chesscubing/scripts/install-proxmox-lxc.sh

#!/usr/bin/env bash
set -Eeuo pipefail

trap 'printf "Erreur: echec de la commande [%s] a la ligne %s.\n" "$BASH_COMMAND" "$LINENO" >&2' ERR

usage() {
  cat <<'EOF'
Usage:
  ./scripts/install-proxmox-lxc.sh \
    --proxmox-host 192.168.1.10 \
    --proxmox-user root@pam \
    --proxmox-password 'motdepasse'

  ./scripts/install-proxmox-lxc.sh --local

Options principales:
  --proxmox-host        IP ou nom DNS du serveur Proxmox
  --proxmox-user        Utilisateur SSH Proxmox (defaut: root@pam)
  --proxmox-password    Mot de passe SSH Proxmox
  --ssh-port            Port SSH Proxmox (defaut: 22)
  --local               Execute directement sur l'hote Proxmox local
  --ctid                CTID Proxmox. Si vide, le prochain ID libre est utilise
  --hostname            Nom du LXC (defaut: chesscubing-web)
  --lxc-ip              IP du LXC ou 'dhcp' (defaut: dhcp)
  --gateway             Passerelle si IP statique
  --bridge              Bridge reseau Proxmox (defaut: vmbr0)
  --cores               Nombre de vCPU du LXC (defaut: 2)
  --memory              Memoire RAM en Mo (defaut: 4096)
  --swap                Swap en Mo (defaut: 1024)
  --disk-gb             Taille disque du LXC en Go (defaut: 16)
  --template-storage    Stockage Proxmox pour les templates
  --rootfs-storage      Stockage Proxmox pour le disque LXC
  --repo-url            Depot Git a deployer
  --branch              Branche Git a deployer (defaut: main)
  --ethan-repo-url      Depot Git de l'application Ethan
  --ethan-branch        Branche Git de l'application Ethan (defaut: main)
  --brice-repo-url      Depot Git de l'application Brice
  --brice-branch        Branche Git de l'application Brice (defaut: main)
  --public-base-url     URL publique du site (ex: http://jeu.example.com)
  --web-port            Port HTTP expose dans le LXC (defaut: 80)
  --keycloak-admin-user Utilisateur admin Keycloak (defaut: admin)
  --keycloak-admin-password
                        Mot de passe admin Keycloak. Genere si absent
  --lxc-password        Mot de passe root du LXC. Genere si absent
  -h, --help            Affiche cette aide

Exemple:
  ./scripts/install-proxmox-lxc.sh \
    --proxmox-host 10.0.0.2 \
    --proxmox-user root@pam \
    --proxmox-password 'secret'
EOF
}

die() {
  printf 'Erreur: %s\n' "$*" >&2
  exit 1
}

need_cmd() {
  command -v "$1" >/dev/null 2>&1 || die "La commande '$1' est requise."
}

PROXMOX_HOST=""
PROXMOX_USER="root@pam"
PROXMOX_PASSWORD="${PROXMOX_PASSWORD:-}"
PROXMOX_PORT="22"
LOCAL_MODE="0"

CTID=""
LXC_HOSTNAME="chesscubing-web"
LXC_IP="dhcp"
LXC_GATEWAY=""
LXC_BRIDGE="vmbr0"
LXC_CORES="2"
LXC_MEMORY="4096"
LXC_SWAP="1024"
LXC_DISK_GB="16"
TEMPLATE_STORAGE=""
ROOTFS_STORAGE=""
REPO_URL="https://git.jeannerot.fr/christophe/chesscubing.git"
REPO_BRANCH="main"
ETHAN_REPO_URL="https://git.jeannerot.fr/Mineloulou/Chesscubing.git"
ETHAN_REPO_BRANCH="main"
BRICE_REPO_URL="https://git.jeannerot.fr/Lescratcheur/ChessCubing.git"
BRICE_REPO_BRANCH="main"
PUBLIC_BASE_URL=""
WEB_PORT="80"
KEYCLOAK_ADMIN_USER="admin"
KEYCLOAK_ADMIN_PASSWORD=""
LXC_PASSWORD=""

