Move the first five high-traffic scripts onto the core engine

Today's engine work reaches 30 of 561 ct scripts, about 5% of ProxmoxVE
traffic. The retry on engine downloads, exit 227 for a container that will not
start, the umask fix that stops a hardened host producing unusable containers,
the TMPDIR guard and the toolchain restore are all sitting where almost nobody
runs them.

Checked before touching anything, because "migrate" meant something much
larger last time:

  - None of the eighteen remaining top-25 scripts has an alpine-* variant, so
    there is no merge to do -- unlike the earlier round.
  - No script references misc/ anywhere except its bootstrap line.
  - Comparing the two engines' function surfaces, 61 names exist only in misc/.
    None of the eighteen calls any of them.

So it really is one line per script, and the head now matches the scripts
migrated earlier byte for byte.

Five in this wave rather than all eighteen, chosen as the lowest-volume of the
set at roughly 170 installs a day each: enough traffic to surface a problem
within a day, contained enough that a regression does not reach thousands.
docker at 1255/day and the OS containers should follow only once this wave has
run clean.

immich and vaultwarden are deliberately not in it. Both already sit near 44%
success, and migrating them now would change two variables at once with no way
to attribute the result.

.github/changelogs/2026/08.md

@@ -1,3 +1,132 @@
+## 2026-08-22
+
+### 🆕 New Scripts
+
+  - pve-ups ([#16670](https://github.com/community-scripts/ProxmoxVE/pull/16670))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - docuseal: use DocuSeal's patched PDFium build to fix service start [@MickLesk](https://github.com/MickLesk) ([#16673](https://github.com/community-scripts/ProxmoxVE/pull/16673))
+
+  - #### ✨ New Features
+
+    - update authentik to 2026.8.0 [@thieneret](https://github.com/thieneret) ([#16674](https://github.com/community-scripts/ProxmoxVE/pull/16674))
+
+## 2026-08-21
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - wallos: fix: migrations [@CrazyWolf13](https://github.com/CrazyWolf13) ([#16666](https://github.com/community-scripts/ProxmoxVE/pull/16666))
+    - barassistant: fix: compatibility with v6 [@CrazyWolf13](https://github.com/CrazyWolf13) ([#16665](https://github.com/community-scripts/ProxmoxVE/pull/16665))
+    - Immichframe: remove settings.yaml UUID placeholder [@MickLesk](https://github.com/MickLesk) ([#16660](https://github.com/community-scripts/ProxmoxVE/pull/16660))
+    - openziti-controller: redirect stdin from /dev/null to skip postinst's interactive bootstrap prompt [@MickLesk](https://github.com/MickLesk) ([#16650](https://github.com/community-scripts/ProxmoxVE/pull/16650))
+    - bookorbit: bump default RAM to prevent tsc OOM segfault during nest build [@MickLesk](https://github.com/MickLesk) ([#16649](https://github.com/community-scripts/ProxmoxVE/pull/16649))
+    - immich: split jpegli into its own build step, resolve library revisions dynamically [@MickLesk](https://github.com/MickLesk) ([#16656](https://github.com/community-scripts/ProxmoxVE/pull/16656))
+    - tdarr: make unzip non-interactive to prevent hang [@MickLesk](https://github.com/MickLesk) ([#16648](https://github.com/community-scripts/ProxmoxVE/pull/16648))
+    - immich: fix jpegli patch path after upstream base-images split jpegli from libjxl [@MickLesk](https://github.com/MickLesk) ([#16647](https://github.com/community-scripts/ProxmoxVE/pull/16647))
+
+## 2026-08-20
+
+### 🆕 New Scripts
+
+  - Umbraco ([#16621](https://github.com/community-scripts/ProxmoxVE/pull/16621))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - storyteller: fix build paths for upstream applications/web/ monorepo restructure [@MickLesk](https://github.com/MickLesk) ([#16627](https://github.com/community-scripts/ProxmoxVE/pull/16627))
+    - tubearchivist: add bgutil POT provider and update yt-dlp to nightly [@CrazyWolf13](https://github.com/CrazyWolf13) ([#16622](https://github.com/community-scripts/ProxmoxVE/pull/16622))
+    - networkoptimizer: preseed iperf3 debconf question to prevent hang install  [@MickLesk](https://github.com/MickLesk) ([#16626](https://github.com/community-scripts/ProxmoxVE/pull/16626))
+    - scanopy: limit cargo build parallelism to prevent OOM kill [@MickLesk](https://github.com/MickLesk) ([#16623](https://github.com/community-scripts/ProxmoxVE/pull/16623))
+    - baikal: fall back to composer update when lock doesn't match [@MickLesk](https://github.com/MickLesk) ([#16625](https://github.com/community-scripts/ProxmoxVE/pull/16625))
+
+  - #### 💥 Breaking Changes
+
+    - update: various script to debian 13 [@CrazyWolf13](https://github.com/CrazyWolf13) ([#16525](https://github.com/community-scripts/ProxmoxVE/pull/16525))
+
+### 🧰 Tools
+
+  - #### 🔧 Refactor
+
+    - copyparty: use fetch_and_deploy_gh_release for version tracking [@MickLesk](https://github.com/MickLesk) ([#16624](https://github.com/community-scripts/ProxmoxVE/pull/16624))
+
+## 2026-08-19
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix: clean yarn cache after mealie frontend build to prevent disk growth [@bferd](https://github.com/bferd) ([#16609](https://github.com/community-scripts/ProxmoxVE/pull/16609))
+    - VictoriaMetrics: use github_api_call for release lookups so GITHUB_TOKEN is honored [@angusmaul](https://github.com/angusmaul) ([#16607](https://github.com/community-scripts/ProxmoxVE/pull/16607))
+    - Increase default RAM allocation for Gatus [@rmpratt1](https://github.com/rmpratt1) ([#16601](https://github.com/community-scripts/ProxmoxVE/pull/16601))
+
+## 2026-08-18
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - romm: add missing /decode and /cache Angie locations for multi-file downloads [@MickLesk](https://github.com/MickLesk) ([#16589](https://github.com/community-scripts/ProxmoxVE/pull/16589))
+    - odoo: use patched wkhtmltopdf build [@MickLesk](https://github.com/MickLesk) ([#16590](https://github.com/community-scripts/ProxmoxVE/pull/16590))
+
+  - #### 💥 Breaking Changes
+
+    - Breaking Change: Migrate all "Alpine" Scripts to Normal CT's  [@MickLesk](https://github.com/MickLesk) ([#16587](https://github.com/community-scripts/ProxmoxVE/pull/16587))
+
+## 2026-08-17
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - keycloak: remove invalid ExecStop, kc.sh has no stop subcommand [@MickLesk](https://github.com/MickLesk) ([#16563](https://github.com/community-scripts/ProxmoxVE/pull/16563))
+    - Pin ownfoil release to version 2.3.0 [@MickLesk](https://github.com/MickLesk) ([#16574](https://github.com/community-scripts/ProxmoxVE/pull/16574))
+    - kometa: add git, needed by requirements.txt's git dependency [@MickLesk](https://github.com/MickLesk) ([#16562](https://github.com/community-scripts/ProxmoxVE/pull/16562))
+    - fix romm: deploy EmulatorJS and Ruffle after the frontend build [@angusmaul](https://github.com/angusmaul) ([#16571](https://github.com/community-scripts/ProxmoxVE/pull/16571))
+
+  - #### 🔧 Refactor
+
+    - patchmon: fetch only SCAP datastream XMLs [@MickLesk](https://github.com/MickLesk) ([#16565](https://github.com/community-scripts/ProxmoxVE/pull/16565))
+    - teslamate: use precompiled Elixir [@MickLesk](https://github.com/MickLesk) ([#16561](https://github.com/community-scripts/ProxmoxVE/pull/16561))
+
+## 2026-08-16
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - [FIX] Shelfmark: internal bypasser never starts under the gevent worker [@robbiet480](https://github.com/robbiet480) ([#16495](https://github.com/community-scripts/ProxmoxVE/pull/16495))
+    - tubearchivist: fix: enhance update script [@CrazyWolf13](https://github.com/CrazyWolf13) ([#16521](https://github.com/community-scripts/ProxmoxVE/pull/16521))
+    - tracktor: build with pnpm using upstream's frozen lockfile [@MickLesk](https://github.com/MickLesk) ([#16530](https://github.com/community-scripts/ProxmoxVE/pull/16530))
+    - wallos: run db migration after apache reload on update [@MickLesk](https://github.com/MickLesk) ([#16528](https://github.com/community-scripts/ProxmoxVE/pull/16528))
+
+  - #### 🔧 Refactor
+
+    - networkoptimizer: also build uwnspeedtest binary for server arch [@MickLesk](https://github.com/MickLesk) ([#16531](https://github.com/community-scripts/ProxmoxVE/pull/16531))
+
+### 🗑️ Deleted Scripts
+
+  - Remove: Jeedom [@MickLesk](https://github.com/MickLesk) ([#16536](https://github.com/community-scripts/ProxmoxVE/pull/16536))
+- Remove: Swizzin [@MickLesk](https://github.com/MickLesk) ([#16535](https://github.com/community-scripts/ProxmoxVE/pull/16535))
+- Remove: NocoDB [@MickLesk](https://github.com/MickLesk) ([#16533](https://github.com/community-scripts/ProxmoxVE/pull/16533))
+
+### 💾 Core
+
+  - #### 🔧 Refactor
+
+    - core: skip mount points during backup and clean installs [@MickLesk](https://github.com/MickLesk) ([#16532](https://github.com/community-scripts/ProxmoxVE/pull/16532))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - cronmaster: back up scripts, data and snippets folders on update [@MickLesk](https://github.com/MickLesk) ([#16529](https://github.com/community-scripts/ProxmoxVE/pull/16529))
+
 ## 2026-08-15
 
 ### 🆕 New Scripts

.github/pull_request_template.md

@@ -35,3 +35,35 @@ Fixes #
 - [ ] 🌍 **Website update** – Changes to script metadata (PocketBase/website data).
 - [ ] 🔧 **Refactoring / Code Cleanup** – Improves readability or maintainability without changing functionality.
 - [ ] 📝 **Documentation update** – Changes to `README`, `AppName.md`, `CONTRIBUTING.md`, or other docs.
+
+---
+
+## 💥 Breaking Change Advisory (only if you checked "Breaking change")
+
+If this PR changes existing behaviour in a way that may require action before an
+update, add a `breaking-change` advisory block to this PR body. The website and
+the in-container update guard read it to tell operators exactly what to expect,
+what to do first, and — with `action: block` — to stop an update until it's
+handled. Every field is optional; the advisory auto-expires 30 days after merge.
+
+Copy the block out of the comment below, fill it in, and paste it here:
+
+<!--
+```breaking-change
+severity: warning        # info | warning | critical
+action: warn             # warn (default) | block — "block" halts the update until an operator forces it
+expect: One line describing what changes and why it may need action.
+before_update:
+  - First thing to do before updating
+  - Second thing to do before updating
+```
+
+Guidance:
+- Leave this commented (or delete it) for a routine change — no block, no advisory.
+- Use `action: block` only for changes that break or lose data if the operator
+  updates without acting first (e.g. a required manual migration or backup).
+- `expect:` supersedes the auto-scraped summary; keep it to one line.
+- Steps render as a checklist on the site and in the update prompt.
+-->
+
+<!-- The advisory block is only active once it is OUTSIDE this comment. -->

