diff --git a/ct/airtrail.sh b/ct/airtrail.sh
index 09bea77e0..9332c1365 100644
--- a/ct/airtrail.sh
+++ b/ct/airtrail.sh
@@ -36,9 +36,9 @@ function update_script() {
     systemctl stop airtrail
     msg_ok "Stopped Service"
 
-    create_backup /opt/airtrail/.env /opt/airtrail/uploads
+    create_backup /opt/airtrail/.env
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "airtrail" "johanohly/AirTrail" "tarball" "latest" "/opt/airtrail"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="uploads" fetch_and_deploy_gh_release "airtrail" "johanohly/AirTrail" "tarball" "latest" "/opt/airtrail"
 
     restore_backup
 
diff --git a/ct/alpine-borgbackup-server.sh b/ct/alpine-borgbackup-server.sh
index ca25e1df9..6bbfd87da 100644
--- a/ct/alpine-borgbackup-server.sh
+++ b/ct/alpine-borgbackup-server.sh
@@ -48,9 +48,7 @@ function update_script() {
       exit
     fi
 
-    msg_info "Setting up SSH Public Key for backup user"
-
-    msg_info "Please paste your SSH public key (e.g., ssh-rsa AAAAB3... user@host): \n"
+    echo -e "${INFO}${YW}Please paste your SSH public key (e.g., ssh-rsa AAAAB3... user@host):${CL}"
     read -p "Key: " SSH_PUBLIC_KEY
     echo
 
diff --git a/ct/alpine-komodo.sh b/ct/alpine-komodo.sh
index b99f1c5e1..bb591091d 100644
--- a/ct/alpine-komodo.sh
+++ b/ct/alpine-komodo.sh
@@ -31,7 +31,7 @@ function update_script() {
 
   msg_warn "⚠️  ${APP} has been migrated to an addon script."
   echo ""
-  msg_info "This is a one-time migration. After this, you can update ${APP} anytime with:"
+  echo -e "${INFO}${YW}This is a one-time migration. After this, you can update ${APP} anytime with:${CL}"
   echo -e "${TAB}${TAB}${GN}update_komodo${CL}  or  ${GN}bash <(curl -fsSL ${ADDON_SCRIPT})${CL}"
   echo ""
   read -r -p "${TAB}Migrate update function now? [y/N]: " CONFIRM
@@ -62,7 +62,7 @@ MIGRATION_EOF
   ln -sf /usr/bin/update /usr/bin/update_komodo 2>/dev/null || true
   msg_ok "Migration complete"
 
-  msg_info "Running addon update"
+  echo -e "${INFO}${YW}Running addon update${CL}"
   type=update bash <(curl -fsSL "${ADDON_SCRIPT}")
   exit
 }
diff --git a/ct/authentik.sh b/ct/authentik.sh
index b93781559..e80503ae2 100644
--- a/ct/authentik.sh
+++ b/ct/authentik.sh
@@ -136,7 +136,6 @@ function update_script() {
     export UV_COMPILE_BYTECODE="1"
     export UV_LINK_MODE="copy"
     export UV_NATIVE_TLS="1"
-    export UV_HTTP_TIMEOUT="300"
     export RUSTUP_PERMIT_COPY_RENAME="true"
     export UV_PYTHON_INSTALL_DIR="/usr/local/bin"
     cd /opt/authentik
diff --git a/ct/beszel.sh b/ct/beszel.sh
index 0a9d4a4a2..5aad94f0b 100644
--- a/ct/beszel.sh
+++ b/ct/beszel.sh
@@ -33,7 +33,7 @@ function update_script() {
   if check_for_gh_release "beszel" "henrygd/beszel"; then
     msg_info "Stopping Service"
     systemctl stop beszel-hub
-    msg_info "Stopped Service"
+    msg_ok "Stopped Service"
 
     msg_info "Updating Beszel"
     $STD /opt/beszel/beszel update
diff --git a/ct/chevereto.sh b/ct/chevereto.sh
index 221b229a8..a23691897 100644
--- a/ct/chevereto.sh
+++ b/ct/chevereto.sh
@@ -38,11 +38,9 @@ function update_script() {
     systemctl stop nginx "$PHP_FPM_SERVICE"
     msg_ok "Stopped Services"
 
-    create_backup /opt/chevereto/app/env.php \
-      /opt/chevereto/images \
-      /opt/chevereto/content
+    create_backup /opt/chevereto/app/env.php /opt/chevereto/content
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "chevereto" "chevereto/chevereto" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="images" fetch_and_deploy_gh_release "chevereto" "chevereto/chevereto" "tarball"
 
     restore_backup
 
diff --git a/ct/cloudreve.sh b/ct/cloudreve.sh
index 75436e39e..c2ad1ef15 100644
--- a/ct/cloudreve.sh
+++ b/ct/cloudreve.sh
@@ -33,7 +33,7 @@ function update_script() {
   if check_for_gh_release "cloudreve" "cloudreve/cloudreve"; then
     msg_info "Stopping Service"
     systemctl stop cloudreve
-    msg_info "Stopped Service"
+    msg_ok "Stopped Service"
 
     fetch_and_deploy_gh_release "cloudreve" "cloudreve/cloudreve" "prebuild" "latest" "/opt/cloudreve" "*linux_$(arch_resolve).tar.gz"
 
diff --git a/ct/convertx.sh b/ct/convertx.sh
index 0f8c37167..39ebbbeec 100644
--- a/ct/convertx.sh
+++ b/ct/convertx.sh
@@ -33,7 +33,7 @@ function update_script() {
   if check_for_gh_release "ConvertX" "C4illin/ConvertX"; then
     msg_info "Stopping Service"
     systemctl stop convertx
-    msg_info "Stopped Service"
+    msg_ok "Stopped Service"
 
     ensure_dependencies libreoffice-writer dasel graphicsmagick libemail-outlook-message-perl libheif-examples libjxl-tools resvg
 
diff --git a/ct/coolify.sh b/ct/coolify.sh
index e911a6d97..7d1ffe012 100644
--- a/ct/coolify.sh
+++ b/ct/coolify.sh
@@ -35,7 +35,7 @@ function update_script() {
 
   msg_warn "⚠️  ${APP} has been migrated to an addon script."
   echo ""
-  msg_info "This is a one-time migration. After this, you can update ${APP} anytime with:"
+  echo -e "${INFO}${YW}This is a one-time migration. After this, you can update ${APP} anytime with:${CL}"
   echo -e "${TAB}${TAB}${GN}update_coolify${CL}  or  ${GN}bash <(curl -fsSL ${ADDON_SCRIPT})${CL}"
   echo ""
   read -r -p "${TAB}Migrate update function now? [y/N]: " CONFIRM
@@ -58,7 +58,7 @@ MIGRATION_EOF
   ln -sf /usr/bin/update /usr/bin/update_coolify 2>/dev/null || true
   msg_ok "Migration complete"
 
-  msg_info "Running addon update"
+  echo -e "${INFO}${YW}Running addon update${CL}"
   type=update bash <(curl -fsSL "${ADDON_SCRIPT}")
   exit
 }
diff --git a/ct/cryptpad.sh b/ct/cryptpad.sh
index fc13fb716..54ac048e3 100644
--- a/ct/cryptpad.sh
+++ b/ct/cryptpad.sh
@@ -33,18 +33,11 @@ function update_script() {
   if check_for_gh_release "cryptpad" "cryptpad/cryptpad"; then
     msg_info "Stopping Service"
     systemctl stop cryptpad
-    msg_info "Stopped Service"
+    msg_ok "Stopped Service"
 
-    create_backup /opt/cryptpad/config/config.js \
-      /opt/cryptpad/blob \
-      /opt/cryptpad/block \
-      /opt/cryptpad/customize \
-      /opt/cryptpad/data \
-      /opt/cryptpad/datastore \
-      /opt/cryptpad/www/common/onlyoffice/dist \
-      /opt/cryptpad/onlyoffice-conf
+    create_backup /opt/cryptpad/config/config.js /opt/cryptpad/www/common/onlyoffice/dist
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "cryptpad" "cryptpad/cryptpad" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="blob block customize data datastore onlyoffice-conf" fetch_and_deploy_gh_release "cryptpad" "cryptpad/cryptpad" "tarball"
 
     restore_backup
 
diff --git a/ct/dispatcharr.sh b/ct/dispatcharr.sh
index 29083b80e..b9e472235 100644
--- a/ct/dispatcharr.sh
+++ b/ct/dispatcharr.sh
@@ -137,7 +137,6 @@ EOF
       set +o allexport
       if [[ -n "$POSTGRES_DB" ]] && [[ -n "$POSTGRES_USER" ]] && [[ -n "$POSTGRES_PASSWORD" ]]; then
         PGPASSWORD=$POSTGRES_PASSWORD pg_dump -U "$POSTGRES_USER" -h "${POSTGRES_HOST:-localhost}" -p "${POSTGRES_PORT:-5432}" "$POSTGRES_DB" >/tmp/dispatcharr_db_$(date +%F).sql
-        msg_info "Database backup created"
       fi
     fi
     $STD tar -czf "$BACKUP_FILE" -C /opt dispatcharr /tmp/dispatcharr_db_*.sql
@@ -150,7 +149,7 @@ EOF
 
     msg_info "Updating Dispatcharr Backend"
     if ! grep -q "DJANGO_SECRET_KEY" /opt/dispatcharr/.env; then
-      DJANGO_SECRET=$(openssl rand -base64 48 | tr -dc 'a-zA-Z0-9' | cut -c1-50)
+      DJANGO_SECRET=$(random_password 50)
       echo "DJANGO_SECRET_KEY=$DJANGO_SECRET" >>/opt/dispatcharr/.env
     fi
 
diff --git a/ct/dockge.sh b/ct/dockge.sh
index f09e1d282..04433bc54 100644
--- a/ct/dockge.sh
+++ b/ct/dockge.sh
@@ -35,7 +35,7 @@ function update_script() {
 
   msg_warn "⚠️  ${APP} has been migrated to an addon script."
   echo ""
-  msg_info "This is a one-time migration. After this, you can update ${APP} anytime with:"
+  echo -e "${INFO}${YW}This is a one-time migration. After this, you can update ${APP} anytime with:${CL}"
   echo -e "${TAB}${TAB}${GN}update_dockge${CL}  or  ${GN}bash <(curl -fsSL ${ADDON_SCRIPT})${CL}"
   echo ""
   read -r -p "${TAB}Migrate update function now? [y/N]: " CONFIRM
@@ -60,7 +60,7 @@ MIGRATION_EOF
   ln -sf /usr/bin/update /usr/bin/update_dockge 2>/dev/null || true
   msg_ok "Migration complete"
 
-  msg_info "Running addon update"
+  echo -e "${INFO}${YW}Running addon update${CL}"
   type=update bash <(curl -fsSL "${ADDON_SCRIPT}")
   exit
 }
diff --git a/ct/docmost.sh b/ct/docmost.sh
index adb830049..99c8b75c4 100644
--- a/ct/docmost.sh
+++ b/ct/docmost.sh
@@ -38,9 +38,9 @@ function update_script() {
     systemctl stop docmost
     msg_ok "Stopped Service"
 
-    create_backup /opt/docmost/.env /opt/docmost/data
+    create_backup /opt/docmost/.env
     
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "docmost" "docmost/docmost" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="data" fetch_and_deploy_gh_release "docmost" "docmost/docmost" "tarball"
 
     restore_backup
 
diff --git a/ct/dokploy.sh b/ct/dokploy.sh
index cc0ab9e27..ceef5d112 100644
--- a/ct/dokploy.sh
+++ b/ct/dokploy.sh
@@ -35,7 +35,7 @@ function update_script() {
 
   msg_warn "⚠️  ${APP} has been migrated to an addon script."
   echo ""
-  msg_info "This is a one-time migration. After this, you can update ${APP} anytime with:"
+  echo -e "${INFO}${YW}This is a one-time migration. After this, you can update ${APP} anytime with:${CL}"
   echo -e "${TAB}${TAB}${GN}update_dokploy${CL}  or  ${GN}bash <(curl -fsSL ${ADDON_SCRIPT})${CL}"
   echo ""
   read -r -p "${TAB}Migrate update function now? [y/N]: " CONFIRM
@@ -58,7 +58,7 @@ MIGRATION_EOF
   ln -sf /usr/bin/update /usr/bin/update_dokploy 2>/dev/null || true
   msg_ok "Migration complete"
 
-  msg_info "Running addon update"
+  echo -e "${INFO}${YW}Running addon update${CL}"
   type=update bash <(curl -fsSL "${ADDON_SCRIPT}")
   exit
 }
diff --git a/ct/domain-locker.sh b/ct/domain-locker.sh
index 59dd8673f..00c76310d 100644
--- a/ct/domain-locker.sh
+++ b/ct/domain-locker.sh
@@ -35,7 +35,7 @@ function update_script() {
   if check_for_gh_release "domain-locker" "Lissy93/domain-locker"; then
     msg_info "Stopping Service"
     systemctl stop domain-locker
-    msg_info "Service stopped"
+    msg_ok "Stopped Service"
 
     PG_VERSION="17" setup_postgresql
     NODE_VERSION="22" setup_nodejs
@@ -51,7 +51,7 @@ function update_script() {
     source /opt/domain-locker.env
     set +a
     $STD npm run build
-    msg_info "Built Domain-Locker"
+    msg_ok "Built Domain-Locker"
 
     msg_info "Restarting Services"
     systemctl start domain-locker
diff --git a/ct/domain-monitor.sh b/ct/domain-monitor.sh
index cfd3329e3..ab01f0446 100644
--- a/ct/domain-monitor.sh
+++ b/ct/domain-monitor.sh
@@ -42,7 +42,7 @@ function update_script() {
   if check_for_gh_release "domain-monitor" "Hosteroid/domain-monitor"; then
     msg_info "Stopping Service"
     systemctl stop apache2
-    msg_info "Service stopped"
+    msg_ok "Stopped Service"
 
     create_backup /opt/domain-monitor/.env
 
diff --git a/ct/duplicati.sh b/ct/duplicati.sh
index cc8400b18..0a24ea5e1 100644
--- a/ct/duplicati.sh
+++ b/ct/duplicati.sh
@@ -33,7 +33,7 @@ function update_script() {
   if check_for_gh_release "duplicati" "duplicati/duplicati"; then
     msg_info "Stopping Service"
     systemctl stop duplicati
-    msg_info "Stopped Service"
+    msg_ok "Stopped Service"
 
     fetch_and_deploy_gh_release "duplicati" "duplicati/duplicati" "binary" "latest" "/opt/duplicati" "duplicati-*-linux-$(arch_resolve "x64" "arm64")-gui.deb"
 
diff --git a/ct/excalidraw.sh b/ct/excalidraw.sh
index 6353d8755..eb39941a3 100644
--- a/ct/excalidraw.sh
+++ b/ct/excalidraw.sh
@@ -36,7 +36,7 @@ function update_script() {
   if check_for_gh_release "excalidraw" "excalidraw/excalidraw"; then
     msg_info "Stopping Service"
     systemctl stop excalidraw
-    msg_info "Stopped Service"
+    msg_ok "Stopped Service"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "excalidraw" "excalidraw/excalidraw" "tarball"
 
diff --git a/ct/flame.sh b/ct/flame.sh
index 4ba348c53..6c0ea3b3e 100644
--- a/ct/flame.sh
+++ b/ct/flame.sh
@@ -36,9 +36,8 @@ function update_script() {
     systemctl stop flame
     msg_ok "Stopped Service"
 
-    create_backup /opt/flame/.env \
-      /opt/flame/data
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "flame" "pawelmalak/flame" "tarball"
+    create_backup /opt/flame/.env
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="data" fetch_and_deploy_gh_release "flame" "pawelmalak/flame" "tarball"
     restore_backup
 
     msg_info "Rebuilding Application"
diff --git a/ct/fluid-calendar.sh b/ct/fluid-calendar.sh
index 1df61d475..99763d36b 100644
--- a/ct/fluid-calendar.sh
+++ b/ct/fluid-calendar.sh
@@ -37,7 +37,7 @@ function update_script() {
   if check_for_gh_release "fluid-calendar" "dotnetfactory/fluid-calendar"; then
     msg_info "Stopping Service"
     systemctl stop fluid-calendar
-    msg_info "Stopped Service"
+    msg_ok "Stopped Service"
 
     create_backup /opt/fluid-calendar/.env
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "fluid-calendar" "dotnetfactory/fluid-calendar" "tarball"
diff --git a/ct/gitea-mirror.sh b/ct/gitea-mirror.sh
index 735ad7ea3..780523f80 100644
--- a/ct/gitea-mirror.sh
+++ b/ct/gitea-mirror.sh
@@ -50,10 +50,10 @@ function update_script() {
     echo ""
     read -r -p "Final confirmation - proceed? (y/N): " CONFIRM2
     if [[ ! "$CONFIRM2" =~ ^[Yy]$ ]]; then
-      msg_info "Update cancelled. Please backup your configuration before proceeding."
+      msg_warn "Update cancelled. Please backup your configuration before proceeding."
       exit 0
     fi
-    msg_info "Proceeding with version $APP_VERSION update. All configuration will be cleared as warned."
+    msg_warn "Proceeding with version $APP_VERSION update. All configuration will be cleared as warned."
     rm -rf /opt/gitea-mirror
   fi
 
diff --git a/ct/graylog.sh b/ct/graylog.sh
index 83b5a8827..884f10b35 100644
--- a/ct/graylog.sh
+++ b/ct/graylog.sh
@@ -34,7 +34,7 @@ function update_script() {
   msg_info "Stopping Service"
   systemctl stop graylog-datanode
   systemctl stop graylog-server
-  msg_info "Stopped Service"
+  msg_ok "Stopped Service"
 
