@startuml

'Actors
actor Customer
actor Agent as "Agent (public)"
actor Ticketing as "Ticketing (public)"
actor Accounting as "Accounting (private)"
actor NETSetup as "NETSetup (private)"
actor Supplier as "Supplier (Alltron)"
actor Provider as "Provider (Dropbox)"
actor Computer
actor SWVendor as "Software Vendor (Microsoft)"
actor HWVendor as "Hardware Vendor (HP)"

'Contact
Customer -> Agent: [[https://github.com/osisa/NETSetup/blob/feature/proxmoxvms/docs/NETSetup/050%20Kontaktaufnahme/Kontaktaufnahme%20V1.1.adoc callAgent() -> new order]]
Agent -> Ticketing: [[https://github.com/osisa/NETSetup/blob/feature/proxmoxvms/docs/NETSetup/050%20Kontaktaufnahme/Ticketverwaltung%20in%20Freshdesk.adoc createNETSetupTicket(order) -> new ticket]]
Ticketing -> Customer: notifyCustomer(ticket)

'Delta
Agent -> Customer: [[https://github.com/osisa/NETSetup/blob/feature/proxmoxvms/docs/NETSetup/100%20Offerte/Offertprozess.adoc#ist-soll-analyse requestCurrentMode(ticket)]] -> ensureConfig(ticket.customer.currentMode)[[https://github.com/osisa/NETSetup/blob/feature/proxmoxvms/docs/Templates/TemplateCompany.adoc Template Company]] [[https://github.com/osisa/NETSetup/tree/feature/proxmoxvms/src/NETSetup.Tests/TestInfrastructure/OfflineCompany.cs Example Code]]
Customer -> Agent: responseCurrentMode(ticket) -> updateConfig(updatedCurrentMode)
Agent -> Customer: requestFutureMode(updatedCurrentMode.config)
Customer -> Agent: responseFutureMode(updatedCurrentMode.config) -> futureMode.config

'Quote
Agent -> Accounting: [[https://github.com/osisa/NETSetup/blob/feature/proxmoxvms/docs/NETSetup/100%20Offerte/Offertprozess.adoc#offerterstellung createQuote(updatedCurrentMode.config, futureMode.config) -> new quote]]
Accounting -> Agent: returnQuote(quote)
Agent -> Customer: sendQuote(quote)
Customer -> Agent: responseQuote(quote)

'Config
Agent -> Supplier: [[https://github.com/osisa/NETSetup/blob/feature/proxmoxvms/docs/NETSetup/230%20Beschaffung/Beschaffung.adoc createOrder(quote) -> new order]]
Supplier -> Agent: return order.Success
Agent -> NETSetup: [[https://github.com/osisa/NETSetup/tree/feature/proxmoxvms/src/NETSetup.Tests/Customers/TranslateCompanyToConfig.cs createConfigs(ticket, futureMode.config)]] -> new config[]
note over Agent, NETSetup: someConfig[] = { {HASTAG}ticket.json, ... }
NETSetup -> Provider: [[https://www.dropbox.com/home/NETSetup/BOOT/Config save config() ]]
Provider -> NETSetup: return save.Success
NETSetup -> Agent: return save.Success

newpage Old Prerequisite Steps
Supplier -> Agent: return order.HardwareHashes
Agent -> NETSetup: TODO: updateConfigs(ticket, hardwareHashes)
NETSetup -> Provider: TODO: updateConfigs(ticket, hardwareHashes)
Provider -> NETSetup: return update.Success
NETSetup -> Agent: return update.Success
Supplier -> Customer: [[https://github.com/osisa/NETSetup/blob/develop/docs/NETSetup/300%20Auslieferung/Auslieferung.adoc deliverOrder(setup)]]
Agent -> NETSetup: [[https://github.com/osisa/NETSetup/tree/feature/proxmoxvms/input/NETSetupInstallUSB.adoc#NS-INSTALL-USB-CREATE-STICK Create NETSetup USB Stick]]
NETSetup -> Agent: NETSetup ready USB Stick

