -e "\n${idsCL[LightRed]}vzdump performance settings could not be updated.${idsCL[Default]}"
+	FINISH_FAILED_ACTION
+}
+
+TAPM_POST_VZDUMP_MENU() {
+	local -a labels=(
+		"Use Proxmox defaults — recommended"
+		"Maximum throughput — unlimited, ionice 5"
+		"Set a custom bandwidth limit"
+		"Restore a TAPM configuration backup"
+	)
+	local -a values=(defaults maximum custom restore)
+	local confirmation
+	local bandwidth_mib
+	local bandwidth_kib
+	local ionice
+
+	SELECT_MENU "Configure vzdump Performance" labels values
+	case "$MENU_SELECTION" in
+		defaults)
+			TAPM_POST_VZDUMP_APPLY defaults
+			;;
+		maximum)
+			echo
+			echo -e "${idsCL[LightYellow]}This can saturate shared storage and increase guest latency.${idsCL[Default]}"
+			read -r -p " Enable maximum throughput (type yes to continue)? " confirmation
+			[[ "${confirmation,,}" == yes ]] &&
+				TAPM_POST_VZDUMP_APPLY maximum
+			;;
+		custom)
+			echo
+			while true; do
+				read -r -p " Bandwidth limit in MiB/s (0 means unlimited): " bandwidth_mib
+				[[ "$bandwidth_mib" =~ ^[0-9]+$ ]] && break
+				echo " Enter a nonnegative whole number."
+			done
+			while true; do
+				read -r -p " I/O priority [0-8, Proxmox default is 7]: " ionice
+				[[ "$ionice" =~ ^[0-8]$ ]] && break
+				echo " Enter a value from 0 through 8."
+			done
+			bandwidth_kib=$((bandwidth_mib * 1024))
+			TAPM_POST_VZDUMP_APPLY custom "$bandwidth_kib" "$ionice"
+			;;
+		restore) TAPM_POST_RESTORE_MENU ;;
+		back) return ;;
+		quit) EXIT1; exit 0 ;;
+	esac
+}
+
+TAPM_HOST_CONFIGURATION_MENU() {
+	local -a labels
+	local -a values
+
+	while true; do
+		labels=(
+			"Audit current host"
+			"Apply/repair recommended TAPM profile"
+			"Customize TAPM profile"
+		)
+		values=(audit apply customize)
+		if TAPM_POST_PROXMENUX_DETECTED; then
+			labels+=("** Migrate from ProxMenux — RECOMMENDED **")
+			values+=(migrate)
+		fi
+		labels+=(
+			"Configure vzdump performance"
+			"Restore a TAPM configuration backup"
+			"View last configuration report"
+		)
+		values+=(vzdump restore report)
+
+		SELECT_MENU "TAPM Host Configuration" labels values
+		case "$MENU_SELECTION" in
+			audit) TAPM_POST_SHOW_AUDIT ;;
+			apply) TAPM_POST_APPLY_RECOMMENDED ;;
+			customize) TAPM_POST_CUSTOMIZE ;;
+			migrate) TAPM_POST_MIGRATE_PROXMENUX ;;
+			vzdump) TAPM_POST_VZDUMP_MENU ;;
+			restore) TAPM_POST_RESTORE_MENU ;;
+			report) TAPM_POST_SHOW_REPORT ;;
+			back) return ;;
+			quit) EXIT1; exit 0 ;;
+		esac
+	done
+}
+
 SHOW_ABOUT() {
 	MENU_HEADER
 	echo
@@ -1877,10 +2170,10 @@ HOST_SETUP_MENU() {
 	local -a values
 
 	while true; do
-		labels=("Run ProxMenux post-install configuration")
+		labels=("TAPM Host Configuration")
 		values=("post_install")
-		[ -f /opt/.PROXMENUX_POST_INSTALL ] &&
+		TAPM_POST_PROXMENUX_DETECTED &&
-			labels[0]="Run ProxMenux post-install configuration (previously run)"
+			labels[0]="TAPM Host Configuration — ProxMenux migration recommended"
 		labels+=("Detect CPU model for live migrations")
 		values+=("cpu")
 