   CURRENT_VERSION=$(apt list --installed 2>/dev/null | grep graylog-server | grep -oP '\d+\.\d+\.\d+')
 
diff --git a/ct/grist.sh b/ct/grist.sh
index 8cd3575b9..ad5711f80 100644
--- a/ct/grist.sh
+++ b/ct/grist.sh
@@ -38,9 +38,9 @@ function update_script() {
     systemctl stop grist
     msg_ok "Stopped Service"
 
-    create_backup /opt/grist/.env /opt/grist/docs /opt/grist/grist-sessions.db /opt/grist/landing.db
+    create_backup /opt/grist/.env /opt/grist/grist-sessions.db /opt/grist/landing.db
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "grist" "gristlabs/grist-core" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="docs" fetch_and_deploy_gh_release "grist" "gristlabs/grist-core" "tarball"
 
     restore_backup
 
diff --git a/ct/homebox.sh b/ct/homebox.sh
index 2dae830b4..d9e6e814f 100644
--- a/ct/homebox.sh
+++ b/ct/homebox.sh
@@ -50,7 +50,7 @@ function update_script() {
     [ -d /opt/.data ] && mv /opt/.data /opt/homebox/.data
 
     if ! grep -q "HBOX_AUTH_API_KEY_PEPPER" /opt/homebox/.env; then
-      AUTH_KEY=$(openssl rand -base64 32 | tr -dc 'a-zA-Z0-9' | cut -c1-32)
+      AUTH_KEY=$(random_password 32)
       echo "HBOX_AUTH_API_KEY_PEPPER=${AUTH_KEY}" >>/opt/homebox/.env
     fi
 
diff --git a/ct/homelable.sh b/ct/homelable.sh
index b46aa6c7d..de0be2918 100644
--- a/ct/homelable.sh
+++ b/ct/homelable.sh
@@ -36,9 +36,9 @@ function update_script() {
     systemctl stop homelable
     msg_ok "Stopped Service"
 
-    create_backup /opt/homelable/backend/.env /opt/homelable/data /opt/homelable/mcp/.env
+    create_backup /opt/homelable/backend/.env /opt/homelable/mcp/.env
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "homelable" "Pouzor/homelable" "tarball" "latest" "/opt/homelable"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="data" fetch_and_deploy_gh_release "homelable" "Pouzor/homelable" "tarball" "latest" "/opt/homelable"
 
     restore_backup
 
diff --git a/ct/homepage.sh b/ct/homepage.sh
index 51229b08d..8cae22c89 100644
--- a/ct/homepage.sh
+++ b/ct/homepage.sh
@@ -38,10 +38,10 @@ function update_script() {
     systemctl stop homepage
     msg_ok "Stopped service"
 
-    create_backup /opt/homepage/.env /opt/homepage/config
+    create_backup /opt/homepage/.env
     BACKUP_DIR=/opt/homepage-assets.backup create_backup /opt/homepage/public/images /opt/homepage/public/icons
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "homepage" "gethomepage/homepage" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="config" fetch_and_deploy_gh_release "homepage" "gethomepage/homepage" "tarball"
 
     restore_backup
 
diff --git a/ct/hortusfox.sh b/ct/hortusfox.sh
index 9004c25af..7b73a7510 100644
--- a/ct/hortusfox.sh
+++ b/ct/hortusfox.sh
@@ -55,18 +55,13 @@ function update_script() {
       printf '["%s"]\n' "$(<~/.hortusfox)" >app/migrations/verhist.json
     fi
 
-    create_backup \
-      /opt/hortusfox/.env \
+    create_backup /opt/hortusfox/.env \
       /opt/hortusfox/app/migrations/migrations.list \
       /opt/hortusfox/app/migrations/verhist.json \
       /opt/hortusfox/public/img \
-      /opt/hortusfox/public/attachments \
-      /opt/hortusfox/public/backup \
-      /opt/hortusfox/public/exports \
-      /opt/hortusfox/public/snd \
       /opt/hortusfox/public/themes
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "hortusfox" "danielbrendel/hortusfox-web" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="public/attachments public/backup public/exports public/snd" fetch_and_deploy_gh_release "hortusfox" "danielbrendel/hortusfox-web" "tarball"
     restore_backup
 
     msg_info "Updating HortusFox"
diff --git a/ct/immich.sh b/ct/immich.sh
index 04e1f8699..7d9e85fb7 100644
--- a/ct/immich.sh
+++ b/ct/immich.sh
@@ -262,7 +262,6 @@ EOF
     chown immich:immich "${UPLOAD_DIR:-$INSTALL_DIR/upload}" 2>/dev/null || true
     chown immich:immich ./uv.lock
     export VIRTUAL_ENV="${ML_DIR}"/ml-venv
-    export UV_HTTP_TIMEOUT=300
     if [[ -f ~/.openvino ]]; then
       ML_PYTHON="python3.13"
       msg_info "Pre-installing Python ${ML_PYTHON} for machine-learning"
diff --git a/ct/investbrain.sh b/ct/investbrain.sh
index 94a7d2b0e..e92143b18 100644
--- a/ct/investbrain.sh
+++ b/ct/investbrain.sh
@@ -42,9 +42,9 @@ function update_script() {
     NODE_VERSION="22" setup_nodejs
     PG_VERSION="17" setup_postgresql
 
-    create_backup /opt/investbrain/.env /opt/investbrain/storage
+    create_backup /opt/investbrain/.env
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Investbrain" "investbrainapp/investbrain" "tarball" "latest" "/opt/investbrain"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="storage" fetch_and_deploy_gh_release "Investbrain" "investbrainapp/investbrain" "tarball" "latest" "/opt/investbrain"
 
     restore_backup
 
diff --git a/ct/invoiceshelf.sh b/ct/invoiceshelf.sh
index a58c7bca4..3d8eb13e2 100644
--- a/ct/invoiceshelf.sh
+++ b/ct/invoiceshelf.sh
@@ -36,9 +36,9 @@ function update_script() {
     systemctl stop caddy
     msg_ok "Stopped Services"
 
-    create_backup /opt/invoiceshelf/.env /opt/invoiceshelf/storage
+    create_backup /opt/invoiceshelf/.env
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "invoiceshelf" "InvoiceShelf/InvoiceShelf" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="storage" fetch_and_deploy_gh_release "invoiceshelf" "InvoiceShelf/InvoiceShelf" "tarball"
 
     restore_backup
 
diff --git a/ct/kasm.sh b/ct/kasm.sh
index 4abecf335..e53d6a0ee 100644
--- a/ct/kasm.sh
+++ b/ct/kasm.sh
@@ -52,7 +52,7 @@ function update_script() {
     msg_error "Unable to detect latest Kasm release URL."
     exit 250
   fi
-  msg_info "Checked for new version"
+  msg_ok "Checked for new version"
 
   msg_info "Removing outdated docker-compose plugin"
   [ -f ~/.docker/cli-plugins/docker-compose ] && rm -rf ~/.docker/cli-plugins/docker-compose
diff --git a/ct/komodo.sh b/ct/komodo.sh
index 214667401..0c98a6771 100644
--- a/ct/komodo.sh
+++ b/ct/komodo.sh
@@ -66,7 +66,7 @@ MIGRATION_EOF
   ln -sf /usr/bin/update /usr/bin/update_komodo 2>/dev/null || true
   msg_ok "Migration complete"
 
-  msg_info "Running addon update"
+  echo -e "${INFO}${YW}Running addon update${CL}"
   type=update bash <(curl -fsSL "${ADDON_SCRIPT}")
   exit
 }
diff --git a/ct/librenms.sh b/ct/librenms.sh
index 9a7f2647a..8d8e81391 100644
--- a/ct/librenms.sh
+++ b/ct/librenms.sh
@@ -37,8 +37,8 @@ function update_script() {
     systemctl stop php8.4-fpm librenms-scheduler.timer
     msg_ok "Stopped Services"
 
-    create_backup /opt/librenms/.env /opt/librenms/config.php /opt/librenms/rrd
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "librenms" "librenms/librenms" "tarball"
+    create_backup /opt/librenms/.env /opt/librenms/config.php
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="rrd" fetch_and_deploy_gh_release "librenms" "librenms/librenms" "tarball"
     restore_backup
 
     msg_info "Updating LibreNMS"
diff --git a/ct/linkwarden.sh b/ct/linkwarden.sh
index 3a813c769..256d3b68d 100644
--- a/ct/linkwarden.sh
+++ b/ct/linkwarden.sh
@@ -36,9 +36,9 @@ function update_script() {
 
     RUST_CRATES="monolith" setup_rust
 
-    create_backup /opt/linkwarden/.env /opt/linkwarden/data
+    create_backup /opt/linkwarden/.env
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "linkwarden" "linkwarden/linkwarden" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="data" fetch_and_deploy_gh_release "linkwarden" "linkwarden/linkwarden" "tarball"
 
     restore_backup
 
diff --git a/ct/livebook.sh b/ct/livebook.sh
index 05ec8c7eb..5ccbe1012 100755
--- a/ct/livebook.sh
+++ b/ct/livebook.sh
@@ -34,7 +34,7 @@ function update_script() {
   if check_for_gh_release "livebook" "livebook-dev/livebook"; then
     msg_info "Stopping Service"
     systemctl stop livebook
-    msg_info "Stopped Service"
+    msg_ok "Stopped Service"
 
     msg_info "Updating Container"
     apt_update_safe
@@ -47,10 +47,11 @@ function update_script() {
     $STD mix escript.install hex livebook --force
 
     chown -R livebook:livebook /opt/livebook /data
+    msg_ok "Updated Livebook"
 
     msg_info "Starting Service"
     systemctl start livebook
-    msg_info "Started Service"
+    msg_ok "Started Service"
 
     msg_ok "Updated successfully!"
   fi
diff --git a/ct/metabase.sh b/ct/metabase.sh
index 70819db81..df35d3d6f 100644
--- a/ct/metabase.sh
+++ b/ct/metabase.sh
@@ -33,7 +33,7 @@ function update_script() {
     if check_for_gh_release "metabase" "metabase/metabase"; then
         msg_info "Stopping Service"
         systemctl stop metabase
-        msg_info "Stopped Service"
+        msg_ok "Stopped Service"
 
         msg_info "Creating backup"
         mv /opt/metabase/.env /opt
diff --git a/ct/nametag.sh b/ct/nametag.sh
index 6c29b2f76..4d278f7dd 100644
--- a/ct/nametag.sh
+++ b/ct/nametag.sh
@@ -36,9 +36,9 @@ function update_script() {
     systemctl stop nametag
     msg_ok "Stopped Service"
 
-    create_backup /opt/nametag/.env /opt/nametag/data
+    create_backup /opt/nametag/.env
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "nametag" "mattogodoy/nametag" "tarball" "latest" "/opt/nametag"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="data" fetch_and_deploy_gh_release "nametag" "mattogodoy/nametag" "tarball" "latest" "/opt/nametag"
 
     restore_backup
 
diff --git a/ct/openwebui.sh b/ct/openwebui.sh
index 6596f1093..16a57354c 100644
--- a/ct/openwebui.sh
+++ b/ct/openwebui.sh
@@ -49,7 +49,6 @@ function update_script() {
 
     msg_info "Installing uv-based Open-WebUI"
     PYTHON_VERSION="3.12" setup_uv
-    export UV_HTTP_TIMEOUT=300
     for attempt in $(seq 1 3); do
       $STD uv tool install --python 3.12 --constraint <(echo "numba>=0.60") open-webui[all] && break
       [[ $attempt -lt 3 ]] && msg_warn "Open WebUI install attempt $attempt failed, retrying..." && sleep 10
@@ -126,7 +125,6 @@ EOF
       OTEL_ARGS+=(--with "$pkg")
     done < <(uv pip list --python "$OWUI_PYTHON" --format freeze 2>/dev/null | grep -i '^opentelemetry-' | cut -d= -f1)
   fi
-  export UV_HTTP_TIMEOUT=300
   for attempt in $(seq 1 3); do
     $STD uv tool install --force --python 3.12 --constraint <(echo "numba>=0.60") "${OTEL_ARGS[@]}" open-webui[all] && break
     [[ $attempt -lt 3 ]] && msg_warn "Open WebUI update attempt $attempt failed, retrying..." && sleep 10
diff --git a/ct/ownfoil.sh b/ct/ownfoil.sh
index e9a2a479c..c9d757581 100644
--- a/ct/ownfoil.sh
+++ b/ct/ownfoil.sh
@@ -36,11 +36,7 @@ function update_script() {
     systemctl stop ownfoil
     msg_ok "Stopped Service"
 
-    create_backup /opt/ownfoil/app/config
-
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "ownfoil" "a1ex4/ownfoil" "tarball" "${RELEASE}"
-
-    restore_backup
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="app/config" fetch_and_deploy_gh_release "ownfoil" "a1ex4/ownfoil" "tarball" "${RELEASE}"
 
     msg_info "Installing Dependencies"
     cd /opt/ownfoil
diff --git a/ct/pangolin.sh b/ct/pangolin.sh
index 5868f490a..e629a0bd8 100644
--- a/ct/pangolin.sh
+++ b/ct/pangolin.sh
@@ -52,7 +52,7 @@ function update_script() {
     msg_info "Stopping Service"
     systemctl stop pangolin
     systemctl stop gerbil
-    msg_info "Service stopped"
+    msg_ok "Stopped Service"
 
     DB_URL=$(sed -n 's/.*connection_string: "\(.*\)".*/\1/p' /opt/pangolin/config/config.yml)
     create_backup /opt/pangolin/config
diff --git a/ct/passwordpusher.sh b/ct/passwordpusher.sh
index 4ac025594..24688c59b 100644
--- a/ct/passwordpusher.sh
+++ b/ct/passwordpusher.sh
@@ -36,9 +36,9 @@ function update_script() {
     systemctl stop passwordpusher
     msg_ok "Stopped Service"
 
-    create_backup /opt/passwordpusher/storage /opt/passwordpusher/.env.production
+    create_backup /opt/passwordpusher/.env.production
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "passwordpusher" "pglombardo/PasswordPusher" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="storage" fetch_and_deploy_gh_release "passwordpusher" "pglombardo/PasswordPusher" "tarball"
 
     restore_backup
 
diff --git a/ct/peanut.sh b/ct/peanut.sh
index 146530c56..4127d85ca 100644
--- a/ct/peanut.sh
+++ b/ct/peanut.sh
@@ -35,7 +35,7 @@ function update_script() {
   if check_for_gh_release "PeaNUT" "Brandawg93/PeaNUT"; then
     msg_info "Stopping Service"
     systemctl stop peanut
-    msg_info "Stopped Service"
+    msg_ok "Stopped Service"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "PeaNUT" "Brandawg93/PeaNUT" "tarball" "latest" "/opt/peanut"
 
diff --git a/ct/plant-it.sh b/ct/plant-it.sh
index 5359de55b..3dd452ec7 100644
--- a/ct/plant-it.sh
+++ b/ct/plant-it.sh
@@ -34,7 +34,7 @@ function update_script() {
   if check_for_gh_release "plant-it" "MDeLuise/plant-it" "${RELEASE}" "last version that includes the web frontend"; then
     msg_info "Stopping Service"
     systemctl stop plant-it
-    msg_info "Stopped Service"
+    msg_ok "Stopped Service"
 
     USE_ORIGINAL_FILENAME="true" fetch_and_deploy_gh_release "plant-it" "MDeLuise/plant-it" "singlefile" "${RELEASE}" "/opt/plant-it/backend" "server.jar"
     fetch_and_deploy_gh_release "plant-it-front" "MDeLuise/plant-it" "prebuild" "${RELEASE}" "/opt/plant-it/frontend" "client.tar.gz"
diff --git a/ct/postiz.sh b/ct/postiz.sh
index 5380b3ec7..0f1d6ea9b 100644
--- a/ct/postiz.sh
+++ b/ct/postiz.sh
@@ -37,10 +37,9 @@ function update_script() {
     systemctl stop postiz-orchestrator postiz-frontend postiz-backend
     msg_ok "Stopped Services"
 
-    create_backup /opt/postiz/.env \
-      /opt/postiz/uploads
+    create_backup /opt/postiz/.env
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "postiz" "gitroomhq/postiz-app" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="uploads" fetch_and_deploy_gh_release "postiz" "gitroomhq/postiz-app" "tarball"
 
     restore_backup
 
diff --git a/ct/radicale.sh b/ct/radicale.sh
index 91a912ad1..ffb0927fd 100644
--- a/ct/radicale.sh
+++ b/ct/radicale.sh
@@ -35,12 +35,8 @@ function update_script() {
     systemctl stop radicale
     msg_ok "Stopped service"
 
