From 889396eaa45f125ac4daedec667d15b06cb99c9c Mon Sep 17 00:00:00 2001
From: juvdiaz <juvenal.diaz@oracle.com>
Date: Mon, 29 Jun 2026 12:57:19 -0600
Subject: [PATCH] Make remote Docker installation opt-in

---
 infra/rpi-services/bootstrap.sh |  7 ++++++-
 jeannie                         | 13 +++++++++++--
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/infra/rpi-services/bootstrap.sh b/infra/rpi-services/bootstrap.sh
index d120a71..08b9000 100755
--- a/infra/rpi-services/bootstrap.sh
+++ b/infra/rpi-services/bootstrap.sh
@@ -290,7 +290,12 @@ seed_uptime_kuma_monitors() {
 install_missing_packages ca-certificates curl iptables python3 rsync
 
 if ! command -v docker >/dev/null 2>&1; then
-    curl -fsSL https://get.docker.com | sudo sh
+    if [[ "${LAB_RPI_INSTALL_DOCKER:-false}" == "true" ]]; then
+        curl -fsSL https://get.docker.com | sudo sh
+    else
+        echo "Docker is not installed on the RPi host. Install Docker first, or rerun with LAB_RPI_INSTALL_DOCKER=true to allow get.docker.com installation." >&2
+        exit 1
+    fi
 fi
 sudo systemctl enable docker >/dev/null
 
diff --git a/jeannie b/jeannie
index 2dd01f3..53e4be7 100755
--- a/jeannie
+++ b/jeannie
@@ -2563,6 +2563,7 @@ deploy_gitea() {
     local root_url="${LAB_GITEA_ROOT_URL:-${LAB_PUBLIC_URL:-https://lab2025.duckdns.org}/git/}"
     local container_name="${LAB_GITEA_CONTAINER_NAME:-homelab-gitea}"
     local compose_file="${REPO_ROOT}/infra/gitea/docker-compose.yml"
+    local install_docker="${LAB_GITEA_INSTALL_DOCKER:-false}"
 
     require_debian_server "deploy-gitea"
 
@@ -2583,6 +2584,7 @@ deploy_gitea() {
 
     ssh -i "${gitea_key}" -o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new "${gitea_user}@${gitea_host}" "set -eu
 install_dir='${install_dir}'
+install_docker='${install_docker}'
 
 install_missing_packages() {
   missing_packages=''
@@ -2600,7 +2602,12 @@ install_missing_packages() {
 install_missing_packages ca-certificates curl iptables
 
 if ! command -v docker >/dev/null 2>&1; then
-  curl -fsSL https://get.docker.com | sudo sh
+  if [ \"\$install_docker\" = 'true' ]; then
+    curl -fsSL https://get.docker.com | sudo sh
+  else
+    echo 'Docker is not installed on the Gitea host. Install Docker through the host bootstrap first, or rerun with LAB_GITEA_INSTALL_DOCKER=true to allow get.docker.com installation.' >&2
+    exit 1
+  fi
 fi
 
 if ! sudo docker compose version >/dev/null 2>&1; then
@@ -2661,6 +2668,7 @@ deploy_rpi_services() {
     local docker_nvme_root="${LAB_RPI_DOCKER_NVME_ROOT:-/nvme-storage/docker}"
     local docker_fallback_root="${LAB_RPI_DOCKER_FALLBACK_ROOT:-/var/lib/docker}"
     local stop_legacy_pihole="${LAB_RPI_STOP_LEGACY_PIHOLE:-true}"
+    local install_docker="${LAB_RPI_INSTALL_DOCKER:-false}"
     local pihole_webpassword="${PIHOLE_WEBPASSWORD:-}"
     local source_dir="${REPO_ROOT}/infra/rpi-services"
     local value_name
@@ -2677,7 +2685,7 @@ deploy_rpi_services() {
         exit 1
     fi
 
-    for value_name in install_dir data_dir docker_nvme_root docker_fallback_root stop_legacy_pihole pihole_webpassword; do
+    for value_name in install_dir data_dir docker_nvme_root docker_fallback_root stop_legacy_pihole install_docker pihole_webpassword; do
         value="${!value_name}"
         if [[ "${value}" == *"'"* ]]; then
             echo "${value_name} cannot contain a single quote." >&2
@@ -2705,6 +2713,7 @@ LAB_RPI_SERVICES_DATA_DIR='${data_dir}' \
 LAB_RPI_DOCKER_NVME_ROOT='${docker_nvme_root}' \
 LAB_RPI_DOCKER_FALLBACK_ROOT='${docker_fallback_root}' \
 LAB_RPI_STOP_LEGACY_PIHOLE='${stop_legacy_pihole}' \
+LAB_RPI_INSTALL_DOCKER='${install_docker}' \
 PIHOLE_WEBPASSWORD='${pihole_webpassword}' \
 bash /tmp/homelab-rpi-services/bootstrap.sh"
 }