immich: install mise from its GitHub release, retry jellyfin-ffmpeg, default the ML prompt

The mise apt repository keeps one version and caches its index for a day; with near-daily mise releases the index points at a deleted deb and the install ends with 100 (18 a week). The binary comes from the release instead, on new containers and on updates that have none yet. jellyfin-ffmpeg7 failed on mirror hiccups; it goes through the retrying installer. The machine-learning prompt ended the install without a TTY.
Update CHANGELOG.md (#18082 )
2026-10-23 11:45:03 +00:00 · 2026-10-23 11:40:12 +02:00 · 2026-10-23 08:31:27 +00:00 · 2026-10-23 08:30:59 +00:00 · 2026-10-23 08:29:14 +00:00 · 2026-10-23 08:07:36 +00:00
72 changed files with 2156 additions and 416 deletions
@@ -1,3 +1,155 @@
+## 2026-10-17
+
+### 🆕 New Scripts
+
+  - ProxCenter ([#17961](https://github.com/community-scripts/ProxmoxVE/pull/17961))
+- Listenarr ([#17963](https://github.com/community-scripts/ProxmoxVE/pull/17963))
+- Youtarr ([#17962](https://github.com/community-scripts/ProxmoxVE/pull/17962))
+- Norish ([#17964](https://github.com/community-scripts/ProxmoxVE/pull/17964))
+
+### 🚀 Updated Scripts
+
+  - #### 🔧 Refactor
+
+    - Sonarr: stay on the newest v4 (pin) [@MickLesk](https://github.com/MickLesk) ([#17958](https://github.com/community-scripts/ProxmoxVE/pull/17958))
+
+## 2026-10-16
+
+### 🆕 New Scripts
+
+  - Downtify ([#17959](https://github.com/community-scripts/ProxmoxVE/pull/17959))
+- openGym ([#17960](https://github.com/community-scripts/ProxmoxVE/pull/17960))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Pelican Panel: pass the URL to p:environment:setup [@MickLesk](https://github.com/MickLesk) ([#17948](https://github.com/community-scripts/ProxmoxVE/pull/17948))
+    - OneDev: use the onedev.server unit of 16.9 [@MickLesk](https://github.com/MickLesk) ([#17949](https://github.com/community-scripts/ProxmoxVE/pull/17949))
+    - ReadMeABook: start the scheduler with the service [@MickLesk](https://github.com/MickLesk) ([#17950](https://github.com/community-scripts/ProxmoxVE/pull/17950))
+
+### 💾 Core
+
+  - Clean up after installs and updates again [@MickLesk](https://github.com/MickLesk) ([core#147](https://github.com/community-scripts/core/pull/147))
+- Fix apt_conffile_report exiting 1 when uutils comm sees locale-sorted input [@BadFlo](https://github.com/BadFlo) ([core#146](https://github.com/community-scripts/core/pull/146))
+
+## 2026-10-15
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(apprise-api): copy static assets into the served directory [@brokentokin](https://github.com/brokentokin) ([#17940](https://github.com/community-scripts/ProxmoxVE/pull/17940))
+    - Bytestash: modify backup process | Update Resources [@MickLesk](https://github.com/MickLesk) ([#17935](https://github.com/community-scripts/ProxmoxVE/pull/17935))
+    - Zabbix: Add '-y' flag to apt install commands [@MickLesk](https://github.com/MickLesk) ([#17933](https://github.com/community-scripts/ProxmoxVE/pull/17933))
+    - karakeep: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17087](https://github.com/community-scripts/ProxmoxVE/pull/17087))
+
+### 💾 Core
+
+  - Keep VM release lookups working without system.func [@MickLesk](https://github.com/MickLesk) ([core#144](https://github.com/community-scripts/core/pull/144))
+- Stop calling exit 1 "Operation not permitted" at several steps [@MickLesk](https://github.com/MickLesk) ([core#140](https://github.com/community-scripts/core/pull/140))
+
+## 2026-10-14
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Paperclip: fall back to a non-frozen install when the release lockfile is stale [@MickLesk](https://github.com/MickLesk) ([#17922](https://github.com/community-scripts/ProxmoxVE/pull/17922))
+
+  - #### 🔧 Refactor
+
+    - Immich: rebuild the image libraries when the revision record is missing [@MickLesk](https://github.com/MickLesk) ([#17919](https://github.com/community-scripts/ProxmoxVE/pull/17919))
+
+### 💾 Core
+
+  - Show what the failing command printed, and keep verbose output in the log [@MickLesk](https://github.com/MickLesk) ([core#139](https://github.com/community-scripts/core/pull/139))
+- Install jq before the release lookup and show what a non-JSON answer was [@MickLesk](https://github.com/MickLesk) ([core#138](https://github.com/community-scripts/core/pull/138))
+- Refresh the NodeSource key before a same-major Node.js update [@MickLesk](https://github.com/MickLesk) ([core#137](https://github.com/community-scripts/core/pull/137))
+- github: say why a forge could not be reached instead of 'connection failed' [@MickLesk](https://github.com/MickLesk) ([core#136](https://github.com/community-scripts/core/pull/136))
+
+## 2026-10-13
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Fix URL for downloading OneDev latest release [@ryansully](https://github.com/ryansully) ([#17915](https://github.com/community-scripts/ProxmoxVE/pull/17915))
+    - LocalAI: pin the CPU backends when the container has no GPU runtime [@MickLesk](https://github.com/MickLesk) ([#17909](https://github.com/community-scripts/ProxmoxVE/pull/17909))
+    - [Gluetun] Update GitHub repository source install and update. [@CerberusStyle](https://github.com/CerberusStyle) ([#17899](https://github.com/community-scripts/ProxmoxVE/pull/17899))
+    - Immich: Bump to 3.3.1 and restore (failed) geodata/countryInfo.txt on update  [@MickLesk](https://github.com/MickLesk) ([#17894](https://github.com/community-scripts/ProxmoxVE/pull/17894))
+    - WikiJS: use v2 Repo until v3 is stable [@MickLesk](https://github.com/MickLesk) ([#17895](https://github.com/community-scripts/ProxmoxVE/pull/17895))
+
+  - #### 💥 Breaking Changes
+
+    - zammad: Debian 13, new apt repo, Elasticsearch 8 [@durzo](https://github.com/durzo) ([#17836](https://github.com/community-scripts/ProxmoxVE/pull/17836))
+
+### 💾 Core
+
+  - Keep the version key parseable by jq 1.6 [@MickLesk](https://github.com/MickLesk) ([core#134](https://github.com/community-scripts/core/pull/134))
+
+## 2026-10-12
+
+### 🆕 New Scripts
+
+  - WatchState ([#17881](https://github.com/community-scripts/ProxmoxVE/pull/17881))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - chore(ct): sync wazuh defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17889](https://github.com/community-scripts/ProxmoxVE/pull/17889))
+    - Wanderer: bring back the wanderer-pb wrapper [@MickLesk](https://github.com/MickLesk) ([#17874](https://github.com/community-scripts/ProxmoxVE/pull/17874))
+    - Tracearr: install only the server's production dependencies [@MickLesk](https://github.com/MickLesk) ([#17873](https://github.com/community-scripts/ProxmoxVE/pull/17873))
+    - Paperless-ngx: QoL restart crashed services | patch regex [@MickLesk](https://github.com/MickLesk) ([#17812](https://github.com/community-scripts/ProxmoxVE/pull/17812))
+    - Splunk Enterprise: start the service as the splunk user [@rcastley](https://github.com/rcastley) ([#17816](https://github.com/community-scripts/ProxmoxVE/pull/17816))
+
+### 💾 Core
+
+  - Draw a Community Scripts banner while a script has no header of its own [@MickLesk](https://github.com/MickLesk) ([core#133](https://github.com/community-scripts/core/pull/133))
+- Order pre-release labels when comparing versions [@MickLesk](https://github.com/MickLesk) ([core#132](https://github.com/community-scripts/core/pull/132))
+- gh: curl_download: wait between attempts [@MickLesk](https://github.com/MickLesk) ([core#131](https://github.com/community-scripts/core/pull/131))
+
+### 🧰 Tools
+
+  - #### ✨ New Features
+
+    - Immich Public Proxy: optional visitor upload service (v4 Release) [@MickLesk](https://github.com/MickLesk) ([#17875](https://github.com/community-scripts/ProxmoxVE/pull/17875))
+
+## 2026-10-11
+
+### 🆕 New Scripts
+
+  - Cinephage ([#17852](https://github.com/community-scripts/ProxmoxVE/pull/17852))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Immich: build libvips with JPEG 2000 support [@MickLesk](https://github.com/MickLesk) ([#17864](https://github.com/community-scripts/ProxmoxVE/pull/17864))
+    - hermesagent: match the relaunched root gateway regardless of interpreter [@MickLesk](https://github.com/MickLesk) ([#17847](https://github.com/community-scripts/ProxmoxVE/pull/17847))
+    - Radicale: install the bcrypt and argon2 extras [@MickLesk](https://github.com/MickLesk) ([#17813](https://github.com/community-scripts/ProxmoxVE/pull/17813))
+    - fix(zigbee2mqtt): preserve backup stream and prevent filename collisions [@petermnt](https://github.com/petermnt) ([#17751](https://github.com/community-scripts/ProxmoxVE/pull/17751))
+
+  - #### ✨ New Features
+
+    - QoL: let var_* answer the optional add-on prompts [@MickLesk](https://github.com/MickLesk) ([#17858](https://github.com/community-scripts/ProxmoxVE/pull/17858))
+    - QoL: Confirm third-party installers through confirm_external_installer [@MickLesk](https://github.com/MickLesk) ([#17857](https://github.com/community-scripts/ProxmoxVE/pull/17857))
+    - docker: take the lxcfs toggle, TCP socket and Compose choice from app variables [@MickLesk](https://github.com/MickLesk) ([#17850](https://github.com/community-scripts/ProxmoxVE/pull/17850))
+
+  - #### 🔧 Refactor
+
+    - RustDesk Server: run the official server, make the web UI optional [@MickLesk](https://github.com/MickLesk) ([#17854](https://github.com/community-scripts/ProxmoxVE/pull/17854))
+    - Caddy: install the .deb from GitHub instead of the Cloudsmith repo [@MickLesk](https://github.com/MickLesk) ([#17862](https://github.com/community-scripts/ProxmoxVE/pull/17862))
+
+### 💾 Core
+
+  - Add confirm_external_installer [@MickLesk](https://github.com/MickLesk) ([core#130](https://github.com/community-scripts/core/pull/130))
+- setup_docker: make LXC resource limits visible to nested containers [@andrebrait](https://github.com/andrebrait) ([core#9](https://github.com/community-scripts/core/pull/9))
+- Incus: fix ENABLE_FUSE / TUN vars [@MickLesk](https://github.com/MickLesk) ([core#127](https://github.com/community-scripts/core/pull/127))
+- Resolve a uv required-version range to the newest release inside it [@MickLesk](https://github.com/MickLesk) ([core#126](https://github.com/community-scripts/core/pull/126))
+- Upgrade MongoDB in place when an app package depends on it [@MickLesk](https://github.com/MickLesk) ([core#128](https://github.com/community-scripts/core/pull/128))
+
 ## 2026-10-10

 ### 🆕 New Scripts
@@ -1,17 +1,14 @@
-# Keeps the GitHub Actions referenced in .github/workflows up to date.
-# https://docs.github.com/code-security/dependabot/working-with-dependabot/dependabot-options-reference
 version: 2
 updates:
  - package-ecosystem: "github-actions"
    directory: "/"
+    labels: []
    schedule:
      interval: "weekly"
-      day: "monday"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-    # One PR per week for all action bumps instead of one PR per action.
+    target-branch: "main"
+    cooldown:
+      default-days: 7
    groups:
-      github-actions:
+      actions:
        patterns:
          - "*"
@@ -116,6 +116,9 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit



+
+
+



@@ -129,7 +132,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit


 <details>
-<summary><h4>October (10 entries)</h4></summary>
+<summary><h4>October (17 entries)</h4></summary>

 [View October 2026 Changelog](.github/changelogs/2026/10.md)

@@ -562,6 +565,207 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 </details>

