navidrome: restore data folder ownership on install and update

Upstream's deb postinstall runs chown navidrome:navidrome on /var/lib/navidrome/cache without -R, and only behind an .installed flag, so it never runs again on an upgrade. Every navidrome command the packaging invokes as root creates cache content owned by root, which the service then cannot write as the navidrome user - artwork that was already cached keeps working while newly resolved album and playlist covers fail. Reassert ownership of the data folder after deploying the release. The music folder is left alone, it is commonly a bind mount.
Update CHANGELOG.md (#17259 )
2026-09-15 01:04:56 +00:00 · 2026-09-14 16:03:47 +02:00 · 2026-09-14 13:51:26 +00:00 · 2026-09-14 15:50:54 +02:00 · 2026-09-14 10:53:55 +00:00 · 2026-09-14 12:53:28 +02:00
33 changed files with 1207 additions and 531 deletions
--- a/.github/changelogs/2026/09.md
+++ b/.github/changelogs/2026/09.md
@@ -1,3 +1,169 @@
+## 2026-09-12
+
+### 🆕 New Scripts
+
+  - Elasticsearch ([#17188](https://github.com/community-scripts/ProxmoxVE/pull/17188))
+- Hammer ([#17189](https://github.com/community-scripts/ProxmoxVE/pull/17189))
+- gotenberg ([#17205](https://github.com/community-scripts/ProxmoxVE/pull/17205))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(dispatcharr): add comskip installation and build dependencies [@eXistC](https://github.com/eXistC) ([#16224](https://github.com/community-scripts/ProxmoxVE/pull/16224))
+    - poznote: serve from src/public docroot [@MickLesk](https://github.com/MickLesk) ([#17187](https://github.com/community-scripts/ProxmoxVE/pull/17187))
+    - calibre-web: use calibreweb release identifier to avoid version file collision [@MickLesk](https://github.com/MickLesk) ([#17186](https://github.com/community-scripts/ProxmoxVE/pull/17186))
+
+  - #### ✨ New Features
+
+    - Docker VM: Feature Bump - Refactor script for improved functionality [@MickLesk](https://github.com/MickLesk) ([#17216](https://github.com/community-scripts/ProxmoxVE/pull/17216))
+    - feat(jitsi-meet): optional public setup (FQDN, Let's Encrypt, NAT, secure domain) [@klanghans](https://github.com/klanghans) ([#17132](https://github.com/community-scripts/ProxmoxVE/pull/17132))
+
+  - #### 🔧 Refactor
+
+    - Paperless-NGX: add --no-sync to uv run services [@MickLesk](https://github.com/MickLesk) ([#17210](https://github.com/community-scripts/ProxmoxVE/pull/17210))
+
+### 💾 Core
+
+  - VM's: show the selected CPU model instead of doubling it [@MickLesk](https://github.com/MickLesk) ([core#37](https://github.com/community-scripts/core/pull/37))
+- Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#36](https://github.com/community-scripts/core/pull/36))
+
+## 2026-09-11
+
+### 🆕 New Scripts
+
+  - Lemonade-Server ([#17190](https://github.com/community-scripts/ProxmoxVE/pull/17190))
+- OneTimeSecret ([#17097](https://github.com/community-scripts/ProxmoxVE/pull/17097))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - update authentik to 2026.8.2 [@thieneret](https://github.com/thieneret) ([#17198](https://github.com/community-scripts/ProxmoxVE/pull/17198))
+    - passwordpusher: restore data before running migrations [@MickLesk](https://github.com/MickLesk) ([#17141](https://github.com/community-scripts/ProxmoxVE/pull/17141))
+    - paperclip: install the rust toolchain needed by the runner build [@MickLesk](https://github.com/MickLesk) ([#17142](https://github.com/community-scripts/ProxmoxVE/pull/17142))
+    - homepage: run next directly instead of through pnpm [@MickLesk](https://github.com/MickLesk) ([#17155](https://github.com/community-scripts/ProxmoxVE/pull/17155))
+    - changedetection: fix: pin browserless [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17163](https://github.com/community-scripts/ProxmoxVE/pull/17163))
+
+### 💾 Core
+
+  - #### 🐞 Bug Fixes
+
+    - core.func: fall back to a usable HOME when the shell has none [@MickLesk](https://github.com/MickLesk) ([#17154](https://github.com/community-scripts/ProxmoxVE/pull/17154))
+
+### 🧰 Tools
+
+  - Dockhand ([#17191](https://github.com/community-scripts/ProxmoxVE/pull/17191))
+
+  - #### 🐞 Bug Fixes
+
+    - update-apps: rewrite the retired Gitea base in every container before updating it [@MickLesk](https://github.com/MickLesk) ([#17156](https://github.com/community-scripts/ProxmoxVE/pull/17156))
+
+  - #### 🔧 Refactor
+
+    - Rename lxc-delete.sh to guest-delete.sh [@MickLesk](https://github.com/MickLesk) ([#17152](https://github.com/community-scripts/ProxmoxVE/pull/17152))
+
+### 📚 Documentation
+
+  - issue template: add PVE release, execution context and phase; refresh distro list / pve versions [@MickLesk](https://github.com/MickLesk) ([#17160](https://github.com/community-scripts/ProxmoxVE/pull/17160))
+
+## 2026-09-10
+
+### 🆕 New Scripts
+
+  - Chevereto ([#17131](https://github.com/community-scripts/ProxmoxVE/pull/17131))
+- Portabase ([#17111](https://github.com/community-scripts/ProxmoxVE/pull/17111))
+- Logseq ([#17112](https://github.com/community-scripts/ProxmoxVE/pull/17112))
+- Safebucket ([#17096](https://github.com/community-scripts/ProxmoxVE/pull/17096))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Immich v3.2.0 [@vhsdream](https://github.com/vhsdream) ([#17137](https://github.com/community-scripts/ProxmoxVE/pull/17137))
+    - fix(solidtime): prevent composer install from hanging on root prompt [@supersoju](https://github.com/supersoju) ([#17146](https://github.com/community-scripts/ProxmoxVE/pull/17146))
+    - fix(hermesagent): wait for root gateway cleanup [@steveonjava](https://github.com/steveonjava) ([#17147](https://github.com/community-scripts/ProxmoxVE/pull/17147))
+
+### 💾 Core
+
+  - Keep the script name when regenerating the entrypoint [@MickLesk](https://github.com/MickLesk) ([core#35](https://github.com/community-scripts/core/pull/35))
+- Rewrite the dead Gitea base onto GitHub instead of failing the update [@MickLesk](https://github.com/MickLesk) ([core#33](https://github.com/community-scripts/core/pull/33))
+- core.func: fall back to a usable HOME when the shell has none [@MickLesk](https://github.com/MickLesk) ([core#32](https://github.com/community-scripts/core/pull/32))
+
+## 2026-09-09
+
+### 🆕 New Scripts
+
+  - Lingarr ([#17130](https://github.com/community-scripts/ProxmoxVE/pull/17130))
+
+### 🚀 Updated Scripts
+
+  - vm: drop the discussions link from the summary [@MickLesk](https://github.com/MickLesk) ([#17117](https://github.com/community-scripts/ProxmoxVE/pull/17117))
+
+  - #### 🐞 Bug Fixes
+
+    - fix(hermesagent): stop spurious root gateway after update [@steveonjava](https://github.com/steveonjava) ([#17126](https://github.com/community-scripts/ProxmoxVE/pull/17126))
+
+## 2026-09-08
+
+### 🆕 New Scripts
+
+  - Decypharr ([#17108](https://github.com/community-scripts/ProxmoxVE/pull/17108))
+- Stash ([#17106](https://github.com/community-scripts/ProxmoxVE/pull/17106))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Update Jellyfin FFmpeg dependency to version 8 [@MickLesk](https://github.com/MickLesk) ([#17109](https://github.com/community-scripts/ProxmoxVE/pull/17109))
+
+### 💾 Core
+
+  - Treat a cut-short forge response as a failure, not as HTTP 200 [@MickLesk](https://github.com/MickLesk) ([core#31](https://github.com/community-scripts/core/pull/31))
+- Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#28](https://github.com/community-scripts/core/pull/28))
+- cloud-init: drop the "configure in Proxmox UI" hint [@MickLesk](https://github.com/MickLesk) ([core#30](https://github.com/community-scripts/core/pull/30))
+- Survive an empty /usr/bin/update instead of aborting the run [@MickLesk](https://github.com/MickLesk) ([core#29](https://github.com/community-scripts/core/pull/29))
+
+## 2026-09-07
+
+### 🆕 New Scripts
+
+  - Chatwoot ([#17095](https://github.com/community-scripts/ProxmoxVE/pull/17095))
+- whisparr-eros ([#17094](https://github.com/community-scripts/ProxmoxVE/pull/17094))
+- Matter-Hub ([#17093](https://github.com/community-scripts/ProxmoxVE/pull/17093))
+- Journiv ([#17092](https://github.com/community-scripts/ProxmoxVE/pull/17092))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - kaneo: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17086](https://github.com/community-scripts/ProxmoxVE/pull/17086))
+    - iobroker: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17085](https://github.com/community-scripts/ProxmoxVE/pull/17085))
+    - reactive-resume: repair any wrong WorkingDirectory on update [@MickLesk](https://github.com/MickLesk) ([#17068](https://github.com/community-scripts/ProxmoxVE/pull/17068))
+    - mediamtx: keep mediamtx.yml across updates [@MickLesk](https://github.com/MickLesk) ([#17069](https://github.com/community-scripts/ProxmoxVE/pull/17069))
+    - omnitools: allow remote action while npm ci [@MickLesk](https://github.com/MickLesk) ([#17070](https://github.com/community-scripts/ProxmoxVE/pull/17070))
+
+  - #### ✨ New Features
+
+    - netboot-xyz: add Secure Boot and Legacy assets [@MickLesk](https://github.com/MickLesk) ([#17066](https://github.com/community-scripts/ProxmoxVE/pull/17066))
+
+  - #### 🔧 Refactor
+
+    - flatnotes: follow upstream move to uv and Python 3.13 [@MickLesk](https://github.com/MickLesk) ([#17090](https://github.com/community-scripts/ProxmoxVE/pull/17090))
+    - heimdall: set up PHP 8.4 on update, keep only the database, run migrations [@MickLesk](https://github.com/MickLesk) ([#17067](https://github.com/community-scripts/ProxmoxVE/pull/17067))
+
+### 📂 Github
+
+  - github: Open per-script Node bump PRs [@MickLesk](https://github.com/MickLesk) ([#17065](https://github.com/community-scripts/ProxmoxVE/pull/17065))
+
+## 2026-09-06
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Fix Sonarqube update script to add +x on sonar.sh [@jarihu](https://github.com/jarihu) ([#17056](https://github.com/community-scripts/ProxmoxVE/pull/17056))
+
 ## 2026-09-05

 ### 🚀 Updated Scripts
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -101,6 +101,9 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit



+
+
+



@@ -114,7 +117,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit


 <details>
-<summary><h4>September (5 entries)</h4></summary>
+<summary><h4>September (12 entries)</h4></summary>

 [View September 2026 Changelog](.github/changelogs/2026/09.md)

@@ -540,6 +543,62 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 </details>

