Move the first five high-traffic scripts onto the core engine

Today's engine work reaches 30 of 561 ct scripts, about 5% of ProxmoxVE
traffic. The retry on engine downloads, exit 227 for a container that will not
start, the umask fix that stops a hardened host producing unusable containers,
the TMPDIR guard and the toolchain restore are all sitting where almost nobody
runs them.

Checked before touching anything, because "migrate" meant something much
larger last time:

  - None of the eighteen remaining top-25 scripts has an alpine-* variant, so
    there is no merge to do -- unlike the earlier round.
  - No script references misc/ anywhere except its bootstrap line.
  - Comparing the two engines' function surfaces, 61 names exist only in misc/.
    None of the eighteen calls any of them.

So it really is one line per script, and the head now matches the scripts
migrated earlier byte for byte.

Five in this wave rather than all eighteen, chosen as the lowest-volume of the
set at roughly 170 installs a day each: enough traffic to surface a problem
within a day, contained enough that a regression does not reach thousands.
docker at 1255/day and the OS containers should follow only once this wave has
run clean.

immich and vaultwarden are deliberately not in it. Both already sit near 44%
success, and migrating them now would change two variables at once with no way
to attribute the result.

.github/pull_request_template.md

@@ -35,3 +35,35 @@ Fixes #
 - [ ] 🌍 **Website update** – Changes to script metadata (PocketBase/website data).
 - [ ] 🔧 **Refactoring / Code Cleanup** – Improves readability or maintainability without changing functionality.
 - [ ] 📝 **Documentation update** – Changes to `README`, `AppName.md`, `CONTRIBUTING.md`, or other docs.
+
+---
+
+## 💥 Breaking Change Advisory (only if you checked "Breaking change")
+
+If this PR changes existing behaviour in a way that may require action before an
+update, add a `breaking-change` advisory block to this PR body. The website and
+the in-container update guard read it to tell operators exactly what to expect,
+what to do first, and — with `action: block` — to stop an update until it's
+handled. Every field is optional; the advisory auto-expires 30 days after merge.
+
+Copy the block out of the comment below, fill it in, and paste it here:
+
+<!--
+```breaking-change
+severity: warning        # info | warning | critical
+action: warn             # warn (default) | block — "block" halts the update until an operator forces it
+expect: One line describing what changes and why it may need action.
+before_update:
+  - First thing to do before updating
+  - Second thing to do before updating
+```
+
+Guidance:
+- Leave this commented (or delete it) for a routine change — no block, no advisory.
+- Use `action: block` only for changes that break or lose data if the operator
+  updates without acting first (e.g. a required manual migration or backup).
+- `expect:` supersedes the auto-scraped summary; keep it to one line.
+- Steps render as a checklist on the site and in the update prompt.
+-->
+
+<!-- The advisory block is only active once it is OUTSIDE this comment. -->

