Post the command that tests a ct/ or install/ change

Reviewing a script change meant working out the URL yourself, and the
obvious guess is wrong: curling the branch URL alone gives you the ct/
script from the PR and the install/ script from main, because each script
pins _CS_DEFAULT_URL to main and that pin is what fills
COMMUNITY_SCRIPTS_URL when it is unset. Frequently the install script is
the only thing that changed.

So the comment spells out both lines, per changed app.

Only for scripts already on the core bootstrap. The older one-liner
resolves everything from ProxmoxVE/main and ignores the variable, so a
command built for it would install main and look like it passed --  worse
than no comment. Those are named instead, with what to do about them.

pull_request_target for fork PRs, and nothing from the PR is checked out
or executed: the file list and the bootstrap line come from the API, and
a branch name that is not [A-Za-z0-9._/-]+ stops the run rather than
reaching a fenced code block.

.github/workflows/pocketbase-bot.yml

@@ -33,6 +33,10 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           FRONTEND_URL: ${{ secrets.FRONTEND_URL }}
           REVALIDATE_SECRET: ${{ secrets.REVALIDATE_SECRET }}
+          # Screenshot attaching is delegated to the frontend, which owns the
+          # fetching and validation. Without this the subcommand says so rather
+          # than failing halfway.
+          SCREENSHOT_IMPORT_SECRET: ${{ secrets.SCREENSHOT_IMPORT_SECRET }}
         run: |
           node << 'ENDSCRIPT'
           (async function () {
@@ -323,11 +327,21 @@ jobs:
               '/pocketbase <slug> method remove <type>\n' +
               '```\n' +
               'Method fields: `cpu` `ram` `hdd` `os` `version` `config_path` `script`\n\n' +
+              '`cpu` `ram` `hdd` `os` `version` also work without `method` — they go to the\n' +
+              'default install method, e.g. `/pocketbase <slug> hdd=25`\n\n' +
               '**Editable fields:** `name` `description` `logo` `documentation` `website` `project_url` `repository` ' +
               '`config_path` `port` `default_user` `default_passwd` ' +
-              '`updateable` `privileged` `is_dev` ' +
+              '`updateable` `privileged` `is_dev` `has_arm` ' +
               '`architectures` (amd64,arm64) `platforms` (pve,incus) ' +
-              '`is_disabled` `disable_message` `is_deleted` `deleted_message`';
+              '`execute_in` (pve,lxc,pbs,vm,pmg,pdm) `categories` (names or ids) ' +
+              '`type` (ct, vm, addon, …) ' +
+              '`is_disabled` `disable_message` `is_deleted` `deleted_message`\n\n' +
+              '**Screenshots:**\n' +
+              '```\n' +
+              '/pocketbase <slug> screenshot https://example.com/one.png https://example.com/two.png\n' +
+              '```\n\n' +
+              '`slug` is deliberately not editable: it is the URL, the JSON filename and the\n' +
+              'ct/<slug>.sh path all at once, so renaming it is a migration rather than an edit.';
 
             if (!withoutCmd) {
               await addReaction('-1');
@@ -490,6 +504,7 @@ jobs:
             const noteMatch   = rest.match(/^note\s+(list|add|edit|remove)\b/i);
             const methodMatch = rest.match(/^method\b/i);
             const setMatch    = rest.match(/^set\s+(\S+)/i);
+            const shotMatch   = rest.match(/^screenshots?\s+(.+)$/i);
 
             if (infoMatch) {
               // ── INFO SUBCOMMAND ──────────────────────────────────────────────
@@ -535,6 +550,44 @@ jobs:
               await addReaction('+1');
               await postComment(out.join('\n'));
 
+            } else if (shotMatch) {
+              // ── SCREENSHOT SUBCOMMAND ────────────────────────────────────────
+              // Delegated to the frontend rather than reimplemented here: it
+              // already fetches the URL, checks the content type and size, and
+              // attaches the file to PocketBase. Doing that a second time in a
+              // workflow would be a second set of bugs.
+              const shotUrls = shotMatch[1].split(/[\s,]+/).map(function (u) { return u.trim(); }).filter(Boolean);
+              const bad = shotUrls.filter(function (u) { return !/^https?:\/\//i.test(u); });
+              if (bad.length > 0) {
+                await addReaction('-1');
+                await postComment('❌ **PocketBase Bot**: not a URL: `' + bad.join('`, `') + '`');
+                process.exit(0);
+              }
+              const frontendUrl = process.env.FRONTEND_URL;
+              const shotSecret = process.env.SCREENSHOT_IMPORT_SECRET;
+              if (!frontendUrl || !shotSecret) {
+                await addReaction('-1');
+                await postComment('❌ **PocketBase Bot**: screenshot import is not configured (FRONTEND_URL / SCREENSHOT_IMPORT_SECRET).');
+                process.exit(1);
+              }
+              const shotRes = await request(frontendUrl.replace(/\/$/, '') + '/api/screenshots', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ slug: slug, secret: shotSecret, urls: shotUrls })
+              });
+              if (!shotRes.ok) {
+                await addReaction('-1');
+                await postComment('❌ **PocketBase Bot**: screenshot import failed:\n```\n' + shotRes.body + '\n```');
+                process.exit(1);
+              }
+              await revalidate(slug);
+              await addReaction('+1');
+              await postComment(
+                '✅ **PocketBase Bot**: attached ' + shotUrls.length + ' screenshot' + (shotUrls.length === 1 ? '' : 's') +
+                ' to **`' + slug + '`**\n\n' + shotUrls.map(function (u) { return '- ' + u; }).join('\n') +
+                '\n\n*Executed by @' + actor + '*'
+              );
+
             } else if (noteMatch) {
               // ── NOTE SUBCOMMAND ──────────────────────────────────────────────
               const noteAction  = noteMatch[1].toLowerCase();
@@ -838,15 +891,20 @@ jobs:
             } else if (setMatch) {
               // ── SET SUBCOMMAND (value from code block) ───────────────────────
               const fieldName = setMatch[1].toLowerCase();
+              // app_vars is a JSON column, so it rides the code-block path like
+              // the long text fields - but its content is parsed, not stored
+              // verbatim, or PocketBase ends up with a string where an object
+              // belongs and every reader has to guess.
               const SET_ALLOWED = {
                 name: 'string', description: 'string', logo: 'string',
                 documentation: 'string', website: 'string', project_url: 'string', repository: 'string',
-                config_path: 'string', disable_message: 'string', deleted_message: 'string'
+                config_path: 'string', disable_message: 'string', deleted_message: 'string',
+                app_vars: 'json'
               };
               if (!SET_ALLOWED[fieldName]) {
                 await addReaction('-1');
                 await postComment(
-                  '❌ **PocketBase Bot**: `set` only supports text fields.\n\n' +
+                  '❌ **PocketBase Bot**: `set` only supports text and JSON fields.\n\n' +
                   '**Allowed:** `' + Object.keys(SET_ALLOWED).join('`, `') + '`\n\n' +
                   'For boolean/number fields use `field=value` syntax instead.'
                 );
@@ -861,7 +919,21 @@ jobs:
                 process.exit(0);
               }
               const setPayload = {};
-              setPayload[fieldName] = codeBlockValue;
+              if (SET_ALLOWED[fieldName] === 'json') {
+                let parsedJson;
+                try {
+                  parsedJson = JSON.parse(codeBlockValue);
+                } catch (e) {
+                  await addReaction('-1');
+                  await postComment(
+                    '❌ **PocketBase Bot**: `' + fieldName + '` must be valid JSON.\n\n```\n' + e.message + '\n```'
+                  );
+                  process.exit(0);
+                }
+                setPayload[fieldName] = parsedJson;
+              } else {
+                setPayload[fieldName] = codeBlockValue;
+              }
               const setPatchRes = await request(recordsUrl + '/' + record.id, {
                 method: 'PATCH',
                 headers: { 'Authorization': token, 'Content-Type': 'application/json' },
@@ -901,6 +973,10 @@ jobs:
                 privileged:       'boolean',
                 architectures:    'select_list',
                 platforms:        'select_list',
+                execute_in:       'select_list',
+                has_arm:          'boolean',
+                categories:       'relation_list',
+                type:             'relation_single',
                 is_dev:           'boolean',
                 is_disabled:      'boolean',
                 disable_message:  'string',
@@ -910,7 +986,18 @@ jobs:
 
               const parsedFields = parseKVPairs(rest);
 
