Add deploy_utilities() — LXC 127, utilities_db, utilities app

Runs before deploy_reports so UTILITIES_API_KEY exists when reports'
.env is written on a fresh install.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

install-stack.sh

@@ -1458,6 +1458,8 @@ APP_SLUG=reports
 DATABASE_URL=postgresql://reports:${REPORTS_DB_PASS}@10.10.10.100:5432/reports_db
 FORECASTING_URL=http://10.10.10.113:3080
 FORECASTING_API_KEY=${FORECASTING_API_KEY:-}
+UTILITIES_URL=http://10.10.10.127:3080
+UTILITIES_API_KEY=${UTILITIES_API_KEY:-}
 CENTRAL_AUTH_SECRET=${CENTRAL_AUTH_SECRET}
 SETTINGS_URL=http://10.10.10.116:3080
 SETTINGS_SECRET=${SETTINGS_SECRET}
@@ -1581,6 +1583,93 @@ ${build_out}"
   npm_add_location "/wages/" "10.10.10.124" 3080
 }
 
+deploy_utilities() {
+  msg_step "Utilities (LXC 127 · 10.10.10.127)"
+
+  if [[ -z "${UTILITIES_DB_PASS:-}" ]]; then
+    UTILITIES_DB_PASS=$(openssl rand -base64 24 | tr -dc 'a-zA-Z0-9' | head -c 24)
+    printf '\nUTILITIES_DB_PASS=%s\n' "$UTILITIES_DB_PASS" >> "$CREDS_FILE"
+    msg_ok "Generated UTILITIES_DB_PASS → ${CREDS_FILE}"
+  fi
+  if [[ -z "${UTILITIES_API_KEY:-}" ]]; then
+    UTILITIES_API_KEY=$(openssl rand -hex 24)
+    printf '\nUTILITIES_API_KEY=%s\n' "$UTILITIES_API_KEY" >> "$CREDS_FILE"
+    msg_ok "Generated UTILITIES_API_KEY → ${CREDS_FILE}"
+  fi
+
+  msg_info "Creating LXC 127"
+  create_lxc 127 "10.10.10.127" "utilities" 1024 1
+  msg_ok "LXC 127 created"
+
+  msg_info "Installing Docker"
+  install_docker 127
+  install_mgmt_key 127
+  msg_ok "Docker + SSH ready"
+
+  msg_info "Creating utilities database"
+  pct exec 100 -- bash -c "
+    docker exec hotel-manage-postgres psql -U postgres -c \
+      \"CREATE USER utilities WITH PASSWORD '${UTILITIES_DB_PASS}';\" 2>/dev/null || true
+    docker exec hotel-manage-postgres psql -U postgres -c \
+      \"CREATE DATABASE utilities_db OWNER utilities;\" 2>/dev/null || true
+    docker exec hotel-manage-postgres psql -U postgres -d utilities_db -c \
+      \"GRANT ALL ON SCHEMA public TO utilities;\" 2>/dev/null || true
+  " &>/dev/null
+  msg_ok "Database utilities_db ready"
+
+  msg_info "Deploying utilities"
+  deploy_service 127 "utilities" "${REPO_ROOT}/utilities" /opt/utilities
+
+  push_file 127 /opt/utilities/.env <<EOF
+NODE_ENV=production
+APP_SLUG=utilities
+DATABASE_URL=postgresql://utilities:${UTILITIES_DB_PASS}@10.10.10.100:5432/utilities_db
+CENTRAL_AUTH_SECRET=${CENTRAL_AUTH_SECRET}
+SETTINGS_URL=http://10.10.10.116:3080
+SETTINGS_SECRET=${SETTINGS_SECRET}
+OFFICE_IP_CHECK=${OFFICE_IP_CHECK:-${OFFICE_IP:-disabled}}
+UTILITIES_API_KEY=${UTILITIES_API_KEY}
+FRONTEND_PORT=3080
+EOF
+
+  local build_out
+  if ! build_out=$(pct exec 127 -- bash -c "cd /opt/utilities && docker compose up -d --build 2>&1"); then
+    msg_error "docker compose build failed in LXC 127:
+${build_out}"
+  fi
+
+  msg_info "Waiting for utilities"
+  wait_healthy 127 "http://localhost:3080/utilities/health" \
+    && msg_ok "Utilities running at 10.10.10.127:3080" \
+    || msg_warn "Utilities may need extra time — check LXC 127"
+
+  msg_info "Seeding utilities into auth DB"
+  pct exec 100 -- docker exec hotel-manage-postgres psql -U postgres -d auth_db -c "
+    INSERT INTO apps (slug, name, description, base_path, icon, theme_color, category, internal_host, internal_port)
+    VALUES ('utilities', 'Utilities', 'Meter readings, tariffs and energy cost tracking', '/utilities', 'Zap', '#1e6091', 'Operations', '10.10.10.127', 3080)
+    ON CONFLICT (slug) DO UPDATE SET
+      name=EXCLUDED.name, description=EXCLUDED.description, base_path=EXCLUDED.base_path,
+      icon=EXCLUDED.icon, theme_color=EXCLUDED.theme_color, category=EXCLUDED.category,
+      internal_host=EXCLUDED.internal_host, internal_port=EXCLUDED.internal_port;
+    INSERT INTO app_capabilities (app_id, slug, name, description, sort_order)
+    SELECT a.id, c.slug, c.name, c.description, c.sort_order
+    FROM apps a, (VALUES
+      ('readings',  'Enter Readings',  'Enter manual meter readings and view reading history', 1),
+      ('meters',    'Manage Meters',   'Create/edit categories, meters, locations and images', 2),
+      ('tariffs',   'Manage Tariffs',  'Create/edit tariffs, rate windows, standing charges and CCL', 3),
+      ('reports',   'View Reports',   'View consumption and cost reports',                     4),
+      ('estimates', 'View Estimates', 'View and adjust period cost estimates',                 5),
+      ('settings',  'Settings',       'App settings',                                          6)
+    ) AS c(slug, name, description, sort_order)
+    WHERE a.slug = 'utilities'
+    ON CONFLICT (app_id, slug) DO NOTHING;
+  " &>/dev/null \
+    && msg_ok "utilities seeded into auth DB" \
+    || msg_warn "Seed failed — run utilities/seed-app.js manually"
+
+  npm_add_location "/utilities/" "10.10.10.127" 3080
+}
+
 deploy_kitchen() {
   msg_step "Kitchen (LXC 110 · 10.10.10.110)"
 