-    create_backup /opt/radicale/users
-
     PYTHON_VERSION="3.13" setup_uv
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Radicale" "Kozea/Radicale" "tarball" "latest" "/opt/radicale"
-
-    restore_backup
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="users" fetch_and_deploy_gh_release "Radicale" "Kozea/Radicale" "tarball" "latest" "/opt/radicale"
 
     if grep -q 'start.sh' /etc/systemd/system/radicale.service; then
       sed -i -e '/^Description/i[Unit]' \
diff --git a/ct/revealjs.sh b/ct/revealjs.sh
index 805c54b05..3ff08f31e 100644
--- a/ct/revealjs.sh
+++ b/ct/revealjs.sh
@@ -33,7 +33,7 @@ function update_script() {
   if check_for_gh_release "revealjs" "hakimel/reveal.js"; then
     msg_info "Stopping Service"
     systemctl stop revealjs
-    msg_info "Stopped Service"
+    msg_ok "Stopped Service"
 
     cp /opt/revealjs/index.html /opt
     fetch_and_deploy_gh_release "revealjs" "hakimel/reveal.js" "tarball"
diff --git a/ct/runtipi.sh b/ct/runtipi.sh
index 4caa48349..b0f3c69f3 100644
--- a/ct/runtipi.sh
+++ b/ct/runtipi.sh
@@ -35,7 +35,7 @@ function update_script() {
 
   msg_warn "⚠️  ${APP} has been migrated to an addon script."
   echo ""
-  msg_info "This is a one-time migration. After this, you can update ${APP} anytime with:"
+  echo -e "${INFO}${YW}This is a one-time migration. After this, you can update ${APP} anytime with:${CL}"
   echo -e "${TAB}${TAB}${GN}update_runtipi${CL}  or  ${GN}bash <(curl -fsSL ${ADDON_SCRIPT})${CL}"
   echo ""
   read -r -p "${TAB}Migrate update function now? [y/N]: " CONFIRM
@@ -58,7 +58,7 @@ MIGRATION_EOF
   ln -sf /usr/bin/update /usr/bin/update_runtipi 2>/dev/null || true
   msg_ok "Migration complete"
 
-  msg_info "Running addon update"
+  echo -e "${INFO}${YW}Running addon update${CL}"
   type=update bash <(curl -fsSL "${ADDON_SCRIPT}")
   exit
 }
diff --git a/ct/rustdeskserver.sh b/ct/rustdeskserver.sh
index 42845a3c1..b270d95fc 100644
--- a/ct/rustdeskserver.sh
+++ b/ct/rustdeskserver.sh
@@ -45,7 +45,7 @@ update_deb_based() {
     if [[ -f /lib/systemd/system/rustdesk-api.service ]]; then
       systemctl stop rustdesk-api
     fi
-    msg_info "Stopped Service"
+    msg_ok "Stopped Service"
 
     fetch_and_deploy_gh_release "rustdesk-hbbr" "lejianwen/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-hbbr*$(arch_resolve).deb"
     fetch_and_deploy_gh_release "rustdesk-hbbs" "lejianwen/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-hbbs*$(arch_resolve).deb"
diff --git a/ct/seelf.sh b/ct/seelf.sh
index 4f706eef1..1e239cfbf 100644
--- a/ct/seelf.sh
+++ b/ct/seelf.sh
@@ -33,7 +33,7 @@ function update_script() {
   if check_for_gh_release "seelf" "YuukanOO/seelf"; then
     msg_info "Stopping Service"
     systemctl stop seelf
-    msg_info "Stopped Service"
+    msg_ok "Stopped Service"
 
     msg_info "Updating seelf"
     cd /opt/seelf 
diff --git a/ct/solidtime.sh b/ct/solidtime.sh
index 26d0a91b6..e25b3f802 100644
--- a/ct/solidtime.sh
+++ b/ct/solidtime.sh
@@ -36,9 +36,9 @@ function update_script() {
     systemctl stop caddy
     msg_ok "Stopped Services"
 
-    create_backup /opt/solidtime/.env /opt/solidtime/storage
+    create_backup /opt/solidtime/.env
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "solidtime" "solidtime-io/solidtime" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="storage" fetch_and_deploy_gh_release "solidtime" "solidtime-io/solidtime" "tarball"
 
     restore_backup
 
diff --git a/ct/soulsync.sh b/ct/soulsync.sh
index 9866b4e64..e461aa9ef 100644
--- a/ct/soulsync.sh
+++ b/ct/soulsync.sh
@@ -38,9 +38,9 @@ function update_script() {
     systemctl stop soulsync
     msg_ok "Stopped Service"
 
-    create_backup /opt/soulsync/config /opt/soulsync/data
+    create_backup /opt/soulsync/config
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "soulsync" "Nezreka/SoulSync" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="data" fetch_and_deploy_gh_release "soulsync" "Nezreka/SoulSync" "tarball"
 
     restore_backup
 
diff --git a/ct/sparkyfitness.sh b/ct/sparkyfitness.sh
index 0016dae09..879dc4a49 100644
--- a/ct/sparkyfitness.sh
+++ b/ct/sparkyfitness.sh
@@ -37,11 +37,7 @@ function update_script() {
     systemctl stop sparkyfitness-server nginx
     msg_ok "Stopped Services"
 
-    create_backup /opt/sparkyfitness/SparkyFitnessServer/uploads /opt/sparkyfitness/SparkyFitnessServer/backup
-
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "sparkyfitness" "CodeWithCJ/SparkyFitness" "tarball"
-
-    restore_backup
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="SparkyFitnessServer/uploads SparkyFitnessServer/backup" fetch_and_deploy_gh_release "sparkyfitness" "CodeWithCJ/SparkyFitness" "tarball"
 
     PNPM_VERSION="$(jq -r '.packageManager | split("@")[1]' /opt/sparkyfitness/package.json)"
     NODE_VERSION="25" NODE_MODULE="pnpm@${PNPM_VERSION}" setup_nodejs
diff --git a/ct/streamlink-webui.sh b/ct/streamlink-webui.sh
index 53fff6824..15eb376cf 100644
--- a/ct/streamlink-webui.sh
+++ b/ct/streamlink-webui.sh
@@ -34,7 +34,7 @@ function update_script() {
   if check_for_gh_release "streamlink-webui" "CrazyWolf13/streamlink-webui"; then
     msg_info "Stopping Service"
     systemctl stop streamlink-webui
-    msg_info "Stopped Service"
+    msg_ok "Stopped Service"
 
     NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
     setup_uv
diff --git a/ct/stylus.sh b/ct/stylus.sh
index 4dfca4e22..c504847f4 100644
--- a/ct/stylus.sh
+++ b/ct/stylus.sh
@@ -34,7 +34,7 @@ function update_script() {
   if check_for_gh_release "stylus" "mmastrac/stylus"; then
     msg_info "Stopping Service"
     systemctl stop stylus
-    msg_info "Stopped Service"
+    msg_ok "Stopped Service"
 
     fetch_and_deploy_gh_release "stylus" "mmastrac/stylus" "singlefile" "latest" "/usr/bin/" "*_linux_$(arch_resolve)"
 
diff --git a/ct/sure.sh b/ct/sure.sh
index 6056314c3..cd5c7a356 100644
--- a/ct/sure.sh
+++ b/ct/sure.sh
@@ -65,9 +65,7 @@ EOF
       msg_ok "Stopped services"
     fi
 
-    create_backup /opt/sure/storage
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Sure" "we-promise/sure" "tarball" "latest" "/opt/sure"
-    restore_backup
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="storage" fetch_and_deploy_gh_release "Sure" "we-promise/sure" "tarball" "latest" "/opt/sure"
     RUBY_VERSION="$(cat /opt/sure/.ruby-version)" RUBY_INSTALL_RAILS=false HOME=/root setup_ruby
 
     msg_info "Updating Sure"
diff --git a/ct/tandoor.sh b/ct/tandoor.sh
index 17e586ca9..efcb2bc99 100644
--- a/ct/tandoor.sh
+++ b/ct/tandoor.sh
@@ -44,11 +44,11 @@ function update_script() {
     systemctl stop tandoor
     msg_ok "Stopped Service"
 
-    create_backup /opt/tandoor/config /opt/tandoor/api /opt/tandoor/mediafiles /opt/tandoor/staticfiles /opt/tandoor/.env
+    create_backup /opt/tandoor/.env
 
     NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
     PYTHON_VERSION="3.13" setup_uv
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "tandoor" "TandoorRecipes/recipes" "tarball" "latest" "/opt/tandoor"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="config api mediafiles staticfiles" fetch_and_deploy_gh_release "tandoor" "TandoorRecipes/recipes" "tarball" "latest" "/opt/tandoor"
 
     restore_backup
 
diff --git a/ct/termix.sh b/ct/termix.sh
index 0142e8e75..4b1c56e35 100644
--- a/ct/termix.sh
+++ b/ct/termix.sh
@@ -163,13 +163,9 @@ EOF
     fi
     msg_ok "Migrated Configuration"
 
-    create_backup \
-      /opt/termix/db/data \
-      /opt/termix/data \
-      /opt/termix/uploads \
-      /opt/termix/.env
+    create_backup /opt/termix/.env
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "termix" "Termix-SSH/Termix" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="db/data data uploads" fetch_and_deploy_gh_release "termix" "Termix-SSH/Termix" "tarball"
 
     restore_backup
 
diff --git a/ct/transmute.sh b/ct/transmute.sh
index e8888221b..fa7608ce2 100644
--- a/ct/transmute.sh
+++ b/ct/transmute.sh
@@ -41,9 +41,9 @@ function update_script() {
     systemctl stop transmute
     msg_ok "Stopped Service"
 
-    create_backup /opt/transmute/backend/.env /opt/transmute/data
+    create_backup /opt/transmute/backend/.env
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "transmute" "transmute-app/transmute" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="data" fetch_and_deploy_gh_release "transmute" "transmute-app/transmute" "tarball"
 
     restore_backup
 
diff --git a/ct/xyops.sh b/ct/xyops.sh
index 9ae0f56a3..c00c8f394 100644
--- a/ct/xyops.sh
+++ b/ct/xyops.sh
@@ -36,11 +36,7 @@ function update_script() {
     systemctl stop xyops
     msg_ok "Stopped Service"
 
-    create_backup /opt/xyops/data /opt/xyops/conf
-
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "xyops" "pixlcore/xyops" "tarball"
-
-    restore_backup
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="data conf" fetch_and_deploy_gh_release "xyops" "pixlcore/xyops" "tarball"
 
     msg_info "Rebuilding Application"
     cd /opt/xyops
diff --git a/install/adventurelog-install.sh b/install/adventurelog-install.sh
index 10e664bc6..751317bec 100644
--- a/install/adventurelog-install.sh
+++ b/install/adventurelog-install.sh
@@ -30,10 +30,10 @@ PG_DB_NAME="adventurelog_db" PG_DB_USER="adventurelog_user" PG_DB_EXTENSIONS="po
 fetch_and_deploy_gh_release "adventurelog" "seanmorley15/adventurelog" "tarball"
 
 msg_info "Installing AdventureLog (Patience)"
-SECRET_KEY="$(openssl rand -base64 32 | tr -dc 'a-zA-Z0-9' | cut -c1-32)"
+SECRET_KEY="$(random_password 32)"
 echo "AdventureLog Secret: $SECRET_KEY" >>~/adventurelog.creds
 DJANGO_ADMIN_USER="djangoadmin"
-DJANGO_ADMIN_PASS="$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-13)"
+DJANGO_ADMIN_PASS="$(random_password 13)"
 cat <<EOF >/opt/adventurelog/backend/server/.env
 PGHOST='localhost'
 PGDATABASE='${PG_DB_NAME}'
diff --git a/install/affine-install.sh b/install/affine-install.sh
index 7928f120a..504497220 100644
--- a/install/affine-install.sh
+++ b/install/affine-install.sh
@@ -160,7 +160,7 @@ systemctl enable -q --now redis-server affine-web affine-worker
 msg_ok "Created Services"
 
 msg_info "Creating Admin User"
-ADMIN_PASS=$(openssl rand -base64 12)
+ADMIN_PASS=$(random_password 16)
 for i in {1..30}; do
   if curl -s http://localhost:3010/info >/dev/null 2>&1; then
     break
diff --git a/install/alpine-nextcloud-install.sh b/install/alpine-nextcloud-install.sh
index d1ac402ab..9e5d959fc 100644
--- a/install/alpine-nextcloud-install.sh
+++ b/install/alpine-nextcloud-install.sh
@@ -37,8 +37,8 @@ msg_ok "Installed PHP/Redis"
 msg_info "Installing MySQL Database"
 DB_NAME=nextcloud
 DB_USER=nextcloud
-DB_PASS="$(openssl rand -base64 18 | cut -c1-13)"
-ADMIN_PASS="$(openssl rand -base64 18 | cut -c1-13)"
+DB_PASS="$(random_password 13)"
+ADMIN_PASS="$(random_password 13)"
 echo "" >>~/nextcloud.creds
 echo -e "MySQL Admin Password: \e[32m$ADMIN_PASS\e[0m" >>~/nextcloud.creds
 echo -e "Nextcloud Database Username: \e[32m$DB_USER\e[0m" >>~/nextcloud.creds
diff --git a/install/apache-airflow-install.sh b/install/apache-airflow-install.sh
index 0db70aa7d..82ddfcf4b 100644
--- a/install/apache-airflow-install.sh
+++ b/install/apache-airflow-install.sh
@@ -40,7 +40,7 @@ msg_ok "Installed Apache Airflow"
 msg_info "Configuring Application"
 FERNET_KEY=$(/opt/airflow/.venv/bin/python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())")
 SECRET_KEY=$(openssl rand -hex 32)
-ADMIN_PASS=$(openssl rand -base64 12 | tr -dc 'a-zA-Z0-9' | cut -c1-12)
+ADMIN_PASS=$(random_password 12)
 cat <<EOF >/opt/airflow/.env
 AIRFLOW_HOME=/opt/airflow
 AIRFLOW__DATABASE__SQL_ALCHEMY_CONN=postgresql+psycopg2://${PG_DB_USER}:${PG_DB_PASS}@localhost:5432/${PG_DB_NAME}
diff --git a/install/apache-couchdb-install.sh b/install/apache-couchdb-install.sh
index 8ba55a802..72350a996 100644
--- a/install/apache-couchdb-install.sh
+++ b/install/apache-couchdb-install.sh
@@ -15,7 +15,7 @@ update_os
 
 msg_info "Installing Apache CouchDB"
 ERLANG_COOKIE=$(openssl rand -hex 32)
-ADMIN_PASS="$(openssl rand -base64 18 | cut -c1-13)"
+ADMIN_PASS="$(random_password 13)"
 debconf-set-selections <<<"couchdb couchdb/cookie string $ERLANG_COOKIE"
 debconf-set-selections <<<"couchdb couchdb/mode select standalone"
 debconf-set-selections <<<"couchdb couchdb/bindaddress string 0.0.0.0"
diff --git a/install/authentik-install.sh b/install/authentik-install.sh
index cfb86ee2a..732bdcec4 100644
--- a/install/authentik-install.sh
+++ b/install/authentik-install.sh
@@ -124,7 +124,6 @@ export UV_NO_BINARY_PACKAGE="cryptography lxml python-kadmin-rs xmlsec"
 export UV_COMPILE_BYTECODE="1"
 export UV_LINK_MODE="copy"
 export UV_NATIVE_TLS="1"
-export UV_HTTP_TIMEOUT="300"
 export UV_PYTHON_INSTALL_DIR="/usr/local/bin"
 cd /opt/authentik
 for attempt in 1 2 3; do
@@ -142,7 +141,7 @@ msg_ok "Setup python server"
 msg_info "Creating authentik config"
 mkdir -p /etc/authentik
 mv /opt/authentik/authentik/lib/default.yml /etc/authentik/config.yml
-yq -i ".secret_key = \"$(openssl rand -base64 128 | tr -dc 'a-zA-Z0-9' | head -c64)\"" /etc/authentik/config.yml
+yq -i ".secret_key = \"$(random_password 64)\"" /etc/authentik/config.yml
 yq -i ".postgresql.password = \"${PG_DB_PASS}\"" /etc/authentik/config.yml
 yq -i ".events.context_processors.geoip = \"/opt/authentik-data/geoip/GeoLite2-City.mmdb\"" /etc/authentik/config.yml
 yq -i ".events.context_processors.asn = \"/opt/authentik-data/geoip/GeoLite2-ASN.mmdb\"" /etc/authentik/config.yml
diff --git a/install/babybuddy-install.sh b/install/babybuddy-install.sh
index 0657a628b..c83ff1738 100644
--- a/install/babybuddy-install.sh
+++ b/install/babybuddy-install.sh
@@ -33,7 +33,7 @@ $STD uv venv --clear .venv
 $STD source .venv/bin/activate
 $STD uv pip install -r requirements.txt
 cp babybuddy/settings/production.example.py babybuddy/settings/production.py
-SECRET_KEY=$(openssl rand -base64 32 | tr -dc 'a-zA-Z0-9' | cut -c1-32)
+SECRET_KEY=$(random_password 32)
 ALLOWED_HOSTS=$(hostname -I | tr ' ' ',' | sed 's/,$//')",127.0.0.1,localhost"
 sed -i \
   -e "s/^SECRET_KEY = \"\"/SECRET_KEY = \"$SECRET_KEY\"/" \
diff --git a/install/baikal-install.sh b/install/baikal-install.sh
index f151d1c25..1b9f5454e 100644
--- a/install/baikal-install.sh
+++ b/install/baikal-install.sh
@@ -21,7 +21,7 @@ PG_VERSION="16" setup_postgresql
 PHP_APACHE="YES" PHP_VERSION="8.3" setup_php
 setup_composer
 fetch_and_deploy_gh_release "baikal" "sabre-io/Baikal" "tarball"
-PG_DB_NAME="baikal_db" PG_DB_USER="baikal_user" PG_DB_PASS="$(openssl rand -base64 12)" setup_postgresql_db
+PG_DB_NAME="baikal_db" PG_DB_USER="baikal_user" PG_DB_PASS="$(random_password 16)" setup_postgresql_db
 
