From 33c27452ac20c2813b36240b1627283deafe72c7 Mon Sep 17 00:00:00 2001
From: claude-hdb <dan@heavyduty.builders>
Date: Fri, 10 Jul 2026 20:50:41 +0000
Subject: [PATCH] =?UTF-8?q?feat:=20coolify=20install=20command=20=E2=80=94?=
 =?UTF-8?q?=20required=20version=20pin,=20AUTOUPDATE=3Dfalse?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 commands/coolify-install.sh | 42 +++++++++++++++++++++++++++++++++++++
 test/cli.sh                 | 10 +++++++++
 2 files changed, 52 insertions(+)
 create mode 100755 commands/coolify-install.sh

diff --git a/commands/coolify-install.sh b/commands/coolify-install.sh
new file mode 100755
index 0000000..5ef862e
--- /dev/null
+++ b/commands/coolify-install.sh
@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+# deployor coolify install — pinned Coolify install; AUTOUPDATE=false so the
+# platform never self-updates underneath its operators. Upgrades are an
+# explicit act.
+set -euo pipefail
+
+log() { printf 'deployor-coolify: %s\n' "$*"; }
+die() { printf 'deployor-coolify: ERROR: %s\n' "$1" >&2; exit "${2:-1}"; }
+
+usage() {
+  cat <<'EOF'
+usage: deployor coolify install --version <pin>
+
+Installs Coolify at exactly <pin> (e.g. 4.1.2) with AUTOUPDATE=false.
+Control-plane box only. The version pin is required — you state the floor
+your tooling is verified against; there is no default.
+EOF
+}
+
+VERSION=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --version)
+      [ $# -ge 2 ] || die "--version needs a value" 2
+      VERSION="$2"; shift 2 ;;
+    -h|--help) usage; exit 0 ;;
+    *) die "unknown flag: $1" 2 ;;
+  esac
+done
+if [ -z "$VERSION" ]; then
+  usage >&2
+  die "--version <pin> is required" 2
+fi
+
+[ "$(id -u)" -eq 0 ] || die "must run as root"
+
+export AUTOUPDATE=false
+log "installing coolify ${VERSION} (AUTOUPDATE=false)"
+curl -fsSL https://cdn.coollabs.io/coolify/install.sh -o /tmp/coolify-install.sh
+bash /tmp/coolify-install.sh "$VERSION"
+log "coolify ${VERSION} installed with AUTOUPDATE=false"
+log "next: your bootstrap runbook (admin user, API token, GitHub App, S3 destination)"
diff --git a/test/cli.sh b/test/cli.sh
index 94decc6..a6ba548 100644
--- a/test/cli.sh
+++ b/test/cli.sh
@@ -42,6 +42,16 @@ else
   echo "skip: bootstrap non-root refusal (running as root)"
 fi
 
+check "coolify: version required, exit 2"  2 "--version"      "$ROOT/commands/coolify-install.sh"
+check "coolify: --help exits 0"            0 "usage:"         "$ROOT/commands/coolify-install.sh" --help
+check "coolify: version needs value"       2 "needs a value"  "$ROOT/commands/coolify-install.sh" --version
+check "coolify: unknown flag exits 2"      2 "unknown flag"   "$ROOT/commands/coolify-install.sh" --nope
+if [ "$(id -u)" -ne 0 ]; then
+  check "coolify: refuses non-root"        1 "must run as root" "$ROOT/commands/coolify-install.sh" --version 4.1.2
+else
+  echo "skip: coolify non-root refusal (running as root)"
+fi
+
 echo "---"
 echo "$PASS passed, $FAIL failed"
 [ "$FAIL" -eq 0 ]