+## 2026-10-23
+
+### 💾 Core
+
+  - error output: report a failure inside a subshell once [@MickLesk](https://github.com/MickLesk) ([core#162](https://github.com/community-scripts/core/pull/162))
+- general: allow Composer as root in every script [@MickLesk](https://github.com/MickLesk) ([core#161](https://github.com/community-scripts/core/pull/161))
+- lxc-updater: skip the resource check when the container cannot read its RAM [@MickLesk](https://github.com/MickLesk) ([core#160](https://github.com/community-scripts/core/pull/160))
+- vm-core: let vm_timezone_default survive a host without /etc/timezone [@MickLesk](https://github.com/MickLesk) ([core#159](https://github.com/community-scripts/core/pull/159))
+
+## 2026-10-22
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Zabbix: keep unattended updates on the installed series [@florianpunz](https://github.com/florianpunz) ([#18051](https://github.com/community-scripts/ProxmoxVE/pull/18051))
+
+  - #### 🔧 Refactor
+
+    - Refactor: Cryptpad [@MickLesk](https://github.com/MickLesk) ([#18065](https://github.com/community-scripts/ProxmoxVE/pull/18065))
+
+### 💾 Core
+
+  - Incus: drive a remote Incus server from the client's default remote [@MickLesk](https://github.com/MickLesk) ([core#154](https://github.com/community-scripts/core/pull/154))
+- Deploy the release again when an update is redone [@MickLesk](https://github.com/MickLesk) ([core#158](https://github.com/community-scripts/core/pull/158))
+
+### ❔ Uncategorized
+
+  - chore(ct): sync sparkyfitness defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18061](https://github.com/community-scripts/ProxmoxVE/pull/18061))
+
+## 2026-10-21
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Immich: bump release version to v3.3.5 (CVE) [@CerberusStyle](https://github.com/CerberusStyle) ([#18057](https://github.com/community-scripts/ProxmoxVE/pull/18057))
+    - DroppedNeedle: pass release version to the app via COMMIT_TAG [@MickLesk](https://github.com/MickLesk) ([#18042](https://github.com/community-scripts/ProxmoxVE/pull/18042))
+
+### 💾 Core
+
+  - Keep the version an update started from across a redo [@MickLesk](https://github.com/MickLesk) ([core#156](https://github.com/community-scripts/core/pull/156))
+- Redo an update whose run did not finish after the deploy [@MickLesk](https://github.com/MickLesk) ([core#155](https://github.com/community-scripts/core/pull/155))
+
+## 2026-10-20
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Plane: give Silo its own HOME [@MickLesk](https://github.com/MickLesk) ([#18028](https://github.com/community-scripts/ProxmoxVE/pull/18028))
+    - Immich: Pin version to 3.3.4 [@vhsdream](https://github.com/vhsdream) ([#18036](https://github.com/community-scripts/ProxmoxVE/pull/18036))
+    - InvenTree: run apt under systemd so postinst can finish [@MickLesk](https://github.com/MickLesk) ([#18029](https://github.com/community-scripts/ProxmoxVE/pull/18029))
+    - Profilarr: pass the deno pin as the version [@MickLesk](https://github.com/MickLesk) ([#18025](https://github.com/community-scripts/ProxmoxVE/pull/18025))
+    - Silo: keep the version file out of ~/.silo [@MickLesk](https://github.com/MickLesk) ([#18030](https://github.com/community-scripts/ProxmoxVE/pull/18030))
+    - InvenTree: move to go.packager.io [@MickLesk](https://github.com/MickLesk) ([#18015](https://github.com/community-scripts/ProxmoxVE/pull/18015))
+    - Zitadel: run init and setup in the foreground [@MickLesk](https://github.com/MickLesk) ([#18016](https://github.com/community-scripts/ProxmoxVE/pull/18016))
+
+  - #### ✨ New Features
+
+    - Zitadel: Support v1 and v2 Login [@MickLesk](https://github.com/MickLesk) ([#18031](https://github.com/community-scripts/ProxmoxVE/pull/18031))
+
+  - #### 🔧 Refactor
+
+    - Refactor: OpenWebUI (remove numba pin)  [@MickLesk](https://github.com/MickLesk) ([#18026](https://github.com/community-scripts/ProxmoxVE/pull/18026))
+
+### 💾 Core
+
+  - Only treat an NVIDIA GPU as present when its device nodes are [@MickLesk](https://github.com/MickLesk) ([core#153](https://github.com/community-scripts/core/pull/153))
+
+## 2026-10-19
+
+### 🆕 New Scripts
+
+  - Calagopus ([#18012](https://github.com/community-scripts/ProxmoxVE/pull/18012))
+- Netronome ([#18011](https://github.com/community-scripts/ProxmoxVE/pull/18011))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - immich: record library revisions when the line is missing [@mazelado](https://github.com/mazelado) ([#17990](https://github.com/community-scripts/ProxmoxVE/pull/17990))
+    - Update authentik 2026.8.4 [@thieneret](https://github.com/thieneret) ([#18004](https://github.com/community-scripts/ProxmoxVE/pull/18004))
+
+  - #### ✨ New Features
+
+    - feat(mealie): add reverse proxy auth settings to mealie.env [@bferd](https://github.com/bferd) ([#18006](https://github.com/community-scripts/ProxmoxVE/pull/18006))
+
+## 2026-10-18
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Donetick: create selfhosted.yaml from the example [@MickLesk](https://github.com/MickLesk) ([#17992](https://github.com/community-scripts/ProxmoxVE/pull/17992))
+    - Wiki.js: only back up db.sqlite on SQLite installs [@MickLesk](https://github.com/MickLesk) ([#17993](https://github.com/community-scripts/ProxmoxVE/pull/17993))
+    - FlareSolverr: pass Chrome an en-US Accept-Language [@MickLesk](https://github.com/MickLesk) ([#17995](https://github.com/community-scripts/ProxmoxVE/pull/17995))
+    - 2FAuth: install the locked dependencies [@MickLesk](https://github.com/MickLesk) ([#17996](https://github.com/community-scripts/ProxmoxVE/pull/17996))
+    - Tracearr: drop the pnpm store after the update build [@gioxx](https://github.com/gioxx) ([#17869](https://github.com/community-scripts/ProxmoxVE/pull/17869))
+    - vaultwarden: build before stopping the service [@mazelado](https://github.com/mazelado) ([#17983](https://github.com/community-scripts/ProxmoxVE/pull/17983))
+
+  - #### 💥 Breaking Changes
+
+    - fix: geopulse 2.0.0 upgrade support (nginx .mjs, pg18, jwt cleanup) [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17978](https://github.com/community-scripts/ProxmoxVE/pull/17978))
+
+### 💾 Core
+
+  - Let get_current_ip reach its IPv6 fallback [@MickLesk](https://github.com/MickLesk) ([core#151](https://github.com/community-scripts/core/pull/151))
+- Drop apt autoclean before apt clean [@MickLesk](https://github.com/MickLesk) ([core#152](https://github.com/community-scripts/core/pull/152))
+- Silence apt's script warning in $STD [@MickLesk](https://github.com/MickLesk) ([core#150](https://github.com/community-scripts/core/pull/150))
+
+## 2026-10-17
+
+### 🆕 New Scripts
+
+  - ProxCenter ([#17961](https://github.com/community-scripts/ProxmoxVE/pull/17961))
+- Listenarr ([#17963](https://github.com/community-scripts/ProxmoxVE/pull/17963))
+- Youtarr ([#17962](https://github.com/community-scripts/ProxmoxVE/pull/17962))
+- Norish ([#17964](https://github.com/community-scripts/ProxmoxVE/pull/17964))
+
+### 🚀 Updated Scripts
+
+  - #### 🔧 Refactor
+
+    - Sonarr: stay on the newest v4 (pin) [@MickLesk](https://github.com/MickLesk) ([#17958](https://github.com/community-scripts/ProxmoxVE/pull/17958))
+
+## 2026-10-16
+
+### 🆕 New Scripts
+
+  - Downtify ([#17959](https://github.com/community-scripts/ProxmoxVE/pull/17959))
+- openGym ([#17960](https://github.com/community-scripts/ProxmoxVE/pull/17960))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Pelican Panel: pass the URL to p:environment:setup [@MickLesk](https://github.com/MickLesk) ([#17948](https://github.com/community-scripts/ProxmoxVE/pull/17948))
+    - OneDev: use the onedev.server unit of 16.9 [@MickLesk](https://github.com/MickLesk) ([#17949](https://github.com/community-scripts/ProxmoxVE/pull/17949))
+    - ReadMeABook: start the scheduler with the service [@MickLesk](https://github.com/MickLesk) ([#17950](https://github.com/community-scripts/ProxmoxVE/pull/17950))
+
+### 💾 Core
+
+  - Clean up after installs and updates again [@MickLesk](https://github.com/MickLesk) ([core#147](https://github.com/community-scripts/core/pull/147))
+- Fix apt_conffile_report exiting 1 when uutils comm sees locale-sorted input [@BadFlo](https://github.com/BadFlo) ([core#146](https://github.com/community-scripts/core/pull/146))
+
+## 2026-10-15
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(apprise-api): copy static assets into the served directory [@brokentokin](https://github.com/brokentokin) ([#17940](https://github.com/community-scripts/ProxmoxVE/pull/17940))
+    - Bytestash: modify backup process | Update Resources [@MickLesk](https://github.com/MickLesk) ([#17935](https://github.com/community-scripts/ProxmoxVE/pull/17935))
+    - Zabbix: Add '-y' flag to apt install commands [@MickLesk](https://github.com/MickLesk) ([#17933](https://github.com/community-scripts/ProxmoxVE/pull/17933))
+    - karakeep: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17087](https://github.com/community-scripts/ProxmoxVE/pull/17087))
+
+### 💾 Core
+
+  - Keep VM release lookups working without system.func [@MickLesk](https://github.com/MickLesk) ([core#144](https://github.com/community-scripts/core/pull/144))
+- Stop calling exit 1 "Operation not permitted" at several steps [@MickLesk](https://github.com/MickLesk) ([core#140](https://github.com/community-scripts/core/pull/140))
+
+## 2026-10-14
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Paperclip: fall back to a non-frozen install when the release lockfile is stale [@MickLesk](https://github.com/MickLesk) ([#17922](https://github.com/community-scripts/ProxmoxVE/pull/17922))
+
+  - #### 🔧 Refactor
+
+    - Immich: rebuild the image libraries when the revision record is missing [@MickLesk](https://github.com/MickLesk) ([#17919](https://github.com/community-scripts/ProxmoxVE/pull/17919))
+
+### 💾 Core
+
+  - Show what the failing command printed, and keep verbose output in the log [@MickLesk](https://github.com/MickLesk) ([core#139](https://github.com/community-scripts/core/pull/139))
+- Install jq before the release lookup and show what a non-JSON answer was [@MickLesk](https://github.com/MickLesk) ([core#138](https://github.com/community-scripts/core/pull/138))
+- Refresh the NodeSource key before a same-major Node.js update [@MickLesk](https://github.com/MickLesk) ([core#137](https://github.com/community-scripts/core/pull/137))
+- github: say why a forge could not be reached instead of 'connection failed' [@MickLesk](https://github.com/MickLesk) ([core#136](https://github.com/community-scripts/core/pull/136))
+
+## 2026-10-13
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Fix URL for downloading OneDev latest release [@ryansully](https://github.com/ryansully) ([#17915](https://github.com/community-scripts/ProxmoxVE/pull/17915))
+    - LocalAI: pin the CPU backends when the container has no GPU runtime [@MickLesk](https://github.com/MickLesk) ([#17909](https://github.com/community-scripts/ProxmoxVE/pull/17909))
+    - [Gluetun] Update GitHub repository source install and update. [@CerberusStyle](https://github.com/CerberusStyle) ([#17899](https://github.com/community-scripts/ProxmoxVE/pull/17899))
+    - Immich: Bump to 3.3.1 and restore (failed) geodata/countryInfo.txt on update  [@MickLesk](https://github.com/MickLesk) ([#17894](https://github.com/community-scripts/ProxmoxVE/pull/17894))
+    - WikiJS: use v2 Repo until v3 is stable [@MickLesk](https://github.com/MickLesk) ([#17895](https://github.com/community-scripts/ProxmoxVE/pull/17895))
+
+  - #### 💥 Breaking Changes
+
+    - zammad: Debian 13, new apt repo, Elasticsearch 8 [@durzo](https://github.com/durzo) ([#17836](https://github.com/community-scripts/ProxmoxVE/pull/17836))
+
+### 💾 Core
+
+  - Keep the version key parseable by jq 1.6 [@MickLesk](https://github.com/MickLesk) ([core#134](https://github.com/community-scripts/core/pull/134))
+
 ## 2026-10-12

 ### 🆕 New Scripts
@@ -1164,175 +1368,4 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 ### 📚 Documentation

-  - chore: fix PR template help [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17364](https://github.com/community-scripts/ProxmoxVE/pull/17364))
-
-## 2026-09-17
-
-### 🆕 New Scripts
-
-  - Alpine-VM ([#17324](https://github.com/community-scripts/ProxmoxVE/pull/17324))
- Allstarlink ([#17321](https://github.com/community-scripts/ProxmoxVE/pull/17321))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - changedetection: update: various fixes [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17331](https://github.com/community-scripts/ProxmoxVE/pull/17331))
-    - sparkyfitness: run the Better Auth migration during the update [@MickLesk](https://github.com/MickLesk) ([#17318](https://github.com/community-scripts/ProxmoxVE/pull/17318))
-    - poznote: follow init.sh into docker/ [@MickLesk](https://github.com/MickLesk) ([#17316](https://github.com/community-scripts/ProxmoxVE/pull/17316))
-
-  - #### ✨ New Features
-
-    - romm: make the library paths follow ROMM_BASE_PATH [@MickLesk](https://github.com/MickLesk) ([#17279](https://github.com/community-scripts/ProxmoxVE/pull/17279))
-    - Debian-VM: Refactor | Support Debian 11, 12, 13 [@MickLesk](https://github.com/MickLesk) ([#17325](https://github.com/community-scripts/ProxmoxVE/pull/17325))
-
-### 💾 Core
-
-  - Ask before replacing a cached image that no longer matches [@MickLesk](https://github.com/MickLesk) ([core#44](https://github.com/community-scripts/core/pull/44))
-
-## 2026-09-16
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Immich: Pin to v3.2.2 [@vhsdream](https://github.com/vhsdream) ([#17307](https://github.com/community-scripts/ProxmoxVE/pull/17307))
-    - Dispatcharr: Bump to 4G RAM [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17302](https://github.com/community-scripts/ProxmoxVE/pull/17302))
-    - navidrome: repair root-owned data folders left by 0.61.x [@MickLesk](https://github.com/MickLesk) ([#17275](https://github.com/community-scripts/ProxmoxVE/pull/17275))
-    - tor-snowflake: read the Go version from the module root [@MickLesk](https://github.com/MickLesk) ([#17276](https://github.com/community-scripts/ProxmoxVE/pull/17276))
-    - docmost: stop corepack asking for confirmation during the build [@MickLesk](https://github.com/MickLesk) ([#17282](https://github.com/community-scripts/ProxmoxVE/pull/17282))
-
-  - #### ✨ New Features
-
-    - Refactor: TrueNAS VM (core / improve functions / performance) [@MickLesk](https://github.com/MickLesk) ([#17277](https://github.com/community-scripts/ProxmoxVE/pull/17277))
-    - Frigate: Bump to 0.18.0 [@MickLesk](https://github.com/MickLesk) ([#17273](https://github.com/community-scripts/ProxmoxVE/pull/17273))
-    - Refactor: HomeAssistant-OS (core / improve functions / performance) [@MickLesk](https://github.com/MickLesk) ([#17281](https://github.com/community-scripts/ProxmoxVE/pull/17281))
-
-### 💾 Core
-
-  - Read the IGC version compute-runtime pins, instead of taking the newest [@MickLesk](https://github.com/MickLesk) ([core#43](https://github.com/community-scripts/core/pull/43))
- Install the Intel driver dependency before the .deb that needs it [@MickLesk](https://github.com/MickLesk) ([core#42](https://github.com/community-scripts/core/pull/42))
-
-### 📚 Documentation
-
-  - pocketbase-bot: accept the var_ names and two missing fields [@MickLesk](https://github.com/MickLesk) ([#17305](https://github.com/community-scripts/ProxmoxVE/pull/17305))
-
-## 2026-09-15
-
-### 🆕 New Scripts
-
-  - valhalla ([#17231](https://github.com/community-scripts/ProxmoxVE/pull/17231))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - borg-ui: missing dependency `sshpass` [@christian-forgacs](https://github.com/christian-forgacs) ([#17286](https://github.com/community-scripts/ProxmoxVE/pull/17286))
-    - tracearr: copy packages/emails into the deploy tree [@connorgallopo](https://github.com/connorgallopo) ([#17268](https://github.com/community-scripts/ProxmoxVE/pull/17268))
-    - Immich: Pin to v3.2.1 [@vhsdream](https://github.com/vhsdream) ([#17264](https://github.com/community-scripts/ProxmoxVE/pull/17264))
-
-### 💾 Core
-
-  - Add vm_extract_image, which two VM scripts already call [@MickLesk](https://github.com/MickLesk) ([core#40](https://github.com/community-scripts/core/pull/40))
- Releases: rank releases on their numbers, not on sort -V over the raw tag [@MickLesk](https://github.com/MickLesk) ([core#39](https://github.com/community-scripts/core/pull/39))
-
-### 🧰 Tools
-
-  - #### 🔧 Refactor
-
-    - Refactor: monitor-all (decide on flag values, not on key presence) [@MickLesk](https://github.com/MickLesk) ([#17261](https://github.com/community-scripts/ProxmoxVE/pull/17261))
-
-## 2026-09-14
-
-### 🆕 New Scripts
-
-  - Borg-UI ([#17258](https://github.com/community-scripts/ProxmoxVE/pull/17258))
-
-### 🚀 Updated Scripts
-
-  - SparkyFitness: substitute NGINX_RATE_LIMIT in nginx config [@RafBorrelli](https://github.com/RafBorrelli) ([#17256](https://github.com/community-scripts/ProxmoxVE/pull/17256))
-
-  - #### 🐞 Bug Fixes
-
-    - spliit: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17250](https://github.com/community-scripts/ProxmoxVE/pull/17250))
-
-## 2026-09-13
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Downgrade iobroker to Node 24 [@Copilot](https://github.com/Copilot) ([#17229](https://github.com/community-scripts/ProxmoxVE/pull/17229))
-
-### 💾 Core
-
-  - Pick the highest release version, not the newest published one [@MickLesk](https://github.com/MickLesk) ([core#38](https://github.com/community-scripts/core/pull/38))
-
-## 2026-09-12
-
-### 🆕 New Scripts
-
-  - Elasticsearch ([#17188](https://github.com/community-scripts/ProxmoxVE/pull/17188))
- Hammer ([#17189](https://github.com/community-scripts/ProxmoxVE/pull/17189))
- gotenberg ([#17205](https://github.com/community-scripts/ProxmoxVE/pull/17205))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - fix(dispatcharr): add comskip installation and build dependencies [@eXistC](https://github.com/eXistC) ([#16224](https://github.com/community-scripts/ProxmoxVE/pull/16224))
-    - poznote: serve from src/public docroot [@MickLesk](https://github.com/MickLesk) ([#17187](https://github.com/community-scripts/ProxmoxVE/pull/17187))
-    - calibre-web: use calibreweb release identifier to avoid version file collision [@MickLesk](https://github.com/MickLesk) ([#17186](https://github.com/community-scripts/ProxmoxVE/pull/17186))
-
-  - #### ✨ New Features
-
-    - Docker VM: Feature Bump - Refactor script for improved functionality [@MickLesk](https://github.com/MickLesk) ([#17216](https://github.com/community-scripts/ProxmoxVE/pull/17216))
-    - feat(jitsi-meet): optional public setup (FQDN, Let's Encrypt, NAT, secure domain) [@klanghans](https://github.com/klanghans) ([#17132](https://github.com/community-scripts/ProxmoxVE/pull/17132))
-
-  - #### 🔧 Refactor
-
-    - Paperless-NGX: add --no-sync to uv run services [@MickLesk](https://github.com/MickLesk) ([#17210](https://github.com/community-scripts/ProxmoxVE/pull/17210))
-
-### 💾 Core
-
-  - VM's: show the selected CPU model instead of doubling it [@MickLesk](https://github.com/MickLesk) ([core#37](https://github.com/community-scripts/core/pull/37))
- Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#36](https://github.com/community-scripts/core/pull/36))
-
-## 2026-09-11
-
-### 🆕 New Scripts
-
-  - Lemonade-Server ([#17190](https://github.com/community-scripts/ProxmoxVE/pull/17190))
- OneTimeSecret ([#17097](https://github.com/community-scripts/ProxmoxVE/pull/17097))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - update authentik to 2026.8.2 [@thieneret](https://github.com/thieneret) ([#17198](https://github.com/community-scripts/ProxmoxVE/pull/17198))
-    - passwordpusher: restore data before running migrations [@MickLesk](https://github.com/MickLesk) ([#17141](https://github.com/community-scripts/ProxmoxVE/pull/17141))
-    - paperclip: install the rust toolchain needed by the runner build [@MickLesk](https://github.com/MickLesk) ([#17142](https://github.com/community-scripts/ProxmoxVE/pull/17142))
-    - homepage: run next directly instead of through pnpm [@MickLesk](https://github.com/MickLesk) ([#17155](https://github.com/community-scripts/ProxmoxVE/pull/17155))
-    - changedetection: fix: pin browserless [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17163](https://github.com/community-scripts/ProxmoxVE/pull/17163))
-
-### 💾 Core
-
-  - #### 🐞 Bug Fixes
-
-    - core.func: fall back to a usable HOME when the shell has none [@MickLesk](https://github.com/MickLesk) ([#17154](https://github.com/community-scripts/ProxmoxVE/pull/17154))
-
-### 🧰 Tools
-
-  - Dockhand ([#17191](https://github.com/community-scripts/ProxmoxVE/pull/17191))
-
-  - #### 🐞 Bug Fixes
-
-    - update-apps: rewrite the retired Gitea base in every container before updating it [@MickLesk](https://github.com/MickLesk) ([#17156](https://github.com/community-scripts/ProxmoxVE/pull/17156))
-
-  - #### 🔧 Refactor
-
-    - Rename lxc-delete.sh to guest-delete.sh [@MickLesk](https://github.com/MickLesk) ([#17152](https://github.com/community-scripts/ProxmoxVE/pull/17152))
-
-### 📚 Documentation
-
-  - issue template: add PVE release, execution context and phase; refresh distro list / pve versions [@MickLesk](https://github.com/MickLesk) ([#17160](https://github.com/community-scripts/ProxmoxVE/pull/17160))
+  - chore: fix PR template help [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17364](https://github.com/community-scripts/ProxmoxVE/pull/17364))
@@ -46,7 +46,7 @@ function update_script() {
    $STD uv venv /opt/apprise/.venv
    $STD uv pip install -r requirements.txt gunicorn supervisor -p /opt/apprise/.venv/bin/python
    ln -sf /opt/apprise/.venv/bin/supervisord /opt/apprise/.venv/bin/gunicorn /usr/local/bin/
-    cp -fr apprise_api/static /usr/share/nginx/html/s/
+    cp -fr apprise_api/static/. /usr/share/nginx/html/s/
    mv apprise_api/ webapp
    touch /etc/nginx/server-override.conf
    touch /etc/nginx/location-override.conf
@@ -47,7 +47,7 @@ function update_script() {
  RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
  setup_yq