@@ -1902,7 +2195,7 @@ HOST_SETUP_MENU() {
 
 		SELECT_MENU "Host Setup" labels values
 		case "$MENU_SELECTION" in
-			post_install) PROXMENUX_POST_INSTALL;;
+			post_install) TAPM_HOST_CONFIGURATION_MENU;;
 			cpu) DETECT_CPU;;
 			virtio) VIRTIO_MENU;;
 			glances) INSTALL_GLANCES;;
@@ -2285,14 +2578,7 @@ if (( ACTION_REQUESTED == 1 )); then
 		omsa) INSTALL_OMSA;;
 		glances) INSTALL_GLANCES;;
 		acronis) INSTALL_ACRONIS;;
-		post-install|post_install) PROXMENUX_POST_INSTALL;;
+		post-install|post_install|proxmenux) TAPM_HOST_CONFIGURATION_MENU;;
-		proxmenux)
-			if [[ ! -f /usr/local/bin/menu ]]; then
-				INSTALL_PROXMENUX
-			else
-				/usr/local/bin/menu
-			fi
-			;;
 		virtio) VIRTIO_MENU;;
 		sentinelone|s1) INSTALL_S1;;
 		screenconnect) INSTALL_SCREENCONNECT;;

tests/test-post-install.sh

@@ -0,0 +1,168 @@
+#!/usr/bin/env bash
+set -u -o pipefail
+
+TEST_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+source "${TEST_ROOT}/tests/testlib.sh"
+source "${TEST_ROOT}/inc/post-install.inc"
+
+POST_TEST_ROOT="$(mktemp -d /tmp/tapm-post-install.XXXXXX)"
+TAPM_HOST_ROOT="$POST_TEST_ROOT"
+
+cleanup_post_install_tests() {
+	if [[ "$POST_TEST_ROOT" == /tmp/tapm-post-install.* &&
+		-d "$POST_TEST_ROOT" ]]; then
+		rm -rf -- "$POST_TEST_ROOT"
+	fi
+}
+trap cleanup_post_install_tests EXIT
+
+mkdir -p \
+	"${POST_TEST_ROOT}/etc/apt/apt.conf.d" \
+	"${POST_TEST_ROOT}/etc/systemd" \
+	"${POST_TEST_ROOT}/etc/logrotate.d" \
+	"${POST_TEST_ROOT}/etc/sysctl.d" \
+	"${POST_TEST_ROOT}/etc/network" \
+	"${POST_TEST_ROOT}/etc" \
+	"${POST_TEST_ROOT}/bin"
+
+printf 'Acquire::Languages "none";\n' \
+	>"${POST_TEST_ROOT}/etc/apt/apt.conf.d/99-disable-translations"
+assert_success "ProxMenux APT language setting recognized" \
+	TAPM_POST_EXACT_APT_LANGUAGES
+
+printf 'Acquire::Languages "en";\n' \
+	>"${POST_TEST_ROOT}/etc/apt/apt.conf.d/99-disable-translations"
+assert_failure "custom APT language setting preserved" \
+	TAPM_POST_EXACT_APT_LANGUAGES
+
+cat >"${POST_TEST_ROOT}/etc/systemd/journald.conf" <<'EOF'
+[Journal]
+Storage=persistent
+Seal=no
+SystemMaxUse=64M
+RuntimeMaxUse=60M
+MaxLevelStore=info
+EOF
+assert_success "ProxMenux journald replacement recognized" \
+	TAPM_POST_PROXMENUX_JOURNALD
+
+cat >"${POST_TEST_ROOT}/etc/logrotate.conf" <<'EOF'
+# ProxMenux optimized configuration (Log2RAM-friendly)
+daily
+rotate 7
+size 10M
+copytruncate
+include /etc/logrotate.d
+EOF
+assert_success "ProxMenux logrotate replacement recognized" \
+	TAPM_POST_PROXMENUX_LOGROTATE
+
+cat >"${POST_TEST_ROOT}/bin/gzip" <<'EOF'
+#!/bin/sh
+GZIP="-1"
+exec /usr/bin/pigz "$@"
+EOF
+cat >"${POST_TEST_ROOT}/bin/gzip.original" <<'EOF'
+#!/bin/sh
+if [ "${1:-}" = "--version" ]; then
+	printf 'gzip 1.13\n'
+else
+	cat
+fi
+EOF
+cp "${POST_TEST_ROOT}/bin/gzip" "${POST_TEST_ROOT}/bin/pigzwrapper"
+chmod 0755 \
+	"${POST_TEST_ROOT}/bin/gzip" \
+	"${POST_TEST_ROOT}/bin/gzip.original" \
+	"${POST_TEST_ROOT}/bin/pigzwrapper"
+assert_success "ProxMenux gzip wrapper recognized" \
+	TAPM_POST_PROXMENUX_GZIP_WRAPPER
+assert_success "ProxMenux gzip wrapper repaired from valid original" \
+	TAPM_POST_REPAIR_GZIP
+assert_failure "repaired gzip is no longer recognized as wrapper" \
+	TAPM_POST_PROXMENUX_GZIP_WRAPPER
+assert_failure "obsolete gzip original removed after verification" \