while [[ $# -gt 0 ]]; do
  case "$1" in
    --proxmox-host)
      PROXMOX_HOST="${2:-}"
      shift 2
      ;;
    --proxmox-user)
      PROXMOX_USER="${2:-}"
      shift 2
      ;;
    --proxmox-password)
      PROXMOX_PASSWORD="${2:-}"
      shift 2
      ;;
    --ssh-port)
      PROXMOX_PORT="${2:-}"
      shift 2
      ;;
    --local)
      LOCAL_MODE="1"
      shift
      ;;
    --ctid)
      CTID="${2:-}"
      shift 2
      ;;
    --hostname)
      LXC_HOSTNAME="${2:-}"
      shift 2
      ;;
    --lxc-ip)
      LXC_IP="${2:-}"
      shift 2
      ;;
    --gateway)
      LXC_GATEWAY="${2:-}"
      shift 2
      ;;
    --bridge)
      LXC_BRIDGE="${2:-}"
      shift 2
      ;;
    --cores)
      LXC_CORES="${2:-}"
      shift 2
      ;;
    --memory)
      LXC_MEMORY="${2:-}"
      shift 2
      ;;
    --swap)
      LXC_SWAP="${2:-}"
      shift 2
      ;;
    --disk-gb)
      LXC_DISK_GB="${2:-}"
      shift 2
      ;;
    --template-storage)
      TEMPLATE_STORAGE="${2:-}"
      shift 2
      ;;
    --rootfs-storage)
      ROOTFS_STORAGE="${2:-}"
      shift 2
      ;;
    --repo-url)
      REPO_URL="${2:-}"
      shift 2
      ;;
    --branch)
      REPO_BRANCH="${2:-}"
      shift 2
      ;;
    --ethan-repo-url)
      ETHAN_REPO_URL="${2:-}"
      shift 2
      ;;
    --ethan-branch)
      ETHAN_REPO_BRANCH="${2:-}"
      shift 2
      ;;
    --brice-repo-url)
      BRICE_REPO_URL="${2:-}"
      shift 2
      ;;
    --brice-branch)
      BRICE_REPO_BRANCH="${2:-}"
      shift 2
      ;;
    --public-base-url)
      PUBLIC_BASE_URL="${2:-}"
      shift 2
      ;;
    --web-port)
      WEB_PORT="${2:-}"
      shift 2
      ;;
    --keycloak-admin-user)
      KEYCLOAK_ADMIN_USER="${2:-}"
      shift 2
      ;;
    --keycloak-admin-password)
      KEYCLOAK_ADMIN_PASSWORD="${2:-}"
      shift 2
      ;;
    --lxc-password)
      LXC_PASSWORD="${2:-}"
      shift 2
      ;;
    -h | --help)
      usage
      exit 0
      ;;
    *)
      die "Option inconnue: $1"
      ;;
  esac
done

if [[ "$LOCAL_MODE" != "1" && -z "$PROXMOX_HOST" ]]; then
  if command -v pct >/dev/null 2>&1 && command -v pveam >/dev/null 2>&1; then
    LOCAL_MODE="1"
  fi
fi

payload_script="$(mktemp)"
cleanup() {
  rm -f "$payload_script"
}
trap cleanup EXIT

cat >"$payload_script" <<'REMOTE'
set -Eeuo pipefail

trap 'printf "Erreur: echec de la commande [%s] a la ligne %s.\n" "$BASH_COMMAND" "$LINENO" >&2' ERR

ctid="$1"
lxc_hostname="$2"
lxc_ip="$3"
lxc_gateway="$4"
lxc_bridge="$5"
lxc_cores="$6"
lxc_memory="$7"
lxc_swap="$8"
lxc_disk_gb="$9"
shift 9
template_storage="$1"
rootfs_storage="$2"
repo_url="$3"
repo_branch="$4"
ethan_repo_url="$5"
ethan_repo_branch="$6"
brice_repo_url="$7"
brice_repo_branch="$8"
lxc_password="$9"
public_base_url="${10}"
web_port="${11}"
keycloak_admin_user="${12}"
keycloak_admin_password="${13}"

die() {
  printf 'Erreur: %s\n' "$*" >&2
  exit 1
}

need_remote_cmd() {
  command -v "$1" >/dev/null 2>&1 || die "La commande '$1' est absente sur Proxmox."
}

