fix: generate first logins and secrets instead of fixed ones in 13 more installs

authelia, qbittorrent, rabbitmq, nagios, neko, paymenter, nodebb, homelable, snapotter and octoprint's Linux user were created with fixed passwords; each now uses random_password and saves the login in ~/<app>.creds. Stirling-PDF no longer sets admin/stirling explicitly, so its own default asks for a new password on first login again. Firefly kept the example APP_KEY and STATIC_CRON_TOKEN, and SigNoz used the JWT secret "secret"; both are generated now. Only new installs change.
fix: generate the webmin, code-server and copyparty logins; leave existing installs alone
2026-11-09 23:12:53 +01:00 · 2026-11-09 15:39:04 +01:00 · 2026-11-09 15:36:10 +01:00 · 2026-11-09 15:16:43 +01:00 · 2026-11-09 15:15:09 +01:00 · 2026-11-09 13:41:43 +00:00
58 changed files with 1090 additions and 542 deletions
@@ -0,0 +1,187 @@
+## 2026-11-07
+
+### 🆕 New Scripts
+
+  - EspoCRM ([#18519](https://github.com/community-scripts/ProxmoxVE/pull/18519))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - RomM: emit player isolation headers from the serving location [@adotagarwal](https://github.com/adotagarwal) ([#18511](https://github.com/community-scripts/ProxmoxVE/pull/18511))
+
+  - #### 💥 Breaking Changes
+
+    - fix: gotenberg: update to v9 [@CrazyWolf13](https://github.com/CrazyWolf13) ([#18491](https://github.com/community-scripts/ProxmoxVE/pull/18491))
+
+### 💾 Core
+
+  - nvidia: close the hardware acceleration step when no GPU is usable | pin the whole NVIDIA userspace to the host's driver version [@MickLesk](https://github.com/MickLesk) ([core#215](https://github.com/community-scripts/core/pull/215))
+- fix: stage release downloads on disk, not in /tmp [@rcourtman](https://github.com/rcourtman) ([core#218](https://github.com/community-scripts/core/pull/218))
+- Minor fixes: restart php-fpm during sigpipe, Install jq for forge commands  [@MickLesk](https://github.com/MickLesk) ([core#213](https://github.com/community-scripts/core/pull/213))
+- incus: name the project restriction that refuses an Incus launch [@MickLesk](https://github.com/MickLesk) ([core#214](https://github.com/community-scripts/core/pull/214))
+
+## 2026-11-06
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - UmbrelOS-VM: report runs as ProxmoxVE, not DevScripts [@MickLesk](https://github.com/MickLesk) ([#18497](https://github.com/community-scripts/ProxmoxVE/pull/18497))
+    - Caddy: skip the xCaddy test build below 2 GB RAM [@MickLesk](https://github.com/MickLesk) ([#18472](https://github.com/community-scripts/ProxmoxVE/pull/18472))
+    - Thingsboard: keep the package defaults in thingsboard.conf [@MickLesk](https://github.com/MickLesk) ([#18499](https://github.com/community-scripts/ProxmoxVE/pull/18499))
+    - Nexterm: keep the extracted app out of the /tmp cleanup [@MickLesk](https://github.com/MickLesk) ([#18501](https://github.com/community-scripts/ProxmoxVE/pull/18501))
+    - PLANKA: run the service with node instead of nodemon [@MickLesk](https://github.com/MickLesk) ([#18503](https://github.com/community-scripts/ProxmoxVE/pull/18503))
+    - MeTube/Yubal: install Deno without its shell setup [@MickLesk](https://github.com/MickLesk) ([#18406](https://github.com/community-scripts/ProxmoxVE/pull/18406))
+    - OPNsense VM: size the temp space check to the unpacked image |  say why the EFI disk could not be allocated [@MickLesk](https://github.com/MickLesk) ([#18404](https://github.com/community-scripts/ProxmoxVE/pull/18404))
+
+  - #### 🔧 Refactor
+
+    - Technitium DNS: read the version from its GitHub releases [@MickLesk](https://github.com/MickLesk) ([#18425](https://github.com/community-scripts/ProxmoxVE/pull/18425))
+
+### 💾 Core
+
+  - fix: spot same-filesystem bind mounts on Alpine [@rcourtman](https://github.com/rcourtman) ([core#212](https://github.com/community-scripts/core/pull/212))
+- fix: report a container that went down during setup, keep finished installs [@MickLesk](https://github.com/MickLesk) ([core#211](https://github.com/community-scripts/core/pull/211))
+
+### 📚 Documentation
+
+  - ci: reject DevScripts URLs in scripts [@MickLesk](https://github.com/MickLesk) ([#18498](https://github.com/community-scripts/ProxmoxVE/pull/18498))
+
+## 2026-11-05
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - OpenWRT-VM: leave the NIC untagged on a bridge without a port [@MickLesk](https://github.com/MickLesk) ([#18473](https://github.com/community-scripts/ProxmoxVE/pull/18473))
+    - Podman: skip Portainer where Podman has no Quadlet [@MickLesk](https://github.com/MickLesk) ([#18469](https://github.com/community-scripts/ProxmoxVE/pull/18469))
+    - Planka: change npm start argument to --production [@CerberusStyle](https://github.com/CerberusStyle) ([#18478](https://github.com/community-scripts/ProxmoxVE/pull/18478))
+    - OPNsense VM: wait for the FreeBSD login prompt instead of 180 seconds [@MickLesk](https://github.com/MickLesk) ([#18467](https://github.com/community-scripts/ProxmoxVE/pull/18467))
+
+  - #### 🔧 Refactor
+
+    - truenas-VM: let a failed ISO lookup reach its own error [@MickLesk](https://github.com/MickLesk) ([#18476](https://github.com/community-scripts/ProxmoxVE/pull/18476))
+    - proxmox-mail-gateway: take the repo suite from the container  [@MickLesk](https://github.com/MickLesk) ([#18475](https://github.com/community-scripts/ProxmoxVE/pull/18475))
+    - Immich: Bump to 3.3.6 and minor improvement [@MickLesk](https://github.com/MickLesk) ([#18474](https://github.com/community-scripts/ProxmoxVE/pull/18474))
+    - Tududi: run 2.0 on PostgreSQL, keep SQLite installs on 1.15.0 [@MickLesk](https://github.com/MickLesk) ([#18465](https://github.com/community-scripts/ProxmoxVE/pull/18465))
+
+### 💾 Core
+
+  - fix: keep the existing install until the new archive has extracted [@rcourtman](https://github.com/rcourtman) ([core#201](https://github.com/community-scripts/core/pull/201))
+- fix: keep the install when a clone or an Alpine extract fails [@rcourtman](https://github.com/rcourtman) ([core#210](https://github.com/community-scripts/core/pull/210))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - Arcane: write both env names, stop shipping the unused .env [@MickLesk](https://github.com/MickLesk) ([#18466](https://github.com/community-scripts/ProxmoxVE/pull/18466))
+
+## 2026-11-04
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Teleport: Poll readyz instead of fixed 10 second sleep. [@cthach](https://github.com/cthach) ([#18461](https://github.com/community-scripts/ProxmoxVE/pull/18461))
+    - n8n: install past its unsatisfiable canvas dependencies [@MickLesk](https://github.com/MickLesk) ([#18439](https://github.com/community-scripts/ProxmoxVE/pull/18439))
+    - Teable: add Redis cache [@MickLesk](https://github.com/MickLesk) ([#18450](https://github.com/community-scripts/ProxmoxVE/pull/18450))
+
+### 💾 Core
+
+  - feat: say why download_gpg_key failed [@MickLesk](https://github.com/MickLesk) ([core#208](https://github.com/community-scripts/core/pull/208))
+- feat: read the MOTD's OS version at login [@MickLesk](https://github.com/MickLesk) ([core#207](https://github.com/community-scripts/core/pull/207))
+- feat: skip screen clear when there is no terminal | pin only the scripts own app with var_appversion [@MickLesk](https://github.com/MickLesk) ([core#203](https://github.com/community-scripts/core/pull/203))
+
+## 2026-11-03
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Fedora VM: let the engine install libguestfs-tools [@MickLesk](https://github.com/MickLesk) ([#18422](https://github.com/community-scripts/ProxmoxVE/pull/18422))
+    - Cinephage: run the camoufox binary the package now ships [@MickLesk](https://github.com/MickLesk) ([#18426](https://github.com/community-scripts/ProxmoxVE/pull/18426))
+    - AlmaLinux VM: report failures through the engine's error handler [@MickLesk](https://github.com/MickLesk) ([#18418](https://github.com/community-scripts/ProxmoxVE/pull/18418))
+    - WireGuard: give the Debian container 1 GB for WGDashboard [@MickLesk](https://github.com/MickLesk) ([#18419](https://github.com/community-scripts/ProxmoxVE/pull/18419))
+    - zabbix: use os specific apt packages [@MickLesk](https://github.com/MickLesk) ([#18417](https://github.com/community-scripts/ProxmoxVE/pull/18417))
+    - Discourse: build libvips 8.18 for its image worker [@MickLesk](https://github.com/MickLesk) ([#18430](https://github.com/community-scripts/ProxmoxVE/pull/18430))
+    - Wazuh: show the installer's own error when it fails [@MickLesk](https://github.com/MickLesk) ([#18428](https://github.com/community-scripts/ProxmoxVE/pull/18428))
+    - Tracearr: move to Node.js 26 [@connorgallopo](https://github.com/connorgallopo) ([#18393](https://github.com/community-scripts/ProxmoxVE/pull/18393))
+
+  - #### ✨ New Features
+
+    - Wiki.js: install 3.x [@MickLesk](https://github.com/MickLesk) ([#18382](https://github.com/community-scripts/ProxmoxVE/pull/18382))
+
+  - #### 🔧 Refactor
+
+    - OpenWrt VM: read the stable release from downloads.openwrt.org [@MickLesk](https://github.com/MickLesk) ([#18411](https://github.com/community-scripts/ProxmoxVE/pull/18411))
+    - Immich: fetch VectorChord from its new repo, skip Java, get GeoNames first [@MickLesk](https://github.com/MickLesk) ([#18397](https://github.com/community-scripts/ProxmoxVE/pull/18397))
+
+### 💾 Core
+
+  - fix: put the reason for a VM failure into its trace [@MickLesk](https://github.com/MickLesk) ([core#200](https://github.com/community-scripts/core/pull/200))
+- fix: check the bridge before creating a container, and its state after start [@MickLesk](https://github.com/MickLesk) ([core#199](https://github.com/community-scripts/core/pull/199))
+- ref: offer to remove only the container this run created [@MickLesk](https://github.com/MickLesk) ([core#198](https://github.com/community-scripts/core/pull/198))
+- feat: report a cancelled tool dialog as an abort and name the failing command [@MickLesk](https://github.com/MickLesk) ([core#197](https://github.com/community-scripts/core/pull/197))
+- feat: check KVM and the host's threads before building a VM [@MickLesk](https://github.com/MickLesk) ([core#196](https://github.com/community-scripts/core/pull/196))
+- ref: give a host tool one log file for the whole run [@MickLesk](https://github.com/MickLesk) ([core#194](https://github.com/community-scripts/core/pull/194))
+- fix: keep a piped stdin when output moves to the log after a hangup [@MickLesk](https://github.com/MickLesk) ([core#193](https://github.com/community-scripts/core/pull/193))
+- fix: pve-LXC: say when the container went away during its setup [@MickLesk](https://github.com/MickLesk) ([core#192](https://github.com/community-scripts/core/pull/192))
+- fix: treat Esc in a VM wizard dialog as leaving the script [@MickLesk](https://github.com/MickLesk) ([core#190](https://github.com/community-scripts/core/pull/190))
+- ref: count a container stopped during a detached install as an abort [@MickLesk](https://github.com/MickLesk) ([core#187](https://github.com/community-scripts/core/pull/187))
+- feat: find the assets of a renamed GitHub repo without the API [@MickLesk](https://github.com/MickLesk) ([core#188](https://github.com/community-scripts/core/pull/188))
+- fix: restore npm when an interrupted update left it behind [@MickLesk](https://github.com/MickLesk) ([core#189](https://github.com/community-scripts/core/pull/189))
+- feat: add var_cmode to set the container console mode [@MickLesk](https://github.com/MickLesk) ([core#180](https://github.com/community-scripts/core/pull/180))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - all-templates: answering No or Cancel is not a failure [@MickLesk](https://github.com/MickLesk) ([#18423](https://github.com/community-scripts/ProxmoxVE/pull/18423))
+    - homebrew: skip service accounts when picking the user, survive a failed apt update [@MickLesk](https://github.com/MickLesk) ([#18424](https://github.com/community-scripts/ProxmoxVE/pull/18424))
+    - add-tailscale-lxc: start a stopped container and check its OS first [@MickLesk](https://github.com/MickLesk) ([#18421](https://github.com/community-scripts/ProxmoxVE/pull/18421))
+    - netdata: survive a failed apt update, leave quietly on Cancel [@MickLesk](https://github.com/MickLesk) ([#18427](https://github.com/community-scripts/ProxmoxVE/pull/18427))
+    - Privilege-Converter: offer only container-capable storages as the converter's restore target [@MickLesk](https://github.com/MickLesk) ([#18415](https://github.com/community-scripts/ProxmoxVE/pull/18415))
+    - let post-pve-install go on when legacy sources are kept [@MickLesk](https://github.com/MickLesk) ([#18403](https://github.com/community-scripts/ProxmoxVE/pull/18403))
+
+  - #### 🔧 Refactor
+
+    -  update-apps: say why an backup or restore failed [@MickLesk](https://github.com/MickLesk) ([#18405](https://github.com/community-scripts/ProxmoxVE/pull/18405))
+    - Keep host tools running when clear does not know the terminal [@MickLesk](https://github.com/MickLesk) ([#18412](https://github.com/community-scripts/ProxmoxVE/pull/18412))
+    - Refuse to run the PBS 4 upgrade on a Proxmox VE host [@MickLesk](https://github.com/MickLesk) ([#18416](https://github.com/community-scripts/ProxmoxVE/pull/18416))
+    - fstrim: keep trimming when pct fstrim fails on one container [@MickLesk](https://github.com/MickLesk) ([#18413](https://github.com/community-scripts/ProxmoxVE/pull/18413))
+    - execute-lxc: do not abort on a container that is not Debian or Ubuntu [@MickLesk](https://github.com/MickLesk) ([#18414](https://github.com/community-scripts/ProxmoxVE/pull/18414))
+
+### 📚 Documentation
+
+  - github: flag instead of closing on first PR template miss; add script-request eligibility check [@MickLesk](https://github.com/MickLesk) ([#18384](https://github.com/community-scripts/ProxmoxVE/pull/18384))
+
+## 2026-11-02
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - FileFlows: replace the program folders on update [@MickLesk](https://github.com/MickLesk) ([#18380](https://github.com/community-scripts/ProxmoxVE/pull/18380))
+    - anchor: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18373](https://github.com/community-scripts/ProxmoxVE/pull/18373))
+    - guardian: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18375](https://github.com/community-scripts/ProxmoxVE/pull/18375))
+    - nametag: bump Node.js from 20 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18376](https://github.com/community-scripts/ProxmoxVE/pull/18376))
+
+### 💾 Core
+
+  - github: trim theater, add signal to the engine bug report; move AI block to end of PR template [@MickLesk](https://github.com/MickLesk) ([core#186](https://github.com/community-scripts/core/pull/186))
+- fix: do not wait forever for verbose output a daemon keeps open [@MickLesk](https://github.com/MickLesk) ([core#185](https://github.com/community-scripts/core/pull/185))
+
+## 2026-11-01
+
+### 🆕 New Scripts
+
+  - Amazon Linux ([#18369](https://github.com/community-scripts/ProxmoxVE/pull/18369))
+- CachyOS VM ([#18368](https://github.com/community-scripts/ProxmoxVE/pull/18368))
+- Razzia ([#18366](https://github.com/community-scripts/ProxmoxVE/pull/18366))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(zerobyte): build the bundled local agent [@nicotsx](https://github.com/nicotsx) ([#18363](https://github.com/community-scripts/ProxmoxVE/pull/18363))
@@ -125,6 +125,9 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit



+
+
+



@@ -137,6 +140,13 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 <summary><h3>2026</h3></summary>


