Fix command to fetch Camoufox in install script

cinephage: bump Node.js from 24 to 26
2026-11-09 23:12:53 +01:00 · 2026-11-09 09:41:10 +01:00 · 2026-11-02 06:19:47 +00:00
130 changed files with 921 additions and 2071 deletions
@@ -58,9 +58,9 @@ body:

        Before continuing, verify that the requested project meets the minimum requirements below.

-        **Projects with fewer than 1,000 stars, or younger than 6 months, are generally not eligible for a script request.**
+        **Projects with fewer than 1,000 stars are generally not eligible for a script request.**

-        An automated check verifies the star count and project age for GitHub-hosted projects. If the project doesn't meet these requirements, fill in **Justification for an exception** below — without one, the request is closed automatically. With one, it's flagged for manual review instead. Exceptions are rare and require a clearly verifiable, significant public adoption signal.
+        Exceptions are only considered where there is a clearly verifiable, significant public adoption signal.

  - type: input
    id: repository-stars
@@ -134,22 +134,6 @@ body:
        - label: I understand that requests outside the project scope may be closed without an extensive explanation.
          required: true

-  - type: textarea
-    id: justification
-    attributes:
-      label: Justification for an exception
-      description: >-
-        Only needed if the project has fewer than 1,000 stars or is younger than 6 months (e.g. it has no GitHub
-        presence, so stars don't apply). Explain the significant public adoption signal. Leave blank if the project
-        meets the normal requirements — requests that don't meet the requirements and have no justification here are
-        closed automatically.
-      placeholder: |
-        Example:
-        No public GitHub repository, but the project has 50k+ active installs reported by its own telemetry
-        dashboard and is covered by several established self-hosting publications.
-    validations:
-      required: false
-
  - type: markdown
    attributes:
      value: |
@@ -1,187 +0,0 @@
-## 2026-11-07
-
-### 🆕 New Scripts
-
-  - EspoCRM ([#18519](https://github.com/community-scripts/ProxmoxVE/pull/18519))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - RomM: emit player isolation headers from the serving location [@adotagarwal](https://github.com/adotagarwal) ([#18511](https://github.com/community-scripts/ProxmoxVE/pull/18511))
-
-  - #### 💥 Breaking Changes
-
-    - fix: gotenberg: update to v9 [@CrazyWolf13](https://github.com/CrazyWolf13) ([#18491](https://github.com/community-scripts/ProxmoxVE/pull/18491))
-
-### 💾 Core
-
-  - nvidia: close the hardware acceleration step when no GPU is usable | pin the whole NVIDIA userspace to the host's driver version [@MickLesk](https://github.com/MickLesk) ([core#215](https://github.com/community-scripts/core/pull/215))
- fix: stage release downloads on disk, not in /tmp [@rcourtman](https://github.com/rcourtman) ([core#218](https://github.com/community-scripts/core/pull/218))
- Minor fixes: restart php-fpm during sigpipe, Install jq for forge commands  [@MickLesk](https://github.com/MickLesk) ([core#213](https://github.com/community-scripts/core/pull/213))
- incus: name the project restriction that refuses an Incus launch [@MickLesk](https://github.com/MickLesk) ([core#214](https://github.com/community-scripts/core/pull/214))
-
-## 2026-11-06
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - UmbrelOS-VM: report runs as ProxmoxVE, not DevScripts [@MickLesk](https://github.com/MickLesk) ([#18497](https://github.com/community-scripts/ProxmoxVE/pull/18497))
-    - Caddy: skip the xCaddy test build below 2 GB RAM [@MickLesk](https://github.com/MickLesk) ([#18472](https://github.com/community-scripts/ProxmoxVE/pull/18472))
-    - Thingsboard: keep the package defaults in thingsboard.conf [@MickLesk](https://github.com/MickLesk) ([#18499](https://github.com/community-scripts/ProxmoxVE/pull/18499))
-    - Nexterm: keep the extracted app out of the /tmp cleanup [@MickLesk](https://github.com/MickLesk) ([#18501](https://github.com/community-scripts/ProxmoxVE/pull/18501))
-    - PLANKA: run the service with node instead of nodemon [@MickLesk](https://github.com/MickLesk) ([#18503](https://github.com/community-scripts/ProxmoxVE/pull/18503))
-    - MeTube/Yubal: install Deno without its shell setup [@MickLesk](https://github.com/MickLesk) ([#18406](https://github.com/community-scripts/ProxmoxVE/pull/18406))
-    - OPNsense VM: size the temp space check to the unpacked image |  say why the EFI disk could not be allocated [@MickLesk](https://github.com/MickLesk) ([#18404](https://github.com/community-scripts/ProxmoxVE/pull/18404))
-
-  - #### 🔧 Refactor
-
-    - Technitium DNS: read the version from its GitHub releases [@MickLesk](https://github.com/MickLesk) ([#18425](https://github.com/community-scripts/ProxmoxVE/pull/18425))
-
-### 💾 Core
-
-  - fix: spot same-filesystem bind mounts on Alpine [@rcourtman](https://github.com/rcourtman) ([core#212](https://github.com/community-scripts/core/pull/212))
- fix: report a container that went down during setup, keep finished installs [@MickLesk](https://github.com/MickLesk) ([core#211](https://github.com/community-scripts/core/pull/211))
-
-### 📚 Documentation
-
-  - ci: reject DevScripts URLs in scripts [@MickLesk](https://github.com/MickLesk) ([#18498](https://github.com/community-scripts/ProxmoxVE/pull/18498))
-
-## 2026-11-05
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - OpenWRT-VM: leave the NIC untagged on a bridge without a port [@MickLesk](https://github.com/MickLesk) ([#18473](https://github.com/community-scripts/ProxmoxVE/pull/18473))
-    - Podman: skip Portainer where Podman has no Quadlet [@MickLesk](https://github.com/MickLesk) ([#18469](https://github.com/community-scripts/ProxmoxVE/pull/18469))
-    - Planka: change npm start argument to --production [@CerberusStyle](https://github.com/CerberusStyle) ([#18478](https://github.com/community-scripts/ProxmoxVE/pull/18478))
-    - OPNsense VM: wait for the FreeBSD login prompt instead of 180 seconds [@MickLesk](https://github.com/MickLesk) ([#18467](https://github.com/community-scripts/ProxmoxVE/pull/18467))
-
-  - #### 🔧 Refactor
-
-    - truenas-VM: let a failed ISO lookup reach its own error [@MickLesk](https://github.com/MickLesk) ([#18476](https://github.com/community-scripts/ProxmoxVE/pull/18476))
-    - proxmox-mail-gateway: take the repo suite from the container  [@MickLesk](https://github.com/MickLesk) ([#18475](https://github.com/community-scripts/ProxmoxVE/pull/18475))
-    - Immich: Bump to 3.3.6 and minor improvement [@MickLesk](https://github.com/MickLesk) ([#18474](https://github.com/community-scripts/ProxmoxVE/pull/18474))
-    - Tududi: run 2.0 on PostgreSQL, keep SQLite installs on 1.15.0 [@MickLesk](https://github.com/MickLesk) ([#18465](https://github.com/community-scripts/ProxmoxVE/pull/18465))
-
-### 💾 Core
-
-  - fix: keep the existing install until the new archive has extracted [@rcourtman](https://github.com/rcourtman) ([core#201](https://github.com/community-scripts/core/pull/201))
- fix: keep the install when a clone or an Alpine extract fails [@rcourtman](https://github.com/rcourtman) ([core#210](https://github.com/community-scripts/core/pull/210))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - Arcane: write both env names, stop shipping the unused .env [@MickLesk](https://github.com/MickLesk) ([#18466](https://github.com/community-scripts/ProxmoxVE/pull/18466))
-
-## 2026-11-04
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Teleport: Poll readyz instead of fixed 10 second sleep. [@cthach](https://github.com/cthach) ([#18461](https://github.com/community-scripts/ProxmoxVE/pull/18461))
-    - n8n: install past its unsatisfiable canvas dependencies [@MickLesk](https://github.com/MickLesk) ([#18439](https://github.com/community-scripts/ProxmoxVE/pull/18439))
-    - Teable: add Redis cache [@MickLesk](https://github.com/MickLesk) ([#18450](https://github.com/community-scripts/ProxmoxVE/pull/18450))
-
-### 💾 Core
-
-  - feat: say why download_gpg_key failed [@MickLesk](https://github.com/MickLesk) ([core#208](https://github.com/community-scripts/core/pull/208))
- feat: read the MOTD's OS version at login [@MickLesk](https://github.com/MickLesk) ([core#207](https://github.com/community-scripts/core/pull/207))
- feat: skip screen clear when there is no terminal | pin only the scripts own app with var_appversion [@MickLesk](https://github.com/MickLesk) ([core#203](https://github.com/community-scripts/core/pull/203))
-
-## 2026-11-03
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Fedora VM: let the engine install libguestfs-tools [@MickLesk](https://github.com/MickLesk) ([#18422](https://github.com/community-scripts/ProxmoxVE/pull/18422))
-    - Cinephage: run the camoufox binary the package now ships [@MickLesk](https://github.com/MickLesk) ([#18426](https://github.com/community-scripts/ProxmoxVE/pull/18426))
-    - AlmaLinux VM: report failures through the engine's error handler [@MickLesk](https://github.com/MickLesk) ([#18418](https://github.com/community-scripts/ProxmoxVE/pull/18418))
-    - WireGuard: give the Debian container 1 GB for WGDashboard [@MickLesk](https://github.com/MickLesk) ([#18419](https://github.com/community-scripts/ProxmoxVE/pull/18419))
-    - zabbix: use os specific apt packages [@MickLesk](https://github.com/MickLesk) ([#18417](https://github.com/community-scripts/ProxmoxVE/pull/18417))
-    - Discourse: build libvips 8.18 for its image worker [@MickLesk](https://github.com/MickLesk) ([#18430](https://github.com/community-scripts/ProxmoxVE/pull/18430))
-    - Wazuh: show the installer's own error when it fails [@MickLesk](https://github.com/MickLesk) ([#18428](https://github.com/community-scripts/ProxmoxVE/pull/18428))
-    - Tracearr: move to Node.js 26 [@connorgallopo](https://github.com/connorgallopo) ([#18393](https://github.com/community-scripts/ProxmoxVE/pull/18393))
-
-  - #### ✨ New Features
-
-    - Wiki.js: install 3.x [@MickLesk](https://github.com/MickLesk) ([#18382](https://github.com/community-scripts/ProxmoxVE/pull/18382))
-
-  - #### 🔧 Refactor
-
-    - OpenWrt VM: read the stable release from downloads.openwrt.org [@MickLesk](https://github.com/MickLesk) ([#18411](https://github.com/community-scripts/ProxmoxVE/pull/18411))
-    - Immich: fetch VectorChord from its new repo, skip Java, get GeoNames first [@MickLesk](https://github.com/MickLesk) ([#18397](https://github.com/community-scripts/ProxmoxVE/pull/18397))
-
-### 💾 Core
-
-  - fix: put the reason for a VM failure into its trace [@MickLesk](https://github.com/MickLesk) ([core#200](https://github.com/community-scripts/core/pull/200))
- fix: check the bridge before creating a container, and its state after start [@MickLesk](https://github.com/MickLesk) ([core#199](https://github.com/community-scripts/core/pull/199))
- ref: offer to remove only the container this run created [@MickLesk](https://github.com/MickLesk) ([core#198](https://github.com/community-scripts/core/pull/198))
- feat: report a cancelled tool dialog as an abort and name the failing command [@MickLesk](https://github.com/MickLesk) ([core#197](https://github.com/community-scripts/core/pull/197))
- feat: check KVM and the host's threads before building a VM [@MickLesk](https://github.com/MickLesk) ([core#196](https://github.com/community-scripts/core/pull/196))
- ref: give a host tool one log file for the whole run [@MickLesk](https://github.com/MickLesk) ([core#194](https://github.com/community-scripts/core/pull/194))
- fix: keep a piped stdin when output moves to the log after a hangup [@MickLesk](https://github.com/MickLesk) ([core#193](https://github.com/community-scripts/core/pull/193))
- fix: pve-LXC: say when the container went away during its setup [@MickLesk](https://github.com/MickLesk) ([core#192](https://github.com/community-scripts/core/pull/192))
- fix: treat Esc in a VM wizard dialog as leaving the script [@MickLesk](https://github.com/MickLesk) ([core#190](https://github.com/community-scripts/core/pull/190))
- ref: count a container stopped during a detached install as an abort [@MickLesk](https://github.com/MickLesk) ([core#187](https://github.com/community-scripts/core/pull/187))
- feat: find the assets of a renamed GitHub repo without the API [@MickLesk](https://github.com/MickLesk) ([core#188](https://github.com/community-scripts/core/pull/188))
- fix: restore npm when an interrupted update left it behind [@MickLesk](https://github.com/MickLesk) ([core#189](https://github.com/community-scripts/core/pull/189))
- feat: add var_cmode to set the container console mode [@MickLesk](https://github.com/MickLesk) ([core#180](https://github.com/community-scripts/core/pull/180))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - all-templates: answering No or Cancel is not a failure [@MickLesk](https://github.com/MickLesk) ([#18423](https://github.com/community-scripts/ProxmoxVE/pull/18423))
-    - homebrew: skip service accounts when picking the user, survive a failed apt update [@MickLesk](https://github.com/MickLesk) ([#18424](https://github.com/community-scripts/ProxmoxVE/pull/18424))
-    - add-tailscale-lxc: start a stopped container and check its OS first [@MickLesk](https://github.com/MickLesk) ([#18421](https://github.com/community-scripts/ProxmoxVE/pull/18421))
-    - netdata: survive a failed apt update, leave quietly on Cancel [@MickLesk](https://github.com/MickLesk) ([#18427](https://github.com/community-scripts/ProxmoxVE/pull/18427))
-    - Privilege-Converter: offer only container-capable storages as the converter's restore target [@MickLesk](https://github.com/MickLesk) ([#18415](https://github.com/community-scripts/ProxmoxVE/pull/18415))
-    - let post-pve-install go on when legacy sources are kept [@MickLesk](https://github.com/MickLesk) ([#18403](https://github.com/community-scripts/ProxmoxVE/pull/18403))
-
-  - #### 🔧 Refactor
-
-    -  update-apps: say why an backup or restore failed [@MickLesk](https://github.com/MickLesk) ([#18405](https://github.com/community-scripts/ProxmoxVE/pull/18405))
-    - Keep host tools running when clear does not know the terminal [@MickLesk](https://github.com/MickLesk) ([#18412](https://github.com/community-scripts/ProxmoxVE/pull/18412))
-    - Refuse to run the PBS 4 upgrade on a Proxmox VE host [@MickLesk](https://github.com/MickLesk) ([#18416](https://github.com/community-scripts/ProxmoxVE/pull/18416))
-    - fstrim: keep trimming when pct fstrim fails on one container [@MickLesk](https://github.com/MickLesk) ([#18413](https://github.com/community-scripts/ProxmoxVE/pull/18413))
-    - execute-lxc: do not abort on a container that is not Debian or Ubuntu [@MickLesk](https://github.com/MickLesk) ([#18414](https://github.com/community-scripts/ProxmoxVE/pull/18414))
-
-### 📚 Documentation
-
-  - github: flag instead of closing on first PR template miss; add script-request eligibility check [@MickLesk](https://github.com/MickLesk) ([#18384](https://github.com/community-scripts/ProxmoxVE/pull/18384))
-
-## 2026-11-02
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - FileFlows: replace the program folders on update [@MickLesk](https://github.com/MickLesk) ([#18380](https://github.com/community-scripts/ProxmoxVE/pull/18380))
-    - anchor: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18373](https://github.com/community-scripts/ProxmoxVE/pull/18373))
-    - guardian: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18375](https://github.com/community-scripts/ProxmoxVE/pull/18375))
-    - nametag: bump Node.js from 20 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18376](https://github.com/community-scripts/ProxmoxVE/pull/18376))
-
-### 💾 Core
-
-  - github: trim theater, add signal to the engine bug report; move AI block to end of PR template [@MickLesk](https://github.com/MickLesk) ([core#186](https://github.com/community-scripts/core/pull/186))
- fix: do not wait forever for verbose output a daemon keeps open [@MickLesk](https://github.com/MickLesk) ([core#185](https://github.com/community-scripts/core/pull/185))
-
-## 2026-11-01
-
-### 🆕 New Scripts
-
-  - Amazon Linux ([#18369](https://github.com/community-scripts/ProxmoxVE/pull/18369))
- CachyOS VM ([#18368](https://github.com/community-scripts/ProxmoxVE/pull/18368))
- Razzia ([#18366](https://github.com/community-scripts/ProxmoxVE/pull/18366))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - fix(zerobyte): build the bundled local agent [@nicotsx](https://github.com/nicotsx) ([#18363](https://github.com/community-scripts/ProxmoxVE/pull/18363))
@@ -17,6 +17,16 @@ Fixes #
 **Tested on:** <!-- e.g. PVE 9.2 / Debian 13 / fresh install + update. Write "not tested" if you could not run it. -->


+---
+
+## 🤖 AI Assistance (**X** in brackets)
+
+> If you used an AI tool (GitHub Copilot, Claude, ChatGPT, etc.) to write or generate any scripts in this PR, you **must** confirm compliance below.  
+> Select exactly one option.
+
+- [ ] **No AI used** – Scripts were written without AI assistance.
+- [ ] **AI was used** – I confirm the scripts were built using [`AGENTS.md`](https://github.com/community-scripts/DevScripts/blob/main/AGENTS.md) and [`.github/agents/pve-script-creator.agent.md`](https://github.com/community-scripts/DevScripts/blob/main/.github/agents/pve-script-creator.agent.md) as guidance, and the output has been reviewed and corrected to match those guidelines.
+
 ---

 ## 🛠️ Type of Change (**X** in brackets)
@@ -60,13 +70,3 @@ Guidance:
 -->

 <!-- The advisory block is only active once it is OUTSIDE this comment. -->
-
---
-
-## 🤖 AI Assistance (**X** in brackets)
-
-> If you used an AI tool (GitHub Copilot, Claude, ChatGPT, etc.) to write or generate any scripts in this PR, you **must** confirm compliance below.  
-> Select exactly one option.
-
- [ ] **No AI used** – Scripts were written without AI assistance.
- [ ] **AI was used** – I confirm the scripts were built using [`AGENTS.md`](https://github.com/community-scripts/DevScripts/blob/main/AGENTS.md) and [`.github/agents/pve-script-creator.agent.md`](https://github.com/community-scripts/DevScripts/blob/main/.github/agents/pve-script-creator.agent.md) as guidance, and the output has been reviewed and corrected to match those guidelines.
@@ -1,27 +0,0 @@
-name: Check Script Repo URL
-
-on:
-  pull_request:
-    branches: ["main"]
-    paths:
-      - "ct/**"
-      - "install/**"
-      - "vm/**"
-      - "tools/**"
-
-permissions:
-  contents: read
-
-jobs:
-  check:
-    if: github.repository == 'community-scripts/ProxmoxVE'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Reject DevScripts URLs
-        run: |
-          if grep -rnE 'community-scripts/(ProxmoxVED|DevScripts)/' ct install vm tools; then
-            echo "::error::These lines point at DevScripts, so telemetry files the runs there. Use community-scripts/ProxmoxVE."
-            exit 1
-          fi
@@ -1,4 +1,4 @@
-name: Flag PRs Missing Template
+name: Close PRs Missing Template

 on:
  pull_request_target:
@@ -14,12 +14,10 @@ jobs:
      issues: write
      contents: read
    steps:
-      - name: Check PR against the template, comment and label instead of closing
+      - name: Close PR if it does not follow the PR template
        uses: actions/github-script@v9
        with:
          script: |
-            const MARKER = "<!-- pr-template-check -->";
-            const LABELS = ["missing pr template", "stale"];
            const pr = context.payload.pull_request;
            const prNumber = pr.number;
            const author = pr.user.login;
@@ -46,11 +44,11 @@ jobs:
              return;
            }

-            const prLabels = pr.labels.map((label) => label.name);
+            const labels = pr.labels.map((label) => label.name);
            const skipLabels = ["automated pr", "keep-open"];

-            if (skipLabels.some((label) => prLabels.includes(label))) {
-              core.info(`PR #${prNumber} has a skip label (${prLabels.join(", ")}) — skipping template validation.`);
+            if (skipLabels.some((label) => labels.includes(label))) {
+              core.info(`PR #${prNumber} has a skip label (${labels.join(", ")}) — skipping template validation.`);
              return;
            }

@@ -116,52 +114,50 @@ jobs:
              failures.push("At least one **Type of Change** checkbox must be checked.");
            }

-            const comments = await github.paginate(github.rest.issues.listComments, {
-              owner, repo, issue_number: prNumber, per_page: 100
-            });
-            const mine = comments.find(c => c.body && c.body.includes(MARKER));
-
            if (failures.length === 0) {
              core.info(`PR #${prNumber} follows the PR template.`);
-              if (mine && !mine.body.startsWith(MARKER + "\n✅")) {
-                await github.rest.issues.updateComment({
-                  owner, repo, comment_id: mine.id,
-                  body: MARKER + "\n✅ **Template check passed.** Thanks for fixing the description — the `stale` mark has been removed.",
-                });
-              }
-              for (const name of LABELS) {
-                if (prLabels.includes(name)) {
-                  await github.rest.issues.removeLabel({ owner, repo, issue_number: prNumber, name });
-                }
-              }
              return;
            }

-            core.info(`PR #${prNumber} — template validation failed, flagging instead of closing.`);
+            core.info(`Closing PR #${prNumber} — template validation failed.`);

            const templateUrl =
              "https://github.com/community-scripts/ProxmoxVE/blob/main/.github/pull_request_template.md";
            const failureList = failures.map((item) => `- ${item}`).join("\n");

-            const text =
-              MARKER + "\n" +
-              `👋 Hi @${author},\n\n` +
-              `This pull request does not follow the [PR template](${templateUrl}) yet:\n\n` +
-              failureList + "\n\n" +
-              `**Edit the PR description** to fix it — no new PR needed. This check runs again on every edit and clears itself once everything is in place.\n\n` +
-              `Until then the PR is marked \`stale\` and will be closed in **7 days**.\n\n` +
-              `Maintainers can add the \`keep-open\` label to exempt a PR from this check.\n\n` +
-              `Thank you for contributing! 🙏`;
+            const comment = [
+              `👋 Hi @${author},`,
+              ``,
+              `This pull request was closed because it does not follow the [PR template](${templateUrl}).`,
+              ``,
+              `Please fix the following and open a new PR (or reopen this one after updating the description):`,
+              ``,
+              failureList,
+              ``,
+              `> Use the template sections, fill in the description, check all prerequisite boxes, and select at least one type of change.`,
+              ``,
+              `Maintainers can add the \`keep-open\` label to exempt a PR from this check.`,
+              ``,
+              `Thank you for contributing! 🙏`,
+            ].join("\n");

-            if (mine) {
-              if (mine.body !== text) {
-                await github.rest.issues.updateComment({ owner, repo, comment_id: mine.id, body: text });
-              }
-            } else {
-              await github.rest.issues.createComment({ owner, repo, issue_number: prNumber, body: text });
-            }
+            await github.rest.issues.createComment({
+              owner,
+              repo,
+              issue_number: prNumber,
+              body: comment,
+            });

