webui: trim the field tooltips added for the slot rename

Matches b562059 — the fourteen mapping entries added alongside the slot rename
were written before that landed and ran 88-100 chars against a median of 44.

containers/matrix/scripts/matrix_install_hooks.sh

@@ -17,14 +17,28 @@ matrix_install_pre()
     fi
 }
 
-# The homeserver's public host, read back out of the deployed compose after tag
+# The homeserver's public host — the value that becomes server_name.
-# substitution has run. DOMAINSUBNAME_TAG_1 belongs to CFG_MATRIX_PORT_1 (the
+#
-# Synapse router), so this is the host that becomes server_name — deliberately
+# Built from the port arrays and $domain_full that variables_init_app has
-# not $host_setup, which for this two-host app points at Element instead.
+# already put in scope, NOT by reading DOMAINSUBNAME_TAG_1 out of the deployed
+# compose: install_post_compose runs before dockerConfigSetupFileWithData, so at
+# that point the compose still holds raw placeholders.
+#
+# port_subdomains[0] is CFG_MATRIX_PORT_1, the Synapse router — deliberately not
+# $host_setup, which for this two-host app resolves to Element instead. The
+# empty/@/root cases mirror tagsProcessorPortSubdomains so the name computed
+# here and the Traefik rule generated later cannot drift apart.
 _matrixServerName()
 {
-    local app_name="$1"
+    local sub="${port_subdomains[0]}"
-    tagsManagerGetTagContent "$containers_dir$app_name/docker-compose.yml" "DOMAINSUBNAME_TAG_1"
+    [[ -z "$domain_full" ]] && return 1
+    if [[ "$sub" == "@" || "$sub" == "root" ]]; then
+        echo "$domain_full"
+    elif [[ -n "$sub" ]]; then
+        echo "${sub}.${domain_full}"
+    else
+        echo "matrix.${domain_full}"
+    fi
 }
 
 matrix_install_post_compose()

scripts/app/install/app_install.sh

@@ -16,13 +16,22 @@
 #
 # Hook surface — all are `declare -f`-gated, silent no-op when absent:
 #
-#   <slug>_install_pre              before any install work
+#   <slug>_install_pre              before any install work. THE ONE HOOK WHOSE
+#                                   RETURN VALUE COUNTS — return non-zero and
+#                                   the install stops here (see CFG_<APP>_REQUIRES)
 #   <slug>_install_post_setup       after dockerConfigSetupToContainer
 #                                   (install folder + .config exist; compose
 #                                   file not yet written)
-#   <slug>_install_post_compose     after dockerComposeSetupFile
+#   <slug>_install_post_compose     after dockerComposeSetupFile (the compose
-#                                   (docker-compose.yml has been written +
+#                                   TEMPLATE has been copied into place;
-#                                   tag-substituted; container not yet up)
+#                                   container not yet up). NOTE: the tags are
+#                                   NOT substituted yet — IPs, ports and
+#                                   #LIBREPORTAL values are filled later, by
+#                                   dockerConfigSetupFileWithData during
+#                                   dockerComposeUpdateAndStartApp. A hook that
+#                                   needs a settled value must read it from
+#                                   CFG_<APP>_* / the port arrays in scope, not
+#                                   by grepping the deployed compose.
 #   <slug>_install_post_start       after dockerComposeUpdateAndStartApp
 #                                   (container is up; the place for
 #                                   wait-for-ready + post-up API calls)
@@ -39,12 +48,18 @@
 # continues regardless. Use that escape hatch for non-fatal app-specific
 # refinements (rotate a key, patch a yaml after start, etc.).
 
+# Returns the hook's own exit status when it ran, and 0 when no such hook
+# exists. The explicit `return 0` matters: without it an absent hook returns the
+# status of the failed `declare -F` test, i.e. non-zero, and any caller that
+# gates on the result would treat "app has no hook" as "hook failed".
 _appCallHook()
 {
     local hook_name="$1"; shift
     if declare -F "$hook_name" >/dev/null 2>&1; then
         "$hook_name" "$@"
+        return $?
     fi
+    return 0
 }
 
 # Standard "post-start integration" steps. Same for every app. Lives in a
@@ -109,7 +124,15 @@ installApp()
 
     if [[ "$actions" == *[iI]* ]]; then
         isHeader "Install $app_name"
-        _appCallHook "${app_slug}_install_pre" "$app_name"
+        # The ONE hook whose return value is honoured. An app declaring
+        # CFG_<APP>_REQUIRES uses its _install_pre to refuse when a prerequisite
+        # is missing; before this gate existed the refusal printed its reasons
+        # and the install carried straight on, leaving a half-configured app
+        # whose later steps failed for confusing secondary reasons.
+        if ! _appCallHook "${app_slug}_install_pre" "$app_name"; then
+            isError "Install of $app_name stopped — its pre-install checks did not pass."
+            return 1
+        fi
 
