fix(update-apps): keep the backup alive on a closed console, stop before restoring

A closed console killed vzdump with the session (7 runs ended "Backup failed ... creating vzdump archive"); it now runs shielded from SIGHUP. A restore after a failed update raced the background shutdown and failed with "can't overwrite running container" (3 runs); it now waits for that shutdown and for the container to stop, and says so when it does not.
Update CHANGELOG.md (#18536 )
2026-11-08 22:40:45 +01:00 · 2026-11-08 16:40:18 +01:00 · 2026-11-08 13:50:39 +00:00 · 2026-11-08 14:50:13 +01:00 · 2026-11-08 14:50:06 +01:00 · 2026-11-08 13:04:55 +00:00
31 changed files with 974 additions and 399 deletions
@@ -0,0 +1,187 @@
+## 2026-11-07
+
+### 🆕 New Scripts
+
+  - EspoCRM ([#18519](https://github.com/community-scripts/ProxmoxVE/pull/18519))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - RomM: emit player isolation headers from the serving location [@adotagarwal](https://github.com/adotagarwal) ([#18511](https://github.com/community-scripts/ProxmoxVE/pull/18511))
+
+  - #### 💥 Breaking Changes
+
+    - fix: gotenberg: update to v9 [@CrazyWolf13](https://github.com/CrazyWolf13) ([#18491](https://github.com/community-scripts/ProxmoxVE/pull/18491))
+
+### 💾 Core
+
+  - nvidia: close the hardware acceleration step when no GPU is usable | pin the whole NVIDIA userspace to the host's driver version [@MickLesk](https://github.com/MickLesk) ([core#215](https://github.com/community-scripts/core/pull/215))
+- fix: stage release downloads on disk, not in /tmp [@rcourtman](https://github.com/rcourtman) ([core#218](https://github.com/community-scripts/core/pull/218))
+- Minor fixes: restart php-fpm during sigpipe, Install jq for forge commands  [@MickLesk](https://github.com/MickLesk) ([core#213](https://github.com/community-scripts/core/pull/213))
+- incus: name the project restriction that refuses an Incus launch [@MickLesk](https://github.com/MickLesk) ([core#214](https://github.com/community-scripts/core/pull/214))
+
+## 2026-11-06
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - UmbrelOS-VM: report runs as ProxmoxVE, not DevScripts [@MickLesk](https://github.com/MickLesk) ([#18497](https://github.com/community-scripts/ProxmoxVE/pull/18497))
+    - Caddy: skip the xCaddy test build below 2 GB RAM [@MickLesk](https://github.com/MickLesk) ([#18472](https://github.com/community-scripts/ProxmoxVE/pull/18472))
+    - Thingsboard: keep the package defaults in thingsboard.conf [@MickLesk](https://github.com/MickLesk) ([#18499](https://github.com/community-scripts/ProxmoxVE/pull/18499))
+    - Nexterm: keep the extracted app out of the /tmp cleanup [@MickLesk](https://github.com/MickLesk) ([#18501](https://github.com/community-scripts/ProxmoxVE/pull/18501))
+    - PLANKA: run the service with node instead of nodemon [@MickLesk](https://github.com/MickLesk) ([#18503](https://github.com/community-scripts/ProxmoxVE/pull/18503))
+    - MeTube/Yubal: install Deno without its shell setup [@MickLesk](https://github.com/MickLesk) ([#18406](https://github.com/community-scripts/ProxmoxVE/pull/18406))
+    - OPNsense VM: size the temp space check to the unpacked image |  say why the EFI disk could not be allocated [@MickLesk](https://github.com/MickLesk) ([#18404](https://github.com/community-scripts/ProxmoxVE/pull/18404))
+
+  - #### 🔧 Refactor
+
+    - Technitium DNS: read the version from its GitHub releases [@MickLesk](https://github.com/MickLesk) ([#18425](https://github.com/community-scripts/ProxmoxVE/pull/18425))
+
+### 💾 Core
+
+  - fix: spot same-filesystem bind mounts on Alpine [@rcourtman](https://github.com/rcourtman) ([core#212](https://github.com/community-scripts/core/pull/212))
+- fix: report a container that went down during setup, keep finished installs [@MickLesk](https://github.com/MickLesk) ([core#211](https://github.com/community-scripts/core/pull/211))
+
+### 📚 Documentation
+
+  - ci: reject DevScripts URLs in scripts [@MickLesk](https://github.com/MickLesk) ([#18498](https://github.com/community-scripts/ProxmoxVE/pull/18498))
+
+## 2026-11-05
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - OpenWRT-VM: leave the NIC untagged on a bridge without a port [@MickLesk](https://github.com/MickLesk) ([#18473](https://github.com/community-scripts/ProxmoxVE/pull/18473))
+    - Podman: skip Portainer where Podman has no Quadlet [@MickLesk](https://github.com/MickLesk) ([#18469](https://github.com/community-scripts/ProxmoxVE/pull/18469))
+    - Planka: change npm start argument to --production [@CerberusStyle](https://github.com/CerberusStyle) ([#18478](https://github.com/community-scripts/ProxmoxVE/pull/18478))
+    - OPNsense VM: wait for the FreeBSD login prompt instead of 180 seconds [@MickLesk](https://github.com/MickLesk) ([#18467](https://github.com/community-scripts/ProxmoxVE/pull/18467))
+
+  - #### 🔧 Refactor
+
+    - truenas-VM: let a failed ISO lookup reach its own error [@MickLesk](https://github.com/MickLesk) ([#18476](https://github.com/community-scripts/ProxmoxVE/pull/18476))
+    - proxmox-mail-gateway: take the repo suite from the container  [@MickLesk](https://github.com/MickLesk) ([#18475](https://github.com/community-scripts/ProxmoxVE/pull/18475))
+    - Immich: Bump to 3.3.6 and minor improvement [@MickLesk](https://github.com/MickLesk) ([#18474](https://github.com/community-scripts/ProxmoxVE/pull/18474))
+    - Tududi: run 2.0 on PostgreSQL, keep SQLite installs on 1.15.0 [@MickLesk](https://github.com/MickLesk) ([#18465](https://github.com/community-scripts/ProxmoxVE/pull/18465))
+
+### 💾 Core
+
+  - fix: keep the existing install until the new archive has extracted [@rcourtman](https://github.com/rcourtman) ([core#201](https://github.com/community-scripts/core/pull/201))
+- fix: keep the install when a clone or an Alpine extract fails [@rcourtman](https://github.com/rcourtman) ([core#210](https://github.com/community-scripts/core/pull/210))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - Arcane: write both env names, stop shipping the unused .env [@MickLesk](https://github.com/MickLesk) ([#18466](https://github.com/community-scripts/ProxmoxVE/pull/18466))
+
+## 2026-11-04
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Teleport: Poll readyz instead of fixed 10 second sleep. [@cthach](https://github.com/cthach) ([#18461](https://github.com/community-scripts/ProxmoxVE/pull/18461))
+    - n8n: install past its unsatisfiable canvas dependencies [@MickLesk](https://github.com/MickLesk) ([#18439](https://github.com/community-scripts/ProxmoxVE/pull/18439))
+    - Teable: add Redis cache [@MickLesk](https://github.com/MickLesk) ([#18450](https://github.com/community-scripts/ProxmoxVE/pull/18450))
+
+### 💾 Core
+
+  - feat: say why download_gpg_key failed [@MickLesk](https://github.com/MickLesk) ([core#208](https://github.com/community-scripts/core/pull/208))
+- feat: read the MOTD's OS version at login [@MickLesk](https://github.com/MickLesk) ([core#207](https://github.com/community-scripts/core/pull/207))
+- feat: skip screen clear when there is no terminal | pin only the scripts own app with var_appversion [@MickLesk](https://github.com/MickLesk) ([core#203](https://github.com/community-scripts/core/pull/203))
+
+## 2026-11-03
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Fedora VM: let the engine install libguestfs-tools [@MickLesk](https://github.com/MickLesk) ([#18422](https://github.com/community-scripts/ProxmoxVE/pull/18422))
+    - Cinephage: run the camoufox binary the package now ships [@MickLesk](https://github.com/MickLesk) ([#18426](https://github.com/community-scripts/ProxmoxVE/pull/18426))
+    - AlmaLinux VM: report failures through the engine's error handler [@MickLesk](https://github.com/MickLesk) ([#18418](https://github.com/community-scripts/ProxmoxVE/pull/18418))
+    - WireGuard: give the Debian container 1 GB for WGDashboard [@MickLesk](https://github.com/MickLesk) ([#18419](https://github.com/community-scripts/ProxmoxVE/pull/18419))
+    - zabbix: use os specific apt packages [@MickLesk](https://github.com/MickLesk) ([#18417](https://github.com/community-scripts/ProxmoxVE/pull/18417))
+    - Discourse: build libvips 8.18 for its image worker [@MickLesk](https://github.com/MickLesk) ([#18430](https://github.com/community-scripts/ProxmoxVE/pull/18430))
+    - Wazuh: show the installer's own error when it fails [@MickLesk](https://github.com/MickLesk) ([#18428](https://github.com/community-scripts/ProxmoxVE/pull/18428))
+    - Tracearr: move to Node.js 26 [@connorgallopo](https://github.com/connorgallopo) ([#18393](https://github.com/community-scripts/ProxmoxVE/pull/18393))
+
+  - #### ✨ New Features
+
+    - Wiki.js: install 3.x [@MickLesk](https://github.com/MickLesk) ([#18382](https://github.com/community-scripts/ProxmoxVE/pull/18382))
+
+  - #### 🔧 Refactor
+
+    - OpenWrt VM: read the stable release from downloads.openwrt.org [@MickLesk](https://github.com/MickLesk) ([#18411](https://github.com/community-scripts/ProxmoxVE/pull/18411))
+    - Immich: fetch VectorChord from its new repo, skip Java, get GeoNames first [@MickLesk](https://github.com/MickLesk) ([#18397](https://github.com/community-scripts/ProxmoxVE/pull/18397))
+
+### 💾 Core
+
+  - fix: put the reason for a VM failure into its trace [@MickLesk](https://github.com/MickLesk) ([core#200](https://github.com/community-scripts/core/pull/200))
+- fix: check the bridge before creating a container, and its state after start [@MickLesk](https://github.com/MickLesk) ([core#199](https://github.com/community-scripts/core/pull/199))
+- ref: offer to remove only the container this run created [@MickLesk](https://github.com/MickLesk) ([core#198](https://github.com/community-scripts/core/pull/198))
+- feat: report a cancelled tool dialog as an abort and name the failing command [@MickLesk](https://github.com/MickLesk) ([core#197](https://github.com/community-scripts/core/pull/197))
+- feat: check KVM and the host's threads before building a VM [@MickLesk](https://github.com/MickLesk) ([core#196](https://github.com/community-scripts/core/pull/196))
+- ref: give a host tool one log file for the whole run [@MickLesk](https://github.com/MickLesk) ([core#194](https://github.com/community-scripts/core/pull/194))
+- fix: keep a piped stdin when output moves to the log after a hangup [@MickLesk](https://github.com/MickLesk) ([core#193](https://github.com/community-scripts/core/pull/193))
+- fix: pve-LXC: say when the container went away during its setup [@MickLesk](https://github.com/MickLesk) ([core#192](https://github.com/community-scripts/core/pull/192))
+- fix: treat Esc in a VM wizard dialog as leaving the script [@MickLesk](https://github.com/MickLesk) ([core#190](https://github.com/community-scripts/core/pull/190))
+- ref: count a container stopped during a detached install as an abort [@MickLesk](https://github.com/MickLesk) ([core#187](https://github.com/community-scripts/core/pull/187))
+- feat: find the assets of a renamed GitHub repo without the API [@MickLesk](https://github.com/MickLesk) ([core#188](https://github.com/community-scripts/core/pull/188))
+- fix: restore npm when an interrupted update left it behind [@MickLesk](https://github.com/MickLesk) ([core#189](https://github.com/community-scripts/core/pull/189))
+- feat: add var_cmode to set the container console mode [@MickLesk](https://github.com/MickLesk) ([core#180](https://github.com/community-scripts/core/pull/180))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - all-templates: answering No or Cancel is not a failure [@MickLesk](https://github.com/MickLesk) ([#18423](https://github.com/community-scripts/ProxmoxVE/pull/18423))
+    - homebrew: skip service accounts when picking the user, survive a failed apt update [@MickLesk](https://github.com/MickLesk) ([#18424](https://github.com/community-scripts/ProxmoxVE/pull/18424))
+    - add-tailscale-lxc: start a stopped container and check its OS first [@MickLesk](https://github.com/MickLesk) ([#18421](https://github.com/community-scripts/ProxmoxVE/pull/18421))
+    - netdata: survive a failed apt update, leave quietly on Cancel [@MickLesk](https://github.com/MickLesk) ([#18427](https://github.com/community-scripts/ProxmoxVE/pull/18427))
+    - Privilege-Converter: offer only container-capable storages as the converter's restore target [@MickLesk](https://github.com/MickLesk) ([#18415](https://github.com/community-scripts/ProxmoxVE/pull/18415))
+    - let post-pve-install go on when legacy sources are kept [@MickLesk](https://github.com/MickLesk) ([#18403](https://github.com/community-scripts/ProxmoxVE/pull/18403))
+
+  - #### 🔧 Refactor
+
+    -  update-apps: say why an backup or restore failed [@MickLesk](https://github.com/MickLesk) ([#18405](https://github.com/community-scripts/ProxmoxVE/pull/18405))
+    - Keep host tools running when clear does not know the terminal [@MickLesk](https://github.com/MickLesk) ([#18412](https://github.com/community-scripts/ProxmoxVE/pull/18412))
+    - Refuse to run the PBS 4 upgrade on a Proxmox VE host [@MickLesk](https://github.com/MickLesk) ([#18416](https://github.com/community-scripts/ProxmoxVE/pull/18416))
+    - fstrim: keep trimming when pct fstrim fails on one container [@MickLesk](https://github.com/MickLesk) ([#18413](https://github.com/community-scripts/ProxmoxVE/pull/18413))
+    - execute-lxc: do not abort on a container that is not Debian or Ubuntu [@MickLesk](https://github.com/MickLesk) ([#18414](https://github.com/community-scripts/ProxmoxVE/pull/18414))
+
+### 📚 Documentation
+
+  - github: flag instead of closing on first PR template miss; add script-request eligibility check [@MickLesk](https://github.com/MickLesk) ([#18384](https://github.com/community-scripts/ProxmoxVE/pull/18384))
+
+## 2026-11-02
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - FileFlows: replace the program folders on update [@MickLesk](https://github.com/MickLesk) ([#18380](https://github.com/community-scripts/ProxmoxVE/pull/18380))
+    - anchor: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18373](https://github.com/community-scripts/ProxmoxVE/pull/18373))
+    - guardian: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18375](https://github.com/community-scripts/ProxmoxVE/pull/18375))
+    - nametag: bump Node.js from 20 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18376](https://github.com/community-scripts/ProxmoxVE/pull/18376))
+
+### 💾 Core
+
+  - github: trim theater, add signal to the engine bug report; move AI block to end of PR template [@MickLesk](https://github.com/MickLesk) ([core#186](https://github.com/community-scripts/core/pull/186))
+- fix: do not wait forever for verbose output a daemon keeps open [@MickLesk](https://github.com/MickLesk) ([core#185](https://github.com/community-scripts/core/pull/185))
+
+## 2026-11-01
+
+### 🆕 New Scripts
+
+  - Amazon Linux ([#18369](https://github.com/community-scripts/ProxmoxVE/pull/18369))
+- CachyOS VM ([#18368](https://github.com/community-scripts/ProxmoxVE/pull/18368))
+- Razzia ([#18366](https://github.com/community-scripts/ProxmoxVE/pull/18366))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(zerobyte): build the bundled local agent [@nicotsx](https://github.com/nicotsx) ([#18363](https://github.com/community-scripts/ProxmoxVE/pull/18363))
@@ -0,0 +1,27 @@
+name: Check Script Repo URL
+
+on:
+  pull_request:
+    branches: ["main"]
+    paths:
+      - "ct/**"
+      - "install/**"
+      - "vm/**"
+      - "tools/**"
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    if: github.repository == 'community-scripts/ProxmoxVE'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Reject DevScripts URLs
+        run: |
+          if grep -rnE 'community-scripts/(ProxmoxVED|DevScripts)/' ct install vm tools; then
+            echo "::error::These lines point at DevScripts, so telemetry files the runs there. Use community-scripts/ProxmoxVE."
+            exit 1
+          fi
@@ -125,6 +125,9 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit



+
+
+



@@ -137,6 +140,13 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 <summary><h3>2026</h3></summary>


+<details>
+<summary><h4>November (7 entries)</h4></summary>
+
+[View November 2026 Changelog](.github/changelogs/2026/11.md)
+
+</details>
+
 <details>
 <summary><h4>October (31 entries)</h4></summary>

@@ -571,11 +581,68 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 </details>

-## 2026-11-06
+## 2026-11-08
+
+### 🆕 New Scripts
+
+  - Chatto ([#18521](https://github.com/community-scripts/ProxmoxVE/pull/18521))
+- Firefox-Syncserver ([#18520](https://github.com/community-scripts/ProxmoxVE/pull/18520))
+
+### 🚀 Updated Scripts
+
+  - #### 🔧 Refactor
+
+    - Databasus: build 3.65 and ship the verification agent [@MickLesk](https://github.com/MickLesk) ([#18500](https://github.com/community-scripts/ProxmoxVE/pull/18500))
+
+## 2026-11-07
+
+### 🆕 New Scripts
+
+  - EspoCRM ([#18519](https://github.com/community-scripts/ProxmoxVE/pull/18519))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - RomM: emit player isolation headers from the serving location [@adotagarwal](https://github.com/adotagarwal) ([#18511](https://github.com/community-scripts/ProxmoxVE/pull/18511))
+
+  - #### 💥 Breaking Changes
+
+    - fix: gotenberg: update to v9 [@CrazyWolf13](https://github.com/CrazyWolf13) ([#18491](https://github.com/community-scripts/ProxmoxVE/pull/18491))

 ### 💾 Core

-  - fix: report a container that went down during setup, keep finished installs [@MickLesk](https://github.com/MickLesk) ([core#211](https://github.com/community-scripts/core/pull/211))
+  - nvidia: close the hardware acceleration step when no GPU is usable | pin the whole NVIDIA userspace to the host's driver version [@MickLesk](https://github.com/MickLesk) ([core#215](https://github.com/community-scripts/core/pull/215))
+- fix: stage release downloads on disk, not in /tmp [@rcourtman](https://github.com/rcourtman) ([core#218](https://github.com/community-scripts/core/pull/218))
+- Minor fixes: restart php-fpm during sigpipe, Install jq for forge commands  [@MickLesk](https://github.com/MickLesk) ([core#213](https://github.com/community-scripts/core/pull/213))
+- incus: name the project restriction that refuses an Incus launch [@MickLesk](https://github.com/MickLesk) ([core#214](https://github.com/community-scripts/core/pull/214))
+
+## 2026-11-06
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - UmbrelOS-VM: report runs as ProxmoxVE, not DevScripts [@MickLesk](https://github.com/MickLesk) ([#18497](https://github.com/community-scripts/ProxmoxVE/pull/18497))
+    - Caddy: skip the xCaddy test build below 2 GB RAM [@MickLesk](https://github.com/MickLesk) ([#18472](https://github.com/community-scripts/ProxmoxVE/pull/18472))
+    - Thingsboard: keep the package defaults in thingsboard.conf [@MickLesk](https://github.com/MickLesk) ([#18499](https://github.com/community-scripts/ProxmoxVE/pull/18499))
+    - Nexterm: keep the extracted app out of the /tmp cleanup [@MickLesk](https://github.com/MickLesk) ([#18501](https://github.com/community-scripts/ProxmoxVE/pull/18501))
+    - PLANKA: run the service with node instead of nodemon [@MickLesk](https://github.com/MickLesk) ([#18503](https://github.com/community-scripts/ProxmoxVE/pull/18503))
+    - MeTube/Yubal: install Deno without its shell setup [@MickLesk](https://github.com/MickLesk) ([#18406](https://github.com/community-scripts/ProxmoxVE/pull/18406))
+    - OPNsense VM: size the temp space check to the unpacked image |  say why the EFI disk could not be allocated [@MickLesk](https://github.com/MickLesk) ([#18404](https://github.com/community-scripts/ProxmoxVE/pull/18404))
+
+  - #### 🔧 Refactor
+
+    - Technitium DNS: read the version from its GitHub releases [@MickLesk](https://github.com/MickLesk) ([#18425](https://github.com/community-scripts/ProxmoxVE/pull/18425))
+
+### 💾 Core
+
+  - fix: spot same-filesystem bind mounts on Alpine [@rcourtman](https://github.com/rcourtman) ([core#212](https://github.com/community-scripts/core/pull/212))
+- fix: report a container that went down during setup, keep finished installs [@MickLesk](https://github.com/MickLesk) ([core#211](https://github.com/community-scripts/core/pull/211))
+
+### 📚 Documentation
+
+  - ci: reject DevScripts URLs in scripts [@MickLesk](https://github.com/MickLesk) ([#18498](https://github.com/community-scripts/ProxmoxVE/pull/18498))