.github/workflows/notify-breaking-change.yml

@@ -0,0 +1,58 @@
+name: Notify breaking change
+
+# When a PR labelled "breaking change" is merged, tell the Helper-Scripts site
+# so it can show a temporary advisory on the affected scripts. The site pulls
+# the PR itself and re-verifies it is merged + labelled, so this workflow only
+# has to hand over the PR number.
+#
+# Requires one repo secret:
+#   BREAKING_CHANGE_INGEST_SECRET  — must match the value the site runs with.
+# Site URL is taken from the existing FRONTEND_URL secret, then an optional
+# SITE_URL variable, then a hard default.
+#
+# pull_request_target (not pull_request) so the run has access to the secret
+# even for fork PRs. It is safe here: the job never checks out or runs PR code —
+# it only forwards the number after the PR has merged.
+
+on:
+  pull_request_target:
+    # closed  -> fires on the merge itself
+    # labeled -> fires if the label is added to an already-merged PR
+    types: [closed, labeled]
+
+concurrency:
+  group: notify-breaking-change-${{ github.event.pull_request.number }}
+  cancel-in-progress: false
+
+jobs:
+  notify:
+    if: >-
+      github.event.pull_request.merged == true &&
+      contains(github.event.pull_request.labels.*.name, 'breaking change')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Notify site of breaking change
+        env:
+          INGEST_SECRET: ${{ secrets.BREAKING_CHANGE_INGEST_SECRET }}
+          SITE_URL: ${{ secrets.FRONTEND_URL || vars.SITE_URL || 'https://community-scripts.org' }}
+          PR: ${{ github.event.pull_request.number }}
+        run: |
+          set -euo pipefail
+          if [ -z "${INGEST_SECRET:-}" ]; then
+            echo "::error::BREAKING_CHANGE_INGEST_SECRET secret is not set."
+            exit 1
+          fi
+          url="${SITE_URL%/}/api/breaking-changes/ingest"
+          echo "Notifying $url for PR #${PR}"
+          status="$(curl -sS -o response.json -w '%{http_code}' \
+            -X POST "$url" \
+            -H "Authorization: Bearer ${INGEST_SECRET}" \
+            -H "Content-Type: application/json" \
+            -d "{\"pr\": ${PR}}")"
+          echo "HTTP $status"
+          cat response.json || true
+          echo
+          if [ "$status" != "200" ]; then
+            echo "::error::ingest endpoint returned HTTP $status"
+            exit 1
+          fi

CHANGELOG.md

@@ -92,6 +92,9 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 
 
+
+
+
 
 
 
@@ -105,7 +108,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 
 <details>
-<summary><h4>August (15 entries)</h4></summary>
+<summary><h4>August (22 entries)</h4></summary>
 
 [View August 2026 Changelog](.github/changelogs/2026/08.md)
 
@@ -524,6 +527,69 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-08-24
+
+### 🆕 New Scripts
+
+  - ArchLinux ([#16715](https://github.com/community-scripts/ProxmoxVE/pull/16715))
+- AirTrail ([#16713](https://github.com/community-scripts/ProxmoxVE/pull/16713))
+- RockyLinux ([#16718](https://github.com/community-scripts/ProxmoxVE/pull/16718))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Add setup_mongodb back in Omada [@lucacome](https://github.com/lucacome) ([#16736](https://github.com/community-scripts/ProxmoxVE/pull/16736))
+    - fireshare: source fireshare.env during update [@MickLesk](https://github.com/MickLesk) ([#16706](https://github.com/community-scripts/ProxmoxVE/pull/16706))
+    - netbox: serve on plain HTTP too, port 80 forced HTTPS redirect broke reverse proxies [@MickLesk](https://github.com/MickLesk) ([#16707](https://github.com/community-scripts/ProxmoxVE/pull/16707))
+    - FileFlows: Fix Download URL [@MickLesk](https://github.com/MickLesk) ([#16708](https://github.com/community-scripts/ProxmoxVE/pull/16708))
+    - Gitea: fix git-over-SSH auth, group-writable home dir tripped sshd StrictModes [@MickLesk](https://github.com/MickLesk) ([#16710](https://github.com/community-scripts/ProxmoxVE/pull/16710))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - post-pve/pbs-install: fix component_exists_in_sources matching substrings of hyphenated tokens [@MickLesk](https://github.com/MickLesk) ([#16709](https://github.com/community-scripts/ProxmoxVE/pull/16709))
+
+## 2026-08-23
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Set default ProxmoxVE raw URL in PVE-UPS & fix var_cpu sorting  [@MickLesk](https://github.com/MickLesk) ([#16689](https://github.com/community-scripts/ProxmoxVE/pull/16689))
+
+## 2026-08-22
+
+### 🆕 New Scripts
+
+  - pve-ups ([#16670](https://github.com/community-scripts/ProxmoxVE/pull/16670))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - docuseal: use DocuSeal's patched PDFium build to fix service start [@MickLesk](https://github.com/MickLesk) ([#16673](https://github.com/community-scripts/ProxmoxVE/pull/16673))
+
+  - #### ✨ New Features
+
+    - update authentik to 2026.8.0 [@thieneret](https://github.com/thieneret) ([#16674](https://github.com/community-scripts/ProxmoxVE/pull/16674))
+
+## 2026-08-21
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - wallos: fix: migrations [@CrazyWolf13](https://github.com/CrazyWolf13) ([#16666](https://github.com/community-scripts/ProxmoxVE/pull/16666))
+    - barassistant: fix: compatibility with v6 [@CrazyWolf13](https://github.com/CrazyWolf13) ([#16665](https://github.com/community-scripts/ProxmoxVE/pull/16665))
+    - Immichframe: remove settings.yaml UUID placeholder [@MickLesk](https://github.com/MickLesk) ([#16660](https://github.com/community-scripts/ProxmoxVE/pull/16660))
+    - openziti-controller: redirect stdin from /dev/null to skip postinst's interactive bootstrap prompt [@MickLesk](https://github.com/MickLesk) ([#16650](https://github.com/community-scripts/ProxmoxVE/pull/16650))
+    - bookorbit: bump default RAM to prevent tsc OOM segfault during nest build [@MickLesk](https://github.com/MickLesk) ([#16649](https://github.com/community-scripts/ProxmoxVE/pull/16649))
+    - immich: split jpegli into its own build step, resolve library revisions dynamically [@MickLesk](https://github.com/MickLesk) ([#16656](https://github.com/community-scripts/ProxmoxVE/pull/16656))
+    - tdarr: make unzip non-interactive to prevent hang [@MickLesk](https://github.com/MickLesk) ([#16648](https://github.com/community-scripts/ProxmoxVE/pull/16648))
+    - immich: fix jpegli patch path after upstream base-images split jpegli from libjxl [@MickLesk](https://github.com/MickLesk) ([#16647](https://github.com/community-scripts/ProxmoxVE/pull/16647))
+
 ## 2026-08-20
 
 ### 🆕 New Scripts
@@ -1113,171 +1179,4 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### ✨ New Features
 
-    - Bump all Alpine scripts to 3.24 [@asylumexp](https://github.com/asylumexp) ([#15994](https://github.com/community-scripts/ProxmoxVE/pull/15994))
-
-## 2026-07-23
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - IronClaw: pin to v0.29.1, 1.0 Reborn CLI/config is incompatible [@MickLesk](https://github.com/MickLesk) ([#15982](https://github.com/community-scripts/ProxmoxVE/pull/15982))
-    - update authentik to 2026.5.6 [@thieneret](https://github.com/thieneret) ([#15973](https://github.com/community-scripts/ProxmoxVE/pull/15973))
-
-  - #### ✨ New Features
-
-    - Cockpit: default to Debian 13, 45Drives now ships Trixie packages | little refactor [@MickLesk](https://github.com/MickLesk) ([#15984](https://github.com/community-scripts/ProxmoxVE/pull/15984))
-    - Paperless-ngx: Support v3 [@tomfrenzel](https://github.com/tomfrenzel) ([#15221](https://github.com/community-scripts/ProxmoxVE/pull/15221))
-
-## 2026-07-22
-
-### 🆕 New Scripts
-
-  - pve-tool: storage share helper script for Proxmox [@MickLesk](https://github.com/MickLesk) ([#15869](https://github.com/community-scripts/ProxmoxVE/pull/15869))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - InvoiceNinja: preserve and Re-download snappdf Chromium [@MickLesk](https://github.com/MickLesk) ([#15956](https://github.com/community-scripts/ProxmoxVE/pull/15956))
-    - Anytype: preserve default mongod.conf when configuring Anytype replica set [@MickLesk](https://github.com/MickLesk) ([#15954](https://github.com/community-scripts/ProxmoxVE/pull/15954))
-    - Nametag: fix missing tailwindcss module [@MickLesk](https://github.com/MickLesk) ([#15955](https://github.com/community-scripts/ProxmoxVE/pull/15955))
-
-  - #### ✨ New Features
-
-    - OPNSense: Bump FreeBSD to 15 and OPNSense to 26.7 [@MickLesk](https://github.com/MickLesk) ([#15943](https://github.com/community-scripts/ProxmoxVE/pull/15943))
-
-### 💾 Core
-
-  - #### ✨ New Features
-
-    - core: add OS mismatch guard for container updates [@MickLesk](https://github.com/MickLesk) ([#15948](https://github.com/community-scripts/ProxmoxVE/pull/15948))
-
-## 2026-07-21
-
-### 🚀 Updated Scripts
-
-  - #### ✨ New Features
-
-    - Pangolin: Bump Version to 1.21.0 [@MickLesk](https://github.com/MickLesk) ([#15938](https://github.com/community-scripts/ProxmoxVE/pull/15938))
-
-  - #### 🔧 Refactor
-
-    - Standardize CT update backup handling [@MickLesk](https://github.com/MickLesk) ([#15937](https://github.com/community-scripts/ProxmoxVE/pull/15937))
-
-## 2026-07-20
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - RomM: use backup helpers in update / clear folder [@MickLesk](https://github.com/MickLesk) ([#15915](https://github.com/community-scripts/ProxmoxVE/pull/15915))
-    - fix: vikunja: asset selection [@CrazyWolf13](https://github.com/CrazyWolf13) ([#15929](https://github.com/community-scripts/ProxmoxVE/pull/15929))
-    - Zammad : bind Elasticsearch to 127.0.0.1 [@MickLesk](https://github.com/MickLesk) ([#15909](https://github.com/community-scripts/ProxmoxVE/pull/15909))
-    - Omada: fix package version extraction [@MickLesk](https://github.com/MickLesk) ([#15908](https://github.com/community-scripts/ProxmoxVE/pull/15908))
-    - fix(wanderer): use PocketBase-relative plugin symlink in unprivileged LXC [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15911](https://github.com/community-scripts/ProxmoxVE/pull/15911))
-
-  - #### ✨ New Features
-
-    - AFFiNE: Bump version to v0.27.2 [@MickLesk](https://github.com/MickLesk) ([#15930](https://github.com/community-scripts/ProxmoxVE/pull/15930))
-
-  - #### 💥 Breaking Changes
-
-    - Gotify: Migration to v3 [@MickLesk](https://github.com/MickLesk) ([#15912](https://github.com/community-scripts/ProxmoxVE/pull/15912))
-
-### 💾 Core
-
-  - #### ✨ New Features
-
-    - core: refactor to single-reporter telemetry and better error_handling [@MickLesk](https://github.com/MickLesk) ([#15933](https://github.com/community-scripts/ProxmoxVE/pull/15933))
-    - tools.func: add support for extracting 7z archives [@MickLesk](https://github.com/MickLesk) ([#15919](https://github.com/community-scripts/ProxmoxVE/pull/15919))
-    - Meilisearch : use dumpless Meilisearch upgrades [@MickLesk](https://github.com/MickLesk) ([#15921](https://github.com/community-scripts/ProxmoxVE/pull/15921))
-
-  - #### 🔧 Refactor
-
-    - core: Improve GPU detection and mapping logic [@MickLesk](https://github.com/MickLesk) ([#15918](https://github.com/community-scripts/ProxmoxVE/pull/15918))
-
-## 2026-07-19
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - change trek repo to liketrek/TREK [@asylumexp](https://github.com/asylumexp) ([#15893](https://github.com/community-scripts/ProxmoxVE/pull/15893))
-    - update authentik to 2026.5.5 [@thieneret](https://github.com/thieneret) ([#15855](https://github.com/community-scripts/ProxmoxVE/pull/15855))
-    - [FIX] BookOrbit: add missing `restore_backup` during update [@vhsdream](https://github.com/vhsdream) ([#15881](https://github.com/community-scripts/ProxmoxVE/pull/15881))
-
-  - #### ✨ New Features
-
-    - tools.func: centralize deploy tail + trap-based tmpdir cleanup [@MickLesk](https://github.com/MickLesk) ([#15872](https://github.com/community-scripts/ProxmoxVE/pull/15872))
-    - Update OPNsense from 26.1 to 26.7 [@tdn131](https://github.com/tdn131) ([#15895](https://github.com/community-scripts/ProxmoxVE/pull/15895))
-
-### 💾 Core
-
-  - Revert "core: add configurable host CA inheritance during bootstrap" [@MickLesk](https://github.com/MickLesk) ([#15886](https://github.com/community-scripts/ProxmoxVE/pull/15886))
-
-  - #### 🐞 Bug Fixes
-
-    - fix(build.func): expand glob in SSH key "Scan Folder/Glob" so it can find keys [@TowyTowy](https://github.com/TowyTowy) ([#15873](https://github.com/community-scripts/ProxmoxVE/pull/15873))
-
-## 2026-07-18
-
-### 💾 Core
-
-  - #### ✨ New Features
-
-    - core: add configurable host CA inheritance during bootstrap [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15840](https://github.com/community-scripts/ProxmoxVE/pull/15840))
-
-  - #### 🔧 Refactor
-
-    - tools.func: Safe Delete Directorys & Update PYTHON_VERSION with setup_uv [@MickLesk](https://github.com/MickLesk) ([#15870](https://github.com/community-scripts/ProxmoxVE/pull/15870))
-
-### 🧰 Tools
-
-  - #### ✨ New Features
-
-    - [tools.update-lxcs] feat: optional reporting success/failures to heathchecks.io (or others) [@sir106](https://github.com/sir106) ([#15701](https://github.com/community-scripts/ProxmoxVE/pull/15701))
-
-## 2026-07-17
-
-### 🆕 New Scripts
-
-  - Invidious ([#15824](https://github.com/community-scripts/ProxmoxVE/pull/15824))
-- OxiCloud ([#15823](https://github.com/community-scripts/ProxmoxVE/pull/15823))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - webtrees: initialize database schema before admin user creation [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15837](https://github.com/community-scripts/ProxmoxVE/pull/15837))
-    - Fix DocuSeal missing Leptonica deps on install and update [@Copilot](https://github.com/Copilot) ([#15858](https://github.com/community-scripts/ProxmoxVE/pull/15858))
-    - apache-guacamole: detect installed extensions during update [@TowyTowy](https://github.com/TowyTowy) ([#15841](https://github.com/community-scripts/ProxmoxVE/pull/15841))
-    - CLIProxyAPI: fix update deleting config.yaml [@austinpilz](https://github.com/austinpilz) ([#15834](https://github.com/community-scripts/ProxmoxVE/pull/15834))
-    - esphome: install libusb-1.0-0 for ESP-IDF native builds [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15838](https://github.com/community-scripts/ProxmoxVE/pull/15838))
-
-  - #### ✨ New Features
-
-    - AFFiNE: Bump to 0.27.0 [@MickLesk](https://github.com/MickLesk) ([#15848](https://github.com/community-scripts/ProxmoxVE/pull/15848))
-    - n8n: unpin / use latest release [@MickLesk](https://github.com/MickLesk) ([#15817](https://github.com/community-scripts/ProxmoxVE/pull/15817))
-    - Pin Opencloud to v7.3.0 [@vhsdream](https://github.com/vhsdream) ([#15826](https://github.com/community-scripts/ProxmoxVE/pull/15826))
-
-  - #### 🔧 Refactor
-
-    - SFTPGo: Update APT Repo & Re-Enable Script [@MickLesk](https://github.com/MickLesk) ([#15829](https://github.com/community-scripts/ProxmoxVE/pull/15829))
-
-### 💾 Core
-
-  - #### ✨ New Features
-
-    - tools.func: enhance rbenv with profile updates / bundle in bashrc [@MickLesk](https://github.com/MickLesk) ([#15822](https://github.com/community-scripts/ProxmoxVE/pull/15822))
-    - feat(build.func): notify users when already on a pinned script version [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15819](https://github.com/community-scripts/ProxmoxVE/pull/15819))
-
-  - #### 💥 Breaking Changes
-
-    - MongoDB: Implement kernel version check and patch [@MickLesk](https://github.com/MickLesk) ([#15821](https://github.com/community-scripts/ProxmoxVE/pull/15821))
-
-### 🧰 Tools
-
-  - #### ✨ New Features
-
-    - update-lxc: autoremove and autoclean after apt full-upgrade [@soupy-boy](https://github.com/soupy-boy) ([#15831](https://github.com/community-scripts/ProxmoxVE/pull/15831))
+    - Bump all Alpine scripts to 3.24 [@asylumexp](https://github.com/asylumexp) ([#15994](https://github.com/community-scripts/ProxmoxVE/pull/15994))