'Installation
loop For every computer
    Agent -> Computer: [[https://github.com/osisa/NETSetup/tree/feature/proxmoxvms/input/NETSetupInstall.adoc#NS-INSTALL-USB-USE-STICK plugIn(Power, USB Stick, Display, Keyboard)]]
    Agent -> Computer: turnOn()
    Agent -> Computer: hold(F9 or other key to get into Boot Menu)
    Agent -> Computer: select(USB Stick)

newpage NETSetup Setup Process - Boot Phase 1: USB Boot into WinPE

    == PHASE 1: UEFI Firmware + WinPE (runs from USB stick) ==
    note over Computer: UEFI firmware is running.\n**Proxmox installs require TWO USB sticks PRE-FLASHED WITH RUFUS (each >= 16 GB):**\n  USB #1 (NETSetup/WinPE, Rufus: Partitionsschema GPT, Zielsystem UEFI, NTFS):\n    Partition 1: FAT32 ESP — Windows Boot Manager + WinPE boot files\n    Partition 2: NTFS (label=DATA) — WinPE boot.wim, NETSetup\n  USB #2 (Proxmox installer, Rufus: DD image mode from proxmox.iso):\n    Unmodified Proxmox hybrid ISO layout (ESP + iso9660).\n    NETSetup does NOT touch USB #2 — it is booted as-is by the agent\n    after WinPE finishes writing the answer.toml to USB #1.\n**Agent boots USB #1 first; after WinPE prep + reboot, agent boots USB #2.**
    Computer -> Computer: UEFI firmware loads Windows Boot Manager from USB ESP (Secure Boot OK)
    alt Can boot NTFS Partition
        Computer -> Computer: Boots WinPE from NTFS Partition on USB
    else Lacks NTFS Driver
        Computer -> Computer: Boots FAT32 NTFS Driver from USB
        Computer -> Computer: Boots WinPE from NTFS Partition on USB
    end
    note over Computer: WinPE is now running from USB RAM disk.\nProcess: startnet.cmd -> autoexecute.ps1 -> NETSetup.exe
    Computer -> Computer: WinPE runs startnet.cmd
    Computer -> Computer: startnet.cmd searches every drive for autoexecute.ps1
    Computer -> Computer: cd to drive and run autoexecute.ps1
    Computer -> NETSetup: autoexecute.ps1 runs [[https://github.com/osisa/NETSetup/tree/feature/proxmoxvms/src/NETSetup/CLI/Commands/InstallCommand.cs NETSetup.exe install]]
    note over NETSetup: [[https://github.com/osisa/NETSetup/tree/feature/proxmoxvms/src/NETSetup/CLI/Commands/InstallCommand.cs InstallCommand.cs]]\nhost = NETSetup.GetSystemHost()\nhost.OperatingSystem, host.ExitIfNotElevated()\nconfig = ConfigMethods.GetConfig(host, services, ticket, hostname)\nBranches on host.IsOnWinPE() -> [[https://github.com/osisa/NETSetup/tree/feature/proxmoxvms/src/NETSetup/Stages/2-WinPE/MainWinPE.cs MainWinPE.InstallOperatingSystem(cli, config, host)]]
    NETSetup -> Computer: host = GetSystemHost() — ISystemHost with Hardware, Logger, OperatingSystem
    NETSetup -> Computer: logs NETSetup Version, host.OperatingSystem
    NETSetup -> Computer: host.ExitIfNotElevated()
    NETSetup -> Computer: config = ConfigMethods.GetConfig(host, services, ticket, hostname)
    opt ConfigMethods.GetConfig()
        NETSetup -> Computer: host.Hardware.SerialNumber
        NETSetup -> Computer: online = CheckOnline(timeout 10s)
        alt online
            NETSetup -> Computer: check for online map file
            note over Agent, NETSetup: foreach machine in config a map file. Nomenclature: SerialNumber#Ticket.json
            NETSetup -> Computer: download map file
            NETSetup -> Computer: check for single matching map file
        end
        NETSetup -> Computer: if no map file found online -> check local map files as fallback (covers USB stick with embedded map file)
        NETSetup -> Computer: if no disks or not online -> try to install drivers
        NETSetup -> Computer: if nothing is found, but there are configs locally -> UI select which
    end

