Update CHANGELOG.md (#17204)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -5,15 +5,19 @@ body:
   - type: markdown
     attributes:
       value: |
-        ## ⚠️ **IMPORTANT - READ FIRST**  
+        ## ⚠️ **IMPORTANT - READ FIRST**
-        - 🔍 **Search first:** Before submitting, check if the issue has already been reported or resolved in [closed issues](https://github.com/community-scripts/ProxmoxVE/issues?q=is%3Aissue+is%3Aclosed). If found, comment on that issue instead of creating a new one.  
-        Alternatively, check the **[Discussions](https://github.com/community-scripts/ProxmoxVE/discussions)** under the *"Announcement"* or *"Guide"* categories for relevant information.  
-        - 🔎 If you encounter `[ERROR] in line 23: exit code *: while executing command "$@" > /dev/null 2>&1`, rerun the script with verbose mode before submitting the issue.  
-        - 📜 **Read the script:** Familiarize yourself with the script's content and its purpose. This will help you understand the issue better and provide more relevant information
 
-        Thank you for taking the time to report an issue! Please provide as much detail as possible to help us address the problem efficiently.  
+        **1. Reproduce the issue with verbose mode - this is mandatory.**
+        Set `var_verbose=yes` (or *Advanced Settings → Verbose Mode*) and run the script again.
+        Only a verbose log shows what actually failed - a bare `[ERROR] in line 23: exit code *` tells us nothing.
+        **Reports without a verbose log will most likely be closed.**
+
+        **2. Search before you post.**
+        Check the [closed issues](https://github.com/community-scripts/ProxmoxVE/issues?q=is%3Aissue+is%3Aclosed) and the [Discussions](https://github.com/community-scripts/ProxmoxVE/discussions) (*Announcement* / *Guide*). If it is already known, comment there instead of opening a new issue.
+
+        **3. Read the script.**
+        Knowing what it does makes it much easier to describe the problem - and often to solve it yourself.
 
-     
   - type: input
     id: guidelines
     attributes:
@@ -28,7 +32,6 @@ body:
       label: 🔎 Did you run the script with verbose mode enabled?
       description: "Required for debugging any script issue. A verbose log is mandatory."
       options:
-        - ""
         - "Yes, verbose mode was enabled and the output is included below"
         - "No (this issue will likely be closed automatically)"
     validations:
@@ -50,6 +53,32 @@ body:
     validations:
       required: true
 
+  - type: dropdown
+    id: issue_phase
+    attributes:
+      label: 🕒 When does the issue occur?
+      options:
+        - "Initial creation / installation"
+        - "Update of an existing container"
+        - "While the application is running"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: execution_context
+    attributes:
+      label: 🖱️ Where did you run the command?
+      description: "The shell matters — the Proxmox web console starts without some environment variables that a normal login shell sets."
+      options:
+        - "Proxmox web UI → node → Shell"
+        - "Proxmox web UI → LXC → Console"
+        - "SSH into the Proxmox host"
+        - "SSH into the container"
+        - "pct enter from the host"
+        - "Other / not listed"
+    validations:
+      required: true
+
   - type: checkboxes
     validations:
       required: true
@@ -64,18 +93,31 @@ body:
       value: "💡 **Tip:** If you are using Advanced Settings, please test with Default Settings before submitting an issue."
 
   - type: dropdown
-    id: linux_distribution
+    id: os_distribution
     attributes:
-      label: 🖥️ Which Linux distribution are you using?
+      label: 🖥️ Which Linux distribution is the container running?
       options:
-        - 
+        - Debian
+        - Ubuntu
         - Alpine
-        - Debian 11
+        - Devuan
-        - Debian 12
+        - AlmaLinux
-        - Debian 13
+        - Rocky Linux
-        - Ubuntu 22.04
+        - CentOS Stream
-        - Ubuntu 24.04
+        - Fedora
-        - Ubuntu 24.10
+        - openSUSE
+        - openEuler
+        - Gentoo
+        - Other / not listed
+    validations:
+      required: true
+
+  - type: input
+    id: os_version
+    attributes:
+      label: 🔢 Which version of that distribution?
+      description: "Run `cat /etc/os-release` inside the container if unsure."
+      placeholder: "e.g. 13 (Debian), 24.04 (Ubuntu), 3.22 (Alpine)"
     validations:
       required: true
 
@@ -85,16 +127,27 @@ body:
       label: 🧱 Is this Proxmox host running arm64?
       description: "Run `dpkg --print-architecture` on your Proxmox host if unsure."
       options:
-        - ""
         - "No"
         - "Yes"
     validations:
       required: true
 
+  - type: dropdown
+    id: pve_major
+    attributes:
+      label: 📈 Which Proxmox VE release are you on?
+      options:
+        - "Proxmox VE 9"
+        - "Proxmox VE 8"
+        - "Proxmox VE 7 or older (end of life)"
+    validations:
+      required: true
+
   - type: input
     id: pve_version
     attributes:
-      label: 📈 Which Proxmox version are you on?
+      label: 🔢 Exact Proxmox version and kernel
+      description: "Both matter — several issues turned out to be kernel-specific."
       placeholder: "run pveversion in your PVE node console"
     validations:
       required: true

.github/changelogs/2026/08.md

@@ -1,3 +1,66 @@
+## 2026-08-31
+
+### 🆕 New Scripts
+
+  - Aurral ([#16908](https://github.com/community-scripts/ProxmoxVE/pull/16908))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - openwebui: add UV_HTTP_TIMEOUT and retry loop to prevent uv install hangs [@MickLesk](https://github.com/MickLesk) ([#16917](https://github.com/community-scripts/ProxmoxVE/pull/16917))
+    - bambuddy: force asyncio loop, uvloop breaks camera proxy handlers [@MickLesk](https://github.com/MickLesk) ([#16904](https://github.com/community-scripts/ProxmoxVE/pull/16904))
+    - bookorbit: raise service start timeout, migration can exceed systemd default [@MickLesk](https://github.com/MickLesk) ([#16860](https://github.com/community-scripts/ProxmoxVE/pull/16860))
+    - node-red: remove --unsafe-perm flag [@MickLesk](https://github.com/MickLesk) ([#16859](https://github.com/community-scripts/ProxmoxVE/pull/16859))
+    - directus: add build-essential dependency [@MickLesk](https://github.com/MickLesk) ([#16858](https://github.com/community-scripts/ProxmoxVE/pull/16858))
+
+  - #### ✨ New Features
+
+    - haos-vm: add optional x86-64-v2-AES CPU option, future HA numpy builds need it [@MickLesk](https://github.com/MickLesk) ([#16868](https://github.com/community-scripts/ProxmoxVE/pull/16868))
+
+  - #### 🔧 Refactor
+
+    - omv: migrate to new package repo host (packages.openmediavault.org) is dead [@MickLesk](https://github.com/MickLesk) ([#16918](https://github.com/community-scripts/ProxmoxVE/pull/16918))
+    - yuvomi/aurral: bump NODE_VERSION [@MickLesk](https://github.com/MickLesk) ([#16914](https://github.com/community-scripts/ProxmoxVE/pull/16914))
+    - vaultwarden: relax cargo release profile via env vars to avoid build OOM [@MickLesk](https://github.com/MickLesk) ([#16915](https://github.com/community-scripts/ProxmoxVE/pull/16915))
+    - kima-hub/maintainerr/planka/spliit: bump NODE_VERSION [@MickLesk](https://github.com/MickLesk) ([#16905](https://github.com/community-scripts/ProxmoxVE/pull/16905))
+    - gatus: pin Go toolchain to gatus's own go.mod version [@MickLesk](https://github.com/MickLesk) ([#16893](https://github.com/community-scripts/ProxmoxVE/pull/16893))
+    - immich: tolerate enable-maintenance-mode crash, same as disable-maintenance-mode [@MickLesk](https://github.com/MickLesk) ([#16866](https://github.com/community-scripts/ProxmoxVE/pull/16866))
+    - move the hardware-accelerated scripts onto new core [@MickLesk](https://github.com/MickLesk) ([#16864](https://github.com/community-scripts/ProxmoxVE/pull/16864))
+    - ntopng: use ntop.org's documented apt repo per Debian codename, not always apt-stable [@MickLesk](https://github.com/MickLesk) ([#16862](https://github.com/community-scripts/ProxmoxVE/pull/16862))
+    - Refactor: OpenGist [@MickLesk](https://github.com/MickLesk) ([#16861](https://github.com/community-scripts/ProxmoxVE/pull/16861))
+
+### 💾 Core
+
+  - Refactor VM script settings and fix load_functions errors [@MickLesk](https://github.com/MickLesk) ([core#13](https://github.com/community-scripts/core/pull/13))
+- Ask ProxmoxVE to refresh its changelog on merge [@MickLesk](https://github.com/MickLesk) ([core#11](https://github.com/community-scripts/core/pull/11))
+- Lift the settings summary and the mode fork into vm-core [@MickLesk](https://github.com/MickLesk) ([core#12](https://github.com/community-scripts/core/pull/12))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - filebrowser-quantum: strip removed disableIndexing key on update, restart service [@MickLesk](https://github.com/MickLesk) ([#16892](https://github.com/community-scripts/ProxmoxVE/pull/16892))
+
+### 📚 Documentation
+
+  - Include engine pull requests in the changelog [@MickLesk](https://github.com/MickLesk) ([#16867](https://github.com/community-scripts/ProxmoxVE/pull/16867))
+
+## 2026-08-30
+
+### 🆕 New Scripts
+
+  - SolidInvoice ([#16869](https://github.com/community-scripts/ProxmoxVE/pull/16869))
+- Super-Productivity ([#16870](https://github.com/community-scripts/ProxmoxVE/pull/16870))
+- Defguard ([#16871](https://github.com/community-scripts/ProxmoxVE/pull/16871))
+- OpenBao ([#16872](https://github.com/community-scripts/ProxmoxVE/pull/16872))
+
+### 🚀 Updated Scripts
+
+  - #### 🔧 Refactor
+
+    - general: remove gitea links overall  [@MickLesk](https://github.com/MickLesk) ([#16863](https://github.com/community-scripts/ProxmoxVE/pull/16863))
+
 ## 2026-08-29
 
 ### 📚 Documentation

.github/changelogs/2026/09.md

@@ -0,0 +1,115 @@
+## 2026-09-05
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - authentik: scope blueprints chown to avoid recursing into the mp0 bind mount [@MickLesk](https://github.com/MickLesk) ([#17008](https://github.com/community-scripts/ProxmoxVE/pull/17008))
+    - iventoy: run iventoy.sh with bash instead of dash [@MickLesk](https://github.com/MickLesk) ([#17034](https://github.com/community-scripts/ProxmoxVE/pull/17034))
+    - frigate: restart go2rtc.service before frigate starts [@MickLesk](https://github.com/MickLesk) ([#17035](https://github.com/community-scripts/ProxmoxVE/pull/17035))
+    - snapotter: seed AI venv base packages on arm64, warn amd64 has no working CPU bundle [@MickLesk](https://github.com/MickLesk) ([#16903](https://github.com/community-scripts/ProxmoxVE/pull/16903))
+    - tolgee: bump required JDK from 21 to 25 [@MickLesk](https://github.com/MickLesk) ([#17005](https://github.com/community-scripts/ProxmoxVE/pull/17005))
+    - romm: write real version into backend/__version__.py placeholder [@MickLesk](https://github.com/MickLesk) ([#17009](https://github.com/community-scripts/ProxmoxVE/pull/17009))
+
+  - #### 🔧 Refactor
+
+    - Refactor FileFlows: Stop Spinner before read -rp / Switch from "Node" to "Agent"  [@MickLesk](https://github.com/MickLesk) ([#17007](https://github.com/community-scripts/ProxmoxVE/pull/17007))
+
+### 💾 Core
+
+  - update helper: follow renamed ct/ scripts instead of curling a 404 [@MickLesk](https://github.com/MickLesk) ([core#22](https://github.com/community-scripts/core/pull/22))
+- Use Proxmox for a template before reaching for linuxcontainers.org [@MickLesk](https://github.com/MickLesk) ([core#23](https://github.com/community-scripts/core/pull/23))
+- implement exponential backoff for curl retries in _cs_curl_retry function [@MickLesk](https://github.com/MickLesk) ([core#26](https://github.com/community-scripts/core/pull/26))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - update-apps: follow renamed ct/ scripts instead of erroring out [@MickLesk](https://github.com/MickLesk) ([#16991](https://github.com/community-scripts/ProxmoxVE/pull/16991))
+
+## 2026-09-04
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(shlink): preserve servers.json across web-client updates [@Corgei](https://github.com/Corgei) ([#17023](https://github.com/community-scripts/ProxmoxVE/pull/17023))
+    - fix-update-authentik-2026.8.1 [@thieneret](https://github.com/thieneret) ([#16999](https://github.com/community-scripts/ProxmoxVE/pull/16999))
+    - Fix npm v12 allow-git/allow-remote restrictions across affected scripts [@MickLesk](https://github.com/MickLesk) ([#17014](https://github.com/community-scripts/ProxmoxVE/pull/17014))
+    - Fix/poznote - 1st party Docker parity [@lucas-at-3x-eye](https://github.com/lucas-at-3x-eye) ([#17011](https://github.com/community-scripts/ProxmoxVE/pull/17011))
+
+### 💾 Core
+
+  - setup_go: resolve bare major.minor versions to the latest patch release [@MickLesk](https://github.com/MickLesk) ([core#24](https://github.com/community-scripts/core/pull/24))
+
+## 2026-09-03
+
+### 🚀 Updated Scripts
+
+  - Immich: bump libheif and libraw [@vhsdream](https://github.com/vhsdream) ([#16996](https://github.com/community-scripts/ProxmoxVE/pull/16996))
+
+  - #### 🐞 Bug Fixes
+
+    - romm: allow git-based npm dependency for rom-patcher under npm v12 [@MickLesk](https://github.com/MickLesk) ([#16990](https://github.com/community-scripts/ProxmoxVE/pull/16990))
+    - Pin Go to the version each project declares in go.mod [@MickLesk](https://github.com/MickLesk) ([#16976](https://github.com/community-scripts/ProxmoxVE/pull/16976))
+    - Authentik update 2026.8.1 [@thieneret](https://github.com/thieneret) ([#16980](https://github.com/community-scripts/ProxmoxVE/pull/16980))
+
+## 2026-09-02
+
+### 🆕 New Scripts
+
+  - OwnTracks-Recorder ([#16967](https://github.com/community-scripts/ProxmoxVE/pull/16967))
+- PeerTube ([#16966](https://github.com/community-scripts/ProxmoxVE/pull/16966))
+- Kaneo ([#16965](https://github.com/community-scripts/ProxmoxVE/pull/16965))
+- JDownloader ([#16964](https://github.com/community-scripts/ProxmoxVE/pull/16964))
+- ReadMeABook ([#16963](https://github.com/community-scripts/ProxmoxVE/pull/16963))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Enhance backup process in teddycloud.sh [@MickLesk](https://github.com/MickLesk) ([#16946](https://github.com/community-scripts/ProxmoxVE/pull/16946))
+    - mealie: copy Nuxt generate output and use pnpm when lockfile is present [@mjhuff](https://github.com/mjhuff) ([#16938](https://github.com/community-scripts/ProxmoxVE/pull/16938))
+    - OpenThread-BR: Clean build directory before update [@tomfrenzel](https://github.com/tomfrenzel) ([#16949](https://github.com/community-scripts/ProxmoxVE/pull/16949))
+
+  - #### 🔧 Refactor
+
+    - Scripts: use shared core bootstrap for final 114 Script Batch [@MickLesk](https://github.com/MickLesk) ([#16953](https://github.com/community-scripts/ProxmoxVE/pull/16953))
+    - Scripts: use shared core bootstrap for next 115 Script Batch [@MickLesk](https://github.com/MickLesk) ([#16952](https://github.com/community-scripts/ProxmoxVE/pull/16952))
+    - Scripts: use shared core bootstrap for next 115 Script Batch [@MickLesk](https://github.com/MickLesk) ([#16951](https://github.com/community-scripts/ProxmoxVE/pull/16951))
+    - Scripts: use shared core bootstrap for next 100 Script Batch [@MickLesk](https://github.com/MickLesk) ([#16950](https://github.com/community-scripts/ProxmoxVE/pull/16950))
+
+### 💾 Core
+
+  - setup_meilisearch: generate a 32-byte master key [@MickLesk](https://github.com/MickLesk) ([core#20](https://github.com/community-scripts/core/pull/20))
+- setup_meilisearch: generate a 32-byte master key [@MickLesk](https://github.com/MickLesk) ([core#19](https://github.com/community-scripts/core/pull/19))
+- setup_nodejs: restore the npm allowScripts bypass lost in the migration [@MickLesk](https://github.com/MickLesk) ([core#18](https://github.com/community-scripts/core/pull/18))
+
+## 2026-09-01
+
+### 🆕 New Scripts
+
+  - Mailpit ([#16942](https://github.com/community-scripts/ProxmoxVE/pull/16942))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Revert Aurral to Node22 [@Copilot](https://github.com/Copilot) ([#16930](https://github.com/community-scripts/ProxmoxVE/pull/16930))
+    - jellyfin: verify repo suite via fallback chain and use ensure_dependencies for clearer apt failures [@MickLesk](https://github.com/MickLesk) ([#16916](https://github.com/community-scripts/ProxmoxVE/pull/16916))
+
+  - #### 🔧 Refactor
+
+    - Move the next 25 scripts onto the core engine [@MickLesk](https://github.com/MickLesk) ([#16934](https://github.com/community-scripts/ProxmoxVE/pull/16934))
+
+### 💾 Core
+
+  - Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#15](https://github.com/community-scripts/core/pull/15))
+- Report the exit code the engine actually saw [@MickLesk](https://github.com/MickLesk) ([core#17](https://github.com/community-scripts/core/pull/17))
+- Silence npm's update notice so the real error stays visible [@MickLesk](https://github.com/MickLesk) ([core#16](https://github.com/community-scripts/core/pull/16))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - fix(add-iptag): merge live IPv4 addresses for running LXCs [@phillf](https://github.com/phillf) ([#16691](https://github.com/community-scripts/ProxmoxVE/pull/16691))

.github/pull_request_template.md

@@ -14,6 +14,9 @@ Fixes #
 - [ ] **Tested thoroughly** – Changes work as expected.
 - [ ] **No security risks** – No hardcoded secrets, unnecessary privilege escalations, or permission issues.
 
