* fix(zabbix): keep unattended updates on the installed series
update_script() asked for a Zabbix version unconditionally. update-apps.sh
exports PHS_SILENT=1 for unattended runs, so that read either blocks the
whole batch or, with stdin closed, fails the container with exit 1 after
its services were already stopped.
Resolve the installed series from the zabbix-release package before
touching systemd, and ask only when the run is interactive. Unattended
runs stay on the installed series and still get minor and patch updates;
changing series remains an attended decision. When the series cannot be
read, exit 75 so the batch logs the container as skipped instead of
failing it.
Fixes#18046
* Clean up comments in zabbix.sh
Removed comments regarding unattended runs and series changes.
---------
Co-authored-by: CanbiZ (MickLesk) <47820557+MickLesk@users.noreply.github.com>
The app reads its version from COMMIT_TAG and falls back to "dev".
Set it in the systemd unit on install, migration and update.
Fixes#18040
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
1.6.0's postinst walks parent PIDs until PID 1 to collect settings. Under pct exec the chain ends at PID 0, and since InvenTree #12995 turned the loop's [ ] into [[ ]] it no longer breaks out there, so the install hung printing ps and strings errors. systemd-run makes systemd the parent.
* Zitadel: Support v1 and v2 Login
* Refactor Zitadel installation and configuration process
Refactor Zitadel installation script to improve configuration and setup processes, including PostgreSQL and Zitadel Login setup.
* Update authorship information in zitadel-install.sh
* Add co-authors to the zitadel.sh file
Updated author information to include co-authors.
* Enhance Zitadel login options descriptions
* Change Zitadel login version check condition
* Change session cookie secret generation method
The update handed v2.7.5 to fetch_and_deploy_gh_release as the mode and 'latest' as the version, so every update stopped with 'Unknown mode: v2.7.5' (#18021). Same arguments as the install now.
* Open WebUI: stop when the install fails three times
The retry loop fell through to "Installed Open WebUI" after the third
failure, so the service was created without a binary and the URL never
answered (#18020). The last attempt now runs under the error trap, which
shows uv's output.
* Open WebUI: keep the retry inline, no function in the script
* Open WebUI: same retry on the update paths, and drop the numba constraint
The migration and update loops in ct/openwebui.sh fell through to
"Updated" after three failures just like the install did. The numba
constraint from #11874 guarded openai-whisper's old pin; 0.12.x depends
on faster-whisper and never resolves numba.
* formatting
Since 20261018 Silo uses ~/.silo as its config directory and stops when that path is a file, which the version file named after the app was. Update moves an existing file to ~/.silo_s3.
dl.packager.io is frozen at 1.5.1, and its key only has a SHA1 self-signature, which apt's sqv rejects on Debian 13 since 2026-02-01. Upstream's installer moved to go.packager.io (InvenTree #12824), which carries 1.6.0 for Ubuntu 24.04/26.04 and Debian 13; update migrates installs on those releases and accepts Debian.
Installs since February 2025 use PostgreSQL and have no db.sqlite, so the update stopped at the backup (#17971). mkdir -p lets a rerun get past the backup folder a failed run left behind.
FlareSolverr hands LANG to Chrome as --accept-lang, which takes a language tag; with the container locale Cloudflare challenges looped unsolved (discussion #17987, FlareSolverr discussion #1717). Update adds the line to existing units.
2.0.0 serves its MapLibre worker as a .mjs file, which nginx's stock
mime.types doesn't map, breaking the map on both fresh installs and
updates. Also drops the now-dead JWT key generation/env vars (2.0.0
uses opaque session tokens), clears stale frontend build output on
update via CLEAN_INSTALL+KEEP instead of accumulating it forever,
backs up the database before updating, bumps new installs straight
to PostgreSQL 18/PostGIS 3.6, and raises the default disk size after
hitting real space pressure during a live upgrade.
v5 reworks a lot and is still a prerelease; once it is marked stable, install and update would move to it untested. Filter on the v4. tag prefix until v5 is checked (discussion #17952).
Since 1.0.0-rc.1 the command asks for the Application URL when --url is missing. Behind $STD the question is invisible, so install and update hung until Enter was pressed (#17944).