ct/airtrail.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/johanohly/AirTrail
+
+APP="AirTrail"
+var_tags="${var_tags:-flights;tracking}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-3072}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/airtrail ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "airtrail" "johanohly/AirTrail"; then
+    msg_info "Stopping Service"
+    systemctl stop airtrail
+    msg_ok "Stopped Service"
+
+    create_backup /opt/airtrail/.env /opt/airtrail/uploads
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "airtrail" "johanohly/AirTrail" "tarball" "latest" "/opt/airtrail"
+
+    restore_backup
+
+    msg_info "Rebuilding AirTrail (Patience)"
+    cd /opt/airtrail
+    $STD bun install --frozen-lockfile
+    export NODE_ENV=production
+    $STD bun run build
+    $STD bun install --frozen-lockfile --production
+    $STD bun run db:migrate-deploy
+    msg_ok "Rebuilt AirTrail"
+
+    msg_info "Starting Service"
+    systemctl start airtrail
+    msg_ok "Started Service"
+    msg_ok "Updated Successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:3000${CL}"

ct/archlinux.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://archlinux.org/
+
+APP="Arch Linux"
+var_tags="${var_tags:-os}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-512}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-archlinux}"
+var_version="${var_version:-base}"
+var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+  if [[ ! -d /var ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+  msg_info "Updating Arch Linux LXC"
+  $STD pacman -Syu --noconfirm
+  msg_ok "Updated Arch Linux LXC"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!"
+msg_custom "🚀" "${GN}" "${APP} setup has been successfully initialized!"

ct/authentik.sh

@@ -32,18 +32,23 @@ function update_script() {
 
   read -r MAJOR MINOR PATCH <<<"$(sed 's/^version\///; s/\./ /g' "$HOME/.authentik")"
 
+  if [[ $MAJOR == 2026 && $MINOR -lt 5 ]]; then
+	msg_error "Updating from version ${MAJOR}.${MINOR}.${PATCH} is not supported. A minimum version of 2026.5.x is required to update. See: https://docs.goauthentik.io/releases/2026.8/"
+	exit
+  fi
+
   msg_info "Update dependencies"
   ensure_dependencies crossbuild-essential-$(arch_resolve) gcc-$(arch_resolve "x86-64" "aarch64")-linux-gnu cmake clang libunwind-18-dev
   msg_ok "Update dependencies"
 
-  NODE_VERSION="24" setup_nodejs
+  NODE_VERSION="26" NODE_MODULE=pnpm@11 setup_nodejs
   setup_go
   $STD uv cache clean
-  UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.6" setup_uv
+  UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.7" setup_uv
   RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
   setup_yq
 
-  AUTHENTIK_VERSION="version/2026.5.6"
+  AUTHENTIK_VERSION="version/2026.8.0"
   # Source: https://github.com/goauthentik/fips/blob/main/Makefile#L26
   XMLSEC_VERSION="1.3.12"
 
@@ -87,30 +92,32 @@ function update_script() {
     msg_ok "Configured rust"
 
     msg_info "Updating web"
-    cd /opt/authentik/web
     export NODE_ENV="production"
-    $STD npm install
-    $STD npm run build
-    $STD npm run build:sfe
+	  cd /opt/authentik
+	  $STD node ./scripts/node/lint-runtime.mjs ./web
+	  cd /opt/authentik/web
+	  $STD pnpm install --frozen-lockfile
+	  $STD pnpm run build
+	  $STD pnpm run build:sfe
     msg_ok "Updated web"
 
-    msg_info "Updating go proxy"
+    msg_info "Updating outposts"
     cd /opt/authentik
+	  mkdir -p /opt/authentik/bin
     export CGO_ENABLED="1"
     export CC="$(arch_resolve "x86_64" "aarch64")-linux-gnu-gcc"
     $STD go mod download
-    $STD go build -o /opt/authentik/authentik-server ./cmd/server
-    $STD go build -o /opt/authentik/ldap ./cmd/ldap
-    $STD go build -o /opt/authentik/rac ./cmd/rac
-    $STD go build -o /opt/authentik/radius ./cmd/radius
-    msg_ok "Updated go proxy"
+    $STD go build -o /opt/authentik/bin/ldap ./cmd/ldap
+    $STD go build -o /opt/authentik/bin/rac ./cmd/rac
+    $STD go build -o /opt/authentik/bin/radius ./cmd/radius
+    msg_ok "Updated outposts"
 
-    msg_info "Building worker. It may take more than 10 minutes, please be patient."
-    export AWS_LC_FIPS_SYS_CC="clang"
-    cd /opt/authentik
-    $STD cargo build --package authentik --no-default-features --features core --locked --release --jobs 1
-    cp ./target/release/authentik /opt/authentik/authentik-worker
-    rm -r ./target
+    msg_info "Building binary. It may take more than 10 minutes, please be patient."
+	  export AWS_LC_FIPS_SYS_CC="clang"
+	  cd /opt/authentik
+	  $STD cargo build --package authentik --no-default-features --features core --locked --release
+	  cp ./target/release/authentik /opt/authentik/bin/
+	  rm -r ./target
     msg_ok "Built worker"
 
     msg_info "Updating python server"
@@ -124,126 +131,47 @@ function update_script() {
     cd /opt/authentik
     for attempt in 1 2 3; do
       if [[ $attempt -eq 3 ]]; then
-        $STD uv sync --frozen --no-install-project --no-dev
+        $STD uv sync --locked --no-install-project --no-dev
         break
       fi
-      $STD uv sync --frozen --no-install-project --no-dev && break
+      $STD uv sync --locked --no-install-project --no-dev && break
       msg_warn "uv sync attempt $attempt failed, retrying..."
       sleep $((attempt * 15))
     done
     chown -R authentik:authentik /opt/authentik
     msg_ok "Updated python server"
 
-    if [[ $MAJOR == 2026 && $MINOR -lt 5 ]]; then
-      msg_info "Updating Worker and Server config"
-      cp /etc/authentik/config.yml /etc/authentik/config.bak
-      yq -i ".postgresql.conn_max_age = 0" /etc/authentik/config.yml
-      yq -i ".postgresql.conn_health_checks = false" /etc/authentik/config.yml
-      yq -i '.listen.debug_tokio = "[::]:6669"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.console_subscriber = "info"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.h2 = "info"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.hyper_util = "warn"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.mio = "info"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.notify = "info"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.reqwest = "info"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.runtime = "info"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.rustls = "info"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.sqlx = "info"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.sqlx_postgres = "info"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.tokio = "info"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.tungstenite = "info"' /etc/authentik/config.yml
-      yq -i ".web.workers = 2" /etc/authentik/config.yml
-      mv /etc/default/authentik /etc/default/authentik.bak
-      cat <<EOF >/etc/default/authentik-server
-TMPDIR=/dev/shm/
-UV_LINK_MODE=copy
-UV_PYTHON_DOWNLOADS=0
-UV_NATIVE_TLS=1
-VENV_PATH=/opt/authentik/.venv
-PYTHONDONTWRITEBYTECODE=1
-PYTHONUNBUFFERED=1
-PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
-DJANGO_SETTINGS_MODULE=authentik.root.settings
-PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
-AUTHENTIK_LISTEN__HTTP="[::]:9000"
-AUTHENTIK_LISTEN__HTTPS="[::]:9443"
-AUTHENTIK_LISTEN__METRICS="[::]:9300"
+	  msg_info "Updating Worker and Server config"
+    cat <<EOF >>/etc/default/authentik-server
+RUST_BACKTRACE=full
 EOF
-      cat <<EOF >/etc/default/authentik-worker
-TMPDIR=/dev/shm/
-UV_LINK_MODE=copy
-UV_PYTHON_DOWNLOADS=0
-UV_NATIVE_TLS=1
-VENV_PATH=/opt/authentik/.venv
-PYTHONDONTWRITEBYTECODE=1
-PYTHONUNBUFFERED=1
-PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
-DJANGO_SETTINGS_MODULE=authentik.root.settings
-PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
-AUTHENTIK_LISTEN__HTTP="[::]:8000"
-AUTHENTIK_LISTEN__HTTPS="[::]:8443"
-AUTHENTIK_LISTEN__METRICS="[::]:8300"
+    cat <<EOF >>/etc/default/authentik-worker
+RUST_BACKTRACE=full
 EOF
-      msg_ok "Updated Worker and Server config!"
-      msg_warn "Please check /etc/default/authentik-worker and /etc/default/authentik-server config files for port configurations!"
+    msg_ok "Updated Worker and Server config!"
 