-              const unknownFields = Object.keys(parsedFields).filter(function (f) { return !ALLOWED_FIELDS[f]; });
+              // cpu/ram/hdd/os/version live inside install_methods, not on the
+              // record itself. "/pocketbase immich hdd=25" is how people ask for
+              // it, so route those keys there instead of rejecting them as
+              // unknown fields. Everything else stays a plain record field.
+              const TOP_RESOURCE_KEYS = { cpu: 'number', ram: 'number', hdd: 'number', os: 'string', version: 'string' };
+              const resourceFields = {};
+              const scriptFields = {};
+              for (const [rk, rv] of Object.entries(parsedFields)) {
+                if (TOP_RESOURCE_KEYS[rk]) resourceFields[rk] = rv; else scriptFields[rk] = rv;
+              }
+
+              const unknownFields = Object.keys(scriptFields).filter(function (f) { return !ALLOWED_FIELDS[f]; });
               if (unknownFields.length > 0) {
                 await addReaction('-1');
                 await postComment(
@@ -930,9 +1017,10 @@ jobs:
               const SELECT_VALUES = {
                 architectures: ['amd64', 'arm64'],
                 platforms: ['pve', 'incus'],
+                execute_in: ['pve', 'lxc', 'pbs', 'vm', 'pmg', 'pdm'],
               };
               const payload = {};
-              for (const [key, rawVal] of Object.entries(parsedFields)) {
+              for (const [key, rawVal] of Object.entries(scriptFields)) {
                 const type = ALLOWED_FIELDS[key];
                 if (type === 'boolean') {
                   if (rawVal === 'true') payload[key] = true;
@@ -962,6 +1050,65 @@ jobs:
                     process.exit(0);
                   }
                   payload[key] = values;
+                } else if (type === 'relation_list') {
+                  // categories is a relation, so the stored value is a list of
+                  // record ids. People write category names, so resolve them —
+                  // and accept ids too, which is what a copy out of the
+                  // PocketBase UI gives you.
+                  const wanted = rawVal.split(',').map(function (v) { return v.trim(); }).filter(Boolean);
+                  const catRes = await request(apiBase + '/collections/script_categories/records?perPage=500&fields=id,name', {
+                    headers: { 'Authorization': token }
+                  });
+                  if (!catRes.ok) {
+                    await addReaction('-1');
+                    await postComment('❌ **PocketBase Bot**: could not read `script_categories` to resolve `' + key + '`.');
+                    process.exit(1);
+                  }
+                  const cats = JSON.parse(catRes.body).items || [];
+                  const byName = {};
+                  const ids = {};
+                  cats.forEach(function (c) { byName[String(c.name).toLowerCase()] = c.id; ids[c.id] = true; });
+                  const resolved = [];
+                  const unknownCats = [];
+                  wanted.forEach(function (w) {
+                    if (ids[w]) { resolved.push(w); return; }
+                    const id = byName[w.toLowerCase()];
+                    if (id) resolved.push(id); else unknownCats.push(w);
+                  });
+                  if (unknownCats.length > 0) {
+                    await addReaction('-1');
+                    await postComment(
+                      '❌ **PocketBase Bot**: unknown ' + key + ': `' + unknownCats.join('`, `') + '`\n\n' +
+                      '**Available:** `' + cats.map(function (c) { return c.name; }).sort().join('`, `') + '`'
+                    );
+                    process.exit(0);
+                  }
+                  payload[key] = resolved;
+                } else if (type === 'relation_single') {
+                  // type points at one z_ref_script_types record. People write
+                  // "ct" or "vm", not a 15-character id.
+                  const typeRes = await request(apiBase + '/collections/z_ref_script_types/records?perPage=200&fields=id,type', {
+                    headers: { 'Authorization': token }
+                  });
+                  if (!typeRes.ok) {
+                    await addReaction('-1');
+                    await postComment('❌ **PocketBase Bot**: could not read `z_ref_script_types` to resolve `' + key + '`.');
+                    process.exit(1);
+                  }
+                  const types = JSON.parse(typeRes.body).items || [];
+                  const wantType = rawVal.trim().toLowerCase();
+                  const hit = types.find(function (t) {
+                    return t.id === rawVal.trim() || String(t.type).toLowerCase() === wantType;
+                  });
+                  if (!hit) {
+                    await addReaction('-1');
+                    await postComment(
+                      '❌ **PocketBase Bot**: unknown type `' + rawVal + '`\n\n' +
+                      '**Available:** `' + types.map(function (t) { return t.type; }).sort().join('`, `') + '`'
+                    );
+                    process.exit(0);
+                  }
+                  payload[key] = hit.id;
                 } else if (type === 'nullable_string') {
                   payload[key] = rawVal === '' ? null : rawVal;
                 } else {
@@ -969,6 +1116,42 @@ jobs:
                 }
               }
 
+              // Resources go into install_methods. Which method: the only one if
+              // there is only one, otherwise the non-Alpine default — and the
+              // reply says which, so nobody has to guess where 25 GB landed.
+              const resourceKeys = Object.keys(resourceFields);
+              let resourceTargetType = null;
+              if (resourceKeys.length > 0) {
+                const methodsArr = readJsonBlob(record.install_methods) || [];
+                if (methodsArr.length === 0) {
+                  await addReaction('-1');
+                  await postComment(
+                    '❌ **PocketBase Bot**: `' + slug + '` has no install methods, so there is nowhere to put `' +
+                    resourceKeys.join('`, `') + '`.\n\nAdd one first: `/pocketbase ' + slug + ' method add default cpu=2 ram=2048 hdd=8`'
+                  );
+                  process.exit(0);
+                }
+                let target = methodsArr.find(function (m) {
+                  return String(m.type || '').toLowerCase() !== 'alpine';
+                }) || methodsArr[0];
+                resourceTargetType = target.type || 'default';
+                if (!target.resources) target.resources = {};
+                for (const [rk, rv] of Object.entries(resourceFields)) {
+                  if (TOP_RESOURCE_KEYS[rk] === 'number') {
+                    const n = parseInt(rv, 10);
+                    if (isNaN(n)) {
+                      await addReaction('-1');
+                      await postComment('❌ **PocketBase Bot**: `' + rk + '` must be a number, got: `' + rv + '`');
+                      process.exit(0);
+                    }
+                    target.resources[rk] = n;
+                  } else {
+                    target.resources[rk] = rv;
+                  }
+                }
+                payload.install_methods = methodsArr;
+              }
+
               const patchRes = await request(recordsUrl + '/' + record.id, {
                 method: 'PATCH',
                 headers: { 'Authorization': token, 'Content-Type': 'application/json' },
@@ -981,10 +1164,16 @@ jobs:
               }
               await revalidate(slug);
               const FIELD_TO_CT_VAR = { tags: 'var_tags', unprivileged: 'var_unprivileged' };
+              const RESOURCE_CT_VAR = { cpu: 'var_cpu', ram: 'var_ram', hdd: 'var_disk', os: 'var_os', version: 'var_version' };
               const fieldCtChanges = {};
               for (const [k, v] of Object.entries(payload)) {
                 if (FIELD_TO_CT_VAR[k]) fieldCtChanges[FIELD_TO_CT_VAR[k]] = v;
               }
+              // Resources belong in the CT script too, exactly as the `method`
+              // path syncs them - otherwise PocketBase and ct/<slug>.sh drift.
+              for (const [k, v] of Object.entries(resourceFields)) {
+                if (RESOURCE_CT_VAR[k]) fieldCtChanges[RESOURCE_CT_VAR[k]] = v;
+              }
               let fieldCtSync = null;
               try {
                 fieldCtSync = await upsertCtDefaultsPr(slug, fieldCtChanges);
@@ -992,8 +1181,14 @@ jobs:
                 fieldCtSync = { status: 'skipped', reason: 'CT sync failed: ' + e.message };
               }
               await addReaction('+1');
+              // install_methods is skipped here: dumping the whole array as JSON
+              // buries the one number that actually changed.
               const changesLines = Object.entries(payload)
+                .filter(function (e) { return e[0] !== 'install_methods'; })
                 .map(function ([k, v]) { return '- `' + k + '` → `' + JSON.stringify(v) + '`'; })
+                .concat(Object.entries(resourceFields).map(function ([k, v]) {
+                  return '- `' + k + '` → `' + v + '` *(install method `' + resourceTargetType + '`)*';
+                }))
                 .join('\n');
               await postComment(
                 '✅ **PocketBase Bot**: Updated **`' + slug + '`** successfully!\n\n' +

