feat(installer): harden Dokploy provisioning

[alti3]

Summary

Replaces the current minimal bootstrap installer with a production-hardened, automation-friendly installer while preserving explicit version pinning and a single-file Bash implementation.

This implements the operational recommendations from the installer review: observable failures, persistent logs, deeper preflight validation, safe existing-state handling, idempotent resources, verified downloads/images, structured upgrades, narrowly scoped rollback, post-install health validation, sanitized diagnostics, check mode, and dedicated CI coverage.

Installer changes

Safety and observability

• enables strict Bash behavior (set -Eeuo pipefail), a safe IFS, and umask 077
• centralizes errors, warnings, phase tracking, command auditing, signal handling, and cleanup
• writes timestamped 0600 logs under /var/log/dokploy for mutating runs
• supports DEBUG=1 while disabling tracing around secret generation and creation
• uses an installer lock to reject concurrent mutating runs
• creates an opt-out, local diagnostics bundle on failure and redacts credentials, authorization headers, connection strings, private keys, and host identity
• never includes application environment variables in diagnostics and never uploads a bundle

Preflight and platform validation

• documents and enforces Ubuntu 22.04/24.04 and Debian 12 on amd64/arm64
• classifies other systemd Linux hosts as experimental behind an explicit override
• rejects WSL, Docker/OpenVZ containers, Podman aliases, Snap Docker, rootless Docker, Docker Desktop, non-default/remote contexts, and unsupported sockets
• detects distribution, package manager, init system, architecture, kernel, virtualization, cgroups, overlay/IPVS capability, filesystem/mount type, writability, inode pressure, RAM, swap, and disk capacity
• validates DNS, TLS, GitHub releases, Docker Hub, IPv4/IPv6 behavior, proxy settings, and clock synchronization before mutation
• emits a structured preflight report with minimum/recommended resource results and actionable port ownership details

Docker and artifact integrity

• validates the Docker client, daemon, local socket, Engine/Compose versions, storage driver, data root, disk space, Swarm state, and existing daemon configuration
• installs Docker only on supported apt hosts through Docker's signed repository
• verifies Docker's repository key fingerprint and atomically installs backed-up repository files
• leaves supported existing Docker installations and daemon configuration unchanged
• resolves latest to an immutable GitHub release tag and fails closed when resolution is ambiguous
• pulls container images over Docker's registry transport, requires repository SHA-256 digests, and deploys those immutable digests
• publishes and verifies install.sh.sha256 for the inspect-before-run installation flow

Existing state, idempotency, upgrades, and recovery

• classifies hosts as fresh, healthy, upgradeable, repairable, partial, or conflicting
• supports explicit auto, install, upgrade, repair, abort, and check actions
• preserves existing networks, volumes, secrets, services, configuration, and healthy installations
• never force-leaves an existing Swarm or deletes/recreates a same-name network
• requires explicit permission to integrate with an existing manager Swarm
• creates resources only when absent and tracks newly created resources so failed-run cleanup cannot delete prior user data
• refuses unsafe database repair when a preserved database volume has lost its original password secret
• separates upgrade validation, backup, image download, migration handoff, service update, health validation, rollback decision, and cleanup
• creates private, checksummed pre-upgrade backups containing service specs, prior image/channel metadata, host configuration, and a PostgreSQL dump
• allows automatic image rollback only for upgrade pairs explicitly declared database-safe; it never automatically restores a database dump

Ports, proxies, configuration, and health

• validates configurable HTTP, HTTPS, and application ports and reports host/container owners
• supports alternate ports and an explicit external-proxy mode without treating expected proxy bindings as conflicts
• centralizes and validates installer configuration, including paths, ports, actions, versions, endpoint modes, limits, and security-sensitive overrides
• retains legacy ADVERTISE_ADDR, ENDPOINT_MODE, and positional update compatibility while documenting the new names
• validates service tasks, restart failures, PostgreSQL readiness, the application endpoint, required mounts and networks, Traefik state/routing, optional HTTPS, and a stabilization window before reporting success

Documentation and website changes

• documents the support matrix, minimum/recommended resources, check mode, action/state model, all installer variables, logs, backups, diagnostics, upgrade behavior, and rollback boundaries
• makes the inspectable download + checksum flow the primary installation method
• updates convenience commands across the docs and website to use fail-fast curl flags and Bash
• removes the obsolete manual-guide copy of the installer, which force-left Swarm, recreated resources, used chmod 777, and declared success without health validation
• updates Swarm, Proxmox LXC, advertise-address, DNSRR, and manual-upgrade guidance to match the new behavior

CI and tests

Adds a dedicated installer workflow with:

• Bash syntax validation, ShellCheck (style severity), shfmt, and committed-checksum verification
• 21 Bats scenarios covering input validation, state/action selection, idempotency, rollback policy, cleanup boundaries, redaction, ports, resource/network failures, unsupported Docker variants, and atomic host-file replacement
• checksum tamper detection
• Ubuntu 22.04, Ubuntu 24.04, Debian 12, amd64, and arm64 platform-contract checks
• scheduled/manual systemd VM fresh-install, rerun, upgrade, health, and diagnostic-artifact checks, including a Debian 12 Lima VM

Local validation

Passed:

• bash -n apps/website/public/install.sh
• sha256sum --check apps/website/public/install.sh.sha256
• shellcheck --severity=style apps/website/public/install.sh tests/installer/install.bats
• shfmt -d -i 0 -ci apps/website/public/install.sh tests/installer/install.bats
• all 21 Bats tests
• workflow YAML parsing and Actionlint
• Biome on both changed TSX files
• real DOKPLOY_INSTALL_ACTION=check execution: correctly rejected the local WSL/Docker Desktop host and created no log or installation directory
• docs production build compiled the edited MDX successfully and proceeded through static generation

Existing repository-wide checks remain blocked by baseline issues unrelated to this branch: pnpm biome ci reports existing formatting/lint failures, website typecheck reports existing application/motion typing failures, and the docs build later fails while prerendering /docs/api/reference-settings because /settings.cleanRedis is missing from the current OpenAPI schema.

Compatibility notes

• the installer now intentionally requires Bash 4.3+; invoking it with sh is unsupported
• version pinning remains available through DOKPLOY_VERSION
• unattended operation remains the default, with every material choice available through validated environment variables
• automatic rollback is deliberately conservative and is not advertised for undeclared migration paths