fix(update-apps): keep the backup alive on a closed console, stop before restoring

A closed console killed vzdump with the session (7 runs ended "Backup failed ... creating vzdump archive"); it now runs shielded from SIGHUP. A restore after a failed update raced the background shutdown and failed with "can't overwrite running container" (3 runs); it now waits for that shutdown and for the container to stop, and says so when it does not.

.github/DISCUSSION_TEMPLATE/request-script.yml

@@ -58,9 +58,9 @@ body:
 
         Before continuing, verify that the requested project meets the minimum requirements below.
 
-        **Projects with fewer than 1,000 stars are generally not eligible for a script request.**
+        **Projects with fewer than 1,000 stars, or younger than 6 months, are generally not eligible for a script request.**
 
-        Exceptions are only considered where there is a clearly verifiable, significant public adoption signal.
+        An automated check verifies the star count and project age for GitHub-hosted projects. If the project doesn't meet these requirements, fill in **Justification for an exception** below — without one, the request is closed automatically. With one, it's flagged for manual review instead. Exceptions are rare and require a clearly verifiable, significant public adoption signal.
 
   - type: input
     id: repository-stars
@@ -134,6 +134,22 @@ body:
         - label: I understand that requests outside the project scope may be closed without an extensive explanation.
           required: true
 
+  - type: textarea
+    id: justification
+    attributes:
+      label: Justification for an exception
+      description: >-
+        Only needed if the project has fewer than 1,000 stars or is younger than 6 months (e.g. it has no GitHub
+        presence, so stars don't apply). Explain the significant public adoption signal. Leave blank if the project
+        meets the normal requirements — requests that don't meet the requirements and have no justification here are
+        closed automatically.
+      placeholder: |
+        Example:
+        No public GitHub repository, but the project has 50k+ active installs reported by its own telemetry
+        dashboard and is covered by several established self-hosting publications.
+    validations:
+      required: false
+
   - type: markdown
     attributes:
       value: |

.github/autolabeler-config.json

@@ -77,17 +77,6 @@
       "excludeGlobs": []
     }
   ],
-  "core": [
-    {
-      "fileStatus": null,
-      "includeGlobs": [
-        "misc/*.func"
-      ],
-      "excludeGlobs": [
-        "misc/api.func"
-      ]
-    }
-  ],
   "documentation": [
     {
       "fileStatus": null,
@@ -114,8 +103,7 @@
     {
       "fileStatus": null,
       "includeGlobs": [
-        "api/**",
-        "misc/api.func"
+        "api/**"
       ],
       "excludeGlobs": []
     }

.github/changelogs/2026/10.md

@@ -1,3 +1,224 @@
+## 2026-10-31
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Docker VM: take the imported disk from vm_import_disk [@MickLesk](https://github.com/MickLesk) ([#18341](https://github.com/community-scripts/ProxmoxVE/pull/18341))
+    - Twenty: move to Node.js 26 [@MickLesk](https://github.com/MickLesk) ([#18337](https://github.com/community-scripts/ProxmoxVE/pull/18337))
+    - Norish: fetch Obscura from the repo Norish pins [@MickLesk](https://github.com/MickLesk) ([#18338](https://github.com/community-scripts/ProxmoxVE/pull/18338))
+    - HAOS VM: take the imported disk from vm_import_disk [@MickLesk](https://github.com/MickLesk) ([#18342](https://github.com/community-scripts/ProxmoxVE/pull/18342))
+    - Aurral: build the pnpm workspace and run backend/server.ts [@MickLesk](https://github.com/MickLesk) ([#18340](https://github.com/community-scripts/ProxmoxVE/pull/18340))
+    - PS5-MQTT: build the yarn workspace and run the packaged server [@MickLesk](https://github.com/MickLesk) ([#18339](https://github.com/community-scripts/ProxmoxVE/pull/18339))
+    - Jellyseerr, Overseerr, Paperless-ngx, Vikunja: skip migration prompts when unattended [@florianpunz](https://github.com/florianpunz) ([#18321](https://github.com/community-scripts/ProxmoxVE/pull/18321))
+    - Discourse: track the Ruby version Discourse requires [@MickLesk](https://github.com/MickLesk) ([#18329](https://github.com/community-scripts/ProxmoxVE/pull/18329))
+
+  - #### ✨ New Features
+
+    - MatterJS-Server: Add time sync [@tomfrenzel](https://github.com/tomfrenzel) ([#18330](https://github.com/community-scripts/ProxmoxVE/pull/18330))
+
+  - #### 🔧 Refactor
+
+    - Debian VM: keep a static IP without a snippets storage [@MickLesk](https://github.com/MickLesk) ([#18346](https://github.com/community-scripts/ProxmoxVE/pull/18346))
+    - Ubuntu VM: check for a snippets storage before building a static-IP VM [@MickLesk](https://github.com/MickLesk) ([#18347](https://github.com/community-scripts/ProxmoxVE/pull/18347))
+
+### 💾 Core
+
+  - feat: add setup_java_memory: size Java services from the CT's RAM on Proxmox [@MickLesk](https://github.com/MickLesk) ([core#181](https://github.com/community-scripts/core/pull/181))
+- analytics: name the Proxmox tasks when a container stops mid-install [@MickLesk](https://github.com/MickLesk) ([core#184](https://github.com/community-scripts/core/pull/184))
+- PVE: do not abort when the spinner PID file cannot be written [@MickLesk](https://github.com/MickLesk) ([core#183](https://github.com/community-scripts/core/pull/183))
+
+### 📂 Github
+
+  - Drop the legacy engine copies from misc/ [@MickLesk](https://github.com/MickLesk) ([#18294](https://github.com/community-scripts/ProxmoxVE/pull/18294))
+
+## 2026-10-30
+
+### 🆕 New Scripts
+
+  - Reconya ([#18325](https://github.com/community-scripts/ProxmoxVE/pull/18325))
+- Blinko ([#18324](https://github.com/community-scripts/ProxmoxVE/pull/18324))
+- ChartDB ([#18323](https://github.com/community-scripts/ProxmoxVE/pull/18323))
+
+## 2026-10-29
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Karakeep: fix monolith release asset pattern [@MohamedBassem](https://github.com/MohamedBassem) ([#18317](https://github.com/community-scripts/ProxmoxVE/pull/18317))
+    - Vikunja: fold the package's service block into the config's service section [@MickLesk](https://github.com/MickLesk) ([#18311](https://github.com/community-scripts/ProxmoxVE/pull/18311))
+    - Stirling-PDF: size JVM heap from container memory, not host RAM [@aashishvanand](https://github.com/aashishvanand) ([#18292](https://github.com/community-scripts/ProxmoxVE/pull/18292))
+    - fix(authentik): migrate systemd units when still on pre-2026.8 paths [@CervezaStallone](https://github.com/CervezaStallone) ([#18307](https://github.com/community-scripts/ProxmoxVE/pull/18307))
+    - fix(dawarich): serve .mjs MapLibre modules as JavaScript [@ricbaral](https://github.com/ricbaral) ([#18304](https://github.com/community-scripts/ProxmoxVE/pull/18304))
+
+  - #### ✨ New Features
+
+    - VictoriaLogs: enable syslog ingestion on TCP/UDP 514 [@opastorello](https://github.com/opastorello) ([#18300](https://github.com/community-scripts/ProxmoxVE/pull/18300))
+
+### 💾 Core
+
+  - feat: Performance - load host data in the background and stop reporting failed pre-checks [@MickLesk](https://github.com/MickLesk) ([core#179](https://github.com/community-scripts/core/pull/179))
+
+### 📚 Documentation
+
+  - gh: let the bot set oidc_url and license [@MickLesk](https://github.com/MickLesk) ([#18313](https://github.com/community-scripts/ProxmoxVE/pull/18313))
+
+## 2026-10-28
+
+### 🆕 New Scripts
+
+  - VictoriaLogs ([#18282](https://github.com/community-scripts/ProxmoxVE/pull/18282))
+- Deemix ([#18272](https://github.com/community-scripts/ProxmoxVE/pull/18272))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(vm/opnsense): increase startup wait from 90 to 180 seconds [@MTlyx](https://github.com/MTlyx) ([#18086](https://github.com/community-scripts/ProxmoxVE/pull/18086))
+    - apache-tomcat: restore the update backup from its real store [@mazelado](https://github.com/mazelado) ([#18145](https://github.com/community-scripts/ProxmoxVE/pull/18145))
+    - AdventureLog: clean-install on update and drop the DRF <3.15 pin [@angusmaul](https://github.com/angusmaul) ([#18281](https://github.com/community-scripts/ProxmoxVE/pull/18281))
+
+  - #### 🔧 Refactor
+
+    - Refactor: ownCloud VM [@MickLesk](https://github.com/MickLesk) ([#18295](https://github.com/community-scripts/ProxmoxVE/pull/18295))
+
+### 💾 Core
+
+  - Keep the console hint out of the default output [@MickLesk](https://github.com/MickLesk) ([core#176](https://github.com/community-scripts/core/pull/176))
+
+### 📚 Documentation
+
+  - Move a promoted script's telemetry history to ProxmoxVE [@MickLesk](https://github.com/MickLesk) ([#18271](https://github.com/community-scripts/ProxmoxVE/pull/18271))
+
+### ❔ Uncategorized
+
+  - chore(ct): sync tdarr defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18289](https://github.com/community-scripts/ProxmoxVE/pull/18289))
+
+## 2026-10-27
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Zabbix: leave out the NVIDIA agent2 plugin that breaks the all-plugins install [@MickLesk](https://github.com/MickLesk) ([#18262](https://github.com/community-scripts/ProxmoxVE/pull/18262))
+    - Omada: detect latest version from product download page [@ChrisKappe](https://github.com/ChrisKappe) ([#18248](https://github.com/community-scripts/ProxmoxVE/pull/18248))
+    - LanguageTool: count ngram prompt retries without tripping errexit [@MickLesk](https://github.com/MickLesk) ([#18258](https://github.com/community-scripts/ProxmoxVE/pull/18258))
+    - Overseerr: point fresh installs to Seerr  [@MickLesk](https://github.com/MickLesk) ([#18259](https://github.com/community-scripts/ProxmoxVE/pull/18259))
+    - stalwart: pin to v0.16.27 until v1 migration is supported [@MickLesk](https://github.com/MickLesk) ([#18252](https://github.com/community-scripts/ProxmoxVE/pull/18252))
+
+  - #### ✨ New Features
+
+    - TurnKey: offer only current appliances, stop on arm64 [@MickLesk](https://github.com/MickLesk) ([#18265](https://github.com/community-scripts/ProxmoxVE/pull/18265))
+
+  - #### 🔧 Refactor
+
+    - NPMplus: let the ACME e-mail stay empty again, Let's Encrypt does not need one [@MickLesk](https://github.com/MickLesk) ([#18263](https://github.com/community-scripts/ProxmoxVE/pull/18263))
+
+### 🗑️ Deleted Scripts
+
+  - Remove: Readarr [@MickLesk](https://github.com/MickLesk) ([#18264](https://github.com/community-scripts/ProxmoxVE/pull/18264))
+
+### 💾 Core
+
+  - Say the same thing on both hosts while a container is created [@MickLesk](https://github.com/MickLesk) ([core#173](https://github.com/community-scripts/core/pull/173))
+- Skip the IPv6 sysctl when the host kernel has no IPv6 [@MickLesk](https://github.com/MickLesk) ([core#171](https://github.com/community-scripts/core/pull/171))
+- Stop reporting a closed console as a user abort, and shield the host's own work [@MickLesk](https://github.com/MickLesk) ([core#172](https://github.com/community-scripts/core/pull/172))
+
+## 2026-10-26
+
+### 🆕 New Scripts
+
+  - Vane ([#18168](https://github.com/community-scripts/ProxmoxVE/pull/18168))
+- HomeTube ([#18172](https://github.com/community-scripts/ProxmoxVE/pull/18172))
+- Honcho ([#18169](https://github.com/community-scripts/ProxmoxVE/pull/18169))
+- YTPTube ([#18174](https://github.com/community-scripts/ProxmoxVE/pull/18174))
+- Stump ([#18173](https://github.com/community-scripts/ProxmoxVE/pull/18173))
+- Casdoor ([#18170](https://github.com/community-scripts/ProxmoxVE/pull/18170))
+- Streamystats ([#18171](https://github.com/community-scripts/ProxmoxVE/pull/18171))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Immich: lock only this platform when mise installs the plugin tools [@MickLesk](https://github.com/MickLesk) ([#18241](https://github.com/community-scripts/ProxmoxVE/pull/18241))
+    - Fix service name case for Splunkd [@CerberusStyle](https://github.com/CerberusStyle) ([#18238](https://github.com/community-scripts/ProxmoxVE/pull/18238))
+    - VMs: pass the machine type, CPU, disk cache and discard settings to qm [@MickLesk](https://github.com/MickLesk) ([#18232](https://github.com/community-scripts/ProxmoxVE/pull/18232))
+    - excalidash: bump Node.js from 20 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18213](https://github.com/community-scripts/ProxmoxVE/pull/18213))
+    - readmeabook: bump Node.js from 20 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18217](https://github.com/community-scripts/ProxmoxVE/pull/18217))
+    - homepage: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18214](https://github.com/community-scripts/ProxmoxVE/pull/18214))
+    - remove old -install.sh (verdaccio) [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18218](https://github.com/community-scripts/ProxmoxVE/pull/18218))
+    - meshcentral: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18215](https://github.com/community-scripts/ProxmoxVE/pull/18215))
+
+  - #### ✨ New Features
+
+    - MeshCentral: update the npm package, not just the OS [@MickLesk](https://github.com/MickLesk) ([#18243](https://github.com/community-scripts/ProxmoxVE/pull/18243))
+
+### 💾 Core
+
+  - feat: let an install survive a closed console / dont sighup installs [@MickLesk](https://github.com/MickLesk) ([core#167](https://github.com/community-scripts/core/pull/167))
+- feat: create containers from the linuxcontainers.org catalog when Proxmox has no template [@MickLesk](https://github.com/MickLesk) ([core#25](https://github.com/community-scripts/core/pull/25))
+
+### 📚 Documentation
+
+  - Ref: Docs / Readme [@MickLesk](https://github.com/MickLesk) ([#18233](https://github.com/community-scripts/ProxmoxVE/pull/18233))
+
+## 2026-10-25
+
+### 🆕 New Scripts
+
+  - Dreeve ([#18167](https://github.com/community-scripts/ProxmoxVE/pull/18167))
+- TaskView ([#18166](https://github.com/community-scripts/ProxmoxVE/pull/18166))
+- EmDash ([#18165](https://github.com/community-scripts/ProxmoxVE/pull/18165))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(mealie): install ffmpeg for video recipe import [@clartek](https://github.com/clartek) ([#18210](https://github.com/community-scripts/ProxmoxVE/pull/18210))
+    - Termix: step through 2.9.2 when updating from 2.8 or older [@MickLesk](https://github.com/MickLesk) ([#18158](https://github.com/community-scripts/ProxmoxVE/pull/18158))
+    - Element Synapse: remove the registration line by its text, not line 34 [@MickLesk](https://github.com/MickLesk) ([#18201](https://github.com/community-scripts/ProxmoxVE/pull/18201))
+    - Element Synapse: drop the ::1 listener so a container without IPv6 starts [@MickLesk](https://github.com/MickLesk) ([#18180](https://github.com/community-scripts/ProxmoxVE/pull/18180))
+    - Heimdall: generate the app key without the production prompt [@MickLesk](https://github.com/MickLesk) ([#18156](https://github.com/community-scripts/ProxmoxVE/pull/18156))
+    - Frigate: fetch the Intel graphics key with retries before building the media driver [@MickLesk](https://github.com/MickLesk) ([#18192](https://github.com/community-scripts/ProxmoxVE/pull/18192))
+    - Pterodactyl Panel: default the admin's first and last name when left empty [@MickLesk](https://github.com/MickLesk) ([#18177](https://github.com/community-scripts/ProxmoxVE/pull/18177))
+    - Jellyseerr: point fresh installs to Seerr instead of a missing install script [@MickLesk](https://github.com/MickLesk) ([#18183](https://github.com/community-scripts/ProxmoxVE/pull/18183))
+    - Pi-hole: download the installer before running it [@MickLesk](https://github.com/MickLesk) ([#18182](https://github.com/community-scripts/ProxmoxVE/pull/18182))
+    - OmniTools: give the build a git commit to read [@MickLesk](https://github.com/MickLesk) ([#18181](https://github.com/community-scripts/ProxmoxVE/pull/18181))
+    - iVentoy: stop early in an unprivileged container [@MickLesk](https://github.com/MickLesk) ([#18179](https://github.com/community-scripts/ProxmoxVE/pull/18179))
+    - Immich: stop early on Debian 12 instead of failing at apt [@MickLesk](https://github.com/MickLesk) ([#18178](https://github.com/community-scripts/ProxmoxVE/pull/18178))
+    - paperless-ngx: fix missing index folder [@Segelzwerg](https://github.com/Segelzwerg) ([#18142](https://github.com/community-scripts/ProxmoxVE/pull/18142))
+    - Anytype Server: keep the .env across updates and recreate a lost one [@MickLesk](https://github.com/MickLesk) ([#18155](https://github.com/community-scripts/ProxmoxVE/pull/18155))
+    - changedetection: build Browserless from its lockfile on update [@MickLesk](https://github.com/MickLesk) ([#18157](https://github.com/community-scripts/ProxmoxVE/pull/18157))
+    - Zitadel: identify the machine by hostname when it has no private IPv4 [@MickLesk](https://github.com/MickLesk) ([#18139](https://github.com/community-scripts/ProxmoxVE/pull/18139))
+    - fix(bar-assistant): publish starter media catalog so new bars provision [@och29](https://github.com/och29) ([#18130](https://github.com/community-scripts/ProxmoxVE/pull/18130))
+
+  - #### ✨ New Features
+
+    - Gramps-Web: run the Celery task queue with Redis [@MickLesk](https://github.com/MickLesk) ([#18141](https://github.com/community-scripts/ProxmoxVE/pull/18141))
+
+  - #### 💥 Breaking Changes
+
+    - Hermes Agent: install, update and run everything as the hermes user [@MickLesk](https://github.com/MickLesk) ([#18203](https://github.com/community-scripts/ProxmoxVE/pull/18203))
+    - tubearchivist: fix: prepare tubearchivist for v0.6.0 [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17867](https://github.com/community-scripts/ProxmoxVE/pull/17867))
+
+  - #### 🔧 Refactor
+
+    - TREK: build 5.0 with 4 GB RAM and without dependency install scripts [@MickLesk](https://github.com/MickLesk) ([#18194](https://github.com/community-scripts/ProxmoxVE/pull/18194))
+
+### 💾 Core
+
+  - alpine: fix uv release url [@mfelipe](https://github.com/mfelipe) ([core#168](https://github.com/community-scripts/core/pull/168))
+- Set npm's script and git policy for root too, so --prefix keeps it [@MickLesk](https://github.com/MickLesk) ([core#170](https://github.com/community-scripts/core/pull/170))
+- Upgrade Node.js in place when an app package depends on it [@MickLesk](https://github.com/MickLesk) ([core#169](https://github.com/community-scripts/core/pull/169))
+
+### 🧰 Tools
+
+  - #### ✨ New Features
+
+    - post-pmg-install: hide the subscription nag in the PMG 9 mobile quarantine [@MickLesk](https://github.com/MickLesk) ([#18140](https://github.com/community-scripts/ProxmoxVE/pull/18140))
+    - post-pve-install: hide the mobile subscription nag in every UI language [@MickLesk](https://github.com/MickLesk) ([#18143](https://github.com/community-scripts/ProxmoxVE/pull/18143))
+
 ## 2026-10-24
 
 ### 🚀 Updated Scripts

.github/changelogs/2026/11.md

@@ -0,0 +1,187 @@
+## 2026-11-07
+
+### 🆕 New Scripts
+
+  - EspoCRM ([#18519](https://github.com/community-scripts/ProxmoxVE/pull/18519))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - RomM: emit player isolation headers from the serving location [@adotagarwal](https://github.com/adotagarwal) ([#18511](https://github.com/community-scripts/ProxmoxVE/pull/18511))
+
+  - #### 💥 Breaking Changes
+
+    - fix: gotenberg: update to v9 [@CrazyWolf13](https://github.com/CrazyWolf13) ([#18491](https://github.com/community-scripts/ProxmoxVE/pull/18491))
+
+### 💾 Core
+
+  - nvidia: close the hardware acceleration step when no GPU is usable | pin the whole NVIDIA userspace to the host's driver version [@MickLesk](https://github.com/MickLesk) ([core#215](https://github.com/community-scripts/core/pull/215))
+- fix: stage release downloads on disk, not in /tmp [@rcourtman](https://github.com/rcourtman) ([core#218](https://github.com/community-scripts/core/pull/218))
+- Minor fixes: restart php-fpm during sigpipe, Install jq for forge commands  [@MickLesk](https://github.com/MickLesk) ([core#213](https://github.com/community-scripts/core/pull/213))
+- incus: name the project restriction that refuses an Incus launch [@MickLesk](https://github.com/MickLesk) ([core#214](https://github.com/community-scripts/core/pull/214))
+
+## 2026-11-06
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - UmbrelOS-VM: report runs as ProxmoxVE, not DevScripts [@MickLesk](https://github.com/MickLesk) ([#18497](https://github.com/community-scripts/ProxmoxVE/pull/18497))
+    - Caddy: skip the xCaddy test build below 2 GB RAM [@MickLesk](https://github.com/MickLesk) ([#18472](https://github.com/community-scripts/ProxmoxVE/pull/18472))
+    - Thingsboard: keep the package defaults in thingsboard.conf [@MickLesk](https://github.com/MickLesk) ([#18499](https://github.com/community-scripts/ProxmoxVE/pull/18499))
+    - Nexterm: keep the extracted app out of the /tmp cleanup [@MickLesk](https://github.com/MickLesk) ([#18501](https://github.com/community-scripts/ProxmoxVE/pull/18501))
+    - PLANKA: run the service with node instead of nodemon [@MickLesk](https://github.com/MickLesk) ([#18503](https://github.com/community-scripts/ProxmoxVE/pull/18503))
+    - MeTube/Yubal: install Deno without its shell setup [@MickLesk](https://github.com/MickLesk) ([#18406](https://github.com/community-scripts/ProxmoxVE/pull/18406))
+    - OPNsense VM: size the temp space check to the unpacked image |  say why the EFI disk could not be allocated [@MickLesk](https://github.com/MickLesk) ([#18404](https://github.com/community-scripts/ProxmoxVE/pull/18404))
+
+  - #### 🔧 Refactor
+
+    - Technitium DNS: read the version from its GitHub releases [@MickLesk](https://github.com/MickLesk) ([#18425](https://github.com/community-scripts/ProxmoxVE/pull/18425))
+
+### 💾 Core
+
+  - fix: spot same-filesystem bind mounts on Alpine [@rcourtman](https://github.com/rcourtman) ([core#212](https://github.com/community-scripts/core/pull/212))
+- fix: report a container that went down during setup, keep finished installs [@MickLesk](https://github.com/MickLesk) ([core#211](https://github.com/community-scripts/core/pull/211))
+
+### 📚 Documentation
+
+  - ci: reject DevScripts URLs in scripts [@MickLesk](https://github.com/MickLesk) ([#18498](https://github.com/community-scripts/ProxmoxVE/pull/18498))
+
+## 2026-11-05
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - OpenWRT-VM: leave the NIC untagged on a bridge without a port [@MickLesk](https://github.com/MickLesk) ([#18473](https://github.com/community-scripts/ProxmoxVE/pull/18473))
+    - Podman: skip Portainer where Podman has no Quadlet [@MickLesk](https://github.com/MickLesk) ([#18469](https://github.com/community-scripts/ProxmoxVE/pull/18469))
+    - Planka: change npm start argument to --production [@CerberusStyle](https://github.com/CerberusStyle) ([#18478](https://github.com/community-scripts/ProxmoxVE/pull/18478))
+    - OPNsense VM: wait for the FreeBSD login prompt instead of 180 seconds [@MickLesk](https://github.com/MickLesk) ([#18467](https://github.com/community-scripts/ProxmoxVE/pull/18467))
+
+  - #### 🔧 Refactor
+
+    - truenas-VM: let a failed ISO lookup reach its own error [@MickLesk](https://github.com/MickLesk) ([#18476](https://github.com/community-scripts/ProxmoxVE/pull/18476))
+    - proxmox-mail-gateway: take the repo suite from the container  [@MickLesk](https://github.com/MickLesk) ([#18475](https://github.com/community-scripts/ProxmoxVE/pull/18475))
+    - Immich: Bump to 3.3.6 and minor improvement [@MickLesk](https://github.com/MickLesk) ([#18474](https://github.com/community-scripts/ProxmoxVE/pull/18474))
+    - Tududi: run 2.0 on PostgreSQL, keep SQLite installs on 1.15.0 [@MickLesk](https://github.com/MickLesk) ([#18465](https://github.com/community-scripts/ProxmoxVE/pull/18465))
+
+### 💾 Core
+
+  - fix: keep the existing install until the new archive has extracted [@rcourtman](https://github.com/rcourtman) ([core#201](https://github.com/community-scripts/core/pull/201))
+- fix: keep the install when a clone or an Alpine extract fails [@rcourtman](https://github.com/rcourtman) ([core#210](https://github.com/community-scripts/core/pull/210))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - Arcane: write both env names, stop shipping the unused .env [@MickLesk](https://github.com/MickLesk) ([#18466](https://github.com/community-scripts/ProxmoxVE/pull/18466))
+
+## 2026-11-04
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Teleport: Poll readyz instead of fixed 10 second sleep. [@cthach](https://github.com/cthach) ([#18461](https://github.com/community-scripts/ProxmoxVE/pull/18461))
+    - n8n: install past its unsatisfiable canvas dependencies [@MickLesk](https://github.com/MickLesk) ([#18439](https://github.com/community-scripts/ProxmoxVE/pull/18439))
+    - Teable: add Redis cache [@MickLesk](https://github.com/MickLesk) ([#18450](https://github.com/community-scripts/ProxmoxVE/pull/18450))
+
+### 💾 Core
+
+  - feat: say why download_gpg_key failed [@MickLesk](https://github.com/MickLesk) ([core#208](https://github.com/community-scripts/core/pull/208))
+- feat: read the MOTD's OS version at login [@MickLesk](https://github.com/MickLesk) ([core#207](https://github.com/community-scripts/core/pull/207))
+- feat: skip screen clear when there is no terminal | pin only the scripts own app with var_appversion [@MickLesk](https://github.com/MickLesk) ([core#203](https://github.com/community-scripts/core/pull/203))
+
+## 2026-11-03
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Fedora VM: let the engine install libguestfs-tools [@MickLesk](https://github.com/MickLesk) ([#18422](https://github.com/community-scripts/ProxmoxVE/pull/18422))
+    - Cinephage: run the camoufox binary the package now ships [@MickLesk](https://github.com/MickLesk) ([#18426](https://github.com/community-scripts/ProxmoxVE/pull/18426))
+    - AlmaLinux VM: report failures through the engine's error handler [@MickLesk](https://github.com/MickLesk) ([#18418](https://github.com/community-scripts/ProxmoxVE/pull/18418))
+    - WireGuard: give the Debian container 1 GB for WGDashboard [@MickLesk](https://github.com/MickLesk) ([#18419](https://github.com/community-scripts/ProxmoxVE/pull/18419))
+    - zabbix: use os specific apt packages [@MickLesk](https://github.com/MickLesk) ([#18417](https://github.com/community-scripts/ProxmoxVE/pull/18417))
+    - Discourse: build libvips 8.18 for its image worker [@MickLesk](https://github.com/MickLesk) ([#18430](https://github.com/community-scripts/ProxmoxVE/pull/18430))
+    - Wazuh: show the installer's own error when it fails [@MickLesk](https://github.com/MickLesk) ([#18428](https://github.com/community-scripts/ProxmoxVE/pull/18428))
+    - Tracearr: move to Node.js 26 [@connorgallopo](https://github.com/connorgallopo) ([#18393](https://github.com/community-scripts/ProxmoxVE/pull/18393))
+
+  - #### ✨ New Features
+
+    - Wiki.js: install 3.x [@MickLesk](https://github.com/MickLesk) ([#18382](https://github.com/community-scripts/ProxmoxVE/pull/18382))
+
+  - #### 🔧 Refactor
+
+    - OpenWrt VM: read the stable release from downloads.openwrt.org [@MickLesk](https://github.com/MickLesk) ([#18411](https://github.com/community-scripts/ProxmoxVE/pull/18411))
+    - Immich: fetch VectorChord from its new repo, skip Java, get GeoNames first [@MickLesk](https://github.com/MickLesk) ([#18397](https://github.com/community-scripts/ProxmoxVE/pull/18397))
+
+### 💾 Core
+
+  - fix: put the reason for a VM failure into its trace [@MickLesk](https://github.com/MickLesk) ([core#200](https://github.com/community-scripts/core/pull/200))
+- fix: check the bridge before creating a container, and its state after start [@MickLesk](https://github.com/MickLesk) ([core#199](https://github.com/community-scripts/core/pull/199))
+- ref: offer to remove only the container this run created [@MickLesk](https://github.com/MickLesk) ([core#198](https://github.com/community-scripts/core/pull/198))
+- feat: report a cancelled tool dialog as an abort and name the failing command [@MickLesk](https://github.com/MickLesk) ([core#197](https://github.com/community-scripts/core/pull/197))
+- feat: check KVM and the host's threads before building a VM [@MickLesk](https://github.com/MickLesk) ([core#196](https://github.com/community-scripts/core/pull/196))
+- ref: give a host tool one log file for the whole run [@MickLesk](https://github.com/MickLesk) ([core#194](https://github.com/community-scripts/core/pull/194))
+- fix: keep a piped stdin when output moves to the log after a hangup [@MickLesk](https://github.com/MickLesk) ([core#193](https://github.com/community-scripts/core/pull/193))
+- fix: pve-LXC: say when the container went away during its setup [@MickLesk](https://github.com/MickLesk) ([core#192](https://github.com/community-scripts/core/pull/192))
+- fix: treat Esc in a VM wizard dialog as leaving the script [@MickLesk](https://github.com/MickLesk) ([core#190](https://github.com/community-scripts/core/pull/190))
+- ref: count a container stopped during a detached install as an abort [@MickLesk](https://github.com/MickLesk) ([core#187](https://github.com/community-scripts/core/pull/187))
+- feat: find the assets of a renamed GitHub repo without the API [@MickLesk](https://github.com/MickLesk) ([core#188](https://github.com/community-scripts/core/pull/188))
+- fix: restore npm when an interrupted update left it behind [@MickLesk](https://github.com/MickLesk) ([core#189](https://github.com/community-scripts/core/pull/189))
+- feat: add var_cmode to set the container console mode [@MickLesk](https://github.com/MickLesk) ([core#180](https://github.com/community-scripts/core/pull/180))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - all-templates: answering No or Cancel is not a failure [@MickLesk](https://github.com/MickLesk) ([#18423](https://github.com/community-scripts/ProxmoxVE/pull/18423))
+    - homebrew: skip service accounts when picking the user, survive a failed apt update [@MickLesk](https://github.com/MickLesk) ([#18424](https://github.com/community-scripts/ProxmoxVE/pull/18424))
+    - add-tailscale-lxc: start a stopped container and check its OS first [@MickLesk](https://github.com/MickLesk) ([#18421](https://github.com/community-scripts/ProxmoxVE/pull/18421))
+    - netdata: survive a failed apt update, leave quietly on Cancel [@MickLesk](https://github.com/MickLesk) ([#18427](https://github.com/community-scripts/ProxmoxVE/pull/18427))
+    - Privilege-Converter: offer only container-capable storages as the converter's restore target [@MickLesk](https://github.com/MickLesk) ([#18415](https://github.com/community-scripts/ProxmoxVE/pull/18415))
+    - let post-pve-install go on when legacy sources are kept [@MickLesk](https://github.com/MickLesk) ([#18403](https://github.com/community-scripts/ProxmoxVE/pull/18403))
+
+  - #### 🔧 Refactor
+
+    -  update-apps: say why an backup or restore failed [@MickLesk](https://github.com/MickLesk) ([#18405](https://github.com/community-scripts/ProxmoxVE/pull/18405))
+    - Keep host tools running when clear does not know the terminal [@MickLesk](https://github.com/MickLesk) ([#18412](https://github.com/community-scripts/ProxmoxVE/pull/18412))
+    - Refuse to run the PBS 4 upgrade on a Proxmox VE host [@MickLesk](https://github.com/MickLesk) ([#18416](https://github.com/community-scripts/ProxmoxVE/pull/18416))
+    - fstrim: keep trimming when pct fstrim fails on one container [@MickLesk](https://github.com/MickLesk) ([#18413](https://github.com/community-scripts/ProxmoxVE/pull/18413))
+    - execute-lxc: do not abort on a container that is not Debian or Ubuntu [@MickLesk](https://github.com/MickLesk) ([#18414](https://github.com/community-scripts/ProxmoxVE/pull/18414))
+
+### 📚 Documentation
+
+  - github: flag instead of closing on first PR template miss; add script-request eligibility check [@MickLesk](https://github.com/MickLesk) ([#18384](https://github.com/community-scripts/ProxmoxVE/pull/18384))
+
+## 2026-11-02
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - FileFlows: replace the program folders on update [@MickLesk](https://github.com/MickLesk) ([#18380](https://github.com/community-scripts/ProxmoxVE/pull/18380))
+    - anchor: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18373](https://github.com/community-scripts/ProxmoxVE/pull/18373))
+    - guardian: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18375](https://github.com/community-scripts/ProxmoxVE/pull/18375))
+    - nametag: bump Node.js from 20 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18376](https://github.com/community-scripts/ProxmoxVE/pull/18376))
+
+### 💾 Core
+
+  - github: trim theater, add signal to the engine bug report; move AI block to end of PR template [@MickLesk](https://github.com/MickLesk) ([core#186](https://github.com/community-scripts/core/pull/186))
+- fix: do not wait forever for verbose output a daemon keeps open [@MickLesk](https://github.com/MickLesk) ([core#185](https://github.com/community-scripts/core/pull/185))
+
+## 2026-11-01
+
+### 🆕 New Scripts
+
+  - Amazon Linux ([#18369](https://github.com/community-scripts/ProxmoxVE/pull/18369))
+- CachyOS VM ([#18368](https://github.com/community-scripts/ProxmoxVE/pull/18368))
+- Razzia ([#18366](https://github.com/community-scripts/ProxmoxVE/pull/18366))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(zerobyte): build the bundled local agent [@nicotsx](https://github.com/nicotsx) ([#18363](https://github.com/community-scripts/ProxmoxVE/pull/18363))

