Update CHANGELOG.md

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -6,13 +6,17 @@ body:
     attributes:
       value: |
         ## ⚠️ **IMPORTANT - READ FIRST**
-        - 🔍 **Search first:** Before submitting, check if the issue has already been reported or resolved in [closed issues](https://github.com/community-scripts/ProxmoxVE/issues?q=is%3Aissue+is%3Aclosed). If found, comment on that issue instead of creating a new one.  
-        Alternatively, check the **[Discussions](https://github.com/community-scripts/ProxmoxVE/discussions)** under the *"Announcement"* or *"Guide"* categories for relevant information.  
-        - 🔎 If you encounter `[ERROR] in line 23: exit code *: while executing command "$@" > /dev/null 2>&1`, rerun the script with verbose mode before submitting the issue.  
-        - 📜 **Read the script:** Familiarize yourself with the script's content and its purpose. This will help you understand the issue better and provide more relevant information
 
-        Thank you for taking the time to report an issue! Please provide as much detail as possible to help us address the problem efficiently.  
+        **1. Reproduce the issue with verbose mode - this is mandatory.**
+        Set `var_verbose=yes` (or *Advanced Settings → Verbose Mode*) and run the script again.
+        Only a verbose log shows what actually failed - a bare `[ERROR] in line 23: exit code *` tells us nothing.
+        **Reports without a verbose log will most likely be closed.**
 
+        **2. Search before you post.**
+        Check the [closed issues](https://github.com/community-scripts/ProxmoxVE/issues?q=is%3Aissue+is%3Aclosed) and the [Discussions](https://github.com/community-scripts/ProxmoxVE/discussions) (*Announcement* / *Guide*). If it is already known, comment there instead of opening a new issue.
+
+        **3. Read the script.**
+        Knowing what it does makes it much easier to describe the problem - and often to solve it yourself.
 
   - type: input
     id: guidelines
@@ -28,7 +32,6 @@ body:
       label: 🔎 Did you run the script with verbose mode enabled?
       description: "Required for debugging any script issue. A verbose log is mandatory."
       options:
-        - ""
         - "Yes, verbose mode was enabled and the output is included below"
         - "No (this issue will likely be closed automatically)"
     validations:
@@ -50,6 +53,32 @@ body:
     validations:
       required: true
 
+  - type: dropdown
+    id: issue_phase
+    attributes:
+      label: 🕒 When does the issue occur?
+      options:
+        - "Initial creation / installation"
+        - "Update of an existing container"
+        - "While the application is running"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: execution_context
+    attributes:
+      label: 🖱️ Where did you run the command?
+      description: "The shell matters — the Proxmox web console starts without some environment variables that a normal login shell sets."
+      options:
+        - "Proxmox web UI → node → Shell"
+        - "Proxmox web UI → LXC → Console"
+        - "SSH into the Proxmox host"
+        - "SSH into the container"
+        - "pct enter from the host"
+        - "Other / not listed"
+    validations:
+      required: true
+
   - type: checkboxes
     validations:
       required: true
@@ -64,18 +93,31 @@ body:
       value: "💡 **Tip:** If you are using Advanced Settings, please test with Default Settings before submitting an issue."
 
   - type: dropdown
-    id: linux_distribution
+    id: os_distribution
     attributes:
-      label: 🖥️ Which Linux distribution are you using?
+      label: 🖥️ Which Linux distribution is the container running?
       options:
-        - 
+        - Debian
+        - Ubuntu
         - Alpine
-        - Debian 11
+        - Devuan
-        - Debian 12
+        - AlmaLinux
-        - Debian 13
+        - Rocky Linux
-        - Ubuntu 22.04
+        - CentOS Stream
-        - Ubuntu 24.04
+        - Fedora
-        - Ubuntu 24.10
+        - openSUSE
+        - openEuler
+        - Gentoo
+        - Other / not listed
+    validations:
+      required: true
+
+  - type: input
+    id: os_version
+    attributes:
+      label: 🔢 Which version of that distribution?
+      description: "Run `cat /etc/os-release` inside the container if unsure."
+      placeholder: "e.g. 13 (Debian), 24.04 (Ubuntu), 3.22 (Alpine)"
     validations:
       required: true
 
@@ -85,16 +127,27 @@ body:
       label: 🧱 Is this Proxmox host running arm64?
       description: "Run `dpkg --print-architecture` on your Proxmox host if unsure."
       options:
-        - ""
         - "No"
         - "Yes"
     validations:
       required: true
 
+  - type: dropdown
+    id: pve_major
+    attributes:
+      label: 📈 Which Proxmox VE release are you on?
+      options:
+        - "Proxmox VE 9"
+        - "Proxmox VE 8"
+        - "Proxmox VE 7 or older (end of life)"
+    validations:
+      required: true
+
   - type: input
     id: pve_version
     attributes:
-      label: 📈 Which Proxmox version are you on?
+      label: 🔢 Exact Proxmox version and kernel
+      description: "Both matter — several issues turned out to be kernel-specific."
       placeholder: "run pveversion in your PVE node console"
     validations:
       required: true

.github/autolabeler-config.json

@@ -8,7 +8,12 @@
         "turnkey/**",
         "vm/**"
       ],
-      "excludeGlobs": []
+      "excludeGlobs": [
+        "**/headers/**",
+        "ct/headers/**",
+        "tools/headers/**",
+        "vm/headers/**"
+      ]
     }
   ],
   "update script": [
@@ -41,7 +46,12 @@
       "includeGlobs": [
         "vm/**"
       ],
-      "excludeGlobs": []
+      "excludeGlobs": [
+        "**/headers/**",
+        "ct/headers/**",
+        "tools/headers/**",
+        "vm/headers/**"
+      ]
     }
   ],
   "tools": [

.github/changelogs/2026/09.md

@@ -1,3 +1,169 @@
+## 2026-09-12
+
+### 🆕 New Scripts
+
+  - Elasticsearch ([#17188](https://github.com/community-scripts/ProxmoxVE/pull/17188))
+- Hammer ([#17189](https://github.com/community-scripts/ProxmoxVE/pull/17189))
+- gotenberg ([#17205](https://github.com/community-scripts/ProxmoxVE/pull/17205))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(dispatcharr): add comskip installation and build dependencies [@eXistC](https://github.com/eXistC) ([#16224](https://github.com/community-scripts/ProxmoxVE/pull/16224))
+    - poznote: serve from src/public docroot [@MickLesk](https://github.com/MickLesk) ([#17187](https://github.com/community-scripts/ProxmoxVE/pull/17187))
+    - calibre-web: use calibreweb release identifier to avoid version file collision [@MickLesk](https://github.com/MickLesk) ([#17186](https://github.com/community-scripts/ProxmoxVE/pull/17186))
+
+  - #### ✨ New Features
+
+    - Docker VM: Feature Bump - Refactor script for improved functionality [@MickLesk](https://github.com/MickLesk) ([#17216](https://github.com/community-scripts/ProxmoxVE/pull/17216))
+    - feat(jitsi-meet): optional public setup (FQDN, Let's Encrypt, NAT, secure domain) [@klanghans](https://github.com/klanghans) ([#17132](https://github.com/community-scripts/ProxmoxVE/pull/17132))
+
+  - #### 🔧 Refactor
+
+    - Paperless-NGX: add --no-sync to uv run services [@MickLesk](https://github.com/MickLesk) ([#17210](https://github.com/community-scripts/ProxmoxVE/pull/17210))
+
+### 💾 Core
+
+  - VM's: show the selected CPU model instead of doubling it [@MickLesk](https://github.com/MickLesk) ([core#37](https://github.com/community-scripts/core/pull/37))
+- Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#36](https://github.com/community-scripts/core/pull/36))
+
+## 2026-09-11
+
+### 🆕 New Scripts
+
+  - Lemonade-Server ([#17190](https://github.com/community-scripts/ProxmoxVE/pull/17190))
+- OneTimeSecret ([#17097](https://github.com/community-scripts/ProxmoxVE/pull/17097))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - update authentik to 2026.8.2 [@thieneret](https://github.com/thieneret) ([#17198](https://github.com/community-scripts/ProxmoxVE/pull/17198))
+    - passwordpusher: restore data before running migrations [@MickLesk](https://github.com/MickLesk) ([#17141](https://github.com/community-scripts/ProxmoxVE/pull/17141))
+    - paperclip: install the rust toolchain needed by the runner build [@MickLesk](https://github.com/MickLesk) ([#17142](https://github.com/community-scripts/ProxmoxVE/pull/17142))
+    - homepage: run next directly instead of through pnpm [@MickLesk](https://github.com/MickLesk) ([#17155](https://github.com/community-scripts/ProxmoxVE/pull/17155))
+    - changedetection: fix: pin browserless [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17163](https://github.com/community-scripts/ProxmoxVE/pull/17163))
+
+### 💾 Core
+
+  - #### 🐞 Bug Fixes
+
+    - core.func: fall back to a usable HOME when the shell has none [@MickLesk](https://github.com/MickLesk) ([#17154](https://github.com/community-scripts/ProxmoxVE/pull/17154))
+
+### 🧰 Tools
+
+  - Dockhand ([#17191](https://github.com/community-scripts/ProxmoxVE/pull/17191))
+
+  - #### 🐞 Bug Fixes
+
+    - update-apps: rewrite the retired Gitea base in every container before updating it [@MickLesk](https://github.com/MickLesk) ([#17156](https://github.com/community-scripts/ProxmoxVE/pull/17156))
+
+  - #### 🔧 Refactor
+
+    - Rename lxc-delete.sh to guest-delete.sh [@MickLesk](https://github.com/MickLesk) ([#17152](https://github.com/community-scripts/ProxmoxVE/pull/17152))
+
+### 📚 Documentation
+
+  - issue template: add PVE release, execution context and phase; refresh distro list / pve versions [@MickLesk](https://github.com/MickLesk) ([#17160](https://github.com/community-scripts/ProxmoxVE/pull/17160))
+
+## 2026-09-10
+
+### 🆕 New Scripts
+
+  - Chevereto ([#17131](https://github.com/community-scripts/ProxmoxVE/pull/17131))
+- Portabase ([#17111](https://github.com/community-scripts/ProxmoxVE/pull/17111))
+- Logseq ([#17112](https://github.com/community-scripts/ProxmoxVE/pull/17112))
+- Safebucket ([#17096](https://github.com/community-scripts/ProxmoxVE/pull/17096))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Immich v3.2.0 [@vhsdream](https://github.com/vhsdream) ([#17137](https://github.com/community-scripts/ProxmoxVE/pull/17137))
+    - fix(solidtime): prevent composer install from hanging on root prompt [@supersoju](https://github.com/supersoju) ([#17146](https://github.com/community-scripts/ProxmoxVE/pull/17146))
+    - fix(hermesagent): wait for root gateway cleanup [@steveonjava](https://github.com/steveonjava) ([#17147](https://github.com/community-scripts/ProxmoxVE/pull/17147))
+
+### 💾 Core
+
+  - Keep the script name when regenerating the entrypoint [@MickLesk](https://github.com/MickLesk) ([core#35](https://github.com/community-scripts/core/pull/35))
+- Rewrite the dead Gitea base onto GitHub instead of failing the update [@MickLesk](https://github.com/MickLesk) ([core#33](https://github.com/community-scripts/core/pull/33))
+- core.func: fall back to a usable HOME when the shell has none [@MickLesk](https://github.com/MickLesk) ([core#32](https://github.com/community-scripts/core/pull/32))
+
+## 2026-09-09
+
+### 🆕 New Scripts
+
+  - Lingarr ([#17130](https://github.com/community-scripts/ProxmoxVE/pull/17130))
+
+### 🚀 Updated Scripts
+
+  - vm: drop the discussions link from the summary [@MickLesk](https://github.com/MickLesk) ([#17117](https://github.com/community-scripts/ProxmoxVE/pull/17117))
+
+  - #### 🐞 Bug Fixes
+
+    - fix(hermesagent): stop spurious root gateway after update [@steveonjava](https://github.com/steveonjava) ([#17126](https://github.com/community-scripts/ProxmoxVE/pull/17126))
+
+## 2026-09-08
+
+### 🆕 New Scripts
+
+  - Decypharr ([#17108](https://github.com/community-scripts/ProxmoxVE/pull/17108))
+- Stash ([#17106](https://github.com/community-scripts/ProxmoxVE/pull/17106))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Update Jellyfin FFmpeg dependency to version 8 [@MickLesk](https://github.com/MickLesk) ([#17109](https://github.com/community-scripts/ProxmoxVE/pull/17109))
+
+### 💾 Core
+
+  - Treat a cut-short forge response as a failure, not as HTTP 200 [@MickLesk](https://github.com/MickLesk) ([core#31](https://github.com/community-scripts/core/pull/31))
+- Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#28](https://github.com/community-scripts/core/pull/28))
+- cloud-init: drop the "configure in Proxmox UI" hint [@MickLesk](https://github.com/MickLesk) ([core#30](https://github.com/community-scripts/core/pull/30))
+- Survive an empty /usr/bin/update instead of aborting the run [@MickLesk](https://github.com/MickLesk) ([core#29](https://github.com/community-scripts/core/pull/29))
+
+## 2026-09-07
+
+### 🆕 New Scripts
+
+  - Chatwoot ([#17095](https://github.com/community-scripts/ProxmoxVE/pull/17095))
+- whisparr-eros ([#17094](https://github.com/community-scripts/ProxmoxVE/pull/17094))
+- Matter-Hub ([#17093](https://github.com/community-scripts/ProxmoxVE/pull/17093))
+- Journiv ([#17092](https://github.com/community-scripts/ProxmoxVE/pull/17092))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - kaneo: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17086](https://github.com/community-scripts/ProxmoxVE/pull/17086))
+    - iobroker: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17085](https://github.com/community-scripts/ProxmoxVE/pull/17085))
+    - reactive-resume: repair any wrong WorkingDirectory on update [@MickLesk](https://github.com/MickLesk) ([#17068](https://github.com/community-scripts/ProxmoxVE/pull/17068))
+    - mediamtx: keep mediamtx.yml across updates [@MickLesk](https://github.com/MickLesk) ([#17069](https://github.com/community-scripts/ProxmoxVE/pull/17069))
+    - omnitools: allow remote action while npm ci [@MickLesk](https://github.com/MickLesk) ([#17070](https://github.com/community-scripts/ProxmoxVE/pull/17070))
+
+  - #### ✨ New Features
+
+    - netboot-xyz: add Secure Boot and Legacy assets [@MickLesk](https://github.com/MickLesk) ([#17066](https://github.com/community-scripts/ProxmoxVE/pull/17066))
+
+  - #### 🔧 Refactor
+
+    - flatnotes: follow upstream move to uv and Python 3.13 [@MickLesk](https://github.com/MickLesk) ([#17090](https://github.com/community-scripts/ProxmoxVE/pull/17090))
+    - heimdall: set up PHP 8.4 on update, keep only the database, run migrations [@MickLesk](https://github.com/MickLesk) ([#17067](https://github.com/community-scripts/ProxmoxVE/pull/17067))
+
+### 📂 Github
+
+  - github: Open per-script Node bump PRs [@MickLesk](https://github.com/MickLesk) ([#17065](https://github.com/community-scripts/ProxmoxVE/pull/17065))
+
+## 2026-09-06
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Fix Sonarqube update script to add +x on sonar.sh [@jarihu](https://github.com/jarihu) ([#17056](https://github.com/community-scripts/ProxmoxVE/pull/17056))
+
 ## 2026-09-05
 
 ### 🚀 Updated Scripts

.github/pull_request_template.md

@@ -14,6 +14,9 @@ Fixes #
 - [ ] **Tested thoroughly** – Changes work as expected.
 - [ ] **No security risks** – No hardcoded secrets, unnecessary privilege escalations, or permission issues.
 
+**Tested on:** <!-- e.g. PVE 9.2 / Debian 13 / fresh install + update. Write "not tested" if you could not run it. -->
+
+
 ---
 
 ## 🤖 AI Assistance (**X** in brackets)

.github/workflows/close-new-script-prs.yml

@@ -28,6 +28,7 @@ jobs:
             const allowedBots = [
               "push-app-to-main[bot]",
               "push-app-to-main",
+              "community-scripts-pr-app[bot]",
               "community-scripts-pr-app"
             ];
 
@@ -62,7 +63,9 @@ jobs:
                 per_page: 100,
               });
               hasAddedScriptFile = files.some(
-                f => f.status === "added" && scriptPrefixes.some(p => f.filename.startsWith(p))
+                f => f.status === "added" &&
+                     !f.filename.includes("/headers/") &&
+                     scriptPrefixes.some(p => f.filename.startsWith(p))
               );
             } catch (error) {
               core.warning(`Could not list files for PR #${prNumber}: ${error.message}`);

.github/workflows/pocketbase-bot.yml

@@ -26,6 +26,7 @@ jobs:
           COMMENT_BODY: ${{ github.event.comment.body }}
           COMMENT_ID: ${{ github.event.comment.id }}
           ISSUE_NUMBER: ${{ github.event.issue.number }}
+          IS_PR_COMMENT: ${{ github.event.issue.pull_request && 'true' || 'false' }}
           REPO_OWNER: ${{ github.repository_owner }}
           REPO_NAME: ${{ github.event.repository.name }}
           ACTOR: ${{ github.event.comment.user.login }}
@@ -84,6 +85,7 @@ jobs:
             const owner = process.env.REPO_OWNER;
             const repo = process.env.REPO_NAME;
             const issueNumber = parseInt(process.env.ISSUE_NUMBER, 10);
+            const isPrComment = process.env.IS_PR_COMMENT === 'true';
             const commentId = parseInt(process.env.COMMENT_ID, 10);
             const actor = process.env.ACTOR;
 
@@ -216,11 +218,22 @@ jobs:
 
               const prTitle = 'chore(ct): sync ' + slugValue + ' defaults with PocketBase';
               const prBody =
-                '## Summary\n' +
+                '## ✍️ Description\n\n' +
-                '- Sync default CT variables for `' + slugValue + '` after `/pocketbase` update.\n' +
+                'Sync of the default CT variables for `' + slugValue + '` after a `/pocketbase` update by @' + actor + '.\n\n' +
-                '- Updated vars: `' + updateResult.updatedVars.join('`, `') + '`.\n\n' +
+                'Updated: `' + updateResult.updatedVars.join('`, `') + '`\n\n' +
-                '## Source\n' +
+                '## 🔗 Related Issue\n\n' +
-                '- Triggered by @' + actor + ' via PocketBase bot.\n';
+                (isPrComment ? 'Triggered from #' : 'Fixes #') + issueNumber + '\n\n' +
+                '## ✅ Prerequisites (**X** in brackets)\n\n' +
+                '- [x] **Self-review completed** – Code follows project standards.\n' +
+                '- [ ] **Tested thoroughly** – Changes work as expected.\n' +
+                '- [x] **No security risks** – No hardcoded secrets, unnecessary privilege escalations, or permission issues.\n\n' +
+                '**Tested on:** not tested — generated from the PocketBase record, only `var_` defaults changed.\n\n' +
+                '---\n\n' +
+                '## 🤖 AI Assistance (**X** in brackets)\n\n' +
+                '- [x] **No AI used** – Scripts were written without AI assistance.\n\n' +
+                '---\n\n' +
+                '## 🛠️ Type of Change (**X** in brackets)\n\n' +
+                '- [x] 🐞 **Bug fix** – Resolves an issue without breaking functionality.\n';
               const createPrRes = await ghRequest('/repos/' + owner + '/' + repo + '/pulls', 'POST', {
                 title: prTitle,
                 body: prBody,
@@ -335,7 +348,10 @@ jobs:
               '`architectures` (amd64,arm64) `platforms` (pve,incus) ' +
               '`execute_in` (pve,lxc,pbs,vm,pmg,pdm) `categories` (names or ids) ' +
               '`type` (ct, vm, addon, …) ' +
-              '`is_disabled` `disable_message` `is_deleted` `deleted_message`\n\n' +
+              '`is_disabled` `disable_message` `is_deleted` `deleted_message` ' +
+              '`pin_reason` `last_update_commit`\n\n' +
+              'The `var_` names from the ct scripts work too: `var_cpu` `var_ram` `var_disk`\n' +
+              '`var_os` `var_version` `var_port` `var_tags` `var_unprivileged`\n\n' +
               '**Screenshots:**\n' +
               '```\n' +
               '/pocketbase <slug> screenshot https://example.com/one.png https://example.com/two.png\n' +
@@ -399,6 +415,14 @@ jobs:
 
             // ── Shared helpers ─────────────────────────────────────────────────
 
+            // The ct scripts name these var_cpu/var_ram/var_disk, and that is what
+            // people type. Accept them for the PocketBase keys.
+            const KEY_ALIASES = {
+              var_cpu: 'cpu', var_ram: 'ram', var_disk: 'hdd', var_hdd: 'hdd',
+              var_os: 'os', var_version: 'version', var_unprivileged: 'unprivileged',
+              var_port: 'port', var_tags: 'tags', disk: 'hdd', memory: 'ram',
+            };
+
             // Key=value parser: handles unquoted and "quoted" values
             function parseKVPairs(str) {
               const fields = {};
@@ -426,7 +450,7 @@ jobs:
                   while (pos < str.length && !/\s/.test(str[pos])) pos++;
                   value = str.substring(valStart, pos);
                 }
-                fields[key] = value;
+                fields[KEY_ALIASES[key.toLowerCase()] || key] = value;
               }
               return fields;
             }
@@ -982,6 +1006,8 @@ jobs:
                 disable_message:  'string',
                 is_deleted:       'boolean',
                 deleted_message:  'string',
+                pin_reason:       'string',
+                last_update_commit: 'string',
               };
 
               const parsedFields = parseKVPairs(rest);

CHANGELOG.md

@@ -101,6 +101,9 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 
 
+
+
+
 
 
 
@@ -114,7 +117,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 
 <details>
-<summary><h4>September (5 entries)</h4></summary>
+<summary><h4>September (12 entries)</h4></summary>
 
 [View September 2026 Changelog](.github/changelogs/2026/09.md)
 