.github/workflows/notify-breaking-change.yml

@@ -0,0 +1,58 @@
+name: Notify breaking change
+
+# When a PR labelled "breaking change" is merged, tell the Helper-Scripts site
+# so it can show a temporary advisory on the affected scripts. The site pulls
+# the PR itself and re-verifies it is merged + labelled, so this workflow only
+# has to hand over the PR number.
+#
+# Requires one repo secret:
+#   BREAKING_CHANGE_INGEST_SECRET  — must match the value the site runs with.
+# Site URL is taken from the existing FRONTEND_URL secret, then an optional
+# SITE_URL variable, then a hard default.
+#
+# pull_request_target (not pull_request) so the run has access to the secret
+# even for fork PRs. It is safe here: the job never checks out or runs PR code —
+# it only forwards the number after the PR has merged.
+
+on:
+  pull_request_target:
+    # closed  -> fires on the merge itself
+    # labeled -> fires if the label is added to an already-merged PR
+    types: [closed, labeled]
+
+concurrency:
+  group: notify-breaking-change-${{ github.event.pull_request.number }}
+  cancel-in-progress: false
+
+jobs:
+  notify:
+    if: >-
+      github.event.pull_request.merged == true &&
+      contains(github.event.pull_request.labels.*.name, 'breaking change')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Notify site of breaking change
+        env:
+          INGEST_SECRET: ${{ secrets.BREAKING_CHANGE_INGEST_SECRET }}
+          SITE_URL: ${{ secrets.FRONTEND_URL || vars.SITE_URL || 'https://community-scripts.org' }}
+          PR: ${{ github.event.pull_request.number }}
+        run: |
+          set -euo pipefail
+          if [ -z "${INGEST_SECRET:-}" ]; then
+            echo "::error::BREAKING_CHANGE_INGEST_SECRET secret is not set."
+            exit 1
+          fi
+          url="${SITE_URL%/}/api/breaking-changes/ingest"
+          echo "Notifying $url for PR #${PR}"
+          status="$(curl -sS -o response.json -w '%{http_code}' \
+            -X POST "$url" \
+            -H "Authorization: Bearer ${INGEST_SECRET}" \
+            -H "Content-Type: application/json" \
+            -d "{\"pr\": ${PR}}")"
+          echo "HTTP $status"
+          cat response.json || true
+          echo
+          if [ "$status" != "200" ]; then
+            echo "::error::ingest endpoint returned HTTP $status"
+            exit 1
+          fi

CHANGELOG.md

@@ -527,8 +527,38 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-08-24
+
+### 🆕 New Scripts
+
+  - ArchLinux ([#16715](https://github.com/community-scripts/ProxmoxVE/pull/16715))
+- AirTrail ([#16713](https://github.com/community-scripts/ProxmoxVE/pull/16713))
+- RockyLinux ([#16718](https://github.com/community-scripts/ProxmoxVE/pull/16718))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Add setup_mongodb back in Omada [@lucacome](https://github.com/lucacome) ([#16736](https://github.com/community-scripts/ProxmoxVE/pull/16736))
+    - fireshare: source fireshare.env during update [@MickLesk](https://github.com/MickLesk) ([#16706](https://github.com/community-scripts/ProxmoxVE/pull/16706))
+    - netbox: serve on plain HTTP too, port 80 forced HTTPS redirect broke reverse proxies [@MickLesk](https://github.com/MickLesk) ([#16707](https://github.com/community-scripts/ProxmoxVE/pull/16707))
+    - FileFlows: Fix Download URL [@MickLesk](https://github.com/MickLesk) ([#16708](https://github.com/community-scripts/ProxmoxVE/pull/16708))
+    - Gitea: fix git-over-SSH auth, group-writable home dir tripped sshd StrictModes [@MickLesk](https://github.com/MickLesk) ([#16710](https://github.com/community-scripts/ProxmoxVE/pull/16710))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - post-pve/pbs-install: fix component_exists_in_sources matching substrings of hyphenated tokens [@MickLesk](https://github.com/MickLesk) ([#16709](https://github.com/community-scripts/ProxmoxVE/pull/16709))
+
 ## 2026-08-23
 
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Set default ProxmoxVE raw URL in PVE-UPS & fix var_cpu sorting  [@MickLesk](https://github.com/MickLesk) ([#16689](https://github.com/community-scripts/ProxmoxVE/pull/16689))
+
 ## 2026-08-22
 
 ### 🆕 New Scripts

ct/airtrail.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/johanohly/AirTrail
+
+APP="AirTrail"
+var_tags="${var_tags:-flights;tracking}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-3072}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/airtrail ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "airtrail" "johanohly/AirTrail"; then
+    msg_info "Stopping Service"
+    systemctl stop airtrail
+    msg_ok "Stopped Service"
+
+    create_backup /opt/airtrail/.env /opt/airtrail/uploads
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "airtrail" "johanohly/AirTrail" "tarball" "latest" "/opt/airtrail"
+
+    restore_backup
+
+    msg_info "Rebuilding AirTrail (Patience)"
+    cd /opt/airtrail
+    $STD bun install --frozen-lockfile
+    export NODE_ENV=production
+    $STD bun run build
+    $STD bun install --frozen-lockfile --production
+    $STD bun run db:migrate-deploy
+    msg_ok "Rebuilt AirTrail"
+
+    msg_info "Starting Service"
+    systemctl start airtrail
+    msg_ok "Started Service"
+    msg_ok "Updated Successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:3000${CL}"