 msg_info "Configuring Baikal"
 cd /opt/baikal
diff --git a/install/bar-assistant-install.sh b/install/bar-assistant-install.sh
index b4830fab7..ad846d7ed 100644
--- a/install/bar-assistant-install.sh
+++ b/install/bar-assistant-install.sh
@@ -34,7 +34,7 @@ msg_info "Configuring PHP"
 PHPVER=$(php -r 'echo PHP_MAJOR_VERSION . "." . PHP_MINOR_VERSION . "\n";')
 sed -i.bak -E 's/^\s*;?\s*ffi\.enable\s*=.*/ffi.enable=true/' /etc/php/${PHPVER}/fpm/php.ini
 $STD systemctl reload php${PHPVER}-fpm
-msg_info "configured PHP"
+msg_ok "Configured PHP"
 
 msg_info "Installing Bar Assistant"
 cd /opt/bar-assistant
diff --git a/install/baserow-install.sh b/install/baserow-install.sh
index d5c342418..15bc097e8 100644
--- a/install/baserow-install.sh
+++ b/install/baserow-install.sh
@@ -50,7 +50,7 @@ NODE_OPTIONS="--max-old-space-size=4096" $STD npm run build
 msg_ok "Built Frontend"
 
 msg_info "Configuring Baserow"
-SECRET_KEY=$(openssl rand -base64 64 | tr -dc 'a-zA-Z0-9' | head -c50)
+SECRET_KEY=$(random_password 50)
 cat <<EOF >/opt/baserow/.env
 DATABASE_HOST=localhost
 DATABASE_PORT=5432
diff --git a/install/bichon-install.sh b/install/bichon-install.sh
index fa1c5983e..ce197056d 100644
--- a/install/bichon-install.sh
+++ b/install/bichon-install.sh
@@ -28,7 +28,7 @@ fi
 
 msg_info "Setting up Bichon"
 mkdir -p /opt/bichon-data
-BICHON_ENC_PASSWORD=$(openssl rand -base64 32 | tr -d "=+/" | cut -c1-32)
+BICHON_ENC_PASSWORD=$(random_password 32)
 
 cat <<EOF >/opt/bichon/bichon.env
 BICHON_ROOT_DIR=/opt/bichon-data
diff --git a/install/bytestash-install.sh b/install/bytestash-install.sh
index bab20655a..2952feec4 100644
--- a/install/bytestash-install.sh
+++ b/install/bytestash-install.sh
@@ -17,7 +17,7 @@ NODE_VERSION="22" setup_nodejs
 fetch_and_deploy_gh_release "bytestash" "jordan-dalby/ByteStash" "tarball"
 
 msg_info "Installing ByteStash"
-JWT_SECRET=$(openssl rand -base64 32 | tr -d '/+=')
+JWT_SECRET=$(random_password 42)
 cd /opt/bytestash/server
 $STD npm install
 cd /opt/bytestash/client
diff --git a/install/checkmk-install.sh b/install/checkmk-install.sh
index f5ab12e2e..eda3fbd47 100644
--- a/install/checkmk-install.sh
+++ b/install/checkmk-install.sh
@@ -25,7 +25,7 @@ msg_ok "Installed Checkmk"
 msg_info "Creating Service"
 SITE_NAME="monitoring"
 $STD omd create "$SITE_NAME"
-MKPASSWORD=$(openssl rand -base64 18 | tr -d '/+=' | cut -c1-16)
+MKPASSWORD=$(random_password 16)
 
 echo -e "$MKPASSWORD\n$MKPASSWORD" | su - "$SITE_NAME" -c "cmk-passwd cmkadmin --stdin"
 $STD omd start "$SITE_NAME"
diff --git a/install/convertx-install.sh b/install/convertx-install.sh
index ca4e4d803..94d05fcba 100644
--- a/install/convertx-install.sh
+++ b/install/convertx-install.sh
@@ -63,7 +63,7 @@ cd /opt/convertx
 mkdir -p data
 $STD bun install
 
-JWT_SECRET=$(openssl rand -base64 32 | tr -dc 'a-zA-Z0-9' | head -c 32)
+JWT_SECRET=$(random_password 32)
 cat <<EOF >/opt/convertx/.env
 JWT_SECRET=$JWT_SECRET
 HTTP_ALLOWED=true
diff --git a/install/cosmos-install.sh b/install/cosmos-install.sh
index 04e75422a..183bce8b3 100644
--- a/install/cosmos-install.sh
+++ b/install/cosmos-install.sh
@@ -55,7 +55,7 @@ WantedBy=multi-user.target
 EOF
 
 systemctl enable -q --now cosmos
-msg_info "Created Service"
+msg_ok "Created Service"
 
 motd_ssh
 customize
diff --git a/install/directus-install.sh b/install/directus-install.sh
index 16c1f704e..99d1bcbf9 100644
--- a/install/directus-install.sh
+++ b/install/directus-install.sh
@@ -35,7 +35,7 @@ msg_ok "Installed Directus"
 msg_info "Configuring Directus"
 DIRECTUS_KEY=$(openssl rand -hex 32)
 DIRECTUS_SECRET=$(openssl rand -hex 32)
-DIRECTUS_ADMIN_PASSWORD=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c16)
+DIRECTUS_ADMIN_PASSWORD=$(random_password 16)
 cat <<EOF >/opt/directus/.env
 HOST="0.0.0.0"
 PORT=8055
diff --git a/install/discourse-install.sh b/install/discourse-install.sh
index 04146a373..175ac7b1d 100644
--- a/install/discourse-install.sh
+++ b/install/discourse-install.sh
@@ -33,7 +33,7 @@ NODE_VERSION="24" setup_nodejs
 RUBY_VERSION="3.4.4" setup_ruby
 
 msg_info "Configuring PostgreSQL for Discourse"
-DISCOURSE_DB_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
+DISCOURSE_DB_PASS=$(random_password 13)
 PG_HBA=$(find /etc/postgresql -name pg_hba.conf 2>/dev/null | head -n1)
 sed -i 's/^local\s\+all\s\+all\s\+peer$/local   all             all                                     md5/' "$PG_HBA"
 $STD systemctl restart postgresql
@@ -97,7 +97,7 @@ $STD bundle exec rails db:seed
 msg_ok "Set Up Database"
 
 msg_info "Creating Admin Account"
-ADMIN_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c16)
+ADMIN_PASS=$(random_password 16)
 $STD bundle exec rails runner "
 user = User.new(email: 'admin@discourse.local', username: 'admin', password: '${ADMIN_PASS}')
 user.active = true
diff --git a/install/dispatcharr-install.sh b/install/dispatcharr-install.sh
index b213e11b6..f83100a2e 100644
--- a/install/dispatcharr-install.sh
+++ b/install/dispatcharr-install.sh
@@ -62,7 +62,7 @@ install -d -m 755 \
   /data/uploads/{m3us,epgs} \
   /data/{m3us,epgs}
 chown -R root:root /data
-DJANGO_SECRET=$(openssl rand -base64 48 | tr -dc 'a-zA-Z0-9' | cut -c1-50)
+DJANGO_SECRET=$(random_password 50)
 export DATABASE_URL="postgresql://${PG_DB_USER}:${PG_DB_PASS}@localhost:5432/${PG_DB_NAME}"
 export POSTGRES_DB=$PG_DB_NAME
 export POSTGRES_USER=$PG_DB_USER
diff --git a/install/docmost-install.sh b/install/docmost-install.sh
index 373f0e4cd..3c748a78b 100644
--- a/install/docmost-install.sh
+++ b/install/docmost-install.sh
@@ -39,7 +39,7 @@ fi
 
 mv .env.example .env
 mkdir data
-sed -i -e "s|APP_SECRET=.*|APP_SECRET=$(openssl rand -base64 32 | tr -dc 'a-zA-Z0-9' | cut -c1-32)|" \
+sed -i -e "s|APP_SECRET=.*|APP_SECRET=$(random_password 32)|" \
   -e "s|DATABASE_URL=.*|DATABASE_URL=\"postgres://$PG_DB_USER:$PG_DB_PASS@localhost:5432/$PG_DB_NAME?schema=public\"|" \
   -e "s|FILE_UPLOAD_SIZE_LIMIT=.*|FILE_UPLOAD_SIZE_LIMIT=50mb|" \
   -e "s|DRAWIO_URL=.*|DRAWIO_URL=https://embed.diagrams.net|" \
diff --git a/install/dolibarr-install.sh b/install/dolibarr-install.sh
index b6b6181d3..4290df904 100644
--- a/install/dolibarr-install.sh
+++ b/install/dolibarr-install.sh
@@ -22,7 +22,7 @@ msg_ok "Installed Dependencies"
 setup_mariadb
 
 msg_info "Setting up Database"
-ROOT_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
+ROOT_PASS=$(random_password 13)
 $STD mariadb -u root -e "ALTER USER 'root'@'localhost' IDENTIFIED BY '$ROOT_PASS'; flush privileges;"
 cat <<EOF >~/dolibarr.creds
 Dolibarr DB Credentials
diff --git a/install/domain-locker-install.sh b/install/domain-locker-install.sh
index 093c61144..85f388660 100644
--- a/install/domain-locker-install.sh
+++ b/install/domain-locker-install.sh
@@ -46,7 +46,7 @@ set -a
 source /opt/domain-locker.env
 set +a
 $STD npm run build
-msg_info "Built Domain-Locker"
+msg_ok "Built Domain-Locker"
 
 msg_info "Building Database schema"
 export PGPASSWORD="$DL_PG_PASSWORD"
@@ -69,7 +69,7 @@ Restart=always
 WantedBy=multi-user.target
 EOF
 systemctl enable -q --now domain-locker
-msg_info "Created Service"
+msg_ok "Created Service"
 
 motd_ssh
 customize
diff --git a/install/dotnetaspwebapi-install.sh b/install/dotnetaspwebapi-install.sh
index cbf41c42f..f67f78e93 100644
--- a/install/dotnetaspwebapi-install.sh
+++ b/install/dotnetaspwebapi-install.sh
@@ -31,7 +31,7 @@ read -r -p "${TAB3}Type the assembly name of the project: " var_project_name
 
 msg_info "Setting up FTP Server"
 useradd ftpuser
-FTP_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
+FTP_PASS=$(random_password 13)
 usermod --password $(echo ${FTP_PASS} | openssl passwd -1 -stdin) ftpuser
 mkdir -p /var/www/html
 usermod -d /var/www/html ftp
diff --git a/install/duplicati-install.sh b/install/duplicati-install.sh
index 76a74c9e5..fa8abdf60 100644
--- a/install/duplicati-install.sh
+++ b/install/duplicati-install.sh
@@ -23,8 +23,8 @@ msg_ok "Installed Dependencies"
 fetch_and_deploy_gh_release "duplicati" "duplicati/duplicati" "binary" "latest" "/opt/duplicati" "duplicati-*-linux-$(arch_resolve "x64" "arm64")-gui.deb"
 
 msg_info "Configuring duplicati"
-DECRYPTKEY=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
-ADMINPASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
+DECRYPTKEY=$(random_password 13)
+ADMINPASS=$(random_password 13)
 cat <<EOF >~/duplicati.creds
 Admin password = ${ADMINPASS}
 Database encryption key = ${DECRYPTKEY}
diff --git a/install/elementsynapse-install.sh b/install/elementsynapse-install.sh
index 11b5e50f1..3c1689680 100644
--- a/install/elementsynapse-install.sh
+++ b/install/elementsynapse-install.sh
@@ -40,7 +40,7 @@ rm -f /usr/sbin/policy-rc.d
 sed -i 's/127.0.0.1/0.0.0.0/g' /etc/matrix-synapse/homeserver.yaml
 sed -i 's/'\''::1'\'', //g' /etc/matrix-synapse/homeserver.yaml
 SECRET=$(openssl rand -hex 32)
-ADMIN_PASS="$(openssl rand -base64 18 | cut -c1-13)"
+ADMIN_PASS="$(random_password 13)"
 echo "enable_registration_without_verification: true" >>/etc/matrix-synapse/homeserver.yaml
 echo "registration_shared_secret: ${SECRET}" >>/etc/matrix-synapse/homeserver.yaml
 
diff --git a/install/erpnext-install.sh b/install/erpnext-install.sh
index e98f32701..14e42a151 100644
--- a/install/erpnext-install.sh
+++ b/install/erpnext-install.sh
@@ -61,8 +61,8 @@ $STD sudo -u frappe bash -c 'export PATH="$HOME/.local/bin:$PATH"; uv tool insta
 msg_ok "Installed Frappe Bench"
 
 msg_info "Initializing Frappe Bench"
-ADMIN_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
-DB_ROOT_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
+ADMIN_PASS=$(random_password 13)
+DB_ROOT_PASS=$(random_password 13)
 mysql -u root -e "ALTER USER 'root'@'localhost' IDENTIFIED BY '${DB_ROOT_PASS}'; FLUSH PRIVILEGES;"
 $STD sudo -u frappe bash -c 'export PATH="$HOME/.local/bin:$PATH"; uv python install 3.14'
 $STD sudo -u frappe bash -c 'export PATH="$HOME/.local/bin:$PATH"; cd /opt && bench init --frappe-branch version-16 --python "$(uv python find 3.14)" frappe-bench'
diff --git a/install/ezbookkeeping-install.sh b/install/ezbookkeeping-install.sh
index f34ecbdc4..6f39ecf8a 100644
--- a/install/ezbookkeeping-install.sh
+++ b/install/ezbookkeeping-install.sh
@@ -17,7 +17,7 @@ fetch_and_deploy_gh_release "ezbookkeeping" "mayswind/ezbookkeeping" "prebuild"
 create_self_signed_cert
 
 msg_info "Configuring ezBookkeeping"
-SECRET_KEY=$(openssl rand -base64 64 | tr -dc 'a-zA-Z0-9' | head -c50)
+SECRET_KEY=$(random_password 50)
 sed -i "s/enable_gzip = false/enable_gzip = true/" /opt/ezbookkeeping/conf/ezbookkeeping.ini
 sed -i "s/protocol = http/protocol = https/" /opt/ezbookkeeping/conf/ezbookkeeping.ini
 sed -i "s/http_port = 8080/http_port = 443/" /opt/ezbookkeeping/conf/ezbookkeeping.ini
diff --git a/install/fileflows-install.sh b/install/fileflows-install.sh
index 1a18a3c2d..fbb623ae1 100644
--- a/install/fileflows-install.sh
+++ b/install/fileflows-install.sh
@@ -54,12 +54,11 @@ if [[ "$install_server" =~ ^[Ss]$ ]]; then
   systemctl enable -q --now fileflows
   msg_ok "Installed FileFlows Server"
 else
-  msg_info "Installing FileFlows Agent"
-  stop_spinner
   read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url
   while [[ -z "${server_url// /}" ]]; do
     read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url
   done
+  msg_info "Installing FileFlows Agent"
   cd /opt/fileflows/Agent
   before_units="$(systemctl list-unit-files 'fileflows*' --no-legend 2>/dev/null | awk '{print $1}' | sort || true)"
   $STD dotnet FileFlows.Agent.dll --server "$server_url" --systemd install --root true
diff --git a/install/firecrawl-install.sh b/install/firecrawl-install.sh
index 1a6582924..8bced9ba2 100644
--- a/install/firecrawl-install.sh
+++ b/install/firecrawl-install.sh
@@ -56,7 +56,7 @@ msg_ok "Configured pg_cron"
 msg_info "Configuring RabbitMQ"
 systemctl enable -q --now rabbitmq-server
 until rabbitmqctl status &>/dev/null; do sleep 1; done
-RABBITMQ_PASSWORD="$(openssl rand -base64 32 | tr -dc 'a-zA-Z0-9' | head -c24)"
+RABBITMQ_PASSWORD="$(random_password 24)"
 $STD rabbitmqctl add_user firecrawl "$RABBITMQ_PASSWORD"
 $STD rabbitmqctl set_permissions -p / firecrawl ".*" ".*" ".*"
 msg_ok "Configured RabbitMQ"
diff --git a/install/fireshare-install.sh b/install/fireshare-install.sh
index 3fe5497de..e1f7b014b 100644
--- a/install/fireshare-install.sh
+++ b/install/fireshare-install.sh
@@ -92,7 +92,7 @@ $STD ldconfig
 msg_ok "Compiled ffmpeg"
 
 msg_info "Configuring Fireshare (Patience)"
-ADMIN_PASSWORD=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
+ADMIN_PASSWORD=$(random_password 13)
 SECRET=$(openssl rand -base64 48)
 mkdir -p /opt/fireshare-{data,videos,images,processed}
 cd /opt/fireshare
diff --git a/install/fluid-calendar-install.sh b/install/fluid-calendar-install.sh
index 3f20f0a8b..630ebbb15 100644
--- a/install/fluid-calendar-install.sh
+++ b/install/fluid-calendar-install.sh
@@ -25,7 +25,7 @@ NODE_VERSION="24" setup_nodejs
 fetch_and_deploy_gh_release "fluid-calendar" "dotnetfactory/fluid-calendar" "tarball"
 
 msg_info "Configuring fluid-calendar"
-NEXTAUTH_SECRET="$(openssl rand -base64 44 | tr -dc 'a-zA-Z0-9' | cut -c1-32)"
+NEXTAUTH_SECRET="$(random_password 32)"
 echo "NextAuth Secret: $NEXTAUTH_SECRET" >>~/$APPLICATION.creds
 cat <<EOF >/opt/fluid-calendar/.env
 DATABASE_URL="postgresql://${PG_DB_USER}:${PG_DB_PASS}@localhost:5432/${PG_DB_NAME}"
diff --git a/install/forgejo-runner-install.sh b/install/forgejo-runner-install.sh
index 94ceb6877..23196c174 100644
--- a/install/forgejo-runner-install.sh
+++ b/install/forgejo-runner-install.sh
@@ -69,7 +69,6 @@ chmod +x /usr/local/bin/forgejo-runner
 echo "${RUNNER_VERSION}" >~/.forgejo-runner
 msg_ok "Installed Forgejo Runner"
 