    NETSetup -> Computer: computer = config.IdentifyHost(host).CastTo<Computer>()

    alt operatingSystem is Windows (target)

newpage NETSetup Setup Process - Windows Install Path

        == PHASE 1 continued: WinPE prepares Windows installation (DISM /Apply-Image) ==
        note over NETSetup: [[https://github.com/osisa/NETSetup/tree/feature/proxmoxvms/src/NETSetup/Stages/2-WinPE/MainWinPE.cs MainWinPE]] Windows branch\nsetup.exe replaced with DISM /Apply-Image (setup.exe fails on Win11 25H2).
        NETSetup -> Computer: unattended = [[https://github.com/osisa/NETSetup/tree/feature/proxmoxvms/src/NETSetup/Stages/2-WinPE/S4WindowsUnattended.cs GetDismUnattendedFileSubPath(host, config, computer)]]
        note over NETSetup: **Image resolution BEFORE wiping install disk:**\nbootRoot = Path.GetFullPath("/") — boot medium root (startnet.cmd cd'd here).\nif <bootRoot>\\NETSetup\\Images\\<OS>\\ exists → prebuilt offline ISO path, no download.\nelse if !isOnline → ExitFailure.\nelse → mark imagesNetsetup = W:\\NETSetup (download after partitioning).\nThe broken pre-clear copy to Z:\\ was removed — Z: lives on the install disk and\ngets wiped by Clear() a few lines below, so anything staged there would be lost.
        NETSetup -> Computer: installationDisk.Clear(GPT) + AddPartitions(S: ESP 1000 MB, W: remaining)
        opt image was NOT prebuilt on boot medium
            NETSetup -> Computer: [[https://github.com/osisa/NETSetup/tree/feature/proxmoxvms/src/NETSetup/Stages/2-WinPE/S2Images.cs S2Images.EnsureImageElseExit(services, host, computer, isOnline, W:\\NETSetup)]]\nDownloads <OS>.7z from Dropbox + sha256 sidecar, extracts to W:\\NETSetup\\Images\\<OS>\\.
        end
        NETSetup -> Computer: wimPath = imagesNetsetup\\Images\\<OS>\\sources\\install.wim (verified with FileExists)
        NETSetup -> Computer: [[https://github.com/osisa/NETSetup/tree/feature/proxmoxvms/src/NETSetup/Stages/2-WinPE/DismCommand.cs DismCommand.ApplyImage(wimPath, imageName, W:)]] — 60 min timeout
        NETSetup -> Computer: [[https://github.com/osisa/NETSetup/tree/feature/proxmoxvms/src/NETSetup/Stages/2-WinPE/BcdbootCommand.cs bcdboot W:\\Windows /s S: /f UEFI]] — bcdboot from applied image, not WinPE's
        NETSetup -> Computer: Copy unattend.xml → W:\\Windows\\Panther\\unattend.xml
        NETSetup -> Computer: Copy NETSetup folder → W:\\NETSetup (excludes Images, Logs)
        NETSetup -> Computer: Reboot()

        == PHASE 2: Windows Setup (runs from target disk) ==
        note over Computer: Windows installer is running from target disk.\nNo USB needed anymore. WinPE is gone.
        Computer -> Computer: UEFI boots Windows Setup from installationDisk
        Computer -> Computer: Windows auto setup via unattend.xml
        Computer -> Computer: Unattend adds scheduled task: run NETSetup on first login
        Computer -> Computer: Reboot()

