Installer: interactive cell identity prompts with live token validation

install.sh now guides the user through the full identity setup before
running make install:
- Cell name prompt with format validation and pic.ngo availability check
- Domain mode selection: pic.ngo / Cloudflare / DuckDNS / HTTP-01 / LAN
- Cloudflare API token: collected and verified against CF tokens/verify API
- DuckDNS: subdomain + token verified against duckdns.org/update
- HTTP-01: domain name collected, port-80 warning shown
- All collected values passed as env vars to make install
- After two failed token attempts user can continue (re-verified at boot)
- Final banner shows configured cell name and domain

setup_cell.py: updated to handle all domain modes
- Reads DOMAIN_MODE / CELL_DOMAIN_NAME / CLOUDFLARE_API_TOKEN /
  DUCKDNS_TOKEN / DUCKDNS_SUBDOMAIN from env
- write_cell_config() now writes domain_mode + domain_name to _identity
  and builds the ddns section for each provider (not hardcoded to pic_ngo)
- register_with_ddns() only called when DOMAIN_MODE == 'pic_ngo'

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/setup_cell.py

@@ -169,7 +169,8 @@ def write_wg0_conf(private_key: str, address: str, port: int):
     print(f'[CREATED] config/wireguard/wg0.conf  address={address}  port={port}')
 
 
-def write_cell_config(cell_name: str, domain: str, port: int):
+def write_cell_config(cell_name: str, domain: str, port: int,
+                      domain_mode: str, domain_name: str) -> None:
     cfg_path = os.path.join(ROOT, 'config', 'api', 'cell_config.json')
     if os.path.exists(cfg_path):
         try:
@@ -179,23 +180,46 @@ def write_cell_config(cell_name: str, domain: str, port: int):
                 return
         except Exception:
             pass
-    config = {
-        '_identity': {
-            'cell_name': cell_name,
-            'domain': domain,
-            'ip_range': '172.20.0.0/16',
-            'wireguard_port': port,
-        },
-        'ddns': {
+
+    ddns: dict = {}
+    if domain_mode == 'pic_ngo':
+        ddns = {
             'provider': 'pic_ngo',
             'api_base_url': DDNS_URL.replace('/api/v1', ''),
             'totp_secret': DDNS_TOTP_SECRET,
             'enabled': True,
+        }
+    elif domain_mode == 'cloudflare':
+        ddns = {'provider': 'cloudflare', 'enabled': True}
+        if CLOUDFLARE_TOKEN:
+            ddns['api_token'] = CLOUDFLARE_TOKEN
+    elif domain_mode == 'duckdns':
+        ddns = {'provider': 'duckdns', 'enabled': True}
+        if DUCKDNS_TOKEN:
+            ddns['token'] = DUCKDNS_TOKEN
+        if DUCKDNS_SUBDOMAIN:
+            ddns['subdomain'] = DUCKDNS_SUBDOMAIN
+    elif domain_mode == 'http01':
+        ddns = {'provider': 'http01', 'enabled': True}
+    else:  # lan
+        ddns = {'provider': 'none', 'enabled': False}
+
+    config = {
+        '_identity': {
+            'cell_name': cell_name,
+            'domain': domain,
+            'domain_mode': domain_mode,
+            'domain_name': domain_name,
+            'ip_range': '172.20.0.0/16',
+            'wireguard_port': port,
         },
+        'ddns': ddns,
     }
     with open(cfg_path, 'w') as f:
         json.dump(config, f, indent=2)
-    print(f'[CREATED] config/api/cell_config.json  name={cell_name}  domain={domain}')
+    os.chmod(cfg_path, 0o600)
+    print(f'[CREATED] config/api/cell_config.json  name={cell_name}  mode={domain_mode}'
+          + (f'  domain={domain_name}' if domain_name else ''))
 
 
 def write_compose_env(ip_range: str):
@@ -244,8 +268,13 @@ def ensure_session_secret():
     print('[CREATED] data/api/.session_secret')
 
