portacode 1.4.15.dev3__py3-none-any.whl → 1.4.15.dev15__py3-none-any.whl

portacode/connection/handlers/proxmox_infra.py

@@ -5,11 +5,10 @@ from __future__ import annotations
 import asyncio
 import json
 import logging
+import math
 import os
 import secrets
 import shlex
-import re
-import select
 import shutil
 import stat
 import subprocess
@@ -17,8 +16,7 @@ import sys
 import tempfile
 import time
 import threading
-import urllib.request
-from datetime import datetime
+from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any, Callable, Dict, Iterable, List, Optional, Sequence, Tuple
 
@@ -43,15 +41,13 @@ BRIDGE_IP = SUBNET_CIDR.split("/", 1)[0]
 DHCP_START = "10.10.0.100"
 DHCP_END = "10.10.0.200"
 DNS_SERVER = "1.1.1.1"
-CLOUDFLARE_DEB_URL = "https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb"
 IFACES_PATH = Path("/etc/network/interfaces")
 SYSCTL_PATH = Path("/etc/sysctl.d/99-portacode-forward.conf")
 UNIT_DIR = Path("/etc/systemd/system")
 _MANAGED_CONTAINERS_CACHE_TTL_S = 30.0
 _MANAGED_CONTAINERS_CACHE: Dict[str, Any] = {"timestamp": 0.0, "summary": None}
 _MANAGED_CONTAINERS_CACHE_LOCK = threading.Lock()
-_CLOUDFLARE_TUNNEL_PROCESSES: Dict[str, subprocess.Popen] = {}
-_CLOUDFLARE_TUNNELS_LOCK = threading.Lock()
+TEMPLATES_REFRESH_INTERVAL_S = 300
 
 ProgressCallback = Callable[[int, int, Dict[str, Any], str, Optional[Dict[str, Any]]], None]
 
@@ -68,6 +64,7 @@ def _emit_progress_event(
     phase: str,
     request_id: Optional[str],
     details: Optional[Dict[str, Any]] = None,
+    on_behalf_of_device: Optional[str] = None,
 ) -> None:
     loop = handler.context.get("event_loop")
     if not loop or loop.is_closed():
@@ -92,6 +89,8 @@ def _emit_progress_event(
         payload["request_id"] = request_id
     if details:
         payload["details"] = details
+    if on_behalf_of_device:
+        payload["on_behalf_of_device"] = str(on_behalf_of_device)
 
     future = asyncio.run_coroutine_threadsafe(handler.send_response(payload), loop)
     future.add_done_callback(
@@ -181,6 +180,64 @@ def _list_templates(client: Any, node: str, storages: Iterable[Dict[str, Any]])
     return templates
 
 
+def _build_proxmox_client_from_config(config: Dict[str, Any]):
+    user = config.get("user")
+    token_name = config.get("token_name")
+    token_value = config.get("token_value")
+    if not user or not token_name or not token_value:
+        raise RuntimeError("Proxmox API credentials are missing")
+    ProxmoxAPI = _ensure_proxmoxer()
+    return ProxmoxAPI(
+        config.get("host", DEFAULT_HOST),
+        user=user,
+        token_name=token_name,
+        token_value=token_value,
+        verify_ssl=config.get("verify_ssl", False),
+        timeout=30,
+    )
+
+
+def _current_time_iso() -> str:
+    return datetime.now(timezone.utc).isoformat()
+
+
+def _parse_iso_timestamp(value: str) -> Optional[datetime]:
+    if not value:
+        return None
+    text = value
+    if text.endswith("Z"):
+        text = text[:-1] + "+00:00"
+    try:
+        return datetime.fromisoformat(text)
+    except ValueError:
+        return None
+
+
+def _templates_need_refresh(config: Dict[str, Any]) -> bool:
+    if not config or not config.get("token_value"):
+        return False
+    last = _parse_iso_timestamp(config.get("templates_last_refreshed") or "")
+    if not last:
+        return True
+    return (datetime.now(timezone.utc) - last).total_seconds() >= TEMPLATES_REFRESH_INTERVAL_S
+
+
+def _ensure_templates_refreshed_on_startup(config: Dict[str, Any]) -> None:
+    if not _templates_need_refresh(config):
+        return
+    try:
+        client = _build_proxmox_client_from_config(config)
+        node = config.get("node") or _pick_node(client)
+        storages = client.nodes(node).storage.get()
+        templates = _list_templates(client, node, storages)
+        if templates:
+            config["templates"] = templates
+            config["templates_last_refreshed"] = _current_time_iso()
+            _save_config(config)
+    except Exception as exc:
+        logger.warning("Unable to refresh Proxmox templates on startup: %s", exc)
+
+
 def _pick_storage(storages: Iterable[Dict[str, Any]]) -> str:
     candidates = [s for s in storages if "rootdir" in s.get("content", "") and s.get("avail", 0) > 0]
     if not candidates:
@@ -285,25 +342,6 @@ def _ensure_bridge(bridge: str = DEFAULT_BRIDGE) -> Dict[str, Any]:
     return {"applied": True, "bridge": bridge, "message": f"Bridge {bridge} configured"}
 
