mongodb, paperless-gpt: accept yes as well as y

install: answer every prompt from the environment, survive a closed stdin
Every interactive prompt takes a var_<app>_<name> override and treats a closed stdin like Enter (`|| true`), so an install keeps going after the console that started it is gone. Values the script cannot do without end with exit 64 and name the variable to set. Validation loops stop asking when nobody can answer instead of spinning on an empty read.
2026-10-24 04:05:03 +00:00 · 2026-10-23 20:50:49 +02:00 · 2026-10-23 20:44:37 +02:00 · 2026-10-23 13:50:36 +00:00 · 2026-10-23 13:50:10 +00:00 · 2026-10-23 15:50:05 +02:00
108 changed files with 1276 additions and 882 deletions
@@ -565,8 +565,148 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 </details>

+## 2026-10-23
+
+### 🚀 Updated Scripts
+
+  - postgresql: default the version prompt and match Alpine's packages [@MickLesk](https://github.com/MickLesk) ([#18093](https://github.com/community-scripts/ProxmoxVE/pull/18093))
+- Storyteller: build the runtime like upstream's Dockerfile [@MickLesk](https://github.com/MickLesk) ([#18083](https://github.com/community-scripts/ProxmoxVE/pull/18083))
+
+  - #### 🐞 Bug Fixes
+
+    - proxcenter: skip the type check and lower the build heap [@MickLesk](https://github.com/MickLesk) ([#18090](https://github.com/community-scripts/ProxmoxVE/pull/18090))
+    - hermesagent: retry the installer download, fall back to GitHub [@MickLesk](https://github.com/MickLesk) ([#18091](https://github.com/community-scripts/ProxmoxVE/pull/18091))
+    - zabbix: use the arm64 repository for 7.0 [@MickLesk](https://github.com/MickLesk) ([#18089](https://github.com/community-scripts/ProxmoxVE/pull/18089))
+    - kasm: survive a failed release lookup and answer the installer with flags [@MickLesk](https://github.com/MickLesk) ([#18092](https://github.com/community-scripts/ProxmoxVE/pull/18092))
+
+  - #### ✨ New Features
+
+    - InvoiceShelf: run the Laravel scheduler [@MickLesk](https://github.com/MickLesk) ([#18079](https://github.com/community-scripts/ProxmoxVE/pull/18079))
+
+  - #### 🔧 Refactor
+
+    - podman-homeassistant: require Debian 13 [@MickLesk](https://github.com/MickLesk) ([#18095](https://github.com/community-scripts/ProxmoxVE/pull/18095))
+    - apache-guacamole: require Debian 13 [@MickLesk](https://github.com/MickLesk) ([#18094](https://github.com/community-scripts/ProxmoxVE/pull/18094))
+    - unifi-os-server: require Debian 13 [@MickLesk](https://github.com/MickLesk) ([#18096](https://github.com/community-scripts/ProxmoxVE/pull/18096))
+    - openwebui: drop the Intel oneAPI Base Toolkit [@MickLesk](https://github.com/MickLesk) ([#18098](https://github.com/community-scripts/ProxmoxVE/pull/18098))
+    - ollama: drop the Intel oneAPI Base Toolkit [@MickLesk](https://github.com/MickLesk) ([#18097](https://github.com/community-scripts/ProxmoxVE/pull/18097))
+    - tdarr: do not let a failed or slow updater block the service start [@MickLesk](https://github.com/MickLesk) ([#18100](https://github.com/community-scripts/ProxmoxVE/pull/18100))
+    - immich: install mise from its GitHub release, retry jellyfin-ffmpeg, default the ML prompt [@MickLesk](https://github.com/MickLesk) ([#18099](https://github.com/community-scripts/ProxmoxVE/pull/18099))
+    - Refactor: pimox-haos-vm [@MickLesk](https://github.com/MickLesk) ([#18077](https://github.com/community-scripts/ProxmoxVE/pull/18077))
+
+### 💾 Core
+
+  - Telemetry: explain and categorize by the command that failed [@MickLesk](https://github.com/MickLesk) ([core#166](https://github.com/community-scripts/core/pull/166))
+- error-handler: report a handled silent failure only on its own line [@MickLesk](https://github.com/MickLesk) ([core#165](https://github.com/community-scripts/core/pull/165))
+- VM silent: return the failure instead of exiting [@MickLesk](https://github.com/MickLesk) ([core#164](https://github.com/community-scripts/core/pull/164))
+- error-handler: keep the start explanation and the final IP lookup from failing the run [@MickLesk](https://github.com/MickLesk) ([core#163](https://github.com/community-scripts/core/pull/163))
+- error output: report a failure inside a subshell once [@MickLesk](https://github.com/MickLesk) ([core#162](https://github.com/community-scripts/core/pull/162))
+- general: allow Composer as root in every script [@MickLesk](https://github.com/MickLesk) ([core#161](https://github.com/community-scripts/core/pull/161))