-            const toAdd = LABELS.filter(name => !prLabels.includes(name));
-            if (toAdd.length > 0) {
-              await github.rest.issues.addLabels({ owner, repo, issue_number: prNumber, labels: toAdd });
-            }
+            await github.rest.pulls.update({
+              owner,
+              repo,
+              pull_number: prNumber,
+              state: "closed",
+            });
+
+            await github.rest.issues.addLabels({
+              owner,
+              repo,
+              issue_number: prNumber,
+              labels: ["missing pr template"],
+            });
@@ -1,141 +0,0 @@
-name: Request Script Eligibility Check
-
-# category.slug is the same string GitHub uses in the "new discussion" URL
-# (?category=request-script, linked from every repo's issue chooser), so this
-# guard matches the live category without needing its numeric id.
-on:
-  discussion:
-    types: [created, edited, reopened]
-
-jobs:
-  check-eligibility:
-    if: github.repository == 'community-scripts/ProxmoxVE' && github.event.discussion.category.slug == 'request-script'
-    runs-on: ubuntu-latest
-    permissions:
-      discussions: write
-      issues: write
-      contents: read
-    steps:
-      - name: Verify stars/age, flag or close
-        uses: actions/github-script@v9
-        with:
-          script: |
-            const owner = context.repo.owner;
-            const repo = context.repo.repo;
-            const discussion = context.payload.discussion;
-
-            if (!discussion || discussion.state === "closed") {
-              core.info("Discussion missing or already closed — skipping.");
-              return;
-            }
-
-            const body = discussion.body || "";
-            const lines = body.split("\n");
-            const fields = {};
-            let current = null;
-            for (const line of lines) {
-              const m = line.match(/^###\s+(.+?)\s*$/);
-              if (m) {
-                current = m[1].trim();
-                fields[current] = [];
-              } else if (current) {
-                fields[current].push(line);
-              }
-            }
-            function fieldText(label) {
-              const raw = (fields[label] || []).join("\n").trim();
-              return raw === "_No response_" ? "" : raw;
-            }
-
-            const sourceRepo = fieldText("Source Repository");
-            const justification = fieldText("Justification for an exception");
-
-            let eligible = false;
-            let verified = false;
-            const ghMatch = sourceRepo.match(/^https?:\/\/(?:www\.)?github\.com\/([^\/\s]+)\/([^\/\s#?]+?)(?:\.git)?\/?(?:[#?].*)?$/i);
-
-            if (ghMatch) {
-              const [, repoOwner, repoName] = ghMatch;
-              try {
-                const { data: repoData } = await github.rest.repos.get({ owner: repoOwner, repo: repoName });
-                const stars = repoData.stargazers_count;
-                const createdAt = new Date(repoData.created_at);
-                const now = new Date();
-                const ageMonths =
-                  (now.getFullYear() - createdAt.getFullYear()) * 12 +
-                  (now.getMonth() - createdAt.getMonth()) -
-                  (now.getDate() < createdAt.getDate() ? 1 : 0);
-                eligible = stars >= 1000 && ageMonths >= 6;
-                verified = true;
-                core.info(`Verified ${repoOwner}/${repoName}: ${stars} stars, ${ageMonths} months old, eligible=${eligible}`);
-              } catch (err) {
-                core.warning(`Could not verify ${repoOwner}/${repoName}: ${err.message} — treating as unverifiable.`);
-              }
-            } else {
-              core.info("Source Repository is not a github.com URL — cannot auto-verify, treating as unverifiable.");
-            }
-
-            if (eligible) {
-              core.info(`Discussion #${discussion.number} meets the requirements — no action.`);
-              return;
-            }
-
-            const labels = (discussion.labels || []).map(l => l.name);
-            const reasonLine = verified
-              ? "the source repository does not meet the 1,000-star / 6-month minimum adoption requirement"
-              : "the source repository's star count and age could not be verified automatically";
-
-            if (justification) {
-              if (labels.includes("investigation")) {
-                core.info(`Discussion #${discussion.number} already flagged for investigation — skipping.`);
-                return;
-              }
-
-              try {
-                await github.rest.issues.createLabel({
-                  owner, repo, name: "investigation",
-                  color: "fbca04",
-                  description: "Below the normal script-request threshold; a justification was given and needs maintainer review.",
-                });
-              } catch (err) {
-                if (err.status !== 422) throw err;
-              }
-
-              const labelQuery = await github.graphql(
-                `query($owner: String!, $repo: String!) { repository(owner: $owner, name: $repo) { label(name: "investigation") { id } } }`,
-                { owner, repo }
-              );
-              const labelNodeId = labelQuery.repository.label.id;
-
-              await github.graphql(
-                `mutation($labelableId: ID!, $labelIds: [ID!]!) { addLabelsToLabelable(input: { labelableId: $labelableId, labelIds: $labelIds }) { clientMutationId } }`,
-                { labelableId: discussion.node_id, labelIds: [labelNodeId] }
-              );
-
-              await github.graphql(
-                `mutation($discussionId: ID!, $body: String!) { addDiscussionComment(input: { discussionId: $discussionId, body: $body }) { comment { id } } }`,
-                {
-                  discussionId: discussion.node_id,
-                  body:
-                    `Thanks for the justification — ${reasonLine}, so this has been flagged \`investigation\` for a maintainer ` +
-                    `to review manually rather than closed automatically.`,
-                }
-              );
-            } else {
-              await github.graphql(
-                `mutation($discussionId: ID!, $body: String!) { addDiscussionComment(input: { discussionId: $discussionId, body: $body }) { comment { id } } }`,
-                {
-                  discussionId: discussion.node_id,
-                  body:
-                    `This request doesn't meet the minimum requirements (1,000 stars, project at least 6 months old) — ` +
-                    `${reasonLine}, and no justification was given. Closing automatically.\n\n` +
-                    `If you believe this project qualifies for an exception, edit this discussion to fill in ` +
-                    `**Justification for an exception** and reopen it — it will then be flagged for manual review instead of closed again.`,
-                }
-              );
-
-              await github.graphql(
-                `mutation($discussionId: ID!) { closeDiscussion(input: { discussionId: $discussionId, reason: OUTDATED }) { discussion { id } } }`,
-                { discussionId: discussion.node_id }
-              );
-            }
@@ -22,112 +22,90 @@ jobs:
            const now = new Date();
            const owner = context.repo.owner;
            const repo = context.repo.repo;
-            const TEMPLATE_LABEL = "missing pr template";
-            const MAINTAINERS = ["OWNER", "MEMBER", "COLLABORATOR"];
-            const days = d => (now - d) / (1000 * 60 * 60 * 24);
-            const staleNotice = author =>
-              `@${author} This PR has been marked as stale. It will be closed if no new commits are added in 7 days.`;
-
-            // Only fires for a maintainer's label: labels set with GITHUB_TOKEN raise no event.
+            
+            // --- When stale label is added, comment immediately ---
            if (context.eventName === "pull_request_target" && context.payload.action === "labeled") {
-              const pr = context.payload.pull_request;
-              const labels = (pr.labels || []).map(l => l.name);
-              if (context.payload.label?.name === "stale" && !labels.includes(TEMPLATE_LABEL)) {
+              const label = context.payload.label?.name;
+              if (label === "stale") {
+                const author = context.payload.pull_request.user.login;
                await github.rest.issues.createComment({
-                  owner, repo, issue_number: pr.number, body: staleNotice(pr.user.login)
+                  owner,
+                  repo,
+                  issue_number: context.payload.pull_request.number,
+                  body: `@${author} This PR has been marked as stale. It will be closed if no new commits are added in 7 days.`
                });
              }
              return;
            }
-
-            const prs = await github.paginate(github.rest.pulls.list, { owner, repo, state: "open", per_page: 100 });
-
+            
+            // --- Scheduled run: check all stale PRs ---
+            const { data: prs } = await github.rest.pulls.list({
+              owner,
+              repo,
+              state: "open",
+              per_page: 100
+            });
+            
            for (const pr of prs) {
-              const labels = pr.labels.map(l => l.name);
-              const author = pr.user.login;
-              const hasStale = labels.includes("stale");
-
-              if (labels.includes("keep-open")) {
-                if (hasStale) {
-                  await github.rest.issues.removeLabel({ owner, repo, issue_number: pr.number, name: "stale" });
-                }
-                continue;
-              }
-
-              const comments = await github.paginate(github.rest.issues.listComments, {
-                owner, repo, issue_number: pr.number, per_page: 100
+              const hasStale = pr.labels.some(l => l.name === "stale");
+              if (!hasStale) continue;
+              
+              // Get timeline events to find when stale label was added
+              const { data: events } = await github.rest.issues.listEvents({
+                owner,
+                repo,
+                issue_number: pr.number,
+                per_page: 100
              });
-              const commits = await github.paginate(github.rest.pulls.listCommits, {
-                owner, repo, pull_number: pr.number, per_page: 100
-              });
-              const lastCommitDate = commits.length > 0
-                ? new Date(commits[commits.length - 1].commit.author.date)
-                : new Date(pr.created_at);
-              const humanComments = comments.filter(c => c.user?.type !== "Bot");
-
-              // -------------------------------------------------------
-              // Auto-label PRs with no activity in the last 14 days,
-              // but ONLY if someone other than the author has engaged.
-              // -------------------------------------------------------
-              if (!hasStale) {
-                const reviews = await github.paginate(github.rest.pulls.listReviews, {
-                  owner, repo, pull_number: pr.number, per_page: 100
-                });
-                const engaged =
-                  reviews.some(r => r.user?.type !== "Bot" && r.user?.login !== author) ||
-                  humanComments.some(c => c.user?.login !== author);
-                if (!engaged) continue;
-
-                const lastCommentDate = humanComments.length > 0
-                  ? new Date(humanComments[humanComments.length - 1].created_at)
-                  : null;
-                const lastActivityDate = lastCommentDate && lastCommentDate > lastCommitDate
-                  ? lastCommentDate
-                  : lastCommitDate;
-
-                if (days(lastActivityDate) > 14) {
-                  await github.rest.issues.addLabels({ owner, repo, issue_number: pr.number, labels: ["stale"] });
-                  await github.rest.issues.createComment({ owner, repo, issue_number: pr.number, body: staleNotice(author) });
-                }
-                continue;
-              }
-
-              // -------------------------------------------------------
-              // Manage already-stale PRs
-              // -------------------------------------------------------
-              const events = await github.paginate(github.rest.issues.listEvents, {
-                owner, repo, issue_number: pr.number, per_page: 100
-              });
-              const staleDates = events
+              
+              // Find the most recent time the stale label was added
+              const staleLabelEvents = events
                .filter(e => e.event === "labeled" && e.label?.name === "stale")
-                .map(e => new Date(e.created_at));
-              if (staleDates.length === 0) continue;
-              const staleLabelDate = new Date(Math.max(...staleDates));
-              const isTemplateIssue = labels.includes(TEMPLATE_LABEL);
-
-              // A push ends an inactivity mark; a template mark only ends via close-invalid-pr-template.yml's re-check.
-              if (!isTemplateIssue && lastCommitDate > staleLabelDate) {
-                await github.rest.issues.removeLabel({ owner, repo, issue_number: pr.number, name: "stale" });
+                .sort((a, b) => new Date(b.created_at) - new Date(a.created_at));
+              
+              if (staleLabelEvents.length === 0) continue;
+              
+              const staleLabelDate = new Date(staleLabelEvents[0].created_at);
+              const daysSinceStale = (now - staleLabelDate) / (1000 * 60 * 60 * 24);
+              
+              // Check for new commits since stale label was added
+              const { data: commits } = await github.rest.pulls.listCommits({
+                owner,
+                repo,
+                pull_number: pr.number
+              });
+              
+              const lastCommitDate = new Date(commits[commits.length - 1].commit.author.date);
+              const author = pr.user.login;
+              
+              // If there are new commits after the stale label, remove it
+              if (lastCommitDate > staleLabelDate) {
+                await github.rest.issues.removeLabel({
+                  owner,
+                  repo,
+                  issue_number: pr.number,
+                  name: "stale"
+                });
                await github.rest.issues.createComment({
-                  owner, repo, issue_number: pr.number,
+                  owner,
+                  repo,
+                  issue_number: pr.number,
                  body: `@${author} Recent activity detected. Removing stale label.`
                });
-                continue;
              }
-
-              // A maintainer comment after the mark restarts the 7 days.
-              const maintainerDates = humanComments
-                .filter(c => MAINTAINERS.includes(c.author_association) && c.user?.login !== author)
-                .map(c => new Date(c.created_at))
-                .filter(d => d > staleLabelDate);
-              const clockStart = maintainerDates.length > 0 ? new Date(Math.max(...maintainerDates)) : staleLabelDate;
-              if (days(clockStart) <= 7) continue;
-
-              await github.rest.issues.createComment({
-                owner, repo, issue_number: pr.number,
-                body: isTemplateIssue
-                  ? `@${author} Closing: the PR template requirements listed above were still missing 7 days later. Once they are in place, please open a new pull request.`
-                  : `@${author} Closing stale PR due to inactivity (no commits for 7 days after stale label).`
-              });
-              await github.rest.pulls.update({ owner, repo, pull_number: pr.number, state: "closed" });
+              // If 7 days have passed since stale label, close the PR
+              else if (daysSinceStale > 7) {
+                await github.rest.pulls.update({
+                  owner,
+                  repo,
+                  pull_number: pr.number,
+                  state: "closed"
+                });
+                await github.rest.issues.createComment({
+                  owner,
+                  repo,
+                  issue_number: pr.number,
+                  body: `@${author} Closing stale PR due to inactivity (no commits for 7 days after stale label).`
+                });
+              }
            }
@@ -125,9 +125,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit



-
-
-



@@ -140,13 +137,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 <summary><h3>2026</h3></summary>


-<details>
-<summary><h4>November (7 entries)</h4></summary>
-
-[View November 2026 Changelog](.github/changelogs/2026/11.md)
-
-</details>
-
 <details>
 <summary><h4>October (31 entries)</h4></summary>

@@ -581,239 +571,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 </details>

-## 2026-11-09
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - zipline: Update RAM to 3GB [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18569](https://github.com/community-scripts/ProxmoxVE/pull/18569))
-    - OpenObserve: record installed version, drop killall ExecStop [@BadFlo](https://github.com/BadFlo) ([#18566](https://github.com/community-scripts/ProxmoxVE/pull/18566))
-    - OpenObserve: extract release tarball with --no-same-owner [@BadFlo](https://github.com/BadFlo) ([#18564](https://github.com/community-scripts/ProxmoxVE/pull/18564))
-    - Immich: download before stopping, and clear maintenance mode after an interrupted update [@angusmaul](https://github.com/angusmaul) ([#18553](https://github.com/community-scripts/ProxmoxVE/pull/18553))
-    - cinephage: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18374](https://github.com/community-scripts/ProxmoxVE/pull/18374))
-    - kan: bump Node.js from 20 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18549](https://github.com/community-scripts/ProxmoxVE/pull/18549))
-    - myip: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18550](https://github.com/community-scripts/ProxmoxVE/pull/18550))
-
-  - #### 🔧 Refactor
-
-    - yuvomi: install from the attested release asset [@ulsklyc](https://github.com/ulsklyc) ([#18554](https://github.com/community-scripts/ProxmoxVE/pull/18554))
-
-### 🗑️ Deleted Scripts
-
-  - coolify: delete old ct / its an addon [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#18562](https://github.com/community-scripts/ProxmoxVE/pull/18562))
-
-### 💾 Core
-
-  - core: detect GPUs by their PCI class, not by text anywhere in the line [@MickLesk](https://github.com/MickLesk) ([core#221](https://github.com/community-scripts/core/pull/221))
- core: load an app's own settings from its .vars file [@MickLesk](https://github.com/MickLesk) ([core#216](https://github.com/community-scripts/core/pull/216))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - IP-Tag: filter guest-agent IPs by CIDR before limiting to 3 [@mazelado](https://github.com/mazelado) ([#18537](https://github.com/community-scripts/ProxmoxVE/pull/18537))
-
-## 2026-11-08
-
-### 🆕 New Scripts
-
-  - Chatto ([#18521](https://github.com/community-scripts/ProxmoxVE/pull/18521))
- Firefox-Syncserver ([#18520](https://github.com/community-scripts/ProxmoxVE/pull/18520))
-
-### 🚀 Updated Scripts
-
-  - #### 🔧 Refactor
-
-    - Immich: do not clone libjxl's testdata [@MickLesk](https://github.com/MickLesk) ([#18539](https://github.com/community-scripts/ProxmoxVE/pull/18539))
-    - Databasus: build 3.65 and ship the verification agent [@MickLesk](https://github.com/MickLesk) ([#18500](https://github.com/community-scripts/ProxmoxVE/pull/18500))
-
-### 💾 Core
-
-  - fix: a closed console no longer ends a running setup | ERR trap fixes | check VM ID before creating [@MickLesk](https://github.com/MickLesk) ([core#219](https://github.com/community-scripts/core/pull/219))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - update-apps: keep the backup alive on a closed console, stop before restoring [@MickLesk](https://github.com/MickLesk) ([#18540](https://github.com/community-scripts/ProxmoxVE/pull/18540))
-    - clean-lxcs: run with sh and keep going when one container fails [@MickLesk](https://github.com/MickLesk) ([#18538](https://github.com/community-scripts/ProxmoxVE/pull/18538))
-    - update-lxcs: keep going when one container fails [@MickLesk](https://github.com/MickLesk) ([#18541](https://github.com/community-scripts/ProxmoxVE/pull/18541))
-
-## 2026-11-07
-
-### 🆕 New Scripts
-
-  - EspoCRM ([#18519](https://github.com/community-scripts/ProxmoxVE/pull/18519))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - RomM: emit player isolation headers from the serving location [@adotagarwal](https://github.com/adotagarwal) ([#18511](https://github.com/community-scripts/ProxmoxVE/pull/18511))
-
-  - #### 💥 Breaking Changes
-
-    - fix: gotenberg: update to v9 [@CrazyWolf13](https://github.com/CrazyWolf13) ([#18491](https://github.com/community-scripts/ProxmoxVE/pull/18491))
-
-### 💾 Core
-
-  - nvidia: close the hardware acceleration step when no GPU is usable | pin the whole NVIDIA userspace to the host's driver version [@MickLesk](https://github.com/MickLesk) ([core#215](https://github.com/community-scripts/core/pull/215))
- fix: stage release downloads on disk, not in /tmp [@rcourtman](https://github.com/rcourtman) ([core#218](https://github.com/community-scripts/core/pull/218))
- Minor fixes: restart php-fpm during sigpipe, Install jq for forge commands  [@MickLesk](https://github.com/MickLesk) ([core#213](https://github.com/community-scripts/core/pull/213))
- incus: name the project restriction that refuses an Incus launch [@MickLesk](https://github.com/MickLesk) ([core#214](https://github.com/community-scripts/core/pull/214))
-
-## 2026-11-06
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - UmbrelOS-VM: report runs as ProxmoxVE, not DevScripts [@MickLesk](https://github.com/MickLesk) ([#18497](https://github.com/community-scripts/ProxmoxVE/pull/18497))
-    - Caddy: skip the xCaddy test build below 2 GB RAM [@MickLesk](https://github.com/MickLesk) ([#18472](https://github.com/community-scripts/ProxmoxVE/pull/18472))
-    - Thingsboard: keep the package defaults in thingsboard.conf [@MickLesk](https://github.com/MickLesk) ([#18499](https://github.com/community-scripts/ProxmoxVE/pull/18499))
-    - Nexterm: keep the extracted app out of the /tmp cleanup [@MickLesk](https://github.com/MickLesk) ([#18501](https://github.com/community-scripts/ProxmoxVE/pull/18501))
-    - PLANKA: run the service with node instead of nodemon [@MickLesk](https://github.com/MickLesk) ([#18503](https://github.com/community-scripts/ProxmoxVE/pull/18503))
-    - MeTube/Yubal: install Deno without its shell setup [@MickLesk](https://github.com/MickLesk) ([#18406](https://github.com/community-scripts/ProxmoxVE/pull/18406))
-    - OPNsense VM: size the temp space check to the unpacked image |  say why the EFI disk could not be allocated [@MickLesk](https://github.com/MickLesk) ([#18404](https://github.com/community-scripts/ProxmoxVE/pull/18404))
-
-  - #### 🔧 Refactor
-
-    - Technitium DNS: read the version from its GitHub releases [@MickLesk](https://github.com/MickLesk) ([#18425](https://github.com/community-scripts/ProxmoxVE/pull/18425))
-
-### 💾 Core
-
-  - fix: spot same-filesystem bind mounts on Alpine [@rcourtman](https://github.com/rcourtman) ([core#212](https://github.com/community-scripts/core/pull/212))
- fix: report a container that went down during setup, keep finished installs [@MickLesk](https://github.com/MickLesk) ([core#211](https://github.com/community-scripts/core/pull/211))
-
-### 📚 Documentation
-
-  - ci: reject DevScripts URLs in scripts [@MickLesk](https://github.com/MickLesk) ([#18498](https://github.com/community-scripts/ProxmoxVE/pull/18498))
-
-## 2026-11-05
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - OpenWRT-VM: leave the NIC untagged on a bridge without a port [@MickLesk](https://github.com/MickLesk) ([#18473](https://github.com/community-scripts/ProxmoxVE/pull/18473))
-    - Podman: skip Portainer where Podman has no Quadlet [@MickLesk](https://github.com/MickLesk) ([#18469](https://github.com/community-scripts/ProxmoxVE/pull/18469))
-    - Planka: change npm start argument to --production [@CerberusStyle](https://github.com/CerberusStyle) ([#18478](https://github.com/community-scripts/ProxmoxVE/pull/18478))
-    - OPNsense VM: wait for the FreeBSD login prompt instead of 180 seconds [@MickLesk](https://github.com/MickLesk) ([#18467](https://github.com/community-scripts/ProxmoxVE/pull/18467))
-
-  - #### 🔧 Refactor
-
-    - truenas-VM: let a failed ISO lookup reach its own error [@MickLesk](https://github.com/MickLesk) ([#18476](https://github.com/community-scripts/ProxmoxVE/pull/18476))
-    - proxmox-mail-gateway: take the repo suite from the container  [@MickLesk](https://github.com/MickLesk) ([#18475](https://github.com/community-scripts/ProxmoxVE/pull/18475))
-    - Immich: Bump to 3.3.6 and minor improvement [@MickLesk](https://github.com/MickLesk) ([#18474](https://github.com/community-scripts/ProxmoxVE/pull/18474))
-    - Tududi: run 2.0 on PostgreSQL, keep SQLite installs on 1.15.0 [@MickLesk](https://github.com/MickLesk) ([#18465](https://github.com/community-scripts/ProxmoxVE/pull/18465))
-
-### 💾 Core
-
-  - fix: keep the existing install until the new archive has extracted [@rcourtman](https://github.com/rcourtman) ([core#201](https://github.com/community-scripts/core/pull/201))
- fix: keep the install when a clone or an Alpine extract fails [@rcourtman](https://github.com/rcourtman) ([core#210](https://github.com/community-scripts/core/pull/210))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - Arcane: write both env names, stop shipping the unused .env [@MickLesk](https://github.com/MickLesk) ([#18466](https://github.com/community-scripts/ProxmoxVE/pull/18466))
-
-## 2026-11-04
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Teleport: Poll readyz instead of fixed 10 second sleep. [@cthach](https://github.com/cthach) ([#18461](https://github.com/community-scripts/ProxmoxVE/pull/18461))
-    - n8n: install past its unsatisfiable canvas dependencies [@MickLesk](https://github.com/MickLesk) ([#18439](https://github.com/community-scripts/ProxmoxVE/pull/18439))
-    - Teable: add Redis cache [@MickLesk](https://github.com/MickLesk) ([#18450](https://github.com/community-scripts/ProxmoxVE/pull/18450))
-
-### 💾 Core
-
-  - feat: say why download_gpg_key failed [@MickLesk](https://github.com/MickLesk) ([core#208](https://github.com/community-scripts/core/pull/208))
- feat: read the MOTD's OS version at login [@MickLesk](https://github.com/MickLesk) ([core#207](https://github.com/community-scripts/core/pull/207))
- feat: skip screen clear when there is no terminal | pin only the scripts own app with var_appversion [@MickLesk](https://github.com/MickLesk) ([core#203](https://github.com/community-scripts/core/pull/203))
-
-## 2026-11-03
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Fedora VM: let the engine install libguestfs-tools [@MickLesk](https://github.com/MickLesk) ([#18422](https://github.com/community-scripts/ProxmoxVE/pull/18422))
-    - Cinephage: run the camoufox binary the package now ships [@MickLesk](https://github.com/MickLesk) ([#18426](https://github.com/community-scripts/ProxmoxVE/pull/18426))
-    - AlmaLinux VM: report failures through the engine's error handler [@MickLesk](https://github.com/MickLesk) ([#18418](https://github.com/community-scripts/ProxmoxVE/pull/18418))
-    - WireGuard: give the Debian container 1 GB for WGDashboard [@MickLesk](https://github.com/MickLesk) ([#18419](https://github.com/community-scripts/ProxmoxVE/pull/18419))
-    - zabbix: use os specific apt packages [@MickLesk](https://github.com/MickLesk) ([#18417](https://github.com/community-scripts/ProxmoxVE/pull/18417))
-    - Discourse: build libvips 8.18 for its image worker [@MickLesk](https://github.com/MickLesk) ([#18430](https://github.com/community-scripts/ProxmoxVE/pull/18430))
-    - Wazuh: show the installer's own error when it fails [@MickLesk](https://github.com/MickLesk) ([#18428](https://github.com/community-scripts/ProxmoxVE/pull/18428))
-    - Tracearr: move to Node.js 26 [@connorgallopo](https://github.com/connorgallopo) ([#18393](https://github.com/community-scripts/ProxmoxVE/pull/18393))
-
-  - #### ✨ New Features
-
-    - Wiki.js: install 3.x [@MickLesk](https://github.com/MickLesk) ([#18382](https://github.com/community-scripts/ProxmoxVE/pull/18382))
-
-  - #### 🔧 Refactor
-
-    - OpenWrt VM: read the stable release from downloads.openwrt.org [@MickLesk](https://github.com/MickLesk) ([#18411](https://github.com/community-scripts/ProxmoxVE/pull/18411))
-    - Immich: fetch VectorChord from its new repo, skip Java, get GeoNames first [@MickLesk](https://github.com/MickLesk) ([#18397](https://github.com/community-scripts/ProxmoxVE/pull/18397))
-
-### 💾 Core
-
-  - fix: put the reason for a VM failure into its trace [@MickLesk](https://github.com/MickLesk) ([core#200](https://github.com/community-scripts/core/pull/200))
- fix: check the bridge before creating a container, and its state after start [@MickLesk](https://github.com/MickLesk) ([core#199](https://github.com/community-scripts/core/pull/199))
- ref: offer to remove only the container this run created [@MickLesk](https://github.com/MickLesk) ([core#198](https://github.com/community-scripts/core/pull/198))
- feat: report a cancelled tool dialog as an abort and name the failing command [@MickLesk](https://github.com/MickLesk) ([core#197](https://github.com/community-scripts/core/pull/197))
- feat: check KVM and the host's threads before building a VM [@MickLesk](https://github.com/MickLesk) ([core#196](https://github.com/community-scripts/core/pull/196))
- ref: give a host tool one log file for the whole run [@MickLesk](https://github.com/MickLesk) ([core#194](https://github.com/community-scripts/core/pull/194))
- fix: keep a piped stdin when output moves to the log after a hangup [@MickLesk](https://github.com/MickLesk) ([core#193](https://github.com/community-scripts/core/pull/193))
- fix: pve-LXC: say when the container went away during its setup [@MickLesk](https://github.com/MickLesk) ([core#192](https://github.com/community-scripts/core/pull/192))
- fix: treat Esc in a VM wizard dialog as leaving the script [@MickLesk](https://github.com/MickLesk) ([core#190](https://github.com/community-scripts/core/pull/190))
- ref: count a container stopped during a detached install as an abort [@MickLesk](https://github.com/MickLesk) ([core#187](https://github.com/community-scripts/core/pull/187))
- feat: find the assets of a renamed GitHub repo without the API [@MickLesk](https://github.com/MickLesk) ([core#188](https://github.com/community-scripts/core/pull/188))
- fix: restore npm when an interrupted update left it behind [@MickLesk](https://github.com/MickLesk) ([core#189](https://github.com/community-scripts/core/pull/189))
- feat: add var_cmode to set the container console mode [@MickLesk](https://github.com/MickLesk) ([core#180](https://github.com/community-scripts/core/pull/180))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - all-templates: answering No or Cancel is not a failure [@MickLesk](https://github.com/MickLesk) ([#18423](https://github.com/community-scripts/ProxmoxVE/pull/18423))
-    - homebrew: skip service accounts when picking the user, survive a failed apt update [@MickLesk](https://github.com/MickLesk) ([#18424](https://github.com/community-scripts/ProxmoxVE/pull/18424))
-    - add-tailscale-lxc: start a stopped container and check its OS first [@MickLesk](https://github.com/MickLesk) ([#18421](https://github.com/community-scripts/ProxmoxVE/pull/18421))
-    - netdata: survive a failed apt update, leave quietly on Cancel [@MickLesk](https://github.com/MickLesk) ([#18427](https://github.com/community-scripts/ProxmoxVE/pull/18427))
-    - Privilege-Converter: offer only container-capable storages as the converter's restore target [@MickLesk](https://github.com/MickLesk) ([#18415](https://github.com/community-scripts/ProxmoxVE/pull/18415))
-    - let post-pve-install go on when legacy sources are kept [@MickLesk](https://github.com/MickLesk) ([#18403](https://github.com/community-scripts/ProxmoxVE/pull/18403))
-
-  - #### 🔧 Refactor
-
-    -  update-apps: say why an backup or restore failed [@MickLesk](https://github.com/MickLesk) ([#18405](https://github.com/community-scripts/ProxmoxVE/pull/18405))
-    - Keep host tools running when clear does not know the terminal [@MickLesk](https://github.com/MickLesk) ([#18412](https://github.com/community-scripts/ProxmoxVE/pull/18412))
-    - Refuse to run the PBS 4 upgrade on a Proxmox VE host [@MickLesk](https://github.com/MickLesk) ([#18416](https://github.com/community-scripts/ProxmoxVE/pull/18416))
-    - fstrim: keep trimming when pct fstrim fails on one container [@MickLesk](https://github.com/MickLesk) ([#18413](https://github.com/community-scripts/ProxmoxVE/pull/18413))
-    - execute-lxc: do not abort on a container that is not Debian or Ubuntu [@MickLesk](https://github.com/MickLesk) ([#18414](https://github.com/community-scripts/ProxmoxVE/pull/18414))
-
-### 📚 Documentation
-
-  - github: flag instead of closing on first PR template miss; add script-request eligibility check [@MickLesk](https://github.com/MickLesk) ([#18384](https://github.com/community-scripts/ProxmoxVE/pull/18384))
-
-## 2026-11-02
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - FileFlows: replace the program folders on update [@MickLesk](https://github.com/MickLesk) ([#18380](https://github.com/community-scripts/ProxmoxVE/pull/18380))
-    - anchor: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18373](https://github.com/community-scripts/ProxmoxVE/pull/18373))
-    - guardian: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18375](https://github.com/community-scripts/ProxmoxVE/pull/18375))
-    - nametag: bump Node.js from 20 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18376](https://github.com/community-scripts/ProxmoxVE/pull/18376))
-
-### 💾 Core
-
-  - github: trim theater, add signal to the engine bug report; move AI block to end of PR template [@MickLesk](https://github.com/MickLesk) ([core#186](https://github.com/community-scripts/core/pull/186))
- fix: do not wait forever for verbose output a daemon keeps open [@MickLesk](https://github.com/MickLesk) ([core#185](https://github.com/community-scripts/core/pull/185))
-
 ## 2026-11-01