         ((menu_number++))
         echo ""

scripts/webui/data/generators/categories/webui_create_app_field_mappings.sh

@@ -466,90 +466,90 @@ PORTEOF
       "category": "general",
       "label": "AdGuard Admin Password",
       "type": "password",
-      "tooltip": "Password for the AdGuard Home admin account (auto-generated; persists across reinstalls)"
+      "tooltip": "AdGuard Home admin password (auto-generated)"
     },
     "GITEA_ADMIN_PASSWORD_1": {
       "category": "general",
       "label": "Gitea Admin Password",
       "type": "password",
-      "tooltip": "Password for the Gitea administrator account (auto-generated; persists across reinstalls)"
+      "tooltip": "Gitea admin account password (auto-generated)"
     },
     "GITEA_METRICS_TOKEN_1": {
       "category": "advanced",
       "label": "Metrics Token",
       "type": "password",
-      "tooltip": "Bearer token Prometheus uses to scrape Gitea's metrics endpoint (auto-generated)",
+      "tooltip": "Bearer token Prometheus scrapes metrics with",
       "advanced": true
     },
     "HEADSCALE_BASIC_AUTH_PASS_1": {
       "category": "general",
       "label": "Basic Auth Password",
       "type": "password",
-      "tooltip": "Password protecting the Headscale endpoint (auto-generated; persists across reinstalls)"
+      "tooltip": "Password protecting the Headscale endpoint"
     },
     "INVIDIOUS_ADMIN_PASSWORD_1": {
       "category": "general",
       "label": "Invidious Admin Password",
       "type": "password",
-      "tooltip": "Password for the Invidious administrator account (auto-generated; persists across reinstalls)"
+      "tooltip": "Invidious admin account password (auto-generated)"
     },
     "INVIDIOUS_HMAC_KEY_1": {
       "category": "advanced",
       "label": "HMAC Key",
       "type": "password",
-      "tooltip": "Signs Invidious session tokens (auto-generated). Changing it logs every user out.",
+      "tooltip": "Signs session tokens. Changing it logs users out.",
       "advanced": true
     },
     "MATRIX_ADMIN_PASSWORD_1": {
       "category": "general",
       "label": "Matrix Admin Password",
       "type": "password",
-      "tooltip": "Password for the first Synapse admin account, created on install (auto-generated)"
+      "tooltip": "Password for the first Synapse admin account"
     },
     "MONEYAPP_AUTH_SECRET_1": {
       "category": "advanced",
       "label": "Auth Secret",
       "type": "password",
-      "tooltip": "Signs session tokens (auto-generated). Changing it logs every user out.",
+      "tooltip": "Signs session tokens. Changing it logs users out.",
       "advanced": true
     },
     "STALWART_ADMIN_PASSWORD_1": {
       "category": "general",
       "label": "Stalwart Admin Password",
       "type": "password",
-      "tooltip": "Password for the Stalwart administrator account (auto-generated; persists across reinstalls)"
+      "tooltip": "Stalwart admin account password (auto-generated)"
     },
     "STALWART_FIRST_MAILBOX_PASSWORD_1": {
       "category": "general",
       "label": "First Mailbox Password",
       "type": "password",
-      "tooltip": "Password for the mailbox created on install (auto-generated; persists across reinstalls)"
+      "tooltip": "Password for the mailbox created on install"
     },
     "TRAEFIK_ADMIN_PASSWORD_1": {
       "category": "general",
       "label": "Traefik Admin Password",
       "type": "password",
-      "tooltip": "Password for the Traefik dashboard account (auto-generated; persists across reinstalls)"
+      "tooltip": "Traefik dashboard password (auto-generated)"
     },
     "BOOKSTACK_APP_KEY_1": {
       "category": "advanced",
       "label": "Application Key",
       "type": "password",
-      "tooltip": "Laravel APP_KEY — encrypts session data (auto-generated). Changing it invalidates existing sessions.",
+      "tooltip": "Laravel APP_KEY. Changing it clears sessions.",
       "advanced": true
     },
     "BOOKSTACK_DB_PASSWORD_1": {
       "category": "advanced",
       "label": "Database Password",
       "type": "password",
-      "tooltip": "MariaDB password for the BookStack user (auto-generated; persists across reinstalls)",
+      "tooltip": "MariaDB password for the BookStack user",
       "advanced": true
     },
     "BOOKSTACK_DB_ROOT_PASSWORD_1": {
       "category": "advanced",
       "label": "Database Root Password",
       "type": "password",
-      "tooltip": "MariaDB root password (auto-generated; kept separate from the app user password)",
+      "tooltip": "MariaDB root password (auto-generated)",
       "advanced": true
     },
     "VAULTWARDEN_ADMIN_TOKEN_1": {