VM's: run first-boot units without debconf dialogs

docs/vm.md

@@ -54,7 +54,7 @@ same functions on either host. Nothing in it calls `qm` or `incus`.
 | `vm_customize <label> <image> <virt-customize args>...` | A script's own image step. Warns with libguestfs' reason like the shared preparation steps, and returns non-zero so a required step can stop the run. |
 | `vm_release_asset <github\|gitlab\|codeberg> <owner/repo> <asset regex> [tag]` | Resolves a release through [`lib/forge.func`](../lib/forge.func) — tokens, rate limits and the API-less GitHub fallback included. Sets `VM_RELEASE_TAG`, `VM_RELEASE_VERSION`, `VM_RELEASE_ASSET`, `VM_RELEASE_URL` and, from GitHub's asset digest, `VM_RELEASE_SHA256`. |
 | `vm_latest_from_index <url> <pcre> [--sort-by <pcre>] [--probe <url with {}>]...` | Newest match on an HTML download index (`grep -oP`, so `\K` works). `--sort-by` orders by part of the match; each `--probe` template is tried newest first and the first answering URL wins. Sets `VM_INDEX_LATEST` and `VM_INDEX_URL`. Never falls back to a hardcoded release. |
-| `vm_firstboot_unit <image> <name> <script> [--description …] [--after <unit>]... [--requires-path <path>] [--cloud-init yes\|no]` | Stages `<script>` as `/usr/local/sbin/<name>` plus a run-once `<name>.service`. The marker `/var/lib/community-scripts/<name>.done` (`VM_FIRSTBOOT_MARKER`) is written only after success, so a failure is retried on the next boot. With Cloud-Init the unit is wanted by `cloud-init.target` and ordered after `cloud-final.service`; wanting `multi-user.target` there would create an ordering cycle. |
+| `vm_firstboot_unit <image> <name> <script> [--description …] [--after <unit>]... [--requires-path <path>] [--cloud-init yes\|no]` | Stages `<script>` as `/usr/local/sbin/<name>` plus a run-once `<name>.service`. The marker `/var/lib/community-scripts/<name>.done` (`VM_FIRSTBOOT_MARKER`) is written only after success, so a failure is retried on the next boot. With Cloud-Init the unit is wanted by `cloud-init.target` and ordered after `cloud-final.service`; wanting `multi-user.target` there would create an ordering cycle. The unit runs with `DEBIAN_FRONTEND=noninteractive` and needrestart in automatic mode, so apt in the script cannot draw a dialog on the console. |
 | `vm_wait_http <url> [timeout] [--insecure]` | Succeeds on any 2xx/3xx, or 401/403 from a login page. |
 | `vm_print_summary ["Label=value"]...`, `vm_next_steps <step>...`, `vm_finish [message]` | The standard closing block: VM ID, hostname, resources, state and `VM_IP`, extra rows, numbered next steps, then the `done` telemetry and the completion message. |
 

tests/vm-helpers.sh

@@ -489,6 +489,7 @@ assert_contains "$UNIT" "ConditionPathExists=/opt/app.bin"
 assert_contains "$UNIT" "ExecStart=/usr/local/sbin/app-setup"
 assert_contains "$UNIT" "touch /var/lib/community-scripts/app-setup.done"
 assert_contains "$UNIT" "Type=oneshot"
+assert_contains "$UNIT" "Environment=DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a NEEDRESTART_SUSPEND=1"
 assert_contains "$UNIT" "Description=App setup"
 assert_contains "$LOG" "--chmod 0755:/usr/local/sbin/app-setup"
 assert_contains "$LOG" "--run-command systemctl enable app-setup.service"

vm/common.func

@@ -300,6 +300,7 @@ vm_firstboot_unit() {
     [[ -n "$requires_path" ]] && printf 'ConditionPathExists=%s\n' "$requires_path"
     printf '\n[Service]\n'
     printf 'Type=oneshot\n'
+    printf 'Environment=DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=a NEEDRESTART_SUSPEND=1\n'
     printf 'ExecStart=/usr/local/sbin/%s\n' "$name"
     printf "ExecStartPost=/bin/sh -c 'mkdir -p /var/lib/community-scripts && touch %s'\n" "$marker"
     printf 'RemainAfterExit=yes\n'