 ### 🆕 New Scripts
@@ -1411,4 +1168,189 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

  - #### ✨ New Features

-    - FileBrowser Quantum: migrate the config and database to v2 [@MickLesk](https://github.com/MickLesk) ([#17815](https://github.com/community-scripts/ProxmoxVE/pull/17815))
+    - FileBrowser Quantum: migrate the config and database to v2 [@MickLesk](https://github.com/MickLesk) ([#17815](https://github.com/community-scripts/ProxmoxVE/pull/17815))
+
+## 2026-10-08
+
+### 🆕 New Scripts
+
+  - Unifi-OS-Server VM ([#17752](https://github.com/community-scripts/ProxmoxVE/pull/17752))
+- ZimaOS VM ([#17778](https://github.com/community-scripts/ProxmoxVE/pull/17778))
+
+### 🚀 Updated Scripts
+
+  - Revert "Immich: Pin to v3.3.0" [@MickLesk](https://github.com/MickLesk) ([#17767](https://github.com/community-scripts/ProxmoxVE/pull/17767))
+
+  - #### 🐞 Bug Fixes
+
+    - Homarr: replace the musl better-sqlite3 that v2.3.0 ships for Debian [@MickLesk](https://github.com/MickLesk) ([#17789](https://github.com/community-scripts/ProxmoxVE/pull/17789))
+    - CLIProxyAPI: keep plugins and data across updates [@MickLesk](https://github.com/MickLesk) ([#17790](https://github.com/community-scripts/ProxmoxVE/pull/17790))
+    - Kima-Hub: install the Python services into a uv venv [@MickLesk](https://github.com/MickLesk) ([#17791](https://github.com/community-scripts/ProxmoxVE/pull/17791))
+
+  - #### ✨ New Features
+
+    - Immich: Pin to 3.3.0 / Update ML Python to 3.13 [@MickLesk](https://github.com/MickLesk) ([#17770](https://github.com/community-scripts/ProxmoxVE/pull/17770))
+
+  - #### 🔧 Refactor
+
+    - Refactor: OPNsense VM [@MickLesk](https://github.com/MickLesk) ([#17785](https://github.com/community-scripts/ProxmoxVE/pull/17785))
+    - Refactor: Nextcloud VM (Turnkey) [@MickLesk](https://github.com/MickLesk) ([#17787](https://github.com/community-scripts/ProxmoxVE/pull/17787))
+    - Refactor: OpenWrt VM [@MickLesk](https://github.com/MickLesk) ([#17774](https://github.com/community-scripts/ProxmoxVE/pull/17774))
+    - Refactor: Ubuntu VM [@MickLesk](https://github.com/MickLesk) ([#17776](https://github.com/community-scripts/ProxmoxVE/pull/17776))
+
+### 💾 Core
+
+  - Tolerate a missing datacenter.cfg in vm_keyboard_default [@MickLesk](https://github.com/MickLesk) ([core#124](https://github.com/community-scripts/core/pull/124))
+- Take the ISO storage from the disk pool when it can hold ISOs [@MickLesk](https://github.com/MickLesk) ([core#122](https://github.com/community-scripts/core/pull/122))
+- Shared VM helpers: disk import, releases, checksums, first boot, IP by MAC [@MickLesk](https://github.com/MickLesk) ([core#117](https://github.com/community-scripts/core/pull/117))
+- tools: forge truncated release list [@MickLesk](https://github.com/MickLesk) ([core#118](https://github.com/community-scripts/core/pull/118))
+- Remember a kept cached image until the upstream changes [@MickLesk](https://github.com/MickLesk) ([core#119](https://github.com/community-scripts/core/pull/119))
+- Choose the VM keyboard layout and carry the host's timezone into prepared images [@MickLesk](https://github.com/MickLesk) ([core#120](https://github.com/community-scripts/core/pull/120))
+- VM's: run first-boot units without debconf dialogs [@MickLesk](https://github.com/MickLesk) ([core#121](https://github.com/community-scripts/core/pull/121))
+
+## 2026-10-07
+
+### 🆕 New Scripts
+
+  - Fedora VM ([#17747](https://github.com/community-scripts/ProxmoxVE/pull/17747))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - AudioMuse-AI: replace the venv on update without asking [@MickLesk](https://github.com/MickLesk) ([#17738](https://github.com/community-scripts/ProxmoxVE/pull/17738))
+    - paperclip: run as a dedicated non-root user so Claude Code can skip permissions [@samvandenbossche](https://github.com/samvandenbossche) ([#17707](https://github.com/community-scripts/ProxmoxVE/pull/17707))
+    - Thingsboard: update Java version from 17 to 25 [@CerberusStyle](https://github.com/CerberusStyle) ([#17733](https://github.com/community-scripts/ProxmoxVE/pull/17733))
+
+  - #### ✨ New Features
+
+    - Immich: Pin to v3.3.0 [@vhsdream](https://github.com/vhsdream) ([#17759](https://github.com/community-scripts/ProxmoxVE/pull/17759))
+
+  - #### 💥 Breaking Changes
+
+    - OpenCloud: bump to v8.1.0, rebuild search index on upgrade [@SimKaiLong](https://github.com/SimKaiLong) ([#17710](https://github.com/community-scripts/ProxmoxVE/pull/17710))
+
+  - #### 🔧 Refactor
+
+    - Pangolin: Unpin Release, stable enough, Bump to latest [@MickLesk](https://github.com/MickLesk) ([#17740](https://github.com/community-scripts/ProxmoxVE/pull/17740))
+    - Refactor: Archlinux-VM [@MickLesk](https://github.com/MickLesk) ([#17741](https://github.com/community-scripts/ProxmoxVE/pull/17741))
+    - Refactor: MikroTik RouterOS [@MickLesk](https://github.com/MickLesk) ([#17748](https://github.com/community-scripts/ProxmoxVE/pull/17748))
+
+### 💾 Core
+
+  - Fix Fedora and BLS cloud image console setup [@MickLesk](https://github.com/MickLesk) ([core#116](https://github.com/community-scripts/core/pull/116))
+- Keep setup_nodejs alive when the caller's directory is gone [@MickLesk](https://github.com/MickLesk) ([core#114](https://github.com/community-scripts/core/pull/114))
+
+## 2026-10-06
+
+### 🆕 New Scripts
+
+  - Pricebuddy ([#17708](https://github.com/community-scripts/ProxmoxVE/pull/17708))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Webtrees: stop serving data/ and the source folders directly [@MickLesk](https://github.com/MickLesk) ([#17724](https://github.com/community-scripts/ProxmoxVE/pull/17724))
+
+### 💾 Core
+
+  - Incus: check the architecture on Incus hosts too [@MickLesk](https://github.com/MickLesk) ([core#113](https://github.com/community-scripts/core/pull/113))
+- Incus: Pass the app's var_* settings into Incus containers  [@MickLesk](https://github.com/MickLesk) ([core#112](https://github.com/community-scripts/core/pull/112))
+- Incus: stub storage_content_check on Incus [@MickLesk](https://github.com/MickLesk) ([core#104](https://github.com/community-scripts/core/pull/104))
+- Incus: map Proxmox template versions to Incus image names [@MickLesk](https://github.com/MickLesk) ([core#111](https://github.com/community-scripts/core/pull/111))
+- Incus: read storage names from .vars files  [@MickLesk](https://github.com/MickLesk) ([core#110](https://github.com/community-scripts/core/pull/110))
+- Incus: show the spinner inside containers again [@MickLesk](https://github.com/MickLesk) ([core#109](https://github.com/community-scripts/core/pull/109))
+- Incus: set the hostname with sh, so it works before bash is installed [@MickLesk](https://github.com/MickLesk) ([core#102](https://github.com/community-scripts/core/pull/102))
+- Incus: reserve a plain address on Incus, leave the gateway to the network [@MickLesk](https://github.com/MickLesk) ([core#101](https://github.com/community-scripts/core/pull/101))
+- Incus: Wait for the network on Alpine OS too [@MickLesk](https://github.com/MickLesk) ([core#105](https://github.com/community-scripts/core/pull/105))
+- Incus: do not fail the build when hostname -I is missing [@MickLesk](https://github.com/MickLesk) ([core#103](https://github.com/community-scripts/core/pull/103))
+- Incus: Fuse always in unprivileged Containers, attach TUN only when container lacks it [@MickLesk](https://github.com/MickLesk) ([core#108](https://github.com/community-scripts/core/pull/108))
+- Incus: accept mode=generated [@MickLesk](https://github.com/MickLesk) ([core#106](https://github.com/community-scripts/core/pull/106))
+- Incus: pass the full install environment into Incus containers (quoted) [@MickLesk](https://github.com/MickLesk) ([core#107](https://github.com/community-scripts/core/pull/107))
+
+## 2026-10-05
+
+### 🚀 Updated Scripts
+
+  - Point to DevScripts, the renamed ProxmoxVED [@MickLesk](https://github.com/MickLesk) ([#17694](https://github.com/community-scripts/ProxmoxVE/pull/17694))
+
+  - #### 🐞 Bug Fixes
+
+    - wanderer: set the proxy secret and install plugins in their own directories [@MickLesk](https://github.com/MickLesk) ([#17698](https://github.com/community-scripts/ProxmoxVE/pull/17698))
+    - discourse: serve stylesheets and repair the update [@MickLesk](https://github.com/MickLesk) ([#17697](https://github.com/community-scripts/ProxmoxVE/pull/17697))
+    - wikijs: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17689](https://github.com/community-scripts/ProxmoxVE/pull/17689))
+    - jotty: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17688](https://github.com/community-scripts/ProxmoxVE/pull/17688))
+
+### 💾 Core
+
+  - Read releases from github.com when the API is rate limited, resume stalled downloads [@MickLesk](https://github.com/MickLesk) ([core#99](https://github.com/community-scripts/core/pull/99))
+- Check for template and container storage before the settings menu [@MickLesk](https://github.com/MickLesk) ([core#98](https://github.com/community-scripts/core/pull/98))
+- Check /etc/pve before the settings menu [@MickLesk](https://github.com/MickLesk) ([core#97](https://github.com/community-scripts/core/pull/97))
+- Check container settings before pct create rejects them [@MickLesk](https://github.com/MickLesk) ([core#96](https://github.com/community-scripts/core/pull/96))
+- PVE: Smart Diagnosis - say why a container would not start [@MickLesk](https://github.com/MickLesk) ([core#95](https://github.com/community-scripts/core/pull/95))
+- Retry template downloads that pveam reports as done but are not [@MickLesk](https://github.com/MickLesk) ([core#94](https://github.com/community-scripts/core/pull/94))
+- Check the OS release against pve-container before creating anything [@MickLesk](https://github.com/MickLesk) ([core#93](https://github.com/community-scripts/core/pull/93))
+- Rename "ProxmoxVED"-Links to "DevScripts" [@MickLesk](https://github.com/MickLesk) ([core#91](https://github.com/community-scripts/core/pull/91))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - monitor-all: read container IPs from the host side [@jasonobrien](https://github.com/jasonobrien) ([#17686](https://github.com/community-scripts/ProxmoxVE/pull/17686))
+
+## 2026-10-04
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - immich: read the Intel runtime from the pinned release [@MickLesk](https://github.com/MickLesk) ([#17677](https://github.com/community-scripts/ProxmoxVE/pull/17677))
+
+### 💾 Core
+
+  - better explain unsupported version & upgrade path for pve [@MickLesk](https://github.com/MickLesk) ([core#86](https://github.com/community-scripts/core/pull/86))
+- Quote PostgreSQL identifiers and drop spaces from the creds file name [@MickLesk](https://github.com/MickLesk) ([core#89](https://github.com/community-scripts/core/pull/89))
+- Find the default Rust toolchain in current rustup output [@MickLesk](https://github.com/MickLesk) ([core#88](https://github.com/community-scripts/core/pull/88))
+
+## 2026-10-03
+
+### 🆕 New Scripts
+
+  - Keeper.sh ([#17659](https://github.com/community-scripts/ProxmoxVE/pull/17659))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - hermesagent: download the installer before running it [@MickLesk](https://github.com/MickLesk) ([#17666](https://github.com/community-scripts/ProxmoxVE/pull/17666))
+    - frigate: raise the Node heap for the web build [@MickLesk](https://github.com/MickLesk) ([#17667](https://github.com/community-scripts/ProxmoxVE/pull/17667))
+    - Tracearr: workaround for failing map tiles download and data preservation [@durzo](https://github.com/durzo) ([#17661](https://github.com/community-scripts/ProxmoxVE/pull/17661))
+    - fix(nginxproxymanager): clean yarn cache after builds to prevent disk growth [@PsycoStea](https://github.com/PsycoStea) ([#17653](https://github.com/community-scripts/ProxmoxVE/pull/17653))
+
+  - #### 🔧 Refactor
+
+    - Several Scripts: refactor msg_ blocks, generate passwords with helper, add CLEAN_INSTALL_KEEP  [@MickLesk](https://github.com/MickLesk) ([#17655](https://github.com/community-scripts/ProxmoxVE/pull/17655))
+
+### 💾 Core
+
+  - detect_repo_source: read the license header and fall back to ProxmoxVE [@MickLesk](https://github.com/MickLesk) ([core#85](https://github.com/community-scripts/core/pull/85))
+
+## 2026-10-02
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - zerobyte: upgrade Bun on update [@MickLesk](https://github.com/MickLesk) ([#17646](https://github.com/community-scripts/ProxmoxVE/pull/17646))
+    - sure: keep Active Storage uploads across updates [@MickLesk](https://github.com/MickLesk) ([#17648](https://github.com/community-scripts/ProxmoxVE/pull/17648))
+    - twenty: run upstreams upgrade command instead of the removed setup-db.ts [@MickLesk](https://github.com/MickLesk) ([#17647](https://github.com/community-scripts/ProxmoxVE/pull/17647))
+
+  - #### 🔧 Refactor
+
+    - NPM: Refactor / Fix npm openresty user and certbot version [@MickLesk](https://github.com/MickLesk) ([#17649](https://github.com/community-scripts/ProxmoxVE/pull/17649))
+    - several scripts: use the release helpers instead of hand-rolled version checks and downloads [@MickLesk](https://github.com/MickLesk) ([#17625](https://github.com/community-scripts/ProxmoxVE/pull/17625))
+
+### 💾 Core
+
+  - QoL: message blocks, clean-install keep list, password helper, network limits [@MickLesk](https://github.com/MickLesk) ([core#61](https://github.com/community-scripts/core/pull/61))
@@ -39,7 +39,6 @@ function update_script() {
    create_backup /opt/anchor/.env

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "anchor" "ZhFahim/anchor" "tarball"
-    NODE_VERSION="26" NODE_MODULE="pnpm" setup_nodejs

    msg_info "Building Server"
    cd /opt/anchor/server
@@ -55,13 +55,9 @@ update_deb_based() {
      setup_go
      fetch_and_deploy_gh_release "xcaddy" "caddyserver/xcaddy" "binary"

-      if (($(awk '/^MemTotal:/ {print int($2 / 1024)}' /proc/meminfo) < 1900)); then
-        msg_warn "xCaddy updated; its test build was skipped because linking Caddy needs about 2 GB RAM"
-      else
-        msg_info "Updating xCaddy"
-        $STD xcaddy build
-        msg_ok "Updated xCaddy"
-      fi
+      msg_info "Updating xCaddy"
+      $STD xcaddy build
+      msg_ok "Updated xCaddy"
    fi
  fi
  msg_ok "Updated successfully!"
@@ -1,57 +0,0 @@
-#!/usr/bin/env bash
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/chattocorp/chatto
-
-APP="Chatto"
-var_tags="${var_tags:-chat;messaging}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
-var_disk="${var_disk:-8}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/chatto ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "chatto" "chattocorp/chatto"; then
-    msg_info "Stopping Service"
-    systemctl stop chatto
-    msg_ok "Stopped Service"
-
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "chatto" "chattocorp/chatto" "prebuild" "latest" "/opt/chatto" "chatto_Linux_$(arch_resolve x86_64 arm64).tar.gz"
-    chmod +x /opt/chatto/chatto
-
-    msg_info "Starting Service"
-    systemctl start chatto
-    msg_ok "Started Service"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:4000${CL}"
@@ -48,7 +48,7 @@ function update_script() {
    msg_ok "Built Cinephage"

    msg_info "Updating Camoufox"
-    $STD /opt/cinephage/node_modules/.bin/camoufox fetch
+    $STD /opt/cinephage/node_modules/.bin/camoufox-js fetch
    msg_ok "Updated Camoufox"

    msg_info "Starting Cinephage"
@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://coolify.io/
+
+APP="Coolify"
+var_tags="${var_tags:-docker;paas}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-30}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+ADDON_SCRIPT="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/coolify.sh"
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /data/coolify ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  msg_warn "⚠️  ${APP} has been migrated to an addon script."
+  echo ""
+  echo -e "${INFO}${YW}This is a one-time migration. After this, you can update ${APP} anytime with:${CL}"
+  echo -e "${TAB}${TAB}${GN}update_coolify${CL}  or  ${GN}bash <(curl -fsSL ${ADDON_SCRIPT})${CL}"
+  echo ""
+  read -r -p "${TAB}Migrate update function now? [y/N]: " CONFIRM
+  if [[ ! "${CONFIRM,,}" =~ ^(y|yes)$ ]]; then
+    msg_warn "Migration skipped. The old update will continue to work for now."
+    msg_info "Updating ${APP} (legacy)"
+    $STD bash <(curl -fsSL https://cdn.coollabs.io/coolify/install.sh)
+    msg_ok "Updated ${APP}"
+    exit
+  fi
+
+  msg_info "Migrating update function"
+  TMP_UPDATE=$(mktemp)
+  cat <<'MIGRATION_EOF' >"$TMP_UPDATE"
+bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/coolify.sh)"
+MIGRATION_EOF
+  mv "$TMP_UPDATE" /usr/bin/update
+  chmod +x /usr/bin/update
+
+  ln -sf /usr/bin/update /usr/bin/update_coolify 2>/dev/null || true
+  msg_ok "Migration complete"
+
+  echo -e "${INFO}${YW}Running addon update${CL}"
+  type=update bash <(curl -fsSL "${ADDON_SCRIPT}")
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8000${CL}"
@@ -26,7 +26,7 @@ function update_script() {
  check_container_storage
  check_container_resources

-  NODE_VERSION="26" setup_nodejs
+  NODE_VERSION="24" setup_nodejs
  ensure_dependencies build-essential

  if command -v cross-seed &>/dev/null; then
@@ -38,29 +38,57 @@ function update_script() {
    $STD systemctl stop databasus
    msg_ok "Stopped Databasus"

