ProxMenux/scripts/gpu_tpu/0001-fix-apex-group-and-udev-rules.patch

cat > 0001-fix-apex-group-and-udev-rules.patch <<'PATCH'
diff --git a/install_coral_pve9.sh b/install_coral_pve9.sh
--- a/install_coral_pve9.sh
+++ b/install_coral_pve9.sh
@@ -1,6 +1,55 @@
 #!/usr/bin/env bash
 # ==========================================================
 # ProxMenux - Coral TPU Installer for Proxmox VE 9
 # ==========================================================
 
+# ----------------------------------------------------------
+# Ensure apex group and udev rules are present
+# ----------------------------------------------------------
+ensure_apex_group_and_udev() {
+  msg_info "Ensuring apex group and udev rules..."
+
+  # Create the apex group if it doesn't exist
+  if ! getent group apex >/dev/null; then
+    groupadd --system apex || true
+    msg_ok "System group 'apex' created"
+  else
+    msg_ok "System group 'apex' already exists"
+  fi
+
+  # Local udev rule for Coral / APEX TPU
+  cat >/etc/udev/rules.d/99-coral-apex.rules <<'EOF'
+# Coral / Google APEX TPU (M.2 / PCIe)
+# Assign group "apex" and safe permissions to device nodes
+KERNEL=="apex_*", GROUP="apex", MODE="0660"
+SUBSYSTEM=="apex", GROUP="apex", MODE="0660"
+EOF
+
+  # Ensure gasket-dkms rule uses the correct group
+  if [[ -f /usr/lib/udev/rules.d/60-gasket-dkms.rules ]]; then
+    sed -i 's/GROUP="[^"]*"/GROUP="apex"/g' /usr/lib/udev/rules.d/60-gasket-dkms.rules || true
+  fi
+
+  # Reload and apply udev rules
+  udevadm control --reload-rules
+  udevadm trigger --subsystem-match=apex || true
+
+  msg_ok "apex group and udev rules are in place"
+
+  # Verify device nodes after reload
+  if ls -l /dev/apex_* 2>/dev/null | grep -q ' apex '; then
+    msg_ok "Coral TPU device nodes detected with correct group (apex)"
+  else
+    msg_warn "apex device node not found yet; a reboot may be required"
+  fi
+}
+
@@ -1,0 +1,0 @@
@@ -100,0 +149,0 @@
@@ -200,6 +249,10 @@ install_coral_host() {
     msg_ok "DKMS module built and installed successfully"
   fi
 
+  # Ensure group and udev setup before loading drivers
+  ensure_apex_group_and_udev
+
+  # Load kernel modules
   modprobe gasket >>"$LOG_FILE" 2>&1 || true
   modprobe apex   >>"$LOG_FILE" 2>&1 || true
   sleep 1
PATCH