ct/archlinux.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://archlinux.org/
+
+APP="Arch Linux"
+var_tags="${var_tags:-os}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-512}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-archlinux}"
+var_version="${var_version:-base}"
+var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+  if [[ ! -d /var ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+  msg_info "Updating Arch Linux LXC"
+  $STD pacman -Syu --noconfirm
+  msg_ok "Updated Arch Linux LXC"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!"
+msg_custom "🚀" "${GN}" "${APP} setup has been successfully initialized!"

ct/cloudflared.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 tteck
 # Author: tteck (tteckster)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE

ct/docker.sh

@@ -9,7 +9,6 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 
 APP="Docker"
 var_tags="${var_tags:-docker}"
-var_cpu="${var_cpu:-2}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
@@ -19,10 +18,12 @@ if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
 fi
 
 if [[ "${var_os:-}" == "alpine" ]]; then
+  var_cpu="${var_cpu:-1}"
   var_ram="${var_ram:-1024}"
   var_disk="${var_disk:-2}"
   var_version="${var_version:-3.24}"
 else
+  var_cpu="${var_cpu:-2}"
   var_ram="${var_ram:-2048}"
   var_disk="${var_disk:-4}"
   var_version="${var_version:-13}"

ct/fileflows.sh

@@ -101,7 +101,7 @@ function update_script() {
   fi
   msg_ok "Ensured ASP.NET Core Runtime"
 
-  fetch_and_deploy_from_url "https://fileflows.com/downloads/zip" "/opt/fileflows"
+  fetch_and_deploy_from_url "https://fileflows.com/downloads/ff-latest.tar.xz" "/opt/fileflows"
 
   msg_info "Starting Service"
   systemctl --all start 'fileflows*'

ct/fireshare.sh

@@ -57,11 +57,9 @@ function update_script() {
     $STD .venv/bin/python -m pip install --upgrade --break-system-packages pip
     $STD .venv/bin/python -m pip install --no-cache-dir --break-system-packages --ignore-installed app/server
     cp .venv/bin/fireshare /usr/local/bin/fireshare
-    export FLASK_APP="/opt/fireshare/app/server/fireshare:create_app()"
-    export DATA_DIRECTORY=/opt/fireshare-data
-    export IMAGE_DIRECTORY=/opt/fireshare-images
-    export VIDEO_DIRECTORY=/opt/fireshare-videos
-    export PROCESSED_DIRECTORY=/opt/fireshare-processed
+    set -a
+    source /opt/fireshare/fireshare.env
+    set +a
     $STD uv run flask db upgrade
     cd /opt/fireshare/app/client
     $STD npm install

ct/forgejo.sh

@@ -9,7 +9,6 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 
 APP="Forgejo"
 var_tags="${var_tags:-git}"
-var_cpu="${var_cpu:-2}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
@@ -19,10 +18,12 @@ if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
 fi
 
 if [[ "${var_os:-}" == "alpine" ]]; then
+  var_cpu="${var_cpu:-1}"
   var_ram="${var_ram:-256}"
   var_disk="${var_disk:-1}"
   var_version="${var_version:-3.24}"
 else
+  var_cpu="${var_cpu:-2}"
   var_ram="${var_ram:-2048}"
   var_disk="${var_disk:-10}"
   var_version="${var_version:-13}"

ct/headers/airtrail

@@ -0,0 +1,6 @@
+    ___    _     ______           _ __
+   /   |  (_)___/_  __/________ _(_) /
+  / /| | / / ___// / / ___/ __ `/ / / 
+ / ___ |/ / /   / / / /  / /_/ / / /  
+/_/  |_/_/_/   /_/ /_/   \__,_/_/_/   
+                                      

