From 400d349d6ac675a16ed73666fe3d5122e3b6d111 Mon Sep 17 00:00:00 2001
From: Florian Schmidt <schmidt.florian90@gmail.com>
Date: Fri, 17 Jul 2026 12:36:29 +0200
Subject: [PATCH] Deploy: guard installer against host execution +
 self-contained update command

Safety fix after a host-vs-container mishap: add a systemd-detect-virt guard at the top of the install script (before install.func is sourced) that refuses to run outside a container, so a mistaken invocation on the Proxmox host exits harmlessly instead of running 'apt upgrade' + installing PostgreSQL/.NET on the hypervisor (override METERVAULT_ALLOW_HOST=1). Also rewrite /usr/bin/update to a self-contained in-container rebuild (git pull + dotnet publish + restart) instead of re-running the ct script through the framework.

Claude-Session: https://claude.ai/code/session_01Kib2MniVFbD95fkgLgBBnB
---
 deploy/install/metervault-install.sh | 32 +++++++++++++++++++++++++---
 1 file changed, 29 insertions(+), 3 deletions(-)

diff --git a/deploy/install/metervault-install.sh b/deploy/install/metervault-install.sh
index f311a22..0e3f2c3 100755
--- a/deploy/install/metervault-install.sh
+++ b/deploy/install/metervault-install.sh
@@ -26,6 +26,18 @@
 : "${DB_NAME:=metervault}"
 : "${DB_USER:=metervault}"
 
+# SAFETY GUARD — this must run INSIDE the MeterVault LXC, never on the Proxmox host.
+# The community-scripts install.func setup below runs `apt upgrade` and installs PostgreSQL/.NET at
+# the top level; on a hypervisor that is destructive. Refuse unless we're in a container. This runs
+# BEFORE install.func is sourced, so a mistaken host invocation exits without touching anything.
+# Override for unusual setups with METERVAULT_ALLOW_HOST=1.
+if ! systemd-detect-virt --container --quiet 2>/dev/null && [[ "${METERVAULT_ALLOW_HOST:-}" != "1" ]]; then
+  echo "ERROR: Run this installer INSIDE the MeterVault LXC, not on the Proxmox host." >&2
+  echo "       It installs PostgreSQL/.NET and runs 'apt upgrade' — destructive on a hypervisor." >&2
+  echo "       Enter the container first (e.g. 'pct enter <ctid>') then re-run. Override: METERVAULT_ALLOW_HOST=1." >&2
+  exit 1
+fi
+
 INSTALL_FUNC_URL="${INSTALL_FUNC_URL:-https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/install.func}"
 FUNCTIONS_FILE_PATH="${FUNCTIONS_FILE_PATH:-$(curl -fsSL "$INSTALL_FUNC_URL")}"
 
@@ -212,11 +224,25 @@ WantedBy=multi-user.target
 EOF
 }
 
+# A self-contained in-container updater: pull the latest source and rebuild, no host round-trip and
+# no re-fetch of the community-scripts framework (safer + simpler than re-running the ct script).
 write_update_command() {
-  local url="${METERVAULT_CT_URL:-https://git.finalfactory.de/FinalFactory/MeterVault/raw/branch/master/deploy/ct/metervault.sh}"
-  cat <<EOF >/usr/bin/update
+  cat <<'EOF' >/usr/bin/update
 #!/usr/bin/env bash
-exec bash -c "\$(curl -fsSL '${url}')"
+set -euo pipefail
+if ! systemd-detect-virt --container --quiet 2>/dev/null; then
+  echo "Run 'update' inside the MeterVault LXC, not on the Proxmox host." >&2
+  exit 1
+fi
+export DOTNET_CLI_TELEMETRY_OPTOUT=1 DOTNET_NOLOGO=1
+echo "Stopping metervault…"; systemctl stop metervault || true
+echo "Pulling latest source…"
+git -C /opt/metervault-src fetch --depth 1 origin master
+git -C /opt/metervault-src reset --hard origin/master
+echo "Rebuilding (dotnet publish)…"
+dotnet publish /opt/metervault-src/src/App/MeterVault.App.csproj -c Release -o /opt/metervault /p:UseAppHost=false
+echo "Starting metervault…"; systemctl start metervault
+echo "MeterVault updated."
 EOF
   chmod +x /usr/bin/update
 }