-      msg_info "Updating services"
-      cat <<EOF >/etc/systemd/system/authentik-server.service
-[Unit]
-Description=authentik Go Server (API Gateway)
-After=network.target
-Wants=postgresql.service
+    msg_info "Updating services"
+	  sed -i "s|ExecStart=/opt/authentik/authentik-server|ExecStart=/opt/authentik/bin/authentik server|g" /etc/systemd/system/authentik-server.service
+	  sed -i "s|ExecStart=/opt/authentik/authentik-worker worker|ExecStart=/opt/authentik/bin/authentik worker|g" /etc/systemd/system/authentik-worker.service
+	  sed -i "s|ExecStart=/opt/authentik/ldap|ExecStart=/opt/authentik/bin/ldap|g" /etc/systemd/system/authentik-ldap.service
+	  sed -i "s|ExecStart=/opt/authentik/radius|ExecStart=/opt/authentik/bin/radius|g" /etc/systemd/system/authentik-radius.service
+	  sed -i "s|ExecStart=/opt/authentik/rac|ExecStart=/opt/authentik/bin/rac|g" /etc/systemd/system/authentik-rac.service
+    systemctl daemon-reload
+    msg_ok "Updated services"
 
-[Service]
-User=authentik
-Group=authentik
-ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
-ExecStart=/opt/authentik/authentik-server
-WorkingDirectory=/opt/authentik/
-Restart=always
-RestartSec=5
-EnvironmentFile=/etc/default/authentik-server
-
-[Install]
-WantedBy=multi-user.target
-EOF
-
-      cat <<EOF >/etc/systemd/system/authentik-worker.service
-[Unit]
-Description=authentik Worker
-After=network.target postgresql.service
-
-[Service]
-User=authentik
-Group=authentik
-Type=simple
-EnvironmentFile=/etc/default/authentik-worker
-ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
-ExecStart=/opt/authentik/authentik-worker worker
-WorkingDirectory=/opt/authentik
-Restart=always
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-      systemctl daemon-reload
-      msg_ok "Updated services"
-    fi
+  	msg_info "Starting Services"
+  	systemctl start authentik-server authentik-worker
+  	if [[ $(systemctl is-enabled authentik-ldap) == enabled ]]; then
+	    systemctl start authentik-ldap
+  	fi
+  	if [[ $(systemctl is-enabled authentik-rac) == enabled ]]; then
+	    systemctl start authentik-rac
+  	fi
+  	if [[ $(systemctl is-enabled authentik-radius) == enabled ]]; then
+	    systemctl start authentik-radius
+  	fi
+  	msg_ok "Started Services"
   fi
-
-  msg_info "Starting Services"
-  systemctl start authentik-server authentik-worker
-  if [[ $(systemctl is-enabled authentik-ldap) == enabled ]]; then
-    systemctl start authentik-ldap
-  fi
-  if [[ $(systemctl is-enabled authentik-rac) == enabled ]]; then
-    systemctl start authentik-rac
-  fi
-  if [[ $(systemctl is-enabled authentik-radius) == enabled ]]; then
-    systemctl start authentik-radius
-  fi
-  msg_ok "Started Services"
   msg_ok "Updated successfully!"
   exit
 }

ct/bar-assistant.sh

@@ -71,13 +71,15 @@ function update_script() {
     systemctl stop nginx
     msg_ok "Stopped nginx"
 
-    fetch_and_deploy_gh_release "vue-salt-rim" "karlomikus/vue-salt-rim" "tarball" "latest" "/opt/vue-salt-rim"
+    NODE_VERSION="22" NODE_MODULE="bun" setup_nodejs
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "vue-salt-rim" "karlomikus/vue-salt-rim" "tarball" "latest" "/opt/vue-salt-rim"
     restore_backup
 
     msg_info "Configuring Vue Salt Rim"
     cd /opt/vue-salt-rim
-    $STD npm install
-    $STD npm run build
+    $STD bun install
+    $STD bun run build
     msg_ok "Configured Vue Salt Rim"
 
     msg_info "Starting nginx"

ct/bookorbit.sh

@@ -8,7 +8,7 @@ source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxV
 APP="BookOrbit"
 var_tags="${var_tags:-books;library;reading}"
 var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
+var_ram="${var_ram:-4096}"
 var_disk="${var_disk:-10}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"

ct/cloudflared.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 tteck
 # Author: tteck (tteckster)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE

ct/docker.sh

@@ -9,7 +9,6 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 
 APP="Docker"
 var_tags="${var_tags:-docker}"
-var_cpu="${var_cpu:-2}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
@@ -19,10 +18,12 @@ if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
 fi
 
 if [[ "${var_os:-}" == "alpine" ]]; then
+  var_cpu="${var_cpu:-1}"
   var_ram="${var_ram:-1024}"
   var_disk="${var_disk:-2}"
   var_version="${var_version:-3.24}"
 else
+  var_cpu="${var_cpu:-2}"
   var_ram="${var_ram:-2048}"
   var_disk="${var_disk:-4}"
   var_version="${var_version:-13}"

ct/docuseal.sh

@@ -30,6 +30,18 @@ function update_script() {
     exit
   fi
 
+  ensure_dependencies musl
+  [[ -f /opt/pdfium/lib/libpdfium.so ]] || rm -f "$HOME/.pdfium"
+  fetch_and_deploy_gh_release "pdfium" "docusealco/pdfium-binaries" "prebuild" "latest" "/opt/pdfium" "pdfium-musl-$(arch_resolve "x86_64" "aarch64").zip"
+  if ! cmp -s /opt/pdfium/lib/libpdfium.so /usr/lib/libpdfium.so; then
+    msg_info "Updating PDFium"
+    install -m 644 /opt/pdfium/lib/libpdfium.so /usr/lib/libpdfium.so
+    echo "/usr/lib/$(arch_resolve "x86_64" "aarch64")-linux-musl" >/etc/ld.so.conf.d/musl.conf
+    ldconfig
+    systemctl restart docuseal docuseal-sidekiq
+    msg_ok "Updated PDFium"
+  fi
+
   if check_for_gh_release "docuseal" "docusealco/docuseal"; then
     msg_info "Stopping Services"
     systemctl stop docuseal docuseal-sidekiq

ct/fileflows.sh

@@ -101,7 +101,7 @@ function update_script() {
   fi
   msg_ok "Ensured ASP.NET Core Runtime"
 
-  fetch_and_deploy_from_url "https://fileflows.com/downloads/zip" "/opt/fileflows"
+  fetch_and_deploy_from_url "https://fileflows.com/downloads/ff-latest.tar.xz" "/opt/fileflows"
 
   msg_info "Starting Service"
   systemctl --all start 'fileflows*'

ct/fireshare.sh

@@ -57,11 +57,9 @@ function update_script() {
     $STD .venv/bin/python -m pip install --upgrade --break-system-packages pip
     $STD .venv/bin/python -m pip install --no-cache-dir --break-system-packages --ignore-installed app/server
     cp .venv/bin/fireshare /usr/local/bin/fireshare
-    export FLASK_APP="/opt/fireshare/app/server/fireshare:create_app()"
-    export DATA_DIRECTORY=/opt/fireshare-data
-    export IMAGE_DIRECTORY=/opt/fireshare-images
-    export VIDEO_DIRECTORY=/opt/fireshare-videos
-    export PROCESSED_DIRECTORY=/opt/fireshare-processed
+    set -a
+    source /opt/fireshare/fireshare.env
+    set +a
     $STD uv run flask db upgrade
     cd /opt/fireshare/app/client
     $STD npm install

ct/forgejo.sh

@@ -9,7 +9,6 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 
 APP="Forgejo"
 var_tags="${var_tags:-git}"
-var_cpu="${var_cpu:-2}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
@@ -19,10 +18,12 @@ if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
 fi
 
 if [[ "${var_os:-}" == "alpine" ]]; then
+  var_cpu="${var_cpu:-1}"
   var_ram="${var_ram:-256}"
   var_disk="${var_disk:-1}"
   var_version="${var_version:-3.24}"
 else
+  var_cpu="${var_cpu:-2}"
   var_ram="${var_ram:-2048}"
   var_disk="${var_disk:-10}"
   var_version="${var_version:-13}"

ct/headers/airtrail

@@ -0,0 +1,6 @@
+    ___    _     ______           _ __
+   /   |  (_)___/_  __/________ _(_) /
+  / /| | / / ___// / / ___/ __ `/ / / 
+ / ___ |/ / /   / / / /  / /_/ / / /  
+/_/  |_/_/_/   /_/ /_/   \__,_/_/_/   
+                                      

ct/headers/archlinux

@@ -0,0 +1,6 @@
+    ___              __       __    _                 
+   /   |  __________/ /_     / /   (_)___  __  ___  __
+  / /| | / ___/ ___/ __ \   / /   / / __ \/ / / / |/_/
+ / ___ |/ /  / /__/ / / /  / /___/ / / / / /_/ />  <  
+/_/  |_/_/   \___/_/ /_/  /_____/_/_/ /_/\__,_/_/|_|  
+                                                      

ct/headers/pve-ups

@@ -0,0 +1,6 @@
+    ____ _    ________     __  ______  _____
+   / __ \ |  / / ____/    / / / / __ \/ ___/
+  / /_/ / | / / __/______/ / / / /_/ /\__ \ 
+ / ____/| |/ / /__/_____/ /_/ / ____/___/ / 
+/_/     |___/_____/     \____/_/    /____/  
+                                            

ct/headers/rockylinux

@@ -0,0 +1,6 @@
+    ____             __            __    _                 
+   / __ \____  _____/ /____  __   / /   (_)___  __  ___  __
+  / /_/ / __ \/ ___/ //_/ / / /  / /   / / __ \/ / / / |/_/
+ / _, _/ /_/ / /__/ ,< / /_/ /  / /___/ / / / / /_/ />  <  
+/_/ |_|\____/\___/_/|_|\__, /  /_____/_/_/ /_/\__,_/_/|_|  
+                      /____/                               