ct/headers/archlinux

@@ -0,0 +1,6 @@
+    ___              __       __    _                 
+   /   |  __________/ /_     / /   (_)___  __  ___  __
+  / /| | / ___/ ___/ __ \   / /   / / __ \/ / / / |/_/
+ / ___ |/ /  / /__/ / / /  / /___/ / / / / /_/ />  <  
+/_/  |_/_/   \___/_/ /_/  /_____/_/_/ /_/\__,_/_/|_|  
+                                                      

ct/headers/rockylinux

@@ -0,0 +1,6 @@
+    ____             __            __    _                 
+   / __ \____  _____/ /____  __   / /   (_)___  __  ___  __
+  / /_/ / __ \/ ___/ //_/ / / /  / /   / / __ \/ / / / |/_/
+ / _, _/ /_/ / /__/ ,< / /_/ /  / /___/ / / / / /_/ />  <  
+/_/ |_|\____/\___/_/|_|\__, /  /_____/_/_/ /_/\__,_/_/|_|  
+                      /____/                               

ct/ironclaw.sh

@@ -9,7 +9,6 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 
 APP="IronClaw"
 var_tags="${var_tags:-ai;agent;security}"
-var_cpu="${var_cpu:-2}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
@@ -19,10 +18,12 @@ if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
 fi
 
 if [[ "${var_os:-}" == "alpine" ]]; then
+  var_cpu="${var_cpu:-1}"
   var_ram="${var_ram:-1024}"
   var_disk="${var_disk:-8}"
   var_version="${var_version:-3.24}"
 else
+  var_cpu="${var_cpu:-2}"
   var_ram="${var_ram:-2048}"
   var_disk="${var_disk:-8}"
   var_version="${var_version:-13}"

ct/n8n.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 tteck
 # Author: tteck (tteckster)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE

ct/omada.sh

@@ -31,7 +31,7 @@ function update_script() {
 
   msg_info "Updating MongoDB"
   if [[ "$(arch_resolve)" == "arm64" ]] || lscpu | grep -q 'avx'; then
-    MONGO_VERSION="8.0"
+    MONGO_VERSION="8.0" setup_mongodb
   else
     msg_error "No AVX detected (CPU-Flag)! We have discontinued support for this. You are welcome to try it manually with a Debian LXC, but due to the many issues with Omada, we currently only support AVX CPUs."
     exit 10

ct/pve-ups.sh

@@ -1,7 +1,5 @@
 #!/usr/bin/env bash
-# Engine comes from community-scripts/core; this repo only ships the scripts.
-# A local core checkout wins (COMMUNITY_SCRIPTS_CORE_DIR, else a sibling ../core),
-# so a fork or branch of core can be tested without editing this file.
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG

ct/qbittorrent.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: tteck (tteckster) | Co-Author: Slaviša Arežina (tremor021)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE

ct/rockylinux.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://rockylinux.org/
+
+APP="Rocky Linux"
+var_tags="${var_tags:-os}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-512}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-rockylinux}"
+var_version="${var_version:-10}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+  if [[ ! -d /var ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+  msg_info "Updating Rocky Linux LXC"
+  $STD dnf -y upgrade
+  msg_ok "Updated Rocky Linux LXC"
+  msg_ok "Completed successfully!"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!\n"
+msg_custom "🚀" "${GN}" "${APP} setup has been successfully initialized!"