16.9.0 replaced the Tanuki wrapper; a fresh server.sh install now creates onedev.server.service, so the install failed on 'Unit onedev.service not found' (#17943). Upgraded installs keep their onedev.service, so update uses whichever unit exists.
Only GET /api/init creates the scheduled jobs and starts the scheduler; upstream's image calls it after every start, the LXC never did (#17945). An ExecStartPost hook now waits for the app and Redis like app-start.sh, and update adds it to existing installs.
* Bytestash: modify backup process
Removed backup creation for /opt/bytestash/data and added CLEAN_INSTALL_KEEP variable to preserve data during installation.
* Increase default CPU and RAM values
LocalAI resolves meta backends from the GPU vendor it reads out of sysfs,
which is the host's card even with no driver installed in the container,
so llama-cpp became cuda12-llama-cpp and never started (#17908). Force
the default capability unless a CUDA, ROCm or Level Zero runtime is
present; update adds the pin to existing installs.
- Default to Debian 13
- Switch Zammad repo from dl.packager.io (frozen at 7.0.x) to go.packager.io
- Install Elasticsearch 8.x instead of EOL 7.x; drop ingest-attachment plugin (built in)
- Update migrates old containers: Zammad repo, ES 7 -> 8, search index rebuild
* Immich: restore geodata/countryInfo.txt on update and pin 3.3.1
Updates run between the 3.3.0 pin and #17823 wrote countryInfo.txt into
app/ instead of geodata/, so metadata extraction failed and new uploads
never got thumbnails. The download sat inside the release block, so a
plain update could not repair it until the next pin. 3.3.1 only bumps
version fields in the manifests.
* Immich: follow base-images for libheif like the other libraries
The hard pin from #16996 sat at 1.23.2 while upstream moved to 1.23.5.
The path refactor in #16487 deleted the wrapper instead of pointing it
at the new layout, while the documented way to create the first
superuser is still wanderer-pb superuser upsert. Calling pocketbase
directly without --dir would quietly start an empty database. Install
the wrapper again, and write it on every update so containers set up
since then get it too.
pnpm 12.10 refuses a frozen install when the lockfile names apps/web but
that directory has no package.json, which is how the runtime tree is
built, so the update to 2.8.0 failed. Filter to @tracearr/server... the
way the upstream Dockerfile does, and copy assets/logo.png, which the
e-mail and newsletter code reads.
v3 compiles PAPERLESS_CONSUMER_IGNORE_PATTERNS as regex, so a v2 glob
like "*.tmp" kills the consumer on start and "._*" ignores every file.
The update now rewrites such globs to anchored regex instead of only
warning.
The four units had no Restart=, so an OOM kill during a large mail
import left the webserver and task queue down. Install sets
Restart=on-failure and the update adds it to existing units.
Only the libopenjp2-7 runtime was installed, so meson found no OpenJPEG
and libvips came out without jp2kload. Immich lists .jp2 as supported
and the upstream image builds against libopenjp2-7-dev. Install the
headers, and rebuild libvips on update when it lacks jp2kload, the way
ImageMagick is rebuilt when its LibRaw define is missing.
* RustDesk Server: run the official server, make the web UI optional
lejianwen/rustdesk-server has had no commit since 2025-09-01 and is 45
commits behind upstream, missing the UDP reflection/amplification and
mio security fixes. hbbs, hbbr and utils now come from
rustdesk/rustdesk-server; the packages and units are the same, so
existing installs upgrade in place and keep their keys.
lejianwen/rustdesk-api is unmaintained as well and becomes an opt-in
prompt. When chosen it is configured with this server's IP and key
instead of its 192.168.1.66 defaults, and Debian gets an admin password
like Alpine did. ~/rustdesk.creds now always holds the server key, and
the API is only updated where it is installed.
* RustDesk Server: answer the web UI prompt with var_rustdesk_api
yes or no skips the question, so unattended installs can choose; unset still asks.
* RustDesk Server: write the creds file with heredocs
Matches how the other install scripts write their creds; the file is unchanged.
