Update CHANGELOG.md

The compose file from main now uses ARCANE_ENCRYPTION_KEY and
ARCANE_PROJECTS_DIRECTORY, which the latest image (2.17.3) does not read,
so it panicked on a missing ENCRYPTION_KEY. Arcane 3 in turn refuses to
start when only the old names are set. Install and update now keep both
names in compose.yaml, which also carries existing installs over to 3.

The .env was never referenced by the compose file, but compose parses it,
and the unanchored ENCRYPTION_KEY sed turned the renamed line into
ARCANE_#ENCRYPTION_KEY and broke every install. New installs no longer
download it; update repairs the broken line.

CHANGELOG.md

@@ -571,6 +571,29 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-11-05
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - OPNsense VM: wait for the FreeBSD login prompt instead of 180 seconds [@MickLesk](https://github.com/MickLesk) ([#18467](https://github.com/community-scripts/ProxmoxVE/pull/18467))
+
+  - #### 🔧 Refactor
+
+    - Tududi: run 2.0 on PostgreSQL, keep SQLite installs on 1.15.0 [@MickLesk](https://github.com/MickLesk) ([#18465](https://github.com/community-scripts/ProxmoxVE/pull/18465))
+
+### 💾 Core
+
+  - fix: keep the existing install until the new archive has extracted [@rcourtman](https://github.com/rcourtman) ([core#201](https://github.com/community-scripts/core/pull/201))
+- fix: keep the install when a clone or an Alpine extract fails [@rcourtman](https://github.com/rcourtman) ([core#210](https://github.com/community-scripts/core/pull/210))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - Arcane: write both env names, stop shipping the unused .env [@MickLesk](https://github.com/MickLesk) ([#18466](https://github.com/community-scripts/ProxmoxVE/pull/18466))
+
 ## 2026-11-04
 
 ### 🚀 Updated Scripts

tools/addon/arcane.sh

@@ -58,8 +58,21 @@ function uninstall() {
 # ==============================================================================
 # UPDATE
 # ==============================================================================
+# Arcane 3 needs the ARCANE_* names, the current latest image reads only the old ones.
+function sync_env_names() {
+  local key
+  for key in ENCRYPTION_KEY PROJECTS_DIRECTORY; do
+    grep -q "^[[:space:]]*- ARCANE_${key}=" "$COMPOSE_FILE" || sed -i "/^[[:space:]]*- ${key}=/{p;s/- ${key}=/- ARCANE_${key}=/;}" "$COMPOSE_FILE"
+    grep -q "^[[:space:]]*- ${key}=" "$COMPOSE_FILE" || sed -i "/^[[:space:]]*- ARCANE_${key}=/{p;s/- ARCANE_${key}=/- ${key}=/;}" "$COMPOSE_FILE"
+  done
+  if [[ -f "$ENV_FILE" ]]; then
+    sed -i 's/^ARCANE_#/#ARCANE_/' "$ENV_FILE"
+  fi
+}
+
 function update() {
   chown -R 65532:65532 /etc/arcane/projects /etc/arcane/builds 2>/dev/null || true
+  sync_env_names
 
   msg_info "Pulling latest ${APP} image"
   cd "$INSTALL_PATH"
@@ -85,9 +98,8 @@ function install() {
   msg_ok "Created ${INSTALL_PATH}"
 
   # Generate secrets and config values
-  local ENCRYPTION_KEY JWT_SECRET PROJ_DIR BUILDS_DIR
+  local ENCRYPTION_KEY PROJ_DIR BUILDS_DIR
   ENCRYPTION_KEY=$(random_password 32)
-  JWT_SECRET=$(random_password 32)
   PROJ_DIR="/etc/arcane/projects"
   BUILDS_DIR="/etc/arcane/builds"
 
@@ -108,20 +120,12 @@ function install() {
   curl -fsSL "https://raw.githubusercontent.com/getarcaneapp/arcane/refs/heads/main/docker/examples/compose.basic.yaml" -o "$COMPOSE_FILE"
   msg_ok "Downloaded Docker Compose file"
 
-  msg_info "Downloading .env file"
-  curl -fsSL "https://raw.githubusercontent.com/getarcaneapp/arcane/refs/heads/main/.env.example" -o "$ENV_FILE"
-  chmod 600 "$ENV_FILE"
-  msg_ok "Downloaded .env file"
-
-  msg_info "Configuring compose and env files"
+  msg_info "Configuring compose file"
   sed -i '/^[[:space:]]*#/!s|/host/path/to/projects|'"$PROJ_DIR"'|g' "$COMPOSE_FILE"
   sed -i '/^[[:space:]]*#/!s|/host/path/to/builds|'"$BUILDS_DIR"'|g' "$COMPOSE_FILE"
   sed -i '/^[[:space:]]*#/!s|ENCRYPTION_KEY=.*|ENCRYPTION_KEY='"$ENCRYPTION_KEY"'|g' "$COMPOSE_FILE"
-  sed -i '/^[[:space:]]*#/!s|JWT_SECRET=.*|JWT_SECRET='"$JWT_SECRET"'|g' "$COMPOSE_FILE"
-  sed -i '/^[[:space:]]*#/!s|APP_URL=.*|APP_URL=http://localhost:'"$DEFAULT_PORT"'|g' "$ENV_FILE"
-  sed -i '/^[[:space:]]*#/!s|ENCRYPTION_KEY=.*|#&|g' "$ENV_FILE"
-  sed -i '/^[[:space:]]*#/!s|JWT_SECRET=.*|#&|g' "$ENV_FILE"
-  msg_ok "Configured compose and env files"
+  sync_env_names
+  msg_ok "Configured compose file"
 
   msg_info "Starting ${APP}"
   cd "$INSTALL_PATH"

vm/opnsense-vm.sh

@@ -442,7 +442,26 @@ msg_ok "Bridge interfaces have been successfully added."
 msg_ok "Created a OPNsense VM ${CL}${BL}(${HN})"
 msg_ok "Starting OPNsense VM (the bootstrap takes 10-30 minutes)"
 $STD qm start $VMID
-sleep 180
+# The FreeBSD image prints its login prompt on the serial console too. Boot takes
+# under a minute with DHCP, each NIC without a DHCP server adds a 60s timeout.
+SERIAL_LOG="${TEMP_DIR}/serial-${VMID}.log"
+timeout 900 socat -u "UNIX-CONNECT:/var/run/qemu-server/${VMID}.serial0" - >"$SERIAL_LOG" 2>/dev/null &
+SERIAL_PID=$!
+boot_wait=0
+until grep -aq 'login:' "$SERIAL_LOG" 2>/dev/null || ! kill -0 "$SERIAL_PID" 2>/dev/null; do
+  sleep 5
+  boot_wait=$((boot_wait + 5))
+done
+kill "$SERIAL_PID" 2>/dev/null || true
+if grep -aq 'login:' "$SERIAL_LOG" 2>/dev/null; then
+  msg_ok "FreeBSD booted after ${boot_wait}s"
+elif [ $boot_wait -lt 180 ]; then
+  msg_warn "Could not read the serial console, waiting 3 minutes instead"
+  sleep $((180 - boot_wait))
+else
+  msg_warn "No login prompt on the serial console after $((boot_wait / 60)) minutes; continuing"
+fi
+sleep 3
 send_line_to_vm "root"
 sleep 2
 send_line_to_vm ""