 
-DDNS_URL = os.environ.get('DDNS_URL', 'https://ddns.pic.ngo/api/v1')
-DDNS_TOTP_SECRET = os.environ.get('DDNS_TOTP_SECRET', 'S6UMA464YIKM74QHXWL5WELDIO3HFZ6K')
+DDNS_URL         = os.environ.get('DDNS_URL',             'https://ddns.pic.ngo/api/v1')
+DDNS_TOTP_SECRET = os.environ.get('DDNS_TOTP_SECRET',    'S6UMA464YIKM74QHXWL5WELDIO3HFZ6K')
+DOMAIN_MODE      = os.environ.get('DOMAIN_MODE',          'pic_ngo')
+CELL_DOMAIN_NAME = os.environ.get('CELL_DOMAIN_NAME',     '')
+CLOUDFLARE_TOKEN = os.environ.get('CLOUDFLARE_API_TOKEN', '')
+DUCKDNS_TOKEN    = os.environ.get('DUCKDNS_TOKEN',        '')
+DUCKDNS_SUBDOMAIN= os.environ.get('DUCKDNS_SUBDOMAIN',   '')
 
 
 def register_with_ddns(cell_name: str) -> None:
@@ -353,15 +382,28 @@ def bootstrap_admin_password():
 
 
 def main():
-    cell_name = os.environ.get('CELL_NAME', 'mycell')
-    domain = os.environ.get('CELL_DOMAIN', 'cell')
+    cell_name   = os.environ.get('CELL_NAME', 'mycell')
+    domain_mode = DOMAIN_MODE  # module-level, read from env
+    domain_name = CELL_DOMAIN_NAME
+
+    # Derive the legacy 'domain' TLD field and fill in domain_name if empty
+    if domain_mode == 'pic_ngo':
+        domain = 'pic.ngo'
+        if not domain_name:
+            domain_name = f'{cell_name}.pic.ngo'
+    elif domain_mode == 'lan':
+        domain = os.environ.get('CELL_DOMAIN', 'cell')
+        domain_name = ''
+    else:
+        # cloudflare / duckdns / http01 — domain_name is the full FQDN
+        domain = domain_name
+
     vpn_address = os.environ.get('VPN_ADDRESS', '10.0.0.1/24')
-    wg_port = int(os.environ.get('WG_PORT', '51820'))
-    # Prefer existing config ip_range over env var so `make setup` is safe to re-run
-    ip_range = os.environ.get('CELL_IP_RANGE') or _read_existing_ip_range() or '172.20.0.0/16'
+    wg_port     = int(os.environ.get('WG_PORT', '51820'))
+    ip_range    = os.environ.get('CELL_IP_RANGE') or _read_existing_ip_range() or '172.20.0.0/16'
 
     print('--- Personal Internet Cell: Setup ---')
-    print(f'    cell={cell_name}  domain={domain}  vpn={vpn_address}  port={wg_port}')
+    print(f'    cell={cell_name}  mode={domain_mode}  domain={domain_name or "(lan)"}  vpn={vpn_address}  port={wg_port}')
     print()
 
     for d in REQUIRED_DIRS:
@@ -372,12 +414,14 @@ def main():
     ensure_caddy_ca_cert()
     priv, _pub = generate_wg_keys()
     write_wg0_conf(priv, vpn_address, wg_port)
-    write_cell_config(cell_name, domain, wg_port)
+    write_cell_config(cell_name, domain, wg_port, domain_mode, domain_name)
     write_compose_env(ip_range)
     write_caddy_config(ip_range, cell_name, domain)
     ensure_session_secret()
     bootstrap_admin_password()
-    register_with_ddns(cell_name)
+
+    if domain_mode == 'pic_ngo':
+        register_with_ddns(cell_name)
 
     print()
     print('--- Setup complete! Run: make start ---')