Campaign Quartermaster v1.2.2

Campaign Quartermaster v1.2.2

Campaign Quartermaster v1.2.2 corrects the primary Proxmox VE bootstrap so an
eligible interactive host receives the guided blue whiptail wizard advertised
in v1.2.1.

Corrected Proxmox one-command install

Run this from the Proxmox VE host shell as root:

bash -c 'set -Eeuo pipefail; umask 077; tmp="$(mktemp -d)"; cleanup() { rm -rf -- "$tmp"; }; trap cleanup EXIT; base="https://github.com/Mptower/campaign-quartermaster/releases/download/v1.2.2"; for file in proxmox-install.sh proxmox-install.sh.sha256 proxmox-common.sh proxmox-common.sh.sha256; do curl --fail --show-error --silent --location --proto "=https" --proto-redir "=https" --tlsv1.2 --output "$tmp/$file" "$base/$file"; done; (cd "$tmp"; sha256sum --check --strict proxmox-install.sh.sha256 proxmox-common.sh.sha256); CQ_LIB_PATH="$tmp/proxmox-common.sh" bash "$tmp/proxmox-install.sh"'

The command downloads immutable v1.2.2 installer and helper assets plus both
SHA-256 sidecars into a private temporary directory. It verifies both scripts
with strict checksum checking before executing the installer, pins the verified
helper through CQ_LIB_PATH, and removes the temporary directory on success or
failure. curl writes payloads only to files and reports failures on stderr, so
download output cannot interfere with the wizard.

Unlike the legacy curl | bash path, the verified installer runs from a file and
inherits the invoking terminal's stdin/stdout. When whiptail, TERM, and the
TTY checks are suitable, the blue wizard remains eligible. Piped, explicit
environment, and CQ_NONINTERACTIVE=1 paths remain supported through their
existing validated plain-text or automation flows.

Validation scope

The exact command is syntax-checked and exercised with modeled release downloads,
real SHA-256 verification, TTY-preservation checks, checksum-failure blocking,
temporary-directory cleanup, and secret-leak assertions. Physical Proxmox
hardware validation was waived for this corrective release.

Upgrade

Back up state before upgrading. Docker users rerun the v1.2.2 installer.
Proxmox users run the v1.2.2 updater from the PVE host with CQ_CTID set to
their managed container.

Campaign Quartermaster 1.2.1

Campaign Quartermaster 1.2.1

Version 1.2.1 makes reverse-proxy origin configuration part of both supported
quick-install paths without relaxing the application's security boundary.

Reverse-proxy first boot

• Docker and Proxmox quick installs ask one optional question for the exact
  public HTTPS URL.
• A blank answer preserves the Docker localhost or Proxmox guest-IP default.
• HTTPS origins are canonicalized before writing APP_ORIGIN; malformed URLs,
  HTTP, credentials, paths, queries, fragments, and invalid ports are rejected.
• Explicit APP_ORIGIN/CQ_APP_ORIGIN automation remains authoritative and is
  not overwritten or reprompted.
• Health checks send the configured Host, including an explicit non-default
  public port.

Completion output prints the browser URL and concise Nginx Proxy Manager
settings for each topology. It also warns that direct localhost, host-IP, or
guest-IP browser access is rejected by design when a public origin is selected.
Exact Host, Origin, same-site, content-type, and CSRF protections are unchanged.

Guided Proxmox installer

Interactive Proxmox installs use the host's existing whiptail to provide a
blue terminal wizard with a security summary, Quick/Advanced selection, proxy
URL, Advanced settings, final review, progress, and success information.
Missing whiptail, unsuitable/non-TTY terminals, explicit environment options,
and noninteractive automation retain the validated plain-text path. The
installer never installs host packages for the UI.

Cancel or Esc before provisioning exits without changes. Once provisioning
starts, the existing cleanup semantics remain authoritative. The one-time
Commander setup secret is never passed to whiptail; the final summary is
nonblocking so it is immediately followed by exactly one plain-terminal display.

Existing deployments

The Docker and Proxmox guides now include supported procedures to back up the
managed environment, replace only APP_ORIGIN, restart, verify /healthz with
the exact Host, and restore the backup if health fails.

