chore(ct): sync cloudflare-ddns defaults from PocketBase

Update .app files (#17441 )
Co-authored-by: GitHub Actions <github-actions[bot]@users.noreply.github.com>
2026-09-22 18:30:37 +00:00 · 2026-09-22 14:15:46 +00:00 · 2026-09-22 16:07:59 +02:00 · 2026-09-22 14:07:00 +00:00 · 2026-09-22 14:06:46 +00:00 · 2026-09-22 16:06:15 +02:00
149 changed files with 3924 additions and 4944 deletions
@@ -8,7 +8,12 @@
        "turnkey/**",
        "vm/**"
      ],
-      "excludeGlobs": []
+      "excludeGlobs": [
+        "**/headers/**",
+        "ct/headers/**",
+        "tools/headers/**",
+        "vm/headers/**"
+      ]
    }
  ],
  "update script": [
@@ -41,7 +46,12 @@
      "includeGlobs": [
        "vm/**"
      ],
-      "excludeGlobs": []
+      "excludeGlobs": [
+        "**/headers/**",
+        "ct/headers/**",
+        "tools/headers/**",
+        "vm/headers/**"
+      ]
    }
  ],
  "tools": [
@@ -1,3 +1,321 @@
+## 2026-09-19
+
+### 🆕 New Scripts
+
+  - qBit-Manage ([#17377](https://github.com/community-scripts/ProxmoxVE/pull/17377))
+- Ubuntu-VM: AIO | new core | performance | remove old wrappers [@MickLesk](https://github.com/MickLesk) ([#17354](https://github.com/community-scripts/ProxmoxVE/pull/17354))
+
+### 💾 Core
+
+  - Fall back to the unversioned banner slug [@MickLesk](https://github.com/MickLesk) ([core#48](https://github.com/community-scripts/core/pull/48))
+
+### ❔ Uncategorized
+
+  - chore(ct): sync immichframe defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17373](https://github.com/community-scripts/ProxmoxVE/pull/17373))
+
+## 2026-09-18
+
+### 🆕 New Scripts
+
+  - Almalinux-VM ([#17349](https://github.com/community-scripts/ProxmoxVE/pull/17349))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - update authentik to 2026.8.3 [@thieneret](https://github.com/thieneret) ([#17366](https://github.com/community-scripts/ProxmoxVE/pull/17366))
+    - crafty-controller: chown after restore_backup so restored data keeps ownership [@MickLesk](https://github.com/MickLesk) ([#17348](https://github.com/community-scripts/ProxmoxVE/pull/17348))
+    - databasus, domain-monitor, poznote: chown after restore_backup so restored data keeps its owner [@MickLesk](https://github.com/MickLesk) ([#17350](https://github.com/community-scripts/ProxmoxVE/pull/17350))
+    - alpine-vm: ask for the Cloud-Init credentials [@MickLesk](https://github.com/MickLesk) ([#17355](https://github.com/community-scripts/ProxmoxVE/pull/17355))
+    - suggestarr: keep the data where the app actually reads it [@MickLesk](https://github.com/MickLesk) ([#17317](https://github.com/community-scripts/ProxmoxVE/pull/17317))
+    - immichframe: set the admin password the new admin UI requires [@MickLesk](https://github.com/MickLesk) ([#17315](https://github.com/community-scripts/ProxmoxVE/pull/17315))
+
+  - #### ✨ New Features
+
+    - pangolin: Bump to 1.23.0 [@MickLesk](https://github.com/MickLesk) ([#17343](https://github.com/community-scripts/ProxmoxVE/pull/17343))
+
+  - #### 🔧 Refactor
+
+    - Refactor: Oxicloud [@MickLesk](https://github.com/MickLesk) ([#17338](https://github.com/community-scripts/ProxmoxVE/pull/17338))
+
+### 💾 Core
+
+  - Stop a modified conffile from aborting the whole update [@MickLesk](https://github.com/MickLesk) ([core#47](https://github.com/community-scripts/core/pull/47))
+- Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#46](https://github.com/community-scripts/core/pull/46))
+- github api: retry a 200 that is not a usable release payload [@MickLesk](https://github.com/MickLesk) ([core#45](https://github.com/community-scripts/core/pull/45))
+
+### 📚 Documentation
+
+  - chore: fix PR template help [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17364](https://github.com/community-scripts/ProxmoxVE/pull/17364))
+
+## 2026-09-17
+
+### 🆕 New Scripts
+
+  - Alpine-VM ([#17324](https://github.com/community-scripts/ProxmoxVE/pull/17324))
+- Allstarlink ([#17321](https://github.com/community-scripts/ProxmoxVE/pull/17321))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - changedetection: update: various fixes [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17331](https://github.com/community-scripts/ProxmoxVE/pull/17331))
+    - sparkyfitness: run the Better Auth migration during the update [@MickLesk](https://github.com/MickLesk) ([#17318](https://github.com/community-scripts/ProxmoxVE/pull/17318))
+    - poznote: follow init.sh into docker/ [@MickLesk](https://github.com/MickLesk) ([#17316](https://github.com/community-scripts/ProxmoxVE/pull/17316))
+
+  - #### ✨ New Features
+
+    - romm: make the library paths follow ROMM_BASE_PATH [@MickLesk](https://github.com/MickLesk) ([#17279](https://github.com/community-scripts/ProxmoxVE/pull/17279))
+    - Debian-VM: Refactor | Support Debian 11, 12, 13 [@MickLesk](https://github.com/MickLesk) ([#17325](https://github.com/community-scripts/ProxmoxVE/pull/17325))
+
+### 💾 Core
+
+  - Ask before replacing a cached image that no longer matches [@MickLesk](https://github.com/MickLesk) ([core#44](https://github.com/community-scripts/core/pull/44))
+
+## 2026-09-16
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Immich: Pin to v3.2.2 [@vhsdream](https://github.com/vhsdream) ([#17307](https://github.com/community-scripts/ProxmoxVE/pull/17307))
+    - Dispatcharr: Bump to 4G RAM [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17302](https://github.com/community-scripts/ProxmoxVE/pull/17302))
+    - navidrome: repair root-owned data folders left by 0.61.x [@MickLesk](https://github.com/MickLesk) ([#17275](https://github.com/community-scripts/ProxmoxVE/pull/17275))
+    - tor-snowflake: read the Go version from the module root [@MickLesk](https://github.com/MickLesk) ([#17276](https://github.com/community-scripts/ProxmoxVE/pull/17276))
+    - docmost: stop corepack asking for confirmation during the build [@MickLesk](https://github.com/MickLesk) ([#17282](https://github.com/community-scripts/ProxmoxVE/pull/17282))
+
+  - #### ✨ New Features
+
+    - Refactor: TrueNAS VM (core / improve functions / performance) [@MickLesk](https://github.com/MickLesk) ([#17277](https://github.com/community-scripts/ProxmoxVE/pull/17277))
+    - Frigate: Bump to 0.18.0 [@MickLesk](https://github.com/MickLesk) ([#17273](https://github.com/community-scripts/ProxmoxVE/pull/17273))
+    - Refactor: HomeAssistant-OS (core / improve functions / performance) [@MickLesk](https://github.com/MickLesk) ([#17281](https://github.com/community-scripts/ProxmoxVE/pull/17281))
+
+### 💾 Core
+
+  - Read the IGC version compute-runtime pins, instead of taking the newest [@MickLesk](https://github.com/MickLesk) ([core#43](https://github.com/community-scripts/core/pull/43))
+- Install the Intel driver dependency before the .deb that needs it [@MickLesk](https://github.com/MickLesk) ([core#42](https://github.com/community-scripts/core/pull/42))
+
+### 📚 Documentation
+
+  - pocketbase-bot: accept the var_ names and two missing fields [@MickLesk](https://github.com/MickLesk) ([#17305](https://github.com/community-scripts/ProxmoxVE/pull/17305))
+
+## 2026-09-15
+
+### 🆕 New Scripts
+
+  - valhalla ([#17231](https://github.com/community-scripts/ProxmoxVE/pull/17231))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - borg-ui: missing dependency `sshpass` [@christian-forgacs](https://github.com/christian-forgacs) ([#17286](https://github.com/community-scripts/ProxmoxVE/pull/17286))
+    - tracearr: copy packages/emails into the deploy tree [@connorgallopo](https://github.com/connorgallopo) ([#17268](https://github.com/community-scripts/ProxmoxVE/pull/17268))
+    - Immich: Pin to v3.2.1 [@vhsdream](https://github.com/vhsdream) ([#17264](https://github.com/community-scripts/ProxmoxVE/pull/17264))
+
+### 💾 Core
+
+  - Add vm_extract_image, which two VM scripts already call [@MickLesk](https://github.com/MickLesk) ([core#40](https://github.com/community-scripts/core/pull/40))
+- Releases: rank releases on their numbers, not on sort -V over the raw tag [@MickLesk](https://github.com/MickLesk) ([core#39](https://github.com/community-scripts/core/pull/39))
+
+### 🧰 Tools
+
+  - #### 🔧 Refactor
+
+    - Refactor: monitor-all (decide on flag values, not on key presence) [@MickLesk](https://github.com/MickLesk) ([#17261](https://github.com/community-scripts/ProxmoxVE/pull/17261))
+
+## 2026-09-14
+
+### 🆕 New Scripts
+
+  - Borg-UI ([#17258](https://github.com/community-scripts/ProxmoxVE/pull/17258))
+
+### 🚀 Updated Scripts
+
+  - SparkyFitness: substitute NGINX_RATE_LIMIT in nginx config [@RafBorrelli](https://github.com/RafBorrelli) ([#17256](https://github.com/community-scripts/ProxmoxVE/pull/17256))
+
+  - #### 🐞 Bug Fixes
+
+    - spliit: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17250](https://github.com/community-scripts/ProxmoxVE/pull/17250))
+
+## 2026-09-13
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Downgrade iobroker to Node 24 [@Copilot](https://github.com/Copilot) ([#17229](https://github.com/community-scripts/ProxmoxVE/pull/17229))
+
+### 💾 Core
+
+  - Pick the highest release version, not the newest published one [@MickLesk](https://github.com/MickLesk) ([core#38](https://github.com/community-scripts/core/pull/38))
+
+## 2026-09-12
+
+### 🆕 New Scripts
+
+  - Elasticsearch ([#17188](https://github.com/community-scripts/ProxmoxVE/pull/17188))
+- Hammer ([#17189](https://github.com/community-scripts/ProxmoxVE/pull/17189))
+- gotenberg ([#17205](https://github.com/community-scripts/ProxmoxVE/pull/17205))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(dispatcharr): add comskip installation and build dependencies [@eXistC](https://github.com/eXistC) ([#16224](https://github.com/community-scripts/ProxmoxVE/pull/16224))
+    - poznote: serve from src/public docroot [@MickLesk](https://github.com/MickLesk) ([#17187](https://github.com/community-scripts/ProxmoxVE/pull/17187))
+    - calibre-web: use calibreweb release identifier to avoid version file collision [@MickLesk](https://github.com/MickLesk) ([#17186](https://github.com/community-scripts/ProxmoxVE/pull/17186))
+
+  - #### ✨ New Features
+
+    - Docker VM: Feature Bump - Refactor script for improved functionality [@MickLesk](https://github.com/MickLesk) ([#17216](https://github.com/community-scripts/ProxmoxVE/pull/17216))
+    - feat(jitsi-meet): optional public setup (FQDN, Let's Encrypt, NAT, secure domain) [@klanghans](https://github.com/klanghans) ([#17132](https://github.com/community-scripts/ProxmoxVE/pull/17132))
+
+  - #### 🔧 Refactor
+
+    - Paperless-NGX: add --no-sync to uv run services [@MickLesk](https://github.com/MickLesk) ([#17210](https://github.com/community-scripts/ProxmoxVE/pull/17210))
+
+### 💾 Core
+
+  - VM's: show the selected CPU model instead of doubling it [@MickLesk](https://github.com/MickLesk) ([core#37](https://github.com/community-scripts/core/pull/37))
+- Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#36](https://github.com/community-scripts/core/pull/36))
+
+## 2026-09-11
+
+### 🆕 New Scripts
+
+  - Lemonade-Server ([#17190](https://github.com/community-scripts/ProxmoxVE/pull/17190))
+- OneTimeSecret ([#17097](https://github.com/community-scripts/ProxmoxVE/pull/17097))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - update authentik to 2026.8.2 [@thieneret](https://github.com/thieneret) ([#17198](https://github.com/community-scripts/ProxmoxVE/pull/17198))
+    - passwordpusher: restore data before running migrations [@MickLesk](https://github.com/MickLesk) ([#17141](https://github.com/community-scripts/ProxmoxVE/pull/17141))
+    - paperclip: install the rust toolchain needed by the runner build [@MickLesk](https://github.com/MickLesk) ([#17142](https://github.com/community-scripts/ProxmoxVE/pull/17142))
+    - homepage: run next directly instead of through pnpm [@MickLesk](https://github.com/MickLesk) ([#17155](https://github.com/community-scripts/ProxmoxVE/pull/17155))
+    - changedetection: fix: pin browserless [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17163](https://github.com/community-scripts/ProxmoxVE/pull/17163))
+
+### 💾 Core
+
+  - #### 🐞 Bug Fixes
+
+    - core.func: fall back to a usable HOME when the shell has none [@MickLesk](https://github.com/MickLesk) ([#17154](https://github.com/community-scripts/ProxmoxVE/pull/17154))
+
+### 🧰 Tools
+
+  - Dockhand ([#17191](https://github.com/community-scripts/ProxmoxVE/pull/17191))
+
+  - #### 🐞 Bug Fixes
+
+    - update-apps: rewrite the retired Gitea base in every container before updating it [@MickLesk](https://github.com/MickLesk) ([#17156](https://github.com/community-scripts/ProxmoxVE/pull/17156))
+
+  - #### 🔧 Refactor
+
+    - Rename lxc-delete.sh to guest-delete.sh [@MickLesk](https://github.com/MickLesk) ([#17152](https://github.com/community-scripts/ProxmoxVE/pull/17152))
+
+### 📚 Documentation
+
+  - issue template: add PVE release, execution context and phase; refresh distro list / pve versions [@MickLesk](https://github.com/MickLesk) ([#17160](https://github.com/community-scripts/ProxmoxVE/pull/17160))
+
+## 2026-09-10
+
+### 🆕 New Scripts
+
+  - Chevereto ([#17131](https://github.com/community-scripts/ProxmoxVE/pull/17131))
+- Portabase ([#17111](https://github.com/community-scripts/ProxmoxVE/pull/17111))
+- Logseq ([#17112](https://github.com/community-scripts/ProxmoxVE/pull/17112))
+- Safebucket ([#17096](https://github.com/community-scripts/ProxmoxVE/pull/17096))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Immich v3.2.0 [@vhsdream](https://github.com/vhsdream) ([#17137](https://github.com/community-scripts/ProxmoxVE/pull/17137))
+    - fix(solidtime): prevent composer install from hanging on root prompt [@supersoju](https://github.com/supersoju) ([#17146](https://github.com/community-scripts/ProxmoxVE/pull/17146))
+    - fix(hermesagent): wait for root gateway cleanup [@steveonjava](https://github.com/steveonjava) ([#17147](https://github.com/community-scripts/ProxmoxVE/pull/17147))
+
+### 💾 Core
+
+  - Keep the script name when regenerating the entrypoint [@MickLesk](https://github.com/MickLesk) ([core#35](https://github.com/community-scripts/core/pull/35))
+- Rewrite the dead Gitea base onto GitHub instead of failing the update [@MickLesk](https://github.com/MickLesk) ([core#33](https://github.com/community-scripts/core/pull/33))
+- core.func: fall back to a usable HOME when the shell has none [@MickLesk](https://github.com/MickLesk) ([core#32](https://github.com/community-scripts/core/pull/32))
+
+## 2026-09-09
+
+### 🆕 New Scripts
+
+  - Lingarr ([#17130](https://github.com/community-scripts/ProxmoxVE/pull/17130))
+
+### 🚀 Updated Scripts
+
+  - vm: drop the discussions link from the summary [@MickLesk](https://github.com/MickLesk) ([#17117](https://github.com/community-scripts/ProxmoxVE/pull/17117))
+
+  - #### 🐞 Bug Fixes
+
+    - fix(hermesagent): stop spurious root gateway after update [@steveonjava](https://github.com/steveonjava) ([#17126](https://github.com/community-scripts/ProxmoxVE/pull/17126))
+
+## 2026-09-08
+
+### 🆕 New Scripts
+
+  - Decypharr ([#17108](https://github.com/community-scripts/ProxmoxVE/pull/17108))
+- Stash ([#17106](https://github.com/community-scripts/ProxmoxVE/pull/17106))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Update Jellyfin FFmpeg dependency to version 8 [@MickLesk](https://github.com/MickLesk) ([#17109](https://github.com/community-scripts/ProxmoxVE/pull/17109))
+
+### 💾 Core
+
+  - Treat a cut-short forge response as a failure, not as HTTP 200 [@MickLesk](https://github.com/MickLesk) ([core#31](https://github.com/community-scripts/core/pull/31))
+- Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#28](https://github.com/community-scripts/core/pull/28))
+- cloud-init: drop the "configure in Proxmox UI" hint [@MickLesk](https://github.com/MickLesk) ([core#30](https://github.com/community-scripts/core/pull/30))
+- Survive an empty /usr/bin/update instead of aborting the run [@MickLesk](https://github.com/MickLesk) ([core#29](https://github.com/community-scripts/core/pull/29))
+
+## 2026-09-07
+
+### 🆕 New Scripts
+
+  - Chatwoot ([#17095](https://github.com/community-scripts/ProxmoxVE/pull/17095))
+- whisparr-eros ([#17094](https://github.com/community-scripts/ProxmoxVE/pull/17094))
+- Matter-Hub ([#17093](https://github.com/community-scripts/ProxmoxVE/pull/17093))
+- Journiv ([#17092](https://github.com/community-scripts/ProxmoxVE/pull/17092))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - kaneo: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17086](https://github.com/community-scripts/ProxmoxVE/pull/17086))
+    - iobroker: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17085](https://github.com/community-scripts/ProxmoxVE/pull/17085))
+    - reactive-resume: repair any wrong WorkingDirectory on update [@MickLesk](https://github.com/MickLesk) ([#17068](https://github.com/community-scripts/ProxmoxVE/pull/17068))
+    - mediamtx: keep mediamtx.yml across updates [@MickLesk](https://github.com/MickLesk) ([#17069](https://github.com/community-scripts/ProxmoxVE/pull/17069))
+    - omnitools: allow remote action while npm ci [@MickLesk](https://github.com/MickLesk) ([#17070](https://github.com/community-scripts/ProxmoxVE/pull/17070))
+
+  - #### ✨ New Features
+
+    - netboot-xyz: add Secure Boot and Legacy assets [@MickLesk](https://github.com/MickLesk) ([#17066](https://github.com/community-scripts/ProxmoxVE/pull/17066))
+
+  - #### 🔧 Refactor
+
+    - flatnotes: follow upstream move to uv and Python 3.13 [@MickLesk](https://github.com/MickLesk) ([#17090](https://github.com/community-scripts/ProxmoxVE/pull/17090))
+    - heimdall: set up PHP 8.4 on update, keep only the database, run migrations [@MickLesk](https://github.com/MickLesk) ([#17067](https://github.com/community-scripts/ProxmoxVE/pull/17067))
+
+### 📂 Github
+
+  - github: Open per-script Node bump PRs [@MickLesk](https://github.com/MickLesk) ([#17065](https://github.com/community-scripts/ProxmoxVE/pull/17065))
+
+## 2026-09-06
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Fix Sonarqube update script to add +x on sonar.sh [@jarihu](https://github.com/jarihu) ([#17056](https://github.com/community-scripts/ProxmoxVE/pull/17056))
+
 ## 2026-09-05

 ### 🚀 Updated Scripts
@@ -8,7 +8,7 @@ PRs without prior testing will be closed. If you are an AI agent writing this pu

 Fixes #

-## ✅ Prerequisites (**X** in brackets)
+## ✅ Prerequisites (**x** in brackets)

 - [ ] **Self-review completed** – Code follows project standards.
 - [ ] **Tested thoroughly** – Changes work as expected.
@@ -43,13 +43,13 @@ Fixes #

 ## 💥 Breaking Change Advisory (only if you checked "Breaking change")

-If this PR changes existing behaviour in a way that may require action before an
+<!-- If this PR changes existing behaviour in a way that may require action before an
 update, add a `breaking-change` advisory block to this PR body. The website and
 the in-container update guard read it to tell operators exactly what to expect,
 what to do first, and — with `action: block` — to stop an update until it's
 handled. Every field is optional; the advisory auto-expires 30 days after merge.

