Generate the NPM admin config and repair certbot's venv on update

2.16.0 ships production.conf only as a template that its s6 prepare step renders,
so installs outside Docker never listened on 81; render it on install, on update
while keeping a custom admin port, and on update for containers already stuck on
2.16.0. Certbot's upgrade died on a dist-info without RECORD, which pip's own
--ignore-installed hint does not clear, so drop such records before upgrading.

CHANGELOG.md

@@ -546,6 +546,54 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-09-26
+
+### 🚀 Updated Scripts
+
+  - #### 💥 Breaking Changes
+
+    - Semaphore: fix BoltDB migration by pinning 2.18.30 [@MickLesk](https://github.com/MickLesk) ([#17439](https://github.com/community-scripts/ProxmoxVE/pull/17439))
+
+## 2026-09-25
+
+### 🆕 New Scripts
+
+  - RustFS ([#17499](https://github.com/community-scripts/ProxmoxVE/pull/17499))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Ignis: take the Obsidian version from release tag [@MickLesk](https://github.com/MickLesk) ([#17503](https://github.com/community-scripts/ProxmoxVE/pull/17503))
+
+  - #### 🔧 Refactor
+
+    - Refactor: Umbrel OS VM [@MickLesk](https://github.com/MickLesk) ([#17505](https://github.com/community-scripts/ProxmoxVE/pull/17505))
+    - Docker-LXC: remove Portainer installation from install [@MickLesk](https://github.com/MickLesk) ([#17493](https://github.com/community-scripts/ProxmoxVE/pull/17493))
+
+### 💾 Core
+
+  - Incus: make prompts visible for end-user [@MickLesk](https://github.com/MickLesk) ([core#73](https://github.com/community-scripts/core/pull/73))
+- incus: do not let an install script block on an invisible prompt [@MickLesk](https://github.com/MickLesk) ([core#71](https://github.com/community-scripts/core/pull/71))
+- tel: report progress from installs only, not updates [@MickLesk](https://github.com/MickLesk) ([core#72](https://github.com/community-scripts/core/pull/72))
+
+## 2026-09-24
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Declare the RomM filesystem structure required since 5.3.0 [@MickLesk](https://github.com/MickLesk) ([#17480](https://github.com/community-scripts/ProxmoxVE/pull/17480))
+    - general: use apt_update_safe instead of aborting on a failed apt update [@MickLesk](https://github.com/MickLesk) ([#17462](https://github.com/community-scripts/ProxmoxVE/pull/17462))
+
+  - #### 🔧 Refactor
+
+    - Journiv: Serve Node Frontend and add HTTP Auth .env [@MickLesk](https://github.com/MickLesk) ([#17479](https://github.com/community-scripts/ProxmoxVE/pull/17479))
+
+### 💾 Core
+
+  - core: accept an off-subnet gateway for /31 and /32 [@MickLesk](https://github.com/MickLesk) ([core#70](https://github.com/community-scripts/core/pull/70))
+
 ## 2026-09-23
 
 ### 🚀 Updated Scripts

ct/2fauth.sh

@@ -33,7 +33,7 @@ function update_script() {
   fi
   setup_mariadb
   if check_for_gh_release "2fauth" "Bubka/2FAuth"; then
-    $STD apt update
+    apt_update_safe
     $STD apt -y upgrade
 
     msg_info "Creating Backup"

ct/apache-cassandra.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating Apache Cassandra"
-  $STD apt update
+  apt_update_safe
   $STD apt install -y --only-upgrade cassandra cassandra-tools
   msg_ok "Updated Apache Cassandra"
   msg_ok "Updated successfully!"

ct/apache-couchdb.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating Apache CouchDB"
-  $STD apt-get update
+  apt_update_safe
   $STD apt-get install -y --only-upgrade couchdb
   msg_ok "Updated Apache CouchDB"
   msg_ok "Updated successfully!"

ct/apt-cacher-ng.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating Apt-Cacher-NG"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated Apt-Cacher-NG"
   msg_ok "Updated successfully!"

ct/aria2.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating Aria2"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated Aria2"
   msg_ok "Updated successfully!"

ct/audiobookshelf.sh

@@ -32,7 +32,7 @@ function update_script() {
   fi
 
   msg_info "Updating AudiobookShelf"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated AudiobookShelf"
   msg_ok "Updated successfully!"

ct/authelia.sh

@@ -34,7 +34,7 @@ function update_script() {
   fi
 
   if check_for_gh_release "authelia" "authelia/authelia"; then
-    $STD apt update
+    apt_update_safe
     $STD apt -y upgrade
     fetch_and_deploy_gh_release "authelia" "authelia/authelia" "binary"
     msg_ok "Updated successfully!"

ct/bunkerweb.sh

@@ -39,7 +39,7 @@ Package: bunkerweb
 Pin: version ${RELEASE}
 Pin-Priority: 1001
 EOF
-    $STD apt update
+    apt_update_safe
     $STD apt-mark unhold bunkerweb nginx
     $STD apt install -y --allow-downgrades bunkerweb="${RELEASE}"
     msg_ok "Updated BunkerWeb"

ct/caddy.sh

@@ -40,7 +40,7 @@ update_deb_based() {
   fi
 
   msg_info "Updating Caddy LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated Caddy LXC"
 

ct/casaos.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating ${APP} LXC"
-  $STD apt-get update
+  apt_update_safe
   $STD apt-get -y upgrade
   msg_ok "Updated ${APP} LXC"
   msg_ok "Updated successfully!"