        == PHASE 3: Windows + NETSetup (runs from target disk) ==
        note over Computer: Full Windows is running.\nScheduled task launches NETSetup.exe install.\nInstallCommand detects host.IsOnWindows() && host.HasNETSetup()\n-> [[https://github.com/osisa/NETSetup/tree/feature/proxmoxvms/src/NETSetup/Stages/3-NETSetupWindows/Stage3Windows.cs Stage3Windows.InstallNETSetupWindows()]]
        Computer -> Computer: Boots Windows from installationDisk
        Computer -> NETSetup: Scheduled Task runs NETSetup.exe install
        NETSetup -> Computer: computer = config.IdentifyHost(host).CastTo<Computer>()
        NETSetup -> Computer: CheckOnline(), EnsureOnlineIfNeededAskForWifi()
        NETSetup -> Computer: PowerSettings: Disable screen timeout and sleep (powercfg)
        NETSetup -> Computer: InstallChocolatey() (needed for HP updates)
        NETSetup -> Computer: TryGetDrivers() from remote source + TryInstallDrivers()
        opt computer is on Proxmox
            NETSetup -> Computer: Install VirtIO drivers via pnputil + disable WU driver search
            NETSetup -> Computer: Install QEMU Guest Agent
        end
        opt computer is HP (host.IsOnHP())
            NETSetup -> Computer: HPUpdateHelper.UpdateHPMachine() — install HP Support Assistant via choco, run silent driver/firmware/BIOS update -> Reboot
        end
        alt computer is WindowsServer
            NETSetup -> Computer: SetIPv4Configuration(staticIP)
            NETSetup -> Computer: InstallADForest() -> Reboot
            NETSetup -> Computer: ConfigureDNSServer()
            NETSetup -> Computer: InstallDHCPServer() -> Reboot
            NETSetup -> Computer: DisableDHCPServer()
            NETSetup -> Computer: Enable Remote Desktop
            NETSetup -> Computer: WinFirewall configuration
            NETSetup -> Computer: Enable Wake-on-LAN
            NETSetup -> Computer: Set Wallpaper
            NETSetup -> Computer: net start netlogon
            NETSetup -> Computer: dcdiag /test:dns + dcdiag
            NETSetup -> Computer: Create AD Users + Groups
            NETSetup -> Computer: Deactivate Default Administrator
            NETSetup -> Computer: Finished DC Setup -> Reboot
            NETSetup -> Computer: RunUpdate (choco upgrade, software install, Windows Update) -> Reboot
        else computer is WindowsComputer (Client)
            NETSetup -> Computer: Enable FullDomainDNSRegistration
            NETSetup -> Computer: Set all networks to Private
            NETSetup -> Computer: Enable Remote Desktop
            NETSetup -> Computer: WinFirewall configuration
            NETSetup -> Computer: Enable Wake-on-LAN
            NETSetup -> Computer: DomainJoin(config.Domain) -> Reboot
            NETSetup -> Computer: Set Wallpaper
            NETSetup -> Computer: gpupdate /force
            NETSetup -> Computer: RunUpdate (choco upgrade, software install, Windows Update) -> Reboot
        end

    else operatingSystem is Linux (target)

newpage NETSetup Setup Process - Linux/Proxmox: WinPE prepares USB

        == PHASE 1 continued: WinPE prepares USB stick for Linux boot ==
        note over NETSetup: [[https://github.com/osisa/NETSetup/tree/feature/proxmoxvms/src/NETSetup/Stages/2-WinPE/MainWinPE.cs MainWinPE]] Linux branch.\nStill running in WinPE from USB RAM disk.\n**Target disk is NOT touched. Everything stays on USB #1.**

        alt operatingSystem is Proxmox

            note over NETSetup: **New architecture (single-USB prep):**\nNETSetup does NOT touch USB #2 at all.\nUSB #2 is a plain Rufus-flashed Proxmox installer stick that the agent\nbrought with them. NETSetup only modifies USB #1 by adding a small FAT32\nSYSTEM partition that holds the generated answer.toml.\nproxmox-fetch-answer will scan *all* attached partitions (including USB #1)\nby label, so answer.toml living on USB #1 still reaches the installer running\nfrom USB #2.