@@ -540,6 +543,244 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-09-18
+
+### 🆕 New Scripts
+
+  - Almalinux-VM ([#17349](https://github.com/community-scripts/ProxmoxVE/pull/17349))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - crafty-controller: chown after restore_backup so restored data keeps ownership [@MickLesk](https://github.com/MickLesk) ([#17348](https://github.com/community-scripts/ProxmoxVE/pull/17348))
+    - databasus, domain-monitor, poznote: chown after restore_backup so restored data keeps its owner [@MickLesk](https://github.com/MickLesk) ([#17350](https://github.com/community-scripts/ProxmoxVE/pull/17350))
+    - alpine-vm: ask for the Cloud-Init credentials [@MickLesk](https://github.com/MickLesk) ([#17355](https://github.com/community-scripts/ProxmoxVE/pull/17355))
+    - suggestarr: keep the data where the app actually reads it [@MickLesk](https://github.com/MickLesk) ([#17317](https://github.com/community-scripts/ProxmoxVE/pull/17317))
+    - immichframe: set the admin password the new admin UI requires [@MickLesk](https://github.com/MickLesk) ([#17315](https://github.com/community-scripts/ProxmoxVE/pull/17315))
+
+  - #### ✨ New Features
+
+    - pangolin: Bump to 1.23.0 [@MickLesk](https://github.com/MickLesk) ([#17343](https://github.com/community-scripts/ProxmoxVE/pull/17343))
+
+  - #### 🔧 Refactor
+
+    - Refactor: Oxicloud [@MickLesk](https://github.com/MickLesk) ([#17338](https://github.com/community-scripts/ProxmoxVE/pull/17338))
+
+### 💾 Core
+
+  - Stop a modified conffile from aborting the whole update [@MickLesk](https://github.com/MickLesk) ([core#47](https://github.com/community-scripts/core/pull/47))
+- Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#46](https://github.com/community-scripts/core/pull/46))
+- github api: retry a 200 that is not a usable release payload [@MickLesk](https://github.com/MickLesk) ([core#45](https://github.com/community-scripts/core/pull/45))
+
+## 2026-09-17
+
+### 🆕 New Scripts
+
+  - Alpine-VM ([#17324](https://github.com/community-scripts/ProxmoxVE/pull/17324))
+- Allstarlink ([#17321](https://github.com/community-scripts/ProxmoxVE/pull/17321))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - changedetection: update: various fixes [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17331](https://github.com/community-scripts/ProxmoxVE/pull/17331))
+    - sparkyfitness: run the Better Auth migration during the update [@MickLesk](https://github.com/MickLesk) ([#17318](https://github.com/community-scripts/ProxmoxVE/pull/17318))
+    - poznote: follow init.sh into docker/ [@MickLesk](https://github.com/MickLesk) ([#17316](https://github.com/community-scripts/ProxmoxVE/pull/17316))
+
+  - #### ✨ New Features
+
+    - romm: make the library paths follow ROMM_BASE_PATH [@MickLesk](https://github.com/MickLesk) ([#17279](https://github.com/community-scripts/ProxmoxVE/pull/17279))
+    - Debian-VM: Refactor | Support Debian 11, 12, 13 [@MickLesk](https://github.com/MickLesk) ([#17325](https://github.com/community-scripts/ProxmoxVE/pull/17325))
+
+### 💾 Core
+
+  - Ask before replacing a cached image that no longer matches [@MickLesk](https://github.com/MickLesk) ([core#44](https://github.com/community-scripts/core/pull/44))
+
+## 2026-09-16
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Immich: Pin to v3.2.2 [@vhsdream](https://github.com/vhsdream) ([#17307](https://github.com/community-scripts/ProxmoxVE/pull/17307))
+    - Dispatcharr: Bump to 4G RAM [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17302](https://github.com/community-scripts/ProxmoxVE/pull/17302))
+    - navidrome: repair root-owned data folders left by 0.61.x [@MickLesk](https://github.com/MickLesk) ([#17275](https://github.com/community-scripts/ProxmoxVE/pull/17275))
+    - tor-snowflake: read the Go version from the module root [@MickLesk](https://github.com/MickLesk) ([#17276](https://github.com/community-scripts/ProxmoxVE/pull/17276))
+    - docmost: stop corepack asking for confirmation during the build [@MickLesk](https://github.com/MickLesk) ([#17282](https://github.com/community-scripts/ProxmoxVE/pull/17282))
+
+  - #### ✨ New Features
+
+    - Refactor: TrueNAS VM (core / improve functions / performance) [@MickLesk](https://github.com/MickLesk) ([#17277](https://github.com/community-scripts/ProxmoxVE/pull/17277))
+    - Frigate: Bump to 0.18.0 [@MickLesk](https://github.com/MickLesk) ([#17273](https://github.com/community-scripts/ProxmoxVE/pull/17273))
+    - Refactor: HomeAssistant-OS (core / improve functions / performance) [@MickLesk](https://github.com/MickLesk) ([#17281](https://github.com/community-scripts/ProxmoxVE/pull/17281))
+
+### 💾 Core
+
+  - Read the IGC version compute-runtime pins, instead of taking the newest [@MickLesk](https://github.com/MickLesk) ([core#43](https://github.com/community-scripts/core/pull/43))
+- Install the Intel driver dependency before the .deb that needs it [@MickLesk](https://github.com/MickLesk) ([core#42](https://github.com/community-scripts/core/pull/42))
+
+### 📚 Documentation
+
+  - pocketbase-bot: accept the var_ names and two missing fields [@MickLesk](https://github.com/MickLesk) ([#17305](https://github.com/community-scripts/ProxmoxVE/pull/17305))
+
+## 2026-09-15
+
+### 🆕 New Scripts
+
+  - valhalla ([#17231](https://github.com/community-scripts/ProxmoxVE/pull/17231))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - borg-ui: missing dependency `sshpass` [@christian-forgacs](https://github.com/christian-forgacs) ([#17286](https://github.com/community-scripts/ProxmoxVE/pull/17286))
+    - tracearr: copy packages/emails into the deploy tree [@connorgallopo](https://github.com/connorgallopo) ([#17268](https://github.com/community-scripts/ProxmoxVE/pull/17268))
+    - Immich: Pin to v3.2.1 [@vhsdream](https://github.com/vhsdream) ([#17264](https://github.com/community-scripts/ProxmoxVE/pull/17264))
+
+### 💾 Core
+
+  - Add vm_extract_image, which two VM scripts already call [@MickLesk](https://github.com/MickLesk) ([core#40](https://github.com/community-scripts/core/pull/40))
+- Releases: rank releases on their numbers, not on sort -V over the raw tag [@MickLesk](https://github.com/MickLesk) ([core#39](https://github.com/community-scripts/core/pull/39))
+
+### 🧰 Tools
+
+  - #### 🔧 Refactor
+
+    - Refactor: monitor-all (decide on flag values, not on key presence) [@MickLesk](https://github.com/MickLesk) ([#17261](https://github.com/community-scripts/ProxmoxVE/pull/17261))
+
+## 2026-09-14
+
+### 🆕 New Scripts
+
+  - Borg-UI ([#17258](https://github.com/community-scripts/ProxmoxVE/pull/17258))
+
+### 🚀 Updated Scripts
+
+  - SparkyFitness: substitute NGINX_RATE_LIMIT in nginx config [@RafBorrelli](https://github.com/RafBorrelli) ([#17256](https://github.com/community-scripts/ProxmoxVE/pull/17256))
+
+  - #### 🐞 Bug Fixes
+
+    - spliit: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17250](https://github.com/community-scripts/ProxmoxVE/pull/17250))
+
+## 2026-09-13
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Downgrade iobroker to Node 24 [@Copilot](https://github.com/Copilot) ([#17229](https://github.com/community-scripts/ProxmoxVE/pull/17229))
+
+### 💾 Core
+
+  - Pick the highest release version, not the newest published one [@MickLesk](https://github.com/MickLesk) ([core#38](https://github.com/community-scripts/core/pull/38))
+
+## 2026-09-12
+
+### 🆕 New Scripts
+
+  - Elasticsearch ([#17188](https://github.com/community-scripts/ProxmoxVE/pull/17188))
+- Hammer ([#17189](https://github.com/community-scripts/ProxmoxVE/pull/17189))
+- gotenberg ([#17205](https://github.com/community-scripts/ProxmoxVE/pull/17205))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(dispatcharr): add comskip installation and build dependencies [@eXistC](https://github.com/eXistC) ([#16224](https://github.com/community-scripts/ProxmoxVE/pull/16224))
+    - poznote: serve from src/public docroot [@MickLesk](https://github.com/MickLesk) ([#17187](https://github.com/community-scripts/ProxmoxVE/pull/17187))
+    - calibre-web: use calibreweb release identifier to avoid version file collision [@MickLesk](https://github.com/MickLesk) ([#17186](https://github.com/community-scripts/ProxmoxVE/pull/17186))
+
+  - #### ✨ New Features
+
+    - Docker VM: Feature Bump - Refactor script for improved functionality [@MickLesk](https://github.com/MickLesk) ([#17216](https://github.com/community-scripts/ProxmoxVE/pull/17216))
+    - feat(jitsi-meet): optional public setup (FQDN, Let's Encrypt, NAT, secure domain) [@klanghans](https://github.com/klanghans) ([#17132](https://github.com/community-scripts/ProxmoxVE/pull/17132))
+
+  - #### 🔧 Refactor
+
+    - Paperless-NGX: add --no-sync to uv run services [@MickLesk](https://github.com/MickLesk) ([#17210](https://github.com/community-scripts/ProxmoxVE/pull/17210))
+
+### 💾 Core
+
+  - VM's: show the selected CPU model instead of doubling it [@MickLesk](https://github.com/MickLesk) ([core#37](https://github.com/community-scripts/core/pull/37))
+- Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#36](https://github.com/community-scripts/core/pull/36))
+
+## 2026-09-11
+
+### 🆕 New Scripts
+
+  - Lemonade-Server ([#17190](https://github.com/community-scripts/ProxmoxVE/pull/17190))
+- OneTimeSecret ([#17097](https://github.com/community-scripts/ProxmoxVE/pull/17097))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - update authentik to 2026.8.2 [@thieneret](https://github.com/thieneret) ([#17198](https://github.com/community-scripts/ProxmoxVE/pull/17198))
+    - passwordpusher: restore data before running migrations [@MickLesk](https://github.com/MickLesk) ([#17141](https://github.com/community-scripts/ProxmoxVE/pull/17141))
+    - paperclip: install the rust toolchain needed by the runner build [@MickLesk](https://github.com/MickLesk) ([#17142](https://github.com/community-scripts/ProxmoxVE/pull/17142))
+    - homepage: run next directly instead of through pnpm [@MickLesk](https://github.com/MickLesk) ([#17155](https://github.com/community-scripts/ProxmoxVE/pull/17155))
+    - changedetection: fix: pin browserless [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17163](https://github.com/community-scripts/ProxmoxVE/pull/17163))
+
+### 💾 Core
+
+  - #### 🐞 Bug Fixes
+
+    - core.func: fall back to a usable HOME when the shell has none [@MickLesk](https://github.com/MickLesk) ([#17154](https://github.com/community-scripts/ProxmoxVE/pull/17154))
+
+### 🧰 Tools
+
+  - Dockhand ([#17191](https://github.com/community-scripts/ProxmoxVE/pull/17191))
+
+  - #### 🐞 Bug Fixes
+
+    - update-apps: rewrite the retired Gitea base in every container before updating it [@MickLesk](https://github.com/MickLesk) ([#17156](https://github.com/community-scripts/ProxmoxVE/pull/17156))
+
+  - #### 🔧 Refactor
+
+    - Rename lxc-delete.sh to guest-delete.sh [@MickLesk](https://github.com/MickLesk) ([#17152](https://github.com/community-scripts/ProxmoxVE/pull/17152))
+
+### 📚 Documentation
+
+  - issue template: add PVE release, execution context and phase; refresh distro list / pve versions [@MickLesk](https://github.com/MickLesk) ([#17160](https://github.com/community-scripts/ProxmoxVE/pull/17160))
+
+## 2026-09-10
+
+### 🆕 New Scripts
+
+  - Chevereto ([#17131](https://github.com/community-scripts/ProxmoxVE/pull/17131))
+- Portabase ([#17111](https://github.com/community-scripts/ProxmoxVE/pull/17111))
+- Logseq ([#17112](https://github.com/community-scripts/ProxmoxVE/pull/17112))
+- Safebucket ([#17096](https://github.com/community-scripts/ProxmoxVE/pull/17096))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Immich v3.2.0 [@vhsdream](https://github.com/vhsdream) ([#17137](https://github.com/community-scripts/ProxmoxVE/pull/17137))
+    - fix(solidtime): prevent composer install from hanging on root prompt [@supersoju](https://github.com/supersoju) ([#17146](https://github.com/community-scripts/ProxmoxVE/pull/17146))
+    - fix(hermesagent): wait for root gateway cleanup [@steveonjava](https://github.com/steveonjava) ([#17147](https://github.com/community-scripts/ProxmoxVE/pull/17147))
+
+### 💾 Core
+
+  - Keep the script name when regenerating the entrypoint [@MickLesk](https://github.com/MickLesk) ([core#35](https://github.com/community-scripts/core/pull/35))
+- Rewrite the dead Gitea base onto GitHub instead of failing the update [@MickLesk](https://github.com/MickLesk) ([core#33](https://github.com/community-scripts/core/pull/33))
+- core.func: fall back to a usable HOME when the shell has none [@MickLesk](https://github.com/MickLesk) ([core#32](https://github.com/community-scripts/core/pull/32))
+
+## 2026-09-09
+
+### 🆕 New Scripts
+
+  - Lingarr ([#17130](https://github.com/community-scripts/ProxmoxVE/pull/17130))
+
+### 🚀 Updated Scripts
+
+  - vm: drop the discussions link from the summary [@MickLesk](https://github.com/MickLesk) ([#17117](https://github.com/community-scripts/ProxmoxVE/pull/17117))
+
+  - #### 🐞 Bug Fixes
+
+    - fix(hermesagent): stop spurious root gateway after update [@steveonjava](https://github.com/steveonjava) ([#17126](https://github.com/community-scripts/ProxmoxVE/pull/17126))
+
 ## 2026-09-08
 
 ### 🆕 New Scripts
@@ -1081,142 +1322,3 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
     - Refactor: PowerDNS move poweradmin database outside the web root [@MickLesk](https://github.com/MickLesk) ([#16476](https://github.com/community-scripts/ProxmoxVE/pull/16476))
     - paperless-ngx: run services with uv --no-sync to avoid startup network dependency [@MickLesk](https://github.com/MickLesk) ([#16479](https://github.com/community-scripts/ProxmoxVE/pull/16479))
-
-## 2026-08-13
-
-### 🆕 New Scripts
-
-  - SuggestArr ([#16449](https://github.com/community-scripts/ProxmoxVE/pull/16449))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - fix(stirling-pdf): LibreOffice listener collides with unoserver on UNO port 2002, burning a core [@angusmaul](https://github.com/angusmaul) ([#16460](https://github.com/community-scripts/ProxmoxVE/pull/16460))
-    - fix(reitti): enable SNI for tile cache [@kylemd](https://github.com/kylemd) ([#16463](https://github.com/community-scripts/ProxmoxVE/pull/16463))
-    - [wanderer] refactor [@johanngrobe](https://github.com/johanngrobe) ([#16448](https://github.com/community-scripts/ProxmoxVE/pull/16448))
-
-  - #### ✨ New Features
-
-    - feat: Update koillection-install.sh to support API usage [@Crazy-Duck](https://github.com/Crazy-Duck) ([#16425](https://github.com/community-scripts/ProxmoxVE/pull/16425))
-
-## 2026-08-12
-
-### 🆕 New Scripts
-
-  - Stalwart ([#16388](https://github.com/community-scripts/ProxmoxVE/pull/16388))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - networkoptimizer: mitigate dotnet publish hang in LXC [@MickLesk](https://github.com/MickLesk) ([#16436](https://github.com/community-scripts/ProxmoxVE/pull/16436))
-    - lazylibrarian: reinstall deps after git pull on update [@MickLesk](https://github.com/MickLesk) ([#16435](https://github.com/community-scripts/ProxmoxVE/pull/16435))
-    - wanderer: fix deprecated meilisearch upgrade flag [@MickLesk](https://github.com/MickLesk) ([#16434](https://github.com/community-scripts/ProxmoxVE/pull/16434))
-    - calibre-web: fix release asset filename pattern [@MickLesk](https://github.com/MickLesk) ([#16433](https://github.com/community-scripts/ProxmoxVE/pull/16433))
-    - fix(stirling-pdf): unoserver installed into the venv, and login mode truncates .env [@angusmaul](https://github.com/angusmaul) ([#16439](https://github.com/community-scripts/ProxmoxVE/pull/16439))
-    - fix(pulse): keep the container recoverable when an update fails [@rcourtman](https://github.com/rcourtman) ([#16311](https://github.com/community-scripts/ProxmoxVE/pull/16311))
-
-  - #### 🔧 Refactor
-
-    - ConvertX: add some new dependencies [@MickLesk](https://github.com/MickLesk) ([#16437](https://github.com/community-scripts/ProxmoxVE/pull/16437))
-
-## 2026-08-11
-
-### 🚀 Updated Scripts
-
-  - Update source URL for Reactive Resume [@MickLesk](https://github.com/MickLesk) ([#16407](https://github.com/community-scripts/ProxmoxVE/pull/16407))
-
-  - #### 🐞 Bug Fixes
-
-    - Pelican-Panel: add php artisan p:environment:database [@MickLesk](https://github.com/MickLesk) ([#16397](https://github.com/community-scripts/ProxmoxVE/pull/16397))
-    - outline: fix URL sed matching wrong line in .env.sample // refactor .env generation [@MickLesk](https://github.com/MickLesk) ([#16408](https://github.com/community-scripts/ProxmoxVE/pull/16408))
-    - paperless-ngx: reindex Tantivy search index on webserver start [@MickLesk](https://github.com/MickLesk) ([#16395](https://github.com/community-scripts/ProxmoxVE/pull/16395))
-    - karakeep: pin Node.js to 22 LTS, avoid Node 24.19 better-sqlite3 crash [@MickLesk](https://github.com/MickLesk) ([#16396](https://github.com/community-scripts/ProxmoxVE/pull/16396))
-
-  - #### ✨ New Features
-
-    - Open WebUI: add optional OpenTelemetry package install [@irishpadres](https://github.com/irishpadres) ([#16415](https://github.com/community-scripts/ProxmoxVE/pull/16415))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - fix(add-tailscale-lxc): stop spinner before whiptail menu [@halcycon](https://github.com/halcycon) ([#16402](https://github.com/community-scripts/ProxmoxVE/pull/16402))
-
-  - #### 🔧 Refactor
-
-    - arcane: fix projects/builds dir ownership for non-root container UID [@MickLesk](https://github.com/MickLesk) ([#16411](https://github.com/community-scripts/ProxmoxVE/pull/16411))
-
-## 2026-08-10
-
-### 🆕 New Scripts
-
-  - GitLab ([#16386](https://github.com/community-scripts/ProxmoxVE/pull/16386))
-- TeslaMate ([#16385](https://github.com/community-scripts/ProxmoxVE/pull/16385))
-- tor-snowflake ([#15684](https://github.com/community-scripts/ProxmoxVE/pull/15684))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - ErsatzTV: update ffmpeg to 8.1 version [@MickLesk](https://github.com/MickLesk) ([#16383](https://github.com/community-scripts/ProxmoxVE/pull/16383))
-
-### 🧰 Tools
-
-  - post-pdm-install ([#16368](https://github.com/community-scripts/ProxmoxVE/pull/16368))
-
-## 2026-08-09
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Fix: CouchDB Erlang cookie breaks vm.args (use hex) [@fudianchn](https://github.com/fudianchn) ([#16361](https://github.com/community-scripts/ProxmoxVE/pull/16361))
-    - SparkyFitness: Install Git for frontend builds [@MickLesk](https://github.com/MickLesk) ([#16352](https://github.com/community-scripts/ProxmoxVE/pull/16352))
-    - Byparr: Use invisible-playwright browser setup [@MickLesk](https://github.com/MickLesk) ([#16353](https://github.com/community-scripts/ProxmoxVE/pull/16353))
-    - Crafty Controller: Restore ownership after updates [@MickLesk](https://github.com/MickLesk) ([#16354](https://github.com/community-scripts/ProxmoxVE/pull/16354))
-    - Webtrees: Fix schema check in silent mode [@MickLesk](https://github.com/MickLesk) ([#16355](https://github.com/community-scripts/ProxmoxVE/pull/16355))
-    - SigNoz: Allow legacy metadata schema on ClickHouse 26 [@MickLesk](https://github.com/MickLesk) ([#16356](https://github.com/community-scripts/ProxmoxVE/pull/16356))
-
-### 🧰 Tools
-
-  - #### ✨ New Features
-
-    - Portainer: Update existing CE and BE installations [@MickLesk](https://github.com/MickLesk) ([#16357](https://github.com/community-scripts/ProxmoxVE/pull/16357))
-
-### 📚 Documentation
-
-  - github: update Star History links and image sources [@MickLesk](https://github.com/MickLesk) ([#16367](https://github.com/community-scripts/ProxmoxVE/pull/16367))
-
-## 2026-08-08
-
-### 🆕 New Scripts
-
-  - Ignis ([#16330](https://github.com/community-scripts/ProxmoxVE/pull/16330))
-
-### 💾 Core
-
-  - #### ✨ New Features
-
-    - core - setup_nodejs: bypass npm allowScripts policy globally on npm >=11 [@MickLesk](https://github.com/MickLesk) ([#16280](https://github.com/community-scripts/ProxmoxVE/pull/16280))
-
-## 2026-08-07
-
-### 🆕 New Scripts
-
-  - NetworkOptimizer ([#16328](https://github.com/community-scripts/ProxmoxVE/pull/16328))
-- Orb ([#16329](https://github.com/community-scripts/ProxmoxVE/pull/16329))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - HortusFox: start applying db migrations [@tomfrenzel](https://github.com/tomfrenzel) ([#16324](https://github.com/community-scripts/ProxmoxVE/pull/16324))
-    - Docker: report container updates instead of prompting, stop auto-updating Portainer Agent, fix addon detection of legacy Portainer [@MickLesk](https://github.com/MickLesk) ([#16298](https://github.com/community-scripts/ProxmoxVE/pull/16298))
-    - Immich: retry mise install on transient npm download failures [@MickLesk](https://github.com/MickLesk) ([#16301](https://github.com/community-scripts/ProxmoxVE/pull/16301))
-    - changedetection: remove msttcorefonts to fix install hang [@austinpilz](https://github.com/austinpilz) ([#16319](https://github.com/community-scripts/ProxmoxVE/pull/16319))
-
-  - #### 🔧 Refactor
-
-    - core: extend new vars and pocketbase values [@MickLesk](https://github.com/MickLesk) ([#16313](https://github.com/community-scripts/ProxmoxVE/pull/16313))

ct/authentik.sh

@@ -49,7 +49,7 @@ function update_script() {
   RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
   setup_yq
 
-  AUTHENTIK_VERSION="version/2026.8.1"
+  AUTHENTIK_VERSION="version/2026.8.2"
   # Source: https://github.com/goauthentik/fips/blob/main/Makefile#L26
   XMLSEC_VERSION="1.3.12"
 
@@ -184,8 +184,12 @@ EOF
 
     msg_info "Updating services"
     sed -i 's/authentik Go Server (API Gateway)/authentik Server/g' /etc/systemd/system/authentik-server.service
-	  sed -i '/ExecStart=/i ExecStartPre=/usr/bin/mkdir -p "${TMPDIR}"' /etc/systemd/system/authentik-server.service
+    if ! grep -qF -- 'ExecStartPre=/usr/bin/mkdir -p "${TMPDIR}"' /etc/systemd/system/authentik-server.service; then
-    sed -i '/ExecStart=/i ExecStartPre=/usr/bin/mkdir -p "${TMPDIR}"' /etc/systemd/system/authentik-worker.service
+	    sed -i '/ExecStart=/i ExecStartPre=/usr/bin/mkdir -p "${TMPDIR}"' /etc/systemd/system/authentik-server.service
+    fi
+    if ! grep -qF -- 'ExecStartPre=/usr/bin/mkdir -p "${TMPDIR}"' /etc/systemd/system/authentik-worker.service; then
+      sed -i '/ExecStart=/i ExecStartPre=/usr/bin/mkdir -p "${TMPDIR}"' /etc/systemd/system/authentik-worker.service
+    fi
     systemctl daemon-reload
     msg_ok "Updated services"
 
@@ -224,8 +228,8 @@ for i in {1..10}; do
   sleep 1
 done
 $STD pct exec "$CTID" -- bash -c "mkdir -p /opt/authentik-data/{certs,media,geoip,templates}; \
-  cp /opt/authentik/tests/GeoLite2-ASN-Test.mmdb /opt/authentik-data/geoip/GeoLite2-ASN.mmdb; \
+  cp /opt/authentik/tests/geoip/GeoLite2-ASN-Test.mmdb /opt/authentik-data/geoip/GeoLite2-ASN.mmdb; \
-  cp /opt/authentik/tests/GeoLite2-City-Test.mmdb /opt/authentik-data/geoip/GeoLite2-City.mmdb; \
+  cp /opt/authentik/tests/geoip/GeoLite2-City-Test.mmdb /opt/authentik-data/geoip/GeoLite2-City.mmdb; \
   cp -r /opt/authentik/blueprints /opt/authentik-data/; \
   rm -r /opt/authentik/blueprints; \
   find /opt/authentik-data -path '*/lost+found' -prune -o -exec chown authentik:authentik {} +"

ct/borg-ui.sh

@@ -0,0 +1,121 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/karanhudia/borg-ui
+
+APP="Borg-UI"
+var_tags="${var_tags:-backup}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/borg-ui ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "borg-ui" "karanhudia/borg-ui"; then
+    msg_info "Stopping Service"
+    systemctl stop borg-ui
+    msg_ok "Stopped Service"
+
+    create_backup /opt/borg-ui/.env
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "borg-ui" "karanhudia/borg-ui" "tarball"
+
+    restore_backup
+
+    BORG_UI_VERSION=$(cat "$HOME/.borg-ui" 2>/dev/null)
+    if [[ -n "$BORG_UI_VERSION" ]]; then
+      if grep -q '^APP_VERSION=' /opt/borg-ui/.env; then
+        sed -i "s|^APP_VERSION=.*|APP_VERSION=${BORG_UI_VERSION}|" /opt/borg-ui/.env
+      else
+        echo "APP_VERSION=${BORG_UI_VERSION}" >>/opt/borg-ui/.env
+      fi
+    fi
+
+    # Only the three Borg pins appear in every release of this file; PYTHON_VERSION
+    # and RCLONE_VERSION were added upstream after v2.2.6, so both fall back.
+    RUNTIME_ENV="/opt/borg-ui/docker/runtime-base.env"
+    BORG1_VERSION=$(sed -n 's/^BORG1_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
+    BORG2_VERSION=$(sed -n 's/^BORG2_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
+    BORGSTORE_VERSION=$(sed -n 's/^BORGSTORE_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
+    RCLONE_VERSION=$(sed -n 's/^RCLONE_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
+    BORG_PYTHON=$(sed -n 's/^PYTHON_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
+    BORG_PYTHON="${BORG_PYTHON:-3.12}"
+    if [[ -z "$BORG1_VERSION" || -z "$BORG2_VERSION" || -z "$BORGSTORE_VERSION" ]]; then
+      msg_error "Could not read the pinned Borg versions from ${RUNTIME_ENV}"
+      exit 1
+    fi
+
+    if [[ "$(cat /opt/borg1-venv/.pinned_version 2>/dev/null)" != "$BORG1_VERSION" ]]; then
+      msg_info "Installing Borg ${BORG1_VERSION} (Patience)"
+      $STD uv venv --python "$BORG_PYTHON" /opt/borg1-venv
+      $STD uv pip install --python /opt/borg1-venv pyfuse3 "borgbackup==${BORG1_VERSION}"
+      echo "$BORG1_VERSION" >/opt/borg1-venv/.pinned_version
+      ln -sf /opt/borg1-venv/bin/borg /usr/local/bin/borg
+      msg_ok "Installed Borg ${BORG1_VERSION}"
+    fi
+
+    if [[ "$(cat /opt/borg2-venv/.pinned_version 2>/dev/null)" != "${BORG2_VERSION}-${BORGSTORE_VERSION}" ]]; then
+      msg_info "Installing Borg ${BORG2_VERSION} (Patience)"
+      $STD uv venv --python "$BORG_PYTHON" /opt/borg2-venv
+      $STD uv pip install --python /opt/borg2-venv pyfuse3 "borgbackup==${BORG2_VERSION}" "borgstore[rclone,sftp,rest,s3,blake3]==${BORGSTORE_VERSION}"
+      echo "${BORG2_VERSION}-${BORGSTORE_VERSION}" >/opt/borg2-venv/.pinned_version
+      ln -sf /opt/borg2-venv/bin/borg /usr/local/bin/borg2
+      msg_ok "Installed Borg ${BORG2_VERSION}"
+    fi
+
+    RCLONE_TAG="${RCLONE_VERSION:+v${RCLONE_VERSION}}"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "rclone" "rclone/rclone" "prebuild" "${RCLONE_TAG:-latest}" "/opt/rclone" "rclone-${RCLONE_TAG:-*}-linux-$(arch_resolve amd64 arm64).zip"
+    ln -sf /opt/rclone/rclone /usr/local/bin/rclone
+
+    msg_info "Building Frontend"
+    cd /opt/borg-ui/frontend
+    $STD npm ci
+    $STD npm run build
+    rm -rf /opt/borg-ui/app/static
+    mkdir -p /opt/borg-ui/app/static
+    cp -r /opt/borg-ui/frontend/build/* /opt/borg-ui/app/static/
+    msg_ok "Built Frontend"
+
+    msg_info "Updating Python Environment"
+    cd /opt/borg-ui
+    $STD uv venv --python "$BORG_PYTHON" /opt/borg-ui/.venv
+    $STD uv pip install --python /opt/borg-ui/.venv -r requirements.txt
+    msg_ok "Updated Python Environment"
+
+    msg_info "Starting Service"
+    systemctl start borg-ui
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8081${CL}"

ct/calibre-web.sh

@@ -32,14 +32,18 @@ function update_script() {
     exit
   fi
 
-  if check_for_gh_release "Calibre-Web" "janeczku/calibre-web"; then
+  if [[ -f /root/.calibre-web && ! -e /root/.calibreweb ]]; then
+    mv /root/.calibre-web /root/.calibreweb
+  fi
+
+  if check_for_gh_release "calibreweb" "janeczku/calibre-web"; then
     msg_info "Stopping Service"
     systemctl stop calibre-web
     msg_ok "Stopped Service"
 
     create_backup /opt/calibre-web/data
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Calibre-Web" "janeczku/calibre-web" "prebuild" "latest" "/opt/calibre-web" "calibreweb*.tar.gz"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "calibreweb" "janeczku/calibre-web" "prebuild" "latest" "/opt/calibre-web" "calibreweb*.tar.gz"
     setup_uv
 
     msg_info "Installing Dependencies"

ct/changedetection.sh

@@ -32,7 +32,18 @@ function update_script() {
     exit
   fi
 
-  ensure_dependencies libjpeg-dev
+  ensure_dependencies libjpeg-dev poppler-utils file locales
+
+  msg_info "Generating Locales"
+  for l in cs_CZ de_DE en_GB en_US es_ES fr_FR id_ID it_IT ja_JP ko_KR \
+    pl_PL pt_BR ru_RU tr_TR uk_UA zh_CN zh_TW; do
+    sed -i "s/^# *${l}.UTF-8 UTF-8/${l}.UTF-8 UTF-8/" /etc/locale.gen
+  done
+  $STD locale-gen
+  if ! grep -q "^LC_ALL=" /opt/changedetection/.env 2>/dev/null; then
+    echo "LC_ALL=en_US.UTF-8" >>/opt/changedetection/.env
+  fi
+  msg_ok "Generated Locales"
 