-    ensure_dependencies libedit2 libgssapi-krb5-2 libncurses6 libreadline8t64
+    create_backup /opt/databasus/.env
+
+    msg_info "Ensuring Database Clients"
+    # Create PostgreSQL version symlinks for compatibility
+    for v in 12 13 14 15 16 18; do
+      ln -sf /usr/lib/postgresql/17 /usr/lib/postgresql/$v
+    done
+    # Install MongoDB Database Tools via direct .deb (no APT repo for Debian 13)
+    if ! command -v mongodump &>/dev/null; then
+      [[ "$(get_os_info id)" == "ubuntu" ]] && MONGO_DIST="ubuntu2204" || MONGO_DIST="debian12"
+      MONGO_ARCH=$(arch_resolve "x86_64" "arm64")
+      # MongoDB only publishes arm64 builds for Ubuntu
+      [[ "$MONGO_ARCH" == "arm64" ]] && MONGO_DIST="ubuntu2204"
+      fetch_and_deploy_from_url "https://fastdl.mongodb.org/tools/db/mongodb-database-tools-${MONGO_DIST}-${MONGO_ARCH}-100.16.1.deb"
+    fi
+    ensure_dependencies mariadb-client
+    mkdir -p /usr/local/mariadb-{10.6,12.1}/bin /usr/local/mysql-{5.7,8.0,8.4,9}/bin /usr/local/mongodb-database-tools/bin
+    [[ -f /usr/bin/mongodump ]] && ln -sf /usr/bin/mongodump /usr/local/mongodb-database-tools/bin/mongodump
+    [[ -f /usr/bin/mongorestore ]] && ln -sf /usr/bin/mongorestore /usr/local/mongodb-database-tools/bin/mongorestore
+    # Create MariaDB and MySQL client symlinks for compatibility
+    for dir in /usr/local/mariadb-{10.6,12.1}/bin; do
+      ln -sf /usr/bin/mariadb-dump "$dir/mariadb-dump"
+      ln -sf /usr/bin/mariadb "$dir/mariadb"
+    done
+    for dir in /usr/local/mysql-{5.7,8.0,8.4,9}/bin; do
+      ln -sf /usr/bin/mariadb-dump "$dir/mysqldump"
+      ln -sf /usr/bin/mariadb "$dir/mysql"
+    done
+    msg_ok "Ensured Database Clients"
+
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "databasus" "databasus/databasus" "tarball" "latest" "/opt/databasus"
    GO_VERSION="$(grep -m1 '^go ' /opt/databasus/backend/go.mod | awk '{print $2}')" setup_go

    msg_info "Updating Databasus"
-    RELEASE=$(cat ~/.databasus)
    export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
    cd /opt/databasus/frontend
+
    $STD corepack prepare pnpm@latest --activate
    $STD pnpm install --frozen-lockfile
-    $STD env VITE_APP_VERSION="${RELEASE}" pnpm run build
+    $STD pnpm run build
    cd /opt/databasus/backend
-    $STD env CGO_ENABLED=0 GOOS=linux GOARCH="$(arch_resolve)" go build -o /opt/databasus/databasus ./cmd/databasus
-    mkdir -p /opt/databasus/agent-binaries
-    for arch in amd64 arm64; do
-      $STD env CGO_ENABLED=0 GOOS=linux GOARCH=$arch go build -ldflags "-X main.Version=${RELEASE}" -o /opt/databasus/agent-binaries/databasus-verification-agent-linux-$arch ./cmd/verification-agent
-    done
+    $STD go mod download
+    $STD /root/go/bin/swag init -g cmd/main.go -o swagger
+    $STD env CGO_ENABLED=0 GOOS=linux GOARCH=$(arch_resolve) go build -o databasus ./cmd
+    mv /opt/databasus/backend/databasus /opt/databasus/databasus
    mkdir -p /opt/databasus/ui/build
    cp -r /opt/databasus/frontend/dist/* /opt/databasus/ui/build/
-    sed -i '/^APP_VERSION=/d' /.env
-    echo "APP_VERSION=${RELEASE}" >>/.env
+    cp -r /opt/databasus/backend/migrations /opt/databasus/
    msg_ok "Updated Databasus"

+    restore_backup
    chown -R postgres:postgres /opt/databasus

    if ! grep -q "EnvironmentFile=/.env" /etc/systemd/system/databasus.service; then
@@ -58,17 +58,6 @@ function update_script() {
  $STD git pull origin main
  msg_ok "Updated Discourse"

-  if check_for_gh_release "libvips" "libvips/libvips"; then
-    ensure_dependencies meson ninja-build pkg-config libglib2.0-dev libexpat1-dev libjpeg-dev libpng-dev libwebp-dev libtiff-dev libheif-dev libjxl-dev librsvg2-dev libcgif-dev libexif-dev liblcms2-dev liborc-0.4-dev libimagequant-dev libpango1.0-dev
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "libvips" "libvips/libvips" "prebuild" "latest" "/opt/libvips" "vips-*.tar.xz"
-    msg_info "Building libvips"
-    cd /opt/libvips
-    $STD meson setup build --prefix=/usr/local --libdir=lib --buildtype=release -Dmodules=disabled -Dmagick=disabled -Dexamples=false
-    $STD ninja -C build install
-    ldconfig
-    msg_ok "Built libvips"
-  fi
-
  msg_info "Updating Dependencies"
  RUBY_TARGET=$(grep -A1 '^RUBY VERSION' /opt/discourse/Gemfile.lock | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -n1)
  RUBY_VERSION="${RUBY_TARGET:-4.0.7}" RUBY_INSTALL_RAILS="false" setup_ruby
@@ -1,74 +0,0 @@
-#!/usr/bin/env bash
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: Masked-Kunsiquat
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://www.espocrm.com/ | Github: https://github.com/espocrm/espocrm
-
-APP="EspoCRM"
-var_tags="${var_tags:-crm;business}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
-var_disk="${var_disk:-8}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
-var_unprivileged="${var_unprivileged:-1}"
-
-export var_admin_user="${var_admin_user:-}"
-export var_admin_pass="${var_admin_pass:-}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/espocrm ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "espo-crm" "espocrm/espocrm"; then
-    msg_info "Stopping Services"
-    systemctl stop nginx cron php8.4-fpm
-    msg_ok "Stopped Services"
-
-    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="data custom client/custom" fetch_and_deploy_gh_release "espo-crm" "espocrm/espocrm" "prebuild" "latest" "/opt/espocrm" "EspoCRM-*.zip"
-
-    msg_info "Migrating EspoCRM"
-    cd /opt/espocrm
-    $STD php bin/command clear-cache
-    if ! $STD php bin/command migrate; then
-      chown -R www-data:www-data /opt/espocrm
-      systemctl start php8.4-fpm
-      systemctl start cron nginx
-      msg_error "Migration failed; customizations may be incompatible. Check /opt/espocrm/data/logs, then run update again."
-      exit 1
-    fi
-    chown -R www-data:www-data /opt/espocrm
-    msg_ok "Migrated EspoCRM"
-
-    msg_info "Starting Services"
-    systemctl start php8.4-fpm
-    systemctl start cron nginx
-    msg_ok "Started Services"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}${CL}"
@@ -102,7 +102,6 @@ function update_script() {
  fi
  msg_ok "Ensured ASP.NET Core Runtime"

-  rm -rf /opt/fileflows/{Server,FlowRunner,Libraries,Agent}
  fetch_and_deploy_from_url "https://fileflows.com/downloads/ff-latest.tar.xz" "/opt/fileflows"

  msg_info "Starting Service"
@@ -1,66 +0,0 @@
-#!/usr/bin/env bash
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/mozilla-services/syncstorage-rs
-
-APP="Firefox-Syncserver"
-var_tags="${var_tags:-sync;firefox}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-3072}"
-var_disk="${var_disk:-10}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-#var_arm64="${var_arm64:-yes}" # built from source, nothing x86-only, but not yet run on arm64
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -f /usr/local/bin/syncserver ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "firefox-syncserver" "mozilla-services/syncstorage-rs"; then
-    msg_info "Stopping Firefox Syncserver"
-    systemctl stop firefox-syncserver
-    msg_ok "Stopped Firefox Syncserver"
-
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "firefox-syncserver" "mozilla-services/syncstorage-rs" "tarball"
-    setup_rust
-
-    msg_info "Building Firefox Syncserver (Patience)"
-    cd /opt/firefox-syncserver
-    $STD cargo build --release --locked --no-default-features --features=syncstorage-db/postgres --features=tokenserver-db/postgres --features=py_verifier
-    cp target/release/syncserver /usr/local/bin/syncserver
-    rm -rf target
-    $STD uv venv --python /usr/bin/python3 /opt/firefox-syncserver/.venv
-    $STD uv pip install --python /opt/firefox-syncserver/.venv/bin/python pyfxa tokenlib cryptography
-    msg_ok "Built Firefox Syncserver"
-
-    msg_info "Starting Firefox Syncserver"
-    systemctl start firefox-syncserver
-    msg_ok "Started Firefox Syncserver"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}In Firefox, set identity.sync.tokenserver.uri in about:config to:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:8000/1.0/sync/1.5${CL}"
@@ -45,32 +45,15 @@ function update_script() {
    export CGO_ENABLED=0
    $STD go mod download
    $STD go build -o /usr/local/bin/gotenberg \
-      -ldflags "-s -w -X 'github.com/gotenberg/gotenberg/v9/cmd.Version=$(cat ~/.gotenberg)'" \
+      -ldflags "-s -w -X 'github.com/gotenberg/gotenberg/v8/cmd.Version=$(cat ~/.gotenberg)'" \
      cmd/gotenberg/main.go
    msg_ok "Built gotenberg"

-    LOK_VERSION="$(awk -F= '/^ARG LOK_VERSION=/{print $2}' /opt/gotenberg/build/Dockerfile)"
-    fetch_and_deploy_gh_release "lok" "gotenberg/lok" "prebuild" "$LOK_VERSION" "/usr/local/bin" "lok_${LOK_VERSION#v}_linux_$(arch_resolve "amd64" "arm64").tar.gz"
-
-    msg_info "Migrating to Gotenberg 9"
-    CODENAME=$(get_os_info codename)
-    setup_deb822_repo \
-      "debian-backports" \
-      "file:///usr/share/keyrings/debian-archive-keyring.gpg" \
-      "http://deb.debian.org/debian" \
-      "${CODENAME}-backports" \
-      "main"
-    $STD apt install -y fonts-urw-base35
-    $STD apt install -y -t "${CODENAME}-backports" \
-      libreoffice-writer libreoffice-calc libreoffice-impress libreoffice-draw libreoffice-math
-    $STD apt purge -y python3-uno python-is-python3 pdftk-java qpdf libimage-exiftool-perl
-    $STD apt autoremove -y
-    rm -rf /usr/local/bin/unoconverter /usr/local/bin/pdfcpu /opt/pdfcpu
-    sed -i '/^Environment=\(UNOCONVERTER\|PDFTK\|QPDF\|EXIFTOOL\|PDFCPU\)_BIN_PATH=/d' /etc/systemd/system/gotenberg.service
-    grep -q '^Environment=LOK_BIN_PATH=' /etc/systemd/system/gotenberg.service ||
-      sed -i '/^Environment=LIBREOFFICE_BIN_PATH=/a Environment=LOK_BIN_PATH=/usr/local/bin/lok' /etc/systemd/system/gotenberg.service
-    systemctl daemon-reload
-    msg_ok "Migrated to Gotenberg 9"
+    msg_info "Updating unoconverter"
+    UNOCONVERTER_VERSION=$(get_latest_github_release "gotenberg/unoconverter" "false")
+    download_file "https://raw.githubusercontent.com/gotenberg/unoconverter/${UNOCONVERTER_VERSION}/unoconv" /usr/local/bin/unoconverter
+    chmod +x /usr/local/bin/unoconverter
+    msg_ok "Updated unoconverter"

    msg_info "Starting Service"
    systemctl start gotenberg
@@ -53,8 +53,6 @@ function update_script() {
      msg_ok "Restored Database"
    fi

-    NODE_VERSION="26" setup_nodejs
-
    msg_info "Updating Guardian"
    cd /opt/guardian/backend
    $STD npm ci
@@ -70,7 +70,32 @@ function update_script() {
    exit
  fi
  if [ "$UPD" == "4" ]; then
-    bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/filebrowser.sh)"
+    msg_info "Installing FileBrowser"
+    RELEASE=$(curl -fsSL https://api.github.com/repos/filebrowser/filebrowser/releases/latest | grep -o '"tag_name": ".*"' | sed 's/"//g' | sed 's/tag_name: //g')
+    $STD curl -fsSL https://github.com/filebrowser/filebrowser/releases/download/v2.23.0/linux-$(arch_resolve)-filebrowser.tar.gz | tar -xzv -C /usr/local/bin
+    $STD filebrowser config init -a '0.0.0.0'
+    $STD filebrowser config set -a '0.0.0.0'
+    $STD filebrowser users add admin community-scripts.org --perm.admin
+    msg_ok "Installed FileBrowser"
+
+    msg_info "Creating Service"
+    service_path="/etc/systemd/system/filebrowser.service"
+    echo "[Unit]
+Description=Filebrowser
+After=network-online.target
+[Service]
+User=root
+WorkingDirectory=/root/
+ExecStart=/usr/local/bin/filebrowser -r /
+[Install]
+WantedBy=default.target" >$service_path
+
+    $STD systemctl enable --now filebrowser
+    msg_ok "Created Service"
+
+    msg_ok "Completed successfully!\n"
+    echo -e "FileBrowser should be reachable by going to the following URL.
+         ${BL}http://$LOCAL_IP:8080${CL}   admin|community-scripts.org\n"
    exit
  fi
 }
@@ -75,7 +75,7 @@ EOF
  BASE_DIR=${STAGING_DIR}/base-images
  SOURCE_DIR=${STAGING_DIR}/image-source
  cd /tmp
-  RELEASE="v3.3.6"
+  RELEASE="v3.3.5"
  if [[ -f ~/.intel_version ]]; then
    INTEL_SRC="https://raw.githubusercontent.com/immich-app/immich/${RELEASE}/machine-learning"
    curl -fsSL "${INTEL_SRC}/scripts/install-intel-runtime.sh" -o ./intel-runtime 2>/dev/null ||
@@ -131,18 +131,7 @@ EOF

  if check_for_gh_release "Immich" "immich-app/immich" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
    msg_warn "The update takes 5-15 minutes, do not interrupt it"
-    PREV_IMMICH="${CS_PREVIOUS_VERSION:-$(cat ~/.immich)}"
-    INSTALL_DIR="/opt/${APP}"
-    UPLOAD_DIR="$(sed -n '/^IMMICH_MEDIA_LOCATION/s/[^=]*=//p' /opt/immich/.env)"
-    SRC_DIR="${INSTALL_DIR}/source"
-    APP_DIR="${INSTALL_DIR}/app"
-    PLUGIN_DIR="${APP_DIR}/plugins/immich-plugin-core"
-    ML_DIR="${APP_DIR}/machine-learning"
-    GEO_DIR="${INSTALL_DIR}/geodata"
-
-    setup_uv
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Immich" "immich-app/immich" "tarball" "${RELEASE}" "$SRC_DIR"
-
+    PREV_IMMICH="$(cat ~/.immich)"
    # An interrupted update leaves app/ empty, so there may be no immich-admin to call.
    if [[ "$PREV_IMMICH" > "2.5.1" && -x /opt/immich/app/bin/immich-admin ]]; then
      msg_info "Enabling Maintenance Mode"
@@ -152,7 +141,6 @@ EOF
      $STD cd -
      msg_ok "Enabled Maintenance Mode"
    fi
-    [[ -x /opt/immich/app/bin/immich-admin ]] || export MAINT_MODE=1
    msg_info "Stopping Services"
    systemctl stop immich-web
    systemctl stop immich-ml
@@ -161,13 +149,13 @@ EOF
    PG_VERSION=$(ls /etc/postgresql/ 2>/dev/null | sort -V | tail -1)
    PG_VERSION=${PG_VERSION:-16}
    [[ -f ~/.vchord_version ]] && mv ~/.vchord_version ~/.vectorchord
-    if check_for_gh_release "VectorChord" "supervc-stack/VectorChord" "${VCHORD_RELEASE}" "updated together with Immich after testing"; then
+    if check_for_gh_release "VectorChord" "tensorchord/VectorChord" "${VCHORD_RELEASE}" "updated together with Immich after testing"; then
      # dead tuples in smart_search/face_search make the REINDEX below fail with
      # "missing chunk ... for toast value" on VectorChord 1.0.0 (#15588); must vacuum
      # while still on the old extension version, a post-upgrade vacuum errors instead
      $STD sudo -u postgres psql -d immich -c "VACUUM (ANALYZE) smart_search;"
      $STD sudo -u postgres psql -d immich -c "VACUUM (ANALYZE) face_search;"
-      fetch_and_deploy_gh_release "VectorChord" "supervc-stack/VectorChord" "binary" "${VCHORD_RELEASE}" "/tmp" "postgresql-${PG_VERSION}-vchord_*_$(arch_resolve).deb"
+      fetch_and_deploy_gh_release "VectorChord" "tensorchord/VectorChord" "binary" "${VCHORD_RELEASE}" "/tmp" "postgresql-${PG_VERSION}-vchord_*_$(arch_resolve).deb"
      systemctl restart postgresql
      $STD sudo -u postgres psql -d immich -c "ALTER EXTENSION vector UPDATE;"
      $STD sudo -u postgres psql -d immich -c "ALTER EXTENSION vchord UPDATE;"
@@ -176,6 +164,14 @@ EOF
    fi
    ensure_dependencies ccache gcc-13 g++-13

+    INSTALL_DIR="/opt/${APP}"
+    UPLOAD_DIR="$(sed -n '/^IMMICH_MEDIA_LOCATION/s/[^=]*=//p' /opt/immich/.env)"
+    SRC_DIR="${INSTALL_DIR}/source"
+    APP_DIR="${INSTALL_DIR}/app"
+    PLUGIN_DIR="${APP_DIR}/plugins/immich-plugin-core"
+    ML_DIR="${APP_DIR}/machine-learning"
+    GEO_DIR="${INSTALL_DIR}/geodata"
+
    [[ -f "$ML_DIR"/ml_start.sh ]] && cp "$ML_DIR"/ml_start.sh "$INSTALL_DIR"
    if grep -qs "set -a" "$APP_DIR"/bin/start.sh && grep -qs "warnings" "$APP_DIR"/bin/start.sh; then
      cp "$APP_DIR"/bin/start.sh "$INSTALL_DIR"
@@ -197,6 +193,8 @@ EOF
      rm -rf "${APP_DIR:?}"/*
    )

+    setup_uv
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Immich" "immich-app/immich" "tarball" "${RELEASE}" "$SRC_DIR"
    PNPM_VERSION="$(jq -r '.packageManager | split("@")[1] | split("+")[0]' ${SRC_DIR}/package.json)"
    export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
    export CI=1
@@ -234,7 +232,7 @@ EOF
    # plugins
    cd "$SRC_DIR"
    export MISE_TRUSTED_CONFIG_PATHS="$SRC_DIR"/mise.toml
-    export MISE_DISABLE_TOOLS=github:jellyfin/jellyfin-ffmpeg,java,terragrunt,opentofu,npm:@openapitools/openapi-generator-cli
+    export MISE_DISABLE_TOOLS=github:jellyfin/jellyfin-ffmpeg
    export MISE_LOCKFILE_MODE=merge MISE_LOCKFILE_PLATFORMS="linux-$(arch_resolve x64 arm64)"
    mise_ok=0
    for i in 1 2 3; do
@@ -294,7 +292,7 @@ EOF
      msg_ok "Pre-installed Python ${ML_PYTHON}"
      msg_info "Updating Intel OpenVINO machine-learning"
      for attempt in $(seq 1 3); do
-        $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT,UV_CONCURRENT_DOWNLOADS,UV_CONCURRENT_BUILDS,UV_CONCURRENT_INSTALLS -Pnu immich uv sync --extra openvino --no-dev --upgrade-package watchfiles --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
+        $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT,UV_CONCURRENT_DOWNLOADS,UV_CONCURRENT_BUILDS,UV_CONCURRENT_INSTALLS -Pnu immich uv sync --extra openvino --no-dev --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
        [[ $attempt -eq 3 ]] && { ML_FAILED=1; break; }
        # Parallel fetches can trip DNS rate limits (AdGuard, Pi-hole); retry one at a time.
        export UV_CONCURRENT_DOWNLOADS=1 UV_CONCURRENT_BUILDS=1 UV_CONCURRENT_INSTALLS=1
@@ -312,7 +310,7 @@ EOF
      msg_ok "Pre-installed Python ${ML_PYTHON}"
      msg_info "Updating machine-learning"
      for attempt in $(seq 1 3); do
-        $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT,UV_CONCURRENT_DOWNLOADS,UV_CONCURRENT_BUILDS,UV_CONCURRENT_INSTALLS -Pnu immich uv sync --extra cpu --no-dev --upgrade-package watchfiles --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
+        $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT,UV_CONCURRENT_DOWNLOADS,UV_CONCURRENT_BUILDS,UV_CONCURRENT_INSTALLS -Pnu immich uv sync --extra cpu --no-dev --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
        [[ $attempt -eq 3 ]] && { ML_FAILED=1; break; }
        # Parallel fetches can trip DNS rate limits (AdGuard, Pi-hole); retry one at a time.
        export UV_CONCURRENT_DOWNLOADS=1 UV_CONCURRENT_BUILDS=1 UV_CONCURRENT_INSTALLS=1
@@ -421,7 +419,7 @@ function compile_libjxl() {
    $STD git clone https://github.com/libjxl/libjxl.git "$SOURCE"
    cd "$SOURCE"
    $STD git reset --hard "$LIBJXL_REVISION"
-    $STD git submodule update --init --recursive --depth 1 --recommend-shallow -- third_party
+    $STD git submodule update --init --recursive --depth 1 --recommend-shallow
    mkdir build
    cd build
    $STD cmake \
@@ -32,14 +32,14 @@ function update_script() {
  fi

  if check_for_gh_tag "kan" "kanbn/kan"; then
-    NODE_VERSION="24" NODE_MODULE="pnpm" setup_nodejs
-    
    msg_info "Stopping Service"
    systemctl stop kan
    msg_ok "Stopped Service"

    create_backup /opt/kan/.env
+
    CLEAN_INSTALL=1 fetch_and_deploy_gh_tag "kan" "kanbn/kan" "latest"
+
    restore_backup

    msg_info "Building Application"
@@ -36,7 +36,7 @@ function update_script() {
    source ~/.bashrc
    if ! command -v deno &>/dev/null; then
      export DENO_INSTALL="/usr/local"
-      curl -fsSL https://deno.land/install.sh | CI=1 $STD sh -s
+      curl -fsSL https://deno.land/install.sh | $STD sh -s -- -y
    else
      $STD deno upgrade
    fi
@@ -9,7 +9,7 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 APP="MyIP"
 var_tags="${var_tags:-network}"
 var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
+var_ram="${var_ram:-1024}"
 var_disk="${var_disk:-4}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
@@ -30,7 +30,7 @@ function update_script() {
    exit
  fi

-  NODE_VERSION="26" setup_nodejs
+  NODE_VERSION="24" setup_nodejs

  if check_for_gh_release "myip" "jason5ng32/MyIP"; then
    msg_info "Stopping Services"
@@ -46,10 +46,7 @@ EOF
    systemctl daemon-reload
  fi

-  # n8n-nodes-base 2.46.0 pins both @napi-rs/canvas musl binaries as hard
-  # dependencies, which no os/cpu/libc combination can satisfy. Drop --force
-  # once upstream makes them optional again.
-  $STD npm install -g n8n@latest --force
+  $STD npm install -g n8n@latest
  systemctl restart n8n
  msg_ok "Updated n8n"
  msg_ok "Updated successfully!"
@@ -9,7 +9,7 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 APP="Nametag"
 var_tags="${var_tags:-contacts;crm}"
 var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-3072}"
+var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-8}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
@@ -37,9 +37,10 @@ function update_script() {
    msg_ok "Stopped Service"

    create_backup /opt/nametag/.env
+
    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="data" fetch_and_deploy_gh_release "nametag" "mattogodoy/nametag" "tarball" "latest" "/opt/nametag"
+
    restore_backup
-    NODE_VERSION="24" setup_nodejs

    msg_info "Rebuilding Application"
    cd /opt/nametag
@@ -31,8 +31,6 @@ function update_script() {
    exit
  fi

-  echo "x /tmp/nexterm-sea-*" >/etc/tmpfiles.d/nexterm.conf
-
  if check_for_gh_release "nexterm-engine" "gnmyt/Nexterm"; then
    msg_info "Stopping nexterm-engine"
    systemctl stop nexterm-engine
@@ -48,7 +46,6 @@ function update_script() {
  if check_for_gh_release "nexterm-server" "gnmyt/Nexterm"; then
    msg_info "Stopping nexterm-server"
    systemctl stop nexterm-server
-    rm -rf /tmp/nexterm-sea-*
    msg_ok "Stopped nexterm-server"

    fetch_and_deploy_gh_release "nexterm-server" "gnmyt/Nexterm" "singlefile" "latest" "/opt/nexterm/server" "nexterm-server-linux-$(arch_resolve "x64" "arm64")"
@@ -32,14 +32,9 @@ function update_script() {

  if check_for_gh_release "openobserve" "openobserve/openobserve"; then
    msg_info "Updating OpenObserve"
-    if grep -q "^ExecStop=killall" /etc/systemd/system/openobserve.service; then
-      sed -i "/^ExecStop=killall/d" /etc/systemd/system/openobserve.service
-      systemctl daemon-reload
-    fi
    systemctl stop openobserve
    RELEASE=$(get_latest_github_release "openobserve/openobserve")
-    tar zxf <(curl -fsSL https://downloads.openobserve.ai/releases/openobserve/v$RELEASE/openobserve-v$RELEASE-linux-$(arch_resolve).tar.gz) -C /opt/openobserve --no-same-owner
-    echo "${RELEASE}" >~/.openobserve
+    tar zxf <(curl -fsSL https://downloads.openobserve.ai/releases/openobserve/v$RELEASE/openobserve-v$RELEASE-linux-$(arch_resolve).tar.gz) -C /opt/openobserve
    systemctl start openobserve
    msg_ok "Updated OpenObserve"
    msg_ok "Updated successfully!"
@@ -30,15 +30,6 @@ function update_script() {
    msg_error "No ${APP} Installation Found!"
    exit
  fi
-
-  if ! grep -q "^Environment=HOME=" /etc/systemd/system/planka.service; then
-    msg_info "Updating Service"
-    sed -i -e '/^Environment=NODE_ENV=/d' -e 's|^ExecStart=.*|Environment=NODE_ENV=production\nEnvironment=HOME=/root\nExecStart=/usr/bin/node app.js --prod|' /etc/systemd/system/planka.service
-    systemctl daemon-reload
-    systemctl restart planka
-    msg_ok "Updated Service"
-  fi
-
  if check_for_gh_release "planka" "plankanban/planka"; then
    msg_info "Stopping Service"
    systemctl stop planka
@@ -66,7 +66,33 @@ function update_script() {
    exit
  fi
  if [ "$UPD" == "3" ]; then
-    bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/filebrowser.sh)"
+    msg_info "Installing FileBrowser"
+    $STD curl -fsSL https://raw.githubusercontent.com/filebrowser/get/master/get.sh | bash
+    $STD filebrowser config init -a '0.0.0.0'
+    $STD filebrowser config set -a '0.0.0.0'
+    $STD filebrowser users add admin community-scripts.org --perm.admin
+    msg_ok "Installed FileBrowser"
+
+    msg_info "Creating Service"
+    cat <<EOF >/etc/systemd/system/filebrowser.service
+[Unit]
+Description=Filebrowser
+After=network-online.target
+
+[Service]
+User=root
+WorkingDirectory=/root/
+ExecStart=/usr/local/bin/filebrowser -r /
+
+[Install]
+WantedBy=default.target
+EOF
+    systemctl enable -q --now filebrowser
+    msg_ok "Created Service"
+
+    msg_ok "Completed successfully!\n"
+    echo -e "FileBrowser should be reachable by going to the following URL.
+         ${BL}http://$LOCAL_IP:8080${CL}   admin|community-scripts.org\n"
    exit
  fi
  if [ "$UPD" == "4" ]; then
@@ -107,9 +107,8 @@ function update_script() {
    ln -sfn "$ROMM_BASE"/resources /opt/romm/frontend/dist/assets/romm/resources
    ln -sfn "$ROMM_BASE"/assets /opt/romm/frontend/dist/assets/romm/assets
    if [[ -f /etc/angie/http.d/romm.conf ]]; then
-      if ! grep -q "js_content decode.decodeBase64" /etc/angie/http.d/romm.conf ||
-        ! grep -q "coep_header" /etc/angie/http.d/romm.conf; then
-        msg_info "Updating Angie config (decode/cache locations, player isolation headers)"
+      if ! grep -q "js_content decode.decodeBase64" /etc/angie/http.d/romm.conf; then
+        msg_info "Adding missing /decode and /cache locations to Angie config"
        dpkg -l angie-module-njs &>/dev/null || $STD apt install -y angie-module-njs
        grep -q "ngx_http_js_module.so" /etc/angie/angie.conf || sed -i '1i load_module modules/ngx_http_js_module.so;' /etc/angie/angie.conf
        mkdir -p /etc/angie/js "${ROMM_BASE}/cache"
@@ -148,20 +147,6 @@ map \$http_upgrade \$connection_upgrade {
    '' close;
 }