-Copy the block out of the comment below, fill it in, and paste it here:
+Copy the block out of the comment below, fill it in, and paste it here: -->

 <!--
 ```breaking-change
@@ -28,6 +28,7 @@ jobs:
            const allowedBots = [
              "push-app-to-main[bot]",
              "push-app-to-main",
+              "community-scripts-pr-app[bot]",
              "community-scripts-pr-app"
            ];

@@ -62,7 +63,9 @@ jobs:
                per_page: 100,
              });
              hasAddedScriptFile = files.some(
-                f => f.status === "added" && scriptPrefixes.some(p => f.filename.startsWith(p))
+                f => f.status === "added" &&
+                     !f.filename.includes("/headers/") &&
+                     scriptPrefixes.some(p => f.filename.startsWith(p))
              );
            } catch (error) {
              core.warning(`Could not list files for PR #${prNumber}: ${error.message}`);
@@ -26,6 +26,7 @@ jobs:
          COMMENT_BODY: ${{ github.event.comment.body }}
          COMMENT_ID: ${{ github.event.comment.id }}
          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          IS_PR_COMMENT: ${{ github.event.issue.pull_request && 'true' || 'false' }}
          REPO_OWNER: ${{ github.repository_owner }}
          REPO_NAME: ${{ github.event.repository.name }}
          ACTOR: ${{ github.event.comment.user.login }}
@@ -84,6 +85,7 @@ jobs:
            const owner = process.env.REPO_OWNER;
            const repo = process.env.REPO_NAME;
            const issueNumber = parseInt(process.env.ISSUE_NUMBER, 10);
+            const isPrComment = process.env.IS_PR_COMMENT === 'true';
            const commentId = parseInt(process.env.COMMENT_ID, 10);
            const actor = process.env.ACTOR;

@@ -216,11 +218,22 @@ jobs:

              const prTitle = 'chore(ct): sync ' + slugValue + ' defaults with PocketBase';
              const prBody =
-                '## Summary\n' +
-                '- Sync default CT variables for `' + slugValue + '` after `/pocketbase` update.\n' +
-                '- Updated vars: `' + updateResult.updatedVars.join('`, `') + '`.\n\n' +
-                '## Source\n' +
-                '- Triggered by @' + actor + ' via PocketBase bot.\n';
+                '## ✍️ Description\n\n' +
+                'Sync of the default CT variables for `' + slugValue + '` after a `/pocketbase` update by @' + actor + '.\n\n' +
+                'Updated: `' + updateResult.updatedVars.join('`, `') + '`\n\n' +
+                '## 🔗 Related Issue\n\n' +
+                (isPrComment ? 'Triggered from #' : 'Fixes #') + issueNumber + '\n\n' +
+                '## ✅ Prerequisites (**X** in brackets)\n\n' +
+                '- [x] **Self-review completed** – Code follows project standards.\n' +
+                '- [ ] **Tested thoroughly** – Changes work as expected.\n' +
+                '- [x] **No security risks** – No hardcoded secrets, unnecessary privilege escalations, or permission issues.\n\n' +
+                '**Tested on:** not tested — generated from the PocketBase record, only `var_` defaults changed.\n\n' +
+                '---\n\n' +
+                '## 🤖 AI Assistance (**X** in brackets)\n\n' +
+                '- [x] **No AI used** – Scripts were written without AI assistance.\n\n' +
+                '---\n\n' +
+                '## 🛠️ Type of Change (**X** in brackets)\n\n' +
+                '- [x] 🐞 **Bug fix** – Resolves an issue without breaking functionality.\n';
              const createPrRes = await ghRequest('/repos/' + owner + '/' + repo + '/pulls', 'POST', {
                title: prTitle,
                body: prBody,
@@ -335,7 +348,10 @@ jobs:
              '`architectures` (amd64,arm64) `platforms` (pve,incus) ' +
              '`execute_in` (pve,lxc,pbs,vm,pmg,pdm) `categories` (names or ids) ' +
              '`type` (ct, vm, addon, …) ' +
-              '`is_disabled` `disable_message` `is_deleted` `deleted_message`\n\n' +
+              '`is_disabled` `disable_message` `is_deleted` `deleted_message` ' +
+              '`pin_reason` `last_update_commit`\n\n' +
+              'The `var_` names from the ct scripts work too: `var_cpu` `var_ram` `var_disk`\n' +
+              '`var_os` `var_version` `var_port` `var_tags` `var_unprivileged`\n\n' +
              '**Screenshots:**\n' +
              '```\n' +
              '/pocketbase <slug> screenshot https://example.com/one.png https://example.com/two.png\n' +
@@ -399,6 +415,14 @@ jobs:

            // ── Shared helpers ─────────────────────────────────────────────────

+            // The ct scripts name these var_cpu/var_ram/var_disk, and that is what
+            // people type. Accept them for the PocketBase keys.
+            const KEY_ALIASES = {
+              var_cpu: 'cpu', var_ram: 'ram', var_disk: 'hdd', var_hdd: 'hdd',
+              var_os: 'os', var_version: 'version', var_unprivileged: 'unprivileged',
+              var_port: 'port', var_tags: 'tags', disk: 'hdd', memory: 'ram',
+            };
+
            // Key=value parser: handles unquoted and "quoted" values
            function parseKVPairs(str) {
              const fields = {};
@@ -426,7 +450,7 @@ jobs:
                  while (pos < str.length && !/\s/.test(str[pos])) pos++;
                  value = str.substring(valStart, pos);
                }
-                fields[key] = value;
+                fields[KEY_ALIASES[key.toLowerCase()] || key] = value;
              }
              return fields;
            }
@@ -982,6 +1006,8 @@ jobs:
                disable_message:  'string',
                is_deleted:       'boolean',
                deleted_message:  'string',
+                pin_reason:       'string',
+                last_update_commit: 'string',
              };

              const parsedFields = parseKVPairs(rest);
@@ -22,7 +22,9 @@ generate_headers() {
  for script in "${file_list[@]}"; do
    [[ -f "$script" ]] || continue

-    app_name=$(grep -oP '^APP="\K[^"]+' "$script" 2>/dev/null)
+    # -m1: a script that sets APP twice (the second carrying ${var_version})
+    # otherwise yields both lines, and the filename gets a newline in it.
+    app_name=$(grep -m1 -oP '^APP="\K[^"]+' "$script" 2>/dev/null)
    if [[ -n "$app_name" ]]; then
      # core.func/vm-core.func look the header up as "${APP,,}" without spaces,
      # so the generated file has to be named after APP - not after the script.
@@ -98,6 +98,12 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit



+
+
+
+
+
+



@@ -114,7 +120,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit


 <details>
-<summary><h4>September (5 entries)</h4></summary>
+<summary><h4>September (19 entries)</h4></summary>

 [View September 2026 Changelog](.github/changelogs/2026/09.md)

@@ -540,6 +546,241 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 </details>

+## 2026-09-22
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(invoiceshelf): re-link storage during update [@owenvoke](https://github.com/owenvoke) ([#17431](https://github.com/community-scripts/ProxmoxVE/pull/17431))
+    - fix(alpine-it-tools): write the version file after a successful update [@Houtek](https://github.com/Houtek) ([#17421](https://github.com/community-scripts/ProxmoxVE/pull/17421))
+    - Umami: Align pnpm with engines.pnpm on update [@ReneNulschDE](https://github.com/ReneNulschDE) ([#17404](https://github.com/community-scripts/ProxmoxVE/pull/17404))
+
+  - #### 🔧 Refactor
+
+    - several scripts: let uv see the project before syncing it | refactor some scripts that use uv [@MickLesk](https://github.com/MickLesk) ([#17436](https://github.com/community-scripts/ProxmoxVE/pull/17436))
+
+### 💾 Core
+
+  - setup_uv: honour a project's required-version pin [@MickLesk](https://github.com/MickLesk) ([core#58](https://github.com/community-scripts/core/pull/58))
+- fix(motd): repair legacy 00_lxc-details.sh header and dead color placeholders [@BadFlo](https://github.com/BadFlo) ([core#53](https://github.com/community-scripts/core/pull/53))
+- meilisearch: take the raw binary, not the .deb [@MickLesk](https://github.com/MickLesk) ([core#57](https://github.com/community-scripts/core/pull/57))
+
+### 📚 Documentation
+
+  - github: Stop generating header filenames with a newline in them [@MickLesk](https://github.com/MickLesk) ([#17435](https://github.com/community-scripts/ProxmoxVE/pull/17435))
+
+## 2026-09-21
+
+### 🆕 New Scripts
+
+  - AudioMuse-AI ([#17415](https://github.com/community-scripts/ProxmoxVE/pull/17415))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(portabase): meet the default admin password rules [@maksimtech](https://github.com/maksimtech) ([#17384](https://github.com/community-scripts/ProxmoxVE/pull/17384))
+    - truenas-vm: strip the G before the storage allocation [@MickLesk](https://github.com/MickLesk) ([#17407](https://github.com/community-scripts/ProxmoxVE/pull/17407))
+    - Librenms - Fix local snmpd community string setup [@dopch](https://github.com/dopch) ([#17363](https://github.com/community-scripts/ProxmoxVE/pull/17363))
+    - fix(iventoy): preserve release data and migrate legacy service launchers [@Msprg](https://github.com/Msprg) ([#17161](https://github.com/community-scripts/ProxmoxVE/pull/17161))
+    - xyops: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17398](https://github.com/community-scripts/ProxmoxVE/pull/17398))
+
+### 💾 Core
+
+  - Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#56](https://github.com/community-scripts/core/pull/56))
+- github-api: take the release the maintainer marked as latest [@MickLesk](https://github.com/MickLesk) ([core#55](https://github.com/community-scripts/core/pull/55))
+- general: prune old Rust toolchains [@MickLesk](https://github.com/MickLesk) ([core#52](https://github.com/community-scripts/core/pull/52))
+- Ask when the preselected storage cannot hold the content [@MickLesk](https://github.com/MickLesk) ([core#51](https://github.com/community-scripts/core/pull/51))
+
+## 2026-09-20
+
+### 🆕 New Scripts
+
+  - Your-Spotify ([#17376](https://github.com/community-scripts/ProxmoxVE/pull/17376))
+
+## 2026-09-19
+
+### 🆕 New Scripts
+
+  - qBit-Manage ([#17377](https://github.com/community-scripts/ProxmoxVE/pull/17377))
+- Ubuntu-VM: AIO | new core | performance | remove old wrappers [@MickLesk](https://github.com/MickLesk) ([#17354](https://github.com/community-scripts/ProxmoxVE/pull/17354))
+
+### 💾 Core
+
+  - Fall back to the unversioned banner slug [@MickLesk](https://github.com/MickLesk) ([core#48](https://github.com/community-scripts/core/pull/48))
+
+### ❔ Uncategorized
+
+  - chore(ct): sync immichframe defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17373](https://github.com/community-scripts/ProxmoxVE/pull/17373))
+
+## 2026-09-18
+
+### 🆕 New Scripts
+
+  - Almalinux-VM ([#17349](https://github.com/community-scripts/ProxmoxVE/pull/17349))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - update authentik to 2026.8.3 [@thieneret](https://github.com/thieneret) ([#17366](https://github.com/community-scripts/ProxmoxVE/pull/17366))
+    - crafty-controller: chown after restore_backup so restored data keeps ownership [@MickLesk](https://github.com/MickLesk) ([#17348](https://github.com/community-scripts/ProxmoxVE/pull/17348))
+    - databasus, domain-monitor, poznote: chown after restore_backup so restored data keeps its owner [@MickLesk](https://github.com/MickLesk) ([#17350](https://github.com/community-scripts/ProxmoxVE/pull/17350))
+    - alpine-vm: ask for the Cloud-Init credentials [@MickLesk](https://github.com/MickLesk) ([#17355](https://github.com/community-scripts/ProxmoxVE/pull/17355))
+    - suggestarr: keep the data where the app actually reads it [@MickLesk](https://github.com/MickLesk) ([#17317](https://github.com/community-scripts/ProxmoxVE/pull/17317))
+    - immichframe: set the admin password the new admin UI requires [@MickLesk](https://github.com/MickLesk) ([#17315](https://github.com/community-scripts/ProxmoxVE/pull/17315))
+
+  - #### ✨ New Features
+
+    - pangolin: Bump to 1.23.0 [@MickLesk](https://github.com/MickLesk) ([#17343](https://github.com/community-scripts/ProxmoxVE/pull/17343))
+
+  - #### 🔧 Refactor
+
+    - Refactor: Oxicloud [@MickLesk](https://github.com/MickLesk) ([#17338](https://github.com/community-scripts/ProxmoxVE/pull/17338))
+
+### 💾 Core
+
+  - Stop a modified conffile from aborting the whole update [@MickLesk](https://github.com/MickLesk) ([core#47](https://github.com/community-scripts/core/pull/47))
+- Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#46](https://github.com/community-scripts/core/pull/46))
+- github api: retry a 200 that is not a usable release payload [@MickLesk](https://github.com/MickLesk) ([core#45](https://github.com/community-scripts/core/pull/45))
+
+### 📚 Documentation
+
+  - chore: fix PR template help [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17364](https://github.com/community-scripts/ProxmoxVE/pull/17364))
+
+## 2026-09-17
+
+### 🆕 New Scripts
+
+  - Alpine-VM ([#17324](https://github.com/community-scripts/ProxmoxVE/pull/17324))
+- Allstarlink ([#17321](https://github.com/community-scripts/ProxmoxVE/pull/17321))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - changedetection: update: various fixes [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17331](https://github.com/community-scripts/ProxmoxVE/pull/17331))
+    - sparkyfitness: run the Better Auth migration during the update [@MickLesk](https://github.com/MickLesk) ([#17318](https://github.com/community-scripts/ProxmoxVE/pull/17318))
+    - poznote: follow init.sh into docker/ [@MickLesk](https://github.com/MickLesk) ([#17316](https://github.com/community-scripts/ProxmoxVE/pull/17316))
+
+  - #### ✨ New Features
+
+    - romm: make the library paths follow ROMM_BASE_PATH [@MickLesk](https://github.com/MickLesk) ([#17279](https://github.com/community-scripts/ProxmoxVE/pull/17279))
+    - Debian-VM: Refactor | Support Debian 11, 12, 13 [@MickLesk](https://github.com/MickLesk) ([#17325](https://github.com/community-scripts/ProxmoxVE/pull/17325))
+
+### 💾 Core
+
+  - Ask before replacing a cached image that no longer matches [@MickLesk](https://github.com/MickLesk) ([core#44](https://github.com/community-scripts/core/pull/44))
+
+## 2026-09-16
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Immich: Pin to v3.2.2 [@vhsdream](https://github.com/vhsdream) ([#17307](https://github.com/community-scripts/ProxmoxVE/pull/17307))
+    - Dispatcharr: Bump to 4G RAM [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17302](https://github.com/community-scripts/ProxmoxVE/pull/17302))
+    - navidrome: repair root-owned data folders left by 0.61.x [@MickLesk](https://github.com/MickLesk) ([#17275](https://github.com/community-scripts/ProxmoxVE/pull/17275))
+    - tor-snowflake: read the Go version from the module root [@MickLesk](https://github.com/MickLesk) ([#17276](https://github.com/community-scripts/ProxmoxVE/pull/17276))
+    - docmost: stop corepack asking for confirmation during the build [@MickLesk](https://github.com/MickLesk) ([#17282](https://github.com/community-scripts/ProxmoxVE/pull/17282))
+
+  - #### ✨ New Features
+
+    - Refactor: TrueNAS VM (core / improve functions / performance) [@MickLesk](https://github.com/MickLesk) ([#17277](https://github.com/community-scripts/ProxmoxVE/pull/17277))
+    - Frigate: Bump to 0.18.0 [@MickLesk](https://github.com/MickLesk) ([#17273](https://github.com/community-scripts/ProxmoxVE/pull/17273))
+    - Refactor: HomeAssistant-OS (core / improve functions / performance) [@MickLesk](https://github.com/MickLesk) ([#17281](https://github.com/community-scripts/ProxmoxVE/pull/17281))
+
+### 💾 Core
+
+  - Read the IGC version compute-runtime pins, instead of taking the newest [@MickLesk](https://github.com/MickLesk) ([core#43](https://github.com/community-scripts/core/pull/43))
+- Install the Intel driver dependency before the .deb that needs it [@MickLesk](https://github.com/MickLesk) ([core#42](https://github.com/community-scripts/core/pull/42))
+
+### 📚 Documentation
+
+  - pocketbase-bot: accept the var_ names and two missing fields [@MickLesk](https://github.com/MickLesk) ([#17305](https://github.com/community-scripts/ProxmoxVE/pull/17305))
+
+## 2026-09-15
+
+### 🆕 New Scripts
+
+  - valhalla ([#17231](https://github.com/community-scripts/ProxmoxVE/pull/17231))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - borg-ui: missing dependency `sshpass` [@christian-forgacs](https://github.com/christian-forgacs) ([#17286](https://github.com/community-scripts/ProxmoxVE/pull/17286))
+    - tracearr: copy packages/emails into the deploy tree [@connorgallopo](https://github.com/connorgallopo) ([#17268](https://github.com/community-scripts/ProxmoxVE/pull/17268))
+    - Immich: Pin to v3.2.1 [@vhsdream](https://github.com/vhsdream) ([#17264](https://github.com/community-scripts/ProxmoxVE/pull/17264))
+
+### 💾 Core
+
+  - Add vm_extract_image, which two VM scripts already call [@MickLesk](https://github.com/MickLesk) ([core#40](https://github.com/community-scripts/core/pull/40))
+- Releases: rank releases on their numbers, not on sort -V over the raw tag [@MickLesk](https://github.com/MickLesk) ([core#39](https://github.com/community-scripts/core/pull/39))
+
+### 🧰 Tools
+
+  - #### 🔧 Refactor
+
+    - Refactor: monitor-all (decide on flag values, not on key presence) [@MickLesk](https://github.com/MickLesk) ([#17261](https://github.com/community-scripts/ProxmoxVE/pull/17261))
+
+## 2026-09-14
+
+### 🆕 New Scripts
+
+  - Borg-UI ([#17258](https://github.com/community-scripts/ProxmoxVE/pull/17258))
+
+### 🚀 Updated Scripts
+
+  - SparkyFitness: substitute NGINX_RATE_LIMIT in nginx config [@RafBorrelli](https://github.com/RafBorrelli) ([#17256](https://github.com/community-scripts/ProxmoxVE/pull/17256))
+
+  - #### 🐞 Bug Fixes
+
+    - spliit: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17250](https://github.com/community-scripts/ProxmoxVE/pull/17250))
+
+## 2026-09-13
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Downgrade iobroker to Node 24 [@Copilot](https://github.com/Copilot) ([#17229](https://github.com/community-scripts/ProxmoxVE/pull/17229))
+
+### 💾 Core
+
+  - Pick the highest release version, not the newest published one [@MickLesk](https://github.com/MickLesk) ([core#38](https://github.com/community-scripts/core/pull/38))
+
+## 2026-09-12
+
+### 🆕 New Scripts
+
+  - Elasticsearch ([#17188](https://github.com/community-scripts/ProxmoxVE/pull/17188))
+- Hammer ([#17189](https://github.com/community-scripts/ProxmoxVE/pull/17189))