+- lxc-updater: skip the resource check when the container cannot read its RAM [@MickLesk](https://github.com/MickLesk) ([core#160](https://github.com/community-scripts/core/pull/160))
+- vm-core: let vm_timezone_default survive a host without /etc/timezone [@MickLesk](https://github.com/MickLesk) ([core#159](https://github.com/community-scripts/core/pull/159))
+
+## 2026-10-22
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Zabbix: keep unattended updates on the installed series [@florianpunz](https://github.com/florianpunz) ([#18051](https://github.com/community-scripts/ProxmoxVE/pull/18051))
+
+  - #### 🔧 Refactor
+
+    - Refactor: Cryptpad [@MickLesk](https://github.com/MickLesk) ([#18065](https://github.com/community-scripts/ProxmoxVE/pull/18065))
+
+### 💾 Core
+
+  - Incus: drive a remote Incus server from the client's default remote [@MickLesk](https://github.com/MickLesk) ([core#154](https://github.com/community-scripts/core/pull/154))
+- Deploy the release again when an update is redone [@MickLesk](https://github.com/MickLesk) ([core#158](https://github.com/community-scripts/core/pull/158))
+
+### ❔ Uncategorized
+
+  - chore(ct): sync sparkyfitness defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18061](https://github.com/community-scripts/ProxmoxVE/pull/18061))
+
+## 2026-10-21
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Immich: bump release version to v3.3.5 (CVE) [@CerberusStyle](https://github.com/CerberusStyle) ([#18057](https://github.com/community-scripts/ProxmoxVE/pull/18057))
+    - DroppedNeedle: pass release version to the app via COMMIT_TAG [@MickLesk](https://github.com/MickLesk) ([#18042](https://github.com/community-scripts/ProxmoxVE/pull/18042))
+
+### 💾 Core
+
+  - Keep the version an update started from across a redo [@MickLesk](https://github.com/MickLesk) ([core#156](https://github.com/community-scripts/core/pull/156))
+- Redo an update whose run did not finish after the deploy [@MickLesk](https://github.com/MickLesk) ([core#155](https://github.com/community-scripts/core/pull/155))
+
+## 2026-10-20
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Plane: give Silo its own HOME [@MickLesk](https://github.com/MickLesk) ([#18028](https://github.com/community-scripts/ProxmoxVE/pull/18028))
+    - Immich: Pin version to 3.3.4 [@vhsdream](https://github.com/vhsdream) ([#18036](https://github.com/community-scripts/ProxmoxVE/pull/18036))
+    - InvenTree: run apt under systemd so postinst can finish [@MickLesk](https://github.com/MickLesk) ([#18029](https://github.com/community-scripts/ProxmoxVE/pull/18029))
+    - Profilarr: pass the deno pin as the version [@MickLesk](https://github.com/MickLesk) ([#18025](https://github.com/community-scripts/ProxmoxVE/pull/18025))
+    - Silo: keep the version file out of ~/.silo [@MickLesk](https://github.com/MickLesk) ([#18030](https://github.com/community-scripts/ProxmoxVE/pull/18030))
+    - InvenTree: move to go.packager.io [@MickLesk](https://github.com/MickLesk) ([#18015](https://github.com/community-scripts/ProxmoxVE/pull/18015))
+    - Zitadel: run init and setup in the foreground [@MickLesk](https://github.com/MickLesk) ([#18016](https://github.com/community-scripts/ProxmoxVE/pull/18016))
+
+  - #### ✨ New Features
+
+    - Zitadel: Support v1 and v2 Login [@MickLesk](https://github.com/MickLesk) ([#18031](https://github.com/community-scripts/ProxmoxVE/pull/18031))
+
+  - #### 🔧 Refactor
+
+    - Refactor: OpenWebUI (remove numba pin)  [@MickLesk](https://github.com/MickLesk) ([#18026](https://github.com/community-scripts/ProxmoxVE/pull/18026))
+
+### 💾 Core
+
+  - Only treat an NVIDIA GPU as present when its device nodes are [@MickLesk](https://github.com/MickLesk) ([core#153](https://github.com/community-scripts/core/pull/153))
+
+## 2026-10-19
+
+### 🆕 New Scripts
+
+  - Calagopus ([#18012](https://github.com/community-scripts/ProxmoxVE/pull/18012))
+- Netronome ([#18011](https://github.com/community-scripts/ProxmoxVE/pull/18011))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - immich: record library revisions when the line is missing [@mazelado](https://github.com/mazelado) ([#17990](https://github.com/community-scripts/ProxmoxVE/pull/17990))
+    - Update authentik 2026.8.4 [@thieneret](https://github.com/thieneret) ([#18004](https://github.com/community-scripts/ProxmoxVE/pull/18004))
+
+  - #### ✨ New Features
+
+    - feat(mealie): add reverse proxy auth settings to mealie.env [@bferd](https://github.com/bferd) ([#18006](https://github.com/community-scripts/ProxmoxVE/pull/18006))
+
 ## 2026-10-18