ct/syncthing.sh

@@ -9,7 +9,6 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 
 APP="Syncthing"
 var_tags="${var_tags:-sync}"
-var_cpu="${var_cpu:-2}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
@@ -19,10 +18,12 @@ if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
 fi
 
 if [[ "${var_os:-}" == "alpine" ]]; then
+  var_cpu="${var_cpu:-1}"
   var_ram="${var_ram:-256}"
   var_disk="${var_disk:-1}"
   var_version="${var_version:-3.24}"
 else
+  var_cpu="${var_cpu:-2}"
   var_ram="${var_ram:-2048}"
   var_disk="${var_disk:-8}"
   var_version="${var_version:-13}"

ct/technitiumdns.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 tteck
 # Author: tteck (tteckster)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE

ct/transmission.sh

@@ -9,7 +9,6 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 
 APP="Transmission"
 var_tags="${var_tags:-torrent}"
-var_cpu="${var_cpu:-2}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
@@ -19,10 +18,12 @@ if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
 fi
 
 if [[ "${var_os:-}" == "alpine" ]]; then
+  var_cpu="${var_cpu:-1}"
   var_ram="${var_ram:-256}"
   var_disk="${var_disk:-1}"
   var_version="${var_version:-3.24}"
 else
+  var_cpu="${var_cpu:-2}"
   var_ram="${var_ram:-2048}"
   var_disk="${var_disk:-8}"
   var_version="${var_version:-13}"

ct/uptimekuma.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 tteck
 # Author: tteck (tteckster)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE

ct/vaultwarden.sh

@@ -9,7 +9,6 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 
 APP="Vaultwarden"
 var_tags="${var_tags:-password-manager}"
-var_cpu="${var_cpu:-4}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
@@ -19,10 +18,12 @@ if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
 fi
 
 if [[ "${var_os:-}" == "alpine" ]]; then
+  var_cpu="${var_cpu:-1}"
   var_ram="${var_ram:-256}"
   var_disk="${var_disk:-1}"
   var_version="${var_version:-3.24}"
 else
+  var_cpu="${var_cpu:-4}"
   var_ram="${var_ram:-6144}"
   var_disk="${var_disk:-20}"
   var_version="${var_version:-13}"

ct/zigbee2mqtt.sh

@@ -9,7 +9,6 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 
 APP="Zigbee2MQTT"
 var_tags="${var_tags:-smarthome;zigbee;mqtt}"
-var_cpu="${var_cpu:-2}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-0}"
 if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
@@ -19,10 +18,12 @@ if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
 fi
 
 if [[ "${var_os:-}" == "alpine" ]]; then
+  var_cpu="${var_cpu:-1}"
   var_ram="${var_ram:-256}"
   var_disk="${var_disk:-1}"
   var_version="${var_version:-3.24}"
 else
+  var_cpu="${var_cpu:-2}"
   var_ram="${var_ram:-1024}"
   var_disk="${var_disk:-5}"
   var_version="${var_version:-13}"

install/airtrail-install.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/johanohly/AirTrail
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+NODE_VERSION="22" setup_nodejs
+
+msg_info "Installing Bun"
+export BUN_INSTALL="/root/.bun"
+curl -fsSL https://bun.sh/install | $STD bash
+ln -sf /root/.bun/bin/bun /usr/local/bin/bun
+ln -sf /root/.bun/bin/bunx /usr/local/bin/bunx
+msg_ok "Installed Bun"
+
+PG_VERSION="16" setup_postgresql
+PG_DB_NAME="airtrail" PG_DB_USER="airtrail" setup_postgresql_db
+
+fetch_and_deploy_gh_release "airtrail" "johanohly/AirTrail" "tarball" "latest" "/opt/airtrail"
+
+msg_info "Configuring AirTrail"
+mkdir -p /opt/airtrail/uploads
+cat <<EOF >/opt/airtrail/.env
+NODE_ENV=production
+DB_URL=postgres://${PG_DB_USER}:${PG_DB_PASS}@localhost:5432/${PG_DB_NAME}
+ORIGIN=http://${LOCAL_IP}:3000
+BODY_SIZE_LIMIT=20M
+UPLOAD_LOCATION=/opt/airtrail/uploads
+EOF
+msg_ok "Configured AirTrail"
+
+msg_info "Building AirTrail (Patience)"
+cd /opt/airtrail
+$STD bun install --frozen-lockfile
+export NODE_ENV=production
+$STD bun run build
+$STD bun install --frozen-lockfile --production
+msg_ok "Built AirTrail"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/airtrail.service
+[Unit]
+Description=AirTrail
+After=network.target postgresql.service
+Wants=postgresql.service
+
+[Service]
+Type=simple
+WorkingDirectory=/opt/airtrail
+EnvironmentFile=/opt/airtrail/.env
+ExecStartPre=/usr/bin/node /opt/airtrail/docker/migrate.js
+ExecStart=/usr/bin/node /opt/airtrail/build
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now airtrail
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/archlinux-install.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://archlinux.org/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+motd_ssh
+customize
+cleanup_lxc