 ## 2026-11-05

@@ -1298,189 +1365,4 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

  - #### ✨ New Features

-    - FileBrowser Quantum: migrate the config and database to v2 [@MickLesk](https://github.com/MickLesk) ([#17815](https://github.com/community-scripts/ProxmoxVE/pull/17815))
-
-## 2026-10-08
-
-### 🆕 New Scripts
-
-  - Unifi-OS-Server VM ([#17752](https://github.com/community-scripts/ProxmoxVE/pull/17752))
- ZimaOS VM ([#17778](https://github.com/community-scripts/ProxmoxVE/pull/17778))
-
-### 🚀 Updated Scripts
-
-  - Revert "Immich: Pin to v3.3.0" [@MickLesk](https://github.com/MickLesk) ([#17767](https://github.com/community-scripts/ProxmoxVE/pull/17767))
-
-  - #### 🐞 Bug Fixes
-
-    - Homarr: replace the musl better-sqlite3 that v2.3.0 ships for Debian [@MickLesk](https://github.com/MickLesk) ([#17789](https://github.com/community-scripts/ProxmoxVE/pull/17789))
-    - CLIProxyAPI: keep plugins and data across updates [@MickLesk](https://github.com/MickLesk) ([#17790](https://github.com/community-scripts/ProxmoxVE/pull/17790))
-    - Kima-Hub: install the Python services into a uv venv [@MickLesk](https://github.com/MickLesk) ([#17791](https://github.com/community-scripts/ProxmoxVE/pull/17791))
-
-  - #### ✨ New Features
-
-    - Immich: Pin to 3.3.0 / Update ML Python to 3.13 [@MickLesk](https://github.com/MickLesk) ([#17770](https://github.com/community-scripts/ProxmoxVE/pull/17770))
-
-  - #### 🔧 Refactor
-
-    - Refactor: OPNsense VM [@MickLesk](https://github.com/MickLesk) ([#17785](https://github.com/community-scripts/ProxmoxVE/pull/17785))
-    - Refactor: Nextcloud VM (Turnkey) [@MickLesk](https://github.com/MickLesk) ([#17787](https://github.com/community-scripts/ProxmoxVE/pull/17787))
-    - Refactor: OpenWrt VM [@MickLesk](https://github.com/MickLesk) ([#17774](https://github.com/community-scripts/ProxmoxVE/pull/17774))
-    - Refactor: Ubuntu VM [@MickLesk](https://github.com/MickLesk) ([#17776](https://github.com/community-scripts/ProxmoxVE/pull/17776))
-
-### 💾 Core
-
-  - Tolerate a missing datacenter.cfg in vm_keyboard_default [@MickLesk](https://github.com/MickLesk) ([core#124](https://github.com/community-scripts/core/pull/124))
- Take the ISO storage from the disk pool when it can hold ISOs [@MickLesk](https://github.com/MickLesk) ([core#122](https://github.com/community-scripts/core/pull/122))
- Shared VM helpers: disk import, releases, checksums, first boot, IP by MAC [@MickLesk](https://github.com/MickLesk) ([core#117](https://github.com/community-scripts/core/pull/117))
- tools: forge truncated release list [@MickLesk](https://github.com/MickLesk) ([core#118](https://github.com/community-scripts/core/pull/118))
- Remember a kept cached image until the upstream changes [@MickLesk](https://github.com/MickLesk) ([core#119](https://github.com/community-scripts/core/pull/119))
- Choose the VM keyboard layout and carry the host's timezone into prepared images [@MickLesk](https://github.com/MickLesk) ([core#120](https://github.com/community-scripts/core/pull/120))
- VM's: run first-boot units without debconf dialogs [@MickLesk](https://github.com/MickLesk) ([core#121](https://github.com/community-scripts/core/pull/121))
-
-## 2026-10-07
-
-### 🆕 New Scripts
-
-  - Fedora VM ([#17747](https://github.com/community-scripts/ProxmoxVE/pull/17747))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - AudioMuse-AI: replace the venv on update without asking [@MickLesk](https://github.com/MickLesk) ([#17738](https://github.com/community-scripts/ProxmoxVE/pull/17738))
-    - paperclip: run as a dedicated non-root user so Claude Code can skip permissions [@samvandenbossche](https://github.com/samvandenbossche) ([#17707](https://github.com/community-scripts/ProxmoxVE/pull/17707))
-    - Thingsboard: update Java version from 17 to 25 [@CerberusStyle](https://github.com/CerberusStyle) ([#17733](https://github.com/community-scripts/ProxmoxVE/pull/17733))
-
-  - #### ✨ New Features
-
-    - Immich: Pin to v3.3.0 [@vhsdream](https://github.com/vhsdream) ([#17759](https://github.com/community-scripts/ProxmoxVE/pull/17759))
-
-  - #### 💥 Breaking Changes
-
-    - OpenCloud: bump to v8.1.0, rebuild search index on upgrade [@SimKaiLong](https://github.com/SimKaiLong) ([#17710](https://github.com/community-scripts/ProxmoxVE/pull/17710))
-
-  - #### 🔧 Refactor
-
-    - Pangolin: Unpin Release, stable enough, Bump to latest [@MickLesk](https://github.com/MickLesk) ([#17740](https://github.com/community-scripts/ProxmoxVE/pull/17740))
-    - Refactor: Archlinux-VM [@MickLesk](https://github.com/MickLesk) ([#17741](https://github.com/community-scripts/ProxmoxVE/pull/17741))
-    - Refactor: MikroTik RouterOS [@MickLesk](https://github.com/MickLesk) ([#17748](https://github.com/community-scripts/ProxmoxVE/pull/17748))
-
-### 💾 Core
-
-  - Fix Fedora and BLS cloud image console setup [@MickLesk](https://github.com/MickLesk) ([core#116](https://github.com/community-scripts/core/pull/116))
- Keep setup_nodejs alive when the caller's directory is gone [@MickLesk](https://github.com/MickLesk) ([core#114](https://github.com/community-scripts/core/pull/114))
-
-## 2026-10-06
-
-### 🆕 New Scripts
-
-  - Pricebuddy ([#17708](https://github.com/community-scripts/ProxmoxVE/pull/17708))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Webtrees: stop serving data/ and the source folders directly [@MickLesk](https://github.com/MickLesk) ([#17724](https://github.com/community-scripts/ProxmoxVE/pull/17724))
-
-### 💾 Core
-
-  - Incus: check the architecture on Incus hosts too [@MickLesk](https://github.com/MickLesk) ([core#113](https://github.com/community-scripts/core/pull/113))
- Incus: Pass the app's var_* settings into Incus containers  [@MickLesk](https://github.com/MickLesk) ([core#112](https://github.com/community-scripts/core/pull/112))
- Incus: stub storage_content_check on Incus [@MickLesk](https://github.com/MickLesk) ([core#104](https://github.com/community-scripts/core/pull/104))
- Incus: map Proxmox template versions to Incus image names [@MickLesk](https://github.com/MickLesk) ([core#111](https://github.com/community-scripts/core/pull/111))
- Incus: read storage names from .vars files  [@MickLesk](https://github.com/MickLesk) ([core#110](https://github.com/community-scripts/core/pull/110))
- Incus: show the spinner inside containers again [@MickLesk](https://github.com/MickLesk) ([core#109](https://github.com/community-scripts/core/pull/109))
- Incus: set the hostname with sh, so it works before bash is installed [@MickLesk](https://github.com/MickLesk) ([core#102](https://github.com/community-scripts/core/pull/102))
- Incus: reserve a plain address on Incus, leave the gateway to the network [@MickLesk](https://github.com/MickLesk) ([core#101](https://github.com/community-scripts/core/pull/101))
- Incus: Wait for the network on Alpine OS too [@MickLesk](https://github.com/MickLesk) ([core#105](https://github.com/community-scripts/core/pull/105))
- Incus: do not fail the build when hostname -I is missing [@MickLesk](https://github.com/MickLesk) ([core#103](https://github.com/community-scripts/core/pull/103))
- Incus: Fuse always in unprivileged Containers, attach TUN only when container lacks it [@MickLesk](https://github.com/MickLesk) ([core#108](https://github.com/community-scripts/core/pull/108))
- Incus: accept mode=generated [@MickLesk](https://github.com/MickLesk) ([core#106](https://github.com/community-scripts/core/pull/106))
- Incus: pass the full install environment into Incus containers (quoted) [@MickLesk](https://github.com/MickLesk) ([core#107](https://github.com/community-scripts/core/pull/107))
-
-## 2026-10-05
-
-### 🚀 Updated Scripts
-
-  - Point to DevScripts, the renamed ProxmoxVED [@MickLesk](https://github.com/MickLesk) ([#17694](https://github.com/community-scripts/ProxmoxVE/pull/17694))
-
-  - #### 🐞 Bug Fixes
-
-    - wanderer: set the proxy secret and install plugins in their own directories [@MickLesk](https://github.com/MickLesk) ([#17698](https://github.com/community-scripts/ProxmoxVE/pull/17698))
-    - discourse: serve stylesheets and repair the update [@MickLesk](https://github.com/MickLesk) ([#17697](https://github.com/community-scripts/ProxmoxVE/pull/17697))
-    - wikijs: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17689](https://github.com/community-scripts/ProxmoxVE/pull/17689))
-    - jotty: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17688](https://github.com/community-scripts/ProxmoxVE/pull/17688))
-
-### 💾 Core
-
-  - Read releases from github.com when the API is rate limited, resume stalled downloads [@MickLesk](https://github.com/MickLesk) ([core#99](https://github.com/community-scripts/core/pull/99))
- Check for template and container storage before the settings menu [@MickLesk](https://github.com/MickLesk) ([core#98](https://github.com/community-scripts/core/pull/98))
- Check /etc/pve before the settings menu [@MickLesk](https://github.com/MickLesk) ([core#97](https://github.com/community-scripts/core/pull/97))
- Check container settings before pct create rejects them [@MickLesk](https://github.com/MickLesk) ([core#96](https://github.com/community-scripts/core/pull/96))
- PVE: Smart Diagnosis - say why a container would not start [@MickLesk](https://github.com/MickLesk) ([core#95](https://github.com/community-scripts/core/pull/95))
- Retry template downloads that pveam reports as done but are not [@MickLesk](https://github.com/MickLesk) ([core#94](https://github.com/community-scripts/core/pull/94))
- Check the OS release against pve-container before creating anything [@MickLesk](https://github.com/MickLesk) ([core#93](https://github.com/community-scripts/core/pull/93))
- Rename "ProxmoxVED"-Links to "DevScripts" [@MickLesk](https://github.com/MickLesk) ([core#91](https://github.com/community-scripts/core/pull/91))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - monitor-all: read container IPs from the host side [@jasonobrien](https://github.com/jasonobrien) ([#17686](https://github.com/community-scripts/ProxmoxVE/pull/17686))
-
-## 2026-10-04
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - immich: read the Intel runtime from the pinned release [@MickLesk](https://github.com/MickLesk) ([#17677](https://github.com/community-scripts/ProxmoxVE/pull/17677))
-
-### 💾 Core
-
-  - better explain unsupported version & upgrade path for pve [@MickLesk](https://github.com/MickLesk) ([core#86](https://github.com/community-scripts/core/pull/86))
- Quote PostgreSQL identifiers and drop spaces from the creds file name [@MickLesk](https://github.com/MickLesk) ([core#89](https://github.com/community-scripts/core/pull/89))
- Find the default Rust toolchain in current rustup output [@MickLesk](https://github.com/MickLesk) ([core#88](https://github.com/community-scripts/core/pull/88))
-
-## 2026-10-03
-
-### 🆕 New Scripts
-
-  - Keeper.sh ([#17659](https://github.com/community-scripts/ProxmoxVE/pull/17659))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - hermesagent: download the installer before running it [@MickLesk](https://github.com/MickLesk) ([#17666](https://github.com/community-scripts/ProxmoxVE/pull/17666))
-    - frigate: raise the Node heap for the web build [@MickLesk](https://github.com/MickLesk) ([#17667](https://github.com/community-scripts/ProxmoxVE/pull/17667))
-    - Tracearr: workaround for failing map tiles download and data preservation [@durzo](https://github.com/durzo) ([#17661](https://github.com/community-scripts/ProxmoxVE/pull/17661))
-    - fix(nginxproxymanager): clean yarn cache after builds to prevent disk growth [@PsycoStea](https://github.com/PsycoStea) ([#17653](https://github.com/community-scripts/ProxmoxVE/pull/17653))
-
-  - #### 🔧 Refactor
-
-    - Several Scripts: refactor msg_ blocks, generate passwords with helper, add CLEAN_INSTALL_KEEP  [@MickLesk](https://github.com/MickLesk) ([#17655](https://github.com/community-scripts/ProxmoxVE/pull/17655))
-
-### 💾 Core
-
-  - detect_repo_source: read the license header and fall back to ProxmoxVE [@MickLesk](https://github.com/MickLesk) ([core#85](https://github.com/community-scripts/core/pull/85))
-
-## 2026-10-02
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - zerobyte: upgrade Bun on update [@MickLesk](https://github.com/MickLesk) ([#17646](https://github.com/community-scripts/ProxmoxVE/pull/17646))
-    - sure: keep Active Storage uploads across updates [@MickLesk](https://github.com/MickLesk) ([#17648](https://github.com/community-scripts/ProxmoxVE/pull/17648))
-    - twenty: run upstreams upgrade command instead of the removed setup-db.ts [@MickLesk](https://github.com/MickLesk) ([#17647](https://github.com/community-scripts/ProxmoxVE/pull/17647))
-
-  - #### 🔧 Refactor
-
-    - NPM: Refactor / Fix npm openresty user and certbot version [@MickLesk](https://github.com/MickLesk) ([#17649](https://github.com/community-scripts/ProxmoxVE/pull/17649))
-    - several scripts: use the release helpers instead of hand-rolled version checks and downloads [@MickLesk](https://github.com/MickLesk) ([#17625](https://github.com/community-scripts/ProxmoxVE/pull/17625))
-
-### 💾 Core
-
-  - QoL: message blocks, clean-install keep list, password helper, network limits [@MickLesk](https://github.com/MickLesk) ([core#61](https://github.com/community-scripts/core/pull/61))
+    - FileBrowser Quantum: migrate the config and database to v2 [@MickLesk](https://github.com/MickLesk) ([#17815](https://github.com/community-scripts/ProxmoxVE/pull/17815))
@@ -55,9 +55,13 @@ update_deb_based() {
      setup_go
      fetch_and_deploy_gh_release "xcaddy" "caddyserver/xcaddy" "binary"

-      msg_info "Updating xCaddy"
-      $STD xcaddy build
-      msg_ok "Updated xCaddy"
+      if (($(awk '/^MemTotal:/ {print int($2 / 1024)}' /proc/meminfo) < 1900)); then
+        msg_warn "xCaddy updated; its test build was skipped because linking Caddy needs about 2 GB RAM"
+      else
+        msg_info "Updating xCaddy"
+        $STD xcaddy build
+        msg_ok "Updated xCaddy"
+      fi
    fi
  fi
  msg_ok "Updated successfully!"
@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/chattocorp/chatto
+
+APP="Chatto"
+var_tags="${var_tags:-chat;messaging}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/chatto ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "chatto" "chattocorp/chatto"; then
+    msg_info "Stopping Service"
+    systemctl stop chatto
+    msg_ok "Stopped Service"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "chatto" "chattocorp/chatto" "prebuild" "latest" "/opt/chatto" "chatto_Linux_$(arch_resolve x86_64 arm64).tar.gz"
+    chmod +x /opt/chatto/chatto
+
+    msg_info "Starting Service"
+    systemctl start chatto
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:4000${CL}"
@@ -38,57 +38,29 @@ function update_script() {
    $STD systemctl stop databasus
    msg_ok "Stopped Databasus"