            NETSetup -> Computer: FindBootDiskNumber(host) — resolve USB #1 disk number from AppContext.BaseDirectory drive letter
            NETSetup -> Computer: UsbLinuxPartitionManager.EnsureUsbDataPartition(usbDiskNumber, 100 MB, label=SYSTEM, fs=fat32, assignDriveLetter=true)
            note over Computer: **On USB #1 (the booted NETSetup stick):**\n  1. Find largest partition (NTFS DATA partition 2)\n  2. Shrink it via diskpart (current - 100 MB)\n  3. Create new primary partition in freed space\n  4. Format FAT32 with label SYSTEM\n  5. Add-PartitionAccessPath -AssignDriveLetter -> first free letter\nIdempotent: if SYSTEM already exists, re-uses it and just re-assigns a letter.
            NETSetup -> Computer: netSetupConfig.ToProxmoxAutoInstall(host, liberator, setStaticNetworkConfiguration: true).WriteTomlFile({letter}:\answer.toml)
            note over Computer: answer.toml lives at {assignedLetter}:\answer.toml on USB #1 SYSTEM (FAT32).\nPath + full TOML content are logged via LogDebugToFile("WinPE_Proxmox_AnswerToml").
            NETSetup -> Agent: UserInteraction.AskRebootNow("You will need to boot from Proxmox USB Stick now...")
            note over Agent: **Agent must now reboot and pick USB #2 (Proxmox) from the boot menu**\n(NETSetup cannot force this — USB #1 is still the default boot device).\nUSB #1 stays plugged in so proxmox-fetch-answer can find SYSTEM:/answer.toml.

        else other Linux (NixOS, etc.)
            note over Computer: VoidPE stays on USB NTFS (not overwritten).\nWinPE writes linux config to SYSTEM partition.
            NETSetup -> Computer: Write linux config file to SYSTEM:\config
        end

        NETSetup -> Computer: ExitReboot()
        note over Computer: **USB #1 layout after WinPE prep (Proxmox case):**\n  Partition 1: FAT32 ESP (unchanged)\n  Partition 2: NTFS DATA (shrunk by 100 MB)\n  Partition 3: FAT32 SYSTEM — answer.toml\n**USB #2 is completely unchanged** (still a plain Rufus-flashed Proxmox ISO).\nTarget disk is completely untouched.

newpage NETSetup Setup Process - Boot Phase 2: Agent boots Proxmox USB

        == PHASE 2: Agent reboots and selects USB #2 (Proxmox) from boot menu ==
        Agent -> Computer: Power-cycle; hold F9 (or equivalent) to open UEFI boot menu
        Agent -> Computer: Select USB #2 "Proxmox" entry (NOT USB #1)
        note over Computer: **USB #1 stays plugged in** — proxmox-fetch-answer will scan all attached\npartitions (by label) and find SYSTEM:answer.toml on USB #1.\nSecure Boot must be OFF (Proxmox GRUBX64.EFI is not signed for SB).\nThe agent already disabled SB in BIOS before deployment.
        Computer -> Computer: UEFI loads Proxmox shim BOOTX64.EFI from USB #2 ESP (unmodified Rufus flash)
        Computer -> Computer: Proxmox shim loads GRUBX64.EFI, which loads the stock Proxmox GRUB.CFG from USB #2

        alt operatingSystem is Proxmox

            Computer -> Computer: Stock Proxmox GRUB menu appears — agent selects "Install Proxmox VE (Automated)"
            note over Computer: **No custom GRUB.CFG** — USB #2 is a plain Rufus-flashed Proxmox ISO.\nAgent picks the stock "Automated" entry manually, which passes\nproxmox-start-auto-installer to the kernel.
            Computer -> Computer: GRUB loads Proxmox kernel+initrd from USB #2 iso9660 partition