-  AUTHENTIK_VERSION="version/2026.8.3"
+  AUTHENTIK_VERSION="version/2026.8.4"
  # Source: https://github.com/goauthentik/fips/blob/main/Makefile#L26
  XMLSEC_VERSION="1.3.12"

@@ -9,8 +9,8 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 APP="ByteStash"
 var_tags="${var_tags:-code}"
 var_disk="${var_disk:-4}"
-var_cpu="${var_cpu:-1}"
-var_ram="${var_ram:-1024}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
@@ -35,9 +35,8 @@ function update_script() {
    systemctl stop bytestash-backend bytestash-frontend
    msg_ok "Services Stopped"

-    [[ -d /opt/bytestash/data ]] && create_backup /opt/bytestash/data
    [[ -d /opt/data ]] && create_backup /opt/data
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "bytestash" "jordan-dalby/ByteStash" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="data" fetch_and_deploy_gh_release "bytestash" "jordan-dalby/ByteStash" "tarball"
    restore_backup

    msg_info "Configuring ByteStash"
@@ -50,7 +49,6 @@ function update_script() {
    msg_info "Starting Services"
    systemctl start bytestash-backend bytestash-frontend
    msg_ok "Started Services"
-
    msg_ok "Updated successfully!"
  fi
  exit
@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Jelcoo
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://calagopus.com/
+
+APP="Calagopus"
+var_tags="${var_tags:-panel;game-server}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-40}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /usr/local/bin/calagopus-panel ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "calagopus-panel" "calagopus/panel"; then
+    msg_info "Stopping Service"
+    systemctl stop calagopus-panel
+    msg_ok "Stopped Service"
+
+    create_backup /etc/calagopus/.env /var/lib/calagopus
+
+    fetch_and_deploy_gh_release "calagopus-panel" "calagopus/panel" "singlefile" "latest" "/usr/local/bin" "panel-rs-aio-$(arch_resolve x86_64 aarch64)-linux"
+
+    restore_backup
+
+    msg_info "Starting Service"
+    systemctl start calagopus-panel
+    msg_ok "Started Service"
+    msg_ok "Updated Successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:8000${CL}"
@@ -30,12 +30,14 @@ function update_script() {
    msg_error "No ${APP} Installation Found!"
    exit
  fi
+  # Updates to 2026.10.0 finished without infra.js; run them again so it gets written
+  [[ -f /opt/cryptpad/config/infra.example.js && ! -f /opt/cryptpad/config/infra.js ]] && rm -f ~/.cryptpad
  if check_for_gh_release "cryptpad" "cryptpad/cryptpad"; then
    msg_info "Stopping Service"
    systemctl stop cryptpad
    msg_ok "Stopped Service"

-    create_backup /opt/cryptpad/config/config.js /opt/cryptpad/www/common/onlyoffice/dist
+    create_backup /opt/cryptpad/config/config.js /opt/cryptpad/config/infra.js /opt/cryptpad/www/common/onlyoffice/dist

    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="blob block customize data datastore onlyoffice-conf" fetch_and_deploy_gh_release "cryptpad" "cryptpad/cryptpad" "tarball"

@@ -45,8 +47,30 @@ function update_script() {
    cd /opt/cryptpad
    $STD npm ci --allow-git=all
    $STD npm run install:components
-    if [ -f "/opt/cryptpad/install-onlyoffice.sh" ]; then
-      $STD bash /opt/cryptpad/install-onlyoffice.sh --accept-license
+    if [[ -d /opt/cryptpad/www/common/onlyoffice/dist ]]; then
+      $STD bash /opt/cryptpad/install-office.sh --accept-license
+    fi
+    if [[ ! -f /opt/cryptpad/config/infra.js ]]; then
+      # 2026.10.0 reads the network settings from infra.js and no longer derives the sandbox origin
+      LOCAL_IP="$LOCAL_IP" node - <<'EOF'
+const c = require("/opt/cryptpad/config/config.js");
+const i = require("/opt/cryptpad/config/infra.example.js");
+const port = c.httpPort || i.public.httpPort;
+const safePort = c.httpSafePort || port + 1;
+const origin = (c.httpUnsafeOrigin || `http://${process.env.LOCAL_IP}:${port}`).replace(/\/+$/, "");
+const sandbox = new URL(origin);
+sandbox.port = safePort;
+Object.assign(i.public, {
+  origin,
+  sandboxOrigin: (c.httpSafeOrigin || sandbox.origin).replace(/\/+$/, ""),
+  httpHost: c.httpAddress || (c.httpUnsafeOrigin ? i.public.httpHost : "0.0.0.0"),
+  httpPort: port,
+  httpSafePort: safePort,
+  externalWebsocketURL: c.externalWebsocketURL,
+  fileHost: c.fileHost,
+});
+require("fs").writeFileSync("/opt/cryptpad/config/infra.js", "module.exports = " + JSON.stringify(i, null, 4) + ";\n");
+EOF
    fi
    $STD npm run build
    msg_ok "Updated CryptaPad"
@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/henriquesebastiao/downtify
+
+APP="Downtify"
+var_tags="${var_tags:-music;downloader}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-1024}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/downtify ]]; then
+    msg_error "No Downtify Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "downtify" "henriquesebastiao/downtify"; then
+    msg_info "Stopping Downtify"
+    systemctl stop downtify
+    msg_ok "Stopped Downtify"
+
+    PYTHON_VERSION="3.14" setup_uv
+    NODE_VERSION="26" setup_nodejs
+    fetch_and_deploy_gh_release "deno" "denoland/deno" "prebuild" "latest" "/usr/local/bin" "deno-$(arch_resolve "x86_64" "aarch64")-unknown-linux-gnu.zip"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "downtify" "henriquesebastiao/downtify" "tarball"
+
+    msg_info "Building Downtify"
+    cd /opt/downtify/frontend
+    $STD npm ci
+    $STD npm run build
+    rm -rf /opt/downtify/frontend/node_modules
+    cd /opt/downtify
+    $STD uv sync --frozen --no-dev --python 3.14
+    msg_ok "Built Downtify"
+
+    msg_info "Starting Downtify"
+    systemctl start downtify
+    msg_ok "Started Downtify"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8000${CL}"
+echo -e "${INFO}${YW}Sign in as admin / downtify and change the password right away${CL}"
@@ -91,6 +91,7 @@ User=root
 WorkingDirectory=/opt/droppedneedle/backend
 Environment=ROOT_APP_DIR=/opt/droppedneedle/backend
 Environment=PORT=8688
+Environment=COMMIT_TAG=v$(<~/.droppedneedle)
 # Environment=SLSKD_DOWNLOADS_PATH=<path-to-slskd-downloads>
 ExecStart=/opt/droppedneedle/venv/bin/python -m maintenance.automatic_upgrade --start-target
 Restart=on-failure
@@ -106,6 +107,11 @@ EOF
        sed -i '\|=8688$|a# Environment=SLSKD_DOWNLOADS_PATH=<path-to-slskd-downloads>' /etc/systemd/system/droppedneedle.service
      fi
      sed -i 's|^ExecStart=.*|ExecStart=/opt/droppedneedle/venv/bin/python -m maintenance.automatic_upgrade --start-target|' /etc/systemd/system/droppedneedle.service
+      if grep -q '^Environment=COMMIT_TAG=' /etc/systemd/system/droppedneedle.service; then
+        sed -i "s|^Environment=COMMIT_TAG=.*|Environment=COMMIT_TAG=v$(<~/.droppedneedle)|" /etc/systemd/system/droppedneedle.service
+      else
+        sed -i "\|=8688$|a Environment=COMMIT_TAG=v$(<~/.droppedneedle)" /etc/systemd/system/droppedneedle.service
+      fi
    fi

    systemctl daemon-reload
@@ -35,6 +35,12 @@ function update_script() {
    msg_error "You must upgrade your LXC to Debian Trixie before updating."
    exit
  fi
+  # FlareSolverr hands LANG to Chrome as Accept-Language, which needs a tag like en-US, not a locale (#17987)
+  if ! grep -q '^Environment="LANG=' /etc/systemd/system/flaresolverr.service; then
+    sed -i '/^Environment="CAPTCHA_SOLVER=/a Environment="LANG=en-US"' /etc/systemd/system/flaresolverr.service
+    systemctl daemon-reload
+    systemctl restart flaresolverr
+  fi
  if check_for_gh_release "flaresolverr" "FlareSolverr/FlareSolverr"; then
    msg_info "Stopping service"
    systemctl stop flaresolverr
@@ -10,7 +10,7 @@ APP="GeoPulse"
 var_tags="${var_tags:-location;tracking;gps}"
 var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-1024}"
-var_disk="${var_disk:-8}"
+var_disk="${var_disk:-12}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
@@ -32,6 +32,16 @@ function update_script() {
  fi

  if check_for_gh_release "geopulse-backend" "tess1o/geopulse"; then
+    msg_info "Backing Up Database"
+    mkdir -p /var/lib/geopulse/dumps
+    DB_NAME="$(grep -oP '^GEOPULSE_POSTGRES_DB=\K.*' /etc/geopulse/geopulse.env 2>/dev/null)"
+    DB_NAME="${DB_NAME:-geopulse}"
+    if sudo -u postgres pg_dump -Fc "${DB_NAME}" >"/var/lib/geopulse/dumps/${DB_NAME}-pre-update-$(date +%Y%m%d%H%M%S).dump" 2>/dev/null; then
+      msg_ok "Backed Up Database"
+    else
+      msg_warn "Database backup failed, continuing anyway"
+    fi
+
    msg_info "Stopping Service"
    systemctl stop geopulse-backend
    msg_ok "Stopped Service"
@@ -51,7 +61,48 @@ function update_script() {
    fi

    fetch_and_deploy_gh_release "geopulse-backend" "tess1o/geopulse" "singlefile" "latest" "/opt/geopulse/backend" "${BINARY_PATTERN}"
-    fetch_and_deploy_gh_release "geopulse-frontend" "tess1o/geopulse" "prebuild" "latest" "/var/www/geopulse" "geopulse-frontend-*.tar.gz"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="avatars" fetch_and_deploy_gh_release "geopulse-frontend" "tess1o/geopulse" "prebuild" "latest" "/var/www/geopulse" "geopulse-frontend-*.tar.gz"
+
+    if [[ -f /etc/geopulse/geopulse.env ]] && grep -q "GEOPULSE_JWT_" /etc/geopulse/geopulse.env 2>/dev/null; then
+      msg_info "Removing Unused JWT Keys"
+      sed -i '/^GEOPULSE_JWT_PRIVATE_KEY_LOCATION=/d;/^GEOPULSE_JWT_PUBLIC_KEY_LOCATION=/d' /etc/geopulse/geopulse.env
+      rm -f /opt/geopulse/keys/jwt-private-key.pem /opt/geopulse/keys/jwt-public-key.pem
+      msg_ok "Removed Unused JWT Keys"
+    fi
+
+    if [[ -f /etc/nginx/sites-available/geopulse.conf ]] && ! grep -q '\.mjs\$' /etc/nginx/sites-available/geopulse.conf; then
+      msg_info "Configuring Nginx for .mjs Assets"
+      cp /etc/nginx/sites-available/geopulse.conf /etc/nginx/sites-available/geopulse.conf.pre-mjs.bak
+
+      ANCHOR_LINE="$(grep -n '    add_header Cache-Control "public, max-age=31536000";' /etc/nginx/sites-available/geopulse.conf.pre-mjs.bak | head -1 | cut -d: -f1)"
+
+      if [[ -n "$ANCHOR_LINE" ]]; then
+        INSERT_LINE=$((ANCHOR_LINE + 1))
+        {
+          head -n "$INSERT_LINE" /etc/nginx/sites-available/geopulse.conf.pre-mjs.bak
+          cat <<'MJSBLOCK'
+
+    location ~* ^/(?!osm/).*\.mjs$ {
+        types {
+            application/javascript mjs;
+        }
+        expires 1y;
+        add_header Cache-Control "public, max-age=31536000";
+    }
+MJSBLOCK
+          tail -n "+$((INSERT_LINE + 1))" /etc/nginx/sites-available/geopulse.conf.pre-mjs.bak
+        } >/etc/nginx/sites-available/geopulse.conf
+      fi
+
+      if [[ -n "$ANCHOR_LINE" ]] && grep -q '\.mjs\$' /etc/nginx/sites-available/geopulse.conf && nginx -t >/dev/null 2>&1; then
+        systemctl reload nginx
+        msg_ok "Configured Nginx for .mjs Assets"
+      else
+        cp /etc/nginx/sites-available/geopulse.conf.pre-mjs.bak /etc/nginx/sites-available/geopulse.conf
+        nginx -t >/dev/null 2>&1 && systemctl reload nginx
+        msg_warn "Could not automatically add the .mjs nginx block (customized config?) - add it manually, see the GeoPulse 2.0.0 upgrade notes"
+      fi
+    fi

    msg_info "Starting Service"
    systemctl start geopulse-backend
@@ -32,7 +32,7 @@ function update_script() {
    exit
  fi

-  if check_for_gh_release "gluetun" "qdm12/gluetun"; then
+  if check_for_gh_release "gluetun" "passteque/gluetun"; then
    msg_info "Stopping Service"
    systemctl stop gluetun
    msg_ok "Stopped Service"
@@ -65,19 +65,17 @@ EOF
    msg_ok "Installed/upgraded Testing repo packages"
  fi

-  if [[ ! -f /etc/apt/sources.list.d/mise.list ]]; then
-    msg_info "Installing Mise"
-    curl -fSs https://mise.jdx.dev/gpg-key.pub | tee /etc/apt/keyrings/mise-archive-keyring.pub 1>/dev/null
-    echo "deb [signed-by=/etc/apt/keyrings/mise-archive-keyring.pub arch=$(arch_resolve)] https://mise.jdx.dev/deb stable main" >/etc/apt/sources.list.d/mise.list
-    ensure_dependencies mise
-    msg_ok "Installed Mise"
+  if ! command -v mise >/dev/null 2>&1; then
+    MISE_ARCH="x64"
+    [[ "$(arch_resolve)" == "arm64" ]] && MISE_ARCH="arm64"
+    fetch_and_deploy_gh_release "mise" "jdx/mise" "singlefile" "latest" "/usr/local/bin" "mise-v*-linux-${MISE_ARCH}"
  fi

  STAGING_DIR=/opt/staging
  BASE_DIR=${STAGING_DIR}/base-images
  SOURCE_DIR=${STAGING_DIR}/image-source
  cd /tmp
-  RELEASE="v3.3.0"
+  RELEASE="v3.3.5"
  if [[ -f ~/.intel_version ]]; then
    INTEL_SRC="https://raw.githubusercontent.com/immich-app/immich/${RELEASE}/machine-learning"
    curl -fsSL "${INTEL_SRC}/scripts/install-intel-runtime.sh" -o ./intel-runtime 2>/dev/null ||
@@ -102,16 +100,33 @@ EOF
      msg_ok "Updated Intel OpenVINO dependencies"
    fi
  fi
-  if [[ -f ~/.immich_library_revisions ]]; then
-    libraries=("libjxl" "jpegli" "libheif" "libraw" "imagemagick" "libvips")
-    cd "$BASE_DIR"
-    msg_warn "Checking for updates to custom image-processing libraries (recompile time: 2-15min per library)"
-    ensure_dependencies liblcms2-dev libjpeg62-turbo-dev libspng-dev libexif-dev libopenjp2-7-dev
-    $STD git pull
-    for library in "${libraries[@]}"; do
-      compile_"$library"
-    done
-    msg_ok "Image-processing libraries up to date"
+  # Without the revision file the refresh was skipped and sharp failed on an old libvips (#17914).
+  [[ -f ~/.immich_library_revisions ]] || msg_warn "No record of the compiled image-processing libraries, rebuilding all of them"
+  for lib in imagemagick jpegli libheif libjxl libraw libvips; do
+    grep -q "^${lib}:" ~/.immich_library_revisions 2>/dev/null || echo "${lib}: unknown" >>~/.immich_library_revisions
+  done
+  [[ -d "$BASE_DIR/.git" ]] || $STD git clone -b main https://github.com/immich-app/base-images "$BASE_DIR"
+  libraries=("libjxl" "jpegli" "libheif" "libraw" "imagemagick" "libvips")
+  cd "$BASE_DIR"
+  msg_warn "Checking for updates to custom image-processing libraries (recompile time: 2-15min per library)"
+  ensure_dependencies liblcms2-dev libjpeg62-turbo-dev libspng-dev libexif-dev libopenjp2-7-dev
+  $STD git pull
+  for library in "${libraries[@]}"; do
+    compile_"$library"
+  done
+  msg_ok "Image-processing libraries up to date"
+
+  # 3.3.0 reads geodata/countryInfo.txt; the update before #17823 saved it into app/ instead.
+  if [[ -d /opt/immich/geodata && ! -s /opt/immich/geodata/countryInfo.txt ]]; then
+    msg_info "Restoring geodata/countryInfo.txt"
+    if [[ -s /opt/immich/app/countryInfo.txt ]]; then
+      mv /opt/immich/app/countryInfo.txt /opt/immich/geodata/countryInfo.txt
+    else
+      curl_with_retry "https://download.geonames.org/export/dump/countryInfo.txt" /opt/immich/geodata/countryInfo.txt
+    fi
+    chown immich:immich /opt/immich/geodata/countryInfo.txt
+    systemctl restart immich-web
+    msg_ok "Restored geodata/countryInfo.txt"
  fi

  if check_for_gh_release "Immich" "immich-app/immich" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
@@ -489,8 +504,7 @@ function compile_jpegli() {
 function compile_libheif() {
  SOURCE=${SOURCE_DIR}/libheif
  ensure_dependencies libaom-dev
-  LIBHEIF_REVISION="ac1cb05c39008f01525c991ff8b88f84ddf70fd2"
-  # : "${LIBHEIF_REVISION:=$(jq -cr '.revision' "$BASE_DIR"/server/sources/libheif.json)}"
+  LIBHEIF_REVISION="$(jq -cr '.revision' "$BASE_DIR"/server/sources/libheif.json)"
  if [[ "${update:-}" ]] || [[ "$LIBHEIF_REVISION" != "$(grep 'libheif' ~/.immich_library_revisions | awk '{print $2}')" ]]; then
    msg_info "Recompiling libheif"
    [[ -d "$SOURCE" ]] && rm -rf "$SOURCE"
@@ -31,14 +31,36 @@ function update_script() {
    exit
  fi