+- gotenberg ([#17205](https://github.com/community-scripts/ProxmoxVE/pull/17205))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(dispatcharr): add comskip installation and build dependencies [@eXistC](https://github.com/eXistC) ([#16224](https://github.com/community-scripts/ProxmoxVE/pull/16224))
+    - poznote: serve from src/public docroot [@MickLesk](https://github.com/MickLesk) ([#17187](https://github.com/community-scripts/ProxmoxVE/pull/17187))
+    - calibre-web: use calibreweb release identifier to avoid version file collision [@MickLesk](https://github.com/MickLesk) ([#17186](https://github.com/community-scripts/ProxmoxVE/pull/17186))
+
+  - #### ✨ New Features
+
+    - Docker VM: Feature Bump - Refactor script for improved functionality [@MickLesk](https://github.com/MickLesk) ([#17216](https://github.com/community-scripts/ProxmoxVE/pull/17216))
+    - feat(jitsi-meet): optional public setup (FQDN, Let's Encrypt, NAT, secure domain) [@klanghans](https://github.com/klanghans) ([#17132](https://github.com/community-scripts/ProxmoxVE/pull/17132))
+
+  - #### 🔧 Refactor
+
+    - Paperless-NGX: add --no-sync to uv run services [@MickLesk](https://github.com/MickLesk) ([#17210](https://github.com/community-scripts/ProxmoxVE/pull/17210))
+
+### 💾 Core
+
+  - VM's: show the selected CPU model instead of doubling it [@MickLesk](https://github.com/MickLesk) ([core#37](https://github.com/community-scripts/core/pull/37))
+- Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#36](https://github.com/community-scripts/core/pull/36))
+
 ## 2026-09-11

 ### 🆕 New Scripts
@@ -1012,287 +1253,4 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
    - bookorbit: bump default RAM to prevent tsc OOM segfault during nest build [@MickLesk](https://github.com/MickLesk) ([#16649](https://github.com/community-scripts/ProxmoxVE/pull/16649))
    - immich: split jpegli into its own build step, resolve library revisions dynamically [@MickLesk](https://github.com/MickLesk) ([#16656](https://github.com/community-scripts/ProxmoxVE/pull/16656))
    - tdarr: make unzip non-interactive to prevent hang [@MickLesk](https://github.com/MickLesk) ([#16648](https://github.com/community-scripts/ProxmoxVE/pull/16648))
-    - immich: fix jpegli patch path after upstream base-images split jpegli from libjxl [@MickLesk](https://github.com/MickLesk) ([#16647](https://github.com/community-scripts/ProxmoxVE/pull/16647))
-
-## 2026-08-20
-
-### 🆕 New Scripts
-
-  - Umbraco ([#16621](https://github.com/community-scripts/ProxmoxVE/pull/16621))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - storyteller: fix build paths for upstream applications/web/ monorepo restructure [@MickLesk](https://github.com/MickLesk) ([#16627](https://github.com/community-scripts/ProxmoxVE/pull/16627))
-    - tubearchivist: add bgutil POT provider and update yt-dlp to nightly [@CrazyWolf13](https://github.com/CrazyWolf13) ([#16622](https://github.com/community-scripts/ProxmoxVE/pull/16622))
-    - networkoptimizer: preseed iperf3 debconf question to prevent hang install  [@MickLesk](https://github.com/MickLesk) ([#16626](https://github.com/community-scripts/ProxmoxVE/pull/16626))
-    - scanopy: limit cargo build parallelism to prevent OOM kill [@MickLesk](https://github.com/MickLesk) ([#16623](https://github.com/community-scripts/ProxmoxVE/pull/16623))
-    - baikal: fall back to composer update when lock doesn't match [@MickLesk](https://github.com/MickLesk) ([#16625](https://github.com/community-scripts/ProxmoxVE/pull/16625))
-
-  - #### 💥 Breaking Changes
-
-    - update: various script to debian 13 [@CrazyWolf13](https://github.com/CrazyWolf13) ([#16525](https://github.com/community-scripts/ProxmoxVE/pull/16525))
-
-### 🧰 Tools
-
-  - #### 🔧 Refactor
-
-    - copyparty: use fetch_and_deploy_gh_release for version tracking [@MickLesk](https://github.com/MickLesk) ([#16624](https://github.com/community-scripts/ProxmoxVE/pull/16624))
-
-## 2026-08-19
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - fix: clean yarn cache after mealie frontend build to prevent disk growth [@bferd](https://github.com/bferd) ([#16609](https://github.com/community-scripts/ProxmoxVE/pull/16609))
-    - VictoriaMetrics: use github_api_call for release lookups so GITHUB_TOKEN is honored [@angusmaul](https://github.com/angusmaul) ([#16607](https://github.com/community-scripts/ProxmoxVE/pull/16607))
-    - Increase default RAM allocation for Gatus [@rmpratt1](https://github.com/rmpratt1) ([#16601](https://github.com/community-scripts/ProxmoxVE/pull/16601))
-
-## 2026-08-18
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - romm: add missing /decode and /cache Angie locations for multi-file downloads [@MickLesk](https://github.com/MickLesk) ([#16589](https://github.com/community-scripts/ProxmoxVE/pull/16589))
-    - odoo: use patched wkhtmltopdf build [@MickLesk](https://github.com/MickLesk) ([#16590](https://github.com/community-scripts/ProxmoxVE/pull/16590))
-
-  - #### 💥 Breaking Changes
-
-    - Breaking Change: Migrate all "Alpine" Scripts to Normal CT's  [@MickLesk](https://github.com/MickLesk) ([#16587](https://github.com/community-scripts/ProxmoxVE/pull/16587))
-
-## 2026-08-17
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - keycloak: remove invalid ExecStop, kc.sh has no stop subcommand [@MickLesk](https://github.com/MickLesk) ([#16563](https://github.com/community-scripts/ProxmoxVE/pull/16563))
-    - Pin ownfoil release to version 2.3.0 [@MickLesk](https://github.com/MickLesk) ([#16574](https://github.com/community-scripts/ProxmoxVE/pull/16574))
-    - kometa: add git, needed by requirements.txt's git dependency [@MickLesk](https://github.com/MickLesk) ([#16562](https://github.com/community-scripts/ProxmoxVE/pull/16562))
-    - fix romm: deploy EmulatorJS and Ruffle after the frontend build [@angusmaul](https://github.com/angusmaul) ([#16571](https://github.com/community-scripts/ProxmoxVE/pull/16571))
-
-  - #### 🔧 Refactor
-
-    - patchmon: fetch only SCAP datastream XMLs [@MickLesk](https://github.com/MickLesk) ([#16565](https://github.com/community-scripts/ProxmoxVE/pull/16565))
-    - teslamate: use precompiled Elixir [@MickLesk](https://github.com/MickLesk) ([#16561](https://github.com/community-scripts/ProxmoxVE/pull/16561))
-
-## 2026-08-16
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - [FIX] Shelfmark: internal bypasser never starts under the gevent worker [@robbiet480](https://github.com/robbiet480) ([#16495](https://github.com/community-scripts/ProxmoxVE/pull/16495))
-    - tubearchivist: fix: enhance update script [@CrazyWolf13](https://github.com/CrazyWolf13) ([#16521](https://github.com/community-scripts/ProxmoxVE/pull/16521))
-    - tracktor: build with pnpm using upstream's frozen lockfile [@MickLesk](https://github.com/MickLesk) ([#16530](https://github.com/community-scripts/ProxmoxVE/pull/16530))
-    - wallos: run db migration after apache reload on update [@MickLesk](https://github.com/MickLesk) ([#16528](https://github.com/community-scripts/ProxmoxVE/pull/16528))
-
-  - #### 🔧 Refactor
-
-    - networkoptimizer: also build uwnspeedtest binary for server arch [@MickLesk](https://github.com/MickLesk) ([#16531](https://github.com/community-scripts/ProxmoxVE/pull/16531))
-
-### 🗑️ Deleted Scripts
-
-  - Remove: Jeedom [@MickLesk](https://github.com/MickLesk) ([#16536](https://github.com/community-scripts/ProxmoxVE/pull/16536))
- Remove: Swizzin [@MickLesk](https://github.com/MickLesk) ([#16535](https://github.com/community-scripts/ProxmoxVE/pull/16535))
- Remove: NocoDB [@MickLesk](https://github.com/MickLesk) ([#16533](https://github.com/community-scripts/ProxmoxVE/pull/16533))
-
-### 💾 Core
-
-  - #### 🔧 Refactor
-
-    - core: skip mount points during backup and clean installs [@MickLesk](https://github.com/MickLesk) ([#16532](https://github.com/community-scripts/ProxmoxVE/pull/16532))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - cronmaster: back up scripts, data and snippets folders on update [@MickLesk](https://github.com/MickLesk) ([#16529](https://github.com/community-scripts/ProxmoxVE/pull/16529))
-
-## 2026-08-15
-
-### 🆕 New Scripts
-
-  - Securo ([#16518](https://github.com/community-scripts/ProxmoxVE/pull/16518))
- ntopng ([#16387](https://github.com/community-scripts/ProxmoxVE/pull/16387))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - AdventureLog: remove pnpm build-allowlist override causing pnpm 10.33 conflict [@MickLesk](https://github.com/MickLesk) ([#16478](https://github.com/community-scripts/ProxmoxVE/pull/16478))
-
-  - #### ✨ New Features
-
-    - PatchMon: add ssg-content [@MickLesk](https://github.com/MickLesk) ([#16481](https://github.com/community-scripts/ProxmoxVE/pull/16481))
-
-## 2026-08-14
-
-### 🆕 New Scripts
-
-  - RSS-Bridge ([#16471](https://github.com/community-scripts/ProxmoxVE/pull/16471))
- GoDoxy ([#16470](https://github.com/community-scripts/ProxmoxVE/pull/16470))
- Mumble ([#16474](https://github.com/community-scripts/ProxmoxVE/pull/16474))
- Fleet ([#16472](https://github.com/community-scripts/ProxmoxVE/pull/16472))
- Newt ([#16473](https://github.com/community-scripts/ProxmoxVE/pull/16473))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - calibre-web: install as package for 0.6.27's src-layout restructure [@MickLesk](https://github.com/MickLesk) ([#16480](https://github.com/community-scripts/ProxmoxVE/pull/16480))
-    - Wanderer: Refactor of Services / Installation / Paths [@johanngrobe](https://github.com/johanngrobe) ([#16487](https://github.com/community-scripts/ProxmoxVE/pull/16487))
-    - pelican-panel: set APP_URL to container IP [@MickLesk](https://github.com/MickLesk) ([#16488](https://github.com/community-scripts/ProxmoxVE/pull/16488))
-    - fix(ampache): update to PHP 8.5 asset, auto-upgrade PHP on update [@CervezaStallone](https://github.com/CervezaStallone) ([#16484](https://github.com/community-scripts/ProxmoxVE/pull/16484))
-
-  - #### ✨ New Features
-
-    - projectsend: rewrite for 2.0.0 (Laravel, nginx, MariaDB) [@MickLesk](https://github.com/MickLesk) ([#16477](https://github.com/community-scripts/ProxmoxVE/pull/16477))
-    - Homepage v2.0 [@vhsdream](https://github.com/vhsdream) ([#16500](https://github.com/community-scripts/ProxmoxVE/pull/16500))
-
-  - #### 🔧 Refactor
-
-    - Refactor: PowerDNS move poweradmin database outside the web root [@MickLesk](https://github.com/MickLesk) ([#16476](https://github.com/community-scripts/ProxmoxVE/pull/16476))
-    - paperless-ngx: run services with uv --no-sync to avoid startup network dependency [@MickLesk](https://github.com/MickLesk) ([#16479](https://github.com/community-scripts/ProxmoxVE/pull/16479))
-
-## 2026-08-13
-
-### 🆕 New Scripts
-
-  - SuggestArr ([#16449](https://github.com/community-scripts/ProxmoxVE/pull/16449))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - fix(stirling-pdf): LibreOffice listener collides with unoserver on UNO port 2002, burning a core [@angusmaul](https://github.com/angusmaul) ([#16460](https://github.com/community-scripts/ProxmoxVE/pull/16460))
-    - fix(reitti): enable SNI for tile cache [@kylemd](https://github.com/kylemd) ([#16463](https://github.com/community-scripts/ProxmoxVE/pull/16463))
-    - [wanderer] refactor [@johanngrobe](https://github.com/johanngrobe) ([#16448](https://github.com/community-scripts/ProxmoxVE/pull/16448))
-
-  - #### ✨ New Features
-
-    - feat: Update koillection-install.sh to support API usage [@Crazy-Duck](https://github.com/Crazy-Duck) ([#16425](https://github.com/community-scripts/ProxmoxVE/pull/16425))
-
-## 2026-08-12
-
-### 🆕 New Scripts
-
-  - Stalwart ([#16388](https://github.com/community-scripts/ProxmoxVE/pull/16388))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - networkoptimizer: mitigate dotnet publish hang in LXC [@MickLesk](https://github.com/MickLesk) ([#16436](https://github.com/community-scripts/ProxmoxVE/pull/16436))
-    - lazylibrarian: reinstall deps after git pull on update [@MickLesk](https://github.com/MickLesk) ([#16435](https://github.com/community-scripts/ProxmoxVE/pull/16435))
-    - wanderer: fix deprecated meilisearch upgrade flag [@MickLesk](https://github.com/MickLesk) ([#16434](https://github.com/community-scripts/ProxmoxVE/pull/16434))
-    - calibre-web: fix release asset filename pattern [@MickLesk](https://github.com/MickLesk) ([#16433](https://github.com/community-scripts/ProxmoxVE/pull/16433))
-    - fix(stirling-pdf): unoserver installed into the venv, and login mode truncates .env [@angusmaul](https://github.com/angusmaul) ([#16439](https://github.com/community-scripts/ProxmoxVE/pull/16439))
-    - fix(pulse): keep the container recoverable when an update fails [@rcourtman](https://github.com/rcourtman) ([#16311](https://github.com/community-scripts/ProxmoxVE/pull/16311))
-
-  - #### 🔧 Refactor
-
-    - ConvertX: add some new dependencies [@MickLesk](https://github.com/MickLesk) ([#16437](https://github.com/community-scripts/ProxmoxVE/pull/16437))
-
-## 2026-08-11
-
-### 🚀 Updated Scripts
-
-  - Update source URL for Reactive Resume [@MickLesk](https://github.com/MickLesk) ([#16407](https://github.com/community-scripts/ProxmoxVE/pull/16407))
-
-  - #### 🐞 Bug Fixes
-
-    - Pelican-Panel: add php artisan p:environment:database [@MickLesk](https://github.com/MickLesk) ([#16397](https://github.com/community-scripts/ProxmoxVE/pull/16397))
-    - outline: fix URL sed matching wrong line in .env.sample // refactor .env generation [@MickLesk](https://github.com/MickLesk) ([#16408](https://github.com/community-scripts/ProxmoxVE/pull/16408))
-    - paperless-ngx: reindex Tantivy search index on webserver start [@MickLesk](https://github.com/MickLesk) ([#16395](https://github.com/community-scripts/ProxmoxVE/pull/16395))
-    - karakeep: pin Node.js to 22 LTS, avoid Node 24.19 better-sqlite3 crash [@MickLesk](https://github.com/MickLesk) ([#16396](https://github.com/community-scripts/ProxmoxVE/pull/16396))
-
-  - #### ✨ New Features
-
-    - Open WebUI: add optional OpenTelemetry package install [@irishpadres](https://github.com/irishpadres) ([#16415](https://github.com/community-scripts/ProxmoxVE/pull/16415))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - fix(add-tailscale-lxc): stop spinner before whiptail menu [@halcycon](https://github.com/halcycon) ([#16402](https://github.com/community-scripts/ProxmoxVE/pull/16402))
-
-  - #### 🔧 Refactor
-
-    - arcane: fix projects/builds dir ownership for non-root container UID [@MickLesk](https://github.com/MickLesk) ([#16411](https://github.com/community-scripts/ProxmoxVE/pull/16411))
-
-## 2026-08-10
-
-### 🆕 New Scripts
-
-  - GitLab ([#16386](https://github.com/community-scripts/ProxmoxVE/pull/16386))
- TeslaMate ([#16385](https://github.com/community-scripts/ProxmoxVE/pull/16385))
- tor-snowflake ([#15684](https://github.com/community-scripts/ProxmoxVE/pull/15684))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - ErsatzTV: update ffmpeg to 8.1 version [@MickLesk](https://github.com/MickLesk) ([#16383](https://github.com/community-scripts/ProxmoxVE/pull/16383))
-
-### 🧰 Tools
-
-  - post-pdm-install ([#16368](https://github.com/community-scripts/ProxmoxVE/pull/16368))
-
-## 2026-08-09
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Fix: CouchDB Erlang cookie breaks vm.args (use hex) [@fudianchn](https://github.com/fudianchn) ([#16361](https://github.com/community-scripts/ProxmoxVE/pull/16361))
-    - SparkyFitness: Install Git for frontend builds [@MickLesk](https://github.com/MickLesk) ([#16352](https://github.com/community-scripts/ProxmoxVE/pull/16352))
-    - Byparr: Use invisible-playwright browser setup [@MickLesk](https://github.com/MickLesk) ([#16353](https://github.com/community-scripts/ProxmoxVE/pull/16353))
-    - Crafty Controller: Restore ownership after updates [@MickLesk](https://github.com/MickLesk) ([#16354](https://github.com/community-scripts/ProxmoxVE/pull/16354))
-    - Webtrees: Fix schema check in silent mode [@MickLesk](https://github.com/MickLesk) ([#16355](https://github.com/community-scripts/ProxmoxVE/pull/16355))
-    - SigNoz: Allow legacy metadata schema on ClickHouse 26 [@MickLesk](https://github.com/MickLesk) ([#16356](https://github.com/community-scripts/ProxmoxVE/pull/16356))
-
-### 🧰 Tools
-
-  - #### ✨ New Features
-
-    - Portainer: Update existing CE and BE installations [@MickLesk](https://github.com/MickLesk) ([#16357](https://github.com/community-scripts/ProxmoxVE/pull/16357))
-
-### 📚 Documentation
-
-  - github: update Star History links and image sources [@MickLesk](https://github.com/MickLesk) ([#16367](https://github.com/community-scripts/ProxmoxVE/pull/16367))
-
-## 2026-08-08
-
-### 🆕 New Scripts
-
-  - Ignis ([#16330](https://github.com/community-scripts/ProxmoxVE/pull/16330))
-
-### 💾 Core
-
-  - #### ✨ New Features
-
-    - core - setup_nodejs: bypass npm allowScripts policy globally on npm >=11 [@MickLesk](https://github.com/MickLesk) ([#16280](https://github.com/community-scripts/ProxmoxVE/pull/16280))
-
-## 2026-08-07
-
-### 🆕 New Scripts
-
-  - NetworkOptimizer ([#16328](https://github.com/community-scripts/ProxmoxVE/pull/16328))
- Orb ([#16329](https://github.com/community-scripts/ProxmoxVE/pull/16329))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - HortusFox: start applying db migrations [@tomfrenzel](https://github.com/tomfrenzel) ([#16324](https://github.com/community-scripts/ProxmoxVE/pull/16324))
-    - Docker: report container updates instead of prompting, stop auto-updating Portainer Agent, fix addon detection of legacy Portainer [@MickLesk](https://github.com/MickLesk) ([#16298](https://github.com/community-scripts/ProxmoxVE/pull/16298))
-    - Immich: retry mise install on transient npm download failures [@MickLesk](https://github.com/MickLesk) ([#16301](https://github.com/community-scripts/ProxmoxVE/pull/16301))
-    - changedetection: remove msttcorefonts to fix install hang [@austinpilz](https://github.com/austinpilz) ([#16319](https://github.com/community-scripts/ProxmoxVE/pull/16319))
-
-  - #### 🔧 Refactor
-
-    - core: extend new vars and pocketbase values [@MickLesk](https://github.com/MickLesk) ([#16313](https://github.com/community-scripts/ProxmoxVE/pull/16313))
+    - immich: fix jpegli patch path after upstream base-images split jpegli from libjxl [@MickLesk](https://github.com/MickLesk) ([#16647](https://github.com/community-scripts/ProxmoxVE/pull/16647))
@@ -40,6 +40,7 @@ function update_script() {
    cp -r /tmp/dist/* /usr/share/nginx/html
    rm -rf /tmp/dist
    rm -f it-tools.zip
+    echo "${RELEASE}" >/opt/${APP}_version.txt
    msg_ok "Updated successfully!"