ct/cloudflared.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating $APP LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated $APP LXC"
   msg_ok "Updated successfully!"

ct/cockpit.sh

@@ -32,7 +32,7 @@ function update_script() {
   fi
 
   msg_info "Updating ${APP} LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated ${APP} LXC"
 

ct/ddclient.sh

@@ -33,7 +33,7 @@ function update_script() {
   fi
 
   msg_info "Updating ddclient"
-  $STD apt update
+  apt_update_safe
   $STD apt install --only-upgrade -y ddclient
   $STD systemctl restart ddclient
   msg_ok "Updated ddclient"

ct/debian.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating $APP LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated $APP LXC"
   msg_ok "Updated successfully!"

ct/deconz.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating deCONZ"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated deCONZ"
   msg_ok "Updated successfully!"

ct/defguard.sh

@@ -33,7 +33,7 @@ function update_script() {
   fi
 
   msg_info "Updating Defguard"
-  $STD apt update
+  apt_update_safe
   $STD apt install -y defguard defguard-proxy
   msg_ok "Updated Defguard"
 

ct/deluge.sh

@@ -32,7 +32,7 @@ function update_script() {
   fi
   msg_info "Updating Deluge"
   ensure_dependencies python3-setuptools
-  $STD apt update
+  apt_update_safe
   $STD pip3 install deluge[all] "pyopenssl<25" --upgrade
   msg_ok "Updated Deluge"
   msg_ok "Updated successfully!"

ct/devuan.sh

@@ -32,7 +32,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating Devuan LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated Devuan LXC"
   exit

ct/docker.sh

@@ -36,7 +36,7 @@ catch_errors
 
 update_deb_based() {
   msg_info "Updating base system"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Base system updated"
 
@@ -73,5 +73,3 @@ description
 
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Portainer is available as a separate addon. Install it with:${CL}"
-echo -e "${GATEWAY}${BGN}bash -c \"\$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/portainer.sh)\"${CL}"

ct/dotnetaspwebapi.sh

@@ -31,7 +31,7 @@ function update_script() {
         exit
     fi
     msg_info "Updating ${APP} LXC"
-    $STD apt-get update
+    apt_update_safe
     $STD apt-get -y upgrade
     msg_ok "Updated successfully!"
     exit

ct/drawio.sh

@@ -37,7 +37,7 @@ function update_script() {
     msg_ok "Service stopped"
 
     msg_info "Updating Debian LXC"
-    $STD apt update
+    apt_update_safe
     $STD apt upgrade -y
     msg_ok "Updated Debian LXC"
 

ct/elasticsearch.sh

@@ -33,7 +33,7 @@ function update_script() {
   fi
 
   msg_info "Updating ${APP}"
-  $STD apt update
+  apt_update_safe
   $STD apt install -y elasticsearch
   msg_ok "Updated ${APP}"
 

ct/elementsynapse.sh

@@ -34,7 +34,7 @@ function update_script() {
   NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
 
   msg_info "Updating LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated LXC"
 

ct/evcc.sh

@@ -40,7 +40,7 @@ function update_script() {
       "main"
   fi
   msg_info "Updating evcc LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt --only-upgrade install -y evcc
   msg_ok "Updated successfully!"
   exit

ct/fhem.sh

@@ -32,7 +32,7 @@ function update_script() {
     fi
 
     msg_info "Updating FHEM"
-    $STD apt update
+    apt_update_safe
     $STD apt upgrade -y
     msg_ok "Updated FHEM"
     msg_ok "Updated successfully!"

ct/gitlab.sh

@@ -33,7 +33,7 @@ function update_script() {
   fi
 
   msg_info "Updating GitLab (Patience)"
-  $STD apt update
+  apt_update_safe
   $STD apt install -y gitlab-ce
   msg_ok "Updated GitLab"
 

ct/globaleaks.sh

@@ -31,7 +31,7 @@ function update_script() {
   fi
 
   msg_info "Updating $APP LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated $APP LXC"
   msg_ok "Updated successfully!"

ct/grafana.sh

@@ -49,7 +49,7 @@ update_deb_based() {
   fi
 
   msg_info "Updating Grafana LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt --only-upgrade install -y grafana
   msg_ok "Updated successfully!"
 }

ct/graylog.sh

@@ -43,17 +43,17 @@ function update_script() {
     MONGO_VERSION="8.2" setup_mongodb
 
     msg_info "Updating Graylog"
-    $STD apt update
+    apt_update_safe
     $STD apt upgrade -y
     curl -fsSL "https://packages.graylog2.org/repo/packages/graylog-7.0-repository_latest.deb" -o "graylog-7.0-repository_latest.deb"
     $STD dpkg -i graylog-7.0-repository_latest.deb
-    $STD apt update
+    apt_update_safe
     ensure_dependencies graylog-server graylog-datanode
     rm -f graylog-7.0-repository_latest.deb
     msg_ok "Updated Graylog"
   elif dpkg --compare-versions "$CURRENT_VERSION" ge "7.0"; then
     msg_info "Updating Graylog"
-    $STD apt update
+    apt_update_safe
     $STD apt upgrade -y
     msg_ok "Updated Graylog"
   fi

ct/haproxy.sh

@@ -33,7 +33,7 @@ function update_script() {
   fi
 
   msg_info "Updating ${APP}"
-  $STD apt update
+  apt_update_safe
   $STD apt install -y haproxy
   msg_ok "Updated ${APP}"
 

ct/headers/rustfs

@@ -0,0 +1,6 @@
+    ____             __  ___________
+   / __ \__  _______/ /_/ ____/ ___/
+  / /_/ / / / / ___/ __/ /_   \__ \ 
+ / _, _/ /_/ (__  ) /_/ __/  ___/ / 
+/_/ |_|\__,_/____/\__/_/    /____/  
+                                    

ct/homarr.sh

@@ -63,7 +63,7 @@ EOF
     fi
 
     msg_info "Updating Nodejs"
-    $STD apt update
+    apt_update_safe
     $STD apt upgrade nodejs -y
     msg_ok "Updated Nodejs"
 

ct/homeassistant.sh

@@ -63,7 +63,7 @@ function update_script() {
   fi
   if [ "$UPD" == "3" ]; then
     msg_info "Installing Home Assistant Community Store (HACS)"
-    $STD apt update
+    apt_update_safe
     cd /var/lib/docker/volumes/hass_config/_data
     $STD bash <(curl -fsSL https://get.hacs.xyz)
     msg_ok "Installed Home Assistant Community Store (HACS)"

ct/homebridge.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating ${APP} LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt install -y homebridge
   msg_ok "Updated successfully!"
   exit

ct/hyperhdr.sh

@@ -32,7 +32,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating $APP LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated $APP LXC"
   msg_ok "Updated successfully!"

ct/hyperion.sh

@@ -32,7 +32,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating ${APP} LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt install -y hyperion
   msg_ok "Updated successfully!"
   exit

ct/ignis.sh

@@ -49,9 +49,14 @@ function update_script() {
     msg_ok "Built Ignis"
 
     msg_info "Checking Obsidian Web Assets"
-    OBSIDIAN_VERSION=$(grep -oP 'OBSIDIAN_VERSION=\K[0-9.]+' /opt/ignis/apps/ignis-server/Dockerfile | head -n1)
-    [[ -z "$OBSIDIAN_VERSION" ]] && OBSIDIAN_VERSION="$(cat /opt/ignis_data/obsidian.version 2>/dev/null)"
-    if [[ -n "$OBSIDIAN_VERSION" && "$OBSIDIAN_VERSION" != "$(cat /opt/ignis_data/obsidian.version 2>/dev/null)" ]]; then
+    # From the release tag (0.8.13+obsidian.1.13.7): upstream renamed the Dockerfile variable.
+    OBSIDIAN_VERSION=""
+    [[ "${IGNIS_BUILD:-}" == *obsidian.* ]] && OBSIDIAN_VERSION="${IGNIS_BUILD##*obsidian.}"
+    if [[ ! "$OBSIDIAN_VERSION" =~ ^[0-9]+(\.[0-9]+)+$ ]]; then
+      OBSIDIAN_VERSION="$(grep -ohP '(OBSIDIAN_VERSION|IGNIS_OBSIDIAN_PIN)=\K[0-9.]+' /opt/ignis/apps/ignis-server/Dockerfile 2>/dev/null | head -n1 || true)"
+    fi
+    [[ "$OBSIDIAN_VERSION" =~ ^[0-9]+(\.[0-9]+)+$ ]] || msg_warn "Could not determine the paired Obsidian version - keeping the installed assets"
+    if [[ "$OBSIDIAN_VERSION" =~ ^[0-9]+(\.[0-9]+)+$ && "$OBSIDIAN_VERSION" != "$(cat /opt/ignis_data/obsidian.version 2>/dev/null)" ]]; then
       rm -rf /opt/ignis_data/obsidian-app
       mkdir -p /opt/ignis_data/obsidian-app
       curl -fsSL -o /tmp/obsidian.asar.gz "https://github.com/obsidianmd/obsidian-releases/releases/download/v${OBSIDIAN_VERSION}/obsidian-${OBSIDIAN_VERSION}.asar.gz"

ct/immich.sh

@@ -56,7 +56,7 @@ Pin:release a=testing
 Pin-Priority: 450
 EOF
     [[ -f /etc/apt/preferences.d/immich ]] && rm /etc/apt/preferences.d/immich
-    $STD apt update
+    apt_update_safe
     msg_ok "Added Debian Testing repo"
   fi
 
@@ -193,8 +193,6 @@ EOF
     export SHARP_FORCE_GLOBAL_LIBVIPS=true
     $STD pnpm --dir "$APP_DIR/node_modules/sharp" exec npm run build
 
-    ln -sfn "$GEO_DIR" "$APP_DIR/geodata"
-
     # Patch helmet.json: disable upgrade-insecure-requests for HTTP access
     if [[ -f "$APP_DIR/helmet.json" ]]; then
       jq '.contentSecurityPolicy.directives["upgrade-insecure-requests"] = null' "$APP_DIR/helmet.json" >"$APP_DIR/helmet.json.tmp" && mv "$APP_DIR/helmet.json.tmp" "$APP_DIR/helmet.json"
@@ -325,7 +323,7 @@ EOF
     [[ ! -f "$GEO_DIR/countryInfo.txt" ]] && curl_with_retry "https://download.geonames.org/export/dump/countryInfo.txt" "countryInfo.txt"
     ln -s "${UPLOAD_DIR:-/opt/immich/upload}" "$APP_DIR"/upload
     ln -s "${UPLOAD_DIR:-/opt/immich/upload}" "$ML_DIR"/upload
-    ln -s "$GEO_DIR" "$APP_DIR"
+    ln -sfn "$GEO_DIR" "$APP_DIR/geodata"
     [[ ! -f /usr/bin/immich ]] && ln -sf "$APP_DIR"/cli/bin/immich /usr/bin/immich
     [[ ! -f /usr/bin/immich-admin ]] && ln -sf "$APP_DIR"/bin/immich-admin /usr/bin/immich-admin
 

ct/infisical.sh

@@ -42,7 +42,7 @@ function update_script() {
   msg_ok "Created backup"
 
   msg_info "Updating Infisical"
-  $STD apt update
+  apt_update_safe
   $STD apt install -y infisical-core
   $STD infisical-ctl reconfigure
   msg_ok "Updated Infisical"

ct/influxdb.sh

@@ -32,7 +32,7 @@ function update_script() {
   fi
   
   msg_info "Updating InfluxDB"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated InfluxDB"
   msg_ok "Updated successfully!"

ct/inventree.sh

@@ -38,7 +38,7 @@ function update_script() {
   fi
 
   msg_info "Updating InvenTree"
-  $STD apt update
+  apt_update_safe
   $STD apt install --only-upgrade inventree -y
   msg_ok "Updated InvenTree"
   msg_ok "Updated successfully!"

ct/iobroker.sh

@@ -34,7 +34,7 @@ function update_script() {
   NODE_VERSION="24" NPM_VERSION="11" setup_nodejs
 
   msg_info "Updating ${APP} LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated successfully!"
   exit

ct/itsm-ng.sh

@@ -34,7 +34,7 @@ function update_script() {
   setup_mariadb
 
   msg_info "Updating ITSM-NG"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   chown -R www-data:www-data /var/lib/itsm-ng
   mkdir -p /usr/share/itsm-ng/css/palettes

ct/jdownloader.sh

@@ -33,7 +33,7 @@ function update_script() {
   fi
 
   msg_info "Updating Container OS"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated Container OS"
 

ct/jenkins.sh

@@ -34,7 +34,7 @@ function update_script() {
   JAVA_VERSION="21" setup_java
 
   msg_info "Updating Jenkins"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated Jenkins"
   msg_ok "Updated successfully!"

ct/jitsi-meet.sh

@@ -41,7 +41,7 @@ function update_script() {
   fi
 
   msg_info "Updating Jitsi Meet"
-  $STD apt update
+  apt_update_safe
   $STD apt install -y --only-upgrade \
     jitsi-meet \
     jicofo \

ct/journiv.sh

@@ -45,6 +45,17 @@ function update_script() {
     $STD uv sync --locked --no-editable --no-install-project
     msg_ok "Updated Python Environment"
 
+    NODE_VERSION="24" setup_nodejs
+    msg_info "Building Frontend"
+    cd /opt/journiv/frontend
+    $STD npm ci
+    $STD npm run build
+    cd /opt/journiv
+    msg_ok "Built Frontend"
+
+    grep -q '^ALLOW_INSECURE_COOKIE_AUTH_OVER_HTTP=' /opt/journiv.env ||
+      echo 'ALLOW_INSECURE_COOKIE_AUTH_OVER_HTTP=true' >>/opt/journiv.env
+
     msg_info "Running Database Migrations"
     set -a
     source /opt/journiv.env

ct/keycloak.sh

@@ -44,7 +44,7 @@ function update_script() {
     msg_ok "Stopped Service"
 
     msg_info "Updating packages"
-    $STD apt-get update
+    apt_update_safe
     $STD apt-get -y upgrade
     msg_ok "Updated packages"
 

ct/kiwix.sh

@@ -35,7 +35,7 @@ function update_script() {
   CURRENT=$(dpkg-query -W -f='${Version}' kiwix-tools 2>/dev/null)
 
   msg_info "Updating Package Index"
-  $STD apt update
+  apt_update_safe
   msg_ok "Updated Package Index"
 
   CANDIDATE=$(apt-cache policy kiwix-tools | awk '/Candidate:/{print $2}')

ct/livebook.sh

@@ -38,7 +38,7 @@ function update_script() {
     msg_info "Stopped Service"
 
     msg_info "Updating Container"
-    $STD apt update
+    apt_update_safe
     $STD apt upgrade -y
     msg_ok "Updated Container"
 

ct/lldap.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating lldap"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y lldap
   msg_ok "Updated lldap"
   msg_ok "Updated successfully!"

ct/loki.sh

@@ -51,7 +51,7 @@ update_deb_based() {
     msg_ok "Stopped Loki"
 
     msg_info "Updating Loki"
-    $STD apt update
+    apt_update_safe
     $STD apt install -y --only-upgrade loki
     msg_ok "Updated Loki"
 

ct/mariadb.sh

@@ -40,7 +40,7 @@ update_deb_based() {
   fi
   setup_mariadb
   msg_info "Updating ${APP} LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated successfully!"
 }

ct/matterbridge.sh

@@ -30,7 +30,7 @@ function update_script() {
     msg_error "No ${APP} Installation Found!"
     exit
   fi
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   NODE_VERSION="24" NODE_MODULE="matterbridge" setup_nodejs
   msg_ok "Updated successfully!"

ct/mattermost.sh

@@ -31,7 +31,7 @@ function update_script() {
         exit
     fi
     msg_info "Updating ${APP} LXC"
-    $STD apt update
+    apt_update_safe
     $STD apt -y upgrade
     msg_ok "Updated successfully!"
     exit

ct/meshcentral.sh

@@ -31,7 +31,7 @@ function update_script() {
         exit
     fi
     msg_info "Updating ${APP} LXC"
-    $STD apt update
+    apt_update_safe
     $STD apt -y upgrade
     msg_ok "Updated successfully!"
     exit

ct/minarca.sh

@@ -37,7 +37,7 @@ function update_script() {
   msg_ok "Stopped Service"
 
   msg_info "Updating ${APP} LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated ${APP} LXC"
 

ct/mongodb.sh

@@ -32,7 +32,7 @@ function update_script() {
     fi
     
     msg_info "Updating MongoDB LXC"
-    $STD apt update
+    apt_update_safe
     $STD apt upgrade -y
     msg_ok "Updated successfully!"
     exit

ct/mqtt.sh

@@ -41,7 +41,7 @@ function update_script() {
   fi
 
   msg_info "Updating MQTT"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated successfully!"
   exit

ct/mumble.sh

@@ -40,7 +40,7 @@ function update_script() {
     create_backup /etc/mumble/mumble-server.ini /var/lib/mumble-server/mumble-server.sqlite
 
     msg_info "Updating Mumble"
-    $STD apt update
+    apt_update_safe
     $STD apt install -y mumble-server
     cat <<EOF >~/.mumble
 $(get_latest_github_release "mumble-voip/mumble")

ct/mysql.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating ${APP} LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated successfully!"
   exit

ct/neo4j.sh

@@ -33,7 +33,7 @@ function update_script() {
   JAVA_VERSION="21" setup_java
 
   msg_info "Updating ${APP}"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated successfully!"
   exit

ct/netbird.sh

@@ -34,7 +34,7 @@ function update_script() {
   fi
 
   msg_info "Updating Netbird"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated successfully!"
   exit

ct/nextcloudpi.sh

@@ -31,7 +31,7 @@ function update_script() {
         exit
     fi
     msg_info "Updating ${APP} LXC"
-    $STD apt update
+    apt_update_safe
     $STD apt -y upgrade
     msg_ok "Updated successfully!"
     exit

ct/nextpvr.sh

@@ -37,7 +37,7 @@ function update_script() {
   msg_ok "Stopped Service"
 
   msg_info "Updating LXC packages"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated LXC packages"
 

ct/nginxproxymanager.sh

@@ -118,10 +118,18 @@ EOF
       $STD "$CERTBOT_PYTHON" -m ensurepip --upgrade
     fi
     $STD "$CERTBOT_PYTHON" -m pip install --upgrade pip setuptools wheel
+    find /opt/certbot/lib/python3*/site-packages -maxdepth 1 -name '*.dist-info' -type d ! -exec test -e '{}/RECORD' ';' -exec rm -rf '{}' + 2>/dev/null || true
     $STD "$CERTBOT_PYTHON" -m pip install --upgrade certbot certbot-dns-cloudflare
     msg_ok "Updated Certbot"
   fi
 
+  if [[ -f /etc/nginx/conf.d/production.conf.template && ! -f /etc/nginx/conf.d/production.conf ]]; then
+    msg_info "Restoring Admin Interface"
+    sed 's/{{NPM_ADMIN_PORT}}/81/g' /etc/nginx/conf.d/production.conf.template >/etc/nginx/conf.d/production.conf
+    systemctl restart openresty
+    msg_ok "Restored Admin Interface"
+  fi
+
   if check_for_gh_release "nginxproxymanager" "NginxProxyManager/nginx-proxy-manager"; then
     msg_info "Stopping Services"
     systemctl stop openresty
@@ -159,6 +167,10 @@ EOF
     cp /opt/nginxproxymanager/docker/rootfs/etc/logrotate.d/nginx-proxy-manager /etc/logrotate.d/nginx-proxy-manager
     ln -sf /etc/nginx/nginx.conf /etc/nginx/conf/nginx.conf
     rm -f /etc/nginx/conf.d/dev.conf
+    if [[ -f /etc/nginx/conf.d/production.conf.template ]]; then
+      ADMIN_PORT=$(grep -oP '^\s*listen\s+\K[0-9]+(?=\s+default)' /etc/nginx/conf.d/production.conf 2>/dev/null | head -n1 || true)
+      sed "s/{{NPM_ADMIN_PORT}}/${ADMIN_PORT:-81}/g" /etc/nginx/conf.d/production.conf.template >/etc/nginx/conf.d/production.conf
+    fi
 
     mkdir -p /tmp/nginx/body \
       /run/nginx \

ct/notifiarr.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating Notifiarr"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated Notifiarr"
   msg_ok "Updated successfully!"

ct/ntfy.sh

@@ -54,7 +54,7 @@ update_deb_based() {
   fi
 
   msg_info "Updating ntfy"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated ntfy"
   msg_ok "Updated successfully!"

ct/ntopng.sh

@@ -33,7 +33,7 @@ function update_script() {
   fi
 
   msg_info "Updating ntopng"
-  $STD apt update
+  apt_update_safe
   $STD apt install -y ntopng
   msg_ok "Updated ntopng"
 

ct/nzbget.sh

@@ -41,7 +41,7 @@ function update_script() {
   fi
 
   msg_info "Updating NZBGet"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated NZBGet"
   msg_ok "Updated successfully!"

ct/obsidian-livesync.sh

@@ -39,7 +39,7 @@ function update_script() {
   create_backup /var/lib/couchdb /opt/couchdb/etc/local.d/obsidian-livesync.ini /opt/obsidian-livesync/.env
 
   msg_info "Updating Container OS"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated Container OS"
 

ct/omv.sh

@@ -39,7 +39,7 @@ function update_script() {
   fi
 
   msg_info "Updating ${APP} LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated successfully!"
   exit

ct/onlyoffice.sh

@@ -33,7 +33,7 @@ function update_script() {
   fi
 
   msg_info "Updating OnlyOffice Document Server"
-  $STD apt update
+  apt_update_safe
   $STD apt -y --only-upgrade install onlyoffice-documentserver
   msg_ok "Updated OnlyOffice Document Server"
 

ct/opencloud.sh

@@ -39,7 +39,7 @@ function update_script() {
     msg_ok "Stopped services"
 
     msg_info "Updating packages"
-    $STD apt-get update
+    apt_update_safe
     $STD apt-get dist-upgrade -y
     ensure_dependencies "inotify-tools"
     msg_ok "Updated packages"

ct/openhab.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating ${APP} LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated successfully!"
   exit

ct/openproject.sh

@@ -32,7 +32,7 @@ function update_script() {
   fi
 
   msg_info "Updating OpenProject"
-  $STD apt update
+  apt_update_safe
   $STD apt install --only-upgrade -y openproject
   msg_ok "Updated OpenProject"
   msg_ok "Updated successfully!"

ct/openziti-controller.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating $APP LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated $APP LXC"
   msg_ok "Updated successfully!"

ct/openziti-tunnel.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating $APP LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated $APP LXC"
   msg_ok "Updated successfully!"

ct/orb.sh

@@ -33,7 +33,7 @@ function update_script() {
   fi
 
   msg_info "Updating Orb"
-  $STD apt update
+  apt_update_safe
   $STD apt install -y --only-upgrade orb
   msg_ok "Updated successfully!"
   exit

ct/owntracks-recorder.sh

@@ -33,7 +33,7 @@ function update_script() {
   fi
 
   msg_info "Updating ${APP}"
-  $STD apt update
+  apt_update_safe
   $STD apt install -y ot-recorder
   msg_ok "Updated ${APP}"
 

ct/passbolt.sh

@@ -32,7 +32,7 @@ function update_script() {
   fi
   setup_mariadb
   msg_info "Updating $APP LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated $APP LXC"
   exit

ct/pihole.sh

@@ -32,7 +32,7 @@ function update_script() {
     fi
     msg_info "Updating PiHole"
     set +e
-    $STD apt update
+    apt_update_safe
     $STD apt upgrade -y
     /usr/local/bin/pihole -up
     msg_ok "Updated PiHole"

ct/plex.sh

@@ -79,7 +79,7 @@ function update_script() {
   fi
 
   msg_info "Updating Plex Media Server"
-  $STD apt update
+  apt_update_safe
   $STD apt install -y plexmediaserver
   msg_ok "Updated Plex Media Server"
 

ct/podman-homeassistant.sh

@@ -38,7 +38,7 @@ function update_script() {
 
   if [ "$UPD" == "1" ]; then
     msg_info "Updating ${APP} LXC"
-    $STD apt update
+    apt_update_safe
     $STD apt upgrade -y
     msg_ok "Updated successfully!"
 
@@ -59,7 +59,7 @@ function update_script() {
   fi
   if [ "$UPD" == "2" ]; then
     msg_info "Installing Home Assistant Community Store (HACS)"
-    $STD apt update
+    apt_update_safe
     cd /var/lib/containers/storage/volumes/hass_config/_data
     $STD bash <(curl -fsSL https://get.hacs.xyz)
     msg_ok "Installed Home Assistant Community Store (HACS)"

ct/podman.sh

@@ -31,7 +31,7 @@ function update_script() {
         exit
     fi
     msg_info "Updating ${APP} LXC"
-    $STD apt update
+    apt_update_safe
     $STD apt upgrade -y
     msg_ok "Updated successfully!"
     exit

ct/postgresql.sh

@@ -39,7 +39,7 @@ update_deb_based() {
       exit
   fi
   msg_info "Updating ${APP} LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated successfully!"
 }

ct/powerdns.sh

@@ -46,7 +46,7 @@ function update_script() {
   fi
 
   msg_info "Updating PowerDNS"
-  $STD apt update
+  apt_update_safe
   $STD apt install -y --only-upgrade pdns-server pdns-backend-sqlite3
   msg_ok "Updated PowerDNS"
 

ct/proxmox-backup-server.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating $APP LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated $APP LXC"
   msg_ok "Updated successfully!"

ct/proxmox-datacenter-manager.sh

@@ -36,7 +36,7 @@ function update_script() {
     echo "deb [signed-by=/usr/share/keyrings/proxmox-archive-keyring.gpg] http://download.proxmox.com/debian/pdm bookworm pdm-test" >/etc/apt/sources.list.d/pdm-test.list
     curl -fsSL https://enterprise.proxmox.com/debian/proxmox-archive-keyring-trixie.gpg -o /usr/share/keyrings/proxmox-archive-keyring.gpg
     rm -f /etc/apt/keyrings/proxmox-release-bookworm.gpg /etc/apt/sources.list.d/proxmox-release-bookworm.list
-    $STD apt update
+    apt_update_safe
     msg_ok "Updated old sources"
   fi
 
@@ -55,7 +55,7 @@ function update_script() {
   fi
 
   msg_info "Updating $APP LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated $APP LXC"
   msg_ok "Updated successfully!"

ct/proxmox-mail-gateway.sh

@@ -32,7 +32,7 @@ function update_script() {
   fi
 
   msg_info "Updating Proxmox-Mail-Gateway"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated Proxmox-Mail-Gateway"
   msg_ok "Updated successfully!"

ct/pterodactyl-panel.sh

@@ -45,7 +45,7 @@ Suites: $(lsb_release -sc)
 Components: main
 Signed-By: /usr/share/keyrings/deb.sury.org-php.gpg
 EOF
-    $STD apt update
+    apt_update_safe
     $STD apt remove -y php"${CURRENT_PHP//./}"*
     $STD apt install -y \
       php8.4 \

ct/readarr.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating $APP LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt -y upgrade
   msg_ok "Updated $APP LXC"
   msg_ok "Updated successfully!"

ct/redis.sh

@@ -40,7 +40,7 @@ update_deb_based() {
   fi
 
   msg_info "Updating $APP LXC"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated $APP LXC"
 }

ct/resiliosync.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
   msg_info "Updating Resilio Sync"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated successfully!"
   exit

ct/romm.sh

@@ -218,6 +218,18 @@ DROPEOF
     fi
     msg_ok "Updated ROMM"
 
+    # 5.3.0 refuses to start without filesystem.structure and dropped
+    # roms_folder/firmware_folder. A custom layout cannot be inferred.
+    ROMM_CFG=/var/lib/romm/config/config.yml
+    if [[ -f "$ROMM_CFG" ]] && ! grep -qE '^[[:space:]]*structure:' "$ROMM_CFG"; then
+      if grep -qE '^[[:space:]]*(roms_folder|firmware_folder):' "$ROMM_CFG"; then
+        msg_warn "RomM 5.3.0 removed roms_folder/firmware_folder - replace them with filesystem.structure in ${ROMM_CFG}"
+      else
+        printf '\nfilesystem:\n  structure:\n    default: "roms/{platform}/{game}"\n    firmware: "bios/{platform}"\n' >>"$ROMM_CFG"
+        msg_ok "Added filesystem.structure to ${ROMM_CFG}"
+      fi
+    fi
+
     msg_info "Starting Services"
     systemctl start romm-backend romm-worker romm-scheduler romm-watcher
     msg_ok "Started Services"

ct/rustfs.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/rustfs/rustfs
+
+APP="RustFS"
+var_tags="${var_tags:-storage;s3}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-20}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /etc/default/rustfs ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "rustfs" "rustfs/rustfs"; then
+    msg_info "Stopping Service"
+    systemctl stop rustfs
+    msg_ok "Stopped Service"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "rustfs" "rustfs/rustfs" "prebuild" "latest" "/opt/rustfs" "rustfs-linux-$(arch_resolve x86_64 aarch64)-gnu-*.zip"
+    chmod +x /opt/rustfs/rustfs
+
+    msg_info "Starting Service"
+    systemctl start rustfs
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Console:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:9001${CL}"
+echo -e "${INFO}${YW}S3 API on port 9000 - keys are in /etc/default/rustfs${CL}"

ct/salt.sh

@@ -36,7 +36,7 @@ function update_script() {
   if check_for_gh_release "salt" "saltstack/salt"; then
     msg_info "Updating Salt"
     sed -i "s/^\(Pin: version \).*/\1${RELEASE}/" /etc/apt/preferences.d/salt-pin-1001
-    $STD apt update
+    apt_update_safe
     $STD apt upgrade -y
     echo "${RELEASE}" >~/.salt
     msg_ok "Updated successfully!"

ct/semaphore.sh

@@ -32,42 +32,68 @@ function update_script() {
     exit
   fi
 
-  if check_for_gh_release "semaphore" "semaphoreui/semaphore"; then
-    if [[ -f /opt/semaphore/semaphore_db.bolt ]]; then
-      msg_warn "WARNING: Due to bugs with BoltDB database, update script will move your application"
-      msg_warn "to use SQLite database instead. Make sure you have a backup of your data!"
-      echo ""
-      read -r -p "${TAB3}Do you want to continue? (y/N): " CONFIRM
-      if [[ ! "$CONFIRM" =~ ^[Yy]$ ]]; then
-        exit 0
-      else
-        msg_info "Moving from BoltDB to SQLite"
-        sed -i \
-          -e 's|"bolt": {|"sqlite": {|' \
-          -e 's|/semaphore_db.bolt"|/database.sqlite"|' \
-          -e '/semaphore_db.bolt/d' \
-          -e '/"dialect"/d' \
-          -e '/^  },$/a\  "dialect": "sqlite",' \
-          /opt/semaphore/config.json
-        msg_ok "Moved from BoltDB to SQLite"
-      fi
+  # Outside the release check on purpose: a container left behind by the old
+  # order already carries the newest version, so the check would skip it.
+  local migrated=0
+  if [[ -f /opt/semaphore/semaphore_db.bolt ]]; then
+    msg_warn "WARNING: Due to bugs with BoltDB database, update script will move your application"
+    msg_warn "to use SQLite database instead. Make sure you have a backup of your data!"
+    echo ""
+    read -r -p "${TAB3}Do you want to continue? (y/N): " CONFIRM
+    if [[ ! "$CONFIRM" =~ ^[Yy]$ ]]; then
+      exit 0
     fi
 
     msg_info "Stopping Service"
     systemctl stop semaphore
     msg_ok "Stopped Service"
 
-    fetch_and_deploy_gh_release "semaphore" "semaphoreui/semaphore" "binary" "latest" "/opt/semaphore" "semaphore_*_linux_$(arch_resolve).deb"
+    msg_info "Moving from BoltDB to SQLite"
+    sed -i \
+      -e 's|"bolt": {|"sqlite": {|' \
+      -e 's|/semaphore_db.bolt"|/database.sqlite"|' \
+      -e '/semaphore_db.bolt/d' \
+      -e '/"dialect"/d' \
+      -e '/^  },$/a\  "dialect": "sqlite",' \
+      /opt/semaphore/config.json
+    msg_ok "Moved from BoltDB to SQLite"
 
-    if [[ -f /opt/semaphore/semaphore_db.bolt ]]; then
-      $STD semaphore migrate --from-boltdb /opt/semaphore/semaphore_db.bolt --config /opt/semaphore/config.json
-      rm -f /opt/semaphore/semaphore_db.bolt
+    # 2.19 dropped BoltDB along with the migration flag, so this has to run on
+    # the last release that still has it.
+    fetch_and_deploy_gh_release "semaphore" "semaphoreui/semaphore" "binary" "v2.18.30" "/opt/semaphore" "semaphore_*_linux_$(arch_resolve).deb"
+
+    msg_info "Migrating BoltDB to SQLite"
+    if [[ -f /opt/semaphore/database.sqlite ]]; then
+      mkdir -p /opt/semaphore/sqlite.bak
+      mv /opt/semaphore/database.sqlite* /opt/semaphore/sqlite.bak/
     fi
+    sed '/"dialect": "sqlite",/a\  "apps": {"ansible": {}, "terraform": {}, "tofu": {}, "terragrunt": {}, "bash": {}, "powershell": {}, "python": {}, "pulumi": {}},' \
+      /opt/semaphore/config.json >/opt/semaphore/migrate.json
+    if ! $STD semaphore migrate --from-boltdb /opt/semaphore/semaphore_db.bolt --config /opt/semaphore/migrate.json; then
+      msg_error "Migration failed - semaphore_db.bolt was kept, run the update again to retry"
+      exit 1
+    fi
+    rm -f /opt/semaphore/migrate.json
+    mv /opt/semaphore/semaphore_db.bolt /opt/semaphore/semaphore_db.bolt.bak
+    msg_ok "Migrated BoltDB to SQLite"
+    migrated=1
+  fi
+
+  if check_for_gh_release "semaphore" "semaphoreui/semaphore"; then
+    msg_info "Stopping Service"
+    systemctl stop semaphore
+    msg_ok "Stopped Service"
+
+    fetch_and_deploy_gh_release "semaphore" "semaphoreui/semaphore" "binary" "latest" "/opt/semaphore" "semaphore_*_linux_$(arch_resolve).deb"
 
     msg_info "Starting Service"
     systemctl start semaphore
     msg_ok "Started Service"
     msg_ok "Updated successfully!"
+  elif ((migrated)); then
+    msg_info "Starting Service"
+    systemctl start semaphore
+    msg_ok "Started Service"
   fi
   exit
 }

ct/sftpgo.sh

@@ -38,7 +38,7 @@ function update_script() {
   "trixie"
   
   msg_info "Updating SFTPGo"
-  $STD apt update
+  apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated SFTPGo"
   msg_ok "Updated successfully!"