   NODE_VERSION="24" setup_nodejs
 
@@ -69,6 +80,7 @@ function update_script() {
     $STD git -C /opt/browserless/ reset --hard origin/main
     $STD npm update --prefix /opt/browserless
     $STD npm ci --include=optional --include=dev --prefix /opt/browserless
+    $STD npm install --save-exact playwright-core@1.62.1 --prefix /opt/browserless
     $STD /opt/browserless/node_modules/playwright-core/cli.js install --with-deps
     # Update Chrome separately, as it has to be done with the force option. Otherwise the installation of other browsers will not be done if Chrome is already installed.
     $STD /opt/browserless/node_modules/playwright-core/cli.js install --force chrome

ct/chevereto.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://chevereto.com/
+
+APP="Chevereto"
+var_tags="${var_tags:-image-hosting;gallery;media}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/chevereto ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "chevereto" "chevereto/chevereto"; then
+    PHP_FPM_SERVICE="$(basename "$(get_php_fpm_socket)" .sock)"
+
+    msg_info "Stopping Services"
+    systemctl stop nginx "$PHP_FPM_SERVICE"
+    msg_ok "Stopped Services"
+
+    create_backup /opt/chevereto/app/env.php \
+      /opt/chevereto/images \
+      /opt/chevereto/content
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "chevereto" "chevereto/chevereto" "tarball"
+
+    restore_backup
+
+    msg_info "Updating Chevereto"
+    cd /opt/chevereto/app
+    export COMPOSER_ALLOW_SUPERUSER=1
+    $STD composer install --no-dev --prefer-dist --no-interaction --optimize-autoloader
+    chown -R www-data:www-data /opt/chevereto
+    chmod -R 775 /opt/chevereto/images /opt/chevereto/content
+    msg_ok "Updated Chevereto"
+
+    msg_info "Starting Services"
+    systemctl start "$PHP_FPM_SERVICE" nginx
+    msg_ok "Started Services"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}${CL}"

ct/crafty-controller.sh

@@ -46,8 +46,8 @@ function update_script() {
 
     CLEAN_INSTALL=1 fetch_and_deploy_gl_release "Crafty-Controller" "crafty-controller/crafty-4" "tarball" "latest" "/opt/crafty-controller/crafty/crafty-4"
 
-    chown -R crafty:crafty /opt/crafty-controller
     restore_backup
+    chown -R crafty:crafty /opt/crafty-controller
 
     msg_info "Updating TemurinJDK"
     setup_java

ct/databasus.sh

@@ -87,10 +87,10 @@ function update_script() {
     mkdir -p /opt/databasus/ui/build
     cp -r /opt/databasus/frontend/dist/* /opt/databasus/ui/build/
     cp -r /opt/databasus/backend/migrations /opt/databasus/
-    chown -R postgres:postgres /opt/databasus
     msg_ok "Updated Databasus"
 
     restore_backup
+    chown -R postgres:postgres /opt/databasus
 
     if ! grep -q "EnvironmentFile=/.env" /etc/systemd/system/databasus.service; then
       msg_info "Updating Service"

ct/dispatcharr.sh

@@ -10,7 +10,7 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 APP="Dispatcharr"
 var_tags="${var_tags:-media;arr}"
 var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
+var_ram="${var_ram:-4096}"
 var_disk="${var_disk:-8}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
@@ -106,7 +106,18 @@ EOF
     msg_ok "Migrated Nginx Configuration"
   fi
 
-  ensure_dependencies vlc-bin vlc-plugin-base
+  ensure_dependencies vlc-bin vlc-plugin-base build-essential autoconf libtool libargtable2-dev libavformat-dev libsdl2-dev libswscale-dev
+
+  if ! command -v comskip &> /dev/null; then
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Comskip" "erikkaashoek/Comskip" "tarball"
+    msg_info "Compiling Comskip"
+    cd /opt/Comskip
+    $STD ./autogen.sh
+    $STD ./configure
+    $STD make
+    $STD make install
+    msg_ok "Compiled and Installed Comskip"
+  fi
 
   if check_for_gh_release "Dispatcharr" "Dispatcharr/Dispatcharr"; then
     msg_info "Stopping Services"

ct/docmost.sh

@@ -57,6 +57,7 @@ function update_script() {
 
     msg_info "Configuring Docmost"
     cd /opt/docmost
+    export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
     $STD pnpm install --force
     $STD pnpm build
     msg_ok "Configured Docmost"

ct/domain-monitor.sh

@@ -53,10 +53,10 @@ function update_script() {
     msg_info "Updating Domain Monitor"
     cd /opt/domain-monitor
     $STD composer install
-    chown -R www-data:www-data /opt/domain-monitor
     msg_ok "Updated Domain Monitor"
 
     restore_backup
+    chown -R www-data:www-data /opt/domain-monitor
 
     msg_info "Restarting Services"
     systemctl start apache2

ct/elasticsearch.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.elastic.co/elasticsearch
+
+APP="Elasticsearch"
+var_tags="${var_tags:-database;search}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-20}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /etc/elasticsearch/elasticsearch.yml ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  msg_info "Updating ${APP}"
+  $STD apt update
+  $STD apt install -y elasticsearch
+  msg_ok "Updated ${APP}"
+
+  msg_info "Restarting Service"
+  systemctl restart elasticsearch
+  msg_ok "Restarted Service"
+  msg_ok "Updated successfully!"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:9200${CL}"
+echo -e "${INFO}${YW}Set the password for the 'elastic' user:${CL}"
+echo -e "${TAB}${DEFAULT}${BGN}/usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic${CL}"

ct/frigate.sh

@@ -10,8 +10,8 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 APP="Frigate"
 var_tags="${var_tags:-nvr}"
 var_cpu="${var_cpu:-8}"
-var_ram="${var_ram:-4096}"
+var_ram="${var_ram:-6144}"
-var_disk="${var_disk:-20}"
+var_disk="${var_disk:-25}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-12}"
 var_arm64="${var_arm64:-no}"

ct/gotenberg.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: CrazyWolf13
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/gotenberg/gotenberg
+
+APP="Gotenberg"
+var_tags="${var_tags:-document;pdf}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-15}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /etc/systemd/system/gotenberg.service ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "gotenberg" "gotenberg/gotenberg"; then
+    msg_info "Stopping Service"
+    systemctl stop gotenberg
+    msg_ok "Stopped Service"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "gotenberg" "gotenberg/gotenberg" "tarball" "latest" "/opt/gotenberg"
+
+    GO_VERSION="$(awk '$1=="go"{print $2}' /opt/gotenberg/go.mod | cut -d. -f1,2)" setup_go
+
+    msg_info "Building gotenberg (Patience)"
+    cd /opt/gotenberg
+    export CGO_ENABLED=0
+    $STD go mod download
+    $STD go build -o /usr/local/bin/gotenberg \
+      -ldflags "-s -w -X 'github.com/gotenberg/gotenberg/v8/cmd.Version=$(cat ~/.gotenberg)'" \
+      cmd/gotenberg/main.go
+    msg_ok "Built gotenberg"
+
+    msg_info "Updating unoconverter"
+    UNOCONVERTER_VERSION=$(get_latest_github_release "gotenberg/unoconverter" "false")
+    download_file "https://raw.githubusercontent.com/gotenberg/unoconverter/${UNOCONVERTER_VERSION}/unoconv" /usr/local/bin/unoconverter
+    chmod +x /usr/local/bin/unoconverter
+    msg_ok "Updated unoconverter"
+
+    msg_info "Starting Service"
+    systemctl start gotenberg
+    msg_ok "Started Service"
+    msg_ok "Updated Successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Gotenberg is a stateless API and has no web interface.${CL}"
+echo -e "${INFO}${YW}Check the health endpoint using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3000/health${CL}"

ct/hammer.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Darkrock-Studios/hammer-editor
+
+APP="Hammer"
+var_tags="${var_tags:-writing;sync-server}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_unprivileged="${var_unprivileged:-1}"
+var_arm64="${var_arm64:-yes}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/hammer ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "hammer" "Darkrock-Studios/hammer-editor"; then
+    msg_info "Stopping Service"
+    systemctl stop hammer
+    msg_ok "Stopped Service"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "hammer" "Darkrock-Studios/hammer-editor" "prebuild" "latest" "/opt/hammer" "server.zip"
+    chmod +x /opt/hammer/bin/server
+
+    msg_info "Starting Service"
+    systemctl start hammer
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8080${CL}"

ct/headers/borg-ui

@@ -0,0 +1,6 @@
+    ____                         __  ______
+   / __ )____  _________ _      / / / /  _/
+  / __  / __ \/ ___/ __ `/_____/ / / // /  
+ / /_/ / /_/ / /  / /_/ /_____/ /_/ // /   
+/_____/\____/_/   \__, /      \____/___/   
+                 /____/                    

ct/headers/chevereto

@@ -0,0 +1,6 @@
+   ________                             __      
+  / ____/ /_  ___ _   _____  ________  / /_____ 
+ / /   / __ \/ _ \ | / / _ \/ ___/ _ \/ __/ __ \
+/ /___/ / / /  __/ |/ /  __/ /  /  __/ /_/ /_/ /
+\____/_/ /_/\___/|___/\___/_/   \___/\__/\____/ 
+                                                

ct/headers/elasticsearch

@@ -0,0 +1,6 @@
+    ________           __  _                                __  
+   / ____/ /___ ______/ /_(_)____________  ____ ___________/ /_ 
+  / __/ / / __ `/ ___/ __/ / ___/ ___/ _ \/ __ `/ ___/ ___/ __ \
+ / /___/ / /_/ (__  ) /_/ / /__(__  )  __/ /_/ / /  / /__/ / / /
+/_____/_/\__,_/____/\__/_/\___/____/\___/\__,_/_/   \___/_/ /_/ 
+                                                                

ct/headers/gotenberg

@@ -0,0 +1,6 @@
+   ______      __             __                   
+  / ____/___  / /____  ____  / /_  ___  _________ _
+ / / __/ __ \/ __/ _ \/ __ \/ __ \/ _ \/ ___/ __ `/
+/ /_/ / /_/ / /_/  __/ / / / /_/ /  __/ /  / /_/ / 
+\____/\____/\__/\___/_/ /_/_.___/\___/_/   \__, /  
+                                          /____/   

ct/headers/hammer

@@ -0,0 +1,6 @@
+    __  __                                   
+   / / / /___ _____ ___  ____ ___  ___  _____
+  / /_/ / __ `/ __ `__ \/ __ `__ \/ _ \/ ___/
+ / __  / /_/ / / / / / / / / / / /  __/ /    
+/_/ /_/\__,_/_/ /_/ /_/_/ /_/ /_/\___/_/     
+                                             

ct/headers/lemonade-server

@@ -0,0 +1,6 @@
+    __                                         __          _____                          
+   / /   ___  ____ ___  ____  ____  ____ _____/ /__       / ___/___  ______   _____  _____
+  / /   / _ \/ __ `__ \/ __ \/ __ \/ __ `/ __  / _ \______\__ \/ _ \/ ___/ | / / _ \/ ___/
+ / /___/  __/ / / / / / /_/ / / / / /_/ / /_/ /  __/_____/__/ /  __/ /   | |/ /  __/ /    
+/_____/\___/_/ /_/ /_/\____/_/ /_/\__,_/\__,_/\___/     /____/\___/_/    |___/\___/_/     
+                                                                                          

ct/headers/lingarr

@@ -0,0 +1,6 @@
+    __    _                            
+   / /   (_)___  ____ _____ ___________
+  / /   / / __ \/ __ `/ __ `/ ___/ ___/
+ / /___/ / / / / /_/ / /_/ / /  / /    
+/_____/_/_/ /_/\__, /\__,_/_/  /_/     
+              /____/                   

ct/headers/logseq

@@ -0,0 +1,6 @@
+    __                               
+   / /   ____  ____ _________  ____ _
+  / /   / __ \/ __ `/ ___/ _ \/ __ `/
+ / /___/ /_/ / /_/ (__  )  __/ /_/ / 
+/_____/\____/\__, /____/\___/\__, /  
+            /____/             /_/   

ct/headers/onetimesecret

@@ -0,0 +1,6 @@
+   ____           _______               _____                     __ 
+  / __ \____  ___/_  __(_)___ ___  ___ / ___/___  _____________  / /_
+ / / / / __ \/ _ \/ / / / __ `__ \/ _ \\__ \/ _ \/ ___/ ___/ _ \/ __/
+/ /_/ / / / /  __/ / / / / / / / /  __/__/ /  __/ /__/ /  /  __/ /_  
+\____/_/ /_/\___/_/ /_/_/ /_/ /_/\___/____/\___/\___/_/   \___/\__/  
+                                                                     

ct/headers/portabase

@@ -0,0 +1,6 @@
+    ____             __        __                  
+   / __ \____  _____/ /_____ _/ /_  ____ _________ 
+  / /_/ / __ \/ ___/ __/ __ `/ __ \/ __ `/ ___/ _ \
+ / ____/ /_/ / /  / /_/ /_/ / /_/ / /_/ (__  )  __/
+/_/    \____/_/   \__/\__,_/_.___/\__,_/____/\___/ 
+                                                   

ct/headers/safebucket

@@ -0,0 +1,6 @@
+   _____       ____     __               __        __ 
+  / ___/____ _/ __/__  / /_  __  _______/ /_____  / /_
+  \__ \/ __ `/ /_/ _ \/ __ \/ / / / ___/ //_/ _ \/ __/
+ ___/ / /_/ / __/  __/ /_/ / /_/ / /__/ ,< /  __/ /_  
+/____/\__,_/_/  \___/_.___/\__,_/\___/_/|_|\___/\__/  
+                                                      

ct/headers/valhalla

@@ -0,0 +1,6 @@
+ _    __      ____          ____     
+| |  / /___ _/ / /_  ____ _/ / /___ _
+| | / / __ `/ / __ \/ __ `/ / / __ `/
+| |/ / /_/ / / / / / /_/ / / / /_/ / 
+|___/\__,_/_/_/ /_/\__,_/_/_/\__,_/  
+                                     

ct/hermesagent.sh

@@ -52,6 +52,16 @@ function update_script() {
     set -a; source /etc/default/hermes; set +a
     /home/hermes/.local/bin/hermes update --yes
   '
+  # See https://github.com/community-scripts/ProxmoxVE/issues/17123
+  mapfile -t root_gateway_pids < <(ps -eo user=,pid=,args= | awk '$1 == "root" && $0 ~ /\/home\/hermes\/\.hermes\/hermes-agent\/venv\/bin\/python -m hermes_cli\.main gateway run --replace$/ { print $2 }')
+  if ((${#root_gateway_pids[@]})); then
+    kill -TERM "${root_gateway_pids[@]}"
+    for pid in "${root_gateway_pids[@]}"; do
+      while kill -0 "$pid" 2>/dev/null; do
+        sleep 0.1
+      done
+    done
+  fi
   chown -R hermes:hermes /home/hermes
   msg_ok "Updated Hermes Agent"
 

ct/homepage.sh

@@ -83,6 +83,10 @@ EOF
       sed -i '/^ExecStart=/i Environment=CI=true' /etc/systemd/system/homepage.service
       systemctl daemon-reload
     fi
+    if grep -q '^ExecStart=pnpm start' /etc/systemd/system/homepage.service; then
+      sed -i 's|^ExecStart=pnpm start$|ExecStart=/opt/homepage/node_modules/.bin/next start|' /etc/systemd/system/homepage.service
+      systemctl daemon-reload
+    fi
     msg_ok "Updated Homepage"
 
     msg_info "Starting service"

ct/immich.sh

@@ -112,7 +112,7 @@ EOF
     msg_ok "Image-processing libraries up to date"
   fi
 
-  RELEASE="v3.1.0"
+  RELEASE="v3.2.2"
   if check_for_gh_release "Immich" "immich-app/immich" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
     if [[ $(cat ~/.immich) > "2.5.1" ]]; then
       msg_info "Enabling Maintenance Mode"
@@ -187,11 +187,10 @@ EOF
     msg_info "Updating Immich web and microservices"
     cd "$SRC_DIR"/server
     # server build
-    export SHARP_IGNORE_GLOBAL_LIBVIPS=true
     $STD pnpm --filter @immich/sdk --filter @immich/plugin-sdk --filter immich build
-    unset SHARP_IGNORE_GLOBAL_LIBVIPS
-    export SHARP_FORCE_GLOBAL_LIBVIPS=true
     $STD pnpm --filter immich --prod --no-optional deploy "$APP_DIR"
+    export SHARP_FORCE_GLOBAL_LIBVIPS=true
+    $STD pnpm --dir "$APP_DIR/node_modules/sharp" exec npm run build
 
     # Patch helmet.json: disable upgrade-insecure-requests for HTTP access
     if [[ -f "$APP_DIR/helmet.json" ]]; then
@@ -205,7 +204,6 @@ EOF
     cd "$SRC_DIR"
     echo "packageImportMethod: hardlink" >>./pnpm-workspace.yaml
     unset SHARP_FORCE_GLOBAL_LIBVIPS
-    export SHARP_IGNORE_GLOBAL_LIBVIPS=true
     $STD pnpm --filter @immich/sdk --filter immich-web --filter @immich/cli build
     $STD pnpm --filter @immich/cli --prod --no-optional deploy "$APP_DIR"/cli
     cp -a web/build "$APP_DIR"/www

ct/immichframe.sh

@@ -79,6 +79,17 @@ function update_script() {
     restore_backup
     chown -R immichframe:immichframe /opt/immichframe
 
+    if ! grep -q '^Environment=IMMICHFRAME_ADMIN_PASSWORD=' /etc/systemd/system/immichframe.service; then
+      msg_info "Setting Admin Password"
+      ADMIN_PASSWORD=$(openssl rand -hex 16)
+      sed -i "/^Environment=DOTNET_CONTENTROOT=/a Environment=IMMICHFRAME_ADMIN_PASSWORD=${ADMIN_PASSWORD}" /etc/systemd/system/immichframe.service
+      cat <<EOF >>~/immichframe.creds
+ImmichFrame Admin User: admin
+ImmichFrame Admin Password: $ADMIN_PASSWORD
+EOF
+      systemctl daemon-reload
+      msg_ok "Set Admin Password (see ~/immichframe.creds)"
+    fi
 
     msg_info "Starting Service"
     systemctl start immichframe

ct/iobroker.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
 
-  NODE_VERSION="26" NPM_VERSION="11" setup_nodejs
+  NODE_VERSION="24" NPM_VERSION="11" setup_nodejs
 
   msg_info "Updating ${APP} LXC"
   $STD apt update

ct/jitsi-meet.sh

@@ -17,6 +17,14 @@ var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 
+# Optional public setup, read by the install script (all empty = LAN-only install as before).
+# Without the export they never reach the container.
+export var_jitsi_domain="${var_jitsi_domain:-}"
+export var_jitsi_le_email="${var_jitsi_le_email:-}"
+export var_jitsi_public_ip="${var_jitsi_public_ip:-}"
+export var_jitsi_admin_user="${var_jitsi_admin_user:-}"
+export var_jitsi_admin_pass="${var_jitsi_admin_pass:-}"
+
 header_info "$APP"
 variables
 color
@@ -50,4 +58,7 @@ description
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}https://${IP}${CL}"
+echo -e "${GATEWAY}${BGN}https://${var_jitsi_domain:-$IP}${CL}"
+if [[ -n "${var_jitsi_domain}" ]]; then
+  echo -e "${INFO}${YW}Forward TCP 80/443 and UDP 10000 to the container. Secure-domain credentials (if enabled) are in ~/jitsi-meet.creds inside the container.${CL}"
+fi

ct/lemonade-server.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Jamie (jamiej)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/lemonade-sdk/lemonade
+
+APP="Lemonade-Server"
+var_tags="${var_tags:-ai}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-8192}"
+var_disk="${var_disk:-80}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+var_gpu="${var_gpu:-yes}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+  if ! command -v lemonade &>/dev/null; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "lemonade-server" "lemonade-sdk/lemonade"; then
+    msg_info "Stopping Service"
+    systemctl stop lemond
+    msg_ok "Stopped Service"
+
+    fetch_and_deploy_gh_release "lemonade-server" "lemonade-sdk/lemonade" "binary" "latest" "/tmp" "lemonade-server_*-debian13_$(arch_resolve).deb"
+
+    msg_info "Starting Service"
+    systemctl start lemond
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:13305${CL}"

ct/lingarr.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/lingarr-translate/lingarr
+
+APP="Lingarr"
+var_tags="${var_tags:-arr;subtitles}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-16}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/lingarr ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "lingarr" "lingarr-translate/lingarr"; then
+    msg_info "Stopping Service"
+    systemctl stop lingarr
+    msg_ok "Stopped Service"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "lingarr" "lingarr-translate/lingarr" "tarball"
+
+    msg_info "Building Lingarr (Patience)"
+    cd /opt/lingarr/Lingarr.Client
+    $STD npm ci
+    $STD npm run build
+    mkdir -p /opt/lingarr/Lingarr.Server/wwwroot
+    cp -r /opt/lingarr/Lingarr.Client/dist/* /opt/lingarr/Lingarr.Server/wwwroot/
+    cd /opt/lingarr
+    export DOTNET_CLI_TELEMETRY_OPTOUT=1
+    rm -rf /opt/lingarr_app
+    $STD dotnet publish ./Lingarr.Server/Lingarr.Server.csproj -c Release -o /opt/lingarr_app /p:UseAppHost=false /p:Version="$(cat ~/.lingarr)"
+    msg_ok "Built Lingarr"
+
+    msg_info "Starting Service"
+    systemctl start lingarr
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:9876${CL}"
+echo -e "${INFO}${YW}Set your translation backend in /opt/lingarr.env${CL}"

ct/logseq.sh

@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://logseq.com/
+
+APP="Logseq"
+var_tags="${var_tags:-notes;knowledge-base}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-8192}"
+var_disk="${var_disk:-16}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/logseq ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "logseq" "logseq/logseq"; then
+    NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs
+    JAVA_VERSION="21" setup_java
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "logseq" "logseq/logseq" "tarball"
+
+    msg_info "Building Logseq Web App (Patience)"
+    cd /opt/logseq
+    export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+    export NODE_OPTIONS="--max-old-space-size=4096"
+    export JAVA_TOOL_OPTIONS="-Xmx4g"
+    $STD corepack enable
+    $STD pnpm install --config.network-timeout=240000
+    $STD pnpm release
+    msg_ok "Built Logseq Web App"
+
+    msg_info "Reloading Webserver"
+    systemctl reload nginx
+    msg_ok "Reloaded Webserver"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}${CL}"

ct/navidrome.sh

@@ -38,6 +38,9 @@ function update_script() {
 
     fetch_and_deploy_gh_release "navidrome" "navidrome/navidrome" "binary"
 