  else
    msg_ok "No update required. ${APP} is already at ${RELEASE}"
@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/NeptuneHub/AudioMuse-AI
+
+APP="AudioMuse-AI"
+var_tags="${var_tags:-music;ai}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-8192}"
+var_disk="${var_disk:-20}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/audiomuse-ai ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "audiomuse-ai" "NeptuneHub/AudioMuse-AI"; then
+    msg_info "Stopping Services"
+    systemctl stop audiomuse-ai audiomuse-ai-worker audiomuse-ai-worker-high audiomuse-ai-janitor audiomuse-ai-control
+    msg_ok "Stopped Services"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "audiomuse-ai" "NeptuneHub/AudioMuse-AI" "tarball"
+
+    AUDIOMUSE_BACKEND="$(cat /opt/audiomuse-ai_data/.backend 2>/dev/null || echo cpu)"
+    REQ_COMMON="common.txt"
+    case "$AUDIOMUSE_BACKEND" in
+    gpu)
+      REQ_ACCEL="gpu.txt"
+      [[ "$(uname -m)" == "aarch64" ]] && REQ_ACCEL="gpu-arm64.txt"
+      ;;
+    cpu-noavx2)
+      REQ_COMMON="common-noavx2.txt"
+      REQ_ACCEL="cpu-noavx2.txt"
+      ;;
+    *)
+      REQ_ACCEL="cpu.txt"
+      ;;
+    esac
+
+    msg_info "Updating Python Environment (${AUDIOMUSE_BACKEND})"
+    cd /opt/audiomuse-ai
+    $STD uv venv --seed --python 3.12 /opt/audiomuse-ai/.venv
+    $STD uv pip install --python /opt/audiomuse-ai/.venv \
+      -r "/opt/audiomuse-ai/requirements/${REQ_COMMON}" \
+      -r "/opt/audiomuse-ai/requirements/${REQ_ACCEL}"
+    msg_ok "Updated Python Environment (${AUDIOMUSE_BACKEND})"
+
+    msg_info "Starting Services"
+    systemctl start audiomuse-ai audiomuse-ai-worker audiomuse-ai-worker-high audiomuse-ai-janitor audiomuse-ai-control
+    msg_ok "Started Services"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8000${CL}"
@@ -43,13 +43,12 @@ function update_script() {
  ensure_dependencies crossbuild-essential-$(arch_resolve) gcc-$(arch_resolve "x86-64" "aarch64")-linux-gnu cmake clang libunwind-18-dev
  msg_ok "Update dependencies"

-  NODE_VERSION="26" NODE_MODULE=pnpm@11 setup_nodejs
+  NODE_VERSION="26" NODE_MODULE=pnpm@12 setup_nodejs
  $STD uv cache clean
-  UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.7" setup_uv
  RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
  setup_yq

-  AUTHENTIK_VERSION="version/2026.8.2"
+  AUTHENTIK_VERSION="version/2026.8.3"
  # Source: https://github.com/goauthentik/fips/blob/main/Makefile#L26
  XMLSEC_VERSION="1.3.12"

@@ -95,6 +94,7 @@ function update_script() {
    fi

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
+    UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.7" UV_PROJECT_DIR="/opt/authentik" setup_uv
    GO_VERSION="$(grep -m1 '^go ' /opt/authentik/go.mod | awk '{print $2}')" setup_go

    msg_info "Configuring rust"
@@ -106,7 +106,7 @@ function update_script() {
    msg_info "Updating web"
    export NODE_ENV="production"
 	  cd /opt/authentik
-	  $STD node ./scripts/node/lint-runtime.mjs ./web
+	  $STD node ./scripts/node/lint-runtime.ts ./web
 	  cd /opt/authentik/web
 	  $STD pnpm install --frozen-lockfile
 	  $STD pnpm run build
@@ -31,8 +31,6 @@ function update_script() {
    exit
  fi

-  setup_uv
-
  RELEASE=$(get_latest_codeberg_release "gelbphoenix/autocaliweb")
  if check_for_codeberg_release "autocaliweb" "gelbphoenix/autocaliweb"; then
    msg_info "Stopping Services"
@@ -43,6 +41,7 @@ function update_script() {
    export VIRTUAL_ENV="${INSTALL_DIR}/venv"
    $STD tar -cf ~/autocaliweb_bkp.tar "$INSTALL_DIR"/{metadata_change_logs,dirs.json,.env,scripts/ingest_watcher.sh,scripts/auto_zipper_wrapper.sh,scripts/metadata_change_detector_wrapper.sh}
    fetch_and_deploy_codeberg_release "autocaliweb" "gelbphoenix/autocaliweb" "tarball" "latest" "/opt/autocaliweb"
+    setup_uv $INSTALL_DIR
    
    msg_info "Updating Autocaliweb"
    cd "$INSTALL_DIR" 
@@ -39,6 +39,7 @@ function update_script() {

    create_backup /opt/baserow/.env
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "baserow" "baserow/baserow" "tarball"
+    UV_PROJECT_DIR="/opt/baserow/backend" setup_uv
    restore_backup

    msg_info "Configuring Baserow"
@@ -40,6 +40,7 @@ function update_script() {
    create_backup /opt/beaverhabits/.user

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "beaverhabits" "daya0576/beaverhabits" "tarball"
+    PYTHON_VERSION="3.14" UV_PROJECT_DIR="/opt/beaverhabits" setup_uv

    msg_info "Syncing Dependencies"
    cd /opt/beaverhabits
@@ -0,0 +1,121 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/karanhudia/borg-ui
+
+APP="Borg-UI"
+var_tags="${var_tags:-backup}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/borg-ui ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "borg-ui" "karanhudia/borg-ui"; then
+    msg_info "Stopping Service"
+    systemctl stop borg-ui
+    msg_ok "Stopped Service"
+
+    create_backup /opt/borg-ui/.env
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "borg-ui" "karanhudia/borg-ui" "tarball"
+
+    restore_backup
+
+    BORG_UI_VERSION=$(cat "$HOME/.borg-ui" 2>/dev/null)
+    if [[ -n "$BORG_UI_VERSION" ]]; then
+      if grep -q '^APP_VERSION=' /opt/borg-ui/.env; then
+        sed -i "s|^APP_VERSION=.*|APP_VERSION=${BORG_UI_VERSION}|" /opt/borg-ui/.env
+      else
+        echo "APP_VERSION=${BORG_UI_VERSION}" >>/opt/borg-ui/.env
+      fi
+    fi
+
+    # Only the three Borg pins appear in every release of this file; PYTHON_VERSION
+    # and RCLONE_VERSION were added upstream after v2.2.6, so both fall back.
+    RUNTIME_ENV="/opt/borg-ui/docker/runtime-base.env"
+    BORG1_VERSION=$(sed -n 's/^BORG1_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
+    BORG2_VERSION=$(sed -n 's/^BORG2_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
+    BORGSTORE_VERSION=$(sed -n 's/^BORGSTORE_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
+    RCLONE_VERSION=$(sed -n 's/^RCLONE_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
+    BORG_PYTHON=$(sed -n 's/^PYTHON_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
+    BORG_PYTHON="${BORG_PYTHON:-3.12}"
+    if [[ -z "$BORG1_VERSION" || -z "$BORG2_VERSION" || -z "$BORGSTORE_VERSION" ]]; then
+      msg_error "Could not read the pinned Borg versions from ${RUNTIME_ENV}"
+      exit 1
+    fi
+
+    if [[ "$(cat /opt/borg1-venv/.pinned_version 2>/dev/null)" != "$BORG1_VERSION" ]]; then
+      msg_info "Installing Borg ${BORG1_VERSION} (Patience)"
+      $STD uv venv --python "$BORG_PYTHON" /opt/borg1-venv
+      $STD uv pip install --python /opt/borg1-venv pyfuse3 "borgbackup==${BORG1_VERSION}"
+      echo "$BORG1_VERSION" >/opt/borg1-venv/.pinned_version
+      ln -sf /opt/borg1-venv/bin/borg /usr/local/bin/borg
+      msg_ok "Installed Borg ${BORG1_VERSION}"
+    fi
+
+    if [[ "$(cat /opt/borg2-venv/.pinned_version 2>/dev/null)" != "${BORG2_VERSION}-${BORGSTORE_VERSION}" ]]; then
+      msg_info "Installing Borg ${BORG2_VERSION} (Patience)"
+      $STD uv venv --python "$BORG_PYTHON" /opt/borg2-venv
+      $STD uv pip install --python /opt/borg2-venv pyfuse3 "borgbackup==${BORG2_VERSION}" "borgstore[rclone,sftp,rest,s3,blake3]==${BORGSTORE_VERSION}"
+      echo "${BORG2_VERSION}-${BORGSTORE_VERSION}" >/opt/borg2-venv/.pinned_version
+      ln -sf /opt/borg2-venv/bin/borg /usr/local/bin/borg2
+      msg_ok "Installed Borg ${BORG2_VERSION}"
+    fi
+
+    RCLONE_TAG="${RCLONE_VERSION:+v${RCLONE_VERSION}}"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "rclone" "rclone/rclone" "prebuild" "${RCLONE_TAG:-latest}" "/opt/rclone" "rclone-${RCLONE_TAG:-*}-linux-$(arch_resolve amd64 arm64).zip"
+    ln -sf /opt/rclone/rclone /usr/local/bin/rclone
+
+    msg_info "Building Frontend"
+    cd /opt/borg-ui/frontend
+    $STD npm ci
+    $STD npm run build
+    rm -rf /opt/borg-ui/app/static
+    mkdir -p /opt/borg-ui/app/static
+    cp -r /opt/borg-ui/frontend/build/* /opt/borg-ui/app/static/
+    msg_ok "Built Frontend"
+
+    msg_info "Updating Python Environment"
+    cd /opt/borg-ui
+    $STD uv venv --python "$BORG_PYTHON" /opt/borg-ui/.venv
+    $STD uv pip install --python /opt/borg-ui/.venv -r requirements.txt
+    msg_ok "Updated Python Environment"
+
+    msg_info "Starting Service"
+    systemctl start borg-ui
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8081${CL}"
@@ -37,6 +37,7 @@ function update_script() {
    msg_ok "Stopped Service"

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Byparr" "ThePhaseless/Byparr" "tarball" "latest"
+    UV_PROJECT_DIR="/opt/Byparr" setup_uv

    if ! dpkg -l | grep -q ffmpeg; then
      msg_info "Installing dependencies"
@@ -32,14 +32,18 @@ function update_script() {
    exit
  fi

-  if check_for_gh_release "Calibre-Web" "janeczku/calibre-web"; then
+  if [[ -f /root/.calibre-web && ! -e /root/.calibreweb ]]; then
+    mv /root/.calibre-web /root/.calibreweb
+  fi
+
+  if check_for_gh_release "calibreweb" "janeczku/calibre-web"; then
    msg_info "Stopping Service"
    systemctl stop calibre-web
    msg_ok "Stopped Service"

    create_backup /opt/calibre-web/data

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Calibre-Web" "janeczku/calibre-web" "prebuild" "latest" "/opt/calibre-web" "calibreweb*.tar.gz"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "calibreweb" "janeczku/calibre-web" "prebuild" "latest" "/opt/calibre-web" "calibreweb*.tar.gz"
    setup_uv

    msg_info "Installing Dependencies"
@@ -32,7 +32,18 @@ function update_script() {
    exit
  fi

-  ensure_dependencies libjpeg-dev
+  ensure_dependencies libjpeg-dev poppler-utils file locales
+
+  msg_info "Generating Locales"
+  for l in cs_CZ de_DE en_GB en_US es_ES fr_FR id_ID it_IT ja_JP ko_KR \
+    pl_PL pt_BR ru_RU tr_TR uk_UA zh_CN zh_TW; do
+    sed -i "s/^# *${l}.UTF-8 UTF-8/${l}.UTF-8 UTF-8/" /etc/locale.gen
+  done
+  $STD locale-gen
+  if ! grep -q "^LC_ALL=" /opt/changedetection/.env 2>/dev/null; then
+    echo "LC_ALL=en_US.UTF-8" >>/opt/changedetection/.env
+  fi
+  msg_ok "Generated Locales"

  NODE_VERSION="24" setup_nodejs

@@ -9,8 +9,8 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_

 APP="Cloudflare-DDNS"
 var_tags="${var_tags:-network}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-1024}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-512}"
 var_disk="${var_disk:-3}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
@@ -46,8 +46,8 @@ function update_script() {

    CLEAN_INSTALL=1 fetch_and_deploy_gl_release "Crafty-Controller" "crafty-controller/crafty-4" "tarball" "latest" "/opt/crafty-controller/crafty/crafty-4"

-    chown -R crafty:crafty /opt/crafty-controller
    restore_backup
+    chown -R crafty:crafty /opt/crafty-controller

    msg_info "Updating TemurinJDK"
    setup_java
@@ -87,10 +87,10 @@ function update_script() {
    mkdir -p /opt/databasus/ui/build
    cp -r /opt/databasus/frontend/dist/* /opt/databasus/ui/build/
    cp -r /opt/databasus/backend/migrations /opt/databasus/
-    chown -R postgres:postgres /opt/databasus
    msg_ok "Updated Databasus"

    restore_backup
+    chown -R postgres:postgres /opt/databasus

    if ! grep -q "EnvironmentFile=/.env" /etc/systemd/system/databasus.service; then
      msg_info "Updating Service"
@@ -10,7 +10,7 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 APP="Dispatcharr"
 var_tags="${var_tags:-media;arr}"
 var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
+var_ram="${var_ram:-4096}"
 var_disk="${var_disk:-8}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
@@ -32,7 +32,6 @@ function update_script() {
    exit
  fi

-  setup_uv
  NODE_VERSION="24" setup_nodejs
  if [[ -f "/etc/nginx/sites-available/dispatcharr.conf" ]] && ! grep -q "real_forwarded_proto" "/etc/nginx/sites-available/dispatcharr.conf"; then
    msg_info "Migrating Nginx Configuration"
@@ -106,7 +105,18 @@ EOF
    msg_ok "Migrated Nginx Configuration"
  fi

-  ensure_dependencies vlc-bin vlc-plugin-base
+  ensure_dependencies vlc-bin vlc-plugin-base build-essential autoconf libtool libargtable2-dev libavformat-dev libsdl2-dev libswscale-dev
+
+  if ! command -v comskip &> /dev/null; then
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Comskip" "erikkaashoek/Comskip" "tarball"
+    msg_info "Compiling Comskip"
+    cd /opt/Comskip
+    $STD ./autogen.sh
+    $STD ./configure
+    $STD make
+    $STD make install
+    msg_ok "Compiled and Installed Comskip"
+  fi

  if check_for_gh_release "Dispatcharr" "Dispatcharr/Dispatcharr"; then
    msg_info "Stopping Services"
@@ -135,6 +145,7 @@ EOF
    msg_ok "Backup created: $BACKUP_FILE"

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "dispatcharr" "Dispatcharr/Dispatcharr" "tarball"
+    UV_PROJECT_DIR="/opt/dispatcharr" setup_uv

    restore_backup

@@ -57,6 +57,7 @@ function update_script() {

    msg_info "Configuring Docmost"
    cd /opt/docmost
+    export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
    $STD pnpm install --force
    $STD pnpm build
    msg_ok "Configured Docmost"
@@ -53,10 +53,10 @@ function update_script() {
    msg_info "Updating Domain Monitor"
    cd /opt/domain-monitor
    $STD composer install
-    chown -R www-data:www-data /opt/domain-monitor
    msg_ok "Updated Domain Monitor"

    restore_backup
+    chown -R www-data:www-data /opt/domain-monitor

    msg_info "Restarting Services"
    systemctl start apache2
@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.elastic.co/elasticsearch
+
+APP="Elasticsearch"
+var_tags="${var_tags:-database;search}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-20}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /etc/elasticsearch/elasticsearch.yml ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  msg_info "Updating ${APP}"
+  $STD apt update
+  $STD apt install -y elasticsearch
+  msg_ok "Updated ${APP}"
+
+  msg_info "Restarting Service"
+  systemctl restart elasticsearch
+  msg_ok "Restarted Service"
+  msg_ok "Updated successfully!"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:9200${CL}"
+echo -e "${INFO}${YW}Set the password for the 'elastic' user:${CL}"
+echo -e "${TAB}${DEFAULT}${BGN}/usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic${CL}"
@@ -39,6 +39,7 @@ function update_script() {

    create_backup /opt/fireshare/fireshare.env
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "fireshare" "ShaneIsrael/fireshare" "tarball"
+    UV_PROJECT_DIR="/opt/fireshare" setup_uv
    restore_backup
    rm -f /usr/local/bin/fireshare

@@ -38,10 +38,10 @@ function update_script() {

    create_backup /opt/flatnotes/.env /opt/flatnotes/data

-    PYTHON_VERSION="3.13" setup_uv
    NODE_VERSION="24" setup_nodejs

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "flatnotes" "dullage/flatnotes" "tarball"
+    PYTHON_VERSION="3.13" UV_PROJECT_DIR="/opt/flatnotes" setup_uv

    restore_backup

@@ -10,8 +10,8 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 APP="Frigate"
 var_tags="${var_tags:-nvr}"
 var_cpu="${var_cpu:-8}"
-var_ram="${var_ram:-4096}"
-var_disk="${var_disk:-20}"
+var_ram="${var_ram:-6144}"
+var_disk="${var_disk:-25}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-12}"
 var_arm64="${var_arm64:-no}"
@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: CrazyWolf13
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/gotenberg/gotenberg
+
+APP="Gotenberg"
+var_tags="${var_tags:-document;pdf}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-15}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /etc/systemd/system/gotenberg.service ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "gotenberg" "gotenberg/gotenberg"; then
+    msg_info "Stopping Service"
+    systemctl stop gotenberg
+    msg_ok "Stopped Service"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "gotenberg" "gotenberg/gotenberg" "tarball" "latest" "/opt/gotenberg"
+
+    GO_VERSION="$(awk '$1=="go"{print $2}' /opt/gotenberg/go.mod | cut -d. -f1,2)" setup_go
+
+    msg_info "Building gotenberg (Patience)"
+    cd /opt/gotenberg
+    export CGO_ENABLED=0
+    $STD go mod download
+    $STD go build -o /usr/local/bin/gotenberg \
+      -ldflags "-s -w -X 'github.com/gotenberg/gotenberg/v8/cmd.Version=$(cat ~/.gotenberg)'" \
+      cmd/gotenberg/main.go
+    msg_ok "Built gotenberg"
+
+    msg_info "Updating unoconverter"
+    UNOCONVERTER_VERSION=$(get_latest_github_release "gotenberg/unoconverter" "false")
+    download_file "https://raw.githubusercontent.com/gotenberg/unoconverter/${UNOCONVERTER_VERSION}/unoconv" /usr/local/bin/unoconverter
+    chmod +x /usr/local/bin/unoconverter
+    msg_ok "Updated unoconverter"
+
+    msg_info "Starting Service"
+    systemctl start gotenberg
+    msg_ok "Started Service"
+    msg_ok "Updated Successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Gotenberg is a stateless API and has no web interface.${CL}"
+echo -e "${INFO}${YW}Check the health endpoint using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3000/health${CL}"
@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Darkrock-Studios/hammer-editor
+
+APP="Hammer"
+var_tags="${var_tags:-writing;sync-server}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_unprivileged="${var_unprivileged:-1}"
+var_arm64="${var_arm64:-yes}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/hammer ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "hammer" "Darkrock-Studios/hammer-editor"; then
+    msg_info "Stopping Service"
+    systemctl stop hammer
+    msg_ok "Stopped Service"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "hammer" "Darkrock-Studios/hammer-editor" "prebuild" "latest" "/opt/hammer" "server.zip"
+    chmod +x /opt/hammer/bin/server
+
+    msg_info "Starting Service"
+    systemctl start hammer
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8080${CL}"
@@ -0,0 +1,6 @@
+    ___             ___       __  ___                      ___    ____
+   /   | __  ______/ (_)___  /  |/  /_  __________        /   |  /  _/
+  / /| |/ / / / __  / / __ \/ /|_/ / / / / ___/ _ \______/ /| |  / /  
+ / ___ / /_/ / /_/ / / /_/ / /  / / /_/ (__  )  __/_____/ ___ |_/ /   
+/_/  |_\__,_/\__,_/_/\____/_/  /_/\__,_/____/\___/     /_/  |_/___/   
+                                                                      
@@ -0,0 +1,6 @@
+    ____                         __  ______
+   / __ )____  _________ _      / / / /  _/
+  / __  / __ \/ ___/ __ `/_____/ / / // /  
+ / /_/ / /_/ / /  / /_/ /_____/ /_/ // /   
+/_____/\____/_/   \__, /      \____/___/   
+                 /____/                    
@@ -0,0 +1,6 @@
+    ________           __  _                                __  
+   / ____/ /___ ______/ /_(_)____________  ____ ___________/ /_ 
+  / __/ / / __ `/ ___/ __/ / ___/ ___/ _ \/ __ `/ ___/ ___/ __ \
+ / /___/ / /_/ (__  ) /_/ / /__(__  )  __/ /_/ / /  / /__/ / / /
+/_____/_/\__,_/____/\__/_/\___/____/\___/\__,_/_/   \___/_/ /_/ 
+                                                                
@@ -0,0 +1,6 @@
+   ______      __             __                   
+  / ____/___  / /____  ____  / /_  ___  _________ _
+ / / __/ __ \/ __/ _ \/ __ \/ __ \/ _ \/ ___/ __ `/
+/ /_/ / /_/ / /_/  __/ / / / /_/ /  __/ /  / /_/ / 
+\____/\____/\__/\___/_/ /_/_.___/\___/_/   \__, /  
+                                          /____/   
@@ -0,0 +1,6 @@
+    __  __                                   
+   / / / /___ _____ ___  ____ ___  ___  _____
+  / /_/ / __ `/ __ `__ \/ __ `__ \/ _ \/ ___/
+ / __  / /_/ / / / / / / / / / / /  __/ /    
+/_/ /_/\__,_/_/ /_/ /_/_/ /_/ /_/\___/_/     
+                                             
@@ -0,0 +1,6 @@
+         ____  _ __        __  ___                           
+  ____ _/ __ )(_) /_      /  |/  /___ _____  ____ _____ ____ 
+ / __ `/ __  / / __/_____/ /|_/ / __ `/ __ \/ __ `/ __ `/ _ \
+/ /_/ / /_/ / / /_/_____/ /  / / /_/ / / / / /_/ / /_/ /  __/
+\__, /_____/_/\__/     /_/  /_/\__,_/_/ /_/\__,_/\__, /\___/ 
+  /_/                                           /____/       
@@ -0,0 +1,6 @@
+ _    __      ____          ____     
+| |  / /___ _/ / /_  ____ _/ / /___ _
+| | / / __ `/ / __ \/ __ `/ / / __ `/
+| |/ / /_/ / / / / / /_/ / / / /_/ / 
+|___/\__,_/_/_/ /_/\__,_/_/_/\__,_/  
+                                     
@@ -0,0 +1,6 @@
+__  __                      _____             __  _ ____     
+\ \/ /___  __  _______     / ___/____  ____  / /_(_) __/_  __
+ \  / __ \/ / / / ___/_____\__ \/ __ \/ __ \/ __/ / /_/ / / /
+ / / /_/ / /_/ / /  /_____/__/ / /_/ / /_/ / /_/ / __/ /_/ / 
+/_/\____/\__,_/_/        /____/ .___/\____/\__/_/_/  \__, /  
+                             /_/                    /____/   
@@ -112,7 +112,7 @@ EOF
    msg_ok "Image-processing libraries up to date"
  fi

-  RELEASE="v3.2.0"
+  RELEASE="v3.2.2"
  if check_for_gh_release "Immich" "immich-app/immich" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
    if [[ $(cat ~/.immich) > "2.5.1" ]]; then
      msg_info "Enabling Maintenance Mode"
@@ -10,7 +10,7 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 APP="ImmichFrame"
 var_tags="${var_tags:-photos;slideshow}"
 var_cpu="${var_cpu:-1}"
-var_ram="${var_ram:-1024}"
+var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-8}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
@@ -79,6 +79,17 @@ function update_script() {
    restore_backup
    chown -R immichframe:immichframe /opt/immichframe

+    if ! grep -q '^Environment=IMMICHFRAME_ADMIN_PASSWORD=' /etc/systemd/system/immichframe.service; then
+      msg_info "Setting Admin Password"
+      ADMIN_PASSWORD=$(openssl rand -hex 16)
+      sed -i "/^Environment=DOTNET_CONTENTROOT=/a Environment=IMMICHFRAME_ADMIN_PASSWORD=${ADMIN_PASSWORD}" /etc/systemd/system/immichframe.service
+      cat <<EOF >>~/immichframe.creds
+ImmichFrame Admin User: admin
+ImmichFrame Admin Password: $ADMIN_PASSWORD
+EOF
+      systemctl daemon-reload
+      msg_ok "Set Admin Password (see ~/immichframe.creds)"
+    fi

    msg_info "Starting Service"
    systemctl start immichframe
@@ -54,6 +54,7 @@ function update_script() {
      $STD pnpm run build
    fi
    $STD php artisan migrate --force
+    $STD php artisan storage:link
    $STD php artisan optimize:clear
    chown -R www-data:www-data /opt/invoiceshelf
    msg_ok "Updated Application"
@@ -31,7 +31,7 @@ function update_script() {
    exit
  fi

-  NODE_VERSION="26" NPM_VERSION="11" setup_nodejs
+  NODE_VERSION="24" NPM_VERSION="11" setup_nodejs

  msg_info "Updating ${APP} LXC"
  $STD apt update
@@ -33,15 +33,43 @@ function update_script() {

  if check_for_gh_release "iventoy" "ventoy/PXE"; then
    msg_info "Stopping iVentoy"
-    $STD /opt/iventoy/iventoy.sh stop
+    systemctl stop iventoy
    msg_ok "Stopped iVentoy"

-    create_backup /opt/iventoy/data /opt/iventoy/iso
+    # Only preserve user state; data/iventoy.dat must match the new executable.