.github/pull_request_template.md

@@ -17,16 +17,6 @@ Fixes #
 **Tested on:** <!-- e.g. PVE 9.2 / Debian 13 / fresh install + update. Write "not tested" if you could not run it. -->
 
 
----
-
-## 🤖 AI Assistance (**X** in brackets)
-
-> If you used an AI tool (GitHub Copilot, Claude, ChatGPT, etc.) to write or generate any scripts in this PR, you **must** confirm compliance below.  
-> Select exactly one option.
-
-- [ ] **No AI used** – Scripts were written without AI assistance.
-- [ ] **AI was used** – I confirm the scripts were built using [`AGENTS.md`](https://github.com/community-scripts/DevScripts/blob/main/AGENTS.md) and [`.github/agents/pve-script-creator.agent.md`](https://github.com/community-scripts/DevScripts/blob/main/.github/agents/pve-script-creator.agent.md) as guidance, and the output has been reviewed and corrected to match those guidelines.
-
 ---
 
 ## 🛠️ Type of Change (**X** in brackets)
@@ -70,3 +60,13 @@ Guidance:
 -->
 
 <!-- The advisory block is only active once it is OUTSIDE this comment. -->
+
+---
+
+## 🤖 AI Assistance (**X** in brackets)
+
+> If you used an AI tool (GitHub Copilot, Claude, ChatGPT, etc.) to write or generate any scripts in this PR, you **must** confirm compliance below.  
+> Select exactly one option.
+
+- [ ] **No AI used** – Scripts were written without AI assistance.
+- [ ] **AI was used** – I confirm the scripts were built using [`AGENTS.md`](https://github.com/community-scripts/DevScripts/blob/main/AGENTS.md) and [`.github/agents/pve-script-creator.agent.md`](https://github.com/community-scripts/DevScripts/blob/main/.github/agents/pve-script-creator.agent.md) as guidance, and the output has been reviewed and corrected to match those guidelines.

.github/workflows/check-script-repo-url.yml

@@ -0,0 +1,27 @@
+name: Check Script Repo URL
+
+on:
+  pull_request:
+    branches: ["main"]
+    paths:
+      - "ct/**"
+      - "install/**"
+      - "vm/**"
+      - "tools/**"
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    if: github.repository == 'community-scripts/ProxmoxVE'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Reject DevScripts URLs
+        run: |
+          if grep -rnE 'community-scripts/(ProxmoxVED|DevScripts)/' ct install vm tools; then
+            echo "::error::These lines point at DevScripts, so telemetry files the runs there. Use community-scripts/ProxmoxVE."
+            exit 1
+          fi

.github/workflows/close-invalid-pr-template.yml

@@ -1,4 +1,4 @@
-name: Close PRs Missing Template
+name: Flag PRs Missing Template
 
 on:
   pull_request_target:
@@ -14,10 +14,12 @@ jobs:
       issues: write
       contents: read
     steps:
-      - name: Close PR if it does not follow the PR template
+      - name: Check PR against the template, comment and label instead of closing
         uses: actions/github-script@v9
         with:
           script: |
+            const MARKER = "<!-- pr-template-check -->";
+            const LABELS = ["missing pr template", "stale"];
             const pr = context.payload.pull_request;
             const prNumber = pr.number;
             const author = pr.user.login;
@@ -44,11 +46,11 @@ jobs:
               return;
             }
 
-            const labels = pr.labels.map((label) => label.name);
+            const prLabels = pr.labels.map((label) => label.name);
             const skipLabels = ["automated pr", "keep-open"];
 
-            if (skipLabels.some((label) => labels.includes(label))) {
-              core.info(`PR #${prNumber} has a skip label (${labels.join(", ")}) — skipping template validation.`);
+            if (skipLabels.some((label) => prLabels.includes(label))) {
+              core.info(`PR #${prNumber} has a skip label (${prLabels.join(", ")}) — skipping template validation.`);
               return;
             }
 
@@ -114,50 +116,52 @@ jobs:
               failures.push("At least one **Type of Change** checkbox must be checked.");
             }
 
+            const comments = await github.paginate(github.rest.issues.listComments, {
+              owner, repo, issue_number: prNumber, per_page: 100
+            });
+            const mine = comments.find(c => c.body && c.body.includes(MARKER));
+
             if (failures.length === 0) {
               core.info(`PR #${prNumber} follows the PR template.`);
+              if (mine && !mine.body.startsWith(MARKER + "\n✅")) {
+                await github.rest.issues.updateComment({
+                  owner, repo, comment_id: mine.id,
+                  body: MARKER + "\n✅ **Template check passed.** Thanks for fixing the description — the `stale` mark has been removed.",
+                });
+              }
+              for (const name of LABELS) {
+                if (prLabels.includes(name)) {
+                  await github.rest.issues.removeLabel({ owner, repo, issue_number: prNumber, name });
+                }
+              }
               return;
             }
 
-            core.info(`Closing PR #${prNumber} — template validation failed.`);
+            core.info(`PR #${prNumber} — template validation failed, flagging instead of closing.`);
 
             const templateUrl =
               "https://github.com/community-scripts/ProxmoxVE/blob/main/.github/pull_request_template.md";
             const failureList = failures.map((item) => `- ${item}`).join("\n");
 
-            const comment = [
-              `👋 Hi @${author},`,
-              ``,
-              `This pull request was closed because it does not follow the [PR template](${templateUrl}).`,
-              ``,
-              `Please fix the following and open a new PR (or reopen this one after updating the description):`,
-              ``,
-              failureList,
-              ``,
-              `> Use the template sections, fill in the description, check all prerequisite boxes, and select at least one type of change.`,
-              ``,
-              `Maintainers can add the \`keep-open\` label to exempt a PR from this check.`,
-              ``,
-              `Thank you for contributing! 🙏`,
-            ].join("\n");
+            const text =
+              MARKER + "\n" +
+              `👋 Hi @${author},\n\n` +
+              `This pull request does not follow the [PR template](${templateUrl}) yet:\n\n` +
+              failureList + "\n\n" +
+              `**Edit the PR description** to fix it — no new PR needed. This check runs again on every edit and clears itself once everything is in place.\n\n` +
+              `Until then the PR is marked \`stale\` and will be closed in **7 days**.\n\n` +
+              `Maintainers can add the \`keep-open\` label to exempt a PR from this check.\n\n` +
+              `Thank you for contributing! 🙏`;
 
-            await github.rest.issues.createComment({
-              owner,
-              repo,
-              issue_number: prNumber,
-              body: comment,
-            });
+            if (mine) {
+              if (mine.body !== text) {
+                await github.rest.issues.updateComment({ owner, repo, comment_id: mine.id, body: text });
+              }
+            } else {
+              await github.rest.issues.createComment({ owner, repo, issue_number: prNumber, body: text });
+            }
 
-            await github.rest.pulls.update({
-              owner,
-              repo,
-              pull_number: prNumber,
-              state: "closed",
-            });
-
-            await github.rest.issues.addLabels({
-              owner,
-              repo,
-              issue_number: prNumber,
-              labels: ["missing pr template"],
-            });
+            const toAdd = LABELS.filter(name => !prLabels.includes(name));
+            if (toAdd.length > 0) {
+              await github.rest.issues.addLabels({ owner, repo, issue_number: prNumber, labels: toAdd });
+            }

.github/workflows/delete-pocketbase-entry-on-removal.yml

@@ -267,15 +267,14 @@ jobs:
               const stubPath = path.join('ct', slug + '.sh');
               const content = [
                 "#!/usr/bin/env bash",
-                "source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)",
+                "source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/core/main/core/core.func)",
                 "# Copyright (c) 2021-2026 community-scripts ORG",
                 "# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE",
                 "",
                 `APP="${appName.replace(/"/g, '\\"')}"`,
                 "",
-                'header_info "$APP"',
-                'variables',
                 'color',
+                'header_info',
                 "",
                 'msg_error "This script is no longer available in community-scripts."',
                 `msg_error "${deletedMessage.replace(/"/g, '\\"')}"`,

.github/workflows/pr-test-command.yml

@@ -184,8 +184,8 @@ jobs:
                 );
               }
               lines.push(
-                'Only the script itself comes from this branch. Whatever it loads, the engine',
-                'or the `misc/` helpers, still comes from `main`.',
+                'Only the script itself comes from this branch. The engine it loads still',
+                'comes from community-scripts/core on `main`.',
               );
             }
 

.github/workflows/request-script-eligibility.yml

@@ -0,0 +1,141 @@
+name: Request Script Eligibility Check
+
+# category.slug is the same string GitHub uses in the "new discussion" URL
+# (?category=request-script, linked from every repo's issue chooser), so this
+# guard matches the live category without needing its numeric id.
+on:
+  discussion:
+    types: [created, edited, reopened]
+
+jobs:
+  check-eligibility:
+    if: github.repository == 'community-scripts/ProxmoxVE' && github.event.discussion.category.slug == 'request-script'
+    runs-on: ubuntu-latest
+    permissions:
+      discussions: write
+      issues: write
+      contents: read
+    steps:
+      - name: Verify stars/age, flag or close
+        uses: actions/github-script@v9
+        with:
+          script: |
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const discussion = context.payload.discussion;
+
+            if (!discussion || discussion.state === "closed") {
+              core.info("Discussion missing or already closed — skipping.");
+              return;
+            }
+
+            const body = discussion.body || "";
+            const lines = body.split("\n");
+            const fields = {};
+            let current = null;
+            for (const line of lines) {
+              const m = line.match(/^###\s+(.+?)\s*$/);
+              if (m) {
+                current = m[1].trim();
+                fields[current] = [];
+              } else if (current) {
+                fields[current].push(line);
+              }
+            }
+            function fieldText(label) {
+              const raw = (fields[label] || []).join("\n").trim();
+              return raw === "_No response_" ? "" : raw;
+            }
+
+            const sourceRepo = fieldText("Source Repository");
+            const justification = fieldText("Justification for an exception");
+
+            let eligible = false;
+            let verified = false;
+            const ghMatch = sourceRepo.match(/^https?:\/\/(?:www\.)?github\.com\/([^\/\s]+)\/([^\/\s#?]+?)(?:\.git)?\/?(?:[#?].*)?$/i);
+
+            if (ghMatch) {
+              const [, repoOwner, repoName] = ghMatch;
+              try {
+                const { data: repoData } = await github.rest.repos.get({ owner: repoOwner, repo: repoName });
+                const stars = repoData.stargazers_count;
+                const createdAt = new Date(repoData.created_at);
+                const now = new Date();
+                const ageMonths =
+                  (now.getFullYear() - createdAt.getFullYear()) * 12 +
+                  (now.getMonth() - createdAt.getMonth()) -
+                  (now.getDate() < createdAt.getDate() ? 1 : 0);
+                eligible = stars >= 1000 && ageMonths >= 6;
+                verified = true;
+                core.info(`Verified ${repoOwner}/${repoName}: ${stars} stars, ${ageMonths} months old, eligible=${eligible}`);
+              } catch (err) {
+                core.warning(`Could not verify ${repoOwner}/${repoName}: ${err.message} — treating as unverifiable.`);
+              }
+            } else {
+              core.info("Source Repository is not a github.com URL — cannot auto-verify, treating as unverifiable.");
+            }
+
+            if (eligible) {
+              core.info(`Discussion #${discussion.number} meets the requirements — no action.`);
+              return;
+            }
+
+            const labels = (discussion.labels || []).map(l => l.name);
+            const reasonLine = verified
+              ? "the source repository does not meet the 1,000-star / 6-month minimum adoption requirement"
+              : "the source repository's star count and age could not be verified automatically";
+
+            if (justification) {
+              if (labels.includes("investigation")) {
+                core.info(`Discussion #${discussion.number} already flagged for investigation — skipping.`);
+                return;
+              }
+
+              try {
+                await github.rest.issues.createLabel({
+                  owner, repo, name: "investigation",
+                  color: "fbca04",
+                  description: "Below the normal script-request threshold; a justification was given and needs maintainer review.",
+                });
+              } catch (err) {
+                if (err.status !== 422) throw err;
+              }
+
+              const labelQuery = await github.graphql(
+                `query($owner: String!, $repo: String!) { repository(owner: $owner, name: $repo) { label(name: "investigation") { id } } }`,
+                { owner, repo }
+              );
+              const labelNodeId = labelQuery.repository.label.id;
+
+              await github.graphql(
+                `mutation($labelableId: ID!, $labelIds: [ID!]!) { addLabelsToLabelable(input: { labelableId: $labelableId, labelIds: $labelIds }) { clientMutationId } }`,
+                { labelableId: discussion.node_id, labelIds: [labelNodeId] }
+              );
+
+              await github.graphql(
+                `mutation($discussionId: ID!, $body: String!) { addDiscussionComment(input: { discussionId: $discussionId, body: $body }) { comment { id } } }`,
+                {
+                  discussionId: discussion.node_id,
+                  body:
+                    `Thanks for the justification — ${reasonLine}, so this has been flagged \`investigation\` for a maintainer ` +
+                    `to review manually rather than closed automatically.`,
+                }
+              );
+            } else {
+              await github.graphql(
+                `mutation($discussionId: ID!, $body: String!) { addDiscussionComment(input: { discussionId: $discussionId, body: $body }) { comment { id } } }`,
+                {
+                  discussionId: discussion.node_id,
+                  body:
+                    `This request doesn't meet the minimum requirements (1,000 stars, project at least 6 months old) — ` +
+                    `${reasonLine}, and no justification was given. Closing automatically.\n\n` +
+                    `If you believe this project qualifies for an exception, edit this discussion to fill in ` +
+                    `**Justification for an exception** and reopen it — it will then be flagged for manual review instead of closed again.`,
+                }
+              );
+
+              await github.graphql(
+                `mutation($discussionId: ID!) { closeDiscussion(input: { discussionId: $discussionId, reason: OUTDATED }) { discussion { id } } }`,
+                { discussionId: discussion.node_id }
+              );
+            }

.github/workflows/stale_pr_close.yml

@@ -22,90 +22,112 @@ jobs:
             const now = new Date();
             const owner = context.repo.owner;
             const repo = context.repo.repo;
-            
-            // --- When stale label is added, comment immediately ---
+            const TEMPLATE_LABEL = "missing pr template";
+            const MAINTAINERS = ["OWNER", "MEMBER", "COLLABORATOR"];
+            const days = d => (now - d) / (1000 * 60 * 60 * 24);
+            const staleNotice = author =>
+              `@${author} This PR has been marked as stale. It will be closed if no new commits are added in 7 days.`;
+
+            // Only fires for a maintainer's label: labels set with GITHUB_TOKEN raise no event.
             if (context.eventName === "pull_request_target" && context.payload.action === "labeled") {
-              const label = context.payload.label?.name;
-              if (label === "stale") {
-                const author = context.payload.pull_request.user.login;
+              const pr = context.payload.pull_request;
+              const labels = (pr.labels || []).map(l => l.name);
+              if (context.payload.label?.name === "stale" && !labels.includes(TEMPLATE_LABEL)) {
                 await github.rest.issues.createComment({
-                  owner,
-                  repo,
-                  issue_number: context.payload.pull_request.number,
-                  body: `@${author} This PR has been marked as stale. It will be closed if no new commits are added in 7 days.`
+                  owner, repo, issue_number: pr.number, body: staleNotice(pr.user.login)
                 });
               }
               return;
             }
-            
-            // --- Scheduled run: check all stale PRs ---
-            const { data: prs } = await github.rest.pulls.list({
-              owner,
-              repo,
-              state: "open",
-              per_page: 100
-            });
-            
+
+            const prs = await github.paginate(github.rest.pulls.list, { owner, repo, state: "open", per_page: 100 });
+
             for (const pr of prs) {
-              const hasStale = pr.labels.some(l => l.name === "stale");
-              if (!hasStale) continue;
-              
-              // Get timeline events to find when stale label was added
-              const { data: events } = await github.rest.issues.listEvents({
-                owner,
-                repo,
-                issue_number: pr.number,
-                per_page: 100
-              });
-              
-              // Find the most recent time the stale label was added
-              const staleLabelEvents = events
-                .filter(e => e.event === "labeled" && e.label?.name === "stale")
-                .sort((a, b) => new Date(b.created_at) - new Date(a.created_at));
-              
-              if (staleLabelEvents.length === 0) continue;
-              
-              const staleLabelDate = new Date(staleLabelEvents[0].created_at);
-              const daysSinceStale = (now - staleLabelDate) / (1000 * 60 * 60 * 24);
-              
-              // Check for new commits since stale label was added
-              const { data: commits } = await github.rest.pulls.listCommits({
-                owner,
-                repo,
-                pull_number: pr.number
-              });
-              
-              const lastCommitDate = new Date(commits[commits.length - 1].commit.author.date);
+              const labels = pr.labels.map(l => l.name);
               const author = pr.user.login;
-              
-              // If there are new commits after the stale label, remove it
-              if (lastCommitDate > staleLabelDate) {
-                await github.rest.issues.removeLabel({
-                  owner,
-                  repo,
-                  issue_number: pr.number,
-                  name: "stale"
+              const hasStale = labels.includes("stale");
+
+              if (labels.includes("keep-open")) {
+                if (hasStale) {
+                  await github.rest.issues.removeLabel({ owner, repo, issue_number: pr.number, name: "stale" });
+                }
+                continue;
+              }
+
+              const comments = await github.paginate(github.rest.issues.listComments, {
+                owner, repo, issue_number: pr.number, per_page: 100
+              });
+              const commits = await github.paginate(github.rest.pulls.listCommits, {
+                owner, repo, pull_number: pr.number, per_page: 100
+              });
+              const lastCommitDate = commits.length > 0
+                ? new Date(commits[commits.length - 1].commit.author.date)
+                : new Date(pr.created_at);
+              const humanComments = comments.filter(c => c.user?.type !== "Bot");
+
+              // -------------------------------------------------------
+              // Auto-label PRs with no activity in the last 14 days,
+              // but ONLY if someone other than the author has engaged.
+              // -------------------------------------------------------
+              if (!hasStale) {
+                const reviews = await github.paginate(github.rest.pulls.listReviews, {
+                  owner, repo, pull_number: pr.number, per_page: 100
                 });
+                const engaged =
+                  reviews.some(r => r.user?.type !== "Bot" && r.user?.login !== author) ||
+                  humanComments.some(c => c.user?.login !== author);
+                if (!engaged) continue;
+
+                const lastCommentDate = humanComments.length > 0
+                  ? new Date(humanComments[humanComments.length - 1].created_at)
+                  : null;
+                const lastActivityDate = lastCommentDate && lastCommentDate > lastCommitDate
+                  ? lastCommentDate
+                  : lastCommitDate;
+
+                if (days(lastActivityDate) > 14) {
+                  await github.rest.issues.addLabels({ owner, repo, issue_number: pr.number, labels: ["stale"] });
+                  await github.rest.issues.createComment({ owner, repo, issue_number: pr.number, body: staleNotice(author) });
+                }
+                continue;
+              }
+
+              // -------------------------------------------------------
+              // Manage already-stale PRs
+              // -------------------------------------------------------
+              const events = await github.paginate(github.rest.issues.listEvents, {
+                owner, repo, issue_number: pr.number, per_page: 100
+              });
+              const staleDates = events
+                .filter(e => e.event === "labeled" && e.label?.name === "stale")
+                .map(e => new Date(e.created_at));
+              if (staleDates.length === 0) continue;
+              const staleLabelDate = new Date(Math.max(...staleDates));
+              const isTemplateIssue = labels.includes(TEMPLATE_LABEL);
+
+              // A push ends an inactivity mark; a template mark only ends via close-invalid-pr-template.yml's re-check.
+              if (!isTemplateIssue && lastCommitDate > staleLabelDate) {
+                await github.rest.issues.removeLabel({ owner, repo, issue_number: pr.number, name: "stale" });
                 await github.rest.issues.createComment({
-                  owner,
-                  repo,
-                  issue_number: pr.number,
+                  owner, repo, issue_number: pr.number,
                   body: `@${author} Recent activity detected. Removing stale label.`
                 });
+                continue;
               }
-              // If 7 days have passed since stale label, close the PR
-              else if (daysSinceStale > 7) {
-                await github.rest.pulls.update({
-                  owner,
-                  repo,
-                  pull_number: pr.number,
-                  state: "closed"
-                });
-                await github.rest.issues.createComment({
-                  owner,
-                  repo,
-                  issue_number: pr.number,
-                  body: `@${author} Closing stale PR due to inactivity (no commits for 7 days after stale label).`
-                });
-              }
+
+              // A maintainer comment after the mark restarts the 7 days.
+              const maintainerDates = humanComments
+                .filter(c => MAINTAINERS.includes(c.author_association) && c.user?.login !== author)
+                .map(c => new Date(c.created_at))
+                .filter(d => d > staleLabelDate);
+              const clockStart = maintainerDates.length > 0 ? new Date(Math.max(...maintainerDates)) : staleLabelDate;
+              if (days(clockStart) <= 7) continue;
+
+              await github.rest.issues.createComment({
+                owner, repo, issue_number: pr.number,
+                body: isTemplateIssue
+                  ? `@${author} Closing: the PR template requirements listed above were still missing 7 days later. Once they are in place, please open a new pull request.`
+                  : `@${author} Closing stale PR due to inactivity (no commits for 7 days after stale label).`
+              });
+              await github.rest.pulls.update({ owner, repo, pull_number: pr.number, state: "closed" });
             }

.github/workflows/sync-to-incus.yml

@@ -5,8 +5,8 @@ name: Sync ct/install to Incus
 #
 # The actual mirroring + transformation lives in community-scripts/Incus
 # (.github/workflows/sync-scripts.yml): it rewrites each script's bootstrap line
-# to load the engine from community-scripts/core (ProxmoxVE's misc/build.func is
-# a monolith with no Incus backend), so a plain 1:1 copy would break every Incus
+# to load the engine from community-scripts/core (ct scripts here load its PVE
+# backend; Incus needs the Incus one), so a plain 1:1 copy would break every Incus
 # script. We therefore only fire a repository_dispatch and let that single
 # source of truth do the work (and auto-approve + merge its own PR).
 #

CHANGELOG.md

@@ -1,6 +1,6 @@
 <div align="center">
   <a href="#">
-    <img src="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/images/logo.png" height="100px" />
+    <img src="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/.github/assets/logo.png" height="100px" />
  </a>
 </div>
 <h1 align="center">Changelog</h1>
@@ -119,6 +119,12 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 
 
+
+
+
+
+
+
 
 
 
@@ -135,7 +141,14 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 
 <details>
-<summary><h4>October (24 entries)</h4></summary>
+<summary><h4>November (7 entries)</h4></summary>
+
+[View November 2026 Changelog](.github/changelogs/2026/11.md)
+
+</details>
+
+<details>
+<summary><h4>October (31 entries)</h4></summary>
 
 [View October 2026 Changelog](.github/changelogs/2026/10.md)
 