-msg_info "Registering Forgejo Runner"
 export DOCKER_HOST="unix:///run/podman/podman.sock"
 
 msg_info "Generating Forgejo Runner Configuration"
diff --git a/install/ghostfolio-install.sh b/install/ghostfolio-install.sh
index 62621a568..4595b07ee 100644
--- a/install/ghostfolio-install.sh
+++ b/install/ghostfolio-install.sh
@@ -26,7 +26,7 @@ NODE_VERSION="24" setup_nodejs
 
 msg_info "Setting up Database"
 PG_DB_NAME="ghostfolio" PG_DB_USER="ghostfolio" PG_DB_SCHEMA_PERMS="true" setup_postgresql_db
-REDIS_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
+REDIS_PASS=$(random_password 13)
 ACCESS_TOKEN_SALT=$(openssl rand -base64 32)
 JWT_SECRET_KEY=$(openssl rand -base64 32)
 cat <<EOF >~/ghostfolio.creds
diff --git a/install/graylog-install.sh b/install/graylog-install.sh
index d3f8c3406..5cd4116db 100644
--- a/install/graylog-install.sh
+++ b/install/graylog-install.sh
@@ -16,7 +16,7 @@ update_os
 MONGO_VERSION="8.2" setup_mongodb
 
 msg_info "Setup Graylog Data Node"
-PASSWORD_SECRET=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c16)
+PASSWORD_SECRET=$(random_password 16)
 curl -fsSL "https://packages.graylog2.org/repo/packages/graylog-7.0-repository_latest.deb" -o "graylog-7.0-repository_latest.deb"
 $STD dpkg -i graylog-7.0-repository_latest.deb
 apt_update_safe
@@ -27,7 +27,7 @@ msg_ok "Setup Graylog Data Node"
 
 msg_info "Setup ${APPLICATION}"
 $STD apt install graylog-server
-ROOT_PASSWORD=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c16)
+ROOT_PASSWORD=$(random_password 16)
 cat <<EOF >~/graylog.creds
 ${APPLICATION} Credentials
 Admin User: admin
diff --git a/install/healthchecks-install.sh b/install/healthchecks-install.sh
index 1c240f51c..4e6dfad71 100644
--- a/install/healthchecks-install.sh
+++ b/install/healthchecks-install.sh
@@ -31,10 +31,10 @@ EOF
 msg_ok "Installed Dependencies"
 
 PG_VERSION=16 setup_postgresql
-PG_DB_NAME="healthchecks_db" PG_DB_USER="hc_user" PG_DB_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-13) setup_postgresql_db
+PG_DB_NAME="healthchecks_db" PG_DB_USER="hc_user" PG_DB_PASS=$(random_password 13) setup_postgresql_db
 
 msg_info "Setup Keys (Admin / Secret)"
-SECRET_KEY="$(openssl rand -base64 32 | tr -dc 'a-zA-Z0-9' | cut -c1-32)"
+SECRET_KEY="$(random_password 32)"
 ADMIN_EMAIL="admin@community-scripts.org"
 ADMIN_PASSWORD="$PG_DB_PASS"
 cat <<EOF >~/healthchecks.creds
diff --git a/install/hermesagent-install.sh b/install/hermesagent-install.sh
index 41e2a71c4..bfacdadc9 100644
--- a/install/hermesagent-install.sh
+++ b/install/hermesagent-install.sh
@@ -57,7 +57,7 @@ git config --system --add safe.directory /home/hermes/.hermes/hermes-agent 2>/de
 msg_ok "Installed Hermes Agent"
 
 msg_info "Configuring API Server"
-API_SERVER_KEY=$(openssl rand -base64 32 | tr -dc 'a-zA-Z0-9' | cut -c1-32)
+API_SERVER_KEY=$(random_password 32)
 mkdir -p /home/hermes/.hermes
 cat <<EOF >/home/hermes/.hermes/.env
 API_SERVER_ENABLED=true
diff --git a/install/hev-socks5-server-install.sh b/install/hev-socks5-server-install.sh
index 02871583c..87c028ac2 100644
--- a/install/hev-socks5-server-install.sh
+++ b/install/hev-socks5-server-install.sh
@@ -19,7 +19,7 @@ msg_info "Setup hev-socks5-server"
 mkdir -p /etc/hev-socks5-server
 download_file "https://raw.githubusercontent.com/heiher/hev-socks5-server/refs/heads/main/conf/main.yml" "/etc/hev-socks5-server/main.yml"
 sed -i 's/^#auth:/auth:/; s/^# file: conf\/auth.txt/  file: \/root\/hev.creds/'  /etc/hev-socks5-server/main.yml
-PASSWORD=$(openssl rand -base64 16)
+PASSWORD=$(random_password 21)
 echo "admin $PASSWORD 0" >/root/hev.creds
 msg_ok "Setup hev-socks5-server"
 
diff --git a/install/homebox-install.sh b/install/homebox-install.sh
index fce110b08..29c589415 100644
--- a/install/homebox-install.sh
+++ b/install/homebox-install.sh
@@ -18,7 +18,7 @@ fetch_and_deploy_gh_release "homebox" "sysadminsmedia/homebox" "prebuild" "lates
 
 msg_info "Configuring Homebox"
 chmod +x /opt/homebox/homebox
-AUTH_KEY="$(openssl rand -base64 32 | tr -dc 'a-zA-Z0-9' | cut -c1-32)"
+AUTH_KEY="$(random_password 32)"
 cat <<EOF >/opt/homebox/.env
 # For possible environment variables check here: https://homebox.software/en/configure-homebox
 HBOX_MODE=production
diff --git a/install/hoodik-install.sh b/install/hoodik-install.sh
index 5cbb863e0..90a2d1eb9 100644
--- a/install/hoodik-install.sh
+++ b/install/hoodik-install.sh
@@ -17,7 +17,7 @@ fetch_and_deploy_gh_release "hoodik" "hudikhq/hoodik" "prebuild" "latest" "/opt/
 
 msg_info "Configuring Hoodik"
 mkdir -p /opt/hoodik_data
-JWT_SECRET=$(openssl rand -base64 32 | tr -dc 'a-zA-Z0-9' | cut -c1-32)
+JWT_SECRET=$(random_password 32)
 cat <<EOF >/opt/hoodik/.env
 DATA_DIR=/opt/hoodik_data
 HTTP_PORT=5443
diff --git a/install/hortusfox-install.sh b/install/hortusfox-install.sh
index 30e6e4a4c..fa3b4fd95 100644
--- a/install/hortusfox-install.sh
+++ b/install/hortusfox-install.sh
@@ -46,7 +46,7 @@ $STD php asatru calendar:classes
 $STD php asatru plants:attributes
 $STD php asatru aquashell:config
 ADMIN_EMAIL="admin@example.com"
-ADMIN_PASS="$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)"
+ADMIN_PASS="$(random_password 13)"
 ADMIN_HASH=$(php -r "echo password_hash('$ADMIN_PASS', PASSWORD_BCRYPT);")
 $STD mariadb -u root -D $MARIADB_DB_NAME -e "INSERT IGNORE INTO UserModel (name, email, password, admin) VALUES ('Admin', '$ADMIN_EMAIL', '$ADMIN_HASH', 1);"
 cat <<EOF >~/hortusfox.creds
diff --git a/install/immich-install.sh b/install/immich-install.sh
index b7b37c0cd..ea4ec53a6 100644
--- a/install/immich-install.sh
+++ b/install/immich-install.sh
@@ -430,7 +430,6 @@ chown immich:immich "$INSTALL_DIR"
 find "$INSTALL_DIR" -maxdepth 1 -mindepth 1 ! -name upload -exec chown -R immich:immich {} +
 chown immich:immich "$UPLOAD_DIR" 2>/dev/null || true
 export VIRTUAL_ENV="${ML_DIR}/ml-venv"
-export UV_HTTP_TIMEOUT=300
 if [[ -f ~/.openvino ]]; then
   ML_PYTHON="python3.13"
   msg_info "Pre-installing Python ${ML_PYTHON} for machine-learning"
diff --git a/install/ironclaw-install.sh b/install/ironclaw-install.sh
index f88875e5e..832503145 100644
--- a/install/ironclaw-install.sh
+++ b/install/ironclaw-install.sh
@@ -97,7 +97,7 @@ setup_alpine() {
   msg_ok "Installed PostgreSQL"
 
   msg_info "Setting up Database"
-  PG_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-13)
+  PG_PASS=$(random_password 13)
   $STD su -s /bin/sh postgres -c "psql -c \"CREATE ROLE ironclaw WITH LOGIN PASSWORD '${PG_PASS}';\""
   $STD su -s /bin/sh postgres -c "psql -c \"CREATE DATABASE ironclaw WITH OWNER ironclaw;\""
   $STD su -s /bin/sh postgres -c "psql -d ironclaw -c \"CREATE EXTENSION IF NOT EXISTS vector;\""
diff --git a/install/jitsi-meet-install.sh b/install/jitsi-meet-install.sh
index a9e2c3fcf..17583d00e 100644
--- a/install/jitsi-meet-install.sh
+++ b/install/jitsi-meet-install.sh
@@ -83,7 +83,7 @@ if [[ -n "${var_jitsi_admin_user:-}" ]]; then
   msg_info "Configuring Secure Domain"
   # Only authenticated users may create rooms; guests join via the anonymous domain.
   # https://jitsi.github.io/handbook/docs/devops-guide/secure-domain/
-  var_jitsi_admin_pass="${var_jitsi_admin_pass:-$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-16)}"
+  var_jitsi_admin_pass="${var_jitsi_admin_pass:-$(random_password 16)}"
   sed -i "0,/authentication = \"jitsi-anonymous\"/s//authentication = \"internal_hashed\"/" \
     "/etc/prosody/conf.avail/${var_jitsi_domain}.cfg.lua"
   cat <<EOF >>"/etc/prosody/conf.avail/${var_jitsi_domain}.cfg.lua"
diff --git a/install/karakeep-install.sh b/install/karakeep-install.sh
index 6148c4349..7f92ee95e 100644
--- a/install/karakeep-install.sh
+++ b/install/karakeep-install.sh
@@ -66,7 +66,7 @@ EOF
 chmod +x /usr/bin/karakeep
 
 export DATA_DIR=/opt/karakeep_data
-karakeep_SECRET=$(openssl rand -base64 36 | cut -c1-24)
+karakeep_SECRET=$(random_password 24)
 mkdir -p /etc/karakeep
 cat <<EOF >/etc/karakeep/karakeep.env
 SERVER_VERSION="$(sed 's/^v//' ~/.karakeep)"
diff --git a/install/languagetool-install.sh b/install/languagetool-install.sh
index dd6930e44..224bd1515 100644
--- a/install/languagetool-install.sh
+++ b/install/languagetool-install.sh
@@ -60,18 +60,16 @@ if [[ -n "$lang_code" ]]; then
     filename=$(curl -fsSL https://languagetool.org/download/ngram-data/ | grep -oP "ngrams-${lang_code}-[0-9]+\.zip" | sort -uV | tail -n1)
 
     if [[ -n "$filename" ]]; then
-      msg_info "Downloading $filename"
       download_file "https://languagetool.org/download/ngram-data/${filename}" "/tmp/${filename}"
 
       mkdir -p /opt/ngrams
-      msg_info "Extracting $lang_code ngrams to /opt/ngrams"
       unzip -q "/tmp/${filename}" -d /opt/ngrams
       rm "/tmp/${filename}"
 
       ngram_dir="/opt/ngrams"
       msg_ok "Installed $lang_code ngrams"
     else
-      msg_info "No ngram file found for ${lang_code}"
+      msg_warn "No ngram file found for ${lang_code}"
     fi
   else
     msg_error "Invalid language code: $lang_code"
diff --git a/install/leafwiki-install.sh b/install/leafwiki-install.sh
index 228ffc702..752fd1e18 100644
--- a/install/leafwiki-install.sh
+++ b/install/leafwiki-install.sh
@@ -19,7 +19,7 @@ msg_info "Configuring LeafWiki"
 mkdir -p /opt/leafwiki/data
 mkdir -p /etc/leafwiki
 JWT_SECRET=$(openssl rand -hex 32)
-ADMIN_PASS=$(openssl rand -base64 12 | tr -dc 'a-zA-Z0-9' | head -c12)
+ADMIN_PASS=$(random_password 12)
 cat <<EOF >/etc/leafwiki/.env
 LEAFWIKI_DATA_DIR=/opt/leafwiki/data
 LEAFWIKI_HOST=0.0.0.0
diff --git a/install/leantime-install.sh b/install/leantime-install.sh
index 1f64c7aa9..7df43bc8f 100644
--- a/install/leantime-install.sh
+++ b/install/leantime-install.sh
@@ -46,7 +46,7 @@ mv "/opt/leantime/config/sample.env" "/opt/leantime/config/.env"
 sed -i -e "s|^LEAN_DB_DATABASE.*|LEAN_DB_DATABASE = '$MARIADB_DB_NAME'|" \
   -e "s|^LEAN_DB_USER.*|LEAN_DB_USER = '$MARIADB_DB_USER'|" \
   -e "s|^LEAN_DB_PASSWORD.*|LEAN_DB_PASSWORD = '$MARIADB_DB_PASS'|" \
-  -e "s|^LEAN_SESSION_PASSWORD.*|LEAN_SESSION_PASSWORD = '$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)'|" \
+  -e "s|^LEAN_SESSION_PASSWORD.*|LEAN_SESSION_PASSWORD = '$(random_password 13)'|" \
   "/opt/leantime/config/.env"
 $STD a2enmod -q proxy_fcgi setenvif rewrite
 $STD a2enconf -q "php8.4-fpm"
diff --git a/install/librenms-install.sh b/install/librenms-install.sh
index 7dd5cd872..5009ca9f3 100644
--- a/install/librenms-install.sh
+++ b/install/librenms-install.sh
@@ -45,7 +45,7 @@ PHP_VERSION="8.4" PHP_FPM="YES" PHP_MODULE="cli,snmp,gmp" setup_php
 setup_mariadb
 setup_composer
 PYTHON_VERSION="3.13" setup_uv
-MARIADB_DB_NAME="librenms" MARIADB_DB_USER="librenms" MARIADB_DB_PASS="$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)" setup_mariadb_db
+MARIADB_DB_NAME="librenms" MARIADB_DB_USER="librenms" MARIADB_DB_PASS="$(random_password 13)" setup_mariadb_db
 fetch_and_deploy_gh_release "librenms" "librenms/librenms" "tarball"
 
 msg_info "Configuring LibreNMS"
@@ -114,7 +114,7 @@ mkdir -p /etc/bash_completion.d/
 cp /opt/librenms/misc/lnms-completion.bash /etc/bash_completion.d/
 cp /opt/librenms/snmpd.conf.example /etc/snmp/snmpd.conf
 
-APP_PASSWORD=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
+APP_PASSWORD=$(random_password 13)
 APP_USER="admin"
 cat <<EOF >~/librenms.creds
 LibreNMS Credentials
@@ -128,7 +128,7 @@ $STD su - librenms -s /bin/bash -c "cd /opt/librenms && php8.4 artisan key:gener
 $STD su - librenms -s /bin/bash -c "cd /opt/librenms && lnms db:seed --force"
 $STD su - librenms -s /bin/bash -c "cd /opt/librenms && lnms user:add -p ${APP_PASSWORD} ${APP_USER} --role=admin"
 