+    create_backup /opt/iventoy/data/config.dat /opt/iventoy/iso /opt/iventoy/user
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "iventoy" "ventoy/PXE" "prebuild" "latest" "/opt/iventoy" "iventoy-*-linux-$(arch_resolve x86_64-free arm64-trial).tar.gz"
    restore_backup

+    # Migrate existing services that invoke the Bash launcher with sh.
+    mkdir -p /etc/systemd/system/iventoy.service.d
+    cat <<EOF >/etc/systemd/system/iventoy.service.d/launcher.conf
+[Service]
+ExecStart=
+ExecStart=/bin/bash /opt/iventoy/iventoy.sh -R start
+ExecStop=
+ExecStop=/bin/bash /opt/iventoy/iventoy.sh stop
+PIDFile=/run/iventoy.pid
+RestartSec=5
+EOF
+    systemctl daemon-reload
+
    msg_info "Starting iVentoy"
-    $STD /opt/iventoy/iventoy.sh -R start
+    systemctl reset-failed iventoy
+    systemctl start iventoy
+    # The launcher can return success before the daemon fails initialization.
+    local i ready=0
+    for ((i = 0; i < 90; i++)); do
+      if systemctl is-active --quiet iventoy && curl -fsS --max-time 2 "${IVENTOY_HEALTH_URL:-http://127.0.0.1:26000/}" >/dev/null 2>&1; then
+        ready=1
+        break
+      fi
+      sleep 2
+    done
+    if [[ "$ready" -ne 1 ]]; then
+      msg_error "iVentoy did not become ready; check journalctl -u iventoy and /opt/iventoy/log/log.txt"
+      exit 1
+    fi
    msg_ok "Started iVentoy"
    msg_ok "Updated Successfully"
  fi
@@ -17,6 +17,14 @@ var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

+# Optional public setup, read by the install script (all empty = LAN-only install as before).
+# Without the export they never reach the container.
+export var_jitsi_domain="${var_jitsi_domain:-}"
+export var_jitsi_le_email="${var_jitsi_le_email:-}"
+export var_jitsi_public_ip="${var_jitsi_public_ip:-}"
+export var_jitsi_admin_user="${var_jitsi_admin_user:-}"
+export var_jitsi_admin_pass="${var_jitsi_admin_pass:-}"
+
 header_info "$APP"
 variables
 color
@@ -50,4 +58,7 @@ description
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}https://${IP}${CL}"
+echo -e "${GATEWAY}${BGN}https://${var_jitsi_domain:-$IP}${CL}"
+if [[ -n "${var_jitsi_domain}" ]]; then
+  echo -e "${INFO}${YW}Forward TCP 80/443 and UDP 10000 to the container. Secure-domain credentials (if enabled) are in ~/jitsi-meet.creds inside the container.${CL}"
+fi
@@ -38,6 +38,7 @@ function update_script() {
    msg_ok "Stopped Services"

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "journiv" "journiv/journiv-app" "tarball"
+    UV_PROJECT_DIR="/opt/journiv" setup_uv

    msg_info "Updating Python Environment"
    cd /opt/journiv
@@ -42,6 +42,7 @@ function update_script() {
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "kitchenowl" "TomBursch/kitchenowl" "tarball" "latest" "/opt/kitchenowl"
    rm -rf /opt/kitchenowl/web
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "kitchenowl-web" "TomBursch/kitchenowl" "prebuild" "latest" "/opt/kitchenowl/web" "kitchenowl_Web.tar.gz"
+    PYTHON_VERSION="3.14" UV_PROJECT_DIR="/opt/kitchenowl/backend" setup_uv

    restore_backup
    sed -i 's/default=True/default=False/' /opt/kitchenowl/backend/wsgi.py
@@ -40,6 +40,7 @@ function update_script() {
    create_backup /opt/linkding/data /opt/linkding/.env

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "linkding" "sissbruecker/linkding" "tarball"
+    UV_PROJECT_DIR="/opt/linkding" setup_uv

    restore_backup
    ln -sf /usr/lib/$(arch_resolve "x86_64-linux-gnu" "aarch64-linux-gnu")/mod_icu.so /opt/linkding/libicu.so
@@ -32,7 +32,6 @@ function update_script() {
    exit
  fi
  if check_for_gh_release "mealie" "mealie-recipes/mealie"; then
-    PYTHON_VERSION="3.12" setup_uv

    msg_info "Stopping Service"
    systemctl stop mealie
@@ -44,6 +43,7 @@ function update_script() {
    msg_ok "Backup completed"

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "mealie" "mealie-recipes/mealie" "tarball"
+    PYTHON_VERSION="3.12" UV_PROJECT_DIR="/opt/mealie" setup_uv

    msg_info "Restoring Configuration"
    mv -f /opt/mealie.env /opt/mealie/mealie.env
@@ -31,14 +31,13 @@ function update_script() {
    exit
  fi

-  setup_uv
-
  if check_for_gh_release "mediamanager" "maxdorninger/MediaManager"; then
    msg_info "Stopping Service"
    systemctl stop mediamanager
    msg_ok "Stopped Service"

    fetch_and_deploy_gh_release "MediaManager" "maxdorninger/MediaManager" "tarball" "latest" "/opt/mediamanager"
+    UV_PROJECT_DIR="/opt/mediamanager" setup_uv
    msg_info "Updating MediaManager"
    MM_DIR="/opt/mm"
    export CONFIG_DIR="${MM_DIR}/config"
@@ -53,6 +53,7 @@ function update_script() {
    create_backup /opt/metube/.env

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "metube" "alexta69/metube" "tarball" "latest"
+    UV_PROJECT_DIR="/opt/metube" setup_uv

    restore_backup

@@ -38,6 +38,9 @@ function update_script() {

    fetch_and_deploy_gh_release "navidrome" "navidrome/navidrome" "binary"

+    find /var/lib/navidrome/cache /var/lib/navidrome/artwork /var/lib/navidrome/plugins \
+      -maxdepth 0 -type d -user root -exec chown -h navidrome:navidrome {} + 2>/dev/null || true
+
    msg_info "Starting Services"
    systemctl start navidrome
    msg_ok "Started Services"
@@ -40,6 +40,7 @@ function update_script() {
    create_backup /opt/notediscovery/data /opt/notediscovery/config.yaml

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "notediscovery" "gamosoft/NoteDiscovery" "tarball"
+    UV_PROJECT_DIR="/opt/notediscovery" setup_uv

    msg_info "Syncing Dependencies"
    cd /opt/notediscovery
@@ -10,8 +10,8 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_

 APP="OxiCloud"
 var_tags="${var_tags:-files;documents}"
-var_cpu="${var_cpu:-4}"
-var_ram="${var_ram:-6144}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-20}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
@@ -33,42 +33,19 @@ function update_script() {
    exit
  fi

-  NODE_VERSION="26" setup_nodejs
+  ensure_dependencies ffmpeg

  if check_for_gh_release "OxiCloud" "DioCrafts/OxiCloud"; then
    msg_info "Stopping OxiCloud"
    systemctl stop oxicloud
    msg_ok "Stopped OxiCloud"

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "OxiCloud" "DioCrafts/OxiCloud" "tarball" "latest" "/opt/oxicloud"
-    TOOLCHAIN="$(grep -oP 'FROM\s+rust:\K[0-9]+\.[0-9]+(\.[0-9]+)?' /opt/oxicloud/Dockerfile | head -1)"
-    RUST_TOOLCHAIN="${TOOLCHAIN:-stable}" setup_rust
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "OxiCloud" "DioCrafts/OxiCloud" "prebuild" "latest" "/opt/oxicloud" "oxicloud-*-$(arch_resolve x86_64 aarch64)-unknown-linux-musl.tar.gz"

-    msg_info "Building Frontend SPA"
-    cd /opt/oxicloud/frontend
-    $STD npm ci
-    $STD npm run build
-    msg_ok "Built Frontend SPA"
-
-    msg_info "Updating OxiCloud (Patience)"
-    set -a
-    source /etc/oxicloud/.env
-    set +a
-    cd /opt/oxicloud
-    export DATABASE_URL
-    export RUSTFLAGS="-C target-cpu=native"
-    RAM_MB=$(awk '/MemTotal/ {print int($2/1024)}' /proc/meminfo)
-    CARGO_JOBS=$((RAM_MB / 2560))
-    [[ $CARGO_JOBS -lt 1 ]] && CARGO_JOBS=1
-    [[ $CARGO_JOBS -gt $(nproc) ]] && CARGO_JOBS=$(nproc)
-    $STD cargo build --release -j "$CARGO_JOBS" --bin oxicloud --bin migrate-nfc-filenames
-    mv target/release/oxicloud /usr/local/bin/oxicloud
-    mv target/release/migrate-nfc-filenames /usr/local/bin/migrate-nfc-filenames
-    chmod +x /usr/local/bin/oxicloud /usr/local/bin/migrate-nfc-filenames
-    rm -f /usr/bin/oxicloud
-    rm -rf /opt/oxicloud/static
-    mv /opt/oxicloud/static-dist /opt/oxicloud/static
-    rm -rf /opt/oxicloud/target /opt/oxicloud/frontend/node_modules
+    msg_info "Updating OxiCloud"
+    install -m 755 /opt/oxicloud/oxicloud /usr/local/bin/oxicloud
+    rm -f /usr/local/bin/migrate-nfc-filenames /usr/bin/oxicloud
+    sed -i 's|^OXICLOUD_STATIC_PATH=|#OXICLOUD_STATIC_PATH=|' /etc/oxicloud/.env
    msg_ok "Updated OxiCloud"

    msg_info "Starting OxiCloud"
@@ -8,7 +8,7 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 # Source: https://pangolin.net/ | Github: https://github.com/fosrl/pangolin

 APP="Pangolin"
-PANGOLIN_VERSION="${PANGOLIN_VERSION:-1.21.0}"
+PANGOLIN_VERSION="${PANGOLIN_VERSION:-1.23.0}"
 var_tags="${var_tags:-proxy}"
 var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-4096}"
@@ -83,13 +83,13 @@ function update_script() {
      [[ -f /opt/paperless/paperless.conf ]] && cp /opt/paperless/paperless.conf "$BACKUP_DIR/"
      msg_ok "Backup completed to $BACKUP_DIR"

-      PYTHON_VERSION="3.13" setup_uv  
      if ((BRIDGE_UPDATE)); then
        CLEAN_INSTALL=1 fetch_and_deploy_gh_release "paperless" "paperless-ngx/paperless-ngx" "prebuild" "v2.20.15" "/opt/paperless" "paperless*tar.xz"
      else
        CLEAN_INSTALL=1 fetch_and_deploy_gh_release "paperless" "paperless-ngx/paperless-ngx" "prebuild" "latest" "/opt/paperless" "paperless*tar.xz"
      fi
      CLEAN_INSTALL=1 fetch_and_deploy_gh_release "jbig2enc" "ie13/jbig2enc" "tarball" "latest" "/opt/jbig2enc"
+      PYTHON_VERSION="3.13" UV_PROJECT_DIR="/opt/paperless" setup_uv

      . /etc/os-release
      if [ "$VERSION_CODENAME" = "bookworm" ]; then
@@ -169,9 +169,13 @@ function update_script() {
      if ((BRIDGE_UPDATE == 0)); then
        sed -i 's|^ExecStart=.*|ExecStart=uv run --no-sync -- granian --interface asginl --ws --loop uvloop "paperless.asgi:application"|' /etc/systemd/system/paperless-webserver.service
        grep -q "document_index reindex" /etc/systemd/system/paperless-webserver.service ||
-          sed -i '/^ExecStart=/i ExecStartPre=uv run -- python manage.py document_index reindex --if-needed --no-progress-bar' /etc/systemd/system/paperless-webserver.service
-        $STD systemctl daemon-reload
+          sed -i '/^ExecStart=/i ExecStartPre=uv run --no-sync -- python manage.py document_index reindex --if-needed --no-progress-bar' /etc/systemd/system/paperless-webserver.service
      fi
+      for svc in consumer scheduler task-queue webserver; do
+        unit="/etc/systemd/system/paperless-${svc}.service"
+        [[ -f "$unit" ]] && sed -i 's|uv run -- |uv run --no-sync -- |g' "$unit"
+      done
+      $STD systemctl daemon-reload
      cd /opt/paperless
      $STD uv sync --all-extras
      cd /opt/paperless/src
@@ -44,14 +44,16 @@ function update_script() {

    msg_info "Deploying New Version"
    cp -r /opt/poznote/src/. /var/www/html/
-    chown -R www-data:www-data /var/www/html
    msg_ok "Deployed New Version"

    restore_backup
+    chown -R www-data:www-data /var/www/html

    msg_info "Running Poznote Initialization"
-    chmod +x /opt/poznote/init.sh
-    $STD /opt/poznote/init.sh
+    POZNOTE_INIT=/opt/poznote/docker/init.sh
+    [[ -f "$POZNOTE_INIT" ]] || POZNOTE_INIT=/opt/poznote/init.sh
+    chmod +x "$POZNOTE_INIT"
+    $STD "$POZNOTE_INIT"
    msg_ok "Initialized Poznote Data Directory"

    msg_info "Updating Nginx Configuration"
@@ -68,7 +70,7 @@ map \$uri \$poznote_coop {

 server {
    listen 8040;
-    root /var/www/html;
+    root /var/www/html/public;
    index index.php index.html;

    gzip on;
@@ -144,10 +146,12 @@ server {
    }

    location ~ ^/data/users/[0-9]+/backgrounds/ {
+        root /var/www/html;
        try_files \$uri =404;
    }

    location ~ ^/data/css/[A-Za-z0-9._-]+\.css$ {
+        root /var/www/html;
        try_files \$uri =404;
    }

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/StuffAnThings/qbit_manage
+
+APP="qBit-Manage"
+var_tags="${var_tags:-arr;torrent}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-1024}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/qbit-manage ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "qbit-manage" "StuffAnThings/qbit_manage"; then
+    msg_info "Stopping Service"
+    systemctl stop qbit-manage
+    msg_ok "Stopped Service"
+
+    fetch_and_deploy_gh_release "qbit-manage" "StuffAnThings/qbit_manage" "singlefile" "latest" "/opt/qbit-manage" "qbit-manage-linux-$(arch_resolve amd64 arm64)"
+
+    msg_info "Starting Service"
+    systemctl start qbit-manage
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8181${CL}"
+echo -e "${INFO}${YW}Point it at your qBittorrent in /opt/qbit-manage_data/config.yml${CL}"
@@ -51,6 +51,7 @@ function update_script() {
      /opt/romm/frontend/dist/assets/ruffle

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "romm" "rommapp/romm" "tarball" "latest" "/opt/romm"
+    PYTHON_VERSION="3.13" UV_PROJECT_DIR="/opt/romm" setup_uv
    echo "__version__ = \"$(cat ~/.romm)\"" >/opt/romm/backend/__version__.py

    find /opt/romm/backend/alembic/versions -maxdepth 1 -type f -name '1.*.py' -delete 2>/dev/null || true
@@ -191,11 +192,30 @@ EOF
        sed -i -e "s|alias .*/library/;|alias ${ROMM_BASE}/library/;|" \
          -e "s|alias .*/cache/;|alias ${ROMM_BASE}/cache/;|" /etc/angie/http.d/romm.conf
      fi
+      cat <<'SYNCEOF' >/usr/local/bin/romm-sync-angie-paths
+#!/usr/bin/env bash
+base="$(grep -m1 '^ROMM_BASE_PATH=' /opt/romm/.env 2>/dev/null | cut -d= -f2)"
+base="${base:-/var/lib/romm}"
+[[ -f /etc/angie/http.d/romm.conf ]] || exit 0
+sed -i -e "s|alias .*/library/;|alias ${base}/library/;|" \
+  -e "s|alias .*/cache/;|alias ${base}/cache/;|" /etc/angie/http.d/romm.conf
+SYNCEOF
+      chmod +x /usr/local/bin/romm-sync-angie-paths
+      mkdir -p /etc/systemd/system/angie.service.d
+      cat <<'DROPEOF' >/etc/systemd/system/angie.service.d/romm-paths.conf
+[Service]
+ExecStartPre=/usr/local/bin/romm-sync-angie-paths
+DROPEOF
+      systemctl daemon-reload
      systemctl reload angie
    elif [[ -f /etc/nginx/sites-available/romm ]]; then
      sed -i "s|alias .*/library/;|alias ${ROMM_BASE}/library/;|" /etc/nginx/sites-available/romm
      nginx_enable_site romm
    fi
+    if [[ -f /etc/systemd/system/romm-watcher.service ]]; then
+      sed -i "s|\(watcher\.py' \).*|\1\${ROMM_BASE_PATH}/library|" /etc/systemd/system/romm-watcher.service
+      systemctl daemon-reload
+    fi
    msg_ok "Updated ROMM"

    msg_info "Starting Services"
@@ -33,7 +33,6 @@ function update_script() {
  fi

  NODE_VERSION="24" setup_nodejs
-  PYTHON_VERSION="3.14" setup_uv

  if check_for_gh_release "shelfmark" "calibrain/shelfmark"; then
    msg_info "Stopping Service(s)"
@@ -68,6 +67,7 @@ function update_script() {
      $STD apt remove -y chromium-driver
    fi
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "shelfmark" "calibrain/shelfmark" "tarball" "latest" "/opt/shelfmark"
+    PYTHON_VERSION="3.14" UV_PROJECT_DIR="/opt/shelfmark" setup_uv
    restore_backup
    RELEASE_VERSION=$(cat "$HOME/.shelfmark")

@@ -67,6 +67,7 @@ function update_script() {
      -e 's|${SPARKY_FITNESS_SERVER_PORT}|3010|g' \
      -e "s|\${SPARKY_FITNESS_FRONTEND_URL}|${FRONTEND_URL}|g" \
      -e 's|${NGINX_LISTEN_PORT}|80|g' \
+      -e 's|${NGINX_RATE_LIMIT}|5r/s|g' \
      -e 's|${NGINX_ACCESS_LOG}|/var/log/nginx/sparkyfitness.access.log|g' \
      -e 's|${NGINX_ERROR_LOG}|/var/log/nginx/sparkyfitness.error.log|g' \
      -e 's|root /usr/share/nginx/html;|root /var/www/sparkyfitness;|g' \
@@ -85,7 +86,7 @@ function update_script() {
  Type=simple
  WorkingDirectory=/opt/sparkyfitness/SparkyFitnessServer
  EnvironmentFile=/etc/sparkyfitness/.env
-  ExecStart=/opt/sparkyfitness/SparkyFitnessServer/node_modules/.bin/tsx SparkyFitnessServer.js
+  ExecStart=/opt/sparkyfitness/SparkyFitnessServer/node_modules/.bin/tsx index.ts
  Restart=always
  RestartSec=5

@@ -42,7 +42,7 @@ function update_script() {
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "spliit" "spliit-app/spliit" "tarball"

    restore_backup
-    NODE_VERSION="24" setup_nodejs
+    NODE_VERSION="26" setup_nodejs

    msg_info "Building Application"
    cd /opt/spliit
@@ -31,8 +31,6 @@ function update_script() {
    exit
  fi

-  PYTHON_VERSION="3.14" setup_uv
-
  if check_for_gh_release "spoolman" "Donkie/Spoolman"; then
    msg_info "Stopping Service"
    systemctl stop spoolman
@@ -41,6 +39,7 @@ function update_script() {
    create_backup /opt/spoolman/.env

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "spoolman" "Donkie/Spoolman" "prebuild" "latest" "/opt/spoolman" "spoolman.zip"
+    PYTHON_VERSION="3.14" UV_PROJECT_DIR="/opt/spoolman" setup_uv

    restore_backup

@@ -37,8 +37,19 @@ function update_script() {
    systemctl stop suggestarr
    msg_ok "Stopped Service"

+    mkdir -p /opt/suggestarr_data
+    if [[ -d /opt/suggestarr/config/config_files && ! -L /opt/suggestarr/config/config_files ]]; then
+      msg_info "Migrating Configuration"
+      cp -an /opt/suggestarr/config/config_files/. /opt/suggestarr_data/
+      msg_ok "Migrated Configuration to /opt/suggestarr_data"
+    fi
+
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "suggestarr" "giuseppe99barchetta/SuggestArr" "tarball"

+    mkdir -p /opt/suggestarr/config
+    rm -rf /opt/suggestarr/config/config_files
+    ln -sfn /opt/suggestarr_data /opt/suggestarr/config/config_files
+
    msg_info "Building Frontend"
    cd /opt/suggestarr/client
    $STD npm install
@@ -44,7 +44,8 @@ function update_script() {
    msg_ok "Stopped Service"

    CLEAN_INSTALL=1 GITLAB_URL="https://gitlab.torproject.org" fetch_and_deploy_gl_release "tor-snowflake" "tpo/anti-censorship/pluggable-transports/snowflake" "tarball"
-    GO_VERSION="$(grep -m1 '^go ' /opt/tor-snowflake/proxy/go.mod | awk '{print $2}')" setup_go
+    GO_VERSION="$(awk '/^go /{print $2; exit}' /opt/tor-snowflake/go.mod 2>/dev/null || true)"
+    GO_VERSION="${GO_VERSION:-latest}" setup_go