@@ -568,6 +581,241 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-11-08
+
+### 🆕 New Scripts
+
+  - Chatto ([#18521](https://github.com/community-scripts/ProxmoxVE/pull/18521))
+- Firefox-Syncserver ([#18520](https://github.com/community-scripts/ProxmoxVE/pull/18520))
+
+### 🚀 Updated Scripts
+
+  - #### 🔧 Refactor
+
+    - Databasus: build 3.65 and ship the verification agent [@MickLesk](https://github.com/MickLesk) ([#18500](https://github.com/community-scripts/ProxmoxVE/pull/18500))
+
+## 2026-11-07
+
+### 🆕 New Scripts
+
+  - EspoCRM ([#18519](https://github.com/community-scripts/ProxmoxVE/pull/18519))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - RomM: emit player isolation headers from the serving location [@adotagarwal](https://github.com/adotagarwal) ([#18511](https://github.com/community-scripts/ProxmoxVE/pull/18511))
+
+  - #### 💥 Breaking Changes
+
+    - fix: gotenberg: update to v9 [@CrazyWolf13](https://github.com/CrazyWolf13) ([#18491](https://github.com/community-scripts/ProxmoxVE/pull/18491))
+
+### 💾 Core
+
+  - nvidia: close the hardware acceleration step when no GPU is usable | pin the whole NVIDIA userspace to the host's driver version [@MickLesk](https://github.com/MickLesk) ([core#215](https://github.com/community-scripts/core/pull/215))
+- fix: stage release downloads on disk, not in /tmp [@rcourtman](https://github.com/rcourtman) ([core#218](https://github.com/community-scripts/core/pull/218))
+- Minor fixes: restart php-fpm during sigpipe, Install jq for forge commands  [@MickLesk](https://github.com/MickLesk) ([core#213](https://github.com/community-scripts/core/pull/213))
+- incus: name the project restriction that refuses an Incus launch [@MickLesk](https://github.com/MickLesk) ([core#214](https://github.com/community-scripts/core/pull/214))
+
+## 2026-11-06
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - UmbrelOS-VM: report runs as ProxmoxVE, not DevScripts [@MickLesk](https://github.com/MickLesk) ([#18497](https://github.com/community-scripts/ProxmoxVE/pull/18497))
+    - Caddy: skip the xCaddy test build below 2 GB RAM [@MickLesk](https://github.com/MickLesk) ([#18472](https://github.com/community-scripts/ProxmoxVE/pull/18472))
+    - Thingsboard: keep the package defaults in thingsboard.conf [@MickLesk](https://github.com/MickLesk) ([#18499](https://github.com/community-scripts/ProxmoxVE/pull/18499))
+    - Nexterm: keep the extracted app out of the /tmp cleanup [@MickLesk](https://github.com/MickLesk) ([#18501](https://github.com/community-scripts/ProxmoxVE/pull/18501))
+    - PLANKA: run the service with node instead of nodemon [@MickLesk](https://github.com/MickLesk) ([#18503](https://github.com/community-scripts/ProxmoxVE/pull/18503))
+    - MeTube/Yubal: install Deno without its shell setup [@MickLesk](https://github.com/MickLesk) ([#18406](https://github.com/community-scripts/ProxmoxVE/pull/18406))
+    - OPNsense VM: size the temp space check to the unpacked image |  say why the EFI disk could not be allocated [@MickLesk](https://github.com/MickLesk) ([#18404](https://github.com/community-scripts/ProxmoxVE/pull/18404))
+
+  - #### 🔧 Refactor
+
+    - Technitium DNS: read the version from its GitHub releases [@MickLesk](https://github.com/MickLesk) ([#18425](https://github.com/community-scripts/ProxmoxVE/pull/18425))
+
+### 💾 Core
+
+  - fix: spot same-filesystem bind mounts on Alpine [@rcourtman](https://github.com/rcourtman) ([core#212](https://github.com/community-scripts/core/pull/212))
+- fix: report a container that went down during setup, keep finished installs [@MickLesk](https://github.com/MickLesk) ([core#211](https://github.com/community-scripts/core/pull/211))
+
+### 📚 Documentation
+
+  - ci: reject DevScripts URLs in scripts [@MickLesk](https://github.com/MickLesk) ([#18498](https://github.com/community-scripts/ProxmoxVE/pull/18498))
+
+## 2026-11-05
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - OpenWRT-VM: leave the NIC untagged on a bridge without a port [@MickLesk](https://github.com/MickLesk) ([#18473](https://github.com/community-scripts/ProxmoxVE/pull/18473))
+    - Podman: skip Portainer where Podman has no Quadlet [@MickLesk](https://github.com/MickLesk) ([#18469](https://github.com/community-scripts/ProxmoxVE/pull/18469))
+    - Planka: change npm start argument to --production [@CerberusStyle](https://github.com/CerberusStyle) ([#18478](https://github.com/community-scripts/ProxmoxVE/pull/18478))
+    - OPNsense VM: wait for the FreeBSD login prompt instead of 180 seconds [@MickLesk](https://github.com/MickLesk) ([#18467](https://github.com/community-scripts/ProxmoxVE/pull/18467))
+
+  - #### 🔧 Refactor
+
+    - truenas-VM: let a failed ISO lookup reach its own error [@MickLesk](https://github.com/MickLesk) ([#18476](https://github.com/community-scripts/ProxmoxVE/pull/18476))
+    - proxmox-mail-gateway: take the repo suite from the container  [@MickLesk](https://github.com/MickLesk) ([#18475](https://github.com/community-scripts/ProxmoxVE/pull/18475))
+    - Immich: Bump to 3.3.6 and minor improvement [@MickLesk](https://github.com/MickLesk) ([#18474](https://github.com/community-scripts/ProxmoxVE/pull/18474))
+    - Tududi: run 2.0 on PostgreSQL, keep SQLite installs on 1.15.0 [@MickLesk](https://github.com/MickLesk) ([#18465](https://github.com/community-scripts/ProxmoxVE/pull/18465))
+
+### 💾 Core
+
+  - fix: keep the existing install until the new archive has extracted [@rcourtman](https://github.com/rcourtman) ([core#201](https://github.com/community-scripts/core/pull/201))
+- fix: keep the install when a clone or an Alpine extract fails [@rcourtman](https://github.com/rcourtman) ([core#210](https://github.com/community-scripts/core/pull/210))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - Arcane: write both env names, stop shipping the unused .env [@MickLesk](https://github.com/MickLesk) ([#18466](https://github.com/community-scripts/ProxmoxVE/pull/18466))
+
+## 2026-11-04
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Teleport: Poll readyz instead of fixed 10 second sleep. [@cthach](https://github.com/cthach) ([#18461](https://github.com/community-scripts/ProxmoxVE/pull/18461))
+    - n8n: install past its unsatisfiable canvas dependencies [@MickLesk](https://github.com/MickLesk) ([#18439](https://github.com/community-scripts/ProxmoxVE/pull/18439))
+    - Teable: add Redis cache [@MickLesk](https://github.com/MickLesk) ([#18450](https://github.com/community-scripts/ProxmoxVE/pull/18450))
+
+### 💾 Core
+
+  - feat: say why download_gpg_key failed [@MickLesk](https://github.com/MickLesk) ([core#208](https://github.com/community-scripts/core/pull/208))
+- feat: read the MOTD's OS version at login [@MickLesk](https://github.com/MickLesk) ([core#207](https://github.com/community-scripts/core/pull/207))
+- feat: skip screen clear when there is no terminal | pin only the scripts own app with var_appversion [@MickLesk](https://github.com/MickLesk) ([core#203](https://github.com/community-scripts/core/pull/203))
+
+## 2026-11-03
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Fedora VM: let the engine install libguestfs-tools [@MickLesk](https://github.com/MickLesk) ([#18422](https://github.com/community-scripts/ProxmoxVE/pull/18422))
+    - Cinephage: run the camoufox binary the package now ships [@MickLesk](https://github.com/MickLesk) ([#18426](https://github.com/community-scripts/ProxmoxVE/pull/18426))
+    - AlmaLinux VM: report failures through the engine's error handler [@MickLesk](https://github.com/MickLesk) ([#18418](https://github.com/community-scripts/ProxmoxVE/pull/18418))
+    - WireGuard: give the Debian container 1 GB for WGDashboard [@MickLesk](https://github.com/MickLesk) ([#18419](https://github.com/community-scripts/ProxmoxVE/pull/18419))
+    - zabbix: use os specific apt packages [@MickLesk](https://github.com/MickLesk) ([#18417](https://github.com/community-scripts/ProxmoxVE/pull/18417))
+    - Discourse: build libvips 8.18 for its image worker [@MickLesk](https://github.com/MickLesk) ([#18430](https://github.com/community-scripts/ProxmoxVE/pull/18430))
+    - Wazuh: show the installer's own error when it fails [@MickLesk](https://github.com/MickLesk) ([#18428](https://github.com/community-scripts/ProxmoxVE/pull/18428))
+    - Tracearr: move to Node.js 26 [@connorgallopo](https://github.com/connorgallopo) ([#18393](https://github.com/community-scripts/ProxmoxVE/pull/18393))
+
+  - #### ✨ New Features
+
+    - Wiki.js: install 3.x [@MickLesk](https://github.com/MickLesk) ([#18382](https://github.com/community-scripts/ProxmoxVE/pull/18382))
+
+  - #### 🔧 Refactor
+
+    - OpenWrt VM: read the stable release from downloads.openwrt.org [@MickLesk](https://github.com/MickLesk) ([#18411](https://github.com/community-scripts/ProxmoxVE/pull/18411))
+    - Immich: fetch VectorChord from its new repo, skip Java, get GeoNames first [@MickLesk](https://github.com/MickLesk) ([#18397](https://github.com/community-scripts/ProxmoxVE/pull/18397))
+
+### 💾 Core
+
+  - fix: put the reason for a VM failure into its trace [@MickLesk](https://github.com/MickLesk) ([core#200](https://github.com/community-scripts/core/pull/200))
+- fix: check the bridge before creating a container, and its state after start [@MickLesk](https://github.com/MickLesk) ([core#199](https://github.com/community-scripts/core/pull/199))
+- ref: offer to remove only the container this run created [@MickLesk](https://github.com/MickLesk) ([core#198](https://github.com/community-scripts/core/pull/198))
+- feat: report a cancelled tool dialog as an abort and name the failing command [@MickLesk](https://github.com/MickLesk) ([core#197](https://github.com/community-scripts/core/pull/197))
+- feat: check KVM and the host's threads before building a VM [@MickLesk](https://github.com/MickLesk) ([core#196](https://github.com/community-scripts/core/pull/196))
+- ref: give a host tool one log file for the whole run [@MickLesk](https://github.com/MickLesk) ([core#194](https://github.com/community-scripts/core/pull/194))
+- fix: keep a piped stdin when output moves to the log after a hangup [@MickLesk](https://github.com/MickLesk) ([core#193](https://github.com/community-scripts/core/pull/193))
+- fix: pve-LXC: say when the container went away during its setup [@MickLesk](https://github.com/MickLesk) ([core#192](https://github.com/community-scripts/core/pull/192))
+- fix: treat Esc in a VM wizard dialog as leaving the script [@MickLesk](https://github.com/MickLesk) ([core#190](https://github.com/community-scripts/core/pull/190))
+- ref: count a container stopped during a detached install as an abort [@MickLesk](https://github.com/MickLesk) ([core#187](https://github.com/community-scripts/core/pull/187))
+- feat: find the assets of a renamed GitHub repo without the API [@MickLesk](https://github.com/MickLesk) ([core#188](https://github.com/community-scripts/core/pull/188))
+- fix: restore npm when an interrupted update left it behind [@MickLesk](https://github.com/MickLesk) ([core#189](https://github.com/community-scripts/core/pull/189))
+- feat: add var_cmode to set the container console mode [@MickLesk](https://github.com/MickLesk) ([core#180](https://github.com/community-scripts/core/pull/180))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - all-templates: answering No or Cancel is not a failure [@MickLesk](https://github.com/MickLesk) ([#18423](https://github.com/community-scripts/ProxmoxVE/pull/18423))
+    - homebrew: skip service accounts when picking the user, survive a failed apt update [@MickLesk](https://github.com/MickLesk) ([#18424](https://github.com/community-scripts/ProxmoxVE/pull/18424))
+    - add-tailscale-lxc: start a stopped container and check its OS first [@MickLesk](https://github.com/MickLesk) ([#18421](https://github.com/community-scripts/ProxmoxVE/pull/18421))
+    - netdata: survive a failed apt update, leave quietly on Cancel [@MickLesk](https://github.com/MickLesk) ([#18427](https://github.com/community-scripts/ProxmoxVE/pull/18427))
+    - Privilege-Converter: offer only container-capable storages as the converter's restore target [@MickLesk](https://github.com/MickLesk) ([#18415](https://github.com/community-scripts/ProxmoxVE/pull/18415))
+    - let post-pve-install go on when legacy sources are kept [@MickLesk](https://github.com/MickLesk) ([#18403](https://github.com/community-scripts/ProxmoxVE/pull/18403))
+
+  - #### 🔧 Refactor
+
+    -  update-apps: say why an backup or restore failed [@MickLesk](https://github.com/MickLesk) ([#18405](https://github.com/community-scripts/ProxmoxVE/pull/18405))
+    - Keep host tools running when clear does not know the terminal [@MickLesk](https://github.com/MickLesk) ([#18412](https://github.com/community-scripts/ProxmoxVE/pull/18412))
+    - Refuse to run the PBS 4 upgrade on a Proxmox VE host [@MickLesk](https://github.com/MickLesk) ([#18416](https://github.com/community-scripts/ProxmoxVE/pull/18416))
+    - fstrim: keep trimming when pct fstrim fails on one container [@MickLesk](https://github.com/MickLesk) ([#18413](https://github.com/community-scripts/ProxmoxVE/pull/18413))
+    - execute-lxc: do not abort on a container that is not Debian or Ubuntu [@MickLesk](https://github.com/MickLesk) ([#18414](https://github.com/community-scripts/ProxmoxVE/pull/18414))
+
+### 📚 Documentation
+
+  - github: flag instead of closing on first PR template miss; add script-request eligibility check [@MickLesk](https://github.com/MickLesk) ([#18384](https://github.com/community-scripts/ProxmoxVE/pull/18384))
+
+## 2026-11-02
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - FileFlows: replace the program folders on update [@MickLesk](https://github.com/MickLesk) ([#18380](https://github.com/community-scripts/ProxmoxVE/pull/18380))
+    - anchor: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18373](https://github.com/community-scripts/ProxmoxVE/pull/18373))
+    - guardian: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18375](https://github.com/community-scripts/ProxmoxVE/pull/18375))
+    - nametag: bump Node.js from 20 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18376](https://github.com/community-scripts/ProxmoxVE/pull/18376))
+
+### 💾 Core
+
+  - github: trim theater, add signal to the engine bug report; move AI block to end of PR template [@MickLesk](https://github.com/MickLesk) ([core#186](https://github.com/community-scripts/core/pull/186))
+- fix: do not wait forever for verbose output a daemon keeps open [@MickLesk](https://github.com/MickLesk) ([core#185](https://github.com/community-scripts/core/pull/185))
+
+## 2026-11-01
+
+### 🆕 New Scripts
+
+  - Amazon Linux ([#18369](https://github.com/community-scripts/ProxmoxVE/pull/18369))
+- CachyOS VM ([#18368](https://github.com/community-scripts/ProxmoxVE/pull/18368))
+- Razzia ([#18366](https://github.com/community-scripts/ProxmoxVE/pull/18366))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(zerobyte): build the bundled local agent [@nicotsx](https://github.com/nicotsx) ([#18363](https://github.com/community-scripts/ProxmoxVE/pull/18363))
+
+## 2026-10-31
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Docker VM: take the imported disk from vm_import_disk [@MickLesk](https://github.com/MickLesk) ([#18341](https://github.com/community-scripts/ProxmoxVE/pull/18341))
+    - Twenty: move to Node.js 26 [@MickLesk](https://github.com/MickLesk) ([#18337](https://github.com/community-scripts/ProxmoxVE/pull/18337))
+    - Norish: fetch Obscura from the repo Norish pins [@MickLesk](https://github.com/MickLesk) ([#18338](https://github.com/community-scripts/ProxmoxVE/pull/18338))
+    - HAOS VM: take the imported disk from vm_import_disk [@MickLesk](https://github.com/MickLesk) ([#18342](https://github.com/community-scripts/ProxmoxVE/pull/18342))
+    - Aurral: build the pnpm workspace and run backend/server.ts [@MickLesk](https://github.com/MickLesk) ([#18340](https://github.com/community-scripts/ProxmoxVE/pull/18340))
+    - PS5-MQTT: build the yarn workspace and run the packaged server [@MickLesk](https://github.com/MickLesk) ([#18339](https://github.com/community-scripts/ProxmoxVE/pull/18339))
+    - Jellyseerr, Overseerr, Paperless-ngx, Vikunja: skip migration prompts when unattended [@florianpunz](https://github.com/florianpunz) ([#18321](https://github.com/community-scripts/ProxmoxVE/pull/18321))
+    - Discourse: track the Ruby version Discourse requires [@MickLesk](https://github.com/MickLesk) ([#18329](https://github.com/community-scripts/ProxmoxVE/pull/18329))
+
+  - #### ✨ New Features
+
+    - MatterJS-Server: Add time sync [@tomfrenzel](https://github.com/tomfrenzel) ([#18330](https://github.com/community-scripts/ProxmoxVE/pull/18330))
+
+  - #### 🔧 Refactor
+
+    - Debian VM: keep a static IP without a snippets storage [@MickLesk](https://github.com/MickLesk) ([#18346](https://github.com/community-scripts/ProxmoxVE/pull/18346))
+    - Ubuntu VM: check for a snippets storage before building a static-IP VM [@MickLesk](https://github.com/MickLesk) ([#18347](https://github.com/community-scripts/ProxmoxVE/pull/18347))
+
+### 💾 Core
+
+  - feat: add setup_java_memory: size Java services from the CT's RAM on Proxmox [@MickLesk](https://github.com/MickLesk) ([core#181](https://github.com/community-scripts/core/pull/181))
+- analytics: name the Proxmox tasks when a container stops mid-install [@MickLesk](https://github.com/MickLesk) ([core#184](https://github.com/community-scripts/core/pull/184))
+- PVE: do not abort when the spinner PID file cannot be written [@MickLesk](https://github.com/MickLesk) ([core#183](https://github.com/community-scripts/core/pull/183))
+
+### 📂 Github
+
+  - Drop the legacy engine copies from misc/ [@MickLesk](https://github.com/MickLesk) ([#18294](https://github.com/community-scripts/ProxmoxVE/pull/18294))
+
 ## 2026-10-30
 
 ### 🆕 New Scripts
@@ -1117,352 +1365,4 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### ✨ New Features
 
-    - FileBrowser Quantum: migrate the config and database to v2 [@MickLesk](https://github.com/MickLesk) ([#17815](https://github.com/community-scripts/ProxmoxVE/pull/17815))
-
-## 2026-10-08
-
-### 🆕 New Scripts
-
-  - Unifi-OS-Server VM ([#17752](https://github.com/community-scripts/ProxmoxVE/pull/17752))
-- ZimaOS VM ([#17778](https://github.com/community-scripts/ProxmoxVE/pull/17778))
-
-### 🚀 Updated Scripts
-
-  - Revert "Immich: Pin to v3.3.0" [@MickLesk](https://github.com/MickLesk) ([#17767](https://github.com/community-scripts/ProxmoxVE/pull/17767))
-
-  - #### 🐞 Bug Fixes
-
-    - Homarr: replace the musl better-sqlite3 that v2.3.0 ships for Debian [@MickLesk](https://github.com/MickLesk) ([#17789](https://github.com/community-scripts/ProxmoxVE/pull/17789))
-    - CLIProxyAPI: keep plugins and data across updates [@MickLesk](https://github.com/MickLesk) ([#17790](https://github.com/community-scripts/ProxmoxVE/pull/17790))
-    - Kima-Hub: install the Python services into a uv venv [@MickLesk](https://github.com/MickLesk) ([#17791](https://github.com/community-scripts/ProxmoxVE/pull/17791))
-
-  - #### ✨ New Features
-
-    - Immich: Pin to 3.3.0 / Update ML Python to 3.13 [@MickLesk](https://github.com/MickLesk) ([#17770](https://github.com/community-scripts/ProxmoxVE/pull/17770))
-
-  - #### 🔧 Refactor
-
-    - Refactor: OPNsense VM [@MickLesk](https://github.com/MickLesk) ([#17785](https://github.com/community-scripts/ProxmoxVE/pull/17785))
-    - Refactor: Nextcloud VM (Turnkey) [@MickLesk](https://github.com/MickLesk) ([#17787](https://github.com/community-scripts/ProxmoxVE/pull/17787))
-    - Refactor: OpenWrt VM [@MickLesk](https://github.com/MickLesk) ([#17774](https://github.com/community-scripts/ProxmoxVE/pull/17774))
-    - Refactor: Ubuntu VM [@MickLesk](https://github.com/MickLesk) ([#17776](https://github.com/community-scripts/ProxmoxVE/pull/17776))
-
-### 💾 Core
-
-  - Tolerate a missing datacenter.cfg in vm_keyboard_default [@MickLesk](https://github.com/MickLesk) ([core#124](https://github.com/community-scripts/core/pull/124))
-- Take the ISO storage from the disk pool when it can hold ISOs [@MickLesk](https://github.com/MickLesk) ([core#122](https://github.com/community-scripts/core/pull/122))
-- Shared VM helpers: disk import, releases, checksums, first boot, IP by MAC [@MickLesk](https://github.com/MickLesk) ([core#117](https://github.com/community-scripts/core/pull/117))
-- tools: forge truncated release list [@MickLesk](https://github.com/MickLesk) ([core#118](https://github.com/community-scripts/core/pull/118))
-- Remember a kept cached image until the upstream changes [@MickLesk](https://github.com/MickLesk) ([core#119](https://github.com/community-scripts/core/pull/119))
-- Choose the VM keyboard layout and carry the host's timezone into prepared images [@MickLesk](https://github.com/MickLesk) ([core#120](https://github.com/community-scripts/core/pull/120))
-- VM's: run first-boot units without debconf dialogs [@MickLesk](https://github.com/MickLesk) ([core#121](https://github.com/community-scripts/core/pull/121))
-
-## 2026-10-07
-
-### 🆕 New Scripts
-
-  - Fedora VM ([#17747](https://github.com/community-scripts/ProxmoxVE/pull/17747))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - AudioMuse-AI: replace the venv on update without asking [@MickLesk](https://github.com/MickLesk) ([#17738](https://github.com/community-scripts/ProxmoxVE/pull/17738))
-    - paperclip: run as a dedicated non-root user so Claude Code can skip permissions [@samvandenbossche](https://github.com/samvandenbossche) ([#17707](https://github.com/community-scripts/ProxmoxVE/pull/17707))
-    - Thingsboard: update Java version from 17 to 25 [@CerberusStyle](https://github.com/CerberusStyle) ([#17733](https://github.com/community-scripts/ProxmoxVE/pull/17733))
-
-  - #### ✨ New Features
-
-    - Immich: Pin to v3.3.0 [@vhsdream](https://github.com/vhsdream) ([#17759](https://github.com/community-scripts/ProxmoxVE/pull/17759))
-
-  - #### 💥 Breaking Changes
-
-    - OpenCloud: bump to v8.1.0, rebuild search index on upgrade [@SimKaiLong](https://github.com/SimKaiLong) ([#17710](https://github.com/community-scripts/ProxmoxVE/pull/17710))
-
-  - #### 🔧 Refactor
-
-    - Pangolin: Unpin Release, stable enough, Bump to latest [@MickLesk](https://github.com/MickLesk) ([#17740](https://github.com/community-scripts/ProxmoxVE/pull/17740))
-    - Refactor: Archlinux-VM [@MickLesk](https://github.com/MickLesk) ([#17741](https://github.com/community-scripts/ProxmoxVE/pull/17741))
-    - Refactor: MikroTik RouterOS [@MickLesk](https://github.com/MickLesk) ([#17748](https://github.com/community-scripts/ProxmoxVE/pull/17748))
-
-### 💾 Core
-
-  - Fix Fedora and BLS cloud image console setup [@MickLesk](https://github.com/MickLesk) ([core#116](https://github.com/community-scripts/core/pull/116))
-- Keep setup_nodejs alive when the caller's directory is gone [@MickLesk](https://github.com/MickLesk) ([core#114](https://github.com/community-scripts/core/pull/114))
-
-## 2026-10-06
-
-### 🆕 New Scripts
-
-  - Pricebuddy ([#17708](https://github.com/community-scripts/ProxmoxVE/pull/17708))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Webtrees: stop serving data/ and the source folders directly [@MickLesk](https://github.com/MickLesk) ([#17724](https://github.com/community-scripts/ProxmoxVE/pull/17724))
-
-### 💾 Core
-
-  - Incus: check the architecture on Incus hosts too [@MickLesk](https://github.com/MickLesk) ([core#113](https://github.com/community-scripts/core/pull/113))
-- Incus: Pass the app's var_* settings into Incus containers  [@MickLesk](https://github.com/MickLesk) ([core#112](https://github.com/community-scripts/core/pull/112))
-- Incus: stub storage_content_check on Incus [@MickLesk](https://github.com/MickLesk) ([core#104](https://github.com/community-scripts/core/pull/104))
-- Incus: map Proxmox template versions to Incus image names [@MickLesk](https://github.com/MickLesk) ([core#111](https://github.com/community-scripts/core/pull/111))
-- Incus: read storage names from .vars files  [@MickLesk](https://github.com/MickLesk) ([core#110](https://github.com/community-scripts/core/pull/110))
-- Incus: show the spinner inside containers again [@MickLesk](https://github.com/MickLesk) ([core#109](https://github.com/community-scripts/core/pull/109))
-- Incus: set the hostname with sh, so it works before bash is installed [@MickLesk](https://github.com/MickLesk) ([core#102](https://github.com/community-scripts/core/pull/102))
-- Incus: reserve a plain address on Incus, leave the gateway to the network [@MickLesk](https://github.com/MickLesk) ([core#101](https://github.com/community-scripts/core/pull/101))
-- Incus: Wait for the network on Alpine OS too [@MickLesk](https://github.com/MickLesk) ([core#105](https://github.com/community-scripts/core/pull/105))
-- Incus: do not fail the build when hostname -I is missing [@MickLesk](https://github.com/MickLesk) ([core#103](https://github.com/community-scripts/core/pull/103))
-- Incus: Fuse always in unprivileged Containers, attach TUN only when container lacks it [@MickLesk](https://github.com/MickLesk) ([core#108](https://github.com/community-scripts/core/pull/108))
-- Incus: accept mode=generated [@MickLesk](https://github.com/MickLesk) ([core#106](https://github.com/community-scripts/core/pull/106))
-- Incus: pass the full install environment into Incus containers (quoted) [@MickLesk](https://github.com/MickLesk) ([core#107](https://github.com/community-scripts/core/pull/107))
-
-## 2026-10-05
-
-### 🚀 Updated Scripts
-
-  - Point to DevScripts, the renamed ProxmoxVED [@MickLesk](https://github.com/MickLesk) ([#17694](https://github.com/community-scripts/ProxmoxVE/pull/17694))
-
-  - #### 🐞 Bug Fixes
-
-    - wanderer: set the proxy secret and install plugins in their own directories [@MickLesk](https://github.com/MickLesk) ([#17698](https://github.com/community-scripts/ProxmoxVE/pull/17698))
-    - discourse: serve stylesheets and repair the update [@MickLesk](https://github.com/MickLesk) ([#17697](https://github.com/community-scripts/ProxmoxVE/pull/17697))
-    - wikijs: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17689](https://github.com/community-scripts/ProxmoxVE/pull/17689))
-    - jotty: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17688](https://github.com/community-scripts/ProxmoxVE/pull/17688))
-
-### 💾 Core
-
-  - Read releases from github.com when the API is rate limited, resume stalled downloads [@MickLesk](https://github.com/MickLesk) ([core#99](https://github.com/community-scripts/core/pull/99))
-- Check for template and container storage before the settings menu [@MickLesk](https://github.com/MickLesk) ([core#98](https://github.com/community-scripts/core/pull/98))
-- Check /etc/pve before the settings menu [@MickLesk](https://github.com/MickLesk) ([core#97](https://github.com/community-scripts/core/pull/97))
-- Check container settings before pct create rejects them [@MickLesk](https://github.com/MickLesk) ([core#96](https://github.com/community-scripts/core/pull/96))
-- PVE: Smart Diagnosis - say why a container would not start [@MickLesk](https://github.com/MickLesk) ([core#95](https://github.com/community-scripts/core/pull/95))
-- Retry template downloads that pveam reports as done but are not [@MickLesk](https://github.com/MickLesk) ([core#94](https://github.com/community-scripts/core/pull/94))
-- Check the OS release against pve-container before creating anything [@MickLesk](https://github.com/MickLesk) ([core#93](https://github.com/community-scripts/core/pull/93))
-- Rename "ProxmoxVED"-Links to "DevScripts" [@MickLesk](https://github.com/MickLesk) ([core#91](https://github.com/community-scripts/core/pull/91))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - monitor-all: read container IPs from the host side [@jasonobrien](https://github.com/jasonobrien) ([#17686](https://github.com/community-scripts/ProxmoxVE/pull/17686))
-
-## 2026-10-04
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - immich: read the Intel runtime from the pinned release [@MickLesk](https://github.com/MickLesk) ([#17677](https://github.com/community-scripts/ProxmoxVE/pull/17677))
-
-### 💾 Core
-
-  - better explain unsupported version & upgrade path for pve [@MickLesk](https://github.com/MickLesk) ([core#86](https://github.com/community-scripts/core/pull/86))
-- Quote PostgreSQL identifiers and drop spaces from the creds file name [@MickLesk](https://github.com/MickLesk) ([core#89](https://github.com/community-scripts/core/pull/89))
-- Find the default Rust toolchain in current rustup output [@MickLesk](https://github.com/MickLesk) ([core#88](https://github.com/community-scripts/core/pull/88))
-
-## 2026-10-03
-
-### 🆕 New Scripts
-
-  - Keeper.sh ([#17659](https://github.com/community-scripts/ProxmoxVE/pull/17659))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - hermesagent: download the installer before running it [@MickLesk](https://github.com/MickLesk) ([#17666](https://github.com/community-scripts/ProxmoxVE/pull/17666))
-    - frigate: raise the Node heap for the web build [@MickLesk](https://github.com/MickLesk) ([#17667](https://github.com/community-scripts/ProxmoxVE/pull/17667))
-    - Tracearr: workaround for failing map tiles download and data preservation [@durzo](https://github.com/durzo) ([#17661](https://github.com/community-scripts/ProxmoxVE/pull/17661))
-    - fix(nginxproxymanager): clean yarn cache after builds to prevent disk growth [@PsycoStea](https://github.com/PsycoStea) ([#17653](https://github.com/community-scripts/ProxmoxVE/pull/17653))
-
-  - #### 🔧 Refactor
-
-    - Several Scripts: refactor msg_ blocks, generate passwords with helper, add CLEAN_INSTALL_KEEP  [@MickLesk](https://github.com/MickLesk) ([#17655](https://github.com/community-scripts/ProxmoxVE/pull/17655))
-
-### 💾 Core
-
-  - detect_repo_source: read the license header and fall back to ProxmoxVE [@MickLesk](https://github.com/MickLesk) ([core#85](https://github.com/community-scripts/core/pull/85))
-
-## 2026-10-02
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - zerobyte: upgrade Bun on update [@MickLesk](https://github.com/MickLesk) ([#17646](https://github.com/community-scripts/ProxmoxVE/pull/17646))
-    - sure: keep Active Storage uploads across updates [@MickLesk](https://github.com/MickLesk) ([#17648](https://github.com/community-scripts/ProxmoxVE/pull/17648))
-    - twenty: run upstreams upgrade command instead of the removed setup-db.ts [@MickLesk](https://github.com/MickLesk) ([#17647](https://github.com/community-scripts/ProxmoxVE/pull/17647))
-
-  - #### 🔧 Refactor
-
-    - NPM: Refactor / Fix npm openresty user and certbot version [@MickLesk](https://github.com/MickLesk) ([#17649](https://github.com/community-scripts/ProxmoxVE/pull/17649))
-    - several scripts: use the release helpers instead of hand-rolled version checks and downloads [@MickLesk](https://github.com/MickLesk) ([#17625](https://github.com/community-scripts/ProxmoxVE/pull/17625))
-
-### 💾 Core
-
-  - QoL: message blocks, clean-install keep list, password helper, network limits [@MickLesk](https://github.com/MickLesk) ([core#61](https://github.com/community-scripts/core/pull/61))
-
-## 2026-10-01
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - romm: keep the asset links in sync with ROMM_BASE_PATH [@MickLesk](https://github.com/MickLesk) ([#17610](https://github.com/community-scripts/ProxmoxVE/pull/17610))
-    - teslamate: build from the elixir directory since 4.3.0 [@MickLesk](https://github.com/MickLesk) ([#17612](https://github.com/community-scripts/ProxmoxVE/pull/17612))
-
-  - #### ✨ New Features
-
-    - feat(glance): add alpine os [@skilletfun](https://github.com/skilletfun) ([#17605](https://github.com/community-scripts/ProxmoxVE/pull/17605))
-    - feat(blocky): add alpine os [@skilletfun](https://github.com/skilletfun) ([#17637](https://github.com/community-scripts/ProxmoxVE/pull/17637))
-
-  - #### 🔧 Refactor
-
-    - several scripts: apt instead of apt-get, cleanup_lxc, nginx_enable_site, drop needless daemon-reloads [@MickLesk](https://github.com/MickLesk) ([#17624](https://github.com/community-scripts/ProxmoxVE/pull/17624))
-    - several scripts: use setup_postgresql_db / setup_mariadb_db instead of hand-written SQL [@MickLesk](https://github.com/MickLesk) ([#17622](https://github.com/community-scripts/ProxmoxVE/pull/17622))
-
-### 💾 Core
-
-  - Offer to raise the kernel key limits instead of only naming them [@MickLesk](https://github.com/MickLesk) ([core#81](https://github.com/community-scripts/core/pull/81))
-
-### 🧰 Tools
-
-  - #### 🔧 Refactor
-
-    - tools, turnkey: load core instead of the legacy misc functions [@MickLesk](https://github.com/MickLesk) ([#17621](https://github.com/community-scripts/ProxmoxVE/pull/17621))
-
-### 📚 Documentation
-
-  - chore: drop the local header generation; headers come from core [@MickLesk](https://github.com/MickLesk) ([#17623](https://github.com/community-scripts/ProxmoxVE/pull/17623))
-
-## 2026-09-30
-
-### 🆕 New Scripts
-
-  - Shoko ([#17617](https://github.com/community-scripts/ProxmoxVE/pull/17617))
-- SIlo ([#17614](https://github.com/community-scripts/ProxmoxVE/pull/17614))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - fix(blocky): restart on failure and wait for network-online [@haplo](https://github.com/haplo) ([#17601](https://github.com/community-scripts/ProxmoxVE/pull/17601))
-    - SparkyFitness: update sed replacement [@tomfrenzel](https://github.com/tomfrenzel) ([#17604](https://github.com/community-scripts/ProxmoxVE/pull/17604))
-
-### 💾 Core
-
-  - vm: autologin on the serial console for images without cloud-init [@MickLesk](https://github.com/MickLesk) ([core#80](https://github.com/community-scripts/core/pull/80))
-- download_gpg_key: make dearmored keyrings world-readable [@MickLesk](https://github.com/MickLesk) ([core#79](https://github.com/community-scripts/core/pull/79))
-
-## 2026-09-29
-
-### 🆕 New Scripts
-
-  - Anki Sync Server ([#17416](https://github.com/community-scripts/ProxmoxVE/pull/17416))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - fix(kaneo): build with Vite+ instead of Turbo [@tinsever](https://github.com/tinsever) ([#17599](https://github.com/community-scripts/ProxmoxVE/pull/17599))
-    - tianji: raise the Node heap for the static build on install [@MickLesk](https://github.com/MickLesk) ([#17582](https://github.com/community-scripts/ProxmoxVE/pull/17582))
-    - fix(romm): snapshot Redis hourly like the upstream image [@DenislavDenev](https://github.com/DenislavDenev) ([#17562](https://github.com/community-scripts/ProxmoxVE/pull/17562))
-    - checkmate: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17554](https://github.com/community-scripts/ProxmoxVE/pull/17554))
-
-  - #### 🔧 Refactor
-
-    - Drop the scripts base pin from every ct/ script [@MickLesk](https://github.com/MickLesk) ([#17585](https://github.com/community-scripts/ProxmoxVE/pull/17585))
-    - odoo: move to Debian 13 and stay on the installed major on update [@MickLesk](https://github.com/MickLesk) ([#17581](https://github.com/community-scripts/ProxmoxVE/pull/17581))
-    - manyfold: use upstream f3d for headless renders on amd64 [@MickLesk](https://github.com/MickLesk) ([#17583](https://github.com/community-scripts/ProxmoxVE/pull/17583))
-
-### 💾 Core
-
-  - Default the scripts base to ProxmoxVE [@MickLesk](https://github.com/MickLesk) ([core#76](https://github.com/community-scripts/core/pull/76))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - all-templates: handle the arch column of pveam available [@MickLesk](https://github.com/MickLesk) ([#17579](https://github.com/community-scripts/ProxmoxVE/pull/17579))
-
-### 📂 Github
-
-  - Skip automated core pull requests in the changelog [@MickLesk](https://github.com/MickLesk) ([#17589](https://github.com/community-scripts/ProxmoxVE/pull/17589))
-- Post a test command for vm/, tools/ and turnkey/ changes too [@MickLesk](https://github.com/MickLesk) ([#17587](https://github.com/community-scripts/ProxmoxVE/pull/17587))
-- Remove the PocketBase AI bot [@MickLesk](https://github.com/MickLesk) ([#17591](https://github.com/community-scripts/ProxmoxVE/pull/17591))
-
-## 2026-09-28
-
-### 🚀 Updated Scripts
-
-  - Immich: Pin version to 3.2.4 [@vhsdream](https://github.com/vhsdream) ([#17564](https://github.com/community-scripts/ProxmoxVE/pull/17564))
-
-  - #### 🐞 Bug Fixes
-
-    - fix(autocaliweb): wire .env into all service units, not just autocali… [@bobartlett](https://github.com/bobartlett) ([#17561](https://github.com/community-scripts/ProxmoxVE/pull/17561))
-    - Zipline: Change cp command [@Mraedis](https://github.com/Mraedis) ([#17559](https://github.com/community-scripts/ProxmoxVE/pull/17559))
-    - Borg-UI: start through upstream's start.sh so migrations run [@MickLesk](https://github.com/MickLesk) ([#17563](https://github.com/community-scripts/ProxmoxVE/pull/17563))
-    - linkding: serve favicons and preview images [@MickLesk](https://github.com/MickLesk) ([#17557](https://github.com/community-scripts/ProxmoxVE/pull/17557))
-    - SparkyFitness: Fill in the nginx resolver 1.7.3 added [@MickLesk](https://github.com/MickLesk) ([#17556](https://github.com/community-scripts/ProxmoxVE/pull/17556))
-
-  - #### 🔧 Refactor
-
-    - Plane: Replace MinIO installation with Silo [@MickLesk](https://github.com/MickLesk) ([#17347](https://github.com/community-scripts/ProxmoxVE/pull/17347))
-
-## 2026-09-27
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - fix(aurral): bump to Node 26 and bypass strict engine pin [@JodyVanden](https://github.com/JodyVanden) ([#17543](https://github.com/community-scripts/ProxmoxVE/pull/17543))
-    - Tracearr: fetch map tiles on install/update [@durzo](https://github.com/durzo) ([#17544](https://github.com/community-scripts/ProxmoxVE/pull/17544))
-    - fix(autocaliweb): define INSTALL_DIR before first use [@bobartlett](https://github.com/bobartlett) ([#17545](https://github.com/community-scripts/ProxmoxVE/pull/17545))
-
-## 2026-09-26
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Manyfold: make /opt/manyfold_data writable for the manyfold user [@sergstepanenko](https://github.com/sergstepanenko) ([#17534](https://github.com/community-scripts/ProxmoxVE/pull/17534))
-    - steamcmd: update itself before installing Satisfactory [@MickLesk](https://github.com/MickLesk) ([#17526](https://github.com/community-scripts/ProxmoxVE/pull/17526))
-    - AudioMuse-AI: build noavx2 environment on Python 3.11 [@MickLesk](https://github.com/MickLesk) ([#17528](https://github.com/community-scripts/ProxmoxVE/pull/17528))
-    - LobeHub: pin lobehub/ui at 5.49 while LobeHub's stable release needs it [@MickLesk](https://github.com/MickLesk) ([#17531](https://github.com/community-scripts/ProxmoxVE/pull/17531))
-    - Keep Trilium updates on the server releases [@MickLesk](https://github.com/MickLesk) ([#17525](https://github.com/community-scripts/ProxmoxVE/pull/17525))
-    - NginxProxyManager: generate admin config and repair certbot's venv on update [@MickLesk](https://github.com/MickLesk) ([#17523](https://github.com/community-scripts/ProxmoxVE/pull/17523))
-    - Komodo: add KOMODO_HOST | fix broken spinner [@MickLesk](https://github.com/MickLesk) ([#17481](https://github.com/community-scripts/ProxmoxVE/pull/17481))
-    - romm: run rq cron and a scans worker for RomM 5.3 [@davidbb](https://github.com/davidbb) ([#17502](https://github.com/community-scripts/ProxmoxVE/pull/17502))
-
-  - #### 💥 Breaking Changes
-
-    - Semaphore: fix BoltDB migration by pinning 2.18.30 [@MickLesk](https://github.com/MickLesk) ([#17439](https://github.com/community-scripts/ProxmoxVE/pull/17439))
-
-### 💾 Core
-
-  - Keep a dash-led bridge comment out of whiptail's options [@MickLesk](https://github.com/MickLesk) ([core#74](https://github.com/community-scripts/core/pull/74))
-
-## 2026-09-25
-
-### 🆕 New Scripts
-
-  - RustFS ([#17499](https://github.com/community-scripts/ProxmoxVE/pull/17499))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Ignis: take the Obsidian version from release tag [@MickLesk](https://github.com/MickLesk) ([#17503](https://github.com/community-scripts/ProxmoxVE/pull/17503))
-
-  - #### 🔧 Refactor
-
-    - Refactor: Umbrel OS VM [@MickLesk](https://github.com/MickLesk) ([#17505](https://github.com/community-scripts/ProxmoxVE/pull/17505))
-    - Docker-LXC: remove Portainer installation from install [@MickLesk](https://github.com/MickLesk) ([#17493](https://github.com/community-scripts/ProxmoxVE/pull/17493))
-
-### 💾 Core
-
-  - Incus: make prompts visible for end-user [@MickLesk](https://github.com/MickLesk) ([core#73](https://github.com/community-scripts/core/pull/73))
-- incus: do not let an install script block on an invisible prompt [@MickLesk](https://github.com/MickLesk) ([core#71](https://github.com/community-scripts/core/pull/71))
-- tel: report progress from installs only, not updates [@MickLesk](https://github.com/MickLesk) ([core#72](https://github.com/community-scripts/core/pull/72))
+    - FileBrowser Quantum: migrate the config and database to v2 [@MickLesk](https://github.com/MickLesk) ([#17815](https://github.com/community-scripts/ProxmoxVE/pull/17815))