+<details>
+<summary><h4>November (7 entries)</h4></summary>
+
+[View November 2026 Changelog](.github/changelogs/2026/11.md)
+
+</details>
+
 <details>
 <summary><h4>October (31 entries)</h4></summary>

@@ -571,14 +581,88 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 </details>

-## 2026-11-07
+## 2026-11-09

 ### 🚀 Updated Scripts

+  - #### 🐞 Bug Fixes
+
+    - zipline: Update RAM to 3GB [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18569](https://github.com/community-scripts/ProxmoxVE/pull/18569))
+    - OpenObserve: record installed version, drop killall ExecStop [@BadFlo](https://github.com/BadFlo) ([#18566](https://github.com/community-scripts/ProxmoxVE/pull/18566))
+    - OpenObserve: extract release tarball with --no-same-owner [@BadFlo](https://github.com/BadFlo) ([#18564](https://github.com/community-scripts/ProxmoxVE/pull/18564))
+    - Immich: download before stopping, and clear maintenance mode after an interrupted update [@angusmaul](https://github.com/angusmaul) ([#18553](https://github.com/community-scripts/ProxmoxVE/pull/18553))
+    - cinephage: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18374](https://github.com/community-scripts/ProxmoxVE/pull/18374))
+    - kan: bump Node.js from 20 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18549](https://github.com/community-scripts/ProxmoxVE/pull/18549))
+    - myip: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18550](https://github.com/community-scripts/ProxmoxVE/pull/18550))
+
+  - #### 🔧 Refactor
+
+    - yuvomi: install from the attested release asset [@ulsklyc](https://github.com/ulsklyc) ([#18554](https://github.com/community-scripts/ProxmoxVE/pull/18554))
+
+### 🗑️ Deleted Scripts
+
+  - coolify: delete old ct / its an addon [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#18562](https://github.com/community-scripts/ProxmoxVE/pull/18562))
+
+### 💾 Core
+
+  - core: detect GPUs by their PCI class, not by text anywhere in the line [@MickLesk](https://github.com/MickLesk) ([core#221](https://github.com/community-scripts/core/pull/221))
+- core: load an app's own settings from its .vars file [@MickLesk](https://github.com/MickLesk) ([core#216](https://github.com/community-scripts/core/pull/216))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - IP-Tag: filter guest-agent IPs by CIDR before limiting to 3 [@mazelado](https://github.com/mazelado) ([#18537](https://github.com/community-scripts/ProxmoxVE/pull/18537))
+
+## 2026-11-08
+
+### 🆕 New Scripts
+
+  - Chatto ([#18521](https://github.com/community-scripts/ProxmoxVE/pull/18521))
+- Firefox-Syncserver ([#18520](https://github.com/community-scripts/ProxmoxVE/pull/18520))
+
+### 🚀 Updated Scripts
+
+  - #### 🔧 Refactor
+
+    - Immich: do not clone libjxl's testdata [@MickLesk](https://github.com/MickLesk) ([#18539](https://github.com/community-scripts/ProxmoxVE/pull/18539))
+    - Databasus: build 3.65 and ship the verification agent [@MickLesk](https://github.com/MickLesk) ([#18500](https://github.com/community-scripts/ProxmoxVE/pull/18500))
+
+### 💾 Core
+
+  - fix: a closed console no longer ends a running setup | ERR trap fixes | check VM ID before creating [@MickLesk](https://github.com/MickLesk) ([core#219](https://github.com/community-scripts/core/pull/219))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - update-apps: keep the backup alive on a closed console, stop before restoring [@MickLesk](https://github.com/MickLesk) ([#18540](https://github.com/community-scripts/ProxmoxVE/pull/18540))
+    - clean-lxcs: run with sh and keep going when one container fails [@MickLesk](https://github.com/MickLesk) ([#18538](https://github.com/community-scripts/ProxmoxVE/pull/18538))
+    - update-lxcs: keep going when one container fails [@MickLesk](https://github.com/MickLesk) ([#18541](https://github.com/community-scripts/ProxmoxVE/pull/18541))
+
+## 2026-11-07
+
+### 🆕 New Scripts
+
+  - EspoCRM ([#18519](https://github.com/community-scripts/ProxmoxVE/pull/18519))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - RomM: emit player isolation headers from the serving location [@adotagarwal](https://github.com/adotagarwal) ([#18511](https://github.com/community-scripts/ProxmoxVE/pull/18511))
+
  - #### 💥 Breaking Changes

    - fix: gotenberg: update to v9 [@CrazyWolf13](https://github.com/CrazyWolf13) ([#18491](https://github.com/community-scripts/ProxmoxVE/pull/18491))

+### 💾 Core
+
+  - nvidia: close the hardware acceleration step when no GPU is usable | pin the whole NVIDIA userspace to the host's driver version [@MickLesk](https://github.com/MickLesk) ([core#215](https://github.com/community-scripts/core/pull/215))
+- fix: stage release downloads on disk, not in /tmp [@rcourtman](https://github.com/rcourtman) ([core#218](https://github.com/community-scripts/core/pull/218))
+- Minor fixes: restart php-fpm during sigpipe, Install jq for forge commands  [@MickLesk](https://github.com/MickLesk) ([core#213](https://github.com/community-scripts/core/pull/213))
+- incus: name the project restriction that refuses an Incus launch [@MickLesk](https://github.com/MickLesk) ([core#214](https://github.com/community-scripts/core/pull/214))
+
 ## 2026-11-06

 ### 🚀 Updated Scripts
@@ -1327,189 +1411,4 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

  - #### ✨ New Features

-    - FileBrowser Quantum: migrate the config and database to v2 [@MickLesk](https://github.com/MickLesk) ([#17815](https://github.com/community-scripts/ProxmoxVE/pull/17815))
-
-## 2026-10-08
-
-### 🆕 New Scripts
-
-  - Unifi-OS-Server VM ([#17752](https://github.com/community-scripts/ProxmoxVE/pull/17752))
- ZimaOS VM ([#17778](https://github.com/community-scripts/ProxmoxVE/pull/17778))
-
-### 🚀 Updated Scripts
-
-  - Revert "Immich: Pin to v3.3.0" [@MickLesk](https://github.com/MickLesk) ([#17767](https://github.com/community-scripts/ProxmoxVE/pull/17767))
-
-  - #### 🐞 Bug Fixes
-
-    - Homarr: replace the musl better-sqlite3 that v2.3.0 ships for Debian [@MickLesk](https://github.com/MickLesk) ([#17789](https://github.com/community-scripts/ProxmoxVE/pull/17789))
-    - CLIProxyAPI: keep plugins and data across updates [@MickLesk](https://github.com/MickLesk) ([#17790](https://github.com/community-scripts/ProxmoxVE/pull/17790))
-    - Kima-Hub: install the Python services into a uv venv [@MickLesk](https://github.com/MickLesk) ([#17791](https://github.com/community-scripts/ProxmoxVE/pull/17791))
-
-  - #### ✨ New Features
-
-    - Immich: Pin to 3.3.0 / Update ML Python to 3.13 [@MickLesk](https://github.com/MickLesk) ([#17770](https://github.com/community-scripts/ProxmoxVE/pull/17770))
-
-  - #### 🔧 Refactor
-
-    - Refactor: OPNsense VM [@MickLesk](https://github.com/MickLesk) ([#17785](https://github.com/community-scripts/ProxmoxVE/pull/17785))
-    - Refactor: Nextcloud VM (Turnkey) [@MickLesk](https://github.com/MickLesk) ([#17787](https://github.com/community-scripts/ProxmoxVE/pull/17787))
-    - Refactor: OpenWrt VM [@MickLesk](https://github.com/MickLesk) ([#17774](https://github.com/community-scripts/ProxmoxVE/pull/17774))
-    - Refactor: Ubuntu VM [@MickLesk](https://github.com/MickLesk) ([#17776](https://github.com/community-scripts/ProxmoxVE/pull/17776))
-
-### 💾 Core
-
-  - Tolerate a missing datacenter.cfg in vm_keyboard_default [@MickLesk](https://github.com/MickLesk) ([core#124](https://github.com/community-scripts/core/pull/124))
- Take the ISO storage from the disk pool when it can hold ISOs [@MickLesk](https://github.com/MickLesk) ([core#122](https://github.com/community-scripts/core/pull/122))
- Shared VM helpers: disk import, releases, checksums, first boot, IP by MAC [@MickLesk](https://github.com/MickLesk) ([core#117](https://github.com/community-scripts/core/pull/117))
- tools: forge truncated release list [@MickLesk](https://github.com/MickLesk) ([core#118](https://github.com/community-scripts/core/pull/118))
- Remember a kept cached image until the upstream changes [@MickLesk](https://github.com/MickLesk) ([core#119](https://github.com/community-scripts/core/pull/119))
- Choose the VM keyboard layout and carry the host's timezone into prepared images [@MickLesk](https://github.com/MickLesk) ([core#120](https://github.com/community-scripts/core/pull/120))
- VM's: run first-boot units without debconf dialogs [@MickLesk](https://github.com/MickLesk) ([core#121](https://github.com/community-scripts/core/pull/121))
-
-## 2026-10-07
-
-### 🆕 New Scripts
-
-  - Fedora VM ([#17747](https://github.com/community-scripts/ProxmoxVE/pull/17747))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - AudioMuse-AI: replace the venv on update without asking [@MickLesk](https://github.com/MickLesk) ([#17738](https://github.com/community-scripts/ProxmoxVE/pull/17738))
-    - paperclip: run as a dedicated non-root user so Claude Code can skip permissions [@samvandenbossche](https://github.com/samvandenbossche) ([#17707](https://github.com/community-scripts/ProxmoxVE/pull/17707))
-    - Thingsboard: update Java version from 17 to 25 [@CerberusStyle](https://github.com/CerberusStyle) ([#17733](https://github.com/community-scripts/ProxmoxVE/pull/17733))
-
-  - #### ✨ New Features
-
-    - Immich: Pin to v3.3.0 [@vhsdream](https://github.com/vhsdream) ([#17759](https://github.com/community-scripts/ProxmoxVE/pull/17759))
-
-  - #### 💥 Breaking Changes
-
-    - OpenCloud: bump to v8.1.0, rebuild search index on upgrade [@SimKaiLong](https://github.com/SimKaiLong) ([#17710](https://github.com/community-scripts/ProxmoxVE/pull/17710))
-
-  - #### 🔧 Refactor
-
-    - Pangolin: Unpin Release, stable enough, Bump to latest [@MickLesk](https://github.com/MickLesk) ([#17740](https://github.com/community-scripts/ProxmoxVE/pull/17740))
-    - Refactor: Archlinux-VM [@MickLesk](https://github.com/MickLesk) ([#17741](https://github.com/community-scripts/ProxmoxVE/pull/17741))
-    - Refactor: MikroTik RouterOS [@MickLesk](https://github.com/MickLesk) ([#17748](https://github.com/community-scripts/ProxmoxVE/pull/17748))
-
-### 💾 Core
-
-  - Fix Fedora and BLS cloud image console setup [@MickLesk](https://github.com/MickLesk) ([core#116](https://github.com/community-scripts/core/pull/116))
- Keep setup_nodejs alive when the caller's directory is gone [@MickLesk](https://github.com/MickLesk) ([core#114](https://github.com/community-scripts/core/pull/114))
-
-## 2026-10-06
-
-### 🆕 New Scripts
-
-  - Pricebuddy ([#17708](https://github.com/community-scripts/ProxmoxVE/pull/17708))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Webtrees: stop serving data/ and the source folders directly [@MickLesk](https://github.com/MickLesk) ([#17724](https://github.com/community-scripts/ProxmoxVE/pull/17724))
-
-### 💾 Core
-
-  - Incus: check the architecture on Incus hosts too [@MickLesk](https://github.com/MickLesk) ([core#113](https://github.com/community-scripts/core/pull/113))
- Incus: Pass the app's var_* settings into Incus containers  [@MickLesk](https://github.com/MickLesk) ([core#112](https://github.com/community-scripts/core/pull/112))
- Incus: stub storage_content_check on Incus [@MickLesk](https://github.com/MickLesk) ([core#104](https://github.com/community-scripts/core/pull/104))
- Incus: map Proxmox template versions to Incus image names [@MickLesk](https://github.com/MickLesk) ([core#111](https://github.com/community-scripts/core/pull/111))
- Incus: read storage names from .vars files  [@MickLesk](https://github.com/MickLesk) ([core#110](https://github.com/community-scripts/core/pull/110))
- Incus: show the spinner inside containers again [@MickLesk](https://github.com/MickLesk) ([core#109](https://github.com/community-scripts/core/pull/109))
- Incus: set the hostname with sh, so it works before bash is installed [@MickLesk](https://github.com/MickLesk) ([core#102](https://github.com/community-scripts/core/pull/102))
- Incus: reserve a plain address on Incus, leave the gateway to the network [@MickLesk](https://github.com/MickLesk) ([core#101](https://github.com/community-scripts/core/pull/101))
- Incus: Wait for the network on Alpine OS too [@MickLesk](https://github.com/MickLesk) ([core#105](https://github.com/community-scripts/core/pull/105))
- Incus: do not fail the build when hostname -I is missing [@MickLesk](https://github.com/MickLesk) ([core#103](https://github.com/community-scripts/core/pull/103))
- Incus: Fuse always in unprivileged Containers, attach TUN only when container lacks it [@MickLesk](https://github.com/MickLesk) ([core#108](https://github.com/community-scripts/core/pull/108))
- Incus: accept mode=generated [@MickLesk](https://github.com/MickLesk) ([core#106](https://github.com/community-scripts/core/pull/106))
- Incus: pass the full install environment into Incus containers (quoted) [@MickLesk](https://github.com/MickLesk) ([core#107](https://github.com/community-scripts/core/pull/107))
-
-## 2026-10-05
-
-### 🚀 Updated Scripts
-
-  - Point to DevScripts, the renamed ProxmoxVED [@MickLesk](https://github.com/MickLesk) ([#17694](https://github.com/community-scripts/ProxmoxVE/pull/17694))
-
-  - #### 🐞 Bug Fixes
-
-    - wanderer: set the proxy secret and install plugins in their own directories [@MickLesk](https://github.com/MickLesk) ([#17698](https://github.com/community-scripts/ProxmoxVE/pull/17698))
-    - discourse: serve stylesheets and repair the update [@MickLesk](https://github.com/MickLesk) ([#17697](https://github.com/community-scripts/ProxmoxVE/pull/17697))
-    - wikijs: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17689](https://github.com/community-scripts/ProxmoxVE/pull/17689))
-    - jotty: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17688](https://github.com/community-scripts/ProxmoxVE/pull/17688))
-
-### 💾 Core
-
-  - Read releases from github.com when the API is rate limited, resume stalled downloads [@MickLesk](https://github.com/MickLesk) ([core#99](https://github.com/community-scripts/core/pull/99))
- Check for template and container storage before the settings menu [@MickLesk](https://github.com/MickLesk) ([core#98](https://github.com/community-scripts/core/pull/98))
- Check /etc/pve before the settings menu [@MickLesk](https://github.com/MickLesk) ([core#97](https://github.com/community-scripts/core/pull/97))
- Check container settings before pct create rejects them [@MickLesk](https://github.com/MickLesk) ([core#96](https://github.com/community-scripts/core/pull/96))
- PVE: Smart Diagnosis - say why a container would not start [@MickLesk](https://github.com/MickLesk) ([core#95](https://github.com/community-scripts/core/pull/95))
- Retry template downloads that pveam reports as done but are not [@MickLesk](https://github.com/MickLesk) ([core#94](https://github.com/community-scripts/core/pull/94))
- Check the OS release against pve-container before creating anything [@MickLesk](https://github.com/MickLesk) ([core#93](https://github.com/community-scripts/core/pull/93))
- Rename "ProxmoxVED"-Links to "DevScripts" [@MickLesk](https://github.com/MickLesk) ([core#91](https://github.com/community-scripts/core/pull/91))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - monitor-all: read container IPs from the host side [@jasonobrien](https://github.com/jasonobrien) ([#17686](https://github.com/community-scripts/ProxmoxVE/pull/17686))
-
-## 2026-10-04
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - immich: read the Intel runtime from the pinned release [@MickLesk](https://github.com/MickLesk) ([#17677](https://github.com/community-scripts/ProxmoxVE/pull/17677))
-
-### 💾 Core
-
-  - better explain unsupported version & upgrade path for pve [@MickLesk](https://github.com/MickLesk) ([core#86](https://github.com/community-scripts/core/pull/86))
- Quote PostgreSQL identifiers and drop spaces from the creds file name [@MickLesk](https://github.com/MickLesk) ([core#89](https://github.com/community-scripts/core/pull/89))
- Find the default Rust toolchain in current rustup output [@MickLesk](https://github.com/MickLesk) ([core#88](https://github.com/community-scripts/core/pull/88))
-
-## 2026-10-03
-
-### 🆕 New Scripts
-
-  - Keeper.sh ([#17659](https://github.com/community-scripts/ProxmoxVE/pull/17659))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - hermesagent: download the installer before running it [@MickLesk](https://github.com/MickLesk) ([#17666](https://github.com/community-scripts/ProxmoxVE/pull/17666))
-    - frigate: raise the Node heap for the web build [@MickLesk](https://github.com/MickLesk) ([#17667](https://github.com/community-scripts/ProxmoxVE/pull/17667))
-    - Tracearr: workaround for failing map tiles download and data preservation [@durzo](https://github.com/durzo) ([#17661](https://github.com/community-scripts/ProxmoxVE/pull/17661))
-    - fix(nginxproxymanager): clean yarn cache after builds to prevent disk growth [@PsycoStea](https://github.com/PsycoStea) ([#17653](https://github.com/community-scripts/ProxmoxVE/pull/17653))
-
-  - #### 🔧 Refactor
-
-    - Several Scripts: refactor msg_ blocks, generate passwords with helper, add CLEAN_INSTALL_KEEP  [@MickLesk](https://github.com/MickLesk) ([#17655](https://github.com/community-scripts/ProxmoxVE/pull/17655))
-
-### 💾 Core
-
-  - detect_repo_source: read the license header and fall back to ProxmoxVE [@MickLesk](https://github.com/MickLesk) ([core#85](https://github.com/community-scripts/core/pull/85))
-
-## 2026-10-02
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - zerobyte: upgrade Bun on update [@MickLesk](https://github.com/MickLesk) ([#17646](https://github.com/community-scripts/ProxmoxVE/pull/17646))
-    - sure: keep Active Storage uploads across updates [@MickLesk](https://github.com/MickLesk) ([#17648](https://github.com/community-scripts/ProxmoxVE/pull/17648))
-    - twenty: run upstreams upgrade command instead of the removed setup-db.ts [@MickLesk](https://github.com/MickLesk) ([#17647](https://github.com/community-scripts/ProxmoxVE/pull/17647))
-
-  - #### 🔧 Refactor
-
-    - NPM: Refactor / Fix npm openresty user and certbot version [@MickLesk](https://github.com/MickLesk) ([#17649](https://github.com/community-scripts/ProxmoxVE/pull/17649))
-    - several scripts: use the release helpers instead of hand-rolled version checks and downloads [@MickLesk](https://github.com/MickLesk) ([#17625](https://github.com/community-scripts/ProxmoxVE/pull/17625))
-
-### 💾 Core
-
-  - QoL: message blocks, clean-install keep list, password helper, network limits [@MickLesk](https://github.com/MickLesk) ([core#61](https://github.com/community-scripts/core/pull/61))
+    - FileBrowser Quantum: migrate the config and database to v2 [@MickLesk](https://github.com/MickLesk) ([#17815](https://github.com/community-scripts/ProxmoxVE/pull/17815))
@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/chattocorp/chatto
+
+APP="Chatto"
+var_tags="${var_tags:-chat;messaging}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/chatto ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "chatto" "chattocorp/chatto"; then
+    msg_info "Stopping Service"
+    systemctl stop chatto
+    msg_ok "Stopped Service"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "chatto" "chattocorp/chatto" "prebuild" "latest" "/opt/chatto" "chatto_Linux_$(arch_resolve x86_64 arm64).tar.gz"
+    chmod +x /opt/chatto/chatto
+
+    msg_info "Starting Service"
+    systemctl start chatto
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:4000${CL}"
@@ -36,7 +36,7 @@ function update_script() {
    systemctl stop cinephage
    msg_ok "Stopped Cinephage"