-    create_backup /opt/databasus/.env
-
-    msg_info "Ensuring Database Clients"
-    # Create PostgreSQL version symlinks for compatibility
-    for v in 12 13 14 15 16 18; do
-      ln -sf /usr/lib/postgresql/17 /usr/lib/postgresql/$v
-    done
-    # Install MongoDB Database Tools via direct .deb (no APT repo for Debian 13)
-    if ! command -v mongodump &>/dev/null; then
-      [[ "$(get_os_info id)" == "ubuntu" ]] && MONGO_DIST="ubuntu2204" || MONGO_DIST="debian12"
-      MONGO_ARCH=$(arch_resolve "x86_64" "arm64")
-      # MongoDB only publishes arm64 builds for Ubuntu
-      [[ "$MONGO_ARCH" == "arm64" ]] && MONGO_DIST="ubuntu2204"
-      fetch_and_deploy_from_url "https://fastdl.mongodb.org/tools/db/mongodb-database-tools-${MONGO_DIST}-${MONGO_ARCH}-100.16.1.deb"
-    fi
-    ensure_dependencies mariadb-client
-    mkdir -p /usr/local/mariadb-{10.6,12.1}/bin /usr/local/mysql-{5.7,8.0,8.4,9}/bin /usr/local/mongodb-database-tools/bin
-    [[ -f /usr/bin/mongodump ]] && ln -sf /usr/bin/mongodump /usr/local/mongodb-database-tools/bin/mongodump
-    [[ -f /usr/bin/mongorestore ]] && ln -sf /usr/bin/mongorestore /usr/local/mongodb-database-tools/bin/mongorestore
-    # Create MariaDB and MySQL client symlinks for compatibility
-    for dir in /usr/local/mariadb-{10.6,12.1}/bin; do
-      ln -sf /usr/bin/mariadb-dump "$dir/mariadb-dump"
-      ln -sf /usr/bin/mariadb "$dir/mariadb"
-    done
-    for dir in /usr/local/mysql-{5.7,8.0,8.4,9}/bin; do
-      ln -sf /usr/bin/mariadb-dump "$dir/mysqldump"
-      ln -sf /usr/bin/mariadb "$dir/mysql"
-    done
-    msg_ok "Ensured Database Clients"
-
+    ensure_dependencies libedit2 libgssapi-krb5-2 libncurses6 libreadline8t64
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "databasus" "databasus/databasus" "tarball" "latest" "/opt/databasus"
    GO_VERSION="$(grep -m1 '^go ' /opt/databasus/backend/go.mod | awk '{print $2}')" setup_go

    msg_info "Updating Databasus"
+    RELEASE=$(cat ~/.databasus)
    export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
    cd /opt/databasus/frontend
-
    $STD corepack prepare pnpm@latest --activate
    $STD pnpm install --frozen-lockfile
-    $STD pnpm run build
+    $STD env VITE_APP_VERSION="${RELEASE}" pnpm run build
    cd /opt/databasus/backend
-    $STD go mod download
-    $STD /root/go/bin/swag init -g cmd/main.go -o swagger
-    $STD env CGO_ENABLED=0 GOOS=linux GOARCH=$(arch_resolve) go build -o databasus ./cmd
-    mv /opt/databasus/backend/databasus /opt/databasus/databasus
+    $STD env CGO_ENABLED=0 GOOS=linux GOARCH="$(arch_resolve)" go build -o /opt/databasus/databasus ./cmd/databasus
+    mkdir -p /opt/databasus/agent-binaries
+    for arch in amd64 arm64; do
+      $STD env CGO_ENABLED=0 GOOS=linux GOARCH=$arch go build -ldflags "-X main.Version=${RELEASE}" -o /opt/databasus/agent-binaries/databasus-verification-agent-linux-$arch ./cmd/verification-agent
+    done
    mkdir -p /opt/databasus/ui/build
    cp -r /opt/databasus/frontend/dist/* /opt/databasus/ui/build/
-    cp -r /opt/databasus/backend/migrations /opt/databasus/
+    sed -i '/^APP_VERSION=/d' /.env
+    echo "APP_VERSION=${RELEASE}" >>/.env
    msg_ok "Updated Databasus"

-    restore_backup
    chown -R postgres:postgres /opt/databasus

    if ! grep -q "EnvironmentFile=/.env" /etc/systemd/system/databasus.service; then
@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Masked-Kunsiquat
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.espocrm.com/ | Github: https://github.com/espocrm/espocrm
+
+APP="EspoCRM"
+var_tags="${var_tags:-crm;business}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+export var_admin_user="${var_admin_user:-}"
+export var_admin_pass="${var_admin_pass:-}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/espocrm ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "espo-crm" "espocrm/espocrm"; then
+    msg_info "Stopping Services"
+    systemctl stop nginx cron php8.4-fpm
+    msg_ok "Stopped Services"
+
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="data custom client/custom" fetch_and_deploy_gh_release "espo-crm" "espocrm/espocrm" "prebuild" "latest" "/opt/espocrm" "EspoCRM-*.zip"
+
+    msg_info "Migrating EspoCRM"
+    cd /opt/espocrm
+    $STD php bin/command clear-cache
+    if ! $STD php bin/command migrate; then
+      chown -R www-data:www-data /opt/espocrm
+      systemctl start php8.4-fpm
+      systemctl start cron nginx
+      msg_error "Migration failed; customizations may be incompatible. Check /opt/espocrm/data/logs, then run update again."
+      exit 1
+    fi
+    chown -R www-data:www-data /opt/espocrm
+    msg_ok "Migrated EspoCRM"
+
+    msg_info "Starting Services"
+    systemctl start php8.4-fpm
+    systemctl start cron nginx
+    msg_ok "Started Services"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}${CL}"
@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/mozilla-services/syncstorage-rs
+
+APP="Firefox-Syncserver"
+var_tags="${var_tags:-sync;firefox}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-3072}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-yes}" # built from source, nothing x86-only, but not yet run on arm64
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /usr/local/bin/syncserver ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "firefox-syncserver" "mozilla-services/syncstorage-rs"; then
+    msg_info "Stopping Firefox Syncserver"
+    systemctl stop firefox-syncserver
+    msg_ok "Stopped Firefox Syncserver"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "firefox-syncserver" "mozilla-services/syncstorage-rs" "tarball"
+    setup_rust
+
+    msg_info "Building Firefox Syncserver (Patience)"
+    cd /opt/firefox-syncserver
+    $STD cargo build --release --locked --no-default-features --features=syncstorage-db/postgres --features=tokenserver-db/postgres --features=py_verifier
+    cp target/release/syncserver /usr/local/bin/syncserver
+    rm -rf target
+    $STD uv venv --python /usr/bin/python3 /opt/firefox-syncserver/.venv
+    $STD uv pip install --python /opt/firefox-syncserver/.venv/bin/python pyfxa tokenlib cryptography
+    msg_ok "Built Firefox Syncserver"
+
+    msg_info "Starting Firefox Syncserver"
+    systemctl start firefox-syncserver
+    msg_ok "Started Firefox Syncserver"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}In Firefox, set identity.sync.tokenserver.uri in about:config to:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8000/1.0/sync/1.5${CL}"
@@ -45,15 +45,32 @@ function update_script() {
    export CGO_ENABLED=0
    $STD go mod download
    $STD go build -o /usr/local/bin/gotenberg \
-      -ldflags "-s -w -X 'github.com/gotenberg/gotenberg/v8/cmd.Version=$(cat ~/.gotenberg)'" \
+      -ldflags "-s -w -X 'github.com/gotenberg/gotenberg/v9/cmd.Version=$(cat ~/.gotenberg)'" \
      cmd/gotenberg/main.go
    msg_ok "Built gotenberg"

-    msg_info "Updating unoconverter"
-    UNOCONVERTER_VERSION=$(get_latest_github_release "gotenberg/unoconverter" "false")
-    download_file "https://raw.githubusercontent.com/gotenberg/unoconverter/${UNOCONVERTER_VERSION}/unoconv" /usr/local/bin/unoconverter
-    chmod +x /usr/local/bin/unoconverter
-    msg_ok "Updated unoconverter"
+    LOK_VERSION="$(awk -F= '/^ARG LOK_VERSION=/{print $2}' /opt/gotenberg/build/Dockerfile)"
+    fetch_and_deploy_gh_release "lok" "gotenberg/lok" "prebuild" "$LOK_VERSION" "/usr/local/bin" "lok_${LOK_VERSION#v}_linux_$(arch_resolve "amd64" "arm64").tar.gz"
+
+    msg_info "Migrating to Gotenberg 9"
+    CODENAME=$(get_os_info codename)
+    setup_deb822_repo \
+      "debian-backports" \
+      "file:///usr/share/keyrings/debian-archive-keyring.gpg" \
+      "http://deb.debian.org/debian" \
+      "${CODENAME}-backports" \
+      "main"
+    $STD apt install -y fonts-urw-base35
+    $STD apt install -y -t "${CODENAME}-backports" \
+      libreoffice-writer libreoffice-calc libreoffice-impress libreoffice-draw libreoffice-math
+    $STD apt purge -y python3-uno python-is-python3 pdftk-java qpdf libimage-exiftool-perl
+    $STD apt autoremove -y
+    rm -rf /usr/local/bin/unoconverter /usr/local/bin/pdfcpu /opt/pdfcpu
+    sed -i '/^Environment=\(UNOCONVERTER\|PDFTK\|QPDF\|EXIFTOOL\|PDFCPU\)_BIN_PATH=/d' /etc/systemd/system/gotenberg.service
+    grep -q '^Environment=LOK_BIN_PATH=' /etc/systemd/system/gotenberg.service ||
+      sed -i '/^Environment=LIBREOFFICE_BIN_PATH=/a Environment=LOK_BIN_PATH=/usr/local/bin/lok' /etc/systemd/system/gotenberg.service
+    systemctl daemon-reload
+    msg_ok "Migrated to Gotenberg 9"

    msg_info "Starting Service"
    systemctl start gotenberg
@@ -36,7 +36,7 @@ function update_script() {
    source ~/.bashrc
    if ! command -v deno &>/dev/null; then
      export DENO_INSTALL="/usr/local"
-      curl -fsSL https://deno.land/install.sh | $STD sh -s -- -y
+      curl -fsSL https://deno.land/install.sh | CI=1 $STD sh -s
    else
      $STD deno upgrade
    fi
@@ -31,6 +31,8 @@ function update_script() {
    exit
  fi

+  echo "x /tmp/nexterm-sea-*" >/etc/tmpfiles.d/nexterm.conf
+
  if check_for_gh_release "nexterm-engine" "gnmyt/Nexterm"; then
    msg_info "Stopping nexterm-engine"
    systemctl stop nexterm-engine
@@ -46,6 +48,7 @@ function update_script() {
  if check_for_gh_release "nexterm-server" "gnmyt/Nexterm"; then
    msg_info "Stopping nexterm-server"
    systemctl stop nexterm-server
+    rm -rf /tmp/nexterm-sea-*
    msg_ok "Stopped nexterm-server"

    fetch_and_deploy_gh_release "nexterm-server" "gnmyt/Nexterm" "singlefile" "latest" "/opt/nexterm/server" "nexterm-server-linux-$(arch_resolve "x64" "arm64")"
@@ -30,6 +30,15 @@ function update_script() {
    msg_error "No ${APP} Installation Found!"
    exit
  fi
+
+  if ! grep -q "^Environment=HOME=" /etc/systemd/system/planka.service; then
+    msg_info "Updating Service"
+    sed -i -e '/^Environment=NODE_ENV=/d' -e 's|^ExecStart=.*|Environment=NODE_ENV=production\nEnvironment=HOME=/root\nExecStart=/usr/bin/node app.js --prod|' /etc/systemd/system/planka.service
+    systemctl daemon-reload
+    systemctl restart planka
+    msg_ok "Updated Service"
+  fi
+
  if check_for_gh_release "planka" "plankanban/planka"; then
    msg_info "Stopping Service"
    systemctl stop planka
@@ -80,8 +89,6 @@ function update_script() {
    msg_ok "Migrated Database"

    msg_info "Starting Service"
-    sed -i 's|ExecStart=/usr/bin/npm start --prod$|ExecStart=/usr/bin/npm start --production|' /etc/systemd/system/planka.service
-    systemctl daemon-reload
    systemctl start planka
    msg_ok "Started Service"
    msg_ok "Updated successfully!"
@@ -107,8 +107,9 @@ function update_script() {
    ln -sfn "$ROMM_BASE"/resources /opt/romm/frontend/dist/assets/romm/resources
    ln -sfn "$ROMM_BASE"/assets /opt/romm/frontend/dist/assets/romm/assets
    if [[ -f /etc/angie/http.d/romm.conf ]]; then
-      if ! grep -q "js_content decode.decodeBase64" /etc/angie/http.d/romm.conf; then
-        msg_info "Adding missing /decode and /cache locations to Angie config"
+      if ! grep -q "js_content decode.decodeBase64" /etc/angie/http.d/romm.conf ||
+        ! grep -q "coep_header" /etc/angie/http.d/romm.conf; then
+        msg_info "Updating Angie config (decode/cache locations, player isolation headers)"
        dpkg -l angie-module-njs &>/dev/null || $STD apt install -y angie-module-njs
        grep -q "ngx_http_js_module.so" /etc/angie/angie.conf || sed -i '1i load_module modules/ngx_http_js_module.so;' /etc/angie/angie.conf
        mkdir -p /etc/angie/js "${ROMM_BASE}/cache"
@@ -147,6 +148,20 @@ map \$http_upgrade \$connection_upgrade {
    '' close;
 }