 
-def _ensure_cloudflared_installed() -> None:
-    if shutil.which("cloudflared"):
-        return
-    apt = shutil.which("apt-get")
-    if not apt:
-        raise RuntimeError("cloudflared is missing and apt-get is unavailable to install it")
-    download_dir = Path(tempfile.mkdtemp())
-    deb_path = download_dir / "cloudflared.deb"
-    try:
-        urllib.request.urlretrieve(CLOUDFLARE_DEB_URL, deb_path)
-        try:
-            _call_subprocess(["dpkg", "-i", str(deb_path)], check=True)
-        except subprocess.CalledProcessError:
-            _call_subprocess([apt, "install", "-f", "-y"], check=True)
-            _call_subprocess(["dpkg", "-i", str(deb_path)], check=True)
-    finally:
-        shutil.rmtree(download_dir, ignore_errors=True)
-
-
 def _verify_connectivity(timeout: float = 5.0) -> bool:
     try:
         _call_subprocess(["/bin/ping", "-c", "2", "1.1.1.1"], check=True, timeout=timeout)
@@ -380,7 +418,6 @@ def _build_managed_containers_summary(records: List[Dict[str, Any]]) -> Dict[str
                 "cpu_share": cpu_share,
                 "created_at": record.get("created_at"),
                 "status": status,
-                "tunnel": record.get("tunnel"),
             }
         )
 
@@ -459,48 +496,119 @@ def _friendly_step_label(step_name: str) -> str:
     return normalized.capitalize()
 
 
+_PACKAGE_MANAGER_PROFILES: Dict[str, Dict[str, Any]] = {
+    "apt": {
+        "update_cmd": "apt-get update -y",
+        "update_step_name": "apt_update",
+        "install_cmd": "apt-get install -y python3 python3-pip sudo --fix-missing",
+        "install_step_name": "install_deps",
+        "update_retries": 4,
+        "install_retries": 5,
+    },
+    "dnf": {
+        "update_cmd": "dnf check-update || true",
+        "update_step_name": "dnf_update",
+        "install_cmd": "dnf install -y python3 python3-pip sudo",
+        "install_step_name": "install_deps",
+        "update_retries": 3,
+        "install_retries": 5,
+    },
+    "yum": {
+        "update_cmd": "yum makecache",
+        "update_step_name": "yum_update",
+        "install_cmd": "yum install -y python3 python3-pip sudo",
+        "install_step_name": "install_deps",
+        "update_retries": 3,
+        "install_retries": 5,
+    },
+    "apk": {
+        "update_cmd": "apk update",
+        "update_step_name": "apk_update",
+        "install_cmd": "apk add --no-cache python3 py3-pip sudo",
+        "install_step_name": "install_deps",
+        "update_retries": 3,
+        "install_retries": 5,
+    },
+    "pacman": {
+        "update_cmd": "pacman -Sy --noconfirm",
+        "update_step_name": "pacman_update",
+        "install_cmd": "pacman -S --noconfirm python python-pip sudo",
+        "install_step_name": "install_deps",
+        "update_retries": 3,
+        "install_retries": 5,
+    },
+    "zypper": {
+        "update_cmd": "zypper refresh",
+        "update_step_name": "zypper_update",
+        "install_cmd": "zypper install -y python3 python3-pip sudo",
+        "install_step_name": "install_deps",
+        "update_retries": 3,
+        "install_retries": 5,
+    },
+}
+
+_UPDATE_RETRY_ON = [
+    "Temporary failure resolving",
+    "Could not resolve",
+    "Failed to fetch",
+]
+
+_INSTALL_RETRY_ON = [
+    "lock-frontend",
+    "Unable to acquire the dpkg frontend lock",
+    "Temporary failure resolving",
+    "Could not resolve",
+    "Failed to fetch",
+]
+
+
 def _build_bootstrap_steps(
     user: str,
     password: str,
     ssh_key: str,
     include_portacode_connect: bool = True,
+    package_manager: str = "apt",
 ) -> List[Dict[str, Any]]:
-    steps = [
-        {
-            "name": "apt_update",
-            "cmd": "apt-get update -y",
-            "retries": 4,
-            "retry_delay_s": 5,
-            "retry_on": [
-                "Temporary failure resolving",
-                "Could not resolve",
-                "Failed to fetch",
-            ],
-        },
-        {
-            "name": "install_deps",
-            "cmd": "apt-get install -y python3 python3-pip sudo --fix-missing",
-            "retries": 5,
-            "retry_delay_s": 5,
-            "retry_on": [
-                "lock-frontend",
-                "Unable to acquire the dpkg frontend lock",
-                "Temporary failure resolving",
-                "Could not resolve",
-                "Failed to fetch",
-            ],
-        },
-        {"name": "user_exists", "cmd": f"id -u {user} >/dev/null 2>&1 || adduser --disabled-password --gecos '' {user}", "retries": 0},
-        {"name": "add_sudo", "cmd": f"usermod -aG sudo {user}", "retries": 0},
-    ]
+    profile = _PACKAGE_MANAGER_PROFILES.get(package_manager, _PACKAGE_MANAGER_PROFILES["apt"])
+    steps: List[Dict[str, Any]] = []
+    update_cmd = profile.get("update_cmd")
+    if update_cmd:
+        steps.append(
+            {
+                "name": profile.get("update_step_name", "package_update"),
+                "cmd": update_cmd,
+                "retries": profile.get("update_retries", 3),
+                "retry_delay_s": 5,
+                "retry_on": _UPDATE_RETRY_ON,
+            }
+        )
+    install_cmd = profile.get("install_cmd")
+    if install_cmd:
+        steps.append(
+            {
+                "name": profile.get("install_step_name", "install_deps"),
+                "cmd": install_cmd,
+                "retries": profile.get("install_retries", 5),
+                "retry_delay_s": 5,
+                "retry_on": _INSTALL_RETRY_ON,
+            }
+        )
+    steps.extend(
+        [
+            {"name": "user_exists", "cmd": f"id -u {user} >/dev/null 2>&1 || adduser --disabled-password --gecos '' {user}", "retries": 0},
+            {"name": "add_sudo", "cmd": f"usermod -aG sudo {user}", "retries": 0},
+        ]
+    )
     if password:
         steps.append({"name": "set_password", "cmd": f"echo '{user}:{password}' | chpasswd", "retries": 0})
     if ssh_key:
-        steps.append({
-            "name": "add_ssh_key",
-            "cmd": f"install -d -m 700 /home/{user}/.ssh && echo '{ssh_key}' >> /home/{user}/.ssh/authorized_keys && chown -R {user}:{user} /home/{user}/.ssh",
-            "retries": 0,
-        })
+        steps.append(
+            {
+                "name": "add_ssh_key",
+                "cmd": f"install -d -m 700 /home/{user}/.ssh && echo '{ssh_key}' >> /home/{user}/.ssh/authorized_keys && chown -R {user}:{user} /home/{user}/.ssh",
+                "retries": 0,
+            }
+        )
     steps.extend(
         [
             {"name": "pip_upgrade", "cmd": "python3 -m pip install --upgrade pip", "retries": 0},
@@ -512,6 +620,45 @@ def _build_bootstrap_steps(
     return steps
 