-  if ! grep -qE "^ID=(ubuntu)$" /etc/os-release; then
-    msg_error "Unsupported OS. InvenTree requires Ubuntu (20.04/22.04/24.04)."
+  if ! grep -qE "^ID=(ubuntu|debian)$" /etc/os-release; then
+    msg_error "Unsupported OS. InvenTree requires Ubuntu or Debian."
    exit
  fi

+  # dl.packager.io is frozen at 1.5.1 and its SHA1-bound key fails on Debian 13;
+  # go.packager.io only carries current builds for these releases
+  if grep -qs "dl.packager.io" /etc/apt/sources.list.d/inventree*; then
+    case "$(get_os_info id)/$(get_os_info version)" in
+    ubuntu/24.04 | ubuntu/26.04 | debian/13)
+      msg_info "Migrating InvenTree Repository"
+      setup_deb822_repo \
+        "inventree" \
+        "https://go.packager.io/srv/deb/inventree/InvenTree/gpg-key.asc" \
+        "https://go.packager.io/srv/deb/inventree/InvenTree/stable/$(get_os_info id)" \
+        "$(get_os_info version)" \
+        "main"
+      msg_ok "Migrated InvenTree Repository"
+      ;;
+    *)
+      msg_warn "InvenTree only publishes updates for Ubuntu 24.04/26.04 and Debian 13; staying on the frozen repository"
+      ;;
+    esac
+  fi
+
  msg_info "Updating InvenTree"
  apt_update_safe
-  $STD apt install --only-upgrade inventree -y
+  # postinst loops forever unless its parent chain reaches PID 1 (not the case under pct exec)
+  $STD systemd-run --wait --pipe --quiet --collect --setenv=DEBIAN_FRONTEND=noninteractive \
+    apt-get install --only-upgrade -y inventree
  msg_ok "Updated InvenTree"
  msg_ok "Updated successfully!"
  exit
@@ -91,7 +91,7 @@ EOF
    sed -i "s/^SERVER_VERSION=.*$/SERVER_VERSION=${CHECK_UPDATE_RELEASE#v}/" /etc/karakeep/karakeep.env
    # Node 24.19.x crashes better-sqlite3 on cleanup (karakeep-app/karakeep#2989); stay on 22 LTS until upstream reverts.
    MODULE_VERSION="$(jq -r '.packageManager | split("@")[1]' /opt/karakeep/package.json)"
-    NODE_VERSION="22" NODE_MODULE="corepack,pnpm@${MODULE_VERSION}" setup_nodejs
+    NODE_VERSION="24" NODE_MODULE="corepack,pnpm@${MODULE_VERSION}" setup_nodejs
    setup_meilisearch

    msg_info "Updating Karakeep"
@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Listenarrs/Listenarr
+
+APP="Listenarr"
+var_tags="${var_tags:-arr;audiobook}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-no}" # upstream publishes a linux-x64 build only
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/listenarr ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if GH_INCLUDE_PRERELEASE=1 check_for_gh_release "listenarr" "Listenarrs/Listenarr"; then
+    msg_info "Stopping Listenarr"
+    systemctl stop listenarr
+    msg_ok "Stopped Listenarr"
+
+    GH_INCLUDE_PRERELEASE=1 CLEAN_INSTALL=1 fetch_and_deploy_gh_release "listenarr" "Listenarrs/Listenarr" "prebuild" "latest" "/opt/listenarr" "listenarr-*-linux-x64.zip"
+
+    msg_info "Starting Listenarr"
+    systemctl start listenarr
+    msg_ok "Started Listenarr"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:4545${CL}"
@@ -37,6 +37,15 @@ function update_script() {
    exit
  fi

+  # Older installs have no CPU pin; on a host with a GPU but no driver in the
+  # container every model then ends in "backend not found".
+  if ! grep -q '^LOCALAI_FORCE_META_BACKEND_CAPABILITY=' /opt/localai.env 2>/dev/null &&
+    ! ldconfig -p 2>/dev/null | grep -qE 'libcuda[.]so|libamdhip64[.]so|libze_intel_gpu[.]so|libze_loader[.]so'; then
+    echo "LOCALAI_FORCE_META_BACKEND_CAPABILITY=default" >>/opt/localai.env
+    systemctl restart localai
+    msg_ok "Pinned LocalAI to the CPU backends (no GPU runtime in the container)"
+  fi
+
  if check_for_gh_release "localai" "mudler/LocalAI"; then
    msg_info "Stopping Service"
    systemctl stop localai
@@ -58,6 +58,18 @@ exec uv run mealie
 STARTEOF
    fi
    chmod +x /opt/mealie/start.sh
+    if ! grep -q "REVERSE_PROXY_AUTH_ENABLED" /opt/mealie/mealie.env; then
+      cat <<EOF >>/opt/mealie/mealie.env
+
+# Reverse proxy auth (Mealie v3.29.0+). Disabled by default.
+# To enable: set REVERSE_PROXY_AUTH_ENABLED=true, set a secret, then restart mealie.
+# REVERSE_PROXY_AUTH_ENABLED=false
+# REVERSE_PROXY_AUTH_HEADER=X-Forwarded-User
+# REVERSE_PROXY_AUTH_SIGNUP_ENABLED=false
+# REVERSE_PROXY_AUTH_SECRET=
+# REVERSE_PROXY_AUTH_SECRET_HEADER=X-Mealie-Reverse-Proxy-Secret
+EOF
+    fi
    msg_ok "Configuration restored"

    msg_info "Installing Python Dependencies with uv"
@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/autobrr/netronome
+
+APP="Netronome"
+var_tags="${var_tags:-network;monitoring;speedtest}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-512}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /usr/bin/netronome ]]; then
+    msg_error "No Netronome Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "netronome" "autobrr/netronome" "" "" "v"; then
+    msg_info "Stopping Netronome"
+    systemctl stop netronome
+    msg_ok "Stopped Netronome"
+
+    fetch_and_deploy_gh_release "netronome" "autobrr/netronome" "binary" "latest" "" "netronome_*_linux_$(arch_resolve).deb" "v"
+
+    msg_info "Starting Netronome"
+    systemctl start netronome
+    msg_ok "Started Netronome"
+    msg_ok "Updated successfully!"
+  fi
+
+  if check_for_gh_release "librespeed-cli" "librespeed/speedtest-cli"; then
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "librespeed-cli" "librespeed/speedtest-cli" "prebuild" "latest" "/opt/librespeed-cli" "librespeed-cli_*_linux_$(arch_resolve).tar.gz"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:7575${CL}"
+echo -e "${INFO}${YW}Register your account right away: the registration page accepts only the first account, and until then anyone who reaches the port can claim it.${CL}"
@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/norish-recipes/norish
+
+APP="Norish"
+var_tags="${var_tags:-recipes;meal-planning}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-6144}"
+var_disk="${var_disk:-12}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/norish ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "norish" "norish-recipes/norish"; then
+    msg_info "Stopping Norish"
+    systemctl stop norish obscura
+    msg_ok "Stopped Norish"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "norish" "norish-recipes/norish" "tarball"
+    NODE_VERSION="22" NODE_MODULE="pnpm@$(jq -r '.packageManager | split("@")[1]' /opt/norish/package.json)" setup_nodejs
+    PYTHON_VERSION="3.14" setup_uv
+    fetch_and_deploy_gh_release "obscura" "h4ckf0r0day/obscura" "prebuild" "v$(sed -n 's/^OBSCURA_VERSION=//p' /opt/norish/docker/obscura/pin.env)" "/opt/obscura" "obscura-$(arch_resolve "x86_64" "aarch64")-linux-stealth.tar.gz"
+    fetch_and_deploy_gh_release "yt-dlp" "yt-dlp/yt-dlp" "singlefile" "latest" "/usr/local/bin" "$(arch_resolve "yt-dlp_linux" "yt-dlp_linux_aarch64")"
+
+    msg_info "Building Norish"
+    cd /opt/norish
+    $STD pnpm install --frozen-lockfile --filter "@norish/web..." --filter norish
+    $STD uv sync --project /opt/norish/apps/parser-api --locked
+    NODE_ENV=production SKIP_ENV_VALIDATION=1 NEXT_TELEMETRY_DISABLED=1 $STD pnpm turbo run build --filter "@norish/web"
+    rm -rf /opt/norish/apps/web/.next/cache /opt/norish/apps/web/.next/standalone
+    msg_ok "Built Norish"
+
+    msg_info "Starting Norish"
+    systemctl start obscura norish
+    msg_ok "Started Norish"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"
@@ -25,7 +25,10 @@ function update_script() {
  check_container_storage
  check_container_resources

-  if [[ ! -f /etc/systemd/system/onedev.service ]]; then
+  # Installs from before 16.9.0 keep their onedev.service; newer ones get onedev.server.service
+  SERVICE="onedev.server"
+  [[ -f /etc/systemd/system/onedev.service ]] && SERVICE="onedev"
+  if [[ ! -f "/etc/systemd/system/${SERVICE}.service" ]]; then
    msg_error "No ${APP} Installation Found!"
    exit
  fi
@@ -34,12 +37,12 @@ function update_script() {
    JAVA_VERSION="21" setup_java

    msg_info "Stopping Service"
-    systemctl stop onedev
+    systemctl stop "$SERVICE"
    msg_ok "Stopped Service"

    msg_info "Updating OneDev"
    cd /opt
-    curl -fsSL "https://code.onedev.io/onedev/server/~site/onedev-latest.tar.gz" -o onedev-latest.tar.gz
+    curl -fsSL "https://code.onedev.io/onedev/server/~sites/public/onedev-latest.tar.gz" -o onedev-latest.tar.gz
    tar -xzf onedev-latest.tar.gz
    $STD /opt/onedev-latest/bin/upgrade.sh /opt/onedev
    rm -rf /opt/onedev-latest
@@ -48,7 +51,7 @@ function update_script() {
    msg_ok "Updated OneDev"

    msg_info "Starting Service"
-    systemctl start onedev
+    systemctl start "$SERVICE"
    msg_ok "Started Service"
    msg_ok "Updated successfully!"
    exit
@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/DuarteSantos8/openGym
+
+APP="openGym"
+var_tags="${var_tags:-health;fitness}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/opengym ]]; then
+    msg_error "No openGym Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "opengym" "DuarteSantos8/openGym" "" "" "v"; then
+    msg_info "Stopping openGym"
+    systemctl stop nginx opengym
+    msg_ok "Stopped openGym"
+
+    NODE_VERSION="22" setup_nodejs
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "opengym" "DuarteSantos8/openGym" "tarball" "latest" "/opt/opengym" "" "v"
+
+    msg_info "Building openGym"
+    cd /opt/opengym/api
+    $STD npm ci --omit=dev --omit=optional
+    cd /opt/opengym/frontend
+    $STD npm ci --ignore-scripts
+    $STD npm run build
+    rm -rf /opt/opengym/frontend/node_modules ~/.npm
+    msg_ok "Built openGym"
+
+    msg_info "Starting openGym"
+    systemctl start opengym nginx
+    msg_ok "Started openGym"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}${CL}"
+echo -e "${INFO}${YW}Sign-in is by password over plain HTTP. Create your profile right away: the first one becomes the admin.${CL}"
+echo -e "${INFO}${YW}For passkeys, serve it over HTTPS on a hostname through a reverse proxy, then set RP_ID and ORIGIN in /opt/opengym_data/.env and run systemctl restart opengym. Changing RP_ID later invalidates existing passkeys.${CL}"
@@ -49,10 +49,13 @@ function update_script() {

    msg_info "Installing uv-based Open-WebUI"
    PYTHON_VERSION="3.12" setup_uv
-    for attempt in $(seq 1 3); do
-      $STD uv tool install --python 3.12 --constraint <(echo "numba>=0.60") open-webui[all] && break
-      [[ $attempt -lt 3 ]] && msg_warn "Open WebUI install attempt $attempt failed, retrying..." && sleep 10
+    installed=0
+    for attempt in 1 2; do
+      $STD uv tool install --python 3.12 open-webui[all] && { installed=1; break; }
+      msg_warn "Open WebUI install attempt $attempt failed, retrying..."
+      sleep 10
    done
+    ((installed)) || $STD uv tool install --python 3.12 open-webui[all]
    msg_ok "Installed uv-based Open-WebUI"

    msg_info "Restoring data"
@@ -125,10 +128,13 @@ EOF
      OTEL_ARGS+=(--with "$pkg")
    done < <(uv pip list --python "$OWUI_PYTHON" --format freeze 2>/dev/null | grep -i '^opentelemetry-' | cut -d= -f1)
  fi
-  for attempt in $(seq 1 3); do
-    $STD uv tool install --force --python 3.12 --constraint <(echo "numba>=0.60") "${OTEL_ARGS[@]}" open-webui[all] && break
-    [[ $attempt -lt 3 ]] && msg_warn "Open WebUI update attempt $attempt failed, retrying..." && sleep 10
+  updated=0
+  for attempt in 1 2; do
+    $STD uv tool install --force --python 3.12 "${OTEL_ARGS[@]}" open-webui[all] && { updated=1; break; }
+    msg_warn "Open WebUI update attempt $attempt failed, retrying..."
+    sleep 10
  done
+  ((updated)) || $STD uv tool install --force --python 3.12 "${OTEL_ARGS[@]}" open-webui[all]
  systemctl restart open-webui
  msg_ok "Updated Open WebUI"
  msg_ok "Updated successfully!"
@@ -50,7 +50,10 @@ function update_script() {
    cd /opt/paperclip-ai
    export HUSKY=0
    export NODE_OPTIONS="--max-old-space-size=8192"
-    $STD pnpm install --frozen-lockfile
+    $STD pnpm install --frozen-lockfile || {
+      msg_warn "The lockfile of this release is out of date, resolving dependencies without it"
+      $STD pnpm install --no-frozen-lockfile
+    }
    $STD pnpm build
    unset NODE_OPTIONS
    msg_ok "Rebuilt Paperclip"
@@ -66,7 +66,8 @@ function update_script() {
    cp -a /opt/backup/storage/app/public /opt/pelican-panel/storage/app/

    $STD composer install --no-dev --optimize-autoloader --no-interaction
-    $STD php artisan p:environment:setup
+    PANEL_URL="$(sed -n 's/^APP_URL=//p' /opt/pelican-panel/.env | tr -d "\"'")"
+    $STD php artisan p:environment:setup --url="$PANEL_URL"
    $STD php artisan view:clear
    $STD php artisan config:clear
    $STD php artisan filament:optimize
@@ -41,7 +41,7 @@ function update_script() {
  ARCH=$(uname -m)

  if check_for_gh_release "deno" "denoland/deno" "v2.7.5" "Deno is pinned to 2.7.5 because the known WouldBlock: Resource temporarily unavailable (os error 11) Issue"; then
-    fetch_and_deploy_gh_release "deno" "denoland/deno" "v2.7.5" "latest" "/usr/local/bin" "deno-${ARCH}-unknown-linux-gnu.zip"
+    fetch_and_deploy_gh_release "deno" "denoland/deno" "prebuild" "v2.7.5" "/usr/local/bin" "deno-${ARCH}-unknown-linux-gnu.zip"
  fi

  if check_for_gh_release "profilarr" "Dictionarry-Hub/profilarr"; then
@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/adminsyspro/proxcenter-ui
+
+APP="ProxCenter"
+var_tags="${var_tags:-proxmox;management}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-6144}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/proxcenter ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "proxcenter" "adminsyspro/proxcenter-ui"; then
+    msg_info "Stopping ProxCenter"
+    systemctl stop proxcenter
+    msg_ok "Stopped ProxCenter"
+
+    NODE_VERSION="26" setup_nodejs
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "proxcenter" "adminsyspro/proxcenter-ui" "tarball"
+
+    msg_info "Building ProxCenter"
+    cd /opt/proxcenter/frontend
+    $STD npm ci --legacy-peer-deps --ignore-scripts
+    $STD npm run build:icons
+    $STD npx prisma generate
+    NODE_OPTIONS="--max-old-space-size=4608" $STD npm run build
+    msg_ok "Built ProxCenter"
+
+    msg_info "Migrating Database"
+    set -a && source /opt/proxcenter_data/.env && set +a
+    $STD npx prisma migrate deploy
+    $STD npx prisma db seed
+    msg_ok "Migrated Database"
+
+    msg_info "Starting ProxCenter"
+    systemctl start proxcenter
+    msg_ok "Started ProxCenter"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"
@@ -31,6 +31,28 @@ function update_script() {
    exit
  fi