    msg_info "Building Snowflake"
    cd /opt/tor-snowflake/proxy
@@ -124,7 +124,7 @@ EOF
    $STD pnpm turbo telemetry disable
    $STD pnpm turbo run build --no-daemon --filter=@tracearr/shared --filter=@tracearr/server --filter=@tracearr/web
    rm -rf /opt/tracearr
-    mkdir -p /opt/tracearr/{packages/shared,apps/server,apps/web,apps/server/src/db}
+    mkdir -p /opt/tracearr/{packages/shared,packages/emails,apps/server,apps/web,apps/server/src/db}
    cp -rf package.json /opt/tracearr/
    cp -rf pnpm-workspace.yaml /opt/tracearr/
    cp -rf pnpm-lock.yaml /opt/tracearr/
@@ -134,6 +134,8 @@ EOF
    cp -rf apps/web/dist /opt/tracearr/apps/web/dist
    cp -rf packages/shared/package.json /opt/tracearr/packages/shared/
    cp -rf packages/shared/dist /opt/tracearr/packages/shared/dist
+    cp -rf packages/emails/package.json /opt/tracearr/packages/emails/
+    cp -rf packages/emails/dist /opt/tracearr/packages/emails/dist
    cp -rf apps/server/src/db/migrations /opt/tracearr/apps/server/src/db/migrations
    cp -rf data /opt/tracearr/data
    mkdir -p /opt/tracearr/data/image-cache
@@ -40,6 +40,9 @@ function update_script() {
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "umami" "umami-software/umami" "tarball"
    restore_backup

+    PNPM_VERSION=$(jq -r '.engines.pnpm // "latest"' /opt/umami/package.json)
+    NODE_VERSION="22" NODE_MODULE="pnpm@${PNPM_VERSION}" setup_nodejs
+
    msg_info "Updating Umami"
    cd /opt/umami
    $STD pnpm install
@@ -0,0 +1,104 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: CrazyWolf13
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/valhalla/valhalla
+
+APP="Valhalla"
+var_tags="${var_tags:-mapping;routing}"
+var_cpu="${var_cpu:-6}"
+var_ram="${var_ram:-6144}"
+var_disk="${var_disk:-24}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /etc/systemd/system/valhalla.service ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "prime_server" "kevinkreiser/prime_server"; then
+    RELEASE="$CHECK_UPDATE_RELEASE"
+
+    msg_info "Stopping Service"
+    systemctl stop valhalla
+    msg_ok "Stopped Service"
+
+    msg_info "Building prime_server ${RELEASE} (Patience)"
+    rm -rf /tmp/prime_server
+    $STD git clone --recurse-submodules --depth 1 --branch "$RELEASE" https://github.com/kevinkreiser/prime_server /tmp/prime_server
+    cd /tmp/prime_server
+    $STD ./autogen.sh
+    $STD ./configure
+    $STD make -j"$(nproc)"
+    $STD make install
+    cd /
+    rm -rf /tmp/prime_server
+    ldconfig
+    echo "${RELEASE#v}" >"$HOME/.prime_server"
+    msg_ok "Built prime_server ${RELEASE}"
+
+    msg_info "Starting Service"
+    systemctl start valhalla
+    msg_ok "Started Service"
+  fi
+
+  if check_for_gh_release "valhalla" "valhalla/valhalla"; then
+    RELEASE="$CHECK_UPDATE_RELEASE"
+
+    msg_info "Stopping Service"
+    systemctl stop valhalla
+    msg_ok "Stopped Service"
+
+    msg_info "Fetching Valhalla ${RELEASE} (Patience)"
+    rm -rf /opt/valhalla
+    $STD git clone --recurse-submodules --depth 1 --branch "$RELEASE" https://github.com/valhalla/valhalla.git /opt/valhalla
+    msg_ok "Fetched Valhalla ${RELEASE}"
+
+    msg_info "Compiling Valhalla ${RELEASE} (this takes 20-45+ minutes, be patient)"
+    MEM_MB=$(awk '/MemTotal/{print int($2/1024)}' /proc/meminfo)
+    BUILD_JOBS=$((MEM_MB / 2000))
+    [[ $BUILD_JOBS -lt 1 ]] && BUILD_JOBS=1
+    [[ $BUILD_JOBS -gt $(nproc) ]] && BUILD_JOBS=$(nproc)
+    cd /opt/valhalla
+    $STD cmake -B build -DCMAKE_BUILD_TYPE=Release -DENABLE_PYTHON_BINDINGS=OFF -DENABLE_TESTS=OFF -DENABLE_SINGLE_FILES_WERROR=OFF
+    $STD cmake --build build -- -j"$BUILD_JOBS"
+    $STD cmake --install build
+    ldconfig
+    echo "${RELEASE#v}" >"$HOME/.valhalla"
+    msg_ok "Compiled Valhalla ${RELEASE}"
+
+    msg_info "Starting Service"
+    systemctl start valhalla
+    msg_ok "Started Service"
+  fi
+
+  msg_ok "Updated Successfully!\n"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8002/status${CL}"
+echo -e "${INFO}${YW}No routing tiles are built yet. Build them for your region with:${CL}"
+echo -e "${TAB}${BGN}/opt/valhalla_data/build-tiles.sh https://download.geofabrik.de/<continent>/<region>-latest.osm.pbf${CL}"
@@ -32,8 +32,6 @@ function update_script() {
    exit
  fi

-  setup_uv
-
  if check_for_gh_release "wizarr" "wizarrrr/wizarr"; then
    msg_info "Stopping Service"
    systemctl stop wizarr
@@ -46,6 +44,7 @@ function update_script() {
    msg_ok "Backup Created"

    fetch_and_deploy_gh_release "wizarr" "wizarrrr/wizarr" "tarball"
+    UV_PROJECT_DIR="/opt/wizarr" setup_uv

    msg_info "Updating Wizarr"
    cd /opt/wizarr
@@ -41,6 +41,7 @@ function update_script() {
    create_backup /opt/yamtrack/src/.env

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "yamtrack" "FuzzyGrim/Yamtrack" "tarball"
+    PYTHON_VERSION="3.12" UV_PROJECT_DIR="/opt/yamtrack" setup_uv

    restore_backup

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Yooooomi/your_spotify
+
+APP="Your-Spotify"
+var_tags="${var_tags:-music;analytics}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-3072}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/your-spotify ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "your-spotify" "Yooooomi/your_spotify"; then
+    msg_info "Stopping Services"
+    systemctl stop your-spotify your-spotify-web
+    msg_ok "Stopped Services"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "your-spotify" "Yooooomi/your_spotify" "tarball"
+
+    msg_info "Building Your Spotify"
+    cd /opt/your-spotify
+    $STD pnpm install --frozen-lockfile
+    $STD pnpm --filter @your_spotify/server build
+    $STD pnpm --filter @your_spotify/client build
+    msg_ok "Built Your Spotify"
+
+    msg_info "Applying Client Configuration"
+    API_ENDPOINT=$(grep '^API_ENDPOINT=' /opt/your-spotify.env | cut -d= -f2-)
+    cp /opt/your-spotify/apps/client/build/variables-template.js /opt/your-spotify/apps/client/build/variables.js
+    sed -i "s;__API_ENDPOINT__;${API_ENDPOINT};g" /opt/your-spotify/apps/client/build/variables.js
+    sed -i "s#connect-src \(.*\);#connect-src 'self' ${API_ENDPOINT}/;#g" /opt/your-spotify/apps/client/build/index.html
+    msg_ok "Applied Client Configuration"
+  
+    msg_info "Restarting Services"
+    systemctl restart your-spotify your-spotify-web
+    msg_ok "Restarted Services"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"
+echo -e "${INFO}${YW}Add your Spotify app keys to /opt/your-spotify.env first${CL}"
+echo -e "${INFO}${YW}Spotify rejects plain http redirect URIs on a LAN address.${CL}"
+echo -e "${INFO}${YW}Put this behind a TLS reverse proxy and register:${CL}"
+echo -e "${TAB}${DEFAULT}${BGN}https://your.domain/oauth/spotify/callback${CL}"
+echo -e "${INFO}${YW}Then set API_ENDPOINT to that https URL and rerun the update.${CL}"
@@ -40,6 +40,7 @@ function update_script() {
    msg_ok "Stopped Services"

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "yubal" "guillevc/yubal" "tarball" "latest" "/opt/yubal"
+    PYTHON_VERSION="3.12" UV_PROJECT_DIR="/opt/yubal" setup_uv

    msg_info "Building Frontend"
    cd /opt/yubal/web
@@ -22,7 +22,7 @@ $STD apt install -y \
  python3-dev
 msg_ok "Installed Dependencies"

-UV_PYTHON="3.12" setup_uv
+PYTHON_VERSION="3.12" setup_uv
 PG_VERSION="16" setup_postgresql
 PG_DB_NAME="airflow" PG_DB_USER="airflow" setup_postgresql_db

@@ -0,0 +1,250 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/NeptuneHub/AudioMuse-AI
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  build-essential \
+  git \
+  ffmpeg \
+  libchromaprint-tools \
+  libsndfile1 \
+  libgomp1
+msg_ok "Installed Dependencies"
+
+PG_VERSION="16" setup_postgresql
+PG_DB_NAME="audiomuse" PG_DB_USER="audiomuse" setup_postgresql_db
+PYTHON_VERSION="3.12" setup_uv
+setup_hwaccel
+
+fetch_and_deploy_gh_release "audiomuse-ai" "NeptuneHub/AudioMuse-AI" "tarball"
+
+var_backend="${var_backend:-auto}"
+if [[ "$var_backend" == "auto" ]]; then
+  if ! grep -qm1 avx2 /proc/cpuinfo; then
+    var_backend="cpu-noavx2"
+  elif [[ "${HWACCEL_VENDOR:-none}" == "nvidia" ]]; then
+    var_backend="gpu"
+  else
+    var_backend="cpu"
+  fi
+fi
+
+REQ_COMMON="common.txt"
+case "$var_backend" in
+gpu)
+  REQ_ACCEL="gpu.txt"
+  [[ "$(uname -m)" == "aarch64" ]] && REQ_ACCEL="gpu-arm64.txt"
+  ;;
+cpu)
+  REQ_ACCEL="cpu.txt"
+  ;;
+cpu-noavx2)
+  REQ_COMMON="common-noavx2.txt"
+  REQ_ACCEL="cpu-noavx2.txt"
+  ;;
+*)
+  msg_error "Unknown var_backend '${var_backend}' (expected auto, gpu, cpu or cpu-noavx2)"
+  exit 1
+  ;;
+esac
+
+msg_info "Setting up Python Environment (${var_backend}, Patience)"
+cd /opt/audiomuse-ai
+$STD uv venv --seed --python 3.12 /opt/audiomuse-ai/.venv
+$STD uv pip install --python /opt/audiomuse-ai/.venv \
+  -r "/opt/audiomuse-ai/requirements/${REQ_COMMON}" \
+  -r "/opt/audiomuse-ai/requirements/${REQ_ACCEL}"
+mkdir -p /opt/audiomuse-ai_data
+echo "$var_backend" >/opt/audiomuse-ai_data/.backend
+msg_ok "Set up Python Environment (${var_backend})"
+
+MODEL_DIR="/opt/audiomuse-ai_data/model"
+MODEL_URL="https://github.com/NeptuneHub/AudioMuse-AI/releases/download/v5.0.0-model"
+DCLAP_URL="https://github.com/NeptuneHub/AudioMuse-AI-DCLAP/releases/download/v1"
+
+msg_info "Downloading ML Models (Patience)"
+mkdir -p "$MODEL_DIR/huggingface"
+for FILE in musicnn_embedding.onnx musicnn_prediction.onnx clap_text_model.onnx; do
+  curl -fsSL "${MODEL_URL}/${FILE}" -o "${MODEL_DIR}/${FILE}"
+done
+for FILE in model_epoch_36.onnx model_epoch_36.onnx.data; do
+  curl -fsSL "${DCLAP_URL}/${FILE}" -o "${MODEL_DIR}/${FILE}"
+done
+for BUNDLE in lyrics_model_whisper lyrics_model_silero_vad lyrics_model_gte_vnni; do
+  curl -fsSL "${MODEL_URL}/${BUNDLE}.tar.gz" -o "/tmp/${BUNDLE}.tar.gz"
+  tar -xzf "/tmp/${BUNDLE}.tar.gz" -C "$MODEL_DIR"
+  rm -f "/tmp/${BUNDLE}.tar.gz"
+done
+curl -fsSL "${MODEL_URL}/huggingface_models.tar.gz" -o /tmp/huggingface_models.tar.gz
+tar -xzf /tmp/huggingface_models.tar.gz -C "${MODEL_DIR}/huggingface"
+rm -f /tmp/huggingface_models.tar.gz
+HF_HUB_DIR="${MODEL_DIR}/huggingface/hub"
+rm -rf "${HF_HUB_DIR}/models--bert-base-uncased" "${HF_HUB_DIR}/models--facebook--bart-base"
+if [[ -d "${HF_HUB_DIR}/models--roberta-base" ]]; then
+  find "${HF_HUB_DIR}/models--roberta-base/blobs" -type f -size +10M -delete
+  find "${HF_HUB_DIR}/models--roberta-base/snapshots" \( -name "model.safetensors" -o -name "pytorch_model.bin" \) -delete
+fi
+msg_ok "Downloaded ML Models"
+
+msg_info "Configuring AudioMuse-AI"
+mkdir -p /opt/audiomuse-ai_data/{temp_audio,ivf_cache,plugins,backup} /opt/audiomuse-ai_data/cache/numba
+AUDIOMUSE_PASSWORD=$(openssl rand -base64 18)
+JWT_SECRET=$(openssl rand -hex 32)
+API_TOKEN=$(openssl rand -hex 32)
+cat <<EOF >/opt/audiomuse-ai_data/audiomuse.env
+POSTGRES_USER=audiomuse
+POSTGRES_PASSWORD=${PG_DB_PASS}
+POSTGRES_DB=audiomuse
+POSTGRES_HOST=127.0.0.1
+POSTGRES_PORT=5432
+TZ=UTC
+AUTH_ENABLED=true
+AUDIOMUSE_USER=admin
+AUDIOMUSE_PASSWORD=${AUDIOMUSE_PASSWORD}
+JWT_SECRET=${JWT_SECRET}
+API_TOKEN=${API_TOKEN}
+MEDIASERVER_TYPE=jellyfin
+JELLYFIN_URL=http://YOUR_JELLYFIN_IP:8096
+JELLYFIN_USER_ID=
+JELLYFIN_TOKEN=
+AI_MODEL_PROVIDER=NONE
+APP_DATA_DIR=/opt/audiomuse-ai_data
+TEMP_DIR=/opt/audiomuse-ai_data/temp_audio
+BACKUP_DIR=/opt/audiomuse-ai_data/backup
+RESTORE_LOG_DIR=/opt/audiomuse-ai_data/backup
+XDG_CACHE_HOME=/opt/audiomuse-ai_data/cache
+NUMBA_CACHE_DIR=/opt/audiomuse-ai_data/cache/numba
+HF_HOME=${MODEL_DIR}/huggingface
+HF_HUB_DISABLE_XET=1
+HF_XET_DISABLE=1
+EMBEDDING_MODEL_PATH=${MODEL_DIR}/musicnn_embedding.onnx
+PREDICTION_MODEL_PATH=${MODEL_DIR}/musicnn_prediction.onnx
+CLAP_AUDIO_MODEL_PATH=${MODEL_DIR}/model_epoch_36.onnx
+CLAP_TEXT_MODEL_PATH=${MODEL_DIR}/clap_text_model.onnx
+LYRICS_MODEL_DIR=${MODEL_DIR}
+LYRICS_WHISPER_MODEL_DIR=${MODEL_DIR}/whisper-small-onnx
+SILERO_VAD_ONNX_PATH=${MODEL_DIR}/silero_vad.onnx
+LYRICS_GTE_ONNX_PATH=${MODEL_DIR}/gte-multilingual-base-int8.onnx
+LYRICS_GTE_TOKENIZER_DIR=${MODEL_DIR}/gte-multilingual-base
+EOF
+{
+  echo ""
+  echo "AudioMuse-AI-Credentials"
+  echo "Web UI User: admin"
+  echo "Web UI Password: ${AUDIOMUSE_PASSWORD}"
+} >>~/audiomuse-ai.creds
+msg_ok "Configured AudioMuse-AI"
+
+msg_info "Creating Services"
+cat <<EOF >/etc/systemd/system/audiomuse-ai.service
+[Unit]
+Description=AudioMuse-AI Web (Flask)
+After=network-online.target postgresql.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/audiomuse-ai
+EnvironmentFile=/opt/audiomuse-ai_data/audiomuse.env
+ExecStart=/opt/audiomuse-ai/.venv/bin/gunicorn --bind 0.0.0.0:8000 --workers 1 --threads 4 --worker-class gthread --keep-alive 5 --timeout 300 app:app
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+cat <<EOF >/etc/systemd/system/audiomuse-ai-worker.service
+[Unit]
+Description=AudioMuse-AI Queue Worker (default)
+After=network-online.target postgresql.service audiomuse-ai.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/audiomuse-ai
+EnvironmentFile=/opt/audiomuse-ai_data/audiomuse.env
+ExecStart=/opt/audiomuse-ai/.venv/bin/python -u -m taskqueue.worker --queue default
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+cat <<EOF >/etc/systemd/system/audiomuse-ai-worker-high.service
+[Unit]
+Description=AudioMuse-AI Queue Worker (high)
+After=network-online.target postgresql.service audiomuse-ai.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/audiomuse-ai
+EnvironmentFile=/opt/audiomuse-ai_data/audiomuse.env
+ExecStart=/opt/audiomuse-ai/.venv/bin/python -u -m taskqueue.worker --queue high
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+cat <<EOF >/etc/systemd/system/audiomuse-ai-janitor.service
+[Unit]
+Description=AudioMuse-AI Queue Maintenance
+After=network-online.target postgresql.service audiomuse-ai.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/audiomuse-ai
+EnvironmentFile=/opt/audiomuse-ai_data/audiomuse.env
+ExecStart=/opt/audiomuse-ai/.venv/bin/python -u -m taskqueue.maintenance
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+cat <<EOF >/etc/systemd/system/audiomuse-ai-control.service
+[Unit]
+Description=AudioMuse-AI Config Restart Listener
+After=network-online.target postgresql.service audiomuse-ai.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/audiomuse-ai
+EnvironmentFile=/opt/audiomuse-ai_data/audiomuse.env
+ExecStart=/opt/audiomuse-ai/.venv/bin/python -u -m taskqueue.control
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now audiomuse-ai audiomuse-ai-worker audiomuse-ai-worker-high audiomuse-ai-janitor audiomuse-ai-control
+msg_ok "Created Services"
+
+motd_ssh
+customize
+cleanup_lxc
@@ -50,19 +50,19 @@ $STD apt install -y \
  git
 msg_ok "Installed Dependencies"

-NODE_VERSION="26" NODE_MODULE=pnpm@11 setup_nodejs
+NODE_VERSION="26" NODE_MODULE=pnpm@12 setup_nodejs
 setup_yq
 RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
-UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.7" setup_uv
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db

 XMLSEC_VERSION="1.3.12"
-AUTHENTIK_VERSION="version/2026.8.2"
+AUTHENTIK_VERSION="version/2026.8.3"
 fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec"
 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
 GO_VERSION="$(grep -m1 '^go ' /opt/authentik/go.mod | awk '{print $2}')" setup_go
 fetch_and_deploy_gh_release "geoipupdate" "maxmind/geoipupdate" "binary"
+UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.7" UV_PROJECT_DIR="/opt/authentik" setup_uv

 msg_info "Setting up xmlsec"
 cd /opt/xmlsec
@@ -82,7 +82,7 @@ msg_ok "Configured rust"
 msg_info "Setting up web"
 export NODE_ENV="production"
 cd /opt/authentik
-$STD node ./scripts/node/lint-runtime.mjs ./web
+$STD node ./scripts/node/lint-runtime.ts ./web
 cd /opt/authentik/web
 $STD pnpm install --frozen-lockfile
 $STD pnpm run build
@@ -54,9 +54,8 @@ $STD /opt/calibre/calibre_postinstall
 CALIBRE_VERSION=$(cat ~/.calibre)
 msg_ok "Installed Calibre"

-setup_uv
-
 fetch_and_deploy_codeberg_release "autocaliweb" "gelbphoenix/autocaliweb" "tarball" "latest" "/opt/autocaliweb"
+setup_uv $INSTALL_DIR

 msg_info "Configuring Autocaliweb"
 INSTALL_DIR="/opt/autocaliweb"
@@ -33,9 +33,9 @@ msg_ok "Installed Dependencies"
 PG_VERSION="16" PG_MODULES="pgvector" setup_postgresql
 PG_DB_NAME="baserow" PG_DB_USER="baserow" setup_postgresql_db
 NODE_VERSION="24" setup_nodejs
-setup_uv

 fetch_and_deploy_gh_release "baserow" "baserow/baserow" "tarball"
+UV_PROJECT_DIR="/opt/baserow/backend" setup_uv

 msg_info "Installing Backend Dependencies"
 cd /opt/baserow/backend
@@ -13,9 +13,8 @@ setting_up_container
 network_check
 update_os

-PYTHON_VERSION="3.14" setup_uv
-
 fetch_and_deploy_gh_release "beaverhabits" "daya0576/beaverhabits" "tarball"
+PYTHON_VERSION="3.14" UV_PROJECT_DIR="/opt/beaverhabits" setup_uv

 msg_info "Installing Dependencies"
 cd /opt/beaverhabits
@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/karanhudia/borg-ui
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  build-essential \
+  python3-dev \
+  pkg-config \
+  libffi-dev \
+  libssl-dev \
+  libacl1-dev \
+  liblz4-dev \
+  libzstd-dev \
+  libxxhash-dev \
+  libfuse3-dev \
+  fuse3 \
+  rsync \
+  sshfs \
+  openssh-client \
+  sshpass
+msg_ok "Installed Dependencies"
+
+PYTHON_VERSION="3.12" setup_uv
+NODE_VERSION="22" setup_nodejs
+
+fetch_and_deploy_gh_release "borg-ui" "karanhudia/borg-ui" "tarball"
+
+# Only the three Borg pins appear in every release of this file; PYTHON_VERSION
+# and RCLONE_VERSION were added upstream after v2.2.6, so both fall back.