+# COEP/COOP for the EmulatorJS and js-dos players (SharedArrayBuffer needs a
+# crossOriginIsolated document). Matched on \$request_uri because try_files
+# rewrites \$uri to /index.html before add_header runs, so a per-location
+# add_header on the player route never fires. Mirrors upstream RomM's
+# docker/nginx/templates/default.conf.template.
+map \$request_uri \$coep_header {
+    default        "";
+    ~^/rom/.*/(ejs|jsdos)(\?|\$) "require-corp";
+}
+map \$request_uri \$coop_header {
+    default        "";
+    ~^/rom/.*/(ejs|jsdos)(\?|\$) "same-origin";
+}
+
 server {
    listen 80;
    server_name _;
@@ -155,6 +170,9 @@ server {

    location / {
        try_files \$uri \$uri/ /index.html;
+        add_header Cache-Control "no-cache";
+        add_header Cross-Origin-Embedder-Policy \$coep_header;
+        add_header Cross-Origin-Opener-Policy \$coop_header;
    }

    location /assets {
@@ -164,12 +182,6 @@ server {
        add_header Cache-Control "public, immutable";
    }

-    location ~ ^/rom/.*/ejs\$ {
-        add_header Cross-Origin-Embedder-Policy "require-corp";
-        add_header Cross-Origin-Opener-Policy "same-origin";
-        try_files \$uri /index.html;
-    }
-
    location /api {
        proxy_pass http://romm_backend;
        proxy_buffering off;
@@ -209,7 +221,7 @@ server {
    }
 }
 EOF
-        msg_ok "Added /decode and /cache locations"
+        msg_ok "Updated Angie config"
      else
        sed -i -e "s|alias .*/library/;|alias ${ROMM_BASE}/library/;|" \
          -e "s|alias .*/cache/;|alias ${ROMM_BASE}/cache/;|" /etc/angie/http.d/romm.conf
@@ -47,7 +47,7 @@ function update_script() {
    $STD apt install -y aspnetcore-runtime-10.0
  fi

-  RELEASE=$(curl -fsSL https://technitium.com/dns/ | grep -oP 'Version \K[\d.]+')
+  RELEASE=$(get_latest_github_release "TechnitiumSoftware/DnsServer")
  if [[ ! -f ~/.technitium || ${RELEASE} != "$(cat ~/.technitium 2>/dev/null)" ]]; then
    fetch_and_deploy_from_url "https://download.technitium.com/dns/DnsServerPortable.tar.gz" /opt/technitium/dns
    echo "${RELEASE}" >~/.technitium
@@ -31,12 +31,30 @@ function update_script() {
  fi

  JAVA_VERSION="25" setup_java
+
+  if ! grep -q "install.data_dir" /etc/thingsboard/conf/thingsboard.conf; then
+    msg_info "Restoring Package Defaults"
+    cat <<'EOF' >>/etc/thingsboard/conf/thingsboard.conf
+
+export JAVA_OPTS="$JAVA_OPTS -Dplatform=deb -Dinstall.data_dir=/usr/share/thingsboard/data"
+export JAVA_OPTS="$JAVA_OPTS -Xlog:gc*,heap*,age*,safepoint=debug:file=/var/log/thingsboard/gc.log:time,uptime,level,tags:filecount=10,filesize=10M"
+export JAVA_OPTS="$JAVA_OPTS -XX:+IgnoreUnrecognizedVMOptions -XX:+HeapDumpOnOutOfMemoryError"
+export JAVA_OPTS="$JAVA_OPTS -XX:-UseBiasedLocking -XX:+UseTLAB -XX:+ResizeTLAB -XX:+PerfDisableSharedMem -XX:+UseCondCardMark"
+export JAVA_OPTS="$JAVA_OPTS -XX:+UseG1GC -XX:MaxGCPauseMillis=500 -XX:+UseStringDeduplication -XX:+ParallelRefProcEnabled -XX:MaxTenuringThreshold=10"
+export LOG_FILENAME=thingsboard.out
+export LOADER_PATH=/usr/share/thingsboard/conf,/usr/share/thingsboard/extensions
+export SQL_DATA_FOLDER=/usr/share/thingsboard/data/sql
+EOF
+    systemctl restart thingsboard
+    msg_ok "Restored Package Defaults"
+  fi
+
  if check_for_gh_release "thingsboard" "thingsboard/thingsboard"; then
    msg_info "Stopping Service"
    systemctl stop thingsboard
    msg_ok "Stopped Service"

-    fetch_and_deploy_gh_release "thingsboard" "thingsboard/thingsboard" "binary" "latest" "/tmp" "thingsboard-*.deb"
+    DPKG_FORCE_CONFOLD=1 fetch_and_deploy_gh_release "thingsboard" "thingsboard/thingsboard" "binary" "latest" "/tmp" "thingsboard-*.deb"

    msg_info "Running Database Upgrade"
    $STD /usr/share/thingsboard/bin/install/upgrade.sh
@@ -23,10 +23,15 @@ setup_deb_based() {
    setup_go
    fetch_and_deploy_gh_release "xcaddy" "caddyserver/xcaddy" "binary"

-    msg_info "Setup xCaddy"
    $STD apt install -y git
-    $STD xcaddy build
-    msg_ok "Setup xCaddy"
+    if (($(awk '/^MemTotal:/ {print int($2 / 1024)}' /proc/meminfo) < 1900)); then
+      msg_warn "xCaddy is installed; its test build was skipped because linking Caddy needs about 2 GB RAM"
+    else
+      msg_info "Setup xCaddy"
+      cd /opt
+      $STD xcaddy build
+      msg_ok "Setup xCaddy"
+    fi
  fi
 }

@@ -69,10 +74,14 @@ EOF
    GO_VERSION="$(curl -fsSL https://go.dev/VERSION?m=text | head -1 | cut -c3-)" setup_go
    fetch_and_deploy_gh_release "xcaddy" "caddyserver/xcaddy" "prebuild" "latest" "/opt/xcaddy" "xcaddy_*_linux_$(arch_resolve).tar.gz"
    ln -sf /opt/xcaddy/xcaddy /usr/local/bin/xcaddy
-    msg_info "Setup xCaddy"
-    cd /opt
-    $STD xcaddy build
-    msg_ok "Setup xCaddy"
+    if (($(awk '/^MemTotal:/ {print int($2 / 1024)}' /proc/meminfo) < 1900)); then
+      msg_warn "xCaddy is installed; its test build was skipped because linking Caddy needs about 2 GB RAM"
+    else
+      msg_info "Setup xCaddy"
+      cd /opt
+      $STD xcaddy build
+      msg_ok "Setup xCaddy"
+    fi
  fi

  msg_info "Enabling Caddy Service"
@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/chattocorp/chatto
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+fetch_and_deploy_gh_release "chatto" "chattocorp/chatto" "prebuild" "latest" "/opt/chatto" "chatto_Linux_$(arch_resolve x86_64 arm64).tar.gz"
+chmod +x /opt/chatto/chatto
+
+msg_info "Configuring Chatto"
+mkdir -p /opt/chatto_data
+cd /opt/chatto
+$STD ./chatto init
+mv /opt/chatto/chatto.toml /opt/chatto_data/chatto.toml
+sed -i \
+  -e "/^\[webserver\]/,/^\[/ s|^url = .*|url = 'http://${LOCAL_IP}:4000'|" \
+  -e "/^\[nats.embedded\]/,/^\[/ s|^data_dir = .*|data_dir = '/opt/chatto_data/data'|" \
+  -e '/^# \[operator_api\]$/,/^$/ { s|^# \[operator_api\]$|[operator_api]|; s|^# enabled = false$|enabled = true| }' \
+  /opt/chatto_data/chatto.toml
+msg_ok "Configured Chatto"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/chatto.service
+[Unit]
+Description=Chatto
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/chatto
+ExecStart=/opt/chatto/chatto run -c /opt/chatto_data/chatto.toml
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now chatto
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc
@@ -16,119 +16,47 @@ update_os
 msg_info "Installing Dependencies"
 $STD apt install -y \
  nginx \
-  valkey \
-  mariadb-client \
-  rclone
+  libedit2 \
+  libgssapi-krb5-2 \
+  libncurses6 \
+  libreadline8t64
 msg_ok "Installed Dependencies"

 PG_VERSION="17" setup_postgresql
 NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs

-msg_info "Installing Database Clients"
-# Create PostgreSQL version symlinks for compatibility
-for v in 12 13 14 15 16 18; do
-  ln -sf /usr/lib/postgresql/17 /usr/lib/postgresql/$v
-done
-# Install MongoDB Database Tools via direct .deb (no APT repo for Debian 13)
-[[ "$(get_os_info id)" == "ubuntu" ]] && MONGO_DIST="ubuntu2204" || MONGO_DIST="debian12"
-# MongoDB only publishes arm64 builds for Ubuntu
-[[ "$(arch_resolve "x86_64" "arm64")" == "arm64" ]] && MONGO_DIST="ubuntu2204"
-MONGO_VERSION=$(get_latest_gh_tag "mongodb/mongo-tools" "100." || echo "100.16.1")
-fetch_and_deploy_from_url "https://fastdl.mongodb.org/tools/db/mongodb-database-tools-${MONGO_DIST}-$(arch_resolve "x86_64" "arm64")-${MONGO_VERSION}.deb" ""
-mkdir -p /usr/local/mongodb-database-tools/bin
-[[ -f /usr/bin/mongodump ]] && ln -sf /usr/bin/mongodump /usr/local/mongodb-database-tools/bin/mongodump
-[[ -f /usr/bin/mongorestore ]] && ln -sf /usr/bin/mongorestore /usr/local/mongodb-database-tools/bin/mongorestore
-# Create MariaDB and MySQL client symlinks for compatibility
-mkdir -p /usr/local/mariadb-{10.6,12.1}/bin /usr/local/mysql-{5.7,8.0,8.4,9}/bin
-for dir in /usr/local/mariadb-{10.6,12.1}/bin; do
-  ln -sf /usr/bin/mariadb-dump "$dir/mariadb-dump"
-  ln -sf /usr/bin/mariadb "$dir/mariadb"
-done
-for dir in /usr/local/mysql-{5.7,8.0,8.4,9}/bin; do
-  ln -sf /usr/bin/mariadb-dump "$dir/mysqldump"
-  ln -sf /usr/bin/mariadb "$dir/mysql"
-done
-msg_ok "Installed Database Clients"
-
 fetch_and_deploy_gh_release "databasus" "databasus/databasus" "tarball" "latest" "/opt/databasus"
 GO_VERSION="$(grep -m1 '^go ' /opt/databasus/backend/go.mod | awk '{print $2}')" setup_go