+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Donetick: create selfhosted.yaml from the example [@MickLesk](https://github.com/MickLesk) ([#17992](https://github.com/community-scripts/ProxmoxVE/pull/17992))
+    - Wiki.js: only back up db.sqlite on SQLite installs [@MickLesk](https://github.com/MickLesk) ([#17993](https://github.com/community-scripts/ProxmoxVE/pull/17993))
+    - FlareSolverr: pass Chrome an en-US Accept-Language [@MickLesk](https://github.com/MickLesk) ([#17995](https://github.com/community-scripts/ProxmoxVE/pull/17995))
+    - 2FAuth: install the locked dependencies [@MickLesk](https://github.com/MickLesk) ([#17996](https://github.com/community-scripts/ProxmoxVE/pull/17996))
+    - Tracearr: drop the pnpm store after the update build [@gioxx](https://github.com/gioxx) ([#17869](https://github.com/community-scripts/ProxmoxVE/pull/17869))
+    - vaultwarden: build before stopping the service [@mazelado](https://github.com/mazelado) ([#17983](https://github.com/community-scripts/ProxmoxVE/pull/17983))
+
+  - #### 💥 Breaking Changes
+
+    - fix: geopulse 2.0.0 upgrade support (nginx .mjs, pg18, jwt cleanup) [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17978](https://github.com/community-scripts/ProxmoxVE/pull/17978))
+
+### 💾 Core
+
+  - Let get_current_ip reach its IPv6 fallback [@MickLesk](https://github.com/MickLesk) ([core#151](https://github.com/community-scripts/core/pull/151))
+- Drop apt autoclean before apt clean [@MickLesk](https://github.com/MickLesk) ([core#152](https://github.com/community-scripts/core/pull/152))
+- Silence apt's script warning in $STD [@MickLesk](https://github.com/MickLesk) ([core#150](https://github.com/community-scripts/core/pull/150))
+
 ## 2026-10-17

 ### 🆕 New Scripts
@@ -47,7 +47,7 @@ function update_script() {
  RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
  setup_yq

-  AUTHENTIK_VERSION="version/2026.8.3"
+  AUTHENTIK_VERSION="version/2026.8.4"
  # Source: https://github.com/goauthentik/fips/blob/main/Makefile#L26
  XMLSEC_VERSION="1.3.12"

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Jelcoo
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://calagopus.com/
+
+APP="Calagopus"
+var_tags="${var_tags:-panel;game-server}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-40}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /usr/local/bin/calagopus-panel ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "calagopus-panel" "calagopus/panel"; then
+    msg_info "Stopping Service"
+    systemctl stop calagopus-panel
+    msg_ok "Stopped Service"
+
+    create_backup /etc/calagopus/.env /var/lib/calagopus
+
+    fetch_and_deploy_gh_release "calagopus-panel" "calagopus/panel" "singlefile" "latest" "/usr/local/bin" "panel-rs-aio-$(arch_resolve x86_64 aarch64)-linux"
+
+    restore_backup
+
+    msg_info "Starting Service"
+    systemctl start calagopus-panel
+    msg_ok "Started Service"
+    msg_ok "Updated Successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:8000${CL}"
@@ -30,12 +30,14 @@ function update_script() {
    msg_error "No ${APP} Installation Found!"
    exit
  fi
+  # Updates to 2026.10.0 finished without infra.js; run them again so it gets written
+  [[ -f /opt/cryptpad/config/infra.example.js && ! -f /opt/cryptpad/config/infra.js ]] && rm -f ~/.cryptpad
  if check_for_gh_release "cryptpad" "cryptpad/cryptpad"; then
    msg_info "Stopping Service"
    systemctl stop cryptpad
    msg_ok "Stopped Service"

-    create_backup /opt/cryptpad/config/config.js /opt/cryptpad/www/common/onlyoffice/dist
+    create_backup /opt/cryptpad/config/config.js /opt/cryptpad/config/infra.js /opt/cryptpad/www/common/onlyoffice/dist

    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="blob block customize data datastore onlyoffice-conf" fetch_and_deploy_gh_release "cryptpad" "cryptpad/cryptpad" "tarball"