-    NODE_VERSION="24" setup_nodejs
+    NODE_VERSION="26" setup_nodejs
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "cinephage" "MoldyTaint/Cinephage" "tarball"

    msg_info "Building Cinephage"
@@ -1,73 +0,0 @@
-#!/usr/bin/env bash
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://coolify.io/
-
-APP="Coolify"
-var_tags="${var_tags:-docker;paas}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-4096}"
-var_disk="${var_disk:-30}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-ADDON_SCRIPT="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/coolify.sh"
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /data/coolify ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  msg_warn "⚠️  ${APP} has been migrated to an addon script."
-  echo ""
-  echo -e "${INFO}${YW}This is a one-time migration. After this, you can update ${APP} anytime with:${CL}"
-  echo -e "${TAB}${TAB}${GN}update_coolify${CL}  or  ${GN}bash <(curl -fsSL ${ADDON_SCRIPT})${CL}"
-  echo ""
-  read -r -p "${TAB}Migrate update function now? [y/N]: " CONFIRM
-  if [[ ! "${CONFIRM,,}" =~ ^(y|yes)$ ]]; then
-    msg_warn "Migration skipped. The old update will continue to work for now."
-    msg_info "Updating ${APP} (legacy)"
-    $STD bash <(curl -fsSL https://cdn.coollabs.io/coolify/install.sh)
-    msg_ok "Updated ${APP}"
-    exit
-  fi
-
-  msg_info "Migrating update function"
-  TMP_UPDATE=$(mktemp)
-  cat <<'MIGRATION_EOF' >"$TMP_UPDATE"
-bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/coolify.sh)"
-MIGRATION_EOF
-  mv "$TMP_UPDATE" /usr/bin/update
-  chmod +x /usr/bin/update
-
-  ln -sf /usr/bin/update /usr/bin/update_coolify 2>/dev/null || true
-  msg_ok "Migration complete"
-
-  echo -e "${INFO}${YW}Running addon update${CL}"
-  type=update bash <(curl -fsSL "${ADDON_SCRIPT}")
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:8000${CL}"
@@ -26,7 +26,7 @@ function update_script() {
  check_container_storage
  check_container_resources

-  NODE_VERSION="24" setup_nodejs
+  NODE_VERSION="26" setup_nodejs
  ensure_dependencies build-essential

  if command -v cross-seed &>/dev/null; then
@@ -38,57 +38,29 @@ function update_script() {
    $STD systemctl stop databasus
    msg_ok "Stopped Databasus"

-    create_backup /opt/databasus/.env
-
-    msg_info "Ensuring Database Clients"
-    # Create PostgreSQL version symlinks for compatibility
-    for v in 12 13 14 15 16 18; do
-      ln -sf /usr/lib/postgresql/17 /usr/lib/postgresql/$v
-    done
-    # Install MongoDB Database Tools via direct .deb (no APT repo for Debian 13)
-    if ! command -v mongodump &>/dev/null; then
-      [[ "$(get_os_info id)" == "ubuntu" ]] && MONGO_DIST="ubuntu2204" || MONGO_DIST="debian12"
-      MONGO_ARCH=$(arch_resolve "x86_64" "arm64")
-      # MongoDB only publishes arm64 builds for Ubuntu
-      [[ "$MONGO_ARCH" == "arm64" ]] && MONGO_DIST="ubuntu2204"
-      fetch_and_deploy_from_url "https://fastdl.mongodb.org/tools/db/mongodb-database-tools-${MONGO_DIST}-${MONGO_ARCH}-100.16.1.deb"
-    fi
-    ensure_dependencies mariadb-client
-    mkdir -p /usr/local/mariadb-{10.6,12.1}/bin /usr/local/mysql-{5.7,8.0,8.4,9}/bin /usr/local/mongodb-database-tools/bin
-    [[ -f /usr/bin/mongodump ]] && ln -sf /usr/bin/mongodump /usr/local/mongodb-database-tools/bin/mongodump
-    [[ -f /usr/bin/mongorestore ]] && ln -sf /usr/bin/mongorestore /usr/local/mongodb-database-tools/bin/mongorestore
-    # Create MariaDB and MySQL client symlinks for compatibility
-    for dir in /usr/local/mariadb-{10.6,12.1}/bin; do
-      ln -sf /usr/bin/mariadb-dump "$dir/mariadb-dump"
-      ln -sf /usr/bin/mariadb "$dir/mariadb"
-    done
-    for dir in /usr/local/mysql-{5.7,8.0,8.4,9}/bin; do
-      ln -sf /usr/bin/mariadb-dump "$dir/mysqldump"
-      ln -sf /usr/bin/mariadb "$dir/mysql"
-    done
-    msg_ok "Ensured Database Clients"
-
+    ensure_dependencies libedit2 libgssapi-krb5-2 libncurses6 libreadline8t64
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "databasus" "databasus/databasus" "tarball" "latest" "/opt/databasus"
    GO_VERSION="$(grep -m1 '^go ' /opt/databasus/backend/go.mod | awk '{print $2}')" setup_go

    msg_info "Updating Databasus"
+    RELEASE=$(cat ~/.databasus)
    export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
    cd /opt/databasus/frontend
-
    $STD corepack prepare pnpm@latest --activate
    $STD pnpm install --frozen-lockfile
-    $STD pnpm run build
+    $STD env VITE_APP_VERSION="${RELEASE}" pnpm run build
    cd /opt/databasus/backend
-    $STD go mod download
-    $STD /root/go/bin/swag init -g cmd/main.go -o swagger
-    $STD env CGO_ENABLED=0 GOOS=linux GOARCH=$(arch_resolve) go build -o databasus ./cmd
-    mv /opt/databasus/backend/databasus /opt/databasus/databasus
+    $STD env CGO_ENABLED=0 GOOS=linux GOARCH="$(arch_resolve)" go build -o /opt/databasus/databasus ./cmd/databasus
+    mkdir -p /opt/databasus/agent-binaries
+    for arch in amd64 arm64; do
+      $STD env CGO_ENABLED=0 GOOS=linux GOARCH=$arch go build -ldflags "-X main.Version=${RELEASE}" -o /opt/databasus/agent-binaries/databasus-verification-agent-linux-$arch ./cmd/verification-agent
+    done
    mkdir -p /opt/databasus/ui/build
    cp -r /opt/databasus/frontend/dist/* /opt/databasus/ui/build/
-    cp -r /opt/databasus/backend/migrations /opt/databasus/
+    sed -i '/^APP_VERSION=/d' /.env
+    echo "APP_VERSION=${RELEASE}" >>/.env
    msg_ok "Updated Databasus"

-    restore_backup
    chown -R postgres:postgres /opt/databasus

    if ! grep -q "EnvironmentFile=/.env" /etc/systemd/system/databasus.service; then
@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Masked-Kunsiquat
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.espocrm.com/ | Github: https://github.com/espocrm/espocrm
+
+APP="EspoCRM"
+var_tags="${var_tags:-crm;business}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+export var_admin_user="${var_admin_user:-}"
+export var_admin_pass="${var_admin_pass:-}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/espocrm ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "espo-crm" "espocrm/espocrm"; then
+    msg_info "Stopping Services"
+    systemctl stop nginx cron php8.4-fpm
+    msg_ok "Stopped Services"
+
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="data custom client/custom" fetch_and_deploy_gh_release "espo-crm" "espocrm/espocrm" "prebuild" "latest" "/opt/espocrm" "EspoCRM-*.zip"
+
+    msg_info "Migrating EspoCRM"
+    cd /opt/espocrm
+    $STD php bin/command clear-cache
+    if ! $STD php bin/command migrate; then
+      chown -R www-data:www-data /opt/espocrm
+      systemctl start php8.4-fpm
+      systemctl start cron nginx
+      msg_error "Migration failed; customizations may be incompatible. Check /opt/espocrm/data/logs, then run update again."
+      exit 1
+    fi
+    chown -R www-data:www-data /opt/espocrm
+    msg_ok "Migrated EspoCRM"
+
+    msg_info "Starting Services"
+    systemctl start php8.4-fpm
+    systemctl start cron nginx
+    msg_ok "Started Services"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}${CL}"
@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/mozilla-services/syncstorage-rs
+
+APP="Firefox-Syncserver"
+var_tags="${var_tags:-sync;firefox}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-3072}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-yes}" # built from source, nothing x86-only, but not yet run on arm64
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /usr/local/bin/syncserver ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "firefox-syncserver" "mozilla-services/syncstorage-rs"; then
+    msg_info "Stopping Firefox Syncserver"
+    systemctl stop firefox-syncserver
+    msg_ok "Stopped Firefox Syncserver"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "firefox-syncserver" "mozilla-services/syncstorage-rs" "tarball"
+    setup_rust
+
+    msg_info "Building Firefox Syncserver (Patience)"
+    cd /opt/firefox-syncserver
+    $STD cargo build --release --locked --no-default-features --features=syncstorage-db/postgres --features=tokenserver-db/postgres --features=py_verifier
+    cp target/release/syncserver /usr/local/bin/syncserver
+    rm -rf target
+    $STD uv venv --python /usr/bin/python3 /opt/firefox-syncserver/.venv
+    $STD uv pip install --python /opt/firefox-syncserver/.venv/bin/python pyfxa tokenlib cryptography
+    msg_ok "Built Firefox Syncserver"
+
+    msg_info "Starting Firefox Syncserver"
+    systemctl start firefox-syncserver
+    msg_ok "Started Firefox Syncserver"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}In Firefox, set identity.sync.tokenserver.uri in about:config to:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8000/1.0/sync/1.5${CL}"
@@ -70,32 +70,7 @@ function update_script() {
    exit
  fi
  if [ "$UPD" == "4" ]; then
-    msg_info "Installing FileBrowser"
-    RELEASE=$(curl -fsSL https://api.github.com/repos/filebrowser/filebrowser/releases/latest | grep -o '"tag_name": ".*"' | sed 's/"//g' | sed 's/tag_name: //g')
-    $STD curl -fsSL https://github.com/filebrowser/filebrowser/releases/download/v2.23.0/linux-$(arch_resolve)-filebrowser.tar.gz | tar -xzv -C /usr/local/bin
-    $STD filebrowser config init -a '0.0.0.0'
-    $STD filebrowser config set -a '0.0.0.0'
-    $STD filebrowser users add admin community-scripts.org --perm.admin
-    msg_ok "Installed FileBrowser"
-
-    msg_info "Creating Service"
-    service_path="/etc/systemd/system/filebrowser.service"
-    echo "[Unit]
-Description=Filebrowser
-After=network-online.target
-[Service]
-User=root
-WorkingDirectory=/root/
-ExecStart=/usr/local/bin/filebrowser -r /
-[Install]
-WantedBy=default.target" >$service_path
-
-    $STD systemctl enable --now filebrowser
-    msg_ok "Created Service"
-
-    msg_ok "Completed successfully!\n"
-    echo -e "FileBrowser should be reachable by going to the following URL.
-         ${BL}http://$LOCAL_IP:8080${CL}   admin|community-scripts.org\n"
+    bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/filebrowser.sh)"
    exit
  fi
 }
@@ -131,7 +131,18 @@ EOF

  if check_for_gh_release "Immich" "immich-app/immich" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
    msg_warn "The update takes 5-15 minutes, do not interrupt it"
-    PREV_IMMICH="$(cat ~/.immich)"
+    PREV_IMMICH="${CS_PREVIOUS_VERSION:-$(cat ~/.immich)}"
+    INSTALL_DIR="/opt/${APP}"
+    UPLOAD_DIR="$(sed -n '/^IMMICH_MEDIA_LOCATION/s/[^=]*=//p' /opt/immich/.env)"
+    SRC_DIR="${INSTALL_DIR}/source"
+    APP_DIR="${INSTALL_DIR}/app"
+    PLUGIN_DIR="${APP_DIR}/plugins/immich-plugin-core"
+    ML_DIR="${APP_DIR}/machine-learning"
+    GEO_DIR="${INSTALL_DIR}/geodata"
+
+    setup_uv
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Immich" "immich-app/immich" "tarball" "${RELEASE}" "$SRC_DIR"
+
    # An interrupted update leaves app/ empty, so there may be no immich-admin to call.
    if [[ "$PREV_IMMICH" > "2.5.1" && -x /opt/immich/app/bin/immich-admin ]]; then
      msg_info "Enabling Maintenance Mode"
@@ -141,6 +152,7 @@ EOF
      $STD cd -
      msg_ok "Enabled Maintenance Mode"
    fi
+    [[ -x /opt/immich/app/bin/immich-admin ]] || export MAINT_MODE=1
    msg_info "Stopping Services"
    systemctl stop immich-web
    systemctl stop immich-ml
@@ -164,14 +176,6 @@ EOF
    fi
    ensure_dependencies ccache gcc-13 g++-13