+## 2026-09-14
+
+### 🆕 New Scripts
+
+  - Borg-UI ([#17258](https://github.com/community-scripts/ProxmoxVE/pull/17258))
+
+### 🚀 Updated Scripts
+
+  - SparkyFitness: substitute NGINX_RATE_LIMIT in nginx config [@RafBorrelli](https://github.com/RafBorrelli) ([#17256](https://github.com/community-scripts/ProxmoxVE/pull/17256))
+
+  - #### 🐞 Bug Fixes
+
+    - spliit: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17250](https://github.com/community-scripts/ProxmoxVE/pull/17250))
+
+## 2026-09-13
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Downgrade iobroker to Node 24 [@Copilot](https://github.com/Copilot) ([#17229](https://github.com/community-scripts/ProxmoxVE/pull/17229))
+
+### 💾 Core
+
+  - Pick the highest release version, not the newest published one [@MickLesk](https://github.com/MickLesk) ([core#38](https://github.com/community-scripts/core/pull/38))
+
+## 2026-09-12
+
+### 🆕 New Scripts
+
+  - Elasticsearch ([#17188](https://github.com/community-scripts/ProxmoxVE/pull/17188))
+- Hammer ([#17189](https://github.com/community-scripts/ProxmoxVE/pull/17189))
+- gotenberg ([#17205](https://github.com/community-scripts/ProxmoxVE/pull/17205))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(dispatcharr): add comskip installation and build dependencies [@eXistC](https://github.com/eXistC) ([#16224](https://github.com/community-scripts/ProxmoxVE/pull/16224))
+    - poznote: serve from src/public docroot [@MickLesk](https://github.com/MickLesk) ([#17187](https://github.com/community-scripts/ProxmoxVE/pull/17187))
+    - calibre-web: use calibreweb release identifier to avoid version file collision [@MickLesk](https://github.com/MickLesk) ([#17186](https://github.com/community-scripts/ProxmoxVE/pull/17186))
+
+  - #### ✨ New Features
+
+    - Docker VM: Feature Bump - Refactor script for improved functionality [@MickLesk](https://github.com/MickLesk) ([#17216](https://github.com/community-scripts/ProxmoxVE/pull/17216))
+    - feat(jitsi-meet): optional public setup (FQDN, Let's Encrypt, NAT, secure domain) [@klanghans](https://github.com/klanghans) ([#17132](https://github.com/community-scripts/ProxmoxVE/pull/17132))
+
+  - #### 🔧 Refactor
+
+    - Paperless-NGX: add --no-sync to uv run services [@MickLesk](https://github.com/MickLesk) ([#17210](https://github.com/community-scripts/ProxmoxVE/pull/17210))
+
+### 💾 Core
+
+  - VM's: show the selected CPU model instead of doubling it [@MickLesk](https://github.com/MickLesk) ([core#37](https://github.com/community-scripts/core/pull/37))
+- Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#36](https://github.com/community-scripts/core/pull/36))
+
 ## 2026-09-11

 ### 🆕 New Scripts
@@ -1156,143 +1215,4 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
  - #### 🔧 Refactor

    - Refactor: PowerDNS move poweradmin database outside the web root [@MickLesk](https://github.com/MickLesk) ([#16476](https://github.com/community-scripts/ProxmoxVE/pull/16476))
-    - paperless-ngx: run services with uv --no-sync to avoid startup network dependency [@MickLesk](https://github.com/MickLesk) ([#16479](https://github.com/community-scripts/ProxmoxVE/pull/16479))
-
-## 2026-08-13
-
-### 🆕 New Scripts
-
-  - SuggestArr ([#16449](https://github.com/community-scripts/ProxmoxVE/pull/16449))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - fix(stirling-pdf): LibreOffice listener collides with unoserver on UNO port 2002, burning a core [@angusmaul](https://github.com/angusmaul) ([#16460](https://github.com/community-scripts/ProxmoxVE/pull/16460))
-    - fix(reitti): enable SNI for tile cache [@kylemd](https://github.com/kylemd) ([#16463](https://github.com/community-scripts/ProxmoxVE/pull/16463))
-    - [wanderer] refactor [@johanngrobe](https://github.com/johanngrobe) ([#16448](https://github.com/community-scripts/ProxmoxVE/pull/16448))
-
-  - #### ✨ New Features
-
-    - feat: Update koillection-install.sh to support API usage [@Crazy-Duck](https://github.com/Crazy-Duck) ([#16425](https://github.com/community-scripts/ProxmoxVE/pull/16425))
-
-## 2026-08-12
-
-### 🆕 New Scripts
-
-  - Stalwart ([#16388](https://github.com/community-scripts/ProxmoxVE/pull/16388))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - networkoptimizer: mitigate dotnet publish hang in LXC [@MickLesk](https://github.com/MickLesk) ([#16436](https://github.com/community-scripts/ProxmoxVE/pull/16436))
-    - lazylibrarian: reinstall deps after git pull on update [@MickLesk](https://github.com/MickLesk) ([#16435](https://github.com/community-scripts/ProxmoxVE/pull/16435))
-    - wanderer: fix deprecated meilisearch upgrade flag [@MickLesk](https://github.com/MickLesk) ([#16434](https://github.com/community-scripts/ProxmoxVE/pull/16434))
-    - calibre-web: fix release asset filename pattern [@MickLesk](https://github.com/MickLesk) ([#16433](https://github.com/community-scripts/ProxmoxVE/pull/16433))
-    - fix(stirling-pdf): unoserver installed into the venv, and login mode truncates .env [@angusmaul](https://github.com/angusmaul) ([#16439](https://github.com/community-scripts/ProxmoxVE/pull/16439))
-    - fix(pulse): keep the container recoverable when an update fails [@rcourtman](https://github.com/rcourtman) ([#16311](https://github.com/community-scripts/ProxmoxVE/pull/16311))
-
-  - #### 🔧 Refactor
-
-    - ConvertX: add some new dependencies [@MickLesk](https://github.com/MickLesk) ([#16437](https://github.com/community-scripts/ProxmoxVE/pull/16437))
-
-## 2026-08-11
-
-### 🚀 Updated Scripts
-
-  - Update source URL for Reactive Resume [@MickLesk](https://github.com/MickLesk) ([#16407](https://github.com/community-scripts/ProxmoxVE/pull/16407))
-
-  - #### 🐞 Bug Fixes
-
-    - Pelican-Panel: add php artisan p:environment:database [@MickLesk](https://github.com/MickLesk) ([#16397](https://github.com/community-scripts/ProxmoxVE/pull/16397))
-    - outline: fix URL sed matching wrong line in .env.sample // refactor .env generation [@MickLesk](https://github.com/MickLesk) ([#16408](https://github.com/community-scripts/ProxmoxVE/pull/16408))
-    - paperless-ngx: reindex Tantivy search index on webserver start [@MickLesk](https://github.com/MickLesk) ([#16395](https://github.com/community-scripts/ProxmoxVE/pull/16395))
-    - karakeep: pin Node.js to 22 LTS, avoid Node 24.19 better-sqlite3 crash [@MickLesk](https://github.com/MickLesk) ([#16396](https://github.com/community-scripts/ProxmoxVE/pull/16396))
-
-  - #### ✨ New Features
-
-    - Open WebUI: add optional OpenTelemetry package install [@irishpadres](https://github.com/irishpadres) ([#16415](https://github.com/community-scripts/ProxmoxVE/pull/16415))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - fix(add-tailscale-lxc): stop spinner before whiptail menu [@halcycon](https://github.com/halcycon) ([#16402](https://github.com/community-scripts/ProxmoxVE/pull/16402))
-
-  - #### 🔧 Refactor
-
-    - arcane: fix projects/builds dir ownership for non-root container UID [@MickLesk](https://github.com/MickLesk) ([#16411](https://github.com/community-scripts/ProxmoxVE/pull/16411))
-
-## 2026-08-10
-
-### 🆕 New Scripts
-
-  - GitLab ([#16386](https://github.com/community-scripts/ProxmoxVE/pull/16386))
- TeslaMate ([#16385](https://github.com/community-scripts/ProxmoxVE/pull/16385))
- tor-snowflake ([#15684](https://github.com/community-scripts/ProxmoxVE/pull/15684))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - ErsatzTV: update ffmpeg to 8.1 version [@MickLesk](https://github.com/MickLesk) ([#16383](https://github.com/community-scripts/ProxmoxVE/pull/16383))
-
-### 🧰 Tools
-
-  - post-pdm-install ([#16368](https://github.com/community-scripts/ProxmoxVE/pull/16368))
-
-## 2026-08-09
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Fix: CouchDB Erlang cookie breaks vm.args (use hex) [@fudianchn](https://github.com/fudianchn) ([#16361](https://github.com/community-scripts/ProxmoxVE/pull/16361))
-    - SparkyFitness: Install Git for frontend builds [@MickLesk](https://github.com/MickLesk) ([#16352](https://github.com/community-scripts/ProxmoxVE/pull/16352))
-    - Byparr: Use invisible-playwright browser setup [@MickLesk](https://github.com/MickLesk) ([#16353](https://github.com/community-scripts/ProxmoxVE/pull/16353))
-    - Crafty Controller: Restore ownership after updates [@MickLesk](https://github.com/MickLesk) ([#16354](https://github.com/community-scripts/ProxmoxVE/pull/16354))
-    - Webtrees: Fix schema check in silent mode [@MickLesk](https://github.com/MickLesk) ([#16355](https://github.com/community-scripts/ProxmoxVE/pull/16355))
-    - SigNoz: Allow legacy metadata schema on ClickHouse 26 [@MickLesk](https://github.com/MickLesk) ([#16356](https://github.com/community-scripts/ProxmoxVE/pull/16356))
-
-### 🧰 Tools
-
-  - #### ✨ New Features
-
-    - Portainer: Update existing CE and BE installations [@MickLesk](https://github.com/MickLesk) ([#16357](https://github.com/community-scripts/ProxmoxVE/pull/16357))
-
-### 📚 Documentation
-
-  - github: update Star History links and image sources [@MickLesk](https://github.com/MickLesk) ([#16367](https://github.com/community-scripts/ProxmoxVE/pull/16367))
-
-## 2026-08-08
-
-### 🆕 New Scripts
-
-  - Ignis ([#16330](https://github.com/community-scripts/ProxmoxVE/pull/16330))
-
-### 💾 Core
-
-  - #### ✨ New Features
-
-    - core - setup_nodejs: bypass npm allowScripts policy globally on npm >=11 [@MickLesk](https://github.com/MickLesk) ([#16280](https://github.com/community-scripts/ProxmoxVE/pull/16280))
-
-## 2026-08-07
-
-### 🆕 New Scripts
-
-  - NetworkOptimizer ([#16328](https://github.com/community-scripts/ProxmoxVE/pull/16328))
- Orb ([#16329](https://github.com/community-scripts/ProxmoxVE/pull/16329))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - HortusFox: start applying db migrations [@tomfrenzel](https://github.com/tomfrenzel) ([#16324](https://github.com/community-scripts/ProxmoxVE/pull/16324))
-    - Docker: report container updates instead of prompting, stop auto-updating Portainer Agent, fix addon detection of legacy Portainer [@MickLesk](https://github.com/MickLesk) ([#16298](https://github.com/community-scripts/ProxmoxVE/pull/16298))
-    - Immich: retry mise install on transient npm download failures [@MickLesk](https://github.com/MickLesk) ([#16301](https://github.com/community-scripts/ProxmoxVE/pull/16301))
-    - changedetection: remove msttcorefonts to fix install hang [@austinpilz](https://github.com/austinpilz) ([#16319](https://github.com/community-scripts/ProxmoxVE/pull/16319))
-
-  - #### 🔧 Refactor
-
-    - core: extend new vars and pocketbase values [@MickLesk](https://github.com/MickLesk) ([#16313](https://github.com/community-scripts/ProxmoxVE/pull/16313))
+    - paperless-ngx: run services with uv --no-sync to avoid startup network dependency [@MickLesk](https://github.com/MickLesk) ([#16479](https://github.com/community-scripts/ProxmoxVE/pull/16479))
--- a/ct/borg-ui.sh
+++ b/ct/borg-ui.sh
@@ -0,0 +1,121 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/karanhudia/borg-ui
+
+APP="Borg-UI"
+var_tags="${var_tags:-backup}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/borg-ui ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "borg-ui" "karanhudia/borg-ui"; then
+    msg_info "Stopping Service"
+    systemctl stop borg-ui
+    msg_ok "Stopped Service"
+
+    create_backup /opt/borg-ui/.env
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "borg-ui" "karanhudia/borg-ui" "tarball"
+
+    restore_backup
+
+    BORG_UI_VERSION=$(cat "$HOME/.borg-ui" 2>/dev/null)
+    if [[ -n "$BORG_UI_VERSION" ]]; then
+      if grep -q '^APP_VERSION=' /opt/borg-ui/.env; then
+        sed -i "s|^APP_VERSION=.*|APP_VERSION=${BORG_UI_VERSION}|" /opt/borg-ui/.env
+      else
+        echo "APP_VERSION=${BORG_UI_VERSION}" >>/opt/borg-ui/.env
+      fi
+    fi
+
+    # Only the three Borg pins appear in every release of this file; PYTHON_VERSION
+    # and RCLONE_VERSION were added upstream after v2.2.6, so both fall back.
+    RUNTIME_ENV="/opt/borg-ui/docker/runtime-base.env"
+    BORG1_VERSION=$(sed -n 's/^BORG1_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
+    BORG2_VERSION=$(sed -n 's/^BORG2_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
+    BORGSTORE_VERSION=$(sed -n 's/^BORGSTORE_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
+    RCLONE_VERSION=$(sed -n 's/^RCLONE_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
+    BORG_PYTHON=$(sed -n 's/^PYTHON_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
+    BORG_PYTHON="${BORG_PYTHON:-3.12}"
+    if [[ -z "$BORG1_VERSION" || -z "$BORG2_VERSION" || -z "$BORGSTORE_VERSION" ]]; then
+      msg_error "Could not read the pinned Borg versions from ${RUNTIME_ENV}"
+      exit 1
+    fi
+
+    if [[ "$(cat /opt/borg1-venv/.pinned_version 2>/dev/null)" != "$BORG1_VERSION" ]]; then
+      msg_info "Installing Borg ${BORG1_VERSION} (Patience)"
+      $STD uv venv --python "$BORG_PYTHON" /opt/borg1-venv
+      $STD uv pip install --python /opt/borg1-venv pyfuse3 "borgbackup==${BORG1_VERSION}"
+      echo "$BORG1_VERSION" >/opt/borg1-venv/.pinned_version
+      ln -sf /opt/borg1-venv/bin/borg /usr/local/bin/borg
+      msg_ok "Installed Borg ${BORG1_VERSION}"
+    fi
+
+    if [[ "$(cat /opt/borg2-venv/.pinned_version 2>/dev/null)" != "${BORG2_VERSION}-${BORGSTORE_VERSION}" ]]; then
+      msg_info "Installing Borg ${BORG2_VERSION} (Patience)"
+      $STD uv venv --python "$BORG_PYTHON" /opt/borg2-venv
+      $STD uv pip install --python /opt/borg2-venv pyfuse3 "borgbackup==${BORG2_VERSION}" "borgstore[rclone,sftp,rest,s3,blake3]==${BORGSTORE_VERSION}"
+      echo "${BORG2_VERSION}-${BORGSTORE_VERSION}" >/opt/borg2-venv/.pinned_version
+      ln -sf /opt/borg2-venv/bin/borg /usr/local/bin/borg2
+      msg_ok "Installed Borg ${BORG2_VERSION}"
+    fi
+
+    RCLONE_TAG="${RCLONE_VERSION:+v${RCLONE_VERSION}}"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "rclone" "rclone/rclone" "prebuild" "${RCLONE_TAG:-latest}" "/opt/rclone" "rclone-${RCLONE_TAG:-*}-linux-$(arch_resolve amd64 arm64).zip"
+    ln -sf /opt/rclone/rclone /usr/local/bin/rclone
+
+    msg_info "Building Frontend"
+    cd /opt/borg-ui/frontend
+    $STD npm ci
+    $STD npm run build
+    rm -rf /opt/borg-ui/app/static
+    mkdir -p /opt/borg-ui/app/static
+    cp -r /opt/borg-ui/frontend/build/* /opt/borg-ui/app/static/
+    msg_ok "Built Frontend"
+
+    msg_info "Updating Python Environment"
+    cd /opt/borg-ui
+    $STD uv venv --python "$BORG_PYTHON" /opt/borg-ui/.venv
+    $STD uv pip install --python /opt/borg-ui/.venv -r requirements.txt
+    msg_ok "Updated Python Environment"
+
+    msg_info "Starting Service"
+    systemctl start borg-ui
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8081${CL}"
--- a/ct/calibre-web.sh
+++ b/ct/calibre-web.sh
@@ -32,14 +32,18 @@ function update_script() {
    exit
  fi