.github/workflows/pr-test-command.yml

@@ -0,0 +1,179 @@
+name: PR test command
+
+# A reviewer should not have to work out which URL exercises a pull request.
+# The engine and the scripts resolve independently, so pointing
+# COMMUNITY_SCRIPTS_URL at this PR's branch runs the changed ct/ and install/
+# scripts against the production engine. This posts that command, filled in.
+#
+# Only for scripts that already bootstrap from community-scripts/core: the older
+# one-liner ignores COMMUNITY_SCRIPTS_URL entirely, so a command built for it
+# would quietly install main and look like it passed.
+#
+# pull_request_target, so the comment can be posted on PRs from forks -- which is
+# most of them. Nothing from the pull request is checked out or executed here.
+# The file list, the branch name and the bootstrap line all come from the API,
+# the branch name is pattern-checked before it reaches the comment, and the body
+# is assembled in JavaScript, so no attacker-controlled string reaches a shell.
+
+on:
+  pull_request_target:
+    branches: ["main"]
+    types: [opened, synchronize, reopened]
+    paths:
+      - "ct/**"
+      - "install/**"
+
+jobs:
+  comment:
+    if: github.repository == 'community-scripts/ProxmoxVE'
+    runs-on: self-hosted
+    permissions:
+      pull-requests: write
+      contents: read
+    steps:
+      - uses: actions/github-script@v9
+        with:
+          script: |
+            const MARKER = '<!-- pr-test-command -->';
+            const MAX_APPS = 10;
+
+            const pr = context.payload.pull_request;
+            const head = pr.head.repo;            // null when the fork is gone
+            if (!head) return;
+
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+
+            // Git allows backticks in a ref name, and this one ends up inside a
+            // fenced block. Anything outside the ordinary set is not worth
+            // rendering, so bail rather than escape.
+            const ref = pr.head.ref;
+            if (!/^[A-Za-z0-9._\/-]+$/.test(ref)) return;
+            const base = `https://raw.githubusercontent.com/${head.full_name}/${ref}`;
+
+            const files = await github.paginate(github.rest.pulls.listFiles, {
+              owner, repo, pull_number: pr.number, per_page: 100,
+            });
+
+            // ct/foo.sh and install/foo-install.sh are the same app. A removed
+            // file has nothing left to run.
+            const apps = new Map();               // slug -> {ct, install}
+            for (const f of files) {
+              if (f.status === 'removed') continue;
+              let m = f.filename.match(/^ct\/([a-z0-9][a-z0-9._-]*)\.sh$/);
+              if (m) { apps.set(m[1], { ...apps.get(m[1]), ct: true }); continue; }
+              m = f.filename.match(/^install\/([a-z0-9][a-z0-9._-]*)-install\.sh$/);
+              if (m) apps.set(m[1], { ...apps.get(m[1]), install: true });
+            }
+            if (apps.size === 0) return;
+
+            // Read the ct script at the PR head to see which engine it loads.
+            // Read only -- it is never sourced or run.
+            async function bootstrapOf(slug) {
+              try {
+                const res = await github.rest.repos.getContent({
+                  owner: head.owner.login, repo: head.name,
+                  path: `ct/${slug}.sh`, ref: pr.head.sha,
+                });
+                if (!res.data.content) return 'unknown';
+                const text = Buffer.from(res.data.content, 'base64').toString('utf8');
+                const firstLines = text.split('\n').slice(0, 12).join('\n');
+                return /_cs_boot=/.test(firstLines) ? 'core' : 'legacy';
+              } catch (e) {
+                return e.status === 404 ? 'missing' : 'unknown';
+              }
+            }
+
+            const ready = [], legacy = [], missing = [];
+            for (const slug of [...apps.keys()].sort()) {
+              const kind = await bootstrapOf(slug);
+              if (kind === 'core') ready.push(slug);
+              else if (kind === 'legacy') legacy.push(slug);
+              else if (kind === 'missing') missing.push(slug);
+            }
+
+            const lines = [MARKER];
+
+            if (ready.length > 0) {
+              const shown = ready.slice(0, MAX_APPS);
+              lines.push(
+                '### Try this branch',
+                '',
+                'The engine and the scripts resolve independently, so this runs the changed',
+                '`ct/` and `install/` scripts against the **production** engine:',
+                '',
+              );
+              for (const slug of shown) {
+                lines.push(
+                  '```bash',
+                  `export COMMUNITY_SCRIPTS_URL=${base}`,
+                  `bash -c "$(curl -fsSL "$COMMUNITY_SCRIPTS_URL/ct/${slug}.sh")"`,
+                  '```',
+                  '',
+                );
+              }
+              if (ready.length > shown.length) {
+                lines.push(
+                  `${ready.length - shown.length} more script(s) changed; same command, different slug.`,
+                  '',
+                );
+              }
+              lines.push(
+                'Both lines are needed. Each script pins `_CS_DEFAULT_URL` to `main`, and that',
+                'pin is what fills `COMMUNITY_SCRIPTS_URL` when the variable is unset — so',
+                'curling the branch URL on its own gives you the `ct/` script from this PR and',
+                'the `install/` script from `main`. Frequently the one you meant to test.',
+                '',
+                'The same command works on an Incus host: the engine detects the platform and',
+                'loads the matching backend, while the scripts still come from this branch.',
+                '',
+                '<details><summary>Useful while testing</summary>',
+                '',
+                '`dev_mode=net` logs every fetch with status and URL, which is the quickest way',
+                'to confirm the branch is really being used. `dev_mode=keep` stops a failed',
+                'build from deleting the container along with the evidence.',
+                '',
+                '```bash',
+                `export COMMUNITY_SCRIPTS_URL=${base}`,
+                `dev_mode=net,keep bash -c "$(curl -fsSL "$COMMUNITY_SCRIPTS_URL/ct/${shown[0]}.sh")"`,
+                '```',
+                '</details>',
+              );
+            }
+
+            if (legacy.length > 0) {
+              lines.push(
+                '',
+                ready.length > 0 ? '---' : '### Not testable this way yet',
+                '',
+                `\`${legacy.join('`, `')}\` still uses the older one-liner bootstrap, which`,
+                'resolves everything from `ProxmoxVE/main` and ignores `COMMUNITY_SCRIPTS_URL`.',
+                'There is no way to point it at this branch — test it from a checkout on the',
+                'host instead, or migrate the script to the `_cs_boot` bootstrap first.',
+              );
+            }
+
+            if (missing.length > 0) {
+              lines.push(
+                '',
+                `No \`ct/\` script found for \`${missing.join('`, `')}\`, so there is nothing to`,
+                'run. If the install script was renamed, its `ct/` counterpart needs the same',
+                'name.',
+              );
+            }
+
+            if (lines.length === 1) return;   // marker only, nothing worth saying
+            const body = lines.join('\n');
+
+            // Update in place rather than posting again on every push.
+            const comments = await github.paginate(github.rest.issues.listComments, {
+              owner, repo, issue_number: pr.number, per_page: 100,
+            });
+            const mine = comments.find(c => c.body.includes(MARKER));
+            if (mine) {
+              if (mine.body !== body) {
+                await github.rest.issues.updateComment({ owner, repo, comment_id: mine.id, body });
+              }
+            } else {
+              await github.rest.issues.createComment({ owner, repo, issue_number: pr.number, body });
+            }