+RUNTIME_ENV="/opt/borg-ui/docker/runtime-base.env"
+BORG1_VERSION=$(sed -n 's/^BORG1_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
+BORG2_VERSION=$(sed -n 's/^BORG2_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
+BORGSTORE_VERSION=$(sed -n 's/^BORGSTORE_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
+RCLONE_VERSION=$(sed -n 's/^RCLONE_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
+BORG_PYTHON=$(sed -n 's/^PYTHON_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
+BORG_PYTHON="${BORG_PYTHON:-3.12}"
+if [[ -z "$BORG1_VERSION" || -z "$BORG2_VERSION" || -z "$BORGSTORE_VERSION" ]]; then
+  msg_error "Could not read the pinned Borg versions from ${RUNTIME_ENV}"
+  exit 1
+fi
+
+msg_info "Installing Borg ${BORG1_VERSION} and Borg ${BORG2_VERSION} (Patience)"
+$STD uv venv --python "$BORG_PYTHON" /opt/borg1-venv
+$STD uv pip install --python /opt/borg1-venv pyfuse3 "borgbackup==${BORG1_VERSION}"
+echo "$BORG1_VERSION" >/opt/borg1-venv/.pinned_version
+$STD uv venv --python "$BORG_PYTHON" /opt/borg2-venv
+$STD uv pip install --python /opt/borg2-venv pyfuse3 "borgbackup==${BORG2_VERSION}" "borgstore[rclone,sftp,rest,s3,blake3]==${BORGSTORE_VERSION}"
+echo "${BORG2_VERSION}-${BORGSTORE_VERSION}" >/opt/borg2-venv/.pinned_version
+ln -sf /opt/borg1-venv/bin/borg /usr/local/bin/borg
+ln -sf /opt/borg2-venv/bin/borg /usr/local/bin/borg2
+msg_ok "Installed Borg ${BORG1_VERSION} and Borg ${BORG2_VERSION}"
+
+RCLONE_TAG="${RCLONE_VERSION:+v${RCLONE_VERSION}}"
+fetch_and_deploy_gh_release "rclone" "rclone/rclone" "prebuild" "${RCLONE_TAG:-latest}" "/opt/rclone" "rclone-${RCLONE_TAG:-*}-linux-$(arch_resolve amd64 arm64).zip"
+ln -sf /opt/rclone/rclone /usr/local/bin/rclone
+
+msg_info "Building Frontend"
+cd /opt/borg-ui/frontend
+$STD npm ci
+$STD npm run build
+mkdir -p /opt/borg-ui/app/static
+cp -r /opt/borg-ui/frontend/build/* /opt/borg-ui/app/static/
+msg_ok "Built Frontend"
+
+msg_info "Setting up Python Environment"
+cd /opt/borg-ui
+$STD uv venv --python "$BORG_PYTHON" /opt/borg-ui/.venv
+$STD uv pip install --python /opt/borg-ui/.venv -r requirements.txt
+msg_ok "Set up Python Environment"
+
+msg_info "Configuring Borg-UI"
+mkdir -p /opt/borg-ui_data
+BORG_UI_VERSION=$(cat "$HOME/.borg-ui" 2>/dev/null)
+if [[ -z "$BORG_UI_VERSION" ]]; then
+  msg_error "Could not determine the deployed Borg-UI version"
+  exit 1
+fi
+cat <<EOF >/opt/borg-ui/.env
+APP_VERSION=${BORG_UI_VERSION}
+PORT=8081
+ENVIRONMENT=production
+TZ=UTC
+DATA_DIR=/opt/borg-ui_data
+ENABLE_CRON_BACKUPS=true
+ENABLE_STARTUP_LICENSE_SYNC=false
+EOF
+chmod 600 /opt/borg-ui/.env
+msg_ok "Configured Borg-UI"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/borg-ui.service
+[Unit]
+Description=Borg-UI
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/borg-ui
+EnvironmentFile=/opt/borg-ui/.env
+ExecStart=/opt/borg-ui/.venv/bin/gunicorn app.main:app --bind 0.0.0.0:8081 --workers 2 --worker-class uvicorn.workers.UvicornWorker --timeout 300
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now borg-ui
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc
@@ -52,8 +52,8 @@ $STD apt -y install --no-install-recommends \
  fonts-tlwg-loma-otf
 msg_ok "Installed Dependencies"

-setup_uv
 fetch_and_deploy_gh_release "Byparr" "ThePhaseless/Byparr" "tarball" "latest"
+UV_PROJECT_DIR="/opt/Byparr" setup_uv

 msg_info "Configuring Byparr"
 cd /opt/Byparr
@@ -32,7 +32,7 @@ msg_info "Installing Calibre (for eBook conversion)"
 $STD apt install -y calibre
 msg_ok "Installed Calibre"

-fetch_and_deploy_gh_release "Calibre-Web" "janeczku/calibre-web" "prebuild" "latest" "/opt/calibre-web" "calibreweb*.tar.gz"
+fetch_and_deploy_gh_release "calibreweb" "janeczku/calibre-web" "prebuild" "latest" "/opt/calibre-web" "calibreweb*.tar.gz"
 setup_uv

 msg_info "Installing Python Dependencies"
@@ -38,9 +38,20 @@ $STD apt-get install -y \
  qpdf \
  xdg-utils \
  xvfb \
-  ca-certificates
+  ca-certificates \
+  locales \
+  poppler-utils \
+  file
 msg_ok "Installed Dependencies"

+msg_info "Generating Locales"
+for l in cs_CZ de_DE en_GB en_US es_ES fr_FR id_ID it_IT ja_JP ko_KR \
+  pl_PL pt_BR ru_RU tr_TR uk_UA zh_CN zh_TW; do
+  sed -i "s/^# *${l}.UTF-8 UTF-8/${l}.UTF-8 UTF-8/" /etc/locale.gen
+done
+$STD locale-gen
+msg_ok "Generated Locales"
+
 PYTHON_VERSION="3.13" setup_uv

 NODE_VERSION="24" setup_nodejs
@@ -54,6 +65,7 @@ $STD /opt/changedetection/.venv/bin/python -m pip install changedetection.io
 cat <<EOF >/opt/changedetection/.env
 WEBDRIVER_URL=http://127.0.0.1:4444/wd/hub
 PLAYWRIGHT_DRIVER_URL=ws://localhost:3000/chrome?launch=eyJkZWZhdWx0Vmlld3BvcnQiOnsiaGVpZ2h0Ijo3MjAsIndpZHRoIjoxMjgwfSwiaGVhZGxlc3MiOmZhbHNlLCJzdGVhbHRoIjp0cnVlfQ==&blockAds=true
+LC_ALL=en_US.UTF-8
 EOF
 msg_ok "Installed Change Detection"

@@ -25,14 +25,29 @@ $STD apt install -y \
  procps \
  vlc-bin \
  vlc-plugin-base \
-  streamlink
+  streamlink \
+  autoconf \
+  libtool \
+  libargtable2-dev \
+  libavformat-dev \
+  libsdl2-dev \
+  libswscale-dev
 msg_ok "Installed Dependencies"

-setup_uv
 NODE_VERSION="24" setup_nodejs
 PG_VERSION="16" setup_postgresql
 PG_DB_NAME="dispatcharr_db" PG_DB_USER="dispatcharr_usr" setup_postgresql_db
 fetch_and_deploy_gh_release "dispatcharr" "Dispatcharr/Dispatcharr" "tarball"
+fetch_and_deploy_gh_release "Comskip" "erikkaashoek/Comskip" "tarball"
+UV_PROJECT_DIR="/opt/dispatcharr" setup_uv
+
+msg_info "Compiling Comskip"
+cd /opt/Comskip
+$STD ./autogen.sh
+$STD ./configure
+$STD make
+$STD make install
+msg_ok "Compiled and Installed Comskip"

 msg_info "Installing Python Dependencies with uv"
 cd /opt/dispatcharr
@@ -48,6 +48,7 @@ sed -i -e "s|APP_SECRET=.*|APP_SECRET=$(openssl rand -base64 32 | tr -dc 'a-zA-Z
  -e "s|^STORAGE_DRIVER=azure|#STORAGE_DRIVER=azure|" \
  /opt/docmost/.env
 export NODE_OPTIONS="--max-old-space-size=2048"
+export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
 $STD pnpm install
 $STD pnpm build
 msg_ok "Configured Docmost"
@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.elastic.co/elasticsearch
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+# vm.max_map_count is not namespaced, so a container cannot raise it - the value
+# is inherited from the Proxmox host. Elasticsearch refuses to start below the
+# required limit once it binds to a non-loopback address (production mode).
+msg_info "Checking Kernel Limits"
+if (($(sysctl -n vm.max_map_count) < 262144)); then
+  msg_error "vm.max_map_count is $(sysctl -n vm.max_map_count), Elasticsearch needs at least 262144"
+  msg_error "Set it on the PROXMOX HOST, not in this container:"
+  msg_error "  echo 'vm.max_map_count=1048576' >/etc/sysctl.d/99-elasticsearch.conf && sysctl --system"
+  exit 1
+fi
+msg_ok "Checked Kernel Limits"
+
+JAVA_VERSION="21" setup_java
+
+setup_deb822_repo \
+  "elasticsearch" \
+  "https://artifacts.elastic.co/GPG-KEY-elasticsearch" \
+  "https://artifacts.elastic.co/packages/9.x/apt" \
+  "stable" \
+  "main"
+
+msg_info "Installing Elasticsearch"
+$STD apt install -y elasticsearch
+msg_ok "Installed Elasticsearch"
+
+msg_info "Configuring Elasticsearch"
+mkdir -p /opt/elasticsearch_data
+chown -R elasticsearch:elasticsearch /opt/elasticsearch_data
+cat <<EOF >/etc/elasticsearch/elasticsearch.yml
+cluster.name: proxmox
+node.name: ${HOSTNAME}
+path.data: /opt/elasticsearch_data
+path.logs: /var/log/elasticsearch
+
+network.host: 0.0.0.0
+http.port: 9200
+discovery.type: single-node
+
+xpack.security.enabled: true
+xpack.security.enrollment.enabled: true
+xpack.security.http.ssl.enabled: false
+xpack.security.transport.ssl.enabled: false
+EOF
+
+cat <<EOF >/etc/elasticsearch/jvm.options.d/heap.options
+-Xms1g
+-Xmx1g
+EOF
+systemctl enable -q --now elasticsearch
+msg_ok "Configured Elasticsearch"
+
+
+motd_ssh
+customize
+cleanup_lxc
@@ -36,7 +36,7 @@ $STD apt install -y \
 msg_ok "Installed Dependencies"

 NODE_VERSION="24" NODE_MODULE="yarn" setup_nodejs
-UV_PYTHON="3.14" setup_uv
+PYTHON_VERSION="3.14" setup_uv
 setup_mariadb

 msg_info "Configuring MariaDB for ERPNext"
@@ -44,6 +44,7 @@ NODE_VERSION=24 setup_nodejs
 PYTHON_VERSION=3.14 setup_uv

 fetch_and_deploy_gh_release "fireshare" "ShaneIsrael/fireshare" "tarball"
+UV_PROJECT_DIR="/opt/fireshare" setup_uv

 msg_info "Compiling SVT-AV1 (Patience)"
 cd /tmp
@@ -14,6 +14,7 @@ network_check
 update_os

 fetch_and_deploy_gh_release "flatnotes" "dullage/flatnotes" "tarball"
+UV_PROJECT_DIR="/opt/flatnotes" setup_uv
 PYTHON_VERSION="3.13" setup_uv
 NODE_VERSION="24" setup_nodejs

@@ -110,7 +110,7 @@ export AUTOGRAPH_VERBOSITY=0
 export GLOG_minloglevel=3
 export GLOG_logtostderr=0

-fetch_and_deploy_gh_release "frigate" "blakeblackshear/frigate" "tarball" "v0.17.2" "/opt/frigate"
+fetch_and_deploy_gh_release "frigate" "blakeblackshear/frigate" "tarball" "v0.18.0" "/opt/frigate"

 msg_info "Building Nginx"
 $STD bash /opt/frigate/docker/main/build_nginx.sh
@@ -122,7 +122,18 @@ msg_info "Building SQLite Extensions"
 $STD bash /opt/frigate/docker/main/build_sqlite_vec.sh
 msg_ok "Built SQLite Extensions"

-fetch_and_deploy_gh_release "go2rtc" "AlexxIT/go2rtc" "singlefile" "latest" "/usr/local/go2rtc/bin" "go2rtc_linux_$(arch_resolve)"
+if [[ "$(arch_resolve)" == "amd64" ]]; then
+  msg_info "Building Intel Media Driver (Patience)"
+  $STD bash /opt/frigate/docker/main/build_intel_media_driver.sh
+  cp -a /rootfs/. /
+  rm -rf /rootfs
+  rm -f /etc/apt/sources.list.d/intel-gpu-jammy.list /usr/share/keyrings/intel-graphics.gpg
+  $STD apt update
+  ldconfig
+  msg_ok "Built Intel Media Driver"
+fi
+
+fetch_and_deploy_gh_release "go2rtc" "AlexxIT/go2rtc" "singlefile" "v1.9.14" "/usr/local/go2rtc/bin" "go2rtc_linux_$(arch_resolve)"

 msg_info "Installing Tempio"
 sed -i 's|/rootfs/usr/local|/usr/local|g' /opt/frigate/docker/main/install_tempio.sh
@@ -194,17 +205,7 @@ if python3 /opt/frigate/docker/main/build_ov_model.py &>/dev/null; then
  mkdir -p /openvino-model
  cp /models/ssdlite_mobilenet_v2.xml /openvino-model/
  cp /models/ssdlite_mobilenet_v2.bin /openvino-model/
-  OV_LABELS=$(python3 -c "import omz_tools; import os; print(os.path.join(omz_tools.__path__[0], 'data/dataset_classes/coco_91cl_bkgr.txt'))" 2>/dev/null)
-  if [[ -n "$OV_LABELS" && -f "$OV_LABELS" ]]; then
-    ln -sf "$OV_LABELS" /openvino-model/coco_91cl_bkgr.txt
-  else
-    OV_LABELS=$(find /usr/local/lib -name "coco_91cl_bkgr.txt" 2>/dev/null | head -1)
-    if [[ -n "$OV_LABELS" ]]; then
-      ln -sf "$OV_LABELS" /openvino-model/coco_91cl_bkgr.txt
-    else
-      curl_with_retry "https://raw.githubusercontent.com/openvinotoolkit/open_model_zoo/master/data/dataset_classes/coco_91cl_bkgr.txt" "/openvino-model/coco_91cl_bkgr.txt"
-    fi
-  fi
+  curl_with_retry "https://raw.githubusercontent.com/openvinotoolkit/open_model_zoo/master/data/dataset_classes/coco_91cl_bkgr.txt" "/openvino-model/coco_91cl_bkgr.txt"
  sed -i 's/truck/car/g' /openvino-model/coco_91cl_bkgr.txt
  msg_ok "Built OpenVino Model"
 else
@@ -251,8 +252,8 @@ curl_download "/media/frigate/person-bicycle-car-detection.mp4" "https://github.