-  if check_for_gh_release "Calibre-Web" "janeczku/calibre-web"; then
+  if [[ -f /root/.calibre-web && ! -e /root/.calibreweb ]]; then
+    mv /root/.calibre-web /root/.calibreweb
+  fi
+
+  if check_for_gh_release "calibreweb" "janeczku/calibre-web"; then
    msg_info "Stopping Service"
    systemctl stop calibre-web
    msg_ok "Stopped Service"

    create_backup /opt/calibre-web/data

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Calibre-Web" "janeczku/calibre-web" "prebuild" "latest" "/opt/calibre-web" "calibreweb*.tar.gz"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "calibreweb" "janeczku/calibre-web" "prebuild" "latest" "/opt/calibre-web" "calibreweb*.tar.gz"
    setup_uv

    msg_info "Installing Dependencies"
--- a/ct/dispatcharr.sh
+++ b/ct/dispatcharr.sh
@@ -106,7 +106,18 @@ EOF
    msg_ok "Migrated Nginx Configuration"
  fi

-  ensure_dependencies vlc-bin vlc-plugin-base
+  ensure_dependencies vlc-bin vlc-plugin-base build-essential autoconf libtool libargtable2-dev libavformat-dev libsdl2-dev libswscale-dev
+
+  if ! command -v comskip &> /dev/null; then
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Comskip" "erikkaashoek/Comskip" "tarball"
+    msg_info "Compiling Comskip"
+    cd /opt/Comskip
+    $STD ./autogen.sh
+    $STD ./configure
+    $STD make
+    $STD make install
+    msg_ok "Compiled and Installed Comskip"
+  fi

  if check_for_gh_release "Dispatcharr" "Dispatcharr/Dispatcharr"; then
    msg_info "Stopping Services"
--- a/ct/elasticsearch.sh
+++ b/ct/elasticsearch.sh
@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.elastic.co/elasticsearch
+
+APP="Elasticsearch"
+var_tags="${var_tags:-database;search}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-20}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /etc/elasticsearch/elasticsearch.yml ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  msg_info "Updating ${APP}"
+  $STD apt update
+  $STD apt install -y elasticsearch
+  msg_ok "Updated ${APP}"
+
+  msg_info "Restarting Service"
+  systemctl restart elasticsearch
+  msg_ok "Restarted Service"
+  msg_ok "Updated successfully!"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:9200${CL}"
+echo -e "${INFO}${YW}Set the password for the 'elastic' user:${CL}"
+echo -e "${TAB}${DEFAULT}${BGN}/usr/share/elasticsearch/bin/elasticsearch-reset-password -u elastic${CL}"
--- a/ct/gotenberg.sh
+++ b/ct/gotenberg.sh
@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: CrazyWolf13
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/gotenberg/gotenberg
+
+APP="Gotenberg"
+var_tags="${var_tags:-document;pdf}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-15}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /etc/systemd/system/gotenberg.service ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "gotenberg" "gotenberg/gotenberg"; then
+    msg_info "Stopping Service"
+    systemctl stop gotenberg
+    msg_ok "Stopped Service"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "gotenberg" "gotenberg/gotenberg" "tarball" "latest" "/opt/gotenberg"
+
+    GO_VERSION="$(awk '$1=="go"{print $2}' /opt/gotenberg/go.mod | cut -d. -f1,2)" setup_go
+
+    msg_info "Building gotenberg (Patience)"
+    cd /opt/gotenberg
+    export CGO_ENABLED=0
+    $STD go mod download
+    $STD go build -o /usr/local/bin/gotenberg \
+      -ldflags "-s -w -X 'github.com/gotenberg/gotenberg/v8/cmd.Version=$(cat ~/.gotenberg)'" \
+      cmd/gotenberg/main.go
+    msg_ok "Built gotenberg"
+
+    msg_info "Updating unoconverter"
+    UNOCONVERTER_VERSION=$(get_latest_github_release "gotenberg/unoconverter" "false")
+    download_file "https://raw.githubusercontent.com/gotenberg/unoconverter/${UNOCONVERTER_VERSION}/unoconv" /usr/local/bin/unoconverter
+    chmod +x /usr/local/bin/unoconverter
+    msg_ok "Updated unoconverter"
+
+    msg_info "Starting Service"
+    systemctl start gotenberg
+    msg_ok "Started Service"
+    msg_ok "Updated Successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Gotenberg is a stateless API and has no web interface.${CL}"
+echo -e "${INFO}${YW}Check the health endpoint using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3000/health${CL}"
--- a/ct/hammer.sh
+++ b/ct/hammer.sh
@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Darkrock-Studios/hammer-editor
+
+APP="Hammer"
+var_tags="${var_tags:-writing;sync-server}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_unprivileged="${var_unprivileged:-1}"
+var_arm64="${var_arm64:-yes}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/hammer ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "hammer" "Darkrock-Studios/hammer-editor"; then
+    msg_info "Stopping Service"
+    systemctl stop hammer
+    msg_ok "Stopped Service"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "hammer" "Darkrock-Studios/hammer-editor" "prebuild" "latest" "/opt/hammer" "server.zip"
+    chmod +x /opt/hammer/bin/server
+
+    msg_info "Starting Service"
+    systemctl start hammer
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8080${CL}"
--- a/ct/headers/borg-ui
+++ b/ct/headers/borg-ui
@@ -0,0 +1,6 @@
+    ____                         __  ______
+   / __ )____  _________ _      / / / /  _/
+  / __  / __ \/ ___/ __ `/_____/ / / // /  
+ / /_/ / /_/ / /  / /_/ /_____/ /_/ // /   
+/_____/\____/_/   \__, /      \____/___/   
+                 /____/                    
--- a/ct/headers/elasticsearch
+++ b/ct/headers/elasticsearch
@@ -0,0 +1,6 @@
+    ________           __  _                                __  
+   / ____/ /___ ______/ /_(_)____________  ____ ___________/ /_ 
+  / __/ / / __ `/ ___/ __/ / ___/ ___/ _ \/ __ `/ ___/ ___/ __ \
+ / /___/ / /_/ (__  ) /_/ / /__(__  )  __/ /_/ / /  / /__/ / / /
+/_____/_/\__,_/____/\__/_/\___/____/\___/\__,_/_/   \___/_/ /_/ 
+                                                                
--- a/ct/headers/gotenberg
+++ b/ct/headers/gotenberg
@@ -0,0 +1,6 @@
+   ______      __             __                   
+  / ____/___  / /____  ____  / /_  ___  _________ _
+ / / __/ __ \/ __/ _ \/ __ \/ __ \/ _ \/ ___/ __ `/
+/ /_/ / /_/ / /_/  __/ / / / /_/ /  __/ /  / /_/ / 
+\____/\____/\__/\___/_/ /_/_.___/\___/_/   \__, /  
+                                          /____/   
--- a/ct/headers/hammer
+++ b/ct/headers/hammer
@@ -0,0 +1,6 @@
+    __  __                                   
+   / / / /___ _____ ___  ____ ___  ___  _____
+  / /_/ / __ `/ __ `__ \/ __ `__ \/ _ \/ ___/
+ / __  / /_/ / / / / / / / / / / /  __/ /    
+/_/ /_/\__,_/_/ /_/ /_/_/ /_/ /_/\___/_/     
+                                             
--- a/ct/iobroker.sh
+++ b/ct/iobroker.sh
@@ -31,7 +31,7 @@ function update_script() {
    exit
  fi

-  NODE_VERSION="26" NPM_VERSION="11" setup_nodejs
+  NODE_VERSION="24" NPM_VERSION="11" setup_nodejs

  msg_info "Updating ${APP} LXC"
  $STD apt update
--- a/ct/jitsi-meet.sh
+++ b/ct/jitsi-meet.sh
@@ -17,6 +17,14 @@ var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

+# Optional public setup, read by the install script (all empty = LAN-only install as before).
+# Without the export they never reach the container.
+export var_jitsi_domain="${var_jitsi_domain:-}"
+export var_jitsi_le_email="${var_jitsi_le_email:-}"
+export var_jitsi_public_ip="${var_jitsi_public_ip:-}"
+export var_jitsi_admin_user="${var_jitsi_admin_user:-}"
+export var_jitsi_admin_pass="${var_jitsi_admin_pass:-}"
+
 header_info "$APP"
 variables
 color
@@ -50,4 +58,7 @@ description
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}https://${IP}${CL}"
+echo -e "${GATEWAY}${BGN}https://${var_jitsi_domain:-$IP}${CL}"
+if [[ -n "${var_jitsi_domain}" ]]; then
+  echo -e "${INFO}${YW}Forward TCP 80/443 and UDP 10000 to the container. Secure-domain credentials (if enabled) are in ~/jitsi-meet.creds inside the container.${CL}"
+fi
--- a/ct/navidrome.sh
+++ b/ct/navidrome.sh
@@ -38,6 +38,15 @@ function update_script() {

    fetch_and_deploy_gh_release "navidrome" "navidrome/navidrome" "binary"