-RANDOM_STRING=$(openssl rand -base64 16 | tr -dc 'a-zA-Z0-9')
+RANDOM_STRING=$(random_password 20)
 sed -i "s/RANDOMSTRINGGOESHERE/$RANDOM_STRING/g" /etc/snmp/snmpd.conf
 echo "SNMP Community String: $RANDOM_STRING" >>~/librenms.creds
 curl -qso /usr/bin/distro https://raw.githubusercontent.com/librenms/librenms-agent/master/snmp/distro
diff --git a/install/linkding-install.sh b/install/linkding-install.sh
index cf90d016b..f61151e22 100644
--- a/install/linkding-install.sh
+++ b/install/linkding-install.sh
@@ -42,7 +42,7 @@ touch bookmarks/settings/custom.py
 $STD uv sync --no-dev --frozen
 $STD uv pip install gunicorn
 mkdir -p data/{favicons,previews,assets}
-ADMIN_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-13)
+ADMIN_PASS=$(random_password 13)
 cat <<EOF >/opt/linkding/.env
 LD_SUPERUSER_NAME=admin
 LD_SUPERUSER_PASSWORD=${ADMIN_PASS}
diff --git a/install/linkwarden-install.sh b/install/linkwarden-install.sh
index 93d9ab841..08df2319c 100644
--- a/install/linkwarden-install.sh
+++ b/install/linkwarden-install.sh
@@ -32,7 +32,7 @@ fi
 fetch_and_deploy_gh_release "linkwarden" "linkwarden/linkwarden" "tarball"
 
 msg_info "Installing Linkwarden (Patience)"
-SECRET_KEY="$(head /dev/urandom | tr -dc A-Za-z0-9 | head -c 32)"
+SECRET_KEY="$(random_password 32)"
 echo "Linkwarden Secret: $SECRET_KEY" >>"${HOME}/linkwarden.creds"
 cd /opt/linkwarden
 yarn_ver="4.12.0"
diff --git a/install/livebook-install.sh b/install/livebook-install.sh
index a8751f84a..bb8665fb1 100644
--- a/install/livebook-install.sh
+++ b/install/livebook-install.sh
@@ -44,7 +44,7 @@ $STD sh install.sh elixir@latest otp@latest
 msg_info "Setup Erlang and Elixir"
 ERLANG_VERSION=$(ls /opt/livebook/.elixir-install/installs/otp/ | head -n1)
 ELIXIR_VERSION=$(ls /opt/livebook/.elixir-install/installs/elixir/ | head -n1)
-LIVEBOOK_PASSWORD=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c16)
+LIVEBOOK_PASSWORD=$(random_password 16)
 
 export ERLANG_BIN="/opt/livebook/.elixir-install/installs/otp/$ERLANG_VERSION/bin"
 export ELIXIR_BIN="/opt/livebook/.elixir-install/installs/elixir/$ELIXIR_VERSION/bin"
diff --git a/install/mail-archiver-install.sh b/install/mail-archiver-install.sh
index d4dfc839c..603033402 100644
--- a/install/mail-archiver-install.sh
+++ b/install/mail-archiver-install.sh
@@ -68,7 +68,7 @@ Restart=always
 WantedBy=multi-user.target
 EOF
 systemctl enable -q --now mail-archiver
-msg_info "Created Service"
+msg_ok "Created Service"
 
 motd_ssh
 customize
diff --git a/install/managemydamnlife-install.sh b/install/managemydamnlife-install.sh
index 1bb3b15dc..f321b0fa9 100644
--- a/install/managemydamnlife-install.sh
+++ b/install/managemydamnlife-install.sh
@@ -32,7 +32,7 @@ sed -i -e 's|db|localhost|' \
   -e 's|5433|3306|' \
   -e 's|DB_DIALECT=postgres|DB_DIALECT=mysql|' \
   -e "s|sample_install_mmdm|mmdl|" \
-  -e "s|=PASSWORD|=$(openssl rand -base64 40 | tr -dc 'a-zA-Z0-9' | head -c40)|" \
+  -e "s|=PASSWORD|=$(random_password 40)|" \
   /opt/mmdl/.env
 cd /opt/mmdl
 export NEXT_TELEMETRY_DISABLED=1
diff --git a/install/miniflux-install.sh b/install/miniflux-install.sh
index 48d0e4ed0..016246245 100644
--- a/install/miniflux-install.sh
+++ b/install/miniflux-install.sh
@@ -19,7 +19,7 @@ fetch_and_deploy_gh_release "miniflux" "miniflux/v2" "binary" "latest"
 
 msg_info "Configuring Miniflux"
 ADMIN_NAME=admin
-ADMIN_PASS="$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)"
+ADMIN_PASS="$(random_password 13)"
 cat <<EOF >/etc/miniflux.conf
 # See https://miniflux.app/docs/configuration.html
 DATABASE_URL=user=$PG_DB_USER password=$PG_DB_PASS dbname=$PG_DB_NAME sslmode=disable
diff --git a/install/minthcm-install.sh b/install/minthcm-install.sh
index 629c6a6ce..17590483c 100644
--- a/install/minthcm-install.sh
+++ b/install/minthcm-install.sh
@@ -58,7 +58,7 @@ systemctl enable -q --now elasticsearch
 msg_ok "Set up Elasticsearch"
 
 msg_info "Configuring Database"
-DB_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
+DB_PASS=$(random_password 13)
 $STD mariadb -u root -e "CREATE USER 'minthcm'@'localhost' IDENTIFIED BY '${DB_PASS}';"
 $STD mariadb -u root -e "GRANT ALL ON *.* TO 'minthcm'@'localhost'; FLUSH PRIVILEGES;"
 sed -i "s/^DB_HOST=.*/DB_HOST=localhost/" /var/www/script/.env
diff --git a/install/mysql-install.sh b/install/mysql-install.sh
index 0dd98cce7..06476fef6 100644
--- a/install/mysql-install.sh
+++ b/install/mysql-install.sh
@@ -54,7 +54,7 @@ $STD apt install -y \
 msg_ok "Installed MySQL"
 
 msg_info "Configure MySQL Server"
-ADMIN_PASS="$(openssl rand -base64 18 | cut -c1-13)"
+ADMIN_PASS="$(random_password 13)"
 $STD mysql -uroot -p"$ADMIN_PASS" -e "ALTER USER 'root'@'localhost' IDENTIFIED WITH $RELEASE_AUTH BY '$ADMIN_PASS'; FLUSH PRIVILEGES;"
 echo "" >~/mysql.creds
 echo -e "MySQL user: root" >>~/mysql.creds
diff --git a/install/netbox-install.sh b/install/netbox-install.sh
index d2b48ae5c..729c25a17 100644
--- a/install/netbox-install.sh
+++ b/install/netbox-install.sh
@@ -117,7 +117,7 @@ msg_ok "Configured NetBox"
 
 msg_info "Setting up Django Admin"
 DJANGO_USER=Admin
-DJANGO_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-13)
+DJANGO_PASS=$(random_password 13)
 
 source /opt/netbox/venv/bin/activate
 $STD python3 /opt/netbox/netbox/manage.py shell <<EOF
diff --git a/install/nodebb-install.sh b/install/nodebb-install.sh
index 8c040df26..865318035 100644
--- a/install/nodebb-install.sh
+++ b/install/nodebb-install.sh
@@ -26,9 +26,9 @@ NODE_VERSION="22" setup_nodejs
 
 msg_info "Configuring MongoDB"
 MONGO_ADMIN_USER="admin"
-MONGO_ADMIN_PWD="$(openssl rand -base64 18 | cut -c1-13)"
+MONGO_ADMIN_PWD="$(random_password 13)"
 NODEBB_USER="nodebb"
-NODEBB_PWD="$(openssl rand -base64 18 | cut -c1-13)"
+NODEBB_PWD="$(random_password 13)"
 MONGO_CONNECTION_STRING="mongodb://${NODEBB_USER}:${NODEBB_PWD}@localhost:27017/nodebb"
 NODEBB_SECRET=$(uuidgen)
 cat <<EOF >~/nodebb.creds
diff --git a/install/omniroute-install.sh b/install/omniroute-install.sh
index cbc370887..44e7c2193 100644
--- a/install/omniroute-install.sh
+++ b/install/omniroute-install.sh
@@ -26,7 +26,7 @@ JWT_SECRET=$(openssl rand -base64 48)
 API_KEY_SECRET=$(openssl rand -hex 32)
 STORAGE_ENCRYPTION_KEY=$(openssl rand -hex 32)
 STORAGE_ENCRYPTION_KEY_VERSION=v1
-INITIAL_PASSWORD=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-20)
+INITIAL_PASSWORD=$(random_password 20)
 PORT=20128
 OMNIROUTE_SERVER_HOST=0.0.0.0
 EOF
diff --git a/install/onlyoffice-install.sh b/install/onlyoffice-install.sh
index 010f0136e..cd203a1d1 100644
--- a/install/onlyoffice-install.sh
+++ b/install/onlyoffice-install.sh
@@ -50,7 +50,7 @@ rm -f "$TMP_KEY_CONTENT"
 
 msg_info "Preconfiguring ONLYOFFICE Debconf Settings"
 RMQ_USER=onlyoffice_rmq
-RMQ_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-13)
+RMQ_PASS=$(random_password 13)
 JWT_SECRET=$(openssl rand -hex 16)
 $STD rabbitmqctl add_user $RMQ_USER $RMQ_PASS
 $STD rabbitmqctl set_permissions -p / $RMQ_USER ".*" ".*" ".*"
diff --git a/install/openobserve-install.sh b/install/openobserve-install.sh
index 84c1a79c8..3f6a192db 100644
--- a/install/openobserve-install.sh
+++ b/install/openobserve-install.sh
@@ -17,7 +17,7 @@ msg_info "Installing OpenObserve"
 mkdir -p /opt/openobserve/data
 RELEASE=$(get_latest_github_release "openobserve/openobserve")
 tar zxf <(curl -fsSL https://downloads.openobserve.ai/releases/openobserve/v$RELEASE/openobserve-v$RELEASE-linux-$(arch_resolve).tar.gz) -C /opt/openobserve
-ROOT_PASS="$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c9)Aa1!"
+ROOT_PASS="$(random_password 9)Aa1!"
 
 cat <<EOF >/opt/openobserve/data/.env
 ZO_ROOT_USER_EMAIL = "admin@example.com"
diff --git a/install/openproject-install.sh b/install/openproject-install.sh
index 6fd65fd03..9ce6311b7 100644
--- a/install/openproject-install.sh
+++ b/install/openproject-install.sh
@@ -22,7 +22,7 @@ msg_ok "Installed Dependencies"
 
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="openproject" PG_DB_USER="openproject" setup_postgresql_db
-API_KEY=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-13)
+API_KEY=$(random_password 13)
 echo "OpenProject API Key: $API_KEY" >>~/openproject.creds
 fetch_and_deploy_gh_release "jemalloc" "jemalloc/jemalloc" "tarball"
 
diff --git a/install/openwebui-install.sh b/install/openwebui-install.sh
index fd46db8ed..752fb7231 100644
--- a/install/openwebui-install.sh
+++ b/install/openwebui-install.sh
@@ -46,7 +46,6 @@ if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
 fi
 
 msg_info "Installing Open WebUI"
-export UV_HTTP_TIMEOUT=300
 for attempt in $(seq 1 3); do
   $STD uv tool install --python 3.12 --constraint <(echo "numba>=0.60") "${OTEL_ARGS[@]}" open-webui[all] && break
   [[ $attempt -lt 3 ]] && msg_warn "Open WebUI install attempt $attempt failed, retrying..." && sleep 10
diff --git a/install/pangolin-install.sh b/install/pangolin-install.sh
index fa2c58512..421154d2b 100644
--- a/install/pangolin-install.sh
+++ b/install/pangolin-install.sh
@@ -41,7 +41,7 @@ if [[ -z "$pango_email" ]]; then
 fi
 
 msg_info "Setup Pangolin"
-SECRET_KEY=$(openssl rand -base64 48 | tr -dc 'A-Za-z0-9' | head -c 32)
+SECRET_KEY=$(random_password 32)
 BADGER_VERSION=$(get_latest_github_release "fosrl/badger" "false")
 cd /opt/pangolin
 mkdir -p /opt/pangolin/config/{traefik,db,letsencrypt,logs}
diff --git a/install/paperclip-install.sh b/install/paperclip-install.sh
index f37e63515..25885cf8b 100644
--- a/install/paperclip-install.sh
+++ b/install/paperclip-install.sh
@@ -100,7 +100,7 @@ for PAPERCLIP_ONBOARD_CMD in \
   if ! grep -q "unknown option '--bind'" "$PAPERCLIP_ONBOARD_LOG"; then
     break
   fi
-  msg_info "Retrying Paperclip Onboarding"
+  msg_warn "Retrying Paperclip Onboarding"
 done
 
 if [[ ! -f "$PAPERCLIP_CONFIG" ]]; then
@@ -127,7 +127,7 @@ EOF
     msg_warn "Paperclip authenticated mode is enabled, but no CEO invite was generated automatically"
   fi
 else
-  msg_info "Paperclip Bootstrapped in Local Trusted Mode"
+  msg_ok "Running in local trusted mode"
 fi
 rm -f "$PAPERCLIP_ONBOARD_LOG" "$PAPERCLIP_BOOTSTRAP_LOG"
 msg_ok "Bootstrapped Paperclip"
diff --git a/install/paperless-ngx-install.sh b/install/paperless-ngx-install.sh
index d8a1cc9c5..16bbca14d 100644
--- a/install/paperless-ngx-install.sh
+++ b/install/paperless-ngx-install.sh
@@ -54,7 +54,7 @@ rm -rf /opt/paperless/docker
 $STD uv sync --all-extras
 mkdir -p /opt/paperless_data/{consume,data,media,trash}
 mkdir -p /opt/paperless/static
-SECRET_KEY="$(head /dev/urandom | tr -dc A-Za-z0-9 | head -c 32)"
+SECRET_KEY="$(random_password 32)"
 cat <<EOF >~/paperless-ngx.creds
 
 Paperless-ngx Secret Key: $SECRET_KEY
diff --git a/install/plane-install.sh b/install/plane-install.sh
index a6dfc940a..a0a940774 100644
--- a/install/plane-install.sh
+++ b/install/plane-install.sh
@@ -37,7 +37,7 @@ PG_VERSION="16" setup_postgresql
 PG_DB_NAME="plane" PG_DB_USER="plane" setup_postgresql_db
 
 msg_info "Configuring RabbitMQ"
-RABBITMQ_PASS=$(openssl rand -base64 24 | tr -dc 'a-zA-Z0-9' | head -c16)
+RABBITMQ_PASS=$(random_password 16)
 $STD rabbitmqctl add_vhost plane
 $STD rabbitmqctl add_user plane "${RABBITMQ_PASS}"
 $STD rabbitmqctl set_permissions -p plane plane ".*" ".*" ".*"
@@ -48,8 +48,8 @@ fetch_and_deploy_gh_release "silo_mcli" "pgsty/mc" "prebuild" "latest" "/opt/mcl
 
 msg_info "Configuring Silo"
 mkdir -p /opt/minio/data
-MINIO_ACCESS_KEY=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c16)
-MINIO_SECRET_KEY=$(openssl rand -base64 36 | tr -dc 'a-zA-Z0-9' | head -c32)
+MINIO_ACCESS_KEY=$(random_password 16)
+MINIO_SECRET_KEY=$(random_password 32)
 cat <<EOF >/etc/default/minio
 MINIO_ROOT_USER="${MINIO_ACCESS_KEY}"
 MINIO_ROOT_PASSWORD="${MINIO_SECRET_KEY}"
diff --git a/install/plant-it-install.sh b/install/plant-it-install.sh
index 8a284baab..b5de0a654 100644
--- a/install/plant-it-install.sh
+++ b/install/plant-it-install.sh
@@ -25,8 +25,8 @@ JAVA_VERSION="21" setup_java
 USE_ORIGINAL_FILENAME="true" fetch_and_deploy_gh_release "plant-it" "MDeLuise/plant-it" "singlefile" "0.10.0" "/opt/plant-it/backend" "server.jar"
 fetch_and_deploy_gh_release "plant-it-front" "MDeLuise/plant-it" "prebuild" "0.10.0" "/opt/plant-it/frontend" "client.tar.gz"
 
-msg_info "Configured Plant-it"
-JWT_SECRET=$(openssl rand -base64 24 | tr -d '/+=')
+msg_info "Configuring Plant-it"
+JWT_SECRET=$(random_password 32)
 mkdir -p /opt/plant-it-data
 cat <<EOF >/opt/plant-it/backend/server.env
 MYSQL_HOST=localhost
diff --git a/install/podman-homeassistant-install.sh b/install/podman-homeassistant-install.sh
index 03fb87b4d..7b8f81563 100644
--- a/install/podman-homeassistant-install.sh
+++ b/install/podman-homeassistant-install.sh
@@ -16,7 +16,7 @@ update_os
 PORTAINER_LATEST_VERSION=$(get_latest_github_release "portainer/portainer")
 PORTAINER_AGENT_LATEST_VERSION=$(get_latest_github_release "portainer/agent")
 
-if $STD mount | grep 'on / type zfs' >null && echo "ZFS"; then
+if $STD mount | grep 'on / type zfs' >/dev/null && echo "ZFS"; then
   msg_info "Enabling ZFS support."
   mkdir -p /etc/containers
   cat <<'EOF' >/usr/local/bin/overlayzfsmount
@@ -37,6 +37,7 @@ mount_program = "/usr/local/bin/overlayzfsmount"
 [storage.options.overlay]
 mountopt = "nodev"
 EOF
+  msg_ok "Enabled ZFS support"
 fi
 
 msg_info "Installing Podman"
diff --git a/install/podman-install.sh b/install/podman-install.sh
index 6e1cd58c2..64fe3ef97 100644
--- a/install/podman-install.sh
+++ b/install/podman-install.sh
@@ -16,7 +16,7 @@ update_os
 PORTAINER_LATEST_VERSION=$(get_latest_github_release "portainer/portainer")
 PORTAINER_AGENT_LATEST_VERSION=$(get_latest_github_release "portainer/agent")
 