+  if ! grep -q '^ExecStartPost=-/usr/local/bin/readmeabook-init$' /etc/systemd/system/readmeabook.service; then
+    msg_info "Starting the scheduler with the service"
+    cat <<'EOF' >/usr/local/bin/readmeabook-init
+#!/usr/bin/env bash
+# Upstream's image calls /api/init after every start: it creates the scheduled jobs and starts the scheduler
+url="http://127.0.0.1:${PORT:-3030}"
+for _ in $(seq 1 60); do curl -sf -o /dev/null "$url/api/health" && break; sleep 1; done
+for _ in $(seq 1 30); do [[ "$(redis-cli ping 2>/dev/null)" == PONG ]] && break; sleep 1; done
+for attempt in 1 2 3 4 5; do
+  curl -sf -o /dev/null "$url/api/init" && exit 0
+  sleep "$attempt"
+done
+echo "ReadMeABook did not answer /api/init, scheduled jobs will not run" >&2
+exit 1
+EOF
+    chmod +x /usr/local/bin/readmeabook-init
+    sed -i '/^ExecStart=/a ExecStartPost=-/usr/local/bin/readmeabook-init\nTimeoutStartSec=180' /etc/systemd/system/readmeabook.service
+    systemctl daemon-reload
+    systemctl restart readmeabook
+    msg_ok "Started the scheduler with the service"
+  fi
+
  if check_for_gh_release "readmeabook" "kikootwo/ReadMeABook"; then
    msg_info "Stopping Service"
    systemctl stop readmeabook
@@ -31,12 +31,13 @@ function update_script() {
    exit
  fi

-  if check_for_gh_release "silo" "pgsty/silo"; then
+  [[ -f ~/.silo ]] && mv ~/.silo ~/.silo_s3
+  if check_for_gh_release "silo_s3" "pgsty/silo"; then
    msg_info "Stopping Silo"
    systemctl stop silo
    msg_ok "Stopped Silo"

-    DPKG_FORCE_CONFOLD=1 fetch_and_deploy_gh_release "silo" "pgsty/silo" "binary"
+    DPKG_FORCE_CONFOLD=1 fetch_and_deploy_gh_release "silo_s3" "pgsty/silo" "binary"

    msg_info "Starting Silo"
    systemctl start silo
@@ -31,12 +31,13 @@ function update_script() {
    exit
  fi

-  if check_for_gh_release "Sonarr" "Sonarr/Sonarr"; then
+  # v5 reworks a lot; stay on the newest v4 until it is tested
+  if check_for_gh_release "Sonarr" "Sonarr/Sonarr" "" "" "v4."; then
    msg_info "Stopping Service"
    systemctl stop sonarr
    msg_ok "Stopped Service"

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Sonarr" "Sonarr/Sonarr" "prebuild" "latest" "/opt/Sonarr" "Sonarr.main.*.linux-$(arch_resolve "x64" "arm64").tar.gz"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Sonarr" "Sonarr/Sonarr" "prebuild" "latest" "/opt/Sonarr" "Sonarr.main.*.linux-$(arch_resolve "x64" "arm64").tar.gz" "v4."

    msg_info "Starting Service"
    systemctl start sonarr
@@ -9,7 +9,7 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 APP="SparkyFitness"
 var_tags="${var_tags:-health;fitness}"
 var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
+var_ram="${var_ram:-4096}"
 var_disk="${var_disk:-7}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
@@ -146,6 +146,7 @@ EOF
    rm -rf /opt/tracearr.build
    cd /opt/tracearr
    $STD pnpm install --prod --frozen-lockfile --ignore-scripts --filter @tracearr/server...
+    rm -rf "$(pnpm store path)"
    $STD chown -R tracearr:tracearr /opt/tracearr
    msg_ok "Built Tracearr"

@@ -53,10 +53,6 @@ update_deb_based() {
      printf '%s\n' "$INSTALLED_VERSION" >"$HOME/.vaultwarden"
    fi
    if check_for_gh_release "vaultwarden" "dani-garcia/vaultwarden"; then
-      msg_info "Stopping Service"
-      systemctl stop vaultwarden
-      msg_ok "Stopped Service"
-
      fetch_and_deploy_gh_release "vaultwarden" "dani-garcia/vaultwarden" "tarball" "latest" "/tmp/vaultwarden-src"

      msg_info "Updating VaultWarden to $VAULT (Patience)"
@@ -64,6 +60,12 @@ update_deb_based() {
      VW_VERSION="$VAULT"
      export VW_VERSION
      CARGO_BUILD_JOBS="$(get_parallel_jobs)" CARGO_PROFILE_RELEASE_LTO=false CARGO_PROFILE_RELEASE_CODEGEN_UNITS=16 $STD cargo build --features "sqlite,mysql,postgresql" --release
+      msg_ok "Built VaultWarden ${VAULT}"
+
+      msg_info "Stopping Service"
+      systemctl stop vaultwarden
+      msg_ok "Stopped Service"
+
      if [[ -f /usr/bin/vaultwarden ]]; then
        cp target/release/vaultwarden /usr/bin/
      else
@@ -32,30 +32,29 @@ function update_script() {

  NODE_VERSION="26" NODE_MODULE="yarn,node-gyp" setup_nodejs

-  if check_for_gh_release "wikijs" "requarks/wiki"; then
-    msg_info "Verifying whether ${APP}' new release is v3.x+ and current install uses SQLite."
-    SQLITE_INSTALL=$([ -f /opt/wikijs/db.sqlite ] && echo "true" || echo "false")
-    if [[ "${SQLITE_INSTALL}" == "true" && "${CHECK_UPDATE_RELEASE}" =~ ^3.* ]]; then
-      echo "SQLite is not supported in v3.x+, currently there is no update path availble."
-      exit
-    fi
-    msg_ok "There is an update path available for ${APP}"
+  if check_for_gh_release "wikijs" "requarks/wiki-v2"; then
+    # Installs before February 2025 use SQLite, newer ones PostgreSQL
+    SQLITE_INSTALL=$([[ -f /opt/wikijs/db.sqlite ]] && echo "true" || echo "false")

    msg_info "Stopping Service"
    systemctl stop wikijs
    msg_ok "Stopped Service"

    msg_info "Backing up Data"
-    mkdir /opt/wikijs-backup
-    $SQLITE_INSTALL && cp /opt/wikijs/db.sqlite /opt/wikijs-backup
+    mkdir -p /opt/wikijs-backup
+    if [[ "$SQLITE_INSTALL" == "true" ]]; then
+      cp /opt/wikijs/db.sqlite /opt/wikijs-backup
+    fi
    cp -R /opt/wikijs/{config.yml,/data} /opt/wikijs-backup
    msg_ok "Backed up Data"

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "wikijs" "requarks/wiki" "prebuild" "latest" "/opt/wikijs" "wiki-js.tar.gz"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "wikijs" "requarks/wiki-v2" "prebuild" "latest" "/opt/wikijs" "wiki-js.tar.gz"

    msg_info "Restoring Data"
    cp -R /opt/wikijs-backup/* /opt/wikijs
-    $SQLITE_INSTALL && $STD npm rebuild sqlite3
+    if [[ "$SQLITE_INSTALL" == "true" ]]; then
+      $STD npm rebuild sqlite3
+    fi
    rm -rf /opt/wikijs-backup
    msg_ok "Restored Data"

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/DialmasterOrg/Youtarr
+
+APP="Youtarr"
+var_tags="${var_tags:-media;youtube;downloader}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-20}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/youtarr ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  msg_info "Updating yt-dlp"
+  $STD yt-dlp -U
+  msg_ok "Updated yt-dlp"
+
+  if check_for_gh_release "youtarr" "DialmasterOrg/Youtarr"; then
+    msg_info "Stopping Youtarr"
+    systemctl stop youtarr
+    msg_ok "Stopped Youtarr"
+
+    NODE_VERSION="24" setup_nodejs
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "youtarr" "DialmasterOrg/Youtarr" "tarball"
+
+    msg_info "Building Youtarr"
+    cd /opt/youtarr/client
+    $STD npm ci --ignore-scripts
+    $STD npm run build
+    rm -rf /opt/youtarr/client/node_modules
+    cd /opt/youtarr
+    $STD npm ci --omit=dev --ignore-scripts
+    mv /opt/youtarr/config/config.example.json /opt/youtarr/server/
+    rm -rf /opt/youtarr/config
+    ln -sfn /opt/youtarr_data/config /opt/youtarr/config
+    msg_ok "Built Youtarr"
+
+    msg_info "Starting Youtarr"
+    systemctl start youtarr
+    msg_ok "Started Youtarr"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3011${CL}"
+echo -e "${INFO}${YW}First login asks for the setup token in /opt/youtarr_data/config/setup-token${CL}"
@@ -46,24 +46,36 @@ function update_script() {
    msg_warn "No Zabbix Agent service found, skipping agent actions"
  fi

+  ZABBIX_SERIES="$(dpkg-query -W -f='${Version}' zabbix-release 2>/dev/null || true)"
+  ZABBIX_SERIES="${ZABBIX_SERIES#*:}"
+  ZABBIX_SERIES="${ZABBIX_SERIES%%[!0-9.]*}"
+  if [[ "${PHS_SILENT:-0}" == "1" ]]; then
+    if [[ ! "$ZABBIX_SERIES" =~ ^[0-9]+\.[0-9]+$ ]]; then
+      msg_warn "Could not detect the installed Zabbix series - skipping update, requires an interactive run"
+      exit 75
+    fi
+    ZABBIX_VERSION="$ZABBIX_SERIES"
+    msg_warn "Unattended update: staying on Zabbix ${ZABBIX_VERSION}"
+  else
+    read -rp "Choose Zabbix version [1] 7.0 LTS  [2] 7.4 (Latest Stable)  [3] Latest available (default: 2): " ZABBIX_CHOICE
+    ZABBIX_CHOICE=${ZABBIX_CHOICE:-2}
+    case "$ZABBIX_CHOICE" in
+    1) ZABBIX_VERSION="7.0" ;;
+    2) ZABBIX_VERSION="7.4" ;;
+    3) ZABBIX_VERSION=$(curl -fsSL https://repo.zabbix.com/zabbix/ |
+      grep -oP '(?<=href=")[0-9]+\.[0-9]+(?=/")' | sort -V | tail -n1) ;;
+    *)
+      ZABBIX_VERSION="7.4"
+      echo "Invalid choice. Defaulting to 7.4."
+      ;;
+    esac
+  fi
+
  msg_info "Stopping Services"
  systemctl stop zabbix-server
  [[ -n "$AGENT_SERVICE" ]] && systemctl stop "$AGENT_SERVICE"
  msg_ok "Stopped Services"

-  read -rp "Choose Zabbix version [1] 7.0 LTS  [2] 7.4 (Latest Stable)  [3] Latest available (default: 2): " ZABBIX_CHOICE
-  ZABBIX_CHOICE=${ZABBIX_CHOICE:-2}
-  case "$ZABBIX_CHOICE" in
-  1) ZABBIX_VERSION="7.0" ;;
-  2) ZABBIX_VERSION="7.4" ;;
-  3) ZABBIX_VERSION=$(curl -fsSL https://repo.zabbix.com/zabbix/ |
-    grep -oP '(?<=href=")[0-9]+\.[0-9]+(?=/")' | sort -V | tail -n1) ;;
-  *)
-    ZABBIX_VERSION="7.4"
-    echo "Invalid choice. Defaulting to 7.4."
-    ;;
-  esac
-
  msg_info "Updating Zabbix to $ZABBIX_VERSION"
  mkdir -p /opt/zabbix-backup/
  cp /etc/zabbix/zabbix_server.conf /opt/zabbix-backup/
@@ -86,16 +98,16 @@ function update_script() {
  rm -rf /tmp/zabbix-release_*.deb
  apt_update_safe

-  $STD apt install --only-upgrade zabbix-server-pgsql zabbix-frontend-php php8.4-pgsql
+  $STD apt install --only-upgrade -y zabbix-server-pgsql zabbix-frontend-php php8.4-pgsql

  if [[ "$AGENT_SERVICE" == "zabbix-agent2" ]]; then
-    $STD apt install --only-upgrade zabbix-agent2 zabbix-agent2-plugin-postgresql
+    $STD apt install --only-upgrade -y zabbix-agent2 zabbix-agent2-plugin-postgresql
    if [ -f /etc/zabbix/zabbix_agent2.d/plugins.d/nvidia.conf ]; then
      sed -i 's|^Plugins.NVIDIA.System.Path=.*|# Plugins.NVIDIA.System.Path=/usr/libexec/zabbix/zabbix-agent2-plugin-nvidia-gpu|' \
        /etc/zabbix/zabbix_agent2.d/plugins.d/nvidia.conf
    fi
  elif [[ "$AGENT_SERVICE" == "zabbix-agent" ]]; then
-    $STD apt install --only-upgrade zabbix-agent
+    $STD apt install --only-upgrade -y zabbix-agent
  fi

  if command -v fping >/dev/null 2>&1; then
@@ -12,7 +12,7 @@ var_disk="${var_disk:-8}"
 var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-4096}"
 var_os="${var_os:-debian}"
-var_version="${var_version:-12}"
+var_version="${var_version:-13}"
 var_arm64="${var_arm64:-no}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -34,6 +34,64 @@ function update_script() {
  systemctl stop zammad
  msg_ok "Stopped Service"

+  if grep -qs "dl.packager.io" /etc/apt/sources.list.d/zammad*; then
+    msg_info "Migrating Zammad Repository"
+    rm -f /etc/apt/keyrings/pkgr-zammad.gpg
+    setup_deb822_repo \
+      "zammad" \
+      "https://go.packager.io/srv/deb/zammad/zammad/gpg-key.asc" \
+      "https://go.packager.io/srv/deb/zammad/zammad/stable/debian" \
+      "$(get_os_info version_id)" \
+      "main"
+    msg_ok "Migrated Zammad Repository"
+  fi
+
+  REBUILD_INDEX=false
+  if [[ "$(dpkg-query -W -f='${Version}' elasticsearch 2>/dev/null)" == 7.* ]]; then
+    msg_info "Upgrading Elasticsearch to 8.x"
+    systemctl stop elasticsearch
+    if /usr/share/elasticsearch/bin/elasticsearch-plugin list 2>/dev/null | grep -q "ingest-attachment"; then
+      $STD /usr/share/elasticsearch/bin/elasticsearch-plugin remove ingest-attachment
+    fi
+    rm -f /etc/apt/sources.list.d/elastic-7.x.list /usr/share/keyrings/elasticsearch-keyring.gpg
+    setup_deb822_repo \
+      "elasticsearch" \
+      "https://artifacts.elastic.co/GPG-KEY-elasticsearch" \
+      "https://artifacts.elastic.co/packages/8.x/apt" \
+      "stable" \
+      "main"
+    ES_JAVA_OPTS="-Xms1g -Xmx1g" $STD apt install -y elasticsearch
+    if [[ -f /etc/elasticsearch/jvm.options.dpkg-dist ]]; then
+      mv /etc/elasticsearch/jvm.options.dpkg-dist /etc/elasticsearch/jvm.options
+    fi
+    rm -f /etc/elasticsearch/elasticsearch.yml.dpkg-dist
+    rm -rf /var/lib/elasticsearch/*
+    cat <<EOF >/etc/elasticsearch/jvm.options.d/heap.options
+-Xms2g
+-Xmx2g
+EOF
+    cat <<EOF >/etc/elasticsearch/elasticsearch.yml
+path.data: /var/lib/elasticsearch
+path.logs: /var/log/elasticsearch
+discovery.type: single-node
+network.host: 127.0.0.1
+xpack.security.enabled: false
+xpack.security.transport.ssl.enabled: false
+xpack.security.http.ssl.enabled: false
+bootstrap.memory_lock: false
+EOF
+    systemctl daemon-reload
+    systemctl restart -q elasticsearch
+    for i in $(seq 1 30); do
+      if curl -s http://127.0.0.1:9200 >/dev/null 2>&1; then
+        break
+      fi
+      sleep 2
+    done
+    REBUILD_INDEX=true
+    msg_ok "Upgraded Elasticsearch to 8.x"
+  fi
+
  msg_info "Updating Zammad"
  apt_update_safe
  $STD apt-mark hold zammad
@@ -42,6 +100,12 @@ function update_script() {
  $STD apt upgrade -y
  msg_ok "Updated Zammad"

+  if [[ "$REBUILD_INDEX" == true ]]; then
+    msg_info "Rebuilding Search Index"
+    $STD zammad run rake zammad:searchindex:rebuild
+    msg_ok "Rebuilt Search Index"
+  fi
+
  msg_info "Starting Service"
  systemctl start zammad
  msg_ok "Started Service"
@@ -2,7 +2,7 @@
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
-# Author: dave-yap (dave-yap)
+# Author: dave-yap (dave-yap) | Co-Author: remz1337, MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://zitadel.com/ | Github: https://github.com/zitadel/zitadel

@@ -16,11 +16,23 @@ var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

+if [[ -z "${var_zitadel_login:-}" ]] && command -v pveversion >/dev/null 2>&1; then
+  var_zitadel_login=$(msg_menu "Choose the Zitadel login UI" \
+    "v2" "Login V2, Zitadel's default (HTTPS, self-signed certificate)" \
+    "v1" "Login V1, the classic login built into the API (HTTP)")
+fi
+export var_zitadel_login="${var_zitadel_login:-v2}"
+
 header_info "$APP"
 variables
 color
 catch_errors

+if [[ ! "${var_zitadel_login}" =~ ^v[12]$ ]]; then
+  msg_error "var_zitadel_login must be v1 or v2"
+  exit 1
+fi
+
 function update_script() {
  header_info
  check_container_storage
@@ -31,20 +43,29 @@ function update_script() {
  fi

  if check_for_gh_release "zitadel" "zitadel/zitadel"; then
-    msg_info "Stopping Service"
+    msg_info "Stopping Zitadel"
+    if [[ -f /etc/systemd/system/zitadel-login.service ]]; then
+      systemctl stop zitadel-login
+    fi
    systemctl stop zitadel
-    msg_ok "Stopped Service"
+    msg_ok "Stopped Zitadel"

-    rm -f /usr/local/bin/zitadel
-    fetch_and_deploy_gh_release "zitadel" "zitadel/zitadel" "prebuild" "latest" "/usr/local/bin" "zitadel-linux-$(arch_resolve).tar.gz"
+    fetch_and_deploy_gh_release "zitadel" "zitadel/zitadel" "prebuild" "${CHECK_UPDATE_RELEASE}" "/usr/local/bin" "zitadel-linux-$(arch_resolve).tar.gz"
+    if [[ -f /etc/systemd/system/zitadel-login.service ]]; then
+      NODE_VERSION="24" setup_nodejs
+      CLEAN_INSTALL=1 fetch_and_deploy_gh_release "zitadel-login" "zitadel/zitadel" "prebuild" "${CHECK_UPDATE_RELEASE}" "/opt/zitadel-login" "zitadel-login.tar.gz"
+    fi