+**Tested on:** <!-- e.g. PVE 9.2 / Debian 13 / fresh install + update. Write "not tested" if you could not run it. -->
+
+
 ---
 
 ## 🤖 AI Assistance (**X** in brackets)

.github/workflows/check-node-versions.yml

@@ -7,8 +7,9 @@ on:
     - cron: "0 6 * * 1"
 
 permissions:
-  contents: read
+  contents: write
   issues: write
+  pull-requests: write
 
 jobs:
   check-node-versions:
@@ -390,6 +391,142 @@ jobs:
 
           cat /tmp/drift_report.md
 
+      # One PR per script, not one for all of them: the bumps are judged
+      # individually (an app can be deliberately held back while the next is a
+      # safe follow), and a combined PR is blocked by its worst member.
+      - name: Open a pull request per drifting script
+        if: steps.check.outputs.drift_count != '0'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          set -euo pipefail
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+          : >/tmp/drift_prs.txt
+
+          while IFS='|' read -r slug our upstream hint repo; do
+            [[ -z "$slug" ]] && continue
+
+            # "dynamic" and "unset" have no literal to rewrite, and a missing
+            # upstream major is nothing to rewrite it to.
+            if [[ ! "$our" =~ ^[0-9]+$ || ! "$upstream" =~ ^[0-9]+$ ]]; then
+              printf '%s|manual||\n' "$slug" >>/tmp/drift_prs.txt
+              continue
+            fi
+
+            # The branch name carries the exact bump, so the PR for it answers
+            # the question on its own: open means it is waiting for a review,
+            # closed means someone said no to this bump. A later upstream
+            # release changes the name and gets its own PR.
+            branch="node-drift/${slug}-${our}-to-${upstream}"
+
+            existing=$(gh pr list --head "$branch" --state all \
+              --json number,state,url,labels --jq '.[0] // empty' 2>/dev/null || echo "")
+
+            if [[ -n "$existing" ]]; then
+              state=$(jq -r '.state' <<<"$existing")
+              url=$(jq -r '.url' <<<"$existing")
+              stale=$(jq -r '[.labels[]?.name] | index("stale") // empty' <<<"$existing")
+
+              case "$state" in
+              OPEN)
+                printf '%s|open|%s\n' "$slug" "$url" >>/tmp/drift_prs.txt
+                continue
+                ;;
+              MERGED)
+                printf '%s|merged|%s\n' "$slug" "$url" >>/tmp/drift_prs.txt
+                continue
+                ;;
+              *)
+                # The stale bot only closes what a human labelled "stale", so
+                # that close carries no verdict on the bump — reopen the case.
+                # A close without it is a decision, and it stands.
+                if [[ -z "$stale" ]]; then
+                  printf '%s|declined|%s\n' "$slug" "$url" >>/tmp/drift_prs.txt
+                  continue
+                fi
+                git push origin --delete "$branch" >/dev/null 2>&1 || true
+                ;;
+              esac
+            fi
+
+            git checkout -q -B "$branch"
+
+            changed=()
+            for f in "install/${slug}-install.sh" "ct/${slug}.sh"; do
+              [[ -f "$f" ]] || continue
+              if grep -qE "NODE_VERSION=\"?${our}\"?" "$f"; then
+                sed -i -E "s/(NODE_VERSION=)\"?${our}\"?/\1\"${upstream}\"/g" "$f"
+                changed+=("$f")
+              fi
+            done
+
+            if [[ ${#changed[@]} -eq 0 ]]; then
+              printf '%s|manual||\n' "$slug" >>/tmp/drift_prs.txt
+              git checkout -q main
+              continue
+            fi
+
+            git add "${changed[@]}"
+            git commit -q -m "${slug}: bump Node.js from ${our} to ${upstream}"
+
+            if ! git push -q -u origin "$branch" 2>/dev/null; then
+              printf '%s|failed||\n' "$slug" >>/tmp/drift_prs.txt
+              git checkout -q main
+              continue
+            fi
+
+            # The test command is written here rather than left to
+            # pr-test-command.yml: a PR opened with GITHUB_TOKEN does not start
+            # another workflow, so that comment would never arrive.
+            body=$(cat <<PR_EOF
+          \`${slug}\` pins Node **${our}**, upstream indicates **${upstream}** (${hint}) — [upstream repo](https://github.com/${repo}).
+
+          Opened automatically by the weekly Node.js version drift check. **Nothing here has been tested.** Run it against a host before merging:
+
+          \`\`\`bash
+          export COMMUNITY_SCRIPTS_URL=https://raw.githubusercontent.com/${GITHUB_REPOSITORY}/${branch}
+          bash -c "\$(curl -fsSL "\$COMMUNITY_SCRIPTS_URL/ct/${slug}.sh")"
+          \`\`\`
+
+          Both lines are needed — each script pins \`_CS_DEFAULT_URL\` to \`main\`, and that pin is what fills \`COMMUNITY_SCRIPTS_URL\` when it is unset.
+
+          If the bump is wrong — upstream ships a newer Node than the app needs, or this script is deliberately held back — **close this PR**. It gets recorded on the drift report and this exact bump is not proposed again.
+          PR_EOF
+            )
+
+            # Labels go on at creation, not in a second call: they are what
+            # exempts the PR from the template check, and that check runs on
+            # "opened" — a label added a moment later can arrive too late.
+            #
+            # "keep-open" rather than "automated pr" for that exemption: both
+            # skip the template check, but changelog-pr.yml drops every PR
+            # carrying "automated pr" (it marks its own PR with it), so that
+            # label would keep these bumps out of the changelog entirely.
+            # "update script" and "bugfix" place them under Updated Scripts →
+            # Bug Fixes; the autolabeler cannot do it, since a PR opened with
+            # GITHUB_TOKEN never triggers its pull_request_target run.
+            if url=$(gh pr create \
+              --title "${slug}: bump Node.js from ${our} to ${upstream}" \
+              --body "$body" \
+              --base main \
+              --head "$branch" \
+              --label "keep-open" \
+              --label "update script" \
+              --label "bugfix" 2>/dev/null); then
+              printf '%s|open|%s\n' "$slug" "$url" >>/tmp/drift_prs.txt
+            else
+              printf '%s|failed||\n' "$slug" >>/tmp/drift_prs.txt
+            fi
+
+            git checkout -q main
+          done </tmp/drift_scripts.txt
+
+          echo "Pull request status per script:"
+          cat /tmp/drift_prs.txt
+
       - name: Create or update summary issue
         if: steps.check.outputs.drift_count != '0'
         env:
@@ -403,11 +540,31 @@ jobs:
           TOTAL="${{ steps.check.outputs.total }}"
           CHECKED="${{ steps.check.outputs.checked }}"
 
-          # Build checklist from drift data
+          # Build checklist from drift data. Each item carries the state of its
+          # own PR, so the list tracks itself instead of relying on someone
+          # ticking a box that the next run would overwrite anyway.
           CHECKLIST=""
           while IFS='|' read -r slug our_version upstream_major upstream_hint repo; do
             [[ -z "$slug" ]] && continue
-            CHECKLIST+="- [ ] **\`${slug}\`** — ours: \`${our_version}\` → upstream: \`${upstream_major}\` (${upstream_hint}) — [repo](https://github.com/${repo})"$'\n'
+
+            pr_state=""
+            pr_url=""
+            if [[ -f /tmp/drift_prs.txt ]]; then
+              pr_line=$(grep -m1 "^${slug}|" /tmp/drift_prs.txt || echo "")
+              pr_state=$(cut -d'|' -f2 <<<"$pr_line")
+              pr_url=$(cut -d'|' -f3 <<<"$pr_line")
+            fi
+
+            case "$pr_state" in
+            open)     mark="- [ ]"; note="— ${pr_url}" ;;
+            declined) mark="- [x]"; note="— declined in ${pr_url}, not proposed again" ;;
+            merged)   mark="- [x]"; note="— merged in ${pr_url}" ;;
+            manual)   mark="- [ ]"; note="— needs a manual change (no fixed \`NODE_VERSION\` to rewrite)" ;;
+            failed)   mark="- [ ]"; note="— could not open a PR automatically" ;;
+            *)        mark="- [ ]"; note="" ;;
+            esac
+
+            CHECKLIST+="${mark} **\`${slug}\`** — ours: \`${our_version}\` → upstream: \`${upstream_major}\` (${upstream_hint}) — [repo](https://github.com/${repo}) ${note}"$'\n'
           done < /tmp/drift_scripts.txt
 
           # Build full report table
@@ -424,11 +581,12 @@ jobs:
 
           ### How to resolve
 
-          1. Check upstream Dockerfile / package.json to confirm the required Node.js version
+          Each item above has its own pull request with the bump already applied and a ready-to-run test command in the description.
-          2. Test the script with the new Node version
+
-          3. Update \`NODE_VERSION\` in \`install/<slug>-install.sh\`
+          1. Check the upstream Dockerfile / package.json to confirm the required Node.js version
-          4. Update \`NODE_VERSION\` in \`ct/<slug>.sh\` (update section) if applicable
+          2. Run the test command from the PR against a host
-          5. Check off the item above once done
+          3. Merge the PR if it works — the item disappears from this list on the next run
+          4. Close the PR if the bump is wrong: the script stays as it is and this exact bump is never proposed again
 
           <details>
           <summary>Full report</summary>

.github/workflows/node-drift-pr-closed.yml

@@ -0,0 +1,55 @@
+name: Record closed Node.js drift PR
+
+# The drift check opens one PR per script and treats a closed one as a verdict:
+# that bump is not proposed again. That decision is invisible on the report
+# unless it is written there, so record it as a comment naming the script.
+
+on:
+  pull_request:
+    types: [closed]
+
+jobs:
+  record:
+    if: >
+      github.repository == 'community-scripts/ProxmoxVE' &&
+      github.event.pull_request.merged == false &&
+      startsWith(github.event.pull_request.head.ref, 'node-drift/')
+    runs-on: ubuntu-latest
+    permissions:
+      issues: write
+    steps:
+      - uses: actions/github-script@v9
+        with:
+          script: |
+            const pr = context.payload.pull_request;
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+
+            // node-drift/<slug>-<from>-to-<to>
+            const m = pr.head.ref.match(/^node-drift\/(.+)-(\d+)-to-(\d+)$/);
+            if (!m) return;
+            const [, slug, from, to] = m;
+
+            // A close by the stale bot is a lapsed review, not a decision on
+            // the bump, and the drift check reopens those. Saying "declined"
+            // here would contradict it.
+            const stale = pr.labels.some((l) => l.name === 'stale');
+
+            const issues = await github.rest.issues.listForRepo({
+              owner, repo, state: 'open', labels: 'automated,dependencies', per_page: 100,
+            });
+            const issue = issues.data.find(
+              (i) => !i.pull_request && i.title === '[Automated] Node.js Version Drift Report',
+            );
+            if (!issue) return;
+
+            const body = stale
+              ? `\`${slug}\` — PR #${pr.number} (Node ${from} → ${to}) was closed as stale. `
+                + `No decision was recorded, so the next drift check opens it again.`
+              : `\`${slug}\` — PR #${pr.number} (Node ${from} → ${to}) was closed without merging. `
+                + `The script keeps Node ${from} and this bump will not be proposed again. `
+                + `If it was closed by mistake, reopen the PR.`;
+
+            await github.rest.issues.createComment({
+              owner, repo, issue_number: issue.number, body,
+            });

CHANGELOG.md

@@ -98,6 +98,9 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 
 
+
+
+
 
 
 
@@ -111,7 +114,14 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 
 <details>
-<summary><h4>August (29 entries)</h4></summary>
+<summary><h4>September (5 entries)</h4></summary>
+
+[View September 2026 Changelog](.github/changelogs/2026/09.md)
+
+</details>
+
+<details>
+<summary><h4>August (31 entries)</h4></summary>
 
 [View August 2026 Changelog](.github/changelogs/2026/08.md)
 
@@ -530,6 +540,194 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-09-12
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - calibre-web: use calibreweb release identifier to avoid version file collision [@MickLesk](https://github.com/MickLesk) ([#17186](https://github.com/community-scripts/ProxmoxVE/pull/17186))
+
+## 2026-09-11
+
+### 🆕 New Scripts
+
+  - Lemonade-Server ([#17190](https://github.com/community-scripts/ProxmoxVE/pull/17190))
+- OneTimeSecret ([#17097](https://github.com/community-scripts/ProxmoxVE/pull/17097))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - update authentik to 2026.8.2 [@thieneret](https://github.com/thieneret) ([#17198](https://github.com/community-scripts/ProxmoxVE/pull/17198))
+    - passwordpusher: restore data before running migrations [@MickLesk](https://github.com/MickLesk) ([#17141](https://github.com/community-scripts/ProxmoxVE/pull/17141))
+    - paperclip: install the rust toolchain needed by the runner build [@MickLesk](https://github.com/MickLesk) ([#17142](https://github.com/community-scripts/ProxmoxVE/pull/17142))
+    - homepage: run next directly instead of through pnpm [@MickLesk](https://github.com/MickLesk) ([#17155](https://github.com/community-scripts/ProxmoxVE/pull/17155))
+    - changedetection: fix: pin browserless [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17163](https://github.com/community-scripts/ProxmoxVE/pull/17163))
+
+### 💾 Core
+
+  - #### 🐞 Bug Fixes
+
+    - core.func: fall back to a usable HOME when the shell has none [@MickLesk](https://github.com/MickLesk) ([#17154](https://github.com/community-scripts/ProxmoxVE/pull/17154))
+
+### 🧰 Tools
+
+  - Dockhand ([#17191](https://github.com/community-scripts/ProxmoxVE/pull/17191))
+
+  - #### 🐞 Bug Fixes
+
+    - update-apps: rewrite the retired Gitea base in every container before updating it [@MickLesk](https://github.com/MickLesk) ([#17156](https://github.com/community-scripts/ProxmoxVE/pull/17156))
+
+  - #### 🔧 Refactor
+
+    - Rename lxc-delete.sh to guest-delete.sh [@MickLesk](https://github.com/MickLesk) ([#17152](https://github.com/community-scripts/ProxmoxVE/pull/17152))
+
+### 📚 Documentation
+
+  - issue template: add PVE release, execution context and phase; refresh distro list / pve versions [@MickLesk](https://github.com/MickLesk) ([#17160](https://github.com/community-scripts/ProxmoxVE/pull/17160))
+
+## 2026-09-10
+
+### 🆕 New Scripts
+
+  - Chevereto ([#17131](https://github.com/community-scripts/ProxmoxVE/pull/17131))
+- Portabase ([#17111](https://github.com/community-scripts/ProxmoxVE/pull/17111))
+- Logseq ([#17112](https://github.com/community-scripts/ProxmoxVE/pull/17112))
+- Safebucket ([#17096](https://github.com/community-scripts/ProxmoxVE/pull/17096))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Immich v3.2.0 [@vhsdream](https://github.com/vhsdream) ([#17137](https://github.com/community-scripts/ProxmoxVE/pull/17137))
+    - fix(solidtime): prevent composer install from hanging on root prompt [@supersoju](https://github.com/supersoju) ([#17146](https://github.com/community-scripts/ProxmoxVE/pull/17146))
+    - fix(hermesagent): wait for root gateway cleanup [@steveonjava](https://github.com/steveonjava) ([#17147](https://github.com/community-scripts/ProxmoxVE/pull/17147))
+
+### 💾 Core
+
+  - Keep the script name when regenerating the entrypoint [@MickLesk](https://github.com/MickLesk) ([core#35](https://github.com/community-scripts/core/pull/35))
+- Rewrite the dead Gitea base onto GitHub instead of failing the update [@MickLesk](https://github.com/MickLesk) ([core#33](https://github.com/community-scripts/core/pull/33))
+- core.func: fall back to a usable HOME when the shell has none [@MickLesk](https://github.com/MickLesk) ([core#32](https://github.com/community-scripts/core/pull/32))
+
+## 2026-09-09
+
+### 🆕 New Scripts
+
+  - Lingarr ([#17130](https://github.com/community-scripts/ProxmoxVE/pull/17130))
+
+### 🚀 Updated Scripts
+
+  - vm: drop the discussions link from the summary [@MickLesk](https://github.com/MickLesk) ([#17117](https://github.com/community-scripts/ProxmoxVE/pull/17117))
+
+  - #### 🐞 Bug Fixes
+
+    - fix(hermesagent): stop spurious root gateway after update [@steveonjava](https://github.com/steveonjava) ([#17126](https://github.com/community-scripts/ProxmoxVE/pull/17126))
+
+## 2026-09-08
+
+### 🆕 New Scripts
+
+  - Decypharr ([#17108](https://github.com/community-scripts/ProxmoxVE/pull/17108))
+- Stash ([#17106](https://github.com/community-scripts/ProxmoxVE/pull/17106))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Update Jellyfin FFmpeg dependency to version 8 [@MickLesk](https://github.com/MickLesk) ([#17109](https://github.com/community-scripts/ProxmoxVE/pull/17109))
+
+### 💾 Core
+
+  - Treat a cut-short forge response as a failure, not as HTTP 200 [@MickLesk](https://github.com/MickLesk) ([core#31](https://github.com/community-scripts/core/pull/31))
+- Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#28](https://github.com/community-scripts/core/pull/28))
+- cloud-init: drop the "configure in Proxmox UI" hint [@MickLesk](https://github.com/MickLesk) ([core#30](https://github.com/community-scripts/core/pull/30))
+- Survive an empty /usr/bin/update instead of aborting the run [@MickLesk](https://github.com/MickLesk) ([core#29](https://github.com/community-scripts/core/pull/29))
+
+## 2026-09-07
+
+### 🆕 New Scripts
+
+  - Chatwoot ([#17095](https://github.com/community-scripts/ProxmoxVE/pull/17095))
+- whisparr-eros ([#17094](https://github.com/community-scripts/ProxmoxVE/pull/17094))
+- Matter-Hub ([#17093](https://github.com/community-scripts/ProxmoxVE/pull/17093))
+- Journiv ([#17092](https://github.com/community-scripts/ProxmoxVE/pull/17092))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - kaneo: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17086](https://github.com/community-scripts/ProxmoxVE/pull/17086))
+    - iobroker: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17085](https://github.com/community-scripts/ProxmoxVE/pull/17085))
+    - reactive-resume: repair any wrong WorkingDirectory on update [@MickLesk](https://github.com/MickLesk) ([#17068](https://github.com/community-scripts/ProxmoxVE/pull/17068))
+    - mediamtx: keep mediamtx.yml across updates [@MickLesk](https://github.com/MickLesk) ([#17069](https://github.com/community-scripts/ProxmoxVE/pull/17069))
+    - omnitools: allow remote action while npm ci [@MickLesk](https://github.com/MickLesk) ([#17070](https://github.com/community-scripts/ProxmoxVE/pull/17070))
+
+  - #### ✨ New Features
+
+    - netboot-xyz: add Secure Boot and Legacy assets [@MickLesk](https://github.com/MickLesk) ([#17066](https://github.com/community-scripts/ProxmoxVE/pull/17066))
+
+  - #### 🔧 Refactor
+
+    - flatnotes: follow upstream move to uv and Python 3.13 [@MickLesk](https://github.com/MickLesk) ([#17090](https://github.com/community-scripts/ProxmoxVE/pull/17090))
+    - heimdall: set up PHP 8.4 on update, keep only the database, run migrations [@MickLesk](https://github.com/MickLesk) ([#17067](https://github.com/community-scripts/ProxmoxVE/pull/17067))
+
+### 📂 Github
+
+  - github: Open per-script Node bump PRs [@MickLesk](https://github.com/MickLesk) ([#17065](https://github.com/community-scripts/ProxmoxVE/pull/17065))
+
+## 2026-09-06
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Fix Sonarqube update script to add +x on sonar.sh [@jarihu](https://github.com/jarihu) ([#17056](https://github.com/community-scripts/ProxmoxVE/pull/17056))
+
+## 2026-09-05
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - authentik: scope blueprints chown to avoid recursing into the mp0 bind mount [@MickLesk](https://github.com/MickLesk) ([#17008](https://github.com/community-scripts/ProxmoxVE/pull/17008))
+    - iventoy: run iventoy.sh with bash instead of dash [@MickLesk](https://github.com/MickLesk) ([#17034](https://github.com/community-scripts/ProxmoxVE/pull/17034))
+    - frigate: restart go2rtc.service before frigate starts [@MickLesk](https://github.com/MickLesk) ([#17035](https://github.com/community-scripts/ProxmoxVE/pull/17035))
+    - snapotter: seed AI venv base packages on arm64, warn amd64 has no working CPU bundle [@MickLesk](https://github.com/MickLesk) ([#16903](https://github.com/community-scripts/ProxmoxVE/pull/16903))
+    - tolgee: bump required JDK from 21 to 25 [@MickLesk](https://github.com/MickLesk) ([#17005](https://github.com/community-scripts/ProxmoxVE/pull/17005))
+    - romm: write real version into backend/__version__.py placeholder [@MickLesk](https://github.com/MickLesk) ([#17009](https://github.com/community-scripts/ProxmoxVE/pull/17009))
+
+  - #### 🔧 Refactor
+
+    - Refactor FileFlows: Stop Spinner before read -rp / Switch from "Node" to "Agent"  [@MickLesk](https://github.com/MickLesk) ([#17007](https://github.com/community-scripts/ProxmoxVE/pull/17007))
+
+### 💾 Core
+
+  - update helper: follow renamed ct/ scripts instead of curling a 404 [@MickLesk](https://github.com/MickLesk) ([core#22](https://github.com/community-scripts/core/pull/22))
+- Use Proxmox for a template before reaching for linuxcontainers.org [@MickLesk](https://github.com/MickLesk) ([core#23](https://github.com/community-scripts/core/pull/23))
+- implement exponential backoff for curl retries in _cs_curl_retry function [@MickLesk](https://github.com/MickLesk) ([core#26](https://github.com/community-scripts/core/pull/26))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - update-apps: follow renamed ct/ scripts instead of erroring out [@MickLesk](https://github.com/MickLesk) ([#16991](https://github.com/community-scripts/ProxmoxVE/pull/16991))
+
+## 2026-09-04
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(shlink): preserve servers.json across web-client updates [@Corgei](https://github.com/Corgei) ([#17023](https://github.com/community-scripts/ProxmoxVE/pull/17023))
+    - fix-update-authentik-2026.8.1 [@thieneret](https://github.com/thieneret) ([#16999](https://github.com/community-scripts/ProxmoxVE/pull/16999))
+    - Fix npm v12 allow-git/allow-remote restrictions across affected scripts [@MickLesk](https://github.com/MickLesk) ([#17014](https://github.com/community-scripts/ProxmoxVE/pull/17014))
+    - Fix/poznote - 1st party Docker parity [@lucas-at-3x-eye](https://github.com/lucas-at-3x-eye) ([#17011](https://github.com/community-scripts/ProxmoxVE/pull/17011))
+
+### 💾 Core
+
+  - setup_go: resolve bare major.minor versions to the latest patch release [@MickLesk](https://github.com/MickLesk) ([core#24](https://github.com/community-scripts/core/pull/24))
+
 ## 2026-09-03
 