-    INSTALL_DIR="/opt/${APP}"
-    UPLOAD_DIR="$(sed -n '/^IMMICH_MEDIA_LOCATION/s/[^=]*=//p' /opt/immich/.env)"
-    SRC_DIR="${INSTALL_DIR}/source"
-    APP_DIR="${INSTALL_DIR}/app"
-    PLUGIN_DIR="${APP_DIR}/plugins/immich-plugin-core"
-    ML_DIR="${APP_DIR}/machine-learning"
-    GEO_DIR="${INSTALL_DIR}/geodata"
-
    [[ -f "$ML_DIR"/ml_start.sh ]] && cp "$ML_DIR"/ml_start.sh "$INSTALL_DIR"
    if grep -qs "set -a" "$APP_DIR"/bin/start.sh && grep -qs "warnings" "$APP_DIR"/bin/start.sh; then
      cp "$APP_DIR"/bin/start.sh "$INSTALL_DIR"
@@ -193,8 +197,6 @@ EOF
      rm -rf "${APP_DIR:?}"/*
    )

-    setup_uv
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Immich" "immich-app/immich" "tarball" "${RELEASE}" "$SRC_DIR"
    PNPM_VERSION="$(jq -r '.packageManager | split("@")[1] | split("+")[0]' ${SRC_DIR}/package.json)"
    export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
    export CI=1
@@ -419,7 +421,7 @@ function compile_libjxl() {
    $STD git clone https://github.com/libjxl/libjxl.git "$SOURCE"
    cd "$SOURCE"
    $STD git reset --hard "$LIBJXL_REVISION"
-    $STD git submodule update --init --recursive --depth 1 --recommend-shallow
+    $STD git submodule update --init --recursive --depth 1 --recommend-shallow -- third_party
    mkdir build
    cd build
    $STD cmake \
@@ -32,14 +32,14 @@ function update_script() {
  fi

  if check_for_gh_tag "kan" "kanbn/kan"; then
+    NODE_VERSION="24" NODE_MODULE="pnpm" setup_nodejs
+    
    msg_info "Stopping Service"
    systemctl stop kan
    msg_ok "Stopped Service"

    create_backup /opt/kan/.env
-
    CLEAN_INSTALL=1 fetch_and_deploy_gh_tag "kan" "kanbn/kan" "latest"
-
    restore_backup

    msg_info "Building Application"
@@ -9,7 +9,7 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 APP="MyIP"
 var_tags="${var_tags:-network}"
 var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-1024}"
+var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-4}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
@@ -30,7 +30,7 @@ function update_script() {
    exit
  fi

-  NODE_VERSION="24" setup_nodejs
+  NODE_VERSION="26" setup_nodejs

  if check_for_gh_release "myip" "jason5ng32/MyIP"; then
    msg_info "Stopping Services"
@@ -32,9 +32,14 @@ function update_script() {

  if check_for_gh_release "openobserve" "openobserve/openobserve"; then
    msg_info "Updating OpenObserve"
+    if grep -q "^ExecStop=killall" /etc/systemd/system/openobserve.service; then
+      sed -i "/^ExecStop=killall/d" /etc/systemd/system/openobserve.service
+      systemctl daemon-reload
+    fi
    systemctl stop openobserve
    RELEASE=$(get_latest_github_release "openobserve/openobserve")
-    tar zxf <(curl -fsSL https://downloads.openobserve.ai/releases/openobserve/v$RELEASE/openobserve-v$RELEASE-linux-$(arch_resolve).tar.gz) -C /opt/openobserve
+    tar zxf <(curl -fsSL https://downloads.openobserve.ai/releases/openobserve/v$RELEASE/openobserve-v$RELEASE-linux-$(arch_resolve).tar.gz) -C /opt/openobserve --no-same-owner
+    echo "${RELEASE}" >~/.openobserve
    systemctl start openobserve
    msg_ok "Updated OpenObserve"
    msg_ok "Updated successfully!"
@@ -66,33 +66,7 @@ function update_script() {
    exit
  fi
  if [ "$UPD" == "3" ]; then
-    msg_info "Installing FileBrowser"
-    $STD curl -fsSL https://raw.githubusercontent.com/filebrowser/get/master/get.sh | bash
-    $STD filebrowser config init -a '0.0.0.0'
-    $STD filebrowser config set -a '0.0.0.0'
-    $STD filebrowser users add admin community-scripts.org --perm.admin
-    msg_ok "Installed FileBrowser"
-
-    msg_info "Creating Service"
-    cat <<EOF >/etc/systemd/system/filebrowser.service
-[Unit]
-Description=Filebrowser
-After=network-online.target
-
-[Service]
-User=root
-WorkingDirectory=/root/
-ExecStart=/usr/local/bin/filebrowser -r /
-
-[Install]
-WantedBy=default.target
-EOF
-    systemctl enable -q --now filebrowser
-    msg_ok "Created Service"
-
-    msg_ok "Completed successfully!\n"
-    echo -e "FileBrowser should be reachable by going to the following URL.
-         ${BL}http://$LOCAL_IP:8080${CL}   admin|community-scripts.org\n"
+    bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/filebrowser.sh)"
    exit
  fi
  if [ "$UPD" == "4" ]; then
@@ -107,8 +107,9 @@ function update_script() {
    ln -sfn "$ROMM_BASE"/resources /opt/romm/frontend/dist/assets/romm/resources
    ln -sfn "$ROMM_BASE"/assets /opt/romm/frontend/dist/assets/romm/assets
    if [[ -f /etc/angie/http.d/romm.conf ]]; then
-      if ! grep -q "js_content decode.decodeBase64" /etc/angie/http.d/romm.conf; then
-        msg_info "Adding missing /decode and /cache locations to Angie config"
+      if ! grep -q "js_content decode.decodeBase64" /etc/angie/http.d/romm.conf ||
+        ! grep -q "coep_header" /etc/angie/http.d/romm.conf; then
+        msg_info "Updating Angie config (decode/cache locations, player isolation headers)"
        dpkg -l angie-module-njs &>/dev/null || $STD apt install -y angie-module-njs
        grep -q "ngx_http_js_module.so" /etc/angie/angie.conf || sed -i '1i load_module modules/ngx_http_js_module.so;' /etc/angie/angie.conf
        mkdir -p /etc/angie/js "${ROMM_BASE}/cache"
@@ -147,6 +148,20 @@ map \$http_upgrade \$connection_upgrade {
    '' close;
 }

+# COEP/COOP for the EmulatorJS and js-dos players (SharedArrayBuffer needs a
+# crossOriginIsolated document). Matched on \$request_uri because try_files
+# rewrites \$uri to /index.html before add_header runs, so a per-location
+# add_header on the player route never fires. Mirrors upstream RomM's
+# docker/nginx/templates/default.conf.template.
+map \$request_uri \$coep_header {
+    default        "";
+    ~^/rom/.*/(ejs|jsdos)(\?|\$) "require-corp";
+}
+map \$request_uri \$coop_header {
+    default        "";
+    ~^/rom/.*/(ejs|jsdos)(\?|\$) "same-origin";
+}
+
 server {
    listen 80;
    server_name _;
@@ -155,6 +170,9 @@ server {

    location / {
        try_files \$uri \$uri/ /index.html;
+        add_header Cache-Control "no-cache";
+        add_header Cross-Origin-Embedder-Policy \$coep_header;
+        add_header Cross-Origin-Opener-Policy \$coop_header;
    }

    location /assets {
@@ -164,12 +182,6 @@ server {
        add_header Cache-Control "public, immutable";
    }

-    location ~ ^/rom/.*/ejs\$ {
-        add_header Cross-Origin-Embedder-Policy "require-corp";
-        add_header Cross-Origin-Opener-Policy "same-origin";
-        try_files \$uri /index.html;
-    }
-
    location /api {
        proxy_pass http://romm_backend;
        proxy_buffering off;
@@ -209,7 +221,7 @@ server {
    }
 }
 EOF
-        msg_ok "Added /decode and /cache locations"
+        msg_ok "Updated Angie config"
      else
        sed -i -e "s|alias .*/library/;|alias ${ROMM_BASE}/library/;|" \
          -e "s|alias .*/cache/;|alias ${ROMM_BASE}/cache/;|" /etc/angie/http.d/romm.conf
@@ -38,7 +38,7 @@ function update_script() {

    create_backup /opt/yuvomi/data /opt/yuvomi/.env

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "yuvomi" "ulsklyc/yuvomi" "tarball"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "yuvomi" "ulsklyc/yuvomi" "prebuild" "latest" "/opt/yuvomi" "yuvomi-*-dist.tar.gz"
    NODE_VERSION="24" setup_nodejs

    msg_info "Installing Node.js Dependencies"
@@ -9,7 +9,7 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 APP="Zipline"
 var_tags="${var_tags:-file;sharing}"
 var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
+var_ram="${var_ram:-3072}"
 var_disk="${var_disk:-5}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
@@ -48,6 +48,7 @@ chown -R archivebox:archivebox /opt/archivebox/{data,.npm,.cache,.local}
 chmod -R 755 /opt/archivebox/data
 $STD uv pip install archivebox --system --break-system-packages
 cd /opt/archivebox/data
+ADMIN_PASS=$(random_password 20)
 expect <<EOF
 set timeout -1
 log_user 0
@@ -62,13 +63,18 @@ expect "Email address"
 send "\r"

 expect "Password"
-send "community-scripts.org\r"
+send "${ADMIN_PASS}\r"

 expect "Password (again)"
-send "community-scripts.org\r"
+send "${ADMIN_PASS}\r"

 expect eof
 EOF
+{
+  echo "ArchiveBox Credentials"
+  echo "Username: archivebox"
+  echo "Password: ${ADMIN_PASS}"
+} >~/archivebox.creds
 msg_ok "Installed ArchiveBox"

 msg_info "Creating Service"
@@ -63,12 +63,19 @@ else
 fi
 echo "$AUTHELIA_URL" >/etc/authelia/.authelia_url

+AUTHELIA_PASS=$(random_password 20)
+AUTHELIA_HASH=$(authelia crypto hash generate argon2 --password "$AUTHELIA_PASS" | awk '/Digest:/{print $2}')
+{
+  echo "Authelia Credentials"
+  echo "Username: authelia"
+  echo "Password: ${AUTHELIA_PASS}"
+} >~/authelia.creds
 cat <<EOF >/etc/authelia/users.yml
 users:
  authelia:
    disabled: false
    displayname: "Authelia Admin"
-    password: "\$argon2id\$v=19\$m=65536,t=3,p=4\$ZBopMzXrzhHXPEZxRDVT2w\$SxWm96DwhOsZyn34DLocwQEIb4kCDsk632PuiMdZnig"
+    password: "${AUTHELIA_HASH}"
    groups: []
 EOF
 cat <<EOF >/etc/authelia/configuration.yml
@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/chattocorp/chatto
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+fetch_and_deploy_gh_release "chatto" "chattocorp/chatto" "prebuild" "latest" "/opt/chatto" "chatto_Linux_$(arch_resolve x86_64 arm64).tar.gz"
+chmod +x /opt/chatto/chatto
+
+msg_info "Configuring Chatto"
+mkdir -p /opt/chatto_data
+cd /opt/chatto
+$STD ./chatto init
+mv /opt/chatto/chatto.toml /opt/chatto_data/chatto.toml
+sed -i \
+  -e "/^\[webserver\]/,/^\[/ s|^url = .*|url = 'http://${LOCAL_IP}:4000'|" \
+  -e "/^\[nats.embedded\]/,/^\[/ s|^data_dir = .*|data_dir = '/opt/chatto_data/data'|" \
+  -e '/^# \[operator_api\]$/,/^$/ { s|^# \[operator_api\]$|[operator_api]|; s|^# enabled = false$|enabled = true| }' \
+  /opt/chatto_data/chatto.toml
+msg_ok "Configured Chatto"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/chatto.service
+[Unit]
+Description=Chatto
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/chatto
+ExecStart=/opt/chatto/chatto run -c /opt/chatto_data/chatto.toml
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now chatto
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc
@@ -24,7 +24,7 @@ $STD apt install -y \
 msg_ok "Installed Dependencies"

 setup_ffmpeg
-NODE_VERSION="24" setup_nodejs
+NODE_VERSION="26" setup_nodejs
 fetch_and_deploy_gh_release "cinephage" "MoldyTaint/Cinephage" "tarball"

 msg_info "Building Cinephage"
@@ -17,7 +17,7 @@ msg_info "Installing Dependencies"
 $STD apt install -y build-essential
 msg_ok "Installed Dependencies"

-NODE_VERSION="24" setup_nodejs
+NODE_VERSION="26" setup_nodejs

 msg_info "Setup Cross-Seed"
 $STD npm install cross-seed@latest -g
@@ -16,119 +16,47 @@ update_os
 msg_info "Installing Dependencies"
 $STD apt install -y \
  nginx \
-  valkey \
-  mariadb-client \
-  rclone
+  libedit2 \
+  libgssapi-krb5-2 \
+  libncurses6 \
+  libreadline8t64
 msg_ok "Installed Dependencies"

 PG_VERSION="17" setup_postgresql
 NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs

-msg_info "Installing Database Clients"
-# Create PostgreSQL version symlinks for compatibility
-for v in 12 13 14 15 16 18; do
-  ln -sf /usr/lib/postgresql/17 /usr/lib/postgresql/$v
-done
-# Install MongoDB Database Tools via direct .deb (no APT repo for Debian 13)
-[[ "$(get_os_info id)" == "ubuntu" ]] && MONGO_DIST="ubuntu2204" || MONGO_DIST="debian12"
-# MongoDB only publishes arm64 builds for Ubuntu
-[[ "$(arch_resolve "x86_64" "arm64")" == "arm64" ]] && MONGO_DIST="ubuntu2204"
-MONGO_VERSION=$(get_latest_gh_tag "mongodb/mongo-tools" "100." || echo "100.16.1")
-fetch_and_deploy_from_url "https://fastdl.mongodb.org/tools/db/mongodb-database-tools-${MONGO_DIST}-$(arch_resolve "x86_64" "arm64")-${MONGO_VERSION}.deb" ""
-mkdir -p /usr/local/mongodb-database-tools/bin
-[[ -f /usr/bin/mongodump ]] && ln -sf /usr/bin/mongodump /usr/local/mongodb-database-tools/bin/mongodump
-[[ -f /usr/bin/mongorestore ]] && ln -sf /usr/bin/mongorestore /usr/local/mongodb-database-tools/bin/mongorestore
-# Create MariaDB and MySQL client symlinks for compatibility
-mkdir -p /usr/local/mariadb-{10.6,12.1}/bin /usr/local/mysql-{5.7,8.0,8.4,9}/bin
-for dir in /usr/local/mariadb-{10.6,12.1}/bin; do
-  ln -sf /usr/bin/mariadb-dump "$dir/mariadb-dump"
-  ln -sf /usr/bin/mariadb "$dir/mariadb"
-done
-for dir in /usr/local/mysql-{5.7,8.0,8.4,9}/bin; do
-  ln -sf /usr/bin/mariadb-dump "$dir/mysqldump"
-  ln -sf /usr/bin/mariadb "$dir/mysql"
-done
-msg_ok "Installed Database Clients"
-
 fetch_and_deploy_gh_release "databasus" "databasus/databasus" "tarball" "latest" "/opt/databasus"
 GO_VERSION="$(grep -m1 '^go ' /opt/databasus/backend/go.mod | awk '{print $2}')" setup_go