ct/immich.sh

@@ -100,7 +100,7 @@ EOF
     fi
   fi
   if [[ -f ~/.immich_library_revisions ]]; then
-    libraries=("libjxl" "libheif" "libraw" "imagemagick" "libvips")
+    libraries=("libjxl" "jpegli" "libheif" "libraw" "imagemagick" "libvips")
     cd "$BASE_DIR"
     msg_warn "Checking for updates to custom image-processing libraries (recompile time: 2-15min per library)"
     $STD git pull
@@ -382,10 +382,7 @@ PY
 
 function compile_libjxl() {
   SOURCE=${SOURCE_DIR}/libjxl
-  JPEGLI_LIBJPEG_LIBRARY_SOVERSION="62"
-  JPEGLI_LIBJPEG_LIBRARY_VERSION="62.3.0"
-  LIBJXL_REVISION="332feb17d17311c748445f7ee75c4fb55cc38530"
-  # : "${LIBJXL_REVISION:=$(jq -cr '.revision' "$BASE_DIR"/server/sources/libjxl.json)}"
+  LIBJXL_REVISION="$(jq -cr '.revision' "$BASE_DIR"/server/sources/libjxl.json)"
   if [[ "$LIBJXL_REVISION" != "$(grep 'libjxl' ~/.immich_library_revisions | awk '{print $2}')" ]]; then
     msg_info "Recompiling libjxl"
     [[ -d "$SOURCE" ]] && rm -rf "$SOURCE"
@@ -393,8 +390,6 @@ function compile_libjxl() {
     cd "$SOURCE"
     $STD git reset --hard "$LIBJXL_REVISION"
     $STD git submodule update --init --recursive --depth 1 --recommend-shallow
-    $STD git apply "$BASE_DIR"/server/sources/libjxl-patches/jpegli-empty-dht-marker.patch
-    $STD git apply "$BASE_DIR"/server/sources/libjxl-patches/jpegli-icc-warning.patch
     mkdir build
     cd build
     $STD cmake \
@@ -402,15 +397,66 @@ function compile_libjxl() {
       -DBUILD_TESTING=OFF \
       -DJPEGXL_ENABLE_DOXYGEN=OFF \
       -DJPEGXL_ENABLE_MANPAGES=OFF \
-      -DJPEGXL_ENABLE_PLUGIN_GIMP210=OFF \
       -DJPEGXL_ENABLE_BENCHMARK=OFF \
       -DJPEGXL_ENABLE_EXAMPLES=OFF \
       -DJPEGXL_FORCE_SYSTEM_BROTLI=ON \
       -DJPEGXL_FORCE_SYSTEM_HWY=ON \
-      -DJPEGXL_ENABLE_JPEGLI=ON \
-      -DJPEGXL_ENABLE_JPEGLI_LIBJPEG=ON \
-      -DJPEGXL_INSTALL_JPEGLI_LIBJPEG=ON \
+      -DJPEGXL_ENABLE_HWY_AVX3=ON \
+      -DJPEGXL_ENABLE_HWY_AVX3_ZEN4=ON \
+      -DJPEGXL_ENABLE_HWY_SVE=OFF \
+      -DJPEGXL_ENABLE_HWY_SVE2=OFF \
+      -DJPEGXL_ENABLE_HWY_SVE2_128=ON \
       -DJPEGXL_ENABLE_PLUGINS=ON \
+      ..
+    $STD cmake --build . -- -j"$(nproc)"
+    $STD cmake --install .
+    ldconfig /usr/local/lib
+    $STD make clean
+    cd "$STAGING_DIR"
+    rm -rf "$SOURCE"/{build,third_party}
+    sed -i "s/libjxl: .*$/libjxl: $LIBJXL_REVISION/" ~/.immich_library_revisions
+    msg_ok "Recompiled libjxl"
+  fi
+}
+
+function compile_jpegli() {
+  SOURCE=${SOURCE_DIR}/jpegli
+  JPEGLI_LIBJPEG_LIBRARY_SOVERSION="62"
+  JPEGLI_LIBJPEG_LIBRARY_VERSION="62.3.0"
+  JPEGLI_REVISION="$(jq -cr '.revision' "$BASE_DIR"/server/sources/jpegli.json)"
+  if [[ "$JPEGLI_REVISION" != "$(grep 'jpegli' ~/.immich_library_revisions | awk '{print $2}')" ]]; then
+    msg_info "Recompiling jpegli"
+    [[ -d "$SOURCE" ]] && rm -rf "$SOURCE"
+    $STD git clone https://github.com/google/jpegli.git "$SOURCE"
+    cd "$SOURCE"
+    $STD git reset --hard "$JPEGLI_REVISION"
+    $STD git submodule update --init --depth 1 --recommend-shallow third_party/libjpeg-turbo
+    $STD git apply -3 "$BASE_DIR"/server/sources/jpegli-patches/jpegli-empty-dht-marker.patch
+    $STD git apply -3 "$BASE_DIR"/server/sources/jpegli-patches/jpegli-icc-warning.patch
+    mkdir build
+    cd build
+    $STD cmake \
+      -DCMAKE_BUILD_TYPE=Release \
+      -DBUILD_TESTING=OFF \
+      -DJPEGLI_ENABLE_DOXYGEN=OFF \
+      -DJPEGLI_ENABLE_MANPAGES=OFF \
+      -DJPEGLI_ENABLE_BENCHMARK=OFF \
+      -DJPEGLI_ENABLE_TOOLS=OFF \
+      -DJPEGLI_ENABLE_DEVTOOLS=OFF \
+      -DJPEGLI_ENABLE_FUZZERS=OFF \
+      -DJPEGLI_ENABLE_JNI=OFF \
+      -DJPEGLI_ENABLE_OPENEXR=OFF \
+      -DJPEGLI_ENABLE_SJPEG=OFF \
+      -DJPEGLI_ENABLE_SKCMS=OFF \
+      -DJPEGLI_FORCE_SYSTEM_HWY=ON \
+      -DJPEGLI_FORCE_SYSTEM_LCMS2=ON \
+      -DJPEGLI_ENABLE_JPEGLI_LIBJPEG=ON \
+      -DJPEGLI_INSTALL_JPEGLI_LIBJPEG=ON \
+      -DJPEGLI_ENABLE_HWY_AVX3=ON \
+      -DJPEGLI_ENABLE_HWY_AVX3_ZEN4=ON \
+      -DJPEGLI_ENABLE_HWY_SVE=OFF \
+      -DJPEGLI_ENABLE_HWY_SVE2=OFF \
+      -DJPEGLI_ENABLE_HWY_SVE2_128=ON \
       -DJPEGLI_LIBJPEG_LIBRARY_SOVERSION="$JPEGLI_LIBJPEG_LIBRARY_SOVERSION" \
       -DJPEGLI_LIBJPEG_LIBRARY_VERSION="$JPEGLI_LIBJPEG_LIBRARY_VERSION" \
       -DLIBJPEG_TURBO_VERSION_NUMBER=2001005 \
@@ -421,8 +467,8 @@ function compile_libjxl() {
     $STD make clean
     cd "$STAGING_DIR"
     rm -rf "$SOURCE"/{build,third_party}
-    sed -i "s/libjxl: .*$/libjxl: $LIBJXL_REVISION/" ~/.immich_library_revisions
-    msg_ok "Recompiled libjxl"
+    sed -i "s/jpegli: .*$/jpegli: $JPEGLI_REVISION/" ~/.immich_library_revisions
+    msg_ok "Recompiled jpegli"
   fi
 }
 
@@ -504,7 +550,7 @@ function compile_imagemagick() {
 
 function compile_libvips() {
   SOURCE=$SOURCE_DIR/libvips
-  LIBVIPS_REVISION="e01a4797cabe77d457fdfa7d776b7a7e7ca6d6a7"
+  LIBVIPS_REVISION="$(jq -cr '.revision' "$BASE_DIR"/server/sources/libvips.json)"
   if [[ "$LIBVIPS_REVISION" != "$(grep 'libvips' ~/.immich_library_revisions | awk '{print $2}')" ]]; then
     msg_info "Recompiling libvips"
     [[ -d "$SOURCE" ]] && rm -rf "$SOURCE"

ct/ironclaw.sh

@@ -9,7 +9,6 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 
 APP="IronClaw"
 var_tags="${var_tags:-ai;agent;security}"
-var_cpu="${var_cpu:-2}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
@@ -19,10 +18,12 @@ if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
 fi
 
 if [[ "${var_os:-}" == "alpine" ]]; then
+  var_cpu="${var_cpu:-1}"
   var_ram="${var_ram:-1024}"
   var_disk="${var_disk:-8}"
   var_version="${var_version:-3.24}"
 else
+  var_cpu="${var_cpu:-2}"
   var_ram="${var_ram:-2048}"
   var_disk="${var_disk:-8}"
   var_version="${var_version:-13}"

ct/n8n.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 tteck
 # Author: tteck (tteckster)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE

ct/omada.sh

@@ -31,7 +31,7 @@ function update_script() {
 
   msg_info "Updating MongoDB"
   if [[ "$(arch_resolve)" == "arm64" ]] || lscpu | grep -q 'avx'; then
-    MONGO_VERSION="8.0"
+    MONGO_VERSION="8.0" setup_mongodb
   else
     msg_error "No AVX detected (CPU-Flag)! We have discontinued support for this. You are welcome to try it manually with a Debian LXC, but due to the many issues with Omada, we currently only support AVX CPUs."
     exit 10

ct/pve-ups.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: CrazyWolf13
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/ffind-dev/pve-ups
+
+APP="PVE-UPS"
+var_tags="${var_tags:-proxmox;ups;monitoring;network}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-512}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/pve-usv ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "pve-usv" "ffind-dev/pve-ups"; then
+    msg_info "Stopping Services"
+    systemctl stop pve-usv pve-usv-agent.path pve-usv-agent.timer
+    msg_ok "Stopped Services"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "pve-usv" "ffind-dev/pve-ups" "tarball"
+
+    msg_info "Updating Application"
+    cd /opt/pve-usv
+    $STD uv venv --clear venv
+    $STD uv pip install --python venv/bin/python .
+    chown -R pveusv:pveusv /opt/pve-usv
+    chmod 0755 deploy/pve-usv-agent.sh
+    install -m 0644 deploy/pve-usv.service /etc/systemd/system/pve-usv.service
+    install -m 0644 deploy/pve-usv-agent.service /etc/systemd/system/pve-usv-agent.service
+    install -m 0644 deploy/pve-usv-agent.path /etc/systemd/system/pve-usv-agent.path
+    install -m 0644 deploy/pve-usv-agent.timer /etc/systemd/system/pve-usv-agent.timer
+    systemctl daemon-reload
+    msg_ok "Updated Application"
+
+    msg_info "Starting Services"
+    systemctl start pve-usv pve-usv-agent.path pve-usv-agent.timer
+    msg_ok "Started Services"
+    msg_ok "Updated ${APP}"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:8080${CL}"

ct/qbittorrent.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: tteck (tteckster) | Co-Author: Slaviša Arežina (tremor021)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE

ct/rockylinux.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://rockylinux.org/
+
+APP="Rocky Linux"
+var_tags="${var_tags:-os}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-512}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-rockylinux}"
+var_version="${var_version:-10}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+  if [[ ! -d /var ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+  msg_info "Updating Rocky Linux LXC"
+  $STD dnf -y upgrade
+  msg_ok "Updated Rocky Linux LXC"
+  msg_ok "Completed successfully!"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!\n"
+msg_custom "🚀" "${GN}" "${APP} setup has been successfully initialized!"