CHANGELOG.md

@@ -527,6 +527,66 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-08-28
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - pve-ups: fix: add pip binary  [@CrazyWolf13](https://github.com/CrazyWolf13) ([#16820](https://github.com/community-scripts/ProxmoxVE/pull/16820))
+
+## 2026-08-27
+
+### 🆕 New Scripts
+
+  - Seanime ([#16777](https://github.com/community-scripts/ProxmoxVE/pull/16777))
+- Yopass ([#16778](https://github.com/community-scripts/ProxmoxVE/pull/16778))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - excalidash: Add a sed to switch to the correct DB Provider [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#16814](https://github.com/community-scripts/ProxmoxVE/pull/16814))
+    - fix(stirling-pdf): remove broken ExecStop using %n [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#16813](https://github.com/community-scripts/ProxmoxVE/pull/16813))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - Fix: Incorporate the new update functions to prevent a empty grep on … [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#16809](https://github.com/community-scripts/ProxmoxVE/pull/16809))
+
+## 2026-08-26
+
+### 🆕 New Scripts
+
+  - CentOS ([#16772](https://github.com/community-scripts/ProxmoxVE/pull/16772))
+- AlmaLinux ([#16771](https://github.com/community-scripts/ProxmoxVE/pull/16771))
+- Fedora ([#16770](https://github.com/community-scripts/ProxmoxVE/pull/16770))
+- Devuan ([#16773](https://github.com/community-scripts/ProxmoxVE/pull/16773))
+- OpenEuler ([#16774](https://github.com/community-scripts/ProxmoxVE/pull/16774))
+- Gentoo ([#16775](https://github.com/community-scripts/ProxmoxVE/pull/16775))
+- openSUSE ([#16776](https://github.com/community-scripts/ProxmoxVE/pull/16776))
+- Directus ([#16779](https://github.com/community-scripts/ProxmoxVE/pull/16779))
+- HAProxy ([#16760](https://github.com/community-scripts/ProxmoxVE/pull/16760))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - [Fix]: LimeSurvey - enable Apache mod_rewrite [@jonathan8devs](https://github.com/jonathan8devs) ([#16767](https://github.com/community-scripts/ProxmoxVE/pull/16767))
+    - endurain: migrate legacy FRONTEND_DIR path on update [@MickLesk](https://github.com/MickLesk) ([#16794](https://github.com/community-scripts/ProxmoxVE/pull/16794))
+
+### 💾 Core
+
+  - #### 🐞 Bug Fixes
+
+    - tools.func: recognize bare XZ-compressed tarballs in fetch_and_deploy* [@MickLesk](https://github.com/MickLesk) ([#16796](https://github.com/community-scripts/ProxmoxVE/pull/16796))
+    - tools.func: fix mongodb version comparison, guard apt purge against removing dependents [@MickLesk](https://github.com/MickLesk) ([#16795](https://github.com/community-scripts/ProxmoxVE/pull/16795))
+
+### 📂 Github
+
+  - github: teach the PocketBase bot every field [@MickLesk](https://github.com/MickLesk) ([#16781](https://github.com/community-scripts/ProxmoxVE/pull/16781))
+
 ## 2026-08-25
 
 ### 🆕 New Scripts

ct/almalinux.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://almalinux.org/
+
+APP="AlmaLinux"
+var_tags="${var_tags:-os}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-512}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-almalinux}"
+var_version="${var_version:-10}"
+var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+  if [[ ! -d /var ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+  msg_info "Updating  AlmaLinux"
+  $STD dnf -y upgrade
+  msg_ok "Updated AlmaLinux"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"

ct/centos.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.centos.org/centos-stream/
+
+APP="CentOS"
+var_tags="${var_tags:-os}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-512}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-centos}"
+var_version="${var_version:-10}"
+var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+  if [[ ! -d /var ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+  msg_info "Updating CentOS LXC"
+  $STD dnf -y upgrade
+  msg_ok "Updated CentOS LXC"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"

ct/devuan.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.devuan.org/
+
+APP="Devuan"
+var_tags="${var_tags:-os}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-512}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-devuan}"
+var_version="${var_version:-5.0}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+  if [[ ! -d /var ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+  msg_info "Updating Devuan LXC"
+  $STD apt update
+  $STD apt -y upgrade
+  msg_ok "Updated Devuan LXC"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"

ct/directus.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://directus.com/
+
+APP="Directus"
+var_tags="${var_tags:-cms;api;database;headless}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /opt/directus/node_modules/.bin/directus ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "directus" "directus/directus"; then
+    msg_info "Stopping Service"
+    systemctl stop directus
+    msg_ok "Stopped Service"
+
+    create_backup /opt/directus/.env \
+      /opt/directus/uploads \
+      /opt/directus/extensions
+
+    msg_info "Updating Directus"
+    cd /opt/directus
+    $STD npm install --omit=dev "directus@${CHECK_UPDATE_RELEASE#v}"
+    cat <<EOF >~/.directus
+${CHECK_UPDATE_RELEASE#v}
+EOF
+    restore_backup
+    msg_ok "Updated Directus"
+
+    msg_info "Starting Service"
+    systemctl start directus
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8055${CL}"

ct/endurain.sh

@@ -35,29 +35,29 @@ function update_script() {
     msg_ok "Stopped Service"
 
     NODE_VERSION="24" setup_nodejs
-
     create_backup /opt/endurain/.env /opt/endurain/frontend/dist/env.js
     CLEAN_INSTALL=1 fetch_and_deploy_codeberg_release "endurain" "endurain-project/endurain" "tarball" "latest" "/opt/endurain"
 
-    msg_info "Preparing Update"
+    msg_info "Updating Endurain Frontend"
     cd /opt/endurain
     rm -rf /opt/endurain/{docs,example.env,screenshot_01.png} /opt/endurain/docker* /opt/endurain/*.yml
-    msg_ok "Prepared Update"
-
-    msg_info "Updating Frontend"
     cd /opt/endurain/frontend
     $STD npm ci
     $STD npm run build
-    msg_ok "Updated Frontend"
+    msg_ok "Updated Endurain Frontend"
 
     restore_backup
 
-    msg_info "Updating Backend"
+    if grep -qxF 'FRONTEND_DIR="/opt/endurain/frontend/app/dist"' /opt/endurain/.env; then
+      sed -i 's|^FRONTEND_DIR="/opt/endurain/frontend/app/dist"$|FRONTEND_DIR="/opt/endurain/frontend/dist"|' /opt/endurain/.env
+    fi
+
+    msg_info "Updating Endurain Backend"
     cd /opt/endurain/backend
     UV_VERSION=$(grep -Po 'required-version\s*=\s*"\K[^"]+' pyproject.toml 2>/dev/null || echo "0.11.18")
     UV_VERSION="$UV_VERSION" setup_uv
     $STD uv sync --frozen --no-dev
-    msg_ok "Backend Updated"
+    msg_ok "Endurain Backend Updated"
 