-    msg_info "Updating Zitadel"
+    msg_info "Migrating Zitadel Database"
    $STD zitadel setup --masterkeyFile /opt/zitadel/.masterkey --config /opt/zitadel/config.yaml --init-projections=true
-    msg_ok "Updated Zitadel"
+    msg_ok "Migrated Zitadel Database"

-    msg_info "Starting Service"
+    msg_info "Starting Zitadel"
    systemctl start zitadel
-    msg_ok "Started Service"
+    if [[ -f /etc/systemd/system/zitadel-login.service ]]; then
+      systemctl start zitadel-login
+    fi
+    msg_ok "Started Zitadel"
    msg_ok "Updated successfully!"
  fi
  exit
@@ -57,4 +78,9 @@ description
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:8080/ui/console${CL}"
+if [[ "${var_zitadel_login}" == "v1" ]]; then
+  echo -e "${GATEWAY}${BGN}http://${IP}:8080/ui/console${CL}"
+else
+  echo -e "${GATEWAY}${BGN}https://${IP}:8080/ui/console${CL}"
+fi
+echo -e "${INFO}${YW}Admin credentials: ~/zitadel.creds (inside the container)${CL}"
@@ -36,7 +36,6 @@ sed -i -e "s|^APP_URL=.*|APP_URL=http://$LOCAL_IP|" \
  -e "s|^DB_USERNAME=$|DB_USERNAME=$MARIADB_DB_USER|" \
  -e "s|^DB_PASSWORD=$|DB_PASSWORD=$MARIADB_DB_PASS|" .env
 export COMPOSER_ALLOW_SUPERUSER=1
-$STD composer update --no-plugins --no-scripts
 $STD composer install --no-dev --prefer-dist --no-plugins --no-scripts
 $STD php artisan key:generate --force
 $STD php artisan migrate:refresh
@@ -29,7 +29,7 @@ cp ./requirements.txt /etc/requirements.txt
 $STD uv venv /opt/apprise/.venv
 $STD uv pip install -r requirements.txt gunicorn supervisor -p /opt/apprise/.venv/bin/python
 ln -sf /opt/apprise/.venv/bin/supervisord /opt/apprise/.venv/bin/gunicorn /usr/local/bin/
-cp -fr apprise_api/static /usr/share/nginx/html/s/
+cp -fr apprise_api/static/. /usr/share/nginx/html/s/
 mv apprise_api/ webapp
 touch /etc/nginx/server-override.conf
 touch /etc/nginx/location-override.conf
@@ -57,7 +57,7 @@ PG_VERSION="17" setup_postgresql
 PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db

 XMLSEC_VERSION="1.3.12"
-AUTHENTIK_VERSION="version/2026.8.3"
+AUTHENTIK_VERSION="version/2026.8.4"
 fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec"
 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
 GO_VERSION="$(grep -m1 '^go ' /opt/authentik/go.mod | awk '{print $2}')" setup_go
@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Jelcoo
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://calagopus.com/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y valkey
+systemctl enable -q --now valkey-server
+msg_ok "Installed Dependencies"
+
+PG_VERSION="18" setup_postgresql
+PG_DB_NAME="panel" PG_DB_USER="calagopus" setup_postgresql_db
+
+setup_docker
+
+fetch_and_deploy_gh_release "calagopus-panel" "calagopus/panel" "singlefile" "latest" "/usr/local/bin" "panel-rs-aio-$(arch_resolve x86_64 aarch64)-linux"
+
+msg_info "Configuring Calagopus"
+mkdir -p /etc/calagopus /var/lib/calagopus /var/log/calagopus
+mkdir -p /etc/calagopus-wings /var/lib/calagopus-wings /var/log/calagopus-wings /tmp/calagopus-wings
+
+APP_ENCRYPTION_KEY=$(openssl rand -hex 16)
+cat <<EOF >/etc/calagopus/.env
+DATABASE_URL=postgresql://${PG_DB_USER}:${PG_DB_PASS}@localhost:5432/${PG_DB_NAME}
+DATABASE_MIGRATE=true
+REDIS_URL=redis://localhost
+PORT=8000
+APP_ENCRYPTION_KEY=${APP_ENCRYPTION_KEY}
+APP_LOG_DIRECTORY=/var/log/calagopus
+APP_PRIMARY=true
+APP_ENABLE_WINGS_PROXY=true
+APP_USE_DECRYPTION_CACHE=true
+APP_USE_INTERNAL_CACHE=true
+AIO_BASE_WINGS_CONFIGURATION=/etc/calagopus/wings-config.yml
+EOF
+chmod 600 /etc/calagopus/.env
+
+cat <<EOF >/etc/calagopus/wings-config.yml
+app_name: Calagopus
+EOF
+msg_ok "Configured Calagopus"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/calagopus-panel.service
+[Unit]
+Description=Calagopus Panel
+After=network.target postgresql.service valkey-server.service docker.service
+Requires=postgresql.service valkey-server.service docker.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/etc/calagopus
+EnvironmentFile=/etc/calagopus/.env
+ExecStart=/usr/local/bin/calagopus-panel
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now calagopus-panel
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc
@@ -28,11 +28,15 @@ cd /opt/cryptpad
 $STD npm ci --allow-git=all
 $STD npm run install:components
 if [[ "${onlyoffice,,}" =~ ^(y|yes)$ ]]; then
-  $STD bash -c "./install-onlyoffice.sh --accept-license"
+  $STD bash -c "./install-office.sh --accept-license"
 fi
 cp config/config.example.js config/config.js
-sed -i "51s/localhost/${LOCAL_IP}/g" /opt/cryptpad/config/config.js
-sed -i "80s#//httpAddress: 'localhost'#httpAddress: '0.0.0.0'#g" /opt/cryptpad/config/config.js
+cp config/infra.example.js config/infra.js
+sed -i \
+  -e "s|origin: \"http://localhost:3000\"|origin: \"http://${LOCAL_IP}:3000\"|" \
+  -e "s|sandboxOrigin: \"http://localhost:3001\"|sandboxOrigin: \"http://${LOCAL_IP}:3001\"|" \
+  -e "s|httpHost: \"localhost\"|httpHost: \"0.0.0.0\"|" \
+  config/infra.js
 $STD npm run build
 msg_ok "Setup CryptPad"

@@ -21,6 +21,7 @@ fetch_and_deploy_gh_release "donetick" "donetick/donetick" "prebuild" "latest" "

 msg_info "Setup Donetick"
 cd /opt/donetick
+[[ -f config/selfhosted.yaml ]] || cp config/selfhosted.yaml.example config/selfhosted.yaml
 TOKEN=$(openssl rand -hex 16)
 sed -i -e "s/change_this_to_a_secure_random_string_32_characters_long/${TOKEN}/g" config/selfhosted.yaml
 msg_ok "Setup Donetick"
@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/henriquesebastiao/downtify
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+setup_ffmpeg
+PYTHON_VERSION="3.14" setup_uv
+NODE_VERSION="26" setup_nodejs
+# yt-dlp solves YouTube's JavaScript challenges with Deno
+fetch_and_deploy_gh_release "deno" "denoland/deno" "prebuild" "latest" "/usr/local/bin" "deno-$(arch_resolve "x86_64" "aarch64")-unknown-linux-gnu.zip"
+fetch_and_deploy_gh_release "downtify" "henriquesebastiao/downtify" "tarball"
+
+msg_info "Building Downtify"
+cd /opt/downtify/frontend
+$STD npm ci
+$STD npm run build
+rm -rf /opt/downtify/frontend/node_modules
+cd /opt/downtify
+# pyproject.toml sets [tool.uv] upgrade = true, so --locked fails whenever PyPI has anything newer than uv.lock
+$STD uv sync --frozen --no-dev --python 3.14
+msg_ok "Built Downtify"
+
+msg_info "Configuring Downtify"
+mkdir -p /opt/downtify_data/{data,downloads}
+cat <<EOF >/opt/downtify_data/.env
+DATABASE_DIR=/opt/downtify_data/data
+DOWNLOAD_DIR=/opt/downtify_data/downloads
+EOF
+msg_ok "Configured Downtify"
+
+msg_info "Creating Downtify Service"
+cat <<EOF >/etc/systemd/system/downtify.service
+[Unit]
+Description=Downtify
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/downtify
+EnvironmentFile=/opt/downtify_data/.env
+Environment=WEB_GUI_LOCATION=/opt/downtify/frontend/dist
+ExecStart=/opt/downtify/.venv/bin/python /opt/downtify/main.py web
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now downtify
+msg_ok "Created Downtify Service"
+
+motd_ssh
+customize
+cleanup_lxc
@@ -44,6 +44,7 @@ User=root
 WorkingDirectory=/opt/droppedneedle/backend
 Environment=ROOT_APP_DIR=/opt/droppedneedle/backend
 Environment=PORT=8688
+Environment=COMMIT_TAG=v$(<~/.droppedneedle)
 # Environment=SLSKD_DOWNLOADS_PATH=<path-to-slskd-downloads>
 ExecStart=/opt/droppedneedle/venv/bin/python -m maintenance.automatic_upgrade --start-target
 Restart=on-failure
@@ -48,6 +48,7 @@ RestartSec=5
 Type=simple
 Environment="LOG_LEVEL=info"
 Environment="CAPTCHA_SOLVER=none"
+Environment="LANG=en-US"
 WorkingDirectory=/opt/flaresolverr
 ExecStart=/opt/flaresolverr/flaresolverr
 TimeoutStopSec=30
@@ -19,17 +19,15 @@ $STD apt install -y \
  nginx
 msg_ok "Installed Dependencies"

-PG_VERSION="17" PG_MODULES="postgis" setup_postgresql
+PG_VERSION="18" PG_MODULES="postgis" setup_postgresql
 PG_DB_NAME="geopulse" PG_DB_USER="geopulse" PG_DB_EXTENSIONS="postgis,postgis_topology" setup_postgresql_db

 msg_info "Generating Security Keys"
 mkdir -p /opt/geopulse/{backend,keys}
 mkdir -p /etc/geopulse /var/www/geopulse /var/lib/geopulse/dumps
 mkdir -p /var/log/geopulse/{backend,nginx}
-openssl genpkey -algorithm RSA -out /opt/geopulse/keys/jwt-private-key.pem 2>/dev/null
-openssl rsa -pubout -in /opt/geopulse/keys/jwt-private-key.pem -out /opt/geopulse/keys/jwt-public-key.pem 2>/dev/null
 openssl rand -base64 32 >/opt/geopulse/keys/ai-encryption-key.txt
-chmod 640 /opt/geopulse/keys/jwt-private-key.pem /opt/geopulse/keys/jwt-public-key.pem /opt/geopulse/keys/ai-encryption-key.txt
+chmod 640 /opt/geopulse/keys/ai-encryption-key.txt
 msg_ok "Generated Security Keys"

 if [[ "$(uname -m)" == "aarch64" ]]; then
@@ -62,8 +60,6 @@ GEOPULSE_POSTGRES_PORT=5432
 GEOPULSE_POSTGRES_DB=${PG_DB_NAME}
 GEOPULSE_POSTGRES_USERNAME=${PG_DB_USER}
 GEOPULSE_POSTGRES_PASSWORD=${PG_DB_PASS}
-GEOPULSE_JWT_PRIVATE_KEY_LOCATION=file:/opt/geopulse/keys/jwt-private-key.pem
-GEOPULSE_JWT_PUBLIC_KEY_LOCATION=file:/opt/geopulse/keys/jwt-public-key.pem
 GEOPULSE_AI_ENCRYPTION_KEY_LOCATION=file:/opt/geopulse/keys/ai-encryption-key.txt
 QUARKUS_LOG_FILE_ENABLE=true
 QUARKUS_LOG_FILE_PATH=/var/log/geopulse/backend/geopulse.log
@@ -128,6 +124,14 @@ server {
        add_header Cache-Control "public, max-age=31536000";
    }

+    location ~* ^/(?!osm/).*\.mjs$ {
+        types {
+            application/javascript mjs;
+        }
+        expires 1y;
+        add_header Cache-Control "public, max-age=31536000";
+    }
+
    location ^~ /osm/tiles/ {
        resolver 8.8.8.8 valid=300s;
        resolver_timeout 10s;
@@ -27,7 +27,7 @@ ln -sf /usr/sbin/openvpn /usr/sbin/openvpn2.6
 msg_ok "Configured iptables"


-fetch_and_deploy_gh_release "gluetun" "qdm12/gluetun" "tarball"
+fetch_and_deploy_gh_release "gluetun" "passteque/gluetun" "tarball"
 GO_VERSION="$(grep -m1 '^go ' /opt/gluetun/go.mod | awk '{print $2}')" setup_go

 msg_info "Building Gluetun"
@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os

-RELEASE="v3.3.0"
+RELEASE="v3.3.5"
 if lscpu | grep -q 'GenuineIntel'; then
  echo ""
  echo ""
@@ -25,7 +25,7 @@ if lscpu | grep -q 'GenuineIntel'; then
  echo " 2) **NEW** Intel OpenVINO CPU or iGPU"
  echo ""

-  read -r -p "${TAB3}Select machine-learning type [1]: " ML_TYPE
+  read -r -p "${TAB3}Select machine-learning type [1]: " ML_TYPE || true
  ML_TYPE="${ML_TYPE:-1}"
  if [[ "$ML_TYPE" == "2" ]]; then
    touch ~/.openvino
@@ -110,7 +110,7 @@ setup_deb822_repo \
  "https://repo.jellyfin.org/jellyfin_team.gpg.key" \
  "https://repo.jellyfin.org/debian" \
  "$(get_os_info codename)"
-$STD apt install -y jellyfin-ffmpeg7
+install_packages_with_retry jellyfin-ffmpeg7
 ln -sf /usr/lib/jellyfin-ffmpeg/ffmpeg /usr/bin/ffmpeg
 ln -sf /usr/lib/jellyfin-ffmpeg/ffprobe /usr/bin/ffprobe

@@ -124,12 +124,9 @@ if [[ "$CTTYPE" == "0" && -d /dev/dri ]]; then
 fi
 msg_ok "Dependencies Installed"

-msg_info "Installing Mise"
-curl -fSs https://mise.jdx.dev/gpg-key.pub | tee /etc/apt/keyrings/mise-archive-keyring.pub 1>/dev/null
-echo "deb [signed-by=/etc/apt/keyrings/mise-archive-keyring.pub arch=$(arch_resolve)] https://mise.jdx.dev/deb stable main" >/etc/apt/sources.list.d/mise.list
-apt_update_safe
-$STD apt install -y mise
-msg_ok "Installed Mise"
+MISE_ARCH="x64"
+[[ "$(arch_resolve)" == "arm64" ]] && MISE_ARCH="arm64"
+fetch_and_deploy_gh_release "mise" "jdx/mise" "singlefile" "latest" "/usr/local/bin" "mise-v*-linux-${MISE_ARCH}"

 msg_info "Configuring Debian Testing Repo"
 if [[ -f /etc/apt/sources.list.d/debian.sources ]]; then
@@ -268,8 +265,7 @@ msg_ok "(2/6) Compiled jpegli"

 msg_info "(3/6) Compiling libheif"
 SOURCE=${SOURCE_DIR}/libheif
-LIBHEIF_REVISION="ac1cb05c39008f01525c991ff8b88f84ddf70fd2"
-# : "${LIBHEIF_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libheif.json)}"
+LIBHEIF_REVISION="$(jq -cr '.revision' "$BASE_DIR"/server/sources/libheif.json)"
 $STD git clone https://github.com/strukturag/libheif.git "$SOURCE"
 cd "$SOURCE"
 $STD git reset --hard "$LIBHEIF_REVISION"
@@ -16,15 +16,17 @@ update_os
 msg_info "Setting up InvenTree Repository"
 setup_deb822_repo \
  "inventree" \
-  "https://dl.packager.io/srv/inventree/InvenTree/key" \
-  "https://dl.packager.io/srv/deb/inventree/InvenTree/stable/$(get_os_info id)" \
+  "https://go.packager.io/srv/deb/inventree/InvenTree/gpg-key.asc" \
+  "https://go.packager.io/srv/deb/inventree/InvenTree/stable/$(get_os_info id)" \
  "$(get_os_info version)" \
  "main"
 msg_ok "Set up InvenTree Repository"

 msg_info "Installing InvenTree (Patience)"
-export SETUP_NO_CALLS=true
-$STD apt install -y inventree
+# The package's postinst walks parent PIDs until it reaches PID 1; under pct exec the chain ends at 0
+# and since 1.6.0 that loops forever, so apt runs as a child of systemd
+$STD systemd-run --wait --pipe --quiet --collect --setenv=SETUP_NO_CALLS=true --setenv=DEBIAN_FRONTEND=noninteractive \
+  apt-get install -y inventree
 msg_ok "Installed InvenTree"

 msg_info "Configuring InvenTree"
@@ -33,7 +33,7 @@ fetch_and_deploy_gh_release "karakeep" "karakeep-app/karakeep" "tarball"
 cd /opt/karakeep
 # Node 24.19.x crashes better-sqlite3 on cleanup (karakeep-app/karakeep#2989); stay on 22 LTS until upstream reverts.
 MODULE_VERSION="$(jq -r '.packageManager | split("@")[1]' /opt/karakeep/package.json)"
-NODE_VERSION="22" NODE_MODULE="pnpm@${MODULE_VERSION}" setup_nodejs
+NODE_VERSION="24" NODE_MODULE="pnpm@${MODULE_VERSION}" setup_nodejs