+    find /var/lib/navidrome/cache /var/lib/navidrome/artwork /var/lib/navidrome/plugins \
+      -maxdepth 0 -type d -user root -exec chown -h navidrome:navidrome {} + 2>/dev/null || true
+
     msg_info "Starting Services"
     systemctl start navidrome
     msg_ok "Started Services"

ct/onetimesecret.sh

@@ -0,0 +1,101 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Hai Tran (epiHATR)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://onetimesecret.com/ | Github: https://github.com/onetimesecret/onetimesecret
+
+APP="OneTimeSecret"
+var_tags="${var_tags:-security;privacy;secrets}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  SSL_VALUE="${OTS_SSL:-}"
+  if [[ -n "${SSL_VALUE}" ]]; then
+    case "${SSL_VALUE,,}" in
+    1 | true | yes | on) SSL_VALUE="true" ;;
+    0 | false | no | off) SSL_VALUE="false" ;;
+    *)
+      msg_error "Invalid OTS_SSL value '${OTS_SSL}' (use true/false)"
+      exit 1
+      ;;
+    esac
+  fi
+
+  if [[ ! -d /opt/onetimesecret ]] || [[ ! -f /opt/onetimesecret/.env ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "onetimesecret" "onetimesecret/onetimesecret"; then
+    msg_info "Stopping Service"
+    systemctl stop onetimesecret
+    msg_ok "Stopped Service"
+
+    create_backup /opt/onetimesecret/.env
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "onetimesecret" "onetimesecret/onetimesecret" "tarball"
+    RUBY_VERSION=$(tr -d ' \n' </opt/onetimesecret/.ruby-version 2>/dev/null)
+    RUBY_VERSION="${RUBY_VERSION:-3.4.10}" setup_ruby
+
+    PNPM_VERSION=$(sed -n 's/.*"packageManager": "pnpm@\([^"]*\)".*/\1/p' /opt/onetimesecret/package.json)
+    NODE_VERSION=$(tr -d ' \n' </opt/onetimesecret/.nvmrc 2>/dev/null)
+    NODE_VERSION="${NODE_VERSION:-25}" NODE_MODULE="pnpm@${PNPM_VERSION:-11.1.2}" setup_nodejs
+
+    restore_backup
+
+    msg_info "Reconciling Application"
+    systemctl enable -q --now redis-server
+    cd /opt/onetimesecret
+    mkdir -p tmp/pids log
+    $STD bash bin/setup reconcile
+    msg_ok "Reconciled Application"
+
+    msg_info "Building Frontend"
+    cd /opt/onetimesecret
+    $STD pnpm run build
+    msg_ok "Built Frontend"
+
+    msg_info "Starting Service"
+    systemctl start onetimesecret
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+DISPLAY_HOST="${OTS_HOST:-$IP}"
+case "${OTS_SSL:-false,,}" in
+1 | true | yes | on)
+  DISPLAY_SCHEME="https"
+  ;;
+*)
+  DISPLAY_SCHEME="http"
+  ;;
+esac
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}${DISPLAY_SCHEME}://${DISPLAY_HOST}${CL}"

ct/oxicloud.sh

@@ -10,8 +10,8 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 
 APP="OxiCloud"
 var_tags="${var_tags:-files;documents}"
-var_cpu="${var_cpu:-4}"
+var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-6144}"
+var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-20}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
@@ -33,42 +33,19 @@ function update_script() {
     exit
   fi
 
-  NODE_VERSION="26" setup_nodejs
+  ensure_dependencies ffmpeg
 
   if check_for_gh_release "OxiCloud" "DioCrafts/OxiCloud"; then
     msg_info "Stopping OxiCloud"
     systemctl stop oxicloud
     msg_ok "Stopped OxiCloud"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "OxiCloud" "DioCrafts/OxiCloud" "tarball" "latest" "/opt/oxicloud"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "OxiCloud" "DioCrafts/OxiCloud" "prebuild" "latest" "/opt/oxicloud" "oxicloud-*-$(arch_resolve x86_64 aarch64)-unknown-linux-musl.tar.gz"
-    TOOLCHAIN="$(grep -oP 'FROM\s+rust:\K[0-9]+\.[0-9]+(\.[0-9]+)?' /opt/oxicloud/Dockerfile | head -1)"
-    RUST_TOOLCHAIN="${TOOLCHAIN:-stable}" setup_rust
 
-    msg_info "Building Frontend SPA"
+    msg_info "Updating OxiCloud"
-    cd /opt/oxicloud/frontend
+    install -m 755 /opt/oxicloud/oxicloud /usr/local/bin/oxicloud
-    $STD npm ci
+    rm -f /usr/local/bin/migrate-nfc-filenames /usr/bin/oxicloud
-    $STD npm run build
+    sed -i 's|^OXICLOUD_STATIC_PATH=|#OXICLOUD_STATIC_PATH=|' /etc/oxicloud/.env
-    msg_ok "Built Frontend SPA"
-
-    msg_info "Updating OxiCloud (Patience)"
-    set -a
-    source /etc/oxicloud/.env
-    set +a
-    cd /opt/oxicloud
-    export DATABASE_URL
-    export RUSTFLAGS="-C target-cpu=native"
-    RAM_MB=$(awk '/MemTotal/ {print int($2/1024)}' /proc/meminfo)
-    CARGO_JOBS=$((RAM_MB / 2560))
-    [[ $CARGO_JOBS -lt 1 ]] && CARGO_JOBS=1
-    [[ $CARGO_JOBS -gt $(nproc) ]] && CARGO_JOBS=$(nproc)
-    $STD cargo build --release -j "$CARGO_JOBS" --bin oxicloud --bin migrate-nfc-filenames
-    mv target/release/oxicloud /usr/local/bin/oxicloud
-    mv target/release/migrate-nfc-filenames /usr/local/bin/migrate-nfc-filenames
-    chmod +x /usr/local/bin/oxicloud /usr/local/bin/migrate-nfc-filenames
-    rm -f /usr/bin/oxicloud
-    rm -rf /opt/oxicloud/static
-    mv /opt/oxicloud/static-dist /opt/oxicloud/static
-    rm -rf /opt/oxicloud/target /opt/oxicloud/frontend/node_modules
     msg_ok "Updated OxiCloud"
 
     msg_info "Starting OxiCloud"

ct/pangolin.sh

@@ -8,7 +8,7 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 # Source: https://pangolin.net/ | Github: https://github.com/fosrl/pangolin
 
 APP="Pangolin"
-PANGOLIN_VERSION="${PANGOLIN_VERSION:-1.21.0}"
+PANGOLIN_VERSION="${PANGOLIN_VERSION:-1.23.0}"
 var_tags="${var_tags:-proxy}"
 var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-4096}"

ct/paperclip.sh

@@ -43,6 +43,8 @@ function update_script() {
 
     restore_backup
 
+    setup_rust
+
     msg_info "Rebuilding Paperclip"
     cd /opt/paperclip-ai
     export HUSKY=0

ct/paperless-ngx.sh

@@ -169,9 +169,13 @@ function update_script() {
       if ((BRIDGE_UPDATE == 0)); then
         sed -i 's|^ExecStart=.*|ExecStart=uv run --no-sync -- granian --interface asginl --ws --loop uvloop "paperless.asgi:application"|' /etc/systemd/system/paperless-webserver.service
         grep -q "document_index reindex" /etc/systemd/system/paperless-webserver.service ||
-          sed -i '/^ExecStart=/i ExecStartPre=uv run -- python manage.py document_index reindex --if-needed --no-progress-bar' /etc/systemd/system/paperless-webserver.service
+          sed -i '/^ExecStart=/i ExecStartPre=uv run --no-sync -- python manage.py document_index reindex --if-needed --no-progress-bar' /etc/systemd/system/paperless-webserver.service
-        $STD systemctl daemon-reload
       fi
+      for svc in consumer scheduler task-queue webserver; do
+        unit="/etc/systemd/system/paperless-${svc}.service"
+        [[ -f "$unit" ]] && sed -i 's|uv run -- |uv run --no-sync -- |g' "$unit"
+      done
+      $STD systemctl daemon-reload
       cd /opt/paperless
       $STD uv sync --all-extras
       cd /opt/paperless/src

ct/passwordpusher.sh

@@ -40,6 +40,9 @@ function update_script() {
     create_backup /opt/passwordpusher/storage /opt/passwordpusher/.env.production
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "passwordpusher" "pglombardo/PasswordPusher" "tarball"
+
+    restore_backup
+
     RUBY_VERSION="$(cat /opt/passwordpusher/.ruby-version)" RUBY_INSTALL_RAILS="false" setup_ruby
 
     msg_info "Installing Gem Dependencies"
@@ -62,8 +65,6 @@ function update_script() {
     RAILS_ENV=production SECRET_KEY_BASE_DUMMY=1 $STD bundle exec rails assets:precompile
     msg_ok "Precompiled Assets"
 
-    restore_backup
-
     msg_info "Starting Service"
     systemctl start passwordpusher
     msg_ok "Started Service"

ct/portabase.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://portabase.io
+
+APP="Portabase"
+var_tags="${var_tags:-database;backup}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-8192}"
+var_disk="${var_disk:-15}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/portabase ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "portabase" "Portabase/portabase"; then
+    msg_info "Stopping Services"
+    systemctl stop portabase portabase-tusd
+    msg_ok "Stopped Services"
+
+    create_backup /opt/portabase/.env
+
+    NODE_VERSION="22" NODE_MODULE="pnpm@11.8.0" setup_nodejs
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "portabase" "Portabase/portabase" "tarball"
+
+    restore_backup
+
+    msg_info "Building Portabase"
+    cd /opt/portabase
+    export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+    export NEXT_TELEMETRY_DISABLED=1
+    $STD pnpm install --frozen-lockfile
+    $STD pnpm run build
+    cp -r /opt/portabase/.next/static /opt/portabase/.next/standalone/.next/static
+    cp -r /opt/portabase/public /opt/portabase/.next/standalone/public
+    mkdir -p /opt/portabase/.next/standalone/src/db
+    cp -r /opt/portabase/src/db/migrations /opt/portabase/.next/standalone/src/db/migrations
+    ln -sf /opt/portabase/.env /opt/portabase/.next/standalone/.env
+    msg_ok "Built Portabase"
+
+    msg_info "Starting Services"
+    systemctl start portabase-tusd portabase
+    msg_ok "Started Services"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"

ct/poznote.sh

@@ -44,14 +44,16 @@ function update_script() {
 
     msg_info "Deploying New Version"
     cp -r /opt/poznote/src/. /var/www/html/
-    chown -R www-data:www-data /var/www/html
     msg_ok "Deployed New Version"
 
     restore_backup
+    chown -R www-data:www-data /var/www/html
 
     msg_info "Running Poznote Initialization"
-    chmod +x /opt/poznote/init.sh
+    POZNOTE_INIT=/opt/poznote/docker/init.sh
-    $STD /opt/poznote/init.sh
+    [[ -f "$POZNOTE_INIT" ]] || POZNOTE_INIT=/opt/poznote/init.sh
+    chmod +x "$POZNOTE_INIT"
+    $STD "$POZNOTE_INIT"
     msg_ok "Initialized Poznote Data Directory"
 
     msg_info "Updating Nginx Configuration"
@@ -68,7 +70,7 @@ map \$uri \$poznote_coop {
 
 server {
     listen 8040;
-    root /var/www/html;
+    root /var/www/html/public;
     index index.php index.html;
 
     gzip on;
@@ -144,10 +146,12 @@ server {
     }
 
     location ~ ^/data/users/[0-9]+/backgrounds/ {
+        root /var/www/html;
         try_files \$uri =404;
     }
 
     location ~ ^/data/css/[A-Za-z0-9._-]+\.css$ {
+        root /var/www/html;
         try_files \$uri =404;
     }
 

ct/romm.sh

@@ -191,11 +191,30 @@ EOF
         sed -i -e "s|alias .*/library/;|alias ${ROMM_BASE}/library/;|" \
           -e "s|alias .*/cache/;|alias ${ROMM_BASE}/cache/;|" /etc/angie/http.d/romm.conf
       fi
+      cat <<'SYNCEOF' >/usr/local/bin/romm-sync-angie-paths
+#!/usr/bin/env bash
+base="$(grep -m1 '^ROMM_BASE_PATH=' /opt/romm/.env 2>/dev/null | cut -d= -f2)"
+base="${base:-/var/lib/romm}"
+[[ -f /etc/angie/http.d/romm.conf ]] || exit 0
+sed -i -e "s|alias .*/library/;|alias ${base}/library/;|" \
+  -e "s|alias .*/cache/;|alias ${base}/cache/;|" /etc/angie/http.d/romm.conf
+SYNCEOF
+      chmod +x /usr/local/bin/romm-sync-angie-paths
+      mkdir -p /etc/systemd/system/angie.service.d
+      cat <<'DROPEOF' >/etc/systemd/system/angie.service.d/romm-paths.conf
+[Service]
+ExecStartPre=/usr/local/bin/romm-sync-angie-paths
+DROPEOF
+      systemctl daemon-reload
       systemctl reload angie
     elif [[ -f /etc/nginx/sites-available/romm ]]; then
       sed -i "s|alias .*/library/;|alias ${ROMM_BASE}/library/;|" /etc/nginx/sites-available/romm
       nginx_enable_site romm
     fi
+    if [[ -f /etc/systemd/system/romm-watcher.service ]]; then
+      sed -i "s|\(watcher\.py' \).*|\1\${ROMM_BASE_PATH}/library|" /etc/systemd/system/romm-watcher.service
+      systemctl daemon-reload
+    fi
     msg_ok "Updated ROMM"
 
     msg_info "Starting Services"

ct/safebucket.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: renizmy
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/safebucket/safebucket
+
+APP="Safebucket"
+var_tags="${var_tags:-files;sharing}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-1024}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /opt/safebucket/safebucket ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit 1
+  fi
+
+  if check_for_gh_release "safebucket" "safebucket/safebucket"; then
+    msg_info "Stopping Service"
+    systemctl stop safebucket
+    msg_ok "Stopped Service"
+
+    create_backup /opt/safebucket/config.yaml /opt/safebucket/data/
+    fetch_and_deploy_gh_release "safebucket" "safebucket/safebucket" "singlefile" "latest" "/opt/safebucket" "safebucket-linux-$(arch_resolve)"
+    restore_backup
+
+    msg_info "Configuring Safebucket"
+    chown -R safebucket:safebucket /opt/safebucket
+    msg_ok "Configured Safebucket"
+
+    msg_info "Starting Service"
+    systemctl start safebucket
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:8080${CL}"

ct/solidtime.sh

@@ -45,7 +45,7 @@ function update_script() {
 
     msg_info "Updating Application"
     cd /opt/solidtime
-    $STD composer install --no-dev --optimize-autoloader
+    COMPOSER_ALLOW_SUPERUSER=1 $STD composer install --no-dev --optimize-autoloader
     $STD npm install
     $STD npm run build
     $STD php artisan migrate --force

ct/sparkyfitness.sh

@@ -67,6 +67,7 @@ function update_script() {
       -e 's|${SPARKY_FITNESS_SERVER_PORT}|3010|g' \
       -e "s|\${SPARKY_FITNESS_FRONTEND_URL}|${FRONTEND_URL}|g" \
       -e 's|${NGINX_LISTEN_PORT}|80|g' \
+      -e 's|${NGINX_RATE_LIMIT}|5r/s|g' \
       -e 's|${NGINX_ACCESS_LOG}|/var/log/nginx/sparkyfitness.access.log|g' \
       -e 's|${NGINX_ERROR_LOG}|/var/log/nginx/sparkyfitness.error.log|g' \
       -e 's|root /usr/share/nginx/html;|root /var/www/sparkyfitness;|g' \
@@ -85,7 +86,7 @@ function update_script() {
   Type=simple
   WorkingDirectory=/opt/sparkyfitness/SparkyFitnessServer
   EnvironmentFile=/etc/sparkyfitness/.env
-  ExecStart=/opt/sparkyfitness/SparkyFitnessServer/node_modules/.bin/tsx SparkyFitnessServer.js
+  ExecStart=/opt/sparkyfitness/SparkyFitnessServer/node_modules/.bin/tsx index.ts
   Restart=always
   RestartSec=5
 

ct/spliit.sh

@@ -42,7 +42,7 @@ function update_script() {
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "spliit" "spliit-app/spliit" "tarball"
 
     restore_backup
-    NODE_VERSION="24" setup_nodejs
+    NODE_VERSION="26" setup_nodejs
 
     msg_info "Building Application"
     cd /opt/spliit

ct/suggestarr.sh

@@ -37,8 +37,19 @@ function update_script() {
     systemctl stop suggestarr
     msg_ok "Stopped Service"
 
+    mkdir -p /opt/suggestarr_data
+    if [[ -d /opt/suggestarr/config/config_files && ! -L /opt/suggestarr/config/config_files ]]; then
+      msg_info "Migrating Configuration"
+      cp -an /opt/suggestarr/config/config_files/. /opt/suggestarr_data/
+      msg_ok "Migrated Configuration to /opt/suggestarr_data"
+    fi
+
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "suggestarr" "giuseppe99barchetta/SuggestArr" "tarball"
 
+    mkdir -p /opt/suggestarr/config
+    rm -rf /opt/suggestarr/config/config_files
+    ln -sfn /opt/suggestarr_data /opt/suggestarr/config/config_files
+
     msg_info "Building Frontend"
     cd /opt/suggestarr/client
     $STD npm install

ct/tor-snowflake.sh

@@ -44,7 +44,8 @@ function update_script() {
     msg_ok "Stopped Service"
 
     CLEAN_INSTALL=1 GITLAB_URL="https://gitlab.torproject.org" fetch_and_deploy_gl_release "tor-snowflake" "tpo/anti-censorship/pluggable-transports/snowflake" "tarball"
-    GO_VERSION="$(grep -m1 '^go ' /opt/tor-snowflake/proxy/go.mod | awk '{print $2}')" setup_go
+    GO_VERSION="$(awk '/^go /{print $2; exit}' /opt/tor-snowflake/go.mod 2>/dev/null || true)"
+    GO_VERSION="${GO_VERSION:-latest}" setup_go
 
     msg_info "Building Snowflake"
     cd /opt/tor-snowflake/proxy

ct/tracearr.sh

@@ -124,7 +124,7 @@ EOF
     $STD pnpm turbo telemetry disable
     $STD pnpm turbo run build --no-daemon --filter=@tracearr/shared --filter=@tracearr/server --filter=@tracearr/web
     rm -rf /opt/tracearr
-    mkdir -p /opt/tracearr/{packages/shared,apps/server,apps/web,apps/server/src/db}
+    mkdir -p /opt/tracearr/{packages/shared,packages/emails,apps/server,apps/web,apps/server/src/db}
     cp -rf package.json /opt/tracearr/
     cp -rf pnpm-workspace.yaml /opt/tracearr/
     cp -rf pnpm-lock.yaml /opt/tracearr/
@@ -134,6 +134,8 @@ EOF
     cp -rf apps/web/dist /opt/tracearr/apps/web/dist
     cp -rf packages/shared/package.json /opt/tracearr/packages/shared/
     cp -rf packages/shared/dist /opt/tracearr/packages/shared/dist
+    cp -rf packages/emails/package.json /opt/tracearr/packages/emails/
+    cp -rf packages/emails/dist /opt/tracearr/packages/emails/dist
     cp -rf apps/server/src/db/migrations /opt/tracearr/apps/server/src/db/migrations
     cp -rf data /opt/tracearr/data
     mkdir -p /opt/tracearr/data/image-cache

ct/valhalla.sh

@@ -0,0 +1,104 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: CrazyWolf13
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/valhalla/valhalla
+
+APP="Valhalla"
+var_tags="${var_tags:-mapping;routing}"
+var_cpu="${var_cpu:-6}"
+var_ram="${var_ram:-6144}"
+var_disk="${var_disk:-24}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /etc/systemd/system/valhalla.service ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "prime_server" "kevinkreiser/prime_server"; then
+    RELEASE="$CHECK_UPDATE_RELEASE"
+
+    msg_info "Stopping Service"
+    systemctl stop valhalla
+    msg_ok "Stopped Service"
+
+    msg_info "Building prime_server ${RELEASE} (Patience)"
+    rm -rf /tmp/prime_server
+    $STD git clone --recurse-submodules --depth 1 --branch "$RELEASE" https://github.com/kevinkreiser/prime_server /tmp/prime_server
+    cd /tmp/prime_server
+    $STD ./autogen.sh
+    $STD ./configure
+    $STD make -j"$(nproc)"
+    $STD make install
+    cd /
+    rm -rf /tmp/prime_server
+    ldconfig
+    echo "${RELEASE#v}" >"$HOME/.prime_server"
+    msg_ok "Built prime_server ${RELEASE}"
+
+    msg_info "Starting Service"
+    systemctl start valhalla
+    msg_ok "Started Service"
+  fi
+
+  if check_for_gh_release "valhalla" "valhalla/valhalla"; then
+    RELEASE="$CHECK_UPDATE_RELEASE"
+
+    msg_info "Stopping Service"
+    systemctl stop valhalla
+    msg_ok "Stopped Service"
+
+    msg_info "Fetching Valhalla ${RELEASE} (Patience)"
+    rm -rf /opt/valhalla
+    $STD git clone --recurse-submodules --depth 1 --branch "$RELEASE" https://github.com/valhalla/valhalla.git /opt/valhalla
+    msg_ok "Fetched Valhalla ${RELEASE}"
+
+    msg_info "Compiling Valhalla ${RELEASE} (this takes 20-45+ minutes, be patient)"
+    MEM_MB=$(awk '/MemTotal/{print int($2/1024)}' /proc/meminfo)
+    BUILD_JOBS=$((MEM_MB / 2000))
+    [[ $BUILD_JOBS -lt 1 ]] && BUILD_JOBS=1
+    [[ $BUILD_JOBS -gt $(nproc) ]] && BUILD_JOBS=$(nproc)
+    cd /opt/valhalla
+    $STD cmake -B build -DCMAKE_BUILD_TYPE=Release -DENABLE_PYTHON_BINDINGS=OFF -DENABLE_TESTS=OFF -DENABLE_SINGLE_FILES_WERROR=OFF
+    $STD cmake --build build -- -j"$BUILD_JOBS"
+    $STD cmake --install build
+    ldconfig
+    echo "${RELEASE#v}" >"$HOME/.valhalla"
+    msg_ok "Compiled Valhalla ${RELEASE}"
+
+    msg_info "Starting Service"
+    systemctl start valhalla
+    msg_ok "Started Service"
+  fi
+
+  msg_ok "Updated Successfully!\n"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8002/status${CL}"
+echo -e "${INFO}${YW}No routing tiles are built yet. Build them for your region with:${CL}"
+echo -e "${TAB}${BGN}/opt/valhalla_data/build-tiles.sh https://download.geofabrik.de/<continent>/<region>-latest.osm.pbf${CL}"

install/authentik-install.sh

@@ -58,7 +58,7 @@ PG_VERSION="17" setup_postgresql
 PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db
 