README.md

@@ -1,6 +1,6 @@
 <div align="center">
-  <a href="misc/images/community-scripts.svg"><img src="misc/images/community-scripts.png" width="112" height="112" alt="Community Scripts — Proxmox VE logo" /></a>
-  <!-- Editable artwork: misc/images/community-scripts.svg; PNG export: 512 × 512. -->
+  <a href=".github/assets/community-scripts.svg"><img src=".github/assets/community-scripts.png" width="112" height="112" alt="Community Scripts — Proxmox VE logo" /></a>
+  <!-- Editable artwork: .github/assets/community-scripts.svg; PNG export: 512 × 512. -->
 
   <h1>Community Scripts — Proxmox VE</h1>
   <p><strong>One-command installations for services, containers and VMs on Proxmox VE</strong><br/>
@@ -104,7 +104,6 @@ Virtual machine scripts need the same versions as containers.
 | `vm/` | Virtual machine scripts |
 | `tools/pve/` | Host tooling: post-install, hardware passthrough, maintenance |
 | `turnkey/` | TurnKey Linux appliance helper |
-| `misc/` | Legacy engine copies — current scripts load [core](https://github.com/community-scripts/core) at runtime, so changes here never reach a running install |
 
 Application metadata — name, description, logo, tags — is managed on the website,
 not in this repository. Use the **Report Issue** link on any script page to

ct/amazonlinux.sh

@@ -0,0 +1,41 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://aws.amazon.com/linux/
+
+APP="Amazon Linux"
+var_tags="${var_tags:-os}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-amazonlinux}"
+var_version="${var_version:-2023}"
+var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+  msg_info "Updating Amazon Linux LXC"
+  $STD dnf -y upgrade
+  msg_ok "Updated Amazon Linux LXC"
+  cleanup_lxc
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!"
+msg_custom "🚀" "${GN}" "${APP} setup has been successfully initialized!"

ct/anchor.sh

@@ -39,6 +39,7 @@ function update_script() {
     create_backup /opt/anchor/.env
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "anchor" "ZhFahim/anchor" "tarball"
+    NODE_VERSION="26" NODE_MODULE="pnpm" setup_nodejs
 
     msg_info "Building Server"
     cd /opt/anchor/server

ct/aurral.sh

@@ -37,19 +37,16 @@ function update_script() {
     msg_ok "Stopped Service"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "aurral" "lklynet/aurral" "tarball"
-    NODE_VERSION="26" setup_nodejs
+    NODE_VERSION="26" NODE_MODULE="pnpm" setup_nodejs
+    ensure_dependencies git
 
     msg_info "Updating Aurral"
     cd /opt/aurral
     export VITE_APP_VERSION="$(cat ~/.aurral)"
     export VITE_GITHUB_REPO="lklynet/aurral"
     export VITE_RELEASE_CHANNEL="stable"
-    # aurral's .npmrc sets engine-strict=true and pins an exact node patch (e.g. 26.8.x),
-    # which NodeSource can't match since it only ships the latest patch per major.
-    export npm_config_engine_strict=false
-    $STD npm ci --workspace frontend --include-workspace-root=false
-    $STD npm run build --workspace frontend
-    $STD npm ci --workspace backend --omit=dev --include=optional --include-workspace-root=false
+    $STD pnpm install --frozen-lockfile --config.engine-strict=false --filter aurral-frontend --filter aurral-backend
+    $STD pnpm --filter aurral-frontend run build
     mkdir -p /opt/aurral_data
     cat <<EOF >/opt/aurral/aurral.env
 NODE_ENV=production
@@ -57,6 +54,8 @@ PORT=3001
 AURRAL_DATA_DIR=/opt/aurral_data
 APP_VERSION=$(cat ~/.aurral)
 EOF
+    sed -i 's#backend/server.js#backend/server.ts#' /etc/systemd/system/aurral.service
+    systemctl daemon-reload
     msg_ok "Updated Aurral"
 
     msg_info "Starting Service"

ct/caddy.sh

@@ -55,9 +55,13 @@ update_deb_based() {
       setup_go
       fetch_and_deploy_gh_release "xcaddy" "caddyserver/xcaddy" "binary"
 
-      msg_info "Updating xCaddy"
-      $STD xcaddy build
-      msg_ok "Updated xCaddy"
+      if (($(awk '/^MemTotal:/ {print int($2 / 1024)}' /proc/meminfo) < 1900)); then
+        msg_warn "xCaddy updated; its test build was skipped because linking Caddy needs about 2 GB RAM"
+      else
+        msg_info "Updating xCaddy"
+        $STD xcaddy build
+        msg_ok "Updated xCaddy"
+      fi
     fi
   fi
   msg_ok "Updated successfully!"

ct/chatto.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/chattocorp/chatto
+
+APP="Chatto"
+var_tags="${var_tags:-chat;messaging}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/chatto ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "chatto" "chattocorp/chatto"; then
+    msg_info "Stopping Service"
+    systemctl stop chatto
+    msg_ok "Stopped Service"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "chatto" "chattocorp/chatto" "prebuild" "latest" "/opt/chatto" "chatto_Linux_$(arch_resolve x86_64 arm64).tar.gz"
+    chmod +x /opt/chatto/chatto
+
+    msg_info "Starting Service"
+    systemctl start chatto
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:4000${CL}"

ct/cinephage.sh

@@ -48,7 +48,7 @@ function update_script() {
     msg_ok "Built Cinephage"
 
     msg_info "Updating Camoufox"
-    $STD /opt/cinephage/node_modules/.bin/camoufox-js fetch
+    $STD /opt/cinephage/node_modules/.bin/camoufox fetch
     msg_ok "Updated Camoufox"
 
     msg_info "Starting Cinephage"

ct/databasus.sh

@@ -38,57 +38,29 @@ function update_script() {
     $STD systemctl stop databasus
     msg_ok "Stopped Databasus"
 
-    create_backup /opt/databasus/.env
-
-    msg_info "Ensuring Database Clients"
-    # Create PostgreSQL version symlinks for compatibility
-    for v in 12 13 14 15 16 18; do
-      ln -sf /usr/lib/postgresql/17 /usr/lib/postgresql/$v
-    done
-    # Install MongoDB Database Tools via direct .deb (no APT repo for Debian 13)
-    if ! command -v mongodump &>/dev/null; then
-      [[ "$(get_os_info id)" == "ubuntu" ]] && MONGO_DIST="ubuntu2204" || MONGO_DIST="debian12"
-      MONGO_ARCH=$(arch_resolve "x86_64" "arm64")
-      # MongoDB only publishes arm64 builds for Ubuntu
-      [[ "$MONGO_ARCH" == "arm64" ]] && MONGO_DIST="ubuntu2204"
-      fetch_and_deploy_from_url "https://fastdl.mongodb.org/tools/db/mongodb-database-tools-${MONGO_DIST}-${MONGO_ARCH}-100.16.1.deb"
-    fi
-    ensure_dependencies mariadb-client
-    mkdir -p /usr/local/mariadb-{10.6,12.1}/bin /usr/local/mysql-{5.7,8.0,8.4,9}/bin /usr/local/mongodb-database-tools/bin
-    [[ -f /usr/bin/mongodump ]] && ln -sf /usr/bin/mongodump /usr/local/mongodb-database-tools/bin/mongodump
-    [[ -f /usr/bin/mongorestore ]] && ln -sf /usr/bin/mongorestore /usr/local/mongodb-database-tools/bin/mongorestore
-    # Create MariaDB and MySQL client symlinks for compatibility
-    for dir in /usr/local/mariadb-{10.6,12.1}/bin; do
-      ln -sf /usr/bin/mariadb-dump "$dir/mariadb-dump"
-      ln -sf /usr/bin/mariadb "$dir/mariadb"
-    done
-    for dir in /usr/local/mysql-{5.7,8.0,8.4,9}/bin; do
-      ln -sf /usr/bin/mariadb-dump "$dir/mysqldump"
-      ln -sf /usr/bin/mariadb "$dir/mysql"
-    done
-    msg_ok "Ensured Database Clients"
-
+    ensure_dependencies libedit2 libgssapi-krb5-2 libncurses6 libreadline8t64
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "databasus" "databasus/databasus" "tarball" "latest" "/opt/databasus"
     GO_VERSION="$(grep -m1 '^go ' /opt/databasus/backend/go.mod | awk '{print $2}')" setup_go
 
     msg_info "Updating Databasus"
+    RELEASE=$(cat ~/.databasus)
     export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
     cd /opt/databasus/frontend
-
     $STD corepack prepare pnpm@latest --activate
     $STD pnpm install --frozen-lockfile
-    $STD pnpm run build
+    $STD env VITE_APP_VERSION="${RELEASE}" pnpm run build
     cd /opt/databasus/backend
-    $STD go mod download
-    $STD /root/go/bin/swag init -g cmd/main.go -o swagger
-    $STD env CGO_ENABLED=0 GOOS=linux GOARCH=$(arch_resolve) go build -o databasus ./cmd
-    mv /opt/databasus/backend/databasus /opt/databasus/databasus
+    $STD env CGO_ENABLED=0 GOOS=linux GOARCH="$(arch_resolve)" go build -o /opt/databasus/databasus ./cmd/databasus
+    mkdir -p /opt/databasus/agent-binaries
+    for arch in amd64 arm64; do
+      $STD env CGO_ENABLED=0 GOOS=linux GOARCH=$arch go build -ldflags "-X main.Version=${RELEASE}" -o /opt/databasus/agent-binaries/databasus-verification-agent-linux-$arch ./cmd/verification-agent
+    done
     mkdir -p /opt/databasus/ui/build
     cp -r /opt/databasus/frontend/dist/* /opt/databasus/ui/build/
-    cp -r /opt/databasus/backend/migrations /opt/databasus/
+    sed -i '/^APP_VERSION=/d' /.env
+    echo "APP_VERSION=${RELEASE}" >>/.env
     msg_ok "Updated Databasus"
 
-    restore_backup
     chown -R postgres:postgres /opt/databasus
 
     if ! grep -q "EnvironmentFile=/.env" /etc/systemd/system/databasus.service; then

ct/discourse.sh

@@ -51,16 +51,42 @@ function update_script() {
   cd /opt/discourse
   export PATH="$HOME/.rbenv/bin:$HOME/.rbenv/shims:$PATH"
   export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+  export BUNDLE_SILENCE_ROOT_WARNING=1
   set -a
   source /opt/discourse/.env
   set +a
   $STD git pull origin main
-  $STD bundle install
+  msg_ok "Updated Discourse"
+
+  if check_for_gh_release "libvips" "libvips/libvips"; then
+    ensure_dependencies meson ninja-build pkg-config libglib2.0-dev libexpat1-dev libjpeg-dev libpng-dev libwebp-dev libtiff-dev libheif-dev libjxl-dev librsvg2-dev libcgif-dev libexif-dev liblcms2-dev liborc-0.4-dev libimagequant-dev libpango1.0-dev
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "libvips" "libvips/libvips" "prebuild" "latest" "/opt/libvips" "vips-*.tar.xz"
+    msg_info "Building libvips"
+    cd /opt/libvips
+    $STD meson setup build --prefix=/usr/local --libdir=lib --buildtype=release -Dmodules=disabled -Dmagick=disabled -Dexamples=false
+    $STD ninja -C build install
+    ldconfig
+    msg_ok "Built libvips"
+  fi
+
+  msg_info "Updating Dependencies"
+  RUBY_TARGET=$(grep -A1 '^RUBY VERSION' /opt/discourse/Gemfile.lock | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -n1)
+  RUBY_VERSION="${RUBY_TARGET:-4.0.7}" RUBY_INSTALL_RAILS="false" setup_ruby
+  export PATH="$HOME/.rbenv/bin:$HOME/.rbenv/shims:$PATH"
+  hash -r
+  cd /opt/discourse
+  $STD bundle install -j"$(nproc)"
   $STD pnpm install
+  msg_ok "Updated Dependencies"
+
+  msg_info "Running Database Migrations"
   $STD runuser -u postgres -- psql -d discourse -c "CREATE EXTENSION IF NOT EXISTS vector;"
   $STD bundle exec rails db:migrate
+  msg_ok "Ran Database Migrations"
+
+  msg_info "Precompiling Assets"
   $STD bundle exec rails assets:precompile
-  msg_ok "Updated Discourse"
+  msg_ok "Precompiled Assets"
 
   msg_info "Starting Services"
   systemctl start discourse discourse-sidekiq

ct/espocrm.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Masked-Kunsiquat
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.espocrm.com/ | Github: https://github.com/espocrm/espocrm
+
+APP="EspoCRM"
+var_tags="${var_tags:-crm;business}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+export var_admin_user="${var_admin_user:-}"
+export var_admin_pass="${var_admin_pass:-}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/espocrm ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "espo-crm" "espocrm/espocrm"; then
+    msg_info "Stopping Services"
+    systemctl stop nginx cron php8.4-fpm
+    msg_ok "Stopped Services"
+
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="data custom client/custom" fetch_and_deploy_gh_release "espo-crm" "espocrm/espocrm" "prebuild" "latest" "/opt/espocrm" "EspoCRM-*.zip"
+
+    msg_info "Migrating EspoCRM"
+    cd /opt/espocrm
+    $STD php bin/command clear-cache
+    if ! $STD php bin/command migrate; then
+      chown -R www-data:www-data /opt/espocrm
+      systemctl start php8.4-fpm
+      systemctl start cron nginx
+      msg_error "Migration failed; customizations may be incompatible. Check /opt/espocrm/data/logs, then run update again."
+      exit 1
+    fi
+    chown -R www-data:www-data /opt/espocrm
+    msg_ok "Migrated EspoCRM"
+
+    msg_info "Starting Services"
+    systemctl start php8.4-fpm
+    systemctl start cron nginx
+    msg_ok "Started Services"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}${CL}"

ct/fileflows.sh

@@ -102,6 +102,7 @@ function update_script() {
   fi
   msg_ok "Ensured ASP.NET Core Runtime"
 
+  rm -rf /opt/fileflows/{Server,FlowRunner,Libraries,Agent}
   fetch_and_deploy_from_url "https://fileflows.com/downloads/ff-latest.tar.xz" "/opt/fileflows"
 
   msg_info "Starting Service"

ct/firefox-syncserver.sh

@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/mozilla-services/syncstorage-rs
+
+APP="Firefox-Syncserver"
+var_tags="${var_tags:-sync;firefox}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-3072}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-yes}" # built from source, nothing x86-only, but not yet run on arm64
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /usr/local/bin/syncserver ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "firefox-syncserver" "mozilla-services/syncstorage-rs"; then
+    msg_info "Stopping Firefox Syncserver"
+    systemctl stop firefox-syncserver
+    msg_ok "Stopped Firefox Syncserver"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "firefox-syncserver" "mozilla-services/syncstorage-rs" "tarball"
+    setup_rust
+
+    msg_info "Building Firefox Syncserver (Patience)"
+    cd /opt/firefox-syncserver
+    $STD cargo build --release --locked --no-default-features --features=syncstorage-db/postgres --features=tokenserver-db/postgres --features=py_verifier
+    cp target/release/syncserver /usr/local/bin/syncserver
+    rm -rf target
+    $STD uv venv --python /usr/bin/python3 /opt/firefox-syncserver/.venv
+    $STD uv pip install --python /opt/firefox-syncserver/.venv/bin/python pyfxa tokenlib cryptography
+    msg_ok "Built Firefox Syncserver"
+
+    msg_info "Starting Firefox Syncserver"
+    systemctl start firefox-syncserver
+    msg_ok "Started Firefox Syncserver"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}In Firefox, set identity.sync.tokenserver.uri in about:config to:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8000/1.0/sync/1.5${CL}"

ct/gotenberg.sh

@@ -45,15 +45,32 @@ function update_script() {
     export CGO_ENABLED=0
     $STD go mod download
     $STD go build -o /usr/local/bin/gotenberg \
-      -ldflags "-s -w -X 'github.com/gotenberg/gotenberg/v8/cmd.Version=$(cat ~/.gotenberg)'" \
+      -ldflags "-s -w -X 'github.com/gotenberg/gotenberg/v9/cmd.Version=$(cat ~/.gotenberg)'" \
       cmd/gotenberg/main.go
     msg_ok "Built gotenberg"
 
-    msg_info "Updating unoconverter"
-    UNOCONVERTER_VERSION=$(get_latest_github_release "gotenberg/unoconverter" "false")
-    download_file "https://raw.githubusercontent.com/gotenberg/unoconverter/${UNOCONVERTER_VERSION}/unoconv" /usr/local/bin/unoconverter
-    chmod +x /usr/local/bin/unoconverter
-    msg_ok "Updated unoconverter"
+    LOK_VERSION="$(awk -F= '/^ARG LOK_VERSION=/{print $2}' /opt/gotenberg/build/Dockerfile)"
+    fetch_and_deploy_gh_release "lok" "gotenberg/lok" "prebuild" "$LOK_VERSION" "/usr/local/bin" "lok_${LOK_VERSION#v}_linux_$(arch_resolve "amd64" "arm64").tar.gz"
+
+    msg_info "Migrating to Gotenberg 9"
+    CODENAME=$(get_os_info codename)
+    setup_deb822_repo \
+      "debian-backports" \
+      "file:///usr/share/keyrings/debian-archive-keyring.gpg" \
+      "http://deb.debian.org/debian" \
+      "${CODENAME}-backports" \
+      "main"
+    $STD apt install -y fonts-urw-base35
+    $STD apt install -y -t "${CODENAME}-backports" \
+      libreoffice-writer libreoffice-calc libreoffice-impress libreoffice-draw libreoffice-math
+    $STD apt purge -y python3-uno python-is-python3 pdftk-java qpdf libimage-exiftool-perl
+    $STD apt autoremove -y
+    rm -rf /usr/local/bin/unoconverter /usr/local/bin/pdfcpu /opt/pdfcpu
+    sed -i '/^Environment=\(UNOCONVERTER\|PDFTK\|QPDF\|EXIFTOOL\|PDFCPU\)_BIN_PATH=/d' /etc/systemd/system/gotenberg.service
+    grep -q '^Environment=LOK_BIN_PATH=' /etc/systemd/system/gotenberg.service ||
+      sed -i '/^Environment=LIBREOFFICE_BIN_PATH=/a Environment=LOK_BIN_PATH=/usr/local/bin/lok' /etc/systemd/system/gotenberg.service
+    systemctl daemon-reload
+    msg_ok "Migrated to Gotenberg 9"
 
     msg_info "Starting Service"
     systemctl start gotenberg

ct/guardian.sh

@@ -53,6 +53,8 @@ function update_script() {
       msg_ok "Restored Database"
     fi
 
+    NODE_VERSION="26" setup_nodejs
+
     msg_info "Updating Guardian"
     cd /opt/guardian/backend
     $STD npm ci

ct/immich.sh

@@ -75,7 +75,7 @@ EOF
   BASE_DIR=${STAGING_DIR}/base-images
   SOURCE_DIR=${STAGING_DIR}/image-source
   cd /tmp
-  RELEASE="v3.3.5"
+  RELEASE="v3.3.6"
   if [[ -f ~/.intel_version ]]; then
     INTEL_SRC="https://raw.githubusercontent.com/immich-app/immich/${RELEASE}/machine-learning"
     curl -fsSL "${INTEL_SRC}/scripts/install-intel-runtime.sh" -o ./intel-runtime 2>/dev/null ||
@@ -149,13 +149,13 @@ EOF
     PG_VERSION=$(ls /etc/postgresql/ 2>/dev/null | sort -V | tail -1)
     PG_VERSION=${PG_VERSION:-16}
     [[ -f ~/.vchord_version ]] && mv ~/.vchord_version ~/.vectorchord
-    if check_for_gh_release "VectorChord" "tensorchord/VectorChord" "${VCHORD_RELEASE}" "updated together with Immich after testing"; then
+    if check_for_gh_release "VectorChord" "supervc-stack/VectorChord" "${VCHORD_RELEASE}" "updated together with Immich after testing"; then
       # dead tuples in smart_search/face_search make the REINDEX below fail with
       # "missing chunk ... for toast value" on VectorChord 1.0.0 (#15588); must vacuum
       # while still on the old extension version, a post-upgrade vacuum errors instead
       $STD sudo -u postgres psql -d immich -c "VACUUM (ANALYZE) smart_search;"
       $STD sudo -u postgres psql -d immich -c "VACUUM (ANALYZE) face_search;"
-      fetch_and_deploy_gh_release "VectorChord" "tensorchord/VectorChord" "binary" "${VCHORD_RELEASE}" "/tmp" "postgresql-${PG_VERSION}-vchord_*_$(arch_resolve).deb"
+      fetch_and_deploy_gh_release "VectorChord" "supervc-stack/VectorChord" "binary" "${VCHORD_RELEASE}" "/tmp" "postgresql-${PG_VERSION}-vchord_*_$(arch_resolve).deb"
       systemctl restart postgresql
       $STD sudo -u postgres psql -d immich -c "ALTER EXTENSION vector UPDATE;"
       $STD sudo -u postgres psql -d immich -c "ALTER EXTENSION vchord UPDATE;"
@@ -232,7 +232,7 @@ EOF
     # plugins
     cd "$SRC_DIR"
     export MISE_TRUSTED_CONFIG_PATHS="$SRC_DIR"/mise.toml
-    export MISE_DISABLE_TOOLS=github:jellyfin/jellyfin-ffmpeg
+    export MISE_DISABLE_TOOLS=github:jellyfin/jellyfin-ffmpeg,java,terragrunt,opentofu,npm:@openapitools/openapi-generator-cli
     export MISE_LOCKFILE_MODE=merge MISE_LOCKFILE_PLATFORMS="linux-$(arch_resolve x64 arm64)"
     mise_ok=0
     for i in 1 2 3; do
@@ -292,7 +292,7 @@ EOF
       msg_ok "Pre-installed Python ${ML_PYTHON}"
       msg_info "Updating Intel OpenVINO machine-learning"
       for attempt in $(seq 1 3); do
-        $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT,UV_CONCURRENT_DOWNLOADS,UV_CONCURRENT_BUILDS,UV_CONCURRENT_INSTALLS -Pnu immich uv sync --extra openvino --no-dev --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
+        $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT,UV_CONCURRENT_DOWNLOADS,UV_CONCURRENT_BUILDS,UV_CONCURRENT_INSTALLS -Pnu immich uv sync --extra openvino --no-dev --upgrade-package watchfiles --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
         [[ $attempt -eq 3 ]] && { ML_FAILED=1; break; }
         # Parallel fetches can trip DNS rate limits (AdGuard, Pi-hole); retry one at a time.
         export UV_CONCURRENT_DOWNLOADS=1 UV_CONCURRENT_BUILDS=1 UV_CONCURRENT_INSTALLS=1
@@ -310,7 +310,7 @@ EOF
       msg_ok "Pre-installed Python ${ML_PYTHON}"
       msg_info "Updating machine-learning"
       for attempt in $(seq 1 3); do
-        $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT,UV_CONCURRENT_DOWNLOADS,UV_CONCURRENT_BUILDS,UV_CONCURRENT_INSTALLS -Pnu immich uv sync --extra cpu --no-dev --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
+        $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT,UV_CONCURRENT_DOWNLOADS,UV_CONCURRENT_BUILDS,UV_CONCURRENT_INSTALLS -Pnu immich uv sync --extra cpu --no-dev --upgrade-package watchfiles --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
         [[ $attempt -eq 3 ]] && { ML_FAILED=1; break; }
         # Parallel fetches can trip DNS rate limits (AdGuard, Pi-hole); retry one at a time.
         export UV_CONCURRENT_DOWNLOADS=1 UV_CONCURRENT_BUILDS=1 UV_CONCURRENT_INSTALLS=1

ct/jellyseerr.sh

@@ -39,6 +39,10 @@ function update_script() {
     echo "Seerr is the new unified Jellyseerr and Overseerr."
     echo "More info: https://docs.seerr.dev/blog/seerr-release"
     echo
+    if [[ "${PHS_SILENT:-0}" == "1" ]]; then
+      msg_warn "Seerr migration detected - skipping update, requires an interactive run"
+      exit 75
+    fi
     read -rp "Do you want to migrate to Seerr now? (y/N): " MIGRATE
     echo
     if [[ ! "$MIGRATE" =~ ^[Yy]$ ]]; then

ct/matterjs-server.sh

@@ -33,6 +33,15 @@ function update_script() {
 
   NODE_VERSION="24" setup_nodejs
 
+  SERVICE_FILE="/etc/systemd/system/matterjs-server.service"
+  if [[ -f "$SERVICE_FILE" ]] && ! grep -Fxq 'Environment=ENABLE_TIME_SYNC=true' "$SERVICE_FILE"; then
+    msg_info "Enabling MatterJS Time Sync"
+    sed -i '/^ExecStart=/i Environment=ENABLE_TIME_SYNC=true' "$SERVICE_FILE"
+    $STD systemctl daemon-reload
+    $STD systemctl restart matterjs-server
+    msg_ok "Enabled MatterJS Time Sync"
+  fi
+
   CURRENT=$(cat /opt/matter-server/node_modules/matter-server/package.json | grep '"version"' | head -1 | sed 's/.*"\([^"]*\)".*/\1/')
   LATEST=$(npm view matter-server version 2>/dev/null)
   if [[ $CURRENT != "$LATEST" ]]; then

ct/metube.sh

@@ -36,7 +36,7 @@ function update_script() {
     source ~/.bashrc
     if ! command -v deno &>/dev/null; then
       export DENO_INSTALL="/usr/local"
-      curl -fsSL https://deno.land/install.sh | $STD sh -s -- -y
+      curl -fsSL https://deno.land/install.sh | CI=1 $STD sh -s
     else
       $STD deno upgrade
     fi

ct/n8n.sh

@@ -46,7 +46,10 @@ EOF
     systemctl daemon-reload
   fi
 
-  $STD npm install -g n8n@latest
+  # n8n-nodes-base 2.46.0 pins both @napi-rs/canvas musl binaries as hard
+  # dependencies, which no os/cpu/libc combination can satisfy. Drop --force
+  # once upstream makes them optional again.
+  $STD npm install -g n8n@latest --force
   systemctl restart n8n
   msg_ok "Updated n8n"
   msg_ok "Updated successfully!"