@@ -1992,7 +2081,7 @@ SUMMARY
 # Sources existing credentials and redeploys just the named service.
 if [[ "${1:-}" == "--only" ]]; then
   ONLY="${2:-}"
-  VALID="postgres auth portal npm management noticeboard settings cashup hk-planner twin-optimiser room-planner maintenance forecasting rates reports kitchen kds wages"
+  VALID="postgres auth portal npm management noticeboard settings cashup hk-planner twin-optimiser room-planner maintenance forecasting rates reports kitchen kds wages utilities"
   [[ -z "$ONLY" ]] && msg_error "Usage: install-stack.sh --only <service>  (one of: ${VALID})"
   grep -qw "$ONLY" <<< "$VALID" || msg_error "Unknown service '${ONLY}'. Valid: ${VALID}"
   CREDS_FILE=/root/hotel-manage-credentials.txt
@@ -2026,6 +2115,10 @@ if [[ "${1:-}" == "--only" ]]; then
     "$(openssl rand -base64 24 | tr -dc 'a-zA-Z0-9' | head -c 24)"
   [[ -z "${WAGES_DB_PASS:-}" ]] && _append_secret WAGES_DB_PASS \
     "$(openssl rand -base64 24 | tr -dc 'a-zA-Z0-9' | head -c 24)"
+  [[ -z "${UTILITIES_DB_PASS:-}" ]] && _append_secret UTILITIES_DB_PASS \
+    "$(openssl rand -base64 24 | tr -dc 'a-zA-Z0-9' | head -c 24)"
+  [[ -z "${UTILITIES_API_KEY:-}" ]] && _append_secret UTILITIES_API_KEY \
+    "$(openssl rand -hex 24)"
 
   USE_FORGEJO=true
   [[ -f /root/.ssh/hotel-manage_deploy.pub ]] \
@@ -2051,6 +2144,7 @@ if [[ "${1:-}" == "--only" ]]; then
     kitchen)         deploy_kitchen ;;
     kds)             deploy_kds ;;
     wages)           deploy_wages ;;
+    utilities)       deploy_utilities ;;
   esac
   exit 0
 fi
@@ -2075,6 +2169,7 @@ deploy_room_planner
 deploy_maintenance
 deploy_forecasting
 deploy_rates
+deploy_utilities
 deploy_reports
 deploy_kitchen
 deploy_kds