+    # The upstream postinstall only chowns the cache directory itself, and only
+    # on the very first install, so root-owned subdirectories survive upgrades
+    # and the service can no longer write its artwork there.
+    if id -u navidrome >/dev/null 2>&1; then
+      msg_info "Fixing Data Folder Ownership"
+      chown -R navidrome:navidrome /var/lib/navidrome
+      msg_ok "Fixed Data Folder Ownership"
+    fi
+
    msg_info "Starting Services"
    systemctl start navidrome
    msg_ok "Started Services"
--- a/ct/paperless-ngx.sh
+++ b/ct/paperless-ngx.sh
@@ -169,9 +169,13 @@ function update_script() {
      if ((BRIDGE_UPDATE == 0)); then
        sed -i 's|^ExecStart=.*|ExecStart=uv run --no-sync -- granian --interface asginl --ws --loop uvloop "paperless.asgi:application"|' /etc/systemd/system/paperless-webserver.service
        grep -q "document_index reindex" /etc/systemd/system/paperless-webserver.service ||
-          sed -i '/^ExecStart=/i ExecStartPre=uv run -- python manage.py document_index reindex --if-needed --no-progress-bar' /etc/systemd/system/paperless-webserver.service
-        $STD systemctl daemon-reload
+          sed -i '/^ExecStart=/i ExecStartPre=uv run --no-sync -- python manage.py document_index reindex --if-needed --no-progress-bar' /etc/systemd/system/paperless-webserver.service
      fi
+      for svc in consumer scheduler task-queue webserver; do
+        unit="/etc/systemd/system/paperless-${svc}.service"
+        [[ -f "$unit" ]] && sed -i 's|uv run -- |uv run --no-sync -- |g' "$unit"
+      done
+      $STD systemctl daemon-reload
      cd /opt/paperless
      $STD uv sync --all-extras
      cd /opt/paperless/src
--- a/ct/poznote.sh
+++ b/ct/poznote.sh
@@ -68,7 +68,7 @@ map \$uri \$poznote_coop {

 server {
    listen 8040;
-    root /var/www/html;
+    root /var/www/html/public;
    index index.php index.html;

    gzip on;
@@ -144,10 +144,12 @@ server {
    }

    location ~ ^/data/users/[0-9]+/backgrounds/ {
+        root /var/www/html;
        try_files \$uri =404;
    }

    location ~ ^/data/css/[A-Za-z0-9._-]+\.css$ {
+        root /var/www/html;
        try_files \$uri =404;
    }

--- a/ct/sparkyfitness.sh
+++ b/ct/sparkyfitness.sh
@@ -67,6 +67,7 @@ function update_script() {
      -e 's|${SPARKY_FITNESS_SERVER_PORT}|3010|g' \
      -e "s|\${SPARKY_FITNESS_FRONTEND_URL}|${FRONTEND_URL}|g" \
      -e 's|${NGINX_LISTEN_PORT}|80|g' \
+      -e 's|${NGINX_RATE_LIMIT}|5r/s|g' \
      -e 's|${NGINX_ACCESS_LOG}|/var/log/nginx/sparkyfitness.access.log|g' \
      -e 's|${NGINX_ERROR_LOG}|/var/log/nginx/sparkyfitness.error.log|g' \
      -e 's|root /usr/share/nginx/html;|root /var/www/sparkyfitness;|g' \
--- a/ct/spliit.sh
+++ b/ct/spliit.sh
@@ -42,7 +42,7 @@ function update_script() {
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "spliit" "spliit-app/spliit" "tarball"

    restore_backup
-    NODE_VERSION="24" setup_nodejs
+    NODE_VERSION="26" setup_nodejs

    msg_info "Building Application"
    cd /opt/spliit
--- a/install/borg-ui-install.sh
+++ b/install/borg-ui-install.sh
@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/karanhudia/borg-ui
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  build-essential \
+  python3-dev \
+  pkg-config \
+  libffi-dev \
+  libssl-dev \
+  libacl1-dev \
+  liblz4-dev \
+  libzstd-dev \
+  libxxhash-dev \
+  libfuse3-dev \
+  fuse3 \
+  rsync \
+  sshfs \
+  openssh-client
+msg_ok "Installed Dependencies"
+
+UV_PYTHON="3.12" setup_uv
+NODE_VERSION="22" setup_nodejs
+
+fetch_and_deploy_gh_release "borg-ui" "karanhudia/borg-ui" "tarball"
+
+# Only the three Borg pins appear in every release of this file; PYTHON_VERSION
+# and RCLONE_VERSION were added upstream after v2.2.6, so both fall back.
+RUNTIME_ENV="/opt/borg-ui/docker/runtime-base.env"
+BORG1_VERSION=$(sed -n 's/^BORG1_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
+BORG2_VERSION=$(sed -n 's/^BORG2_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
+BORGSTORE_VERSION=$(sed -n 's/^BORGSTORE_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
+RCLONE_VERSION=$(sed -n 's/^RCLONE_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
+BORG_PYTHON=$(sed -n 's/^PYTHON_VERSION=//p' "$RUNTIME_ENV" 2>/dev/null | tr -d ' \r')
+BORG_PYTHON="${BORG_PYTHON:-3.12}"
+if [[ -z "$BORG1_VERSION" || -z "$BORG2_VERSION" || -z "$BORGSTORE_VERSION" ]]; then
+  msg_error "Could not read the pinned Borg versions from ${RUNTIME_ENV}"
+  exit 1
+fi
+
+msg_info "Installing Borg ${BORG1_VERSION} and Borg ${BORG2_VERSION} (Patience)"
+$STD uv venv --python "$BORG_PYTHON" /opt/borg1-venv
+$STD uv pip install --python /opt/borg1-venv pyfuse3 "borgbackup==${BORG1_VERSION}"
+echo "$BORG1_VERSION" >/opt/borg1-venv/.pinned_version
+$STD uv venv --python "$BORG_PYTHON" /opt/borg2-venv
+$STD uv pip install --python /opt/borg2-venv pyfuse3 "borgbackup==${BORG2_VERSION}" "borgstore[rclone,sftp,rest,s3,blake3]==${BORGSTORE_VERSION}"
+echo "${BORG2_VERSION}-${BORGSTORE_VERSION}" >/opt/borg2-venv/.pinned_version
+ln -sf /opt/borg1-venv/bin/borg /usr/local/bin/borg
+ln -sf /opt/borg2-venv/bin/borg /usr/local/bin/borg2
+msg_ok "Installed Borg ${BORG1_VERSION} and Borg ${BORG2_VERSION}"
+
+RCLONE_TAG="${RCLONE_VERSION:+v${RCLONE_VERSION}}"
+fetch_and_deploy_gh_release "rclone" "rclone/rclone" "prebuild" "${RCLONE_TAG:-latest}" "/opt/rclone" "rclone-${RCLONE_TAG:-*}-linux-$(arch_resolve amd64 arm64).zip"
+ln -sf /opt/rclone/rclone /usr/local/bin/rclone
+
+msg_info "Building Frontend"
+cd /opt/borg-ui/frontend
+$STD npm ci
+$STD npm run build
+mkdir -p /opt/borg-ui/app/static
+cp -r /opt/borg-ui/frontend/build/* /opt/borg-ui/app/static/
+msg_ok "Built Frontend"
+
+msg_info "Setting up Python Environment"
+cd /opt/borg-ui
+$STD uv venv --python "$BORG_PYTHON" /opt/borg-ui/.venv
+$STD uv pip install --python /opt/borg-ui/.venv -r requirements.txt
+msg_ok "Set up Python Environment"
+
+msg_info "Configuring Borg-UI"
+mkdir -p /opt/borg-ui_data
+BORG_UI_VERSION=$(cat "$HOME/.borg-ui" 2>/dev/null)
+if [[ -z "$BORG_UI_VERSION" ]]; then
+  msg_error "Could not determine the deployed Borg-UI version"
+  exit 1
+fi
+cat <<EOF >/opt/borg-ui/.env
+APP_VERSION=${BORG_UI_VERSION}
+PORT=8081
+ENVIRONMENT=production
+TZ=UTC
+DATA_DIR=/opt/borg-ui_data
+ENABLE_CRON_BACKUPS=true
+ENABLE_STARTUP_LICENSE_SYNC=false
+EOF
+chmod 600 /opt/borg-ui/.env
+msg_ok "Configured Borg-UI"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/borg-ui.service
+[Unit]
+Description=Borg-UI
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/borg-ui
+EnvironmentFile=/opt/borg-ui/.env
+ExecStart=/opt/borg-ui/.venv/bin/gunicorn app.main:app --bind 0.0.0.0:8081 --workers 2 --worker-class uvicorn.workers.UvicornWorker --timeout 300
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now borg-ui
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc
--- a/install/calibre-web-install.sh
+++ b/install/calibre-web-install.sh
@@ -32,7 +32,7 @@ msg_info "Installing Calibre (for eBook conversion)"
 $STD apt install -y calibre
 msg_ok "Installed Calibre"

-fetch_and_deploy_gh_release "Calibre-Web" "janeczku/calibre-web" "prebuild" "latest" "/opt/calibre-web" "calibreweb*.tar.gz"
+fetch_and_deploy_gh_release "calibreweb" "janeczku/calibre-web" "prebuild" "latest" "/opt/calibre-web" "calibreweb*.tar.gz"
 setup_uv

 msg_info "Installing Python Dependencies"
--- a/install/dispatcharr-install.sh
+++ b/install/dispatcharr-install.sh
@@ -25,7 +25,13 @@ $STD apt install -y \
  procps \
  vlc-bin \
  vlc-plugin-base \
-  streamlink
+  streamlink \
+  autoconf \
+  libtool \
+  libargtable2-dev \
+  libavformat-dev \
+  libsdl2-dev \
+  libswscale-dev
 msg_ok "Installed Dependencies"

 setup_uv
@@ -33,6 +39,15 @@ NODE_VERSION="24" setup_nodejs
 PG_VERSION="16" setup_postgresql
 PG_DB_NAME="dispatcharr_db" PG_DB_USER="dispatcharr_usr" setup_postgresql_db
 fetch_and_deploy_gh_release "dispatcharr" "Dispatcharr/Dispatcharr" "tarball"
+fetch_and_deploy_gh_release "Comskip" "erikkaashoek/Comskip" "tarball"
+
+msg_info "Compiling Comskip"
+cd /opt/Comskip
+$STD ./autogen.sh
+$STD ./configure
+$STD make
+$STD make install
+msg_ok "Compiled and Installed Comskip"