-# COEP/COOP for the EmulatorJS and js-dos players (SharedArrayBuffer needs a
-# crossOriginIsolated document). Matched on \$request_uri because try_files
-# rewrites \$uri to /index.html before add_header runs, so a per-location
-# add_header on the player route never fires. Mirrors upstream RomM's
-# docker/nginx/templates/default.conf.template.
-map \$request_uri \$coep_header {
-    default        "";
-    ~^/rom/.*/(ejs|jsdos)(\?|\$) "require-corp";
-}
-map \$request_uri \$coop_header {
-    default        "";
-    ~^/rom/.*/(ejs|jsdos)(\?|\$) "same-origin";
-}
-
 server {
    listen 80;
    server_name _;
@@ -170,9 +155,6 @@ server {

    location / {
        try_files \$uri \$uri/ /index.html;
-        add_header Cache-Control "no-cache";
-        add_header Cross-Origin-Embedder-Policy \$coep_header;
-        add_header Cross-Origin-Opener-Policy \$coop_header;
    }

    location /assets {
@@ -182,6 +164,12 @@ server {
        add_header Cache-Control "public, immutable";
    }

+    location ~ ^/rom/.*/ejs\$ {
+        add_header Cross-Origin-Embedder-Policy "require-corp";
+        add_header Cross-Origin-Opener-Policy "same-origin";
+        try_files \$uri /index.html;
+    }
+
    location /api {
        proxy_pass http://romm_backend;
        proxy_buffering off;
@@ -221,7 +209,7 @@ server {
    }
 }
 EOF
-        msg_ok "Updated Angie config"
+        msg_ok "Added /decode and /cache locations"
      else
        sed -i -e "s|alias .*/library/;|alias ${ROMM_BASE}/library/;|" \
          -e "s|alias .*/cache/;|alias ${ROMM_BASE}/cache/;|" /etc/angie/http.d/romm.conf
@@ -32,16 +32,6 @@ function update_script() {
    exit
  fi

-  ensure_dependencies redis-server
-  systemctl enable -q --now redis-server
-  if ! grep -q "BACKEND_CACHE_REDIS_URI" /opt/teable/.env; then
-    sed -i '/^BACKEND_CACHE_SQLITE_URI=/d' /opt/teable/.env
-    sed -i 's|^BACKEND_CACHE_PROVIDER=.*|BACKEND_CACHE_PROVIDER=redis\nBACKEND_CACHE_REDIS_URI=redis://127.0.0.1:6379/0|' /opt/teable/.env
-    sed -i 's|^After=network.target postgresql.service$|After=network.target postgresql.service redis-server.service|' /etc/systemd/system/teable.service
-    systemctl daemon-reload
-    systemctl restart teable
-  fi
-
  if check_for_gh_release "teable" "teableio/teable"; then
    msg_info "Stopping Service"
    systemctl stop teable
@@ -47,7 +47,7 @@ function update_script() {
    $STD apt install -y aspnetcore-runtime-10.0
  fi

-  RELEASE=$(get_latest_github_release "TechnitiumSoftware/DnsServer")
+  RELEASE=$(curl -fsSL https://technitium.com/dns/ | grep -oP 'Version \K[\d.]+')
  if [[ ! -f ~/.technitium || ${RELEASE} != "$(cat ~/.technitium 2>/dev/null)" ]]; then
    fetch_and_deploy_from_url "https://download.technitium.com/dns/DnsServerPortable.tar.gz" /opt/technitium/dns
    echo "${RELEASE}" >~/.technitium
@@ -31,30 +31,12 @@ function update_script() {
  fi

  JAVA_VERSION="25" setup_java
-
-  if ! grep -q "install.data_dir" /etc/thingsboard/conf/thingsboard.conf; then
-    msg_info "Restoring Package Defaults"
-    cat <<'EOF' >>/etc/thingsboard/conf/thingsboard.conf
-
-export JAVA_OPTS="$JAVA_OPTS -Dplatform=deb -Dinstall.data_dir=/usr/share/thingsboard/data"
-export JAVA_OPTS="$JAVA_OPTS -Xlog:gc*,heap*,age*,safepoint=debug:file=/var/log/thingsboard/gc.log:time,uptime,level,tags:filecount=10,filesize=10M"
-export JAVA_OPTS="$JAVA_OPTS -XX:+IgnoreUnrecognizedVMOptions -XX:+HeapDumpOnOutOfMemoryError"
-export JAVA_OPTS="$JAVA_OPTS -XX:-UseBiasedLocking -XX:+UseTLAB -XX:+ResizeTLAB -XX:+PerfDisableSharedMem -XX:+UseCondCardMark"
-export JAVA_OPTS="$JAVA_OPTS -XX:+UseG1GC -XX:MaxGCPauseMillis=500 -XX:+UseStringDeduplication -XX:+ParallelRefProcEnabled -XX:MaxTenuringThreshold=10"
-export LOG_FILENAME=thingsboard.out
-export LOADER_PATH=/usr/share/thingsboard/conf,/usr/share/thingsboard/extensions
-export SQL_DATA_FOLDER=/usr/share/thingsboard/data/sql
-EOF
-    systemctl restart thingsboard
-    msg_ok "Restored Package Defaults"
-  fi
-
  if check_for_gh_release "thingsboard" "thingsboard/thingsboard"; then
    msg_info "Stopping Service"
    systemctl stop thingsboard
    msg_ok "Stopped Service"

-    DPKG_FORCE_CONFOLD=1 fetch_and_deploy_gh_release "thingsboard" "thingsboard/thingsboard" "binary" "latest" "/tmp" "thingsboard-*.deb"
+    fetch_and_deploy_gh_release "thingsboard" "thingsboard/thingsboard" "binary" "latest" "/tmp" "thingsboard-*.deb"

    msg_info "Running Database Upgrade"
    $STD /usr/share/thingsboard/bin/install/upgrade.sh
@@ -30,7 +30,7 @@ function update_script() {
    exit
  fi

-  NODE_VERSION="26" setup_nodejs
+  NODE_VERSION="24" setup_nodejs

  msg_info "Updating prestart script"
  cat <<EOF >/data/tracearr/prestart.sh
@@ -32,14 +32,7 @@ function update_script() {

  NODE_VERSION="22" setup_nodejs

-  RELEASE=""
-  if ! grep -qs '^DATABASE_URL=' /opt/tududi/backend/.env; then
-    RELEASE="v1.15.0"
-    msg_warn "Tududi 2.0 runs on PostgreSQL only, so this SQLite install stays on 1.15.0"
-    msg_warn "To move to 2.0, export in Settings > Backups and import into a new Tududi LXC"
-  fi
-
-  if check_for_gh_release "tududi" "chrisvel/tududi" "${RELEASE}" "2.0 needs PostgreSQL"; then
+  if check_for_gh_release "tududi" "chrisvel/tududi"; then
    msg_info "Stopping Service"
    systemctl stop tududi
    msg_ok "Stopped Service"
@@ -50,14 +43,9 @@ function update_script() {
    else
      cp /opt/tududi/.env /opt/tududi.env
    fi
-    if ! grep -q '^TUDUDI_UPLOAD_PATH=' /opt/tududi.env; then
-      mkdir -p /opt/tududi-uploads
-      [[ -d /opt/tududi/backend/uploads ]] && cp -a /opt/tududi/backend/uploads/. /opt/tududi-uploads/
-      echo "TUDUDI_UPLOAD_PATH=/opt/tududi-uploads" >>/opt/tududi.env
-    fi
    msg_ok "Backed up env file"

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "tududi" "chrisvel/tududi" "tarball" "${CHECK_UPDATE_RELEASE}" "/opt/tududi"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "tududi" "chrisvel/tududi" "tarball" "latest" "/opt/tududi"

    msg_info "Updating Tududi"
    cd /opt/tududi
@@ -30,41 +30,6 @@ function update_script() {
    exit
  fi

-  if [[ -d /opt/wikijs/backend ]]; then
-    NODE_VERSION="26" setup_nodejs
-
-    if check_for_gh_release "wikijs" "requarks/wiki"; then
-      PUPPETEER_INSTALLED=$([[ -d /opt/wikijs/backend/node_modules/puppeteer ]] && echo "true" || echo "false")
-
-      msg_info "Stopping Service"
-      systemctl stop wikijs
-      msg_ok "Stopped Service"
-
-      create_backup /opt/wikijs/config.yml
-      CLEAN_INSTALL=1 fetch_and_deploy_gh_release "wikijs" "requarks/wiki" "prebuild" "latest" "/opt/wikijs" "wiki-js.tar.gz"
-      restore_backup
-
-      cd /opt/wikijs/backend
-      if [[ "$(arch_resolve)" == "arm64" ]]; then
-        msg_info "Building Wiki.js Dependencies"
-        $STD npm ci --omit=dev
-        msg_ok "Built Wiki.js Dependencies"
-      fi
-      if [[ "$PUPPETEER_INSTALLED" == "true" ]]; then
-        msg_info "Reinstalling Puppeteer"
-        $STD npm install --no-save --force --include=optional --no-ignore-scripts --no-audit --no-fund "puppeteer@$(sed -n 's/^installVersion: *//p' modules/extensions/puppeteer/definition.yml)"
-        msg_ok "Reinstalled Puppeteer"
-      fi
-
-      msg_info "Starting Service"
-      systemctl start wikijs
-      msg_ok "Started Service"
-      msg_ok "Updated successfully!"
-    fi
-    exit
-  fi
-
-  msg_warn "Wiki.js 3 cannot update a 2.x install in place. Export it under Administration > Utilities > Export for Wiki.js 3.x and import it into a new Wiki.js 3 container."
  NODE_VERSION="26" NODE_MODULE="yarn,node-gyp" setup_nodejs

  if check_for_gh_release "wikijs" "requarks/wiki-v2"; then
@@ -22,7 +22,7 @@ if [[ "${var_os:-}" == "alpine" ]]; then
  var_disk="${var_disk:-1}"
  var_version="${var_version:-3.24}"
 else
-  var_ram="${var_ram:-1024}"
+  var_ram="${var_ram:-512}"
  var_disk="${var_disk:-4}"
  var_version="${var_version:-13}"
 fi
@@ -38,7 +38,7 @@ function update_script() {

    create_backup /opt/yuvomi/data /opt/yuvomi/.env

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "yuvomi" "ulsklyc/yuvomi" "prebuild" "latest" "/opt/yuvomi" "yuvomi-*-dist.tar.gz"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "yuvomi" "ulsklyc/yuvomi" "tarball"
    NODE_VERSION="24" setup_nodejs

    msg_info "Installing Node.js Dependencies"
@@ -9,7 +9,7 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 APP="Zipline"
 var_tags="${var_tags:-file;sharing}"
 var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-3072}"
+var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-5}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os

-NODE_VERSION="26" NODE_MODULE="pnpm" setup_nodejs
+NODE_VERSION="24" NODE_MODULE="pnpm" setup_nodejs
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="anchor" PG_DB_USER="anchor" setup_postgresql_db

@@ -48,7 +48,6 @@ chown -R archivebox:archivebox /opt/archivebox/{data,.npm,.cache,.local}
 chmod -R 755 /opt/archivebox/data
 $STD uv pip install archivebox --system --break-system-packages
 cd /opt/archivebox/data
-ADMIN_PASS=$(random_password 20)
 expect <<EOF
 set timeout -1
 log_user 0
@@ -63,18 +62,13 @@ expect "Email address"
 send "\r"

 expect "Password"
-send "${ADMIN_PASS}\r"
+send "community-scripts.org\r"

 expect "Password (again)"
-send "${ADMIN_PASS}\r"
+send "community-scripts.org\r"

 expect eof
 EOF
-{
-  echo "ArchiveBox Credentials"
-  echo "Username: archivebox"
-  echo "Password: ${ADMIN_PASS}"
-} >~/archivebox.creds
 msg_ok "Installed ArchiveBox"

 msg_info "Creating Service"
@@ -63,19 +63,12 @@ else
 fi
 echo "$AUTHELIA_URL" >/etc/authelia/.authelia_url

-AUTHELIA_PASS=$(random_password 20)
-AUTHELIA_HASH=$(authelia crypto hash generate argon2 --password "$AUTHELIA_PASS" | awk '/Digest:/{print $2}')
-{
-  echo "Authelia Credentials"
-  echo "Username: authelia"
-  echo "Password: ${AUTHELIA_PASS}"
-} >~/authelia.creds
 cat <<EOF >/etc/authelia/users.yml
 users:
  authelia:
    disabled: false
    displayname: "Authelia Admin"
-    password: "${AUTHELIA_HASH}"
+    password: "\$argon2id\$v=19\$m=65536,t=3,p=4\$ZBopMzXrzhHXPEZxRDVT2w\$SxWm96DwhOsZyn34DLocwQEIb4kCDsk632PuiMdZnig"
    groups: []
 EOF
 cat <<EOF >/etc/authelia/configuration.yml
@@ -23,15 +23,10 @@ setup_deb_based() {
    setup_go
    fetch_and_deploy_gh_release "xcaddy" "caddyserver/xcaddy" "binary"

+    msg_info "Setup xCaddy"
    $STD apt install -y git
-    if (($(awk '/^MemTotal:/ {print int($2 / 1024)}' /proc/meminfo) < 1900)); then
-      msg_warn "xCaddy is installed; its test build was skipped because linking Caddy needs about 2 GB RAM"
-    else
-      msg_info "Setup xCaddy"
-      cd /opt
-      $STD xcaddy build
-      msg_ok "Setup xCaddy"
-    fi
+    $STD xcaddy build
+    msg_ok "Setup xCaddy"
  fi
 }

@@ -74,14 +69,10 @@ EOF
    GO_VERSION="$(curl -fsSL https://go.dev/VERSION?m=text | head -1 | cut -c3-)" setup_go
    fetch_and_deploy_gh_release "xcaddy" "caddyserver/xcaddy" "prebuild" "latest" "/opt/xcaddy" "xcaddy_*_linux_$(arch_resolve).tar.gz"
    ln -sf /opt/xcaddy/xcaddy /usr/local/bin/xcaddy
-    if (($(awk '/^MemTotal:/ {print int($2 / 1024)}' /proc/meminfo) < 1900)); then
-      msg_warn "xCaddy is installed; its test build was skipped because linking Caddy needs about 2 GB RAM"
-    else
-      msg_info "Setup xCaddy"
-      cd /opt
-      $STD xcaddy build
-      msg_ok "Setup xCaddy"
-    fi
+    msg_info "Setup xCaddy"
+    cd /opt
+    $STD xcaddy build
+    msg_ok "Setup xCaddy"
  fi

  msg_info "Enabling Caddy Service"
@@ -1,54 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/chattocorp/chatto
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-fetch_and_deploy_gh_release "chatto" "chattocorp/chatto" "prebuild" "latest" "/opt/chatto" "chatto_Linux_$(arch_resolve x86_64 arm64).tar.gz"
-chmod +x /opt/chatto/chatto
-
-msg_info "Configuring Chatto"
-mkdir -p /opt/chatto_data
-cd /opt/chatto
-$STD ./chatto init
-mv /opt/chatto/chatto.toml /opt/chatto_data/chatto.toml
-sed -i \
-  -e "/^\[webserver\]/,/^\[/ s|^url = .*|url = 'http://${LOCAL_IP}:4000'|" \
-  -e "/^\[nats.embedded\]/,/^\[/ s|^data_dir = .*|data_dir = '/opt/chatto_data/data'|" \
-  -e '/^# \[operator_api\]$/,/^$/ { s|^# \[operator_api\]$|[operator_api]|; s|^# enabled = false$|enabled = true| }' \
-  /opt/chatto_data/chatto.toml
-msg_ok "Configured Chatto"
-
-msg_info "Creating Service"
-cat <<EOF >/etc/systemd/system/chatto.service
-[Unit]
-Description=Chatto
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=/opt/chatto
-ExecStart=/opt/chatto/chatto run -c /opt/chatto_data/chatto.toml
-Restart=always
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now chatto
-msg_ok "Created Service"
-
-motd_ssh
-customize
-cleanup_lxc
@@ -17,7 +17,7 @@ msg_info "Installing Dependencies"
 $STD apt install -y build-essential
 msg_ok "Installed Dependencies"

-NODE_VERSION="26" setup_nodejs
+NODE_VERSION="24" setup_nodejs

 msg_info "Setup Cross-Seed"
 $STD npm install cross-seed@latest -g
@@ -16,47 +16,119 @@ update_os
 msg_info "Installing Dependencies"
 $STD apt install -y \
  nginx \
-  libedit2 \
-  libgssapi-krb5-2 \
-  libncurses6 \
-  libreadline8t64
+  valkey \
+  mariadb-client \
+  rclone
 msg_ok "Installed Dependencies"

 PG_VERSION="17" setup_postgresql
 NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs

+msg_info "Installing Database Clients"
+# Create PostgreSQL version symlinks for compatibility
+for v in 12 13 14 15 16 18; do
+  ln -sf /usr/lib/postgresql/17 /usr/lib/postgresql/$v
+done
+# Install MongoDB Database Tools via direct .deb (no APT repo for Debian 13)
+[[ "$(get_os_info id)" == "ubuntu" ]] && MONGO_DIST="ubuntu2204" || MONGO_DIST="debian12"
+# MongoDB only publishes arm64 builds for Ubuntu
+[[ "$(arch_resolve "x86_64" "arm64")" == "arm64" ]] && MONGO_DIST="ubuntu2204"
+MONGO_VERSION=$(get_latest_gh_tag "mongodb/mongo-tools" "100." || echo "100.16.1")
+fetch_and_deploy_from_url "https://fastdl.mongodb.org/tools/db/mongodb-database-tools-${MONGO_DIST}-$(arch_resolve "x86_64" "arm64")-${MONGO_VERSION}.deb" ""
+mkdir -p /usr/local/mongodb-database-tools/bin
+[[ -f /usr/bin/mongodump ]] && ln -sf /usr/bin/mongodump /usr/local/mongodb-database-tools/bin/mongodump
+[[ -f /usr/bin/mongorestore ]] && ln -sf /usr/bin/mongorestore /usr/local/mongodb-database-tools/bin/mongorestore
+# Create MariaDB and MySQL client symlinks for compatibility
+mkdir -p /usr/local/mariadb-{10.6,12.1}/bin /usr/local/mysql-{5.7,8.0,8.4,9}/bin
+for dir in /usr/local/mariadb-{10.6,12.1}/bin; do
+  ln -sf /usr/bin/mariadb-dump "$dir/mariadb-dump"
+  ln -sf /usr/bin/mariadb "$dir/mariadb"
+done
+for dir in /usr/local/mysql-{5.7,8.0,8.4,9}/bin; do
+  ln -sf /usr/bin/mariadb-dump "$dir/mysqldump"
+  ln -sf /usr/bin/mariadb "$dir/mysql"
+done
+msg_ok "Installed Database Clients"
+
 fetch_and_deploy_gh_release "databasus" "databasus/databasus" "tarball" "latest" "/opt/databasus"
 GO_VERSION="$(grep -m1 '^go ' /opt/databasus/backend/go.mod | awk '{print $2}')" setup_go

 msg_info "Building Databasus (Patience)"
-RELEASE=$(cat ~/.databasus)
 export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
 cd /opt/databasus/frontend
+
 $STD corepack prepare pnpm@latest --activate
 $STD pnpm install --frozen-lockfile
-$STD env VITE_APP_VERSION="${RELEASE}" pnpm run build
+$STD pnpm run build
 cd /opt/databasus/backend
-$STD env CGO_ENABLED=0 GOOS=linux GOARCH="$(arch_resolve)" go build -o /opt/databasus/databasus ./cmd/databasus
-mkdir -p /opt/databasus/agent-binaries
-for arch in amd64 arm64; do
-  $STD env CGO_ENABLED=0 GOOS=linux GOARCH=$arch go build -ldflags "-X main.Version=${RELEASE}" -o /opt/databasus/agent-binaries/databasus-verification-agent-linux-$arch ./cmd/verification-agent
-done
+$STD go mod tidy
+$STD go mod download
+$STD go install github.com/swaggo/swag/cmd/swag@latest
+$STD /root/go/bin/swag init -g cmd/main.go -o swagger
+$STD env CGO_ENABLED=0 GOOS=linux GOARCH=$(arch_resolve) go build -o databasus ./cmd
+mv /opt/databasus/backend/databasus /opt/databasus/databasus
 mkdir -p /databasus-data/{pgdata,temp,backups,data,logs}
 mkdir -p /opt/databasus/ui/build
+mkdir -p /opt/databasus/migrations
 cp -r /opt/databasus/frontend/dist/* /opt/databasus/ui/build/
+cp -r /opt/databasus/backend/migrations/* /opt/databasus/migrations/
 chown -R postgres:postgres /databasus-data
 msg_ok "Built Databasus"

 msg_info "Configuring Databasus"
+JWT_SECRET=$(openssl rand -hex 32)
+ENCRYPTION_KEY=$(openssl rand -hex 32)
+# Install goose for migrations
+$STD go install github.com/pressly/goose/v3/cmd/goose@latest
+ln -sf /root/go/bin/goose /usr/local/bin/goose
 cat <<EOF >/.env
+# Environment
 ENV_MODE=production
-APP_VERSION=${RELEASE}
+
+# Server
+SERVER_PORT=4005
+SERVER_HOST=0.0.0.0
+
+# Database
 DATABASE_DSN=host=localhost user=postgres password=postgres dbname=databasus port=5432 sslmode=disable
+DATABASE_URL=postgres://postgres:postgres@localhost:5432/databasus?sslmode=disable
+
+# Migrations
+GOOSE_DRIVER=postgres
+GOOSE_DBSTRING=postgres://postgres:postgres@localhost:5432/databasus?sslmode=disable
+GOOSE_MIGRATION_DIR=/opt/databasus/migrations
+
+# Valkey (Redis-compatible cache)
+VALKEY_HOST=localhost
+VALKEY_PORT=6379
+
+# Security
+JWT_SECRET=${JWT_SECRET}
+ENCRYPTION_KEY=${ENCRYPTION_KEY}
+
+# Paths
+DATA_DIR=/databasus-data/data
+BACKUP_DIR=/databasus-data/backups
+LOG_DIR=/databasus-data/logs
 EOF
 chmod 600 /.env
 msg_ok "Configured Databasus"