     msg_info "Starting Service"
     systemctl start endurain

ct/excalidash.sh

@@ -42,6 +42,7 @@ function update_script() {
     msg_info "Configuring Database Provider (${DATABASE_PROVIDER:-sqlite})"
     cd /opt/excalidash/backend
     sed -i '/datasource db {/,/}/ s/provider = env("[^"]*")/provider = "'"${DATABASE_PROVIDER:-sqlite}"'"/' prisma/schema.prisma
+    sed -i '/datasource db {/,/}/ s/provider = "[^"]*"/provider = "'"${DATABASE_PROVIDER:-sqlite}"'"/' prisma/schema.prisma
     mv prisma/migrations/"${DATABASE_PROVIDER:-sqlite}"/* prisma/migrations/
     rm -rf prisma/migrations/postgresql prisma/migrations/sqlite
     msg_ok "Configured Database Provider"

ct/fedora.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://fedoraproject.org/
+
+APP="Fedora"
+var_tags="${var_tags:-os}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-512}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-fedora}"
+var_version="${var_version:-43}"
+var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+  if [[ ! -d /var ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+  msg_info "Updating Fedora LXC"
+  $STD dnf -y upgrade
+  msg_ok "Updated Fedora LXC"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"

ct/gentoo.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.gentoo.org/
+
+APP="Gentoo"
+var_tags="${var_tags:-os}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-gentoo}"
+var_version="${var_version:-current}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+  if [[ ! -d /var ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+  msg_info "Updating Gentoo LXC"
+  $STD emerge --sync
+  $STD emerge --quiet --update --deep @world
+  msg_ok "Updated Gentoo LXC"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"

ct/haproxy.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.haproxy.org/
+
+APP="HAProxy"
+var_tags="${var_tags:-network;proxy}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-512}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /etc/haproxy/haproxy.cfg ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  msg_info "Updating ${APP}"
+  $STD apt update
+  $STD apt install -y haproxy
+  msg_ok "Updated ${APP}"
+
+  msg_info "Validating Configuration"
+  if ! $STD haproxy -c -f /etc/haproxy/haproxy.cfg; then
+    msg_error "Configuration is invalid - service not restarted"
+    exit
+  fi
+  msg_ok "Validated Configuration"
+
+  msg_info "Restarting Service"
+  systemctl restart haproxy
+  msg_ok "Restarted Service"
+  msg_ok "Updated successfully!"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Statistics page:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8404${CL}"
+echo -e "${INFO}${YW}The generated stats password is in /etc/haproxy/haproxy.cfg${CL}"

ct/headers/almalinux

@@ -0,0 +1,6 @@
+    ___    __                __    _                 
+   /   |  / /___ ___  ____ _/ /   (_)___  __  ___  __
+  / /| | / / __ `__ \/ __ `/ /   / / __ \/ / / / |/_/
+ / ___ |/ / / / / / / /_/ / /___/ / / / / /_/ />  <  
+/_/  |_/_/_/ /_/ /_/\__,_/_____/_/_/ /_/\__,_/_/|_|  
+                                                     

ct/headers/centos

@@ -0,0 +1,6 @@
+   ______           __  ____  _____
+  / ____/__  ____  / /_/ __ \/ ___/
+ / /   / _ \/ __ \/ __/ / / /\__ \ 
+/ /___/  __/ / / / /_/ /_/ /___/ / 
+\____/\___/_/ /_/\__/\____//____/  
+                                   

ct/headers/devuan

@@ -0,0 +1,6 @@
+    ____                            
+   / __ \___ _   ____  ______ _____ 
+  / / / / _ \ | / / / / / __ `/ __ \
+ / /_/ /  __/ |/ / /_/ / /_/ / / / /
+/_____/\___/|___/\__,_/\__,_/_/ /_/ 
+                                    

ct/headers/directus

@@ -0,0 +1,6 @@
+    ____  _                __            
+   / __ \(_)_______  _____/ /___  _______
+  / / / / / ___/ _ \/ ___/ __/ / / / ___/
+ / /_/ / / /  /  __/ /__/ /_/ /_/ (__  ) 
+/_____/_/_/   \___/\___/\__/\__,_/____/  
+                                         

ct/headers/fedora

@@ -0,0 +1,6 @@
+    ______         __                
+   / ____/__  ____/ /___  _________ _
+  / /_  / _ \/ __  / __ \/ ___/ __ `/
+ / __/ /  __/ /_/ / /_/ / /  / /_/ / 
+/_/    \___/\__,_/\____/_/   \__,_/  
+                                     

ct/headers/gentoo

@@ -0,0 +1,6 @@
+   ______           __            
+  / ____/__  ____  / /_____  ____ 
+ / / __/ _ \/ __ \/ __/ __ \/ __ \
+/ /_/ /  __/ / / / /_/ /_/ / /_/ /
+\____/\___/_/ /_/\__/\____/\____/ 
+                                  

ct/headers/haproxy

@@ -0,0 +1,6 @@
+    __  _____    ____                       
+   / / / /   |  / __ \_________  _  ____  __
+  / /_/ / /| | / /_/ / ___/ __ \| |/_/ / / /
+ / __  / ___ |/ ____/ /  / /_/ />  </ /_/ / 
+/_/ /_/_/  |_/_/   /_/   \____/_/|_|\__, /  
+                                   /____/   

ct/headers/openeuler

@@ -0,0 +1,6 @@
+                          ______      __         
+  ____  ____  ___  ____  / ____/_  __/ /__  _____
+ / __ \/ __ \/ _ \/ __ \/ __/ / / / / / _ \/ ___/
+/ /_/ / /_/ /  __/ / / / /___/ /_/ / /  __/ /    
+\____/ .___/\___/_/ /_/_____/\__,_/_/\___/_/     
+    /_/                                          

ct/headers/opensuse

@@ -0,0 +1,6 @@
+                         _____ __  _______ ______
+  ____  ____  ___  ____ / ___// / / / ___// ____/
+ / __ \/ __ \/ _ \/ __ \\__ \/ / / /\__ \/ __/   
+/ /_/ / /_/ /  __/ / / /__/ / /_/ /___/ / /___   
+\____/ .___/\___/_/ /_/____/\____//____/_____/   
+    /_/                                          

ct/headers/seanime

@@ -0,0 +1,6 @@
+   _____                  _              
+  / ___/___  ____ _____  (_)___ ___  ___ 
+  \__ \/ _ \/ __ `/ __ \/ / __ `__ \/ _ \
+ ___/ /  __/ /_/ / / / / / / / / / /  __/
+/____/\___/\__,_/_/ /_/_/_/ /_/ /_/\___/ 
+                                         

ct/headers/yopass

@@ -0,0 +1,6 @@
+__  __                           
+\ \/ /___  ____  ____ ___________
+ \  / __ \/ __ \/ __ `/ ___/ ___/
+ / / /_/ / /_/ / /_/ (__  |__  ) 
+/_/\____/ .___/\__,_/____/____/  
+       /_/                       

ct/limesurvey.sh

@@ -28,6 +28,13 @@ function update_script() {
     msg_error "No ${APP} Installation Found!"
     exit
   fi
+  if [[ ! -L /etc/apache2/mods-enabled/rewrite.load ]]; then
+    msg_info "Enabling Apache mod_rewrite"
+    $STD a2enmod rewrite
+    systemctl restart apache2
+    msg_ok "Enabled Apache mod_rewrite"
+  fi
+
   setup_mariadb
 
   msg_warn "Application is updated via Web Interface"

ct/openeuler.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.openeuler.org/
+
+APP="openEuler"
+var_tags="${var_tags:-os}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-512}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-openeuler}"
+var_version="${var_version:-25.03}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+  if [[ ! -d /var ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+  msg_info "Updating OpenEuler LXC"
+  $STD dnf -y upgrade
+  msg_ok "Updated OpenEuler LXC"
+  msg_ok "Updated successfully!"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"

ct/opensuse.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.opensuse.org/
+
+APP="openSUSE"
+var_tags="${var_tags:-os}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-512}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-opensuse}"
+var_version="${var_version:-16.0}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+  if [[ ! -d /var ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+  msg_info "Updating OpenSUSE LXC"
+  $STD zypper -n update
+  msg_ok "Updated OpenSUSE LXC"
+  msg_ok "Updated successfully!"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!\n"
+msg_custom "🚀" "${GN}" "${APP} setup has been successfully initialized!"