 ### 🚀 Updated Scripts
@@ -1105,133 +1303,4 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🔧 Refactor
 
-    - core: extend new vars and pocketbase values [@MickLesk](https://github.com/MickLesk) ([#16313](https://github.com/community-scripts/ProxmoxVE/pull/16313))
+    - core: extend new vars and pocketbase values [@MickLesk](https://github.com/MickLesk) ([#16313](https://github.com/community-scripts/ProxmoxVE/pull/16313))
-
-## 2026-08-06
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - paperless: change update abort message (endless spinner) [@MickLesk](https://github.com/MickLesk) ([#16299](https://github.com/community-scripts/ProxmoxVE/pull/16299))
-
-  - #### ✨ New Features
-
-    - Vikunja: remove version pin, v2.5.0 fixes the systemd syscall filter crash [@MickLesk](https://github.com/MickLesk) ([#16300](https://github.com/community-scripts/ProxmoxVE/pull/16300))
-
-### 💾 Core
-
-  - #### 🔧 Refactor
-
-    - build.func: filter templates by host architecture during search [@MickLesk](https://github.com/MickLesk) ([#16302](https://github.com/community-scripts/ProxmoxVE/pull/16302))
-
-## 2026-08-05
-
-### 🚀 Updated Scripts
-
-  - #### ✨ New Features
-
-    - NextcloudPI: Bump to Debian Trixie & Tweak broken SSH [@MickLesk](https://github.com/MickLesk) ([#15957](https://github.com/community-scripts/ProxmoxVE/pull/15957))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - fix(monitor-all): reduce polling CPU overhead [@jomplox](https://github.com/jomplox) ([#15907](https://github.com/community-scripts/ProxmoxVE/pull/15907))
-
-## 2026-08-04
-
-### 🆕 New Scripts
-
-  - Hister ([#16259](https://github.com/community-scripts/ProxmoxVE/pull/16259))
-- Obsidian-LiveSync ([#16233](https://github.com/community-scripts/ProxmoxVE/pull/16233))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Actual Budget: allow native module install scripts under npm 11 (Node24) [@MickLesk](https://github.com/MickLesk) ([#16277](https://github.com/community-scripts/ProxmoxVE/pull/16277))
-    - Heimdall-Dashboard: run full composer install on update, force production env [@MickLesk](https://github.com/MickLesk) ([#16278](https://github.com/community-scripts/ProxmoxVE/pull/16278))
-    - xyOps: rebuild xySat satellite during update [@MickLesk](https://github.com/MickLesk) ([#16279](https://github.com/community-scripts/ProxmoxVE/pull/16279))
-    - HAOS: remove non-ASCII dash from CPU model dialog text [@MickLesk](https://github.com/MickLesk) ([#16276](https://github.com/community-scripts/ProxmoxVE/pull/16276))
-    - fix: back up Termix db/data so the update stops destroying encryption keys [@LukeGus](https://github.com/LukeGus) ([#16275](https://github.com/community-scripts/ProxmoxVE/pull/16275))
-    - passwordpusher: dynamically read Ruby version from .ruby-version file [@Copilot](https://github.com/Copilot) ([#16242](https://github.com/community-scripts/ProxmoxVE/pull/16242))
-    - fix(salt): write version cache to ~/.salt, not /~.salt [@TowyTowy](https://github.com/TowyTowy) ([#16265](https://github.com/community-scripts/ProxmoxVE/pull/16265))
-    - AFFiNE: fix version and build type reported by the app itself [@MickLesk](https://github.com/MickLesk) ([#16251](https://github.com/community-scripts/ProxmoxVE/pull/16251))
-    - Passbolt: fetch GPG key from Passbolt's own host instead of the flaky keyserver [@MickLesk](https://github.com/MickLesk) ([#16248](https://github.com/community-scripts/ProxmoxVE/pull/16248))
-
-  - #### ✨ New Features
-
-    - Opencloud: Pin version to 7.4.0 [@vhsdream](https://github.com/vhsdream) ([#16257](https://github.com/community-scripts/ProxmoxVE/pull/16257))
-
-  - #### 🔧 Refactor
-
-    - Bump NodeJS Versions of several scripts [@MickLesk](https://github.com/MickLesk) ([#16230](https://github.com/community-scripts/ProxmoxVE/pull/16230))
-
-### 💾 Core
-
-  - #### 🐞 Bug Fixes
-
-    - tools.func: never delete ubuntu.sources (or other distro base sources) as orphaned [@MickLesk](https://github.com/MickLesk) ([#16250](https://github.com/community-scripts/ProxmoxVE/pull/16250))
-    - tools.func: complete a stale/partial backup manifest instead of trusting it as-is [@MickLesk](https://github.com/MickLesk) ([#16252](https://github.com/community-scripts/ProxmoxVE/pull/16252))
-
-  - #### 🔧 Refactor
-
-    - Refactor: harmonize tools/addon and move boilerplate into core.func [@MickLesk](https://github.com/MickLesk) ([#16202](https://github.com/community-scripts/ProxmoxVE/pull/16202))
-
-## 2026-08-03
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Correction to link in Paperless-NGX update script [@jsspen](https://github.com/jsspen) ([#16241](https://github.com/community-scripts/ProxmoxVE/pull/16241))
-    - fix restore env in split pro [@johanngrobe](https://github.com/johanngrobe) ([#16228](https://github.com/community-scripts/ProxmoxVE/pull/16228))
-
-### 💾 Core
-
-  - #### 🔧 Refactor
-
-    - core: read all interactive prompts from /dev/tty, drain leftover input on read failure (hotfix) [@MickLesk](https://github.com/MickLesk) ([#16235](https://github.com/community-scripts/ProxmoxVE/pull/16235))
-
-## 2026-08-02
-
-### 🆕 New Scripts
-
-  - Portainer as Addon [@MickLesk](https://github.com/MickLesk) ([#16200](https://github.com/community-scripts/ProxmoxVE/pull/16200))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - LibreNMS: Ensure ipmitool dependency is installed [@tremor021](https://github.com/tremor021) ([#16219](https://github.com/community-scripts/ProxmoxVE/pull/16219))
-    - Bitfocus Companion: add libatomic1 dependency [@tremor021](https://github.com/tremor021) ([#16212](https://github.com/community-scripts/ProxmoxVE/pull/16212))
-    - fix(dispatcharr): add recordings and dvr queues to celery worker [@eXistC](https://github.com/eXistC) ([#16204](https://github.com/community-scripts/ProxmoxVE/pull/16204))
-    - add retry for uv - same as immich [@asylumexp](https://github.com/asylumexp) ([#16203](https://github.com/community-scripts/ProxmoxVE/pull/16203))
-    - Fix for cross-seed node version regression [@TorinFrancis](https://github.com/TorinFrancis) ([#16209](https://github.com/community-scripts/ProxmoxVE/pull/16209))
-
-  - #### 🔧 Refactor
-
-    - chore: remove portainer setup from several scripts (moved to addon) [@MickLesk](https://github.com/MickLesk) ([#16201](https://github.com/community-scripts/ProxmoxVE/pull/16201))
-
-## 2026-08-01
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Update bazarr-install.sh [@asylumexp](https://github.com/asylumexp) ([#16191](https://github.com/community-scripts/ProxmoxVE/pull/16191))
-    - fix romm missing 7z [@asylumexp](https://github.com/asylumexp) ([#16194](https://github.com/community-scripts/ProxmoxVE/pull/16194))
-
-  - #### 🔧 Refactor
-
-    - add CLEANUPARR_CONFIG_PATH, CLEANUPARR_LOGS_PATH vars [@asylumexp](https://github.com/asylumexp) ([#16193](https://github.com/community-scripts/ProxmoxVE/pull/16193))
-
-## 2026-07-31
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Docmost: cleanup folder at update [@MickLesk](https://github.com/MickLesk) ([#16177](https://github.com/community-scripts/ProxmoxVE/pull/16177))
-    - Firecrawl: Add dependency [@tremor021](https://github.com/tremor021) ([#16174](https://github.com/community-scripts/ProxmoxVE/pull/16174))

ct/authentik.sh

@@ -49,7 +49,7 @@ function update_script() {
   RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
   setup_yq
 
-  AUTHENTIK_VERSION="version/2026.8.1"
+  AUTHENTIK_VERSION="version/2026.8.2"
   # Source: https://github.com/goauthentik/fips/blob/main/Makefile#L26
   XMLSEC_VERSION="1.3.12"
 
@@ -88,7 +88,7 @@ function update_script() {
       msg_info "Moving blueprints to presistent directory"
       cp -r /opt/authentik/blueprints /opt/authentik-data/
       rm -r /opt/authentik/blueprints
-      chown -R authentik:authentik /opt/authentik-data
+      $STD find /opt/authentik-data -path '*/lost+found' -prune -o -exec chown authentik:authentik {} +
       yq -i ".blueprints_dir = \"/opt/authentik-data/blueprints\"" /etc/authentik/config.yml
       msg_ok "blueprints moved to presistent directory"
       msg_warn "The blueprints provided by authentik are always overwritten when updated! Only manually created custom blueprints remain unchanged between updates."
@@ -155,8 +155,8 @@ function update_script() {
 
     cp -r /opt/authentik/blueprints /opt/authentik-data/
     rm -r /opt/authentik/blueprints
-    chown -R authentik:authentik /opt/authentik-data
+    $STD find /opt/authentik-data -path '*/lost+found' -prune -o -exec chown authentik:authentik {} +
-    
+
     if [[ $MAJOR == 2026 && $MINOR -lt 8 ]]; then
 	    msg_info "Updating Worker and Server config (from $MAJOR.$MINOR)"
       cat <<EOF >>/etc/default/authentik-server
@@ -178,14 +178,18 @@ EOF
     fi
 
     msg_info "Updating Worker and Server config"
-    sed -i "s|/dev/shm$|/dev/shm/authentik-server|g" /etc/default/authentik-server
+    sed -i "s|/dev/shm\/\?$|/dev/shm/authentik-server|g" /etc/default/authentik-server
-	  sed -i "s|/dev/shm$|/dev/shm/authentik-worker|g" /etc/default/authentik-worker
+	  sed -i "s|/dev/shm\/\?$|/dev/shm/authentik-worker|g" /etc/default/authentik-worker
     msg_ok "Updated Worker and Server config"
 
     msg_info "Updating services"
     sed -i 's/authentik Go Server (API Gateway)/authentik Server/g' /etc/systemd/system/authentik-server.service
-	  sed -i '/ExecStart=/i ExecStartPre=/usr/bin/mkdir -p "${TMPDIR}"' /etc/systemd/system/authentik-server.service
+    if ! grep -qF -- 'ExecStartPre=/usr/bin/mkdir -p "${TMPDIR}"' /etc/systemd/system/authentik-server.service; then
-    sed -i '/ExecStart=/i ExecStartPre=/usr/bin/mkdir -p "${TMPDIR}"' /etc/systemd/system/authentik-worker.service
+	    sed -i '/ExecStart=/i ExecStartPre=/usr/bin/mkdir -p "${TMPDIR}"' /etc/systemd/system/authentik-server.service
+    fi
+    if ! grep -qF -- 'ExecStartPre=/usr/bin/mkdir -p "${TMPDIR}"' /etc/systemd/system/authentik-worker.service; then
+      sed -i '/ExecStart=/i ExecStartPre=/usr/bin/mkdir -p "${TMPDIR}"' /etc/systemd/system/authentik-worker.service
+    fi
     systemctl daemon-reload
     msg_ok "Updated services"
 
@@ -224,11 +228,11 @@ for i in {1..10}; do
   sleep 1
 done
 $STD pct exec "$CTID" -- bash -c "mkdir -p /opt/authentik-data/{certs,media,geoip,templates}; \
-  cp /opt/authentik/tests/GeoLite2-ASN-Test.mmdb /opt/authentik-data/geoip/GeoLite2-ASN.mmdb; \
+  cp /opt/authentik/tests/geoip/GeoLite2-ASN-Test.mmdb /opt/authentik-data/geoip/GeoLite2-ASN.mmdb; \
-  cp /opt/authentik/tests/GeoLite2-City-Test.mmdb /opt/authentik-data/geoip/GeoLite2-City.mmdb; \
+  cp /opt/authentik/tests/geoip/GeoLite2-City-Test.mmdb /opt/authentik-data/geoip/GeoLite2-City.mmdb; \
   cp -r /opt/authentik/blueprints /opt/authentik-data/; \
   rm -r /opt/authentik/blueprints; \
-  chown -R authentik:authentik /opt/authentik-data"
+  find /opt/authentik-data -path '*/lost+found' -prune -o -exec chown authentik:authentik {} +"
 msg_ok "Attached data storage volume"
 
 msg_info "Starting Services"

ct/baserow.sh

@@ -48,7 +48,7 @@ function update_script() {
 
     msg_info "Rebuilding Frontend"
     cd /opt/baserow/web-frontend
-    $STD npm install
+    $STD npm install --allow-remote=all
     $STD npm run build
     msg_ok "Rebuilt Frontend"
 

ct/bentopdf.sh

@@ -44,7 +44,7 @@ function update_script() {
 
     msg_info "Configuring BentoPDF"
     cd /opt/bentopdf
-    $STD npm ci --no-audit --no-fund
+    $STD npm ci --no-audit --no-fund --allow-remote=all
     export NODE_OPTIONS="--max-old-space-size=3072"
     export SIMPLE_MODE=true
     export VITE_USE_CDN=true

ct/calibre-web.sh

@@ -32,14 +32,18 @@ function update_script() {
     exit
   fi
 
-  if check_for_gh_release "Calibre-Web" "janeczku/calibre-web"; then
+  if [[ -f /root/.calibre-web && ! -e /root/.calibreweb ]]; then
+    mv /root/.calibre-web /root/.calibreweb
+  fi
+
+  if check_for_gh_release "calibreweb" "janeczku/calibre-web"; then
     msg_info "Stopping Service"
     systemctl stop calibre-web
     msg_ok "Stopped Service"
 
     create_backup /opt/calibre-web/data
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Calibre-Web" "janeczku/calibre-web" "prebuild" "latest" "/opt/calibre-web" "calibreweb*.tar.gz"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "calibreweb" "janeczku/calibre-web" "prebuild" "latest" "/opt/calibre-web" "calibreweb*.tar.gz"
     setup_uv
 
     msg_info "Installing Dependencies"

ct/changedetection.sh

@@ -69,6 +69,7 @@ function update_script() {
     $STD git -C /opt/browserless/ reset --hard origin/main
     $STD npm update --prefix /opt/browserless
     $STD npm ci --include=optional --include=dev --prefix /opt/browserless
+    $STD npm install --save-exact playwright-core@1.62.1 --prefix /opt/browserless
     $STD /opt/browserless/node_modules/playwright-core/cli.js install --with-deps
     # Update Chrome separately, as it has to be done with the force option. Otherwise the installation of other browsers will not be done if Chrome is already installed.
     $STD /opt/browserless/node_modules/playwright-core/cli.js install --force chrome

ct/chatwoot.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.chatwoot.com/
+
+APP="Chatwoot"
+var_tags="${var_tags:-support;chat;helpdesk;crm}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-6144}"
+var_disk="${var_disk:-16}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /opt/chatwoot/.env ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "chatwoot" "chatwoot/chatwoot"; then
+    msg_info "Stopping Services"
+    systemctl stop chatwoot-web chatwoot-worker
+    msg_ok "Stopped Services"
+
+    create_backup /opt/chatwoot/.env /opt/chatwoot/storage
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "chatwoot" "chatwoot/chatwoot" "tarball"
+    RUBY_VERSION=$(tr -d ' \n' </opt/chatwoot/.ruby-version)
+    RUBY_VERSION="${RUBY_VERSION}" RUBY_INSTALL_RAILS="false" setup_ruby
+    NODE_VERSION=$(tr -d ' \n' </opt/chatwoot/.nvmrc)
+    NODE_VERSION="${NODE_VERSION}" NODE_MODULE="pnpm" setup_nodejs
+    export PATH="$HOME/.rbenv/shims:$HOME/.rbenv/bin:$PATH"
+
+    restore_backup
+
+    msg_info "Updating Application"
+    cd /opt/chatwoot
+    $STD bundle config set --local without 'development test'
+    $STD bundle config set --local deployment 'true'
+    $STD bundle install
+    $STD pnpm install --frozen-lockfile
+    RAILS_ENV=production $STD bundle exec rails db:chatwoot_prepare
+    RAILS_ENV=production $STD bundle exec rails assets:precompile
+    msg_ok "Updated Application"
+
+    msg_info "Starting Services"
+    systemctl start chatwoot-web chatwoot-worker
+    msg_ok "Started Services"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"

ct/chevereto.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://chevereto.com/
+
+APP="Chevereto"
+var_tags="${var_tags:-image-hosting;gallery;media}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/chevereto ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "chevereto" "chevereto/chevereto"; then
+    PHP_FPM_SERVICE="$(basename "$(get_php_fpm_socket)" .sock)"
+
+    msg_info "Stopping Services"
+    systemctl stop nginx "$PHP_FPM_SERVICE"
+    msg_ok "Stopped Services"
+
+    create_backup /opt/chevereto/app/env.php \
+      /opt/chevereto/images \
+      /opt/chevereto/content
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "chevereto" "chevereto/chevereto" "tarball"
+
+    restore_backup
+
+    msg_info "Updating Chevereto"
+    cd /opt/chevereto/app
+    export COMPOSER_ALLOW_SUPERUSER=1
+    $STD composer install --no-dev --prefer-dist --no-interaction --optimize-autoloader
+    chown -R www-data:www-data /opt/chevereto
+    chmod -R 775 /opt/chevereto/images /opt/chevereto/content
+    msg_ok "Updated Chevereto"
+
+    msg_info "Starting Services"
+    systemctl start "$PHP_FPM_SERVICE" nginx
+    msg_ok "Started Services"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}${CL}"

ct/cryptpad.sh

@@ -51,7 +51,7 @@ function update_script() {
 
     msg_info "Updating CryptPad"
     cd /opt/cryptpad
-    $STD npm ci
+    $STD npm ci --allow-git=all
     $STD npm run install:components
     if [ -f "/opt/cryptpad/install-onlyoffice.sh" ]; then
       $STD bash /opt/cryptpad/install-onlyoffice.sh --accept-license

ct/decypharr.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/sirrobot01/decypharr
+
+APP="Decypharr"
+var_tags="${var_tags:-arr;debrid}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/decypharr ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "decypharr" "sirrobot01/decypharr"; then
+    msg_info "Stopping Service"
+    systemctl stop decypharr
+    msg_ok "Stopped Service"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "decypharr" "sirrobot01/decypharr" "prebuild" "latest" "/opt/decypharr" "decypharr_Linux_$(arch_resolve x86_64 arm64).tar.gz"
+    chmod +x /opt/decypharr/decypharr
+
+    msg_info "Starting Service"
+    systemctl start decypharr
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8282${CL}"

ct/flatnotes.sh

@@ -38,19 +38,18 @@ function update_script() {
 
     create_backup /opt/flatnotes/.env /opt/flatnotes/data
 
+    PYTHON_VERSION="3.13" setup_uv
+    NODE_VERSION="24" setup_nodejs
+
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "flatnotes" "dullage/flatnotes" "tarball"
 
     restore_backup
 
     msg_info "Updating Flatnotes"
-    cd /opt/flatnotes/client
-    $STD npm install
-    $STD npm run build
     cd /opt/flatnotes
-    rm -f uv.lock
+    $STD uv sync --locked --no-dev
-    sed -i 's/^name = ""$/name = "flatnotes"/' pyproject.toml
+    $STD npm ci
-    $STD /usr/local/bin/uvx migrate-to-uv
+    $STD npm run build
-    $STD /usr/local/bin/uv sync
     msg_ok "Updated Flatnotes"
 
     msg_info "Starting Service"