 msg_info "Building Databasus (Patience)"
+RELEASE=$(cat ~/.databasus)
 export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
 cd /opt/databasus/frontend
-
 $STD corepack prepare pnpm@latest --activate
 $STD pnpm install --frozen-lockfile
-$STD pnpm run build
+$STD env VITE_APP_VERSION="${RELEASE}" pnpm run build
 cd /opt/databasus/backend
-$STD go mod tidy
-$STD go mod download
-$STD go install github.com/swaggo/swag/cmd/swag@latest
-$STD /root/go/bin/swag init -g cmd/main.go -o swagger
-$STD env CGO_ENABLED=0 GOOS=linux GOARCH=$(arch_resolve) go build -o databasus ./cmd
-mv /opt/databasus/backend/databasus /opt/databasus/databasus
+$STD env CGO_ENABLED=0 GOOS=linux GOARCH="$(arch_resolve)" go build -o /opt/databasus/databasus ./cmd/databasus
+mkdir -p /opt/databasus/agent-binaries
+for arch in amd64 arm64; do
+  $STD env CGO_ENABLED=0 GOOS=linux GOARCH=$arch go build -ldflags "-X main.Version=${RELEASE}" -o /opt/databasus/agent-binaries/databasus-verification-agent-linux-$arch ./cmd/verification-agent
+done
 mkdir -p /databasus-data/{pgdata,temp,backups,data,logs}
 mkdir -p /opt/databasus/ui/build
-mkdir -p /opt/databasus/migrations
 cp -r /opt/databasus/frontend/dist/* /opt/databasus/ui/build/
-cp -r /opt/databasus/backend/migrations/* /opt/databasus/migrations/
 chown -R postgres:postgres /databasus-data
 msg_ok "Built Databasus"

 msg_info "Configuring Databasus"
-JWT_SECRET=$(openssl rand -hex 32)
-ENCRYPTION_KEY=$(openssl rand -hex 32)
-# Install goose for migrations
-$STD go install github.com/pressly/goose/v3/cmd/goose@latest
-ln -sf /root/go/bin/goose /usr/local/bin/goose
 cat <<EOF >/.env
-# Environment
 ENV_MODE=production
-
-# Server
-SERVER_PORT=4005
-SERVER_HOST=0.0.0.0
-
-# Database
+APP_VERSION=${RELEASE}
 DATABASE_DSN=host=localhost user=postgres password=postgres dbname=databasus port=5432 sslmode=disable
-DATABASE_URL=postgres://postgres:postgres@localhost:5432/databasus?sslmode=disable
-
-# Migrations
-GOOSE_DRIVER=postgres
-GOOSE_DBSTRING=postgres://postgres:postgres@localhost:5432/databasus?sslmode=disable
-GOOSE_MIGRATION_DIR=/opt/databasus/migrations
-
-# Valkey (Redis-compatible cache)
-VALKEY_HOST=localhost
-VALKEY_PORT=6379
-
-# Security
-JWT_SECRET=${JWT_SECRET}
-ENCRYPTION_KEY=${ENCRYPTION_KEY}
-
-# Paths
-DATA_DIR=/databasus-data/data
-BACKUP_DIR=/databasus-data/backups
-LOG_DIR=/databasus-data/logs
 EOF
 chmod 600 /.env
 msg_ok "Configured Databasus"

-msg_info "Configuring Valkey"
-cat <<EOF >/etc/valkey/valkey.conf
-port 6379
-bind 127.0.0.1
-protected-mode yes
-save ""
-maxmemory 256mb
-maxmemory-policy allkeys-lru
-EOF
-systemctl enable -q --now valkey-server
-systemctl restart valkey-server
-msg_ok "Configured Valkey"
-
 msg_info "Creating Database"
-# Configure PostgreSQL to allow local password auth for databasus
 PG_HBA="/etc/postgresql/17/main/pg_hba.conf"
 if ! grep -q "databasus" "$PG_HBA"; then
  sed -i '/^local\s*all\s*all/i local   databasus   postgres                                trust' "$PG_HBA"
@@ -143,8 +71,8 @@ msg_info "Creating Databasus Service"
 cat <<EOF >/etc/systemd/system/databasus.service
 [Unit]
 Description=Databasus - Database Backup Management
-After=network.target postgresql.service valkey.service
-Requires=postgresql.service valkey.service
+After=network.target postgresql.service
+Requires=postgresql.service

 [Service]
 Type=simple
@@ -0,0 +1,146 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Masked-Kunsiquat
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.espocrm.com/ | Github: https://github.com/espocrm/espocrm
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+if [[ -z "${var_admin_user:-}" ]]; then
+  var_admin_user=$(prompt_input "EspoCRM admin username (a-z, 0-9, @ . _ -):" "admin" 60)
+fi
+var_admin_user="${var_admin_user:-admin}"
+var_admin_user="${var_admin_user,,}"
+if [[ ! "$var_admin_user" =~ ^[a-z0-9@._-]+$ ]]; then
+  msg_warn "EspoCRM usernames take only a-z, 0-9 and @ . _ -; using admin"
+  var_admin_user="admin"
+fi
+if [[ -z "${var_admin_pass:-}" ]]; then
+  var_admin_pass=$(random_password 16)
+fi
+
+msg_info "Installing Dependencies"
+$STD apt install -y nginx
+msg_ok "Installed Dependencies"
+
+setup_mariadb
+MARIADB_DB_NAME="espocrm" MARIADB_DB_USER="espocrm" setup_mariadb_db
+PHP_VERSION="8.4" PHP_FPM="YES" PHP_MODULE="ldap" setup_php
+fetch_and_deploy_gh_release "espo-crm" "espocrm/espocrm" "prebuild" "latest" "/opt/espocrm" "EspoCRM-*.zip"
+
+msg_info "Configuring EspoCRM"
+cd /opt/espocrm
+$STD php bin/command config:populate
+$STD php bin/command config:set defaultPermissions.user www-data
+$STD php bin/command config:set defaultPermissions.group www-data
+$STD php bin/command config:set database.platform Mysql
+$STD php bin/command config:set database.host localhost
+$STD php bin/command config:set database.dbname "$MARIADB_DB_NAME"
+$STD php bin/command config:set database.user "$MARIADB_DB_USER"
+$STD php bin/command config:set database.password "$MARIADB_DB_PASS"
+$STD php bin/command rebuild
+$STD php bin/command create-admin-user "$var_admin_user"
+printf '%s\n' "$var_admin_pass" | $STD php bin/command set-password "$var_admin_user"
+$STD php bin/command config:set siteUrl "http://${LOCAL_IP}"
+$STD php bin/command populate-scheduled-jobs
+$STD php bin/command config:set jobRunInParallel true --type=bool
+$STD php bin/command app-check
+$STD php bin/command config:set isInstalled true --type=bool
+chown -R www-data:www-data /opt/espocrm
+msg_ok "Configured EspoCRM"
+
+msg_info "Creating Nginx Site"
+PHP_SOCK=$(get_php_fpm_socket)
+cat <<EOF >/etc/nginx/sites-available/espocrm
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    server_name _;
+
+    charset utf-8;
+    index index.html index.php;
+
+    client_max_body_size 128M;
+    keepalive_timeout 300;
+    server_tokens off;
+    fastcgi_send_timeout 300;
+    fastcgi_read_timeout 300;
+
+    gzip on;
+    gzip_types text/plain text/css text/javascript application/javascript application/json;
+    gzip_min_length 1000;
+
+    root /opt/espocrm/public;
+
+    location /client {
+        root /opt/espocrm;
+        autoindex off;
+
+        location ~* ^.+\.(js|css|png|jpg|svg|svgz|jpeg|gif|ico|tpl)\$ {
+            access_log off;
+            expires max;
+        }
+    }
+
+    location = /favicon.ico { access_log off; log_not_found off; }
+    location = /robots.txt { access_log off; log_not_found off; }
+
+    location ~ \.php\$ {
+        fastcgi_pass unix:${PHP_SOCK};
+        include fastcgi_params;
+        fastcgi_index index.php;
+        fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
+        fastcgi_param QUERY_STRING \$query_string;
+    }
+
+    location /api/v1/ {
+        if (!-e \$request_filename) {
+            rewrite ^/api/v1/(.*)\$ /api/v1/index.php last;
+        }
+    }
+
+    location /portal/ {
+        try_files \$uri \$uri/ /portal/index.php?\$query_string;
+    }
+
+    location /api/v1/portal-access {
+        if (!-e \$request_filename) {
+            rewrite ^/api/v1/(.*)\$ /api/v1/portal-access/index.php last;
+        }
+    }
+
+    location ~ /(\.htaccess|web\.config|\.git) {
+        deny all;
+    }
+}
+EOF
+msg_ok "Created Nginx Site"
+nginx_enable_site "espocrm"
+
+msg_info "Setting up Cron"
+cat <<EOF >/etc/cron.d/espocrm
+* * * * * www-data cd /opt/espocrm && php -f cron.php >/dev/null 2>&1
+EOF
+systemctl enable -q --now cron
+msg_ok "Set up Cron"
+
+msg_info "Saving Credentials"
+cat <<EOF >>~/espocrm.creds
+
+EspoCRM Admin
+Username: ${var_admin_user}
+Password: ${var_admin_pass}
+EOF
+chmod 600 ~/espocrm.creds
+msg_ok "Saved Credentials"
+
+motd_ssh
+customize
+cleanup_lxc
@@ -26,6 +26,7 @@ chown -R www-data:www-data /opt/firefly
 chmod -R 775 /opt/firefly/storage
 cd /opt/firefly
 cp .env.example .env
+sed -i -e "s|^APP_KEY=.*|APP_KEY=$(random_password 32)|" -e "s|^STATIC_CRON_TOKEN=.*|STATIC_CRON_TOKEN=$(random_password 32)|" /opt/firefly/.env
 sed -i "s/DB_HOST=.*/DB_HOST=localhost/" /opt/firefly/.env
 sed -i "s/DB_PASSWORD=.*/DB_PASSWORD=$MARIADB_DB_PASS/" /opt/firefly/.env
 $STD composer install --no-dev --no-plugins --no-interaction
@@ -0,0 +1,99 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/mozilla-services/syncstorage-rs
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  build-essential \
+  pkg-config \
+  libssl-dev \
+  libpq-dev \
+  python3-dev
+msg_ok "Installed Dependencies"
+
+PG_VERSION="18" setup_postgresql
+PG_DB_NAME="syncserver" PG_DB_USER="syncserver" setup_postgresql_db
+setup_rust
+setup_uv
+
+fetch_and_deploy_gh_release "firefox-syncserver" "mozilla-services/syncstorage-rs" "tarball"
+
+msg_info "Building Firefox Syncserver (Patience)"
+cd /opt/firefox-syncserver
+$STD cargo build --release --locked --no-default-features --features=syncstorage-db/postgres --features=tokenserver-db/postgres --features=py_verifier
+cp target/release/syncserver /usr/local/bin/syncserver
+rm -rf target
+$STD uv venv --python /usr/bin/python3 /opt/firefox-syncserver/.venv
+$STD uv pip install --python /opt/firefox-syncserver/.venv/bin/python pyfxa tokenlib cryptography
+msg_ok "Built Firefox Syncserver"
+
+msg_info "Configuring Firefox Syncserver"
+mkdir -p /opt/firefox-syncserver_data
+cat <<EOF >/opt/firefox-syncserver_data/.env
+SYNC_HOST=0.0.0.0
+SYNC_PORT=8000
+SYNC_MASTER_SECRET=$(openssl rand -hex 32)
+SYNC_HUMAN_LOGS=true
+RUST_LOG=info
+SYNC_SYNCSTORAGE__DATABASE_URL=postgres://syncserver:${PG_DB_PASS}@127.0.0.1:5432/syncserver
+SYNC_SYNCSTORAGE__GLEAN_ENABLED=false
+SYNC_TOKENSERVER__ENABLED=true
+SYNC_TOKENSERVER__RUN_MIGRATIONS=true
+SYNC_TOKENSERVER__DATABASE_URL=postgres://syncserver:${PG_DB_PASS}@127.0.0.1:5432/syncserver
+SYNC_TOKENSERVER__NODE_TYPE=postgres
+SYNC_TOKENSERVER__FXA_EMAIL_DOMAIN=api.accounts.firefox.com
+SYNC_TOKENSERVER__FXA_OAUTH_SERVER_URL=https://oauth.accounts.firefox.com
+SYNC_TOKENSERVER__INIT_NODE_URL=http://${LOCAL_IP}:8000
+EOF
+chmod 600 /opt/firefox-syncserver_data/.env
+cat <<'EOF' >/opt/firefox-syncserver_data/nodes.sql
+SELECT to_regclass('nodes') IS NOT NULL AS ready \gset
+\if :ready
+UPDATE nodes SET node = :'url'
+ WHERE id = (SELECT min(id) FROM nodes)
+   AND NOT EXISTS (SELECT 1 FROM nodes WHERE node = :'url');
+UPDATE users SET nodeid = (SELECT id FROM nodes WHERE node = :'url')
+ WHERE nodeid <> (SELECT id FROM nodes WHERE node = :'url');
+DELETE FROM nodes WHERE node <> :'url';
+\endif
+EOF
+msg_ok "Configured Firefox Syncserver"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/firefox-syncserver.service
+[Unit]
+Description=Firefox Syncserver
+After=network.target postgresql.service
+Wants=postgresql.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/firefox-syncserver
+EnvironmentFile=/opt/firefox-syncserver_data/.env
+Environment=PYTHONPATH=/opt/firefox-syncserver/.venv/lib/python3.13/site-packages
+ExecStartPre=/usr/bin/psql -1 -q -v ON_ERROR_STOP=1 -v url=\${SYNC_TOKENSERVER__INIT_NODE_URL} -f /opt/firefox-syncserver_data/nodes.sql \${SYNC_TOKENSERVER__DATABASE_URL}
+ExecStart=/usr/local/bin/syncserver
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now firefox-syncserver
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc
@@ -33,7 +33,13 @@ msg_ok "Set up Python Backend"
 msg_info "Configuring Homelable"
 mkdir -p /opt/homelable/data
 SECRET_KEY=$(openssl rand -hex 32)
-BCRYPT_HASH=$(/opt/homelable/backend/.venv/bin/python -c "import bcrypt; print(bcrypt.hashpw(b'admin', bcrypt.gensalt()).decode())")
+HOMELABLE_PASS=$(random_password 20)
+BCRYPT_HASH=$(/opt/homelable/backend/.venv/bin/python -c "import bcrypt,sys; print(bcrypt.hashpw(sys.argv[1].encode(), bcrypt.gensalt()).decode())" "$HOMELABLE_PASS")
+{
+  echo "Homelable Credentials"
+  echo "Username: admin"
+  echo "Password: ${HOMELABLE_PASS}"
+} >~/homelable.creds
 cat <<EOF >/opt/homelable/backend/.env
 SECRET_KEY=${SECRET_KEY}
 SQLITE_PATH=/opt/homelable/data/homelab.db
@@ -222,7 +222,7 @@ LIBJXL_REVISION="$(jq -cr '.revision' "$BASE_DIR"/server/sources/libjxl.json)"
 $STD git clone https://github.com/libjxl/libjxl.git "$SOURCE"
 cd "$SOURCE"
 $STD git reset --hard "$LIBJXL_REVISION"
-$STD git submodule update --init --recursive --depth 1 --recommend-shallow
+$STD git submodule update --init --recursive --depth 1 --recommend-shallow -- third_party
 mkdir build
 cd build
 $STD cmake \
@@ -21,7 +21,7 @@ msg_ok "Installed Dependencies"

 PG_VERSION="16" setup_postgresql
 PG_DB_NAME="kan" PG_DB_USER="kan" setup_postgresql_db
-NODE_VERSION="20" NODE_MODULE="pnpm" setup_nodejs
+NODE_VERSION="24" NODE_MODULE="pnpm" setup_nodejs

 fetch_and_deploy_gh_tag "kan" "kanbn/kan" "latest"

@@ -21,6 +21,7 @@ PG_DB_NAME="keycloak" PG_DB_USER="keycloak" setup_postgresql_db
 fetch_and_deploy_gh_release "keycloak_app" "keycloak/keycloak" "prebuild" "latest" "/opt/keycloak" "keycloak-*.tar.gz"

 msg_info "Creating Service"
+ADMIN_PASS=$(random_password 20)
 cat <<EOF >/etc/systemd/system/keycloak.service
 [Unit]
 Description=Keycloak Service
@@ -40,7 +41,7 @@ Environment="KC_DB_USERNAME=keycloak"
 Environment="KC_DB_PASSWORD=$PG_DB_PASS"
 Environment="KC_HTTP_ENABLED=true"
 Environment="KC_BOOTSTRAP_ADMIN_USERNAME=tmpadm"
-Environment="KC_BOOTSTRAP_ADMIN_PASSWORD=admin123"
+Environment="KC_BOOTSTRAP_ADMIN_PASSWORD=${ADMIN_PASS}"
 # Comment following line and uncomment the next 2 if working behind a reverse proxy
 Environment="KC_HOSTNAME_STRICT=false"
 #Environment="KC_HOSTNAME=keycloak.example.com"
@@ -48,6 +49,13 @@ Environment="KC_HOSTNAME_STRICT=false"
 [Install]
 WantedBy=multi-user.target
 EOF
+chmod 600 /etc/systemd/system/keycloak.service
+{
+  echo "Keycloak Credentials"
+  echo "Temporary admin, replace it with a permanent one"
+  echo "Username: tmpadm"
+  echo "Password: ${ADMIN_PASS}"
+} >~/keycloak.creds
 systemctl enable -q --now keycloak
 msg_ok "Created Service"