 XMLSEC_VERSION="1.3.12"
-AUTHENTIK_VERSION="version/2026.8.1"
+AUTHENTIK_VERSION="version/2026.8.2"
 fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec"
 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
 GO_VERSION="$(grep -m1 '^go ' /opt/authentik/go.mod | awk '{print $2}')" setup_go

install/borg-ui-install.sh

@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/karanhudia/borg-ui
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  build-essential \
+  python3-dev \
+  pkg-config \
+  libffi-dev \
+  libssl-dev \
+  libacl1-dev \
+  liblz4-dev \
+  libzstd-dev \
+  libxxhash-dev \
+  libfuse3-dev \
+  fuse3 \
+  rsync \
+  sshfs \
+  openssh-client \
+  sshpass
+msg_ok "Installed Dependencies"
+
+UV_PYTHON="3.12" setup_uv
+NODE_VERSION="22" setup_nodejs
+
+fetch_and_deploy_gh_release "borg-ui" "karanhudia/borg-ui" "tarball"
+
+# Only the three Borg pins appear in every release of this file; PYTHON_VERSION
+# and RCLONE_VERSION were added upstream after v2.2.6, so both fall back.
+RUNTIME_ENV="/opt/borg-ui/docker/runtime-base.env"
+BORG1_VERSION=$(sed -n 's/^BORG1_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
+BORG2_VERSION=$(sed -n 's/^BORG2_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
+BORGSTORE_VERSION=$(sed -n 's/^BORGSTORE_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
+RCLONE_VERSION=$(sed -n 's/^RCLONE_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
+BORG_PYTHON=$(sed -n 's/^PYTHON_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
+BORG_PYTHON="${BORG_PYTHON:-3.12}"
+if [[ -z "$BORG1_VERSION" || -z "$BORG2_VERSION" || -z "$BORGSTORE_VERSION" ]]; then
+  msg_error "Could not read the pinned Borg versions from ${RUNTIME_ENV}"
+  exit 1
+fi
+
+msg_info "Installing Borg ${BORG1_VERSION} and Borg ${BORG2_VERSION} (Patience)"
+$STD uv venv --python "$BORG_PYTHON" /opt/borg1-venv
+$STD uv pip install --python /opt/borg1-venv pyfuse3 "borgbackup==${BORG1_VERSION}"
+echo "$BORG1_VERSION" >/opt/borg1-venv/.pinned_version
+$STD uv venv --python "$BORG_PYTHON" /opt/borg2-venv
+$STD uv pip install --python /opt/borg2-venv pyfuse3 "borgbackup==${BORG2_VERSION}" "borgstore[rclone,sftp,rest,s3,blake3]==${BORGSTORE_VERSION}"
+echo "${BORG2_VERSION}-${BORGSTORE_VERSION}" >/opt/borg2-venv/.pinned_version
+ln -sf /opt/borg1-venv/bin/borg /usr/local/bin/borg
+ln -sf /opt/borg2-venv/bin/borg /usr/local/bin/borg2
+msg_ok "Installed Borg ${BORG1_VERSION} and Borg ${BORG2_VERSION}"
+
+RCLONE_TAG="${RCLONE_VERSION:+v${RCLONE_VERSION}}"
+fetch_and_deploy_gh_release "rclone" "rclone/rclone" "prebuild" "${RCLONE_TAG:-latest}" "/opt/rclone" "rclone-${RCLONE_TAG:-*}-linux-$(arch_resolve amd64 arm64).zip"
+ln -sf /opt/rclone/rclone /usr/local/bin/rclone
+
+msg_info "Building Frontend"
+cd /opt/borg-ui/frontend
+$STD npm ci
+$STD npm run build
+mkdir -p /opt/borg-ui/app/static
+cp -r /opt/borg-ui/frontend/build/* /opt/borg-ui/app/static/
+msg_ok "Built Frontend"
+
+msg_info "Setting up Python Environment"
+cd /opt/borg-ui
+$STD uv venv --python "$BORG_PYTHON" /opt/borg-ui/.venv
+$STD uv pip install --python /opt/borg-ui/.venv -r requirements.txt
+msg_ok "Set up Python Environment"
+
+msg_info "Configuring Borg-UI"
+mkdir -p /opt/borg-ui_data
+BORG_UI_VERSION=$(cat "$HOME/.borg-ui" 2>/dev/null)
+if [[ -z "$BORG_UI_VERSION" ]]; then
+  msg_error "Could not determine the deployed Borg-UI version"
+  exit 1
+fi
+cat <<EOF >/opt/borg-ui/.env
+APP_VERSION=${BORG_UI_VERSION}
+PORT=8081
+ENVIRONMENT=production
+TZ=UTC
+DATA_DIR=/opt/borg-ui_data
+ENABLE_CRON_BACKUPS=true
+ENABLE_STARTUP_LICENSE_SYNC=false
+EOF
+chmod 600 /opt/borg-ui/.env
+msg_ok "Configured Borg-UI"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/borg-ui.service
+[Unit]
+Description=Borg-UI
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/borg-ui
+EnvironmentFile=/opt/borg-ui/.env
+ExecStart=/opt/borg-ui/.venv/bin/gunicorn app.main:app --bind 0.0.0.0:8081 --workers 2 --worker-class uvicorn.workers.UvicornWorker --timeout 300
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now borg-ui
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/calibre-web-install.sh

@@ -32,7 +32,7 @@ msg_info "Installing Calibre (for eBook conversion)"
 $STD apt install -y calibre
 msg_ok "Installed Calibre"
 
-fetch_and_deploy_gh_release "Calibre-Web" "janeczku/calibre-web" "prebuild" "latest" "/opt/calibre-web" "calibreweb*.tar.gz"
+fetch_and_deploy_gh_release "calibreweb" "janeczku/calibre-web" "prebuild" "latest" "/opt/calibre-web" "calibreweb*.tar.gz"
 setup_uv
 
 msg_info "Installing Python Dependencies"

install/changedetection-install.sh

@@ -38,9 +38,20 @@ $STD apt-get install -y \
   qpdf \
   xdg-utils \
   xvfb \
-  ca-certificates
+  ca-certificates \
+  locales \
+  poppler-utils \
+  file
 msg_ok "Installed Dependencies"
 
+msg_info "Generating Locales"
+for l in cs_CZ de_DE en_GB en_US es_ES fr_FR id_ID it_IT ja_JP ko_KR \
+  pl_PL pt_BR ru_RU tr_TR uk_UA zh_CN zh_TW; do
+  sed -i "s/^# *${l}.UTF-8 UTF-8/${l}.UTF-8 UTF-8/" /etc/locale.gen
+done
+$STD locale-gen
+msg_ok "Generated Locales"
+
 PYTHON_VERSION="3.13" setup_uv
 
 NODE_VERSION="24" setup_nodejs
@@ -54,6 +65,7 @@ $STD /opt/changedetection/.venv/bin/python -m pip install changedetection.io
 cat <<EOF >/opt/changedetection/.env
 WEBDRIVER_URL=http://127.0.0.1:4444/wd/hub
 PLAYWRIGHT_DRIVER_URL=ws://localhost:3000/chrome?launch=eyJkZWZhdWx0Vmlld3BvcnQiOnsiaGVpZ2h0Ijo3MjAsIndpZHRoIjoxMjgwfSwiaGVhZGxlc3MiOmZhbHNlLCJzdGVhbHRoIjp0cnVlfQ==&blockAds=true
+LC_ALL=en_US.UTF-8
 EOF
 msg_ok "Installed Change Detection"
 
@@ -62,6 +74,7 @@ mkdir /opt/browserless
 $STD /opt/changedetection/.venv/bin/python -m pip install playwright
 $STD git clone https://github.com/browserless/chrome /opt/browserless
 $STD npm ci --include=optional --include=dev --prefix /opt/browserless
+$STD npm install --save-exact playwright-core@1.62.1 --prefix /opt/browserless
 $STD /opt/browserless/node_modules/playwright-core/cli.js install --with-deps &>/dev/null
 $STD /opt/browserless/node_modules/playwright-core/cli.js install --force chrome &>/dev/null
 $STD /opt/browserless/node_modules/playwright-core/cli.js install chromium firefox webkit &>/dev/null

install/chevereto-install.sh

@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://chevereto.com/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  nginx \
+  exiftran \
+  libimage-exiftool-perl
+msg_ok "Installed Dependencies"
+
+PHP_VERSION="8.3" PHP_FPM="YES" PHP_UPLOAD_MAX_FILESIZE="512M" PHP_POST_MAX_SIZE="512M" PHP_MAX_EXECUTION_TIME="600" setup_php
+setup_composer
+setup_mariadb
+setup_ffmpeg
+MARIADB_DB_NAME="chevereto" MARIADB_DB_USER="chevereto" setup_mariadb_db
+
+fetch_and_deploy_gh_release "chevereto" "chevereto/chevereto" "tarball"
+
+msg_info "Installing Chevereto Dependencies"
+cd /opt/chevereto/app
+export COMPOSER_ALLOW_SUPERUSER=1
+$STD composer install --no-dev --prefer-dist --no-interaction --optimize-autoloader
+msg_ok "Installed Chevereto Dependencies"
+
+msg_info "Configuring Chevereto"
+cat <<EOF >/opt/chevereto/app/env.php
+<?php
+
+return [
+    'CHEVERETO_DB_HOST' => 'localhost',
+    'CHEVERETO_DB_PORT' => '3306',
+    'CHEVERETO_DB_NAME' => '${MARIADB_DB_NAME}',
+    'CHEVERETO_DB_USER' => '${MARIADB_DB_USER}',
+    'CHEVERETO_DB_PASS' => '${MARIADB_DB_PASS}',
+    'CHEVERETO_DB_TABLE_PREFIX' => 'chv_',
+    'CHEVERETO_HOSTNAME' => '${LOCAL_IP}',
+];
+EOF
+chown -R www-data:www-data /opt/chevereto
+chmod -R 775 /opt/chevereto/images /opt/chevereto/content
+msg_ok "Configured Chevereto"
+
+msg_info "Configuring Nginx"
+cat <<'EOF' >/etc/nginx/sites-available/chevereto
+server {
+    listen 80;
+    server_name _;
+    root /opt/chevereto;
+    index index.php;
+
+    charset utf-8;
+    client_max_body_size 512M;
+
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options "nosniff";
+
+    location / {
+        try_files $uri $uri/ /index.php$is_args$args;
+    }
+
+    location = /favicon.ico { access_log off; log_not_found off; }
+    location = /robots.txt  { access_log off; log_not_found off; }
+
+    location ~* ^/images/.+\.(gif|jpe?g|png|bmp|webp)$ {
+        try_files $uri =404;
+    }
+
+    location = /index.php {
+        include fastcgi_params;
+        fastcgi_pass unix:__PHP_FPM_SOCK__;
+        fastcgi_param SCRIPT_FILENAME $document_root/index.php;
+        fastcgi_read_timeout 600;
+    }
+
+    location ~ \.php$ {
+        deny all;
+    }
+
+    location ^~ /app/ {
+        deny all;
+    }
+
+    location ~ /\.(?!well-known).* {
+        deny all;
+    }
+}
+EOF
+sed -i "s|__PHP_FPM_SOCK__|$(get_php_fpm_socket)|" /etc/nginx/sites-available/chevereto
+nginx_enable_site chevereto
+msg_ok "Configured Nginx"
+
+motd_ssh
+customize
+cleanup_lxc

install/dispatcharr-install.sh

@@ -25,7 +25,13 @@ $STD apt install -y \
   procps \
   vlc-bin \
   vlc-plugin-base \
-  streamlink
+  streamlink \
+  autoconf \
+  libtool \
+  libargtable2-dev \
+  libavformat-dev \
+  libsdl2-dev \
+  libswscale-dev
 msg_ok "Installed Dependencies"
 
 setup_uv
@@ -33,6 +39,15 @@ NODE_VERSION="24" setup_nodejs
 PG_VERSION="16" setup_postgresql
 PG_DB_NAME="dispatcharr_db" PG_DB_USER="dispatcharr_usr" setup_postgresql_db
 fetch_and_deploy_gh_release "dispatcharr" "Dispatcharr/Dispatcharr" "tarball"
+fetch_and_deploy_gh_release "Comskip" "erikkaashoek/Comskip" "tarball"
+
+msg_info "Compiling Comskip"
+cd /opt/Comskip
+$STD ./autogen.sh
+$STD ./configure
+$STD make
+$STD make install
+msg_ok "Compiled and Installed Comskip"
 
 msg_info "Installing Python Dependencies with uv"
 cd /opt/dispatcharr

install/docmost-install.sh

@@ -48,6 +48,7 @@ sed -i -e "s|APP_SECRET=.*|APP_SECRET=$(openssl rand -base64 32 | tr -dc 'a-zA-Z
   -e "s|^STORAGE_DRIVER=azure|#STORAGE_DRIVER=azure|" \
   /opt/docmost/.env
 export NODE_OPTIONS="--max-old-space-size=2048"
+export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
 $STD pnpm install
 $STD pnpm build
 msg_ok "Configured Docmost"

install/elasticsearch-install.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.elastic.co/elasticsearch
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+# vm.max_map_count is not namespaced, so a container cannot raise it - the value
+# is inherited from the Proxmox host. Elasticsearch refuses to start below the
+# required limit once it binds to a non-loopback address (production mode).
+msg_info "Checking Kernel Limits"
+if (($(sysctl -n vm.max_map_count) < 262144)); then
+  msg_error "vm.max_map_count is $(sysctl -n vm.max_map_count), Elasticsearch needs at least 262144"
+  msg_error "Set it on the PROXMOX HOST, not in this container:"
+  msg_error "  echo 'vm.max_map_count=1048576' >/etc/sysctl.d/99-elasticsearch.conf && sysctl --system"
+  exit 1
+fi
+msg_ok "Checked Kernel Limits"
+
+JAVA_VERSION="21" setup_java
+
+setup_deb822_repo \
+  "elasticsearch" \
+  "https://artifacts.elastic.co/GPG-KEY-elasticsearch" \
+  "https://artifacts.elastic.co/packages/9.x/apt" \
+  "stable" \
+  "main"
+
+msg_info "Installing Elasticsearch"
+$STD apt install -y elasticsearch
+msg_ok "Installed Elasticsearch"
+
+msg_info "Configuring Elasticsearch"
+mkdir -p /opt/elasticsearch_data
+chown -R elasticsearch:elasticsearch /opt/elasticsearch_data
+cat <<EOF >/etc/elasticsearch/elasticsearch.yml
+cluster.name: proxmox
+node.name: ${HOSTNAME}
+path.data: /opt/elasticsearch_data
+path.logs: /var/log/elasticsearch
+
+network.host: 0.0.0.0
+http.port: 9200
+discovery.type: single-node
+
+xpack.security.enabled: true
+xpack.security.enrollment.enabled: true
+xpack.security.http.ssl.enabled: false
+xpack.security.transport.ssl.enabled: false
+EOF
+
+cat <<EOF >/etc/elasticsearch/jvm.options.d/heap.options
+-Xms1g
+-Xmx1g
+EOF
+systemctl enable -q --now elasticsearch
+msg_ok "Configured Elasticsearch"
+
+
+motd_ssh
+customize
+cleanup_lxc

install/frigate-install.sh

@@ -110,7 +110,7 @@ export AUTOGRAPH_VERBOSITY=0
 export GLOG_minloglevel=3
 export GLOG_logtostderr=0
 
-fetch_and_deploy_gh_release "frigate" "blakeblackshear/frigate" "tarball" "v0.17.2" "/opt/frigate"
+fetch_and_deploy_gh_release "frigate" "blakeblackshear/frigate" "tarball" "v0.18.0" "/opt/frigate"
 
 msg_info "Building Nginx"
 $STD bash /opt/frigate/docker/main/build_nginx.sh
@@ -122,7 +122,18 @@ msg_info "Building SQLite Extensions"
 $STD bash /opt/frigate/docker/main/build_sqlite_vec.sh
 msg_ok "Built SQLite Extensions"
 
-fetch_and_deploy_gh_release "go2rtc" "AlexxIT/go2rtc" "singlefile" "latest" "/usr/local/go2rtc/bin" "go2rtc_linux_$(arch_resolve)"
+if [[ "$(arch_resolve)" == "amd64" ]]; then
+  msg_info "Building Intel Media Driver (Patience)"
+  $STD bash /opt/frigate/docker/main/build_intel_media_driver.sh
+  cp -a /rootfs/. /
+  rm -rf /rootfs
+  rm -f /etc/apt/sources.list.d/intel-gpu-jammy.list /usr/share/keyrings/intel-graphics.gpg
+  $STD apt update
+  ldconfig
+  msg_ok "Built Intel Media Driver"
+fi
+
+fetch_and_deploy_gh_release "go2rtc" "AlexxIT/go2rtc" "singlefile" "v1.9.14" "/usr/local/go2rtc/bin" "go2rtc_linux_$(arch_resolve)"
 
 msg_info "Installing Tempio"
 sed -i 's|/rootfs/usr/local|/usr/local|g' /opt/frigate/docker/main/install_tempio.sh
@@ -194,17 +205,7 @@ if python3 /opt/frigate/docker/main/build_ov_model.py &>/dev/null; then
   mkdir -p /openvino-model
   cp /models/ssdlite_mobilenet_v2.xml /openvino-model/
   cp /models/ssdlite_mobilenet_v2.bin /openvino-model/
-  OV_LABELS=$(python3 -c "import omz_tools; import os; print(os.path.join(omz_tools.__path__[0], 'data/dataset_classes/coco_91cl_bkgr.txt'))" 2>/dev/null)
+  curl_with_retry "https://raw.githubusercontent.com/openvinotoolkit/open_model_zoo/master/data/dataset_classes/coco_91cl_bkgr.txt" "/openvino-model/coco_91cl_bkgr.txt"
-  if [[ -n "$OV_LABELS" && -f "$OV_LABELS" ]]; then
-    ln -sf "$OV_LABELS" /openvino-model/coco_91cl_bkgr.txt
-  else
-    OV_LABELS=$(find /usr/local/lib -name "coco_91cl_bkgr.txt" 2>/dev/null | head -1)
-    if [[ -n "$OV_LABELS" ]]; then
-      ln -sf "$OV_LABELS" /openvino-model/coco_91cl_bkgr.txt
-    else
-      curl_with_retry "https://raw.githubusercontent.com/openvinotoolkit/open_model_zoo/master/data/dataset_classes/coco_91cl_bkgr.txt" "/openvino-model/coco_91cl_bkgr.txt"
-    fi
-  fi
   sed -i 's/truck/car/g' /openvino-model/coco_91cl_bkgr.txt
   msg_ok "Built OpenVino Model"
 else
@@ -251,8 +252,8 @@ curl_download "/media/frigate/person-bicycle-car-detection.mp4" "https://github.
 echo "tmpfs   /tmp/cache      tmpfs   defaults        0       0" >>/etc/fstab
 
 cat <<EOF >/etc/frigate.env
-DEFAULT_FFMPEG_VERSION="7.0"
+DEFAULT_FFMPEG_VERSION="8.0"
-INCLUDED_FFMPEG_VERSIONS="7.0:5.0"
+INCLUDED_FFMPEG_VERSIONS="8.0:7.0:5.0"
 NVIDIA_VISIBLE_DEVICES=all
 NVIDIA_DRIVER_CAPABILITIES="compute,video,utility"
 TOKENIZERS_PARALLELISM=true
@@ -268,6 +269,23 @@ GLOG_minloglevel=3
 GLOG_logtostderr=0
 EOF
 
+if grep -q -o -m1 -E 'avx[^ ]*|sse4_2' /proc/cpuinfo && [[ -f /openvino-model/ssdlite_mobilenet_v2.xml ]] && [[ -f /openvino-model/coco_91cl_bkgr.txt ]]; then
+  DETECTOR_CONFIG="detectors:
+  detector01:
+    type: openvino
+    device: AUTO
+model:
+  width: 300
+  height: 300
+  input_tensor: nhwc
+  input_pixel_format: bgr
+  path: /openvino-model/ssdlite_mobilenet_v2.xml
+  labelmap_path: /openvino-model/coco_91cl_bkgr.txt"
+else
+  DETECTOR_CONFIG="model:
+  path: /models/cpu_model.tflite"
+fi
+
 cat <<EOF >/config/config.yml
 mqtt:
   enabled: false
@@ -287,32 +305,10 @@ auth:
   enabled: false
 detect:
   enabled: false
-EOF
-
-if grep -q -o -m1 -E 'avx[^ ]*|sse4_2' /proc/cpuinfo && [[ -f /openvino-model/ssdlite_mobilenet_v2.xml ]] && [[ -f /openvino-model/coco_91cl_bkgr.txt ]]; then
-  cat <<EOF >/config/config.yml
 ffmpeg:
   hwaccel_args: auto
-detectors:
+${DETECTOR_CONFIG}
-  detector01:
-    type: openvino
-    device: AUTO
-model:
-  width: 300
-  height: 300
-  input_tensor: nhwc
-  input_pixel_format: bgr
-  path: /openvino-model/ssdlite_mobilenet_v2.xml
-  labelmap_path: /openvino-model/coco_91cl_bkgr.txt
 EOF
-else
-  cat <<EOF >/config/config.yml
-ffmpeg:
-  hwaccel_args: auto
-model:
-  path: /models/cpu_model.tflite
-EOF
-fi
 msg_ok "Configured Frigate"
 
 msg_info "Creating Services"

install/gotenberg-install.sh

@@ -0,0 +1,96 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: CrazyWolf13
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/gotenberg/gotenberg
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  chromium \
+  libreoffice-writer \
+  libreoffice-calc \
+  libreoffice-impress \
+  libreoffice-draw \
+  libreoffice-math \
+  python3-uno \
+  python-is-python3 \
+  pdftk-java \
+  qpdf \
+  libimage-exiftool-perl \
+  fonts-crosextra-carlito \
+  fonts-crosextra-caladea \
+  fonts-liberation \
+  fonts-liberation2 \
+  fonts-dejavu \
+  fonts-noto-cjk \
+  fonts-noto-color-emoji \
+  fonts-noto-core
+msg_ok "Installed Dependencies"
+
+fetch_and_deploy_gh_release "pdfcpu" "pdfcpu/pdfcpu" "prebuild" "latest" "/opt/pdfcpu" "pdfcpu_*_Linux_$(arch_resolve "x86_64" "arm64").tar.xz"
+ln -sf "$(find /opt/pdfcpu -type f -name pdfcpu | head -n1)" /usr/local/bin/pdfcpu
+
+msg_info "Installing unoconverter"
+UNOCONVERTER_VERSION=$(get_latest_github_release "gotenberg/unoconverter" "false")
+download_file "https://raw.githubusercontent.com/gotenberg/unoconverter/${UNOCONVERTER_VERSION}/unoconv" /usr/local/bin/unoconverter
+chmod +x /usr/local/bin/unoconverter
+msg_ok "Installed unoconverter"
+
+fetch_and_deploy_gh_release "gotenberg" "gotenberg/gotenberg" "tarball" "latest" "/opt/gotenberg"
+
+GO_VERSION="$(awk '$1=="go"{print $2}' /opt/gotenberg/go.mod | cut -d. -f1,2)" setup_go
+
+msg_info "Building Gotenberg (Patience)"
+cd /opt/gotenberg
+export CGO_ENABLED=0
+$STD go mod download
+$STD go build -o /usr/local/bin/gotenberg \
+  -ldflags "-s -w -X 'github.com/gotenberg/gotenberg/v8/cmd.Version=$(cat ~/.gotenberg)'" \
+  cmd/gotenberg/main.go
+msg_ok "Built Gotenberg"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/gotenberg.service
+[Unit]
+Description=Gotenberg
+Documentation=https://gotenberg.dev
+After=network.target
+
+[Service]
+Type=simple
+User=root
+Environment=LANG=C.UTF-8
+Environment=LC_ALL=C.UTF-8
+Environment=PDFTK_BIN_PATH=/usr/bin/pdftk
+Environment=QPDF_BIN_PATH=/usr/bin/qpdf
+Environment=EXIFTOOL_BIN_PATH=/usr/bin/exiftool
+Environment=PDFCPU_BIN_PATH=/usr/local/bin/pdfcpu
+Environment=CHROMIUM_BIN_PATH=/usr/bin/chromium
+Environment=CHROMIUM_HYPHEN_DATA_DIR_PATH=/opt/gotenberg/build/chromium-hyphen-data
+Environment=LIBREOFFICE_BIN_PATH=/usr/lib/libreoffice/program/soffice.bin
+Environment=UNOCONVERTER_BIN_PATH=/usr/local/bin/unoconverter
+Environment=OTEL_TRACES_EXPORTER=none
+Environment=OTEL_METRICS_EXPORTER=none
+Environment=OTEL_LOGS_EXPORTER=none
+ExecStart=/usr/local/bin/gotenberg --api-port=3000
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now gotenberg
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/hammer-install.sh

@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Darkrock-Studios/hammer-editor
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  unzip \
+  fontconfig \
+  libfreetype6
+msg_ok "Installed Dependencies"
+
+JAVA_VERSION="21" setup_java
+
+fetch_and_deploy_gh_release "hammer" "Darkrock-Studios/hammer-editor" "prebuild" "latest" "/opt/hammer" "server.zip"
+
+msg_info "Configuring Hammer Sync Server"
+chmod +x /opt/hammer/bin/server
+mkdir -p /opt/hammer_data
+cat <<EOF >/opt/hammer_data/config.toml
+# Hammer Sync Server configuration
+# Reference: https://github.com/Darkrock-Studios/hammer-editor/blob/develop/docs/HOW-TO-RUN-A-SERVER.md
+# Loaded automatically from the data directory. Apply changes with:
+#   systemctl restart hammer
+
+host = "${LOCAL_IP}"
+port = 8080
+
+# Hammer clients speak https only and will not connect to plain HTTP. Either put
+# a TLS reverse proxy in front of this port, or let Hammer terminate TLS itself
+# with a real certificate (self-signed certs are rejected by the clients).
+#
+# Behind a reverse proxy on this host, restrict the plain port to loopback and
+# set the URL the clients actually use:
+# bindHosts = ["127.0.0.1", "::1"]
+# publicUrl = "https://hammer.example.com"
+#
+# Hammer terminating TLS itself:
+# sslPort = 443
+# [sslCert]
+# certChainPath = "/etc/letsencrypt/live/hammer.example.com/fullchain.pem"
+# privateKeyPath = "/etc/letsencrypt/live/hammer.example.com/privkey.pem"
+# forceHttps = true
+
+# Per-page social share images. fontconfig and libfreetype6 are already installed.
+# richLinkPreviews = true
+
+# communityEnabled = true
+
+# Storage defaults to an in-process PostgreSQL under /opt/hammer_data/pgdata.
+# To use an external PostgreSQL instead:
+# [storage]
+# type = "remote"
+# [storage.remote]
+# host = "db.example.com"
+# port = 5432
+# database = "hammer"
+# user = "hammer"
+# password = "change-me"
+# useSsl = true
+
+# Regenerable render/preview caches, default <data dir>/cache.
+# [cache]
+# directory = "/var/tmp/hammer-cache"
+# maxSizeMb = 200
+EOF
+cat <<EOF >/etc/systemd/system/hammer.service
+[Unit]
+Description=Hammer Sync Server
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/hammer
+Environment=SERVER_OPTS=-Duser.home=/opt
+ExecStart=/opt/hammer/bin/server
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now hammer
+msg_ok "Configured Hammer Sync Server"
+
+motd_ssh
+customize
+cleanup_lxc

install/homepage-install.sh

@@ -64,7 +64,7 @@ RestartSec=1
 User=root
 WorkingDirectory=/opt/homepage/
 Environment=CI=true
-ExecStart=pnpm start
+ExecStart=/opt/homepage/node_modules/.bin/next start
 