newpage NETSetup Setup Process - Phase 2 continued: Proxmox auto-installer

            == PHASE 2 continued: Proxmox auto-installer ==
            Computer -> Computer: Kernel boots, normal Proxmox /init runs
            Computer -> Computer: /init mounts squashfs (pve-base.squashfs, pve-installer.squashfs)
            Computer -> Computer: Creates overlayfs, switch_root -> /sbin/unconfigured.sh
            Computer -> Computer: proxmox-start-auto-installer triggers proxmox-auto-installer
            Computer -> Computer: proxmox-fetch-answer scans all attached partitions for answer.toml
            note over Computer: proxmox-fetch-answer uses blkid to scan every attached partition and reads\nthe first one containing answer.toml.\nFinds **USB #1 partition 3 (SYSTEM, FAT32, written by WinPE)**.\nUSB #1 must still be plugged in at boot time — agent keeps both sticks attached\nuntil the installer has read the answer.
            Computer -> Computer: Auto-installer partitions TARGET DISK, installs Proxmox
            note over Computer: Target disk touched for the FIRST TIME here.\nAuto-installer: sgdisk, mkfs, LVM, debootstrap.\nConfigures network, hostname, root password from answer.toml.\nBoth USB sticks stay completely intact.
            Computer -> Computer: Reboot into installed Proxmox

        else other Linux (VoidPE path)

            Computer -> Computer: GRUB selects "NETSetup VoidPE" entry
            Computer -> Computer: GRUB loads VoidPE kernel+initrd from LINUX partition
            note over Computer: VoidPE boots from USB LINUX partition.\ndracut live module finds squashfs on LABEL=LINUX.\nOverlayfs rootfs. /etc/rc.local runs NETSetup.
            Computer -> NETSetup: NETSetup.exe install (Stage4LinuxPE)
            NETSetup -> Computer: Partition target drive, format, unpack image
            NETSetup -> Computer: Update boot entry (GRUB/EFI), reboot into installed Linux

        end

newpage NETSetup Setup Process - Phase 3: Proxmox Host Creates VMs

        == PHASE 3: Proxmox Host + NETSetup (runs ON installed Proxmox) ==
        note over Computer: Proxmox VE is now installed and running.\n[[https://github.com/osisa/NETSetup/tree/feature/proxmoxvms/src/NETSetup/Resources/netsetup-first-boot.sh netsetup-first-boot.sh]] (USB-only install, no network fallback):\n  0. **Log-exists gate** — if /NETSetup/first-boot.log exists → exit (idempotent)\n  1. Restore Windows Boot Manager on USB ESP (bootmgfw.efi.bak → BOOTX64.EFI)\n  2. Mount SYSTEM partition (label=SYSTEM, FAT32 on USB #1)\n  3. cp -p NETSetup binary from /mnt/system/NETSetup/NETSetup → /NETSetup/NETSetup (preserves mtime)\n  4. cp -r config files from /mnt/system/NETSetup/Config → /NETSetup/Config\n  5. Install systemd service + timer (OnBootSec=2min, OnUnitActiveSec=6h, Persistent=true)\n  6. systemctl enable netsetup.timer (**NOT --now** — fires only after reboot)\n  7. **systemctl reboot** (scheduled +5s so first-boot unit exits cleanly)\n**No inline `netsetup update`** — network flaky during first-boot (DNS/403 on GitHub).\nBinary handles self-update via GitHub Releases API on every update cycle (see 3a).
        Computer -> Computer: First-boot service runs (from Proxmox ISO, ordering=fully-up)
        Computer -> Computer: Restore USB ESP boot manager (so USB is reusable)
        Computer -> Computer: Mount SYSTEM partition → cp NETSetup binary + Config locally
        Computer -> Computer: systemctl enable netsetup.timer (timer armed, NOT fired)
        Computer -> Computer: **Reboot** — clean boot, full network, then timer fires
        note over Computer: **After reboot**, systemd timer fires 2 min in (Persistent=true catches missed runs).\nOn **every subsequent boot** the timer also re-fires `netsetup update`.
        Computer -> NETSetup: systemd timer → ExecStart=/NETSetup/NETSetup update