 msg_info "Installing external JavaScript Extension for yt-dlp"
 $STD pip install -U yt-dlp-ejs --break-system-packages
@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Listenarrs/Listenarr
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y libicu-dev
+msg_ok "Installed Dependencies"
+
+GH_INCLUDE_PRERELEASE=1 fetch_and_deploy_gh_release "listenarr" "Listenarrs/Listenarr" "prebuild" "latest" "/opt/listenarr" "listenarr-*-linux-x64.zip"
+
+msg_info "Configuring Listenarr"
+mkdir -p /opt/listenarr_data
+ln -s /opt/listenarr/wwwroot /opt/listenarr_data/wwwroot
+msg_ok "Configured Listenarr"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/listenarr.service
+[Unit]
+Description=Listenarr
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/listenarr
+Environment=LISTENARR_CONTENT_ROOT=/opt/listenarr_data
+ExecStart=/opt/listenarr/Listenarr.Api
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now listenarr
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc
@@ -39,6 +39,12 @@ LOCALAI_MODELS_PATH=/opt/localai_data/models
 LOCALAI_BACKENDS_PATH=/opt/localai_data/backends
 LOCALAI_LOG_LEVEL=info
 EOF
+# LocalAI picks the backend variant from the GPU it sees in sysfs, which is the
+# host's card even when no driver was installed in here, and a CUDA/ROCm/SYCL
+# backend then never starts. Pin the CPU variants unless a runtime is present.
+if ! ldconfig -p 2>/dev/null | grep -qE 'libcuda[.]so|libamdhip64[.]so|libze_intel_gpu[.]so|libze_loader[.]so'; then
+  echo "LOCALAI_FORCE_META_BACKEND_CAPABILITY=default" >>/opt/localai.env
+fi
 # LocalAI refuses to start on a wildcard bind with nothing to identify callers,
 # and binding the wildcard is what makes the container reachable at all.
 if [[ "$var_auth" == "yes" ]]; then
@@ -98,6 +98,14 @@ PRODUCTION=true
 HOST=0.0.0.0
 PORT=9000
 BASE_URL=http://${LOCAL_IP}:9000
+
+# Reverse proxy auth (Mealie v3.29.0+). Disabled by default.
+# To enable: set REVERSE_PROXY_AUTH_ENABLED=true, set a secret, then restart mealie.
+# REVERSE_PROXY_AUTH_ENABLED=false
+# REVERSE_PROXY_AUTH_HEADER=X-Forwarded-User
+# REVERSE_PROXY_AUTH_SIGNUP_ENABLED=false
+# REVERSE_PROXY_AUTH_SECRET=
+# REVERSE_PROXY_AUTH_SECRET_HEADER=X-Mealie-Reverse-Proxy-Secret
 EOF
 msg_ok "Wrote Environment File"

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/autobrr/netronome
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  iperf3 \
+  iputils-ping \
+  mtr-tiny \
+  traceroute
+msg_ok "Installed Dependencies"
+
+fetch_and_deploy_gh_release "librespeed-cli" "librespeed/speedtest-cli" "prebuild" "latest" "/opt/librespeed-cli" "librespeed-cli_*_linux_$(arch_resolve).tar.gz"
+ln -sf /opt/librespeed-cli/librespeed-cli /usr/local/bin/librespeed-cli
+fetch_and_deploy_gh_release "netronome" "autobrr/netronome" "binary" "latest" "" "netronome_*_linux_$(arch_resolve).deb" "v"
+
+msg_info "Configuring Netronome"
+mkdir -p /opt/netronome_data /root/.config
+$STD netronome generate-config --config /opt/netronome_data/config.toml
+sed -i 's/^host = "127.0.0.1"$/host = "0.0.0.0"/' /opt/netronome_data/config.toml
+chmod 600 /opt/netronome_data/config.toml
+ln -s /opt/netronome_data /root/.config/netronome
+msg_ok "Configured Netronome"
+
+msg_info "Creating Netronome Service"
+cat <<EOF >/etc/systemd/system/netronome.service
+[Unit]
+Description=Netronome
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/netronome_data
+ExecStart=/usr/bin/netronome serve --config /opt/netronome_data/config.toml
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now netronome
+msg_ok "Created Netronome Service"
+
+motd_ssh
+customize
+cleanup_lxc
@@ -0,0 +1,92 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/norish-recipes/norish
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y redis-server
+msg_ok "Installed Dependencies"
+
+PG_VERSION="17" setup_postgresql
+PG_DB_NAME="norish" PG_DB_USER="norish" setup_postgresql_db
+PYTHON_VERSION="3.14" setup_uv
+
+fetch_and_deploy_gh_release "norish" "norish-recipes/norish" "tarball"
+NODE_VERSION="22" NODE_MODULE="pnpm@$(jq -r '.packageManager | split("@")[1]' /opt/norish/package.json)" setup_nodejs
+fetch_and_deploy_gh_release "obscura" "h4ckf0r0day/obscura" "prebuild" "v$(sed -n 's/^OBSCURA_VERSION=//p' /opt/norish/docker/obscura/pin.env)" "/opt/obscura" "obscura-$(arch_resolve "x86_64" "aarch64")-linux-stealth.tar.gz"
+fetch_and_deploy_gh_release "yt-dlp" "yt-dlp/yt-dlp" "singlefile" "latest" "/usr/local/bin" "$(arch_resolve "yt-dlp_linux" "yt-dlp_linux_aarch64")"
+
+msg_info "Building Norish"
+cd /opt/norish
+$STD pnpm install --frozen-lockfile --filter "@norish/web..." --filter norish
+$STD uv sync --project /opt/norish/apps/parser-api --locked
+NODE_ENV=production SKIP_ENV_VALIDATION=1 NEXT_TELEMETRY_DISABLED=1 $STD pnpm turbo run build --filter "@norish/web"
+rm -rf /opt/norish/apps/web/.next/cache /opt/norish/apps/web/.next/standalone
+msg_ok "Built Norish"
+
+msg_info "Configuring Norish"
+mkdir -p /opt/norish_data/uploads
+cat <<EOF >/opt/norish_data/.env
+NODE_ENV=production
+NEXT_TELEMETRY_DISABLED=1
+AUTH_URL=http://${LOCAL_IP}:3000
+DATABASE_URL=postgresql://norish:${PG_DB_PASS}@localhost:5432/norish
+MASTER_KEY=$(openssl rand -base64 32)
+REDIS_URL=redis://127.0.0.1:6379
+OBSCURA_ENDPOINT=ws://127.0.0.1:9222
+UPLOADS_DIR=/opt/norish_data/uploads
+YT_DLP_BIN_DIR=/usr/local/bin
+EOF
+chmod 600 /opt/norish_data/.env
+msg_ok "Configured Norish"
+
+msg_info "Creating Services"
+cat <<EOF >/etc/systemd/system/obscura.service
+[Unit]
+Description=Obscura headless browser for Norish URL imports
+After=network.target
+
+[Service]
+Type=simple
+ExecStart=/opt/obscura/obscura serve --host 127.0.0.1 --port 9222 --stealth
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+cat <<EOF >/etc/systemd/system/norish.service
+[Unit]
+Description=Norish
+After=network.target postgresql.service redis-server.service obscura.service
+Requires=postgresql.service redis-server.service
+Wants=obscura.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/norish
+EnvironmentFile=/opt/norish_data/.env
+ExecStart=/usr/bin/node /opt/norish/dist-server/index.mjs
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now obscura norish
+msg_ok "Created Services"
+
+motd_ssh
+customize
+cleanup_lxc
@@ -24,11 +24,11 @@ JAVA_VERSION="21" setup_java
 msg_info "Installing OneDev"
 RELEASE=$(get_latest_github_release "theonedev/onedev" false)
 cd /opt
-curl -fsSL "https://code.onedev.io/onedev/server/~site/onedev-latest.tar.gz" -o onedev-latest.tar.gz
+curl -fsSL "https://code.onedev.io/onedev/server/~sites/public/onedev-latest.tar.gz" -o onedev-latest.tar.gz
 tar -xzf onedev-latest.tar.gz
 mv /opt/onedev-latest /opt/onedev
 $STD /opt/onedev/bin/server.sh install
-systemctl start onedev
+systemctl start onedev.server
 rm -rf /opt/onedev-latest.tar.gz
 echo "${RELEASE}" >~/.onedev
 msg_ok "Installed OneDev"
@@ -0,0 +1,158 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/DuarteSantos8/openGym
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y nginx
+msg_ok "Installed Dependencies"
+
+NODE_VERSION="22" setup_nodejs
+fetch_and_deploy_gh_release "opengym" "DuarteSantos8/openGym" "tarball" "latest" "/opt/opengym" "" "v"
+
+msg_info "Building openGym"
+cd /opt/opengym/api
+$STD npm ci --omit=dev --omit=optional
+cd /opt/opengym/frontend
+# Like upstream's web/Dockerfile: skips sharp's libvips download, which only draws the mobile app icons
+$STD npm ci --ignore-scripts
+$STD npm run build
+rm -rf /opt/opengym/frontend/node_modules ~/.npm
+msg_ok "Built openGym"
+
+msg_info "Configuring openGym"
+mkdir -p /opt/opengym_data
+cat <<EOF >/opt/opengym_data/.env
+PORT=3000
+DATA_DIR=/opt/opengym_data
+RP_NAME=openGym
+# Passkeys need HTTPS on a hostname. Behind a reverse proxy set both to the address in the browser,
+# e.g. RP_ID=gym.example.com and ORIGIN=https://gym.example.com, then: systemctl restart opengym
+RP_ID=${LOCAL_IP}
+ORIGIN=http://${LOCAL_IP}
+PASSWORD_LOGIN=1
+FIRST_USER_ADMIN=1
+EOF
+chmod 600 /opt/opengym_data/.env
+msg_ok "Configured openGym"
+
+msg_info "Creating openGym Service"
+cat <<EOF >/etc/systemd/system/opengym.service
+[Unit]
+Description=openGym API
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/opengym/api
+EnvironmentFile=/opt/opengym_data/.env
+Environment=NODE_ENV=production
+ExecStart=/usr/bin/node server.js
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now opengym
+msg_ok "Created openGym Service"
+
+msg_info "Configuring Nginx"
+cat <<'EOF' >/etc/nginx/sites-available/opengym
+server {
+    listen 80 default_server;
+    server_name _;
+    root /opt/opengym/frontend/dist;
+    index index.html;
+    absolute_redirect off;
+
+    add_header X-Frame-Options "DENY" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "same-origin" always;
+    add_header Content-Security-Policy "frame-ancestors 'none'" always;
+
+    location ^~ /api/ {
+        client_max_body_size 5m;
+        proxy_pass http://127.0.0.1:3000;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header CF-Connecting-IP "";
+        proxy_read_timeout 300s;
+        proxy_send_timeout 300s;
+    }
+
+    location ^~ /api/media/ {
+        client_max_body_size 48m;
+        proxy_request_buffering off;
+        proxy_buffering off;
+        proxy_pass http://127.0.0.1:3000;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $remote_addr;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header CF-Connecting-IP "";
+        proxy_read_timeout 300s;
+        proxy_send_timeout 300s;
+    }
+
+    location / {
+        try_files $uri $uri/ @root;
+    }
+
+    location @root {
+        return 302 /$is_args$args;
+    }
+
+    location ~* \.(js|css|json|html)$ {
+        add_header Cache-Control "no-cache, must-revalidate";
+        add_header X-Frame-Options "DENY" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "same-origin" always;
+        add_header Content-Security-Policy "frame-ancestors 'none'" always;
+    }
+
+    location ^~ /exercise-media/ {
+        alias /opt/opengym/catalogue/media/;
+        add_header Cache-Control "public, max-age=2592000, immutable";
+        add_header Cross-Origin-Resource-Policy "same-origin" always;
+        add_header X-Frame-Options "DENY" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "same-origin" always;
+        add_header Content-Security-Policy "frame-ancestors 'none'" always;
+    }
+
+    location ~* \.(png|jpg|jpeg|gif|ico|svg|woff|woff2|webp|avif|mp4)$ {
+        add_header Cache-Control "public, max-age=2592000, immutable";
+        add_header X-Frame-Options "DENY" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Referrer-Policy "same-origin" always;
+        add_header Content-Security-Policy "frame-ancestors 'none'" always;
+    }
+
+    gzip on;
+    gzip_types text/plain text/css application/json application/javascript image/svg+xml;
+    gzip_vary on;
+    gzip_min_length 1024;
+}
+EOF
+nginx_enable_site "opengym"
+msg_ok "Configured Nginx"
+
+motd_ssh
+customize
+cleanup_lxc
@@ -47,10 +47,13 @@ if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
 fi

 msg_info "Installing Open WebUI"
-for attempt in $(seq 1 3); do
-  $STD uv tool install --python 3.12 --constraint <(echo "numba>=0.60") "${OTEL_ARGS[@]}" open-webui[all] && break
-  [[ $attempt -lt 3 ]] && msg_warn "Open WebUI install attempt $attempt failed, retrying..." && sleep 10
+installed=0
+for attempt in 1 2; do
+  $STD uv tool install --python 3.12 "${OTEL_ARGS[@]}" open-webui[all] && { installed=1; break; }
+  msg_warn "Open WebUI install attempt $attempt failed, retrying..."
+  sleep 10
 done
+((installed)) || $STD uv tool install --python 3.12 "${OTEL_ARGS[@]}" open-webui[all]
 msg_ok "Installed Open WebUI"

 prompt="${var_openwebui_ollama:-}"
@@ -31,7 +31,11 @@ msg_info "Building Paperclip"
 cd /opt/paperclip-ai
 export HUSKY=0
 export NODE_OPTIONS="--max-old-space-size=8192"
-$STD pnpm install --frozen-lockfile
+# Upstream tags ship with a stale pnpm-lock.yaml now and then (paperclipai/paperclip#13923).
+$STD pnpm install --frozen-lockfile || {
+  msg_warn "The lockfile of this release is out of date, resolving dependencies without it"
+  $STD pnpm install --no-frozen-lockfile
+}
 $STD pnpm build
 unset NODE_OPTIONS
 msg_ok "Built Paperclip"
@@ -26,8 +26,7 @@ fetch_and_deploy_gh_release "pelican-panel" "pelican-dev/panel" "prebuild" "late
 msg_info "Installing Pelican Panel"
 cd /opt/pelican-panel
 $STD composer install --no-dev --optimize-autoloader --no-interaction
-$STD php artisan p:environment:setup
-sed -i "s|^APP_URL=.*|APP_URL=http://${LOCAL_IP}|" /opt/pelican-panel/.env
+$STD php artisan p:environment:setup --url="http://${LOCAL_IP}"
 echo "yes" | $STD php artisan p:environment:database --driver mariadb --host localhost --port 3306 --database "$MARIADB_DB_NAME" --username "$MARIADB_DB_USER" --password "$MARIADB_DB_PASS"
 $STD php artisan p:environment:queue-service --no-interaction
 echo "* * * * * php /opt/pelican-panel/artisan schedule:run >> /dev/null 2>&1" | crontab -u www-data -
@@ -43,7 +43,7 @@ $STD rabbitmqctl add_user plane "${RABBITMQ_PASS}"
 $STD rabbitmqctl set_permissions -p plane plane ".*" ".*" ".*"
 msg_ok "Configured RabbitMQ"

-fetch_and_deploy_gh_release "silo" "pgsty/silo" "prebuild" "latest" "/opt/silo" "silo_*_linux_$(arch_resolve).tar.gz"
+fetch_and_deploy_gh_release "silo_s3" "pgsty/silo" "prebuild" "latest" "/opt/silo" "silo_*_linux_$(arch_resolve).tar.gz"
 fetch_and_deploy_gh_release "silo_mcli" "pgsty/mc" "prebuild" "latest" "/opt/mcli" "mcli_*_linux_$(arch_resolve).tar.gz"

 msg_info "Configuring Silo"
@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/adminsyspro/proxcenter-ui
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+NODE_VERSION="26" setup_nodejs
+PG_VERSION="16" setup_postgresql
+PG_DB_NAME="proxcenter" PG_DB_USER="proxcenter" setup_postgresql_db
+
+fetch_and_deploy_gh_release "proxcenter" "adminsyspro/proxcenter-ui" "tarball"
+
+msg_info "Building ProxCenter"
+cd /opt/proxcenter/frontend
+$STD npm ci --legacy-peer-deps --ignore-scripts
+$STD npm run build:icons
+$STD npx prisma generate
+NODE_OPTIONS="--max-old-space-size=4608" $STD npm run build
+msg_ok "Built ProxCenter"
+
+msg_info "Configuring ProxCenter"
+mkdir -p /opt/proxcenter_data
+cat <<EOF >/opt/proxcenter_data/.env
+NODE_ENV=production
+DATABASE_URL=postgresql://${PG_DB_USER}:${PG_DB_PASS}@localhost:5432/${PG_DB_NAME}?schema=public
+APP_SECRET=$(openssl rand -base64 32)
+NEXTAUTH_SECRET=$(openssl rand -base64 32)
+NEXTAUTH_URL=http://${LOCAL_IP}:3000
+APP_URL=http://${LOCAL_IP}:3000
+PROXCENTER_INSTANCE_ID=proxcenter
+EOF
+chmod 600 /opt/proxcenter_data/.env
+msg_ok "Configured ProxCenter"
+
+msg_info "Migrating Database"
+set -a && source /opt/proxcenter_data/.env && set +a
+$STD npx prisma migrate deploy
+$STD npx prisma db seed
+msg_ok "Migrated Database"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/proxcenter.service
+[Unit]
+Description=ProxCenter
+After=network.target postgresql.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/proxcenter/frontend
+EnvironmentFile=/opt/proxcenter_data/.env
+ExecStart=/usr/bin/node start.js
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now proxcenter
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc
@@ -63,6 +63,20 @@ fi
 msg_ok "Built ReadMeABook"

 msg_info "Creating Service"
+cat <<'EOF' >/usr/local/bin/readmeabook-init
+#!/usr/bin/env bash
+# Upstream's image calls /api/init after every start: it creates the scheduled jobs and starts the scheduler
+url="http://127.0.0.1:${PORT:-3030}"
+for _ in $(seq 1 60); do curl -sf -o /dev/null "$url/api/health" && break; sleep 1; done
+for _ in $(seq 1 30); do [[ "$(redis-cli ping 2>/dev/null)" == PONG ]] && break; sleep 1; done
+for attempt in 1 2 3 4 5; do
+  curl -sf -o /dev/null "$url/api/init" && exit 0
+  sleep "$attempt"
+done
+echo "ReadMeABook did not answer /api/init, scheduled jobs will not run" >&2
+exit 1
+EOF
+chmod +x /usr/local/bin/readmeabook-init
 cat <<EOF >/etc/systemd/system/readmeabook.service
 [Unit]
 Description=ReadMeABook
@@ -75,6 +89,8 @@ User=root
 WorkingDirectory=/opt/readmeabook
 EnvironmentFile=/opt/readmeabook/.env
 ExecStart=${START_CMD}
+ExecStartPost=-/usr/local/bin/readmeabook-init
+TimeoutStartSec=180
 Restart=on-failure
 RestartSec=10