ct/pve-ups.sh

@@ -41,7 +41,7 @@ function update_script() {
 
     msg_info "Updating Application"
     cd /opt/pve-usv
-    $STD uv venv --clear venv
+    $STD uv venv --clear --seed venv
     $STD uv pip install --python venv/bin/python .
     chown -R pveusv:pveusv /opt/pve-usv
     chmod 0755 deploy/pve-usv-agent.sh

ct/seanime.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: hasan-ismail
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://seanime.app/
+
+APP="Seanime"
+var_tags="${var_tags:-media;anime;manga}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+var_gpu="${var_gpu:-yes}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/seanime ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "seanime" "5rahim/seanime"; then
+    msg_info "Stopping Service"
+    systemctl stop seanime
+    msg_ok "Stopped Service"
+
+    create_backup /opt/seanime-data/config.toml
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "seanime" "5rahim/seanime" "prebuild" "latest" "/opt/seanime" "seanime-[0-9]*_Linux_$(arch_resolve x86_64 arm64).tar.gz"
+    chmod +x /opt/seanime/seanime
+
+    restore_backup
+
+    msg_info "Starting Service"
+    systemctl start seanime
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:43211${CL}"

ct/yopass.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/jhaals/yopass
+
+APP="Yopass"
+var_tags="${var_tags:-security;secrets}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/yopass ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "yopass" "jhaals/yopass"; then
+    msg_info "Stopping Service"
+    systemctl stop yopass
+    msg_ok "Stopped Service"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "yopass" "jhaals/yopass" "tarball"
+
+    msg_info "Building Yopass"
+    cd /opt/yopass
+    $STD go build -ldflags "-X main.version=$(cat ~/.yopass)" ./cmd/yopass-server
+    cd /opt/yopass/website
+    $STD yarn install --network-timeout 600000
+    $STD yarn build
+    msg_ok "Built Yopass"
+
+    msg_info "Starting Service"
+    systemctl start yopass
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}https://${IP}:1337${CL}"

install/almalinux-install.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://almalinux.org/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+motd_ssh
+customize
+cleanup_lxc

install/centos-install.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.centos.org/centos-stream/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+motd_ssh
+customize
+cleanup_lxc

install/devuan-install.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.devuan.org/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+motd_ssh
+customize
+cleanup_lxc

install/directus-install.sh

@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://directus.com/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+NODE_VERSION="22" setup_nodejs
+PG_VERSION="17" setup_postgresql
+PG_DB_NAME="directus" PG_DB_USER="directus" setup_postgresql_db
+
+msg_info "Installing Directus"
+mkdir -p /opt/directus/uploads /opt/directus/extensions
+cd /opt/directus
+$STD npm init -y
+DIRECTUS_VERSION=$(get_latest_github_release "directus/directus")
+$STD npm install --omit=dev "directus@${DIRECTUS_VERSION}"
+cat <<EOF >~/.directus
+${DIRECTUS_VERSION}
+EOF
+msg_ok "Installed Directus"
+
+msg_info "Configuring Directus"
+DIRECTUS_KEY=$(openssl rand -hex 32)
+DIRECTUS_SECRET=$(openssl rand -hex 32)
+DIRECTUS_ADMIN_PASSWORD=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c16)
+cat <<EOF >/opt/directus/.env
+HOST="0.0.0.0"
+PORT=8055
+PUBLIC_URL="http://${LOCAL_IP}:8055"
+KEY="${DIRECTUS_KEY}"
+SECRET="${DIRECTUS_SECRET}"
+
+DB_CLIENT="pg"
+DB_HOST="127.0.0.1"
+DB_PORT=5432
+DB_DATABASE="${PG_DB_NAME}"
+DB_USER="${PG_DB_USER}"
+DB_PASSWORD="${PG_DB_PASS}"
+
+ADMIN_EMAIL="admin@community-scripts.org"
+ADMIN_PASSWORD="${DIRECTUS_ADMIN_PASSWORD}"
+
+STORAGE_LOCATIONS="local"
+STORAGE_LOCAL_DRIVER="local"
+STORAGE_LOCAL_ROOT="/opt/directus/uploads"
+EXTENSIONS_PATH="/opt/directus/extensions"
+TELEMETRY=false
+EOF
+chmod 640 /opt/directus/.env
+msg_ok "Configured Directus"
+
+msg_info "Initializing Directus"
+cd /opt/directus
+$STD /opt/directus/node_modules/.bin/directus bootstrap
+msg_ok "Initialized Directus"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/directus.service
+[Unit]
+Description=Directus
+After=network.target postgresql.service
+Requires=postgresql.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/directus
+EnvironmentFile=/opt/directus/.env
+ExecStart=/opt/directus/node_modules/.bin/directus start
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now directus
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/fedora-install.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://fedoraproject.org/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+motd_ssh
+customize
+cleanup_lxc

install/gentoo-install.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.gentoo.org/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+motd_ssh
+customize
+cleanup_lxc

install/haproxy-install.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.haproxy.org/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing HAProxy"
+$STD apt install -y haproxy
+msg_ok "Installed HAProxy"
+
+msg_info "Configuring HAProxy"
+HAPROXY_STATS_PASSWORD=$(openssl rand -base64 18)
+cat <<EOF >/etc/haproxy/haproxy.cfg
+global
+	log /dev/log local0
+	chroot /var/lib/haproxy
+	stats socket /run/haproxy/admin.sock mode 660 level admin
+	stats timeout 30s
+	user haproxy
+	group haproxy
+	daemon
+	ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets
+
+defaults
+	log global
+	mode http
+	option httplog
+	option dontlognull
+	timeout connect 5s
+	timeout client 50s
+	timeout server 50s
+	errorfile 400 /etc/haproxy/errors/400.http
+	errorfile 403 /etc/haproxy/errors/403.http
+	errorfile 408 /etc/haproxy/errors/408.http
+	errorfile 500 /etc/haproxy/errors/500.http
+	errorfile 502 /etc/haproxy/errors/502.http
+	errorfile 503 /etc/haproxy/errors/503.http
+	errorfile 504 /etc/haproxy/errors/504.http
+
+listen stats
+	bind *:8404
+	stats enable
+	stats uri /
+	stats refresh 10s
+	stats admin if TRUE
+	stats auth admin:${HAPROXY_STATS_PASSWORD}
+
+# Example: replace with your own frontend/backend pairs.
+#frontend http_in
+#	bind *:80
+#	default_backend servers
+#
+#backend servers
+#	balance roundrobin
+#	server web1 192.168.1.10:80 check
+#	server web2 192.168.1.11:80 check
+EOF
+$STD haproxy -c -f /etc/haproxy/haproxy.cfg
+systemctl restart haproxy
+msg_ok "Configured HAProxy"
+
+motd_ssh
+customize
+cleanup_lxc