        note over NETSetup: [[https://github.com/osisa/NETSetup/tree/feature/proxmoxvms/src/NETSetup/CLI/Commands/UpdateCommands.cs UpdateCommands.cs]] → [[https://github.com/osisa/NETSetup/tree/feature/proxmoxvms/src/NETSetup/Helpers/UpdateMethods.cs UpdateMethods.RunUpdate]]\nDetermineUpdateStage(host) → host.IsProxmoxHost() → RunProxmoxUpdate.\nEvery step is a discrete NETCommand call so individual failures stay scoped\nand surface in the C# log (no monolithic shell scripts).

        == PHASE 3a: Self-Update via GitHub Releases ==
        note over NETSetup: [[https://github.com/osisa/NETSetup/tree/feature/proxmoxvms/src/NETSetup/Helpers/UpdateMethods.cs EnsureLatestBinaryOrReexec]] — runs FIRST, before anything else:\n  1. Decrypt embedded GitHub PAT via osisa.Security.Contracts.EncryptionHelper\n     (AES-256-CBC, PBKDF2-SHA1, baked-in ciphertext invisible to strings(1))\n  2. curl GET /repos/osisa/netsetup/releases/latest with Bearer token\n  3. ParseReleaseInfo → (version, assetId)\n  4. CompareSemVer(local, remote) — same major.minor.patch ⇒ trailing build counter wins\n  5. Remote newer → curl /releases/assets/{id} (Accept: application/octet-stream),\n     mv -f → /NETSetup/NETSetup, chmod 755, spawn child `NETSetup update`,\n     Environment.Exit(child.IsSuccess ? 0 : 1) — re-execs into the new binary
        NETSetup -> Computer: Decrypt embedded PAT (Contents:Read on osisa/netsetup only)
        NETSetup -> Computer: curl /releases/latest → ParseReleaseInfo
        alt remoteSemVer > localSemVer
            NETSetup -> Computer: Download asset by id → mv -f → chmod 755
            NETSetup -> NETSetup: Spawn `/NETSetup/NETSetup update`, wait, Environment.Exit
            note over NETSetup: Re-execed into the new binary; rest of this cycle runs there.
        else equal or older
            NETSetup -> Computer: Continue with current binary
        end

        == PHASE 3b: EnsureProxmoxPostInstall (once-only, LogFileExists-gated) ==
        note over NETSetup: **Log-file gate** mirrors Windows Stage3 pattern:\n  `if (!host.Logger.LogFileExists("ProxmoxPostInstall"))` → run + LogInformationToFile → **reboot + Environment.Exit(0)**\n  → next boot the log exists → skip → continue with 3c.\nEach helper = one discrete NETCommand or IFileOperator call:\n  - DisableEnterpriseListRepos (PVE 8 .list — sed in-place)\n  - DisableEnterpriseDeb822Repos (PVE 9 .sources — fileop read+write)\n  - EnsureNoSubscriptionRepo (pveversion → write .list or .sources)\n  - InstallNagRemovalHook (write hook + apt post-invoke + chmod + run once)\n  - ConfigureBanners (clear /etc/motd + systemctl disable pvebanner + write /etc/issue with detected IP)
        alt /NETSetup/Logs/ProxmoxPostInstall.log missing (FIRST run)
            NETSetup -> Computer: EnsureProxmoxPostInstall (repos, nag, banners)
            NETSetup -> Computer: LogInformationToFile("ProxmoxPostInstall", ...) — writes gate marker
            NETSetup -> Computer: systemctl reboot + Environment.Exit(0) — rest of cycle skipped
            note over Computer: **Next boot** the timer re-fires `netsetup update`.\nlog exists → post-install skipped → continues with 3c-3e below.
        else log exists (subsequent runs)
            NETSetup -> Computer: log "skipping post-install, continuing update" — falls through to 3c
        end