-if $STD mount | grep 'on / type zfs' >null && echo "ZFS"; then
+if $STD mount | grep 'on / type zfs' >/dev/null && echo "ZFS"; then
   msg_info "Enabling ZFS support."
   mkdir -p /etc/containers
   cat <<'EOF' >/usr/local/bin/overlayzfsmount
@@ -37,6 +37,7 @@ mount_program = "/usr/local/bin/overlayzfsmount"
 [storage.options.overlay]
 mountopt = "nodev"
 EOF
+  msg_ok "Enabled ZFS support"
 fi
 
 msg_info "Installing Podman"
diff --git a/install/powerdns-install.sh b/install/powerdns-install.sh
index 904a43b1c..3f947ced3 100644
--- a/install/powerdns-install.sh
+++ b/install/powerdns-install.sh
@@ -55,7 +55,7 @@ sqlite3 /var/lib/powerdns/powerdns.db </opt/poweradmin/sql/pdns/49/schema.sqlite
 PA_ADMIN_USERNAME="admin"
 PA_ADMIN_EMAIL="admin@example.com"
 PA_ADMIN_FULLNAME="Administrator"
-PA_ADMIN_PASSWORD=$(openssl rand -base64 16 | tr -d "=+/" | cut -c1-16)
+PA_ADMIN_PASSWORD=$(random_password 16)
 PA_SESSION_KEY=$(openssl rand -base64 75 | tr -dc 'A-Za-z0-9^@#!(){}[]%_\-+=~' | head -c 50)
 PASSWORD_HASH=$(php -r "echo password_hash(\$argv[1], PASSWORD_DEFAULT);" -- "${PA_ADMIN_PASSWORD}" 2>/dev/null)
 sqlite3 /var/lib/powerdns/powerdns.db "INSERT INTO users (username, password, fullname, email, description, perm_templ, active, use_ldap) \
diff --git a/install/projectsend-install.sh b/install/projectsend-install.sh
index d017ececd..a5f4b89be 100644
--- a/install/projectsend-install.sh
+++ b/install/projectsend-install.sh
@@ -28,7 +28,7 @@ msg_info "Configuring ProjectSend"
 cd /opt/projectsend
 cp .env.example .env
 ADMIN_EMAIL="admin@example.com"
-ADMIN_PASSWORD=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
+ADMIN_PASSWORD=$(random_password 13)
 sed -i \
   -e "s|^APP_ENV=.*|APP_ENV=production|" \
   -e "s|^APP_DEBUG=.*|APP_DEBUG=false|" \
diff --git a/install/pterodactyl-panel-install.sh b/install/pterodactyl-panel-install.sh
index 8754a0a75..71de60220 100644
--- a/install/pterodactyl-panel-install.sh
+++ b/install/pterodactyl-panel-install.sh
@@ -56,7 +56,7 @@ fetch_and_deploy_gh_release "pterodactyl-panel" "pterodactyl/panel" "prebuild" "
 msg_info "Installing pterodactyl Panel"
 cd /opt/pterodactyl-panel
 cp .env.example .env
-ADMIN_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
+ADMIN_PASS=$(random_password 13)
 $STD composer install --no-dev --optimize-autoloader --no-interaction
 $STD php artisan key:generate --force
 $STD php artisan p:environment:setup --no-interaction --author "$ADMIN_EMAIL" --url "http://$LOCAL_IP"
diff --git a/install/radicale-install.sh b/install/radicale-install.sh
index 18adbea2a..d16c19e41 100644
--- a/install/radicale-install.sh
+++ b/install/radicale-install.sh
@@ -22,7 +22,7 @@ fetch_and_deploy_gh_release "Radicale" "Kozea/Radicale" "tarball" "latest" "/opt
 
 msg_info "Setting up Radicale"
 cd /opt/radicale
-RNDPASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
+RNDPASS=$(random_password 13)
 $STD htpasswd -c -b -5 /opt/radicale/users admin "$RNDPASS"
 cat <<EOF >~/radicale.creds
 Radicale Credentials
diff --git a/install/rclone-install.sh b/install/rclone-install.sh
index 68cb3f3ee..dda8974cd 100644
--- a/install/rclone-install.sh
+++ b/install/rclone-install.sh
@@ -22,7 +22,7 @@ setup_deb_based() {
 
   msg_info "Installing rclone"
   cd /opt/rclone
-  RCLONE_PASSWORD=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
+  RCLONE_PASSWORD=$(random_password 13)
   $STD htpasswd -cb -B /opt/login.pwd admin "$RCLONE_PASSWORD"
   cat <<EOF >~/rclone.creds
 rclone-Credentials
diff --git a/install/rustfs-install.sh b/install/rustfs-install.sh
index a961b3b5c..d6c1f89d6 100644
--- a/install/rustfs-install.sh
+++ b/install/rustfs-install.sh
@@ -19,7 +19,7 @@ chmod +x /opt/rustfs/rustfs
 
 msg_info "Configuring RustFS"
 RUSTFS_ACCESS_KEY=$(openssl rand -hex 8)
-RUSTFS_SECRET_KEY=$(openssl rand -base64 24 | tr -dc 'a-zA-Z0-9' | head -c 32)
+RUSTFS_SECRET_KEY=$(random_password 32)
 cat <<EOF >/etc/default/rustfs
 RUSTFS_ACCESS_KEY=${RUSTFS_ACCESS_KEY}
 RUSTFS_SECRET_KEY=${RUSTFS_SECRET_KEY}
diff --git a/install/safebucket-install.sh b/install/safebucket-install.sh
index d190656f8..ade47215b 100644
--- a/install/safebucket-install.sh
+++ b/install/safebucket-install.sh
@@ -116,7 +116,7 @@ msg_info "Configuring Safebucket"
 useradd --system --no-create-home --shell /usr/sbin/nologin safebucket 2>/dev/null || true
 mkdir -p /opt/safebucket/data/{notifications,activity}
 TOKEN_SECRET=$(openssl rand -base64 32)
-MFA_KEY=$(openssl rand -base64 48 | tr -dc 'a-zA-Z0-9' | cut -c1-32)
+MFA_KEY=$(random_password 32)
 ADMIN_PASSWORD=$(openssl rand -hex 12)
 cat <<EOF >/opt/safebucket/config.yaml
 app:
diff --git a/install/seanime-install.sh b/install/seanime-install.sh
index 28fbc1fa7..9da3c9c99 100644
--- a/install/seanime-install.sh
+++ b/install/seanime-install.sh
@@ -30,7 +30,7 @@ fetch_and_deploy_gh_release "seanime" "5rahim/seanime" "prebuild" "latest" "/opt
 chmod +x /opt/seanime/seanime
 
 msg_info "Configuring Seanime"
-SEANIME_PASSWORD=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-13)
+SEANIME_PASSWORD=$(random_password 13)
 mkdir -p /opt/seanime-data
 cat <<EOF >/opt/seanime-data/config.toml
 [server]
diff --git a/install/searxng-install.sh b/install/searxng-install.sh
index ad38297b2..68ef88ec8 100644
--- a/install/searxng-install.sh
+++ b/install/searxng-install.sh
@@ -93,7 +93,7 @@ chown searxng:searxng /etc/searxng/settings.yml
 chmod 640 /etc/searxng/settings.yml
 msg_ok "Configured settings"
 
-msg_info "Set up web services"
+msg_info "Setting up web services"
 cat <<EOF >/etc/systemd/system/searxng.service
 [Unit]
 Description=SearXNG service
diff --git a/install/seelf-install.sh b/install/seelf-install.sh
index 19e7d0c38..8eefc8fd6 100644
--- a/install/seelf-install.sh
+++ b/install/seelf-install.sh
@@ -26,7 +26,7 @@ GO_VERSION="$(grep -m1 '^go ' /opt/seelf/go.mod | awk '{print $2}')" setup_go
 msg_info "Setting up seelf. Patience"
 cd /opt/seelf
 $STD make build
-PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
+PASS=$(random_password 13)
 mkdir -p /opt/seelf/data
 {
   echo "ADMIN_EMAIL=admin@example.com"
diff --git a/install/semaphore-install.sh b/install/semaphore-install.sh
index f86d61be5..72ac8bf9a 100644
--- a/install/semaphore-install.sh
+++ b/install/semaphore-install.sh
@@ -27,7 +27,7 @@ cd /opt/semaphore
 SEM_HASH=$(openssl rand -base64 32)
 SEM_ENCRYPTION=$(openssl rand -base64 32)
 SEM_KEY=$(openssl rand -base64 32)
-SEM_PW=$(openssl rand -base64 12)
+SEM_PW=$(random_password 16)
 cat <<EOF >/opt/semaphore/config.json
 {
   "sqlite": {
diff --git a/install/silo-install.sh b/install/silo-install.sh
index 220c8a36e..812bd645c 100644
--- a/install/silo-install.sh
+++ b/install/silo-install.sh
@@ -18,7 +18,7 @@ fetch_and_deploy_gh_release "silo" "pgsty/silo" "binary"
 msg_info "Configuring Silo"
 mkdir -p /opt/silo_data
 chown silo:silo /opt/silo_data
-SILO_ROOT_PASSWORD=$(openssl rand -base64 32 | tr -dc 'a-zA-Z0-9' | head -c 32)
+SILO_ROOT_PASSWORD=$(random_password 32)
 cat <<EOF >/etc/default/silo
 MINIO_VOLUMES="/opt/silo_data"
 MINIO_OPTS="--console-address :9001"
diff --git a/install/sparkyfitness-install.sh b/install/sparkyfitness-install.sh
index 78ac983ae..2b2904a2b 100644
--- a/install/sparkyfitness-install.sh
+++ b/install/sparkyfitness-install.sh
@@ -36,7 +36,7 @@ sed \
   -e "s|^SPARKY_FITNESS_DB_USER=.*|SPARKY_FITNESS_DB_USER=sparky|" \
   -e "s|^SPARKY_FITNESS_DB_PASSWORD=.*|SPARKY_FITNESS_DB_PASSWORD=${PG_DB_PASS}|" \
   -e "s|^# SPARKY_FITNESS_APP_DB_USER=.*|SPARKY_FITNESS_APP_DB_USER=sparky_app|" \
-  -e "s|^# SPARKY_FITNESS_APP_DB_PASSWORD=.*|SPARKY_FITNESS_APP_DB_PASSWORD=$(openssl rand -base64 24 | tr -dc 'a-zA-Z0-9' | head -c20)|" \
+  -e "s|^# SPARKY_FITNESS_APP_DB_PASSWORD=.*|SPARKY_FITNESS_APP_DB_PASSWORD=$(random_password 20)|" \
   -e "s|^# SPARKY_FITNESS_SERVER_HOST=.*|SPARKY_FITNESS_SERVER_HOST=localhost|" \
   -e "s|^# SPARKY_FITNESS_SERVER_PORT=.*|SPARKY_FITNESS_SERVER_PORT=3010|" \
   -e "s|^SPARKY_FITNESS_FRONTEND_URL=.*|SPARKY_FITNESS_FRONTEND_URL=http://${LOCAL_IP}:80|" \
diff --git a/install/splunk-enterprise-install.sh b/install/splunk-enterprise-install.sh
index f2a2c9336..26e2abf41 100644
--- a/install/splunk-enterprise-install.sh
+++ b/install/splunk-enterprise-install.sh
@@ -58,7 +58,7 @@ msg_ok "Setup Splunk Enterprise v${RELEASE}"
 
 msg_info "Creating Splunk admin user"
 ADMIN_USER="admin"
-ADMIN_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
+ADMIN_PASS=$(random_password 13)
 cat <<EOF >~/splunk.creds
 Splunk-Credentials
 Username: $ADMIN_USER
diff --git a/install/sportarr-install.sh b/install/sportarr-install.sh
index aedb4a7d1..bb8d35901 100644
--- a/install/sportarr-install.sh
+++ b/install/sportarr-install.sh
@@ -48,7 +48,7 @@ Restart=always
 WantedBy=multi-user.target
 EOF
 systemctl enable -q --now sportarr
-msg_info "Created Service"
+msg_ok "Created Service"
 
 motd_ssh
 customize
diff --git a/install/sync-in-install.sh b/install/sync-in-install.sh
index fdaab44c5..136e0aeab 100644
--- a/install/sync-in-install.sh
+++ b/install/sync-in-install.sh
@@ -51,7 +51,7 @@ msg_ok "Ran Database Migrations"
 
 msg_info "Creating Admin User"
 cd /opt/sync-in
-ADMIN_PASS=$(openssl rand -base64 18)
+ADMIN_PASS=$(random_password 24)
 $STD npx sync-in-server create-user --role admin --login admin --password "${ADMIN_PASS}"
 cat <<EOF >~/sync-in.creds
 Sync-in Credentials
diff --git a/install/tinyauth-install.sh b/install/tinyauth-install.sh
index b0f710fdb..251a16398 100644
--- a/install/tinyauth-install.sh
+++ b/install/tinyauth-install.sh
@@ -23,7 +23,7 @@ setup_deb_based() {
   fetch_and_deploy_gh_release "tinyauth" "steveiliop56/tinyauth" "singlefile" "latest" "/opt/tinyauth" "tinyauth-$(arch_resolve)"
 
   msg_info "Setting up Tinyauth"
-  PASS=$(openssl rand -base64 8 | tr -dc 'a-zA-Z0-9' | head -c 8)
+  PASS=$(random_password 8)
   USER=$(htpasswd -Bbn "tinyauth" "${PASS}")
   cat <<EOF >/opt/tinyauth/credentials.txt
 Tinyauth Credentials
@@ -67,7 +67,7 @@ setup_alpine() {
   fetch_and_deploy_gh_release "tinyauth" "tinyauthapp/tinyauth" "singlefile" "latest" "/opt/tinyauth" "tinyauth-$(arch_resolve)"
 
   msg_info "Configuring Tinyauth"
-  PASS=$(openssl rand -base64 8 | tr -dc 'a-zA-Z0-9' | head -c 8)
+  PASS=$(random_password 8)
   USER=$(htpasswd -Bbn "tinyauth" "${PASS}")
 
   cat <<EOF >/opt/tinyauth/credentials.txt
diff --git a/install/trek-install.sh b/install/trek-install.sh
index 1161ce73a..48414eff6 100644
--- a/install/trek-install.sh
+++ b/install/trek-install.sh
@@ -55,7 +55,7 @@ msg_ok "Set up TREK Workspace"
 msg_info "Configuring TREK"
 ENCRYPTION_KEY=$(openssl rand -hex 32)
 ADMIN_EMAIL="admin@trek.local"
-ADMIN_PASSWORD=$(openssl rand -base64 18 | tr -dc 'A-Za-z0-9' | head -c 16)
+ADMIN_PASSWORD=$(random_password 16)
 cat <<EOF >/opt/trek/server/.env
 NODE_ENV=production
 HOST=0.0.0.0
diff --git a/install/tubearchivist-install.sh b/install/tubearchivist-install.sh
index 9ce601318..a5ec3b0f3 100644
--- a/install/tubearchivist-install.sh
+++ b/install/tubearchivist-install.sh
@@ -98,8 +98,8 @@ if [[ -f /opt/tubearchivist/backend/requirements.plugins.txt ]]; then
   mkdir -p /opt/yt_plugins/bgutil
   $STD uv pip install --python /opt/tubearchivist/.venv/bin/python --target /opt/yt_plugins/bgutil -r /opt/tubearchivist/backend/requirements.plugins.txt
 fi
-TA_PASSWORD=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
-ES_PASSWORD=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
+TA_PASSWORD=$(random_password 13)
+ES_PASSWORD=$(random_password 13)
 mkdir -p /opt/tubearchivist/{cache,media}
 ln -sf /opt/tubearchivist/cache /cache
 ln -sf /opt/tubearchivist/media /youtube
diff --git a/install/umbraco-install.sh b/install/umbraco-install.sh
index f6da551df..0cfe68280 100644
--- a/install/umbraco-install.sh
+++ b/install/umbraco-install.sh
@@ -40,7 +40,7 @@ msg_ok "Umbraco templates installed and project created"
 
 msg_info "Configuring database connection and unattended setup"
 cd /var/www/html/$var_project_name
-UMBRACO_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
+UMBRACO_PASS=$(random_password 13)
 jq --arg umbracopass "$UMBRACO_PASS" '. + {
   "ConnectionStrings": {
     "umbracoDbDSN": "Data Source=|DataDirectory|/Umbraco.sqlite.db;Cache=Shared;Foreign Keys=True;Pooling=True",
@@ -141,7 +141,7 @@ msg_ok "Umbraco published successfully to /var/www/html/$var_project_name-publis
 
 msg_info "Setting up FTP Server"
 useradd ftpuser
-FTP_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
+FTP_PASS=$(random_password 13)
 usermod --password $(echo ${FTP_PASS} | openssl passwd -1 -stdin) ftpuser
 mkdir -p /var/www/html
 usermod -d /var/www/html ftp
diff --git a/install/valkey-install.sh b/install/valkey-install.sh
index c9ade3aec..f304ad276 100644
--- a/install/valkey-install.sh
+++ b/install/valkey-install.sh
@@ -19,7 +19,7 @@ setup_deb_based() {
   $STD apt install -y valkey openssl
   sed -i 's/^bind .*/bind 0.0.0.0/' /etc/valkey/valkey.conf
 
-  PASS="$(openssl rand -base64 48 | tr -dc 'a-zA-Z0-9' | head -c32)"
+  PASS="$(random_password 32)"
   echo "requirepass $PASS" >>/etc/valkey/valkey.conf
   echo "$PASS" >~/valkey.creds
   chmod 600 ~/valkey.creds
@@ -80,7 +80,7 @@ setup_alpine() {
   $STD apk add valkey valkey-openrc valkey-cli
   sed -i 's/^bind .*/bind 0.0.0.0/' /etc/valkey/valkey.conf
 