@@ -40,6 +40,7 @@ cp .env.dist .env
 sed -i "/^DATABASE_URL=.*/c\DATABASE_URL=mysql://kimai:$MARIADB_DB_PASS@127.0.0.1:3306/kimai_db?charset=utf8mb4&serverVersion=mariadb-$MYSQL_VERSION" /opt/kimai/.env
 sed -i "s|^APP_SECRET=.*|APP_SECRET=$APP_SECRET|" /opt/kimai/.env
 $STD bin/console kimai:install -n
+ADMIN_PASS=$(random_password 20)
 $STD expect <<EOF
 set timeout -1
 log_user 0
@@ -47,10 +48,16 @@ log_user 0
 spawn bin/console kimai:user:create admin admin@community-scripts.org ROLE_SUPER_ADMIN

 expect "Please enter the password:"
-send "community-scripts.org\r"
+send "${ADMIN_PASS}\r"

 expect eof
 EOF
+{
+  echo "Kimai Credentials"
+  echo "Username: admin"
+  echo "Email: admin@community-scripts.org"
+  echo "Password: ${ADMIN_PASS}"
+} >~/kimai.creds
 $STD composer update --no-interaction
 cat <<EOF >/opt/kimai/config/packages/local.yaml
 kimai:
@@ -33,7 +33,13 @@ $STD yarn config set ignore-engines true
 $STD yarn install
 $STD yarn run production
 $STD php artisan key:generate
-$STD php artisan setup:production --email=admin@community-scripts.org --password=community-scripts.org --force
+ADMIN_PASS=$(random_password 20)
+$STD php artisan setup:production --email=admin@community-scripts.org --password="${ADMIN_PASS}" --force
+{
+  echo "Monica Credentials"
+  echo "Email: admin@community-scripts.org"
+  echo "Password: ${ADMIN_PASS}"
+} >~/monica.creds
 chown -R www-data:www-data /opt/monica
 chmod -R 775 /opt/monica/storage
 echo "* * * * * root php /opt/monica/artisan schedule:run >> /dev/null 2>&1" >>/etc/crontab
@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os

-NODE_VERSION="24" setup_nodejs
+NODE_VERSION="26" setup_nodejs
 fetch_and_deploy_gh_release "myip" "jason5ng32/MyIP" "tarball"

 msg_info "Configuring MyIP"
@@ -63,7 +63,13 @@ setcap cap_net_raw+p /bin/ping
 msg_ok "Built Nagios Plugins"

 msg_info "Configuring Web Authentication"
-$STD htpasswd -bc /usr/local/nagios/etc/htpasswd.users nagiosadmin nagiosadmin
+NAGIOS_PASS=$(random_password 20)
+$STD htpasswd -bc /usr/local/nagios/etc/htpasswd.users nagiosadmin "$NAGIOS_PASS"
+{
+  echo "Nagios Credentials"
+  echo "Username: nagiosadmin"
+  echo "Password: ${NAGIOS_PASS}"
+} >~/nagios.creds
 chown root:www-data /usr/local/nagios/etc/htpasswd.users
 chmod 640 /usr/local/nagios/etc/htpasswd.users
 msg_ok "Configured Web Authentication"
@@ -201,6 +201,13 @@ cat <<'EOF' >/etc/neko/openbox.xml
 </openbox_config>
 EOF

+NEKO_ADMIN_PASS=$(random_password 20)
+NEKO_USER_PASS=$(random_password 20)
+{
+  echo "Neko Credentials"
+  echo "Admin password: ${NEKO_ADMIN_PASS}"
+  echo "User password: ${NEKO_USER_PASS}"
+} >~/neko.creds
 cat <<EOF >/etc/neko/neko.yaml
 server:
  bind: "0.0.0.0:8080"
@@ -219,8 +226,8 @@ desktop:
 member:
  provider: "multiuser"
  multiuser:
-    admin_password: "admin"
-    user_password: "neko"
+    admin_password: "${NEKO_ADMIN_PASS}"
+    user_password: "${NEKO_USER_PASS}"
 EOF
 msg_ok "Set up Runtime"

@@ -31,6 +31,7 @@ NODEBB_USER="nodebb"
 NODEBB_PWD="$(random_password 13)"
 MONGO_CONNECTION_STRING="mongodb://${NODEBB_USER}:${NODEBB_PWD}@localhost:27017/nodebb"
 NODEBB_SECRET=$(uuidgen)
+NODEBB_ADMIN_PASS="$(random_password 20)"
 cat <<EOF >~/nodebb.creds
 NodeBB-Credentials
 Mongo Database User: $MONGO_ADMIN_USER
@@ -38,6 +39,8 @@ Mongo Database Password: $MONGO_ADMIN_PWD
 NodeBB User: $NODEBB_USER
 NodeBB Password: $NODEBB_PWD
 NodeBB Secret: $NODEBB_SECRET
+NodeBB Admin User: community-scripts
+NodeBB Admin Password: $NODEBB_ADMIN_PASS
 EOF

 $STD mongosh <<EOF
@@ -97,10 +100,10 @@ expect "Administrator email address" {
    send "admin@community-scripts.org\r"
 }
 expect "Password" {
-    send "community-scripts\r"
+    send "$NODEBB_ADMIN_PASS\r"
 }
 expect "Confirm Password" {
-    send "community-scripts\r"
+    send "$NODEBB_ADMIN_PASS\r"
 }
 expect eof
 EOF
@@ -57,11 +57,17 @@ done
 ACME_EMAIL_INPUT="${var_npmplus_acme_email:-}"
 [[ -n "$ACME_EMAIL_INPUT" ]] || read -r -p "${TAB3}Enter your ACME Email (optional, press ENTER to skip): " ACME_EMAIL_INPUT || true

+ADMIN_PASS=$(random_password 20)
 yq -i "
  .services.npmplus.environment |=
    (map(select(. != \"TZ=*\" and . != \"ACME_EMAIL=*\" and . != \"INITIAL_ADMIN_EMAIL=*\" and . != \"INITIAL_ADMIN_PASSWORD=*\")) +
-    [\"TZ=$TZ_INPUT\", \"ACME_EMAIL=$ACME_EMAIL_INPUT\", \"INITIAL_ADMIN_EMAIL=admin@local.com\", \"INITIAL_ADMIN_PASSWORD=community-scripts.org\"])
+    [\"TZ=$TZ_INPUT\", \"ACME_EMAIL=$ACME_EMAIL_INPUT\", \"INITIAL_ADMIN_EMAIL=admin@local.com\", \"INITIAL_ADMIN_PASSWORD=${ADMIN_PASS}\"])
 " /opt/compose.yaml
+{
+  echo "NPMplus Credentials"
+  echo "Email: admin@local.com"
+  echo "Password: ${ADMIN_PASS}"
+} >~/npmplus.creds

 msg_info "Building and Starting NPMplus (Patience)"
 $STD docker compose up -d
@@ -30,7 +30,13 @@ rm -rf /usr/lib/python3.*/EXTERNALLY-MANAGED
 msg_ok "Setup Python3"

 msg_info "Creating user octoprint"
-useradd -m -s /bin/bash -p $(openssl passwd -1 octoprint) octoprint
+OCTOPRINT_PASS=$(random_password 20)
+useradd -m -s /bin/bash -p "$(openssl passwd -6 "$OCTOPRINT_PASS")" octoprint
+{
+  echo "OctoPrint Linux user Credentials"
+  echo "Username: octoprint"
+  echo "Password: ${OCTOPRINT_PASS}"
+} >~/octoprint.creds
 usermod -aG sudo,tty,dialout octoprint
 chown -R octoprint:octoprint /opt
 echo "octoprint ALL=NOPASSWD: $(command -v systemctl) restart octoprint, $(command -v reboot), $(command -v poweroff)" >/etc/sudoers.d/octoprint
@@ -16,7 +16,7 @@ update_os
 msg_info "Installing OpenObserve"
 mkdir -p /opt/openobserve/data
 RELEASE=$(get_latest_github_release "openobserve/openobserve")
-tar zxf <(curl -fsSL https://downloads.openobserve.ai/releases/openobserve/v$RELEASE/openobserve-v$RELEASE-linux-$(arch_resolve).tar.gz) -C /opt/openobserve
+tar zxf <(curl -fsSL https://downloads.openobserve.ai/releases/openobserve/v$RELEASE/openobserve-v$RELEASE-linux-$(arch_resolve).tar.gz) -C /opt/openobserve --no-same-owner
 ROOT_PASS="$(random_password 9)Aa1!"

 cat <<EOF >/opt/openobserve/data/.env
@@ -25,7 +25,7 @@ ZO_ROOT_USER_PASSWORD = "${ROOT_PASS}"
 ZO_DATA_DIR = "/opt/openobserve/data"
 ZO_HTTP_PORT = "5080"
 EOF
-echo "${RELEASE}" >>~/.openobserve
+echo "${RELEASE}" >~/.openobserve
 msg_ok "Installed OpenObserve"

 msg_info "Creating Service"
@@ -38,7 +38,6 @@ After=network.target
 Type=simple
 EnvironmentFile=/opt/openobserve/data/.env
 ExecStart=/opt/openobserve/openobserve
-ExecStop=killall -QUIT openobserve
 Restart=on-failure

 [Install]
@@ -43,7 +43,13 @@ $STD php artisan migrate --force --seed
 msg_ok "Set up database"

 msg_info "Creating Admin User"
-$STD php artisan app:user:create paymenter admin admin@paymenter.org paymenter 1 -q
+PAYMENTER_PASS=$(random_password 20)
+$STD php artisan app:user:create paymenter admin admin@paymenter.org "$PAYMENTER_PASS" 1 -q
+{
+  echo "Paymenter Credentials"
+  echo "Email: admin@paymenter.org"
+  echo "Password: ${PAYMENTER_PASS}"
+} >~/paymenter.creds
 msg_ok "Created Admin User"

 msg_info "Configuring Nginx"
@@ -46,10 +46,16 @@ tar -xzf /tmp/libheif.tar.gz -C /usr/local
 ldconfig
 echo "${LIBHEIF_URL}" >~/.photoprism_libheif
 chmod -R 755 /opt/photoprism/photos/originals
+ADMIN_PASS=$(random_password 20)
+{
+  echo "PhotoPrism Credentials"
+  echo "Username: admin"
+  echo "Password: ${ADMIN_PASS}"
+} >~/photoprism.creds
 cat <<EOF >/opt/photoprism/config/.env
 # Authentication
 PHOTOPRISM_ADMIN_USER='admin'
-PHOTOPRISM_ADMIN_PASSWORD='changeme'
+PHOTOPRISM_ADMIN_PASSWORD='${ADMIN_PASS}'
 PHOTOPRISM_AUTH_MODE='password'
 PHOTOPRISM_PUBLIC='false'

@@ -112,7 +118,7 @@ StoragePath: "/opt/photoprism/storage"
 OriginalsPath: "/opt/photoprism/photos/originals"
 ImportPath: "/media"
 AdminUser: "admin"
-AdminPassword: "changeme"
+AdminPassword: "${ADMIN_PASS}"
 AuthMode: "password"
 DatabaseDriver: "sqlite"
 HttpHost: "0.0.0.0"
@@ -18,12 +18,20 @@ fetch_and_deploy_gh_release "qbittorrent" "userdocs/qbittorrent-nox-static" "sin
 msg_info "Setup qBittorrent-nox"
 mv /opt/qbittorrent/qbittorrent /opt/qbittorrent/qbittorrent-nox
 mkdir -p ~/.config/qBittorrent/
+QB_PASS=$(random_password 20)
+QB_SALT=$(random_password 16)
+QB_HASH="$(printf '%s' "$QB_SALT" | base64 -w0):$(openssl kdf -keylen 64 -kdfopt digest:SHA512 -kdfopt pass:"$QB_PASS" -kdfopt salt:"$QB_SALT" -kdfopt iter:100000 -binary PBKDF2 | base64 -w0)"
+{
+  echo "qBittorrent Credentials"
+  echo "Username: admin"
+  echo "Password: ${QB_PASS}"
+} >~/qbittorrent.creds
 cat <<EOF >~/.config/qBittorrent/qBittorrent.conf
 [LegalNotice]
 Accepted=true

 [Preferences]
-WebUI\Password_PBKDF2="@ByteArray(amjeuVrF3xRbgzqWQmes5A==:XK3/Ra9jUmqUc4RwzCtrhrkQIcYczBl90DJw2rT8DFVTss4nxpoRhvyxhCf87ahVE3SzD8K9lyPdpyUCfmVsUg==)"
+WebUI\Password_PBKDF2="@ByteArray(${QB_HASH})"
 WebUI\Port=8090
 WebUI\UseUPnP=false
 WebUI\Username=admin
@@ -43,9 +43,15 @@ $STD rabbitmqctl enable_feature_flag all
 msg_ok "Enabled RabbitMQ Management Plugin"

 msg_info "Creating User"
-$STD rabbitmqctl add_user proxmox proxmox
+RABBITMQ_PASS=$(random_password 20)
+$STD rabbitmqctl add_user proxmox "$RABBITMQ_PASS"
 $STD rabbitmqctl set_user_tags proxmox administrator
 $STD rabbitmqctl set_permissions -p / proxmox ".*" ".*" ".*"
+{
+  echo "RabbitMQ Credentials"
+  echo "Username: proxmox"
+  echo "Password: ${RABBITMQ_PASS}"
+} >~/rabbitmq.creds
 msg_ok "Created User"

 motd_ssh
@@ -257,15 +257,33 @@ map $http_upgrade $connection_upgrade {
    '' close;
 }

+# COEP/COOP for the EmulatorJS and js-dos players (SharedArrayBuffer needs a
+# crossOriginIsolated document). Matched on $request_uri because try_files
+# rewrites $uri to /index.html before add_header runs, so a per-location
+# add_header on the player route never fires. Mirrors upstream RomM's
+# docker/nginx/templates/default.conf.template.
+map $request_uri $coep_header {
+    default        "";
+    ~^/rom/.*/(ejs|jsdos)(\?|$) "require-corp";
+}
+map $request_uri $coop_header {
+    default        "";
+    ~^/rom/.*/(ejs|jsdos)(\?|$) "same-origin";
+}
+
 server {
    listen 80;
    server_name _;
    root /opt/romm/frontend/dist;
    client_max_body_size 0;

-    # Frontend SPA
+    # Frontend SPA - also emits the player isolation headers: the player URLs
+    # fall through try_files to /index.html, which this location serves
    location / {
        try_files $uri $uri/ /index.html;
+        add_header Cache-Control "no-cache";
+        add_header Cross-Origin-Embedder-Policy $coep_header;
+        add_header Cross-Origin-Opener-Policy $coop_header;
    }

    # Static assets
@@ -276,13 +294,6 @@ server {
        add_header Cache-Control "public, immutable";
    }

-    # EmulatorJS player - requires COOP/COEP headers for SharedArrayBuffer
-    location ~ ^/rom/.*/ejs$ {
-        add_header Cross-Origin-Embedder-Policy "require-corp";
-        add_header Cross-Origin-Opener-Policy "same-origin";
-        try_files $uri /index.html;
-    }
-
    # Backend API
    location /api {
        proxy_pass http://romm_backend;
@@ -151,7 +151,7 @@ INVITE_EMAIL_TEMPLATE=/opt/signoz/templates/invitation_email_template.html
 SIGNOZ_SQLSTORE_SQLITE_PATH=/var/lib/signoz/signoz.db
 SIGNOZ_WEB_ENABLED=true
 SIGNOZ_WEB_DIRECTORY=/opt/signoz/web
-SIGNOZ_JWT_SECRET=secret
+SIGNOZ_JWT_SECRET=$(openssl rand -hex 32)
 SIGNOZ_ALERTMANAGER_PROVIDER=signoz
 SIGNOZ_TELEMETRYSTORE_PROVIDER=clickhouse
 SIGNOZ_TELEMETRYSTORE_CLICKHOUSE_DSN=tcp://localhost:9000?password=
@@ -78,6 +78,12 @@ msg_info "Configuring SnapOtter"
 mkdir -p /opt/snapotter_data/files
 mkdir -p /tmp/snapotter-workspace