ct/syncthing.sh

@@ -9,7 +9,6 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 
 APP="Syncthing"
 var_tags="${var_tags:-sync}"
-var_cpu="${var_cpu:-2}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
@@ -19,10 +18,12 @@ if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
 fi
 
 if [[ "${var_os:-}" == "alpine" ]]; then
+  var_cpu="${var_cpu:-1}"
   var_ram="${var_ram:-256}"
   var_disk="${var_disk:-1}"
   var_version="${var_version:-3.24}"
 else
+  var_cpu="${var_cpu:-2}"
   var_ram="${var_ram:-2048}"
   var_disk="${var_disk:-8}"
   var_version="${var_version:-13}"

ct/tdarr.sh

@@ -36,7 +36,7 @@ function update_script() {
   cd /opt/tdarr
   RELEASE=$(curl_with_retry "https://f000.backblazeb2.com/file/tdarrs/versions.json" "-" | grep -oP '(?<="Tdarr_Updater": ")[^"]+' | grep "linux_$(arch_resolve "x64" "arm64")" | head -n 1)
   curl_with_retry "$RELEASE" "Tdarr_Updater.zip"
-  $STD unzip Tdarr_Updater.zip
+  $STD unzip -o Tdarr_Updater.zip
   chmod +x Tdarr_Updater
   $STD ./Tdarr_Updater
   rm -rf /opt/tdarr/Tdarr_Updater.zip

ct/technitiumdns.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 tteck
 # Author: tteck (tteckster)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE

ct/transmission.sh

@@ -9,7 +9,6 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 
 APP="Transmission"
 var_tags="${var_tags:-torrent}"
-var_cpu="${var_cpu:-2}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
@@ -19,10 +18,12 @@ if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
 fi
 
 if [[ "${var_os:-}" == "alpine" ]]; then
+  var_cpu="${var_cpu:-1}"
   var_ram="${var_ram:-256}"
   var_disk="${var_disk:-1}"
   var_version="${var_version:-3.24}"
 else
+  var_cpu="${var_cpu:-2}"
   var_ram="${var_ram:-2048}"
   var_disk="${var_disk:-8}"
   var_version="${var_version:-13}"

ct/uptimekuma.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 tteck
 # Author: tteck (tteckster)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE

ct/vaultwarden.sh

@@ -9,7 +9,6 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 
 APP="Vaultwarden"
 var_tags="${var_tags:-password-manager}"
-var_cpu="${var_cpu:-4}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
@@ -19,10 +18,12 @@ if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
 fi
 
 if [[ "${var_os:-}" == "alpine" ]]; then
+  var_cpu="${var_cpu:-1}"
   var_ram="${var_ram:-256}"
   var_disk="${var_disk:-1}"
   var_version="${var_version:-3.24}"
 else
+  var_cpu="${var_cpu:-4}"
   var_ram="${var_ram:-6144}"
   var_disk="${var_disk:-20}"
   var_version="${var_version:-13}"

ct/wallos.sh

@@ -55,7 +55,8 @@ function update_script() {
     msg_ok "Apache2 Reloaded"
 
     msg_info "Running Database Migration"
-    $STD curl http://localhost/endpoints/db/migrate.php
+    cd /opt/wallos
+    $STD sudo -u www-data php /opt/wallos/endpoints/db/migrate.php
     msg_ok "Ran Database Migration"
     msg_ok "Updated successfully!"
   fi

ct/zigbee2mqtt.sh

@@ -9,7 +9,6 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 
 APP="Zigbee2MQTT"
 var_tags="${var_tags:-smarthome;zigbee;mqtt}"
-var_cpu="${var_cpu:-2}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-0}"
 if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
@@ -19,10 +18,12 @@ if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
 fi
 
 if [[ "${var_os:-}" == "alpine" ]]; then
+  var_cpu="${var_cpu:-1}"
   var_ram="${var_ram:-256}"
   var_disk="${var_disk:-1}"
   var_version="${var_version:-3.24}"
 else
+  var_cpu="${var_cpu:-2}"
   var_ram="${var_ram:-1024}"
   var_disk="${var_disk:-5}"
   var_version="${var_version:-13}"

install/airtrail-install.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/johanohly/AirTrail
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+NODE_VERSION="22" setup_nodejs
+
+msg_info "Installing Bun"
+export BUN_INSTALL="/root/.bun"
+curl -fsSL https://bun.sh/install | $STD bash
+ln -sf /root/.bun/bin/bun /usr/local/bin/bun
+ln -sf /root/.bun/bin/bunx /usr/local/bin/bunx
+msg_ok "Installed Bun"
+
+PG_VERSION="16" setup_postgresql
+PG_DB_NAME="airtrail" PG_DB_USER="airtrail" setup_postgresql_db
+
+fetch_and_deploy_gh_release "airtrail" "johanohly/AirTrail" "tarball" "latest" "/opt/airtrail"
+
+msg_info "Configuring AirTrail"
+mkdir -p /opt/airtrail/uploads
+cat <<EOF >/opt/airtrail/.env
+NODE_ENV=production
+DB_URL=postgres://${PG_DB_USER}:${PG_DB_PASS}@localhost:5432/${PG_DB_NAME}
+ORIGIN=http://${LOCAL_IP}:3000
+BODY_SIZE_LIMIT=20M
+UPLOAD_LOCATION=/opt/airtrail/uploads
+EOF
+msg_ok "Configured AirTrail"
+
+msg_info "Building AirTrail (Patience)"
+cd /opt/airtrail
+$STD bun install --frozen-lockfile
+export NODE_ENV=production
+$STD bun run build
+$STD bun install --frozen-lockfile --production
+msg_ok "Built AirTrail"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/airtrail.service
+[Unit]
+Description=AirTrail
+After=network.target postgresql.service
+Wants=postgresql.service
+
+[Service]
+Type=simple
+WorkingDirectory=/opt/airtrail
+EnvironmentFile=/opt/airtrail/.env
+ExecStartPre=/usr/bin/node /opt/airtrail/docker/migrate.js
+ExecStart=/usr/bin/node /opt/airtrail/build
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now airtrail
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/archlinux-install.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://archlinux.org/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+motd_ssh
+customize
+cleanup_lxc

install/authentik-install.sh

@@ -50,16 +50,16 @@ $STD apt install -y \
   git
 msg_ok "Installed Dependencies"
 
-NODE_VERSION="24" setup_nodejs
+NODE_VERSION="26" NODE_MODULE=pnpm@11 setup_nodejs
 setup_yq
 setup_go
 RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
-UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.6" setup_uv
+UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.7" setup_uv
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db
 
 XMLSEC_VERSION="1.3.12"
-AUTHENTIK_VERSION="version/2026.5.6"
+AUTHENTIK_VERSION="version/2026.8.0"
 fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec"
 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
 fetch_and_deploy_gh_release "geoipupdate" "maxmind/geoipupdate" "binary"
@@ -80,23 +80,25 @@ $STD rustup default "$(sed -n 's/channel = "\(.*\)"/\1/p' rust-toolchain.toml)"
 msg_ok "Configured rust"
 
 msg_info "Setting up web"
-cd /opt/authentik/web
 export NODE_ENV="production"
-$STD npm install
-$STD npm run build
-$STD npm run build:sfe
+cd /opt/authentik
+$STD node ./scripts/node/lint-runtime.mjs ./web
+cd /opt/authentik/web
+$STD pnpm install --frozen-lockfile
+$STD pnpm run build
+$STD pnpm run build:sfe
 msg_ok "Setup web"
 
-msg_info "Setting up go proxy"
+msg_info "Building outposts"
 cd /opt/authentik
+mkdir -p /opt/authentik/bin
 export CGO_ENABLED="1"
 export CC="$(arch_resolve "x86_64" "aarch64")-linux-gnu-gcc"
 $STD go mod download
-$STD go build -o /opt/authentik/authentik-server ./cmd/server
-$STD go build -o /opt/authentik/ldap ./cmd/ldap
-$STD go build -o /opt/authentik/rac ./cmd/rac
-$STD go build -o /opt/authentik/radius ./cmd/radius
-msg_ok "Setup go proxy"
+$STD go build -o /opt/authentik/bin/ldap ./cmd/ldap
+$STD go build -o /opt/authentik/bin/rac ./cmd/rac
+$STD go build -o /opt/authentik/bin/radius ./cmd/radius
+msg_ok "Built outposts"
 
 cat <<EOF >/usr/local/etc/GeoIP.conf
 AccountID ChangeME
@@ -109,13 +111,13 @@ EOF
 
 echo "#39 19 * * 6,4 /usr/bin/geoipupdate -f /usr/local/etc/GeoIP.conf" | crontab -
 
-msg_info "Building worker. It may take more than 10 minutes, please be patient."
+msg_info "Building binary. It may take more than 10 minutes, please be patient."
 export AWS_LC_FIPS_SYS_CC="clang"
 cd /opt/authentik
-$STD cargo build --package authentik --no-default-features --features core --locked --release --jobs 1
-cp ./target/release/authentik /opt/authentik/authentik-worker
+$STD cargo build --package authentik --no-default-features --features core --locked --release
+cp ./target/release/authentik /opt/authentik/bin/
 rm -r ./target
-msg_ok "Built worker"
+msg_ok "Built binary"
 
 msg_info "Setting up python server"
 export UV_NO_BINARY_PACKAGE="cryptography lxml python-kadmin-rs xmlsec"
@@ -127,10 +129,10 @@ export UV_PYTHON_INSTALL_DIR="/usr/local/bin"
 cd /opt/authentik
 for attempt in 1 2 3; do
   if [[ $attempt -eq 3 ]]; then
-    $STD uv sync --frozen --no-install-project --no-dev
+    $STD uv sync --locked --no-install-project --no-dev
     break
   fi
-  $STD uv sync --frozen --no-install-project --no-dev && break
+  $STD uv sync --locked --no-install-project --no-dev && break
   msg_warn "uv sync attempt $attempt failed, retrying..."
   sleep $((attempt * 15))
 done
@@ -159,6 +161,7 @@ UV_NATIVE_TLS=1
 VENV_PATH=/opt/authentik/.venv
 PYTHONDONTWRITEBYTECODE=1
 PYTHONUNBUFFERED=1
+RUST_BACKTRACE=full
 PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
 DJANGO_SETTINGS_MODULE=authentik.root.settings
 PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
@@ -174,6 +177,7 @@ UV_NATIVE_TLS=1
 VENV_PATH=/opt/authentik/.venv
 PYTHONDONTWRITEBYTECODE=1
 PYTHONUNBUFFERED=1
+RUST_BACKTRACE=full
 PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
 DJANGO_SETTINGS_MODULE=authentik.root.settings
 PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
@@ -201,7 +205,7 @@ msg_ok "Created authentik config"
 msg_info "Creating services"
 cat <<EOF >/etc/systemd/system/authentik-server.service
 [Unit]
-Description=authentik Go Server (API Gateway)
+Description=authentik Server
 After=network.target
 Wants=postgresql.service
 
@@ -210,7 +214,7 @@ User=authentik
 Group=authentik
 EnvironmentFile=/etc/default/authentik-server
 ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
-ExecStart=/opt/authentik/authentik-server
+ExecStart=/opt/authentik/bin/authentik server
 WorkingDirectory=/opt/authentik/
 Restart=always
 RestartSec=5
@@ -230,7 +234,7 @@ Group=authentik
 Type=simple
 EnvironmentFile=/etc/default/authentik-worker
 ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
-ExecStart=/opt/authentik/authentik-worker worker
+ExecStart=/opt/authentik/bin/authentik worker
 WorkingDirectory=/opt/authentik
 Restart=always
 RestartSec=5
@@ -248,7 +252,7 @@ Wants=postgresql.service
 [Service]
 User=authentik
 Group=authentik
-ExecStart=/opt/authentik/ldap
+ExecStart=/opt/authentik/bin/ldap
 WorkingDirectory=/opt/authentik/
 Restart=always
 RestartSec=5
@@ -267,7 +271,7 @@ Wants=postgresql.service
 [Service]
 User=authentik
 Group=authentik
-ExecStart=/opt/authentik/rac
+ExecStart=/opt/authentik/bin/rac
 WorkingDirectory=/opt/authentik/
 Restart=always
 RestartSec=5
@@ -286,7 +290,7 @@ Wants=postgresql.service
 [Service]
 User=authentik
 Group=authentik
-ExecStart=/opt/authentik/radius
+ExecStart=/opt/authentik/bin/radius
 WorkingDirectory=/opt/authentik/
 Restart=always
 RestartSec=5

install/bar-assistant-install.sh

@@ -25,7 +25,7 @@ msg_ok "Installed Dependencies"
 