pick_storage() {
  local candidate=""

  for candidate in "$@"; do
    if pvesm status 2>/dev/null | awk 'NR > 1 { print $1 }' | grep -Fxq "$candidate"; then
      printf '%s\n' "$candidate"
      return 0
    fi
  done

  return 1
}

pick_first_dir_storage() {
  pvesm status 2>/dev/null | awk 'NR > 1 && $2 == "dir" { print $1; exit }'
}

find_ctid_by_hostname() {
  local wanted="$1"
  local candidate=""
  local candidate_hostname=""

  while read -r candidate; do
    [[ -n "$candidate" ]] || continue
    candidate_hostname="$(pct config "$candidate" 2>/dev/null | awk -F ': ' '/^hostname:/ { print $2; exit }')"
    if [[ "$candidate_hostname" == "$wanted" ]]; then
      printf '%s\n' "$candidate"
      return 0
    fi
  done < <(pct list | awk 'NR > 1 { print $1 }')

  return 1
}

ct_exec() {
  pct exec "$ctid" -- bash -lc "$1"
}

need_remote_cmd pct
need_remote_cmd pveam
need_remote_cmd pvesm

if [[ -z "$ctid" ]]; then
  command -v pvesh >/dev/null 2>&1 || die "Impossible de calculer le prochain CTID sans pvesh."
  ctid="$(pvesh get /cluster/nextid)"
fi

if pct status "$ctid" >/dev/null 2>&1; then
  die "Le CTID $ctid existe deja."
fi

if existing_ctid="$(find_ctid_by_hostname "$lxc_hostname")"; then
  die "Un conteneur nomme $lxc_hostname existe deja sous le CTID $existing_ctid."
fi

if [[ -z "$template_storage" ]]; then
  template_storage="$(pick_storage local)"
  if [[ -z "$template_storage" ]]; then
    template_storage="$(pick_first_dir_storage)"
  fi
fi

[[ -n "$template_storage" ]] || die "Aucun stockage de template detecte. Passe --template-storage."

if [[ -z "$rootfs_storage" ]]; then
  rootfs_storage="$(pick_storage local-lvm local-zfs local)"
fi

[[ -n "$rootfs_storage" ]] || die "Aucun stockage rootfs detecte. Passe --rootfs-storage."

printf 'Mise a jour du catalogue de templates Proxmox...\n'
pveam update >/dev/null

template_name="$(pveam available --section system | awk '/debian-12-standard/ { print $2 }' | sort -V | tail -n 1)"
if [[ -z "$template_name" ]]; then
  template_name="debian-12-standard_12.7-1_amd64.tar.zst"
fi

if ! pveam list "$template_storage" 2>/dev/null | grep -Fq "$template_name"; then
  printf 'Telechargement du template %s sur %s...\n' "$template_name" "$template_storage"
  pveam download "$template_storage" "$template_name" >/dev/null
fi

template_ref="${template_storage}:vztmpl/${template_name}"

if [[ -z "$lxc_password" ]]; then
  lxc_password="$(od -An -N12 -tx1 /dev/urandom | tr -d ' \n')"
fi

net0="name=eth0,bridge=${lxc_bridge},ip=dhcp"
if [[ "$lxc_ip" != "dhcp" ]]; then
  net0="name=eth0,bridge=${lxc_bridge},ip=${lxc_ip}"
  if [[ -n "$lxc_gateway" ]]; then
    net0="${net0},gw=${lxc_gateway}"
  fi
fi

printf 'Creation du LXC %s (%s)...\n' "$ctid" "$lxc_hostname"
pct create "$ctid" "$template_ref" \
  --hostname "$lxc_hostname" \
  --cores "$lxc_cores" \
  --memory "$lxc_memory" \
  --swap "$lxc_swap" \
  --rootfs "${rootfs_storage}:${lxc_disk_gb}" \
  --net0 "$net0" \
  --onboot 1 \
  --ostype debian \
  --password "$lxc_password" \
  --unprivileged 1 \
  --features nesting=1,keyctl=1

pct start "$ctid"

printf 'Attente du demarrage du LXC...\n'
for _ in $(seq 1 20); do
  if pct exec "$ctid" -- true >/dev/null 2>&1; then
    break
  fi
  sleep 2
done

pct exec "$ctid" -- true >/dev/null 2>&1 || die "Le LXC n'est pas joignable apres le demarrage."

