Add apparmor:unconfined to Beszel Docker agents - dbus mount alone isn't enough

The systemd/dbus mounts added last commit aren't sufficient by themselves
on an AppArmor-enabled host (Ubuntu/Debian by default): the dbus "Hello"
handshake fails with "An AppArmor policy prevents this sender from sending
this message to this recipient", since the container has no AppArmor label
the host's dbus-daemon profile recognizes. Only visible at LOG_LEVEL=debug
- silent otherwise, which is why the mounts alone looked like they should
have worked but didn't. Confirmed live against a real box hitting exactly
this error.

security_opt: apparmor:unconfined is Beszel's own documented fix
(beszel.dev/guide/systemd#apparmor-error) for this exact error string.
Added to both Docker-based agent compose generators (install_beszel's
combined hub+agent, and install_beszel-agent's remote-only variant).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H4k6J1qXXyYxhGEgnJaMvn

services/beszel.sh

@@ -220,6 +220,7 @@ install_beszel() {
         echo "[DRY-RUN] Port 8090 published for the hub (auto-scanned for a free host port)"
         echo "[DRY-RUN] Agent connects to the hub over a shared unix socket, not a TCP port"
         echo "[DRY-RUN] Would mount host systemd/dbus sockets + sensor paths read-only (Services/Temp columns)"
+        echo "[DRY-RUN] Would set security_opt: apparmor:unconfined on the agent (needed for dbus to work at all on an AppArmor host)"
         echo "[DRY-RUN] Would pause for you to log into the hub and provide its key + universal token to finish the agent"
         return 0
     fi
@@ -295,6 +296,15 @@ networks:
     # running as a normal host process, which is what first surfaced this
     # gap — a Docker-deployed agent sitting right next to it showed nothing
     # in either column until these were added.
+    #
+    # The mounts alone aren't enough on an AppArmor-enabled host (Ubuntu/
+    # Debian by default): the dbus connection attempt fails with "An
+    # AppArmor policy prevents this sender from sending this message to
+    # this recipient" (visible only at LOG_LEVEL=debug — silent otherwise),
+    # since the container has no AppArmor label the host's dbus-daemon
+    # profile recognizes. security_opt: apparmor:unconfined below is
+    # Beszel's own documented fix (beszel.dev/guide/systemd#apparmor-error)
+    # — confirmed live, this exact error on a real box.
     cat > docker-compose.yml << BESZEL_COMPOSE
 name: beszel
 
@@ -316,6 +326,8 @@ ${_CADDY_NET_BLOCK}
     container_name: beszel-agent
     restart: unless-stopped
     network_mode: host
+    security_opt:
+      - apparmor:unconfined
     env_file: .env
     environment:
       - LISTEN=/beszel_socket/beszel.sock
@@ -375,10 +387,13 @@ report every currently-running container automatically — nothing to
 configure per-service; install or remove a container on this box and the
 agent's next poll just reflects it.
 
-Also mounts the host's systemd/dbus sockets and sensor paths (read-only) so
+Also mounts the host's systemd/dbus sockets and sensor paths (read-only),
+plus `security_opt: apparmor:unconfined` (required on Ubuntu/Debian for the
+dbus connection to work at all — otherwise AppArmor silently blocks it), so
 the hub's **Services** (systemd units) and **Temp** (hardware sensors)
-columns work for this box — without them a Docker-deployed agent silently
-shows both empty, no error anywhere pointing at why.
+columns work for this box — without both, a Docker-deployed agent silently
+shows both empty, no error anywhere pointing at why (visible only at
+`LOG_LEVEL=debug`).
 
 ## First login
 
@@ -454,6 +469,7 @@ install_beszel-agent() {
         echo "[DRY-RUN] Would deploy henrygd/beszel-agent only (no hub, no web UI on this box)"
         echo "[DRY-RUN]   network_mode: host, /var/run/docker.sock mounted read-only"
         echo "[DRY-RUN]   plus host systemd/dbus sockets + sensor paths read-only (Services/Temp columns)"
+        echo "[DRY-RUN]   plus security_opt: apparmor:unconfined (needed for dbus to work at all on an AppArmor host)"
         echo "[DRY-RUN] Would prompt for the hub's public URL, then its key + universal token"
         echo "[DRY-RUN]   (same paste flow as the hub-side installer)"
         echo "[DRY-RUN] No inbound port opened — the agent connects OUTBOUND to the hub, so no"
@@ -515,6 +531,8 @@ services:
     container_name: beszel-agent
     restart: unless-stopped
     network_mode: host
+    security_opt:
+      - apparmor:unconfined
     env_file: .env
     environment:
       - HUB_URL=\${HUB_URL}
@@ -544,10 +562,13 @@ Reports this box's host resources and Docker container stats to a Beszel
 HUB running elsewhere — no hub, no web UI, nothing web-facing on this box
 at all.
 
-Also mounts the host's systemd/dbus sockets and sensor paths (read-only) so
+Also mounts the host's systemd/dbus sockets and sensor paths (read-only),
+plus \`security_opt: apparmor:unconfined\` (required on Ubuntu/Debian for the
+dbus connection to work at all — otherwise AppArmor silently blocks it), so
 the hub's **Services** (systemd units) and **Temp** (hardware sensors)
-columns work for this box too — without them a Docker-deployed agent
-silently shows both empty, no error anywhere pointing at why.
+columns work for this box too — without both, a Docker-deployed agent
+silently shows both empty, no error anywhere pointing at why (visible only
+at \`LOG_LEVEL=debug\`).
 
 ## Connecting (if you skipped it during install)