 
+def _guess_package_manager_from_template(template: str) -> str:
+    normalized = (template or "").lower()
+    if "alpine" in normalized:
+        return "apk"
+    if "archlinux" in normalized:
+        return "pacman"
+    if "centos-7" in normalized:
+        return "yum"
+    if any(keyword in normalized for keyword in ("centos-8", "centos-9", "centos-9-stream", "centos-8-stream")):
+        return "dnf"
+    if any(keyword in normalized for keyword in ("rockylinux", "almalinux", "fedora")):
+        return "dnf"
+    if "opensuse" in normalized or "suse" in normalized:
+        return "zypper"
+    if any(keyword in normalized for keyword in ("debian", "ubuntu", "devuan", "turnkeylinux")):
+        return "apt"
+    if normalized.startswith("system/") and "linux" in normalized:
+        return "apt"
+    return "apt"
+
+
+def _detect_package_manager(vmid: int) -> str:
+    candidates = [
+        ("apt", "apt-get"),
+        ("dnf", "dnf"),
+        ("yum", "yum"),
+        ("apk", "apk"),
+        ("pacman", "pacman"),
+        ("zypper", "zypper"),
+    ]
+    for name, binary in candidates:
+        res = _run_pct(vmid, f"command -v {binary} >/dev/null 2>&1")
+        if res.get("returncode") == 0:
+            logger.debug("Detected package manager %s inside container %s", name, vmid)
+            return name
+    logger.warning("Unable to detect package manager inside container %s; defaulting to apt", vmid)
+    return "apt"
+
+
 def _get_storage_type(storages: Iterable[Dict[str, Any]], storage_name: str) -> str:
     for entry in storages:
         if entry.get("storage") == storage_name:
@@ -618,89 +765,6 @@ def _remove_container_record(vmid: int) -> None:
         _invalidate_managed_containers_cache()
 
 
-def _update_container_tunnel(vmid: int, tunnel: Optional[Dict[str, Any]]) -> None:
-    record = _read_container_record(vmid)
-    if tunnel:
-        record["tunnel"] = tunnel
-    else:
-        record.pop("tunnel", None)
-    _write_container_record(vmid, record)
-
-
-def _ensure_cloudflare_token(config: Dict[str, Any]) -> str:
-    cloudflare = config.get("cloudflare") or {}
-    token = cloudflare.get("api_token")
-    if not token:
-        raise RuntimeError("Cloudflare API token is not configured.")
-    return token
-
-
-def _launch_container_tunnel(proxmox: Any, node: str, vmid: int, tunnel: Dict[str, Any]) -> Dict[str, Any]:
-    port = int(tunnel.get("container_port") or 0)
-    if not port:
-        raise ValueError("container_port is required to create a tunnel.")
-    requested_hostname = tunnel.get("url") or None
-    protocol = (tunnel.get("protocol") or "http").lower()
-    ip_address = _resolve_container_ip(proxmox, node, vmid)
-    target_url = f"{protocol}://{ip_address}:{port}"
-    name = tunnel.get("name") or _build_tunnel_name(vmid, port)
-    _stop_cloudflare_process(name)
-    proc, assigned_url = _start_cloudflare_process(name, target_url, hostname=requested_hostname)
-    if not assigned_url:
-        raise RuntimeError("Failed to determine Cloudflare hostname for the tunnel.")
-    updated = {
-        "name": name,
-        "container_port": port,
-        "url": assigned_url,
-        "protocol": protocol,
-        "status": "running",
-        "pid": proc.pid,
-        "target_ip": ip_address,
-        "target_url": target_url,
-        "last_updated": datetime.utcnow().isoformat() + "Z",
-    }
-    _update_container_tunnel(vmid, updated)
-    return updated
-
-
-def _stop_container_tunnel(vmid: int) -> None:
-    try:
-        record = _read_container_record(vmid)
-    except FileNotFoundError:
-        return
-    tunnel = record.get("tunnel")
-    if not tunnel:
-        return
-    name = tunnel.get("name") or _build_tunnel_name(vmid, int(tunnel.get("container_port") or 0))
-    stopped = _stop_cloudflare_process(name)
-    if not stopped and tunnel.get("status") == "stopped":
-        return
-    tunnel_update = {
-        **tunnel,
-        "status": "stopped",
-        "pid": None,
-        "last_updated": datetime.utcnow().isoformat() + "Z",
-    }
-    _update_container_tunnel(vmid, tunnel_update)
-
-
-def _remove_container_tunnel_state(vmid: int) -> None:
-    _stop_container_tunnel(vmid)
-    _update_container_tunnel(vmid, None)
-
-
-def _ensure_container_tunnel_running(proxmox: Any, node: str, vmid: int) -> None:
-    try:
-        record = _read_container_record(vmid)
-    except FileNotFoundError:
-        return
-    tunnel = record.get("tunnel")
-    if not tunnel:
-        return
-    _ensure_cloudflare_token(_load_config())
-    _launch_container_tunnel(proxmox, node, vmid, tunnel)
-
-
 def _build_container_payload(message: Dict[str, Any], config: Dict[str, Any]) -> Dict[str, Any]:
     templates = config.get("templates") or []
     default_template = templates[0] if templates else ""
@@ -816,116 +880,6 @@ def _run_pct_push(vmid: int, src: str, dest: str) -> subprocess.CompletedProcess
     return _call_subprocess(["pct", "push", str(vmid), src, dest])
 