install/limesurvey-install.sh

@@ -60,6 +60,7 @@ cat <<EOF >/etc/apache2/sites-enabled/000-default.conf
 EOF
 chown -R www-data:www-data "/opt/limesurvey"
 chmod -R 750 "/opt/limesurvey"
+$STD a2enmod rewrite
 systemctl reload apache2
 rm -rf "$temp_file"
 msg_ok "Set up LimeSurvey"

install/openeuler-install.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.openeuler.org/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+motd_ssh
+customize
+cleanup_lxc

install/opensuse-install.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.opensuse.org/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+motd_ssh
+customize
+cleanup_lxc

install/pve-ups-install.sh

@@ -27,7 +27,7 @@ install -d -o pveusv -g pveusv -m 0750 \
   /var/lib/pve-usv/updates
 chown -R pveusv:pveusv /opt/pve-usv
 cd /opt/pve-usv
-$STD uv venv --clear venv
+$STD uv venv --clear --seed venv
 $STD uv pip install --python venv/bin/python .
 chmod 0755 deploy/pve-usv-agent.sh
 msg_ok "Set up Application"

install/seanime-install.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: hasan-ismail
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://seanime.app/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+setup_hwaccel
+
+msg_info "Installing FFmpeg"
+setup_deb822_repo \
+  "jellyfin" \
+  "https://repo.jellyfin.org/jellyfin_team.gpg.key" \
+  "https://repo.jellyfin.org/debian" \
+  "$(get_os_info codename)"
+$STD apt install -y jellyfin-ffmpeg7
+ln -sf /usr/lib/jellyfin-ffmpeg/ffmpeg /usr/bin/ffmpeg
+ln -sf /usr/lib/jellyfin-ffmpeg/ffprobe /usr/bin/ffprobe
+msg_ok "Installed FFmpeg"
+
+fetch_and_deploy_gh_release "seanime" "5rahim/seanime" "prebuild" "latest" "/opt/seanime" "seanime-[0-9]*_Linux_$(arch_resolve x86_64 arm64).tar.gz"
+chmod +x /opt/seanime/seanime
+
+msg_info "Configuring Seanime"
+SEANIME_PASSWORD=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-13)
+mkdir -p /opt/seanime-data
+cat <<EOF >/opt/seanime-data/config.toml
+[server]
+password = "${SEANIME_PASSWORD}"
+EOF
+cat <<EOF >/root/seanime.creds
+Seanime URL: http://${LOCAL_IP}:43211
+Password: ${SEANIME_PASSWORD}
+EOF
+msg_ok "Configured Seanime"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/seanime.service
+[Unit]
+Description=Seanime
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/seanime
+ExecStart=/opt/seanime/seanime --datadir /opt/seanime-data --host 0.0.0.0
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now seanime
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/stirling-pdf-install.sh

@@ -147,7 +147,6 @@ Group=root
 EnvironmentFile=/opt/Stirling-PDF/.env
 WorkingDirectory=/opt/Stirling-PDF
 ExecStart=/usr/bin/java -jar Stirling-PDF.jar
-ExecStop=/bin/kill -15 %n
 Restart=always
 RestartSec=10
 

install/yopass-install.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/jhaals/yopass
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y redis-server
+systemctl enable -q --now redis-server
+msg_ok "Installed Dependencies"
+
+setup_go
+NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
+
+fetch_and_deploy_gh_release "yopass" "jhaals/yopass" "tarball"
+
+msg_info "Building Yopass"
+cd /opt/yopass
+$STD go build -ldflags "-X main.version=$(cat ~/.yopass)" ./cmd/yopass-server
+cd /opt/yopass/website
+$STD yarn install --network-timeout 600000
+$STD yarn build
+msg_ok "Built Yopass"
+
+msg_info "Generating SSL Certificate"
+mkdir -p /opt/yopass/certificates
+openssl req -x509 -nodes -days 3650 -newkey rsa:2048 \
+  -keyout /opt/yopass/certificates/key.pem \
+  -out /opt/yopass/certificates/cert.pem \
+  -subj "/C=US/ST=State/L=City/O=Yopass/CN=${LOCAL_IP}" \
+  -addext "subjectAltName=IP:${LOCAL_IP},DNS:localhost,IP:127.0.0.1" \
+  2>/dev/null
+chmod 600 /opt/yopass/certificates/key.pem
+chmod 644 /opt/yopass/certificates/cert.pem
+msg_ok "Generated SSL Certificate"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/yopass.service
+[Unit]
+Description=Yopass
+Wants=network-online.target
+After=network-online.target redis-server.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/yopass
+ExecStart=/opt/yopass/yopass-server --address 0.0.0.0 --port 1337 --tls-cert /opt/yopass/certificates/cert.pem --tls-key /opt/yopass/certificates/key.pem --database redis --redis redis://127.0.0.1:6379/0 --asset-path /opt/yopass/website/dist
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now yopass
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

misc/tools.func

@@ -632,7 +632,7 @@ is_tool_installed() {
     ;;
   mongodb | mongod)
     if command -v mongod >/dev/null 2>&1; then
-      installed_version=$(mongod --version 2>/dev/null | awk '/db version/{print $3}' | cut -d. -f1,2)
+      installed_version=$(mongod --version 2>/dev/null | awk '/db version/{print $3}' | sed 's/^v//' | cut -d. -f1,2)
     fi
     ;;
   node | nodejs)
@@ -685,6 +685,39 @@ is_tool_installed() {
   return 0 # Installed and version matches (if specified)
 }
 