+SNAPOTTER_PASS=$(random_password 20)
+{
+  echo "SnapOtter Credentials"
+  echo "Username: admin"
+  echo "Password: ${SNAPOTTER_PASS}"
+} >~/snapotter.creds
 cat <<EOF >/opt/snapotter_data/.env
 PORT=1349
 NODE_ENV=production
@@ -92,7 +98,7 @@ FEATURE_MANIFEST_PATH=/opt/snapotter/docker/feature-manifest.json
 U2NET_HOME=/opt/snapotter_data/ai/models/rembg
 AUTH_ENABLED=true
 DEFAULT_USERNAME=admin
-DEFAULT_PASSWORD=admin
+DEFAULT_PASSWORD=${SNAPOTTER_PASS}
 LOG_LEVEL=info
 TRUST_PROXY=true
 FILE_MAX_AGE_HOURS=72
@@ -116,10 +116,6 @@ if [[ "$login_mode" == "true" ]]; then
 # activate Login
 DISABLE_ADDITIONAL_FEATURES=false
 SECURITY_ENABLELOGIN=true
-
-# login credentials
-SECURITY_INITIALLOGIN_USERNAME=admin
-SECURITY_INITIALLOGIN_PASSWORD=stirling
 EOF
 fi
 msg_ok "Created Environment Variables"
@@ -23,7 +23,7 @@ msg_ok "Installed Dependencies"

 NODE_VERSION="24" setup_nodejs

-fetch_and_deploy_gh_release "yuvomi" "ulsklyc/yuvomi" "tarball"
+fetch_and_deploy_gh_release "yuvomi" "ulsklyc/yuvomi" "prebuild" "latest" "/opt/yuvomi" "yuvomi-*-dist.tar.gz"

 msg_info "Installing Node.js Dependencies"
 cd /opt/yuvomi
@@ -85,12 +85,16 @@ function install() {
  mkdir -p "${HOME}/.config/code-server/"

  if [ "$preexisting_config" = false ]; then
+    CS_PASS=$(random_password 20)
    cat <<EOF >"$config_path"
 bind-addr: 0.0.0.0:8680
-auth: none
-password: 
+auth: password
+password: ${CS_PASS}
 cert: false
 EOF
+    chmod 600 "$config_path"
+    echo -e "Coder Code Server\nPassword: ${CS_PASS}" >~/coder-code-server.creds
+    chmod 600 ~/coder-code-server.creds
  fi
  systemctl enable -q --now code-server@"$USER"
  systemctl restart code-server@"$USER"
@@ -111,7 +115,7 @@ EOF
  msg_ok "Created update script (/usr/local/bin/update_coder-code-server)"

  echo -e "${APP} should be reachable by going to the following URL.
-         ${BL}http://${IP}:8680${CL} \n"
+         ${BL}http://${IP}:8680${CL} (password in ~/coder-code-server.creds)\n"
 }

 # ==============================================================================
@@ -151,9 +151,9 @@ function install() {
  else
    read -rp "${TAB}Set admin username [admin]: " admin_user
    admin_user=${admin_user:-admin}
-    read -rsp "${TAB}Set admin password [community-scripts.org]: " admin_pass
+    read -rsp "${TAB}Set admin password [random]: " admin_pass
    echo ""
-    admin_pass=${admin_pass:-community-scripts.org}
+    admin_pass=${admin_pass:-$(random_password 20)}
    msg_ok "Configured with admin user: ${admin_user}"
  fi

@@ -291,8 +291,10 @@ UPDATEEOF
  msg_ok "Storage: ${BL}${DATA_PATH}${CL}"
  msg_ok "Config: ${BL}${CONF_PATH}${CL}"
  if [[ -n "$admin_user" ]]; then
+    echo -e "Copyparty\nUsername: ${admin_user}\nPassword: ${admin_pass}" >~/copyparty.creds
+    chmod 600 ~/copyparty.creds
    echo ""
-    msg_ok "Login: ${GN}${admin_user}${CL} / ${GN}${admin_pass}${CL}"
+    msg_ok "Login: ${GN}${admin_user}${CL} (password in ~/copyparty.creds)"
  fi
 }

@@ -189,6 +189,8 @@ chown root:root /usr/local/community-scripts
 chmod 755 /usr/local/community-scripts
 msg_ok "Directory prepared"

+ADMIN_PASS=$(random_password 20)
+msg_warn "FileBrowser runs as root and shows the whole filesystem. Without authentication, anyone who reaches port ${PORT} can read and change every file."
 echo -n "${TAB}Use No Authentication? (y/N): "
 read -r noauth_prompt

@@ -234,9 +236,12 @@ server:
          - neverWatchPath: "/lost+found"
 auth:
  adminUsername: admin
-  adminPassword: community-scripts.org
+  adminPassword: ${ADMIN_PASS}
 EOF
-  msg_ok "Configured with default admin (admin / community-scripts.org)"
+  chmod 600 "$CONFIG_PATH"
+  echo -e "FileBrowser Quantum\nUsername: admin\nPassword: ${ADMIN_PASS}" >~/filebrowser-quantum.creds
+  chmod 600 ~/filebrowser-quantum.creds
+  msg_ok "Configured admin (credentials saved in ~/filebrowser-quantum.creds)"
 fi

 msg_info "Creating service"
@@ -276,4 +281,13 @@ EOF
 fi

 msg_ok "Service created successfully"
+
+# auth.adminPassword resets the password on every start, so it stays only until the admin exists
+if grep -q '^\s*adminPassword:' "$CONFIG_PATH"; then
+  for _ in {1..30}; do
+    [[ "$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${PORT}/health")" == "200" ]] && break
+    sleep 1
+  done
+  sed -i '/^\s*adminPassword:/d' "$CONFIG_PATH"
+fi
 msg_ok "${APP} is reachable at: ${BL}http://${IP}:${PORT}${CL}"
@@ -122,9 +122,11 @@ if [[ "${install_prompt,,}" =~ ^(y|yes)$ ]]; then
  chmod 755 /usr/local/community-scripts
  touch "$DB_PATH"
  chown root:root "$DB_PATH"
-  chmod 644 "$DB_PATH"
+  chmod 600 "$DB_PATH"
  msg_ok "Directory created successfully"

+  ADMIN_PASS=$(random_password 20)
+  msg_warn "FileBrowser runs as root and shows the whole filesystem. Without authentication, anyone who reaches port ${PORT} can read and change every file."
  read -r -p "Would you like to use No Authentication? (y/N): " auth_prompt
  if [[ "${auth_prompt,,}" =~ ^(y|yes)$ ]]; then
    msg_info "Configuring No Authentication"
@@ -133,16 +135,18 @@ if [[ "${install_prompt,,}" =~ ^(y|yes)$ ]]; then
    $STD filebrowser config set -a '0.0.0.0' -p "$PORT" -d "$DB_PATH"
    $STD filebrowser config set --auth.method=noauth --database "$DB_PATH"
    if ! filebrowser users update 1 --perm.admin --database "$DB_PATH" &>/dev/null; then
-      $STD filebrowser users add admin community-scripts.org --perm.admin --database "$DB_PATH"
+      $STD filebrowser users add admin "$ADMIN_PASS" --perm.admin --database "$DB_PATH"
    fi
    msg_ok "No Authentication configured"
  else
-    msg_info "Setting up default authentication"
+    msg_info "Setting up authentication"
    cd /usr/local/community-scripts
    $STD filebrowser config init -a '0.0.0.0' -p "$PORT" -d "$DB_PATH"
    $STD filebrowser config set -a '0.0.0.0' -p "$PORT" -d "$DB_PATH"
-    $STD filebrowser users add admin community-scripts.org --perm.admin --database "$DB_PATH"
-    msg_ok "Default authentication configured (admin:community-scripts.org)"
+    $STD filebrowser users add admin "$ADMIN_PASS" --perm.admin --database "$DB_PATH"
+    echo -e "FileBrowser\nUsername: admin\nPassword: ${ADMIN_PASS}" >~/filebrowser.creds
+    chmod 600 ~/filebrowser.creds
+    msg_ok "Authentication configured (credentials saved in ~/filebrowser.creds)"
  fi

  msg_info "Creating service"
@@ -156,7 +160,6 @@ After=network-online.target
 User=root
 WorkingDirectory=/usr/local/community-scripts
 ExecStartPre=/bin/touch /usr/local/community-scripts/filebrowser.db
-ExecStartPre=/usr/local/bin/filebrowser config set -a "0.0.0.0" -p ${PORT} -d /usr/local/community-scripts/filebrowser.db
 ExecStart=/usr/local/bin/filebrowser -r / -d /usr/local/community-scripts/filebrowser.db -p ${PORT}
 Restart=always

@@ -30,6 +30,7 @@ catch_errors

 # Initialize all core functions (colors, formatting, icons, STD mode)
 load_functions
+confirm_not_pve_host
 require_debian_like

 header_info
@@ -49,9 +50,13 @@ msg_ok "Installed Prerequisites"

 msg_info "Installing ${APP}"
 fetch_and_deploy_gh_release "webmin" "webmin/webmin" "binary" "latest" "/opt/webmin" "webmin_*_all.deb"
-/usr/share/webmin/changepass.pl /etc/webmin root root &>/dev/null
+WEBMIN_PASS=$(random_password 20)
+/usr/share/webmin/changepass.pl /etc/webmin root "$WEBMIN_PASS" &>/dev/null
+echo -e "Webmin\nUsername: root\nPassword: ${WEBMIN_PASS}" >~/webmin.creds
+chmod 600 ~/webmin.creds
 msg_ok "Installed ${APP}"

 get_lxc_ip
 echo -e "Successfully Installed!! ${APP} should be reachable by going to ${BL}https://${LOCAL_IP}:10000${CL}"
+echo -e "Login: root, password in ~/webmin.creds"

@@ -588,11 +588,17 @@ get_vm_ips() {
    fi
    if [[ "$agent_enabled" == "1" ]] && command -v qm >/dev/null 2>&1; then
        debug_log "vm $vmid: querying guest agent"
-        local qm_ips=$(timeout 5 qm guest cmd "$vmid" network-get-interfaces 2>/dev/null | grep -oE '([0-9]{1,3}\.){3}[0-9]{1,3}' | grep -v "127.0.0.1" | head -3)
+        local qm_ips=$(timeout 5 qm guest cmd "$vmid" network-get-interfaces 2>/dev/null | grep -oE '([0-9]{1,3}\.){3}[0-9]{1,3}' | grep -v "127.0.0.1")
+        local qm_kept=0
        for qm_ip in $qm_ips; do
            if [[ "$qm_ip" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]]; then
-                debug_log "vm $vmid: found IP $qm_ip via qm guest cmd"
-                ips+="$qm_ip "
+                if ip_in_cidrs "$qm_ip" "${CIDR_LIST[*]}"; then
+                    debug_log "vm $vmid: found IP $qm_ip via qm guest cmd"
+                    ips+="$qm_ip "
+                    ((++qm_kept >= 3)) && break
+                else
+                    debug_log "vm $vmid: skipping IP $qm_ip via qm guest cmd (outside CIDR_LIST)"
+                fi
            fi
        done
    else
@@ -54,35 +54,35 @@ function run_lxc_clean() {
  header_info
  name=$(pct exec "$container" -- hostname)

-  pct exec "$container" -- bash -c '
+  pct exec "$container" -- sh -c '
    BL="\033[36m"; GN="\033[1;92m"; CL="\033[m"
    name=$(hostname)
    if [ -e /etc/alpine-release ]; then
-      echo -e "${BL}[Info]${GN} Cleaning $name (Alpine)${CL}\n"
+      printf "%b\n\n" "${BL}[Info]${GN} Cleaning $name (Alpine)${CL}"
      apk cache clean
      find /var/log -type f -delete 2>/dev/null
      find /tmp -mindepth 1 -delete 2>/dev/null
      apk update
    elif [ -e /etc/redhat-release ]; then
-      echo -e "${BL}[Info]${GN} Cleaning $name (CentOS)${CL}\n"
+      printf "%b\n\n" "${BL}[Info]${GN} Cleaning $name (CentOS)${CL}"
      yum clean all
      find /var/log -type f -delete 2>/dev/null
      find /tmp -mindepth 1 -delete 2>/dev/null
      yum update
      yum upgrade -y
    else
-      echo -e "${BL}[Info]${GN} Cleaning $name (Debian/Ubuntu)${CL}\n"
+      printf "%b\n\n" "${BL}[Info]${GN} Cleaning $name (Debian/Ubuntu)${CL}"
      find /var/cache -type f -delete 2>/dev/null
      find /var/log -type f -delete 2>/dev/null
      find /tmp -mindepth 1 -delete 2>/dev/null
      apt -y --purge autoremove
      apt -y autoclean
-      rm -rf /var/lib/apt/lists/*
      apt update
    fi
  '
 }

+failed_containers=()
 for container in $(pct list | awk '{if(NR>1) print $1}'); do
  excluded=0
  for ex in $excluded_containers; do
@@ -112,17 +112,25 @@ for container in $(pct list | awk '{if(NR>1) print $1}'); do

  if [ "$template" == "false" ] && [ "$status" == "status: stopped" ]; then
    echo -e "${BL}[Info]${GN} Starting${BL} $container ${CL} \n"
-    pct start "$container"
+    if ! pct start "$container"; then
+      failed_containers+=("$container (start)")
+      continue
+    fi
    echo -e "${BL}[Info]${GN} Waiting For${BL} $container${CL}${GN} To Start ${CL} \n"
    sleep 5
-    run_lxc_clean "$container"
+    run_lxc_clean "$container" || failed_containers+=("$container")
    echo -e "${BL}[Info]${GN} Shutting down${BL} $container ${CL} \n"
    pct shutdown "$container" &
  elif [ "$status" == "status: running" ]; then
-    run_lxc_clean "$container"
+    run_lxc_clean "$container" || failed_containers+=("$container")
  fi
 done

 wait
 header_info
+if [ "${#failed_containers[@]}" -gt 0 ]; then
+  echo -e "${RD}Cleaning failed in these containers:${CL}"
+  printf '%s\n' "${failed_containers[@]}"
+  exit 1
+fi
 echo -e "${GN} Finished, Selected Containers Cleaned. ${CL} \n"
@@ -282,7 +282,7 @@ function failure_reason() {
 function backup_container() {
  msg_info "Creating backup for container $1"
  local output
-  if output=$(vzdump $1 --compress zstd --storage $STORAGE_CHOICE -notes-template "{{guestname}} - community-scripts backup updater" 2>&1); then
+  if output=$(_cs_shield_hangup vzdump $1 --compress zstd --storage $STORAGE_CHOICE -notes-template "{{guestname}} - community-scripts backup updater" 2>&1); then
    msg_ok "Backup created"
  else
    log_write "Container $1: vzdump failed:"$'\n'"$output"
@@ -651,7 +651,18 @@ for container in $CHOICE; do
    msg_error "Update failed for container $container ($service, exit code: $exit_code) — attempting restore"
    log_write "Container $container ($service): FAILED (exit $exit_code) — attempting restore"
    msg_info "Restoring LXC $container from backup ($STORAGE_CHOICE)"
-    pct stop $container
+    wait
+    pct stop $container &>/dev/null || true
+    for _ in {1..30}; do
+      [[ "$(pct status $container 2>/dev/null)" == "status: stopped" ]] && break
+      sleep 1
+    done
+    if [[ "$(pct status $container 2>/dev/null)" != "status: stopped" ]]; then
+      msg_error "Container $container did not stop, so it cannot be restored"
+      log_result "$container" "$service" "FAILED" "Update failed (exit $exit_code) — container did not stop for the restore"
+      log_write "Container $container ($service): FAILED — container did not stop for the restore"
+      exit 235
+    fi
    LXC_STORAGE=$(pct config $container | awk -F '[:,]' '/rootfs/ {print $2}')
    BACKUP_ENTRY=$(pvesm list "$STORAGE_CHOICE" 2>/dev/null | awk -v ctid="$container" '$1 ~ "vzdump-lxc-"ctid"-" || $1 ~ "/ct/"ctid"/" {print $1}' | sort -r | head -n1)
    if [ -z "$BACKUP_ENTRY" ]; then
@@ -84,6 +84,7 @@ function update_container() {
 }

