update pulse installer

inc/deploy-pulse-lxc.sh

@@ -215,9 +215,8 @@ TAPM_PULSE_CONFIRM_CREDENTIALS_SAVED() {
 	local admin_username="$2"
 	local admin_password="$3"
 	local primary_api_token="$4"
-	local installed="$5"
-	local failed="$6"
-	local cluster_status="$7"
+	local cluster_status="$5"
+	local agent_status="$6"
 	local acknowledgement
 
 	while true; do
@@ -231,7 +230,7 @@ TAPM_PULSE_CONFIRM_CREDENTIALS_SAVED() {
 		echo -e " Password:   ${idsCL[LightGreen]}${admin_password}${idsCL[Default]}"
 		echo -e " API token:  ${idsCL[LightGreen]}${primary_api_token}${idsCL[Default]}"
 		echo " Cluster:    ${cluster_status}"
-		echo " Agents:     ${installed} installed, ${failed} failed or offline"
+		echo " Agents:     ${agent_status}"
 		echo -e "${idsCL[LightYellow]}============================================================================${idsCL[Default]}"
 		echo
 		read -r -p " Type saved after recording the password and API token: " acknowledgement
@@ -356,10 +355,37 @@ TAPM_PULSE_REMOVE_PARTIAL_LXC() {
 	local ctid="$1"
 
 	echo -e "${idsCL[LightYellow]}Removing incomplete LXC ${ctid} created by this deployment...${idsCL[Default]}"
+	if command -v ha-manager >/dev/null 2>&1; then
+		ha-manager remove "ct:${ctid}" >/dev/null 2>&1 || true
+	fi
 	pct stop "$ctid" --skiplock 1 >/dev/null 2>&1 || true
 	pct destroy "$ctid" --purge 1 >/dev/null 2>&1 || true
 }
 
+TAPM_PULSE_OFFER_FAILED_LXC_REMOVAL() {
+	local ctid="$1"
+	local choice
+
+	while true; do
+		echo
+		read -r -p " Remove the incomplete Pulse LXC ${ctid} now? [Y/n] " choice
+		case "$choice" in
+			''|[Yy])
+				TAPM_PULSE_REMOVE_PARTIAL_LXC "$ctid"
+				echo -e "${idsCL[Green]}Incomplete Pulse LXC ${ctid} was removed.${idsCL[Default]}"
+				return 0
+				;;
+			[Nn])
+				echo -e "${idsCL[LightYellow]}Pulse LXC ${ctid} was kept for troubleshooting.${idsCL[Default]}"
+				return 1
+				;;
+			*)
+				TAPM_PULSE_FAIL "Enter y or n."
+				;;
+		esac
+	done
+}
+
 TAPM_PULSE_CONFIGURE_SECURITY() {
 	local ctid="$1"
 	local pulse_url="$2"
@@ -486,6 +512,12 @@ TAPM_PULSE_REGISTER_CLUSTER() {
 		# shellcheck disable=SC1090
 		source "$installer"
 		IN_CONTAINER=false
+		# Pulse v6.1.1's installer omits backup_perms from its expected
+		# artifact URLs even when it requests backupPerms=true. That causes it
+		# to reject Pulse's otherwise valid response as "missing setup token."
+		# Use the internally consistent least-privilege request until a newer
+		# pinned Pulse release fixes that upstream contract mismatch.
+		PULSE_AUTO_BACKUP_PERMS=false
 
 		# Pulse v6.1.1 requires authentication for setup-token creation. Add
 		# the primary token only to that request; never send it to Proxmox.
@@ -802,6 +834,7 @@ TAPM_DEPLOY_PULSE_LXC() {
 	local network_config choice add_ha='no' auto_updates='yes' container_ip timezone temp_dir
 	local default_bridge pulse_url admin_username admin_password primary_api_token
 	local cluster_status='Registration failed'
+	local agent_status='Skipped because cluster registration failed'
 	local container_created=0
 	local -a create_args=()
 