ct/nametag.sh

@@ -9,7 +9,7 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 APP="Nametag"
 var_tags="${var_tags:-contacts;crm}"
 var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
+var_ram="${var_ram:-3072}"
 var_disk="${var_disk:-8}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
@@ -37,10 +37,9 @@ function update_script() {
     msg_ok "Stopped Service"
 
     create_backup /opt/nametag/.env
-
     CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="data" fetch_and_deploy_gh_release "nametag" "mattogodoy/nametag" "tarball" "latest" "/opt/nametag"
-
     restore_backup
+    NODE_VERSION="24" setup_nodejs
 
     msg_info "Rebuilding Application"
     cd /opt/nametag

ct/nexterm.sh

@@ -31,6 +31,8 @@ function update_script() {
     exit
   fi
 
+  echo "x /tmp/nexterm-sea-*" >/etc/tmpfiles.d/nexterm.conf
+
   if check_for_gh_release "nexterm-engine" "gnmyt/Nexterm"; then
     msg_info "Stopping nexterm-engine"
     systemctl stop nexterm-engine
@@ -46,6 +48,7 @@ function update_script() {
   if check_for_gh_release "nexterm-server" "gnmyt/Nexterm"; then
     msg_info "Stopping nexterm-server"
     systemctl stop nexterm-server
+    rm -rf /tmp/nexterm-sea-*
     msg_ok "Stopped nexterm-server"
 
     fetch_and_deploy_gh_release "nexterm-server" "gnmyt/Nexterm" "singlefile" "latest" "/opt/nexterm/server" "nexterm-server-linux-$(arch_resolve "x64" "arm64")"

ct/norish.sh

@@ -37,9 +37,9 @@ function update_script() {
     msg_ok "Stopped Norish"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "norish" "norish-recipes/norish" "tarball"
-    NODE_VERSION="22" NODE_MODULE="pnpm@$(jq -r '.packageManager | split("@")[1]' /opt/norish/package.json)" setup_nodejs
+    NODE_VERSION="26" NODE_MODULE="pnpm@$(jq -r '.packageManager | split("@")[1]' /opt/norish/package.json)" setup_nodejs
     PYTHON_VERSION="3.14" setup_uv
-    fetch_and_deploy_gh_release "obscura" "h4ckf0r0day/obscura" "prebuild" "v$(sed -n 's/^OBSCURA_VERSION=//p' /opt/norish/docker/obscura/pin.env)" "/opt/obscura" "obscura-$(arch_resolve "x86_64" "aarch64")-linux-stealth.tar.gz"
+    fetch_and_deploy_gh_release "obscura" "$(sed -n 's#^OBSCURA_REPO=https://github.com/##p' /opt/norish/docker/obscura/pin.env)" "prebuild" "v$(sed -n 's/^OBSCURA_VERSION=//p' /opt/norish/docker/obscura/pin.env)" "/opt/obscura" "obscura-$(arch_resolve "x86_64" "aarch64")-linux-stealth.tar.gz"
     fetch_and_deploy_gh_release "yt-dlp" "yt-dlp/yt-dlp" "singlefile" "latest" "/usr/local/bin" "$(arch_resolve "yt-dlp_linux" "yt-dlp_linux_aarch64")"
 
     msg_info "Building Norish"
@@ -48,6 +48,8 @@ function update_script() {
     $STD uv sync --project /opt/norish/apps/parser-api --locked
     NODE_ENV=production SKIP_ENV_VALIDATION=1 NEXT_TELEMETRY_DISABLED=1 $STD pnpm turbo run build --filter "@norish/web"
     rm -rf /opt/norish/apps/web/.next/cache /opt/norish/apps/web/.next/standalone
+    sed -i -e "s|^WorkingDirectory=.*|WorkingDirectory=/opt/norish/apps/web|" -e "s|^ExecStart=.*|ExecStart=/usr/bin/node --import tsx server/index.ts|" /etc/systemd/system/norish.service
+    systemctl daemon-reload
     msg_ok "Built Norish"
 
     msg_info "Starting Norish"

ct/overseerr.sh

@@ -38,6 +38,10 @@ function update_script() {
     echo "Seerr is the new unified Jellyseerr and Overseerr."
     echo "More info: https://docs.seerr.dev/blog/seerr-release"
     echo
+    if [[ "${PHS_SILENT:-0}" == "1" ]]; then
+      msg_warn "Seerr migration detected - skipping update, requires an interactive run"
+      exit 75
+    fi
     read -rp "Do you want to migrate to Seerr now? (y/N): " MIGRATE
     echo
     if [[ ! "$MIGRATE" =~ ^[Yy]$ ]]; then

ct/paperless-ngx.sh

@@ -63,6 +63,10 @@ function update_script() {
       echo -e "${GATEWAY}${BGN}https://docs.paperless-ngx.com/migration-v3/#encryption-support${CL}"
       msg_warn "Before continuing make sure that you do not use encryption or have decrypted all documents."
       echo ""
+      if [[ "${PHS_SILENT:-0}" == "1" ]]; then
+        msg_warn "Paperless-ngx v3 migration detected - skipping update, requires an interactive run"
+        exit 75
+      fi
       read -rp "Do you want to continue with the update? (y/N): " MIGRATE
       echo
       if [[ ! "$MIGRATE" =~ ^[Yy]$ ]]; then
@@ -71,6 +75,11 @@ function update_script() {
       fi
     fi
 
+    if [[ "${PHS_SILENT:-0}" == "1" ]] && ! grep -q "uv run" /etc/systemd/system/paperless-webserver.service; then
+      msg_warn "Paperless-ngx uv migration detected - skipping update, requires an interactive run"
+      exit 75
+    fi
+
     msg_info "Stopping all Paperless-ngx Services"
     systemctl stop paperless-consumer paperless-webserver paperless-scheduler paperless-task-queue
     msg_ok "Stopped all Paperless-ngx Services"

ct/planka.sh

@@ -30,6 +30,15 @@ function update_script() {
     msg_error "No ${APP} Installation Found!"
     exit
   fi
+
+  if ! grep -q "^Environment=HOME=" /etc/systemd/system/planka.service; then
+    msg_info "Updating Service"
+    sed -i -e '/^Environment=NODE_ENV=/d' -e 's|^ExecStart=.*|Environment=NODE_ENV=production\nEnvironment=HOME=/root\nExecStart=/usr/bin/node app.js --prod|' /etc/systemd/system/planka.service
+    systemctl daemon-reload
+    systemctl restart planka
+    msg_ok "Updated Service"
+  fi
+
   if check_for_gh_release "planka" "plankanban/planka"; then
     msg_info "Stopping Service"
     systemctl stop planka

ct/ps5-mqtt.sh

@@ -9,7 +9,7 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 APP="PS5-MQTT"
 var_tags="${var_tags:-smarthome;automation}"
 var_cpu="${var_cpu:-1}"
-var_ram="${var_ram:-512}"
+var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-3}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
@@ -37,12 +37,16 @@ function update_script() {
     systemctl stop ps5-mqtt
     msg_ok "Stopped service"
 
-    fetch_and_deploy_gh_release "ps5-mqtt" "FunkeyFlo/ps5-mqtt" "tarball"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "ps5-mqtt" "FunkeyFlo/ps5-mqtt" "tarball"
 
     msg_info "Configuring ${APP}"
-    cd /opt/ps5-mqtt/ps5-mqtt/
-    $STD npm install
-    $STD npm run build
+    cd /opt/ps5-mqtt
+    $STD corepack yarn install --immutable
+    $STD env PREPARE_ONLY=1 corepack yarn workspace @ps5-mqtt/server run package
+    cd /opt/ps5-mqtt/ps5-mqtt/server/.packaged/server
+    $STD npm install --omit=dev --omit=optional
+    sed -i 's|^WorkingDirectory=.*|WorkingDirectory=/opt/ps5-mqtt/ps5-mqtt/server/.packaged|' /etc/systemd/system/ps5-mqtt.service
+    systemctl daemon-reload
     msg_ok "Configured ${APP}"
 
     msg_info "Starting service"

ct/razzia.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Owen Voke (owenvoke)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Ralex91/Razzia
+
+APP="Razzia"
+var_tags="${var_tags:-quiz;games}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-3072}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/razzia ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "razzia" "Ralex91/Razzia"; then
+    msg_info "Stopping Service"
+    systemctl stop razzia
+    msg_ok "Stopped Service"
+
+    create_backup /opt/razzia/.env
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "razzia" "Ralex91/Razzia" "tarball"
+
+    restore_backup
+
+    NODE_VERSION="24" NODE_MODULE="pnpm@11" setup_nodejs
+
+    msg_info "Building Razzia"
+    cd /opt/razzia
+    $STD pnpm install --frozen-lockfile
+    $STD pnpm build
+    msg_ok "Built Razzia"
+
+    msg_info "Starting Service"
+    systemctl start razzia
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"

ct/romm.sh

@@ -107,8 +107,9 @@ function update_script() {
     ln -sfn "$ROMM_BASE"/resources /opt/romm/frontend/dist/assets/romm/resources
     ln -sfn "$ROMM_BASE"/assets /opt/romm/frontend/dist/assets/romm/assets
     if [[ -f /etc/angie/http.d/romm.conf ]]; then
-      if ! grep -q "js_content decode.decodeBase64" /etc/angie/http.d/romm.conf; then
-        msg_info "Adding missing /decode and /cache locations to Angie config"
+      if ! grep -q "js_content decode.decodeBase64" /etc/angie/http.d/romm.conf ||
+        ! grep -q "coep_header" /etc/angie/http.d/romm.conf; then
+        msg_info "Updating Angie config (decode/cache locations, player isolation headers)"
         dpkg -l angie-module-njs &>/dev/null || $STD apt install -y angie-module-njs
         grep -q "ngx_http_js_module.so" /etc/angie/angie.conf || sed -i '1i load_module modules/ngx_http_js_module.so;' /etc/angie/angie.conf
         mkdir -p /etc/angie/js "${ROMM_BASE}/cache"
@@ -147,6 +148,20 @@ map \$http_upgrade \$connection_upgrade {
     '' close;
 }
 
+# COEP/COOP for the EmulatorJS and js-dos players (SharedArrayBuffer needs a
+# crossOriginIsolated document). Matched on \$request_uri because try_files
+# rewrites \$uri to /index.html before add_header runs, so a per-location
+# add_header on the player route never fires. Mirrors upstream RomM's
+# docker/nginx/templates/default.conf.template.
+map \$request_uri \$coep_header {
+    default        "";
+    ~^/rom/.*/(ejs|jsdos)(\?|\$) "require-corp";
+}
+map \$request_uri \$coop_header {
+    default        "";
+    ~^/rom/.*/(ejs|jsdos)(\?|\$) "same-origin";
+}
+
 server {
     listen 80;
     server_name _;
@@ -155,6 +170,9 @@ server {
 
     location / {
         try_files \$uri \$uri/ /index.html;
+        add_header Cache-Control "no-cache";
+        add_header Cross-Origin-Embedder-Policy \$coep_header;
+        add_header Cross-Origin-Opener-Policy \$coop_header;
     }
 
     location /assets {
@@ -164,12 +182,6 @@ server {
         add_header Cache-Control "public, immutable";
     }
 
-    location ~ ^/rom/.*/ejs\$ {
-        add_header Cross-Origin-Embedder-Policy "require-corp";
-        add_header Cross-Origin-Opener-Policy "same-origin";
-        try_files \$uri /index.html;
-    }
-
     location /api {
         proxy_pass http://romm_backend;
         proxy_buffering off;
@@ -209,7 +221,7 @@ server {
     }
 }
 EOF
-        msg_ok "Added /decode and /cache locations"
+        msg_ok "Updated Angie config"
       else
         sed -i -e "s|alias .*/library/;|alias ${ROMM_BASE}/library/;|" \
           -e "s|alias .*/cache/;|alias ${ROMM_BASE}/cache/;|" /etc/angie/http.d/romm.conf

ct/teable.sh

@@ -32,6 +32,16 @@ function update_script() {
     exit
   fi
 
+  ensure_dependencies redis-server
+  systemctl enable -q --now redis-server
+  if ! grep -q "BACKEND_CACHE_REDIS_URI" /opt/teable/.env; then
+    sed -i '/^BACKEND_CACHE_SQLITE_URI=/d' /opt/teable/.env
+    sed -i 's|^BACKEND_CACHE_PROVIDER=.*|BACKEND_CACHE_PROVIDER=redis\nBACKEND_CACHE_REDIS_URI=redis://127.0.0.1:6379/0|' /opt/teable/.env
+    sed -i 's|^After=network.target postgresql.service$|After=network.target postgresql.service redis-server.service|' /etc/systemd/system/teable.service
+    systemctl daemon-reload
+    systemctl restart teable
+  fi
+
   if check_for_gh_release "teable" "teableio/teable"; then
     msg_info "Stopping Service"
     systemctl stop teable

ct/technitiumdns.sh

@@ -47,7 +47,7 @@ function update_script() {
     $STD apt install -y aspnetcore-runtime-10.0
   fi
 
-  RELEASE=$(curl -fsSL https://technitium.com/dns/ | grep -oP 'Version \K[\d.]+')
+  RELEASE=$(get_latest_github_release "TechnitiumSoftware/DnsServer")
   if [[ ! -f ~/.technitium || ${RELEASE} != "$(cat ~/.technitium 2>/dev/null)" ]]; then
     fetch_and_deploy_from_url "https://download.technitium.com/dns/DnsServerPortable.tar.gz" /opt/technitium/dns
     echo "${RELEASE}" >~/.technitium

ct/thingsboard.sh

@@ -31,12 +31,30 @@ function update_script() {
   fi
 
   JAVA_VERSION="25" setup_java
+
+  if ! grep -q "install.data_dir" /etc/thingsboard/conf/thingsboard.conf; then
+    msg_info "Restoring Package Defaults"
+    cat <<'EOF' >>/etc/thingsboard/conf/thingsboard.conf
+
+export JAVA_OPTS="$JAVA_OPTS -Dplatform=deb -Dinstall.data_dir=/usr/share/thingsboard/data"
+export JAVA_OPTS="$JAVA_OPTS -Xlog:gc*,heap*,age*,safepoint=debug:file=/var/log/thingsboard/gc.log:time,uptime,level,tags:filecount=10,filesize=10M"
+export JAVA_OPTS="$JAVA_OPTS -XX:+IgnoreUnrecognizedVMOptions -XX:+HeapDumpOnOutOfMemoryError"
+export JAVA_OPTS="$JAVA_OPTS -XX:-UseBiasedLocking -XX:+UseTLAB -XX:+ResizeTLAB -XX:+PerfDisableSharedMem -XX:+UseCondCardMark"
+export JAVA_OPTS="$JAVA_OPTS -XX:+UseG1GC -XX:MaxGCPauseMillis=500 -XX:+UseStringDeduplication -XX:+ParallelRefProcEnabled -XX:MaxTenuringThreshold=10"
+export LOG_FILENAME=thingsboard.out
+export LOADER_PATH=/usr/share/thingsboard/conf,/usr/share/thingsboard/extensions
+export SQL_DATA_FOLDER=/usr/share/thingsboard/data/sql
+EOF
+    systemctl restart thingsboard
+    msg_ok "Restored Package Defaults"
+  fi
+
   if check_for_gh_release "thingsboard" "thingsboard/thingsboard"; then
     msg_info "Stopping Service"
     systemctl stop thingsboard
     msg_ok "Stopped Service"
 
-    fetch_and_deploy_gh_release "thingsboard" "thingsboard/thingsboard" "binary" "latest" "/tmp" "thingsboard-*.deb"
+    DPKG_FORCE_CONFOLD=1 fetch_and_deploy_gh_release "thingsboard" "thingsboard/thingsboard" "binary" "latest" "/tmp" "thingsboard-*.deb"
 
     msg_info "Running Database Upgrade"
     $STD /usr/share/thingsboard/bin/install/upgrade.sh

ct/tracearr.sh

@@ -30,7 +30,7 @@ function update_script() {
     exit
   fi
 
-  NODE_VERSION="24" setup_nodejs
+  NODE_VERSION="26" setup_nodejs
 
   msg_info "Updating prestart script"
   cat <<EOF >/data/tracearr/prestart.sh

ct/tududi.sh

@@ -32,7 +32,14 @@ function update_script() {
 
   NODE_VERSION="22" setup_nodejs
 
-  if check_for_gh_release "tududi" "chrisvel/tududi"; then
+  RELEASE=""
+  if ! grep -qs '^DATABASE_URL=' /opt/tududi/backend/.env; then
+    RELEASE="v1.15.0"
+    msg_warn "Tududi 2.0 runs on PostgreSQL only, so this SQLite install stays on 1.15.0"
+    msg_warn "To move to 2.0, export in Settings > Backups and import into a new Tududi LXC"
+  fi
+
+  if check_for_gh_release "tududi" "chrisvel/tududi" "${RELEASE}" "2.0 needs PostgreSQL"; then
     msg_info "Stopping Service"
     systemctl stop tududi
     msg_ok "Stopped Service"
@@ -43,9 +50,14 @@ function update_script() {
     else
       cp /opt/tududi/.env /opt/tududi.env
     fi
+    if ! grep -q '^TUDUDI_UPLOAD_PATH=' /opt/tududi.env; then
+      mkdir -p /opt/tududi-uploads
+      [[ -d /opt/tududi/backend/uploads ]] && cp -a /opt/tududi/backend/uploads/. /opt/tududi-uploads/
+      echo "TUDUDI_UPLOAD_PATH=/opt/tududi-uploads" >>/opt/tududi.env
+    fi
     msg_ok "Backed up env file"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "tududi" "chrisvel/tududi" "tarball" "latest" "/opt/tududi"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "tududi" "chrisvel/tududi" "tarball" "${CHECK_UPDATE_RELEASE}" "/opt/tududi"
 
     msg_info "Updating Tududi"
     cd /opt/tududi

ct/twenty.sh

@@ -32,7 +32,7 @@ function update_script() {
     exit
   fi
 
-  NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs
+  NODE_VERSION="26" NODE_MODULE="corepack" setup_nodejs
 
   if check_for_gh_release "twenty" "twentyhq/twenty"; then
     msg_info "Stopping Services"

ct/vikunja.sh

@@ -36,6 +36,10 @@ function update_script() {
     msg_warn "This requires MANUAL config changes in /etc/vikunja/config.yml."
     msg_warn "See: https://vikunja.io/changelog/whats-new-in-vikunja-1.0.0/#config-changes"
 
+    if [[ "${PHS_SILENT:-0}" == "1" ]]; then
+      msg_warn "Vikunja 1.0 config migration detected - skipping update, requires an interactive run"
+      exit 75
+    fi
     read -rp "Continue with update? (y to proceed): " -t 30 CONFIRM1 || exit 254
     [[ "$CONFIRM1" =~ ^[yY]$ ]] || exit 0
 
@@ -60,7 +64,11 @@ function update_script() {
     echo -e "${TAB}${YW}How do you want to handle /etc/vikunja/config.yml?${CL}"
     echo -e "${TAB}  1) Keep your current config"
     echo -e "${TAB}  2) Install the new package maintainer's config"
-    read -rp "  Choose [1/2] (default: 1): " -t 60 CONFIG_CHOICE || CONFIG_CHOICE="1"
+    if [[ "${PHS_SILENT:-0}" == "1" ]]; then
+      CONFIG_CHOICE="1"
+    else
+      read -rp "  Choose [1/2] (default: 1): " -t 60 CONFIG_CHOICE || CONFIG_CHOICE="1"
+    fi
     [[ -z "$CONFIG_CHOICE" ]] && CONFIG_CHOICE="1"
 
     if [[ "$CONFIG_CHOICE" == "2" ]]; then

ct/wikijs.sh

@@ -30,6 +30,41 @@ function update_script() {
     exit
   fi
 
+  if [[ -d /opt/wikijs/backend ]]; then
+    NODE_VERSION="26" setup_nodejs
+
+    if check_for_gh_release "wikijs" "requarks/wiki"; then
+      PUPPETEER_INSTALLED=$([[ -d /opt/wikijs/backend/node_modules/puppeteer ]] && echo "true" || echo "false")
+
+      msg_info "Stopping Service"
+      systemctl stop wikijs
+      msg_ok "Stopped Service"
+
+      create_backup /opt/wikijs/config.yml
+      CLEAN_INSTALL=1 fetch_and_deploy_gh_release "wikijs" "requarks/wiki" "prebuild" "latest" "/opt/wikijs" "wiki-js.tar.gz"
+      restore_backup
+
+      cd /opt/wikijs/backend
+      if [[ "$(arch_resolve)" == "arm64" ]]; then
+        msg_info "Building Wiki.js Dependencies"
+        $STD npm ci --omit=dev
+        msg_ok "Built Wiki.js Dependencies"
+      fi
+      if [[ "$PUPPETEER_INSTALLED" == "true" ]]; then
+        msg_info "Reinstalling Puppeteer"
+        $STD npm install --no-save --force --include=optional --no-ignore-scripts --no-audit --no-fund "puppeteer@$(sed -n 's/^installVersion: *//p' modules/extensions/puppeteer/definition.yml)"
+        msg_ok "Reinstalled Puppeteer"
+      fi
+
+      msg_info "Starting Service"
+      systemctl start wikijs
+      msg_ok "Started Service"
+      msg_ok "Updated successfully!"
+    fi
+    exit
+  fi
+
+  msg_warn "Wiki.js 3 cannot update a 2.x install in place. Export it under Administration > Utilities > Export for Wiki.js 3.x and import it into a new Wiki.js 3 container."
   NODE_VERSION="26" NODE_MODULE="yarn,node-gyp" setup_nodejs
 
   if check_for_gh_release "wikijs" "requarks/wiki-v2"; then

ct/wireguard.sh

@@ -22,7 +22,7 @@ if [[ "${var_os:-}" == "alpine" ]]; then
   var_disk="${var_disk:-1}"
   var_version="${var_version:-3.24}"
 else
-  var_ram="${var_ram:-512}"
+  var_ram="${var_ram:-1024}"
   var_disk="${var_disk:-4}"
   var_version="${var_version:-13}"
 fi

ct/zerobyte.sh

@@ -53,6 +53,7 @@ function update_script() {
     cd /opt/zerobyte
     $STD bun install
     $STD node ./node_modules/vite/bin/vite.js build
+    $STD bun build apps/agent/src/index.ts --outfile .output/agent/index.mjs --target bun
     msg_ok "Built Zerobyte"
 
     msg_info "Starting Service"

install/amazonlinux-install.sh

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://aws.amazon.com/linux/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Base Dependencies"
+$STD dnf install -y hostname procps-ng
+msg_ok "Installed Base Dependencies"
+
+motd_ssh
+customize
+cleanup_lxc

install/anchor-install.sh

@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os
 
-NODE_VERSION="24" NODE_MODULE="pnpm" setup_nodejs
+NODE_VERSION="26" NODE_MODULE="pnpm" setup_nodejs
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="anchor" PG_DB_USER="anchor" setup_postgresql_db
 

install/argus-install.sh

@@ -57,7 +57,7 @@ service:
       url: community-scripts/ProxmoxVE
       use_prerelease: false
     dashboard:
-      icon: https://raw.githubusercontent.com/community-scripts/ProxmoxVE/refs/heads/main/misc/images/logo.png
+      icon: https://raw.githubusercontent.com/community-scripts/ProxmoxVE/refs/heads/main/.github/assets/logo.png
       icon_link_to: https://community-scripts.org/
       web_url: https://github.com/community-scripts/ProxmoxVE/releases
 EOF

install/aurral-install.sh

@@ -16,13 +16,14 @@ update_os
 msg_info "Installing Dependencies"
 $STD apt install -y \
   build-essential \
+  git \
   python3 \
   ffmpeg \
   fontconfig \
   fonts-dejavu-core
 msg_ok "Installed Dependencies"
 
-NODE_VERSION="26" setup_nodejs
+NODE_VERSION="26" NODE_MODULE="pnpm" setup_nodejs
 
 fetch_and_deploy_gh_release "yt-dlp" "yt-dlp/yt-dlp" "singlefile" "latest" "/usr/local/bin" "yt-dlp"
 fetch_and_deploy_gh_release "aurral" "lklynet/aurral" "tarball"
@@ -32,12 +33,8 @@ cd /opt/aurral
 export VITE_APP_VERSION="$(cat ~/.aurral)"
 export VITE_GITHUB_REPO="lklynet/aurral"
 export VITE_RELEASE_CHANNEL="stable"
-# aurral's .npmrc sets engine-strict=true and pins an exact node patch (e.g. 26.8.x),
-# which NodeSource can't match since it only ships the latest patch per major.
-export npm_config_engine_strict=false
-$STD npm ci --workspace frontend --include-workspace-root=false
-$STD npm run build --workspace frontend
-$STD npm ci --workspace backend --omit=dev --include=optional --include-workspace-root=false
+$STD pnpm install --frozen-lockfile --config.engine-strict=false --filter aurral-frontend --filter aurral-backend
+$STD pnpm --filter aurral-frontend run build
 msg_ok "Built Aurral"
 
 msg_info "Creating Service"
@@ -58,7 +55,7 @@ Type=simple
 User=root
 WorkingDirectory=/opt/aurral
 EnvironmentFile=/opt/aurral/aurral.env
-ExecStart=/usr/bin/node backend/server.js
+ExecStart=/usr/bin/node backend/server.ts
 Restart=on-failure
 RestartSec=5
 

install/caddy-install.sh

@@ -23,10 +23,15 @@ setup_deb_based() {
     setup_go
     fetch_and_deploy_gh_release "xcaddy" "caddyserver/xcaddy" "binary"
 
-    msg_info "Setup xCaddy"
     $STD apt install -y git
-    $STD xcaddy build
-    msg_ok "Setup xCaddy"
+    if (($(awk '/^MemTotal:/ {print int($2 / 1024)}' /proc/meminfo) < 1900)); then
+      msg_warn "xCaddy is installed; its test build was skipped because linking Caddy needs about 2 GB RAM"
+    else
+      msg_info "Setup xCaddy"
+      cd /opt
+      $STD xcaddy build
+      msg_ok "Setup xCaddy"
+    fi
   fi
 }
 
@@ -69,10 +74,14 @@ EOF
     GO_VERSION="$(curl -fsSL https://go.dev/VERSION?m=text | head -1 | cut -c3-)" setup_go
     fetch_and_deploy_gh_release "xcaddy" "caddyserver/xcaddy" "prebuild" "latest" "/opt/xcaddy" "xcaddy_*_linux_$(arch_resolve).tar.gz"
     ln -sf /opt/xcaddy/xcaddy /usr/local/bin/xcaddy
-    msg_info "Setup xCaddy"
-    cd /opt
-    $STD xcaddy build
-    msg_ok "Setup xCaddy"
+    if (($(awk '/^MemTotal:/ {print int($2 / 1024)}' /proc/meminfo) < 1900)); then
+      msg_warn "xCaddy is installed; its test build was skipped because linking Caddy needs about 2 GB RAM"
+    else
+      msg_info "Setup xCaddy"
+      cd /opt
+      $STD xcaddy build
+      msg_ok "Setup xCaddy"
+    fi
   fi
 
   msg_info "Enabling Caddy Service"

install/chatto-install.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/chattocorp/chatto
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+fetch_and_deploy_gh_release "chatto" "chattocorp/chatto" "prebuild" "latest" "/opt/chatto" "chatto_Linux_$(arch_resolve x86_64 arm64).tar.gz"
+chmod +x /opt/chatto/chatto
+
+msg_info "Configuring Chatto"
+mkdir -p /opt/chatto_data
+cd /opt/chatto
+$STD ./chatto init
+mv /opt/chatto/chatto.toml /opt/chatto_data/chatto.toml
+sed -i \
+  -e "/^\[webserver\]/,/^\[/ s|^url = .*|url = 'http://${LOCAL_IP}:4000'|" \
+  -e "/^\[nats.embedded\]/,/^\[/ s|^data_dir = .*|data_dir = '/opt/chatto_data/data'|" \
+  -e '/^# \[operator_api\]$/,/^$/ { s|^# \[operator_api\]$|[operator_api]|; s|^# enabled = false$|enabled = true| }' \
+  /opt/chatto_data/chatto.toml
+msg_ok "Configured Chatto"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/chatto.service
+[Unit]
+Description=Chatto
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/chatto
+ExecStart=/opt/chatto/chatto run -c /opt/chatto_data/chatto.toml
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now chatto
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/cinephage-install.sh