 
-def _build_tunnel_name(vmid: int, port: int) -> str:
-    return f"portacode-ct{vmid}-{port}"
-
-
-def _get_cloudflared_binary() -> str:
-    binary = shutil.which("cloudflared")
-    if not binary:
-        raise RuntimeError(
-            "cloudflared is required for Cloudflare tunnels but was not found on PATH. "
-            "Install cloudflared and run 'cloudflared tunnel login' before creating tunnels."
-        )
-    return binary
-
-
-def _drain_stream(stream: Optional[Any]) -> None:
-    if stream is None:
-        return
-    try:
-        for _ in iter(stream.readline, ""):
-            continue
-    except Exception:
-        pass
-    finally:
-        try:
-            stream.close()
-        except Exception:
-            pass
-
-
-def _await_quick_tunnel_url(proc: subprocess.Popen, timeout: float = 15.0) -> Optional[str]:
-    if not proc.stdout:
-        return None
-    cf_re = re.compile(r"https://[A-Za-z0-9\-.]+\.cfargotunnel\.com")
-    deadline = time.time() + timeout
-    while time.time() < deadline:
-        ready, _, _ = select.select([proc.stdout], [], [], 1)
-        if not ready:
-            continue
-        line = proc.stdout.readline()
-        if not line:
-            continue
-        match = cf_re.search(line)
-        if match:
-            return match.group(0)
-    return None
-
-
-def _start_cloudflare_process(name: str, target_url: str, hostname: Optional[str] = None) -> Tuple[subprocess.Popen, Optional[str]]:
-    binary = _get_cloudflared_binary()
-    cmd = [
-        binary,
-        "tunnel",
-        "--url",
-        target_url,
-        "--no-autoupdate",
-    ]
-    if hostname:
-        cmd.extend(["--hostname", hostname])
-        stdout_target = subprocess.DEVNULL
-    else:
-        stdout_target = subprocess.PIPE
-    proc = subprocess.Popen(
-        cmd,
-        stdout=stdout_target,
-        stderr=subprocess.PIPE,
-        text=True,
-    )
-    with _CLOUDFLARE_TUNNELS_LOCK:
-        _CLOUDFLARE_TUNNEL_PROCESSES[name] = proc
-    assigned_url = hostname
-    if not hostname:
-        assigned_url = _await_quick_tunnel_url(proc)
-        threading.Thread(target=_drain_stream, args=(proc.stdout,), daemon=True).start()
-    threading.Thread(target=_drain_stream, args=(proc.stderr,), daemon=True).start()
-    return proc, assigned_url
-
-
-def _stop_cloudflare_process(name: str) -> bool:
-    with _CLOUDFLARE_TUNNELS_LOCK:
-        proc = _CLOUDFLARE_TUNNEL_PROCESSES.pop(name, None)
-    if not proc:
-        return False
-    try:
-        proc.terminate()
-        proc.wait(timeout=5)
-    except subprocess.TimeoutExpired:
-        proc.kill()
-        proc.wait()
-    return True
-
-
-def _resolve_container_ip(proxmox: Any, node: str, vmid: int) -> str:
-    status = proxmox.nodes(node).lxc(vmid).status.current.get()
-    if status:
-        ip_field = status.get("ip")
-        if isinstance(ip_field, list):
-            for entry in ip_field:
-                if isinstance(entry, str) and "." in entry:
-                    return entry.split("/")[0]
-        elif isinstance(ip_field, str) and "." in ip_field:
-            return ip_field.split("/")[0]
-    res = _run_pct_exec(vmid, ["ip", "-4", "-o", "addr", "show", "eth0"])
-    line = res.stdout.splitlines()[0] if res.stdout else ""
-    parts = line.split()
-    if len(parts) >= 4:
-        addr = parts[3]
-        return addr.split("/")[0]
-    raise RuntimeError("Unable to determine container IP address")
-
-
 def _push_bytes_to_container(
     vmid: int, user: str, path: str, data: bytes, mode: int = 0o600
 ) -> None:
@@ -1182,7 +1136,16 @@ def _bootstrap_portacode(
     total_steps: Optional[int] = None,
     default_public_key: Optional[str] = None,
 ) -> Tuple[str, List[Dict[str, Any]]]:
-    actual_steps = steps if steps is not None else _build_bootstrap_steps(user, password, ssh_key)
+    if steps is not None:
+        actual_steps = steps
+    else:
+        detected_manager = _detect_package_manager(vmid)
+        actual_steps = _build_bootstrap_steps(
+            user,
+            password,
+            ssh_key,
+            package_manager=detected_manager,
+        )
     results, ok = _run_setup_steps(
         vmid,
         actual_steps,
@@ -1206,6 +1169,15 @@ def _bootstrap_portacode(
             else:
                 command_text = str(command)
         command_suffix = f" command={command_text}" if command_text else ""
+        stdout = details.get("stdout")
+        stderr = details.get("stderr")
+        if stdout or stderr:
+            logger.debug(
+                "Bootstrap command output%s%s%s",
+                f" stdout={stdout!r}" if stdout else "",
+                " " if stdout and stderr else "",
+                f"stderr={stderr!r}" if stderr else "",
+            )
         if summary:
             logger.warning(
                 "Portacode bootstrap failure summary=%s%s%s",
@@ -1213,10 +1185,15 @@ def _bootstrap_portacode(
                 f" history_len={len(history)}" if history else "",
                 f" command={command_text}" if command_text else "",
             )
-            raise RuntimeError(
-                f"Portacode bootstrap steps failed: {summary}{history_snippet}{command_suffix}"
-            )
-        raise RuntimeError("Portacode bootstrap steps failed.")
+        logger.error(
+            "Portacode bootstrap command failed%s%s%s",
+            f" command={command_text}" if command_text else "",
+            f" stdout={stdout!r}" if stdout else "",
+            f" stderr={stderr!r}" if stderr else "",
+        )
+        raise RuntimeError(
+            f"Portacode bootstrap steps failed: {summary}{history_snippet}{command_suffix}"
+        )
     key_step = next((entry for entry in results if entry.get("name") == "portacode_connect"), None)
     public_key = key_step.get("public_key") if key_step else default_public_key
     if not public_key:
@@ -1224,12 +1201,6 @@ def _bootstrap_portacode(
     return public_key, results
 