ct/headers/chatwoot

@@ -0,0 +1,6 @@
+   ________          __                       __ 
+  / ____/ /_  ____ _/ /__      ______  ____  / /_
+ / /   / __ \/ __ `/ __/ | /| / / __ \/ __ \/ __/
+/ /___/ / / / /_/ / /_ | |/ |/ / /_/ / /_/ / /_  
+\____/_/ /_/\__,_/\__/ |__/|__/\____/\____/\__/  
+                                                 

ct/headers/chevereto

@@ -0,0 +1,6 @@
+   ________                             __      
+  / ____/ /_  ___ _   _____  ________  / /_____ 
+ / /   / __ \/ _ \ | / / _ \/ ___/ _ \/ __/ __ \
+/ /___/ / / /  __/ |/ /  __/ /  /  __/ /_/ /_/ /
+\____/_/ /_/\___/|___/\___/_/   \___/\__/\____/ 
+                                                

ct/headers/decypharr

@@ -0,0 +1,6 @@
+    ____                        __                   
+   / __ \___  _______  ______  / /_  ____ ___________
+  / / / / _ \/ ___/ / / / __ \/ __ \/ __ `/ ___/ ___/
+ / /_/ /  __/ /__/ /_/ / /_/ / / / / /_/ / /  / /    
+/_____/\___/\___/\__, / .___/_/ /_/\__,_/_/  /_/     
+                /____/_/                             

ct/headers/journiv

@@ -0,0 +1,6 @@
+       __                       _      
+      / /___  __  ___________  (_)   __
+ __  / / __ \/ / / / ___/ __ \/ / | / /
+/ /_/ / /_/ / /_/ / /  / / / / /| |/ / 
+\____/\____/\__,_/_/  /_/ /_/_/ |___/  
+                                       

ct/headers/lemonade-server

@@ -0,0 +1,6 @@
+    __                                         __          _____                          
+   / /   ___  ____ ___  ____  ____  ____ _____/ /__       / ___/___  ______   _____  _____
+  / /   / _ \/ __ `__ \/ __ \/ __ \/ __ `/ __  / _ \______\__ \/ _ \/ ___/ | / / _ \/ ___/
+ / /___/  __/ / / / / / /_/ / / / / /_/ / /_/ /  __/_____/__/ /  __/ /   | |/ /  __/ /    
+/_____/\___/_/ /_/ /_/\____/_/ /_/\__,_/\__,_/\___/     /____/\___/_/    |___/\___/_/     
+                                                                                          

ct/headers/lingarr

@@ -0,0 +1,6 @@
+    __    _                            
+   / /   (_)___  ____ _____ ___________
+  / /   / / __ \/ __ `/ __ `/ ___/ ___/
+ / /___/ / / / / /_/ / /_/ / /  / /    
+/_____/_/_/ /_/\__, /\__,_/_/  /_/     
+              /____/                   

ct/headers/logseq

@@ -0,0 +1,6 @@
+    __                               
+   / /   ____  ____ _________  ____ _
+  / /   / __ \/ __ `/ ___/ _ \/ __ `/
+ / /___/ /_/ / /_/ (__  )  __/ /_/ / 
+/_____/\____/\__, /____/\___/\__, /  
+            /____/             /_/   

ct/headers/matter-hub

@@ -0,0 +1,6 @@
+    __  ___      __  __                  __  __      __  
+   /  |/  /___ _/ /_/ /____  _____      / / / /_  __/ /_ 
+  / /|_/ / __ `/ __/ __/ _ \/ ___/_____/ /_/ / / / / __ \
+ / /  / / /_/ / /_/ /_/  __/ /  /_____/ __  / /_/ / /_/ /
+/_/  /_/\__,_/\__/\__/\___/_/        /_/ /_/\__,_/_.___/ 
+                                                         

ct/headers/onetimesecret

@@ -0,0 +1,6 @@
+   ____           _______               _____                     __ 
+  / __ \____  ___/_  __(_)___ ___  ___ / ___/___  _____________  / /_
+ / / / / __ \/ _ \/ / / / __ `__ \/ _ \\__ \/ _ \/ ___/ ___/ _ \/ __/
+/ /_/ / / / /  __/ / / / / / / / /  __/__/ /  __/ /__/ /  /  __/ /_  
+\____/_/ /_/\___/_/ /_/_/ /_/ /_/\___/____/\___/\___/_/   \___/\__/  
+                                                                     

ct/headers/portabase

@@ -0,0 +1,6 @@
+    ____             __        __                  
+   / __ \____  _____/ /_____ _/ /_  ____ _________ 
+  / /_/ / __ \/ ___/ __/ __ `/ __ \/ __ `/ ___/ _ \
+ / ____/ /_/ / /  / /_/ /_/ / /_/ / /_/ (__  )  __/
+/_/    \____/_/   \__/\__,_/_.___/\__,_/____/\___/ 
+                                                   

ct/headers/safebucket

@@ -0,0 +1,6 @@
+   _____       ____     __               __        __ 
+  / ___/____ _/ __/__  / /_  __  _______/ /_____  / /_
+  \__ \/ __ `/ /_/ _ \/ __ \/ / / / ___/ //_/ _ \/ __/
+ ___/ / /_/ / __/  __/ /_/ / /_/ / /__/ ,< /  __/ /_  
+/____/\__,_/_/  \___/_.___/\__,_/\___/_/|_|\___/\__/  
+                                                      

ct/headers/stash

@@ -0,0 +1,6 @@
+   _____ __             __  
+  / ___// /_____ ______/ /_ 
+  \__ \/ __/ __ `/ ___/ __ \
+ ___/ / /_/ /_/ (__  ) / / /
+/____/\__/\__,_/____/_/ /_/ 
+                            

ct/headers/whisparr-eros

@@ -0,0 +1,6 @@
+ _       ____    _                                  ______               
+| |     / / /_  (_)________  ____ ___________      / ____/________  _____
+| | /| / / __ \/ / ___/ __ \/ __ `/ ___/ ___/_____/ __/ / ___/ __ \/ ___/
+| |/ |/ / / / / (__  ) /_/ / /_/ / /  / /  /_____/ /___/ /  / /_/ (__  ) 
+|__/|__/_/ /_/_/____/ .___/\__,_/_/  /_/        /_____/_/   \____/____/  
+                   /_/                                                   

ct/heimdall-dashboard.sh

@@ -37,12 +37,9 @@ function update_script() {
     sleep 1
     msg_ok "Stopped Service"
 
-    msg_info "Backing up Data"
+    create_backup /opt/Heimdall/database/app.sqlite
-    cp -R /opt/Heimdall/database database-backup
-    cp -R /opt/Heimdall/public public-backup
-    sleep 1
-    msg_ok "Backed up Data"
 
+    PHP_VERSION="8.4" PHP_FPM="YES" setup_php
     setup_composer
     fetch_and_deploy_gh_release "Heimdall" "linuxserver/Heimdall" "tarball"
 
@@ -52,20 +49,15 @@ function update_script() {
     rm -f bootstrap/cache/*.php
     export COMPOSER_ALLOW_SUPERUSER=1
     $STD composer install --no-dev --no-interaction --prefer-dist --optimize-autoloader
-    $STD php artisan optimize:clear
     msg_ok "Updated Heimdall-Dashboard"
 
-    msg_info "Restoring Data"
+    restore_backup
-    cd ~
-    cp -R database-backup/* /opt/Heimdall/database
-    cp -R public-backup/* /opt/Heimdall/public
-    sleep 1
-    msg_ok "Restored Data"
 
-    msg_info "Cleaning Up"
+    msg_info "Migrating Database"
-    rm -rf {public-backup,database-backup}
+    cd /opt/Heimdall
-    sleep 1
+    $STD php artisan migrate --force
-    msg_ok "Cleaned Up"
+    $STD php artisan optimize:clear
+    msg_ok "Migrated Database"
 
     msg_info "Starting Service"
     systemctl start heimdall.service

ct/hermesagent.sh

@@ -52,6 +52,16 @@ function update_script() {
     set -a; source /etc/default/hermes; set +a
     /home/hermes/.local/bin/hermes update --yes
   '
+  # See https://github.com/community-scripts/ProxmoxVE/issues/17123
+  mapfile -t root_gateway_pids < <(ps -eo user=,pid=,args= | awk '$1 == "root" && $0 ~ /\/home\/hermes\/\.hermes\/hermes-agent\/venv\/bin\/python -m hermes_cli\.main gateway run --replace$/ { print $2 }')
+  if ((${#root_gateway_pids[@]})); then
+    kill -TERM "${root_gateway_pids[@]}"
+    for pid in "${root_gateway_pids[@]}"; do
+      while kill -0 "$pid" 2>/dev/null; do
+        sleep 0.1
+      done
+    done
+  fi
   chown -R hermes:hermes /home/hermes
   msg_ok "Updated Hermes Agent"
 

ct/homepage.sh

@@ -83,6 +83,10 @@ EOF
       sed -i '/^ExecStart=/i Environment=CI=true' /etc/systemd/system/homepage.service
       systemctl daemon-reload
     fi
+    if grep -q '^ExecStart=pnpm start' /etc/systemd/system/homepage.service; then
+      sed -i 's|^ExecStart=pnpm start$|ExecStart=/opt/homepage/node_modules/.bin/next start|' /etc/systemd/system/homepage.service
+      systemctl daemon-reload
+    fi
     msg_ok "Updated Homepage"
 
     msg_info "Starting service"

ct/immich.sh

@@ -112,7 +112,7 @@ EOF
     msg_ok "Image-processing libraries up to date"
   fi
 
-  RELEASE="v3.1.0"
+  RELEASE="v3.2.0"
   if check_for_gh_release "Immich" "immich-app/immich" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
     if [[ $(cat ~/.immich) > "2.5.1" ]]; then
       msg_info "Enabling Maintenance Mode"
@@ -187,11 +187,10 @@ EOF
     msg_info "Updating Immich web and microservices"
     cd "$SRC_DIR"/server
     # server build
-    export SHARP_IGNORE_GLOBAL_LIBVIPS=true
     $STD pnpm --filter @immich/sdk --filter @immich/plugin-sdk --filter immich build
-    unset SHARP_IGNORE_GLOBAL_LIBVIPS
-    export SHARP_FORCE_GLOBAL_LIBVIPS=true
     $STD pnpm --filter immich --prod --no-optional deploy "$APP_DIR"
+    export SHARP_FORCE_GLOBAL_LIBVIPS=true
+    $STD pnpm --dir "$APP_DIR/node_modules/sharp" exec npm run build
 
     # Patch helmet.json: disable upgrade-insecure-requests for HTTP access
     if [[ -f "$APP_DIR/helmet.json" ]]; then
@@ -205,7 +204,6 @@ EOF
     cd "$SRC_DIR"
     echo "packageImportMethod: hardlink" >>./pnpm-workspace.yaml
     unset SHARP_FORCE_GLOBAL_LIBVIPS
-    export SHARP_IGNORE_GLOBAL_LIBVIPS=true
     $STD pnpm --filter @immich/sdk --filter immich-web --filter @immich/cli build
     $STD pnpm --filter @immich/cli --prod --no-optional deploy "$APP_DIR"/cli
     cp -a web/build "$APP_DIR"/www

ct/iobroker.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
 
-  NODE_VERSION="24" setup_nodejs
+  NODE_VERSION="26" NPM_VERSION="11" setup_nodejs
 
   msg_info "Updating ${APP} LXC"
   $STD apt update

ct/jellyfin.sh

@@ -64,7 +64,7 @@ function update_script() {
     ln -sf "/usr/lib/$(arch_resolve "x86_64-linux-gnu" "aarch64-linux-gnu")/libjemalloc.so.2" /usr/lib/libjemalloc.so
   fi
   $STD apt -y upgrade
-  $STD apt -y --with-new-pkgs upgrade jellyfin jellyfin-server jellyfin-ffmpeg7
+  $STD apt -y --with-new-pkgs upgrade jellyfin jellyfin-server jellyfin-ffmpeg8
   ln -sf /usr/lib/jellyfin-ffmpeg/ffmpeg /usr/bin/ffmpeg
   ln -sf /usr/lib/jellyfin-ffmpeg/ffprobe /usr/bin/ffprobe
   msg_ok "Updated Jellyfin"

ct/journiv.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/journiv/journiv-app
+
+APP="Journiv"
+var_tags="${var_tags:-journal;notes}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-12}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/journiv ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "journiv" "journiv/journiv-app"; then
+    msg_info "Stopping Services"
+    systemctl stop journiv journiv-worker journiv-beat
+    msg_ok "Stopped Services"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "journiv" "journiv/journiv-app" "tarball"
+
+    msg_info "Updating Python Environment"
+    cd /opt/journiv
+    $STD uv sync --locked --no-editable --no-install-project
+    msg_ok "Updated Python Environment"
+
+    msg_info "Running Database Migrations"
+    set -a
+    source /opt/journiv.env
+    set +a
+    $STD /opt/journiv/.venv/bin/python -c "from alembic.config import main; main(['upgrade', 'head'])"
+    msg_ok "Ran Database Migrations"
+
+    msg_info "Starting Services"
+    systemctl start journiv journiv-worker journiv-beat
+    msg_ok "Started Services"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8000${CL}"

ct/kaneo.sh

@@ -42,7 +42,7 @@ function update_script() {
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "kaneo" "usekaneo/kaneo" "tarball"
 
     PNPM_VERSION=$(sed -n 's/.*"packageManager": "pnpm@\([^"+]*\).*/\1/p' /opt/kaneo/package.json)
-    NODE_VERSION="22" NODE_MODULE="pnpm@${PNPM_VERSION:-10.32.1}" setup_nodejs
+    NODE_VERSION="24" NODE_MODULE="pnpm@${PNPM_VERSION:-10.32.1}" setup_nodejs
 
     restore_backup
 

ct/lemonade-server.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Jamie (jamiej)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/lemonade-sdk/lemonade
+
+APP="Lemonade-Server"
+var_tags="${var_tags:-ai}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-8192}"
+var_disk="${var_disk:-80}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+var_gpu="${var_gpu:-yes}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+  if ! command -v lemonade &>/dev/null; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "lemonade-server" "lemonade-sdk/lemonade"; then
+    msg_info "Stopping Service"
+    systemctl stop lemond
+    msg_ok "Stopped Service"
+
+    fetch_and_deploy_gh_release "lemonade-server" "lemonade-sdk/lemonade" "binary" "latest" "/tmp" "lemonade-server_*-debian13_$(arch_resolve).deb"
+
+    msg_info "Starting Service"
+    systemctl start lemond
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:13305${CL}"

ct/librechat.sh

@@ -45,7 +45,7 @@ function update_script() {
 
     msg_info "Installing Dependencies"
     cd /opt/librechat
-    $STD npm ci
+    $STD npm ci --allow-remote=all
     msg_ok "Installed Dependencies"
 
     msg_info "Building Frontend"

ct/lingarr.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/lingarr-translate/lingarr
+
+APP="Lingarr"
+var_tags="${var_tags:-arr;subtitles}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-16}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/lingarr ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "lingarr" "lingarr-translate/lingarr"; then
+    msg_info "Stopping Service"
+    systemctl stop lingarr
+    msg_ok "Stopped Service"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "lingarr" "lingarr-translate/lingarr" "tarball"
+
+    msg_info "Building Lingarr (Patience)"
+    cd /opt/lingarr/Lingarr.Client
+    $STD npm ci
+    $STD npm run build
+    mkdir -p /opt/lingarr/Lingarr.Server/wwwroot
+    cp -r /opt/lingarr/Lingarr.Client/dist/* /opt/lingarr/Lingarr.Server/wwwroot/
+    cd /opt/lingarr
+    export DOTNET_CLI_TELEMETRY_OPTOUT=1
+    rm -rf /opt/lingarr_app
+    $STD dotnet publish ./Lingarr.Server/Lingarr.Server.csproj -c Release -o /opt/lingarr_app /p:UseAppHost=false /p:Version="$(cat ~/.lingarr)"
+    msg_ok "Built Lingarr"
+
+    msg_info "Starting Service"
+    systemctl start lingarr
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:9876${CL}"
+echo -e "${INFO}${YW}Set your translation backend in /opt/lingarr.env${CL}"

ct/logseq.sh

@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://logseq.com/
+
+APP="Logseq"
+var_tags="${var_tags:-notes;knowledge-base}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-8192}"
+var_disk="${var_disk:-16}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/logseq ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "logseq" "logseq/logseq"; then
+    NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs
+    JAVA_VERSION="21" setup_java
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "logseq" "logseq/logseq" "tarball"
+
+    msg_info "Building Logseq Web App (Patience)"
+    cd /opt/logseq
+    export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+    export NODE_OPTIONS="--max-old-space-size=4096"
+    export JAVA_TOOL_OPTIONS="-Xmx4g"
+    $STD corepack enable
+    $STD pnpm install --config.network-timeout=240000
+    $STD pnpm release
+    msg_ok "Built Logseq Web App"
+
+    msg_info "Reloading Webserver"
+    systemctl reload nginx
+    msg_ok "Reloaded Webserver"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}${CL}"

ct/matter-hub.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/RiDDiX/home-assistant-matter-hub
+
+APP="Matter-Hub"
+var_tags="${var_tags:-smarthome;matter}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-12}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/matter-hub ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "matter-hub" "RiDDiX/home-assistant-matter-hub"; then
+    msg_info "Stopping Service"
+    systemctl stop matter-hub
+    msg_ok "Stopped Service"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "matter-hub" "RiDDiX/home-assistant-matter-hub" "tarball"
+
+    msg_info "Building Matter Hub"
+    cd /opt/matter-hub
+    MATTER_HUB_VERSION=$(cat ~/.matter-hub)
+    $STD pnpm install --frozen-lockfile
+    $STD pnpm run release:version "$MATTER_HUB_VERSION"
+    APP_VERSION="$MATTER_HUB_VERSION" $STD pnpm build
+    sed -i "s|^APP_VERSION=.*|APP_VERSION=${MATTER_HUB_VERSION}|" /opt/matter-hub.env
+    msg_ok "Built Matter Hub"
+
+    msg_info "Installing Matter Hub"
+    rm -rf /opt/matter-hub_app/node_modules /opt/matter-hub_app/package-lock.json
+    cd /opt/matter-hub_app
+    $STD npm install --omit=dev --no-audit --no-fund
+    msg_ok "Installed Matter Hub"
+
+    msg_info "Starting Service"
+    systemctl start matter-hub
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8482${CL}"

ct/mediamtx.sh

@@ -37,7 +37,9 @@ function update_script() {
     systemctl stop mediamtx
     msg_ok "Service stopped"
 
