domain-locker-install.sh: missing `whois` system package breaks .io, .app and some other TLDs

[firstlayerdigital]

Script

install/domain-locker-install.sh (Lissy93/domain-locker installer)

Problem

Domain Locker's WHOIS lookup logic (src/server/utils/whois.ts) tries the whois-json npm library first, then falls back to executing the native whois binary via child_process.exec for TLDs the library can't handle (e.g. .io, .app, several ccTLDs with bespoke WHOIS servers).

The install script installs Postgres 17 and Node 22, then runs npm install and npm run build, but never installs the whois system package. On a freshly-provisioned CT, which whois returns nothing, so the native fallback silently errors out and the domain-info endpoint returns {"error":"Failed to fetch WHOIS data"} for any domain the npm lib alone can't cover.

Repro

bash -c "$(wget -qLO - https://github.com/community-scripts/ProxmoxVE/raw/main/ct/domain-locker.sh)"
# ...install finishes, UI comes up...

pct exec <CTID> -- bash -c 'which whois'
# (no output)

pct exec <CTID> -- bash -c 'curl -s "http://localhost:3000/api/domain-info-preview?domain=vantagedash.io"'
# {"error":"Failed to fetch WHOIS data"}

Also visible in the /domain-updater endpoint output:

"domain":"vantagedash.io","error":"No domainInfo found in response for \"vantagedash.io\""

After apt install -y whois, the same domain resolves cleanly:

"domain":"vantagedash.io","changes":["Expiry Date","Registrar","Status+: clienttransferprohibited","SSL created","WHOIS created"]

Suggested fix

Add a step to install/domain-locker-install.sh before the Node/npm steps:

msg_info "Installing Dependencies"
$STD apt-get install -y whois
msg_ok "Installed Dependencies"

Alternatively, include whois in the setup_* helpers if there's a shared dependency list for this category of app.

Environment

• Installed fresh on PVE 8.x, Debian 13 (Trixie) LXC template as provisioned by the current script
• Domain Locker tarball: latest main (as of 2026-04-20)
• Affected TLDs I verified: .io (Porkbun); several .com domains worked without whois because whois-json handles Verisign's server directly

Related

• Upstream bug in Domain Locker's SSL updater (separate from this): fix(domain-updater): don't clobber existing SSL data with empty values lissy93/domain-locker#90

[MickLesk]

Its faster to create an PR with 1 more dep, then the whole issue report...?