 msg_info "Installing Python Dependencies with uv"
 cd /opt/dispatcharr
--- a/install/elasticsearch-install.sh
+++ b/install/elasticsearch-install.sh
@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.elastic.co/elasticsearch
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+# vm.max_map_count is not namespaced, so a container cannot raise it - the value
+# is inherited from the Proxmox host. Elasticsearch refuses to start below the
+# required limit once it binds to a non-loopback address (production mode).
+msg_info "Checking Kernel Limits"
+if (($(sysctl -n vm.max_map_count) < 262144)); then
+  msg_error "vm.max_map_count is $(sysctl -n vm.max_map_count), Elasticsearch needs at least 262144"
+  msg_error "Set it on the PROXMOX HOST, not in this container:"
+  msg_error "  echo 'vm.max_map_count=1048576' >/etc/sysctl.d/99-elasticsearch.conf && sysctl --system"
+  exit 1
+fi
+msg_ok "Checked Kernel Limits"
+
+JAVA_VERSION="21" setup_java
+
+setup_deb822_repo \
+  "elasticsearch" \
+  "https://artifacts.elastic.co/GPG-KEY-elasticsearch" \
+  "https://artifacts.elastic.co/packages/9.x/apt" \
+  "stable" \
+  "main"
+
+msg_info "Installing Elasticsearch"
+$STD apt install -y elasticsearch
+msg_ok "Installed Elasticsearch"
+
+msg_info "Configuring Elasticsearch"
+mkdir -p /opt/elasticsearch_data
+chown -R elasticsearch:elasticsearch /opt/elasticsearch_data
+cat <<EOF >/etc/elasticsearch/elasticsearch.yml
+cluster.name: proxmox
+node.name: ${HOSTNAME}
+path.data: /opt/elasticsearch_data
+path.logs: /var/log/elasticsearch
+
+network.host: 0.0.0.0
+http.port: 9200
+discovery.type: single-node
+
+xpack.security.enabled: true
+xpack.security.enrollment.enabled: true
+xpack.security.http.ssl.enabled: false
+xpack.security.transport.ssl.enabled: false
+EOF
+
+cat <<EOF >/etc/elasticsearch/jvm.options.d/heap.options
+-Xms1g
+-Xmx1g
+EOF
+systemctl enable -q --now elasticsearch
+msg_ok "Configured Elasticsearch"
+
+
+motd_ssh
+customize
+cleanup_lxc
--- a/install/gotenberg-install.sh
+++ b/install/gotenberg-install.sh
@@ -0,0 +1,96 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: CrazyWolf13
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/gotenberg/gotenberg
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  chromium \
+  libreoffice-writer \
+  libreoffice-calc \
+  libreoffice-impress \
+  libreoffice-draw \
+  libreoffice-math \
+  python3-uno \
+  python-is-python3 \
+  pdftk-java \
+  qpdf \
+  libimage-exiftool-perl \
+  fonts-crosextra-carlito \
+  fonts-crosextra-caladea \
+  fonts-liberation \
+  fonts-liberation2 \
+  fonts-dejavu \
+  fonts-noto-cjk \
+  fonts-noto-color-emoji \
+  fonts-noto-core
+msg_ok "Installed Dependencies"
+
+fetch_and_deploy_gh_release "pdfcpu" "pdfcpu/pdfcpu" "prebuild" "latest" "/opt/pdfcpu" "pdfcpu_*_Linux_$(arch_resolve "x86_64" "arm64").tar.xz"
+ln -sf "$(find /opt/pdfcpu -type f -name pdfcpu | head -n1)" /usr/local/bin/pdfcpu
+
+msg_info "Installing unoconverter"
+UNOCONVERTER_VERSION=$(get_latest_github_release "gotenberg/unoconverter" "false")
+download_file "https://raw.githubusercontent.com/gotenberg/unoconverter/${UNOCONVERTER_VERSION}/unoconv" /usr/local/bin/unoconverter
+chmod +x /usr/local/bin/unoconverter
+msg_ok "Installed unoconverter"
+
+fetch_and_deploy_gh_release "gotenberg" "gotenberg/gotenberg" "tarball" "latest" "/opt/gotenberg"
+
+GO_VERSION="$(awk '$1=="go"{print $2}' /opt/gotenberg/go.mod | cut -d. -f1,2)" setup_go
+
+msg_info "Building Gotenberg (Patience)"
+cd /opt/gotenberg
+export CGO_ENABLED=0
+$STD go mod download
+$STD go build -o /usr/local/bin/gotenberg \
+  -ldflags "-s -w -X 'github.com/gotenberg/gotenberg/v8/cmd.Version=$(cat ~/.gotenberg)'" \
+  cmd/gotenberg/main.go
+msg_ok "Built Gotenberg"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/gotenberg.service
+[Unit]
+Description=Gotenberg
+Documentation=https://gotenberg.dev
+After=network.target
+
+[Service]
+Type=simple
+User=root
+Environment=LANG=C.UTF-8
+Environment=LC_ALL=C.UTF-8
+Environment=PDFTK_BIN_PATH=/usr/bin/pdftk
+Environment=QPDF_BIN_PATH=/usr/bin/qpdf
+Environment=EXIFTOOL_BIN_PATH=/usr/bin/exiftool
+Environment=PDFCPU_BIN_PATH=/usr/local/bin/pdfcpu
+Environment=CHROMIUM_BIN_PATH=/usr/bin/chromium
+Environment=CHROMIUM_HYPHEN_DATA_DIR_PATH=/opt/gotenberg/build/chromium-hyphen-data
+Environment=LIBREOFFICE_BIN_PATH=/usr/lib/libreoffice/program/soffice.bin
+Environment=UNOCONVERTER_BIN_PATH=/usr/local/bin/unoconverter
+Environment=OTEL_TRACES_EXPORTER=none
+Environment=OTEL_METRICS_EXPORTER=none
+Environment=OTEL_LOGS_EXPORTER=none
+ExecStart=/usr/local/bin/gotenberg --api-port=3000
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now gotenberg
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc
--- a/install/hammer-install.sh
+++ b/install/hammer-install.sh
@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Darkrock-Studios/hammer-editor
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  unzip \
+  fontconfig \
+  libfreetype6
+msg_ok "Installed Dependencies"
+
+JAVA_VERSION="21" setup_java
+
+fetch_and_deploy_gh_release "hammer" "Darkrock-Studios/hammer-editor" "prebuild" "latest" "/opt/hammer" "server.zip"
+
+msg_info "Configuring Hammer Sync Server"
+chmod +x /opt/hammer/bin/server
+mkdir -p /opt/hammer_data
+cat <<EOF >/opt/hammer_data/config.toml
+# Hammer Sync Server configuration
+# Reference: https://github.com/Darkrock-Studios/hammer-editor/blob/develop/docs/HOW-TO-RUN-A-SERVER.md
+# Loaded automatically from the data directory. Apply changes with:
+#   systemctl restart hammer
+
+host = "${LOCAL_IP}"
+port = 8080
+
+# Hammer clients speak https only and will not connect to plain HTTP. Either put
+# a TLS reverse proxy in front of this port, or let Hammer terminate TLS itself
+# with a real certificate (self-signed certs are rejected by the clients).
+#
+# Behind a reverse proxy on this host, restrict the plain port to loopback and
+# set the URL the clients actually use:
+# bindHosts = ["127.0.0.1", "::1"]
+# publicUrl = "https://hammer.example.com"
+#
+# Hammer terminating TLS itself:
+# sslPort = 443
+# [sslCert]
+# certChainPath = "/etc/letsencrypt/live/hammer.example.com/fullchain.pem"
+# privateKeyPath = "/etc/letsencrypt/live/hammer.example.com/privkey.pem"
+# forceHttps = true
+
+# Per-page social share images. fontconfig and libfreetype6 are already installed.
+# richLinkPreviews = true
+
+# communityEnabled = true
+
+# Storage defaults to an in-process PostgreSQL under /opt/hammer_data/pgdata.
+# To use an external PostgreSQL instead:
+# [storage]
+# type = "remote"
+# [storage.remote]
+# host = "db.example.com"
+# port = 5432
+# database = "hammer"
+# user = "hammer"
+# password = "change-me"
+# useSsl = true
+
+# Regenerable render/preview caches, default <data dir>/cache.
+# [cache]
+# directory = "/var/tmp/hammer-cache"
+# maxSizeMb = 200
+EOF
+cat <<EOF >/etc/systemd/system/hammer.service
+[Unit]
+Description=Hammer Sync Server
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/hammer
+Environment=SERVER_OPTS=-Duser.home=/opt
+ExecStart=/opt/hammer/bin/server
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now hammer
+msg_ok "Configured Hammer Sync Server"
+
+motd_ssh
+customize
+cleanup_lxc
--- a/install/iobroker-install.sh
+++ b/install/iobroker-install.sh
@@ -28,7 +28,7 @@ if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
  exit 10
 fi

-NODE_VERSION="26" NPM_VERSION="11" setup_nodejs
+NODE_VERSION="24" NPM_VERSION="11" setup_nodejs

 msg_info "Installing ioBroker (Patience)"
 $STD bash <(curl -fsSL https://iobroker.net/install.sh)
--- a/install/jitsi-meet-install.sh
+++ b/install/jitsi-meet-install.sh
@@ -13,6 +13,29 @@ setting_up_container
 network_check
 update_os

+# Optional public setup. Leave the hostname empty for a LAN-only install
+# (container IP, self-signed certificate) - the previous default behaviour.
+if [[ -z "${var_jitsi_domain:-}" ]]; then
+  read -rp "${TAB3}Public hostname (FQDN, leave empty to use the container IP): " var_jitsi_domain || true
+fi
+var_jitsi_domain="${var_jitsi_domain:-$LOCAL_IP}"
+
+if [[ "$var_jitsi_domain" != "$LOCAL_IP" ]]; then
+  if [[ -z "${var_jitsi_le_email:-}" ]]; then
+    read -rp "${TAB3}E-mail for Let's Encrypt (leave empty for a self-signed certificate): " var_jitsi_le_email || true
+  fi
+  if [[ -z "${var_jitsi_public_ip:-}" ]]; then
+    read -rp "${TAB3}Public IP behind NAT (leave empty to detect via STUN): " var_jitsi_public_ip || true
+  fi
+  if [[ -z "${var_jitsi_admin_user:-}" ]]; then
+    read -rp "${TAB3}Admin user for secure domain (leave empty to let anyone create rooms): " var_jitsi_admin_user || true
+  fi
+  if [[ -n "${var_jitsi_admin_user:-}" && -z "${var_jitsi_admin_pass:-}" ]]; then
+    read -rsp "${TAB3}Admin password (leave empty to generate): " var_jitsi_admin_pass || true
+    echo
+  fi
+fi
+
 msg_info "Installing Dependencies"
 $STD apt install -y nginx
 msg_ok "Installed Dependencies"
@@ -25,11 +48,72 @@ setup_deb822_repo "jitsi" \
  ""

 msg_info "Installing Jitsi Meet"
-echo "jitsi-videobridge2 jitsi-videobridge/jvb-hostname string ${LOCAL_IP}" | debconf-set-selections
-echo "jitsi-meet-web-config jitsi-meet/cert-choice select Generate a new self-signed certificate" | debconf-set-selections
+echo "jitsi-videobridge2 jitsi-videobridge/jvb-hostname string ${var_jitsi_domain}" | debconf-set-selections
+if [[ -n "${var_jitsi_le_email:-}" ]]; then
+  # acme.sh (used by the packaged Let's Encrypt helper) refuses to install without cron
+  $STD apt install -y cron
+  echo "jitsi-meet-web-config jitsi-meet/cert-choice select Let's Encrypt certificates" | debconf-set-selections
+  echo "jitsi-meet-web-config jitsi-meet/email string ${var_jitsi_le_email}" | debconf-set-selections
+else
+  echo "jitsi-meet-web-config jitsi-meet/cert-choice select Generate a new self-signed certificate" | debconf-set-selections
+fi
+echo "jitsi-meet-web-config jitsi-meet/jaas-choice boolean false" | debconf-set-selections
 DEBIAN_FRONTEND=noninteractive $STD apt install -y jitsi-meet
 msg_ok "Installed Jitsi Meet"

+if [[ -n "${var_jitsi_public_ip:-}" ]]; then
+  msg_info "Configuring NAT mapping"
+  # JVB 2.3+ reads this from jvb.conf; sip-communicator.properties is no longer used
+  cat <<EOF >>/etc/jitsi/videobridge/jvb.conf
+ice4j {
+  harvest {
+    mapping {
+      static-mappings = [
+        { local-address = "${LOCAL_IP}", public-address = "${var_jitsi_public_ip}" }
+      ]
+    }
+  }
+}
+EOF
+  systemctl restart jitsi-videobridge2
+  msg_ok "Configured NAT mapping"
+fi
+
+if [[ -n "${var_jitsi_admin_user:-}" ]]; then
+  msg_info "Configuring Secure Domain"
+  # Only authenticated users may create rooms; guests join via the anonymous domain.
+  # https://jitsi.github.io/handbook/docs/devops-guide/secure-domain/
+  var_jitsi_admin_pass="${var_jitsi_admin_pass:-$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-16)}"
+  sed -i "0,/authentication = \"jitsi-anonymous\"/s//authentication = \"internal_hashed\"/" \
+    "/etc/prosody/conf.avail/${var_jitsi_domain}.cfg.lua"
+  cat <<EOF >>"/etc/prosody/conf.avail/${var_jitsi_domain}.cfg.lua"
+
+VirtualHost "guest.${var_jitsi_domain}"
+    authentication = "anonymous"
+    c2s_require_encryption = false
+EOF
+  cat <<EOF >>/etc/jitsi/jicofo/jicofo.conf
+jicofo {
+  authentication {
+    enabled = true
+    type = XMPP
+    login-url = "${var_jitsi_domain}"
+  }
+}
+EOF
+  sed -i "s|^\s*// anonymousdomain: 'guest.example.com',|    anonymousdomain: 'guest.${var_jitsi_domain}',|" \
+    "/etc/jitsi/meet/${var_jitsi_domain}-config.js"
+  $STD prosodyctl register "${var_jitsi_admin_user}" "${var_jitsi_domain}" "${var_jitsi_admin_pass}"
+  cat <<EOF >~/jitsi-meet.creds
+Jitsi Meet Secure Domain
+Admin User: ${var_jitsi_admin_user}
+Admin Password: ${var_jitsi_admin_pass}
+Add more users: prosodyctl register <name> ${var_jitsi_domain} <password>
+EOF
+  systemctl restart prosody jicofo jitsi-videobridge2
+  msg_ok "Configured Secure Domain"
+fi
+
 motd_ssh
 customize
 cleanup_lxc
--- a/install/navidrome-install.sh
+++ b/install/navidrome-install.sh
@@ -19,6 +19,10 @@ msg_ok "Installed Dependencies"

 fetch_and_deploy_gh_release "navidrome" "navidrome/navidrome" "binary"