 
-def _build_cloudflare_snapshot(cloudflare_config: Dict[str, Any] | None) -> Dict[str, Any]:
-    if not cloudflare_config:
-        return {"configured": False}
-    return {"configured": bool(cloudflare_config.get("api_token"))}
-
-
 def build_snapshot(config: Dict[str, Any]) -> Dict[str, Any]:
     network = config.get("network", {})
     base_network = {
@@ -1237,13 +1208,9 @@ def build_snapshot(config: Dict[str, Any]) -> Dict[str, Any]:
         "message": network.get("message"),
         "bridge": network.get("bridge", DEFAULT_BRIDGE),
     }
-    cloudflare_snapshot = _build_cloudflare_snapshot(config.get("cloudflare"))
     if not config:
-        return {
-            "configured": False,
-            "network": base_network,
-            "cloudflare": cloudflare_snapshot,
-        }
+        return {"configured": False, "network": base_network}
+    _ensure_templates_refreshed_on_startup(config)
     return {
         "configured": True,
         "host": config.get("host"),
@@ -1254,54 +1221,18 @@ def build_snapshot(config: Dict[str, Any]) -> Dict[str, Any]:
         "templates": config.get("templates") or [],
         "last_verified": config.get("last_verified"),
         "network": base_network,
-        "cloudflare": cloudflare_snapshot,
     }
 