Back up state before upgrading. Docker users rerun the v1.2.1 installer.
Proxmox users run the v1.2.1 updater from the PVE host with CQ_CTID set to
the managed container. Setup state and role credentials are preserved.

Campaign Quartermaster 1.2.0

Campaign Quartermaster 1.2.0

Version 1.2.0 makes the supported Docker Compose and Proxmox VE paths faster to
install, standardizes reverse-proxy-friendly port 8484 access, and fixes
systemd startup in a standard unprivileged Proxmox LXC.

Installer experience

• Quick mode applies conservative supported defaults with minimal questions.
• Advanced mode exposes validated origin, network, port, and resource controls.
• Docker quick installs bind 127.0.0.1:8484 with one CPU and 1 GiB RAM.
• Proxmox quick installs expose guest HTTPS at <guest-ip>:8484 with one core,
  1 GiB RAM, 1 GiB swap, and 8 GiB disk.
• Existing noninteractive automation infers advanced mode when overrides are
  supplied, so values are never silently discarded.

Proxmox compatibility and recovery

The generated systemd unit no longer requests mount, device, or proc namespace
sandboxes that Proxmox blocks inside an unprivileged LXC with nesting disabled.
It retains the non-root service account, empty capability sets,
NoNewPrivileges, restricted namespace creation/address families/realtime,
locked personality, native syscall architecture, and a restrictive umask.

The updater migrates existing installer-managed units, backs up the prior unit,
application tree, and database, and restores them if health fails. Verified
database backups are promoted into root-owned storage before code changes.
Failure output now includes service status and the last 80 journal entries.

The fixed installer was validated successfully on a real Proxmox VE host using
an unprivileged Debian 12 LXC before release. The guest completed provisioning,
started the service without 226/NAMESPACE, passed health checks, and produced
the expected URL, certificate fingerprint, and exactly-once setup secret.

Upgrade notes

Back up the deployment first. Docker users rerun the v1.2.0 installer.
Proxmox users run the v1.2.0 updater from the PVE host with CQ_CTID set to
the managed container. Setup state and role credentials are preserved.

See Docker installation,
Proxmox installation, and
Administration.

Campaign Quartermaster 1.1.0

Campaign Quartermaster 1.1.0

Version 1.1.0 adds release-quality one-command deployment for Docker Compose
and Proxmox VE LXC while preserving the application's existing authentication,
origin, and state boundaries.

Deployment additions

• Multi-stage, non-root production image based on the supported Node.js
  22.17.1 Debian image, with native module build support and a read-only runtime
  root filesystem
• Hardened Compose definition with loopback exposure by default, named /data
  persistence, health checks, capability removal, resource bounds, and
  no-new-privileges
• Versioned, checksummed Docker installer that creates and displays a setup
  secret exactly once
• Community-script-style Proxmox VE helper that creates an unprivileged Debian
  12 LXC and installs Node/systemd natively without Docker
• Transactional Proxmox update path with a verified database backup, atomic
  code swap, health check, and code rollback
• Tagged-release workflow for amd64/arm64 GHCR images, BuildKit provenance,
  SPDX SBOM attestations, keyless image signing, and checksummed installer
  assets
• Stable Pages paths and SHA-256 files for all public deployment scripts

Application changes

• Added unauthenticated GET /healthz, returning only {"status":"ok"} and
  creating no browser session.
• Added setup-secret --ensure --machine for installer use. It returns a new
  secret only when one was just created and otherwise reports pending or
  complete without replacing or revealing existing setup state.
• Network origins continue to require HTTPS. Private-IP HTTP is available only
  behind an explicit emergency/manual opt-in that official installers never
  set. Proxmox guests receive a unique self-signed TLS endpoint and print its
  SHA-256 fingerprint from the PVE console.
• Secure cookies now follow the configured HTTPS origin, allowing the documented
  loopback HTTP Compose default to complete setup.

Upgrade notes

Back up state before upgrading. Docker users rerun the installer for the target
release; the named volume is retained. Proxmox users run
scripts/proxmox-update.sh on the PVE host with the container ID and target
version. Neither path regenerates setup state or replaces role credentials.

See Docker installation,
Proxmox installation, and
Administration.

No container image, GitHub release, tag, or Proxmox guest is created merely by
merging the source. Publication occurs only when a maintainer explicitly
publishes a versioned GitHub Release.