 PHP_VERSION="8.4" PHP_FPM="YES" PHP_MODULE="pdo-sqlite" setup_php
 setup_composer
-NODE_VERSION="22" setup_nodejs
+NODE_VERSION="22" NODE_MODULE="bun" setup_nodejs
 setup_meilisearch
 fetch_and_deploy_gh_release "bar-assistant" "karlomikus/bar-assistant" "tarball" "latest" "/opt/bar-assistant"
 fetch_and_deploy_gh_release "vue-salt-rim" "karlomikus/vue-salt-rim" "tarball" "latest" "/opt/vue-salt-rim"
@@ -68,8 +68,8 @@ window.srConfig = {}
 window.srConfig.API_URL = "http://${LOCAL_IP}/bar"
 window.srConfig.MEILISEARCH_URL = "http://${LOCAL_IP}/search"
 EOF
-$STD npm install
-$STD npm run build
+$STD bun install
+$STD bun run build
 msg_ok "Installed Salt Rim"
 
 msg_info "Creating Service"

install/docuseal-install.sh

@@ -29,16 +29,16 @@ $STD apt install -y \
   libvips-dev \
   libheif1 \
   redis-server \
-  fontconfig
+  fontconfig \
+  musl
 msg_ok "Installed Dependencies"
 
 NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="docuseal" PG_DB_USER="docuseal" setup_postgresql_db
 
-msg_info "Downloading Fonts and PDFium"
+msg_info "Downloading Fonts"
 mkdir -p /opt/fonts /usr/share/fonts/noto
-ARCH=$(uname -m | sed 's/x86_64/x64/;s/aarch64/arm64/')
 curl -fsSL -o /opt/fonts/GoNotoKurrent-Regular.ttf \
   https://github.com/satbyy/go-noto-universal/releases/download/v7.0/GoNotoKurrent-Regular.ttf
 curl -fsSL -o /opt/fonts/GoNotoKurrent-Bold.ttf \
@@ -48,12 +48,15 @@ curl -fsSL -o /opt/fonts/DancingScript-Regular.otf \
 ln -sf /opt/fonts/GoNotoKurrent-Regular.ttf /usr/share/fonts/noto/
 ln -sf /opt/fonts/GoNotoKurrent-Bold.ttf /usr/share/fonts/noto/
 $STD fc-cache -f
-curl -fsSL -o /tmp/pdfium.tgz \
-  "https://github.com/bblanchon/pdfium-binaries/releases/latest/download/pdfium-linux-${ARCH}.tgz"
-mkdir -p /tmp/pdfium && tar -xzf /tmp/pdfium.tgz -C /tmp/pdfium
-cp /tmp/pdfium/lib/libpdfium.so /usr/lib/libpdfium.so
-rm -rf /tmp/pdfium /tmp/pdfium.tgz
-msg_ok "Downloaded Fonts and PDFium"
+msg_ok "Downloaded Fonts"
+
+fetch_and_deploy_gh_release "pdfium" "docusealco/pdfium-binaries" "prebuild" "latest" "/opt/pdfium" "pdfium-musl-$(arch_resolve "x86_64" "aarch64").zip"
+
+msg_info "Installing PDFium"
+install -m 644 /opt/pdfium/lib/libpdfium.so /usr/lib/libpdfium.so
+echo "/usr/lib/$(arch_resolve "x86_64" "aarch64")-linux-musl" >/etc/ld.so.conf.d/musl.conf
+ldconfig
+msg_ok "Installed PDFium"
 
 fetch_and_deploy_gh_release "docuseal" "docusealco/docuseal" "tarball"
 

install/fileflows-install.sh

@@ -39,7 +39,7 @@ else
 fi
 msg_ok "Installed ASP.NET Core Runtime"
 
-fetch_and_deploy_from_url "https://fileflows.com/downloads/zip" "/opt/fileflows"
+fetch_and_deploy_from_url "https://fileflows.com/downloads/ff-latest.tar.xz" "/opt/fileflows"
 
 $STD ln -svf /usr/bin/ffmpeg /usr/local/bin/ffmpeg
 $STD ln -svf /usr/bin/ffprobe /usr/local/bin/ffprobe

install/gitea-install.sh

@@ -30,7 +30,7 @@ setup_deb_based() {
   chown -R gitea:gitea /var/lib/gitea/
   chmod -R 750 /var/lib/gitea/
   chown root:gitea /etc/gitea
-  chmod 770 /etc/gitea
+  chmod 750 /etc/gitea
   sudo -u gitea ln -s /var/lib/gitea/data/.ssh/ /etc/gitea/.ssh
   msg_ok "Configured Gitea"
 

install/immich-install.sh

@@ -183,19 +183,14 @@ SOURCE_DIR=${STAGING_DIR}/image-source
 $STD git clone -b main "$BASE_REPO" "$BASE_DIR"
 mkdir -p "$SOURCE_DIR"
 
-msg_info "(1/5) Compiling libjxl"
+msg_info "(1/6) Compiling libjxl"
 cd "$STAGING_DIR"
 SOURCE=${SOURCE_DIR}/libjxl
-JPEGLI_LIBJPEG_LIBRARY_SOVERSION="62"
-JPEGLI_LIBJPEG_LIBRARY_VERSION="62.3.0"
-LIBJXL_REVISION="332feb17d17311c748445f7ee75c4fb55cc38530"
-# : "${LIBJXL_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libjxl.json)}"
+LIBJXL_REVISION="$(jq -cr '.revision' "$BASE_DIR"/server/sources/libjxl.json)"
 $STD git clone https://github.com/libjxl/libjxl.git "$SOURCE"
 cd "$SOURCE"
 $STD git reset --hard "$LIBJXL_REVISION"
 $STD git submodule update --init --recursive --depth 1 --recommend-shallow
-$STD git apply "$BASE_DIR"/server/sources/libjxl-patches/jpegli-empty-dht-marker.patch
-$STD git apply "$BASE_DIR"/server/sources/libjxl-patches/jpegli-icc-warning.patch
 mkdir build
 cd build
 $STD cmake \
@@ -203,15 +198,60 @@ $STD cmake \
   -DBUILD_TESTING=OFF \
   -DJPEGXL_ENABLE_DOXYGEN=OFF \
   -DJPEGXL_ENABLE_MANPAGES=OFF \
-  -DJPEGXL_ENABLE_PLUGIN_GIMP210=OFF \
   -DJPEGXL_ENABLE_BENCHMARK=OFF \
   -DJPEGXL_ENABLE_EXAMPLES=OFF \
   -DJPEGXL_FORCE_SYSTEM_BROTLI=ON \
   -DJPEGXL_FORCE_SYSTEM_HWY=ON \
-  -DJPEGXL_ENABLE_JPEGLI=ON \
-  -DJPEGXL_ENABLE_JPEGLI_LIBJPEG=ON \
-  -DJPEGXL_INSTALL_JPEGLI_LIBJPEG=ON \
+  -DJPEGXL_ENABLE_HWY_AVX3=ON \
+  -DJPEGXL_ENABLE_HWY_AVX3_ZEN4=ON \
+  -DJPEGXL_ENABLE_HWY_SVE=OFF \
+  -DJPEGXL_ENABLE_HWY_SVE2=OFF \
+  -DJPEGXL_ENABLE_HWY_SVE2_128=ON \
   -DJPEGXL_ENABLE_PLUGINS=ON \
+  ..
+$STD cmake --build . -- -j"$(nproc)"
+$STD cmake --install .
+ldconfig /usr/local/lib
+$STD make clean
+cd "$STAGING_DIR"
+rm -rf "$SOURCE"/{build,third_party}
+msg_ok "(1/6) Compiled libjxl"
+
+msg_info "(2/6) Compiling jpegli"
+SOURCE=${SOURCE_DIR}/jpegli
+JPEGLI_LIBJPEG_LIBRARY_SOVERSION="62"
+JPEGLI_LIBJPEG_LIBRARY_VERSION="62.3.0"
+JPEGLI_REVISION="$(jq -cr '.revision' "$BASE_DIR"/server/sources/jpegli.json)"
+$STD git clone https://github.com/google/jpegli.git "$SOURCE"
+cd "$SOURCE"
+$STD git reset --hard "$JPEGLI_REVISION"
+$STD git submodule update --init --depth 1 --recommend-shallow third_party/libjpeg-turbo
+$STD git apply -3 "$BASE_DIR"/server/sources/jpegli-patches/jpegli-empty-dht-marker.patch
+$STD git apply -3 "$BASE_DIR"/server/sources/jpegli-patches/jpegli-icc-warning.patch
+mkdir build
+cd build
+$STD cmake \
+  -DCMAKE_BUILD_TYPE=Release \
+  -DBUILD_TESTING=OFF \
+  -DJPEGLI_ENABLE_DOXYGEN=OFF \
+  -DJPEGLI_ENABLE_MANPAGES=OFF \
+  -DJPEGLI_ENABLE_BENCHMARK=OFF \
+  -DJPEGLI_ENABLE_TOOLS=OFF \
+  -DJPEGLI_ENABLE_DEVTOOLS=OFF \
+  -DJPEGLI_ENABLE_FUZZERS=OFF \
+  -DJPEGLI_ENABLE_JNI=OFF \
+  -DJPEGLI_ENABLE_OPENEXR=OFF \
+  -DJPEGLI_ENABLE_SJPEG=OFF \
+  -DJPEGLI_ENABLE_SKCMS=OFF \
+  -DJPEGLI_FORCE_SYSTEM_HWY=ON \
+  -DJPEGLI_FORCE_SYSTEM_LCMS2=ON \
+  -DJPEGLI_ENABLE_JPEGLI_LIBJPEG=ON \
+  -DJPEGLI_INSTALL_JPEGLI_LIBJPEG=ON \
+  -DJPEGLI_ENABLE_HWY_AVX3=ON \
+  -DJPEGLI_ENABLE_HWY_AVX3_ZEN4=ON \
+  -DJPEGLI_ENABLE_HWY_SVE=OFF \
+  -DJPEGLI_ENABLE_HWY_SVE2=OFF \
+  -DJPEGLI_ENABLE_HWY_SVE2_128=ON \
   -DJPEGLI_LIBJPEG_LIBRARY_SOVERSION="$JPEGLI_LIBJPEG_LIBRARY_SOVERSION" \
   -DJPEGLI_LIBJPEG_LIBRARY_VERSION="$JPEGLI_LIBJPEG_LIBRARY_VERSION" \
   -DLIBJPEG_TURBO_VERSION_NUMBER=2001005 \
@@ -222,9 +262,9 @@ ldconfig /usr/local/lib
 $STD make clean
 cd "$STAGING_DIR"
 rm -rf "$SOURCE"/{build,third_party}
-msg_ok "(1/5) Compiled libjxl"
+msg_ok "(2/6) Compiled jpegli"
 
-msg_info "(2/5) Compiling libheif"
+msg_info "(3/6) Compiling libheif"
 SOURCE=${SOURCE_DIR}/libheif
 LIBHEIF_REVISION="62f1b8c76ed4d8305071fdacbe74ef9717bacac5"
 # : "${LIBHEIF_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libheif.json)}"
@@ -248,9 +288,9 @@ ldconfig /usr/local/lib
 $STD make clean
 cd "$STAGING_DIR"
 rm -rf "$SOURCE"/build
-msg_ok "(2/5) Compiled libheif"
+msg_ok "(3/6) Compiled libheif"
 
-msg_info "(3/5) Compiling libraw"
+msg_info "(4/6) Compiling libraw"
 SOURCE=${SOURCE_DIR}/libraw
 LIBRAW_REVISION="b860248a89d9082b8e0a1e202e516f46af9adb29"
 # : "${LIBRAW_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libraw.json)}"
@@ -264,9 +304,9 @@ $STD make install
 ldconfig /usr/local/lib
 $STD make clean
 cd "$STAGING_DIR"
-msg_ok "(3/5) Compiled libraw"
+msg_ok "(4/6) Compiled libraw"
 