+msg_info "Configuring Valkey"
+cat <<EOF >/etc/valkey/valkey.conf
+port 6379
+bind 127.0.0.1
+protected-mode yes
+save ""
+maxmemory 256mb
+maxmemory-policy allkeys-lru
+EOF
+systemctl enable -q --now valkey-server
+systemctl restart valkey-server
+msg_ok "Configured Valkey"
+
 msg_info "Creating Database"
+# Configure PostgreSQL to allow local password auth for databasus
 PG_HBA="/etc/postgresql/17/main/pg_hba.conf"
 if ! grep -q "databasus" "$PG_HBA"; then
  sed -i '/^local\s*all\s*all/i local   databasus   postgres                                trust' "$PG_HBA"
@@ -71,8 +143,8 @@ msg_info "Creating Databasus Service"
 cat <<EOF >/etc/systemd/system/databasus.service
 [Unit]
 Description=Databasus - Database Backup Management
-After=network.target postgresql.service
-Requires=postgresql.service
+After=network.target postgresql.service valkey.service
+Requires=postgresql.service valkey.service

 [Service]
 Type=simple
@@ -25,36 +25,9 @@ $STD apt install -y \
  gsfonts \
  brotli \
  nginx \
-  redis-server \
-  meson \
-  ninja-build \
-  pkg-config \
-  libglib2.0-dev \
-  libexpat1-dev \
-  libjpeg-dev \
-  libpng-dev \
-  libwebp-dev \
-  libtiff-dev \
-  libheif-dev \
-  libjxl-dev \
-  librsvg2-dev \
-  libcgif-dev \
-  libexif-dev \
-  liblcms2-dev \
-  liborc-0.4-dev \
-  libimagequant-dev \
-  libpango1.0-dev
+  redis-server
 msg_ok "Installed Dependencies"

-fetch_and_deploy_gh_release "libvips" "libvips/libvips" "prebuild" "latest" "/opt/libvips" "vips-*.tar.xz"
-
-msg_info "Building libvips"
-cd /opt/libvips
-$STD meson setup build --prefix=/usr/local --libdir=lib --buildtype=release -Dmodules=disabled -Dmagick=disabled -Dexamples=false
-$STD ninja -C build install
-ldconfig
-msg_ok "Built libvips"
-
 msg_info "Cloning Discourse"
 $STD git clone --depth 1 https://github.com/discourse/discourse.git /opt/discourse
 msg_ok "Cloned Discourse"
@@ -1,146 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: Masked-Kunsiquat
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://www.espocrm.com/ | Github: https://github.com/espocrm/espocrm
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-if [[ -z "${var_admin_user:-}" ]]; then
-  var_admin_user=$(prompt_input "EspoCRM admin username (a-z, 0-9, @ . _ -):" "admin" 60)
-fi
-var_admin_user="${var_admin_user:-admin}"
-var_admin_user="${var_admin_user,,}"
-if [[ ! "$var_admin_user" =~ ^[a-z0-9@._-]+$ ]]; then
-  msg_warn "EspoCRM usernames take only a-z, 0-9 and @ . _ -; using admin"
-  var_admin_user="admin"
-fi
-if [[ -z "${var_admin_pass:-}" ]]; then
-  var_admin_pass=$(random_password 16)
-fi
-
-msg_info "Installing Dependencies"
-$STD apt install -y nginx
-msg_ok "Installed Dependencies"
-
-setup_mariadb
-MARIADB_DB_NAME="espocrm" MARIADB_DB_USER="espocrm" setup_mariadb_db
-PHP_VERSION="8.4" PHP_FPM="YES" PHP_MODULE="ldap" setup_php
-fetch_and_deploy_gh_release "espo-crm" "espocrm/espocrm" "prebuild" "latest" "/opt/espocrm" "EspoCRM-*.zip"
-
-msg_info "Configuring EspoCRM"
-cd /opt/espocrm
-$STD php bin/command config:populate
-$STD php bin/command config:set defaultPermissions.user www-data
-$STD php bin/command config:set defaultPermissions.group www-data
-$STD php bin/command config:set database.platform Mysql
-$STD php bin/command config:set database.host localhost
-$STD php bin/command config:set database.dbname "$MARIADB_DB_NAME"
-$STD php bin/command config:set database.user "$MARIADB_DB_USER"
-$STD php bin/command config:set database.password "$MARIADB_DB_PASS"
-$STD php bin/command rebuild
-$STD php bin/command create-admin-user "$var_admin_user"
-printf '%s\n' "$var_admin_pass" | $STD php bin/command set-password "$var_admin_user"
-$STD php bin/command config:set siteUrl "http://${LOCAL_IP}"
-$STD php bin/command populate-scheduled-jobs
-$STD php bin/command config:set jobRunInParallel true --type=bool
-$STD php bin/command app-check
-$STD php bin/command config:set isInstalled true --type=bool
-chown -R www-data:www-data /opt/espocrm
-msg_ok "Configured EspoCRM"
-
-msg_info "Creating Nginx Site"
-PHP_SOCK=$(get_php_fpm_socket)
-cat <<EOF >/etc/nginx/sites-available/espocrm
-server {
-    listen 80 default_server;
-    listen [::]:80 default_server;
-    server_name _;
-
-    charset utf-8;
-    index index.html index.php;
-
-    client_max_body_size 128M;
-    keepalive_timeout 300;
-    server_tokens off;
-    fastcgi_send_timeout 300;
-    fastcgi_read_timeout 300;
-
-    gzip on;
-    gzip_types text/plain text/css text/javascript application/javascript application/json;
-    gzip_min_length 1000;
-
-    root /opt/espocrm/public;
-
-    location /client {
-        root /opt/espocrm;
-        autoindex off;
-
-        location ~* ^.+\.(js|css|png|jpg|svg|svgz|jpeg|gif|ico|tpl)\$ {
-            access_log off;
-            expires max;
-        }
-    }
-
-    location = /favicon.ico { access_log off; log_not_found off; }
-    location = /robots.txt { access_log off; log_not_found off; }
-
-    location ~ \.php\$ {
-        fastcgi_pass unix:${PHP_SOCK};
-        include fastcgi_params;
-        fastcgi_index index.php;
-        fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
-        fastcgi_param QUERY_STRING \$query_string;
-    }
-
-    location /api/v1/ {
-        if (!-e \$request_filename) {
-            rewrite ^/api/v1/(.*)\$ /api/v1/index.php last;
-        }
-    }
-
-    location /portal/ {
-        try_files \$uri \$uri/ /portal/index.php?\$query_string;
-    }
-
-    location /api/v1/portal-access {
-        if (!-e \$request_filename) {
-            rewrite ^/api/v1/(.*)\$ /api/v1/portal-access/index.php last;
-        }
-    }
-
-    location ~ /(\.htaccess|web\.config|\.git) {
-        deny all;
-    }
-}
-EOF
-msg_ok "Created Nginx Site"
-nginx_enable_site "espocrm"
-
-msg_info "Setting up Cron"
-cat <<EOF >/etc/cron.d/espocrm
-* * * * * www-data cd /opt/espocrm && php -f cron.php >/dev/null 2>&1
-EOF
-systemctl enable -q --now cron
-msg_ok "Set up Cron"
-
-msg_info "Saving Credentials"
-cat <<EOF >>~/espocrm.creds
-
-EspoCRM Admin
-Username: ${var_admin_user}
-Password: ${var_admin_pass}
-EOF
-chmod 600 ~/espocrm.creds
-msg_ok "Saved Credentials"
-
-motd_ssh
-customize
-cleanup_lxc
@@ -26,7 +26,6 @@ chown -R www-data:www-data /opt/firefly
 chmod -R 775 /opt/firefly/storage
 cd /opt/firefly
 cp .env.example .env
-sed -i -e "s|^APP_KEY=.*|APP_KEY=$(random_password 32)|" -e "s|^STATIC_CRON_TOKEN=.*|STATIC_CRON_TOKEN=$(random_password 32)|" /opt/firefly/.env
 sed -i "s/DB_HOST=.*/DB_HOST=localhost/" /opt/firefly/.env
 sed -i "s/DB_PASSWORD=.*/DB_PASSWORD=$MARIADB_DB_PASS/" /opt/firefly/.env
 $STD composer install --no-dev --no-plugins --no-interaction
@@ -1,99 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/mozilla-services/syncstorage-rs
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-msg_info "Installing Dependencies"
-$STD apt install -y \
-  build-essential \
-  pkg-config \
-  libssl-dev \
-  libpq-dev \
-  python3-dev
-msg_ok "Installed Dependencies"
-
-PG_VERSION="18" setup_postgresql
-PG_DB_NAME="syncserver" PG_DB_USER="syncserver" setup_postgresql_db
-setup_rust
-setup_uv
-
-fetch_and_deploy_gh_release "firefox-syncserver" "mozilla-services/syncstorage-rs" "tarball"
-
-msg_info "Building Firefox Syncserver (Patience)"
-cd /opt/firefox-syncserver
-$STD cargo build --release --locked --no-default-features --features=syncstorage-db/postgres --features=tokenserver-db/postgres --features=py_verifier
-cp target/release/syncserver /usr/local/bin/syncserver
-rm -rf target
-$STD uv venv --python /usr/bin/python3 /opt/firefox-syncserver/.venv
-$STD uv pip install --python /opt/firefox-syncserver/.venv/bin/python pyfxa tokenlib cryptography
-msg_ok "Built Firefox Syncserver"
-
-msg_info "Configuring Firefox Syncserver"
-mkdir -p /opt/firefox-syncserver_data
-cat <<EOF >/opt/firefox-syncserver_data/.env
-SYNC_HOST=0.0.0.0
-SYNC_PORT=8000
-SYNC_MASTER_SECRET=$(openssl rand -hex 32)
-SYNC_HUMAN_LOGS=true
-RUST_LOG=info
-SYNC_SYNCSTORAGE__DATABASE_URL=postgres://syncserver:${PG_DB_PASS}@127.0.0.1:5432/syncserver
-SYNC_SYNCSTORAGE__GLEAN_ENABLED=false
-SYNC_TOKENSERVER__ENABLED=true
-SYNC_TOKENSERVER__RUN_MIGRATIONS=true
-SYNC_TOKENSERVER__DATABASE_URL=postgres://syncserver:${PG_DB_PASS}@127.0.0.1:5432/syncserver
-SYNC_TOKENSERVER__NODE_TYPE=postgres
-SYNC_TOKENSERVER__FXA_EMAIL_DOMAIN=api.accounts.firefox.com
-SYNC_TOKENSERVER__FXA_OAUTH_SERVER_URL=https://oauth.accounts.firefox.com
-SYNC_TOKENSERVER__INIT_NODE_URL=http://${LOCAL_IP}:8000
-EOF
-chmod 600 /opt/firefox-syncserver_data/.env
-cat <<'EOF' >/opt/firefox-syncserver_data/nodes.sql
-SELECT to_regclass('nodes') IS NOT NULL AS ready \gset
-\if :ready
-UPDATE nodes SET node = :'url'
- WHERE id = (SELECT min(id) FROM nodes)
-   AND NOT EXISTS (SELECT 1 FROM nodes WHERE node = :'url');
-UPDATE users SET nodeid = (SELECT id FROM nodes WHERE node = :'url')
- WHERE nodeid <> (SELECT id FROM nodes WHERE node = :'url');
-DELETE FROM nodes WHERE node <> :'url';
-\endif
-EOF
-msg_ok "Configured Firefox Syncserver"
-
-msg_info "Creating Service"
-cat <<EOF >/etc/systemd/system/firefox-syncserver.service
-[Unit]
-Description=Firefox Syncserver
-After=network.target postgresql.service
-Wants=postgresql.service
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=/opt/firefox-syncserver
-EnvironmentFile=/opt/firefox-syncserver_data/.env
-Environment=PYTHONPATH=/opt/firefox-syncserver/.venv/lib/python3.13/site-packages
-ExecStartPre=/usr/bin/psql -1 -q -v ON_ERROR_STOP=1 -v url=\${SYNC_TOKENSERVER__INIT_NODE_URL} -f /opt/firefox-syncserver_data/nodes.sql \${SYNC_TOKENSERVER__DATABASE_URL}
-ExecStart=/usr/local/bin/syncserver
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now firefox-syncserver
-msg_ok "Created Service"
-
-motd_ssh
-customize
-cleanup_lxc
@@ -14,15 +14,18 @@ network_check
 update_os

 msg_info "Installing Dependencies"
-CODENAME=$(get_os_info codename)
-setup_deb822_repo \
-  "debian-backports" \
-  "file:///usr/share/keyrings/debian-archive-keyring.gpg" \
-  "http://deb.debian.org/debian" \
-  "${CODENAME}-backports" \
-  "main"
 $STD apt install -y \
  chromium \
+  libreoffice-writer \
+  libreoffice-calc \
+  libreoffice-impress \
+  libreoffice-draw \
+  libreoffice-math \
+  python3-uno \
+  python-is-python3 \
+  pdftk-java \
+  qpdf \
+  libimage-exiftool-perl \
  fonts-crosextra-carlito \
  fonts-crosextra-caladea \
  fonts-liberation \
@@ -30,30 +33,28 @@ $STD apt install -y \
  fonts-dejavu \
  fonts-noto-cjk \
  fonts-noto-color-emoji \
-  fonts-noto-core \
-  fonts-urw-base35
-# lok is built against the LibreOffice from backports
-$STD apt install -y -t "${CODENAME}-backports" \
-  libreoffice-writer \
-  libreoffice-calc \
-  libreoffice-impress \
-  libreoffice-draw \
-  libreoffice-math
+  fonts-noto-core
 msg_ok "Installed Dependencies"

+fetch_and_deploy_gh_release "pdfcpu" "pdfcpu/pdfcpu" "prebuild" "latest" "/opt/pdfcpu" "pdfcpu_*_Linux_$(arch_resolve "x86_64" "arm64").tar.xz"
+ln -sf "$(find /opt/pdfcpu -type f -name pdfcpu | head -n1)" /usr/local/bin/pdfcpu
+
+msg_info "Installing unoconverter"
+UNOCONVERTER_VERSION=$(get_latest_github_release "gotenberg/unoconverter" "false")
+download_file "https://raw.githubusercontent.com/gotenberg/unoconverter/${UNOCONVERTER_VERSION}/unoconv" /usr/local/bin/unoconverter
+chmod +x /usr/local/bin/unoconverter
+msg_ok "Installed unoconverter"
+
 fetch_and_deploy_gh_release "gotenberg" "gotenberg/gotenberg" "tarball" "latest" "/opt/gotenberg"

 GO_VERSION="$(awk '$1=="go"{print $2}' /opt/gotenberg/go.mod | cut -d. -f1,2)" setup_go

-LOK_VERSION="$(awk -F= '/^ARG LOK_VERSION=/{print $2}' /opt/gotenberg/build/Dockerfile)"
-fetch_and_deploy_gh_release "lok" "gotenberg/lok" "prebuild" "$LOK_VERSION" "/usr/local/bin" "lok_${LOK_VERSION#v}_linux_$(arch_resolve "amd64" "arm64").tar.gz"
-
 msg_info "Building Gotenberg (Patience)"
 cd /opt/gotenberg
 export CGO_ENABLED=0
 $STD go mod download
 $STD go build -o /usr/local/bin/gotenberg \
-  -ldflags "-s -w -X 'github.com/gotenberg/gotenberg/v9/cmd.Version=$(cat ~/.gotenberg)'" \
+  -ldflags "-s -w -X 'github.com/gotenberg/gotenberg/v8/cmd.Version=$(cat ~/.gotenberg)'" \
  cmd/gotenberg/main.go
 msg_ok "Built Gotenberg"

@@ -69,10 +70,14 @@ Type=simple
 User=root
 Environment=LANG=C.UTF-8
 Environment=LC_ALL=C.UTF-8
+Environment=PDFTK_BIN_PATH=/usr/bin/pdftk
+Environment=QPDF_BIN_PATH=/usr/bin/qpdf
+Environment=EXIFTOOL_BIN_PATH=/usr/bin/exiftool
+Environment=PDFCPU_BIN_PATH=/usr/local/bin/pdfcpu
 Environment=CHROMIUM_BIN_PATH=/usr/bin/chromium
 Environment=CHROMIUM_HYPHEN_DATA_DIR_PATH=/opt/gotenberg/build/chromium-hyphen-data
 Environment=LIBREOFFICE_BIN_PATH=/usr/lib/libreoffice/program/soffice.bin
-Environment=LOK_BIN_PATH=/usr/local/bin/lok
+Environment=UNOCONVERTER_BIN_PATH=/usr/local/bin/unoconverter
 Environment=OTEL_TRACES_EXPORTER=none
 Environment=OTEL_METRICS_EXPORTER=none
 Environment=OTEL_LOGS_EXPORTER=none
@@ -17,7 +17,7 @@ msg_info "Installing Dependencies"
 $STD apt install -y sqlite3
 msg_ok "Installed Dependencies"

-NODE_VERSION="26" setup_nodejs
+NODE_VERSION="24" setup_nodejs
 fetch_and_deploy_gh_release "guardian" "HydroshieldMKII/Guardian" "tarball" "latest" "/opt/guardian"

 msg_info "Configuring ${APPLICATION}"
@@ -33,13 +33,7 @@ msg_ok "Set up Python Backend"
 msg_info "Configuring Homelable"
 mkdir -p /opt/homelable/data
 SECRET_KEY=$(openssl rand -hex 32)
-HOMELABLE_PASS=$(random_password 20)
-BCRYPT_HASH=$(/opt/homelable/backend/.venv/bin/python -c "import bcrypt,sys; print(bcrypt.hashpw(sys.argv[1].encode(), bcrypt.gensalt()).decode())" "$HOMELABLE_PASS")
-{
-  echo "Homelable Credentials"
-  echo "Username: admin"
-  echo "Password: ${HOMELABLE_PASS}"
-} >~/homelable.creds
+BCRYPT_HASH=$(/opt/homelable/backend/.venv/bin/python -c "import bcrypt; print(bcrypt.hashpw(b'admin', bcrypt.gensalt()).decode())")
 cat <<EOF >/opt/homelable/backend/.env
 SECRET_KEY=${SECRET_KEY}
 SQLITE_PATH=/opt/homelable/data/homelab.db
@@ -18,12 +18,7 @@ if is_debian && [[ "$(get_os_version_major)" -lt 13 ]]; then
  exit 238
 fi

-if [[ "$(arch_resolve)" == "amd64" ]] && ! grep -qm1 sse4_2 /proc/cpuinfo; then
-  msg_error "Immich needs a CPU with SSE4.2: its web build stops with 'Illegal instruction' on older ones."
-  exit 236
-fi
-
-RELEASE="v3.3.6"
+RELEASE="v3.3.5"
 if lscpu | grep -q 'GenuineIntel'; then
  echo ""
  echo ""
@@ -113,7 +108,6 @@ $STD apt install --no-install-recommends -y \
  libhwy-dev \
  libwebp-dev \
  libaom-dev \
-  unzip \
  ccache

 setup_deb822_repo \
@@ -135,28 +129,6 @@ if [[ "$CTTYPE" == "0" && -d /dev/dri ]]; then
 fi
 msg_ok "Dependencies Installed"

-INSTALL_DIR="/opt/${APPLICATION}"
-UPLOAD_DIR="${INSTALL_DIR}/upload"
-SRC_DIR="${INSTALL_DIR}/source"
-APP_DIR="${INSTALL_DIR}/app"
-PLUGIN_DIR="${APP_DIR}/plugins/immich-plugin-core"
-ML_DIR="${APP_DIR}/machine-learning"
-GEO_DIR="${INSTALL_DIR}/geodata"
-mkdir -p {"${APP_DIR}","${UPLOAD_DIR}","${GEO_DIR}","${INSTALL_DIR}"/cache}
-
-msg_info "Installing GeoNames data"
-cd "$GEO_DIR"
-CURL_RETRIES=6 CURL_CONNECT_TO=30 curl_with_retry "https://download.geonames.org/export/dump/admin1CodesASCII.txt" "admin1CodesASCII.txt"
-CURL_RETRIES=6 CURL_CONNECT_TO=30 curl_with_retry "https://download.geonames.org/export/dump/admin2Codes.txt" "admin2Codes.txt"
-CURL_RETRIES=6 CURL_CONNECT_TO=30 curl_with_retry "https://download.geonames.org/export/dump/countryInfo.txt" "countryInfo.txt"
-CURL_RETRIES=6 CURL_CONNECT_TO=30 curl_with_retry "https://download.geonames.org/export/dump/cities500.zip" "cities500.zip"
-curl_with_retry "https://raw.githubusercontent.com/nvkelso/natural-earth-vector/v5.1.2/geojson/ne_10m_admin_0_countries.geojson" "ne_10m_admin_0_countries.geojson"
-unzip -q cities500.zip
-date --iso-8601=seconds | tr -d "\n" >geodata-date.txt
-rm cities500.zip
-cd ~
-msg_ok "Installed GeoNames data"
-
 MISE_ARCH="x64"
 [[ "$(arch_resolve)" == "arm64" ]] && MISE_ARCH="arm64"
 fetch_and_deploy_gh_release "mise" "jdx/mise" "singlefile" "latest" "/usr/local/bin" "mise-v*-linux-${MISE_ARCH}"
@@ -195,7 +167,7 @@ ACTUAL_PG_VERSION=$(ls /etc/postgresql/ 2>/dev/null | sort -V | tail -1)
 ACTUAL_PG_VERSION=${ACTUAL_PG_VERSION:-16}

 VCHORD_RELEASE="1.1.1"
-fetch_and_deploy_gh_release "VectorChord" "supervc-stack/VectorChord" "binary" "${VCHORD_RELEASE}" "/tmp" "postgresql-${ACTUAL_PG_VERSION}-vchord_*_$(arch_resolve).deb"
+fetch_and_deploy_gh_release "VectorChord" "tensorchord/VectorChord" "binary" "${VCHORD_RELEASE}" "/tmp" "postgresql-${ACTUAL_PG_VERSION}-vchord_*_$(arch_resolve).deb"

 sed -i "s/^#shared_preload.*/shared_preload_libraries = 'vchord.so'/" /etc/postgresql/${ACTUAL_PG_VERSION}/main/postgresql.conf
 systemctl restart postgresql.service
@@ -222,7 +194,7 @@ LIBJXL_REVISION="$(jq -cr '.revision' "$BASE_DIR"/server/sources/libjxl.json)"
 $STD git clone https://github.com/libjxl/libjxl.git "$SOURCE"
 cd "$SOURCE"
 $STD git reset --hard "$LIBJXL_REVISION"
-$STD git submodule update --init --recursive --depth 1 --recommend-shallow -- third_party
+$STD git submodule update --init --recursive --depth 1 --recommend-shallow
 mkdir build
 cd build
 $STD cmake \
@@ -375,6 +347,15 @@ libvips: $LIBVIPS_REVISION
 EOF
 msg_ok "Custom Photo-processing Libraries Compiled Successfully"

+INSTALL_DIR="/opt/${APPLICATION}"
+UPLOAD_DIR="${INSTALL_DIR}/upload"
+SRC_DIR="${INSTALL_DIR}/source"
+APP_DIR="${INSTALL_DIR}/app"
+PLUGIN_DIR="${APP_DIR}/plugins/immich-plugin-core"
+ML_DIR="${APP_DIR}/machine-learning"
+GEO_DIR="${INSTALL_DIR}/geodata"
+mkdir -p {"${APP_DIR}","${UPLOAD_DIR}","${GEO_DIR}","${INSTALL_DIR}"/cache}
+
 fetch_and_deploy_gh_release "Immich" "immich-app/immich" "tarball" "${RELEASE}" "$SRC_DIR"
 PNPM_VERSION="$(jq -r '.packageManager | split("@")[1] | split("+")[0]' ${SRC_DIR}/package.json)"
 export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
@@ -415,7 +396,7 @@ cp -a web/build "$APP_DIR"/www
 cp LICENSE "$APP_DIR"
 cd "$SRC_DIR"
 export MISE_TRUSTED_CONFIG_PATHS="$SRC_DIR"/mise.toml
-export MISE_DISABLE_TOOLS=github:jellyfin/jellyfin-ffmpeg,java,terragrunt,opentofu,npm:@openapitools/openapi-generator-cli
+export MISE_DISABLE_TOOLS=github:jellyfin/jellyfin-ffmpeg
 export MISE_LOCKFILE_MODE=merge MISE_LOCKFILE_PLATFORMS="linux-$(arch_resolve x64 arm64)"
 mise_ok=0
 for i in 1 2 3; do
@@ -463,7 +444,7 @@ if [[ -f ~/.openvino ]]; then
  msg_ok "Pre-installed Python ${ML_PYTHON}"
  msg_info "Installing Intel OpenVINO machine-learning"
  for attempt in $(seq 1 3); do
-    $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT,UV_CONCURRENT_DOWNLOADS,UV_CONCURRENT_BUILDS,UV_CONCURRENT_INSTALLS -Pnu immich uv sync --extra openvino --no-dev --upgrade-package watchfiles --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
+    $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT,UV_CONCURRENT_DOWNLOADS,UV_CONCURRENT_BUILDS,UV_CONCURRENT_INSTALLS -Pnu immich uv sync --extra openvino --no-dev --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
    [[ $attempt -eq 3 ]] && { msg_error "uv sync failed three times, the machine-learning environment was not built"; exit 1; }
    # Parallel fetches can trip DNS rate limits (AdGuard, Pi-hole); retry one at a time.
    export UV_CONCURRENT_DOWNLOADS=1 UV_CONCURRENT_BUILDS=1 UV_CONCURRENT_INSTALLS=1
@@ -481,7 +462,7 @@ else
  msg_ok "Pre-installed Python ${ML_PYTHON}"
  msg_info "Installing machine-learning"
  for attempt in $(seq 1 3); do
-    $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT,UV_CONCURRENT_DOWNLOADS,UV_CONCURRENT_BUILDS,UV_CONCURRENT_INSTALLS -Pnu immich uv sync --extra cpu --no-dev --upgrade-package watchfiles --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
+    $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT,UV_CONCURRENT_DOWNLOADS,UV_CONCURRENT_BUILDS,UV_CONCURRENT_INSTALLS -Pnu immich uv sync --extra cpu --no-dev --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
    [[ $attempt -eq 3 ]] && { msg_error "uv sync failed three times, the machine-learning environment was not built"; exit 1; }
    # Parallel fetches can trip DNS rate limits (AdGuard, Pi-hole); retry one at a time.
    export UV_CONCURRENT_DOWNLOADS=1 UV_CONCURRENT_BUILDS=1 UV_CONCURRENT_INSTALLS=1
@@ -500,8 +481,20 @@ grep -rlE "'/build'" | xargs -n1 sed -i "s|'/build'|'$APP_DIR'|g"
 sed -i "s@\"/cache\"@\"$INSTALL_DIR/cache\"@g" "$ML_DIR"/immich_ml/config.py
 ln -s "$UPLOAD_DIR" "$APP_DIR"/upload
 ln -s "$UPLOAD_DIR" "$ML_DIR"/upload
+
+msg_info "Installing GeoNames data"
+cd "$GEO_DIR"
+curl_with_retry "https://download.geonames.org/export/dump/admin1CodesASCII.txt" "admin1CodesASCII.txt"
+curl_with_retry "https://download.geonames.org/export/dump/admin2Codes.txt" "admin2Codes.txt"
+curl_with_retry "https://download.geonames.org/export/dump/countryInfo.txt" "countryInfo.txt"
+curl_with_retry "https://download.geonames.org/export/dump/cities500.zip" "cities500.zip"
+curl_with_retry "https://raw.githubusercontent.com/nvkelso/natural-earth-vector/v5.1.2/geojson/ne_10m_admin_0_countries.geojson" "ne_10m_admin_0_countries.geojson"
+unzip -q cities500.zip
+date --iso-8601=seconds | tr -d "\n" >geodata-date.txt
+rm cities500.zip
 cd "$INSTALL_DIR"
 ln -s "$GEO_DIR" "$APP_DIR"
+msg_ok "Installed GeoNames data"