+	test -e "${POST_TEST_ROOT}/bin/gzip.original"
+
+assert_success "kernel panic profile written" TAPM_POST_CONFIGURE_PANIC
+assert_success "inotify profile written" TAPM_POST_CONFIGURE_LIMITS
+assert_success "memory profile written" TAPM_POST_CONFIGURE_MEMORY
+assert_success "network profile written" TAPM_POST_CONFIGURE_NETWORK
+assert_success "BBR profile written" TAPM_POST_CONFIGURE_BBR
+assert_equal 30 \
+	"$(awk '/kernel.panic =/ {print $3}' \
+		"${POST_TEST_ROOT}/etc/sysctl.d/99-ta-proxmenu-kernel-panic.conf")" \
+	"kernel panic delay"
+assert_equal 524288 \
+	"$(awk '/max_user_watches/ {print $3}' \
+		"${POST_TEST_ROOT}/etc/sysctl.d/99-ta-proxmenu-limits.conf")" \
+	"inotify watch limit"
+assert_equal 10 \
+	"$(awk '/vm.swappiness/ {print $3}' \
+		"${POST_TEST_ROOT}/etc/sysctl.d/99-ta-proxmenu-memory.conf")" \
+	"host swappiness"
+
+cat >"${POST_TEST_ROOT}/etc/vzdump.conf" <<'EOF'
+# existing setting
+bwlimit: 50000
+pigz: 4
+pigz: 8
+EOF
+assert_success "vzdump key replacement" \
+	TAPM_POST_SET_COLON_KEY /etc/vzdump.conf pigz 1
+assert_equal 1 \
+	"$(awk -F: '/^pigz:/ {gsub(/[[:space:]]/, "", $2); print $2}' \
+		"${POST_TEST_ROOT}/etc/vzdump.conf")" \
+	"vzdump pigz setting is unique"
+assert_success "vzdump key removal" \
+	TAPM_POST_REMOVE_COLON_KEY /etc/vzdump.conf bwlimit
+assert_failure "vzdump bandwidth setting removed" \
+	grep -q '^bwlimit:' "${POST_TEST_ROOT}/etc/vzdump.conf"
+
+printf 'deb should-be-backed-up\n' \
+	>"${POST_TEST_ROOT}/etc/apt/sources.list"
+TAPM_POST_BACKUP_BASE='/var/backups/ta-proxmenu/post-install'
+test_post_backup() {
+	TAPM_POST_BACKUP >/dev/null
+}
+assert_success "host configuration backup created" test_post_backup
+printf 'changed\n' >"${POST_TEST_ROOT}/etc/apt/sources.list"
+assert_success "host configuration backup restored" \
+	TAPM_POST_RESTORE_BACKUP "$TAPM_POST_LAST_BACKUP"
+assert_equal 'deb should-be-backed-up' \
+	"$(cat "${POST_TEST_ROOT}/etc/apt/sources.list")" \
+	"restored APT sources"
+
+assert_success "APT source layout enforced in fixture root" \
+	TAPM_POST_ENSURE_APT_LAYOUT
+assert_equal 0 \
+	"$(wc -c <"${POST_TEST_ROOT}/etc/apt/sources.list" | tr -d ' ')" \
+	"main APT sources list is empty"
+
+mkdir -p \
+	"${POST_TEST_ROOT}/etc/security/limits.d" \
+	"${POST_TEST_ROOT}/usr/local/share/proxmenux" \
+	"${POST_TEST_ROOT}/usr/local/bin"
+cat >"${POST_TEST_ROOT}/etc/sysctl.d/99-network.conf" <<'EOF'
+# Custom administrator network profile
+net.ipv4.ip_forward = 1
+EOF
+cat >"${POST_TEST_ROOT}/etc/security/limits.d/99-limits.conf" <<'EOF'
+# ProxMenux configuration
+* soft nofile 1048576
+EOF
+cat >"${POST_TEST_ROOT}/usr/local/bin/menu" <<'EOF'
+#!/bin/sh
+exec /usr/local/share/proxmenux/menu.sh
+EOF
+assert_success "recognized ProxMenux settings cleaned" \
+	TAPM_POST_CLEAN_PROXMENUX_SETTINGS
+assert_success "custom similarly named network profile retained" \
+	test -f "${POST_TEST_ROOT}/etc/sysctl.d/99-network.conf"
+assert_failure "recognized ProxMenux limits profile removed" \
+	test -e "${POST_TEST_ROOT}/etc/security/limits.d/99-limits.conf"
+assert_success "ProxMenux application removed" TAPM_POST_REMOVE_PROXMENUX_APP
+assert_failure "ProxMenux menu launcher removed" \
+	test -e "${POST_TEST_ROOT}/usr/local/bin/menu"
+
+finish_tests