+if id -u navidrome >/dev/null 2>&1; then
+  chown -R navidrome:navidrome /var/lib/navidrome
+fi
+
 msg_info "Starting Navidrome"
 systemctl enable -q --now navidrome
 msg_ok "Started Navidrome"
--- a/install/paperless-ngx-install.sh
+++ b/install/paperless-ngx-install.sh
@@ -151,7 +151,7 @@ Requires=redis.service

 [Service]
 WorkingDirectory=/opt/paperless/src
-#ExecStartPre=uv run -- python manage.py document_index reindex --if-needed --no-progress-bar
+#ExecStartPre=uv run --no-sync -- python manage.py document_index reindex --if-needed --no-progress-bar
 ExecStart=uv run --no-sync -- granian --interface asginl --ws --loop uvloop "paperless.asgi:application"
 Environment=GRANIAN_HOST=::
 Environment=GRANIAN_PORT=8000
--- a/install/poznote-install.sh
+++ b/install/poznote-install.sh
@@ -46,7 +46,7 @@ map \$uri \$poznote_coop {

 server {
    listen 8040;
-    root /var/www/html;
+    root /var/www/html/public;
    index index.php index.html;

    gzip on;
@@ -122,10 +122,12 @@ server {
    }

    location ~ ^/data/users/[0-9]+/backgrounds/ {
+        root /var/www/html;
        try_files \$uri =404;
    }

    location ~ ^/data/css/[A-Za-z0-9._-]+\.css$ {
+        root /var/www/html;
        try_files \$uri =404;
    }

--- a/install/sparkyfitness-install.sh
+++ b/install/sparkyfitness-install.sh
@@ -86,6 +86,7 @@ sed \
  -e 's|${SPARKY_FITNESS_SERVER_PORT}|3010|g' \
  -e "s|\${SPARKY_FITNESS_FRONTEND_URL}|http://${LOCAL_IP}:80|g" \
  -e 's|${NGINX_LISTEN_PORT}|80|g' \
+  -e 's|${NGINX_RATE_LIMIT}|5r/s|g' \
  -e 's|${NGINX_ACCESS_LOG}|/var/log/nginx/sparkyfitness.access.log|g' \
  -e 's|${NGINX_ERROR_LOG}|/var/log/nginx/sparkyfitness.error.log|g' \
  -e 's|root /usr/share/nginx/html;|root /var/www/sparkyfitness;|g' \
--- a/install/spliit-install.sh
+++ b/install/spliit-install.sh
@@ -15,7 +15,7 @@ update_os

 PG_VERSION="16" setup_postgresql
 PG_DB_NAME="spliit" PG_DB_USER="spliit" setup_postgresql_db
-NODE_VERSION="24" setup_nodejs
+NODE_VERSION="26" setup_nodejs
 fetch_and_deploy_gh_release "spliit" "spliit-app/spliit" "tarball"

 msg_info "Configuring Application"
--- a/vm/docker-vm.sh
+++ b/vm/docker-vm.sh
@@ -2,15 +2,15 @@

 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: thost96 (thost96) | michelroegl-brunner | MickLesk
-# License: MIT | https://github.com/community-scripts/ProxmoxVED/raw/main/LICENSE
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE

 # ==============================================================================
 # Docker VM - Creates a Docker-ready Virtual Machine
 # ==============================================================================

-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/api.func)
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/vm-core.func)
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/cloud-init.func) || true
+COMMUNITY_SCRIPTS_URL="${COMMUNITY_SCRIPTS_URL:-https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main}"
+source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/pve/vm-core.func")
+load_functions

 # ==============================================================================
 # SCRIPT VARIABLES
@@ -32,8 +32,6 @@ OS_VERSION=""
 THIN="discard=on,ssd=1,"
 var_arm64="yes"

-load_functions
-
 # ==============================================================================
 # ERROR HANDLING & CLEANUP
 # ==============================================================================
@@ -44,73 +42,70 @@ trap 'post_update_to_api "failed" "130"' SIGINT
 trap 'post_update_to_api "failed" "143"' SIGTERM
 trap 'post_update_to_api "failed" "129"; exit 129' SIGHUP

-function error_handler() {
-  local exit_code="$?"
-  local line_number="$1"
-  local command="$2"
-  local error_message="${RD}[ERROR]${CL} in line ${RD}$line_number${CL}: exit code ${RD}$exit_code${CL}: while executing command ${YW}$command${CL}"
-  post_update_to_api "failed" "${exit_code}"
-  echo -e "\n$error_message\n"
-  cleanup_vmid
-}
-
 # ==============================================================================
 # OS SELECTION FUNCTIONS
 # ==============================================================================
 function select_os() {
-  if OS_CHOICE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "SELECT OS" --radiolist \
-    "Choose Operating System for Docker VM" 14 68 4 \
+  if [[ "${VM_UNATTENDED:-0}" == "1" ]]; then
+    OS_CHOICE="${VM_OS_VERSION:-debian13}"
+  elif ! OS_CHOICE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "SELECT OS" --radiolist \
+    "Choose Operating System for Docker VM" 15 68 5 \
    "debian13" "Debian 13 (Trixie) - Latest" ON \
    "debian12" "Debian 12 (Bookworm) - Stable" OFF \
+    "ubuntu2604" "Ubuntu 26.04 LTS (Resolute)" OFF \
    "ubuntu2404" "Ubuntu 24.04 LTS (Noble)" OFF \
    "ubuntu2204" "Ubuntu 22.04 LTS (Jammy)" OFF \
    3>&1 1>&2 2>&3); then
-    case $OS_CHOICE in
-    debian13)
-      OS_TYPE="debian"
-      OS_VERSION="13"
-      OS_CODENAME="trixie"
-      OS_DISPLAY="Debian 13 (Trixie)"
-      ;;
-    debian12)
-      OS_TYPE="debian"
-      OS_VERSION="12"
-      OS_CODENAME="bookworm"
-      OS_DISPLAY="Debian 12 (Bookworm)"
-      ;;
-    ubuntu2404)
-      OS_TYPE="ubuntu"
-      OS_VERSION="24.04"
-      OS_CODENAME="noble"
-      OS_DISPLAY="Ubuntu 24.04 LTS"
-      ;;
-    ubuntu2204)
-      OS_TYPE="ubuntu"
-      OS_VERSION="22.04"
-      OS_CODENAME="jammy"
-      OS_DISPLAY="Ubuntu 22.04 LTS"
-      ;;
-    esac
-    echo -e "${OS}${BOLD}${DGN}Operating System: ${BGN}${OS_DISPLAY}${CL}"
-  else
    exit_script
  fi
+
+  case $OS_CHOICE in
+  debian13)
+    OS_TYPE="debian"
+    OS_VERSION="13"
+    OS_CODENAME="trixie"
+    OS_DISPLAY="Debian 13 (Trixie)"
+    ;;
+  debian12)
+    OS_TYPE="debian"
+    OS_VERSION="12"
+    OS_CODENAME="bookworm"
+    OS_DISPLAY="Debian 12 (Bookworm)"
+    ;;
+  ubuntu2604)
+    OS_TYPE="ubuntu"
+    OS_VERSION="26.04"
+    OS_CODENAME="resolute"
+    OS_DISPLAY="Ubuntu 26.04 LTS"
+    ;;
+  ubuntu2404)
+    OS_TYPE="ubuntu"
+    OS_VERSION="24.04"
+    OS_CODENAME="noble"
+    OS_DISPLAY="Ubuntu 24.04 LTS"
+    ;;
+  ubuntu2204)
+    OS_TYPE="ubuntu"
+    OS_VERSION="22.04"
+    OS_CODENAME="jammy"
+    OS_DISPLAY="Ubuntu 22.04 LTS"
+    ;;
+  *)
+    msg_error "Unsupported OS '${OS_CHOICE}' (expected debian13, debian12, ubuntu2604, ubuntu2404 or ubuntu2204)"
+    exit 1
+    ;;
+  esac
+  echo -e "${OS}${BOLD}${DGN}Operating System: ${BGN}${OS_DISPLAY}${CL}"
 }

 function select_cloud_init() {
-  if [ "$OS_TYPE" = "ubuntu" ]; then
-    USE_CLOUD_INIT="yes"
-    echo -e "${CLOUD:-${TAB}☁️${TAB}${CL}}${BOLD}${DGN}Cloud-Init: ${BGN}yes (Ubuntu requires Cloud-Init)${CL}"
-    return
-  fi
+  vm_prompt_cloud_init "root"

-  if (whiptail --backtitle "Proxmox VE Helper Scripts" --title "CLOUD-INIT" \
-    --yesno "Enable Cloud-Init for VM configuration?\n\nCloud-Init allows automatic configuration of:\n- User accounts and passwords\n- SSH keys\n- Network settings (DHCP/Static)\n- DNS configuration\n\nYou can also configure these settings later in Proxmox UI.\n\nNote: Debian without Cloud-Init will use nocloud image with console auto-login." 18 68); then
+  # Ubuntu ships only cloud images; without cloud-init there is no way in.
+  if [ "$OS_TYPE" = "ubuntu" ] && [ "$USE_CLOUD_INIT" != "yes" ]; then
    USE_CLOUD_INIT="yes"
-    echo -e "${CLOUD:-${TAB}☁️${TAB}${CL}}${BOLD}${DGN}Cloud-Init: ${BGN}yes${CL}"
-  else
-    USE_CLOUD_INIT="no"
-    echo -e "${CLOUD:-${TAB}☁️${TAB}${CL}}${BOLD}${DGN}Cloud-Init: ${BGN}no${CL}"
+    export CLOUDINIT_ENABLE="yes"
+    msg_warn "Ubuntu requires Cloud-Init - enabling it anyway"
  fi
 }

@@ -134,16 +129,14 @@ function get_image_url() {
 # SETTINGS FUNCTIONS
 # ==============================================================================
 function default_settings() {
+  vm_apply_machine_type "q35"
  select_os
  select_cloud_init

  VMID=$(get_valid_nextid)
-  FORMAT=""
  if [ "$ARCH" = "arm64" ]; then
-    MACHINE=""
    CPU_TYPE=""
  else
-    MACHINE=" -machine q35"
    CPU_TYPE=" -cpu host"
  fi
  DISK_CACHE=""
@@ -158,252 +151,29 @@ function default_settings() {
  START_VM="yes"
  METHOD="default"

-  echo -e "${CONTAINERID}${BOLD}${DGN}Virtual Machine ID: ${BGN}${VMID}${CL}"
-  if [ "$ARCH" = "arm64" ]; then
-    echo -e "${CONTAINERTYPE}${BOLD}${DGN}Machine Type: ${BGN}virt (ARM64)${CL}"
-  else
-    echo -e "${CONTAINERTYPE}${BOLD}${DGN}Machine Type: ${BGN}Q35 (Modern)${CL}"
-  fi
-  echo -e "${DISKSIZE}${BOLD}${DGN}Disk Size: ${BGN}${DISK_SIZE}${CL}"
-  echo -e "${DISKSIZE}${BOLD}${DGN}Disk Cache: ${BGN}None${CL}"
-  echo -e "${HOSTNAME}${BOLD}${DGN}Hostname: ${BGN}${HN}${CL}"
-  echo -e "${OS}${BOLD}${DGN}CPU Model: ${BGN}$([ "$ARCH" = "arm64" ] && echo "Default" || echo "Host")${CL}"
-  echo -e "${CPUCORE}${BOLD}${DGN}CPU Cores: ${BGN}${CORE_COUNT}${CL}"
-  echo -e "${RAMSIZE}${BOLD}${DGN}RAM Size: ${BGN}${RAM_SIZE}${CL}"
-  echo -e "${BRIDGE}${BOLD}${DGN}Bridge: ${BGN}${BRG}${CL}"
-  echo -e "${MACADDRESS}${BOLD}${DGN}MAC Address: ${BGN}${MAC}${CL}"
-  echo -e "${VLANTAG}${BOLD}${DGN}VLAN: ${BGN}Default${CL}"
-  echo -e "${DEFAULT}${BOLD}${DGN}Interface MTU Size: ${BGN}Default${CL}"
-  echo -e "${GATEWAY}${BOLD}${DGN}Start VM when completed: ${BGN}yes${CL}"
-  echo -e "${CREATING}${BOLD}${DGN}Creating a Docker VM using the above settings${CL}"
+  vm_echo_default_settings
 }

 function advanced_settings() {
+  METHOD="advanced"
  select_os
  select_cloud_init
+  vm_prompt_vmid "${VMID:-$(get_valid_nextid)}"
+  vm_prompt_machine_type "q35"
+  vm_prompt_disk_size "10G"
+  vm_prompt_disk_cache "none"
+  vm_prompt_hostname "docker"
+  vm_prompt_cpu_model "host"
+  vm_prompt_cpu_cores "2"
+  vm_prompt_ram "4096"
+  vm_prompt_bridge "vmbr0"
+  vm_prompt_mac "$GEN_MAC"
+  vm_prompt_vlan
+  vm_prompt_mtu
+  vm_prompt_verbose "no"
+  vm_prompt_start_vm "yes"