 [Install]
 WantedBy=multi-user.target

install/immich-install.sh

@@ -353,7 +353,7 @@ ML_DIR="${APP_DIR}/machine-learning"
 GEO_DIR="${INSTALL_DIR}/geodata"
 mkdir -p {"${APP_DIR}","${UPLOAD_DIR}","${GEO_DIR}","${INSTALL_DIR}"/cache}
 
-fetch_and_deploy_gh_release "Immich" "immich-app/immich" "tarball" "v3.1.0" "$SRC_DIR"
+fetch_and_deploy_gh_release "Immich" "immich-app/immich" "tarball" "v3.2.2" "$SRC_DIR"
 PNPM_VERSION="$(jq -r '.packageManager | split("@")[1] | split("+")[0]' ${SRC_DIR}/package.json)"
 export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
 NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs
@@ -370,11 +370,10 @@ export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
 export CI=1
 
 # server build
-export SHARP_IGNORE_GLOBAL_LIBVIPS=true
 $STD pnpm --filter @immich/sdk --filter @immich/plugin-sdk --filter immich build
-unset SHARP_IGNORE_GLOBAL_LIBVIPS
-export SHARP_FORCE_GLOBAL_LIBVIPS=true
 $STD pnpm --filter immich --prod --no-optional deploy "$APP_DIR"
+export SHARP_FORCE_GLOBAL_LIBVIPS=true
+$STD pnpm --dir "$APP_DIR/node_modules/sharp" exec npm run build
 
 # Patch helmet.json: disable upgrade-insecure-requests for HTTP access
 if [[ -f "$APP_DIR/helmet.json" ]]; then
@@ -388,7 +387,6 @@ sed -i "s|^start|${APP_DIR}/bin/start|" "$APP_DIR"/bin/immich-admin
 cd "$SRC_DIR"
 echo "packageImportMethod: hardlink" >>./pnpm-workspace.yaml
 unset SHARP_FORCE_GLOBAL_LIBVIPS
-export SHARP_IGNORE_GLOBAL_LIBVIPS=true
 $STD pnpm --filter @immich/sdk --filter immich-web --filter @immich/cli build
 $STD pnpm --filter @immich/cli --prod --no-optional deploy "$APP_DIR"/cli
 cp -a web/build "$APP_DIR"/www

install/immichframe-install.sh

@@ -60,6 +60,11 @@ chown -R immichframe:immichframe /opt/immichframe
 msg_ok "Setup ImmichFrame"
 
 msg_info "Creating Service"
+ADMIN_PASSWORD=$(openssl rand -hex 16)
+cat <<EOF >~/immichframe.creds
+ImmichFrame Admin User: admin
+ImmichFrame Admin Password: $ADMIN_PASSWORD
+EOF
 cat <<EOF >/etc/systemd/system/immichframe.service
 [Unit]
 Description=ImmichFrame Digital Photo Frame
@@ -74,6 +79,7 @@ ExecStart=/usr/bin/dotnet /opt/immichframe/ImmichFrame.WebApi.dll
 Environment=ASPNETCORE_URLS=http://0.0.0.0:8080
 Environment=ASPNETCORE_ENVIRONMENT=Production
 Environment=DOTNET_CONTENTROOT=/opt/immichframe
+Environment=IMMICHFRAME_ADMIN_PASSWORD=$ADMIN_PASSWORD
 Restart=always
 RestartSec=5
 StandardOutput=journal

install/iobroker-install.sh

@@ -28,7 +28,7 @@ if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
   exit 10
 fi
 
-NODE_VERSION="26" NPM_VERSION="11" setup_nodejs
+NODE_VERSION="24" NPM_VERSION="11" setup_nodejs
 
 msg_info "Installing ioBroker (Patience)"
 $STD bash <(curl -fsSL https://iobroker.net/install.sh)

install/jitsi-meet-install.sh

@@ -13,6 +13,29 @@ setting_up_container
 network_check
 update_os
 
+# Optional public setup. Leave the hostname empty for a LAN-only install
+# (container IP, self-signed certificate) - the previous default behaviour.
+if [[ -z "${var_jitsi_domain:-}" ]]; then
+  read -rp "${TAB3}Public hostname (FQDN, leave empty to use the container IP): " var_jitsi_domain || true
+fi
+var_jitsi_domain="${var_jitsi_domain:-$LOCAL_IP}"
+
+if [[ "$var_jitsi_domain" != "$LOCAL_IP" ]]; then
+  if [[ -z "${var_jitsi_le_email:-}" ]]; then
+    read -rp "${TAB3}E-mail for Let's Encrypt (leave empty for a self-signed certificate): " var_jitsi_le_email || true
+  fi
+  if [[ -z "${var_jitsi_public_ip:-}" ]]; then
+    read -rp "${TAB3}Public IP behind NAT (leave empty to detect via STUN): " var_jitsi_public_ip || true
+  fi
+  if [[ -z "${var_jitsi_admin_user:-}" ]]; then
+    read -rp "${TAB3}Admin user for secure domain (leave empty to let anyone create rooms): " var_jitsi_admin_user || true
+  fi
+  if [[ -n "${var_jitsi_admin_user:-}" && -z "${var_jitsi_admin_pass:-}" ]]; then
+    read -rsp "${TAB3}Admin password (leave empty to generate): " var_jitsi_admin_pass || true
+    echo
+  fi
+fi
+
 msg_info "Installing Dependencies"
 $STD apt install -y nginx
 msg_ok "Installed Dependencies"
@@ -25,11 +48,72 @@ setup_deb822_repo "jitsi" \
   ""
 
 msg_info "Installing Jitsi Meet"
-echo "jitsi-videobridge2 jitsi-videobridge/jvb-hostname string ${LOCAL_IP}" | debconf-set-selections
+echo "jitsi-videobridge2 jitsi-videobridge/jvb-hostname string ${var_jitsi_domain}" | debconf-set-selections
-echo "jitsi-meet-web-config jitsi-meet/cert-choice select Generate a new self-signed certificate" | debconf-set-selections
+if [[ -n "${var_jitsi_le_email:-}" ]]; then
+  # acme.sh (used by the packaged Let's Encrypt helper) refuses to install without cron
+  $STD apt install -y cron
+  echo "jitsi-meet-web-config jitsi-meet/cert-choice select Let's Encrypt certificates" | debconf-set-selections
+  echo "jitsi-meet-web-config jitsi-meet/email string ${var_jitsi_le_email}" | debconf-set-selections
+else
+  echo "jitsi-meet-web-config jitsi-meet/cert-choice select Generate a new self-signed certificate" | debconf-set-selections
+fi
+echo "jitsi-meet-web-config jitsi-meet/jaas-choice boolean false" | debconf-set-selections
 DEBIAN_FRONTEND=noninteractive $STD apt install -y jitsi-meet
 msg_ok "Installed Jitsi Meet"
 
+if [[ -n "${var_jitsi_public_ip:-}" ]]; then
+  msg_info "Configuring NAT mapping"
+  # JVB 2.3+ reads this from jvb.conf; sip-communicator.properties is no longer used
+  cat <<EOF >>/etc/jitsi/videobridge/jvb.conf
+ice4j {
+  harvest {
+    mapping {
+      static-mappings = [
+        { local-address = "${LOCAL_IP}", public-address = "${var_jitsi_public_ip}" }
+      ]
+    }
+  }
+}
+EOF
+  systemctl restart jitsi-videobridge2
+  msg_ok "Configured NAT mapping"
+fi
+
+if [[ -n "${var_jitsi_admin_user:-}" ]]; then
+  msg_info "Configuring Secure Domain"
+  # Only authenticated users may create rooms; guests join via the anonymous domain.
+  # https://jitsi.github.io/handbook/docs/devops-guide/secure-domain/
+  var_jitsi_admin_pass="${var_jitsi_admin_pass:-$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-16)}"
+  sed -i "0,/authentication = \"jitsi-anonymous\"/s//authentication = \"internal_hashed\"/" \
+    "/etc/prosody/conf.avail/${var_jitsi_domain}.cfg.lua"
+  cat <<EOF >>"/etc/prosody/conf.avail/${var_jitsi_domain}.cfg.lua"
+
+VirtualHost "guest.${var_jitsi_domain}"
+    authentication = "anonymous"
+    c2s_require_encryption = false
+EOF
+  cat <<EOF >>/etc/jitsi/jicofo/jicofo.conf
+jicofo {
+  authentication {
+    enabled = true
+    type = XMPP
+    login-url = "${var_jitsi_domain}"
+  }
+}
+EOF
+  sed -i "s|^\s*// anonymousdomain: 'guest.example.com',|    anonymousdomain: 'guest.${var_jitsi_domain}',|" \
+    "/etc/jitsi/meet/${var_jitsi_domain}-config.js"
+  $STD prosodyctl register "${var_jitsi_admin_user}" "${var_jitsi_domain}" "${var_jitsi_admin_pass}"
+  cat <<EOF >~/jitsi-meet.creds
+Jitsi Meet Secure Domain
+Admin User: ${var_jitsi_admin_user}
+Admin Password: ${var_jitsi_admin_pass}
+Add more users: prosodyctl register <name> ${var_jitsi_domain} <password>
+EOF
+  systemctl restart prosody jicofo jitsi-videobridge2
+  msg_ok "Configured Secure Domain"
+fi
+
 motd_ssh
 customize
 cleanup_lxc

install/lemonade-server-install.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Jamie (jamiej)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/lemonade-sdk/lemonade
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+setup_deb822_repo \
+  "backports" \
+  "https://ftp-master.debian.org/keys/archive-key-13.asc" \
+  "http://deb.debian.org/debian" \
+  "trixie-backports" \
+  "main"
+
+msg_info "Installing Lemonade Server dependencies"
+$STD apt install -y \
+  fonts-katex \
+  libcpp-httplib0.41 \
+  libmbedcrypto16 \
+  libwebsockets19t64
+msg_ok "Installed Lemonade Server dependencies"
+
+setup_hwaccel
+
+fetch_and_deploy_gh_release "lemonade-server" "lemonade-sdk/lemonade" "binary" "latest" "/tmp" "lemonade-server_*-debian13_$(arch_resolve).deb"
+
+msg_info "Configuring Remote Access"
+systemctl enable -q --now lemond
+for _ in $(seq 1 60); do
+  lemonade status >/dev/null 2>&1 && break
+  sleep 2
+done
+$STD lemonade config set host=0.0.0.0
+systemctl restart lemond
+msg_ok "Configured Remote Access"
+
+motd_ssh
+customize
+cleanup_lxc

install/lingarr-install.sh

@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/lingarr-translate/lingarr
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+PG_VERSION="17" setup_postgresql
+PG_DB_NAME="lingarr" PG_DB_USER="lingarr" setup_postgresql_db
+NODE_VERSION="24" setup_nodejs
+
+DOTNET_VERSION="10" DOTNET_TYPE="sdk" setup_dotnet
+
+fetch_and_deploy_gh_release "lingarr" "lingarr-translate/lingarr" "tarball"
+
+msg_info "Building Lingarr (Patience)"
+cd /opt/lingarr/Lingarr.Client
+$STD npm ci
+$STD npm run build
+mkdir -p /opt/lingarr/Lingarr.Server/wwwroot
+cp -r /opt/lingarr/Lingarr.Client/dist/* /opt/lingarr/Lingarr.Server/wwwroot/
+cd /opt/lingarr
+export DOTNET_CLI_TELEMETRY_OPTOUT=1
+$STD dotnet publish ./Lingarr.Server/Lingarr.Server.csproj -c Release -o /opt/lingarr_app /p:UseAppHost=false /p:Version="$(cat ~/.lingarr)"
+msg_ok "Built Lingarr"
+
+msg_info "Configuring Lingarr"
+mkdir -p /opt/lingarr_data/{config,plugins}
+cat <<EOF >/opt/lingarr.env
+ASPNETCORE_ENVIRONMENT=Production
+ASPNETCORE_URLS=http://+:9876
+ASPNETCORE_HTTP_PORTS=9876
+
+DB_CONNECTION=postgresql
+DB_HOST=127.0.0.1
+DB_PORT=5432
+DB_DATABASE=lingarr
+DB_USERNAME=lingarr
+DB_PASSWORD=${PG_DB_PASS}
+
+PLUGINS_PATH=/opt/lingarr_data/plugins
+DOTNET_CLI_TELEMETRY_OPTOUT=1
+
+# Translation backend. Alternatives: openai, deepl, anthropic, gemini, localai
+SERVICE_TYPE=libretranslate
+LIBRE_TRANSLATE_URL=http://CHANGE_ME:5000
+EOF
+chmod 600 /opt/lingarr.env
+msg_ok "Configured Lingarr"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/lingarr.service
+[Unit]
+Description=Lingarr
+Wants=network-online.target
+After=network-online.target postgresql.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/lingarr_app
+EnvironmentFile=/opt/lingarr.env
+ExecStart=/usr/bin/dotnet /opt/lingarr_app/Lingarr.Server.dll
+Restart=on-failure
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now lingarr
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/logseq-install.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://logseq.com/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  git \
+  nginx \
+  build-essential \
+  libcairo2-dev \
+  libpango1.0-dev \
+  libjpeg-dev \
+  libgif-dev \
+  librsvg2-dev
+msg_ok "Installed Dependencies"
+
+NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs
+JAVA_VERSION="21" setup_java
+
+msg_info "Installing Clojure CLI"
+cd /tmp
+curl_download "linux-install.sh" "https://github.com/clojure/brew-install/releases/latest/download/linux-install.sh"
+$STD bash linux-install.sh
+rm -f linux-install.sh
+msg_ok "Installed Clojure CLI"
+
+fetch_and_deploy_gh_release "logseq" "logseq/logseq" "tarball"
+
+msg_info "Building Logseq Web App (Patience)"
+cd /opt/logseq
+export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+export NODE_OPTIONS="--max-old-space-size=4096"
+export JAVA_TOOL_OPTIONS="-Xmx4g"
+$STD corepack enable
+$STD pnpm install --config.network-timeout=240000
+$STD pnpm release
+msg_ok "Built Logseq Web App"
+
+msg_info "Generating Self-Signed Certificate"
+create_self_signed_cert "logseq"
+msg_ok "Generated Self-Signed Certificate"
+
+msg_info "Configuring Nginx"
+cat <<'EOF' >/etc/nginx/sites-available/logseq
+server {
+    listen 80 default_server;
+    server_name _;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl default_server;
+    http2 on;
+    server_name _;
+
+    ssl_certificate /etc/ssl/logseq/logseq.crt;
+    ssl_certificate_key /etc/ssl/logseq/logseq.key;
+
+    root /opt/logseq/static;
+    index index.html;
+
+    add_header Cross-Origin-Opener-Policy same-origin always;
+    add_header Cross-Origin-Embedder-Policy require-corp always;
+
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+}
+EOF
+nginx_enable_site logseq
+msg_ok "Configured Nginx"
+
+motd_ssh
+customize
+cleanup_lxc

install/onetimesecret-install.sh

@@ -0,0 +1,138 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Hai Tran (epiHATR)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://onetimesecret.com/ | Github: https://github.com/onetimesecret/onetimesecret
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  build-essential \
+  git \
+  libffi-dev \
+  libgmp-dev \
+  libpq-dev \
+  libreadline-dev \
+  libsodium23 \
+  libsqlite3-dev \
+  libssl-dev \
+  libxml2-dev \
+  libxslt1-dev \
+  libyaml-dev \
+  nginx \
+  pkg-config \
+  python3 \
+  redis-server \
+  zlib1g-dev
+msg_ok "Installed Dependencies"
+
+fetch_and_deploy_gh_release "onetimesecret" "onetimesecret/onetimesecret" "tarball"
+
+RUBY_VERSION=$(tr -d ' \n' </opt/onetimesecret/.ruby-version 2>/dev/null)
+RUBY_VERSION="${RUBY_VERSION:-3.4.10}" setup_ruby
+PNPM_VERSION=$(sed -n 's/.*"packageManager": "pnpm@\([^"]*\)".*/\1/p' /opt/onetimesecret/package.json)
+NODE_VERSION=$(tr -d ' \n' </opt/onetimesecret/.nvmrc 2>/dev/null)
+NODE_VERSION="${NODE_VERSION:-25}" NODE_MODULE="pnpm@${PNPM_VERSION:-11.1.2}" setup_nodejs
+HOST_VALUE="${OTS_HOST:-$LOCAL_IP}"
+SSL_VALUE="${OTS_SSL:-false}"
+case "${SSL_VALUE,,}" in
+1 | true | yes | on) SSL_VALUE="true" ;;
+0 | false | no | off | "") SSL_VALUE="false" ;;
+*)
+  msg_error "Invalid OTS_SSL value '${OTS_SSL}' (use true/false)"
+  exit 1
+  ;;
+esac
+
+msg_info "Configuring Application"
+systemctl enable -q --now redis-server
+cd /opt/onetimesecret
+$STD bash bin/setup init
+sed -i \
+  -e "s|^REDIS_URL=.*|REDIS_URL=redis://127.0.0.1:6379/0|" \
+  -e "s|^HOST=.*|HOST=${HOST_VALUE//&/\\&}|" \
+  -e "s|^SSL=.*|SSL=${SSL_VALUE}|" \
+  /opt/onetimesecret/.env
+if grep -q '^RACK_ENV=' /opt/onetimesecret/.env; then
+  sed -i 's|^RACK_ENV=.*|RACK_ENV=production|' /opt/onetimesecret/.env
+else
+  echo "RACK_ENV=production" >>/opt/onetimesecret/.env
+fi
+if grep -q '^AUTHENTICATION_MODE=' /opt/onetimesecret/.env; then
+  sed -i 's|^AUTHENTICATION_MODE=.*|AUTHENTICATION_MODE=simple|' /opt/onetimesecret/.env
+else
+  echo "AUTHENTICATION_MODE=simple" >>/opt/onetimesecret/.env
+fi
+if ! grep -q '^PORT=' /opt/onetimesecret/.env; then
+  echo "PORT=3000" >>/opt/onetimesecret/.env
+fi
+chmod 600 /opt/onetimesecret/.env
+mkdir -p /opt/onetimesecret/tmp/pids /opt/onetimesecret/log
+msg_ok "Configured Application"
+
+msg_info "Reconciling Application"
+cd /opt/onetimesecret
+$STD bash bin/setup reconcile
+msg_ok "Reconciled Application"
+
+msg_info "Building Frontend"
+cd /opt/onetimesecret
+$STD pnpm run build
+msg_ok "Built Frontend"
+
+msg_info "Creating Service"
+cat <<'EOF' >/etc/systemd/system/onetimesecret.service
+[Unit]
+Description=Onetime Secret Service
+After=network.target redis-server.service
+Requires=redis-server.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/onetimesecret
+Environment=HOME=/root
+Environment=PATH=/root/.rbenv/shims:/root/.rbenv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+EnvironmentFile=/opt/onetimesecret/.env
+ExecStart=/root/.rbenv/shims/bundle exec puma -C etc/puma.rb
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now onetimesecret
+msg_ok "Created Service"
+
+msg_info "Configuring Nginx"
+cat <<'EOF' >/etc/nginx/sites-available/onetimesecret
+server {
+  listen 80 default_server;
+  server_name _;
+
+  location / {
+    proxy_pass http://127.0.0.1:3000;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+  }
+}
+EOF
+nginx_enable_site onetimesecret
+msg_ok "Configured Nginx"
+
+motd_ssh
+customize
+cleanup_lxc

install/oxicloud-install.sh

@@ -14,43 +14,20 @@ network_check
 update_os
 
 msg_info "Installing Dependencies"
-$STD apt install -y build-essential
+$STD apt install -y ffmpeg
 msg_ok "Installed Dependencies"
 
-NODE_VERSION="26" setup_nodejs
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="oxicloud" PG_DB_USER="oxicloud" setup_postgresql_db
-fetch_and_deploy_gh_release "OxiCloud" "DioCrafts/OxiCloud" "tarball" "latest" "/opt/oxicloud"
+fetch_and_deploy_gh_release "OxiCloud" "DioCrafts/OxiCloud" "prebuild" "latest" "/opt/oxicloud" "oxicloud-*-$(arch_resolve x86_64 aarch64)-unknown-linux-musl.tar.gz"
-TOOLCHAIN="$(grep -oP 'FROM\s+rust:\K[0-9]+\.[0-9]+(\.[0-9]+)?' /opt/oxicloud/Dockerfile | head -1)"
+install -m 755 /opt/oxicloud/oxicloud /usr/local/bin/oxicloud
-RUST_TOOLCHAIN="${TOOLCHAIN:-stable}" setup_rust
-
-msg_info "Building Frontend SPA"
-cd /opt/oxicloud/frontend
-$STD npm ci
-$STD npm run build
-msg_ok "Built Frontend SPA"
-
-msg_info "Building OxiCloud (Patience)"
-cd /opt/oxicloud
-export DATABASE_URL="postgres://${PG_DB_USER}:${PG_DB_PASS}@localhost/${PG_DB_NAME}"
-export RUSTFLAGS="-C target-cpu=native"
-RAM_MB=$(awk '/MemTotal/ {print int($2/1024)}' /proc/meminfo)
-CARGO_JOBS=$((RAM_MB / 2560))
-[[ $CARGO_JOBS -lt 1 ]] && CARGO_JOBS=1
-[[ $CARGO_JOBS -gt $(nproc) ]] && CARGO_JOBS=$(nproc)
-$STD cargo build --release -j "$CARGO_JOBS" --bin oxicloud --bin migrate-nfc-filenames
-mv target/release/oxicloud /usr/local/bin/oxicloud
-mv target/release/migrate-nfc-filenames /usr/local/bin/migrate-nfc-filenames
-rm -rf /opt/oxicloud/static
-mv /opt/oxicloud/static-dist /opt/oxicloud/static
-rm -rf /opt/oxicloud/target /opt/oxicloud/frontend/node_modules
-msg_ok "Built OxiCloud"
 
 msg_info "Configuring OxiCloud"
 mkdir -p {/mnt/oxicloud,/etc/oxicloud}
+DATABASE_URL="postgres://${PG_DB_USER}:${PG_DB_PASS}@localhost/${PG_DB_NAME}"
 sed -e 's|OXICLOUD_STORAGE_PATH=.*|OXICLOUD_STORAGE_PATH=/mnt/oxicloud|' \
   -e 's|OXICLOUD_SERVER_HOST=.*|OXICLOUD_SERVER_HOST=0.0.0.0|' \
-  -e 's|OXICLOUD_STATIC_PATH=.*|OXICLOUD_STATIC_PATH=/opt/oxicloud/static|' \
+  -e 's|^OXICLOUD_STATIC_PATH=|#OXICLOUD_STATIC_PATH=|' \
   -e "s|^#OXICLOUD_BASE_URL=.*|OXICLOUD_BASE_URL=http://${LOCAL_IP}:8086|" \
   -e "s|OXICLOUD_DB_CONNECTION_STRING=.*|OXICLOUD_DB_CONNECTION_STRING=${DATABASE_URL}|" \
   -e "s|^DATABASE_URL=.*|DATABASE_URL=${DATABASE_URL}|" \

install/pangolin-install.sh

@@ -22,7 +22,7 @@ msg_ok "Installed Dependencies"
 NODE_VERSION="24" setup_nodejs
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="pangolin" PG_DB_USER="pangolin" setup_postgresql_db
-PANGOLIN_VERSION="${PANGOLIN_VERSION:-1.21.0}"
+PANGOLIN_VERSION="${PANGOLIN_VERSION:-1.23.0}"
 fetch_and_deploy_gh_release "pangolin" "fosrl/pangolin" "tarball" "$PANGOLIN_VERSION"
 fetch_and_deploy_gh_release "gerbil" "fosrl/gerbil" "singlefile" "latest" "/usr/bin" "gerbil_linux_$(arch_resolve)"
 fetch_and_deploy_gh_release "traefik" "traefik/traefik" "prebuild" "latest" "/usr/bin" "traefik_v*_linux_$(arch_resolve).tar.gz"

install/paperclip-install.sh

@@ -23,6 +23,7 @@ msg_ok "Installed Dependencies"
 NODE_VERSION="24" NODE_MODULE="pnpm" setup_nodejs
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="paperclip" PG_DB_USER="paperclip" setup_postgresql_db
+setup_rust
 
 fetch_and_deploy_gh_release "paperclip-ai" "paperclipai/paperclip" "tarball"
 

install/paperless-ngx-install.sh

@@ -151,7 +151,7 @@ Requires=redis.service
 
 [Service]
 WorkingDirectory=/opt/paperless/src
-#ExecStartPre=uv run -- python manage.py document_index reindex --if-needed --no-progress-bar
+#ExecStartPre=uv run --no-sync -- python manage.py document_index reindex --if-needed --no-progress-bar
 ExecStart=uv run --no-sync -- granian --interface asginl --ws --loop uvloop "paperless.asgi:application"
 Environment=GRANIAN_HOST=::
 Environment=GRANIAN_PORT=8000