+    create_backup /opt/mediamtx/mediamtx.yml
     fetch_and_deploy_gh_release "mediamtx" "bluenviron/mediamtx" "prebuild" "latest" "/opt/mediamtx" "mediamtx*linux_$(arch_resolve).tar.gz"
+    restore_backup
 
     msg_info "Starting service"
     systemctl start mediamtx

ct/netboot-xyz.sh

@@ -58,6 +58,14 @@ function update_script() {
     USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-linux-bin" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-linux.bin"
     USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-dsk" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz.dsk"
     USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-pdsk" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz.pdsk"
+
+    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-efi" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.efi"
+    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-kpxe" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.kpxe"
+    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-lkrn" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.lkrn"
+    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-dsk" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.dsk"
+    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-pdsk" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.pdsk"
+    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-metal-legacy-efi" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-metal-legacy.efi"
+    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-metal-legacy-kpxe" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-metal-legacy.kpxe"
     USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-arm64" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-arm64.efi"
     USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-arm64-snp" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-arm64-snp.efi"
     USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-arm64-snponly" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-arm64-snponly.efi"
@@ -70,6 +78,12 @@ function update_script() {
     USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-arm64-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-arm64.img"
     USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-multiarch-iso" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-multiarch.iso"
     USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-multiarch-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-multiarch.img"
+    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-iso" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.iso"
+    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.img"
+    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-sb-iso" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sb.iso"
+    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-sb-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sb.img"
+    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-sb-arm64-iso" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sb-arm64.iso"
+    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-sb-arm64-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sb-arm64.img"
     USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-checksums" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sha256-checksums.txt"
 
     msg_info "Restoring Configuration"

ct/omnitools.sh

@@ -40,7 +40,7 @@ function update_script() {
     msg_info "Building OmniTools"
     cd /opt/omnitools
     export HUSKY=0
-    $STD npm ci
+    $STD npm ci --allow-remote=all
     $STD npm run build
     msg_ok "Built OmniTools"
 

ct/onetimesecret.sh

@@ -0,0 +1,101 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Hai Tran (epiHATR)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://onetimesecret.com/ | Github: https://github.com/onetimesecret/onetimesecret
+
+APP="OneTimeSecret"
+var_tags="${var_tags:-security;privacy;secrets}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  SSL_VALUE="${OTS_SSL:-}"
+  if [[ -n "${SSL_VALUE}" ]]; then
+    case "${SSL_VALUE,,}" in
+    1 | true | yes | on) SSL_VALUE="true" ;;
+    0 | false | no | off) SSL_VALUE="false" ;;
+    *)
+      msg_error "Invalid OTS_SSL value '${OTS_SSL}' (use true/false)"
+      exit 1
+      ;;
+    esac
+  fi
+
+  if [[ ! -d /opt/onetimesecret ]] || [[ ! -f /opt/onetimesecret/.env ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "onetimesecret" "onetimesecret/onetimesecret"; then
+    msg_info "Stopping Service"
+    systemctl stop onetimesecret
+    msg_ok "Stopped Service"
+
+    create_backup /opt/onetimesecret/.env
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "onetimesecret" "onetimesecret/onetimesecret" "tarball"
+    RUBY_VERSION=$(tr -d ' \n' </opt/onetimesecret/.ruby-version 2>/dev/null)
+    RUBY_VERSION="${RUBY_VERSION:-3.4.10}" setup_ruby
+
+    PNPM_VERSION=$(sed -n 's/.*"packageManager": "pnpm@\([^"]*\)".*/\1/p' /opt/onetimesecret/package.json)
+    NODE_VERSION=$(tr -d ' \n' </opt/onetimesecret/.nvmrc 2>/dev/null)
+    NODE_VERSION="${NODE_VERSION:-25}" NODE_MODULE="pnpm@${PNPM_VERSION:-11.1.2}" setup_nodejs
+
+    restore_backup
+
+    msg_info "Reconciling Application"
+    systemctl enable -q --now redis-server
+    cd /opt/onetimesecret
+    mkdir -p tmp/pids log
+    $STD bash bin/setup reconcile
+    msg_ok "Reconciled Application"
+
+    msg_info "Building Frontend"
+    cd /opt/onetimesecret
+    $STD pnpm run build
+    msg_ok "Built Frontend"
+
+    msg_info "Starting Service"
+    systemctl start onetimesecret
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+DISPLAY_HOST="${OTS_HOST:-$IP}"
+case "${OTS_SSL:-false,,}" in
+1 | true | yes | on)
+  DISPLAY_SCHEME="https"
+  ;;
+*)
+  DISPLAY_SCHEME="http"
+  ;;
+esac
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}${DISPLAY_SCHEME}://${DISPLAY_HOST}${CL}"

ct/pangolin.sh

@@ -63,7 +63,7 @@ function update_script() {
 
     msg_info "Updating Pangolin"
     cd /opt/pangolin
-    $STD npm ci
+    $STD npm ci --allow-remote=all
     $STD npm run set:pg
     $STD npm run set:oss
     rm -rf server/private

ct/paperclip.sh

@@ -43,6 +43,8 @@ function update_script() {
 
     restore_backup
 
+    setup_rust
+
     msg_info "Rebuilding Paperclip"
     cd /opt/paperclip-ai
     export HUSKY=0

ct/passwordpusher.sh

@@ -40,6 +40,9 @@ function update_script() {
     create_backup /opt/passwordpusher/storage /opt/passwordpusher/.env.production
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "passwordpusher" "pglombardo/PasswordPusher" "tarball"
+
+    restore_backup
+
     RUBY_VERSION="$(cat /opt/passwordpusher/.ruby-version)" RUBY_INSTALL_RAILS="false" setup_ruby
 
     msg_info "Installing Gem Dependencies"
@@ -62,8 +65,6 @@ function update_script() {
     RAILS_ENV=production SECRET_KEY_BASE_DUMMY=1 $STD bundle exec rails assets:precompile
     msg_ok "Precompiled Assets"
 
-    restore_backup
-
     msg_info "Starting Service"
     systemctl start passwordpusher
     msg_ok "Started Service"

ct/portabase.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://portabase.io
+
+APP="Portabase"
+var_tags="${var_tags:-database;backup}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-8192}"
+var_disk="${var_disk:-15}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/portabase ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "portabase" "Portabase/portabase"; then
+    msg_info "Stopping Services"
+    systemctl stop portabase portabase-tusd
+    msg_ok "Stopped Services"
+
+    create_backup /opt/portabase/.env
+
+    NODE_VERSION="22" NODE_MODULE="pnpm@11.8.0" setup_nodejs
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "portabase" "Portabase/portabase" "tarball"
+
+    restore_backup
+
+    msg_info "Building Portabase"
+    cd /opt/portabase
+    export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+    export NEXT_TELEMETRY_DISABLED=1
+    $STD pnpm install --frozen-lockfile
+    $STD pnpm run build
+    cp -r /opt/portabase/.next/static /opt/portabase/.next/standalone/.next/static
+    cp -r /opt/portabase/public /opt/portabase/.next/standalone/public
+    mkdir -p /opt/portabase/.next/standalone/src/db
+    cp -r /opt/portabase/src/db/migrations /opt/portabase/.next/standalone/src/db/migrations
+    ln -sf /opt/portabase/.env /opt/portabase/.next/standalone/.env
+    msg_ok "Built Portabase"
+
+    msg_info "Starting Services"
+    systemctl start portabase-tusd portabase
+    msg_ok "Started Services"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"

ct/poznote.sh

@@ -35,6 +35,7 @@ function update_script() {
   if check_for_gh_release "poznote" "timothepoznanski/poznote"; then
     msg_info "Stopping Service"
     systemctl stop nginx
+    systemctl stop poznote-reminder-worker poznote-s3-backup-worker 2>/dev/null || true
     msg_ok "Stopped Service"
 
     create_backup /var/www/html/data
@@ -48,8 +49,178 @@ function update_script() {
 
     restore_backup
 
+    msg_info "Running Poznote Initialization"
+    chmod +x /opt/poznote/init.sh
+    $STD /opt/poznote/init.sh
+    msg_ok "Initialized Poznote Data Directory"
+
+    msg_info "Updating Nginx Configuration"
+    [[ -f /etc/nginx/sites-available/poznote ]] && cp /etc/nginx/sites-available/poznote /etc/nginx/sites-available/poznote.bak
+    PHP_SOCK=$(get_php_fpm_socket)
+    cat <<EOF >/etc/nginx/sites-available/poznote
+# The Excalidraw editor must keep its window.opener relationship with
+# libraries.excalidraw.com so "Add to Excalidraw" can hand the chosen library
+# back to the already-open editor tab; COOP same-origin would sever it.
+map \$uri \$poznote_coop {
+    default                  "same-origin";
+    /excalidraw_editor.php   "unsafe-none";
+}
+
+server {
+    listen 8040;
+    root /var/www/html;
+    index index.php index.html;
+
+    gzip on;
+    gzip_comp_level 5;
+    gzip_min_length 1024;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_types text/css application/javascript text/javascript application/json
+               image/svg+xml application/manifest+json font/ttf font/otf;
+
+    location ~* \.webmanifest$ {
+        default_type application/manifest+json;
+        try_files \$uri =404;
+    }
+
+    client_max_body_size 800M;
+
+    location /api/v1 {
+        try_files \$uri \$uri/ /api/v1/index.php?\$query_string;
+    }
+
+    location = /api/health {
+        rewrite ^ /api_health.php last;
+    }
+
+    location = /api/info {
+        rewrite ^ /api_health.php last;
+    }
+
+    location / {
+        try_files \$uri \$uri/ @poznote_public;
+    }
+
+    location @poznote_public {
+        rewrite ^/folder/([^/]+)/?$ /public_folder.php?token=\$1 last;
+        rewrite ^/workspace/([^/]+)/?$ /public_note.php?token=\$1 last;
+        rewrite ^/([^/]+)/?$ /public_slug.php?slug=\$1 last;
+    }
+
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Cross-Origin-Opener-Policy \$poznote_coop always;
+    add_header Cross-Origin-Resource-Policy "same-origin" always;
+    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;
+
+    location ~* ^/data/.*\.(php[0-9]?|phtml|phar|pht)$ {
+        deny all;
+    }
+
+    location ~ \.php$ {
+        include fastcgi_params;
+        fastcgi_pass unix:${PHP_SOCK};
+        fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
+        fastcgi_param DOCUMENT_ROOT \$document_root;
+        fastcgi_param PATH_INFO \$fastcgi_path_info;
+
+        fastcgi_param HTTP_X_FORWARDED_FOR \$http_x_forwarded_for;
+        fastcgi_param HTTP_X_FORWARDED_PROTO \$http_x_forwarded_proto;
+        fastcgi_param HTTP_X_FORWARDED_HOST \$http_x_forwarded_host;
+        fastcgi_param HTTP_X_FORWARDED_PORT \$http_x_forwarded_port;
+        fastcgi_param HTTP_X_REAL_IP \$http_x_real_ip;
+        fastcgi_param HTTPS \$https if_not_empty;
+
+        # fastcgi_read_timeout 600;
+        # fastcgi_send_timeout 600;
+        # Left at nginx's 60s default, not Docker's 600s:
+        # a stalled git-sync request can hold the PHP session lock, otherwise
+    }
+
+    location ~ /\. {
+        deny all;
+    }
+
+    location ~ ^/data/users/[0-9]+/backgrounds/ {
+        try_files \$uri =404;
+    }
+
+    location ~ ^/data/css/[A-Za-z0-9._-]+\.css$ {
+        try_files \$uri =404;
+    }
+
+    location ~ ^/(data|config)/ {
+        deny all;
+    }
+
+    location ~* ^/pwa/poznote(-[0-9]+)?\.png$ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Cross-Origin-Resource-Policy "cross-origin" always;
+        try_files \$uri =404;
+    }
+
+    location ~* \.(?:js|css|png|jpg|jpeg|gif|svg|ico|woff2?|ttf|otf|eot|webp|webmanifest)$ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Cross-Origin-Resource-Policy "same-origin" always;
+        try_files \$uri =404;
+    }
+}
+EOF
+    msg_ok "Updated Nginx Configuration"
+
+    if [[ ! -f /etc/systemd/system/poznote-reminder-worker.service ]]; then
+      msg_info "Creating Reminder Worker Service"
+      cat <<EOF >/etc/systemd/system/poznote-reminder-worker.service
+[Unit]
+Description=Poznote Reminder Email Worker
+After=network.target
+
+[Service]
+Type=simple
+User=www-data
+Group=www-data
+Restart=always
+ExecStart=/usr/bin/php /var/www/html/workers/reminder-email-worker.php
+WorkingDirectory=/var/www/html
+
+[Install]
+WantedBy=multi-user.target
+EOF
+      systemctl daemon-reload
+      msg_ok "Created Reminder Worker Service"
+    fi
+
+    if [[ ! -f /etc/systemd/system/poznote-s3-backup-worker.service ]]; then
+      msg_info "Creating S3 Backup Worker Service"
+      cat <<EOF >/etc/systemd/system/poznote-s3-backup-worker.service
+[Unit]
+Description=Poznote S3 Backup Worker
+After=network.target
+
+[Service]
+Type=simple
+User=www-data
+Group=www-data
+Restart=always
+ExecStart=/usr/bin/php /var/www/html/workers/s3-backup-worker.php
+WorkingDirectory=/var/www/html
+
+[Install]
+WantedBy=multi-user.target
+EOF
+      systemctl daemon-reload
+      msg_ok "Created S3 Backup Worker Service"
+    fi
+
     msg_info "Starting Service"
     systemctl start nginx
+    systemctl enable -q --now poznote-reminder-worker poznote-s3-backup-worker
     msg_ok "Started Service"
     msg_ok "Updated successfully!"
   fi

ct/reactive-resume.sh

@@ -55,7 +55,7 @@ function update_script() {
     msg_ok "Updated Reactive Resume"
 
     msg_info "Updating Service"
-    sed -i 's|WorkingDirectory=/opt/reactive-resume/apps/web|WorkingDirectory=/opt/reactive-resume/apps/server|; s|ExecStart=/usr/bin/node .output/server/index.mjs|ExecStart=/usr/bin/node dist/index.mjs|' /etc/systemd/system/reactive-resume.service
+    sed -i -E 's|^WorkingDirectory=/opt/reactive-resume(/.*)?$|WorkingDirectory=/opt/reactive-resume/apps/server|; s|ExecStart=/usr/bin/node .output/server/index.mjs|ExecStart=/usr/bin/node dist/index.mjs|' /etc/systemd/system/reactive-resume.service
     systemctl daemon-reload
     msg_ok "Updated Service"
 

ct/romm.sh

@@ -51,6 +51,7 @@ function update_script() {
       /opt/romm/frontend/dist/assets/ruffle
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "romm" "rommapp/romm" "tarball" "latest" "/opt/romm"
+    echo "__version__ = \"$(cat ~/.romm)\"" >/opt/romm/backend/__version__.py
 
     find /opt/romm/backend/alembic/versions -maxdepth 1 -type f -name '1.*.py' -delete 2>/dev/null || true
     find /opt/romm/backend/alembic/versions -maxdepth 1 -type f -name '2.0.0_.py' -delete 2>/dev/null || true

ct/safebucket.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: renizmy
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/safebucket/safebucket
+
+APP="Safebucket"
+var_tags="${var_tags:-files;sharing}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-1024}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /opt/safebucket/safebucket ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit 1
+  fi
+
+  if check_for_gh_release "safebucket" "safebucket/safebucket"; then
+    msg_info "Stopping Service"
+    systemctl stop safebucket
+    msg_ok "Stopped Service"
+
+    create_backup /opt/safebucket/config.yaml /opt/safebucket/data/
+    fetch_and_deploy_gh_release "safebucket" "safebucket/safebucket" "singlefile" "latest" "/opt/safebucket" "safebucket-linux-$(arch_resolve)"
+    restore_backup
+
+    msg_info "Configuring Safebucket"
+    chown -R safebucket:safebucket /opt/safebucket
+    msg_ok "Configured Safebucket"
+
+    msg_info "Starting Service"
+    systemctl start safebucket
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:8080${CL}"

ct/shlink.sh

@@ -61,7 +61,12 @@ function update_script() {
 
   if [[ -d /opt/shlink-web-client ]]; then
     if check_for_gh_release "shlink-web-client" "shlinkio/shlink-web-client"; then
+      create_backup /opt/shlink-web-client/servers.json
+
       CLEAN_INSTALL=1 fetch_and_deploy_gh_release "shlink-web-client" "shlinkio/shlink-web-client" "prebuild" "latest" "/opt/shlink-web-client" "shlink-web-client_*_dist.zip"
+
+      restore_backup
+
       msg_ok "Updated Web Client"
     fi
   fi

ct/snapotter.sh

@@ -88,6 +88,13 @@ EOF
     msg_info "Updating SnapOtter"
     $STD uv python install 3.11
     $STD uv venv --seed --python 3.11 /opt/snapotter_data/ai/venv
+    if [[ "$(arch_resolve)" == "arm64" ]]; then
+      $STD uv pip install --python /opt/snapotter_data/ai/venv/bin/python \
+        numpy==1.26.4 Pillow==12.3.0 opencv-python-headless==4.10.0.84 fonttools \
+        'huggingface-hub[hf_xet,hf_transfer]==0.36.2'
+    else
+      msg_warn "SnapOtter AI Features have no working CPU-only bundle for amd64 upstream (published bundle is Python 3.12/GPU-CUDA only). Use the official Docker image instead: https://docs.snapotter.com"
+    fi
     ln -sfn /opt/snapotter /app
     msg_ok "Updated SnapOtter"
 

ct/solidtime.sh

@@ -45,7 +45,7 @@ function update_script() {
 
     msg_info "Updating Application"
     cd /opt/solidtime
-    $STD composer install --no-dev --optimize-autoloader
+    COMPOSER_ALLOW_SUPERUSER=1 $STD composer install --no-dev --optimize-autoloader
     $STD npm install
     $STD npm run build
     $STD php artisan migrate --force

ct/sonarqube.sh

@@ -54,6 +54,7 @@ function update_script() {
     cp -rp ${BACKUP_DIR}/extensions/ /opt/sonarqube/extensions/
     cp -p ${BACKUP_DIR}/conf/sonar.properties /opt/sonarqube/conf/sonar.properties
     rm -rf ${BACKUP_DIR}
+    chmod +x /opt/sonarqube/bin/linux-x86-64/sonar.sh
     chown -R sonarqube:sonarqube /opt/sonarqube
     msg_ok "Restored Backup"
 

ct/stash.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/stashapp/stash
+
+APP="Stash"
+var_tags="${var_tags:-media;organizer}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_gpu="${var_gpu:-yes}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/stash ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "stash" "stashapp/stash"; then
+    msg_info "Stopping Service"
+    systemctl stop stash
+    msg_ok "Stopped Service"
+
+    fetch_and_deploy_gh_release "stash" "stashapp/stash" "singlefile" "latest" "/opt/stash" "$(arch_resolve stash-linux stash-linux-arm64v8)"
+
+    msg_info "Starting Service"
+    systemctl start stash
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:9999${CL}"

ct/tolgee.sh

@@ -37,6 +37,8 @@ function update_script() {
     systemctl stop tolgee
     msg_ok "Stopped Service"
 
+    JAVA_VERSION="25" setup_java
+
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "tolgee" "tolgee/tolgee-platform" "singlefile" "latest" "/opt/tolgee" "tolgee-*.jar"
     find /opt/tolgee -maxdepth 1 -type f -name 'tolgee-*.jar' -exec mv {} /opt/tolgee/tolgee.jar \;
 

ct/whisparr-eros.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: angusmaul
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Whisparr/Whisparr-Eros
+
+APP="Whisparr-Eros"
+var_tags="${var_tags:-arr}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /var/lib/whisparr-eros ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "whisparr-eros" "Whisparr/Whisparr-Eros"; then
+    msg_info "Stopping Service"
+    systemctl stop whisparr-eros
+    msg_ok "Stopped Service"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "whisparr-eros" "Whisparr/Whisparr-Eros" "prebuild" "latest" "/opt/Whisparr-Eros" "Whisparr.eros.*.linux-$(arch_resolve "x64" "arm64").tar.gz"
+    rm -rf /opt/Whisparr-Eros/Whisparr.Update
+    chmod +x /opt/Whisparr-Eros/Whisparr
+
+    msg_info "Starting Service"
+    systemctl start whisparr-eros
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:6969${CL}"

install/authentik-install.sh

@@ -58,7 +58,7 @@ PG_VERSION="17" setup_postgresql
 PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db
 
 XMLSEC_VERSION="1.3.12"
-AUTHENTIK_VERSION="version/2026.8.1"
+AUTHENTIK_VERSION="version/2026.8.2"
 fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec"
 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
 GO_VERSION="$(grep -m1 '^go ' /opt/authentik/go.mod | awk '{print $2}')" setup_go

install/baserow-install.sh

@@ -45,7 +45,7 @@ msg_ok "Installed Backend Dependencies"
 
 msg_info "Building Frontend"
 cd /opt/baserow/web-frontend
-NODE_OPTIONS="--max-old-space-size=4096" $STD npm install --legacy-peer-deps
+NODE_OPTIONS="--max-old-space-size=4096" $STD npm install --legacy-peer-deps --allow-remote=all
 NODE_OPTIONS="--max-old-space-size=4096" $STD npm run build
 msg_ok "Built Frontend"
 

install/bentopdf-install.sh

@@ -24,7 +24,7 @@ fetch_and_deploy_gh_release "bentopdf" "alam00000/bentopdf" "tarball" "latest" "
 
 msg_info "Setup BentoPDF"
 cd /opt/bentopdf
-$STD npm ci --no-audit --no-fund
+$STD npm ci --no-audit --no-fund --allow-remote=all
 cp ./.env.example ./.env.production
 export NODE_OPTIONS="--max-old-space-size=3072"
 export SIMPLE_MODE=true

install/calibre-web-install.sh

@@ -32,7 +32,7 @@ msg_info "Installing Calibre (for eBook conversion)"
 $STD apt install -y calibre
 msg_ok "Installed Calibre"
 