-  # SSH Key selection for Cloud-Init VMs
-  if [ "$USE_CLOUD_INIT" = "yes" ]; then
-    configure_cloudinit_ssh_keys || true
-  fi
-
-  METHOD="advanced"
-  [ -z "${VMID:-}" ] && VMID=$(get_valid_nextid)
-
-  # VM ID
-  while true; do
-    if VMID=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set Virtual Machine ID" 8 58 $VMID --title "VIRTUAL MACHINE ID" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
-      if [ -z "$VMID" ]; then
-        VMID=$(get_valid_nextid)
-      fi
-      if pct status "$VMID" &>/dev/null || qm status "$VMID" &>/dev/null; then
-        echo -e "${CROSS}${RD} ID $VMID is already in use${CL}"
-        sleep 2
-        continue
-      fi
-      echo -e "${CONTAINERID}${BOLD}${DGN}Virtual Machine ID: ${BGN}$VMID${CL}"
-      break
-    else
-      exit_script
-    fi
-  done
-
-  # Machine Type
-  if [ "$ARCH" = "arm64" ]; then
-    FORMAT=""
-    MACHINE=""
-    echo -e "${CONTAINERTYPE}${BOLD}${DGN}Machine Type: ${BGN}virt${CL}"
-  elif MACH=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "MACHINE TYPE" --radiolist --cancel-button Exit-Script "Choose Type" 10 58 2 \
-    "q35" "Q35 (Modern, PCIe)" ON \
-    "i440fx" "i440fx (Legacy, PCI)" OFF \
-    3>&1 1>&2 2>&3); then
-    if [ $MACH = q35 ]; then
-      echo -e "${CONTAINERTYPE}${BOLD}${DGN}Machine Type: ${BGN}Q35 (Modern)${CL}"
-      FORMAT=""
-      MACHINE=" -machine q35"
-    else
-      echo -e "${CONTAINERTYPE}${BOLD}${DGN}Machine Type: ${BGN}i440fx (Legacy)${CL}"
-      FORMAT=",efitype=4m"
-      MACHINE=""
-    fi
-  else
-    exit_script
-  fi
-
-  # Disk Size
-  if DISK_SIZE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set Disk Size in GiB (e.g., 10, 20)" 8 58 "$DISK_SIZE" --title "DISK SIZE" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
-    DISK_SIZE=$(echo "$DISK_SIZE" | tr -d ' ')
-    if [[ "$DISK_SIZE" =~ ^[0-9]+$ ]]; then
-      DISK_SIZE="${DISK_SIZE}G"
-      echo -e "${DISKSIZE}${BOLD}${DGN}Disk Size: ${BGN}$DISK_SIZE${CL}"
-    elif [[ "$DISK_SIZE" =~ ^[0-9]+G$ ]]; then
-      echo -e "${DISKSIZE}${BOLD}${DGN}Disk Size: ${BGN}$DISK_SIZE${CL}"
-    else
-      echo -e "${DISKSIZE}${BOLD}${RD}Invalid Disk Size. Please use a number (e.g., 10 or 10G).${CL}"
-      exit_script
-    fi
-  else
-    exit_script
-  fi
-
-  # Disk Cache
-  if DISK_CACHE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "DISK CACHE" --radiolist "Choose" --cancel-button Exit-Script 10 58 2 \
-    "0" "None (Default)" ON \
-    "1" "Write Through" OFF \
-    3>&1 1>&2 2>&3); then
-    if [ $DISK_CACHE = "1" ]; then
-      echo -e "${DISKSIZE}${BOLD}${DGN}Disk Cache: ${BGN}Write Through${CL}"
-      DISK_CACHE="cache=writethrough,"
-    else
-      echo -e "${DISKSIZE}${BOLD}${DGN}Disk Cache: ${BGN}None${CL}"
-      DISK_CACHE=""
-    fi
-  else
-    exit_script
-  fi
-
-  # Hostname
-  if VM_NAME=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set Hostname" 8 58 docker --title "HOSTNAME" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
-    if [ -z $VM_NAME ]; then
-      HN="docker"
-    else
-      HN=$(echo "${VM_NAME,,}" | tr -cs 'a-z0-9-' '-' | sed 's/^-//;s/-$//')
-      if [ "$HN" != "${VM_NAME,,}" ]; then
-        whiptail --backtitle "Proxmox VE Helper Scripts" --title "HOSTNAME ADJUSTED" --msgbox "Invalid characters detected. Hostname has been adjusted to:\n\n  $HN" 10 58
-      fi
-    fi
-    echo -e "${HOSTNAME}${BOLD}${DGN}Hostname: ${BGN}$HN${CL}"
-  else
-    exit_script
-  fi
-
-  # CPU Model
-  if [ "$ARCH" = "arm64" ]; then
-    CPU_TYPE=""
-    echo -e "${OS}${BOLD}${DGN}CPU Model: ${BGN}Default${CL}"
-  elif CPU_TYPE1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "CPU MODEL" --radiolist "Choose" --cancel-button Exit-Script 10 58 2 \
-    "1" "Host (Recommended)" ON \
-    "0" "KVM64" OFF \
-    3>&1 1>&2 2>&3); then
-    if [ $CPU_TYPE1 = "1" ]; then
-      echo -e "${OS}${BOLD}${DGN}CPU Model: ${BGN}Host${CL}"
-      CPU_TYPE=" -cpu host"
-    else
-      echo -e "${OS}${BOLD}${DGN}CPU Model: ${BGN}KVM64${CL}"
-      CPU_TYPE=""
-    fi
-  else
-    exit_script
-  fi
-
-  # CPU Cores
-  while true; do
-    if CORE_COUNT=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Allocate CPU Cores" 8 58 2 --title "CORE COUNT" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
-      if [ -z "$CORE_COUNT" ]; then CORE_COUNT="2"; fi
-      if [[ "$CORE_COUNT" =~ ^[1-9][0-9]*$ ]]; then
-        echo -e "${CPUCORE}${BOLD}${DGN}CPU Cores: ${BGN}$CORE_COUNT${CL}"
-        break
-      fi
-      whiptail --backtitle "Proxmox VE Helper Scripts" --title "INVALID INPUT" --msgbox "CPU Cores must be a positive integer (e.g., 2)." 8 58
-    else
-      exit_script
-    fi
-  done
-
-  # RAM Size
-  while true; do
-    if RAM_SIZE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Allocate RAM in MiB" 8 58 4096 --title "RAM" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
-      if [ -z "$RAM_SIZE" ]; then RAM_SIZE="4096"; fi
-      if [[ "$RAM_SIZE" =~ ^[1-9][0-9]*$ ]]; then
-        echo -e "${RAMSIZE}${BOLD}${DGN}RAM Size: ${BGN}$RAM_SIZE${CL}"
-        break
-      fi
-      whiptail --backtitle "Proxmox VE Helper Scripts" --title "INVALID INPUT" --msgbox "RAM Size must be a positive integer in MiB (e.g., 4096)." 8 58
-    else
-      exit_script
-    fi
-  done
-
-  # Bridge
-  if BRG=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a Bridge" 8 58 vmbr0 --title "BRIDGE" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
-    if [ -z $BRG ]; then
-      BRG="vmbr0"
-    fi
-    echo -e "${BRIDGE}${BOLD}${DGN}Bridge: ${BGN}$BRG${CL}"
-  else
-    exit_script
-  fi
-
-  # MAC Address
-  while true; do
-    if MAC1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a MAC Address" 8 58 $GEN_MAC --title "MAC ADDRESS" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
-      if [ -z "$MAC1" ]; then
-        MAC="$GEN_MAC"
-        echo -e "${MACADDRESS}${BOLD}${DGN}MAC Address: ${BGN}$MAC${CL}"
-        break
-      fi
-      if [[ "$MAC1" =~ ^([0-9A-Fa-f]{2}:){5}[0-9A-Fa-f]{2}$ ]]; then
-        MAC="$MAC1"
-        echo -e "${MACADDRESS}${BOLD}${DGN}MAC Address: ${BGN}$MAC${CL}"
-        break
-      fi
-      whiptail --backtitle "Proxmox VE Helper Scripts" --title "INVALID INPUT" --msgbox "Invalid MAC address format. Use XX:XX:XX:XX:XX:XX (e.g., AA:BB:CC:DD:EE:FF)." 8 58
-    else
-      exit_script
-    fi
-  done
-
-  # VLAN
-  while true; do
-    if VLAN1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a Vlan (leave blank for default)" 8 58 --title "VLAN" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
-      if [ -z "$VLAN1" ]; then
-        VLAN1="Default"
-        VLAN=""
-        echo -e "${VLANTAG}${BOLD}${DGN}VLAN: ${BGN}$VLAN1${CL}"
-        break
-      fi
-      if [[ "$VLAN1" =~ ^[0-9]+$ ]] && [ "$VLAN1" -ge 1 ] && [ "$VLAN1" -le 4094 ]; then
-        VLAN=",tag=$VLAN1"
-        echo -e "${VLANTAG}${BOLD}${DGN}VLAN: ${BGN}$VLAN1${CL}"
-        break
-      fi
-      whiptail --backtitle "Proxmox VE Helper Scripts" --title "INVALID INPUT" --msgbox "VLAN must be a number between 1 and 4094, or leave blank for default." 8 58
-    else
-      exit_script
-    fi
-  done
-
-  # MTU
-  while true; do
-    if MTU1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set Interface MTU Size (leave blank for default)" 8 58 --title "MTU SIZE" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
-      if [ -z "$MTU1" ]; then
-        MTU1="Default"
-        MTU=""
-        echo -e "${DEFAULT}${BOLD}${DGN}Interface MTU Size: ${BGN}$MTU1${CL}"
-        break
-      fi
-      if [[ "$MTU1" =~ ^[0-9]+$ ]] && [ "$MTU1" -ge 576 ] && [ "$MTU1" -le 65520 ]; then
-        MTU=",mtu=$MTU1"
-        echo -e "${DEFAULT}${BOLD}${DGN}Interface MTU Size: ${BGN}$MTU1${CL}"
-        break
-      fi
-      whiptail --backtitle "Proxmox VE Helper Scripts" --title "INVALID INPUT" --msgbox "MTU Size must be a number between 576 and 65520, or leave blank for default." 8 58
-    else
-      exit_script
-    fi
-  done
-
-  # Start VM
-  if (whiptail --backtitle "Proxmox VE Helper Scripts" --title "START VIRTUAL MACHINE" --yesno "Start VM when completed?" 10 58); then
-    echo -e "${GATEWAY}${BOLD}${DGN}Start VM when completed: ${BGN}yes${CL}"
-    START_VM="yes"
-  else
-    echo -e "${GATEWAY}${BOLD}${DGN}Start VM when completed: ${BGN}no${CL}"
-    START_VM="no"
-  fi
-
-  # Confirm
-  if (whiptail --backtitle "Proxmox VE Helper Scripts" --title "ADVANCED SETTINGS COMPLETE" --yesno "Ready to create a Docker VM?" --no-button Do-Over 10 58); then
+  if vm_confirm_advanced_settings "Ready to create a Docker VM?"; then
    echo -e "${CREATING}${BOLD}${DGN}Creating a Docker VM using the above advanced settings${CL}"
  else
    header_info
@@ -412,81 +182,27 @@ function advanced_settings() {
  fi
 }

-function start_script() {
-  if (whiptail --backtitle "Proxmox VE Helper Scripts" --title "SETTINGS" --yesno "Use Default Settings?" --no-button Advanced 10 58); then
-    header_info
-    echo -e "${DEFAULT}${BOLD}${BL}Using Default Settings${CL}"
-    default_settings
-  else
-    header_info
-    echo -e "${ADVANCED}${BOLD}${RD}Using Advanced Settings${CL}"
-    advanced_settings
-  fi
-}

 # ==============================================================================
 # MAIN EXECUTION
 # ==============================================================================
 header_info