install/portabase-install.sh

@@ -0,0 +1,163 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://portabase.io
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  build-essential \
+  git \
+  nginx
+msg_ok "Installed Dependencies"
+
+NODE_VERSION="22" NODE_MODULE="pnpm@11.8.0" setup_nodejs
+PG_VERSION="17" setup_postgresql
+PG_DB_NAME="portabase" PG_DB_USER="portabase" setup_postgresql_db
+
+fetch_and_deploy_gh_release "portabase" "Portabase/portabase" "tarball"
+fetch_and_deploy_gh_release "tusd" "tus/tusd" "prebuild" "latest" "/opt/tusd" "tusd_linux_$(arch_resolve).tar.gz"
+
+msg_info "Configuring Portabase"
+mkdir -p /opt/portabase-data/uploads/tmp
+mv -f "/opt/tusd/tusd_linux_$(arch_resolve)/tusd" /opt/tusd/tusd
+rm -rf "/opt/tusd/tusd_linux_$(arch_resolve)"
+chmod +x /opt/tusd/tusd
+PROJECT_SECRET=$(openssl rand -hex 32)
+ADMIN_PASSWORD=$(openssl rand -base64 18 | tr -dc 'A-Za-z0-9' | head -c 16)
+cat <<EOF >/opt/portabase/.env
+LOG_LEVEL=info
+DATABASE_URL=postgresql://${PG_DB_USER}:${PG_DB_PASS}@127.0.0.1:5432/${PG_DB_NAME}
+PROJECT_NAME=Portabase
+PROJECT_URL=http://${LOCAL_IP}:3000
+PROJECT_SECRET=${PROJECT_SECRET}
+TRUSTED_DOMAINS=http://${LOCAL_IP}:3000
+PRIVATE_PATH=/opt/portabase-data
+AUTH_DEFAULT_USER_NAME=Portabase Admin
+AUTH_DEFAULT_USER=admin@example.com
+AUTH_DEFAULT_PASSWORD=${ADMIN_PASSWORD}
+AUTH_EMAIL_PASSWORD_ENABLED=true
+AUTH_SIGNUP_ENABLED=true
+RETENTION_CRON=0 7 * * *
+TUSD_BEHIND_PROXY=true
+TELEMETRY=false
+EOF
+cat <<EOF >~/portabase.creds
+Portabase Admin
+Username: admin@example.com
+Password: ${ADMIN_PASSWORD}
+EOF
+msg_ok "Configured Portabase"
+
+msg_info "Building Portabase"
+cd /opt/portabase
+export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+export NEXT_TELEMETRY_DISABLED=1
+$STD pnpm install --frozen-lockfile
+$STD pnpm run build
+cp -r /opt/portabase/.next/static /opt/portabase/.next/standalone/.next/static
+cp -r /opt/portabase/public /opt/portabase/.next/standalone/public
+mkdir -p /opt/portabase/.next/standalone/src/db
+cp -r /opt/portabase/src/db/migrations /opt/portabase/.next/standalone/src/db/migrations
+ln -sf /opt/portabase/.env /opt/portabase/.next/standalone/.env
+msg_ok "Built Portabase"
+
+msg_info "Creating Services"
+cat <<EOF >/etc/systemd/system/portabase-tusd.service
+[Unit]
+Description=Portabase tusd Upload Server
+After=network.target
+Before=portabase.service
+
+[Service]
+Type=simple
+ExecStart=/opt/tusd/tusd --base-path /tus/files/ --upload-dir /opt/portabase-data/uploads/tmp --hooks-http http://127.0.0.1:8887/api/tus/hooks --port 1080 --max-size 21474836480 --behind-proxy
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+cat <<EOF >/etc/systemd/system/portabase.service
+[Unit]
+Description=Portabase
+After=network.target postgresql.service portabase-tusd.service
+Wants=postgresql.service
+
+[Service]
+Type=simple
+WorkingDirectory=/opt/portabase/.next/standalone
+Environment=NODE_ENV=production
+Environment=PORT=8887
+Environment=HOSTNAME=127.0.0.1
+ExecStart=/usr/bin/node /opt/portabase/.next/standalone/server.js
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now portabase-tusd portabase
+msg_ok "Created Services"
+
+msg_info "Configuring Nginx"
+cat <<'EOF' >/etc/nginx/sites-available/portabase
+map $http_x_forwarded_proto $forwarded_proto {
+    default $scheme;
+    "~*^\s*(https?)\s*(?:,|$)" $1;
+}
+
+server {
+    listen 3000;
+    server_name _;
+
+    client_max_body_size 20G;
+    ignore_invalid_headers off;
+
+    location /tus/ {
+        proxy_pass http://127.0.0.1:1080/tus/;
+        proxy_pass_request_headers on;
+        proxy_request_buffering off;
+        proxy_buffering off;
+        proxy_http_version 1.1;
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Forwarded-Host $http_host;
+        proxy_set_header X-Forwarded-Proto $forwarded_proto;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    location = /api/tus/hooks {
+        deny all;
+        return 404;
+    }
+
+    location / {
+        proxy_pass http://127.0.0.1:8887;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Forwarded-Host $http_host;
+        proxy_set_header X-Forwarded-Proto $forwarded_proto;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+}
+EOF
+nginx_enable_site portabase
+msg_ok "Configured Nginx"
+
+motd_ssh
+customize
+cleanup_lxc

install/poznote-install.sh

@@ -29,8 +29,10 @@ chown -R www-data:www-data /var/www/html
 msg_ok "Deployed Poznote"
 
 msg_info "Running Poznote Initialization"
-chmod +x /opt/poznote/init.sh
+POZNOTE_INIT=/opt/poznote/docker/init.sh
-$STD /opt/poznote/init.sh
+[[ -f "$POZNOTE_INIT" ]] || POZNOTE_INIT=/opt/poznote/init.sh
+chmod +x "$POZNOTE_INIT"
+$STD "$POZNOTE_INIT"
 msg_ok "Initialized Poznote Data Directory"
 
 msg_info "Configuring Nginx"
@@ -46,7 +48,7 @@ map \$uri \$poznote_coop {
 
 server {
     listen 8040;
-    root /var/www/html;
+    root /var/www/html/public;
     index index.php index.html;
 
     gzip on;
@@ -122,10 +124,12 @@ server {
     }
 
     location ~ ^/data/users/[0-9]+/backgrounds/ {
+        root /var/www/html;
         try_files \$uri =404;
     }
 
     location ~ ^/data/css/[A-Za-z0-9._-]+\.css$ {
+        root /var/www/html;
         try_files \$uri =404;
     }
 

install/romm-install.sh

@@ -327,8 +327,22 @@ server {
 }
 EOF
 
-sed -i -e "s|alias /var/lib/romm/library/;|alias ${ROMM_BASE}/library/;|" \
+cat <<'SYNCEOF' >/usr/local/bin/romm-sync-angie-paths
-  -e "s|alias /var/lib/romm/cache/;|alias ${ROMM_BASE}/cache/;|" /etc/angie/http.d/romm.conf
+#!/usr/bin/env bash
+base="$(grep -m1 '^ROMM_BASE_PATH=' /opt/romm/.env 2>/dev/null | cut -d= -f2)"
+base="${base:-/var/lib/romm}"
+[[ -f /etc/angie/http.d/romm.conf ]] || exit 0
+sed -i -e "s|alias .*/library/;|alias ${base}/library/;|" \
+  -e "s|alias .*/cache/;|alias ${base}/cache/;|" /etc/angie/http.d/romm.conf
+SYNCEOF
+chmod +x /usr/local/bin/romm-sync-angie-paths
+mkdir -p /etc/systemd/system/angie.service.d
+cat <<'EOF' >/etc/systemd/system/angie.service.d/romm-paths.conf
+[Service]
+ExecStartPre=/usr/local/bin/romm-sync-angie-paths
+EOF
+systemctl daemon-reload
+/usr/local/bin/romm-sync-angie-paths
 rm -f /etc/angie/http.d/default.conf
 systemctl restart angie
 systemctl enable -q --now angie
@@ -405,7 +419,7 @@ Type=simple
 WorkingDirectory=/opt/romm/backend
 EnvironmentFile=/opt/romm/.env
 Environment="PYTHONPATH=/opt/romm/backend"
-ExecStart=/opt/romm/.venv/bin/watchfiles --target-type command '/opt/romm/.venv/bin/python watcher.py' /var/lib/romm/library
+ExecStart=/opt/romm/.venv/bin/watchfiles --target-type command '/opt/romm/.venv/bin/python watcher.py' \${ROMM_BASE_PATH}/library
 Restart=on-failure
 RestartSec=5
 

install/safebucket-install.sh

@@ -0,0 +1,226 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: renizmy
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/safebucket/safebucket
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y awscli
+msg_ok "Installed Dependencies"
+
+msg_info "Installing Garage"
+useradd --system --no-create-home --shell /usr/sbin/nologin garage 2>/dev/null || true
+GARAGE_VERSION=$(get_latest_gh_tag "deuxfleurs-org/garage" "v")
+if [[ -z "$GARAGE_VERSION" ]]; then
+  msg_error "Could not determine latest stable Garage version"
+  exit 1
+fi
+curl -fsSL "https://garagehq.deuxfleurs.fr/_releases/${GARAGE_VERSION}/$(arch_resolve "x86_64-unknown-linux-musl" "aarch64-unknown-linux-musl")/garage" -o /usr/local/bin/garage
+chmod +x /usr/local/bin/garage
+mkdir -p /opt/garage/{data,meta}
+RPC_SECRET=$(openssl rand -hex 32)
+ADMIN_TOKEN=$(openssl rand -base64 32)
+cat <<EOF >/opt/garage/garage.toml
+metadata_dir = "/opt/garage/meta"
+data_dir = "/opt/garage/data"
+db_engine = "lmdb"
+replication_factor = 1
+
+rpc_bind_addr = "[::]:3901"
+rpc_public_addr = "127.0.0.1:3901"
+rpc_secret = "${RPC_SECRET}"
+
+[s3_api]
+s3_region = "garage"
+api_bind_addr = "[::]:3900"
+root_domain = ".s3.garage.localhost"
+
+[admin]
+api_bind_addr = "[::]:3903"
+admin_token = "${ADMIN_TOKEN}"
+EOF
+chmod 600 /opt/garage/garage.toml
+chown -R garage:garage /opt/garage
+cat <<EOF >/etc/systemd/system/garage.service
+[Unit]
+Description=Garage Object Storage
+After=network.target
+
+[Service]
+Type=simple
+User=garage
+Group=garage
+WorkingDirectory=/opt/garage
+ExecStart=/usr/local/bin/garage -c /opt/garage/garage.toml server
+Restart=on-failure
+RestartSec=5
+LimitNOFILE=65536
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now garage
+msg_ok "Installed Garage"
+
+msg_info "Configuring Garage Bucket"
+RETRIES=0
+until garage -c /opt/garage/garage.toml status &>/dev/null; do
+  RETRIES=$((RETRIES + 1))
+  if [[ $RETRIES -ge 60 ]]; then
+    msg_error "Garage did not become ready within 60 seconds"
+    exit 1
+  fi
+  sleep 1
+done
+NODE_ID=$(garage -c /opt/garage/garage.toml status 2>/dev/null | awk '/^[0-9a-f]/{print $1; exit}')
+if [[ -z "$NODE_ID" ]]; then
+  msg_error "Could not determine Garage node ID from cluster status"
+  exit 1
+fi
+GARAGE_CAPACITY="${GARAGE_CAPACITY:-$(df -BG --output=avail /opt/garage | awk 'NR==2{gsub(/G/,"",$1); v=$1-1; print (v<1?1:v)"G"}')}"
+$STD garage -c /opt/garage/garage.toml layout assign -z dc1 -c "${GARAGE_CAPACITY}" "${NODE_ID}"
+$STD garage -c /opt/garage/garage.toml layout apply --version 1
+GARAGE_KEY_INFO=$(garage -c /opt/garage/garage.toml key create safebucket-key)
+GARAGE_ACCESS_KEY=$(echo "$GARAGE_KEY_INFO" | awk '/Key ID:/{print $3}')
+GARAGE_SECRET_KEY=$(echo "$GARAGE_KEY_INFO" | awk '/Secret key:/{print $3}')
+$STD garage -c /opt/garage/garage.toml bucket create safebucket
+$STD garage -c /opt/garage/garage.toml bucket allow --read --write --owner safebucket --key safebucket-key
+msg_ok "Configured Garage Bucket"
+
+msg_info "Applying CORS Policy to Bucket"
+export AWS_ACCESS_KEY_ID="${GARAGE_ACCESS_KEY}"
+export AWS_SECRET_ACCESS_KEY="${GARAGE_SECRET_KEY}"
+export AWS_DEFAULT_REGION="garage"
+if aws s3api put-bucket-cors \
+  --bucket safebucket \
+  --endpoint-url "http://127.0.0.1:3900" \
+  --cors-configuration '{"CORSRules":[{"AllowedHeaders":["*"],"AllowedMethods":["GET","PUT","POST","DELETE","HEAD"],"AllowedOrigins":["http://'"${LOCAL_IP}"':8080"],"ExposeHeaders":["ETag"]}]}' &>/dev/null; then
+  msg_ok "Applied CORS Policy to Bucket"
+else
+  msg_warn "Could not apply CORS policy automatically; direct browser uploads may fail until CORS is configured manually"
+fi
+unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_DEFAULT_REGION
+
+fetch_and_deploy_gh_release "safebucket" "safebucket/safebucket" "singlefile" "latest" "/opt/safebucket" "safebucket-linux-$(arch_resolve)"
+
+msg_info "Configuring Safebucket"
+useradd --system --no-create-home --shell /usr/sbin/nologin safebucket 2>/dev/null || true
+mkdir -p /opt/safebucket/data/{notifications,activity}
+TOKEN_SECRET=$(openssl rand -base64 32)
+MFA_KEY=$(openssl rand -base64 48 | tr -dc 'a-zA-Z0-9' | cut -c1-32)
+ADMIN_PASSWORD=$(openssl rand -hex 12)
+cat <<EOF >/opt/safebucket/config.yaml
+app:
+  profile: default
+  log_level: info
+  api_url: http://${LOCAL_IP}:8080
+  web_url: http://${LOCAL_IP}:8080
+  allowed_origins:
+    - http://${LOCAL_IP}:8080
+  port: 8080
+  token_secret: "${TOKEN_SECRET}"
+  mfa_encryption_key: "${MFA_KEY}"
+  mfa_required: false
+  admin_email: admin@safebucket.io
+  admin_password: "${ADMIN_PASSWORD}"
+  trash_retention_days: 7
+  max_upload_size: 5368709120
+  trusted_proxies:
+    - 10.0.0.0/8
+    - 172.16.0.0/12
+    - 192.168.0.0/16
+    - 127.0.0.0/8
+    - ::1/128
+    - fc00::/7
+  static_files:
+    enabled: true
+
+database:
+  type: sqlite
+  sqlite:
+    path: /opt/safebucket/data/safebucket.db
+
+cache:
+  type: memory
+
+storage:
+  type: s3
+  s3:
+    bucket_name: safebucket
+    endpoint: 127.0.0.1:3900
+    external_endpoint: http://${LOCAL_IP}:3900
+    access_key: ${GARAGE_ACCESS_KEY}
+    secret_key: ${GARAGE_SECRET_KEY}
+    region: garage
+    force_path_style: true
+    use_tls: false
+
+events:
+  type: memory
+  queues:
+    notifications:
+      name: safebucket-notifications
+    object_deletion:
+      name: safebucket-object-deletion
+    bucket_events:
+      name: safebucket-bucket-events
+
+notifier:
+  type: filesystem
+  filesystem:
+    directory: /opt/safebucket/data/notifications
+
+activity:
+  type: filesystem
+  filesystem:
+    directory: /opt/safebucket/data/activity
+
+auth:
+  providers:
+    local:
+      name: local
+      type: local
+      sharing:
+        allowed: true
+        domains: []
+EOF
+chmod 600 /opt/safebucket/config.yaml
+chown -R safebucket:safebucket /opt/safebucket
+msg_ok "Configured Safebucket"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/safebucket.service
+[Unit]
+Description=Safebucket File Sharing Platform
+After=network-online.target garage.service
+Wants=network-online.target
+Requires=garage.service
+
+[Service]
+Type=simple
+User=safebucket
+Group=safebucket
+WorkingDirectory=/opt/safebucket
+Environment=CONFIG_FILE_PATH=/opt/safebucket/config.yaml
+ExecStart=/opt/safebucket/safebucket
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now safebucket
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/sparkyfitness-install.sh

@@ -70,7 +70,7 @@ Requires=postgresql.service
 Type=simple
 WorkingDirectory=/opt/sparkyfitness/SparkyFitnessServer
 EnvironmentFile=/etc/sparkyfitness/.env
-ExecStart=/opt/sparkyfitness/SparkyFitnessServer/node_modules/.bin/tsx SparkyFitnessServer.js
+ExecStart=/opt/sparkyfitness/SparkyFitnessServer/node_modules/.bin/tsx index.ts
 Restart=always
 RestartSec=5
 
@@ -86,6 +86,7 @@ sed \
   -e 's|${SPARKY_FITNESS_SERVER_PORT}|3010|g' \
   -e "s|\${SPARKY_FITNESS_FRONTEND_URL}|http://${LOCAL_IP}:80|g" \
   -e 's|${NGINX_LISTEN_PORT}|80|g' \
+  -e 's|${NGINX_RATE_LIMIT}|5r/s|g' \
   -e 's|${NGINX_ACCESS_LOG}|/var/log/nginx/sparkyfitness.access.log|g' \
   -e 's|${NGINX_ERROR_LOG}|/var/log/nginx/sparkyfitness.error.log|g' \
   -e 's|root /usr/share/nginx/html;|root /var/www/sparkyfitness;|g' \

install/spliit-install.sh

@@ -15,7 +15,7 @@ update_os
 
 PG_VERSION="16" setup_postgresql
 PG_DB_NAME="spliit" PG_DB_USER="spliit" setup_postgresql_db
-NODE_VERSION="24" setup_nodejs
+NODE_VERSION="26" setup_nodejs
 fetch_and_deploy_gh_release "spliit" "spliit-app/spliit" "tarball"
 
 msg_info "Configuring Application"

install/suggestarr-install.sh

@@ -38,7 +38,9 @@ $STD uv pip install --python /opt/suggestarr/.venv -r /opt/suggestarr/api_servic
 msg_ok "Set up Python Environment"
 
 msg_info "Configuring SuggestArr"
-mkdir -p /opt/suggestarr_data
+mkdir -p /opt/suggestarr_data /opt/suggestarr/config
+rm -rf /opt/suggestarr/config/config_files
+ln -sfn /opt/suggestarr_data /opt/suggestarr/config/config_files
 cat <<EOF >/opt/suggestarr.env
 SUGGESTARR_PORT=5000
 LOG_LEVEL=info

install/tor-snowflake-install.sh

@@ -16,7 +16,8 @@ update_os
 
 msg_info "Building Snowflake"
 GITLAB_URL="https://gitlab.torproject.org" fetch_and_deploy_gl_release "tor-snowflake" "tpo/anti-censorship/pluggable-transports/snowflake" "tarball"
-GO_VERSION="$(grep -m1 '^go ' /opt/tor-snowflake/proxy/go.mod | awk '{print $2}')" setup_go
+GO_VERSION="$(awk '/^go /{print $2; exit}' /opt/tor-snowflake/go.mod 2>/dev/null || true)"
+GO_VERSION="${GO_VERSION:-latest}" setup_go
 cd /opt/tor-snowflake/proxy
 $STD go build -o snowflake-proxy .
 msg_ok "Built Snowflake Proxy"

install/tracearr-install.sh

@@ -67,7 +67,7 @@ cd /opt/tracearr.build
 $STD pnpm install --frozen-lockfile --force
 $STD pnpm turbo telemetry disable
 $STD pnpm turbo run build --no-daemon --filter=@tracearr/shared --filter=@tracearr/server --filter=@tracearr/web
-mkdir -p /opt/tracearr/{packages/shared,apps/server,apps/web,apps/server/src/db}
+mkdir -p /opt/tracearr/{packages/shared,packages/emails,apps/server,apps/web,apps/server/src/db}
 cp -rf package.json /opt/tracearr/
 cp -rf pnpm-workspace.yaml /opt/tracearr/
 cp -rf pnpm-lock.yaml /opt/tracearr/
@@ -77,6 +77,8 @@ cp -rf apps/server/scripts /opt/tracearr/apps/server/scripts
 cp -rf apps/web/dist /opt/tracearr/apps/web/dist
 cp -rf packages/shared/package.json /opt/tracearr/packages/shared/
 cp -rf packages/shared/dist /opt/tracearr/packages/shared/dist
+cp -rf packages/emails/package.json /opt/tracearr/packages/emails/
+cp -rf packages/emails/dist /opt/tracearr/packages/emails/dist
 cp -rf apps/server/src/db/migrations /opt/tracearr/apps/server/src/db/migrations
 cp -rf data /opt/tracearr/data
 mkdir -p /opt/tracearr/data/image-cache

install/valhalla-install.sh

@@ -0,0 +1,187 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: CrazyWolf13
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/valhalla/valhalla
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  autoconf \
+  automake \
+  ccache \
+  clang \
+  clang-tidy \
+  coreutils \
+  cmake \
+  g++ \
+  gcc \
+  git \
+  jq \
+  lcov \
+  libboost-all-dev \
+  libcurl4-openssl-dev \
+  libczmq-dev \
+  libgdal-dev \
+  libgeos++-dev \
+  libgeos-dev \
+  libluajit-5.1-dev \
+  liblz4-dev \
+  libprotobuf-dev \
+  libspatialite-dev \
+  libsqlite3-dev \
+  libsqlite3-mod-spatialite \
+  libtool \
+  libzmq3-dev \
+  lld \
+  locales \
+  luajit \
+  make \
+  osmium-tool \
+  parallel \
+  pkgconf \
+  protobuf-compiler \
+  python3-all-dev \
+  python3-shapely \
+  python3-requests \
+  python3-pip \
+  spatialite-bin \
+  unzip \
+  zlib1g-dev
+msg_ok "Installed Dependencies"
+
+PRIME_SERVER_RELEASE=$(get_latest_github_release "kevinkreiser/prime_server" "false")
+msg_info "Building prime_server ${PRIME_SERVER_RELEASE} (Patience)"
+$STD git clone --recurse-submodules --depth 1 --branch "$PRIME_SERVER_RELEASE" https://github.com/kevinkreiser/prime_server /tmp/prime_server
+cd /tmp/prime_server
+$STD ./autogen.sh
+$STD ./configure
+$STD make -j"$(nproc)"
+$STD make install
+cd /
+rm -rf /tmp/prime_server
+echo "${PRIME_SERVER_RELEASE#v}" >"$HOME/.prime_server"
+msg_ok "Built prime_server"
+
+RELEASE=$(get_latest_github_release "valhalla/valhalla" "false")
+msg_info "Cloning Valhalla ${RELEASE} (Patience)"
+mkdir -p /opt/valhalla
+$STD git clone --recurse-submodules --depth 1 --branch "$RELEASE" https://github.com/valhalla/valhalla.git /opt/valhalla
+msg_ok "Cloned Valhalla ${RELEASE}"
+
+msg_info "Compiling Valhalla ${RELEASE} (this takes 20-45+ minutes, be patient)"
+MEM_MB=$(awk '/MemTotal/{print int($2/1024)}' /proc/meminfo)
+BUILD_JOBS=$((MEM_MB / 2000))
+[[ $BUILD_JOBS -lt 1 ]] && BUILD_JOBS=1
+[[ $BUILD_JOBS -gt $(nproc) ]] && BUILD_JOBS=$(nproc)
+cd /opt/valhalla
+$STD cmake -B build -DCMAKE_BUILD_TYPE=Release -DENABLE_PYTHON_BINDINGS=OFF -DENABLE_TESTS=OFF -DENABLE_SINGLE_FILES_WERROR=OFF
+$STD cmake --build build -- -j"$BUILD_JOBS"
+$STD cmake --install build
+ldconfig
+echo "${RELEASE#v}" >"$HOME/.valhalla"
+msg_ok "Compiled Valhalla ${RELEASE}"
+
+msg_info "Configuring Valhalla"
+useradd --system --no-create-home --shell /usr/sbin/nologin valhalla 2>/dev/null || true
+mkdir -p /opt/valhalla_data/{valhalla_tiles,pbf}
+THREADS=$(nproc)
+valhalla_build_config \
+  --mjolnir-tile-dir /opt/valhalla_data/valhalla_tiles \
+  --mjolnir-tile-extract /opt/valhalla_data/valhalla_tiles.tar \
+  --mjolnir-admin /opt/valhalla_data/admins.sqlite \
+  --mjolnir-timezone /opt/valhalla_data/timezones.sqlite \
+  --mjolnir-concurrency "$THREADS" \
+  >/opt/valhalla_data/valhalla.json
+
+cat <<'EOF' >/opt/valhalla_data/build-tiles.sh
+#!/usr/bin/env bash
+# (Re)builds Valhalla routing tiles from one or more OSM extracts.
+# Usage: build-tiles.sh <pbf-url-or-path> [<pbf-url-or-path> ...]
+# Example: build-tiles.sh https://download.geofabrik.de/europe/germany-latest.osm.pbf
+set -euo pipefail
+export PATH="/usr/local/bin:/usr/local/sbin:$PATH"
+if [[ $# -eq 0 ]]; then
+  echo "Usage: $0 <pbf-url-or-path> [<pbf-url-or-path> ...]" >&2
+  exit 1
+fi
+
+DATA_DIR=/opt/valhalla_data
+CONFIG="$DATA_DIR/valhalla.json"
+mkdir -p "$DATA_DIR/pbf"
+
+FILES=()
+for src in "$@"; do
+  if [[ "$src" == http://* || "$src" == https://* ]]; then
+    fname="$DATA_DIR/pbf/$(basename "$src")"
+    echo "Downloading $src"
+    curl -fL --progress-bar -o "$fname" "$src"
+  else
+    fname="$src"
+  fi
+  FILES+=("$fname")
+done
+
+systemctl stop valhalla
+
+echo "Building admin database"
+valhalla_build_admins --config "$CONFIG" "${FILES[@]}"
+
+echo "Building timezone database"
+valhalla_build_timezones >"$DATA_DIR/timezones.sqlite"
+
+echo "Building initial tile graph"
+valhalla_build_tiles -c "$CONFIG" -e build "${FILES[@]}"
+
+echo "Enhancing tile graph"
+valhalla_build_tiles -c "$CONFIG" -s enhance "${FILES[@]}"
+
+echo "Packing tiles into a single extract"
+valhalla_build_extract -c "$CONFIG" -v
+
+chown -R valhalla:valhalla "$DATA_DIR"
+systemctl start valhalla
+echo "Done. Tiles are in $DATA_DIR/valhalla_tiles (and packed at $DATA_DIR/valhalla_tiles.tar)."
+EOF
+chmod +x /opt/valhalla_data/build-tiles.sh
+chown -R valhalla:valhalla /opt/valhalla_data
+msg_ok "Configured Valhalla"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/valhalla.service
+[Unit]
+Description=Valhalla Routing Engine
+After=network.target
+
+[Service]
+Type=simple
+User=valhalla
+Group=valhalla
+WorkingDirectory=/opt/valhalla_data
+ExecStart=/usr/local/bin/valhalla_service /opt/valhalla_data/valhalla.json ${THREADS}
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now valhalla
+msg_ok "Created Service"
+
+if [[ -n "${VALHALLA_PBF_URLS:-}" ]]; then
+  msg_info "Building Initial Tiles from VALHALLA_PBF_URLS (this can take a long time)"
+  $STD /opt/valhalla_data/build-tiles.sh $VALHALLA_PBF_URLS
+  msg_ok "Built Initial Tiles"
+fi
+
+motd_ssh
+customize
+cleanup_lxc

misc/core.func

@@ -15,6 +15,11 @@
 [[ -n "${_CORE_FUNC_LOADED:-}" ]] && return
 _CORE_FUNC_LOADED=1
 