@@ -1092,7 +1125,8 @@ TAPM_DEPLOY_PULSE_LXC() {
 		pct exec "$ctid" -- rm -f \
 			/tmp/install.sh "/tmp/${archive_name}" "/tmp/${archive_name}.sshsig" || true
 		TAPM_CLEAN_TEMP_DIR "$temp_dir"
-		TAPM_PULSE_FAIL "Pulse is running, but its LXC address could not be determined. The LXC was kept."
+		TAPM_PULSE_FAIL "Pulse is running, but its LXC address could not be determined."
+		TAPM_PULSE_OFFER_FAILED_LXC_REMOVAL "$ctid" || true
 		return 1
 	fi
 
@@ -1103,9 +1137,11 @@ TAPM_DEPLOY_PULSE_LXC() {
 		pct exec "$ctid" -- rm -f \
 			/tmp/install.sh "/tmp/${archive_name}" "/tmp/${archive_name}.sshsig" || true
 		TAPM_CLEAN_TEMP_DIR "$temp_dir"
-		echo " The Pulse LXC was kept so setup can be recovered without reinstalling it."
-		echo " Run this on the Proxmox host to request a fresh setup token:"
-		echo "   pct exec ${ctid} -- env PULSE_DATA_DIR=/etc/pulse /usr/local/bin/pulse bootstrap-token"
+		if ! TAPM_PULSE_OFFER_FAILED_LXC_REMOVAL "$ctid"; then
+			echo " Setup can be recovered without reinstalling the retained LXC."
+			echo " Run this on the Proxmox host to request a fresh setup token:"
+			echo "   pct exec ${ctid} -- env PULSE_DATA_DIR=/etc/pulse /usr/local/bin/pulse bootstrap-token"
+		fi
 		return 1
 	fi
 
@@ -1115,16 +1151,23 @@ TAPM_DEPLOY_PULSE_LXC() {
 		"$primary_api_token" "$temp_dir"; then
 		cluster_status='Registered'
 		echo -e "${idsCL[Green]}Pulse confirmed Proxmox cluster registration.${idsCL[Default]}"
+
+		echo -e "\n${idsCL[LightCyan]}Deploying clean Pulse Unified Agents to cluster nodes...${idsCL[Default]}"
+		TAPM_PULSE_AGENTS_INSTALLED=0
+		TAPM_PULSE_AGENTS_FAILED=0
+		TAPM_PULSE_DEPLOY_CLUSTER_AGENTS \
+			"$pulse_url" "$primary_api_token" "$temp_dir" || true
+		agent_status="${TAPM_PULSE_AGENTS_INSTALLED} registered, ${TAPM_PULSE_AGENTS_FAILED} failed or offline"
 	else
 		echo -e "${idsCL[LightRed]}Pulse is secured, but Proxmox cluster registration did not complete.${idsCL[Default]}"
+		echo -e "${idsCL[LightYellow]}Skipping Unified Agent deployment until cluster registration succeeds.${idsCL[Default]}"
+		if TAPM_PULSE_OFFER_FAILED_LXC_REMOVAL "$ctid"; then
+			TAPM_CLEAN_TEMP_DIR "$temp_dir"
+			unset admin_password primary_api_token
+			return 1
+		fi
 	fi
 
-	echo -e "\n${idsCL[LightCyan]}Deploying clean Pulse Unified Agents to cluster nodes...${idsCL[Default]}"
-	TAPM_PULSE_AGENTS_INSTALLED=0
-	TAPM_PULSE_AGENTS_FAILED=0
-	TAPM_PULSE_DEPLOY_CLUSTER_AGENTS \
-		"$pulse_url" "$primary_api_token" "$temp_dir" || true
-
 	pct exec "$ctid" -- rm -f \
 		/tmp/install.sh "/tmp/${archive_name}" "/tmp/${archive_name}.sshsig" || true
 	TAPM_CLEAN_TEMP_DIR "$temp_dir"
@@ -1134,6 +1177,5 @@ TAPM_DEPLOY_PULSE_LXC() {
 	echo -e "${idsCL[Green]}Pulse ${release} was installed and its service is active.${idsCL[Default]}"
 	TAPM_PULSE_CONFIRM_CREDENTIALS_SAVED \
 		"$pulse_url" "$admin_username" "$admin_password" "$primary_api_token" \
-		"$TAPM_PULSE_AGENTS_INSTALLED" "$TAPM_PULSE_AGENTS_FAILED" \
-		"$cluster_status"
+		"$cluster_status" "$agent_status"
 }