-fetch_and_deploy_gh_release "Calibre-Web" "janeczku/calibre-web" "prebuild" "latest" "/opt/calibre-web" "calibreweb*.tar.gz"
+fetch_and_deploy_gh_release "calibreweb" "janeczku/calibre-web" "prebuild" "latest" "/opt/calibre-web" "calibreweb*.tar.gz"
 setup_uv
 
 msg_info "Installing Python Dependencies"

install/changedetection-install.sh

@@ -62,6 +62,7 @@ mkdir /opt/browserless
 $STD /opt/changedetection/.venv/bin/python -m pip install playwright
 $STD git clone https://github.com/browserless/chrome /opt/browserless
 $STD npm ci --include=optional --include=dev --prefix /opt/browserless
+$STD npm install --save-exact playwright-core@1.62.1 --prefix /opt/browserless
 $STD /opt/browserless/node_modules/playwright-core/cli.js install --with-deps &>/dev/null
 $STD /opt/browserless/node_modules/playwright-core/cli.js install --force chrome &>/dev/null
 $STD /opt/browserless/node_modules/playwright-core/cli.js install chromium firefox webkit &>/dev/null

install/chatwoot-install.sh

@@ -0,0 +1,130 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.chatwoot.com/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  build-essential \
+  git \
+  imagemagick \
+  libpq-dev \
+  libvips42 \
+  pkg-config \
+  redis-server
+msg_ok "Installed Dependencies"
+
+PG_VERSION="17" PG_MODULES="pgvector" setup_postgresql
+PG_DB_NAME="chatwoot_production" PG_DB_USER="chatwoot" PG_DB_EXTENSIONS="vector,pg_stat_statements" setup_postgresql_db
+
+fetch_and_deploy_gh_release "chatwoot" "chatwoot/chatwoot" "tarball"
+
+RUBY_VERSION=$(tr -d ' \n' </opt/chatwoot/.ruby-version)
+RUBY_VERSION="${RUBY_VERSION}" RUBY_INSTALL_RAILS="false" setup_ruby
+NODE_VERSION=$(grep -oP '"node":\s*"\K[0-9]+' /opt/chatwoot/package.json)
+NODE_VERSION="${NODE_VERSION}" NODE_MODULE="pnpm" setup_nodejs
+export PATH="$HOME/.rbenv/shims:$HOME/.rbenv/bin:$PATH"
+
+msg_info "Installing Application Dependencies"
+cd /opt/chatwoot
+$STD bundle config set --local without 'development test'
+$STD bundle config set --local deployment 'true'
+$STD bundle install
+$STD pnpm install --frozen-lockfile
+msg_ok "Installed Application Dependencies"
+
+msg_info "Configuring Chatwoot"
+SECRET_KEY_BASE=$(openssl rand -hex 64)
+mkdir -p /opt/chatwoot/storage
+cat <<EOF >/opt/chatwoot/.env
+RAILS_ENV=production
+NODE_ENV=production
+RAILS_LOG_TO_STDOUT=true
+SECRET_KEY_BASE=${SECRET_KEY_BASE}
+FRONTEND_URL=http://${LOCAL_IP}:3000
+FORCE_SSL=false
+ENABLE_ACCOUNT_SIGNUP=false
+
+POSTGRES_HOST=127.0.0.1
+POSTGRES_PORT=5432
+POSTGRES_DATABASE=${PG_DB_NAME}
+POSTGRES_USERNAME=${PG_DB_USER}
+POSTGRES_PASSWORD=${PG_DB_PASS}
+REDIS_URL=redis://127.0.0.1:6379
+
+ACTIVE_STORAGE_SERVICE=local
+EOF
+ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=$(openssl rand -hex 32)
+ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=$(openssl rand -hex 32)
+ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=$(openssl rand -hex 32)
+cat <<EOF >>/opt/chatwoot/.env
+ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=${ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY}
+ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=${ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY}
+ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=${ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT}
+EOF
+chmod 640 /opt/chatwoot/.env
+msg_ok "Configured Chatwoot"
+
+msg_info "Preparing Database"
+RAILS_ENV=production $STD bundle exec rails db:chatwoot_prepare
+msg_ok "Prepared Database"
+
+msg_info "Precompiling Assets"
+RAILS_ENV=production NODE_OPTIONS="--max-old-space-size=4096" $STD bundle exec rails assets:precompile
+msg_ok "Precompiled Assets"
+
+msg_info "Creating Services"
+cat <<EOF >/etc/systemd/system/chatwoot-web.service
+[Unit]
+Description=Chatwoot Web
+After=network.target postgresql.service redis-server.service
+Requires=postgresql.service redis-server.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/chatwoot
+EnvironmentFile=/opt/chatwoot/.env
+Environment=PATH=/root/.rbenv/shims:/root/.rbenv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+ExecStart=/root/.rbenv/shims/bundle exec rails server -p 3000 -e production
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+cat <<EOF >/etc/systemd/system/chatwoot-worker.service
+[Unit]
+Description=Chatwoot Worker
+After=network.target postgresql.service redis-server.service
+Requires=postgresql.service redis-server.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/chatwoot
+EnvironmentFile=/opt/chatwoot/.env
+Environment=PATH=/root/.rbenv/shims:/root/.rbenv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+ExecStart=/root/.rbenv/shims/bundle exec sidekiq -C config/sidekiq.yml
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now chatwoot-web chatwoot-worker redis-server
+msg_ok "Created Services"
+
+motd_ssh
+customize
+cleanup_lxc

install/chevereto-install.sh

@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://chevereto.com/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  nginx \
+  exiftran \
+  libimage-exiftool-perl
+msg_ok "Installed Dependencies"
+
+PHP_VERSION="8.3" PHP_FPM="YES" PHP_UPLOAD_MAX_FILESIZE="512M" PHP_POST_MAX_SIZE="512M" PHP_MAX_EXECUTION_TIME="600" setup_php
+setup_composer
+setup_mariadb
+setup_ffmpeg
+MARIADB_DB_NAME="chevereto" MARIADB_DB_USER="chevereto" setup_mariadb_db
+
+fetch_and_deploy_gh_release "chevereto" "chevereto/chevereto" "tarball"
+
+msg_info "Installing Chevereto Dependencies"
+cd /opt/chevereto/app
+export COMPOSER_ALLOW_SUPERUSER=1
+$STD composer install --no-dev --prefer-dist --no-interaction --optimize-autoloader
+msg_ok "Installed Chevereto Dependencies"
+
+msg_info "Configuring Chevereto"
+cat <<EOF >/opt/chevereto/app/env.php
+<?php
+
+return [
+    'CHEVERETO_DB_HOST' => 'localhost',
+    'CHEVERETO_DB_PORT' => '3306',
+    'CHEVERETO_DB_NAME' => '${MARIADB_DB_NAME}',
+    'CHEVERETO_DB_USER' => '${MARIADB_DB_USER}',
+    'CHEVERETO_DB_PASS' => '${MARIADB_DB_PASS}',
+    'CHEVERETO_DB_TABLE_PREFIX' => 'chv_',
+    'CHEVERETO_HOSTNAME' => '${LOCAL_IP}',
+];
+EOF
+chown -R www-data:www-data /opt/chevereto
+chmod -R 775 /opt/chevereto/images /opt/chevereto/content
+msg_ok "Configured Chevereto"
+
+msg_info "Configuring Nginx"
+cat <<'EOF' >/etc/nginx/sites-available/chevereto
+server {
+    listen 80;
+    server_name _;
+    root /opt/chevereto;
+    index index.php;
+
+    charset utf-8;
+    client_max_body_size 512M;
+
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options "nosniff";
+
+    location / {
+        try_files $uri $uri/ /index.php$is_args$args;
+    }
+
+    location = /favicon.ico { access_log off; log_not_found off; }
+    location = /robots.txt  { access_log off; log_not_found off; }
+
+    location ~* ^/images/.+\.(gif|jpe?g|png|bmp|webp)$ {
+        try_files $uri =404;
+    }
+
+    location = /index.php {
+        include fastcgi_params;
+        fastcgi_pass unix:__PHP_FPM_SOCK__;
+        fastcgi_param SCRIPT_FILENAME $document_root/index.php;
+        fastcgi_read_timeout 600;
+    }
+
+    location ~ \.php$ {
+        deny all;
+    }
+
+    location ^~ /app/ {
+        deny all;
+    }
+
+    location ~ /\.(?!well-known).* {
+        deny all;
+    }
+}
+EOF
+sed -i "s|__PHP_FPM_SOCK__|$(get_php_fpm_socket)|" /etc/nginx/sites-available/chevereto
+nginx_enable_site chevereto
+msg_ok "Configured Nginx"
+
+motd_ssh
+customize
+cleanup_lxc

install/cryptpad-install.sh

@@ -24,7 +24,7 @@ fetch_and_deploy_gh_release "cryptpad" "cryptpad/cryptpad" "tarball"
 
 msg_info "Setup CryptPad"
 cd /opt/cryptpad
-$STD npm ci
+$STD npm ci --allow-git=all
 $STD npm run install:components
 if [[ "$onlyoffice" =~ ^[Yy]$ ]]; then
   $STD bash -c "./install-onlyoffice.sh --accept-license"

install/decypharr-install.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/sirrobot01/decypharr
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y fuse3
+msg_ok "Installed Dependencies"
+
+fetch_and_deploy_gh_release "decypharr" "sirrobot01/decypharr" "prebuild" "latest" "/opt/decypharr" "decypharr_Linux_$(arch_resolve x86_64 arm64).tar.gz"
+chmod +x /opt/decypharr/decypharr
+
+msg_info "Creating Service"
+mkdir -p /opt/decypharr_data
+cat <<EOF >/etc/systemd/system/decypharr.service
+[Unit]
+Description=Decypharr
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/decypharr
+ExecStart=/opt/decypharr/decypharr --config /opt/decypharr_data
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now decypharr
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/fileflows-install.sh

@@ -45,7 +45,7 @@ $STD ln -svf /usr/bin/ffmpeg /usr/local/bin/ffmpeg
 $STD ln -svf /usr/bin/ffprobe /usr/local/bin/ffprobe
 $STD rm -rf /opt/fileflows/Server/runtimes/win-*
 
-read -r -p "${TAB3}Do you want to install FileFlows Server or Node? (S/N): " install_server
+read -r -p "${TAB3}Do you want to install FileFlows Server or Agent? (S/A): " install_server
 
 if [[ "$install_server" =~ ^[Ss]$ ]]; then
   msg_info "Installing FileFlows Server"
@@ -54,15 +54,23 @@ if [[ "$install_server" =~ ^[Ss]$ ]]; then
   systemctl enable -q --now fileflows
   msg_ok "Installed FileFlows Server"
 else
-  msg_info "Installing FileFlows Node"
+  msg_info "Installing FileFlows Agent"
+  stop_spinner
   read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url
   while [[ -z "${server_url// /}" ]]; do
     read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url
   done
-  cd /opt/fileflows/Node
+  cd /opt/fileflows/Agent
-  $STD dotnet FileFlows.Node.dll --server "$server_url" --systemd install --root true
+  before_units="$(systemctl list-unit-files 'fileflows*' --no-legend 2>/dev/null | awk '{print $1}' | sort || true)"
-  systemctl enable -q --now fileflows-node
+  $STD dotnet FileFlows.Agent.dll --server "$server_url" --systemd install --root true
-  msg_ok "Installed FileFlows Node"
+  after_units="$(systemctl list-unit-files 'fileflows*' --no-legend 2>/dev/null | awk '{print $1}' | sort || true)"
+  agent_unit="$(comm -13 <(echo "$before_units") <(echo "$after_units") | head -n1)"
+  if [[ -n "$agent_unit" ]]; then
+    systemctl enable -q --now "$agent_unit"
+  else
+    msg_warn "Could not detect the FileFlows Agent systemd unit; start it manually (systemctl list-unit-files 'fileflows*')."
+  fi
+  msg_ok "Installed FileFlows Agent"
 fi
 
 motd_ssh

install/flatnotes-install.sh

@@ -14,17 +14,14 @@ network_check
 update_os
 
 fetch_and_deploy_gh_release "flatnotes" "dullage/flatnotes" "tarball"
-USE_UVX="YES" setup_uv
+PYTHON_VERSION="3.13" setup_uv
-NODE_VERSION="22" setup_nodejs
+NODE_VERSION="24" setup_nodejs
 
 msg_info "Setting up Flatnotes"
 cd /opt/flatnotes
-sed -i 's/^name = ""$/name = "flatnotes"/' pyproject.toml
+$STD uv sync --locked --no-dev
-$STD /usr/local/bin/uvx migrate-to-uv
-$STD /usr/local/bin/uv sync
 mkdir -p /opt/flatnotes/data
-cd /opt/flatnotes/client
+$STD npm ci
-$STD npm install
 $STD npm run build
 
 cat <<EOF >/opt/flatnotes/.env

install/frigate-install.sh

@@ -362,6 +362,7 @@ Restart=always
 RestartSec=1
 User=root
 EnvironmentFile=/etc/frigate.env
+ExecStartPre=+/usr/bin/systemctl restart go2rtc.service
 ExecStartPre=+rm -f /dev/shm/logs/frigate/current
 ExecStart=/bin/bash -c "bash /opt/frigate/docker/main/rootfs/etc/s6-overlay/s6-rc.d/frigate/run 2> >(/usr/bin/ts '%%Y-%%m-%%d %%H:%%M:%%.S ' >&2) | /usr/bin/ts '%%Y-%%m-%%d %%H:%%M:%%.S '"
 StandardOutput=file:/dev/shm/logs/frigate/current

install/homepage-install.sh

@@ -64,7 +64,7 @@ RestartSec=1
 User=root
 WorkingDirectory=/opt/homepage/
 Environment=CI=true
-ExecStart=pnpm start
+ExecStart=/opt/homepage/node_modules/.bin/next start
 
 [Install]
 WantedBy=multi-user.target

install/immich-install.sh

@@ -353,7 +353,7 @@ ML_DIR="${APP_DIR}/machine-learning"
 GEO_DIR="${INSTALL_DIR}/geodata"
 mkdir -p {"${APP_DIR}","${UPLOAD_DIR}","${GEO_DIR}","${INSTALL_DIR}"/cache}
 
-fetch_and_deploy_gh_release "Immich" "immich-app/immich" "tarball" "v3.1.0" "$SRC_DIR"
+fetch_and_deploy_gh_release "Immich" "immich-app/immich" "tarball" "v3.2.0" "$SRC_DIR"
 PNPM_VERSION="$(jq -r '.packageManager | split("@")[1] | split("+")[0]' ${SRC_DIR}/package.json)"
 export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
 NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs
@@ -370,11 +370,10 @@ export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
 export CI=1
 
 # server build
-export SHARP_IGNORE_GLOBAL_LIBVIPS=true
 $STD pnpm --filter @immich/sdk --filter @immich/plugin-sdk --filter immich build
-unset SHARP_IGNORE_GLOBAL_LIBVIPS
-export SHARP_FORCE_GLOBAL_LIBVIPS=true
 $STD pnpm --filter immich --prod --no-optional deploy "$APP_DIR"
+export SHARP_FORCE_GLOBAL_LIBVIPS=true
+$STD pnpm --dir "$APP_DIR/node_modules/sharp" exec npm run build
 
 # Patch helmet.json: disable upgrade-insecure-requests for HTTP access
 if [[ -f "$APP_DIR/helmet.json" ]]; then
@@ -388,7 +387,6 @@ sed -i "s|^start|${APP_DIR}/bin/start|" "$APP_DIR"/bin/immich-admin
 cd "$SRC_DIR"
 echo "packageImportMethod: hardlink" >>./pnpm-workspace.yaml
 unset SHARP_FORCE_GLOBAL_LIBVIPS
-export SHARP_IGNORE_GLOBAL_LIBVIPS=true
 $STD pnpm --filter @immich/sdk --filter immich-web --filter @immich/cli build
 $STD pnpm --filter @immich/cli --prod --no-optional deploy "$APP_DIR"/cli
 cp -a web/build "$APP_DIR"/www

install/iobroker-install.sh

@@ -28,7 +28,7 @@ if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
   exit 10
 fi
 
-NODE_VERSION="24" setup_nodejs
+NODE_VERSION="26" NPM_VERSION="11" setup_nodejs
 
 msg_info "Installing ioBroker (Patience)"
 $STD bash <(curl -fsSL https://iobroker.net/install.sh)

install/iventoy-install.sh

@@ -31,8 +31,8 @@ Environment=IVENTOY_API_ALL=1
 Environment=IVENTOY_AUTO_RUN=1
 Environment=LIBRARY_PATH=/opt/iventoy/lib/lin64
 Environment=LD_LIBRARY_PATH=/opt/iventoy/lib/lin64
-ExecStart=/bin/sh /opt/iventoy/iventoy.sh -R start
+ExecStart=/bin/bash /opt/iventoy/iventoy.sh -R start
-ExecStop=/bin/sh /opt/iventoy/iventoy.sh stop
+ExecStop=/bin/bash /opt/iventoy/iventoy.sh stop
 Restart=on-failure
 RestartSec=5
 

install/jellyfin-install.sh

@@ -33,7 +33,7 @@ setup_deb822_repo \
 msg_ok "Set up Jellyfin Repository"
 
 msg_info "Installing Jellyfin"
-ensure_dependencies jellyfin jellyfin-ffmpeg7
+ensure_dependencies jellyfin jellyfin-ffmpeg8
 ln -sf /usr/lib/jellyfin-ffmpeg/ffmpeg /usr/bin/ffmpeg
 ln -sf /usr/lib/jellyfin-ffmpeg/ffprobe /usr/bin/ffprobe
 msg_ok "Installed Jellyfin"

install/journiv-install.sh

@@ -0,0 +1,131 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/journiv/journiv-app
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  build-essential \
+  libffi-dev \
+  libpq-dev \
+  libmagic1 \
+  libheif1 \
+  libde265-0 \
+  libpango-1.0-0 \
+  libpangoft2-1.0-0 \
+  redis-server
+systemctl enable -q --now redis-server
+msg_ok "Installed Dependencies"
+
+setup_ffmpeg
+PG_VERSION="17" setup_postgresql
+PG_DB_NAME="journiv" PG_DB_USER="journiv" setup_postgresql_db
+UV_PYTHON="3.12" setup_uv
+
+fetch_and_deploy_gh_release "journiv" "journiv/journiv-app" "tarball"
+
+msg_info "Setting up Python Environment"
+cd /opt/journiv
+$STD uv sync --locked --no-editable --no-install-project
+msg_ok "Set up Python Environment"
+
+msg_info "Configuring Journiv"
+mkdir -p /opt/journiv_data/{media,logs,exports,imports/temp}
+cat <<EOF >/opt/journiv.env
+ENVIRONMENT=production
+SECRET_KEY=$(openssl rand -hex 32)
+DB_DRIVER=postgres
+DATABASE_URL=postgresql://journiv:${PG_DB_PASS}@localhost:5432/journiv
+REDIS_URL=redis://127.0.0.1:6379/0
+MEDIA_ROOT=/opt/journiv_data/media
+LOG_DIR=/opt/journiv_data/logs
+EXPORT_DIR=/opt/journiv_data/exports
+IMPORT_TEMP_DIR=/opt/journiv_data/imports/temp
+DOMAIN_NAME=${LOCAL_IP}
+DOMAIN_SCHEME=http
+PYTHONPATH=/opt/journiv
+EOF
+chmod 600 /opt/journiv.env
+msg_ok "Configured Journiv"
+
+msg_info "Initializing Database"
+set -a
+source /opt/journiv.env
+set +a
+$STD /opt/journiv/.venv/bin/python -c "from alembic.config import main; main(['upgrade', 'head'])"
+SKIP_DATA_SEEDING=false $STD /opt/journiv/.venv/bin/python -c "from app.core.database import seed_initial_data; seed_initial_data()"
+msg_ok "Initialized Database"
+
+msg_info "Creating Services"
+cat <<EOF >/etc/systemd/system/journiv.service
+[Unit]
+Description=Journiv
+Wants=network-online.target
+After=network-online.target postgresql.service redis-server.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/journiv
+EnvironmentFile=/opt/journiv.env
+ExecStart=/opt/journiv/.venv/bin/python -m gunicorn app.main:app -w 2 -k uvicorn.workers.UvicornWorker --timeout 300 -b 0.0.0.0:8000
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+cat <<EOF >/etc/systemd/system/journiv-worker.service
+[Unit]
+Description=Journiv Celery Worker
+Wants=network-online.target
+After=network-online.target journiv.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/journiv
+EnvironmentFile=/opt/journiv.env
+ExecStart=/opt/journiv/.venv/bin/python -m celery -A app.core.celery_app worker --loglevel=info
+Restart=on-failure
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+cat <<EOF >/etc/systemd/system/journiv-beat.service
+[Unit]
+Description=Journiv Celery Beat
+Wants=network-online.target
+After=network-online.target journiv.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/journiv
+EnvironmentFile=/opt/journiv.env
+ExecStart=/opt/journiv/.venv/bin/python -m celery -A app.core.celery_app beat --loglevel=info --scheduler redbeat.RedBeatScheduler --pidfile=/run/journiv-beat.pid
+Restart=on-failure
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now journiv journiv-worker journiv-beat
+msg_ok "Created Services"
+
+motd_ssh
+customize
+cleanup_lxc

install/kaneo-install.sh

@@ -22,7 +22,7 @@ PG_DB_NAME="kaneo" PG_DB_USER="kaneo" setup_postgresql_db
 fetch_and_deploy_gh_release "kaneo" "usekaneo/kaneo" "tarball"
 