+if [[ -z "${HOME:-}" ]]; then
+  HOME="$(getent passwd "$(id -u)" 2>/dev/null | cut -d: -f6)"
+  export HOME="${HOME:-/root}"
+fi
+
 # ==============================================================================
 # SECTION 1: INITIALIZATION & SETUP
 # ==============================================================================

tools/addon/dockhand.sh

@@ -0,0 +1,111 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Finsys/dockhand
+
+if command -v curl >/dev/null 2>&1; then
+  source <(curl -fsSL ${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/core.func)
+  load_functions
+elif command -v wget >/dev/null 2>&1; then
+  source <(wget -qO- ${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/core.func)
+  load_functions
+fi
+source <(curl -fsSL ${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/lib/tools.func)
+
+color
+catch_errors
+
+APP="Dockhand"
+APP_TYPE="addon"
+INSTALL_PATH="/opt/dockhand"
+COMPOSE_FILE="${INSTALL_PATH}/docker-compose.yaml"
+DEFAULT_PORT=3000
+
+header_info "$APP"
+
+IP=$(_get_current_ip)
+
+function check_docker() {
+  if ! command -v docker >/dev/null 2>&1; then
+    msg_error "Docker is not installed. This addon requires an existing Docker host/LXC. Exiting."
+    exit 1
+  fi
+  if ! docker compose version >/dev/null 2>&1; then
+    msg_error "Docker Compose plugin is not available. Install it before running this addon. Exiting."
+    exit 1
+  fi
+  msg_ok "Docker $(docker --version | cut -d' ' -f3 | tr -d ',') and Docker Compose are available"
+}
+
+function install_dockhand() {
+  local port="${1:-$DEFAULT_PORT}"
+  check_docker
+
+  msg_info "Creating Compose Project"
+  mkdir -p "$INSTALL_PATH"
+  cat <<EOF >"$COMPOSE_FILE"
+services:
+  dockhand:
+    image: fnsys/dockhand:latest
+    container_name: dockhand
+    restart: unless-stopped
+    ports:
+      - ${port}:3000
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - dockhand_data:/app/data
+
+volumes:
+  dockhand_data:
+EOF
+  msg_ok "Created Compose Project"
+
+  msg_info "Starting ${APP}"
+  cd "$INSTALL_PATH"
+  $STD docker compose up -d
+  msg_ok "Started ${APP}"
+
+  msg_ok "${APP} is reachable at http://${IP}:${port}"
+  echo -e "${TAB}Open the URL and complete the first-run setup wizard to create the admin account."
+}
+
+function update_dockhand() {
+  msg_info "Pulling latest ${APP} image"
+  cd "$INSTALL_PATH"
+  $STD docker compose pull
+  msg_ok "Pulled latest image"
+
+  msg_info "Restarting ${APP}"
+  $STD docker compose up -d --remove-orphans
+  msg_ok "Restarted ${APP}"
+
+  msg_ok "${APP} updated successfully"
+}
+
+function uninstall_dockhand() {
+  msg_info "Removing ${APP}"
+  cd "$INSTALL_PATH"
+  $STD docker compose down --remove-orphans
+  cd /
+  rm -rf "$INSTALL_PATH"
+  msg_ok "${APP} uninstalled (the dockhand_data volume was kept; remove it with: docker volume rm dockhand_data)"
+}
+
+if [[ -f "$COMPOSE_FILE" ]]; then
+  read -r -p "Update (1), Uninstall (2), Cancel (3)? [1/2/3]: " action
+  action="${action//[[:space:]]/}"
+  case "$action" in
+  1) update_dockhand ;;
+  2) uninstall_dockhand ;;
+  3) msg_info "Cancelled" ;;
+  *) msg_error "Invalid input" ;;
+  esac
+else
+  read -r -p "Enter port number (default: ${DEFAULT_PORT}): " PORT_INPUT
+  PORT="${PORT_INPUT:-$DEFAULT_PORT}"
+  read -r -p "Install ${APP}? (y/n): " answer
+  answer="${answer//[[:space:]]/}"
+  [[ "${answer,,}" =~ ^(y|yes)$ ]] && install_dockhand "$PORT" || msg_info "Installation skipped"
+fi

tools/headers/dockhand

@@ -0,0 +1,6 @@
+    ____             __   __                    __
+   / __ \____  _____/ /__/ /_  ____ _____  ____/ /
+  / / / / __ \/ ___/ //_/ __ \/ __ `/ __ \/ __  / 
+ / /_/ / /_/ / /__/ ,< / / / / /_/ / / / / /_/ /  
+/_____/\____/\___/_/|_/_/ /_/\__,_/_/ /_/\__,_/   
+                                                  

tools/pve/guest-delete.sh

@@ -0,0 +1,189 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+
+function header_info {
+  clear
+  cat <<"EOF"
+    ____                                          ______                __     ____       __     __
+   / __ \_________  _  ______ ___  ____  _  __   / ____/_  _____  _____/ /_   / __ \___  / /__  / /____
+  / /_/ / ___/ __ \| |/_/ __ `__ \/ __ \| |/_/  / / __/ / / / _ \/ ___/ __/  / / / / _ \/ / _ \/ __/ _ \
+ / ____/ /  / /_/ />  </ / / / / / /_/ />  <   / /_/ / /_/ /  __(__  ) /_   / /_/ /  __/ /  __/ /_/  __/
+/_/   /_/   \____/_/|_/_/ /_/ /_/\____/_/|_|   \____/\__,_/\___/____/\__/  /_____/\___/_/\___/\__/\___/
+
+EOF
+}
+
+spinner() {
+  local pid=$1
+  local delay=0.1
+  local spinstr='|/-\'
+  while ps -p $pid >/dev/null; do
+    printf " [%c]  " "$spinstr"
+    spinstr=${spinstr#?}${spinstr%"${spinstr#?}"}
+    sleep $delay
+    printf "\r"
+  done
+  printf "    \r"
+}
+
+set -eEuo pipefail
+YW=$(echo "\033[33m")
+BL=$(echo "\033[36m")
+RD=$(echo "\033[01;31m")
+GN=$(echo "\033[1;92m")
+CL=$(echo "\033[m")
+TAB="  "
+CM="${TAB}✔️${TAB}${CL}"
+
+# Telemetry
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/api.func) 2>/dev/null || true
+declare -f init_tool_telemetry &>/dev/null && init_tool_telemetry "guest-delete" "pve"
+
+GUEST_LOG=$(mktemp)
+trap 'rm -f "$GUEST_LOG"' EXIT
+
+# pct and qm differ in both their subcommands and their list layout, so every
+# guest carries its type from the menu through to the destroy call.
+stop_guest() {
+  local type=$1 id=$2 pid
+  if [ "$type" == "ct" ]; then
+    pct stop "$id" >"$GUEST_LOG" 2>&1 &
+  else
+    qm stop "$id" >"$GUEST_LOG" 2>&1 &
+  fi
+  pid=$!
+  spinner "$pid"
+  wait "$pid" || true
+}
+
+destroy_guest() {
+  local type=$1 id=$2 pid
+  if [ "$type" == "ct" ]; then
+    pct destroy "$id" -f >"$GUEST_LOG" 2>&1 &
+  else
+    qm destroy "$id" --purge --destroy-unreferenced-disks >"$GUEST_LOG" 2>&1 &
+  fi
+  pid=$!
+  spinner "$pid"
+  wait "$pid"
+}
+
+header_info
+echo "Loading..."
+whiptail --backtitle "Proxmox VE Helper Scripts" --title "Proxmox VE Guest Deletion" --yesno "This will delete LXC containers and/or VMs. Proceed?" 10 58
+
+NODE=$(hostname)
+containers=$(pct list 2>/dev/null | tail -n +2 || true)
+vms=$(qm list 2>/dev/null | tail -n +2 || true)
+
+if [ -z "$containers" ] && [ -z "$vms" ]; then
+  whiptail --title "Guest Delete" --msgbox "No LXC containers or VMs available!" 10 60
+  exit 234
+fi
+
+declare -A GUEST_TYPE=()
+menu_items=()
+FORMAT="%-4s %-20s %-10s"
+
+if [ -n "$containers" ]; then
+  menu_items+=("ALL-CT" "$(printf "$FORMAT" "CT" "Delete ALL containers" "")" "OFF")
+  while read -r line; do
+    [ -z "$line" ] && continue
+    # pct list: VMID Status [Lock] Name -- Lock is usually blank, so take the
+    # name from the end of the row rather than a fixed column.
+    container_id=$(awk '{print $1}' <<<"$line")
+    container_status=$(awk '{print $2}' <<<"$line")
+    container_name=$(awk '{print $NF}' <<<"$line")
+    GUEST_TYPE[$container_id]="ct"
+    menu_items+=("$container_id" "$(printf "$FORMAT" "CT" "$container_name" "$container_status")" "OFF")
+  done <<<"$containers"
+fi
+
+if [ -n "$vms" ]; then
+  menu_items+=("ALL-VM" "$(printf "$FORMAT" "VM" "Delete ALL VMs" "")" "OFF")
+  while read -r line; do
+    [ -z "$line" ] && continue
+    # qm list: VMID NAME STATUS MEM(MB) BOOTDISK(GB) PID
+    vm_id=$(awk '{print $1}' <<<"$line")
+    vm_name=$(awk '{print $2}' <<<"$line")
+    vm_status=$(awk '{print $3}' <<<"$line")
+    GUEST_TYPE[$vm_id]="vm"
+    menu_items+=("$vm_id" "$(printf "$FORMAT" "VM" "$vm_name" "$vm_status")" "OFF")
+  done <<<"$vms"
+fi
+
+CHOICES=$(whiptail --title "Guest Delete" \
+  --checklist "Select LXC containers and VMs to delete:" 25 70 13 \
+  "${menu_items[@]}" 3>&2 2>&1 1>&3 || true)
+
+if [ -z "$CHOICES" ]; then
+  whiptail --title "Guest Delete" \
+    --msgbox "No guests selected!" 10 60
+  exit 0
+fi
+
+read -p "Delete guests manually or automatically? (Default: manual) m/a: " DELETE_MODE
+DELETE_MODE=${DELETE_MODE:-m}
+
+# Expand the ALL entries, keeping each ID once so selecting ALL alongside a
+# single guest does not try to destroy that guest twice.
+expanded_ids=""
+for choice in $(echo "$CHOICES" | tr -d '"' | tr -s ' ' '\n'); do
+  case "$choice" in
+  ALL-CT) expanded_ids+=$'\n'$(awk '{print $1}' <<<"$containers") ;;
+  ALL-VM) expanded_ids+=$'\n'$(awk '{print $1}' <<<"$vms") ;;
+  *) expanded_ids+=$'\n'"$choice" ;;
+  esac
+done
+selected_ids=$(echo "$expanded_ids" | sed '/^$/d' | awk '!seen[$0]++')
+
+for guest_id in $selected_ids; do
+  guest_type="${GUEST_TYPE[$guest_id]:-}"
+  if [ -z "$guest_type" ]; then
+    echo -e "${BL}[Info]${RD} Skipping unknown guest $guest_id...${CL}"
+    continue
+  fi
+
+  if [ "$guest_type" == "ct" ]; then
+    label="container $guest_id"
+  else
+    label="VM $guest_id"
+  fi
+
+  if [[ "$DELETE_MODE" == "a" ]]; then
+    echo -e "${BL}[Info]${GN} Automatically deleting $label...${CL}"
+  else
+    read -p "Delete $label? (y/N): " CONFIRM
+    if [[ ! "$CONFIRM" =~ ^[Yy]$ ]]; then
+      echo -e "${BL}[Info]${RD} Skipping $label...${CL}"
+      continue
+    fi
+    echo -e "${BL}[Info]${GN} Deleting $label...${CL}"
+  fi
+
+  # Stop only once the deletion is confirmed, so declining leaves a running
+  # guest running instead of powering it off on the way out.
+  if [ "$guest_type" == "ct" ]; then
+    status=$(pct status "$guest_id" 2>/dev/null || echo "unknown")
+  else
+    status=$(qm status "$guest_id" 2>/dev/null || echo "unknown")
+  fi
+
+  if [ "$status" == "status: running" ]; then
+    echo -e "${BL}[Info]${GN} Stopping $label...${CL}"
+    stop_guest "$guest_type" "$guest_id"
+    echo -e "${BL}[Info]${GN} ${label^} stopped.${CL}"
+  fi
+
+  if destroy_guest "$guest_type" "$guest_id"; then
+    echo -e "${CM}${GN}${label^} deleted.${CL}"
+  else
+    whiptail --title "Error" --msgbox "Failed to delete ${label}.\n\n$(tail -n 5 "$GUEST_LOG")" 15 70
+  fi
+done
+
+header_info
+echo -e "${GN}Deletion process completed.${CL}\n"

tools/pve/lxc-delete.sh

@@ -1,119 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-
-function header_info {
-  clear
-  cat <<"EOF"
-    ____                                          __   _  ________   ____       __     __
-   / __ \_________  _  ______ ___  ____  _  __   / /  | |/ / ____/  / __ \___  / /__  / /____
-  / /_/ / ___/ __ \| |/_/ __ `__ \/ __ \| |/_/  / /   |   / /      / / / / _ \/ / _ \/ __/ _ \
- / ____/ /  / /_/ />  </ / / / / / /_/ />  <   / /___/   / /___   / /_/ /  __/ /  __/ /_/  __/
-/_/   /_/   \____/_/|_/_/ /_/ /_/\____/_/|_|  /_____/_/|_\____/  /_____/\___/_/\___/\__/\___/
-
-EOF
-}
-
-spinner() {
-  local pid=$1
-  local delay=0.1
-  local spinstr='|/-\'
-  while ps -p $pid >/dev/null; do
-    printf " [%c]  " "$spinstr"
-    spinstr=${spinstr#?}${spinstr%"${spinstr#?}"}
-    sleep $delay
-    printf "\r"
-  done
-  printf "    \r"
-}
-
-set -eEuo pipefail
-YW=$(echo "\033[33m")
-BL=$(echo "\033[36m")
-RD=$(echo "\033[01;31m")
-GN=$(echo "\033[1;92m")
-CL=$(echo "\033[m")
-TAB="  "
-CM="${TAB}✔️${TAB}${CL}"
-
-# Telemetry
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/api.func) 2>/dev/null || true
-declare -f init_tool_telemetry &>/dev/null && init_tool_telemetry "lxc-delete" "pve"
-
-header_info
-echo "Loading..."
-whiptail --backtitle "Proxmox VE Helper Scripts" --title "Proxmox VE LXC Deletion" --yesno "This will delete LXC containers. Proceed?" 10 58
-
-NODE=$(hostname)
-containers=$(pct list | tail -n +2 | awk '{print $0 " " $4}')
-
-if [ -z "$containers" ]; then
-  whiptail --title "LXC Container Delete" --msgbox "No LXC containers available!" 10 60
-  exit 234
-fi
-
-menu_items=("ALL" "Delete ALL containers" "OFF") # Add as first option
-FORMAT="%-10s %-15s %-10s"
-
-while read -r container; do
-  container_id=$(echo $container | awk '{print $1}')
-  container_name=$(echo $container | awk '{print $2}')
-  container_status=$(echo $container | awk '{print $3}')
-  formatted_line=$(printf "$FORMAT" "$container_name" "$container_status")
-  menu_items+=("$container_id" "$formatted_line" "OFF")
-done <<<"$containers"
-
-CHOICES=$(whiptail --title "LXC Container Delete" \
-  --checklist "Select LXC containers to delete:" 25 60 13 \
-  "${menu_items[@]}" 3>&2 2>&1 1>&3)
-
-if [ -z "$CHOICES" ]; then
-  whiptail --title "LXC Container Delete" \
-    --msgbox "No containers selected!" 10 60
-  exit 0
-fi
-
-read -p "Delete containers manually or automatically? (Default: manual) m/a: " DELETE_MODE
-DELETE_MODE=${DELETE_MODE:-m}
-
-selected_ids=$(echo "$CHOICES" | tr -d '"' | tr -s ' ' '\n')
-
-# If "ALL" is selected, override with all container IDs
-if echo "$selected_ids" | grep -q "^ALL$"; then
-  selected_ids=$(echo "$containers" | awk '{print $1}')
-fi
-
-for container_id in $selected_ids; do
-  status=$(pct status $container_id)
-
-  if [ "$status" == "status: running" ]; then
-    echo -e "${BL}[Info]${GN} Stopping container $container_id...${CL}"
-    pct stop $container_id &
-    sleep 5
-    echo -e "${BL}[Info]${GN} Container $container_id stopped.${CL}"
-  fi
-
-  if [[ "$DELETE_MODE" == "a" ]]; then
-    echo -e "${BL}[Info]${GN} Automatically deleting container $container_id...${CL}"
-    pct destroy "$container_id" -f &
-    pid=$!
-    spinner $pid
-    [ $? -eq 0 ] && echo "Container $container_id deleted." || whiptail --title "Error" --msgbox "Failed to delete container $container_id." 10 60
-  else
-    read -p "Delete container $container_id? (y/N): " CONFIRM
-    if [[ "$CONFIRM" =~ ^[Yy]$ ]]; then
-      echo -e "${BL}[Info]${GN} Deleting container $container_id...${CL}"
-      pct destroy "$container_id" -f &
-      pid=$!
-      spinner $pid
-      [ $? -eq 0 ] && echo "Container $container_id deleted." || whiptail --title "Error" --msgbox "Failed to delete container $container_id." 10 60
-    else
-      echo -e "${BL}[Info]${RD} Skipping container $container_id...${CL}"
-    fi
-  fi
-done
-
-header_info
-echo -e "${GN}Deletion process completed.${CL}\n"

tools/pve/monitor-all.sh

@@ -45,6 +45,8 @@ add() {
 excluded_instances=("$@")
 echo "Excluded instances: ${excluded_instances[@]}"
 
+value_of() { sed -n "s/^$1:[[:space:]]*//p" <<<"$config" | head -n1; }
+
 while true; do
 
   for instance in $(pct list | awk 'NR>1 {print $1}'; qm list | awk 'NR>1 {print $1}'); do
@@ -59,21 +61,21 @@ while true; do
     if [ -r "/etc/pve/lxc/$instance.conf" ]; then
       type="ct"
       config_file="/etc/pve/lxc/$instance.conf"
-    else
+    elif [ -r "/etc/pve/qemu-server/$instance.conf" ]; then
       type="vm"
       config_file="/etc/pve/qemu-server/$instance.conf"
+    else
+      echo "Skipping $instance because its config is no longer readable"
+      continue
     fi
     config=$(sed '/^\[/,$d' "$config_file")
 
-    # Skip templates and onboot-disabled
+    # Both are booleans that Proxmox also writes as 0, so the value decides and
-    if grep -q "onboot: 0" <<<"$config" || ! grep -q "onboot" <<<"$config"; then
+    # not the presence of the key.
-      onboot="true"
+    [ "$(value_of onboot)" = "1" ] && onboot="true" || onboot="false"
-    else
+    [ "$(value_of template)" = "1" ] && template="true" || template="false"
-      onboot="false"
-    fi
-    template=$(grep -q "^template:" <<<"$config" && echo "true" || echo "false")
 
-    if [ "$onboot" == "true" ]; then
+    if [ "$onboot" != "true" ]; then
       echo "Skipping $instance because it is set not to boot"
       continue
     elif [ "$template" == "true" ]; then
@@ -81,34 +83,40 @@ while true; do
       continue
     fi
 
-    # Check for mon-restart tag
+    # Tags are semicolon separated, so match a whole entry instead of a
-    has_tag=$(grep -q "tags:.*mon-restart" <<<"$config" && echo "true" || echo "false")
+    # substring of a longer tag such as mon-restart-disabled.
-    if [ "$has_tag" != "true" ]; then
+    tags=";$(value_of tags | tr -d '[:space:]');"
+    if [[ "$tags" != *";mon-restart;"* ]]; then
       echo "Skipping $instance because it does not have 'mon-restart' tag"
       continue
     fi
 
     # Responsiveness check and restart if needed
     if [ "$type" == "vm" ]; then
-      # Check if guest agent responds
+      if ! qm status "$instance" 2>/dev/null | grep -q "status: running"; then
-      if qm guest cmd $instance ping >/dev/null 2>&1; then
+        echo "$(date): VM $instance is not running, starting..."
+        qm start "$instance" >/dev/null 2>&1
+      elif qm guest cmd "$instance" ping >/dev/null 2>&1; then
         echo "VM $instance is responsive via guest agent"
       else
         echo "$(date): VM $instance is not responding to agent ping, restarting..."
-        if qm status $instance | grep -q "status: running"; then
+        qm stop "$instance" >/dev/null 2>&1
-          qm stop $instance >/dev/null 2>&1
+        sleep 5
-          sleep 5
+        qm start "$instance" >/dev/null 2>&1
-        fi
-        qm start $instance >/dev/null 2>&1
       fi
     else
-      # Container: get IP and ping
+      if ! pct status "$instance" 2>/dev/null | grep -q "status: running"; then
-      IP=$(pct exec $instance ip a s dev eth0 | awk '/inet / {print $2}' | cut -d/ -f1 | head -n1)
+        echo "$(date): CT $instance is not running, starting..."
-      if ! ping -c 1 $IP >/dev/null 2>&1; then
+        pct start "$instance" >/dev/null 2>&1
+        continue
+      fi
+      # Not every container names its interface eth0.
+      IP=$(pct exec "$instance" -- ip -4 -o addr show scope global 2>/dev/null | awk '{print $4}' | cut -d/ -f1 | head -n1)
+      if [ -z "$IP" ] || ! ping -c 1 -W 2 "$IP" >/dev/null 2>&1; then
         echo "$(date): CT $instance is not responding, restarting..."
-        pct stop $instance >/dev/null 2>&1
+        pct stop "$instance" >/dev/null 2>&1
         sleep 5
-        pct start $instance >/dev/null 2>&1
+        pct start "$instance" >/dev/null 2>&1
       else
         echo "CT $instance is responsive"
       fi
@@ -124,23 +132,18 @@ EOF
   touch /var/log/ping-instances.log
   chmod +x /usr/local/bin/ping-instances.sh
 
-  cat <<EOF >/etc/systemd/system/ping-instances.timer
+  # The service loops with its own five minute sleep, so the timer that earlier
-[Unit]
+  # versions installed could only ever start a unit that was already running.
-Description=Delay ping-instances.service by 5 minutes
+  if [[ -f /etc/systemd/system/ping-instances.timer ]]; then
-
+    systemctl disable -q --now ping-instances.timer 2>/dev/null || true
-[Timer]
+    rm -f /etc/systemd/system/ping-instances.timer
-OnBootSec=300
+  fi
-OnUnitActiveSec=300
-
-[Install]
-WantedBy=timers.target
-EOF
 
   cat <<EOF >/etc/systemd/system/ping-instances.service
 [Unit]
 Description=Ping instances every 5 minutes and restart if necessary
-After=ping-instances.timer
+After=pve-cluster.service
-Requires=ping-instances.timer
+Wants=pve-cluster.service
 
 [Service]
 Type=simple
@@ -158,7 +161,6 @@ WantedBy=multi-user.target
 EOF
 
   systemctl daemon-reload
-  systemctl enable -q --now ping-instances.timer
   systemctl enable -q --now ping-instances.service
   clear
   echo -e "\n Monitor All installed."
@@ -167,7 +169,7 @@ EOF
 }
 
 remove() {
-  systemctl disable -q --now ping-instances.timer
+  systemctl disable -q --now ping-instances.timer 2>/dev/null || true
   systemctl disable -q --now ping-instances.service
   rm -f /etc/systemd/system/ping-instances.service
   rm -f /etc/systemd/system/ping-instances.timer