ct_exec "install -d -m 0755 /opt/chesscubing/repo /opt/chesscubing/ethan-repo /opt/chesscubing/brice-repo /opt/chesscubing/deploy /opt/chesscubing/config"

ct_exec "cat > /usr/local/bin/update-chesscubing <<'SCRIPT'
#!/usr/bin/env bash
set -Eeuo pipefail

trap 'printf \"Erreur: echec de la commande [%s] a la ligne %s.\\n\" \"\$BASH_COMMAND\" \"\$LINENO\" >&2' ERR

main_repo_dir='/opt/chesscubing/repo'
ethan_repo_dir='/opt/chesscubing/ethan-repo'
brice_repo_dir='/opt/chesscubing/brice-repo'
deploy_dir='/opt/chesscubing/deploy'
config_dir='/opt/chesscubing/config'
env_file=\"\$config_dir/chesscubing.env\"
main_branch=\"\${1:-${repo_branch}}\"
public_base_url_override=\"\${2:-}\"
web_port_override=\"\${3:-}\"
keycloak_admin_user_override=\"\${4:-}\"
keycloak_admin_password_override=\"\${5:-}\"
main_repo_url='${repo_url}'
ethan_repo_url='${ethan_repo_url}'
ethan_branch='${ethan_repo_branch}'
brice_repo_url='${brice_repo_url}'
brice_branch='${brice_repo_branch}'

random_secret() {
  od -An -N24 -tx1 /dev/urandom | tr -d ' \n'
}

ensure_base_packages() {
  apt-get update
  apt-get install -y ca-certificates curl gpg git rsync
}

ensure_docker_stack() {
  ensure_base_packages

  if ! command -v docker >/dev/null 2>&1 || ! docker compose version >/dev/null 2>&1; then
    install -m 0755 -d /etc/apt/keyrings

    if [[ ! -f /etc/apt/keyrings/docker.asc ]]; then
      curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
      chmod a+r /etc/apt/keyrings/docker.asc
    fi

    if [[ ! -f /etc/apt/sources.list.d/docker.list ]]; then
      printf 'deb [arch=%s signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian %s stable\n' \
        \"\$(dpkg --print-architecture)\" \
        \"\$(. /etc/os-release && printf '%s' \"\$VERSION_CODENAME\")\" > /etc/apt/sources.list.d/docker.list
    fi

    apt-get update
    apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
  fi

  systemctl enable docker >/dev/null 2>&1 || true
  if ! systemctl is-active --quiet docker; then
    systemctl start docker
  fi
}

sync_git_repo() {
  local repo_dir=\"\$1\"
  local repo_url=\"\$2\"
  local branch=\"\$3\"
  local label=\"\$4\"

  if [[ -d \"\$repo_dir/.git\" ]]; then
    cd \"\$repo_dir\"

    if ! git diff --quiet || ! git diff --cached --quiet; then
      echo \"Le depot \${label} contient des modifications locales. Mise a jour annulee.\" >&2
      exit 1
    fi

    git fetch origin \"\$branch\"
    if git show-ref --verify --quiet \"refs/heads/\$branch\"; then
      git checkout \"\$branch\"
    else
      git checkout -b \"\$branch\" --track \"origin/\$branch\"
    fi
    git pull --ff-only origin \"\$branch\"
    return 0
  fi

  [[ -n \"\$repo_url\" ]] || {
    echo \"Le depot \${label} est absent et aucune URL n'a ete fournie.\" >&2
    exit 1
  }

  rm -rf \"\$repo_dir\"
  git clone --branch \"\$branch\" --single-branch \"\$repo_url\" \"\$repo_dir\"
}

get_env_var() {
  local key=\"\$1\"