-msg_info "(4/5) Compiling imagemagick"
+msg_info "(5/6) Compiling imagemagick"
 SOURCE=$SOURCE_DIR/imagemagick
 : "${IMAGEMAGICK_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/imagemagick.json)}"
 $STD git clone https://github.com/ImageMagick/ImageMagick.git "$SOURCE"
@@ -278,11 +318,11 @@ $STD make install
 ldconfig /usr/local/lib
 $STD make clean
 cd "$STAGING_DIR"
-msg_ok "(4/5) Compiled imagemagick"
+msg_ok "(5/6) Compiled imagemagick"
 
-msg_info "(5/5) Compiling libvips"
+msg_info "(6/6) Compiling libvips"
 SOURCE=$SOURCE_DIR/libvips
-LIBVIPS_REVISION="e01a4797cabe77d457fdfa7d776b7a7e7ca6d6a7"
+LIBVIPS_REVISION="$(jq -cr '.revision' "$BASE_DIR"/server/sources/libvips.json)"
 $STD git clone https://github.com/libvips/libvips.git "$SOURCE"
 cd "$SOURCE"
 $STD git reset --hard "$LIBVIPS_REVISION"
@@ -293,9 +333,10 @@ $STD ninja install
 ldconfig /usr/local/lib
 cd "$STAGING_DIR"
 rm -rf "$SOURCE"/build
-msg_ok "(5/5) Compiled libvips"
+msg_ok "(6/6) Compiled libvips"
 cat <<EOF >~/.immich_library_revisions
 imagemagick: $IMAGEMAGICK_REVISION
+jpegli: $JPEGLI_REVISION
 libheif: $LIBHEIF_REVISION
 libjxl: $LIBJXL_REVISION
 libraw: $LIBRAW_REVISION

install/immichframe-install.sh

@@ -54,6 +54,7 @@ cp -r build/* /opt/immichframe/wwwroot
 rm -rf /tmp/immichframe
 mkdir -p /opt/immichframe/Config
 curl -fsSL "https://raw.githubusercontent.com/immichFrame/ImmichFrame/main/docker/Settings.example.yml" -o /opt/immichframe/Config/Settings.yml
+sed -i '/^[[:space:]]*- UUID[[:space:]]*$/d' /opt/immichframe/Config/Settings.yml
 useradd -r -s /sbin/nologin -d /opt/immichframe -M immichframe
 chown -R immichframe:immichframe /opt/immichframe
 msg_ok "Setup ImmichFrame"

install/netbox-install.sh

@@ -59,8 +59,52 @@ sed -i -e 's/ALLOWED_HOSTS = \[\]/ALLOWED_HOSTS = ["*"]/' \
 $STD /opt/netbox/upgrade.sh
 ln -s /opt/netbox/contrib/netbox-housekeeping.sh /etc/cron.daily/netbox-housekeeping
 
-mv /opt/netbox/contrib/apache.conf /etc/apache2/sites-available/netbox.conf
 $STD openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/netbox.key -out /etc/ssl/certs/netbox.crt -subj "/C=US/O=NetBox/OU=Certificate/CN=localhost"
+cat <<EOF >/etc/apache2/sites-available/netbox.conf
+<VirtualHost *:80>
+    ProxyPreserveHost On
+
+    Alias /static /opt/netbox/netbox/static
+
+    <Directory /opt/netbox/netbox/static>
+        Options FollowSymLinks MultiViews
+        AllowOverride None
+        Require all granted
+    </Directory>
+
+    <Location /static>
+        ProxyPass !
+    </Location>
+
+    RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
+    ProxyPass / http://127.0.0.1:8001/
+    ProxyPassReverse / http://127.0.0.1:8001/
+</VirtualHost>
+
+<VirtualHost *:443>
+    ProxyPreserveHost On
+
+    SSLEngine on
+    SSLCertificateFile /etc/ssl/certs/netbox.crt
+    SSLCertificateKeyFile /etc/ssl/private/netbox.key
+
+    Alias /static /opt/netbox/netbox/static
+
+    <Directory /opt/netbox/netbox/static>
+        Options FollowSymLinks MultiViews
+        AllowOverride None
+        Require all granted
+    </Directory>
+
+    <Location /static>
+        ProxyPass !
+    </Location>
+
+    RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
+    ProxyPass / http://127.0.0.1:8001/
+    ProxyPassReverse / http://127.0.0.1:8001/
+</VirtualHost>
+EOF
 $STD a2enmod ssl proxy proxy_http headers rewrite
 $STD a2ensite netbox
 systemctl restart apache2

install/openziti-controller-install.sh

@@ -24,7 +24,7 @@ Components: main
 Signed-By: /usr/share/keyrings/openziti.gpg
 EOF
 $STD apt update
-$STD apt install -y openziti-controller openziti-console
+$STD apt install -y openziti-controller openziti-console </dev/null
 msg_ok "Installed openziti"
 
 read -r -p "${TAB3}Would you like to go through the auto configuration now? <y/N>" prompt

install/pve-ups-install.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: CrazyWolf13
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/ffind-dev/pve-ups
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+setup_uv
+
+fetch_and_deploy_gh_release "pve-usv" "ffind-dev/pve-ups" "tarball"
+
+msg_info "Setting up Application"
+useradd --system --home /opt/pve-usv --shell /usr/sbin/nologin pveusv
+install -d -o pveusv -g pveusv -m 0750 \
+  /etc/pve-usv \
+  /var/lib/pve-usv \
+  /var/lib/pve-usv/agent \
+  /var/lib/pve-usv/agent/queue \
+  /var/lib/pve-usv/updates
+chown -R pveusv:pveusv /opt/pve-usv
+cd /opt/pve-usv
+$STD uv venv --clear venv
+$STD uv pip install --python venv/bin/python .
+chmod 0755 deploy/pve-usv-agent.sh
+msg_ok "Set up Application"
+
+msg_info "Creating Services"
+install -m 0644 /opt/pve-usv/deploy/pve-usv.service /etc/systemd/system/pve-usv.service
+install -m 0644 /opt/pve-usv/deploy/pve-usv-agent.service /etc/systemd/system/pve-usv-agent.service
+install -m 0644 /opt/pve-usv/deploy/pve-usv-agent.path /etc/systemd/system/pve-usv-agent.path
+install -m 0644 /opt/pve-usv/deploy/pve-usv-agent.timer /etc/systemd/system/pve-usv-agent.timer
+systemctl enable -q --now pve-usv pve-usv-agent.path pve-usv-agent.timer
+msg_ok "Created Services"
+
+motd_ssh
+customize
+cleanup_lxc

install/rockylinux-install.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://rockylinux.org/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+motd_ssh
+customize
+cleanup_lxc

install/tdarr-install.sh

@@ -22,7 +22,7 @@ mkdir -p /opt/tdarr
 cd /opt/tdarr
 RELEASE=$(curl_with_retry "https://f000.backblazeb2.com/file/tdarrs/versions.json" "-" | grep -oP '(?<="Tdarr_Updater": ")[^"]+' | grep "linux_$(arch_resolve "x64" "arm64")" | head -n 1)
 curl_with_retry "$RELEASE" "Tdarr_Updater.zip"
-$STD unzip Tdarr_Updater.zip
+$STD unzip -o Tdarr_Updater.zip
 chmod +x Tdarr_Updater
 $STD ./Tdarr_Updater
 rm -rf /opt/tdarr/Tdarr_Updater.zip

install/wallos-install.sh

@@ -40,7 +40,7 @@ EOF
 $STD a2ensite wallos.conf
 $STD a2dissite 000-default.conf
 $STD systemctl restart apache2
-$STD curl http://localhost/endpoints/db/migrate.php
+$STD sudo -u www-data php /opt/wallos/endpoints/db/migrate.php
 msg_ok "Installed Wallos"
 
 msg_info "Setting up Crontabs"

misc/build.func

@@ -1208,10 +1208,12 @@ base_settings() {
 # - Used by default_var_settings and app defaults loading
 # - Only loads whitelisted var_* keys
 # - Optional force parameter to override existing values (for app defaults)
+# - Optional protected list preserves genuinely user-exported var_* values
 # ------------------------------------------------------------------------------
 load_vars_file() {
   local file="$1"
-  local force="${2:-no}" # If "yes", override existing variables
+  local force="${2:-no}"      # If "yes", override existing variables
+  local protected="${3:-}"    # space-separated var_* keys the user genuinely exported before this file loaded; never overwritten
   [ -f "$file" ] || return 0
   msg_info "Loading defaults from ${file}"
 
@@ -1231,6 +1233,13 @@ load_vars_file() {
     return 1
   }
 
+  # Protected check helper (genuinely user-exported vars, see $protected above)
+  _is_protected() {
+    local k="$1" p
+    for p in $protected; do [ "$k" = "$p" ] && return 0; done
+    return 1
+  }
+
   local line key val
   while IFS= read -r line || [ -n "$line" ]; do
     line="${line#"${line%%[![:space:]]*}"}"
@@ -1435,9 +1444,19 @@ load_vars_file() {
         esac
       fi
 
-      # Set variable: force mode overrides existing, otherwise only set if empty
+      # Set variable: force mode overrides existing, otherwise only set if empty.
+      # Exception: var_cpu/var_ram/var_disk are always applied here (unless the
+      # user genuinely exported them beforehand, per $protected) even though the
+      # app script already declared its own baseline for them - base_settings()
+      # reconciles the final floor against APP_DEFAULT_* afterward, so this file
+      # must be allowed to raise them instead of being silently blocked by the
+      # app's own pre-set value.
       if [[ "$force" == "yes" ]]; then
         export "${var_key}=${var_val}"
+      elif _is_protected "$var_key"; then
+        :
+      elif [[ "$var_key" == "var_cpu" || "$var_key" == "var_ram" || "$var_key" == "var_disk" ]]; then
+        export "${var_key}=${var_val}"
       else
         [[ -z "${!var_key+x}" ]] && export "${var_key}=${var_val}"
       fi
@@ -1597,7 +1616,7 @@ EOF
     msg_error "default.vars not found after ensure step"
     return 252
   }
-  load_vars_file "$dv"
+  load_vars_file "$dv" "no" "${!_HARD_ENV[*]}"
 
   # 3) Map var_verbose → VERBOSE
   if [[ -n "${var_verbose:-}" ]]; then

tools/pve/post-pbs-install.sh

@@ -62,7 +62,14 @@ repo_state_list() {
 
 component_exists_in_sources() {
   local component="$1"
-  grep -h -E "^[^#]*Components:[^#]*\b${component}\b" /etc/apt/sources.list.d/*.sources 2>/dev/null | grep -q .
+  local line comp
+  while IFS= read -r line; do
+    line="${line#*Components:}"
+    for comp in $line; do
+      [[ "$comp" == "$component" ]] && return 0
+    done
+  done < <(grep -h -E "^[^#]*Components:" /etc/apt/sources.list.d/*.sources 2>/dev/null)
+  return 1
 }
 
 require_whiptail() {

tools/pve/post-pve-install.sh

@@ -63,7 +63,14 @@ get_pve_major_minor() {
 
 component_exists_in_sources() {
   local component="$1"
-  grep -h -E "^[^#]*Components:[^#]*\b${component}\b" /etc/apt/sources.list.d/*.sources 2>/dev/null | grep -q .
+  local line comp
+  while IFS= read -r line; do
+    line="${line#*Components:}"
+    for comp in $line; do
+      [[ "$comp" == "$component" ]] && return 0
+    done
+  done < <(grep -h -E "^[^#]*Components:" /etc/apt/sources.list.d/*.sources 2>/dev/null)
+  return 1
 }
 
 main() {