npm_get_token now attempts the sourced NPM_ADMIN_* pair, then every
email/pass pair present in the credentials file, then admin@example.com/
changeme. Makes proxy-host automation resilient to duplicate, reordered,
or placeholder NPM entries regardless of how they got there.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The NPM API was reached via NPM_LAN_IP, which breaks when that value is a
placeholder or unset (and the :-10.10.10.103 fallback was wrong — the
internal IP is .3, not .103). NPM listens on all interfaces, so the host
can always reach it at 10.10.10.3:81 over vmbr1. NPM_LAN_IP now only drives
user-facing messages and the NPM LXC's LAN net0.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
In --only mode the creds file provides OFFICE_IP_CHECK, not OFFICE_IP,
so the bare ${OFFICE_IP} tripped 'set -u'. Use the same tolerant
${OFFICE_IP_CHECK:-${OFFICE_IP:-disabled}} form as cashup/hk-planner.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Save NPM_LAN_IP to creds file and reload it in --only mode
- npm_get_token and deploy_cashup NPM patch fall back to 10.10.10.103
(internal vmbr1 IP) when NPM_LAN_IP is unset
- Fix health check URL: /cashup/api/health → /cashup/health
(nginx proxies /cashup/health to backend:3001/health; /cashup/api/
proxies to /api/ which has no /health route)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add manage@hotel.com NPM credentials to creds file template and
reload block (NPM_ADMIN_EMAIL was missing from the --only path)
- Extract npm_get_token() so both configure_npm_proxy_hosts and
deploy_cashup share one auth call
- deploy_cashup now patches the live NPM proxy host to add /cashup/
→ 10.10.10.117:3083 after containers are healthy (idempotent)
- /cashup/ also added to the fresh-install locations array
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Using 'if ! pct exec ... > tmp 2>&1' avoids the bash set -e + $()
interaction where the shell exits inside the subshell before || fires.
Errors are now captured to a temp file and printed via msg_error.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Removed &>/dev/null suppression; output is now captured and shown in
msg_error with a debug command when clone or pull fails.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
SETTINGS_DB_PASS and SETTINGS_SECRET won't be in the credentials file
on stacks installed before settings was added. Generate and append them
automatically so --only settings works without a full reinstall.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace source+grep with a safe line-by-line reader so SITE_NAME and
ADMIN_PASS with spaces do not get interpreted as shell commands. Also
quote SITE_NAME and ADMIN_PASS in the written credentials file.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Sources existing credentials file and redeploys just the named service
without running the full interactive installer. Works for any service:
postgres auth portal npm management noticeboard settings.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add LXC 116 (settings) to install-stack.sh: generates SETTINGS_DB_PASS and
SETTINGS_SECRET, creates settings_db in postgres init SQL, provisions the
LXC and deploys the service. Step counter updated to 7/7.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