 msg_info "Building Databasus (Patience)"
+RELEASE=$(cat ~/.databasus)
 export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
 cd /opt/databasus/frontend
-
 $STD corepack prepare pnpm@latest --activate
 $STD pnpm install --frozen-lockfile
-$STD pnpm run build
+$STD env VITE_APP_VERSION="${RELEASE}" pnpm run build
 cd /opt/databasus/backend
-$STD go mod tidy
-$STD go mod download
-$STD go install github.com/swaggo/swag/cmd/swag@latest
-$STD /root/go/bin/swag init -g cmd/main.go -o swagger
-$STD env CGO_ENABLED=0 GOOS=linux GOARCH=$(arch_resolve) go build -o databasus ./cmd
-mv /opt/databasus/backend/databasus /opt/databasus/databasus
+$STD env CGO_ENABLED=0 GOOS=linux GOARCH="$(arch_resolve)" go build -o /opt/databasus/databasus ./cmd/databasus
+mkdir -p /opt/databasus/agent-binaries
+for arch in amd64 arm64; do
+  $STD env CGO_ENABLED=0 GOOS=linux GOARCH=$arch go build -ldflags "-X main.Version=${RELEASE}" -o /opt/databasus/agent-binaries/databasus-verification-agent-linux-$arch ./cmd/verification-agent
+done
 mkdir -p /databasus-data/{pgdata,temp,backups,data,logs}
 mkdir -p /opt/databasus/ui/build
-mkdir -p /opt/databasus/migrations
 cp -r /opt/databasus/frontend/dist/* /opt/databasus/ui/build/
-cp -r /opt/databasus/backend/migrations/* /opt/databasus/migrations/
 chown -R postgres:postgres /databasus-data
 msg_ok "Built Databasus"

 msg_info "Configuring Databasus"
-JWT_SECRET=$(openssl rand -hex 32)
-ENCRYPTION_KEY=$(openssl rand -hex 32)
-# Install goose for migrations
-$STD go install github.com/pressly/goose/v3/cmd/goose@latest
-ln -sf /root/go/bin/goose /usr/local/bin/goose
 cat <<EOF >/.env
-# Environment
 ENV_MODE=production
-
-# Server
-SERVER_PORT=4005
-SERVER_HOST=0.0.0.0
-
-# Database
+APP_VERSION=${RELEASE}
 DATABASE_DSN=host=localhost user=postgres password=postgres dbname=databasus port=5432 sslmode=disable
-DATABASE_URL=postgres://postgres:postgres@localhost:5432/databasus?sslmode=disable
-
-# Migrations
-GOOSE_DRIVER=postgres
-GOOSE_DBSTRING=postgres://postgres:postgres@localhost:5432/databasus?sslmode=disable
-GOOSE_MIGRATION_DIR=/opt/databasus/migrations
-
-# Valkey (Redis-compatible cache)
-VALKEY_HOST=localhost
-VALKEY_PORT=6379
-
-# Security
-JWT_SECRET=${JWT_SECRET}
-ENCRYPTION_KEY=${ENCRYPTION_KEY}
-
-# Paths
-DATA_DIR=/databasus-data/data
-BACKUP_DIR=/databasus-data/backups
-LOG_DIR=/databasus-data/logs
 EOF
 chmod 600 /.env
 msg_ok "Configured Databasus"

-msg_info "Configuring Valkey"
-cat <<EOF >/etc/valkey/valkey.conf
-port 6379
-bind 127.0.0.1
-protected-mode yes
-save ""
-maxmemory 256mb
-maxmemory-policy allkeys-lru
-EOF
-systemctl enable -q --now valkey-server
-systemctl restart valkey-server
-msg_ok "Configured Valkey"
-
 msg_info "Creating Database"
-# Configure PostgreSQL to allow local password auth for databasus
 PG_HBA="/etc/postgresql/17/main/pg_hba.conf"
 if ! grep -q "databasus" "$PG_HBA"; then
  sed -i '/^local\s*all\s*all/i local   databasus   postgres                                trust' "$PG_HBA"
@@ -143,8 +71,8 @@ msg_info "Creating Databasus Service"
 cat <<EOF >/etc/systemd/system/databasus.service
 [Unit]
 Description=Databasus - Database Backup Management
-After=network.target postgresql.service valkey.service
-Requires=postgresql.service valkey.service
+After=network.target postgresql.service
+Requires=postgresql.service

 [Service]
 Type=simple
@@ -0,0 +1,146 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Masked-Kunsiquat
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.espocrm.com/ | Github: https://github.com/espocrm/espocrm
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+if [[ -z "${var_admin_user:-}" ]]; then
+  var_admin_user=$(prompt_input "EspoCRM admin username (a-z, 0-9, @ . _ -):" "admin" 60)
+fi
+var_admin_user="${var_admin_user:-admin}"
+var_admin_user="${var_admin_user,,}"
+if [[ ! "$var_admin_user" =~ ^[a-z0-9@._-]+$ ]]; then
+  msg_warn "EspoCRM usernames take only a-z, 0-9 and @ . _ -; using admin"
+  var_admin_user="admin"
+fi
+if [[ -z "${var_admin_pass:-}" ]]; then
+  var_admin_pass=$(random_password 16)
+fi
+
+msg_info "Installing Dependencies"
+$STD apt install -y nginx
+msg_ok "Installed Dependencies"
+
+setup_mariadb
+MARIADB_DB_NAME="espocrm" MARIADB_DB_USER="espocrm" setup_mariadb_db
+PHP_VERSION="8.4" PHP_FPM="YES" PHP_MODULE="ldap" setup_php
+fetch_and_deploy_gh_release "espo-crm" "espocrm/espocrm" "prebuild" "latest" "/opt/espocrm" "EspoCRM-*.zip"
+
+msg_info "Configuring EspoCRM"
+cd /opt/espocrm
+$STD php bin/command config:populate
+$STD php bin/command config:set defaultPermissions.user www-data
+$STD php bin/command config:set defaultPermissions.group www-data
+$STD php bin/command config:set database.platform Mysql
+$STD php bin/command config:set database.host localhost
+$STD php bin/command config:set database.dbname "$MARIADB_DB_NAME"
+$STD php bin/command config:set database.user "$MARIADB_DB_USER"
+$STD php bin/command config:set database.password "$MARIADB_DB_PASS"
+$STD php bin/command rebuild
+$STD php bin/command create-admin-user "$var_admin_user"
+printf '%s\n' "$var_admin_pass" | $STD php bin/command set-password "$var_admin_user"
+$STD php bin/command config:set siteUrl "http://${LOCAL_IP}"
+$STD php bin/command populate-scheduled-jobs
+$STD php bin/command config:set jobRunInParallel true --type=bool
+$STD php bin/command app-check
+$STD php bin/command config:set isInstalled true --type=bool
+chown -R www-data:www-data /opt/espocrm
+msg_ok "Configured EspoCRM"
+
+msg_info "Creating Nginx Site"
+PHP_SOCK=$(get_php_fpm_socket)
+cat <<EOF >/etc/nginx/sites-available/espocrm
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+    server_name _;
+
+    charset utf-8;
+    index index.html index.php;
+
+    client_max_body_size 128M;
+    keepalive_timeout 300;
+    server_tokens off;
+    fastcgi_send_timeout 300;
+    fastcgi_read_timeout 300;
+
+    gzip on;
+    gzip_types text/plain text/css text/javascript application/javascript application/json;
+    gzip_min_length 1000;
+
+    root /opt/espocrm/public;
+
+    location /client {
+        root /opt/espocrm;
+        autoindex off;
+
+        location ~* ^.+\.(js|css|png|jpg|svg|svgz|jpeg|gif|ico|tpl)\$ {
+            access_log off;
+            expires max;
+        }
+    }
+
+    location = /favicon.ico { access_log off; log_not_found off; }
+    location = /robots.txt { access_log off; log_not_found off; }
+
+    location ~ \.php\$ {
+        fastcgi_pass unix:${PHP_SOCK};
+        include fastcgi_params;
+        fastcgi_index index.php;
+        fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
+        fastcgi_param QUERY_STRING \$query_string;
+    }
+
+    location /api/v1/ {
+        if (!-e \$request_filename) {
+            rewrite ^/api/v1/(.*)\$ /api/v1/index.php last;
+        }
+    }
+
+    location /portal/ {
+        try_files \$uri \$uri/ /portal/index.php?\$query_string;
+    }
+
+    location /api/v1/portal-access {
+        if (!-e \$request_filename) {
+            rewrite ^/api/v1/(.*)\$ /api/v1/portal-access/index.php last;
+        }
+    }
+
+    location ~ /(\.htaccess|web\.config|\.git) {
+        deny all;
+    }
+}
+EOF
+msg_ok "Created Nginx Site"
+nginx_enable_site "espocrm"
+
+msg_info "Setting up Cron"
+cat <<EOF >/etc/cron.d/espocrm
+* * * * * www-data cd /opt/espocrm && php -f cron.php >/dev/null 2>&1
+EOF
+systemctl enable -q --now cron
+msg_ok "Set up Cron"
+
+msg_info "Saving Credentials"
+cat <<EOF >>~/espocrm.creds
+
+EspoCRM Admin
+Username: ${var_admin_user}
+Password: ${var_admin_pass}
+EOF
+chmod 600 ~/espocrm.creds
+msg_ok "Saved Credentials"
+
+motd_ssh
+customize
+cleanup_lxc
@@ -0,0 +1,99 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/mozilla-services/syncstorage-rs
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  build-essential \
+  pkg-config \
+  libssl-dev \
+  libpq-dev \
+  python3-dev
+msg_ok "Installed Dependencies"
+
+PG_VERSION="18" setup_postgresql
+PG_DB_NAME="syncserver" PG_DB_USER="syncserver" setup_postgresql_db
+setup_rust
+setup_uv
+
+fetch_and_deploy_gh_release "firefox-syncserver" "mozilla-services/syncstorage-rs" "tarball"
+
+msg_info "Building Firefox Syncserver (Patience)"
+cd /opt/firefox-syncserver
+$STD cargo build --release --locked --no-default-features --features=syncstorage-db/postgres --features=tokenserver-db/postgres --features=py_verifier
+cp target/release/syncserver /usr/local/bin/syncserver
+rm -rf target
+$STD uv venv --python /usr/bin/python3 /opt/firefox-syncserver/.venv
+$STD uv pip install --python /opt/firefox-syncserver/.venv/bin/python pyfxa tokenlib cryptography
+msg_ok "Built Firefox Syncserver"
+
+msg_info "Configuring Firefox Syncserver"
+mkdir -p /opt/firefox-syncserver_data
+cat <<EOF >/opt/firefox-syncserver_data/.env
+SYNC_HOST=0.0.0.0
+SYNC_PORT=8000
+SYNC_MASTER_SECRET=$(openssl rand -hex 32)
+SYNC_HUMAN_LOGS=true
+RUST_LOG=info
+SYNC_SYNCSTORAGE__DATABASE_URL=postgres://syncserver:${PG_DB_PASS}@127.0.0.1:5432/syncserver
+SYNC_SYNCSTORAGE__GLEAN_ENABLED=false
+SYNC_TOKENSERVER__ENABLED=true
+SYNC_TOKENSERVER__RUN_MIGRATIONS=true
+SYNC_TOKENSERVER__DATABASE_URL=postgres://syncserver:${PG_DB_PASS}@127.0.0.1:5432/syncserver
+SYNC_TOKENSERVER__NODE_TYPE=postgres
+SYNC_TOKENSERVER__FXA_EMAIL_DOMAIN=api.accounts.firefox.com
+SYNC_TOKENSERVER__FXA_OAUTH_SERVER_URL=https://oauth.accounts.firefox.com
+SYNC_TOKENSERVER__INIT_NODE_URL=http://${LOCAL_IP}:8000
+EOF
+chmod 600 /opt/firefox-syncserver_data/.env
+cat <<'EOF' >/opt/firefox-syncserver_data/nodes.sql
+SELECT to_regclass('nodes') IS NOT NULL AS ready \gset
+\if :ready
+UPDATE nodes SET node = :'url'
+ WHERE id = (SELECT min(id) FROM nodes)
+   AND NOT EXISTS (SELECT 1 FROM nodes WHERE node = :'url');
+UPDATE users SET nodeid = (SELECT id FROM nodes WHERE node = :'url')
+ WHERE nodeid <> (SELECT id FROM nodes WHERE node = :'url');
+DELETE FROM nodes WHERE node <> :'url';
+\endif
+EOF
+msg_ok "Configured Firefox Syncserver"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/firefox-syncserver.service
+[Unit]
+Description=Firefox Syncserver
+After=network.target postgresql.service
+Wants=postgresql.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/firefox-syncserver
+EnvironmentFile=/opt/firefox-syncserver_data/.env
+Environment=PYTHONPATH=/opt/firefox-syncserver/.venv/lib/python3.13/site-packages
+ExecStartPre=/usr/bin/psql -1 -q -v ON_ERROR_STOP=1 -v url=\${SYNC_TOKENSERVER__INIT_NODE_URL} -f /opt/firefox-syncserver_data/nodes.sql \${SYNC_TOKENSERVER__DATABASE_URL}
+ExecStart=/usr/local/bin/syncserver
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now firefox-syncserver
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc
@@ -14,18 +14,15 @@ network_check
 update_os

 msg_info "Installing Dependencies"
+CODENAME=$(get_os_info codename)
+setup_deb822_repo \
+  "debian-backports" \
+  "file:///usr/share/keyrings/debian-archive-keyring.gpg" \
+  "http://deb.debian.org/debian" \
+  "${CODENAME}-backports" \
+  "main"
 $STD apt install -y \
  chromium \
-  libreoffice-writer \
-  libreoffice-calc \
-  libreoffice-impress \
-  libreoffice-draw \
-  libreoffice-math \
-  python3-uno \
-  python-is-python3 \
-  pdftk-java \
-  qpdf \
-  libimage-exiftool-perl \
  fonts-crosextra-carlito \
  fonts-crosextra-caladea \
  fonts-liberation \
@@ -33,28 +30,30 @@ $STD apt install -y \
  fonts-dejavu \
  fonts-noto-cjk \
  fonts-noto-color-emoji \
-  fonts-noto-core
+  fonts-noto-core \
+  fonts-urw-base35
+# lok is built against the LibreOffice from backports
+$STD apt install -y -t "${CODENAME}-backports" \
+  libreoffice-writer \
+  libreoffice-calc \
+  libreoffice-impress \
+  libreoffice-draw \
+  libreoffice-math
 msg_ok "Installed Dependencies"