 echo "tmpfs   /tmp/cache      tmpfs   defaults        0       0" >>/etc/fstab

 cat <<EOF >/etc/frigate.env
-DEFAULT_FFMPEG_VERSION="7.0"
-INCLUDED_FFMPEG_VERSIONS="7.0:5.0"
+DEFAULT_FFMPEG_VERSION="8.0"
+INCLUDED_FFMPEG_VERSIONS="8.0:7.0:5.0"
 NVIDIA_VISIBLE_DEVICES=all
 NVIDIA_DRIVER_CAPABILITIES="compute,video,utility"
 TOKENIZERS_PARALLELISM=true
@@ -268,6 +269,23 @@ GLOG_minloglevel=3
 GLOG_logtostderr=0
 EOF

+if grep -q -o -m1 -E 'avx[^ ]*|sse4_2' /proc/cpuinfo && [[ -f /openvino-model/ssdlite_mobilenet_v2.xml ]] && [[ -f /openvino-model/coco_91cl_bkgr.txt ]]; then
+  DETECTOR_CONFIG="detectors:
+  detector01:
+    type: openvino
+    device: AUTO
+model:
+  width: 300
+  height: 300
+  input_tensor: nhwc
+  input_pixel_format: bgr
+  path: /openvino-model/ssdlite_mobilenet_v2.xml
+  labelmap_path: /openvino-model/coco_91cl_bkgr.txt"
+else
+  DETECTOR_CONFIG="model:
+  path: /models/cpu_model.tflite"
+fi
+
 cat <<EOF >/config/config.yml
 mqtt:
  enabled: false
@@ -287,32 +305,10 @@ auth:
  enabled: false
 detect:
  enabled: false
-EOF
-
-if grep -q -o -m1 -E 'avx[^ ]*|sse4_2' /proc/cpuinfo && [[ -f /openvino-model/ssdlite_mobilenet_v2.xml ]] && [[ -f /openvino-model/coco_91cl_bkgr.txt ]]; then
-  cat <<EOF >/config/config.yml
 ffmpeg:
  hwaccel_args: auto
-detectors:
-  detector01:
-    type: openvino
-    device: AUTO
-model:
-  width: 300
-  height: 300
-  input_tensor: nhwc
-  input_pixel_format: bgr
-  path: /openvino-model/ssdlite_mobilenet_v2.xml
-  labelmap_path: /openvino-model/coco_91cl_bkgr.txt
+${DETECTOR_CONFIG}
 EOF
-else
-  cat <<EOF >/config/config.yml
-ffmpeg:
-  hwaccel_args: auto
-model:
-  path: /models/cpu_model.tflite
-EOF
-fi
 msg_ok "Configured Frigate"

 msg_info "Creating Services"
@@ -0,0 +1,96 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: CrazyWolf13
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/gotenberg/gotenberg
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  chromium \
+  libreoffice-writer \
+  libreoffice-calc \
+  libreoffice-impress \
+  libreoffice-draw \
+  libreoffice-math \
+  python3-uno \
+  python-is-python3 \
+  pdftk-java \
+  qpdf \
+  libimage-exiftool-perl \
+  fonts-crosextra-carlito \
+  fonts-crosextra-caladea \
+  fonts-liberation \
+  fonts-liberation2 \
+  fonts-dejavu \
+  fonts-noto-cjk \
+  fonts-noto-color-emoji \
+  fonts-noto-core
+msg_ok "Installed Dependencies"
+
+fetch_and_deploy_gh_release "pdfcpu" "pdfcpu/pdfcpu" "prebuild" "latest" "/opt/pdfcpu" "pdfcpu_*_Linux_$(arch_resolve "x86_64" "arm64").tar.xz"
+ln -sf "$(find /opt/pdfcpu -type f -name pdfcpu | head -n1)" /usr/local/bin/pdfcpu
+
+msg_info "Installing unoconverter"
+UNOCONVERTER_VERSION=$(get_latest_github_release "gotenberg/unoconverter" "false")
+download_file "https://raw.githubusercontent.com/gotenberg/unoconverter/${UNOCONVERTER_VERSION}/unoconv" /usr/local/bin/unoconverter
+chmod +x /usr/local/bin/unoconverter
+msg_ok "Installed unoconverter"
+
+fetch_and_deploy_gh_release "gotenberg" "gotenberg/gotenberg" "tarball" "latest" "/opt/gotenberg"
+
+GO_VERSION="$(awk '$1=="go"{print $2}' /opt/gotenberg/go.mod | cut -d. -f1,2)" setup_go
+
+msg_info "Building Gotenberg (Patience)"
+cd /opt/gotenberg
+export CGO_ENABLED=0
+$STD go mod download
+$STD go build -o /usr/local/bin/gotenberg \
+  -ldflags "-s -w -X 'github.com/gotenberg/gotenberg/v8/cmd.Version=$(cat ~/.gotenberg)'" \
+  cmd/gotenberg/main.go
+msg_ok "Built Gotenberg"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/gotenberg.service
+[Unit]
+Description=Gotenberg
+Documentation=https://gotenberg.dev
+After=network.target
+
+[Service]
+Type=simple
+User=root
+Environment=LANG=C.UTF-8
+Environment=LC_ALL=C.UTF-8
+Environment=PDFTK_BIN_PATH=/usr/bin/pdftk
+Environment=QPDF_BIN_PATH=/usr/bin/qpdf
+Environment=EXIFTOOL_BIN_PATH=/usr/bin/exiftool
+Environment=PDFCPU_BIN_PATH=/usr/local/bin/pdfcpu
+Environment=CHROMIUM_BIN_PATH=/usr/bin/chromium
+Environment=CHROMIUM_HYPHEN_DATA_DIR_PATH=/opt/gotenberg/build/chromium-hyphen-data
+Environment=LIBREOFFICE_BIN_PATH=/usr/lib/libreoffice/program/soffice.bin
+Environment=UNOCONVERTER_BIN_PATH=/usr/local/bin/unoconverter
+Environment=OTEL_TRACES_EXPORTER=none
+Environment=OTEL_METRICS_EXPORTER=none
+Environment=OTEL_LOGS_EXPORTER=none
+ExecStart=/usr/local/bin/gotenberg --api-port=3000
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now gotenberg
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc
@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Darkrock-Studios/hammer-editor
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  unzip \
+  fontconfig \
+  libfreetype6
+msg_ok "Installed Dependencies"
+
+JAVA_VERSION="21" setup_java
+
+fetch_and_deploy_gh_release "hammer" "Darkrock-Studios/hammer-editor" "prebuild" "latest" "/opt/hammer" "server.zip"
+
+msg_info "Configuring Hammer Sync Server"
+chmod +x /opt/hammer/bin/server
+mkdir -p /opt/hammer_data
+cat <<EOF >/opt/hammer_data/config.toml
+# Hammer Sync Server configuration
+# Reference: https://github.com/Darkrock-Studios/hammer-editor/blob/develop/docs/HOW-TO-RUN-A-SERVER.md
+# Loaded automatically from the data directory. Apply changes with:
+#   systemctl restart hammer
+
+host = "${LOCAL_IP}"
+port = 8080
+
+# Hammer clients speak https only and will not connect to plain HTTP. Either put
+# a TLS reverse proxy in front of this port, or let Hammer terminate TLS itself
+# with a real certificate (self-signed certs are rejected by the clients).
+#
+# Behind a reverse proxy on this host, restrict the plain port to loopback and
+# set the URL the clients actually use:
+# bindHosts = ["127.0.0.1", "::1"]
+# publicUrl = "https://hammer.example.com"
+#
+# Hammer terminating TLS itself:
+# sslPort = 443
+# [sslCert]
+# certChainPath = "/etc/letsencrypt/live/hammer.example.com/fullchain.pem"
+# privateKeyPath = "/etc/letsencrypt/live/hammer.example.com/privkey.pem"
+# forceHttps = true
+
+# Per-page social share images. fontconfig and libfreetype6 are already installed.
+# richLinkPreviews = true
+
+# communityEnabled = true
+
+# Storage defaults to an in-process PostgreSQL under /opt/hammer_data/pgdata.
+# To use an external PostgreSQL instead:
+# [storage]
+# type = "remote"
+# [storage.remote]
+# host = "db.example.com"
+# port = 5432
+# database = "hammer"
+# user = "hammer"
+# password = "change-me"
+# useSsl = true
+
+# Regenerable render/preview caches, default <data dir>/cache.
+# [cache]
+# directory = "/var/tmp/hammer-cache"
+# maxSizeMb = 200
+EOF
+cat <<EOF >/etc/systemd/system/hammer.service
+[Unit]
+Description=Hammer Sync Server
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/hammer
+Environment=SERVER_OPTS=-Duser.home=/opt
+ExecStart=/opt/hammer/bin/server
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now hammer
+msg_ok "Configured Hammer Sync Server"
+
+motd_ssh
+customize
+cleanup_lxc
@@ -20,7 +20,7 @@ $STD apt install -y \
  caddy
 msg_ok "Installed Dependencies"

-UV_PYTHON="3.13" setup_uv
+PYTHON_VERSION="3.13" setup_uv
 NODE_VERSION="20" setup_nodejs
 fetch_and_deploy_gh_release "homelable" "Pouzor/homelable" "tarball" "latest" "/opt/homelable"

@@ -353,7 +353,7 @@ ML_DIR="${APP_DIR}/machine-learning"
 GEO_DIR="${INSTALL_DIR}/geodata"
 mkdir -p {"${APP_DIR}","${UPLOAD_DIR}","${GEO_DIR}","${INSTALL_DIR}"/cache}

-fetch_and_deploy_gh_release "Immich" "immich-app/immich" "tarball" "v3.2.0" "$SRC_DIR"
+fetch_and_deploy_gh_release "Immich" "immich-app/immich" "tarball" "v3.2.2" "$SRC_DIR"
 PNPM_VERSION="$(jq -r '.packageManager | split("@")[1] | split("+")[0]' ${SRC_DIR}/package.json)"
 export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
 NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs
@@ -60,6 +60,11 @@ chown -R immichframe:immichframe /opt/immichframe
 msg_ok "Setup ImmichFrame"

 msg_info "Creating Service"
+ADMIN_PASSWORD=$(openssl rand -hex 16)
+cat <<EOF >~/immichframe.creds
+ImmichFrame Admin User: admin
+ImmichFrame Admin Password: $ADMIN_PASSWORD
+EOF
 cat <<EOF >/etc/systemd/system/immichframe.service
 [Unit]
 Description=ImmichFrame Digital Photo Frame
@@ -74,6 +79,7 @@ ExecStart=/usr/bin/dotnet /opt/immichframe/ImmichFrame.WebApi.dll
 Environment=ASPNETCORE_URLS=http://0.0.0.0:8080
 Environment=ASPNETCORE_ENVIRONMENT=Production
 Environment=DOTNET_CONTENTROOT=/opt/immichframe
+Environment=IMMICHFRAME_ADMIN_PASSWORD=$ADMIN_PASSWORD
 Restart=always
 RestartSec=5
 StandardOutput=journal
@@ -28,7 +28,7 @@ if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
  exit 10
 fi

-NODE_VERSION="26" NPM_VERSION="11" setup_nodejs
+NODE_VERSION="24" NPM_VERSION="11" setup_nodejs

 msg_info "Installing ioBroker (Patience)"
 $STD bash <(curl -fsSL https://iobroker.net/install.sh)
@@ -13,6 +13,29 @@ setting_up_container
 network_check
 update_os

+# Optional public setup. Leave the hostname empty for a LAN-only install
+# (container IP, self-signed certificate) - the previous default behaviour.
+if [[ -z "${var_jitsi_domain:-}" ]]; then
+  read -rp "${TAB3}Public hostname (FQDN, leave empty to use the container IP): " var_jitsi_domain || true
+fi
+var_jitsi_domain="${var_jitsi_domain:-$LOCAL_IP}"
+
+if [[ "$var_jitsi_domain" != "$LOCAL_IP" ]]; then
+  if [[ -z "${var_jitsi_le_email:-}" ]]; then
+    read -rp "${TAB3}E-mail for Let's Encrypt (leave empty for a self-signed certificate): " var_jitsi_le_email || true
+  fi
+  if [[ -z "${var_jitsi_public_ip:-}" ]]; then
+    read -rp "${TAB3}Public IP behind NAT (leave empty to detect via STUN): " var_jitsi_public_ip || true
+  fi
+  if [[ -z "${var_jitsi_admin_user:-}" ]]; then
+    read -rp "${TAB3}Admin user for secure domain (leave empty to let anyone create rooms): " var_jitsi_admin_user || true
+  fi
+  if [[ -n "${var_jitsi_admin_user:-}" && -z "${var_jitsi_admin_pass:-}" ]]; then
+    read -rsp "${TAB3}Admin password (leave empty to generate): " var_jitsi_admin_pass || true
+    echo
+  fi
+fi
+
 msg_info "Installing Dependencies"
 $STD apt install -y nginx
 msg_ok "Installed Dependencies"
@@ -25,11 +48,72 @@ setup_deb822_repo "jitsi" \
  ""

 msg_info "Installing Jitsi Meet"
-echo "jitsi-videobridge2 jitsi-videobridge/jvb-hostname string ${LOCAL_IP}" | debconf-set-selections
-echo "jitsi-meet-web-config jitsi-meet/cert-choice select Generate a new self-signed certificate" | debconf-set-selections
+echo "jitsi-videobridge2 jitsi-videobridge/jvb-hostname string ${var_jitsi_domain}" | debconf-set-selections
+if [[ -n "${var_jitsi_le_email:-}" ]]; then
+  # acme.sh (used by the packaged Let's Encrypt helper) refuses to install without cron
+  $STD apt install -y cron
+  echo "jitsi-meet-web-config jitsi-meet/cert-choice select Let's Encrypt certificates" | debconf-set-selections
+  echo "jitsi-meet-web-config jitsi-meet/email string ${var_jitsi_le_email}" | debconf-set-selections
+else
+  echo "jitsi-meet-web-config jitsi-meet/cert-choice select Generate a new self-signed certificate" | debconf-set-selections
+fi
+echo "jitsi-meet-web-config jitsi-meet/jaas-choice boolean false" | debconf-set-selections
 DEBIAN_FRONTEND=noninteractive $STD apt install -y jitsi-meet
 msg_ok "Installed Jitsi Meet"

+if [[ -n "${var_jitsi_public_ip:-}" ]]; then
+  msg_info "Configuring NAT mapping"
+  # JVB 2.3+ reads this from jvb.conf; sip-communicator.properties is no longer used
+  cat <<EOF >>/etc/jitsi/videobridge/jvb.conf
+ice4j {
+  harvest {
+    mapping {
+      static-mappings = [
+        { local-address = "${LOCAL_IP}", public-address = "${var_jitsi_public_ip}" }
+      ]
+    }
+  }
+}
+EOF
+  systemctl restart jitsi-videobridge2
+  msg_ok "Configured NAT mapping"
+fi
+
+if [[ -n "${var_jitsi_admin_user:-}" ]]; then
+  msg_info "Configuring Secure Domain"
+  # Only authenticated users may create rooms; guests join via the anonymous domain.
+  # https://jitsi.github.io/handbook/docs/devops-guide/secure-domain/
+  var_jitsi_admin_pass="${var_jitsi_admin_pass:-$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-16)}"
+  sed -i "0,/authentication = \"jitsi-anonymous\"/s//authentication = \"internal_hashed\"/" \
+    "/etc/prosody/conf.avail/${var_jitsi_domain}.cfg.lua"
+  cat <<EOF >>"/etc/prosody/conf.avail/${var_jitsi_domain}.cfg.lua"
+
+VirtualHost "guest.${var_jitsi_domain}"
+    authentication = "anonymous"
+    c2s_require_encryption = false
+EOF
+  cat <<EOF >>/etc/jitsi/jicofo/jicofo.conf
+jicofo {
+  authentication {
+    enabled = true
+    type = XMPP
+    login-url = "${var_jitsi_domain}"
+  }
+}
+EOF
+  sed -i "s|^\s*// anonymousdomain: 'guest.example.com',|    anonymousdomain: 'guest.${var_jitsi_domain}',|" \
+    "/etc/jitsi/meet/${var_jitsi_domain}-config.js"
+  $STD prosodyctl register "${var_jitsi_admin_user}" "${var_jitsi_domain}" "${var_jitsi_admin_pass}"
+  cat <<EOF >~/jitsi-meet.creds
+Jitsi Meet Secure Domain
+Admin User: ${var_jitsi_admin_user}
+Admin Password: ${var_jitsi_admin_pass}
+Add more users: prosodyctl register <name> ${var_jitsi_domain} <password>
+EOF
+  systemctl restart prosody jicofo jitsi-videobridge2
+  msg_ok "Configured Secure Domain"
+fi
+
 motd_ssh
 customize
 cleanup_lxc
@@ -30,9 +30,9 @@ msg_ok "Installed Dependencies"
 setup_ffmpeg
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="journiv" PG_DB_USER="journiv" setup_postgresql_db
-UV_PYTHON="3.12" setup_uv

 fetch_and_deploy_gh_release "journiv" "journiv/journiv-app" "tarball"
+PYTHON_VERSION="3.12" UV_PROJECT_DIR="/opt/journiv" setup_uv

 msg_info "Setting up Python Environment"
 cd /opt/journiv
@@ -38,10 +38,10 @@ $STD apt install -y \
  libicu-dev
 msg_ok "Installed Dependencies"

-PYTHON_VERSION="3.14" setup_uv
 fetch_and_deploy_gh_release "kitchenowl" "TomBursch/kitchenowl" "tarball" "latest" "/opt/kitchenowl"
 rm -rf /opt/kitchenowl/web
 fetch_and_deploy_gh_release "kitchenowl-web" "TomBursch/kitchenowl" "prebuild" "latest" "/opt/kitchenowl/web" "kitchenowl_Web.tar.gz"
+PYTHON_VERSION="3.14" UV_PROJECT_DIR="/opt/kitchenowl/backend" setup_uv

 msg_info "Setting up KitchenOwl"
 cd /opt/kitchenowl/backend
@@ -18,7 +18,7 @@ setup_meilisearch
 PG_VERSION="17" PG_MODULES="pgvector" setup_postgresql
 PG_DB_NAME="ragapi" PG_DB_USER="ragapi" PG_DB_EXTENSIONS="vector" setup_postgresql_db
 NODE_VERSION="24" setup_nodejs
-UV_PYTHON="3.12" setup_uv
+PYTHON_VERSION="3.12" setup_uv

 fetch_and_deploy_gh_tag "librechat" "danny-avila/LibreChat"
 fetch_and_deploy_gh_release "rag-api" "danny-avila/rag_api" "tarball"
@@ -129,7 +129,7 @@ $STD su - librenms -s /bin/bash -c "cd /opt/librenms && lnms db:seed --force"
 $STD su - librenms -s /bin/bash -c "cd /opt/librenms && lnms user:add -p ${APP_PASSWORD} ${APP_USER} --role=admin"

 RANDOM_STRING=$(openssl rand -base64 16 | tr -dc 'a-zA-Z0-9')
-sed -i "s/RANDOMSTRINGHERE/$RANDOM_STRING/g" /etc/snmp/snmpd.conf
+sed -i "s/RANDOMSTRINGGOESHERE/$RANDOM_STRING/g" /etc/snmp/snmpd.conf
 echo "SNMP Community String: $RANDOM_STRING" >>~/librenms.creds
 curl -qso /usr/bin/distro https://raw.githubusercontent.com/librenms/librenms-agent/master/snmp/distro
 chmod +x /usr/bin/distro
@@ -26,8 +26,8 @@ $STD apt install -y \
 msg_ok "Installed Dependencies"

 NODE_VERSION="22" setup_nodejs
-setup_uv
 fetch_and_deploy_gh_release "linkding" "sissbruecker/linkding" "tarball"
+UV_PROJECT_DIR="/opt/linkding" setup_uv

 msg_info "Building Frontend"
 cd /opt/linkding
@@ -23,7 +23,7 @@ $STD apt install -y \
  iproute2
 msg_ok "Installed Dependencies"

-UV_PYTHON="3.12" setup_uv
+PYTHON_VERSION="3.12" setup_uv

 msg_info "Setting up Matter Server"
 mkdir -p /opt/matter-server/data/credentials
--- a/Show More
+++ b/Show More