fix: docker in core packages, add user to docker group, tls category

2 files changed, 32 insertions, 12 deletions

diff --git a/straper/install-base.sh b/straper/install-base.sh
index c3e62c4..819fa7a 100755
--- a/straper/install-base.sh
+++ b/straper/install-base.sh
@@ -84,7 +84,7 @@ BASE_PACKAGES=(
 )
 
 CORE_PACKAGES=(
-  wireguard wireguard-tools dnsmasq unbound dns-root-data nginx mariadb-server postfix prosody
+  wireguard wireguard-tools dnsmasq unbound dns-root-data docker.io nginx mariadb-server postfix prosody
   tor i2pd pygopherd mumble-server prometheus prometheus-node-exporter loki
   apparmor apparmor-utils
 )
@@ -98,8 +98,24 @@ bootstrap_dns_prepare() {
   local test_host="${BOOTSTRAP_TEST_HOST:-deb.debian.org}"
   local backup="/etc/resolv.conf.labunix-preinstall.bak"
 
+  # Always write a static resolv.conf for bootstrap — breaks any symlink to
+  # systemd-resolved stub which can disappear mid-install when services restart.
+  if [[ -e /etc/resolv.conf && ! -e "${backup}" ]]; then
+    cp -a /etc/resolv.conf "${backup}" || true
+  fi
+
   if getent ahostsv4 "${test_host}" >/dev/null 2>&1; then
-    report "${SCRIPT_NAME}" "dns" "bootstrap" "check" "ok" "resolver already working" ""
+    # DNS works — write static file pointing at current resolver
+    local current_ns
+    current_ns="$(grep '^nameserver' /etc/resolv.conf 2>/dev/null | head -1 | awk '{print $2}')"
+    current_ns="${current_ns:-1.1.1.1}"
+    # Don't use stub addresses — they won't survive service restarts
+    if [[ "$current_ns" == "127.0.0.53" || "$current_ns" == "127.0.0.54" ]]; then
+      current_ns="1.1.1.1"
+    fi
+    printf 'nameserver %s\nnameserver 9.9.9.9\n' "$current_ns" > /etc/resolv.conf
+    chmod 644 /etc/resolv.conf
+    report "${SCRIPT_NAME}" "dns" "bootstrap" "check" "ok" "static resolv.conf written: ${current_ns}" ""
     return 0
   fi
 
@@ -108,17 +124,12 @@ bootstrap_dns_prepare() {
     die "bootstrap DNS check failed: no outbound IP connectivity"
   fi
 
-  if command -v dig >/dev/null 2>&1 && dig +time=2 +tries=1 +short @1.1.1.1 "${test_host}" >/dev/null 2>&1; then
-    [[ -e /etc/resolv.conf && ! -e "${backup}" ]] && cp -a /etc/resolv.conf "${backup}" || true
-    printf 'nameserver 1.1.1.1
-nameserver 9.9.9.9
-' > /etc/resolv.conf
-    chmod 644 /etc/resolv.conf || true
+  printf 'nameserver 1.1.1.1\nnameserver 9.9.9.9\n' > /etc/resolv.conf
+  chmod 644 /etc/resolv.conf
 
-    if getent ahostsv4 "${test_host}" >/dev/null 2>&1; then
-      report "${SCRIPT_NAME}" "dns" "bootstrap" "fallback" "changed" "static resolv.conf applied" "${backup}"
-      return 0
-    fi
+  if getent ahostsv4 "${test_host}" >/dev/null 2>&1; then
+    report "${SCRIPT_NAME}" "dns" "bootstrap" "fallback" "changed" "static fallback resolv.conf applied" "${backup}"
+    return 0
   fi
 
   note_failure "${SCRIPT_NAME}" "dns" "bootstrap" "check" "DNS still broken after fallback attempt"
diff --git a/straper/restore-configs.sh b/straper/restore-configs.sh
index 9284f27..a9310cc 100755
--- a/straper/restore-configs.sh
+++ b/straper/restore-configs.sh
@@ -1474,6 +1474,15 @@ restore_docker() {
     report "${SCRIPT_NAME}" "docker" "compose-full" "manual" "manual" \
       "compose files available in secret DB; restore manually per stack" ""
   fi
+
+  # Ensure primary user is in docker group
+  if ! $DRY_RUN && id "${PRIMARY_USER:-lukasz}" >/dev/null 2>&1; then
+    if ! id -nG "${PRIMARY_USER:-lukasz}" | grep -qw docker; then
+      usermod -aG docker "${PRIMARY_USER:-lukasz}" 2>/dev/null || true
+      report "${SCRIPT_NAME}" "docker" "docker-group" "fix" "changed" \
+        "${PRIMARY_USER:-lukasz} added to docker group — re-login required" ""
+    fi
+  fi
 }
 
 restore_monitoring() {