 
-def _resolve_proxmox_credentials(
-    token_identifier: Optional[str],
-    token_value: Optional[str],
-    existing: Dict[str, Any],
-) -> Tuple[str, str, str]:
-    if token_identifier:
-        if not token_value:
-            raise ValueError("token_value is required when providing a new token_identifier")
-        user, token_name = _parse_token(token_identifier)
-        return user, token_name, token_value
-    if existing and existing.get("user") and existing.get("token_name") and existing.get("token_value"):
-        return existing["user"], existing["token_name"], existing["token_value"]
-    raise ValueError("Proxmox token identifier and value are required when no existing configuration is available")
-
-
-def _build_cloudflare_config(existing: Dict[str, Any], api_token: Optional[str]) -> Dict[str, Any]:
-    cloudflare: Dict[str, Any] = dict(existing.get("cloudflare", {}) or {})
-    if api_token:
-        cloudflare["api_token"] = api_token
-    if cloudflare.get("api_token"):
-        cloudflare["configured"] = True
-    elif "configured" in cloudflare:
-        cloudflare.pop("configured", None)
-    return cloudflare
-
-
-def configure_infrastructure(
-    token_identifier: Optional[str] = None,
-    token_value: Optional[str] = None,
-    verify_ssl: Optional[bool] = None,
-    cloudflare_api_token: Optional[str] = None,
-) -> Dict[str, Any]:
+def configure_infrastructure(token_identifier: str, token_value: str, verify_ssl: bool = False) -> Dict[str, Any]:
     ProxmoxAPI = _ensure_proxmoxer()
-    existing = _load_config()
-    user, token_name, resolved_token_value = _resolve_proxmox_credentials(
-        token_identifier, token_value, existing
-    )
-    actual_verify_ssl = verify_ssl if verify_ssl is not None else existing.get("verify_ssl", False)
+    user, token_name = _parse_token(token_identifier)
     client = ProxmoxAPI(
         DEFAULT_HOST,
         user=user,
         token_name=token_name,
-        token_value=resolved_token_value,
-        verify_ssl=actual_verify_ssl,
+        token_value=token_value,
+        verify_ssl=verify_ssl,
         timeout=30,
     )
     node = _pick_node(client)
@@ -1309,36 +1240,32 @@ def configure_infrastructure(
     storages = client.nodes(node).storage.get()
     default_storage = _pick_storage(storages)
     templates = _list_templates(client, node, storages)
-    network = dict(existing.get("network", {}) or {})
-    _ensure_cloudflared_installed()
-    if not network.get("applied"):
-        try:
-            network = _ensure_bridge()
-            # Wait for network convergence before validating connectivity
-            time.sleep(2)
-            if not _verify_connectivity():
-                raise RuntimeError("Connectivity check failed; bridge reverted")
-            network["health"] = "healthy"
-        except Exception as exc:
-            logger.warning("Bridge setup failed; reverting previous changes: %s", exc)
-            _revert_bridge()
-            raise
+    network: Dict[str, Any] = {}
+    try:
+        network = _ensure_bridge()
+        # Wait for network convergence before validating connectivity
+        time.sleep(2)
+        if not _verify_connectivity():
+            raise RuntimeError("Connectivity check failed; bridge reverted")
+        network["health"] = "healthy"
+    except Exception as exc:
+        logger.warning("Bridge setup failed; reverting previous changes: %s", exc)
+        _revert_bridge()
+        raise
     config = {
         "host": DEFAULT_HOST,
         "node": node,
         "user": user,
         "token_name": token_name,
-        "token_value": resolved_token_value,
-        "verify_ssl": actual_verify_ssl,
+        "token_value": token_value,
+        "verify_ssl": verify_ssl,
         "default_storage": default_storage,
-        "templates": templates,
         "last_verified": datetime.utcnow().isoformat() + "Z",
+        "templates": templates,
+        "templates_last_refreshed": _current_time_iso(),
         "network": network,
         "node_status": status,
     }
-    cloudflare = _build_cloudflare_config(existing, cloudflare_api_token)
-    if cloudflare:
-        config["cloudflare"] = cloudflare
     _save_config(config)
     snapshot = build_snapshot(config)
     snapshot["node_status"] = status
@@ -1389,7 +1316,7 @@ def _instantiate_container(proxmox: Any, node: str, payload: Dict[str, Any]) ->
             memory=int(payload["ram_mib"]),
             swap=int(payload.get("swap_mb", 0)),
             cores=max(int(payload.get("cores", 1)), 1),
-            cpuunits=int(payload.get("cpuunits", 256)),
+            cpulimit=float(payload.get("cpulimit", payload.get("cpus", 1))),
             net0=payload["net0"],
             unprivileged=int(payload.get("unprivileged", 1)),
             description=payload.get("description", MANAGED_MARKER),
@@ -1412,16 +1339,24 @@ class CreateProxmoxContainerHandler(SyncHandler):
     def execute(self, message: Dict[str, Any]) -> Dict[str, Any]:
         logger.info("create_proxmox_container command received")
         request_id = message.get("request_id")
-        device_id = message.get("device_id")
+        raw_device_id = message.get("device_id")
+        device_id = str(raw_device_id or "").strip()
+        if not device_id:
+            raise ValueError("device_id is required to create a container")
         device_public_key = (message.get("device_public_key") or "").strip()
         device_private_key = (message.get("device_private_key") or "").strip()
         has_device_keypair = bool(device_public_key and device_private_key)
+        config_guess = _load_config()
+        template_candidates = config_guess.get("templates") or []
+        template_hint = (message.get("template") or (template_candidates[0] if template_candidates else "")).strip()
+        package_manager = _guess_package_manager_from_template(template_hint)
         bootstrap_user, bootstrap_password, bootstrap_ssh_key = _get_provisioning_user_info(message)
         bootstrap_steps = _build_bootstrap_steps(
             bootstrap_user,
             bootstrap_password,
             bootstrap_ssh_key,
             include_portacode_connect=not has_device_keypair,
+            package_manager=package_manager,
         )
         total_steps = 3 + len(bootstrap_steps) + 2
         current_step_index = 1
@@ -1444,6 +1379,7 @@ class CreateProxmoxContainerHandler(SyncHandler):
                 message=start_message,
                 phase="lifecycle",
                 request_id=request_id,
+                on_behalf_of_device=device_id,
             )
             try:
                 result = action()
@@ -1459,6 +1395,7 @@ class CreateProxmoxContainerHandler(SyncHandler):
                     phase="lifecycle",
                     request_id=request_id,
                     details={"error": str(exc)},
+                    on_behalf_of_device=device_id,
                 )
                 raise
             _emit_progress_event(
@@ -1471,6 +1408,7 @@ class CreateProxmoxContainerHandler(SyncHandler):
                 message=success_message,
                 phase="lifecycle",
                 request_id=request_id,
+                on_behalf_of_device=device_id,
             )
             current_step_index += 1
             return result
@@ -1497,7 +1435,8 @@ class CreateProxmoxContainerHandler(SyncHandler):
             proxmox = _connect_proxmox(config)
             node = config.get("node") or DEFAULT_NODE_NAME
             payload = _build_container_payload(message, config)
-            payload["cpuunits"] = max(int(payload["cpus"] * 1024), 10)
+            payload["cpulimit"] = float(payload["cpus"])
+            payload["cores"] = int(max(math.ceil(payload["cpus"]), 1))
             payload["memory"] = int(payload["ram_mib"])
             payload["node"] = node
             logger.debug(
@@ -1512,6 +1451,7 @@ class CreateProxmoxContainerHandler(SyncHandler):
             payload["vmid"] = vmid
             payload["created_at"] = datetime.utcnow().isoformat() + "Z"
             payload["status"] = "creating"
+            payload["device_id"] = device_id
             _write_container_record(vmid, payload)
             return proxmox, node, vmid, payload
 