        == PHASE 3c: apt update + full-upgrade ==
        NETSetup -> Computer: apt update (only succeeds AFTER enterprise repos disabled in 3b)
        NETSetup -> Computer: env DEBIAN_FRONTEND=noninteractive apt full-upgrade -y

        == PHASE 3d: EnsureCustomerVms ==
        note over NETSetup: [[https://github.com/osisa/NETSetup/tree/feature/proxmoxvms/src/NETSetup/Helpers/EnsureCustomerVms.cs EnsureCustomerVms.Run]] orchestrates VM provisioning per host:\n  1. orderedVms = [[https://github.com/osisa/NETSetup/tree/feature/proxmoxvms/src/NETSetup/Stages/5-NETSetupLinux/CreateVirtualMachines.cs GetOrderedVmsForHost]](config, host.SerialNumber)\n     — IsForHost matches serial format `<VMID>@<HostSerial>`\n     — VirtualHyperVTestBase.EnsureVirtualMachineSerialNumber rewires every hosted VM's\n       suffix to the real BIOS serial of the test host before publishing\n  2. Classify each machine: Nix (OS.NixOS / OS.Nix*) | Windows (Win10/11/Server) | Skip\n  3. If any Nix → EnsureNixosIsoOnProxmoxHost (sha256-driven 7z sync from Dropbox)\n  4. Per-VM dispatch with fault isolation:\n     - Nix → ProvisionNixosVm.Run (NixHostTemplate via NixTemplateFactory)\n     - Windows → ProvisionWindowsVmOnProxmox.Run (offline production ISO + answer.toml)
        NETSetup -> Computer: EnsureCustomerVms.Run(host, config, services)
        loop For each customer VM (DC first via WindowsServer ordering)
            alt Nix-backed (e.g. Nextcloud → NixGenericTemplate, NixNextcloud → NixNextcloudTemplate)
                NETSetup -> Computer: ProvisionNixosVm.Run — emits flake.nix + hardware.nix + default.nix, qm create, install.sh over SSH
            else Windows
                NETSetup -> Computer: ProvisionWindowsVmOnProxmox.Run — MainISO.CreateOfflineProductionISO, qm create, attach
            else Skip
                NETSetup -> Computer: log "OS not classified for provisioning" — continue
            end
        end

        == PHASE 3e: btrfs scrub ==
        NETSetup -> Computer: For each mounted btrfs filesystem → btrfs scrub start -B
        note over Computer: systemd timer re-fires netsetup.service every 6h **and on every boot** (OnBootSec=2min).\nPhases 3c/3d/3e run every cycle (apt, VMs, scrub are inherently idempotent).\nPhase 3b runs ONCE (log-gated) and reboots on first run.\nPhase 3a swaps binary only when remote SemVer is strictly greater, logs outcome either way.

    end
end

newpage Approval and Billing
Agent -> Customer: [[https://github.com/osisa/NETSetup/tree/develop/docs/NETSetup/400%20Abnahme config.CreateApprovalForm())]]
Customer -> Agent: fillOut(config.approvalForm)
Agent -> Accounting: [[https://github.com/osisa/NETSetup/blob/develop/docs/Infobl%C3%A4tter/Software/Sage/Sage%20Start/Softwareinfoblatt%20Sage%20Start.adoc commissionBill(config)]]
Accounting -> Agent: returnBill(config.bill)
Agent -> Customer: sendBill(config.bill)
Customer -> Accounting: payBill(config.bill)
Accounting -> Agent: notify(config.bill.paid)
Agent -> Ticketing: closeTicket()

@enduml