@@ -35,7 +35,7 @@ $STD npm prune --omit=dev
 msg_ok "Built Cinephage"
 
 msg_info "Installing Camoufox"
-$STD /opt/cinephage/node_modules/.bin/camoufox-js fetch
+$STD /opt/cinephage/node_modules/.bin/camoufox fetch
 msg_ok "Installed Camoufox"
 
 msg_info "Configuring Cinephage"

install/databasus-install.sh

@@ -16,119 +16,47 @@ update_os
 msg_info "Installing Dependencies"
 $STD apt install -y \
   nginx \
-  valkey \
-  mariadb-client \
-  rclone
+  libedit2 \
+  libgssapi-krb5-2 \
+  libncurses6 \
+  libreadline8t64
 msg_ok "Installed Dependencies"
 
 PG_VERSION="17" setup_postgresql
 NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs
 
-msg_info "Installing Database Clients"
-# Create PostgreSQL version symlinks for compatibility
-for v in 12 13 14 15 16 18; do
-  ln -sf /usr/lib/postgresql/17 /usr/lib/postgresql/$v
-done
-# Install MongoDB Database Tools via direct .deb (no APT repo for Debian 13)
-[[ "$(get_os_info id)" == "ubuntu" ]] && MONGO_DIST="ubuntu2204" || MONGO_DIST="debian12"
-# MongoDB only publishes arm64 builds for Ubuntu
-[[ "$(arch_resolve "x86_64" "arm64")" == "arm64" ]] && MONGO_DIST="ubuntu2204"
-MONGO_VERSION=$(get_latest_gh_tag "mongodb/mongo-tools" "100." || echo "100.16.1")
-fetch_and_deploy_from_url "https://fastdl.mongodb.org/tools/db/mongodb-database-tools-${MONGO_DIST}-$(arch_resolve "x86_64" "arm64")-${MONGO_VERSION}.deb" ""
-mkdir -p /usr/local/mongodb-database-tools/bin
-[[ -f /usr/bin/mongodump ]] && ln -sf /usr/bin/mongodump /usr/local/mongodb-database-tools/bin/mongodump
-[[ -f /usr/bin/mongorestore ]] && ln -sf /usr/bin/mongorestore /usr/local/mongodb-database-tools/bin/mongorestore
-# Create MariaDB and MySQL client symlinks for compatibility
-mkdir -p /usr/local/mariadb-{10.6,12.1}/bin /usr/local/mysql-{5.7,8.0,8.4,9}/bin
-for dir in /usr/local/mariadb-{10.6,12.1}/bin; do
-  ln -sf /usr/bin/mariadb-dump "$dir/mariadb-dump"
-  ln -sf /usr/bin/mariadb "$dir/mariadb"
-done
-for dir in /usr/local/mysql-{5.7,8.0,8.4,9}/bin; do
-  ln -sf /usr/bin/mariadb-dump "$dir/mysqldump"
-  ln -sf /usr/bin/mariadb "$dir/mysql"
-done
-msg_ok "Installed Database Clients"
-
 fetch_and_deploy_gh_release "databasus" "databasus/databasus" "tarball" "latest" "/opt/databasus"
 GO_VERSION="$(grep -m1 '^go ' /opt/databasus/backend/go.mod | awk '{print $2}')" setup_go
 
 msg_info "Building Databasus (Patience)"
+RELEASE=$(cat ~/.databasus)
 export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
 cd /opt/databasus/frontend
-
 $STD corepack prepare pnpm@latest --activate
 $STD pnpm install --frozen-lockfile
-$STD pnpm run build
+$STD env VITE_APP_VERSION="${RELEASE}" pnpm run build
 cd /opt/databasus/backend
-$STD go mod tidy
-$STD go mod download
-$STD go install github.com/swaggo/swag/cmd/swag@latest
-$STD /root/go/bin/swag init -g cmd/main.go -o swagger
-$STD env CGO_ENABLED=0 GOOS=linux GOARCH=$(arch_resolve) go build -o databasus ./cmd
-mv /opt/databasus/backend/databasus /opt/databasus/databasus
+$STD env CGO_ENABLED=0 GOOS=linux GOARCH="$(arch_resolve)" go build -o /opt/databasus/databasus ./cmd/databasus
+mkdir -p /opt/databasus/agent-binaries
+for arch in amd64 arm64; do
+  $STD env CGO_ENABLED=0 GOOS=linux GOARCH=$arch go build -ldflags "-X main.Version=${RELEASE}" -o /opt/databasus/agent-binaries/databasus-verification-agent-linux-$arch ./cmd/verification-agent
+done
 mkdir -p /databasus-data/{pgdata,temp,backups,data,logs}
 mkdir -p /opt/databasus/ui/build
-mkdir -p /opt/databasus/migrations
 cp -r /opt/databasus/frontend/dist/* /opt/databasus/ui/build/
-cp -r /opt/databasus/backend/migrations/* /opt/databasus/migrations/
 chown -R postgres:postgres /databasus-data
 msg_ok "Built Databasus"
 
 msg_info "Configuring Databasus"
-JWT_SECRET=$(openssl rand -hex 32)
-ENCRYPTION_KEY=$(openssl rand -hex 32)
-# Install goose for migrations
-$STD go install github.com/pressly/goose/v3/cmd/goose@latest
-ln -sf /root/go/bin/goose /usr/local/bin/goose
 cat <<EOF >/.env
-# Environment
 ENV_MODE=production
-
-# Server
-SERVER_PORT=4005
-SERVER_HOST=0.0.0.0
-
-# Database
+APP_VERSION=${RELEASE}
 DATABASE_DSN=host=localhost user=postgres password=postgres dbname=databasus port=5432 sslmode=disable
-DATABASE_URL=postgres://postgres:postgres@localhost:5432/databasus?sslmode=disable
-
-# Migrations
-GOOSE_DRIVER=postgres
-GOOSE_DBSTRING=postgres://postgres:postgres@localhost:5432/databasus?sslmode=disable
-GOOSE_MIGRATION_DIR=/opt/databasus/migrations
-
-# Valkey (Redis-compatible cache)
-VALKEY_HOST=localhost
-VALKEY_PORT=6379
-
-# Security
-JWT_SECRET=${JWT_SECRET}
-ENCRYPTION_KEY=${ENCRYPTION_KEY}
-
-# Paths
-DATA_DIR=/databasus-data/data
-BACKUP_DIR=/databasus-data/backups
-LOG_DIR=/databasus-data/logs
 EOF
 chmod 600 /.env
 msg_ok "Configured Databasus"
 
-msg_info "Configuring Valkey"
-cat <<EOF >/etc/valkey/valkey.conf
-port 6379
-bind 127.0.0.1
-protected-mode yes
-save ""
-maxmemory 256mb
-maxmemory-policy allkeys-lru
-EOF
-systemctl enable -q --now valkey-server
-systemctl restart valkey-server
-msg_ok "Configured Valkey"
-
 msg_info "Creating Database"
-# Configure PostgreSQL to allow local password auth for databasus
 PG_HBA="/etc/postgresql/17/main/pg_hba.conf"
 if ! grep -q "databasus" "$PG_HBA"; then
   sed -i '/^local\s*all\s*all/i local   databasus   postgres                                trust' "$PG_HBA"
@@ -143,8 +71,8 @@ msg_info "Creating Databasus Service"
 cat <<EOF >/etc/systemd/system/databasus.service
 [Unit]
 Description=Databasus - Database Backup Management
-After=network.target postgresql.service valkey.service
-Requires=postgresql.service valkey.service
+After=network.target postgresql.service
+Requires=postgresql.service
 
 [Service]
 Type=simple

install/discourse-install.sh

@@ -25,12 +25,44 @@ $STD apt install -y \
   gsfonts \
   brotli \
   nginx \
-  redis-server
+  redis-server \
+  meson \
+  ninja-build \
+  pkg-config \
+  libglib2.0-dev \
+  libexpat1-dev \
+  libjpeg-dev \
+  libpng-dev \
+  libwebp-dev \
+  libtiff-dev \
+  libheif-dev \
+  libjxl-dev \
+  librsvg2-dev \
+  libcgif-dev \
+  libexif-dev \
+  liblcms2-dev \
+  liborc-0.4-dev \
+  libimagequant-dev \
+  libpango1.0-dev
 msg_ok "Installed Dependencies"
 
+fetch_and_deploy_gh_release "libvips" "libvips/libvips" "prebuild" "latest" "/opt/libvips" "vips-*.tar.xz"
+
+msg_info "Building libvips"
+cd /opt/libvips
+$STD meson setup build --prefix=/usr/local --libdir=lib --buildtype=release -Dmodules=disabled -Dmagick=disabled -Dexamples=false
+$STD ninja -C build install
+ldconfig
+msg_ok "Built libvips"
+
+msg_info "Cloning Discourse"
+$STD git clone --depth 1 https://github.com/discourse/discourse.git /opt/discourse
+msg_ok "Cloned Discourse"
+
 PG_VERSION="17" PG_MODULES="pgvector" setup_postgresql
 NODE_VERSION="24" setup_nodejs
-RUBY_VERSION="3.4.4" setup_ruby
+RUBY_TARGET=$(grep -A1 '^RUBY VERSION' /opt/discourse/Gemfile.lock | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -n1)
+RUBY_VERSION="${RUBY_TARGET:-4.0.7}" RUBY_INSTALL_RAILS="false" setup_ruby
 
 msg_info "Configuring PostgreSQL for Discourse"
 DISCOURSE_DB_PASS=$(random_password 13)
@@ -42,7 +74,6 @@ msg_ok "Configured PostgreSQL for Discourse"
 
 msg_info "Configuring Discourse"
 DISCOURSE_SECRET_KEY=$(openssl rand -hex 64)
-$STD git clone --depth 1 https://github.com/discourse/discourse.git /opt/discourse
 cd /opt/discourse
 cat <<EOF >/opt/discourse/.env
 RAILS_ENV=production
@@ -77,6 +108,7 @@ export PATH="$HOME/.rbenv/bin:$HOME/.rbenv/shims:$PATH"
 eval "$(rbenv init - bash)" 2>/dev/null || true
 export RAILS_ENV=production
 export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+export BUNDLE_SILENCE_ROOT_WARNING=1
 $STD corepack enable
 $STD bundle config set --local deployment true
 $STD bundle config set --local without 'test development'

install/espocrm-install.sh

@@ -0,0 +1,146 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Masked-Kunsiquat
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.espocrm.com/ | Github: https://github.com/espocrm/espocrm
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+if [[ -z "${var_admin_user:-}" ]]; then
+  var_admin_user=$(prompt_input "EspoCRM admin username (a-z, 0-9, @ . _ -):" "admin" 60)
+fi
+var_admin_user="${var_admin_user:-admin}"
+var_admin_user="${var_admin_user,,}"
+if [[ ! "$var_admin_user" =~ ^[a-z0-9@._-]+$ ]]; then
+  msg_warn "EspoCRM usernames take only a-z, 0-9 and @ . _ -; using admin"
+  var_admin_user="admin"
+fi
+if [[ -z "${var_admin_pass:-}" ]]; then
+  var_admin_pass=$(random_password 16)
+fi
+
+msg_info "Installing Dependencies"
+$STD apt install -y nginx
+msg_ok "Installed Dependencies"
+
+setup_mariadb
+MARIADB_DB_NAME="espocrm" MARIADB_DB_USER="espocrm" setup_mariadb_db
+PHP_VERSION="8.4" PHP_FPM="YES" PHP_MODULE="ldap" setup_php
+fetch_and_deploy_gh_release "espo-crm" "espocrm/espocrm" "prebuild" "latest" "/opt/espocrm" "EspoCRM-*.zip"
+
+msg_info "Configuring EspoCRM"
+cd /opt/espocrm
+$STD php bin/command config:populate
+$STD php bin/command config:set defaultPermissions.user www-data
+$STD php bin/command config:set defaultPermissions.group www-data
+$STD php bin/command config:set database.platform Mysql
+$STD php bin/command config:set database.host localhost
+$STD php bin/command config:set database.dbname "$MARIADB_DB_NAME"
+$STD php bin/command config:set database.user "$MARIADB_DB_USER"
+$STD php bin/command config:set database.password "$MARIADB_DB_PASS"
+$STD php bin/command rebuild
+$STD php bin/command create-admin-user "$var_admin_user"
+printf '%s\n' "$var_admin_pass" | $STD php bin/command set-password "$var_admin_user"
+$STD php bin/command config:set siteUrl "http://${LOCAL_IP}"
+$STD php bin/command populate-scheduled-jobs
+$STD php bin/command config:set jobRunInParallel true --type=bool
+$STD php bin/command app-check
+$STD php bin/command config:set isInstalled true --type=bool
+chown -R www-data:www-data /opt/espocrm
+msg_ok "Configured EspoCRM"
+
+msg_info "Creating Nginx Site"
+PHP_SOCK=$(get_php_fpm_socket)
+cat <<EOF >/etc/nginx/sites-available/espocrm
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    server_name _;
+
+    charset utf-8;
+    index index.html index.php;
+
+    client_max_body_size 128M;
+    keepalive_timeout 300;
+    server_tokens off;
+    fastcgi_send_timeout 300;
+    fastcgi_read_timeout 300;
+
+    gzip on;
+    gzip_types text/plain text/css text/javascript application/javascript application/json;
+    gzip_min_length 1000;
+
+    root /opt/espocrm/public;
+
+    location /client {
+        root /opt/espocrm;
+        autoindex off;
+
+        location ~* ^.+\.(js|css|png|jpg|svg|svgz|jpeg|gif|ico|tpl)\$ {
+            access_log off;
+            expires max;
+        }
+    }
+
+    location = /favicon.ico { access_log off; log_not_found off; }
+    location = /robots.txt { access_log off; log_not_found off; }
+
+    location ~ \.php\$ {
+        fastcgi_pass unix:${PHP_SOCK};
+        include fastcgi_params;
+        fastcgi_index index.php;
+        fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
+        fastcgi_param QUERY_STRING \$query_string;
+    }
+
+    location /api/v1/ {
+        if (!-e \$request_filename) {
+            rewrite ^/api/v1/(.*)\$ /api/v1/index.php last;
+        }
+    }
+
+    location /portal/ {
+        try_files \$uri \$uri/ /portal/index.php?\$query_string;
+    }
+
+    location /api/v1/portal-access {
+        if (!-e \$request_filename) {
+            rewrite ^/api/v1/(.*)\$ /api/v1/portal-access/index.php last;
+        }
+    }
+
+    location ~ /(\.htaccess|web\.config|\.git) {
+        deny all;
+    }
+}
+EOF
+msg_ok "Created Nginx Site"
+nginx_enable_site "espocrm"
+
+msg_info "Setting up Cron"
+cat <<EOF >/etc/cron.d/espocrm
+* * * * * www-data cd /opt/espocrm && php -f cron.php >/dev/null 2>&1
+EOF
+systemctl enable -q --now cron
+msg_ok "Set up Cron"
+
+msg_info "Saving Credentials"
+cat <<EOF >>~/espocrm.creds
+
+EspoCRM Admin
+Username: ${var_admin_user}
+Password: ${var_admin_pass}
+EOF
+chmod 600 ~/espocrm.creds
+msg_ok "Saved Credentials"
+
+motd_ssh
+customize
+cleanup_lxc

install/firefox-syncserver-install.sh

@@ -0,0 +1,99 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/mozilla-services/syncstorage-rs
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  build-essential \
+  pkg-config \
+  libssl-dev \
+  libpq-dev \
+  python3-dev
+msg_ok "Installed Dependencies"
+
+PG_VERSION="18" setup_postgresql
+PG_DB_NAME="syncserver" PG_DB_USER="syncserver" setup_postgresql_db
+setup_rust
+setup_uv
+
+fetch_and_deploy_gh_release "firefox-syncserver" "mozilla-services/syncstorage-rs" "tarball"
+
+msg_info "Building Firefox Syncserver (Patience)"
+cd /opt/firefox-syncserver
+$STD cargo build --release --locked --no-default-features --features=syncstorage-db/postgres --features=tokenserver-db/postgres --features=py_verifier
+cp target/release/syncserver /usr/local/bin/syncserver
+rm -rf target
+$STD uv venv --python /usr/bin/python3 /opt/firefox-syncserver/.venv
+$STD uv pip install --python /opt/firefox-syncserver/.venv/bin/python pyfxa tokenlib cryptography
+msg_ok "Built Firefox Syncserver"
+
+msg_info "Configuring Firefox Syncserver"
+mkdir -p /opt/firefox-syncserver_data
+cat <<EOF >/opt/firefox-syncserver_data/.env
+SYNC_HOST=0.0.0.0
+SYNC_PORT=8000
+SYNC_MASTER_SECRET=$(openssl rand -hex 32)
+SYNC_HUMAN_LOGS=true
+RUST_LOG=info
+SYNC_SYNCSTORAGE__DATABASE_URL=postgres://syncserver:${PG_DB_PASS}@127.0.0.1:5432/syncserver
+SYNC_SYNCSTORAGE__GLEAN_ENABLED=false
+SYNC_TOKENSERVER__ENABLED=true
+SYNC_TOKENSERVER__RUN_MIGRATIONS=true
+SYNC_TOKENSERVER__DATABASE_URL=postgres://syncserver:${PG_DB_PASS}@127.0.0.1:5432/syncserver
+SYNC_TOKENSERVER__NODE_TYPE=postgres
+SYNC_TOKENSERVER__FXA_EMAIL_DOMAIN=api.accounts.firefox.com
+SYNC_TOKENSERVER__FXA_OAUTH_SERVER_URL=https://oauth.accounts.firefox.com
+SYNC_TOKENSERVER__INIT_NODE_URL=http://${LOCAL_IP}:8000
+EOF
+chmod 600 /opt/firefox-syncserver_data/.env
+cat <<'EOF' >/opt/firefox-syncserver_data/nodes.sql
+SELECT to_regclass('nodes') IS NOT NULL AS ready \gset
+\if :ready
+UPDATE nodes SET node = :'url'
+ WHERE id = (SELECT min(id) FROM nodes)
+   AND NOT EXISTS (SELECT 1 FROM nodes WHERE node = :'url');
+UPDATE users SET nodeid = (SELECT id FROM nodes WHERE node = :'url')
+ WHERE nodeid <> (SELECT id FROM nodes WHERE node = :'url');
+DELETE FROM nodes WHERE node <> :'url';
+\endif
+EOF
+msg_ok "Configured Firefox Syncserver"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/firefox-syncserver.service
+[Unit]
+Description=Firefox Syncserver
+After=network.target postgresql.service
+Wants=postgresql.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/firefox-syncserver
+EnvironmentFile=/opt/firefox-syncserver_data/.env
+Environment=PYTHONPATH=/opt/firefox-syncserver/.venv/lib/python3.13/site-packages
+ExecStartPre=/usr/bin/psql -1 -q -v ON_ERROR_STOP=1 -v url=\${SYNC_TOKENSERVER__INIT_NODE_URL} -f /opt/firefox-syncserver_data/nodes.sql \${SYNC_TOKENSERVER__DATABASE_URL}
+ExecStart=/usr/local/bin/syncserver
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now firefox-syncserver
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/gotenberg-install.sh

@@ -14,18 +14,15 @@ network_check
 update_os
 
 msg_info "Installing Dependencies"
+CODENAME=$(get_os_info codename)
+setup_deb822_repo \
+  "debian-backports" \
+  "file:///usr/share/keyrings/debian-archive-keyring.gpg" \
+  "http://deb.debian.org/debian" \
+  "${CODENAME}-backports" \
+  "main"
 $STD apt install -y \
   chromium \
-  libreoffice-writer \
-  libreoffice-calc \
-  libreoffice-impress \
-  libreoffice-draw \
-  libreoffice-math \
-  python3-uno \
-  python-is-python3 \
-  pdftk-java \
-  qpdf \
-  libimage-exiftool-perl \
   fonts-crosextra-carlito \
   fonts-crosextra-caladea \
   fonts-liberation \
@@ -33,28 +30,30 @@ $STD apt install -y \
   fonts-dejavu \
   fonts-noto-cjk \
   fonts-noto-color-emoji \
-  fonts-noto-core
+  fonts-noto-core \
+  fonts-urw-base35
+# lok is built against the LibreOffice from backports
+$STD apt install -y -t "${CODENAME}-backports" \
+  libreoffice-writer \
+  libreoffice-calc \
+  libreoffice-impress \
+  libreoffice-draw \
+  libreoffice-math
 msg_ok "Installed Dependencies"
 
-fetch_and_deploy_gh_release "pdfcpu" "pdfcpu/pdfcpu" "prebuild" "latest" "/opt/pdfcpu" "pdfcpu_*_Linux_$(arch_resolve "x86_64" "arm64").tar.xz"
-ln -sf "$(find /opt/pdfcpu -type f -name pdfcpu | head -n1)" /usr/local/bin/pdfcpu
-
-msg_info "Installing unoconverter"
-UNOCONVERTER_VERSION=$(get_latest_github_release "gotenberg/unoconverter" "false")
-download_file "https://raw.githubusercontent.com/gotenberg/unoconverter/${UNOCONVERTER_VERSION}/unoconv" /usr/local/bin/unoconverter
-chmod +x /usr/local/bin/unoconverter
-msg_ok "Installed unoconverter"
-
 fetch_and_deploy_gh_release "gotenberg" "gotenberg/gotenberg" "tarball" "latest" "/opt/gotenberg"
 
 GO_VERSION="$(awk '$1=="go"{print $2}' /opt/gotenberg/go.mod | cut -d. -f1,2)" setup_go
 
+LOK_VERSION="$(awk -F= '/^ARG LOK_VERSION=/{print $2}' /opt/gotenberg/build/Dockerfile)"
+fetch_and_deploy_gh_release "lok" "gotenberg/lok" "prebuild" "$LOK_VERSION" "/usr/local/bin" "lok_${LOK_VERSION#v}_linux_$(arch_resolve "amd64" "arm64").tar.gz"
+
 msg_info "Building Gotenberg (Patience)"
 cd /opt/gotenberg
 export CGO_ENABLED=0
 $STD go mod download
 $STD go build -o /usr/local/bin/gotenberg \
-  -ldflags "-s -w -X 'github.com/gotenberg/gotenberg/v8/cmd.Version=$(cat ~/.gotenberg)'" \
+  -ldflags "-s -w -X 'github.com/gotenberg/gotenberg/v9/cmd.Version=$(cat ~/.gotenberg)'" \
   cmd/gotenberg/main.go
 msg_ok "Built Gotenberg"
 
@@ -70,14 +69,10 @@ Type=simple
 User=root
 Environment=LANG=C.UTF-8
 Environment=LC_ALL=C.UTF-8
-Environment=PDFTK_BIN_PATH=/usr/bin/pdftk
-Environment=QPDF_BIN_PATH=/usr/bin/qpdf
-Environment=EXIFTOOL_BIN_PATH=/usr/bin/exiftool
-Environment=PDFCPU_BIN_PATH=/usr/local/bin/pdfcpu
 Environment=CHROMIUM_BIN_PATH=/usr/bin/chromium
 Environment=CHROMIUM_HYPHEN_DATA_DIR_PATH=/opt/gotenberg/build/chromium-hyphen-data
 Environment=LIBREOFFICE_BIN_PATH=/usr/lib/libreoffice/program/soffice.bin
-Environment=UNOCONVERTER_BIN_PATH=/usr/local/bin/unoconverter
+Environment=LOK_BIN_PATH=/usr/local/bin/lok
 Environment=OTEL_TRACES_EXPORTER=none
 Environment=OTEL_METRICS_EXPORTER=none
 Environment=OTEL_LOGS_EXPORTER=none

install/guardian-install.sh

@@ -17,7 +17,7 @@ msg_info "Installing Dependencies"
 $STD apt install -y sqlite3
 msg_ok "Installed Dependencies"
 
-NODE_VERSION="24" setup_nodejs
+NODE_VERSION="26" setup_nodejs
 fetch_and_deploy_gh_release "guardian" "HydroshieldMKII/Guardian" "tarball" "latest" "/opt/guardian"
 
 msg_info "Configuring ${APPLICATION}"

install/immich-install.sh

@@ -18,7 +18,12 @@ if is_debian && [[ "$(get_os_version_major)" -lt 13 ]]; then
   exit 238
 fi
 
-RELEASE="v3.3.5"
+if [[ "$(arch_resolve)" == "amd64" ]] && ! grep -qm1 sse4_2 /proc/cpuinfo; then
+  msg_error "Immich needs a CPU with SSE4.2: its web build stops with 'Illegal instruction' on older ones."
+  exit 236
+fi
+
+RELEASE="v3.3.6"
 if lscpu | grep -q 'GenuineIntel'; then
   echo ""
   echo ""
@@ -108,6 +113,7 @@ $STD apt install --no-install-recommends -y \
   libhwy-dev \
   libwebp-dev \
   libaom-dev \
+  unzip \
   ccache
 
 setup_deb822_repo \
@@ -129,6 +135,28 @@ if [[ "$CTTYPE" == "0" && -d /dev/dri ]]; then
 fi
 msg_ok "Dependencies Installed"
 
+INSTALL_DIR="/opt/${APPLICATION}"
+UPLOAD_DIR="${INSTALL_DIR}/upload"
+SRC_DIR="${INSTALL_DIR}/source"
+APP_DIR="${INSTALL_DIR}/app"
+PLUGIN_DIR="${APP_DIR}/plugins/immich-plugin-core"
+ML_DIR="${APP_DIR}/machine-learning"
+GEO_DIR="${INSTALL_DIR}/geodata"
+mkdir -p {"${APP_DIR}","${UPLOAD_DIR}","${GEO_DIR}","${INSTALL_DIR}"/cache}
+
+msg_info "Installing GeoNames data"
+cd "$GEO_DIR"
+CURL_RETRIES=6 CURL_CONNECT_TO=30 curl_with_retry "https://download.geonames.org/export/dump/admin1CodesASCII.txt" "admin1CodesASCII.txt"
+CURL_RETRIES=6 CURL_CONNECT_TO=30 curl_with_retry "https://download.geonames.org/export/dump/admin2Codes.txt" "admin2Codes.txt"
+CURL_RETRIES=6 CURL_CONNECT_TO=30 curl_with_retry "https://download.geonames.org/export/dump/countryInfo.txt" "countryInfo.txt"
+CURL_RETRIES=6 CURL_CONNECT_TO=30 curl_with_retry "https://download.geonames.org/export/dump/cities500.zip" "cities500.zip"
+curl_with_retry "https://raw.githubusercontent.com/nvkelso/natural-earth-vector/v5.1.2/geojson/ne_10m_admin_0_countries.geojson" "ne_10m_admin_0_countries.geojson"
+unzip -q cities500.zip
+date --iso-8601=seconds | tr -d "\n" >geodata-date.txt
+rm cities500.zip
+cd ~
+msg_ok "Installed GeoNames data"
+
 MISE_ARCH="x64"
 [[ "$(arch_resolve)" == "arm64" ]] && MISE_ARCH="arm64"
 fetch_and_deploy_gh_release "mise" "jdx/mise" "singlefile" "latest" "/usr/local/bin" "mise-v*-linux-${MISE_ARCH}"
@@ -167,7 +195,7 @@ ACTUAL_PG_VERSION=$(ls /etc/postgresql/ 2>/dev/null | sort -V | tail -1)
 ACTUAL_PG_VERSION=${ACTUAL_PG_VERSION:-16}
 
 VCHORD_RELEASE="1.1.1"
-fetch_and_deploy_gh_release "VectorChord" "tensorchord/VectorChord" "binary" "${VCHORD_RELEASE}" "/tmp" "postgresql-${ACTUAL_PG_VERSION}-vchord_*_$(arch_resolve).deb"
+fetch_and_deploy_gh_release "VectorChord" "supervc-stack/VectorChord" "binary" "${VCHORD_RELEASE}" "/tmp" "postgresql-${ACTUAL_PG_VERSION}-vchord_*_$(arch_resolve).deb"
 
 sed -i "s/^#shared_preload.*/shared_preload_libraries = 'vchord.so'/" /etc/postgresql/${ACTUAL_PG_VERSION}/main/postgresql.conf
 systemctl restart postgresql.service
@@ -347,15 +375,6 @@ libvips: $LIBVIPS_REVISION
 EOF
 msg_ok "Custom Photo-processing Libraries Compiled Successfully"
 