 PNPM_VERSION=$(sed -n 's/.*"packageManager": "pnpm@\([^"+]*\).*/\1/p' /opt/kaneo/package.json)
-NODE_VERSION="22" NODE_MODULE="pnpm@${PNPM_VERSION:-10.32.1}" setup_nodejs
+NODE_VERSION="24" NODE_MODULE="pnpm@${PNPM_VERSION:-10.32.1}" setup_nodejs
 
 msg_info "Configuring Kaneo"
 cat <<EOF >/opt/kaneo/.env

install/lemonade-server-install.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Jamie (jamiej)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/lemonade-sdk/lemonade
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+setup_deb822_repo \
+  "backports" \
+  "https://ftp-master.debian.org/keys/archive-key-13.asc" \
+  "http://deb.debian.org/debian" \
+  "trixie-backports" \
+  "main"
+
+msg_info "Installing Lemonade Server dependencies"
+$STD apt install -y \
+  fonts-katex \
+  libcpp-httplib0.41 \
+  libmbedcrypto16 \
+  libwebsockets19t64
+msg_ok "Installed Lemonade Server dependencies"
+
+setup_hwaccel
+
+fetch_and_deploy_gh_release "lemonade-server" "lemonade-sdk/lemonade" "binary" "latest" "/tmp" "lemonade-server_*-debian13_$(arch_resolve).deb"
+
+msg_info "Configuring Remote Access"
+systemctl enable -q --now lemond
+for _ in $(seq 1 60); do
+  lemonade status >/dev/null 2>&1 && break
+  sleep 2
+done
+$STD lemonade config set host=0.0.0.0
+systemctl restart lemond
+msg_ok "Configured Remote Access"
+
+motd_ssh
+customize
+cleanup_lxc

install/librechat-install.sh

@@ -25,7 +25,7 @@ fetch_and_deploy_gh_release "rag-api" "danny-avila/rag_api" "tarball"
 
 msg_info "Installing LibreChat Dependencies"
 cd /opt/librechat
-$STD npm ci
+$STD npm ci --allow-remote=all
 msg_ok "Installed LibreChat Dependencies"
 
 msg_info "Building Frontend"

install/lingarr-install.sh

@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/lingarr-translate/lingarr
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+PG_VERSION="17" setup_postgresql
+PG_DB_NAME="lingarr" PG_DB_USER="lingarr" setup_postgresql_db
+NODE_VERSION="24" setup_nodejs
+
+DOTNET_VERSION="10" DOTNET_TYPE="sdk" setup_dotnet
+
+fetch_and_deploy_gh_release "lingarr" "lingarr-translate/lingarr" "tarball"
+
+msg_info "Building Lingarr (Patience)"
+cd /opt/lingarr/Lingarr.Client
+$STD npm ci
+$STD npm run build
+mkdir -p /opt/lingarr/Lingarr.Server/wwwroot
+cp -r /opt/lingarr/Lingarr.Client/dist/* /opt/lingarr/Lingarr.Server/wwwroot/
+cd /opt/lingarr
+export DOTNET_CLI_TELEMETRY_OPTOUT=1
+$STD dotnet publish ./Lingarr.Server/Lingarr.Server.csproj -c Release -o /opt/lingarr_app /p:UseAppHost=false /p:Version="$(cat ~/.lingarr)"
+msg_ok "Built Lingarr"
+
+msg_info "Configuring Lingarr"
+mkdir -p /opt/lingarr_data/{config,plugins}
+cat <<EOF >/opt/lingarr.env
+ASPNETCORE_ENVIRONMENT=Production
+ASPNETCORE_URLS=http://+:9876
+ASPNETCORE_HTTP_PORTS=9876
+
+DB_CONNECTION=postgresql
+DB_HOST=127.0.0.1
+DB_PORT=5432
+DB_DATABASE=lingarr
+DB_USERNAME=lingarr
+DB_PASSWORD=${PG_DB_PASS}
+
+PLUGINS_PATH=/opt/lingarr_data/plugins
+DOTNET_CLI_TELEMETRY_OPTOUT=1
+
+# Translation backend. Alternatives: openai, deepl, anthropic, gemini, localai
+SERVICE_TYPE=libretranslate
+LIBRE_TRANSLATE_URL=http://CHANGE_ME:5000
+EOF
+chmod 600 /opt/lingarr.env
+msg_ok "Configured Lingarr"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/lingarr.service
+[Unit]
+Description=Lingarr
+Wants=network-online.target
+After=network-online.target postgresql.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/lingarr_app
+EnvironmentFile=/opt/lingarr.env
+ExecStart=/usr/bin/dotnet /opt/lingarr_app/Lingarr.Server.dll
+Restart=on-failure
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now lingarr
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/logseq-install.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://logseq.com/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  git \
+  nginx \
+  build-essential \
+  libcairo2-dev \
+  libpango1.0-dev \
+  libjpeg-dev \
+  libgif-dev \
+  librsvg2-dev
+msg_ok "Installed Dependencies"
+
+NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs
+JAVA_VERSION="21" setup_java
+
+msg_info "Installing Clojure CLI"
+cd /tmp
+curl_download "linux-install.sh" "https://github.com/clojure/brew-install/releases/latest/download/linux-install.sh"
+$STD bash linux-install.sh
+rm -f linux-install.sh
+msg_ok "Installed Clojure CLI"
+
+fetch_and_deploy_gh_release "logseq" "logseq/logseq" "tarball"
+
+msg_info "Building Logseq Web App (Patience)"
+cd /opt/logseq
+export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+export NODE_OPTIONS="--max-old-space-size=4096"
+export JAVA_TOOL_OPTIONS="-Xmx4g"
+$STD corepack enable
+$STD pnpm install --config.network-timeout=240000
+$STD pnpm release
+msg_ok "Built Logseq Web App"
+
+msg_info "Generating Self-Signed Certificate"
+create_self_signed_cert "logseq"
+msg_ok "Generated Self-Signed Certificate"
+
+msg_info "Configuring Nginx"
+cat <<'EOF' >/etc/nginx/sites-available/logseq
+server {
+    listen 80 default_server;
+    server_name _;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl default_server;
+    http2 on;
+    server_name _;
+
+    ssl_certificate /etc/ssl/logseq/logseq.crt;
+    ssl_certificate_key /etc/ssl/logseq/logseq.key;
+
+    root /opt/logseq/static;
+    index index.html;
+
+    add_header Cross-Origin-Opener-Policy same-origin always;
+    add_header Cross-Origin-Embedder-Policy require-corp always;
+
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+}
+EOF
+nginx_enable_site logseq
+msg_ok "Configured Nginx"
+
+motd_ssh
+customize
+cleanup_lxc

install/matter-hub-install.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/RiDDiX/home-assistant-matter-hub
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+NODE_VERSION="24" NODE_MODULE="pnpm@^10" setup_nodejs
+
+fetch_and_deploy_gh_release "matter-hub" "RiDDiX/home-assistant-matter-hub" "tarball"
+
+msg_info "Building Matter Hub"
+cd /opt/matter-hub
+MATTER_HUB_VERSION=$(cat ~/.matter-hub)
+$STD pnpm install --frozen-lockfile
+$STD pnpm run release:version "$MATTER_HUB_VERSION"
+APP_VERSION="$MATTER_HUB_VERSION" $STD pnpm build
+msg_ok "Built Matter Hub"
+
+msg_info "Installing Matter Hub"
+mkdir -p /opt/matter-hub_app
+cat <<EOF >/opt/matter-hub_app/package.json
+{
+  "name": "hamh-wrapper",
+  "version": "0.0.0",
+  "private": true,
+  "dependencies": {
+    "home-assistant-matter-hub": "file:/opt/matter-hub/apps/home-assistant-matter-hub/package.tgz"
+  }
+}
+EOF
+cd /opt/matter-hub_app
+$STD npm install --omit=dev --no-audit --no-fund
+msg_ok "Installed Matter Hub"
+
+msg_info "Configuring Matter Hub"
+mkdir -p /opt/matter-hub_data
+cat <<EOF >/opt/matter-hub.env
+HAMH_HOME_ASSISTANT_URL=http://CHANGE_ME:8123/
+HAMH_HOME_ASSISTANT_ACCESS_TOKEN=CHANGE_ME
+HAMH_HTTP_PORT=8482
+HAMH_LOG_LEVEL=info
+APP_VERSION=${MATTER_HUB_VERSION}
+EOF
+chmod 600 /opt/matter-hub.env
+msg_ok "Configured Matter Hub"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/matter-hub.service
+[Unit]
+Description=Home Assistant Matter Hub
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/matter-hub_data
+EnvironmentFile=/opt/matter-hub.env
+ExecStart=/opt/matter-hub_app/node_modules/.bin/home-assistant-matter-hub start --storage-location=/opt/matter-hub_data
+Restart=on-failure
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now matter-hub
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/netboot-xyz-install.sh

@@ -41,6 +41,14 @@ USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-lkrn" "netbo
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-linux-bin" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-linux.bin"
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-dsk" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz.dsk"
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-pdsk" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz.pdsk"
+
+USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-efi" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.efi"
+USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-kpxe" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.kpxe"
+USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-lkrn" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.lkrn"
+USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-dsk" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.dsk"
+USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-pdsk" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.pdsk"
+USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-metal-legacy-efi" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-metal-legacy.efi"
+USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-metal-legacy-kpxe" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-metal-legacy.kpxe"
 # ARM64 bootloaders
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-arm64" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-arm64.efi"
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-arm64-snp" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-arm64-snp.efi"
@@ -55,6 +63,12 @@ USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-arm64-iso" "
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-arm64-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-arm64.img"
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-multiarch-iso" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-multiarch.iso"
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-multiarch-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-multiarch.img"
+USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-iso" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.iso"
+USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.img"
+USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-sb-iso" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sb.iso"
+USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-sb-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sb.img"
+USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-sb-arm64-iso" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sb-arm64.iso"
+USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-sb-arm64-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sb-arm64.img"
 # SHA256 checksums
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-checksums" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sha256-checksums.txt"
 

install/omada-install.sh

@@ -28,7 +28,31 @@ fi
 
 if ! dpkg -l | grep -q 'libssl1.1'; then
   msg_info "Installing libssl (if needed)"
-  curl_download "/tmp/libssl.deb" "https://security.debian.org/debian-security/pool/updates/main/o/openssl/libssl1.1_1.1.1w-0+deb11u8_$(arch_resolve).deb"
+  # libssl1.1 is bullseye's last build, and the pinned filename rotted twice over:
+  # the point release moves on its own schedule, and bullseye left
+  # security.debian.org when its LTS ended. Take the newest build from whichever
+  # pool still carries one instead of hardcoding a name.
+  LIBSSL_ARCH=$(arch_resolve)
+  LIBSSL_URL=""
+  LIBSSL_DEB=""
+  for POOL in \
+    "https://security.debian.org/debian-security/pool/updates/main/o/openssl" \
+    "https://archive.debian.org/debian-security/pool/updates/main/o/openssl" \
+    "https://archive.debian.org/debian/pool/main/o/openssl"; do
+    FOUND=$(curl -fsSL "$POOL/" | grep -oE "libssl1\.1_[^\"<>]+_${LIBSSL_ARCH}\.deb" | sort -V | tail -n1 || true)
+    [[ -z "$FOUND" ]] && continue
+    # Newest across every pool, not the first hit: the security archive still
+    # only carries buster, whose 1.1.1n is older than bullseye's 1.1.1w.
+    if [[ -z "$LIBSSL_DEB" || "$(printf '%s\n%s\n' "$LIBSSL_DEB" "$FOUND" | sort -V | tail -n1)" == "$FOUND" ]]; then
+      LIBSSL_DEB="$FOUND"
+      LIBSSL_URL="$POOL/$FOUND"
+    fi
+  done
+  if [[ -z "$LIBSSL_URL" ]]; then
+    msg_error "No libssl1.1 package for ${LIBSSL_ARCH} found in any Debian pool"
+    exit 1
+  fi
+  curl_download "/tmp/libssl.deb" "$LIBSSL_URL"
   $STD dpkg -i /tmp/libssl.deb
   rm -f /tmp/libssl.deb
   msg_ok "Installed libssl1.1"

install/omnitools-install.sh

@@ -23,7 +23,7 @@ fetch_and_deploy_gh_release "omnitools" "iib0011/omni-tools" "tarball"
 msg_info "Building OmniTools"
 cd /opt/omnitools
 export HUSKY=0
-$STD npm ci
+$STD npm ci --allow-remote=all
 $STD npm run build
 msg_ok "Built OmniTools"
 

install/onetimesecret-install.sh

@@ -0,0 +1,138 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Hai Tran (epiHATR)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://onetimesecret.com/ | Github: https://github.com/onetimesecret/onetimesecret
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  build-essential \
+  git \
+  libffi-dev \
+  libgmp-dev \
+  libpq-dev \
+  libreadline-dev \
+  libsodium23 \
+  libsqlite3-dev \
+  libssl-dev \
+  libxml2-dev \
+  libxslt1-dev \
+  libyaml-dev \
+  nginx \
+  pkg-config \
+  python3 \
+  redis-server \
+  zlib1g-dev
+msg_ok "Installed Dependencies"
+
+fetch_and_deploy_gh_release "onetimesecret" "onetimesecret/onetimesecret" "tarball"
+
+RUBY_VERSION=$(tr -d ' \n' </opt/onetimesecret/.ruby-version 2>/dev/null)
+RUBY_VERSION="${RUBY_VERSION:-3.4.10}" setup_ruby
+PNPM_VERSION=$(sed -n 's/.*"packageManager": "pnpm@\([^"]*\)".*/\1/p' /opt/onetimesecret/package.json)
+NODE_VERSION=$(tr -d ' \n' </opt/onetimesecret/.nvmrc 2>/dev/null)
+NODE_VERSION="${NODE_VERSION:-25}" NODE_MODULE="pnpm@${PNPM_VERSION:-11.1.2}" setup_nodejs
+HOST_VALUE="${OTS_HOST:-$LOCAL_IP}"
+SSL_VALUE="${OTS_SSL:-false}"
+case "${SSL_VALUE,,}" in
+1 | true | yes | on) SSL_VALUE="true" ;;
+0 | false | no | off | "") SSL_VALUE="false" ;;
+*)
+  msg_error "Invalid OTS_SSL value '${OTS_SSL}' (use true/false)"
+  exit 1
+  ;;
+esac
+
+msg_info "Configuring Application"
+systemctl enable -q --now redis-server
+cd /opt/onetimesecret
+$STD bash bin/setup init
+sed -i \
+  -e "s|^REDIS_URL=.*|REDIS_URL=redis://127.0.0.1:6379/0|" \
+  -e "s|^HOST=.*|HOST=${HOST_VALUE//&/\\&}|" \
+  -e "s|^SSL=.*|SSL=${SSL_VALUE}|" \
+  /opt/onetimesecret/.env
+if grep -q '^RACK_ENV=' /opt/onetimesecret/.env; then
+  sed -i 's|^RACK_ENV=.*|RACK_ENV=production|' /opt/onetimesecret/.env
+else
+  echo "RACK_ENV=production" >>/opt/onetimesecret/.env
+fi
+if grep -q '^AUTHENTICATION_MODE=' /opt/onetimesecret/.env; then
+  sed -i 's|^AUTHENTICATION_MODE=.*|AUTHENTICATION_MODE=simple|' /opt/onetimesecret/.env
+else
+  echo "AUTHENTICATION_MODE=simple" >>/opt/onetimesecret/.env
+fi
+if ! grep -q '^PORT=' /opt/onetimesecret/.env; then
+  echo "PORT=3000" >>/opt/onetimesecret/.env
+fi
+chmod 600 /opt/onetimesecret/.env
+mkdir -p /opt/onetimesecret/tmp/pids /opt/onetimesecret/log
+msg_ok "Configured Application"
+
+msg_info "Reconciling Application"
+cd /opt/onetimesecret
+$STD bash bin/setup reconcile
+msg_ok "Reconciled Application"
+
+msg_info "Building Frontend"
+cd /opt/onetimesecret
+$STD pnpm run build
+msg_ok "Built Frontend"
+
+msg_info "Creating Service"
+cat <<'EOF' >/etc/systemd/system/onetimesecret.service
+[Unit]
+Description=Onetime Secret Service
+After=network.target redis-server.service
+Requires=redis-server.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/onetimesecret
+Environment=HOME=/root
+Environment=PATH=/root/.rbenv/shims:/root/.rbenv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+EnvironmentFile=/opt/onetimesecret/.env
+ExecStart=/root/.rbenv/shims/bundle exec puma -C etc/puma.rb
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now onetimesecret
+msg_ok "Created Service"
+
+msg_info "Configuring Nginx"
+cat <<'EOF' >/etc/nginx/sites-available/onetimesecret
+server {
+  listen 80 default_server;
+  server_name _;
+
+  location / {
+    proxy_pass http://127.0.0.1:3000;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+  }
+}
+EOF
+nginx_enable_site onetimesecret
+msg_ok "Configured Nginx"
+
+motd_ssh
+customize
+cleanup_lxc

install/pangolin-install.sh

@@ -45,7 +45,7 @@ SECRET_KEY=$(openssl rand -base64 48 | tr -dc 'A-Za-z0-9' | head -c 32)
 BADGER_VERSION=$(get_latest_github_release "fosrl/badger" "false")
 cd /opt/pangolin
 mkdir -p /opt/pangolin/config/{traefik,db,letsencrypt,logs}
-$STD npm ci
+$STD npm ci --allow-remote=all
 $STD npm run set:pg
 $STD npm run set:oss
 rm -rf server/private

install/paperclip-install.sh

@@ -23,6 +23,7 @@ msg_ok "Installed Dependencies"
 NODE_VERSION="24" NODE_MODULE="pnpm" setup_nodejs
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="paperclip" PG_DB_USER="paperclip" setup_postgresql_db
+setup_rust
 
 fetch_and_deploy_gh_release "paperclip-ai" "paperclipai/paperclip" "tarball"
 