install/fileflows-install.sh

@@ -39,7 +39,7 @@ else
 fi
 msg_ok "Installed ASP.NET Core Runtime"
 
-fetch_and_deploy_from_url "https://fileflows.com/downloads/zip" "/opt/fileflows"
+fetch_and_deploy_from_url "https://fileflows.com/downloads/ff-latest.tar.xz" "/opt/fileflows"
 
 $STD ln -svf /usr/bin/ffmpeg /usr/local/bin/ffmpeg
 $STD ln -svf /usr/bin/ffprobe /usr/local/bin/ffprobe

install/gitea-install.sh

@@ -30,7 +30,7 @@ setup_deb_based() {
   chown -R gitea:gitea /var/lib/gitea/
   chmod -R 750 /var/lib/gitea/
   chown root:gitea /etc/gitea
-  chmod 770 /etc/gitea
+  chmod 750 /etc/gitea
   sudo -u gitea ln -s /var/lib/gitea/data/.ssh/ /etc/gitea/.ssh
   msg_ok "Configured Gitea"
 

install/netbox-install.sh

@@ -59,8 +59,52 @@ sed -i -e 's/ALLOWED_HOSTS = \[\]/ALLOWED_HOSTS = ["*"]/' \
 $STD /opt/netbox/upgrade.sh
 ln -s /opt/netbox/contrib/netbox-housekeeping.sh /etc/cron.daily/netbox-housekeeping
 
-mv /opt/netbox/contrib/apache.conf /etc/apache2/sites-available/netbox.conf
 $STD openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/ssl/private/netbox.key -out /etc/ssl/certs/netbox.crt -subj "/C=US/O=NetBox/OU=Certificate/CN=localhost"
+cat <<EOF >/etc/apache2/sites-available/netbox.conf
+<VirtualHost *:80>
+    ProxyPreserveHost On
+
+    Alias /static /opt/netbox/netbox/static
+
+    <Directory /opt/netbox/netbox/static>
+        Options FollowSymLinks MultiViews
+        AllowOverride None
+        Require all granted
+    </Directory>
+
+    <Location /static>
+        ProxyPass !
+    </Location>
+
+    RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
+    ProxyPass / http://127.0.0.1:8001/
+    ProxyPassReverse / http://127.0.0.1:8001/
+</VirtualHost>
+
+<VirtualHost *:443>
+    ProxyPreserveHost On
+
+    SSLEngine on
+    SSLCertificateFile /etc/ssl/certs/netbox.crt
+    SSLCertificateKeyFile /etc/ssl/private/netbox.key
+
+    Alias /static /opt/netbox/netbox/static
+
+    <Directory /opt/netbox/netbox/static>
+        Options FollowSymLinks MultiViews
+        AllowOverride None
+        Require all granted
+    </Directory>
+
+    <Location /static>
+        ProxyPass !
+    </Location>
+
+    RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
+    ProxyPass / http://127.0.0.1:8001/
+    ProxyPassReverse / http://127.0.0.1:8001/
+</VirtualHost>
+EOF
 $STD a2enmod ssl proxy proxy_http headers rewrite
 $STD a2ensite netbox
 systemctl restart apache2

install/rockylinux-install.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://rockylinux.org/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+motd_ssh
+customize
+cleanup_lxc