 # MickLesk temporary patch for HEIC thumbnail gen
 MEDIA_REPO_JS="/opt/immich/app/dist/repositories/media.repository.js"
@@ -21,7 +21,7 @@ msg_ok "Installed Dependencies"

 PG_VERSION="16" setup_postgresql
 PG_DB_NAME="kan" PG_DB_USER="kan" setup_postgresql_db
-NODE_VERSION="24" NODE_MODULE="pnpm" setup_nodejs
+NODE_VERSION="20" NODE_MODULE="pnpm" setup_nodejs

 fetch_and_deploy_gh_tag "kan" "kanbn/kan" "latest"

@@ -21,7 +21,6 @@ PG_DB_NAME="keycloak" PG_DB_USER="keycloak" setup_postgresql_db
 fetch_and_deploy_gh_release "keycloak_app" "keycloak/keycloak" "prebuild" "latest" "/opt/keycloak" "keycloak-*.tar.gz"

 msg_info "Creating Service"
-ADMIN_PASS=$(random_password 20)
 cat <<EOF >/etc/systemd/system/keycloak.service
 [Unit]
 Description=Keycloak Service
@@ -41,7 +40,7 @@ Environment="KC_DB_USERNAME=keycloak"
 Environment="KC_DB_PASSWORD=$PG_DB_PASS"
 Environment="KC_HTTP_ENABLED=true"
 Environment="KC_BOOTSTRAP_ADMIN_USERNAME=tmpadm"
-Environment="KC_BOOTSTRAP_ADMIN_PASSWORD=${ADMIN_PASS}"
+Environment="KC_BOOTSTRAP_ADMIN_PASSWORD=admin123"
 # Comment following line and uncomment the next 2 if working behind a reverse proxy
 Environment="KC_HOSTNAME_STRICT=false"
 #Environment="KC_HOSTNAME=keycloak.example.com"
@@ -49,13 +48,6 @@ Environment="KC_HOSTNAME_STRICT=false"
 [Install]
 WantedBy=multi-user.target
 EOF
-chmod 600 /etc/systemd/system/keycloak.service
-{
-  echo "Keycloak Credentials"
-  echo "Temporary admin, replace it with a permanent one"
-  echo "Username: tmpadm"
-  echo "Password: ${ADMIN_PASS}"
-} >~/keycloak.creds
 systemctl enable -q --now keycloak
 msg_ok "Created Service"

@@ -40,7 +40,6 @@ cp .env.dist .env
 sed -i "/^DATABASE_URL=.*/c\DATABASE_URL=mysql://kimai:$MARIADB_DB_PASS@127.0.0.1:3306/kimai_db?charset=utf8mb4&serverVersion=mariadb-$MYSQL_VERSION" /opt/kimai/.env
 sed -i "s|^APP_SECRET=.*|APP_SECRET=$APP_SECRET|" /opt/kimai/.env
 $STD bin/console kimai:install -n
-ADMIN_PASS=$(random_password 20)
 $STD expect <<EOF
 set timeout -1
 log_user 0
@@ -48,16 +47,10 @@ log_user 0
 spawn bin/console kimai:user:create admin admin@community-scripts.org ROLE_SUPER_ADMIN

 expect "Please enter the password:"
-send "${ADMIN_PASS}\r"
+send "community-scripts.org\r"

 expect eof
 EOF
-{
-  echo "Kimai Credentials"
-  echo "Username: admin"
-  echo "Email: admin@community-scripts.org"
-  echo "Password: ${ADMIN_PASS}"
-} >~/kimai.creds
 $STD composer update --no-interaction
 cat <<EOF >/opt/kimai/config/packages/local.yaml
 kimai:
@@ -26,7 +26,7 @@ NODE_VERSION="24" NODE_MODULE="corepack,pnpm" setup_nodejs

 msg_info "Installing Deno"
 export DENO_INSTALL="/usr/local"
-curl -fsSL https://deno.land/install.sh | CI=1 $STD sh -s
+curl -fsSL https://deno.land/install.sh | $STD sh -s -- -y
 [[ ":$PATH:" != *":/usr/local/bin:"* ]] &&
  echo -e "\nexport PATH=\"/usr/local/bin:\$PATH\"" >>~/.bashrc &&
  source ~/.bashrc
@@ -33,13 +33,7 @@ $STD yarn config set ignore-engines true
 $STD yarn install
 $STD yarn run production
 $STD php artisan key:generate
-ADMIN_PASS=$(random_password 20)
-$STD php artisan setup:production --email=admin@community-scripts.org --password="${ADMIN_PASS}" --force
-{
-  echo "Monica Credentials"
-  echo "Email: admin@community-scripts.org"
-  echo "Password: ${ADMIN_PASS}"
-} >~/monica.creds
+$STD php artisan setup:production --email=admin@community-scripts.org --password=community-scripts.org --force
 chown -R www-data:www-data /opt/monica
 chmod -R 775 /opt/monica/storage
 echo "* * * * * root php /opt/monica/artisan schedule:run >> /dev/null 2>&1" >>/etc/crontab
@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os

-NODE_VERSION="26" setup_nodejs
+NODE_VERSION="24" setup_nodejs
 fetch_and_deploy_gh_release "myip" "jason5ng32/MyIP" "tarball"

 msg_info "Configuring MyIP"
@@ -23,10 +23,7 @@ msg_ok "Installed Dependencies"
 NODE_VERSION="24" setup_nodejs

 msg_info "Installing n8n (Patience)"
-# n8n-nodes-base 2.46.0 pins both @napi-rs/canvas musl binaries as hard
-# dependencies, which no os/cpu/libc combination can satisfy. Drop --force
-# once upstream makes them optional again.
-$STD npm install -g n8n@latest --force
+$STD npm install -g n8n@latest
 msg_ok "Installed n8n"

 msg_info "Creating Service"
@@ -63,13 +63,7 @@ setcap cap_net_raw+p /bin/ping
 msg_ok "Built Nagios Plugins"

 msg_info "Configuring Web Authentication"
-NAGIOS_PASS=$(random_password 20)
-$STD htpasswd -bc /usr/local/nagios/etc/htpasswd.users nagiosadmin "$NAGIOS_PASS"
-{
-  echo "Nagios Credentials"
-  echo "Username: nagiosadmin"
-  echo "Password: ${NAGIOS_PASS}"
-} >~/nagios.creds
+$STD htpasswd -bc /usr/local/nagios/etc/htpasswd.users nagiosadmin nagiosadmin
 chown root:www-data /usr/local/nagios/etc/htpasswd.users
 chmod 640 /usr/local/nagios/etc/htpasswd.users
 msg_ok "Configured Web Authentication"
@@ -15,7 +15,7 @@ update_os

 PG_VERSION="16" setup_postgresql
 PG_DB_NAME="nametag_db" PG_DB_USER="nametag" setup_postgresql_db
-NODE_VERSION="24" setup_nodejs
+NODE_VERSION="20" setup_nodejs
 fetch_and_deploy_gh_release "nametag" "mattogodoy/nametag" "tarball" "latest" "/opt/nametag"

 msg_info "Setting up Application"
@@ -201,13 +201,6 @@ cat <<'EOF' >/etc/neko/openbox.xml
 </openbox_config>
 EOF

-NEKO_ADMIN_PASS=$(random_password 20)
-NEKO_USER_PASS=$(random_password 20)
-{
-  echo "Neko Credentials"
-  echo "Admin password: ${NEKO_ADMIN_PASS}"
-  echo "User password: ${NEKO_USER_PASS}"
-} >~/neko.creds
 cat <<EOF >/etc/neko/neko.yaml
 server:
  bind: "0.0.0.0:8080"
@@ -226,8 +219,8 @@ desktop:
 member:
  provider: "multiuser"
  multiuser:
-    admin_password: "${NEKO_ADMIN_PASS}"
-    user_password: "${NEKO_USER_PASS}"
+    admin_password: "admin"
+    user_password: "neko"
 EOF
 msg_ok "Set up Runtime"

@@ -33,7 +33,6 @@ LOCAL_ENGINE_TOKEN=${LOCAL_ENGINE_TOKEN}
 ENCRYPTION_KEY=${ENCRYPTION_KEY}
 EOF
 chmod 0640 /etc/nexterm-engine/config.yaml /etc/nexterm-server/server.env
-echo "x /tmp/nexterm-sea-*" >/etc/tmpfiles.d/nexterm.conf
 msg_ok "Configured Nexterm"

 msg_info "Creating Services"
@@ -31,7 +31,6 @@ NODEBB_USER="nodebb"
 NODEBB_PWD="$(random_password 13)"
 MONGO_CONNECTION_STRING="mongodb://${NODEBB_USER}:${NODEBB_PWD}@localhost:27017/nodebb"
 NODEBB_SECRET=$(uuidgen)
-NODEBB_ADMIN_PASS="$(random_password 20)"
 cat <<EOF >~/nodebb.creds
 NodeBB-Credentials
 Mongo Database User: $MONGO_ADMIN_USER
@@ -39,8 +38,6 @@ Mongo Database Password: $MONGO_ADMIN_PWD
 NodeBB User: $NODEBB_USER
 NodeBB Password: $NODEBB_PWD
 NodeBB Secret: $NODEBB_SECRET
-NodeBB Admin User: community-scripts
-NodeBB Admin Password: $NODEBB_ADMIN_PASS
 EOF

 $STD mongosh <<EOF
@@ -100,10 +97,10 @@ expect "Administrator email address" {
    send "admin@community-scripts.org\r"
 }
 expect "Password" {
-    send "$NODEBB_ADMIN_PASS\r"
+    send "community-scripts\r"
 }
 expect "Confirm Password" {
-    send "$NODEBB_ADMIN_PASS\r"
+    send "community-scripts\r"
 }
 expect eof
 EOF
@@ -57,17 +57,11 @@ done
 ACME_EMAIL_INPUT="${var_npmplus_acme_email:-}"
 [[ -n "$ACME_EMAIL_INPUT" ]] || read -r -p "${TAB3}Enter your ACME Email (optional, press ENTER to skip): " ACME_EMAIL_INPUT || true

-ADMIN_PASS=$(random_password 20)
 yq -i "
  .services.npmplus.environment |=
    (map(select(. != \"TZ=*\" and . != \"ACME_EMAIL=*\" and . != \"INITIAL_ADMIN_EMAIL=*\" and . != \"INITIAL_ADMIN_PASSWORD=*\")) +
-    [\"TZ=$TZ_INPUT\", \"ACME_EMAIL=$ACME_EMAIL_INPUT\", \"INITIAL_ADMIN_EMAIL=admin@local.com\", \"INITIAL_ADMIN_PASSWORD=${ADMIN_PASS}\"])
+    [\"TZ=$TZ_INPUT\", \"ACME_EMAIL=$ACME_EMAIL_INPUT\", \"INITIAL_ADMIN_EMAIL=admin@local.com\", \"INITIAL_ADMIN_PASSWORD=community-scripts.org\"])
 " /opt/compose.yaml
-{
-  echo "NPMplus Credentials"
-  echo "Email: admin@local.com"
-  echo "Password: ${ADMIN_PASS}"
-} >~/npmplus.creds

 msg_info "Building and Starting NPMplus (Patience)"
 $STD docker compose up -d
@@ -30,13 +30,7 @@ rm -rf /usr/lib/python3.*/EXTERNALLY-MANAGED
 msg_ok "Setup Python3"

 msg_info "Creating user octoprint"
-OCTOPRINT_PASS=$(random_password 20)
-useradd -m -s /bin/bash -p "$(openssl passwd -6 "$OCTOPRINT_PASS")" octoprint
-{
-  echo "OctoPrint Linux user Credentials"
-  echo "Username: octoprint"
-  echo "Password: ${OCTOPRINT_PASS}"
-} >~/octoprint.creds
+useradd -m -s /bin/bash -p $(openssl passwd -1 octoprint) octoprint
 usermod -aG sudo,tty,dialout octoprint
 chown -R octoprint:octoprint /opt
 echo "octoprint ALL=NOPASSWD: $(command -v systemctl) restart octoprint, $(command -v reboot), $(command -v poweroff)" >/etc/sudoers.d/octoprint
@@ -16,7 +16,7 @@ update_os
 msg_info "Installing OpenObserve"
 mkdir -p /opt/openobserve/data
 RELEASE=$(get_latest_github_release "openobserve/openobserve")
-tar zxf <(curl -fsSL https://downloads.openobserve.ai/releases/openobserve/v$RELEASE/openobserve-v$RELEASE-linux-$(arch_resolve).tar.gz) -C /opt/openobserve --no-same-owner
+tar zxf <(curl -fsSL https://downloads.openobserve.ai/releases/openobserve/v$RELEASE/openobserve-v$RELEASE-linux-$(arch_resolve).tar.gz) -C /opt/openobserve
 ROOT_PASS="$(random_password 9)Aa1!"

 cat <<EOF >/opt/openobserve/data/.env
@@ -25,7 +25,7 @@ ZO_ROOT_USER_PASSWORD = "${ROOT_PASS}"
 ZO_DATA_DIR = "/opt/openobserve/data"
 ZO_HTTP_PORT = "5080"
 EOF
-echo "${RELEASE}" >~/.openobserve
+echo "${RELEASE}" >>~/.openobserve
 msg_ok "Installed OpenObserve"

 msg_info "Creating Service"
@@ -38,6 +38,7 @@ After=network.target
 Type=simple
 EnvironmentFile=/opt/openobserve/data/.env
 ExecStart=/opt/openobserve/openobserve
+ExecStop=killall -QUIT openobserve
 Restart=on-failure

 [Install]
@@ -43,13 +43,7 @@ $STD php artisan migrate --force --seed
 msg_ok "Set up database"

 msg_info "Creating Admin User"
-PAYMENTER_PASS=$(random_password 20)
-$STD php artisan app:user:create paymenter admin admin@paymenter.org "$PAYMENTER_PASS" 1 -q
-{
-  echo "Paymenter Credentials"
-  echo "Email: admin@paymenter.org"
-  echo "Password: ${PAYMENTER_PASS}"
-} >~/paymenter.creds
+$STD php artisan app:user:create paymenter admin admin@paymenter.org paymenter 1 -q
 msg_ok "Created Admin User"

 msg_info "Configuring Nginx"
@@ -46,16 +46,10 @@ tar -xzf /tmp/libheif.tar.gz -C /usr/local
 ldconfig
 echo "${LIBHEIF_URL}" >~/.photoprism_libheif
 chmod -R 755 /opt/photoprism/photos/originals
-ADMIN_PASS=$(random_password 20)
-{
-  echo "PhotoPrism Credentials"
-  echo "Username: admin"
-  echo "Password: ${ADMIN_PASS}"
-} >~/photoprism.creds
 cat <<EOF >/opt/photoprism/config/.env
 # Authentication
 PHOTOPRISM_ADMIN_USER='admin'
-PHOTOPRISM_ADMIN_PASSWORD='${ADMIN_PASS}'
+PHOTOPRISM_ADMIN_PASSWORD='changeme'
 PHOTOPRISM_AUTH_MODE='password'
 PHOTOPRISM_PUBLIC='false'

@@ -118,7 +112,7 @@ StoragePath: "/opt/photoprism/storage"
 OriginalsPath: "/opt/photoprism/photos/originals"
 ImportPath: "/media"
 AdminUser: "admin"
-AdminPassword: "${ADMIN_PASS}"
+AdminPassword: "changeme"
 AuthMode: "password"
 DatabaseDriver: "sqlite"
 HttpHost: "0.0.0.0"
@@ -70,9 +70,7 @@ After=network.target

 [Service]
 WorkingDirectory=/opt/planka
-Environment=NODE_ENV=production
-Environment=HOME=/root
-ExecStart=/usr/bin/node app.js --prod
+ExecStart=/usr/bin/npm start --prod
 Restart=always

 [Install]
@@ -48,10 +48,6 @@ msg_ok "Installed Podman"

 mkdir -p /etc/containers/systemd

-if [[ ! -x /usr/libexec/podman/quadlet ]]; then
-  msg_warn "Portainer runs as a Quadlet unit, which needs Podman 4.4 or newer (Debian 13); skipping it"
-  var_podman_portainer="n" var_podman_portainer_agent="n"
-fi
 prompt="${var_podman_portainer:-}"
 [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Portainer? <y/N> " prompt || true
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
@@ -16,9 +16,9 @@ update_os
 msg_info "Installing Proxmox Mail Gateway"
 setup_deb822_repo \
  "pmg" \
-  "https://enterprise.proxmox.com/debian/proxmox-release-$(get_os_info codename).gpg" \
+  "https://enterprise.proxmox.com/debian/proxmox-release-trixie.gpg" \
  "http://download.proxmox.com/debian/pmg" \
-  "$(get_os_info codename)" \
+  "trixie" \
  "pmg-no-subscription"
 $STD apt install -y proxmox-mailgateway-container
 msg_ok "Installed Proxmox Mail Gateway"
@@ -18,20 +18,12 @@ fetch_and_deploy_gh_release "qbittorrent" "userdocs/qbittorrent-nox-static" "sin
 msg_info "Setup qBittorrent-nox"
 mv /opt/qbittorrent/qbittorrent /opt/qbittorrent/qbittorrent-nox
 mkdir -p ~/.config/qBittorrent/
-QB_PASS=$(random_password 20)
-QB_SALT=$(random_password 16)
-QB_HASH="$(printf '%s' "$QB_SALT" | base64 -w0):$(openssl kdf -keylen 64 -kdfopt digest:SHA512 -kdfopt pass:"$QB_PASS" -kdfopt salt:"$QB_SALT" -kdfopt iter:100000 -binary PBKDF2 | base64 -w0)"
-{
-  echo "qBittorrent Credentials"
-  echo "Username: admin"
-  echo "Password: ${QB_PASS}"
-} >~/qbittorrent.creds
 cat <<EOF >~/.config/qBittorrent/qBittorrent.conf
 [LegalNotice]
 Accepted=true

 [Preferences]
-WebUI\Password_PBKDF2="@ByteArray(${QB_HASH})"
+WebUI\Password_PBKDF2="@ByteArray(amjeuVrF3xRbgzqWQmes5A==:XK3/Ra9jUmqUc4RwzCtrhrkQIcYczBl90DJw2rT8DFVTss4nxpoRhvyxhCf87ahVE3SzD8K9lyPdpyUCfmVsUg==)"
 WebUI\Port=8090
 WebUI\UseUPnP=false
 WebUI\Username=admin
@@ -43,15 +43,9 @@ $STD rabbitmqctl enable_feature_flag all
 msg_ok "Enabled RabbitMQ Management Plugin"

 msg_info "Creating User"
-RABBITMQ_PASS=$(random_password 20)
-$STD rabbitmqctl add_user proxmox "$RABBITMQ_PASS"
+$STD rabbitmqctl add_user proxmox proxmox
 $STD rabbitmqctl set_user_tags proxmox administrator
 $STD rabbitmqctl set_permissions -p / proxmox ".*" ".*" ".*"
-{
-  echo "RabbitMQ Credentials"
-  echo "Username: proxmox"
-  echo "Password: ${RABBITMQ_PASS}"
-} >~/rabbitmq.creds
 msg_ok "Created User"

 motd_ssh
@@ -257,33 +257,15 @@ map $http_upgrade $connection_upgrade {
    '' close;
 }

-# COEP/COOP for the EmulatorJS and js-dos players (SharedArrayBuffer needs a
-# crossOriginIsolated document). Matched on $request_uri because try_files
-# rewrites $uri to /index.html before add_header runs, so a per-location
-# add_header on the player route never fires. Mirrors upstream RomM's
-# docker/nginx/templates/default.conf.template.
-map $request_uri $coep_header {
-    default        "";
-    ~^/rom/.*/(ejs|jsdos)(\?|$) "require-corp";
-}
-map $request_uri $coop_header {
-    default        "";
-    ~^/rom/.*/(ejs|jsdos)(\?|$) "same-origin";
-}
-
 server {
    listen 80;
    server_name _;
    root /opt/romm/frontend/dist;
    client_max_body_size 0;

-    # Frontend SPA - also emits the player isolation headers: the player URLs
-    # fall through try_files to /index.html, which this location serves
+    # Frontend SPA
    location / {
        try_files $uri $uri/ /index.html;
-        add_header Cache-Control "no-cache";
-        add_header Cross-Origin-Embedder-Policy $coep_header;
-        add_header Cross-Origin-Opener-Policy $coop_header;
    }

    # Static assets
@@ -294,6 +276,13 @@ server {
        add_header Cache-Control "public, immutable";
    }

+    # EmulatorJS player - requires COOP/COEP headers for SharedArrayBuffer
+    location ~ ^/rom/.*/ejs$ {
+        add_header Cross-Origin-Embedder-Policy "require-corp";
+        add_header Cross-Origin-Opener-Policy "same-origin";
+        try_files $uri /index.html;
+    }
+
    # Backend API
    location /api {
        proxy_pass http://romm_backend;
@@ -151,7 +151,7 @@ INVITE_EMAIL_TEMPLATE=/opt/signoz/templates/invitation_email_template.html
 SIGNOZ_SQLSTORE_SQLITE_PATH=/var/lib/signoz/signoz.db
 SIGNOZ_WEB_ENABLED=true
 SIGNOZ_WEB_DIRECTORY=/opt/signoz/web
-SIGNOZ_JWT_SECRET=$(openssl rand -hex 32)
+SIGNOZ_JWT_SECRET=secret
 SIGNOZ_ALERTMANAGER_PROVIDER=signoz
 SIGNOZ_TELEMETRYSTORE_PROVIDER=clickhouse
 SIGNOZ_TELEMETRYSTORE_CLICKHOUSE_DSN=tcp://localhost:9000?password=
@@ -78,12 +78,6 @@ msg_info "Configuring SnapOtter"
 mkdir -p /opt/snapotter_data/files
 mkdir -p /tmp/snapotter-workspace

-SNAPOTTER_PASS=$(random_password 20)
-{
-  echo "SnapOtter Credentials"
-  echo "Username: admin"
-  echo "Password: ${SNAPOTTER_PASS}"
-} >~/snapotter.creds
 cat <<EOF >/opt/snapotter_data/.env
 PORT=1349
 NODE_ENV=production
@@ -98,7 +92,7 @@ FEATURE_MANIFEST_PATH=/opt/snapotter/docker/feature-manifest.json
 U2NET_HOME=/opt/snapotter_data/ai/models/rembg
 AUTH_ENABLED=true
 DEFAULT_USERNAME=admin
-DEFAULT_PASSWORD=${SNAPOTTER_PASS}
+DEFAULT_PASSWORD=admin
 LOG_LEVEL=info
 TRUST_PROXY=true
 FILE_MAX_AGE_HOURS=72
@@ -116,6 +116,10 @@ if [[ "$login_mode" == "true" ]]; then
 # activate Login
 DISABLE_ADDITIONAL_FEATURES=false
 SECURITY_ENABLELOGIN=true
+
+# login credentials
+SECURITY_INITIALLOGIN_USERNAME=admin
+SECURITY_INITIALLOGIN_PASSWORD=stirling
 EOF
 fi
 msg_ok "Created Environment Variables"
@@ -17,8 +17,7 @@ msg_info "Installing Dependencies"
 $STD apt install -y \
  build-essential \
  python3 \
-  git \
-  redis-server
+  git
 msg_ok "Installed Dependencies"