-check_root
-arch_check
-pve_check
+vm_preflight

-if whiptail --backtitle "Proxmox VE Helper Scripts" --title "Docker VM" --yesno "This will create a New Docker VM. Proceed?" 10 58; then
-  :
-else
-  header_info && echo -e "${CROSS}${RD}User exited script${CL}\n" && exit
-fi
-
-start_script
+vm_start_script "Use Default Settings?" 10 58
 post_to_api_vm

 # ==============================================================================
 # STORAGE SELECTION
 # ==============================================================================
-msg_info "Validating Storage"
-while read -r line; do
-  TAG=$(echo $line | awk '{print $1}')
-  TYPE=$(echo $line | awk '{printf "%-10s", $2}')
-  FREE=$(echo $line | numfmt --field 4-6 --from-unit=K --to=iec --format %.2f | awk '{printf( "%9sB", $6)}')
-  ITEM="  Type: $TYPE Free: $FREE "
-  OFFSET=2
-  if [[ $((${#ITEM} + $OFFSET)) -gt ${MSG_MAX_LENGTH:-} ]]; then
-    MSG_MAX_LENGTH=$((${#ITEM} + $OFFSET))
-  fi
-  STORAGE_MENU+=("$TAG" "$ITEM" "OFF")
-done < <(pvesm status -content images | awk 'NR>1')
-
-VALID=$(pvesm status -content images | awk 'NR>1')
-if [ -z "$VALID" ]; then
-  msg_error "Unable to detect a valid storage location."
-  exit
-elif [ $((${#STORAGE_MENU[@]} / 3)) -eq 1 ]; then
-  STORAGE=${STORAGE_MENU[0]}
-else
-  if [ -n "$SPINNER_PID" ] && ps -p $SPINNER_PID >/dev/null; then kill $SPINNER_PID >/dev/null; fi
-  printf "\e[?25h"
-  while [ -z "${STORAGE:+x}" ]; do
-    STORAGE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "Storage Pools" --radiolist \
-      "Which storage pool would you like to use for ${HN}?\nTo make a selection, use the Spacebar.\n" \
-      16 $(($MSG_MAX_LENGTH + 23)) 6 \
-      "${STORAGE_MENU[@]}" 3>&1 1>&2 2>&3)
-  done
-fi
-msg_ok "Using ${CL}${BL}$STORAGE${CL} ${GN}for Storage Location."
-msg_ok "Virtual Machine ID is ${CL}${BL}$VMID${CL}."
+vm_select_storage "$HN"

 # ==============================================================================
 # PREREQUISITES
 # ==============================================================================
-if ! command -v virt-customize &>/dev/null; then
-  msg_info "Installing libguestfs-tools"
-  apt-get -qq update >/dev/null
-  apt-get -qq install libguestfs-tools lsb-release -y >/dev/null
-  apt-get -qq install dhcpcd-base -y >/dev/null 2>&1 || true
-  msg_ok "Installed libguestfs-tools"
-fi
+vm_ensure_virt_customize
+$STD apt-get -qq install lsb-release dhcpcd-base -y 2>/dev/null || true

 # ==============================================================================
 # IMAGE DOWNLOAD
@@ -498,13 +214,8 @@ CACHE_FILE="$CACHE_DIR/$(basename "$URL")"
 mkdir -p "$CACHE_DIR"
 msg_ok "${CL}${BL}${URL}${CL}"

-if [[ ! -s "$CACHE_FILE" ]]; then
-  curl -f#SL -o "$CACHE_FILE" "$URL"
-  echo -en "\e[1A\e[0K"
-  msg_ok "Downloaded ${CL}${BL}$(basename "$CACHE_FILE")${CL}"
-else
-  msg_ok "Using cached image ${CL}${BL}$(basename "$CACHE_FILE")${CL}"
-fi
+MIN_IMAGE_BYTES=$((100 * 1024 * 1024))
+vm_fetch_image "$URL" "$CACHE_FILE" --cache --min-bytes "$MIN_IMAGE_BYTES" || exit 115

 # ==============================================================================
 # STORAGE TYPE DETECTION
@@ -539,6 +250,13 @@ msg_info "Preparing ${OS_DISPLAY} image with Docker"
 WORK_FILE=$(mktemp --suffix=.qcow2)
 cp "$CACHE_FILE" "$WORK_FILE"

+# qm resize only grows the block device. Without cloud-init nothing grows the
+# guest partition, so expand the working copy offline first.
+if [ "${USE_CLOUD_INIT:-no}" != "yes" ]; then
+  msg_info "Expanding the root filesystem to ${DISK_SIZE}"
+  vm_expand_image "$WORK_FILE" "$DISK_SIZE" || true
+fi
+
 export LIBGUESTFS_BACKEND_SETTINGS=dns=8.8.8.8,1.1.1.1

 DOCKER_PREINSTALLED="no"
@@ -577,9 +295,7 @@ fi

 msg_info "Finalizing image (hostname, SSH config)"
 # Set hostname and prepare for unique machine-id
-virt-customize -q -a "$WORK_FILE" --hostname "${HN}" >/dev/null 2>&1 || true
-virt-customize -q -a "$WORK_FILE" --run-command "truncate -s 0 /etc/machine-id" >/dev/null 2>&1 || true
-virt-customize -q -a "$WORK_FILE" --run-command "rm -f /var/lib/dbus/machine-id" >/dev/null 2>&1 || true
+vm_prepare_cloud_image "$WORK_FILE" "$HN" || true

 # Configure SSH for Cloud-Init
 if [ "$USE_CLOUD_INIT" = "yes" ]; then
@@ -716,16 +432,17 @@ msg_ok "Attached EFI and root disk"
 set_description

 # Cloud-Init configuration
-if [ "$USE_CLOUD_INIT" = "yes" ]; then
-  msg_info "Configuring Cloud-Init"
-  setup_cloud_init "$VMID" "$STORAGE" "$HN" "yes"
+msg_info "Configuring Cloud-Init"
+if vm_provision "$VMID"; then
  msg_ok "Cloud-Init configured"
+else
+  msg_warn "VM created, but not provisioned"
 fi

 # Start VM
 if [ "$START_VM" == "yes" ]; then
  msg_info "Starting Docker VM"
-  qm start $VMID >/dev/null 2>&1
+  $STD qm start $VMID
  msg_ok "Started Docker VM"
 fi
Author	SHA1	Message	Date
MickLesk	0a8426d0c0	navidrome: restore data folder ownership on install and update Upstream's deb postinstall runs chown navidrome:navidrome on /var/lib/navidrome/cache without -R, and only behind an .installed flag, so it never runs again on an upgrade. Every navidrome command the packaging invokes as root creates cache content owned by root, which the service then cannot write as the navidrome user - artwork that was already cached keeps working while newly resolved album and playlist covers fail. Reassert ownership of the data folder after deploying the release. The music folder is left alone, it is commonly a bind mount.	2026-09-14 16:03:47 +02:00
community-scripts-pr-app[bot]	787dbf2420	Update CHANGELOG.md (#17259 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-09-14 13:51:26 +00:00
push-app-to-main[bot]	2bac6ac611	Add borg-ui (ct) (#17258 ) Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com>	2026-09-14 15:50:54 +02:00
community-scripts-pr-app[bot]	7a36712ef4	Update CHANGELOG.md (#17257 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-09-14 10:53:55 +00:00
Raffaele Borrelli	f21bd26c8a	fix(sparkyfitness): substitute NGINX_RATE_LIMIT in nginx config (#17256 ) Co-authored-by: Raffaele Borrelli <r.borrelli@novomatic.it>	2026-09-14 12:53:28 +02:00
community-scripts-pr-app[bot]	e476e28e33	Update CHANGELOG.md (#17253 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-09-14 08:08:57 +00:00
github-actions[bot]	db50b50a63	spliit: bump Node.js from 24 to 26 (#17250 ) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>	2026-09-14 10:08:27 +02:00
community-scripts-pr-app[bot]	33a110f06a	Update CHANGELOG.md (#17242 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-09-13 18:22:02 +00:00
community-scripts-pr-app[bot]	70091db00b	Update CHANGELOG.md (#17241 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-09-13 18:08:12 +00:00
Copilot	8b02661dd0	Downgrade iobroker to Node 24 (#17229 ) Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: MickLesk <47820557+MickLesk@users.noreply.github.com>	2026-09-13 20:07:45 +02:00
community-scripts-pr-app[bot]	9e25624107	Update CHANGELOG.md (#17233 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-09-13 00:05:14 +00:00
community-scripts-pr-app[bot]	e1a084edea	Archive old changelog entries (#17232 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-09-13 00:04:44 +00:00
community-scripts-pr-app[bot]	e24a47ebca	Update CHANGELOG.md (#17227 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-09-12 20:12:20 +00:00
community-scripts-pr-app[bot]	9e0a57a04a	Update CHANGELOG.md (#17226 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-09-12 20:11:38 +00:00
push-app-to-main[bot]	2551a576d5	Elasticsearch (#17188 )	2026-09-12 22:11:22 +02:00
community-scripts-pr-app[bot]	aa2d63f569	Update CHANGELOG.md (#17225 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-09-12 20:11:11 +00:00
community-scripts-pr-app[bot]	8348fb3cb3	Update CHANGELOG.md (#17224 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-09-12 20:10:59 +00:00
CanbiZ (MickLesk)	be0a8c3467	Add --no-sync to Paperless uv run services (#17210 )	2026-09-12 22:10:47 +02:00
community-scripts-pr-app[bot]	1131d748e8	Update CHANGELOG.md (#17223 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-09-12 20:10:36 +00:00
CanbiZ (MickLesk)	764e4232ba	Docker VM: Feature Bump - Refactor script for improved functionality (#17216 )	2026-09-12 22:10:00 +02:00
community-scripts-pr-app[bot]	8ee86a91b8	Update CHANGELOG.md (#17218 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-09-12 15:18:08 +00:00
community-scripts-pr-app[bot]	95d80a4941	Update CHANGELOG.md (#17217 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-09-12 15:15:09 +00:00
community-scripts-pr-app[bot]	5f1b71a85e	Update CHANGELOG.md (#17213 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-09-12 12:31:07 +00:00
eXistC	2c6a578343	fix(dispatcharr): add comskip installation and build dependencies (#16224 )	2026-09-12 14:30:42 +02:00
community-scripts-pr-app[bot]	b068e7cd8a	Update CHANGELOG.md (#17212 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-09-12 12:25:32 +00:00
Kevin Langhans	02cf8a0a8f	feat(jitsi-meet): optional public setup (FQDN, Let's Encrypt, NAT, secure domain) (#17132 ) Adds five optional var_jitsi_* settings to the install script. All default to empty, which keeps the previous LAN-only behaviour (container IP, self-signed certificate): - var_jitsi_domain public hostname instead of the container IP - var_jitsi_le_email Let's Encrypt via the packaged debconf option - var_jitsi_public_ip static NAT mapping in jvb.conf (JVB 2.3+) - var_jitsi_admin_user secure domain: only authenticated users create rooms - var_jitsi_admin_pass password for that user (generated when empty) Tested on Proxmox VE 9.2 as unprivileged Debian 13 LXC, both with all variables set (self-signed) and with none set. Co-authored-by: klanghans <13657862+klanghans@users.noreply.github.com> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>	2026-09-12 14:25:09 +02:00
community-scripts-pr-app[bot]	9580c0f5bd	Update CHANGELOG.md (#17211 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-09-12 12:24:23 +00:00
push-app-to-main[bot]	3dbfe54701	Add hammer (ct) (#17189 ) Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com>	2026-09-12 14:24:00 +02:00
community-scripts-pr-app[bot]	ab5f20ec71	Update CHANGELOG.md (#17207 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-09-12 10:01:49 +00:00
CanbiZ (MickLesk)	0a48435ef9	poznote: serve from src/public docroot (#17187 )	2026-09-12 12:01:26 +02:00
community-scripts-pr-app[bot]	9e22ffe10d	Update CHANGELOG.md (#17206 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-09-12 09:53:19 +00:00
push-app-to-main[bot]	4412cc0eae	gotenberg (#17205 ) * Add gotenberg (ct) * Update messages in gotenberg.sh for clarity * Implement unoconverter update in gotenberg.sh * Fix formatting and add Go version setup in script * Update Gotenberg installation script for Go version --------- Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com> Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com>	2026-09-12 11:52:55 +02:00
community-scripts-pr-app[bot]	fe823143fb	Update CHANGELOG.md (#17204 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-09-12 06:31:53 +00:00
CanbiZ (MickLesk)	24e006cd81	calibre-web: use calibreweb release identifier to avoid version file collision (#17186 )	2026-09-12 08:31:29 +02:00