@@ -1572,6 +1512,7 @@ class CreateProxmoxContainerHandler(SyncHandler):
                 phase="bootstrap",
                 request_id=request_id,
                 details=details or None,
+                on_behalf_of_device=device_id,
             )
 
         public_key, steps = _bootstrap_portacode(
@@ -1615,6 +1556,7 @@ class CreateProxmoxContainerHandler(SyncHandler):
                 message="Notifying the server of the new device…",
                 phase="service",
                 request_id=request_id,
+                on_behalf_of_device=device_id,
             )
             _emit_progress_event(
                 self,
@@ -1626,6 +1568,7 @@ class CreateProxmoxContainerHandler(SyncHandler):
                 message="Authentication metadata recorded.",
                 phase="service",
                 request_id=request_id,
+                on_behalf_of_device=device_id,
             )
 
             install_step = service_start_index + 1
@@ -1640,6 +1583,7 @@ class CreateProxmoxContainerHandler(SyncHandler):
                 message="Running sudo portacode service install…",
                 phase="service",
                 request_id=request_id,
+                on_behalf_of_device=device_id,
             )
 
             cmd = f"su - {payload['username']} -c 'sudo -S portacode service install'"
@@ -1660,6 +1604,7 @@ class CreateProxmoxContainerHandler(SyncHandler):
                         "stderr": res.get("stderr"),
                         "stdout": res.get("stdout"),
                     },
+                    on_behalf_of_device=device_id,
                 )
                 raise RuntimeError(res.get("stderr") or res.get("stdout") or "Service install failed")
 
@@ -1673,6 +1618,7 @@ class CreateProxmoxContainerHandler(SyncHandler):
                 message="Portacode service install finished.",
                 phase="service",
                 request_id=request_id,
+                on_behalf_of_device=device_id,
             )
 
             logger.info("create_proxmox_container: portacode service install completed inside ct %s", vmid)
@@ -1696,6 +1642,7 @@ class CreateProxmoxContainerHandler(SyncHandler):
             },
             "setup_steps": steps,
             "device_id": device_id,
+            "on_behalf_of_device": device_id,
             "service_installed": service_installed,
         }
 
@@ -1721,6 +1668,9 @@ class StartPortacodeServiceHandler(SyncHandler):
         password = record.get("password")
         if not user or not password:
             raise RuntimeError("Container credentials unavailable")
+        on_behalf_of_device = record.get("device_id")
+        if on_behalf_of_device:
+            on_behalf_of_device = str(on_behalf_of_device)
 
         start_index = int(message.get("step_index", 1))
         total_steps = int(message.get("total_steps", start_index + 2))
@@ -1738,6 +1688,7 @@ class StartPortacodeServiceHandler(SyncHandler):
             message="Notifying the server of the new device…",
             phase="service",
             request_id=request_id,
+            on_behalf_of_device=on_behalf_of_device,
         )
         _emit_progress_event(
             self,
@@ -1749,6 +1700,7 @@ class StartPortacodeServiceHandler(SyncHandler):
             message="Authentication metadata recorded.",
             phase="service",
             request_id=request_id,
+            on_behalf_of_device=on_behalf_of_device,
         )
 
         install_step = start_index + 1
@@ -1763,6 +1715,7 @@ class StartPortacodeServiceHandler(SyncHandler):
             message="Running sudo portacode service install…",
             phase="service",
             request_id=request_id,
+            on_behalf_of_device=on_behalf_of_device,
         )
 
         cmd = f"su - {user} -c 'sudo -S portacode service install'"
@@ -1783,6 +1736,7 @@ class StartPortacodeServiceHandler(SyncHandler):
                     "stderr": res.get("stderr"),
                     "stdout": res.get("stdout"),
                 },
+                on_behalf_of_device=on_behalf_of_device,
             )
             raise RuntimeError(res.get("stderr") or res.get("stdout") or "Service install failed")
 
@@ -1796,6 +1750,7 @@ class StartPortacodeServiceHandler(SyncHandler):
             message="Portacode service install finished.",
             phase="service",
             request_id=request_id,
+            on_behalf_of_device=on_behalf_of_device,
         )
 
         return {
@@ -1822,10 +1777,6 @@ class StartProxmoxContainerHandler(SyncHandler):
 
         status, elapsed = _start_container(proxmox, node, vmid)
         _update_container_record(vmid, {"status": "running"})
-        try:
-            _ensure_container_tunnel_running(proxmox, node, vmid)
-        except Exception as exc:
-            raise RuntimeError(f"Failed to start Cloudflare tunnel for container {vmid}: {exc}") from exc
 
         infra = get_infra_snapshot()
         return {
@@ -1855,7 +1806,6 @@ class StopProxmoxContainerHandler(SyncHandler):
         _ensure_container_managed(proxmox, node, vmid)
 
         status, elapsed = _stop_container(proxmox, node, vmid)
-        _stop_container_tunnel(vmid)
         final_status = status.get("status") or "stopped"
         _update_container_record(vmid, {"status": final_status})
 
@@ -1891,13 +1841,8 @@ class RemoveProxmoxContainerHandler(SyncHandler):
         node = _get_node_from_config(config)
         _ensure_container_managed(proxmox, node, vmid)
 
-        _stop_container_tunnel(vmid)
         stop_status, stop_elapsed = _stop_container(proxmox, node, vmid)
         delete_status, delete_elapsed = _delete_container(proxmox, node, vmid)
-        try:
-            _update_container_tunnel(vmid, None)
-        except FileNotFoundError:
-            pass
         _remove_container_record(vmid)
 
         infra = get_infra_snapshot()
@@ -1916,134 +1861,6 @@ class RemoveProxmoxContainerHandler(SyncHandler):
         }
 