-fetch_and_deploy_gh_release "pdfcpu" "pdfcpu/pdfcpu" "prebuild" "latest" "/opt/pdfcpu" "pdfcpu_*_Linux_$(arch_resolve "x86_64" "arm64").tar.xz"
-ln -sf "$(find /opt/pdfcpu -type f -name pdfcpu | head -n1)" /usr/local/bin/pdfcpu
-
-msg_info "Installing unoconverter"
-UNOCONVERTER_VERSION=$(get_latest_github_release "gotenberg/unoconverter" "false")
-download_file "https://raw.githubusercontent.com/gotenberg/unoconverter/${UNOCONVERTER_VERSION}/unoconv" /usr/local/bin/unoconverter
-chmod +x /usr/local/bin/unoconverter
-msg_ok "Installed unoconverter"
-
 fetch_and_deploy_gh_release "gotenberg" "gotenberg/gotenberg" "tarball" "latest" "/opt/gotenberg"

 GO_VERSION="$(awk '$1=="go"{print $2}' /opt/gotenberg/go.mod | cut -d. -f1,2)" setup_go

+LOK_VERSION="$(awk -F= '/^ARG LOK_VERSION=/{print $2}' /opt/gotenberg/build/Dockerfile)"
+fetch_and_deploy_gh_release "lok" "gotenberg/lok" "prebuild" "$LOK_VERSION" "/usr/local/bin" "lok_${LOK_VERSION#v}_linux_$(arch_resolve "amd64" "arm64").tar.gz"
+
 msg_info "Building Gotenberg (Patience)"
 cd /opt/gotenberg
 export CGO_ENABLED=0
 $STD go mod download
 $STD go build -o /usr/local/bin/gotenberg \
-  -ldflags "-s -w -X 'github.com/gotenberg/gotenberg/v8/cmd.Version=$(cat ~/.gotenberg)'" \
+  -ldflags "-s -w -X 'github.com/gotenberg/gotenberg/v9/cmd.Version=$(cat ~/.gotenberg)'" \
  cmd/gotenberg/main.go
 msg_ok "Built Gotenberg"

@@ -70,14 +69,10 @@ Type=simple
 User=root
 Environment=LANG=C.UTF-8
 Environment=LC_ALL=C.UTF-8
-Environment=PDFTK_BIN_PATH=/usr/bin/pdftk
-Environment=QPDF_BIN_PATH=/usr/bin/qpdf
-Environment=EXIFTOOL_BIN_PATH=/usr/bin/exiftool
-Environment=PDFCPU_BIN_PATH=/usr/local/bin/pdfcpu
 Environment=CHROMIUM_BIN_PATH=/usr/bin/chromium
 Environment=CHROMIUM_HYPHEN_DATA_DIR_PATH=/opt/gotenberg/build/chromium-hyphen-data
 Environment=LIBREOFFICE_BIN_PATH=/usr/lib/libreoffice/program/soffice.bin
-Environment=UNOCONVERTER_BIN_PATH=/usr/local/bin/unoconverter
+Environment=LOK_BIN_PATH=/usr/local/bin/lok
 Environment=OTEL_TRACES_EXPORTER=none
 Environment=OTEL_METRICS_EXPORTER=none
 Environment=OTEL_LOGS_EXPORTER=none
@@ -26,7 +26,7 @@ NODE_VERSION="24" NODE_MODULE="corepack,pnpm" setup_nodejs

 msg_info "Installing Deno"
 export DENO_INSTALL="/usr/local"
-curl -fsSL https://deno.land/install.sh | $STD sh -s -- -y
+curl -fsSL https://deno.land/install.sh | CI=1 $STD sh -s
 [[ ":$PATH:" != *":/usr/local/bin:"* ]] &&
  echo -e "\nexport PATH=\"/usr/local/bin:\$PATH\"" >>~/.bashrc &&
  source ~/.bashrc
@@ -33,6 +33,7 @@ LOCAL_ENGINE_TOKEN=${LOCAL_ENGINE_TOKEN}
 ENCRYPTION_KEY=${ENCRYPTION_KEY}
 EOF
 chmod 0640 /etc/nexterm-engine/config.yaml /etc/nexterm-server/server.env
+echo "x /tmp/nexterm-sea-*" >/etc/tmpfiles.d/nexterm.conf
 msg_ok "Configured Nexterm"

 msg_info "Creating Services"
@@ -70,7 +70,9 @@ After=network.target

 [Service]
 WorkingDirectory=/opt/planka
-ExecStart=/usr/bin/npm start --production
+Environment=NODE_ENV=production
+Environment=HOME=/root
+ExecStart=/usr/bin/node app.js --prod
 Restart=always

 [Install]
@@ -257,15 +257,33 @@ map $http_upgrade $connection_upgrade {
    '' close;
 }

+# COEP/COOP for the EmulatorJS and js-dos players (SharedArrayBuffer needs a
+# crossOriginIsolated document). Matched on $request_uri because try_files
+# rewrites $uri to /index.html before add_header runs, so a per-location
+# add_header on the player route never fires. Mirrors upstream RomM's
+# docker/nginx/templates/default.conf.template.
+map $request_uri $coep_header {
+    default        "";
+    ~^/rom/.*/(ejs|jsdos)(\?|$) "require-corp";
+}
+map $request_uri $coop_header {
+    default        "";
+    ~^/rom/.*/(ejs|jsdos)(\?|$) "same-origin";
+}
+
 server {
    listen 80;
    server_name _;
    root /opt/romm/frontend/dist;
    client_max_body_size 0;

-    # Frontend SPA
+    # Frontend SPA - also emits the player isolation headers: the player URLs
+    # fall through try_files to /index.html, which this location serves
    location / {
        try_files $uri $uri/ /index.html;
+        add_header Cache-Control "no-cache";
+        add_header Cross-Origin-Embedder-Policy $coep_header;
+        add_header Cross-Origin-Opener-Policy $coop_header;
    }

    # Static assets
@@ -276,13 +294,6 @@ server {
        add_header Cache-Control "public, immutable";
    }

-    # EmulatorJS player - requires COOP/COEP headers for SharedArrayBuffer
-    location ~ ^/rom/.*/ejs$ {
-        add_header Cross-Origin-Embedder-Policy "require-corp";
-        add_header Cross-Origin-Opener-Policy "same-origin";
-        try_files $uri /index.html;
-    }
-
    # Backend API
    location /api {
        proxy_pass http://romm_backend;
@@ -23,7 +23,7 @@ setup_deb822_repo \
 $STD apt install -y aspnetcore-runtime-10.0
 msg_ok "Installed Dependencies"

-RELEASE=$(curl -fsSL https://technitium.com/dns/ | grep -oP 'Version \K[\d.]+')
+RELEASE=$(get_latest_github_release "TechnitiumSoftware/DnsServer")
 fetch_and_deploy_from_url "https://download.technitium.com/dns/DnsServerPortable.tar.gz" /opt/technitium/dns
 echo "${RELEASE}" >~/.technitium

@@ -26,7 +26,8 @@ PG_DB_NAME="thingsboard_db" PG_DB_USER="thingsboard" setup_postgresql_db
 fetch_and_deploy_gh_release "thingsboard" "thingsboard/thingsboard" "binary" "latest" "/tmp" "thingsboard-*.deb"

 msg_info "Configuring ThingsBoard"
-cat <<EOF >/etc/thingsboard/conf/thingsboard.conf
+cat <<EOF >>/etc/thingsboard/conf/thingsboard.conf
+
 # DB Configuration
 export DATABASE_TS_TYPE=sql
 export SPRING_DATASOURCE_URL=jdbc:postgresql://localhost:5432/${PG_DB_NAME}
@@ -31,7 +31,7 @@ ln -sf /opt/bun/bin/bunx /usr/local/bin/bunx
 msg_ok "Installed Bun"

 msg_info "Installing Deno"
-$STD sh -c "curl -fsSL https://deno.land/install.sh | DENO_INSTALL=/usr/local sh -s -- -y"
+curl -fsSL https://deno.land/install.sh | CI=1 $STD sh -s
 msg_ok "Installed Deno"

 msg_info "Creating directories"
@@ -282,7 +282,7 @@ function failure_reason() {
 function backup_container() {
  msg_info "Creating backup for container $1"
  local output
-  if output=$(vzdump $1 --compress zstd --storage $STORAGE_CHOICE -notes-template "{{guestname}} - community-scripts backup updater" 2>&1); then
+  if output=$(_cs_shield_hangup vzdump $1 --compress zstd --storage $STORAGE_CHOICE -notes-template "{{guestname}} - community-scripts backup updater" 2>&1); then
    msg_ok "Backup created"
  else
    log_write "Container $1: vzdump failed:"$'\n'"$output"
@@ -651,7 +651,18 @@ for container in $CHOICE; do
    msg_error "Update failed for container $container ($service, exit code: $exit_code) — attempting restore"
    log_write "Container $container ($service): FAILED (exit $exit_code) — attempting restore"
    msg_info "Restoring LXC $container from backup ($STORAGE_CHOICE)"
-    pct stop $container
+    wait
+    pct stop $container &>/dev/null || true
+    for _ in {1..30}; do
+      [[ "$(pct status $container 2>/dev/null)" == "status: stopped" ]] && break
+      sleep 1
+    done
+    if [[ "$(pct status $container 2>/dev/null)" != "status: stopped" ]]; then
+      msg_error "Container $container did not stop, so it cannot be restored"
+      log_result "$container" "$service" "FAILED" "Update failed (exit $exit_code) — container did not stop for the restore"
+      log_write "Container $container ($service): FAILED — container did not stop for the restore"
+      exit 235
+    fi
    LXC_STORAGE=$(pct config $container | awk -F '[:,]' '/rootfs/ {print $2}')
    BACKUP_ENTRY=$(pvesm list "$STORAGE_CHOICE" 2>/dev/null | awk -v ctid="$container" '$1 ~ "vzdump-lxc-"ctid"-" || $1 ~ "/ct/"ctid"/" {print $1}' | sort -r | head -n1)
    if [ -z "$BACKUP_ENTRY" ]; then
@@ -47,7 +47,7 @@ function check_disk_space() {
 }

 TEMP_DIR=$(mktemp -d)
-if ! check_disk_space "$TEMP_DIR" 20 && [ -d "/var/tmp" ] && check_disk_space "/var/tmp" 20; then
+if ! check_disk_space "$TEMP_DIR" 4 && [ -d "/var/tmp" ] && check_disk_space "/var/tmp" 4; then
  rm -rf "$TEMP_DIR"
  TEMP_DIR=$(mktemp -d /var/tmp/opnsense-vm.XXXXXX)
 fi
@@ -364,15 +364,6 @@ FREEBSD_VER="$VM_INDEX_LATEST"
 URL="$VM_INDEX_URL"
 msg_ok "Download URL: ${CL}${BL}${URL}${CL}"