  [[ -f \"\$env_file\" ]] || return 0
  awk -F= -v wanted=\"\$key\" '\$1 == wanted { print substr(\$0, length(wanted) + 2); exit }' \"\$env_file\"
}

set_env_var() {
  local key=\"\$1\"
  local value=\"\$2\"

  touch \"\$env_file\"
  if grep -q \"^\${key}=\" \"\$env_file\" 2>/dev/null; then
    sed -i \"s|^\${key}=.*|\${key}=\${value}|\" \"\$env_file\"
  else
    printf '%s=%s\n' \"\$key\" \"\$value\" >> \"\$env_file\"
  fi
}

ensure_env_default() {
  local key=\"\$1\"
  local fallback=\"\$2\"
  local value

  value=\"\$(get_env_var \"\$key\")\"
  if [[ -z \"\$value\" ]]; then
    value=\"\$fallback\"
  fi

  set_env_var \"\$key\" \"\$value\"
}

normalize_public_base_url() {
  local value=\"\$1\"
  printf '%s\n' \"\${value%/}\"
}

build_default_public_base_url() {
  local port=\"\$1\"
  local detected_ip

  detected_ip=\"\$(hostname -I | awk '{print \$1}')\"
  [[ -n \"\$detected_ip\" ]] || return 1

  if [[ \"\$port\" == \"80\" ]]; then
    printf 'http://%s\n' \"\$detected_ip\"
  else
    printf 'http://%s:%s\n' \"\$detected_ip\" \"\$port\"
  fi
}

configure_env_file() {
  local current_value
  local effective_web_port
  local effective_public_base_url
  local effective_keycloak_admin_user
  local effective_keycloak_admin_password

  effective_web_port=\"\$web_port_override\"
  if [[ -z \"\$effective_web_port\" ]]; then
    effective_web_port=\"\$(get_env_var WEB_PORT)\"
  fi
  if [[ -z \"\$effective_web_port\" ]]; then
    effective_web_port='80'
  fi
  set_env_var WEB_PORT \"\$effective_web_port\"

  effective_public_base_url=\"\$public_base_url_override\"
  if [[ -z \"\$effective_public_base_url\" ]]; then
    effective_public_base_url=\"\$(get_env_var PUBLIC_BASE_URL)\"
  fi
  if [[ -z \"\$effective_public_base_url\" ]]; then
    effective_public_base_url=\"\$(build_default_public_base_url \"\$effective_web_port\" || true)\"
  fi
  if [[ -z \"\$effective_public_base_url\" ]]; then
    if [[ \"\$effective_web_port\" == \"80\" ]]; then
      effective_public_base_url='http://localhost'
    else
      effective_public_base_url=\"http://localhost:\$effective_web_port\"
    fi
  fi
  set_env_var PUBLIC_BASE_URL \"\$(normalize_public_base_url \"\$effective_public_base_url\")\"

  effective_keycloak_admin_user=\"\$keycloak_admin_user_override\"
  if [[ -z \"\$effective_keycloak_admin_user\" ]]; then
    effective_keycloak_admin_user=\"\$(get_env_var KEYCLOAK_ADMIN_USER)\"
  fi
  if [[ -z \"\$effective_keycloak_admin_user\" ]]; then
    effective_keycloak_admin_user='admin'
  fi
  set_env_var KEYCLOAK_ADMIN_USER \"\$effective_keycloak_admin_user\"

  effective_keycloak_admin_password=\"\$keycloak_admin_password_override\"
  if [[ -z \"\$effective_keycloak_admin_password\" ]]; then
    effective_keycloak_admin_password=\"\$(get_env_var KEYCLOAK_ADMIN_PASSWORD)\"
  fi
  if [[ -z \"\$effective_keycloak_admin_password\" ]]; then
    effective_keycloak_admin_password=\"\$(random_secret)\"
  fi
  set_env_var KEYCLOAK_ADMIN_PASSWORD \"\$effective_keycloak_admin_password\"

  ensure_env_default KEYCLOAK_DB_NAME keycloak
  ensure_env_default KEYCLOAK_DB_USER keycloak
  current_value=\"\$(get_env_var KEYCLOAK_DB_PASSWORD)\"
  if [[ -z \"\$current_value\" ]]; then
    current_value=\"\$(random_secret)\"
  fi
  set_env_var KEYCLOAK_DB_PASSWORD \"\$current_value\"

  ensure_env_default SITE_DB_NAME chesscubing_site
  ensure_env_default SITE_DB_USER chesscubing
  current_value=\"\$(get_env_var SITE_DB_PASSWORD)\"
  if [[ -z \"\$current_value\" ]]; then
    current_value=\"\$(random_secret)\"
  fi
  set_env_var SITE_DB_PASSWORD \"\$current_value\"

