feat: coolify install command — required version pin, AUTOUPDATE=false

commands/coolify-install.sh

@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# deployor coolify install — pinned Coolify install; AUTOUPDATE=false so the
+# platform never self-updates underneath its operators. Upgrades are an
+# explicit act.
+set -euo pipefail
+
+log() { printf 'deployor-coolify: %s\n' "$*"; }
+die() { printf 'deployor-coolify: ERROR: %s\n' "$1" >&2; exit "${2:-1}"; }
+
+usage() {
+  cat <<'EOF'
+usage: deployor coolify install --version <pin>
+
+Installs Coolify at exactly <pin> (e.g. 4.1.2) with AUTOUPDATE=false.
+Control-plane box only. The version pin is required — you state the floor
+your tooling is verified against; there is no default.
+EOF
+}
+
+VERSION=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --version)
+      [ $# -ge 2 ] || die "--version needs a value" 2
+      VERSION="$2"; shift 2 ;;
+    -h|--help) usage; exit 0 ;;
+    *) die "unknown flag: $1" 2 ;;
+  esac
+done
+if [ -z "$VERSION" ]; then
+  usage >&2
+  die "--version <pin> is required" 2
+fi
+
+[ "$(id -u)" -eq 0 ] || die "must run as root"
+
+export AUTOUPDATE=false
+log "installing coolify ${VERSION} (AUTOUPDATE=false)"
+curl -fsSL https://cdn.coollabs.io/coolify/install.sh -o /tmp/coolify-install.sh
+bash /tmp/coolify-install.sh "$VERSION"
+log "coolify ${VERSION} installed with AUTOUPDATE=false"
+log "next: your bootstrap runbook (admin user, API token, GitHub App, S3 destination)"

test/cli.sh

@@ -42,6 +42,16 @@ else
   echo "skip: bootstrap non-root refusal (running as root)"
 fi
 
+check "coolify: version required, exit 2"  2 "--version"      "$ROOT/commands/coolify-install.sh"
+check "coolify: --help exits 0"            0 "usage:"         "$ROOT/commands/coolify-install.sh" --help
+check "coolify: version needs value"       2 "needs a value"  "$ROOT/commands/coolify-install.sh" --version
+check "coolify: unknown flag exits 2"      2 "unknown flag"   "$ROOT/commands/coolify-install.sh" --nope
+if [ "$(id -u)" -ne 0 ]; then
+  check "coolify: refuses non-root"        1 "must run as root" "$ROOT/commands/coolify-install.sh" --version 4.1.2
+else
+  echo "skip: coolify non-root refusal (running as root)"
+fi
+
 echo "---"
 echo "$PASS passed, $FAIL failed"
 [ "$FAIL" -eq 0 ]