-INSTALL_DIR="/opt/${APPLICATION}"
-UPLOAD_DIR="${INSTALL_DIR}/upload"
-SRC_DIR="${INSTALL_DIR}/source"
-APP_DIR="${INSTALL_DIR}/app"
-PLUGIN_DIR="${APP_DIR}/plugins/immich-plugin-core"
-ML_DIR="${APP_DIR}/machine-learning"
-GEO_DIR="${INSTALL_DIR}/geodata"
-mkdir -p {"${APP_DIR}","${UPLOAD_DIR}","${GEO_DIR}","${INSTALL_DIR}"/cache}
-
 fetch_and_deploy_gh_release "Immich" "immich-app/immich" "tarball" "${RELEASE}" "$SRC_DIR"
 PNPM_VERSION="$(jq -r '.packageManager | split("@")[1] | split("+")[0]' ${SRC_DIR}/package.json)"
 export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
@@ -396,7 +415,7 @@ cp -a web/build "$APP_DIR"/www
 cp LICENSE "$APP_DIR"
 cd "$SRC_DIR"
 export MISE_TRUSTED_CONFIG_PATHS="$SRC_DIR"/mise.toml
-export MISE_DISABLE_TOOLS=github:jellyfin/jellyfin-ffmpeg
+export MISE_DISABLE_TOOLS=github:jellyfin/jellyfin-ffmpeg,java,terragrunt,opentofu,npm:@openapitools/openapi-generator-cli
 export MISE_LOCKFILE_MODE=merge MISE_LOCKFILE_PLATFORMS="linux-$(arch_resolve x64 arm64)"
 mise_ok=0
 for i in 1 2 3; do
@@ -444,7 +463,7 @@ if [[ -f ~/.openvino ]]; then
   msg_ok "Pre-installed Python ${ML_PYTHON}"
   msg_info "Installing Intel OpenVINO machine-learning"
   for attempt in $(seq 1 3); do
-    $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT,UV_CONCURRENT_DOWNLOADS,UV_CONCURRENT_BUILDS,UV_CONCURRENT_INSTALLS -Pnu immich uv sync --extra openvino --no-dev --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
+    $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT,UV_CONCURRENT_DOWNLOADS,UV_CONCURRENT_BUILDS,UV_CONCURRENT_INSTALLS -Pnu immich uv sync --extra openvino --no-dev --upgrade-package watchfiles --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
     [[ $attempt -eq 3 ]] && { msg_error "uv sync failed three times, the machine-learning environment was not built"; exit 1; }
     # Parallel fetches can trip DNS rate limits (AdGuard, Pi-hole); retry one at a time.
     export UV_CONCURRENT_DOWNLOADS=1 UV_CONCURRENT_BUILDS=1 UV_CONCURRENT_INSTALLS=1
@@ -462,7 +481,7 @@ else
   msg_ok "Pre-installed Python ${ML_PYTHON}"
   msg_info "Installing machine-learning"
   for attempt in $(seq 1 3); do
-    $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT,UV_CONCURRENT_DOWNLOADS,UV_CONCURRENT_BUILDS,UV_CONCURRENT_INSTALLS -Pnu immich uv sync --extra cpu --no-dev --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
+    $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT,UV_CONCURRENT_DOWNLOADS,UV_CONCURRENT_BUILDS,UV_CONCURRENT_INSTALLS -Pnu immich uv sync --extra cpu --no-dev --upgrade-package watchfiles --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
     [[ $attempt -eq 3 ]] && { msg_error "uv sync failed three times, the machine-learning environment was not built"; exit 1; }
     # Parallel fetches can trip DNS rate limits (AdGuard, Pi-hole); retry one at a time.
     export UV_CONCURRENT_DOWNLOADS=1 UV_CONCURRENT_BUILDS=1 UV_CONCURRENT_INSTALLS=1
@@ -481,20 +500,8 @@ grep -rlE "'/build'" | xargs -n1 sed -i "s|'/build'|'$APP_DIR'|g"
 sed -i "s@\"/cache\"@\"$INSTALL_DIR/cache\"@g" "$ML_DIR"/immich_ml/config.py
 ln -s "$UPLOAD_DIR" "$APP_DIR"/upload
 ln -s "$UPLOAD_DIR" "$ML_DIR"/upload
-
-msg_info "Installing GeoNames data"
-cd "$GEO_DIR"
-curl_with_retry "https://download.geonames.org/export/dump/admin1CodesASCII.txt" "admin1CodesASCII.txt"
-curl_with_retry "https://download.geonames.org/export/dump/admin2Codes.txt" "admin2Codes.txt"
-curl_with_retry "https://download.geonames.org/export/dump/countryInfo.txt" "countryInfo.txt"
-curl_with_retry "https://download.geonames.org/export/dump/cities500.zip" "cities500.zip"
-curl_with_retry "https://raw.githubusercontent.com/nvkelso/natural-earth-vector/v5.1.2/geojson/ne_10m_admin_0_countries.geojson" "ne_10m_admin_0_countries.geojson"
-unzip -q cities500.zip
-date --iso-8601=seconds | tr -d "\n" >geodata-date.txt
-rm cities500.zip
 cd "$INSTALL_DIR"
 ln -s "$GEO_DIR" "$APP_DIR"
-msg_ok "Installed GeoNames data"
 
 # MickLesk temporary patch for HEIC thumbnail gen
 MEDIA_REPO_JS="/opt/immich/app/dist/repositories/media.repository.js"

install/matterjs-server-install.sh

@@ -43,6 +43,7 @@ After=network.target
 [Service]
 Type=simple
 User=root
+Environment=ENABLE_TIME_SYNC=true
 ExecStart=/usr/bin/node /opt/matter-server/node_modules/matter-server/dist/esm/MatterServer.js --storage-path /var/lib/matterjs-server
 Restart=on-failure
 RestartSec=5

install/metube-install.sh

@@ -26,7 +26,7 @@ NODE_VERSION="24" NODE_MODULE="corepack,pnpm" setup_nodejs
 
 msg_info "Installing Deno"
 export DENO_INSTALL="/usr/local"
-curl -fsSL https://deno.land/install.sh | $STD sh -s -- -y
+curl -fsSL https://deno.land/install.sh | CI=1 $STD sh -s
 [[ ":$PATH:" != *":/usr/local/bin:"* ]] &&
   echo -e "\nexport PATH=\"/usr/local/bin:\$PATH\"" >>~/.bashrc &&
   source ~/.bashrc

install/n8n-install.sh

@@ -23,7 +23,10 @@ msg_ok "Installed Dependencies"
 NODE_VERSION="24" setup_nodejs
 
 msg_info "Installing n8n (Patience)"
-$STD npm install -g n8n@latest
+# n8n-nodes-base 2.46.0 pins both @napi-rs/canvas musl binaries as hard
+# dependencies, which no os/cpu/libc combination can satisfy. Drop --force
+# once upstream makes them optional again.
+$STD npm install -g n8n@latest --force
 msg_ok "Installed n8n"
 
 msg_info "Creating Service"

install/nametag-install.sh

@@ -15,7 +15,7 @@ update_os
 
 PG_VERSION="16" setup_postgresql
 PG_DB_NAME="nametag_db" PG_DB_USER="nametag" setup_postgresql_db
-NODE_VERSION="20" setup_nodejs
+NODE_VERSION="24" setup_nodejs
 fetch_and_deploy_gh_release "nametag" "mattogodoy/nametag" "tarball" "latest" "/opt/nametag"
 
 msg_info "Setting up Application"

install/nexterm-install.sh

@@ -33,6 +33,7 @@ LOCAL_ENGINE_TOKEN=${LOCAL_ENGINE_TOKEN}
 ENCRYPTION_KEY=${ENCRYPTION_KEY}
 EOF
 chmod 0640 /etc/nexterm-engine/config.yaml /etc/nexterm-server/server.env
+echo "x /tmp/nexterm-sea-*" >/etc/tmpfiles.d/nexterm.conf
 msg_ok "Configured Nexterm"
 
 msg_info "Creating Services"

install/norish-install.sh

@@ -22,8 +22,8 @@ PG_DB_NAME="norish" PG_DB_USER="norish" setup_postgresql_db
 PYTHON_VERSION="3.14" setup_uv
 
 fetch_and_deploy_gh_release "norish" "norish-recipes/norish" "tarball"
-NODE_VERSION="22" NODE_MODULE="pnpm@$(jq -r '.packageManager | split("@")[1]' /opt/norish/package.json)" setup_nodejs
-fetch_and_deploy_gh_release "obscura" "h4ckf0r0day/obscura" "prebuild" "v$(sed -n 's/^OBSCURA_VERSION=//p' /opt/norish/docker/obscura/pin.env)" "/opt/obscura" "obscura-$(arch_resolve "x86_64" "aarch64")-linux-stealth.tar.gz"
+NODE_VERSION="26" NODE_MODULE="pnpm@$(jq -r '.packageManager | split("@")[1]' /opt/norish/package.json)" setup_nodejs
+fetch_and_deploy_gh_release "obscura" "$(sed -n 's#^OBSCURA_REPO=https://github.com/##p' /opt/norish/docker/obscura/pin.env)" "prebuild" "v$(sed -n 's/^OBSCURA_VERSION=//p' /opt/norish/docker/obscura/pin.env)" "/opt/obscura" "obscura-$(arch_resolve "x86_64" "aarch64")-linux-stealth.tar.gz"
 fetch_and_deploy_gh_release "yt-dlp" "yt-dlp/yt-dlp" "singlefile" "latest" "/usr/local/bin" "$(arch_resolve "yt-dlp_linux" "yt-dlp_linux_aarch64")"
 
 msg_info "Building Norish"
@@ -75,9 +75,9 @@ Wants=obscura.service
 [Service]
 Type=simple
 User=root
-WorkingDirectory=/opt/norish
+WorkingDirectory=/opt/norish/apps/web
 EnvironmentFile=/opt/norish_data/.env
-ExecStart=/usr/bin/node /opt/norish/dist-server/index.mjs
+ExecStart=/usr/bin/node --import tsx server/index.ts
 Restart=on-failure
 RestartSec=5
 

install/planka-install.sh

@@ -70,7 +70,9 @@ After=network.target
 
 [Service]
 WorkingDirectory=/opt/planka
-ExecStart=/usr/bin/npm start --prod
+Environment=NODE_ENV=production
+Environment=HOME=/root
+ExecStart=/usr/bin/node app.js --prod
 Restart=always
 
 [Install]

install/podman-install.sh

@@ -48,6 +48,10 @@ msg_ok "Installed Podman"
 
 mkdir -p /etc/containers/systemd
 
+if [[ ! -x /usr/libexec/podman/quadlet ]]; then
+  msg_warn "Portainer runs as a Quadlet unit, which needs Podman 4.4 or newer (Debian 13); skipping it"
+  var_podman_portainer="n" var_podman_portainer_agent="n"
+fi
 prompt="${var_podman_portainer:-}"
 [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Portainer? <y/N> " prompt || true
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then

install/proxmox-mail-gateway-install.sh

@@ -16,9 +16,9 @@ update_os
 msg_info "Installing Proxmox Mail Gateway"
 setup_deb822_repo \
   "pmg" \
-  "https://enterprise.proxmox.com/debian/proxmox-release-trixie.gpg" \
+  "https://enterprise.proxmox.com/debian/proxmox-release-$(get_os_info codename).gpg" \
   "http://download.proxmox.com/debian/pmg" \
-  "trixie" \
+  "$(get_os_info codename)" \
   "pmg-no-subscription"
 $STD apt install -y proxmox-mailgateway-container
 msg_ok "Installed Proxmox Mail Gateway"

install/ps5-mqtt-install.sh

@@ -23,9 +23,11 @@ NODE_VERSION="24" NODE_MODULE="playactor" setup_nodejs
 fetch_and_deploy_gh_release "ps5-mqtt" "FunkeyFlo/ps5-mqtt" "tarball"
 
 msg_info "Configuring PS5-MQTT"
-cd /opt/ps5-mqtt/ps5-mqtt/
-$STD npm install
-$STD npm run build
+cd /opt/ps5-mqtt
+$STD corepack yarn install --immutable
+$STD env PREPARE_ONLY=1 corepack yarn workspace @ps5-mqtt/server run package
+cd /opt/ps5-mqtt/ps5-mqtt/server/.packaged/server
+$STD npm install --omit=dev --omit=optional
 mkdir -p /opt/.config/ps5-mqtt/
 mkdir -p /opt/.config/ps5-mqtt/playactor
 cat <<EOF >/opt/.config/ps5-mqtt/config.json
@@ -66,7 +68,7 @@ Description=PS5-MQTT Daemon
 After=syslog.target network.target
 
 [Service]
-WorkingDirectory=/opt/ps5-mqtt/ps5-mqtt
+WorkingDirectory=/opt/ps5-mqtt/ps5-mqtt/server/.packaged
 Environment="CONFIG_PATH=/opt/.config/ps5-mqtt/config.json"
 Environment="DEBUG='@ha:ps5:*'"
 Restart=always

install/razzia-install.sh

@@ -0,0 +1,118 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Owen Voke (owenvoke)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Ralex91/Razzia
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y nginx
+msg_ok "Installed Dependencies"
+
+NODE_VERSION="24" NODE_MODULE="pnpm@11" setup_nodejs
+fetch_and_deploy_gh_release "razzia" "Ralex91/Razzia" "tarball"
+
+msg_info "Building Razzia"
+cd /opt/razzia
+$STD pnpm install --frozen-lockfile
+$STD pnpm build
+msg_ok "Built Razzia"
+
+msg_info "Configuring Razzia"
+mkdir -p /opt/razzia-config
+cat <<EOF >/opt/razzia/.env
+MANAGER_PASSWORD=$(random_password 16)
+JWT_SECRET=$(openssl rand -hex 32)
+EOF
+msg_ok "Configured Razzia"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/razzia.service
+[Unit]
+Description=Razzia Socket Server
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/razzia/packages/socket
+EnvironmentFile=/opt/razzia/.env
+Environment=NODE_ENV=production
+Environment=CONFIG_PATH=/opt/razzia-config
+ExecStart=/usr/bin/node /opt/razzia/packages/socket/dist/index.cjs
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now razzia
+msg_ok "Created Service"
+
+msg_info "Configuring Nginx"
+cat <<EOF >/etc/nginx/sites-available/razzia
+server {
+  listen 3000;
+  server_name _;
+
+  root /opt/razzia/packages/web/dist;
+  index index.html;
+
+  location / {
+    try_files \$uri \$uri/ /index.html;
+  }
+
+  location /branding/ {
+    alias /opt/razzia-config/branding/;
+  }
+
+  location /media/ {
+    alias /opt/razzia-config/media/;
+    types {
+      image/png png;
+      image/jpeg jpg;
+      image/webp webp;
+      image/gif gif;
+      audio/mpeg mp3;
+      audio/ogg ogg;
+      audio/wav wav;
+      video/mp4 mp4;
+      video/webm webm;
+    }
+    default_type application/octet-stream;
+    add_header X-Content-Type-Options nosniff;
+  }
+
+  location /api {
+    client_max_body_size 101m;
+    proxy_pass http://127.0.0.1:3001;
+    proxy_set_header Host \$host;
+    proxy_read_timeout 300s;
+    proxy_send_timeout 300s;
+  }
+
+  location /ws {
+    proxy_pass http://127.0.0.1:3001;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade \$http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_set_header Host \$host;
+    proxy_read_timeout 3600s;
+    proxy_send_timeout 3600s;
+  }
+}
+EOF
+nginx_enable_site razzia
+msg_ok "Configured Nginx"
+
+motd_ssh
+customize
+cleanup_lxc

install/romm-install.sh

@@ -257,15 +257,33 @@ map $http_upgrade $connection_upgrade {
     '' close;
 }
 
+# COEP/COOP for the EmulatorJS and js-dos players (SharedArrayBuffer needs a
+# crossOriginIsolated document). Matched on $request_uri because try_files
+# rewrites $uri to /index.html before add_header runs, so a per-location
+# add_header on the player route never fires. Mirrors upstream RomM's
+# docker/nginx/templates/default.conf.template.
+map $request_uri $coep_header {
+    default        "";
+    ~^/rom/.*/(ejs|jsdos)(\?|$) "require-corp";
+}
+map $request_uri $coop_header {
+    default        "";
+    ~^/rom/.*/(ejs|jsdos)(\?|$) "same-origin";
+}
+
 server {
     listen 80;
     server_name _;
     root /opt/romm/frontend/dist;
     client_max_body_size 0;
 
-    # Frontend SPA
+    # Frontend SPA - also emits the player isolation headers: the player URLs
+    # fall through try_files to /index.html, which this location serves
     location / {
         try_files $uri $uri/ /index.html;
+        add_header Cache-Control "no-cache";
+        add_header Cross-Origin-Embedder-Policy $coep_header;
+        add_header Cross-Origin-Opener-Policy $coop_header;
     }
 
     # Static assets
@@ -276,13 +294,6 @@ server {
         add_header Cache-Control "public, immutable";
     }
 
-    # EmulatorJS player - requires COOP/COEP headers for SharedArrayBuffer
-    location ~ ^/rom/.*/ejs$ {
-        add_header Cross-Origin-Embedder-Policy "require-corp";
-        add_header Cross-Origin-Opener-Policy "same-origin";
-        try_files $uri /index.html;
-    }
-
     # Backend API
     location /api {
         proxy_pass http://romm_backend;

install/teable-install.sh

@@ -17,7 +17,8 @@ msg_info "Installing Dependencies"
 $STD apt install -y \
   build-essential \
   python3 \
-  git
+  git \
+  redis-server
 msg_ok "Installed Dependencies"
 
 NODE_VERSION="24" NODE_MODULE="pnpm" setup_nodejs
@@ -56,8 +57,8 @@ SECRET_KEY=${SECRET_KEY}
 PORT=3000
 NODE_ENV=production
 NEXT_TELEMETRY_DISABLED=1
-BACKEND_CACHE_PROVIDER=sqlite
-BACKEND_CACHE_SQLITE_URI=sqlite:///opt/teable/.assets/.cache.db
+BACKEND_CACHE_PROVIDER=redis
+BACKEND_CACHE_REDIS_URI=redis://127.0.0.1:6379/0
 NEXTJS_DIR=apps/nextjs-app
 EOF
 ln -sf /opt/teable /app
@@ -70,10 +71,11 @@ fi
 msg_ok "Configured Teable"
 
 msg_info "Creating Service"
+systemctl enable -q --now redis-server
 cat <<EOF >/etc/systemd/system/teable.service
 [Unit]
 Description=Teable
-After=network.target postgresql.service
+After=network.target postgresql.service redis-server.service
 
 [Service]
 Type=simple

install/technitiumdns-install.sh

@@ -23,7 +23,7 @@ setup_deb822_repo \
 $STD apt install -y aspnetcore-runtime-10.0
 msg_ok "Installed Dependencies"
 
-RELEASE=$(curl -fsSL https://technitium.com/dns/ | grep -oP 'Version \K[\d.]+')
+RELEASE=$(get_latest_github_release "TechnitiumSoftware/DnsServer")
 fetch_and_deploy_from_url "https://download.technitium.com/dns/DnsServerPortable.tar.gz" /opt/technitium/dns
 echo "${RELEASE}" >~/.technitium
 

install/teleport-install.sh

@@ -24,7 +24,11 @@ msg_info "Configuring Teleport"
 $STD apt install -y teleport
 $STD teleport configure -o /etc/teleport.yaml
 systemctl enable -q --now teleport
-sleep 10
+SECONDS=0
+until teleport debug readyz &>/dev/null; do
+  sleep 2
+  ((SECONDS >= 120)) && { msg_error "Teleport did not become ready in time"; exit 1; }
+done
 tctl users add teleport-admin --roles=editor,access --logins=root >~/teleportadmin.txt
 sed -i "s|https://[^:]*:3080|https://${LOCAL_IP}:3080|g" ~/teleportadmin.txt
 msg_ok "Configured Teleport"

install/thingsboard-install.sh

@@ -26,7 +26,8 @@ PG_DB_NAME="thingsboard_db" PG_DB_USER="thingsboard" setup_postgresql_db
 fetch_and_deploy_gh_release "thingsboard" "thingsboard/thingsboard" "binary" "latest" "/tmp" "thingsboard-*.deb"
 
 msg_info "Configuring ThingsBoard"
-cat <<EOF >/etc/thingsboard/conf/thingsboard.conf
+cat <<EOF >>/etc/thingsboard/conf/thingsboard.conf
+
 # DB Configuration
 export DATABASE_TS_TYPE=sql
 export SPRING_DATASOURCE_URL=jdbc:postgresql://localhost:5432/${PG_DB_NAME}

install/tracearr-install.sh

@@ -17,7 +17,7 @@ msg_info "Installing Dependencies"
 $STD apt install -y redis-server
 msg_ok "Installed Dependencies"
 
-NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs
+NODE_VERSION="26" NODE_MODULE="corepack" setup_nodejs
 PG_VERSION="18" setup_postgresql
 
 msg_info "Installing pnpm"

install/tududi-install.sh

@@ -13,13 +13,9 @@ setting_up_container
 network_check
 update_os
 
-msg_info "Installing Dependencies"
-$STD apt install -y \
-  sqlite3 \
-  yq
-msg_ok "Installed Dependencies"
-
 NODE_VERSION="22" setup_nodejs
+PG_VERSION="17" setup_postgresql
+PG_DB_NAME="tududi" PG_DB_USER="tududi" setup_postgresql_db
 fetch_and_deploy_gh_release "tududi" "chrisvel/tududi" "tarball" "latest" "/opt/tududi"
 
 msg_info "Configuring Tududi"
@@ -30,30 +26,22 @@ $STD npm run frontend:build
 mv ./dist ./backend
 msg_ok "Configured Tududi"
 
-msg_info "Creating env and database"
-DB_LOCATION="/opt/tududi-db"
-UPLOAD_DIR="/opt/tududi-uploads"
-mkdir -p {"$DB_LOCATION","$UPLOAD_DIR"}
+msg_info "Creating env"
+mkdir -p /opt/tududi-uploads
 SECRET="$(openssl rand -hex 64)"
 sed -e '/^NODE_ENV=/s/=.*$/=production/' \
   -e 's/^TUDUDI_USER/# TUDUDI_USER/g' \
-  -e "/_SECRET=/s/=.*$/=${SECRET}/" \
-  -e '/^# DB_FILE=/s/^# //' \
-  -e "s|^DB_FILE=.*|DB_FILE=${DB_LOCATION}/production.sqlite3|" \
-  -e "/^# TUDUDI_ALLOWED/s/^# //; \
-    \|_ORIGINS=|s|=.*$|=<your tududi IP or FDQN>|" \
-  -e "/^# TUDUDI_UPLOAD/s/^# //; \
-    \|UPLOAD_PATH=|s|=.*$|=${UPLOAD_DIR}|" \
+  -e "s/^TUDUDI_SESSION_SECRET=.*/TUDUDI_SESSION_SECRET=${SECRET}/" \
+  -e "s|^DATABASE_URL=.*|DATABASE_URL=postgres://tududi:${PG_DB_PASS}@localhost:5432/tududi|" \
   /opt/tududi/backend/.env.example >/opt/tududi/backend/.env
-export DB_FILE="${DB_LOCATION}/production.sqlite3"
-$STD npm run db:init
-msg_ok "Created env and database"
+echo "TUDUDI_UPLOAD_PATH=/opt/tududi-uploads" >>/opt/tududi/backend/.env
+msg_ok "Created env"
 
 msg_info "Creating service"
 cat <<EOF >/etc/systemd/system/tududi.service
 [Unit]
 Description=Tududi Service
-After=network.target
+After=network.target postgresql.service
 
 [Service]
 Type=simple

install/twenty-install.sh

@@ -21,7 +21,7 @@ msg_ok "Installed Dependencies"
 
 PG_VERSION="17" PG_MODULES="pgvector" setup_postgresql
 PG_DB_NAME="twenty_db" PG_DB_USER="twenty" PG_DB_SCHEMA_PERMS="true" PG_DB_EXTENSIONS="vector" setup_postgresql_db
-NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs
+NODE_VERSION="26" NODE_MODULE="corepack" setup_nodejs
 
 fetch_and_deploy_gh_release "twenty" "twentyhq/twenty" "tarball"
 

install/wazuh-install.sh

@@ -21,7 +21,11 @@ msg_info "Setup Wazuh"
 curl -fsSL https://packages.wazuh.com/$RELEASE/wazuh-install.sh -o wazuh-install.sh
 chmod +x wazuh-install.sh
 if [ "$STD" = "silent" ]; then
-  bash wazuh-install.sh -a >>~/wazuh-install.output
+  bash wazuh-install.sh -a >>~/wazuh-install.output || {
+    $STD tail -n 25 ~/wazuh-install.output
+    msg_error "The Wazuh installer failed, see its output above or in ~/wazuh-install.output"
+    exit 1
+  }
 else
   bash wazuh-install.sh -a | tee -a ~/wazuh-install.output
 fi

install/wikijs-install.sh

@@ -17,26 +17,44 @@ msg_info "Installing Dependencies"
 $STD apt install -y git
 msg_ok "Installed Dependencies"
 
-NODE_VERSION="26" NODE_MODULE="yarn,node-gyp" setup_nodejs
+NODE_VERSION="26" setup_nodejs
 PG_VERSION="17" setup_postgresql
-PG_DB_NAME="wiki" PG_DB_USER="wikijs_user" PG_DB_EXTENSIONS="pg_trgm" setup_postgresql_db
-fetch_and_deploy_gh_release "wikijs" "requarks/wiki-v2" "prebuild" "latest" "/opt/wikijs" "wiki-js.tar.gz"
+PG_DB_NAME="wiki" PG_DB_USER="wikijs_user" setup_postgresql_db
+fetch_and_deploy_gh_release "wikijs" "requarks/wiki" "prebuild" "latest" "/opt/wikijs" "wiki-js.tar.gz"
+
+if [[ "$(arch_resolve)" == "arm64" ]]; then
+  msg_info "Building Wiki.js Dependencies"
+  cd /opt/wikijs/backend
+  $STD npm ci --omit=dev
+  msg_ok "Built Wiki.js Dependencies"
+fi
 
 msg_info "Configuring Wiki.js"
-mv /opt/wikijs/config.sample.yml /opt/wikijs/config.yml
-sed -i -E 's|^( *user: ).*|\1'"$PG_DB_USER"'|' /opt/wikijs/config.yml
-sed -i -E 's|^( *pass: ).*|\1'"$PG_DB_PASS"'|' /opt/wikijs/config.yml
+mkdir -p /opt/wikijs_data
+cp /opt/wikijs/config.sample.yml /opt/wikijs/config.yml
+sed -i \
+  -e "s|^  user: .*|  user: wikijs_user|" \
+  -e "s|^  pass: .*|  pass: ${PG_DB_PASS}|" \
+  -e "s|^  db: .*|  db: wiki|" \
+  -e "s|^dataPath: .*|dataPath: /opt/wikijs_data|" \
+  /opt/wikijs/config.yml
+ADMIN_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-16)
+cat <<EOF >~/wikijs.creds
+Wiki.js Admin
+Email: admin@example.com
+Password: ${ADMIN_PASS}
+EOF
 msg_ok "Configured Wiki.js"
 
 msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/wikijs.service
 [Unit]
 Description=Wiki.js
-After=network.target
+After=network.target postgresql.service
 
 [Service]
 Type=simple
-ExecStart=/usr/bin/node server
+ExecStart=/usr/bin/node --no-experimental-webstorage backend
 Restart=always
 User=root
 Environment=NODE_ENV=production
@@ -45,7 +63,13 @@ WorkingDirectory=/opt/wikijs
 [Install]
 WantedBy=multi-user.target
 EOF
+systemctl set-environment ADMIN_PASS="${ADMIN_PASS}"
 systemctl enable -q --now wikijs
+for _ in $(seq 60); do
+  curl -fs -o /dev/null http://127.0.0.1:3000 && break
+  sleep 2
+done
+systemctl unset-environment ADMIN_PASS
 msg_ok "Created Service"
 
 motd_ssh

install/yubal-install.sh

@@ -31,7 +31,7 @@ ln -sf /opt/bun/bin/bunx /usr/local/bin/bunx
 msg_ok "Installed Bun"
 
 msg_info "Installing Deno"
-$STD sh -c "curl -fsSL https://deno.land/install.sh | DENO_INSTALL=/usr/local sh -s -- -y"
+curl -fsSL https://deno.land/install.sh | CI=1 $STD sh -s
 msg_ok "Installed Deno"
 
 msg_info "Creating directories"

install/zabbix-install.sh

@@ -36,17 +36,17 @@ cd /tmp
 ZABBIX_REPO_DIR="debian"
 [[ "$ZABBIX_VERSION" == "7.0" && "$(arch_resolve)" == "arm64" ]] && ZABBIX_REPO_DIR="debian-arm64"
 if [[ "$ZABBIX_VERSION" == "7.0" ]]; then
-  ZABBIX_DEB_URL="https://repo.zabbix.com/zabbix/${ZABBIX_VERSION}/${ZABBIX_REPO_DIR}/pool/main/z/zabbix-release/zabbix-release_latest_${ZABBIX_VERSION}+debian13_all.deb"
-  ZABBIX_DEB_FILE="zabbix-release_latest_${ZABBIX_VERSION}+debian13_all.deb"
+  ZABBIX_DEB_URL="https://repo.zabbix.com/zabbix/${ZABBIX_VERSION}/${ZABBIX_REPO_DIR}/pool/main/z/zabbix-release/zabbix-release_latest_${ZABBIX_VERSION}+debian$(get_os_version_major)_all.deb"
+  ZABBIX_DEB_FILE="zabbix-release_latest_${ZABBIX_VERSION}+debian$(get_os_version_major)_all.deb"
 else
-  ZABBIX_DEB_URL="https://repo.zabbix.com/zabbix/${ZABBIX_VERSION}/release/debian/pool/main/z/zabbix-release/zabbix-release_latest+debian13_all.deb"
-  ZABBIX_DEB_FILE="zabbix-release_latest+debian13_all.deb"
+  ZABBIX_DEB_URL="https://repo.zabbix.com/zabbix/${ZABBIX_VERSION}/release/debian/pool/main/z/zabbix-release/zabbix-release_latest+debian$(get_os_version_major)_all.deb"
+  ZABBIX_DEB_FILE="zabbix-release_latest+debian$(get_os_version_major)_all.deb"
 fi
 
 curl -fsSL "$ZABBIX_DEB_URL" -o /tmp/"$ZABBIX_DEB_FILE"
 $STD dpkg -i /tmp/"$ZABBIX_DEB_FILE"
 apt_update_safe
-$STD apt install -y zabbix-server-pgsql zabbix-frontend-php php8.4-pgsql zabbix-apache-conf zabbix-sql-scripts
+$STD apt install -y zabbix-server-pgsql zabbix-frontend-php php-pgsql zabbix-apache-conf zabbix-sql-scripts
 
 if [[ "$ZABBIX_VERSION" == "7.0" ]]; then
   ZABBIX_SQL="/usr/share/zabbix-sql-scripts/postgresql/server.sql.gz"

install/zerobyte-install.sh

@@ -53,6 +53,7 @@ export VITE_SHOUTRRR_VERSION=$(cat ~/.shoutrrr)
 export NODE_OPTIONS="--max-old-space-size=3072"
 $STD bun install
 $STD node ./node_modules/vite/bin/vite.js build
+$STD bun build apps/agent/src/index.ts --outfile .output/agent/index.mjs --target bun
 msg_ok "Built Zerobyte"
 
 msg_info "Configuring Zerobyte"