install/portabase-install.sh

@@ -0,0 +1,163 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://portabase.io
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  build-essential \
+  git \
+  nginx
+msg_ok "Installed Dependencies"
+
+NODE_VERSION="22" NODE_MODULE="pnpm@11.8.0" setup_nodejs
+PG_VERSION="17" setup_postgresql
+PG_DB_NAME="portabase" PG_DB_USER="portabase" setup_postgresql_db
+
+fetch_and_deploy_gh_release "portabase" "Portabase/portabase" "tarball"
+fetch_and_deploy_gh_release "tusd" "tus/tusd" "prebuild" "latest" "/opt/tusd" "tusd_linux_$(arch_resolve).tar.gz"
+
+msg_info "Configuring Portabase"
+mkdir -p /opt/portabase-data/uploads/tmp
+mv -f "/opt/tusd/tusd_linux_$(arch_resolve)/tusd" /opt/tusd/tusd
+rm -rf "/opt/tusd/tusd_linux_$(arch_resolve)"
+chmod +x /opt/tusd/tusd
+PROJECT_SECRET=$(openssl rand -hex 32)
+ADMIN_PASSWORD=$(openssl rand -base64 18 | tr -dc 'A-Za-z0-9' | head -c 16)
+cat <<EOF >/opt/portabase/.env
+LOG_LEVEL=info
+DATABASE_URL=postgresql://${PG_DB_USER}:${PG_DB_PASS}@127.0.0.1:5432/${PG_DB_NAME}
+PROJECT_NAME=Portabase
+PROJECT_URL=http://${LOCAL_IP}:3000
+PROJECT_SECRET=${PROJECT_SECRET}
+TRUSTED_DOMAINS=http://${LOCAL_IP}:3000
+PRIVATE_PATH=/opt/portabase-data
+AUTH_DEFAULT_USER_NAME=Portabase Admin
+AUTH_DEFAULT_USER=admin@example.com
+AUTH_DEFAULT_PASSWORD=${ADMIN_PASSWORD}
+AUTH_EMAIL_PASSWORD_ENABLED=true
+AUTH_SIGNUP_ENABLED=true
+RETENTION_CRON=0 7 * * *
+TUSD_BEHIND_PROXY=true
+TELEMETRY=false
+EOF
+cat <<EOF >~/portabase.creds
+Portabase Admin
+Username: admin@example.com
+Password: ${ADMIN_PASSWORD}
+EOF
+msg_ok "Configured Portabase"
+
+msg_info "Building Portabase"
+cd /opt/portabase
+export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+export NEXT_TELEMETRY_DISABLED=1
+$STD pnpm install --frozen-lockfile
+$STD pnpm run build
+cp -r /opt/portabase/.next/static /opt/portabase/.next/standalone/.next/static
+cp -r /opt/portabase/public /opt/portabase/.next/standalone/public
+mkdir -p /opt/portabase/.next/standalone/src/db
+cp -r /opt/portabase/src/db/migrations /opt/portabase/.next/standalone/src/db/migrations
+ln -sf /opt/portabase/.env /opt/portabase/.next/standalone/.env
+msg_ok "Built Portabase"
+
+msg_info "Creating Services"
+cat <<EOF >/etc/systemd/system/portabase-tusd.service
+[Unit]
+Description=Portabase tusd Upload Server
+After=network.target
+Before=portabase.service
+
+[Service]
+Type=simple
+ExecStart=/opt/tusd/tusd --base-path /tus/files/ --upload-dir /opt/portabase-data/uploads/tmp --hooks-http http://127.0.0.1:8887/api/tus/hooks --port 1080 --max-size 21474836480 --behind-proxy
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+cat <<EOF >/etc/systemd/system/portabase.service
+[Unit]
+Description=Portabase
+After=network.target postgresql.service portabase-tusd.service
+Wants=postgresql.service
+
+[Service]
+Type=simple
+WorkingDirectory=/opt/portabase/.next/standalone
+Environment=NODE_ENV=production
+Environment=PORT=8887
+Environment=HOSTNAME=127.0.0.1
+ExecStart=/usr/bin/node /opt/portabase/.next/standalone/server.js
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now portabase-tusd portabase
+msg_ok "Created Services"
+
+msg_info "Configuring Nginx"
+cat <<'EOF' >/etc/nginx/sites-available/portabase
+map $http_x_forwarded_proto $forwarded_proto {
+    default $scheme;
+    "~*^\s*(https?)\s*(?:,|$)" $1;
+}
+
+server {
+    listen 3000;
+    server_name _;
+
+    client_max_body_size 20G;
+    ignore_invalid_headers off;
+
+    location /tus/ {
+        proxy_pass http://127.0.0.1:1080/tus/;
+        proxy_pass_request_headers on;
+        proxy_request_buffering off;
+        proxy_buffering off;
+        proxy_http_version 1.1;
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Forwarded-Host $http_host;
+        proxy_set_header X-Forwarded-Proto $forwarded_proto;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    location = /api/tus/hooks {
+        deny all;
+        return 404;
+    }
+
+    location / {
+        proxy_pass http://127.0.0.1:8887;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Forwarded-Host $http_host;
+        proxy_set_header X-Forwarded-Proto $forwarded_proto;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+}
+EOF
+nginx_enable_site portabase
+msg_ok "Configured Nginx"
+
+motd_ssh
+customize
+cleanup_lxc

install/poznote-install.sh

@@ -28,16 +28,73 @@ touch /var/www/html/data/database/poznote.db
 chown -R www-data:www-data /var/www/html
 msg_ok "Deployed Poznote"
 
+msg_info "Running Poznote Initialization"
+chmod +x /opt/poznote/init.sh
+$STD /opt/poznote/init.sh
+msg_ok "Initialized Poznote Data Directory"
+
 msg_info "Configuring Nginx"
 PHP_SOCK=$(get_php_fpm_socket)
 cat <<EOF >/etc/nginx/sites-available/poznote
+# The Excalidraw editor must keep its window.opener relationship with
+# libraries.excalidraw.com so "Add to Excalidraw" can hand the chosen library
+# back to the already-open editor tab; COOP same-origin would sever it.
+map \$uri \$poznote_coop {
+    default                  "same-origin";
+    /excalidraw_editor.php   "unsafe-none";
+}
+
 server {
     listen 8040;
     root /var/www/html;
     index index.php index.html;
 
+    gzip on;
+    gzip_comp_level 5;
+    gzip_min_length 1024;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_types text/css application/javascript text/javascript application/json
+               image/svg+xml application/manifest+json font/ttf font/otf;
+
+    location ~* \.webmanifest$ {
+        default_type application/manifest+json;
+        try_files \$uri =404;
+    }
+
+    client_max_body_size 800M;
+
+    location /api/v1 {
+        try_files \$uri \$uri/ /api/v1/index.php?\$query_string;
+    }
+
+    location = /api/health {
+        rewrite ^ /api_health.php last;
+    }
+
+    location = /api/info {
+        rewrite ^ /api_health.php last;
+    }
+
     location / {
-        try_files \$uri \$uri/ /index.php?\$query_string;
+        try_files \$uri \$uri/ @poznote_public;
+    }
+
+    location @poznote_public {
+        rewrite ^/folder/([^/]+)/?$ /public_folder.php?token=\$1 last;
+        rewrite ^/workspace/([^/]+)/?$ /public_note.php?token=\$1 last;
+        rewrite ^/([^/]+)/?$ /public_slug.php?slug=\$1 last;
+    }
+
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Cross-Origin-Opener-Policy \$poznote_coop always;
+    add_header Cross-Origin-Resource-Policy "same-origin" always;
+    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;
+
+    location ~* ^/data/.*\.(php[0-9]?|phtml|phar|pht)$ {
+        deny all;
     }
 
     location ~ \.php$ {
@@ -45,16 +102,93 @@ server {
         fastcgi_pass unix:${PHP_SOCK};
         fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
         fastcgi_param DOCUMENT_ROOT \$document_root;
+        fastcgi_param PATH_INFO \$fastcgi_path_info;
+
+        fastcgi_param HTTP_X_FORWARDED_FOR \$http_x_forwarded_for;
+        fastcgi_param HTTP_X_FORWARDED_PROTO \$http_x_forwarded_proto;
+        fastcgi_param HTTP_X_FORWARDED_HOST \$http_x_forwarded_host;
+        fastcgi_param HTTP_X_FORWARDED_PORT \$http_x_forwarded_port;
+        fastcgi_param HTTP_X_REAL_IP \$http_x_real_ip;
+        fastcgi_param HTTPS \$https if_not_empty;
+
+        # fastcgi_read_timeout 600;
+        # fastcgi_send_timeout 600;
+        # Left at nginx's 60s default, not Docker's 600s:
+        # a stalled git-sync request can hold the PHP session lock, otherwise
     }
 
-    location ~ /\.ht {
+    location ~ /\. {
         deny all;
     }
+
+    location ~ ^/data/users/[0-9]+/backgrounds/ {
+        try_files \$uri =404;
+    }
+
+    location ~ ^/data/css/[A-Za-z0-9._-]+\.css$ {
+        try_files \$uri =404;
+    }
+
+    location ~ ^/(data|config)/ {
+        deny all;
+    }
+
+    location ~* ^/pwa/poznote(-[0-9]+)?\.png$ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Cross-Origin-Resource-Policy "cross-origin" always;
+        try_files \$uri =404;
+    }
+
+    location ~* \.(?:js|css|png|jpg|jpeg|gif|svg|ico|woff2?|ttf|otf|eot|webp|webmanifest)$ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Cross-Origin-Resource-Policy "same-origin" always;
+        try_files \$uri =404;
+    }
 }
 EOF
 nginx_enable_site poznote
 msg_ok "Configured Nginx"
 
+msg_info "Creating Background Worker Services"
+cat <<EOF >/etc/systemd/system/poznote-reminder-worker.service
+[Unit]
+Description=Poznote Reminder Email Worker
+After=network.target
+
+[Service]
+Type=simple
+User=www-data
+Group=www-data
+Restart=always
+ExecStart=/usr/bin/php /var/www/html/workers/reminder-email-worker.php
+WorkingDirectory=/var/www/html
+
+[Install]
+WantedBy=multi-user.target
+EOF
+cat <<EOF >/etc/systemd/system/poznote-s3-backup-worker.service
+[Unit]
+Description=Poznote S3 Backup Worker
+After=network.target
+
+[Service]
+Type=simple
+User=www-data
+Group=www-data
+Restart=always
+ExecStart=/usr/bin/php /var/www/html/workers/s3-backup-worker.php
+WorkingDirectory=/var/www/html
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now poznote-reminder-worker poznote-s3-backup-worker
+msg_ok "Created Background Worker Services"
+
 motd_ssh
 customize
 cleanup_lxc

install/romm-install.sh

@@ -161,6 +161,7 @@ else
 fi
 
 fetch_and_deploy_gh_release "romm" "rommapp/romm" "tarball"
+echo "__version__ = \"$(cat ~/.romm)\"" >/opt/romm/backend/__version__.py
 
 msg_info "Creating environment file"
 sed -i 's/^supervised no/supervised systemd/' /etc/redis/redis.conf

install/safebucket-install.sh

@@ -0,0 +1,226 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: renizmy
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/safebucket/safebucket
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y awscli
+msg_ok "Installed Dependencies"
+
+msg_info "Installing Garage"
+useradd --system --no-create-home --shell /usr/sbin/nologin garage 2>/dev/null || true
+GARAGE_VERSION=$(get_latest_gh_tag "deuxfleurs-org/garage" "v")
+if [[ -z "$GARAGE_VERSION" ]]; then
+  msg_error "Could not determine latest stable Garage version"
+  exit 1
+fi
+curl -fsSL "https://garagehq.deuxfleurs.fr/_releases/${GARAGE_VERSION}/$(arch_resolve "x86_64-unknown-linux-musl" "aarch64-unknown-linux-musl")/garage" -o /usr/local/bin/garage
+chmod +x /usr/local/bin/garage
+mkdir -p /opt/garage/{data,meta}
+RPC_SECRET=$(openssl rand -hex 32)
+ADMIN_TOKEN=$(openssl rand -base64 32)
+cat <<EOF >/opt/garage/garage.toml
+metadata_dir = "/opt/garage/meta"
+data_dir = "/opt/garage/data"
+db_engine = "lmdb"
+replication_factor = 1
+
+rpc_bind_addr = "[::]:3901"
+rpc_public_addr = "127.0.0.1:3901"
+rpc_secret = "${RPC_SECRET}"
+
+[s3_api]
+s3_region = "garage"
+api_bind_addr = "[::]:3900"
+root_domain = ".s3.garage.localhost"
+
+[admin]
+api_bind_addr = "[::]:3903"
+admin_token = "${ADMIN_TOKEN}"
+EOF
+chmod 600 /opt/garage/garage.toml
+chown -R garage:garage /opt/garage
+cat <<EOF >/etc/systemd/system/garage.service
+[Unit]
+Description=Garage Object Storage
+After=network.target
+
+[Service]
+Type=simple
+User=garage
+Group=garage
+WorkingDirectory=/opt/garage
+ExecStart=/usr/local/bin/garage -c /opt/garage/garage.toml server
+Restart=on-failure
+RestartSec=5
+LimitNOFILE=65536
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now garage
+msg_ok "Installed Garage"
+
+msg_info "Configuring Garage Bucket"
+RETRIES=0
+until garage -c /opt/garage/garage.toml status &>/dev/null; do
+  RETRIES=$((RETRIES + 1))
+  if [[ $RETRIES -ge 60 ]]; then
+    msg_error "Garage did not become ready within 60 seconds"
+    exit 1
+  fi
+  sleep 1
+done
+NODE_ID=$(garage -c /opt/garage/garage.toml status 2>/dev/null | awk '/^[0-9a-f]/{print $1; exit}')
+if [[ -z "$NODE_ID" ]]; then
+  msg_error "Could not determine Garage node ID from cluster status"
+  exit 1
+fi
+GARAGE_CAPACITY="${GARAGE_CAPACITY:-$(df -BG --output=avail /opt/garage | awk 'NR==2{gsub(/G/,"",$1); v=$1-1; print (v<1?1:v)"G"}')}"
+$STD garage -c /opt/garage/garage.toml layout assign -z dc1 -c "${GARAGE_CAPACITY}" "${NODE_ID}"
+$STD garage -c /opt/garage/garage.toml layout apply --version 1
+GARAGE_KEY_INFO=$(garage -c /opt/garage/garage.toml key create safebucket-key)
+GARAGE_ACCESS_KEY=$(echo "$GARAGE_KEY_INFO" | awk '/Key ID:/{print $3}')
+GARAGE_SECRET_KEY=$(echo "$GARAGE_KEY_INFO" | awk '/Secret key:/{print $3}')
+$STD garage -c /opt/garage/garage.toml bucket create safebucket
+$STD garage -c /opt/garage/garage.toml bucket allow --read --write --owner safebucket --key safebucket-key
+msg_ok "Configured Garage Bucket"
+
+msg_info "Applying CORS Policy to Bucket"
+export AWS_ACCESS_KEY_ID="${GARAGE_ACCESS_KEY}"
+export AWS_SECRET_ACCESS_KEY="${GARAGE_SECRET_KEY}"
+export AWS_DEFAULT_REGION="garage"
+if aws s3api put-bucket-cors \
+  --bucket safebucket \
+  --endpoint-url "http://127.0.0.1:3900" \
+  --cors-configuration '{"CORSRules":[{"AllowedHeaders":["*"],"AllowedMethods":["GET","PUT","POST","DELETE","HEAD"],"AllowedOrigins":["http://'"${LOCAL_IP}"':8080"],"ExposeHeaders":["ETag"]}]}' &>/dev/null; then
+  msg_ok "Applied CORS Policy to Bucket"
+else
+  msg_warn "Could not apply CORS policy automatically; direct browser uploads may fail until CORS is configured manually"
+fi
+unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_DEFAULT_REGION
+
+fetch_and_deploy_gh_release "safebucket" "safebucket/safebucket" "singlefile" "latest" "/opt/safebucket" "safebucket-linux-$(arch_resolve)"
+
+msg_info "Configuring Safebucket"
+useradd --system --no-create-home --shell /usr/sbin/nologin safebucket 2>/dev/null || true
+mkdir -p /opt/safebucket/data/{notifications,activity}
+TOKEN_SECRET=$(openssl rand -base64 32)
+MFA_KEY=$(openssl rand -base64 48 | tr -dc 'a-zA-Z0-9' | cut -c1-32)
+ADMIN_PASSWORD=$(openssl rand -hex 12)
+cat <<EOF >/opt/safebucket/config.yaml
+app:
+  profile: default
+  log_level: info
+  api_url: http://${LOCAL_IP}:8080
+  web_url: http://${LOCAL_IP}:8080
+  allowed_origins:
+    - http://${LOCAL_IP}:8080
+  port: 8080
+  token_secret: "${TOKEN_SECRET}"
+  mfa_encryption_key: "${MFA_KEY}"
+  mfa_required: false
+  admin_email: admin@safebucket.io
+  admin_password: "${ADMIN_PASSWORD}"
+  trash_retention_days: 7
+  max_upload_size: 5368709120
+  trusted_proxies:
+    - 10.0.0.0/8
+    - 172.16.0.0/12
+    - 192.168.0.0/16
+    - 127.0.0.0/8
+    - ::1/128
+    - fc00::/7
+  static_files:
+    enabled: true
+
+database:
+  type: sqlite
+  sqlite:
+    path: /opt/safebucket/data/safebucket.db
+
+cache:
+  type: memory
+
+storage:
+  type: s3
+  s3:
+    bucket_name: safebucket
+    endpoint: 127.0.0.1:3900
+    external_endpoint: http://${LOCAL_IP}:3900
+    access_key: ${GARAGE_ACCESS_KEY}
+    secret_key: ${GARAGE_SECRET_KEY}
+    region: garage
+    force_path_style: true
+    use_tls: false
+
+events:
+  type: memory
+  queues:
+    notifications:
+      name: safebucket-notifications
+    object_deletion:
+      name: safebucket-object-deletion
+    bucket_events:
+      name: safebucket-bucket-events
+
+notifier:
+  type: filesystem
+  filesystem:
+    directory: /opt/safebucket/data/notifications
+
+activity:
+  type: filesystem
+  filesystem:
+    directory: /opt/safebucket/data/activity
+
+auth:
+  providers:
+    local:
+      name: local
+      type: local
+      sharing:
+        allowed: true
+        domains: []
+EOF
+chmod 600 /opt/safebucket/config.yaml
+chown -R safebucket:safebucket /opt/safebucket
+msg_ok "Configured Safebucket"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/safebucket.service
+[Unit]
+Description=Safebucket File Sharing Platform
+After=network-online.target garage.service
+Wants=network-online.target
+Requires=garage.service
+
+[Service]
+Type=simple
+User=safebucket
+Group=safebucket
+WorkingDirectory=/opt/safebucket
+Environment=CONFIG_FILE_PATH=/opt/safebucket/config.yaml
+ExecStart=/opt/safebucket/safebucket
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now safebucket
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/snapotter-install.sh

@@ -34,7 +34,12 @@ $STD apt install -y \
   python3 \
   python3-dev \
   gcc \
-  g++
+  g++ \
+  libavif-bin \
+  libavif-dev \
+  libopencv-dev \
+  python3-opencv \
+  libgles2
 msg_ok "Installed Dependencies"
 
 PYTHON_VERSION="3.11" setup_uv
@@ -59,11 +64,13 @@ msg_info "Setting up Python Environment"
 mkdir -p /opt/snapotter_data/ai/models/rembg
 $STD uv python install 3.11
 $STD uv venv --seed --python 3.11 /opt/snapotter_data/ai/venv
-#if [[ -f /opt/snapotter/packages/ai/python/requirements.txt ]]; then
+if [[ "$(arch_resolve)" == "arm64" ]]; then
-#  $STD uv pip install \
+  $STD uv pip install --python /opt/snapotter_data/ai/venv/bin/python \
-#    --python /opt/snapotter_data/ai/venv/bin/python \
+    numpy==1.26.4 Pillow==12.3.0 opencv-python-headless==4.10.0.84 fonttools \
-#    -r /opt/snapotter/packages/ai/python/requirements.txt
+    'huggingface-hub[hf_xet,hf_transfer]==0.36.2'
-#fi
+else
+  msg_warn "SnapOtter AI Features have no working CPU-only bundle for amd64 upstream (published bundle is Python 3.12/GPU-CUDA only). Use the official Docker image instead: https://docs.snapotter.com"
+fi
 ln -sfn /opt/snapotter /app
 msg_ok "Set up Python Environment"
 

install/stash-install.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/stashapp/stash
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+setup_ffmpeg
+setup_hwaccel
+
+fetch_and_deploy_gh_release "stash" "stashapp/stash" "singlefile" "latest" "/opt/stash" "$(arch_resolve stash-linux stash-linux-arm64v8)"
+
+msg_info "Creating Service"
+mkdir -p /opt/stash_data
+cat <<EOF >/etc/systemd/system/stash.service
+[Unit]
+Description=Stash
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/stash
+Environment=STASH_CONFIG_FILE=/opt/stash_data/config.yml
+ExecStart=/opt/stash/stash
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now stash
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/tolgee-install.sh

@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os
 
-JAVA_VERSION="21" setup_java
+JAVA_VERSION="25" setup_java
 PG_VERSION="16" setup_postgresql
 PG_DB_NAME="tolgee" PG_DB_USER="tolgee" setup_postgresql_db
 

install/whisparr-eros-install.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: angusmaul
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Whisparr/Whisparr-Eros
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y sqlite3 libicu-dev
+msg_ok "Installed Dependencies"
+
+fetch_and_deploy_gh_release "whisparr-eros" "Whisparr/Whisparr-Eros" "prebuild" "latest" "/opt/Whisparr-Eros" "Whisparr.eros.*.linux-$(arch_resolve "x64" "arm64").tar.gz"
+
+msg_info "Configuring Whisparr-Eros"
+rm -rf /opt/Whisparr-Eros/Whisparr.Update
+chmod +x /opt/Whisparr-Eros/Whisparr
+mkdir -p /var/lib/whisparr-eros/
+chmod 775 /var/lib/whisparr-eros/ /opt/Whisparr-Eros/
+msg_ok "Configured Whisparr-Eros"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/whisparr-eros.service
+[Unit]
+Description=Whisparr-Eros Daemon
+After=syslog.target network.target
+
+[Service]
+UMask=0002
+Type=simple
+ExecStart=/opt/Whisparr-Eros/Whisparr -nobrowser -data=/var/lib/whisparr-eros/
+TimeoutStopSec=20
+KillMode=process
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now whisparr-eros
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc