Generate the NPM admin config and repair certbot's venv on update

2.16.0 ships production.conf only as a template that its s6 prepare step renders,
so installs outside Docker never listened on 81; render it on install, on update
while keeping a custom admin port, and on update for containers already stuck on
2.16.0. Certbot's upgrade died on a dist-info without RECORD, which pip's own
--ignore-installed hint does not clear, so drop such records before upgrading.

CHANGELOG.md

@@ -546,6 +546,14 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-09-26
+
+### 🚀 Updated Scripts
+
+  - #### 💥 Breaking Changes
+
+    - Semaphore: fix BoltDB migration by pinning 2.18.30 [@MickLesk](https://github.com/MickLesk) ([#17439](https://github.com/community-scripts/ProxmoxVE/pull/17439))
+
 ## 2026-09-25
 
 ### 🆕 New Scripts

ct/nginxproxymanager.sh

@@ -118,10 +118,18 @@ EOF
       $STD "$CERTBOT_PYTHON" -m ensurepip --upgrade
     fi
     $STD "$CERTBOT_PYTHON" -m pip install --upgrade pip setuptools wheel
+    find /opt/certbot/lib/python3*/site-packages -maxdepth 1 -name '*.dist-info' -type d ! -exec test -e '{}/RECORD' ';' -exec rm -rf '{}' + 2>/dev/null || true
     $STD "$CERTBOT_PYTHON" -m pip install --upgrade certbot certbot-dns-cloudflare
     msg_ok "Updated Certbot"
   fi
 
+  if [[ -f /etc/nginx/conf.d/production.conf.template && ! -f /etc/nginx/conf.d/production.conf ]]; then
+    msg_info "Restoring Admin Interface"
+    sed 's/{{NPM_ADMIN_PORT}}/81/g' /etc/nginx/conf.d/production.conf.template >/etc/nginx/conf.d/production.conf
+    systemctl restart openresty
+    msg_ok "Restored Admin Interface"
+  fi
+
   if check_for_gh_release "nginxproxymanager" "NginxProxyManager/nginx-proxy-manager"; then
     msg_info "Stopping Services"
     systemctl stop openresty
@@ -159,6 +167,10 @@ EOF
     cp /opt/nginxproxymanager/docker/rootfs/etc/logrotate.d/nginx-proxy-manager /etc/logrotate.d/nginx-proxy-manager
     ln -sf /etc/nginx/nginx.conf /etc/nginx/conf/nginx.conf
     rm -f /etc/nginx/conf.d/dev.conf
+    if [[ -f /etc/nginx/conf.d/production.conf.template ]]; then
+      ADMIN_PORT=$(grep -oP '^\s*listen\s+\K[0-9]+(?=\s+default)' /etc/nginx/conf.d/production.conf 2>/dev/null | head -n1 || true)
+      sed "s/{{NPM_ADMIN_PORT}}/${ADMIN_PORT:-81}/g" /etc/nginx/conf.d/production.conf.template >/etc/nginx/conf.d/production.conf
+    fi
 
     mkdir -p /tmp/nginx/body \
       /run/nginx \

ct/semaphore.sh

@@ -32,42 +32,68 @@ function update_script() {
     exit
   fi
 
-  if check_for_gh_release "semaphore" "semaphoreui/semaphore"; then
-    if [[ -f /opt/semaphore/semaphore_db.bolt ]]; then
-      msg_warn "WARNING: Due to bugs with BoltDB database, update script will move your application"
-      msg_warn "to use SQLite database instead. Make sure you have a backup of your data!"
-      echo ""
-      read -r -p "${TAB3}Do you want to continue? (y/N): " CONFIRM
-      if [[ ! "$CONFIRM" =~ ^[Yy]$ ]]; then
-        exit 0
-      else
-        msg_info "Moving from BoltDB to SQLite"
-        sed -i \
-          -e 's|"bolt": {|"sqlite": {|' \
-          -e 's|/semaphore_db.bolt"|/database.sqlite"|' \
-          -e '/semaphore_db.bolt/d' \
-          -e '/"dialect"/d' \
-          -e '/^  },$/a\  "dialect": "sqlite",' \
-          /opt/semaphore/config.json
-        msg_ok "Moved from BoltDB to SQLite"
-      fi
+  # Outside the release check on purpose: a container left behind by the old
+  # order already carries the newest version, so the check would skip it.
+  local migrated=0
+  if [[ -f /opt/semaphore/semaphore_db.bolt ]]; then
+    msg_warn "WARNING: Due to bugs with BoltDB database, update script will move your application"
+    msg_warn "to use SQLite database instead. Make sure you have a backup of your data!"
+    echo ""
+    read -r -p "${TAB3}Do you want to continue? (y/N): " CONFIRM
+    if [[ ! "$CONFIRM" =~ ^[Yy]$ ]]; then
+      exit 0
     fi
 
     msg_info "Stopping Service"
     systemctl stop semaphore
     msg_ok "Stopped Service"
 
-    fetch_and_deploy_gh_release "semaphore" "semaphoreui/semaphore" "binary" "latest" "/opt/semaphore" "semaphore_*_linux_$(arch_resolve).deb"
+    msg_info "Moving from BoltDB to SQLite"
+    sed -i \
+      -e 's|"bolt": {|"sqlite": {|' \
+      -e 's|/semaphore_db.bolt"|/database.sqlite"|' \
+      -e '/semaphore_db.bolt/d' \
+      -e '/"dialect"/d' \
+      -e '/^  },$/a\  "dialect": "sqlite",' \
+      /opt/semaphore/config.json
+    msg_ok "Moved from BoltDB to SQLite"
 
-    if [[ -f /opt/semaphore/semaphore_db.bolt ]]; then
-      $STD semaphore migrate --from-boltdb /opt/semaphore/semaphore_db.bolt --config /opt/semaphore/config.json
-      rm -f /opt/semaphore/semaphore_db.bolt
+    # 2.19 dropped BoltDB along with the migration flag, so this has to run on
+    # the last release that still has it.
+    fetch_and_deploy_gh_release "semaphore" "semaphoreui/semaphore" "binary" "v2.18.30" "/opt/semaphore" "semaphore_*_linux_$(arch_resolve).deb"
+
+    msg_info "Migrating BoltDB to SQLite"
+    if [[ -f /opt/semaphore/database.sqlite ]]; then
+      mkdir -p /opt/semaphore/sqlite.bak
+      mv /opt/semaphore/database.sqlite* /opt/semaphore/sqlite.bak/
     fi
+    sed '/"dialect": "sqlite",/a\  "apps": {"ansible": {}, "terraform": {}, "tofu": {}, "terragrunt": {}, "bash": {}, "powershell": {}, "python": {}, "pulumi": {}},' \
+      /opt/semaphore/config.json >/opt/semaphore/migrate.json
+    if ! $STD semaphore migrate --from-boltdb /opt/semaphore/semaphore_db.bolt --config /opt/semaphore/migrate.json; then
+      msg_error "Migration failed - semaphore_db.bolt was kept, run the update again to retry"
+      exit 1
+    fi
+    rm -f /opt/semaphore/migrate.json
+    mv /opt/semaphore/semaphore_db.bolt /opt/semaphore/semaphore_db.bolt.bak
+    msg_ok "Migrated BoltDB to SQLite"
+    migrated=1
+  fi
+
+  if check_for_gh_release "semaphore" "semaphoreui/semaphore"; then
+    msg_info "Stopping Service"
+    systemctl stop semaphore
+    msg_ok "Stopped Service"
+
+    fetch_and_deploy_gh_release "semaphore" "semaphoreui/semaphore" "binary" "latest" "/opt/semaphore" "semaphore_*_linux_$(arch_resolve).deb"
 
     msg_info "Starting Service"
     systemctl start semaphore
     msg_ok "Started Service"
     msg_ok "Updated successfully!"
+  elif ((migrated)); then
+    msg_info "Starting Service"
+    systemctl start semaphore
+    msg_ok "Started Service"
   fi
   exit
 }

install/nginxproxymanager-install.sh

@@ -96,6 +96,9 @@ cp /opt/nginxproxymanager/docker/rootfs/etc/letsencrypt.ini /etc/letsencrypt.ini
 cp /opt/nginxproxymanager/docker/rootfs/etc/logrotate.d/nginx-proxy-manager /etc/logrotate.d/nginx-proxy-manager
 ln -sf /etc/nginx/nginx.conf /etc/nginx/conf/nginx.conf
 rm -f /etc/nginx/conf.d/dev.conf
+if [[ -f /etc/nginx/conf.d/production.conf.template ]]; then
+  sed 's/{{NPM_ADMIN_PORT}}/81/g' /etc/nginx/conf.d/production.conf.template >/etc/nginx/conf.d/production.conf
+fi
 
 mkdir -p /tmp/nginx/body \
   /run/nginx \