@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os

-fetch_and_deploy_gh_release "silo" "pgsty/silo" "binary"
+fetch_and_deploy_gh_release "silo_s3" "pgsty/silo" "binary"

 msg_info "Configuring Silo"
 mkdir -p /opt/silo_data
@@ -17,7 +17,7 @@ msg_info "Installing Dependencies"
 $STD apt install -y sqlite3 libicu-dev
 msg_ok "Installed Dependencies"

-fetch_and_deploy_gh_release "Sonarr" "Sonarr/Sonarr" "prebuild" "latest" "/opt/Sonarr" "Sonarr.main.*.linux-$(arch_resolve "x64" "arm64").tar.gz"
+fetch_and_deploy_gh_release "Sonarr" "Sonarr/Sonarr" "prebuild" "latest" "/opt/Sonarr" "Sonarr.main.*.linux-$(arch_resolve "x64" "arm64").tar.gz" "v4."
 mkdir -p /var/lib/sonarr/
 chmod 775 /var/lib/sonarr/

@@ -20,7 +20,7 @@ msg_ok "Installed Dependencies"
 NODE_VERSION="26" NODE_MODULE="yarn,node-gyp" setup_nodejs
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="wiki" PG_DB_USER="wikijs_user" PG_DB_EXTENSIONS="pg_trgm" setup_postgresql_db
-fetch_and_deploy_gh_release "wikijs" "requarks/wiki" "prebuild" "latest" "/opt/wikijs" "wiki-js.tar.gz"
+fetch_and_deploy_gh_release "wikijs" "requarks/wiki-v2" "prebuild" "latest" "/opt/wikijs" "wiki-js.tar.gz"

 msg_info "Configuring Wiki.js"
 mv /opt/wikijs/config.sample.yml /opt/wikijs/config.yml
@@ -0,0 +1,85 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/DialmasterOrg/Youtarr
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  atomicparsley \
+  python3
+msg_ok "Installed Dependencies"
+
+setup_ffmpeg
+setup_mariadb
+MARIADB_DB_NAME="youtarr" MARIADB_DB_USER="youtarr" setup_mariadb_db
+NODE_VERSION="24" setup_nodejs
+setup_uv
+
+msg_info "Installing Apprise"
+UV_TOOL_BIN_DIR=/usr/local/bin $STD uv tool install apprise
+msg_ok "Installed Apprise"
+
+fetch_and_deploy_gh_release "deno" "denoland/deno" "prebuild" "latest" "/usr/local/bin" "deno-$(arch_resolve "x86_64" "aarch64")-unknown-linux-gnu.zip"
+fetch_and_deploy_gh_release "yt-dlp" "yt-dlp/yt-dlp" "singlefile" "latest" "/usr/local/bin" "yt-dlp_$(arch_resolve "linux" "linux_aarch64")"
+fetch_and_deploy_gh_release "youtarr" "DialmasterOrg/Youtarr" "tarball"
+
+msg_info "Building Youtarr"
+cd /opt/youtarr/client
+$STD npm ci --ignore-scripts
+$STD npm run build
+rm -rf /opt/youtarr/client/node_modules
+cd /opt/youtarr
+$STD npm ci --omit=dev --ignore-scripts
+msg_ok "Built Youtarr"
+
+msg_info "Configuring Youtarr"
+mkdir -p /opt/youtarr_data/config /opt/youtarr_data/videos
+mv /opt/youtarr/config/config.example.json /opt/youtarr/server/
+rm -rf /opt/youtarr/config
+ln -sfn /opt/youtarr_data/config /opt/youtarr/config
+cat <<EOF >/opt/youtarr_data/.env
+PORT=3011
+DB_HOST=127.0.0.1
+DB_PORT=3306
+DB_NAME=youtarr
+DB_USER=youtarr
+DB_PASSWORD=${MARIADB_DB_PASS}
+DATA_PATH=/opt/youtarr_data/videos
+EOF
+chmod 600 /opt/youtarr_data/.env
+msg_ok "Configured Youtarr"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/youtarr.service
+[Unit]
+Description=Youtarr
+After=network.target mariadb.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/youtarr
+EnvironmentFile=/opt/youtarr_data/.env
+ExecStart=/usr/bin/node server/server.js
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now youtarr
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc
@@ -16,29 +16,31 @@ update_os
 msg_info "Installing Dependencies"
 $STD apt install -y \
  git \
-  nginx \
-  apt-transport-https
+  nginx
 msg_ok "Installed Dependencies"

 msg_info "Setting up Elasticsearch"
 setup_deb822_repo \
  "elasticsearch" \
  "https://artifacts.elastic.co/GPG-KEY-elasticsearch" \
-  "https://artifacts.elastic.co/packages/7.x/apt" \
+  "https://artifacts.elastic.co/packages/8.x/apt" \
  "stable" \
  "main"
-$STD apt install -y elasticsearch
-sed -i 's/^#\{0,2\} *-Xms[0-9]*g.*/-Xms2g/' /etc/elasticsearch/jvm.options
-sed -i 's/^#\{0,2\} *-Xmx[0-9]*g.*/-Xmx2g/' /etc/elasticsearch/jvm.options
+ES_JAVA_OPTS="-Xms1g -Xmx1g" $STD apt install -y elasticsearch
+cat <<EOF >/etc/elasticsearch/jvm.options.d/heap.options
+-Xms2g
+-Xmx2g
+EOF
 cat <<EOF >/etc/elasticsearch/elasticsearch.yml
 path.data: /var/lib/elasticsearch
 path.logs: /var/log/elasticsearch
 discovery.type: single-node
 network.host: 127.0.0.1
 xpack.security.enabled: false
+xpack.security.transport.ssl.enabled: false
+xpack.security.http.ssl.enabled: false
 bootstrap.memory_lock: false
 EOF
-$STD /usr/share/elasticsearch/bin/elasticsearch-plugin install ingest-attachment -b
 systemctl daemon-reload
 systemctl enable -q elasticsearch
 systemctl restart -q elasticsearch
@@ -53,8 +55,8 @@ msg_ok "Setup Elasticsearch"
 msg_info "Installing Zammad"
 setup_deb822_repo \
  "zammad" \
-  "https://dl.packager.io/srv/zammad/zammad/key" \
-  "https://dl.packager.io/srv/deb/zammad/zammad/stable/debian" \
+  "https://go.packager.io/srv/deb/zammad/zammad/gpg-key.asc" \
+  "https://go.packager.io/srv/deb/zammad/zammad/stable/debian" \
  "$(get_os_info version_id)" \
  "main"
 $STD apt install -y zammad
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash

 # Copyright (c) 2021-2026 community-scripts ORG
-# Author: dave-yap
+# Author: dave-yap (dave-yap) | Co-Author: remz1337, MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://zitadel.com/ | Github: https://github.com/zitadel/zitadel

@@ -13,132 +13,174 @@ setting_up_container
 network_check
 update_os

-msg_info "Installing Dependencies (Patience)"
-$STD apt install -y ca-certificates lsof
-msg_ok "Installed Dependecies"
+var_zitadel_login="${var_zitadel_login:-v2}"

 PG_VERSION="17" setup_postgresql
-
-msg_info "Installing Postgresql"
-DB_NAME="zitadel"
-DB_USER="zitadel"
-DB_PASS=$(random_password 13)
-DB_ADMIN_USER="root"
-DB_ADMIN_PASS=$(random_password 13)
-systemctl start postgresql
-$STD sudo -u postgres psql -c "CREATE USER $DB_USER WITH PASSWORD '$DB_PASS';"
-$STD sudo -u postgres psql -c "CREATE USER $DB_ADMIN_USER WITH PASSWORD '$DB_ADMIN_PASS' SUPERUSER;"
-$STD sudo -u postgres psql -c "CREATE DATABASE $DB_NAME OWNER $DB_ADMIN_USER;"
-cat <<EOF >~/zitadel.creds
-Application Credentials
-DB_NAME: $DB_NAME
-DB_USER: $DB_USER
-DB_PASS: $DB_PASS
-DB_ADMIN_USER: $DB_ADMIN_USER
-DB_ADMIN_PASS: $DB_ADMIN_PASS
-EOF
-msg_ok "Installed PostgreSQL"
-
+PG_DB_NAME="zitadel" PG_DB_USER="zitadel" setup_postgresql_db
 fetch_and_deploy_gh_release "zitadel" "zitadel/zitadel" "prebuild" "latest" "/usr/local/bin" "zitadel-linux-$(arch_resolve).tar.gz"

-msg_info "Setting up Zitadel Environments"
+msg_info "Configuring Zitadel"
 mkdir -p /opt/zitadel
-echo "/opt/zitadel/config.yaml" >"/opt/zitadel/.config"
-random_password 32 >"/opt/zitadel/.masterkey"
-cat <<EOF >~/zitadel.creds
-Config location: $(cat "/opt/zitadel/.config")
-Masterkey: $(cat "/opt/zitadel/.masterkey")
-EOF
+random_password 32 >/opt/zitadel/.masterkey
+ADMIN_PASS="$(random_password 20)Aa1!"
 cat <<EOF >/opt/zitadel/config.yaml
-Port: 8080
+ExternalDomain: ${LOCAL_IP}
 ExternalPort: 8080
-ExternalDomain: localhost
-ExternalSecure: false
 TLS:
  Enabled: false
-  KeyPath: ""
-  Key: ""
-  CertPath: ""
-  Cert: ""
-
 Database:
  postgres:
    Host: localhost
    Port: 5432
-    Database: ${DB_NAME}
+    Database: zitadel
    User:
-      Username: ${DB_USER}
-      Password: ${DB_PASS}
+      Username: zitadel
+      Password: ${PG_DB_PASS}
      SSL:
        Mode: disable
-        RootCert: ""
-        Cert: ""
-        Key: ""
-    Admin:
-      Username: ${DB_ADMIN_USER}
-      Password: ${DB_ADMIN_PASS}
-      SSL:
-        Mode: disable
-        RootCert: ""
-        Cert: ""
-        Key: ""
+EOF
+if [[ "$var_zitadel_login" == "v1" ]]; then
+  cat <<EOF >>/opt/zitadel/config.yaml
+Port: 8080
+ExternalSecure: false
 DefaultInstance:
  Features:
    LoginV2:
      Required: false
+FirstInstance:
+  Org:
+    Human:
+      UserName: zitadel-admin@zitadel.localhost
+      Password: ${ADMIN_PASS}
+      PasswordChangeRequired: true
 EOF
-msg_ok "Installed Zitadel Enviroments"
+else
+  cat <<EOF >>/opt/zitadel/config.yaml
+Port: 8081
+ExternalSecure: true
+DefaultInstance:
+  Features:
+    LoginV2:
+      Required: true
+FirstInstance:
+  LoginClientPatPath: /opt/zitadel/login-client.pat
+  Org:
+    Human:
+      UserName: zitadel-admin@zitadel.localhost
+      Password: ${ADMIN_PASS}
+      PasswordChangeRequired: true
+    LoginClient:
+      Machine:
+        Username: login-client
+        Name: Automatically Initialized IAM_LOGIN_CLIENT
+      Pat:
+        ExpirationDate: 2099-01-01T00:00:00Z
+EOF
+fi
+chmod 600 /opt/zitadel/.masterkey /opt/zitadel/config.yaml
+msg_ok "Configured Zitadel"

-msg_info "Creating Services"
+msg_info "Initializing Zitadel"
+$STD zitadel init zitadel --config /opt/zitadel/config.yaml
+$STD zitadel setup --masterkeyFile /opt/zitadel/.masterkey --config /opt/zitadel/config.yaml --steps /opt/zitadel/config.yaml
+cat <<EOF >>~/zitadel.creds
+
+Zitadel Admin
+Username: zitadel-admin@zitadel.localhost
+Initial Password: ${ADMIN_PASS}
+EOF
+chmod 600 ~/zitadel.creds
+msg_ok "Initialized Zitadel"
+
+msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/zitadel.service
 [Unit]
-Description=ZITADEL Identiy Server
+Description=Zitadel
 After=network.target postgresql.service
 Wants=postgresql.service

 [Service]
 Type=simple
-User=zitadel
-Group=zitadel
-ExecStart=/usr/local/bin/zitadel start --masterkeyFile "/opt/zitadel/.masterkey" --config "/opt/zitadel/config.yaml"
+ExecStart=/usr/local/bin/zitadel start --masterkeyFile /opt/zitadel/.masterkey --config /opt/zitadel/config.yaml
 Restart=always
 RestartSec=5
-TimeoutStartSec=0
-
-# Security Hardening options
-ProtectSystem=full
-ProtectHome=true
-PrivateTmp=true
-NoNewPrivileges=true

 [Install]
 WantedBy=multi-user.target
 EOF
 systemctl enable -q --now zitadel
-msg_ok "Created Services"
+msg_ok "Created Service"

-msg_info "Zitadel initial setup"
-zitadel start-from-init --masterkeyFile /opt/zitadel/.masterkey --config /opt/zitadel/config.yaml &>/dev/null &
-sleep 60
-kill $(lsof -i | awk '/zitadel/ {print $2}' | head -n1)
-useradd zitadel
-msg_ok "Zitadel initialized"
+if [[ "$var_zitadel_login" != "v1" ]]; then
+  NODE_VERSION="24" setup_nodejs
+  fetch_and_deploy_gh_release "zitadel-login" "zitadel/zitadel" "prebuild" "latest" "/opt/zitadel-login" "zitadel-login.tar.gz"

-msg_info "Set ExternalDomain to current IP and restart Zitadel"
-IP=$(ip a s dev eth0 | awk '/inet / {print $2}' | cut -d/ -f1)
-sed -i "0,/localhost/s/localhost/${IP}/" /opt/zitadel/config.yaml
-systemctl stop -q zitadel
-$STD zitadel setup --masterkeyFile /opt/zitadel/.masterkey --config /opt/zitadel/config.yaml
-systemctl restart -q zitadel
-msg_ok "Zitadel restarted with ExternalDomain set to current IP"
-
-msg_info "Create zitadel-rerun.sh"
-cat <<EOF >~/zitadel-rerun.sh
-systemctl stop zitadel
-timeout --kill-after=5s 15s zitadel setup --masterkeyFile /opt/zitadel/.masterkey --config /opt/zitadel/config.yaml
-systemctl restart zitadel
+  msg_info "Setting up Zitadel Login"
+  $STD apt install -y nginx
+  create_self_signed_cert "zitadel"
+  cat <<EOF >/opt/zitadel/login.env
+ZITADEL_API_URL=http://127.0.0.1:8081
+ZITADEL_API_AWAITINITIALCONN=5m
+ZITADEL_SERVICE_USER_TOKEN_FILE=/opt/zitadel/login-client.pat
+ZITADEL_SESSION_COOKIE_SECRET=$(random_password 48)
+NEXT_PUBLIC_BASE_PATH=/ui/v2/login
+HOSTNAME=127.0.0.1
+PORT=3000
 EOF
-msg_ok "Bash script for rerunning Zitadel after changing Zitadel config.yaml"
+  chmod 600 /opt/zitadel/login.env /opt/zitadel/login-client.pat
+  cat <<EOF >/etc/systemd/system/zitadel-login.service
+[Unit]
+Description=Zitadel Login
+After=network.target zitadel.service
+Wants=zitadel.service
+
+[Service]
+Type=simple
+WorkingDirectory=/opt/zitadel-login
+EnvironmentFile=/opt/zitadel/login.env
+ExecStart=/opt/zitadel-login/entrypoint.sh node apps/login/server.js
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+  systemctl enable -q --now zitadel-login
+  cat <<'EOF' >/etc/nginx/sites-available/zitadel
+server {
+    listen 8080 ssl;
+    http2 on;
+    server_name _;
+    ssl_certificate /etc/ssl/zitadel/zitadel.crt;
+    ssl_certificate_key /etc/ssl/zitadel/zitadel.key;
+    error_page 497 =301 https://$http_host$request_uri;
+
+    location = / {
+        return 302 /ui/v2/login/;
+    }
+
+    location /ui/v2/login {
+        proxy_pass http://127.0.0.1:3000;
+        proxy_http_version 1.1;
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+
+    location /api/ {
+        rewrite ^/api(/.*)$ $1 break;
+        grpc_pass grpc://127.0.0.1:8081;
+        grpc_set_header Host $http_host;
+    }
+
+    location / {
+        grpc_pass grpc://127.0.0.1:8081;
+        grpc_set_header Host $http_host;
+    }
+}
+EOF
+  nginx_enable_site "zitadel"
+  msg_ok "Set up Zitadel Login"
+fi

 motd_ssh
 customize