updated structure

.claude/worktrees/debian-restructure/proxmox/scripts/create-admin-user.sh

@@ -0,0 +1,43 @@
+#!/bin/bash
+# Create a named PVE admin user (Administrator role) so root@pam can be
+# reserved for emergencies. Generates a random initial password, printed
+# once - change it and enable TOTP on first login (Datacenter -> Permissions
+# -> Two Factor, or the user icon menu in the top right).
+#
+# Idempotent - if the user already exists, does nothing (won't reset an
+# existing password). Run as root on the PVE host.
+#
+# Usage: ./create-admin-user.sh <username>   (realm is always @pve)
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=lib/common.sh
+source "${SCRIPT_DIR}/lib/common.sh"
+require_root
+
+USERNAME="${1:-}"
+if [ -z "$USERNAME" ]; then
+    echo "Usage: $0 <username>" >&2
+    exit 1
+fi
+
+USERID="${USERNAME}@pve"
+
+if pveum user list --output-format json 2>/dev/null | grep -q "\"${USERID}\""; then
+    echo "${USERID} already exists - not touching password or role. Skipping."
+    exit 0
+fi
+
+PASSWORD="$(openssl rand -base64 24)"
+
+pveum user add "$USERID" --password "$PASSWORD" --comment "Named admin account, created by create-admin-user.sh"
+pveum acl modify / --users "$USERID" --roles Administrator
+
+echo
+echo "Created ${USERID} with the Administrator role."
+echo "Initial password (shown once - not logged anywhere): ${PASSWORD}"
+echo
+echo "Next steps (do these before relying on this account):"
+echo "  1. Log in as ${USERID} and change the password."
+echo "  2. Enable TOTP/2FA for ${USERID} (and for root@pam)."
+echo "  3. Reserve root@pam for emergencies only from here on."