  current_value=\"\$(get_env_var SITE_DB_ROOT_PASSWORD)\"
  if [[ -z \"\$current_value\" ]]; then
    current_value=\"\$(random_secret)\"
  fi
  set_env_var SITE_DB_ROOT_PASSWORD \"\$current_value\"
}

sync_deploy_tree() {
  install -d -m 0755 \"\$deploy_dir\" \"\$config_dir\"

  rsync -a --delete \
    --exclude='.git/' \
    --exclude='bin/' \
    --exclude='obj/' \
    --exclude='.env' \
    --exclude='node_modules/' \
    \"\$main_repo_dir/\" \"\$deploy_dir/\"

  if [[ -d \"\$ethan_repo_dir/.git\" ]]; then
    rm -rf \"\$deploy_dir/ethan\"
    rsync -a --delete \
      --exclude='.git/' \
      --exclude='node_modules/' \
      \"\$ethan_repo_dir/\" \"\$deploy_dir/ethan/\"
  fi

  if [[ -d \"\$brice_repo_dir/.git\" ]]; then
    rm -rf \"\$deploy_dir/brice\"
    rsync -a --delete \
      --exclude='.git/' \
      --exclude='node_modules/' \
      \"\$brice_repo_dir/\" \"\$deploy_dir/brice/\"
  fi
}

disable_legacy_nginx() {
  systemctl disable --now nginx >/dev/null 2>&1 || true
}

prepare_disk_space() {
  cd \"\$deploy_dir\"
  docker builder prune -af || true
  docker image prune -f || true
  apt-get clean || true
  rm -rf /var/lib/apt/lists/* || true
}

ensure_free_space_mb() {
  local required_mb=\"\$1\"
  local available_mb

  available_mb=\"\$(df -Pm / | awk 'NR == 2 { print \$4 }')\"
  if [[ -z \"\$available_mb\" ]]; then
    echo \"Impossible de mesurer l'espace disque libre dans le LXC.\" >&2
    exit 1
  fi

  if (( available_mb < required_mb )); then
    echo \"Espace disque insuffisant dans le LXC: \${available_mb} Mo libres, \${required_mb} Mo recommandes avant la reconstruction Docker.\" >&2
    echo \"Agrandis le disque du LXC puis relance la mise a jour.\" >&2
    exit 1
  fi
}

deploy_stack() {
  cp \"\$env_file\" \"\$deploy_dir/.env\"

  prepare_disk_space
  ensure_free_space_mb 6144

  cd \"\$deploy_dir\"
  docker compose up -d --build
  docker compose ps
}

ensure_docker_stack
sync_git_repo \"\$main_repo_dir\" \"\$main_repo_url\" \"\$main_branch\" 'principal'
sync_git_repo \"\$ethan_repo_dir\" \"\$ethan_repo_url\" \"\$ethan_branch\" 'Ethan'
sync_git_repo \"\$brice_repo_dir\" \"\$brice_repo_url\" \"\$brice_branch\" 'Brice'
sync_deploy_tree
configure_env_file
disable_legacy_nginx
deploy_stack
SCRIPT
chmod +x /usr/local/bin/update-chesscubing"

printf 'Deploiement de la stack Docker complete dans le LXC...\n'
ct_exec "/usr/local/bin/update-chesscubing '$repo_branch' '$public_base_url' '$web_port' '$keycloak_admin_user' '$keycloak_admin_password'"

container_ip="$(pct exec "$ctid" -- bash -lc "hostname -I | awk '{print \$1}'" 2>/dev/null | tr -d '\r' || true)"
public_url="$(pct exec "$ctid" -- bash -lc "awk -F= '/^PUBLIC_BASE_URL=/{print substr(\$0, 17); exit}' /opt/chesscubing/config/chesscubing.env" 2>/dev/null | tr -d '\r' || true)"
effective_keycloak_admin_user="$(pct exec "$ctid" -- bash -lc "awk -F= '/^KEYCLOAK_ADMIN_USER=/{print substr(\$0, 21); exit}' /opt/chesscubing/config/chesscubing.env" 2>/dev/null | tr -d '\r' || true)"
effective_keycloak_admin_password="$(pct exec "$ctid" -- bash -lc "awk -F= '/^KEYCLOAK_ADMIN_PASSWORD=/{print substr(\$0, 25); exit}' /opt/chesscubing/config/chesscubing.env" 2>/dev/null | tr -d '\r' || true)"