misc/build.func

@@ -1208,10 +1208,12 @@ base_settings() {
 # - Used by default_var_settings and app defaults loading
 # - Only loads whitelisted var_* keys
 # - Optional force parameter to override existing values (for app defaults)
+# - Optional protected list preserves genuinely user-exported var_* values
 # ------------------------------------------------------------------------------
 load_vars_file() {
   local file="$1"
-  local force="${2:-no}" # If "yes", override existing variables
+  local force="${2:-no}"      # If "yes", override existing variables
+  local protected="${3:-}"    # space-separated var_* keys the user genuinely exported before this file loaded; never overwritten
   [ -f "$file" ] || return 0
   msg_info "Loading defaults from ${file}"
 
@@ -1231,6 +1233,13 @@ load_vars_file() {
     return 1
   }
 
+  # Protected check helper (genuinely user-exported vars, see $protected above)
+  _is_protected() {
+    local k="$1" p
+    for p in $protected; do [ "$k" = "$p" ] && return 0; done
+    return 1
+  }
+
   local line key val
   while IFS= read -r line || [ -n "$line" ]; do
     line="${line#"${line%%[![:space:]]*}"}"
@@ -1435,9 +1444,19 @@ load_vars_file() {
         esac
       fi
 
-      # Set variable: force mode overrides existing, otherwise only set if empty
+      # Set variable: force mode overrides existing, otherwise only set if empty.
+      # Exception: var_cpu/var_ram/var_disk are always applied here (unless the
+      # user genuinely exported them beforehand, per $protected) even though the
+      # app script already declared its own baseline for them - base_settings()
+      # reconciles the final floor against APP_DEFAULT_* afterward, so this file
+      # must be allowed to raise them instead of being silently blocked by the
+      # app's own pre-set value.
       if [[ "$force" == "yes" ]]; then
         export "${var_key}=${var_val}"
+      elif _is_protected "$var_key"; then
+        :
+      elif [[ "$var_key" == "var_cpu" || "$var_key" == "var_ram" || "$var_key" == "var_disk" ]]; then
+        export "${var_key}=${var_val}"
       else
         [[ -z "${!var_key+x}" ]] && export "${var_key}=${var_val}"
       fi
@@ -1597,7 +1616,7 @@ EOF
     msg_error "default.vars not found after ensure step"
     return 252
   }
-  load_vars_file "$dv"
+  load_vars_file "$dv" "no" "${!_HARD_ENV[*]}"
 
   # 3) Map var_verbose → VERBOSE
   if [[ -n "${var_verbose:-}" ]]; then

tools/pve/post-pbs-install.sh

@@ -62,7 +62,14 @@ repo_state_list() {
 
 component_exists_in_sources() {
   local component="$1"
-  grep -h -E "^[^#]*Components:[^#]*\b${component}\b" /etc/apt/sources.list.d/*.sources 2>/dev/null | grep -q .
+  local line comp
+  while IFS= read -r line; do
+    line="${line#*Components:}"
+    for comp in $line; do
+      [[ "$comp" == "$component" ]] && return 0
+    done
+  done < <(grep -h -E "^[^#]*Components:" /etc/apt/sources.list.d/*.sources 2>/dev/null)
+  return 1
 }
 
 require_whiptail() {

tools/pve/post-pve-install.sh

@@ -63,7 +63,14 @@ get_pve_major_minor() {
 
 component_exists_in_sources() {
   local component="$1"
-  grep -h -E "^[^#]*Components:[^#]*\b${component}\b" /etc/apt/sources.list.d/*.sources 2>/dev/null | grep -q .
+  local line comp
+  while IFS= read -r line; do
+    line="${line#*Components:}"
+    for comp in $line; do
+      [[ "$comp" == "$component" ]] && return 0
+    done
+  done < <(grep -h -E "^[^#]*Components:" /etc/apt/sources.list.d/*.sources 2>/dev/null)
+  return 1
 }
 
 main() {