-# Check available disk space (require at least 20GB for safety)
-if ! check_disk_space "$TEMP_DIR" 20; then
-  AVAILABLE_GB=$(df -h "$TEMP_DIR" | awk 'NR==2 {print $4}')
-  msg_error "Insufficient disk space in temporary directory ($TEMP_DIR)."
-  msg_error "Available: ${AVAILABLE_GB}, Required: ~20GB for FreeBSD image decompression."
-  msg_error "Please free up space or ensure /tmp has sufficient storage."
-  exit 214
-fi
-
 msg_info "Downloading FreeBSD Image"
 # A mirror serving an error page returns 200, so size decides whether this
 # is an image. Anything real here is far above 5 MB.
@@ -381,11 +372,12 @@ vm_fetch_image "$URL" "$CACHE_FILE" --cache --verify-xz --min-bytes $((5 * 1024
 echo -en "\e[1A\e[0K"
 msg_ok "Downloaded ${CL}${BL}$(basename "$CACHE_FILE")${CL}"

-# Check disk space again before decompression
-if ! check_disk_space "$TEMP_DIR" 15; then
+NEED_GB=$(($(xz --robot -l "$CACHE_FILE" | awk '$1 == "totals" {print $5}') / 1024 / 1024 / 1024 + 1))
+if ! check_disk_space "$TEMP_DIR" "$NEED_GB"; then
  AVAILABLE_GB=$(df -h "$TEMP_DIR" | awk 'NR==2 {print $4}')
-  msg_error "Insufficient disk space for decompression."
-  msg_error "Available: ${AVAILABLE_GB}, Required: ~15GB for decompressed image."
+  msg_error "Insufficient disk space for decompression in ${TEMP_DIR}."
+  msg_error "Available: ${AVAILABLE_GB}, Required: ~${NEED_GB}GB for the decompressed image."
+  msg_error "Please free up space or ensure /tmp or /var/tmp has sufficient storage."
  exit 214
 fi

@@ -417,7 +409,7 @@ while :; do
    alloc_delay=$((alloc_delay * 2))
    continue
  fi
-  echo -e "$alloc_err" >&2
+  msg_error "Could not allocate the EFI disk on ${STORAGE}: ${alloc_err}"
  exit 220
 done
 vm_import_disk "$VMID" "$FILE" "$STORAGE"
@@ -4,7 +4,7 @@
 # Author: MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE

-COMMUNITY_SCRIPTS_URL="${COMMUNITY_SCRIPTS_URL:-https://raw.githubusercontent.com/community-scripts/ProxmoxVED/main}"
+COMMUNITY_SCRIPTS_URL="${COMMUNITY_SCRIPTS_URL:-https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main}"
 source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/pve/vm-core.func")
 load_functions
Author	SHA1	Message	Date
MickLesk	b07f0b649e	fix(update-apps): keep the backup alive on a closed console, stop before restoring A closed console killed vzdump with the session (7 runs ended "Backup failed ... creating vzdump archive"); it now runs shielded from SIGHUP. A restore after a failed update raced the background shutdown and failed with "can't overwrite running container" (3 runs); it now waits for that shutdown and for the container to stop, and says so when it does not.	2026-11-08 16:40:18 +01:00
community-scripts-pr-app[bot]	b457333b72	Update CHANGELOG.md (#18536 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-08 13:50:39 +00:00
push-app-to-main[bot]	06e30b9c4f	Chatto (#18521 ) * Add chatto (ct) * rm old Header comments --------- Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com> Co-authored-by: CanbiZ (MickLesk) <47820557+MickLesk@users.noreply.github.com>	2026-11-08 14:50:13 +01:00
push-app-to-main[bot]	8390e7e524	Firefox-Syncserver (#18520 ) * Add firefox-syncserver (ct) * cleanup --------- Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com> Co-authored-by: CanbiZ (MickLesk) <47820557+MickLesk@users.noreply.github.com>	2026-11-08 14:50:06 +01:00
community-scripts-pr-app[bot]	81441221ad	Update CHANGELOG.md (#18534 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-08 13:04:55 +00:00
CanbiZ (MickLesk)	d65cf17de4	fix(databasus): build 3.65 and ship the verification agent (#18500 ) 3.65 moved the entry point to cmd/databasus and embeds the API spec and migrations, so swag failed and every install since 2026-11-05 broke. It now builds like the upstream image: bundled client tools, the verification agent for amd64 and arm64, and APP_VERSION set to the release. Valkey, goose and the client symlinks are gone because 3.65 uses none of them. Closes #18493.	2026-11-08 14:04:30 +01:00
community-scripts-pr-app[bot]	8127d1caea	Update CHANGELOG.md (#18531 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-08 00:03:47 +00:00
community-scripts-pr-app[bot]	6eb9414ee7	Archive old changelog entries (#18530 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-08 00:03:21 +00:00
community-scripts-pr-app[bot]	a60d5882d3	Update CHANGELOG.md (#18528 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-07 20:36:10 +00:00
community-scripts-pr-app[bot]	292561163c	Update CHANGELOG.md (#18527 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-07 20:33:19 +00:00
community-scripts-pr-app[bot]	76aa58d6c4	Update CHANGELOG.md (#18526 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-07 20:33:02 +00:00
community-scripts-pr-app[bot]	4442360cd9	Update CHANGELOG.md (#18525 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-07 20:05:59 +00:00
adotagarwal	7bc2815df7	RomM: emit player isolation headers from the serving location (#18511 ) The player location's COOP/COEP add_header never fires: try_files internally redirects /rom/<id>/ejs to /index.html, served by "location /" — so SharedArrayBuffer cores (PSP/DS) fail with a misleading "must be run over HTTPS" error. Apply upstream RomM's own fix (docker nginx template): map $request_uri — which survives the redirect — to header values for the ejs and jsdos player paths, emit them from "location /", and drop the dead player location. Also restore upstream's Cache-Control "no-cache" on the SPA shell, without which a cached index.html hides the headers and stale frontends survive RomM updates. Widen the updater's migration gate so existing installs converge.	2026-11-07 21:05:35 +01:00
community-scripts-pr-app[bot]	1e722e8bd7	Update CHANGELOG.md (#18524 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-07 20:01:03 +00:00
push-app-to-main[bot]	91e9cc699c	EspoCRM (#18519 ) * Add espocrm (ct) * minor fixes * minor --------- Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com> Co-authored-by: CanbiZ (MickLesk) <47820557+MickLesk@users.noreply.github.com>	2026-11-07 21:00:38 +01:00
community-scripts-pr-app[bot]	fbbbc55699	Update CHANGELOG.md (#18518 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-07 19:54:21 +00:00
community-scripts-pr-app[bot]	6ad67ca11e	Update CHANGELOG.md (#18517 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-07 19:53:59 +00:00
Tobias	68c1309517	fix: gotenberg: update to v9 (#18491 )	2026-11-07 20:53:53 +01:00
community-scripts-pr-app[bot]	53c32f293b	Update CHANGELOG.md (#18508 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-07 20:53:36 +01:00
community-scripts-pr-app[bot]	1d5fdefc4e	Update CHANGELOG.md (#18509 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-07 00:40:43 +01:00
community-scripts-pr-app[bot]	6a0c9b002d	Update CHANGELOG.md (#18507 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-06 22:51:59 +00:00
CanbiZ (MickLesk)	81d218adc2	fix(umbrel-os-vm): report runs as ProxmoxVE, not DevScripts (#18497 ) The script kept the DevScripts base URL from the refactor in #17505, so every production run was filed under DevScripts in telemetry.	2026-11-06 23:51:57 +01:00
CanbiZ (MickLesk)	125c2c44a7	ci: reject DevScripts URLs in scripts (#18498 ) openwrt-vm and umbrel-os-vm kept the DevScripts base URL when they moved over, and telemetry filed their production runs under DevScripts. The check fails a pull request that adds such a URL to ct, install, vm or tools.	2026-11-06 23:51:35 +01:00
community-scripts-pr-app[bot]	d63c98936b	Update CHANGELOG.md (#18506 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-06 22:50:56 +00:00
CanbiZ (MickLesk)	df10e1d2dd	Technitium DNS: read the version from its GitHub releases (#18425 ) The version came from scraping technitium.com, which failed for some hosts ("Command substitution exited with status 1", 6 runs on 4 hosts in three days) and has no rate-limit fallback. The GitHub release carries the same version and goes through the engine's release lookup.	2026-11-06 23:50:54 +01:00
CanbiZ (MickLesk)	50c5b786e4	Caddy: skip the xCaddy test build below 2 GB RAM (#18472 ) * fix(caddy): skip the xCaddy test build below 2 GB RAM The container defaults to 512 MB (256 MB on Alpine), and Go's linker was killed in xcaddy build: 14 runs on 6 hosts in a week. The build only produced an unused binary, so below 2 GB xCaddy is installed without it and a warning says why; install and update alike. * Change directory to /opt before building xCaddy	2026-11-06 23:50:49 +01:00
CanbiZ (MickLesk)	3c0e693c2d	fix(thingsboard): keep the package defaults in thingsboard.conf (#18499 ) The install replaced the file, which dropped JAVA_OPTS with install.data_dir, so creating a tenant failed. The DB settings are now appended, and an update restores the defaults on existing containers. The package upgrade keeps the edited file. Fixes #18483.	2026-11-06 23:50:29 +01:00
community-scripts-pr-app[bot]	d8f3874f42	Update CHANGELOG.md (#18505 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-06 22:47:00 +00:00
CanbiZ (MickLesk)	1a2bbb06bb	fix(nexterm): keep the extracted app out of the /tmp cleanup (#18501 ) The server unpacks its frontend into /tmp/nexterm-sea-*. systemd-tmpfiles removes it after 10 days while the process keeps running, and every page returns 404. Fixes #18488.	2026-11-06 23:46:31 +01:00
community-scripts-pr-app[bot]	996900f145	Update CHANGELOG.md (#18504 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-06 22:42:46 +00:00
CanbiZ (MickLesk)	bc348949c4	fix(planka): run the service with node instead of nodemon (#18503 ) npm 12 rejects --prod, and --production still starts PLANKA through nodemon. Starting node app.js directly needs HOME: Sails 1.5.18 only looks for the project's .sailsrc when HOME is set, and systemd sets none without User=, so the app lifted with the wrong paths and returned 503. The unit now sets NODE_ENV and HOME, and an update repairs existing units even without a new release. Follow-up to #18477.	2026-11-06 23:42:25 +01:00
CanbiZ (MickLesk)	5720358d1b	MeTube/Yubal: install Deno without its shell setup (#18406 ) * MeTube: install Deno without its shell setup With -y, deno's install.sh also fetches jsr:@deno/installer-shell-setup to edit the shell profile, and when jsr.io did not answer the install stopped ("JSR package manifest ... failed to load"). Deno goes to /usr/local/bin, which is on PATH, so the shell setup is not needed; CI=1 keeps the installer from asking for it on a terminal. * Modify Deno installation command Update Deno installation command to include CI environment variable.	2026-11-06 23:42:22 +01:00
community-scripts-pr-app[bot]	ebf9cf656e	Update CHANGELOG.md (#18502 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-11-06 18:32:26 +00:00
CanbiZ (MickLesk)	c5c406b392	OPNsense VM: size the temp space check to the unpacked image \| say why the EFI disk could not be allocated (#18404 ) * OPNsense VM: size the temp space check to the unpacked image The script refused to run unless TEMP_DIR had 20 GB free, a figure left over from when the download went there too. The download now goes to the image cache and only the unpacked FreeBSD image (2.5 GB) lands in TEMP_DIR, so hosts with 8 to 16 GB free in /tmp stopped with exit 214. Check the size xz reports for the image instead. * OPNsense VM: say why the EFI disk could not be allocated pvesm's error went to stderr only, so the two exit 220 runs in telemetry carry no reason. As msg_error it reaches the log and the trace, e.g. "disk image '.../vm-969-disk-0.qcow2' already exists" after an earlier run left its disk on a storage that qm destroy does not clean. * Clean up comments in opnsense-vm.sh Removed comments about image cache and size calculation.	2026-11-06 19:31:58 +01:00