 
-class CreateCloudflareTunnelHandler(SyncHandler):
-    """Create a Cloudflare tunnel for a container."""
-
-    @property
-    def command_name(self) -> str:
-        return "create_cloudflare_tunnel"
-
-    def execute(self, message: Dict[str, Any]) -> Dict[str, Any]:
-        vmid = _parse_ctid(message)
-        container_port = int(message.get("container_port") or 0)
-        if container_port <= 0:
-            raise ValueError("container_port is required and must be greater than zero.")
-        hostname = (message.get("cloudflare_url") or message.get("hostname") or "").strip()
-        hostname = hostname or None
-        protocol = (message.get("protocol") or "http").strip().lower()
-        if protocol not in {"http", "https", "tcp"}:
-            raise ValueError("protocol must be one of http, https, or tcp.")
-        config = _ensure_infra_configured()
-        _ensure_cloudflare_token(config)
-        proxmox = _connect_proxmox(config)
-        node = _get_node_from_config(config)
-        _ensure_container_managed(proxmox, node, vmid)
-        status = proxmox.nodes(node).lxc(vmid).status.current.get().get("status")
-        if status != "running":
-            raise RuntimeError("Container must be running to create a tunnel.")
-        tunnel = {
-            "container_port": container_port,
-            "protocol": protocol,
-        }
-        if hostname:
-            tunnel["url"] = hostname
-        created = _launch_container_tunnel(proxmox, node, vmid, tunnel)
-        infra = get_infra_snapshot()
-        host_url = created.get("url")
-        response_message = f"Created Cloudflare tunnel for container {vmid}."
-        if host_url:
-            response_message = f"{response_message[:-1]} -> {host_url}."
-        response = {
-            "event": "cloudflare_tunnel_created",
-            "ctid": str(vmid),
-            "success": True,
-            "message": response_message,
-            "tunnel": created,
-            "infra": infra,
-        }
-        device_id = message.get("device_id")
-        if device_id:
-            response["device_id"] = device_id
-        return response
-
-
-class UpdateCloudflareTunnelHandler(SyncHandler):
-    """Update an existing Cloudflare tunnel for a container."""
-
-    @property
-    def command_name(self) -> str:
-        return "update_cloudflare_tunnel"
-
-    def execute(self, message: Dict[str, Any]) -> Dict[str, Any]:
-        vmid = _parse_ctid(message)
-        config = _ensure_infra_configured()
-        _ensure_cloudflare_token(config)
-        proxmox = _connect_proxmox(config)
-        node = _get_node_from_config(config)
-        _ensure_container_managed(proxmox, node, vmid)
-        record = _read_container_record(vmid)
-        tunnel = record.get("tunnel")
-        if not tunnel:
-            raise RuntimeError("No Cloudflare tunnel configured for this container.")
-        container_port = int(message.get("container_port") or tunnel.get("container_port") or 0)
-        if container_port <= 0:
-            raise ValueError("container_port must be greater than zero.")
-        hostname = (message.get("cloudflare_url") or tunnel.get("url") or "").strip()
-        hostname = hostname or None
-        protocol = (message.get("protocol") or tunnel.get("protocol") or "http").strip().lower()
-        if protocol not in {"http", "https", "tcp"}:
-            raise ValueError("protocol must be one of http, https, or tcp.")
-        updated_tunnel = {
-            "container_port": container_port,
-            "protocol": protocol,
-        }
-        if hostname:
-            updated_tunnel["url"] = hostname
-        result = _launch_container_tunnel(proxmox, node, vmid, updated_tunnel)
-        infra = get_infra_snapshot()
-        host_url = result.get("url")
-        response_message = f"Updated Cloudflare tunnel for container {vmid}."
-        if host_url:
-            response_message = f"{response_message[:-1]} -> {host_url}."
-        response = {
-            "event": "cloudflare_tunnel_updated",
-            "ctid": str(vmid),
-            "success": True,
-            "message": response_message,
-            "tunnel": result,
-            "infra": infra,
-        }
-        device_id = message.get("device_id")
-        if device_id:
-            response["device_id"] = device_id
-        return response
-
-
-class RemoveCloudflareTunnelHandler(SyncHandler):
-    """Remove any Cloudflare tunnel associated with a container."""
-
-    @property
-    def command_name(self) -> str:
-        return "remove_cloudflare_tunnel"
-
-    def execute(self, message: Dict[str, Any]) -> Dict[str, Any]:
-        vmid = _parse_ctid(message)
-        _remove_container_tunnel_state(vmid)
-        infra = get_infra_snapshot()
-        response = {
-            "event": "cloudflare_tunnel_removed",
-            "ctid": str(vmid),
-            "success": True,
-            "message": f"Removed Cloudflare tunnel state for container {vmid}.",
-            "tunnel": None,
-            "infra": infra,
-        }
-        device_id = message.get("device_id")
-        if device_id:
-            response["device_id"] = device_id
-        return response
-
-
 class ConfigureProxmoxInfraHandler(SyncHandler):
     @property
     def command_name(self) -> str:
@@ -2052,13 +1869,10 @@ class ConfigureProxmoxInfraHandler(SyncHandler):
     def execute(self, message: Dict[str, Any]) -> Dict[str, Any]:
         token_identifier = message.get("token_identifier")
         token_value = message.get("token_value")
-        verify_ssl = message.get("verify_ssl")
-        snapshot = configure_infrastructure(
-            token_identifier=token_identifier,
-            token_value=token_value,
-            verify_ssl=verify_ssl,
-            cloudflare_api_token=message.get("cloudflare_api_token"),
-        )
+        verify_ssl = bool(message.get("verify_ssl"))
+        if not token_identifier or not token_value:
+            raise ValueError("token_identifier and token_value are required")
+        snapshot = configure_infrastructure(token_identifier, token_value, verify_ssl=verify_ssl)
         return {
             "event": "proxmox_infra_configured",
             "success": True,