+# ------------------------------------------------------------------------------
+# Checks whether purging the given package glob(s) would also remove packages
+# outside those globs (i.e. reverse dependents, such as an app depending on
+# mongodb-org-server). Uses `apt-get -s` (simulate) with the stable apt-get
+# output format, not `apt`, whose output is explicitly unstable for scripting.
+# Returns 0 (safe to purge) or 1 (unsafe - prints the unexpected packages).
+# Usage: _purge_is_safe 'mongodb*' ['other-glob*' ...]
+# ------------------------------------------------------------------------------
+_purge_is_safe() {
+  local -a globs=("$@")
+  local -a collateral=()
+  local pkg glob matched
+  local sim_out
+  sim_out=$(apt-get -s purge -y "${globs[@]}" 2>/dev/null) || return 0
+  while IFS= read -r pkg; do
+    [[ -z "$pkg" ]] && continue
+    matched=0
+    for glob in "${globs[@]}"; do
+      # shellcheck disable=SC2053
+      [[ "$pkg" == $glob ]] && {
+        matched=1
+        break
+      }
+    done
+    ((matched)) || collateral+=("$pkg")
+  done < <(awk '/^(Remv|Purg) /{print $2}' <<<"$sim_out")
+  if ((${#collateral[@]} > 0)); then
+    msg_warn "Refusing purge of '${globs[*]}': would also remove ${collateral[*]}"
+    return 1
+  fi
+  return 0
+}
+
 # ------------------------------------------------------------------------------
 # Remove old tool version completely (purge + cleanup repos)
 # Usage: remove_old_tool_version "mariadb" "repository-name"
@@ -696,11 +729,13 @@ remove_old_tool_version() {
   case "$tool_name" in
   mariadb)
     stop_all_services "mariadb"
+    _purge_is_safe 'mariadb*' || return 1
     $STD apt purge -y 'mariadb*' >/dev/null 2>&1 || true
     cleanup_tool_keyrings "mariadb"
     ;;
   mysql)
     stop_all_services "mysql"
+    _purge_is_safe 'mysql*' || return 1
     $STD apt purge -y 'mysql*' >/dev/null 2>&1 || true
     # Keep data directory for safety (remove manually if needed)
     # rm -rf /var/lib/mysql 2>/dev/null || true
@@ -708,12 +743,14 @@ remove_old_tool_version() {
     ;;
   mongodb)
     stop_all_services "mongod"
+    _purge_is_safe 'mongodb*' || return 1
     $STD apt purge -y 'mongodb*' >/dev/null 2>&1 || true
     # Keep data directory for safety (remove manually if needed)
     # rm -rf /var/lib/mongodb 2>/dev/null || true
     cleanup_tool_keyrings "mongodb"
     ;;
   node | nodejs)
+    _purge_is_safe nodejs npm || return 1
     $STD apt purge -y nodejs npm >/dev/null 2>&1 || true
     # Clean up npm global modules
     if command -v npm >/dev/null 2>&1; then
@@ -726,23 +763,27 @@ remove_old_tool_version() {
     ;;
   php)
     stop_all_services "php.*-fpm"
+    _purge_is_safe 'php*' || return 1
     $STD apt purge -y 'php*' >/dev/null 2>&1 || true
     rm -rf /etc/php 2>/dev/null || true
     cleanup_tool_keyrings "deb.sury.org-php" "php"
     ;;
   postgresql)
     stop_all_services "postgresql"
+    _purge_is_safe 'postgresql*' || return 1
     $STD apt purge -y 'postgresql*' >/dev/null 2>&1 || true
     # Keep data directory for safety (can be removed manually if needed)
     # rm -rf /var/lib/postgresql 2>/dev/null || true
     cleanup_tool_keyrings "postgresql" "pgdg"
     ;;
   java)
+    _purge_is_safe 'temurin*' 'adoptium*' 'openjdk*' || return 1
     $STD apt purge -y 'temurin*' 'adoptium*' 'openjdk*' >/dev/null 2>&1 || true
     cleanup_tool_keyrings "adoptium"
     ;;
   ruby)
     cleanup_legacy_install "ruby"
+    _purge_is_safe 'ruby*' || return 1
     $STD apt purge -y 'ruby*' >/dev/null 2>&1 || true
     ;;
   rust)
@@ -754,6 +795,7 @@ remove_old_tool_version() {
     ;;
   clickhouse)
     stop_all_services "clickhouse-server"
+    _purge_is_safe 'clickhouse*' || return 1
     $STD apt purge -y 'clickhouse*' >/dev/null 2>&1 || true
     # Keep data directory for safety (remove manually if needed)
     # rm -rf /var/lib/clickhouse 2>/dev/null || true
@@ -4473,7 +4515,10 @@ setup_clickhouse() {
   if [[ -n "$CURRENT_VERSION" && "$CURRENT_VERSION" != "$CLICKHOUSE_VERSION" ]]; then
     msg_info "Upgrade ClickHouse from $CURRENT_VERSION to $CLICKHOUSE_VERSION"
     stop_all_services "clickhouse-server"
-    remove_old_tool_version "clickhouse"
+    remove_old_tool_version "clickhouse" || {
+      msg_error "Aborting ClickHouse upgrade: another package depends on it"
+      return 1
+    }
   else
     msg_info "Setup ClickHouse $CLICKHOUSE_VERSION"
   fi
@@ -5150,7 +5195,10 @@ setup_go() {
   # Scenario 2: Different version or not installed
   if [[ -n "$CURRENT_VERSION" && "$CURRENT_VERSION" != "$GO_VERSION" ]]; then
     msg_info "Upgrade Go from $CURRENT_VERSION to $GO_VERSION"
-    remove_old_tool_version "go"
+    remove_old_tool_version "go" || {
+      msg_error "Aborting Go upgrade: another package depends on it"
+      return 1
+    }
   else
     msg_info "Setup Go $GO_VERSION"
   fi
@@ -6753,7 +6801,10 @@ EOF
   # Scenario 2b: Different version installed - clean upgrade
   if [[ -n "$CURRENT_VERSION" ]] && ! version_matches_spec "$CURRENT_VERSION" "$MARIADB_VERSION"; then
     msg_info "Upgrade MariaDB from $CURRENT_VERSION to $MARIADB_VERSION"
-    remove_old_tool_version "mariadb"
+    remove_old_tool_version "mariadb" || {
+      msg_error "Aborting MariaDB upgrade: another package depends on it"
+      return 1
+    }
   fi
 
   # Scenario 3: Fresh install or version change with specific version
@@ -7283,7 +7334,10 @@ setup_mongodb() {
   # Scenario 2: Different version installed - clean upgrade
   if [[ -n "$INSTALLED_VERSION" && "$INSTALLED_VERSION" != "$MONGO_VERSION" ]]; then
     msg_info "Upgrade MongoDB from $INSTALLED_VERSION to $MONGO_VERSION"
-    remove_old_tool_version "mongodb"
+    remove_old_tool_version "mongodb" || {
+      msg_error "Aborting MongoDB upgrade: another package depends on it (e.g. an app using it)"
+      return 1
+    }
   else
     msg_info "Setup MongoDB $MONGO_VERSION"
   fi
@@ -7473,7 +7527,10 @@ setup_mysql() {
   # Scenario 2: Different version installed - clean upgrade
   if [[ -n "$CURRENT_VERSION" ]] && ! version_matches_spec "$CURRENT_VERSION" "$MYSQL_VERSION"; then
     msg_info "Upgrade MySQL from $CURRENT_VERSION to $MYSQL_VERSION"
-    remove_old_tool_version "mysql"
+    remove_old_tool_version "mysql" || {
+      msg_error "Aborting MySQL upgrade: another package depends on it"
+      return 1
+    }
   else
     msg_info "Setup MySQL $MYSQL_VERSION"
   fi
@@ -7637,7 +7694,10 @@ setup_nodejs() {
     if [[ -n "$CURRENT_NODE_VERSION" && "$CURRENT_NODE_VERSION" != "$NODE_VERSION" ]]; then
       msg_info "Upgrade Node.js from $CURRENT_NODE_VERSION to $NODE_VERSION"
       node_setup_ok_msg="Upgrade Node.js to $NODE_VERSION"
-      remove_old_tool_version "nodejs"
+      remove_old_tool_version "nodejs" || {
+        msg_error "Aborting Node.js upgrade: another package depends on it"
+        return 1
+      }
     else
       msg_info "Setup Node.js $NODE_VERSION"
       node_setup_ok_msg="Setup Node.js $NODE_VERSION"
@@ -9334,6 +9394,8 @@ fetch_and_deploy_from_url() {
 
   if [[ "$file_desc" =~ gzip.*compressed|gzip\ compressed\ data ]]; then
     archive_type="tar"
+  elif [[ "$file_desc" =~ XZ\ compressed\ data ]]; then
+    archive_type="tar"
   elif [[ "$file_desc" =~ Zip.*archive|ZIP\ archive ]]; then
     archive_type="zip"
   elif [[ "$file_desc" =~ Debian.*package|Debian\ binary\ package ]]; then

tools/pve/update-apps.sh

@@ -173,7 +173,11 @@ function detect_service() {
     rm -rf "$tmpdir"
     return 1
   fi
-  service=$(grep -oE '/ct/[a-zA-Z0-9._-]+\.sh' "$update_file" 2>/dev/null | head -n1 | sed 's|.*/ct/||; s|\.sh$||')
+
+  service=$(sed -n -E 's/^[[:space:]]*export[[:space:]]+UPDATE_SCRIPT_NAME=["'"'"']?([a-zA-Z0-9._-]+).*/\1/p' "$update_file" | head -n1)
+  [[ -z "$service" ]] && service=$(sed -n -E 's/^[[:space:]]*export[[:space:]]+SCRIPT_SLUG=["'"'"']?([a-zA-Z0-9._-]+).*/\1/p' "$update_file" | head -n1)
+  [[ -z "$service" ]] && service=$(grep -oE '/ct/[a-zA-Z0-9._-]+\.sh' "$update_file" 2>/dev/null | head -n1 | sed 's|.*/ct/||; s|\.sh$||')
+
   rm -rf "$tmpdir"
 }