 containers_needing_reboot=()
+failed_containers=()
 header_info
 for container in $(pct list | awk '{if(NR>1) print $1}'); do
  if [[ " ${excluded_containers[@]} " =~ " $container " ]]; then
@@ -101,14 +102,17 @@ for container in $(pct list | awk '{if(NR>1) print $1}'); do
    template=$(pct config $container | grep -q "template:" && echo "true" || echo "false")
    if [ "$template" == "false" ] && [ "$status" == "status: stopped" ]; then
      echo -e "${BL}[Info]${GN} Starting${BL} $container ${CL} \n"
-      pct start $container
+      if ! pct start $container; then
+        failed_containers+=("$container (start)")
+        continue
+      fi
      echo -e "${BL}[Info]${GN} Waiting For${BL} $container${CL}${GN} To Start ${CL} \n"
      sleep 5
-      update_container $container
+      update_container $container || failed_containers+=("$container")
      echo -e "${BL}[Info]${GN} Shutting down${BL} $container ${CL} \n"
      pct shutdown $container &
    elif [ "$status" == "status: running" ]; then
-      update_container $container
+      update_container $container || failed_containers+=("$container")
    fi
    if [ "$status" == "status: running" ]; then
      if pct exec "$container" -- [ -e "/var/run/reboot-required" ]; then
@@ -119,14 +123,20 @@ for container in $(pct list | awk '{if(NR>1) print $1}'); do
      # check if patchmon agent is present in container and run a report if found
      if pct exec "$container" -- [ -e "/usr/local/bin/patchmon-agent" ]; then
        echo -e "${BL}[Info]${GN} patchmon-agent found in ${BL} $container ${CL}, triggering report. \n"
-        pct exec "$container" -- "/usr/local/bin/patchmon-agent" "report"
+        pct exec "$container" -- "/usr/local/bin/patchmon-agent" "report" || echo -e "${YW}[Warn]${CL} patchmon-agent report failed in $container\n"
      fi
    fi
  fi
 done
 wait
 header_info
-echo -e "${GN}The process is complete, and the containers have been successfully updated.${CL}\n"
+if [ "${#failed_containers[@]}" -gt 0 ]; then
+  echo -e "${RD}The update failed in these containers:${CL}"
+  printf '%s\n' "${failed_containers[@]}"
+  echo ""
+else
+  echo -e "${GN}The process is complete, and the containers have been successfully updated.${CL}\n"
+fi
 if [ "${#containers_needing_reboot[@]}" -gt 0 ]; then
  echo -e "${RD}The following containers require a reboot:${CL}"
  for container_name in "${containers_needing_reboot[@]}"; do
@@ -134,3 +144,4 @@ if [ "${#containers_needing_reboot[@]}" -gt 0 ]; then
  done
 fi
 echo ""
+[ "${#failed_containers[@]}" -eq 0 ] || exit 1
Author	SHA1	Message	Date
MickLesk	80183b1e9e	fix: generate first logins and secrets instead of fixed ones in 13 more installs authelia, qbittorrent, rabbitmq, nagios, neko, paymenter, nodebb, homelable, snapotter and octoprint's Linux user were created with fixed passwords; each now uses random_password and saves the login in ~/<app>.creds. Stirling-PDF no longer sets admin/stirling explicitly, so its own default asks for a new password on first login again. Firefly kept the example APP_KEY and STATIC_CRON_TOKEN, and SigNoz used the JWT secret "secret"; both are generated now. Only new installs change.	2026-11-09 15:39:04 +01:00
MickLesk	fdace325ad	fix: generate the webmin, code-server and copyparty logins; leave existing installs alone webmin set root/root, coder-code-server ran without authentication as root on 0.0.0.0:8680, and copyparty took community-scripts.org when the password prompt was left empty. New installs now get a random password in ~/<app>.creds. The filebrowser and quantum updates no longer touch existing installs, and the FileBrowser database is no longer world-readable.	2026-11-09 15:36:10 +01:00
MickLesk	db2721208a	fix: generate the admin password in monica, archivebox, kimai, npmplus, keycloak, photoprism These installs created their first admin with a public password (community-scripts.org, admin123 or changeme). Each now uses random_password and saves the login in ~/<app>.creds. The Keycloak unit, which carries the bootstrap admin, is no longer world-readable.	2026-11-09 15:16:43 +01:00
MickLesk	77853ffe37	fix(filebrowser): generate the admin password instead of a public one The addon, filebrowser-quantum and the FileBrowser option of homeassistant and podman-homeassistant created admin with the password community-scripts.org, on a service that runs as root over the whole filesystem. A new install now gets a random password in ~/filebrowser.creds or ~/filebrowser-quantum.creds, and an update replaces the public password on existing installs. Quantum only keeps adminPassword in its config until the admin exists, since it resets the password on every start. The Home Assistant options run the addon instead of their own copy pinned to FileBrowser 2.23.0, the service no longer forces the listen address back to 0.0.0.0, and the no-authentication prompt says what it exposes.	2026-11-09 15:15:09 +01:00
community-scripts-pr-app[bot]	cfeb555f8b	Update CHANGELOG.md (#18571 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-09 13:41:43 +00:00
community-scripts-pr-app[bot]	af8f922610	Update CHANGELOG.md (#18570 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-09 13:19:39 +00:00
github-actions[bot]	08854f9b1b	chore(ct): sync zipline defaults from PocketBase (#18569 ) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-11-09 14:19:13 +01:00
community-scripts-pr-app[bot]	293a0a85c1	Update CHANGELOG.md (#18567 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-09 12:27:09 +00:00
BadFlo	bfba6d1f30	OpenObserve: record installed version, drop killall ExecStop (#18566 ) update_script never wrote ~/.openobserve, so check_for_gh_release reported an update on every run and reinstalled the release. Write the version after extraction, as other ct scripts do, and overwrite instead of append at install. The unit ExecStop=killall failed with 203/EXEC because psmisc is never installed. OpenObserve treats SIGQUIT and SIGTERM alike, so drop ExecStop and remove it from existing units during update. Co-authored-by: BadFlo <7882184+BadFlo@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-09 13:26:43 +01:00
community-scripts-pr-app[bot]	2166dfc210	Update CHANGELOG.md (#18565 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-09 12:08:44 +00:00
BadFlo	7a0faa4f94	OpenObserve: extract release tarball with --no-same-owner (#18564 ) The release tarball stores the binary as uid/gid 1001. Extracted as root, GNU tar keeps that owner, so /opt/openobserve/openobserve ended up owned by a non-existent uid after install and every update. Co-authored-by: BadFlo <7882184+BadFlo@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-09 13:08:19 +01:00
community-scripts-pr-app[bot]	f4c8bff028	Update CHANGELOG.md (#18563 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-09 11:40:50 +00:00
Michel Roegl-Brunner	81f14b0a02	Delete ct/coolify.sh (#18562 )	2026-11-09 12:40:20 +01:00
community-scripts-pr-app[bot]	19b6cbc34e	Update CHANGELOG.md (#18560 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-09 09:17:10 +00:00
Ulaş Kalaycı	eb2f583793	yuvomi: install from the attested release asset (#18554 )	2026-11-09 10:16:37 +01:00
community-scripts-pr-app[bot]	8d50af5c69	Update CHANGELOG.md (#18559 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-09 08:59:45 +00:00
github-actions[bot]	2b63e9da14	cinephage: bump Node.js from 24 to 26 (#18374 ) * cinephage: bump Node.js from 24 to 26 * Fix command to fetch Camoufox in install script --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: CanbiZ (MickLesk) <47820557+MickLesk@users.noreply.github.com>	2026-11-09 09:59:18 +01:00
community-scripts-pr-app[bot]	0283df4573	Update CHANGELOG.md (#18558 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-09 08:46:47 +00:00
community-scripts-pr-app[bot]	d8087c2c0e	Update CHANGELOG.md (#18557 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-09 08:42:33 +00:00
Tim Moore	90d80949c1	Immich: download before stopping, and clear maintenance mode after an interrupted update (#18553 ) * fix(immich): download before stopping, and clear maintenance mode after an interrupted update setup_uv and the Immich release fetch ran after maintenance mode, the service stop and rm -rf app/, so a failed download (e.g. a GitHub releases/download 504) left the container with no app at all. They now run first, while the old install is still serving. The fetch writes the new version to ~/.immich, so the old version is put back until the update finishes and a failed run can still be retried. Maintenance mode is now disabled whenever immich-admin exists at the end, not only when this run enabled it. Since #17798 a re-run after an interrupted update skips the enable, so it skipped the disable too and left the web UI on the maintenance page. fix(immich): trim comments to the AGENTS.md limit * fix(immich): rely on the core pending marker, and only clear maintenance mode this run owns fetch_and_deploy_release already keeps ~/.immich.pending until a clean exit and redoes the update while it exists, so the hand-rolled version swap is dropped; PREV_IMMICH now reads CS_PREVIOUS_VERSION so a redo sees the real old version. Maintenance mode is disabled when this run enabled it, or when app/ was empty at the start (an interrupted run left it on), rather than whenever immich-admin exists. * immich: drop comment per review Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-09 09:42:03 +01:00
CanbiZ (MickLesk)	2f0f6daee8	Update Node.js version to 26 in cinephage.sh	2026-11-09 09:40:29 +01:00
community-scripts-pr-app[bot]	cdae3b974f	Update CHANGELOG.md (#18556 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-09 08:39:39 +00:00
mazelado	50d1c199f5	IP-Tag: filter guest-agent IPs by CIDR before limiting to 3 (#18537 ) Co-authored-by: Matt Daleo <12395090+mazelado@users.noreply.github.com>	2026-11-09 09:39:13 +01:00
github-actions[bot]	f4e0f5508f	cross-seed: bump Node.js from 24 to 26 (#17083 ) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-11-09 09:34:16 +01:00
community-scripts-pr-app[bot]	492575699c	Update CHANGELOG.md (#18555 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-09 08:16:26 +00:00
github-actions[bot]	623d26a39d	kan: bump Node.js from 20 to 24 (#18549 ) * kan: bump Node.js from 20 to 24 * Set NODE_VERSION and NODE_MODULE before setup --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: CanbiZ (MickLesk) <47820557+MickLesk@users.noreply.github.com>	2026-11-09 09:16:02 +01:00
github-actions[bot]	191ab7e861	myip: bump Node.js from 24 to 26 (#18550 ) * myip: bump Node.js from 24 to 26 * Increase default RAM allocation from 1024MB to 2048MB --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: CanbiZ (MickLesk) <47820557+MickLesk@users.noreply.github.com>	2026-11-09 09:15:51 +01:00
community-scripts-pr-app[bot]	ba43fb009b	Update CHANGELOG.md (#18545 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-08 20:53:58 +00:00
community-scripts-pr-app[bot]	9c04500924	Update CHANGELOG.md (#18544 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-08 20:53:49 +00:00
CanbiZ (MickLesk)	d6d5996837	fix(update-apps): keep the backup alive on a closed console, stop before restoring (#18540 ) A closed console killed vzdump with the session (7 runs ended "Backup failed ... creating vzdump archive"); it now runs shielded from SIGHUP. A restore after a failed update raced the background shutdown and failed with "can't overwrite running container" (3 runs); it now waits for that shutdown and for the container to stop, and says so when it does not.	2026-11-08 21:53:34 +01:00
CanbiZ (MickLesk)	d4ab2d465f	fix(clean-lxcs): run with sh and keep going when one container fails (#18538 ) Alpine containers without bash failed with 127, and a failed apt update or pct start ended the whole run (12 runs in three days). The cleanup now runs with sh, keeps the apt lists so a failed update does not leave none, and lists the failed containers at the end.	2026-11-08 21:53:28 +01:00
CanbiZ (MickLesk)	31666305dc	fix(update-lxcs): keep going when one container fails (#18541 ) A failed patchmon-agent report, apk upgrade or pct start ended the whole run under set -e (18 runs in three days). The run now updates the other containers, lists the failed ones at the end and exits 1.	2026-11-08 21:53:26 +01:00
community-scripts-pr-app[bot]	84ba70bc1c	Update CHANGELOG.md (#18543 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-08 17:04:05 +00:00
CanbiZ (MickLesk)	2032fa8175	fix(immich): do not clone libjxl's testdata (#18539 ) The build runs with BUILD_TESTING=OFF, but the recursive submodule update also cloned the large testdata repo, and two installs died on network errors inside it. Only third_party is fetched now; libjxl at Immich's pinned revision configures and builds without it.	2026-11-08 18:03:40 +01:00
community-scripts-pr-app[bot]	d4de03f8e8	Update CHANGELOG.md (#18542 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-08 16:06:59 +00:00
community-scripts-pr-app[bot]	b457333b72	Update CHANGELOG.md (#18536 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-08 13:50:39 +00:00
push-app-to-main[bot]	06e30b9c4f	Chatto (#18521 ) * Add chatto (ct) * rm old Header comments --------- Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com> Co-authored-by: CanbiZ (MickLesk) <47820557+MickLesk@users.noreply.github.com>	2026-11-08 14:50:13 +01:00
push-app-to-main[bot]	8390e7e524	Firefox-Syncserver (#18520 ) * Add firefox-syncserver (ct) * cleanup --------- Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com> Co-authored-by: CanbiZ (MickLesk) <47820557+MickLesk@users.noreply.github.com>	2026-11-08 14:50:06 +01:00
community-scripts-pr-app[bot]	81441221ad	Update CHANGELOG.md (#18534 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-08 13:04:55 +00:00
CanbiZ (MickLesk)	d65cf17de4	fix(databasus): build 3.65 and ship the verification agent (#18500 ) 3.65 moved the entry point to cmd/databasus and embeds the API spec and migrations, so swag failed and every install since 2026-11-05 broke. It now builds like the upstream image: bundled client tools, the verification agent for amd64 and arm64, and APP_VERSION set to the release. Valkey, goose and the client symlinks are gone because 3.65 uses none of them. Closes #18493.	2026-11-08 14:04:30 +01:00
community-scripts-pr-app[bot]	8127d1caea	Update CHANGELOG.md (#18531 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-08 00:03:47 +00:00
community-scripts-pr-app[bot]	6eb9414ee7	Archive old changelog entries (#18530 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-08 00:03:21 +00:00
community-scripts-pr-app[bot]	a60d5882d3	Update CHANGELOG.md (#18528 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-07 20:36:10 +00:00
community-scripts-pr-app[bot]	292561163c	Update CHANGELOG.md (#18527 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-07 20:33:19 +00:00
community-scripts-pr-app[bot]	76aa58d6c4	Update CHANGELOG.md (#18526 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-07 20:33:02 +00:00
community-scripts-pr-app[bot]	4442360cd9	Update CHANGELOG.md (#18525 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-07 20:05:59 +00:00
adotagarwal	7bc2815df7	RomM: emit player isolation headers from the serving location (#18511 ) The player location's COOP/COEP add_header never fires: try_files internally redirects /rom/<id>/ejs to /index.html, served by "location /" — so SharedArrayBuffer cores (PSP/DS) fail with a misleading "must be run over HTTPS" error. Apply upstream RomM's own fix (docker nginx template): map $request_uri — which survives the redirect — to header values for the ejs and jsdos player paths, emit them from "location /", and drop the dead player location. Also restore upstream's Cache-Control "no-cache" on the SPA shell, without which a cached index.html hides the headers and stale frontends survive RomM updates. Widen the updater's migration gate so existing installs converge.	2026-11-07 21:05:35 +01:00
community-scripts-pr-app[bot]	1e722e8bd7	Update CHANGELOG.md (#18524 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-07 20:01:03 +00:00
push-app-to-main[bot]	91e9cc699c	EspoCRM (#18519 ) * Add espocrm (ct) * minor fixes * minor --------- Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com> Co-authored-by: CanbiZ (MickLesk) <47820557+MickLesk@users.noreply.github.com>	2026-11-07 21:00:38 +01:00