 NODE_VERSION="24" NODE_MODULE="pnpm" setup_nodejs
@@ -57,8 +56,8 @@ SECRET_KEY=${SECRET_KEY}
 PORT=3000
 NODE_ENV=production
 NEXT_TELEMETRY_DISABLED=1
-BACKEND_CACHE_PROVIDER=redis
-BACKEND_CACHE_REDIS_URI=redis://127.0.0.1:6379/0
+BACKEND_CACHE_PROVIDER=sqlite
+BACKEND_CACHE_SQLITE_URI=sqlite:///opt/teable/.assets/.cache.db
 NEXTJS_DIR=apps/nextjs-app
 EOF
 ln -sf /opt/teable /app
@@ -71,11 +70,10 @@ fi
 msg_ok "Configured Teable"

 msg_info "Creating Service"
-systemctl enable -q --now redis-server
 cat <<EOF >/etc/systemd/system/teable.service
 [Unit]
 Description=Teable
-After=network.target postgresql.service redis-server.service
+After=network.target postgresql.service

 [Service]
 Type=simple
@@ -23,7 +23,7 @@ setup_deb822_repo \
 $STD apt install -y aspnetcore-runtime-10.0
 msg_ok "Installed Dependencies"

-RELEASE=$(get_latest_github_release "TechnitiumSoftware/DnsServer")
+RELEASE=$(curl -fsSL https://technitium.com/dns/ | grep -oP 'Version \K[\d.]+')
 fetch_and_deploy_from_url "https://download.technitium.com/dns/DnsServerPortable.tar.gz" /opt/technitium/dns
 echo "${RELEASE}" >~/.technitium

@@ -24,11 +24,7 @@ msg_info "Configuring Teleport"
 $STD apt install -y teleport
 $STD teleport configure -o /etc/teleport.yaml
 systemctl enable -q --now teleport
-SECONDS=0
-until teleport debug readyz &>/dev/null; do
-  sleep 2
-  ((SECONDS >= 120)) && { msg_error "Teleport did not become ready in time"; exit 1; }
-done
+sleep 10
 tctl users add teleport-admin --roles=editor,access --logins=root >~/teleportadmin.txt
 sed -i "s|https://[^:]*:3080|https://${LOCAL_IP}:3080|g" ~/teleportadmin.txt
 msg_ok "Configured Teleport"
@@ -26,8 +26,7 @@ PG_DB_NAME="thingsboard_db" PG_DB_USER="thingsboard" setup_postgresql_db
 fetch_and_deploy_gh_release "thingsboard" "thingsboard/thingsboard" "binary" "latest" "/tmp" "thingsboard-*.deb"

 msg_info "Configuring ThingsBoard"
-cat <<EOF >>/etc/thingsboard/conf/thingsboard.conf
-
+cat <<EOF >/etc/thingsboard/conf/thingsboard.conf
 # DB Configuration
 export DATABASE_TS_TYPE=sql
 export SPRING_DATASOURCE_URL=jdbc:postgresql://localhost:5432/${PG_DB_NAME}
@@ -17,7 +17,7 @@ msg_info "Installing Dependencies"
 $STD apt install -y redis-server
 msg_ok "Installed Dependencies"

-NODE_VERSION="26" NODE_MODULE="corepack" setup_nodejs
+NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs
 PG_VERSION="18" setup_postgresql

 msg_info "Installing pnpm"
@@ -13,9 +13,13 @@ setting_up_container
 network_check
 update_os

+msg_info "Installing Dependencies"
+$STD apt install -y \
+  sqlite3 \
+  yq
+msg_ok "Installed Dependencies"
+
 NODE_VERSION="22" setup_nodejs
-PG_VERSION="17" setup_postgresql
-PG_DB_NAME="tududi" PG_DB_USER="tududi" setup_postgresql_db
 fetch_and_deploy_gh_release "tududi" "chrisvel/tududi" "tarball" "latest" "/opt/tududi"

 msg_info "Configuring Tududi"
@@ -26,22 +30,30 @@ $STD npm run frontend:build
 mv ./dist ./backend
 msg_ok "Configured Tududi"

-msg_info "Creating env"
-mkdir -p /opt/tududi-uploads
+msg_info "Creating env and database"
+DB_LOCATION="/opt/tududi-db"
+UPLOAD_DIR="/opt/tududi-uploads"
+mkdir -p {"$DB_LOCATION","$UPLOAD_DIR"}
 SECRET="$(openssl rand -hex 64)"
 sed -e '/^NODE_ENV=/s/=.*$/=production/' \
  -e 's/^TUDUDI_USER/# TUDUDI_USER/g' \
-  -e "s/^TUDUDI_SESSION_SECRET=.*/TUDUDI_SESSION_SECRET=${SECRET}/" \
-  -e "s|^DATABASE_URL=.*|DATABASE_URL=postgres://tududi:${PG_DB_PASS}@localhost:5432/tududi|" \
+  -e "/_SECRET=/s/=.*$/=${SECRET}/" \
+  -e '/^# DB_FILE=/s/^# //' \
+  -e "s|^DB_FILE=.*|DB_FILE=${DB_LOCATION}/production.sqlite3|" \
+  -e "/^# TUDUDI_ALLOWED/s/^# //; \
+    \|_ORIGINS=|s|=.*$|=<your tududi IP or FDQN>|" \
+  -e "/^# TUDUDI_UPLOAD/s/^# //; \
+    \|UPLOAD_PATH=|s|=.*$|=${UPLOAD_DIR}|" \
  /opt/tududi/backend/.env.example >/opt/tududi/backend/.env
-echo "TUDUDI_UPLOAD_PATH=/opt/tududi-uploads" >>/opt/tududi/backend/.env
-msg_ok "Created env"
+export DB_FILE="${DB_LOCATION}/production.sqlite3"
+$STD npm run db:init
+msg_ok "Created env and database"

 msg_info "Creating service"
 cat <<EOF >/etc/systemd/system/tududi.service
 [Unit]
 Description=Tududi Service
-After=network.target postgresql.service
+After=network.target

 [Service]
 Type=simple
@@ -21,11 +21,7 @@ msg_info "Setup Wazuh"
 curl -fsSL https://packages.wazuh.com/$RELEASE/wazuh-install.sh -o wazuh-install.sh
 chmod +x wazuh-install.sh
 if [ "$STD" = "silent" ]; then
-  bash wazuh-install.sh -a >>~/wazuh-install.output || {
-    $STD tail -n 25 ~/wazuh-install.output
-    msg_error "The Wazuh installer failed, see its output above or in ~/wazuh-install.output"
-    exit 1
-  }
+  bash wazuh-install.sh -a >>~/wazuh-install.output
 else
  bash wazuh-install.sh -a | tee -a ~/wazuh-install.output
 fi
@@ -17,44 +17,26 @@ msg_info "Installing Dependencies"
 $STD apt install -y git
 msg_ok "Installed Dependencies"

-NODE_VERSION="26" setup_nodejs
+NODE_VERSION="26" NODE_MODULE="yarn,node-gyp" setup_nodejs
 PG_VERSION="17" setup_postgresql
-PG_DB_NAME="wiki" PG_DB_USER="wikijs_user" setup_postgresql_db
-fetch_and_deploy_gh_release "wikijs" "requarks/wiki" "prebuild" "latest" "/opt/wikijs" "wiki-js.tar.gz"
-
-if [[ "$(arch_resolve)" == "arm64" ]]; then
-  msg_info "Building Wiki.js Dependencies"
-  cd /opt/wikijs/backend
-  $STD npm ci --omit=dev
-  msg_ok "Built Wiki.js Dependencies"
-fi
+PG_DB_NAME="wiki" PG_DB_USER="wikijs_user" PG_DB_EXTENSIONS="pg_trgm" setup_postgresql_db
+fetch_and_deploy_gh_release "wikijs" "requarks/wiki-v2" "prebuild" "latest" "/opt/wikijs" "wiki-js.tar.gz"

 msg_info "Configuring Wiki.js"
-mkdir -p /opt/wikijs_data
-cp /opt/wikijs/config.sample.yml /opt/wikijs/config.yml
-sed -i \
-  -e "s|^  user: .*|  user: wikijs_user|" \
-  -e "s|^  pass: .*|  pass: ${PG_DB_PASS}|" \
-  -e "s|^  db: .*|  db: wiki|" \
-  -e "s|^dataPath: .*|dataPath: /opt/wikijs_data|" \
-  /opt/wikijs/config.yml
-ADMIN_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-16)
-cat <<EOF >~/wikijs.creds
-Wiki.js Admin
-Email: admin@example.com
-Password: ${ADMIN_PASS}
-EOF
+mv /opt/wikijs/config.sample.yml /opt/wikijs/config.yml
+sed -i -E 's|^( *user: ).*|\1'"$PG_DB_USER"'|' /opt/wikijs/config.yml
+sed -i -E 's|^( *pass: ).*|\1'"$PG_DB_PASS"'|' /opt/wikijs/config.yml
 msg_ok "Configured Wiki.js"

 msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/wikijs.service
 [Unit]
 Description=Wiki.js
-After=network.target postgresql.service
+After=network.target

 [Service]
 Type=simple
-ExecStart=/usr/bin/node --no-experimental-webstorage backend
+ExecStart=/usr/bin/node server
 Restart=always
 User=root
 Environment=NODE_ENV=production
@@ -63,13 +45,7 @@ WorkingDirectory=/opt/wikijs
 [Install]
 WantedBy=multi-user.target
 EOF
-systemctl set-environment ADMIN_PASS="${ADMIN_PASS}"
 systemctl enable -q --now wikijs
-for _ in $(seq 60); do
-  curl -fs -o /dev/null http://127.0.0.1:3000 && break
-  sleep 2
-done
-systemctl unset-environment ADMIN_PASS
 msg_ok "Created Service"

 motd_ssh
@@ -31,7 +31,7 @@ ln -sf /opt/bun/bin/bunx /usr/local/bin/bunx
 msg_ok "Installed Bun"

 msg_info "Installing Deno"
-curl -fsSL https://deno.land/install.sh | CI=1 $STD sh -s
+$STD sh -c "curl -fsSL https://deno.land/install.sh | DENO_INSTALL=/usr/local sh -s -- -y"
 msg_ok "Installed Deno"

 msg_info "Creating directories"
@@ -23,7 +23,7 @@ msg_ok "Installed Dependencies"

 NODE_VERSION="24" setup_nodejs

-fetch_and_deploy_gh_release "yuvomi" "ulsklyc/yuvomi" "prebuild" "latest" "/opt/yuvomi" "yuvomi-*-dist.tar.gz"
+fetch_and_deploy_gh_release "yuvomi" "ulsklyc/yuvomi" "tarball"

 msg_info "Installing Node.js Dependencies"
 cd /opt/yuvomi
@@ -36,17 +36,17 @@ cd /tmp
 ZABBIX_REPO_DIR="debian"
 [[ "$ZABBIX_VERSION" == "7.0" && "$(arch_resolve)" == "arm64" ]] && ZABBIX_REPO_DIR="debian-arm64"
 if [[ "$ZABBIX_VERSION" == "7.0" ]]; then
-  ZABBIX_DEB_URL="https://repo.zabbix.com/zabbix/${ZABBIX_VERSION}/${ZABBIX_REPO_DIR}/pool/main/z/zabbix-release/zabbix-release_latest_${ZABBIX_VERSION}+debian$(get_os_version_major)_all.deb"
-  ZABBIX_DEB_FILE="zabbix-release_latest_${ZABBIX_VERSION}+debian$(get_os_version_major)_all.deb"
+  ZABBIX_DEB_URL="https://repo.zabbix.com/zabbix/${ZABBIX_VERSION}/${ZABBIX_REPO_DIR}/pool/main/z/zabbix-release/zabbix-release_latest_${ZABBIX_VERSION}+debian13_all.deb"
+  ZABBIX_DEB_FILE="zabbix-release_latest_${ZABBIX_VERSION}+debian13_all.deb"
 else
-  ZABBIX_DEB_URL="https://repo.zabbix.com/zabbix/${ZABBIX_VERSION}/release/debian/pool/main/z/zabbix-release/zabbix-release_latest+debian$(get_os_version_major)_all.deb"
-  ZABBIX_DEB_FILE="zabbix-release_latest+debian$(get_os_version_major)_all.deb"
+  ZABBIX_DEB_URL="https://repo.zabbix.com/zabbix/${ZABBIX_VERSION}/release/debian/pool/main/z/zabbix-release/zabbix-release_latest+debian13_all.deb"
+  ZABBIX_DEB_FILE="zabbix-release_latest+debian13_all.deb"
 fi

 curl -fsSL "$ZABBIX_DEB_URL" -o /tmp/"$ZABBIX_DEB_FILE"
 $STD dpkg -i /tmp/"$ZABBIX_DEB_FILE"
 apt_update_safe
-$STD apt install -y zabbix-server-pgsql zabbix-frontend-php php-pgsql zabbix-apache-conf zabbix-sql-scripts
+$STD apt install -y zabbix-server-pgsql zabbix-frontend-php php8.4-pgsql zabbix-apache-conf zabbix-sql-scripts

 if [[ "$ZABBIX_VERSION" == "7.0" ]]; then
  ZABBIX_SQL="/usr/share/zabbix-sql-scripts/postgresql/server.sql.gz"
@@ -65,28 +65,6 @@ while [[ -z "${CTID}" ]]; do
    "${CTID_MENU[@]}" 3>&1 1>&2 2>&3) || exit 0
 done

-if [[ "$(pct status "$CTID" | awk '{print $2}')" != "running" ]]; then
-  msg_info "Starting CT $CTID"
-  pct start "$CTID"
-  for _ in {1..30}; do
-    pct exec "$CTID" -- sh -c 'ip route 2>/dev/null | grep -q "^default"' && break
-    sleep 1
-  done
-  msg_ok "Started CT $CTID"
-fi
-
-CT_OS=$(pct exec "$CTID" -- sh -c '. /etc/os-release 2>/dev/null; echo "${ID:-}"')
-case "$CT_OS" in
-debian | ubuntu) ;;
-alpine)
-  pct exec "$CTID" -- sh -c 'command -v bash >/dev/null 2>&1 || apk add --no-cache bash >/dev/null'
-  ;;
-*)
-  msg_error "CT $CTID runs ${CT_OS:-an unknown OS}. This add-on supports Debian, Ubuntu and Alpine containers."
-  exit 238
-  ;;
-esac
-
 CTID_CONFIG_PATH="/etc/pve/lxc/${CTID}.conf"

 # Skip if already configured
@@ -70,10 +70,14 @@ function cleanup_ctid() {
 header_info
 require_pve_host

+# Stop Proxmox VE Monitor-All if running
+if systemctl is-active -q ping-instances.service; then
+  systemctl stop ping-instances.service
+fi
 msg_info "Updating template list"
 pveam update >/dev/null 2>&1
 msg_ok "Updated template list"
-whiptail --backtitle "Proxmox VE Helper Scripts" --title "All Templates" --yesno "This will allow for the creation of one of the many Template LXC Containers. Proceed?" 10 68 || exit 0
+whiptail --backtitle "Proxmox VE Helper Scripts" --title "All Templates" --yesno "This will allow for the creation of one of the many Template LXC Containers. Proceed?" 10 68
 TEMPLATE_MENU=()
 MSG_MAX_LENGTH=0
 HOST_ARCH=$(dpkg --print-architecture)
@@ -83,7 +87,7 @@ while read -r TAG ITEM ARCH; do
  ((${#ITEM} + OFFSET > MSG_MAX_LENGTH)) && MSG_MAX_LENGTH=${#ITEM}+OFFSET
  TEMPLATE_MENU+=("$ITEM" "$TAG " "OFF")
 done < <(pveam available)
-TEMPLATE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "All Template LXCs" --radiolist "\nSelect a Template LXC to create:\n" 16 $((MSG_MAX_LENGTH + 58)) 10 "${TEMPLATE_MENU[@]}" 3>&1 1>&2 2>&3 | tr -d '"') || exit 0
+TEMPLATE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "All Template LXCs" --radiolist "\nSelect a Template LXC to create:\n" 16 $((MSG_MAX_LENGTH + 58)) 10 "${TEMPLATE_MENU[@]}" 3>&1 1>&2 2>&3 | tr -d '"')
 [ -z "$TEMPLATE" ] && {
  whiptail --backtitle "Proxmox VE Helper Scripts" --title "No Template LXC Selected" --msgbox "It appears that no Template LXC container was selected" 10 68
  echo "Done"
@@ -181,11 +185,6 @@ msg_ok "Using '$TEMPLATE_STORAGE' for template storage."
 CONTAINER_STORAGE=$(select_storage container)
 msg_ok "Using '$CONTAINER_STORAGE' for container storage."

-# Stop Proxmox VE Monitor-All if running
-if systemctl is-active -q ping-instances.service; then
-  systemctl stop ping-instances.service
-fi
-
 # Download template
 msg_info "Downloading LXC template (Patience)"
 pveam download "$TEMPLATE_STORAGE" "$TEMPLATE" >/dev/null || {
@@ -58,21 +58,8 @@ function uninstall() {
 # ==============================================================================
 # UPDATE
 # ==============================================================================
-# Arcane 3 needs the ARCANE_* names, the current latest image reads only the old ones.
-function sync_env_names() {
-  local key
-  for key in ENCRYPTION_KEY PROJECTS_DIRECTORY; do
-    grep -q "^[[:space:]]*- ARCANE_${key}=" "$COMPOSE_FILE" || sed -i "/^[[:space:]]*- ${key}=/{p;s/- ${key}=/- ARCANE_${key}=/;}" "$COMPOSE_FILE"
-    grep -q "^[[:space:]]*- ${key}=" "$COMPOSE_FILE" || sed -i "/^[[:space:]]*- ARCANE_${key}=/{p;s/- ARCANE_${key}=/- ${key}=/;}" "$COMPOSE_FILE"
-  done
-  if [[ -f "$ENV_FILE" ]]; then
-    sed -i 's/^ARCANE_#/#ARCANE_/' "$ENV_FILE"
-  fi
-}
-
 function update() {
  chown -R 65532:65532 /etc/arcane/projects /etc/arcane/builds 2>/dev/null || true
-  sync_env_names

  msg_info "Pulling latest ${APP} image"
  cd "$INSTALL_PATH"
@@ -98,8 +85,9 @@ function install() {
  msg_ok "Created ${INSTALL_PATH}"

  # Generate secrets and config values
-  local ENCRYPTION_KEY PROJ_DIR BUILDS_DIR
+  local ENCRYPTION_KEY JWT_SECRET PROJ_DIR BUILDS_DIR
  ENCRYPTION_KEY=$(random_password 32)
+  JWT_SECRET=$(random_password 32)
  PROJ_DIR="/etc/arcane/projects"
  BUILDS_DIR="/etc/arcane/builds"

@@ -120,12 +108,20 @@ function install() {
  curl -fsSL "https://raw.githubusercontent.com/getarcaneapp/arcane/refs/heads/main/docker/examples/compose.basic.yaml" -o "$COMPOSE_FILE"
  msg_ok "Downloaded Docker Compose file"

-  msg_info "Configuring compose file"
+  msg_info "Downloading .env file"
+  curl -fsSL "https://raw.githubusercontent.com/getarcaneapp/arcane/refs/heads/main/.env.example" -o "$ENV_FILE"
+  chmod 600 "$ENV_FILE"
+  msg_ok "Downloaded .env file"
+
+  msg_info "Configuring compose and env files"
  sed -i '/^[[:space:]]*#/!s|/host/path/to/projects|'"$PROJ_DIR"'|g' "$COMPOSE_FILE"
  sed -i '/^[[:space:]]*#/!s|/host/path/to/builds|'"$BUILDS_DIR"'|g' "$COMPOSE_FILE"
  sed -i '/^[[:space:]]*#/!s|ENCRYPTION_KEY=.*|ENCRYPTION_KEY='"$ENCRYPTION_KEY"'|g' "$COMPOSE_FILE"
-  sync_env_names
-  msg_ok "Configured compose file"
+  sed -i '/^[[:space:]]*#/!s|JWT_SECRET=.*|JWT_SECRET='"$JWT_SECRET"'|g' "$COMPOSE_FILE"
+  sed -i '/^[[:space:]]*#/!s|APP_URL=.*|APP_URL=http://localhost:'"$DEFAULT_PORT"'|g' "$ENV_FILE"
+  sed -i '/^[[:space:]]*#/!s|ENCRYPTION_KEY=.*|#&|g' "$ENV_FILE"
+  sed -i '/^[[:space:]]*#/!s|JWT_SECRET=.*|#&|g' "$ENV_FILE"
+  msg_ok "Configured compose and env files"

  msg_info "Starting ${APP}"
  cd "$INSTALL_PATH"
@@ -85,16 +85,12 @@ function install() {
  mkdir -p "${HOME}/.config/code-server/"

  if [ "$preexisting_config" = false ]; then
-    CS_PASS=$(random_password 20)
    cat <<EOF >"$config_path"
 bind-addr: 0.0.0.0:8680
-auth: password
-password: ${CS_PASS}
+auth: none
+password: 
 cert: false
 EOF
-    chmod 600 "$config_path"
-    echo -e "Coder Code Server\nPassword: ${CS_PASS}" >~/coder-code-server.creds
-    chmod 600 ~/coder-code-server.creds
  fi
  systemctl enable -q --now code-server@"$USER"
  systemctl restart code-server@"$USER"
@@ -115,7 +111,7 @@ EOF
  msg_ok "Created update script (/usr/local/bin/update_coder-code-server)"

  echo -e "${APP} should be reachable by going to the following URL.
-         ${BL}http://${IP}:8680${CL} (password in ~/coder-code-server.creds)\n"
+         ${BL}http://${IP}:8680${CL} \n"
 }

 # ==============================================================================
@@ -151,9 +151,9 @@ function install() {
  else
    read -rp "${TAB}Set admin username [admin]: " admin_user
    admin_user=${admin_user:-admin}
-    read -rsp "${TAB}Set admin password [random]: " admin_pass
+    read -rsp "${TAB}Set admin password [community-scripts.org]: " admin_pass
    echo ""
-    admin_pass=${admin_pass:-$(random_password 20)}
+    admin_pass=${admin_pass:-community-scripts.org}
    msg_ok "Configured with admin user: ${admin_user}"
  fi

@@ -291,10 +291,8 @@ UPDATEEOF
  msg_ok "Storage: ${BL}${DATA_PATH}${CL}"
  msg_ok "Config: ${BL}${CONF_PATH}${CL}"
  if [[ -n "$admin_user" ]]; then
-    echo -e "Copyparty\nUsername: ${admin_user}\nPassword: ${admin_pass}" >~/copyparty.creds
-    chmod 600 ~/copyparty.creds
    echo ""
-    msg_ok "Login: ${GN}${admin_user}${CL} (password in ~/copyparty.creds)"
+    msg_ok "Login: ${GN}${admin_user}${CL} / ${GN}${admin_pass}${CL}"
  fi
 }

@@ -189,8 +189,6 @@ chown root:root /usr/local/community-scripts
 chmod 755 /usr/local/community-scripts
 msg_ok "Directory prepared"

-ADMIN_PASS=$(random_password 20)
-msg_warn "FileBrowser runs as root and shows the whole filesystem. Without authentication, anyone who reaches port ${PORT} can read and change every file."
 echo -n "${TAB}Use No Authentication? (y/N): "
 read -r noauth_prompt

@@ -236,12 +234,9 @@ server:
          - neverWatchPath: "/lost+found"
 auth:
  adminUsername: admin
-  adminPassword: ${ADMIN_PASS}
+  adminPassword: community-scripts.org
 EOF
-  chmod 600 "$CONFIG_PATH"
-  echo -e "FileBrowser Quantum\nUsername: admin\nPassword: ${ADMIN_PASS}" >~/filebrowser-quantum.creds
-  chmod 600 ~/filebrowser-quantum.creds
-  msg_ok "Configured admin (credentials saved in ~/filebrowser-quantum.creds)"
+  msg_ok "Configured with default admin (admin / community-scripts.org)"
 fi

 msg_info "Creating service"
@@ -281,13 +276,4 @@ EOF
 fi

 msg_ok "Service created successfully"
-
-# auth.adminPassword resets the password on every start, so it stays only until the admin exists
-if grep -q '^\s*adminPassword:' "$CONFIG_PATH"; then
-  for _ in {1..30}; do
-    [[ "$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${PORT}/health")" == "200" ]] && break
-    sleep 1
-  done
-  sed -i '/^\s*adminPassword:/d' "$CONFIG_PATH"
-fi
 msg_ok "${APP} is reachable at: ${BL}http://${IP}:${PORT}${CL}"
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
CanbiZ (MickLesk)	d711c6c1fa	Fix command to fetch Camoufox in install script	2026-11-09 09:41:10 +01:00
github-actions[bot]	57a10b59fb	cinephage: bump Node.js from 24 to 26	2026-11-02 06:19:47 +00:00