misc/alpine-install.func

@@ -1,275 +0,0 @@
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: tteck (tteckster)
-# Co-Author: MickLesk
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-
-if ! command -v curl >/dev/null 2>&1; then
-  apk update && apk add curl >/dev/null 2>&1
-fi
-# Mark container context BEFORE error handling starts: error_handler/on_exit
-# must write local failure artifacts instead of talking to the telemetry API
-# (the host is the single telemetry reporter).
-export TELEMETRY_CONTEXT="container"
-# A freshly booted container may not have DNS up yet. `source <(curl ...)` hides
-# curl's exit code, so a failed download would silently source an empty stream.
-_bootstrap_die() {
-  if declare -f msg_error >/dev/null 2>&1; then
-    msg_error "$1"
-  else
-    echo "FATAL: $1" >&2
-  fi
-  exit 115
-}
-
-_bootstrap_source() {
-  local url="$1" probe="$2" content
-  content=$(curl -fsSL --connect-timeout 10 --retry 5 --retry-connrefused --retry-delay 2 "$url") ||
-    _bootstrap_die "Failed to download ${url##*/}"
-  source /dev/stdin <<<"$content"
-  declare -f "$probe" >/dev/null 2>&1 ||
-    _bootstrap_die "${url##*/} loaded but incomplete (missing ${probe})"
-}
-
-_FUNC_BASE="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc"
-_bootstrap_source "$_FUNC_BASE/core.func" load_functions
-_bootstrap_source "$_FUNC_BASE/error_handler.func" catch_errors
-load_functions
-catch_errors
-
-# Persist diagnostics setting inside container (exported from build.func)
-# so addon scripts running later can find the user's choice
-if [[ ! -f /usr/local/community-scripts/diagnostics ]]; then
-  mkdir -p /usr/local/community-scripts
-  echo "DIAGNOSTICS=${DIAGNOSTICS:-no}" >/usr/local/community-scripts/diagnostics
-fi
-
-# Get LXC IP address (must be called INSIDE container, after network is up)
-get_lxc_ip
-
-# ------------------------------------------------------------------------------
-# post_progress_to_api()
-#
-# - Lightweight progress ping from inside the container
-# - Updates the existing telemetry record status
-# - Arguments:
-#   * $1: status (optional, default: "configuring")
-# - Signals that the installation is actively progressing (not stuck)
-# - Fire-and-forget: never blocks or fails the script
-# - Only executes if DIAGNOSTICS=yes and RANDOM_UUID is set
-# ------------------------------------------------------------------------------
-post_progress_to_api() {
-  command -v curl &>/dev/null || return 0
-  [[ "${DIAGNOSTICS:-no}" == "no" ]] && return 0
-  [[ -z "${RANDOM_UUID:-}" ]] && return 0
-
-  local progress_status="${1:-configuring}"
-
-  curl -fsS -m 5 -X POST "https://telemetry.community-scripts.org/telemetry" \
-    -H "Content-Type: application/json" \
-    -d "{\"random_id\":\"${RANDOM_UUID}\",\"execution_id\":\"${EXECUTION_ID:-${RANDOM_UUID}}\",\"type\":\"lxc\",\"nsapp\":\"${app:-unknown}\",\"status\":\"${progress_status}\",\"platform\":\"${TELEMETRY_PLATFORM:-}\",\"repo_source\":\"${REPO_SOURCE:-}\",\"repo_slug\":\"${REPO_SLUG:-}\"}" &>/dev/null || true
-}
-
-# This function enables IPv6 if it's not disabled and sets verbose mode
-verb_ip6() {
-  set_std_mode # Set STD mode based on VERBOSE
-
-  if [ "${IPV6_METHOD:-}" = "disable" ]; then
-    msg_info "Disabling IPv6 (this may affect some services)"
-    $STD sysctl -w net.ipv6.conf.all.disable_ipv6=1
-    $STD sysctl -w net.ipv6.conf.default.disable_ipv6=1
-    $STD sysctl -w net.ipv6.conf.lo.disable_ipv6=1
-    mkdir -p /etc/sysctl.d
-    $STD tee /etc/sysctl.d/99-disable-ipv6.conf >/dev/null <<EOF
-net.ipv6.conf.all.disable_ipv6 = 1
-net.ipv6.conf.default.disable_ipv6 = 1
-net.ipv6.conf.lo.disable_ipv6 = 1
-EOF
-    $STD rc-update add sysctl default
-    msg_ok "Disabled IPv6"
-  fi
-}
-
-# This function sets up the Container OS by generating the locale, setting the timezone, and checking the network connection
-setting_up_container() {
-  msg_info "Setting up Container OS"
-  while [ $i -gt 0 ]; do
-    if [ "$(ip addr show | grep 'inet ' | grep -v '127.0.0.1' | awk '{print $2}' | cut -d'/' -f1)" != "" ]; then
-      break
-    fi
-    echo 1>&2 -en "${CROSS}${RD} No Network! "
-    sleep $RETRY_EVERY
-    i=$((i - 1))
-  done
-
-  if [ "$(ip addr show | grep 'inet ' | grep -v '127.0.0.1' | awk '{print $2}' | cut -d'/' -f1)" = "" ]; then
-    echo 1>&2 -e "\n${CROSS}${RD} No Network After $RETRY_NUM Tries${CL}"
-    echo -e "${NETWORK}Check Network Settings"
-    exit 121
-  fi
-  msg_ok "Set up Container OS"
-  msg_ok "Network Connected: ${BL}$(ip addr show | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1 | tail -n1)${CL}"
-  post_progress_to_api
-}
-
-# This function checks the network connection by pinging a known IP address and prompts the user to continue if the internet is not connected
-network_check() {
-  set +e
-  trap - ERR
-  ipv4_connected=false
-
-  # Check IPv4 connectivity to Cloudflare, Google & Quad9 DNS servers
-  if ping -c 1 -W 1 1.1.1.1 &>/dev/null || ping -c 1 -W 1 8.8.8.8 &>/dev/null || ping -c 1 -W 1 9.9.9.9 &>/dev/null; then
-    msg_ok "IPv4 Internet Connected"
-    ipv4_connected=true
-  else
-    msg_error "IPv4 Internet Not Connected"
-  fi
-
-  if [[ $ipv4_connected == false ]]; then
-    read -r -p "No Internet detected, would you like to continue anyway? <y/N> " prompt </dev/tty
-    if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
-      echo -e "${INFO}${RD}Expect Issues Without Internet${CL}"
-    else
-      echo -e "${NETWORK}Check Network Settings"
-      exit 122
-    fi
-  fi
-
-  # DNS resolution checks for GitHub-related domains
-  GIT_HOSTS=("github.com" "raw.githubusercontent.com" "api.github.com")
-  GIT_STATUS="Git DNS:"
-  DNS_FAILED=false
-
-  for HOST in "${GIT_HOSTS[@]}"; do
-    RESOLVEDIP=$(getent hosts "$HOST" | awk '{ print $1 }' | grep -E '(^([0-9]{1,3}\.){3}[0-9]{1,3}$)|(^[a-fA-F0-9:]+$)' | head -n1)
-    if [[ -z "$RESOLVEDIP" ]]; then
-      GIT_STATUS+="$HOST:($DNSFAIL)"
-      DNS_FAILED=true
-    else
-      GIT_STATUS+=" $HOST:($DNSOK)"
-    fi
-  done
-
-  if [[ "$DNS_FAILED" == true ]]; then
-    fatal "$GIT_STATUS"
-  else
-    msg_ok "$GIT_STATUS"
-  fi
-
-  set -e
-  trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
-}
-
-# This function updates the Container OS by running apk upgrade with mirror fallback
-update_os() {
-  msg_info "Updating Container OS"
-  configure_http_proxy
-  if ! $STD apk -U upgrade; then
-    msg_warn "apk update failed (dl-cdn.alpinelinux.org), trying alternate mirrors..."
-    local alpine_mirrors="mirror.init7.net ftp.halifax.rwth-aachen.de mirrors.edge.kernel.org alpine.mirror.wearetriple.com mirror.leaseweb.com uk.alpinelinux.org dl-2.alpinelinux.org dl-4.alpinelinux.org"
-    local apk_ok=false
-    for m in $(printf '%s\n' $alpine_mirrors | shuf); do
-      if timeout 2 bash -c "echo >/dev/tcp/$m/80" 2>/dev/null; then
-        msg_custom "${INFO}" "${YW}" "Attempting mirror: ${m}"
-        cat <<EOF >/etc/apk/repositories
-http://$m/alpine/latest-stable/main
-http://$m/alpine/latest-stable/community
-EOF
-        if $STD apk -U upgrade; then
-          msg_ok "CDN set to ${m}: tests passed"
-          apk_ok=true
-          break
-        else
-          msg_warn "Mirror ${m} failed"
-        fi
-      fi
-    done
-    if [[ "$apk_ok" != true ]]; then
-      msg_error "All Alpine mirrors failed. Check network or try again later."
-      exit 1
-    fi
-  fi
-  local tools_content
-  tools_content=$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/tools.func) || {
-    msg_error "Failed to download tools.func"
-    exit 115
-  }
-  source /dev/stdin <<<"$tools_content"
-  if ! declare -f fetch_and_deploy_gh_release >/dev/null 2>&1; then
-    msg_error "tools.func loaded but incomplete — missing expected functions"
-    exit 115
-  fi
-  msg_ok "Updated Container OS"
-  post_progress_to_api
-}
-
-# This function modifies the message of the day (motd) and SSH settings
-motd_ssh() {
-  echo "export TERM='xterm-256color'" >>/root/.bashrc
-
-  PROFILE_FILE="/etc/profile.d/00_lxc-details.sh"
-
-  echo "[ -t 1 ] || return 0" >"$PROFILE_FILE"
-  echo "echo -e \"\"" >>"$PROFILE_FILE"
-  echo -e "echo -e \"${BOLD}${APPLICATION} LXC Container${CL}"\" >>"$PROFILE_FILE"
-  echo -e "echo -e \"${TAB}${GATEWAY}${YW} Provided by: ${GN}community-scripts ORG ${YW}| GitHub: ${GN}https://github.com/community-scripts/ProxmoxVE${CL}\"" >>"$PROFILE_FILE"
-  echo "echo \"\"" >>"$PROFILE_FILE"
-  cat <<EOF >>"$PROFILE_FILE"
-os_display="Unknown OS"
-if [ -r /etc/os-release ]; then
-  . /etc/os-release
-  os_display="\${PRETTY_NAME:-\${NAME:-Unknown OS}}"
-fi
-echo -e "${TAB}${OS}${YW} OS: ${GN}\${os_display}${CL}"
-EOF
-  echo -e "echo -e \"${TAB}${HOSTNAME}${YW} Hostname: ${GN}\$(hostname)${CL}\"" >>"$PROFILE_FILE"
-  echo -e "echo -e \"${TAB}${INFO}${YW} IP Address: ${GN}\$(ip -4 addr show eth0 | awk '/inet / {print \$2}' | cut -d/ -f1 | head -n 1)${CL}\"" >>"$PROFILE_FILE"
-
-  # Configure SSH if enabled
-  if [[ "${SSH_ROOT}" == "yes" ]]; then
-    # Enable sshd service
-    $STD rc-update add sshd
-    # Allow root login via SSH
-    sed -i "s/#PermitRootLogin prohibit-password/PermitRootLogin yes/g" /etc/ssh/sshd_config
-    # Start the sshd service
-    $STD /etc/init.d/sshd start
-  fi
-  post_progress_to_api
-}
-
-# Validate Timezone for some LXC's
-validate_tz() {
-  [[ -f "/usr/share/zoneinfo/$1" ]]
-}
-
-# This function customizes the container and enables passwordless login for the root user
-customize() {
-  if [[ "$PASSWORD" == "" ]]; then
-    msg_info "Customizing Container"
-    passwd -d root >/dev/null 2>&1
-
-    # Ensure agetty is available
-    apk add --no-cache --force-broken-world util-linux >/dev/null 2>&1
-
-    # Create persistent autologin boot script
-    mkdir -p /etc/local.d
-    cat <<'EOF' >/etc/local.d/autologin.start
-#!/bin/sh
-sed -i 's|^tty1::respawn:.*|tty1::respawn:/sbin/agetty --autologin root --noclear tty1 38400 linux|' /etc/inittab
-kill -HUP 1
-EOF
-    touch /root/.hushlogin
-
-    chmod +x /etc/local.d/autologin.start
-    rc-update add local >/dev/null 2>&1
-
-    # Apply autologin immediately for current session
-    /etc/local.d/autologin.start
-
-    msg_ok "Customized Container"
-  fi
-
-  echo 'set -a; [ -f /etc/profile.d/90-http-proxy.sh ] && . /etc/profile.d/90-http-proxy.sh; set +a; bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/'"${app}"'.sh)"' >/usr/bin/update
-  chmod +x /usr/bin/update
-  post_progress_to_api
-}

misc/alpine-tools.func

@@ -1,515 +0,0 @@
-#!/bin/ash
-# shellcheck shell=ash
-
-# Expects existing msg_* functions and optional $STD from the framework.
-
-# ------------------------------
-# helpers
-# ------------------------------
-lower() { printf '%s' "$1" | tr '[:upper:]' '[:lower:]'; }
-has() { command -v "$1" >/dev/null 2>&1; }
-
-need_tool() {
-  # usage: need_tool curl jq unzip ...
-  # setup missing tools via apk
-  local missing=0 t
-  for t in "$@"; do
-    if ! has "$t"; then missing=1; fi
-  done
-  if [ "$missing" -eq 1 ]; then
-    msg_info "Installing tools: $*"
-    apk add --no-cache "$@" >/dev/null 2>&1 || {
-      msg_error "apk add failed for: $*"
-      return 100
-    }
-    msg_ok "Tools ready: $*"
-  fi
-}
-
-net_resolves() {
-  # better handling for missing getent on Alpine
-  # usage: net_resolves api.github.com
-  local host="$1"
-  ping -c1 -W1 "$host" >/dev/null 2>&1 || nslookup "$host" >/dev/null 2>&1
-}
-
-ensure_usr_local_bin_persist() {
-  # Login shells: /etc/profile.d/
-  local PROFILE_FILE="/etc/profile.d/10-localbin.sh"
-  if [ ! -f "$PROFILE_FILE" ]; then
-    echo 'case ":$PATH:" in *:/usr/local/bin:*) ;; *) export PATH="/usr/local/bin:$PATH";; esac' >"$PROFILE_FILE"
-    chmod +x "$PROFILE_FILE"
-  fi
-
-  # Non-login shells (pct enter): /root/.profile and /root/.bashrc
-  for rc_file in /root/.profile /root/.bashrc; do
-    if [ -f "$rc_file" ] && ! grep -q '/usr/local/bin' "$rc_file"; then
-      echo 'export PATH="/usr/local/bin:$PATH"' >>"$rc_file"
-    fi
-  done
-}
-
-download_with_progress() {
-  # $1 url, $2 dest
-  local url="$1" out="$2" cl
-  need_tool curl pv || return 127
-  cl=$(curl -fsSLI "$url" 2>/dev/null | awk 'tolower($0) ~ /^content-length:/ {print $2}' | tr -d '\r')
-  if [ -n "$cl" ]; then
-    curl -fsSL "$url" | pv -s "$cl" >"$out" || {
-      msg_error "Download failed: $url"
-      return 250
-    }
-  else
-    curl -fL# -o "$out" "$url" || {
-      msg_error "Download failed: $url"
-      return 250
-    }
-  fi
-}
-
-# ------------------------------
-# GitHub: check Release
-# ------------------------------
-check_for_gh_release() {
-  # app, repo, [pinned]
-  local app="$1" source="$2" pinned="${3:-}"
-  local app_lc
-  app_lc="$(lower "$app" | tr -d ' ')"
-  local current_file="$HOME/.${app_lc}"
-  local current="" release tag
-
-  msg_info "Check for update: $app"
-
-  net_resolves api.github.com || {
-    msg_error "DNS/network error: api.github.com"
-    return 6
-  }
-  need_tool curl jq || return 127
-
-  tag=$(curl -fsSL "https://api.github.com/repos/${source}/releases/latest" | jq -r '.tag_name // empty')
-  [ -z "$tag" ] && {
-    msg_error "Unable to fetch latest tag for $app"
-    return 22
-  }
-  release="${tag#v}"
-
-  [ -f "$current_file" ] && current="$(cat "$current_file")"
-
-  if [ -n "$pinned" ]; then
-    if [ "$pinned" = "$release" ]; then
-      msg_ok "$app pinned to v$pinned (no update)"
-      return 1
-    fi
-    if [ "$current" = "$pinned" ]; then
-      msg_ok "$app pinned v$pinned installed (upstream v$release)"
-      return 1
-    fi
-    msg_info "$app pinned v$pinned (upstream v$release) → update/downgrade"
-    CHECK_UPDATE_RELEASE="$pinned"
-    return 0
-  fi
-
-  if [ "$release" != "$current" ] || [ ! -f "$current_file" ]; then
-    CHECK_UPDATE_RELEASE="$release"
-    msg_info "New release available: v$release (current: v${current:-none})"
-    return 0
-  fi
-
-  msg_ok "$app is up to date (v$release)"
-  return 1
-}
-
-# ------------------------------
-# GitHub: get Release  & deploy (Alpine)
-# modes: tarball | prebuild | singlefile
-# ------------------------------
-fetch_and_deploy_gh() {
-  # $1 app, $2 repo, [$3 mode], [$4 version], [$5 target], [$6 asset_pattern
-  local app="$1" repo="$2" mode="${3:-tarball}" version="${4:-latest}" target="${5:-/opt/$1}" pattern="${6:-}"
-  local app_lc
-  app_lc="$(lower "$app" | tr -d ' ')"
-  local vfile="$HOME/.${app_lc}"
-  local json url filename tmpd unpack
-
-  net_resolves api.github.com || {
-    msg_error "DNS/network error"
-    return 6
-  }
-  need_tool curl jq tar || return 127
-  [ "$mode" = "prebuild" ] || [ "$mode" = "singlefile" ] && need_tool unzip >/dev/null 2>&1 || true
-
-  tmpd="$(mktemp -d)" || return 252
-  mkdir -p "$target"
-
-  # Release JSON
-  if [ "$version" = "latest" ]; then
-    json="$(curl -fsSL "https://api.github.com/repos/$repo/releases/latest")" || {
-      msg_error "GitHub API failed"
-      rm -rf "$tmpd"
-      return 22
-    }
-  else
-    json="$(curl -fsSL "https://api.github.com/repos/$repo/releases/tags/$version")" || {
-      msg_error "GitHub API failed"
-      rm -rf "$tmpd"
-      return 22
-    }
-  fi
-
-  # correct Version
-  version="$(printf '%s' "$json" | jq -r '.tag_name // empty')"
-  version="${version#v}"
-
-  [ -z "$version" ] && {
-    msg_error "No tag in release json"
-    rm -rf "$tmpd"
-    return 65
-  }
-
-  case "$mode" in
-  tarball | source)
-    url="$(printf '%s' "$json" | jq -r '.tarball_url // empty')"
-    [ -z "$url" ] && url="https://github.com/$repo/archive/refs/tags/v$version.tar.gz"
-    filename="${app_lc}-${version}.tar.gz"
-    download_with_progress "$url" "$tmpd/$filename" || {
-      rm -rf "$tmpd"
-      return 250
-    }
-    tar -xzf "$tmpd/$filename" -C "$tmpd" || {
-      msg_error "tar extract failed"
-      rm -rf "$tmpd"
-      return 251
-    }
-    unpack="$(find "$tmpd" -mindepth 1 -maxdepth 1 -type d | head -n1)"
-    # copy content of unpack to target
-    (cd "$unpack" && tar -cf - .) | (cd "$target" && tar -xf -) || {
-      msg_error "copy failed"
-      rm -rf "$tmpd"
-      return 252
-    }
-    ;;
-  prebuild)
-    [ -n "$pattern" ] || {
-      msg_error "prebuild requires asset pattern"
-      rm -rf "$tmpd"
-      return 65
-    }
-    url="$(printf '%s' "$json" | jq -r '.assets[].browser_download_url' | awk -v p="$pattern" '
-        BEGIN{IGNORECASE=1}
-        $0 ~ p {print; exit}
-      ')"
-    [ -z "$url" ] && {
-      msg_error "asset not found for pattern: $pattern"
-      rm -rf "$tmpd"
-      return 250
-    }
-    filename="${url##*/}"
-    download_with_progress "$url" "$tmpd/$filename" || {
-      rm -rf "$tmpd"
-      return 250
-    }
-    # unpack archive (Zip or tarball)
-    case "$filename" in
-    *.zip)
-      need_tool unzip || {
-        rm -rf "$tmpd"
-        return 127
-      }
-      mkdir -p "$tmpd/unp"
-      unzip -q "$tmpd/$filename" -d "$tmpd/unp"
-      ;;
-    *.tar.gz | *.tgz | *.tar.xz | *.tar.zst | *.tar.bz2)
-      mkdir -p "$tmpd/unp"
-      tar -xf "$tmpd/$filename" -C "$tmpd/unp"
-      ;;
-    *)
-      msg_error "unsupported archive: $filename"
-      rm -rf "$tmpd"
-      return 251
-      ;;
-    esac
-    # top-level folder strippen
-    if [ "$(find "$tmpd/unp" -mindepth 1 -maxdepth 1 -type d | wc -l)" -eq 1 ] && [ -z "$(find "$tmpd/unp" -mindepth 1 -maxdepth 1 -type f | head -n1)" ]; then
-      unpack="$(find "$tmpd/unp" -mindepth 1 -maxdepth 1 -type d)"
-      (cd "$unpack" && tar -cf - .) | (cd "$target" && tar -xf -) || {
-        msg_error "copy failed"
-        rm -rf "$tmpd"
-        return 252
-      }
-    else
-      (cd "$tmpd/unp" && tar -cf - .) | (cd "$target" && tar -xf -) || {
-        msg_error "copy failed"
-        rm -rf "$tmpd"
-        return 252
-      }
-    fi
-    ;;
-  singlefile)
-    [ -n "$pattern" ] || {
-      msg_error "singlefile requires asset pattern"
-      rm -rf "$tmpd"
-      return 65
-    }
-    url="$(printf '%s' "$json" | jq -r '.assets[].browser_download_url' | awk -v p="$pattern" '
-        BEGIN{IGNORECASE=1}
-        $0 ~ p {print; exit}
-      ')"
-    [ -z "$url" ] && {
-      msg_error "asset not found for pattern: $pattern"
-      rm -rf "$tmpd"
-      return 250
-    }
-    filename="${url##*/}"
-    download_with_progress "$url" "$target/$app" || {
-      rm -rf "$tmpd"
-      return 250
-    }
-    chmod +x "$target/$app"
-    ;;
-  *)
-    msg_error "Unknown mode: $mode"
-    rm -rf "$tmpd"
-    return 65
-    ;;
-  esac
-
-  echo "$version" >"$vfile"
-  ensure_usr_local_bin_persist
-  rm -rf "$tmpd"
-  msg_ok "Deployed $app ($version) → $target"
-}
-
-# ------------------------------
-# yq (mikefarah) – Alpine
-# ------------------------------
-setup_yq() {
-  # prefer apk, unless FORCE_GH=1
-  if [ "${FORCE_GH:-0}" != "1" ] && apk info -e yq >/dev/null 2>&1; then
-    msg_info "Updating yq via apk"
-    apk add --no-cache --upgrade yq >/dev/null 2>&1 || true
-    msg_ok "yq ready ($(yq --version 2>/dev/null))"
-    return 0
-  fi
-
-  need_tool curl || return 127
-  local arch bin url tmp
-  case "$(uname -m)" in
-  x86_64) arch="amd64" ;;
-  aarch64) arch="arm64" ;;
-  *)
-    msg_error "Unsupported arch for yq: $(uname -m)"
-    return 238
-    ;;
-  esac
-  url="https://github.com/mikefarah/yq/releases/latest/download/yq_linux_${arch}"
-  tmp="$(mktemp)"
-  download_with_progress "$url" "$tmp" || return 250
-  /usr/bin/install -m 0755 "$tmp" /usr/local/bin/yq
-  rm -f "$tmp"
-  msg_ok "Setup yq ($(yq --version 2>/dev/null))"
-}
-
-# ------------------------------
-# Adminer – Alpine
-# ------------------------------
-setup_adminer() {
-  need_tool curl || return 127
-  msg_info "Setup Adminer (Alpine)"
-  mkdir -p /var/www/localhost/htdocs/adminer
-  curl -fsSL https://github.com/vrana/adminer/releases/latest/download/adminer.php \
-    -o /var/www/localhost/htdocs/adminer/index.php || {
-    msg_error "Adminer download failed"
-    return 250
-  }
-  msg_ok "Adminer at /adminer (served by your webserver)"
-}
-
-# ------------------------------
-# uv – Alpine (musl tarball)
-# optional: PYTHON_VERSION="3.12"
-# ------------------------------
-setup_uv() {
-  need_tool curl tar || return 127
-  local UV_BIN="/usr/local/bin/uv"
-  local arch tarball url tmpd ver installed
-
-  case "$(uname -m)" in
-  x86_64) arch="x86_64-unknown-linux-musl" ;;
-  aarch64) arch="aarch64-unknown-linux-musl" ;;
-  *)
-    msg_error "Unsupported arch for uv: $(uname -m)"
-    return 238
-    ;;
-  esac
-
-  ver="$(curl -fsSL https://api.github.com/repos/astral-sh/uv/releases/latest | jq -r '.tag_name' 2>/dev/null)"
-  ver="${ver#v}"
-  [ -z "$ver" ] && {
-    msg_error "uv: cannot determine latest version"
-    return 250
-  }
-
-  if has "$UV_BIN"; then
-    installed="$($UV_BIN -V 2>/dev/null | awk '{print $2}')"
-    [ "$installed" = "$ver" ] && {
-      msg_ok "uv $ver already installed"
-      return 0
-    }
-    msg_info "Updating uv $installed → $ver"
-  else
-    msg_info "Setup uv $ver"
-  fi
-
-  tmpd="$(mktemp -d)" || return 252
-  tarball="uv-${arch}.tar.gz"
-  url="https://github.com/astral-sh/uv/releases/download/v${ver}/${tarball}"
-
-  download_with_progress "$url" "$tmpd/uv.tar.gz" || {
-    rm -rf "$tmpd"
-    return 250
-  }
-  tar -xzf "$tmpd/uv.tar.gz" -C "$tmpd" || {
-    msg_error "uv: extract failed"
-    rm -rf "$tmpd"
-    return 251
-  }
-
-  # tar contains ./uv
-  if [ -x "$tmpd/uv" ]; then
-    /usr/bin/install -m 0755 "$tmpd/uv" "$UV_BIN"
-  else
-    # fallback: in subfolder
-    /usr/bin/install -m 0755 "$tmpd"/*/uv "$UV_BIN" 2>/dev/null || {
-      msg_error "uv binary not found in tar"
-      rm -rf "$tmpd"
-      return 252
-    }
-  fi
-  rm -rf "$tmpd"
-  ensure_usr_local_bin_persist
-  msg_ok "Setup uv $ver"
-
-  if [ -n "${PYTHON_VERSION:-}" ]; then
-    local match
-    match="$(uv python list --only-downloads 2>/dev/null | awk -v maj="$PYTHON_VERSION" '
-      $0 ~ "^cpython-"maj"\\." { print $0 }' | awk -F- '{print $2}' | sort -V | tail -n1)"
-    [ -z "$match" ] && {
-      msg_error "No matching Python for $PYTHON_VERSION"
-      return 250
-    }
-    if ! uv python list | grep -q "cpython-${match}-linux"; then
-      msg_info "Installing Python $match via uv"
-      uv python install "$match" || {
-        msg_error "uv python install failed"
-        return 150
-      }
-      msg_ok "Python $match installed (uv)"
-    fi
-  fi
-}
-
-# ------------------------------
-# Java – Alpine (OpenJDK)
-# JAVA_VERSION: 17|21 (Default 21)
-# ------------------------------
-setup_java() {
-  local JAVA_VERSION="${JAVA_VERSION:-21}" pkg
-  case "$JAVA_VERSION" in
-  17) pkg="openjdk17-jdk" ;;
-  21 | *) pkg="openjdk21-jdk" ;;
-  esac
-  msg_info "Setup Java (OpenJDK $JAVA_VERSION)"
-  apk add --no-cache "$pkg" >/dev/null 2>&1 || {
-    msg_error "apk add $pkg failed"
-    return 100
-  }
-  # set JAVA_HOME
-  local prof="/etc/profile.d/20-java.sh"
-  if [ ! -f "$prof" ]; then
-    echo 'export JAVA_HOME=$(dirname $(dirname $(readlink -f $(command -v java))))' >"$prof"
-    echo 'case ":$PATH:" in *:$JAVA_HOME/bin:*) ;; *) export PATH="$JAVA_HOME/bin:$PATH";; esac' >>"$prof"
-    chmod +x "$prof"
-  fi
-  msg_ok "Java ready: $(java -version 2>&1 | head -n1)"
-}
-
-# ------------------------------
-# Go – Alpine (apk prefers, else tarball)
-# ------------------------------
-setup_go() {
-  if [ -z "${GO_VERSION:-}" ]; then
-    msg_info "Setup Go (apk)"
-    apk add --no-cache go >/dev/null 2>&1 || {
-      msg_error "apk add go failed"
-      return 100
-    }
-    msg_ok "Go ready: $(go version 2>/dev/null)"
-    return 0
-  fi
-
-  need_tool curl tar || return 127
-  local ARCH TARBALL URL TMP
-  case "$(uname -m)" in
-  x86_64) ARCH="amd64" ;;
-  aarch64) ARCH="arm64" ;;
-  *)
-    msg_error "Unsupported arch for Go: $(uname -m)"
-    return 238
-    ;;
-  esac
-  TARBALL="go${GO_VERSION}.linux-${ARCH}.tar.gz"
-  URL="https://go.dev/dl/${TARBALL}"
-  msg_info "Setup Go $GO_VERSION (tarball)"
-  TMP="$(mktemp)"
-  download_with_progress "$URL" "$TMP" || return 250
-  rm -rf /usr/local/go
-  tar -C /usr/local -xzf "$TMP" || {
-    msg_error "extract go failed"
-    rm -f "$TMP"
-    return 251
-  }
-  rm -f "$TMP"
-  ln -sf /usr/local/go/bin/go /usr/local/bin/go
-  ln -sf /usr/local/go/bin/gofmt /usr/local/bin/gofmt
-  ensure_usr_local_bin_persist
-  msg_ok "Go ready: $(go version 2>/dev/null)"
-}
-
-# ------------------------------
-# Composer – Alpine
-# uses php83-cli + openssl + phar
-# ------------------------------
-setup_composer() {
-  local COMPOSER_BIN="/usr/local/bin/composer"
-  if ! has php; then
-    # prefers php83
-    msg_info "Installing PHP CLI for Composer"
-    apk add --no-cache php83-cli php83-openssl php83-phar php83-iconv >/dev/null 2>&1 || {
-      # Fallback to generic php if 83 not available
-      apk add --no-cache php-cli php-openssl php-phar php-iconv >/dev/null 2>&1 || {
-        msg_error "Failed to install php-cli for composer"
-        return 100
-      }
-    }
-    msg_ok "PHP CLI ready: $(php -v | head -n1)"
-  fi
-
-  if [ -x "$COMPOSER_BIN" ]; then
-    msg_info "Updating Composer"
-  else
-    msg_info "Setup Composer"
-  fi
-
-  need_tool curl || return 127
-  curl -fsSL https://getcomposer.org/installer -o /tmp/composer-setup.php || {
-    msg_error "composer installer download failed"
-    return 250
-  }
-  php /tmp/composer-setup.php --install-dir=/usr/local/bin --filename=composer >/dev/null 2>&1 || {
-    msg_error "composer install failed"
-    return 150
-  }
-  rm -f /tmp/composer-setup.php
-  ensure_usr_local_bin_persist
-  msg_ok "Composer ready: $(composer --version 2>/dev/null)"
-}