cat <<EOF

Installation terminee.
- CTID: $ctid
- Nom du LXC: $lxc_hostname
- Mot de passe root du LXC: $lxc_password
- IP detectee du LXC: ${container_ip:-<ip_du_lxc>}
- URL publique configuree: ${public_url:-http://${container_ip:-<ip_du_lxc>}}
- Admin Keycloak: ${effective_keycloak_admin_user:-admin}
- Mot de passe admin Keycloak: ${effective_keycloak_admin_password:-<voir /opt/chesscubing/config/chesscubing.env>}

Pour mettre a jour l'application plus tard:
  ./scripts/update-proxmox-lxc.sh --proxmox-host <ip-proxmox> --proxmox-user <user> --proxmox-password '<motdepasse>' --ctid $ctid
EOF
REMOTE

if [[ "$LOCAL_MODE" == "1" ]]; then
  printf 'Creation du LXC "%s" en local sur cet hote Proxmox...\n' "$LXC_HOSTNAME"
  bash "$payload_script" \
    "$CTID" \
    "$LXC_HOSTNAME" \
    "$LXC_IP" \
    "$LXC_GATEWAY" \
    "$LXC_BRIDGE" \
    "$LXC_CORES" \
    "$LXC_MEMORY" \
    "$LXC_SWAP" \
    "$LXC_DISK_GB" \
    "$TEMPLATE_STORAGE" \
    "$ROOTFS_STORAGE" \
    "$REPO_URL" \
    "$REPO_BRANCH" \
    "$ETHAN_REPO_URL" \
    "$ETHAN_REPO_BRANCH" \
    "$BRICE_REPO_URL" \
    "$BRICE_REPO_BRANCH" \
    "$LXC_PASSWORD" \
    "$PUBLIC_BASE_URL" \
    "$WEB_PORT" \
    "$KEYCLOAK_ADMIN_USER" \
    "$KEYCLOAK_ADMIN_PASSWORD"
  exit 0
fi

[[ -n "$PROXMOX_HOST" ]] || die "Merci de fournir --proxmox-host."
[[ -n "$PROXMOX_USER" ]] || die "Merci de fournir --proxmox-user."

if [[ -z "$PROXMOX_PASSWORD" ]]; then
  read -rsp "Mot de passe SSH pour ${PROXMOX_USER}@${PROXMOX_HOST}: " PROXMOX_PASSWORD
  echo
fi

need_cmd ssh
need_cmd sshpass

printf 'Creation du LXC "%s" sur %s...\n' "$LXC_HOSTNAME" "$PROXMOX_HOST"

sshpass -p "$PROXMOX_PASSWORD" \
  ssh \
  -p "$PROXMOX_PORT" \
  -o StrictHostKeyChecking=accept-new \
  -o PreferredAuthentications=password \
  -o PubkeyAuthentication=no \
  "$PROXMOX_USER@$PROXMOX_HOST" \
  bash -s -- \
  "$CTID" \
  "$LXC_HOSTNAME" \
  "$LXC_IP" \
  "$LXC_GATEWAY" \
  "$LXC_BRIDGE" \
  "$LXC_CORES" \
  "$LXC_MEMORY" \
  "$LXC_SWAP" \
  "$LXC_DISK_GB" \
  "$TEMPLATE_STORAGE" \
  "$ROOTFS_STORAGE" \
  "$REPO_URL" \
  "$REPO_BRANCH" \
  "$ETHAN_REPO_URL" \
  "$ETHAN_REPO_BRANCH" \
  "$BRICE_REPO_URL" \
  "$BRICE_REPO_BRANCH" \
  "$LXC_PASSWORD" \
  "$PUBLIC_BASE_URL" \
  "$WEB_PORT" \
  "$KEYCLOAK_ADMIN_USER" \
  "$KEYCLOAK_ADMIN_PASSWORD" < "$payload_script"