-  PASS="$(head -c 100 /dev/urandom | tr -dc 'a-zA-Z0-9' | head -c32)"
+  PASS="$(random_password 32)"
   echo "requirepass $PASS" >>/etc/valkey/valkey.conf
   echo "$PASS" >~/valkey.creds
   chmod 600 ~/valkey.creds
diff --git a/install/versitygw-install.sh b/install/versitygw-install.sh
index 25ef43977..36c1b6a3e 100644
--- a/install/versitygw-install.sh
+++ b/install/versitygw-install.sh
@@ -24,8 +24,8 @@ fi
 
 msg_info "Configuring VersityGW"
 mkdir -p /opt/versitygw-data
-ACCESS_KEY=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-20)
-SECRET_KEY=$(openssl rand -base64 36 | tr -dc 'a-zA-Z0-9' | cut -c1-40)
+ACCESS_KEY=$(random_password 20)
+SECRET_KEY=$(random_password 40)
 
 cat <<EOF >/etc/versitygw.d/gateway.conf
 VGW_BACKEND=posix
diff --git a/install/wallabag-install.sh b/install/wallabag-install.sh
index 6cf9d8a6d..caa87b8f1 100644
--- a/install/wallabag-install.sh
+++ b/install/wallabag-install.sh
@@ -29,7 +29,7 @@ fetch_and_deploy_gh_release "wallabag" "wallabag/wallabag" "prebuild" "latest" "
 
 msg_info "Configuring Wallabag"
 cd /opt/wallabag
-SECRET_KEY="$(openssl rand -base64 32 | tr -dc 'a-zA-Z0-9' | cut -c1-32)"
+SECRET_KEY="$(random_password 32)"
 cat <<EOF >/opt/wallabag/app/config/parameters.yml
 parameters:
     database_driver: pdo_mysql
diff --git a/install/warracker-install.sh b/install/warracker-install.sh
index 5afa6b5be..8b959d680 100644
--- a/install/warracker-install.sh
+++ b/install/warracker-install.sh
@@ -26,9 +26,9 @@ PG_VERSION="17" setup_postgresql
 msg_info "Setup PostgreSQL"
 DB_NAME="warranty_db"
 DB_USER="warranty_user"
-DB_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-13)
+DB_PASS=$(random_password 13)
 DB_ADMIN_USER="warracker_admin"
-DB_ADMIN_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-13)
+DB_ADMIN_PASS=$(random_password 13)
 $STD sudo -u postgres psql -c "CREATE USER $DB_USER WITH PASSWORD '$DB_PASS';"
 $STD sudo -u postgres psql -c "CREATE USER $DB_ADMIN_USER WITH PASSWORD '$DB_ADMIN_PASS' SUPERUSER;"
 $STD sudo -u postgres psql -c "CREATE DATABASE $DB_NAME OWNER $DB_ADMIN_USER;"
diff --git a/install/wealthfolio-install.sh b/install/wealthfolio-install.sh
index 24f4dabfd..f54054a23 100644
--- a/install/wealthfolio-install.sh
+++ b/install/wealthfolio-install.sh
@@ -26,7 +26,7 @@ msg_ok "Installed Wealthfolio"
 msg_info "Configuring Wealthfolio"
 mkdir -p /opt/wealthfolio_data
 SECRET_KEY=$(openssl rand -base64 32)
-WF_PASSWORD=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-16)
+WF_PASSWORD=$(random_password 16)
 WF_PASSWORD_HASH=$(echo -n "$WF_PASSWORD" | argon2 "$(openssl rand -base64 16)" -id -e)
 cat <<EOF >/opt/wealthfolio/.env
 WF_LISTEN_ADDR=0.0.0.0:8080
diff --git a/install/webtrees-install.sh b/install/webtrees-install.sh
index d071d06c8..410a7a24e 100644
--- a/install/webtrees-install.sh
+++ b/install/webtrees-install.sh
@@ -50,7 +50,7 @@ msg_info "Automating Webtrees Setup"
 cd /opt/webtrees
 mkdir -p /opt/webtrees/data
 chown -R www-data:www-data /opt/webtrees/data
-WT_ADMIN_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c15)
+WT_ADMIN_PASS=$(random_password 15)
 $STD sudo -u www-data php /opt/webtrees/index.php config-ini \
   --dbhost=127.0.0.1 \
   --dbport=3306 \
diff --git a/install/yourls-install.sh b/install/yourls-install.sh
index a146bc61b..8aed7f2c6 100644
--- a/install/yourls-install.sh
+++ b/install/yourls-install.sh
@@ -25,7 +25,7 @@ fetch_and_deploy_gh_release "yourls" "YOURLS/YOURLS" "tarball"
 
 msg_info "Configuring YOURLS"
 COOKIEKEY=$(openssl rand -hex 24)
-YOURLS_PASS=$(openssl rand -base64 12 | tr -dc 'a-zA-Z0-9' | cut -c1-16)
+YOURLS_PASS=$(random_password 16)
 cat <<EOF >/opt/yourls/user/config.php
 <?php
 define( 'YOURLS_DB_USER', '${MARIADB_DB_USER}' );
diff --git a/install/yt-dlp-webui-install.sh b/install/yt-dlp-webui-install.sh
index 845296731..2432ecc64 100644
--- a/install/yt-dlp-webui-install.sh
+++ b/install/yt-dlp-webui-install.sh
@@ -23,7 +23,7 @@ fetch_and_deploy_gh_release "yt-dlp" "yt-dlp/yt-dlp" "singlefile" "latest" "/usr
 msg_info "Setting up YT-DLP-WEBUI"
 mkdir -p /opt/yt-dlp-webui
 mkdir /downloads
-RPC_PASSWORD=$(openssl rand -base64 16)
+RPC_PASSWORD=$(random_password 21)
 cat <<EOF >~/yt-dlp-webui.creds
 yt-dlp-webui-Credentials
 Username: admin
diff --git a/install/zipline-install.sh b/install/zipline-install.sh
index 8205135d5..b5be5c48a 100644
--- a/install/zipline-install.sh
+++ b/install/zipline-install.sh
@@ -18,7 +18,7 @@ NODE_VERSION="24" NODE_MODULE="pnpm" setup_nodejs
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="ziplinedb" PG_DB_USER="zipline" setup_postgresql_db
 fetch_and_deploy_gh_release "zipline" "diced/zipline" "tarball"
-SECRET_KEY="$(openssl rand -base64 42 | tr -dc 'a-zA-Z0-9')"
+SECRET_KEY="$(random_password 56)"
 echo "Zipline Secret Key: ${SECRET_KEY}" >>~/zipline.creds
 
 msg_info "Installing Zipline (Patience)"
diff --git a/install/zitadel-install.sh b/install/zitadel-install.sh
index d203b4051..39a231727 100644
--- a/install/zitadel-install.sh
+++ b/install/zitadel-install.sh
@@ -22,9 +22,9 @@ PG_VERSION="17" setup_postgresql
 msg_info "Installing Postgresql"
 DB_NAME="zitadel"
 DB_USER="zitadel"
-DB_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-13)
+DB_PASS=$(random_password 13)
 DB_ADMIN_USER="root"
-DB_ADMIN_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-13)
+DB_ADMIN_PASS=$(random_password 13)
 systemctl start postgresql
 $STD sudo -u postgres psql -c "CREATE USER $DB_USER WITH PASSWORD '$DB_PASS';"
 $STD sudo -u postgres psql -c "CREATE USER $DB_ADMIN_USER WITH PASSWORD '$DB_ADMIN_PASS' SUPERUSER;"
@@ -44,7 +44,7 @@ fetch_and_deploy_gh_release "zitadel" "zitadel/zitadel" "prebuild" "latest" "/us
 msg_info "Setting up Zitadel Environments"
 mkdir -p /opt/zitadel
 echo "/opt/zitadel/config.yaml" >"/opt/zitadel/.config"
-head -c 32 < <(openssl rand -base64 48 | tr -dc 'a-zA-Z0-9') >"/opt/zitadel/.masterkey"
+random_password 32 >"/opt/zitadel/.masterkey"
 cat <<EOF >~/zitadel.creds
 Config location: $(cat "/opt/zitadel/.config")
 Masterkey: $(cat "/opt/zitadel/.masterkey")
diff --git a/install/zot-registry-install.sh b/install/zot-registry-install.sh
index 5cf9feb49..6fd22c804 100644
--- a/install/zot-registry-install.sh
+++ b/install/zot-registry-install.sh
@@ -22,7 +22,7 @@ fetch_and_deploy_gh_release "zot" "project-zot/zot" "singlefile" "latest" "/usr/
 msg_info "Configuring Zot Registry"
 mkdir -p /etc/zot
 curl -fsSL https://raw.githubusercontent.com/project-zot/zot/refs/heads/main/examples/config-ui.json -o /etc/zot/config.json
-ZOTPASSWORD=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
+ZOTPASSWORD=$(random_password 13)
 $STD htpasswd -b -B -c /etc/zot/htpasswd admin "$ZOTPASSWORD"
 cat <<EOF >~/zot.creds
 Zot-Credentials
diff --git a/tools/addon/add-netbird-lxc.sh b/tools/addon/add-netbird-lxc.sh
index 9fc8a08d4..9cfd31cdf 100644
--- a/tools/addon/add-netbird-lxc.sh
+++ b/tools/addon/add-netbird-lxc.sh
@@ -70,7 +70,6 @@ if [[ "$LXC_STATUS" != "running" ]]; then
   msg_info "Container $CTID is not running. Starting it now..."
   pct start "$CTID"
   while [[ "$(pct status "$CTID" | awk '{print $2}')" != "running" ]]; do
-    msg_info "Waiting for the container to start..."
     sleep 2
   done
   msg_ok "Container $CTID is now running."
diff --git a/tools/addon/add-tailscale-lxc.sh b/tools/addon/add-tailscale-lxc.sh
index 8549b7b16..6d83b4d1c 100644
--- a/tools/addon/add-tailscale-lxc.sh
+++ b/tools/addon/add-tailscale-lxc.sh
@@ -56,8 +56,7 @@ while read -r line; do
   ((${#ITEM} + OFFSET > MSG_MAX_LENGTH)) && MSG_MAX_LENGTH=$((${#ITEM} + OFFSET))
   CTID_MENU+=("$TAG" "$ITEM" "OFF")
 done < <(pct list | awk 'NR>1')
-
-stop_spinner
+msg_ok "Loaded container list"
 CTID=""
 while [[ -z "${CTID}" ]]; do
   CTID=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "Containers on $NODE" --radiolist \
diff --git a/tools/addon/all-templates.sh b/tools/addon/all-templates.sh
index ecc1a4cb4..54f585186 100644
--- a/tools/addon/all-templates.sh
+++ b/tools/addon/all-templates.sh
@@ -96,7 +96,7 @@ TEMPLATE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "All Templat
 
 # Setup script environment
 NAME=$(echo "$TEMPLATE" | grep -oE '^[^-]+-[^-]+')
-PASS="$(openssl rand -base64 8)"
+PASS="$(random_password 16)"
 
 # Get valid Container ID
 CTID=$(pvesh get /cluster/nextid)
diff --git a/tools/addon/arcane.sh b/tools/addon/arcane.sh
index bb0cabac5..11886f447 100644
--- a/tools/addon/arcane.sh
+++ b/tools/addon/arcane.sh
@@ -86,8 +86,8 @@ function install() {
 
   # Generate secrets and config values
   local ENCRYPTION_KEY JWT_SECRET PROJ_DIR BUILDS_DIR
-  ENCRYPTION_KEY=$(openssl rand -base64 32 | tr -dc 'a-zA-Z0-9' | head -c32)
-  JWT_SECRET=$(openssl rand -base64 32 | tr -dc 'a-zA-Z0-9' | head -c32)
+  ENCRYPTION_KEY=$(random_password 32)
+  JWT_SECRET=$(random_password 32)
   PROJ_DIR="/etc/arcane/projects"
   BUILDS_DIR="/etc/arcane/builds"
 
diff --git a/tools/addon/cronmaster.sh b/tools/addon/cronmaster.sh
index a868bda3b..3cd79ba05 100644
--- a/tools/addon/cronmaster.sh
+++ b/tools/addon/cronmaster.sh
@@ -89,7 +89,7 @@ function install() {
   fetch_and_deploy_gh_release "cronmaster" "fccview/cronmaster" "prebuild" "latest" "$INSTALL_PATH" "cronmaster_*_prebuild.tar.gz"
 
   local AUTH_PASS
-  AUTH_PASS="$(openssl rand -base64 18 | cut -c1-13)"
+  AUTH_PASS="$(random_password 13)"
 
   msg_info "Creating configuration"
   cat <<EOF >"$CONFIG_PATH"
diff --git a/tools/addon/jellystat.sh b/tools/addon/jellystat.sh
index ceb9dd992..4d7e0c095 100644
--- a/tools/addon/jellystat.sh
+++ b/tools/addon/jellystat.sh
@@ -137,7 +137,7 @@ function install() {
     echo ""
   else
     # Generate new password
-    DB_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c16)
+    DB_PASS=$(random_password 16)
 
     # Check if user exists, create if not
     if sudo -u postgres psql -tAc "SELECT 1 FROM pg_roles WHERE rolname='${DB_USER}'" 2>/dev/null | grep -q 1; then
@@ -187,7 +187,7 @@ function install() {
 
   # Generate JWT Secret
   local JWT_SECRET
-  JWT_SECRET=$(openssl rand -base64 32 | tr -dc 'a-zA-Z0-9' | head -c32)
+  JWT_SECRET=$(random_password 32)
 
   # Force fresh download by removing version cache
   rm -f "$HOME/.jellystat"
diff --git a/tools/addon/komodo.sh b/tools/addon/komodo.sh
index 0dbb244d1..bcaabf210 100644
--- a/tools/addon/komodo.sh
+++ b/tools/addon/komodo.sh
@@ -189,10 +189,10 @@ function install() {
   msg_info "Configuring environment"
   curl -fsSL "https://raw.githubusercontent.com/moghtech/komodo/main/compose/compose.env" -o "$COMPOSE_ENV"
 
-  DB_PASSWORD=$(openssl rand -base64 16 | tr -d '/+=')
-  ADMIN_PASSWORD=$(openssl rand -base64 8 | tr -d '/+=')
-  WEBHOOK_SECRET=$(openssl rand -base64 24 | tr -d '/+=')
-  JWT_SECRET=$(openssl rand -base64 24 | tr -d '/+=')
+  DB_PASSWORD=$(random_password 21)
+  ADMIN_PASSWORD=$(random_password 16)
+  WEBHOOK_SECRET=$(random_password 32)
+  JWT_SECRET=$(random_password 32)
 
   sed -i "s/^KOMODO_DATABASE_USERNAME=.*/KOMODO_DATABASE_USERNAME=komodo_admin/" "$COMPOSE_ENV"
   sed -i "s/^KOMODO_DATABASE_PASSWORD=.*/KOMODO_DATABASE_PASSWORD=${DB_PASSWORD}/" "$COMPOSE_ENV"
diff --git a/tools/addon/phpmyadmin.sh b/tools/addon/phpmyadmin.sh
index 3355c7e44..607e916c1 100644
--- a/tools/addon/phpmyadmin.sh
+++ b/tools/addon/phpmyadmin.sh
@@ -141,6 +141,7 @@ function install_phpmyadmin() {
   mkdir -p "$INSTALL_DIR"
   tar xf "$tarball" --strip-components=1 -C "$INSTALL_DIR"
   rm -f "$tarball"
+  msg_ok "Downloaded phpMyAdmin ${LATEST_VERSION}"
 }
 
 function configure_phpmyadmin() {
@@ -210,12 +211,12 @@ function uninstall_phpmyadmin() {
     $STD rc-service lighttpd stop
     $STD rc-service php-fpm stop
   fi
+  msg_ok "Stopped Webserver"
 
   msg_info "Removing phpMyAdmin directory"
   rm -rf "$INSTALL_DIR"
 
   if [[ "$OS" == "Alpine" ]]; then
-    msg_info "Removing Lighttpd config"
     rm -f /etc/lighttpd/lighttpd.conf
     $STD rc-service php-fpm restart
     $STD rc-service lighttpd restart
diff --git a/tools/pve/update-apps.sh b/tools/pve/update-apps.sh
index 3944dd9d1..90257dc04 100644
--- a/tools/pve/update-apps.sh
+++ b/tools/pve/update-apps.sh
@@ -654,12 +654,11 @@ for container in $CHOICE; do
       log_write "Container $container ($service): FAILED — no backup found for restore"
       exit 235
     fi
-    msg_info "Restoring from: $BACKUP_ENTRY"
     pct restore $container "$BACKUP_ENTRY" --storage $LXC_STORAGE --force >/dev/null 2>&1
     restorestatus=$?
     if [ $restorestatus -eq 0 ]; then
       pct start $container
-      msg_ok "Container $container successfully restored from backup"
+      msg_ok "Container $container restored from ${BACKUP_ENTRY}"
       log_result "$container" "$service" "RESTORED" "Update failed (exit $exit_code) — restored from backup"
       log_write "Container $container ($service): RESTORED from $BACKUP_ENTRY"
     else
diff --git a/turnkey/turnkey.sh b/turnkey/turnkey.sh
index 702fc21fb..f79c6b715 100644
--- a/turnkey/turnkey.sh
+++ b/turnkey/turnkey.sh
@@ -224,7 +224,7 @@ TEMPLATE="${TURNKEY_TEMPLATES[$selected]}"
 turnkey="${selected%-*}"
 
 # Generate random password
-PASS="$(openssl rand -base64 8)"
+PASS="$(random_password 16)"
 
 # Prompt for Container ID
 NEXT_ID=$(pvesh get /cluster/nextid 2>/dev/null || echo 100)