@@ -45,8 +47,30 @@ function update_script() {
    cd /opt/cryptpad
    $STD npm ci --allow-git=all
    $STD npm run install:components
-    if [ -f "/opt/cryptpad/install-onlyoffice.sh" ]; then
-      $STD bash /opt/cryptpad/install-onlyoffice.sh --accept-license
+    if [[ -d /opt/cryptpad/www/common/onlyoffice/dist ]]; then
+      $STD bash /opt/cryptpad/install-office.sh --accept-license
+    fi
+    if [[ ! -f /opt/cryptpad/config/infra.js ]]; then
+      # 2026.10.0 reads the network settings from infra.js and no longer derives the sandbox origin
+      LOCAL_IP="$LOCAL_IP" node - <<'EOF'
+const c = require("/opt/cryptpad/config/config.js");
+const i = require("/opt/cryptpad/config/infra.example.js");
+const port = c.httpPort || i.public.httpPort;
+const safePort = c.httpSafePort || port + 1;
+const origin = (c.httpUnsafeOrigin || `http://${process.env.LOCAL_IP}:${port}`).replace(/\/+$/, "");
+const sandbox = new URL(origin);
+sandbox.port = safePort;
+Object.assign(i.public, {
+  origin,
+  sandboxOrigin: (c.httpSafeOrigin || sandbox.origin).replace(/\/+$/, ""),
+  httpHost: c.httpAddress || (c.httpUnsafeOrigin ? i.public.httpHost : "0.0.0.0"),
+  httpPort: port,
+  httpSafePort: safePort,
+  externalWebsocketURL: c.externalWebsocketURL,
+  fileHost: c.fileHost,
+});
+require("fs").writeFileSync("/opt/cryptpad/config/infra.js", "module.exports = " + JSON.stringify(i, null, 4) + ";\n");
+EOF
    fi
    $STD npm run build
    msg_ok "Updated CryptaPad"
@@ -91,6 +91,7 @@ User=root
 WorkingDirectory=/opt/droppedneedle/backend
 Environment=ROOT_APP_DIR=/opt/droppedneedle/backend
 Environment=PORT=8688
+Environment=COMMIT_TAG=v$(<~/.droppedneedle)
 # Environment=SLSKD_DOWNLOADS_PATH=<path-to-slskd-downloads>
 ExecStart=/opt/droppedneedle/venv/bin/python -m maintenance.automatic_upgrade --start-target
 Restart=on-failure
@@ -106,6 +107,11 @@ EOF
        sed -i '\|=8688$|a# Environment=SLSKD_DOWNLOADS_PATH=<path-to-slskd-downloads>' /etc/systemd/system/droppedneedle.service
      fi
      sed -i 's|^ExecStart=.*|ExecStart=/opt/droppedneedle/venv/bin/python -m maintenance.automatic_upgrade --start-target|' /etc/systemd/system/droppedneedle.service
+      if grep -q '^Environment=COMMIT_TAG=' /etc/systemd/system/droppedneedle.service; then
+        sed -i "s|^Environment=COMMIT_TAG=.*|Environment=COMMIT_TAG=v$(<~/.droppedneedle)|" /etc/systemd/system/droppedneedle.service
+      else
+        sed -i "\|=8688$|a Environment=COMMIT_TAG=v$(<~/.droppedneedle)" /etc/systemd/system/droppedneedle.service
+      fi
    fi

    systemctl daemon-reload
@@ -35,6 +35,12 @@ function update_script() {
    msg_error "You must upgrade your LXC to Debian Trixie before updating."
    exit
  fi
+  # FlareSolverr hands LANG to Chrome as Accept-Language, which needs a tag like en-US, not a locale (#17987)
+  if ! grep -q '^Environment="LANG=' /etc/systemd/system/flaresolverr.service; then
+    sed -i '/^Environment="CAPTCHA_SOLVER=/a Environment="LANG=en-US"' /etc/systemd/system/flaresolverr.service
+    systemctl daemon-reload
+    systemctl restart flaresolverr
+  fi
  if check_for_gh_release "flaresolverr" "FlareSolverr/FlareSolverr"; then
    msg_info "Stopping service"
    systemctl stop flaresolverr
@@ -10,7 +10,7 @@ APP="GeoPulse"
 var_tags="${var_tags:-location;tracking;gps}"
 var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-1024}"
-var_disk="${var_disk:-8}"
+var_disk="${var_disk:-12}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
@@ -32,6 +32,16 @@ function update_script() {
  fi

  if check_for_gh_release "geopulse-backend" "tess1o/geopulse"; then
+    msg_info "Backing Up Database"
+    mkdir -p /var/lib/geopulse/dumps
+    DB_NAME="$(grep -oP '^GEOPULSE_POSTGRES_DB=\K.*' /etc/geopulse/geopulse.env 2>/dev/null)"
+    DB_NAME="${DB_NAME:-geopulse}"
+    if sudo -u postgres pg_dump -Fc "${DB_NAME}" >"/var/lib/geopulse/dumps/${DB_NAME}-pre-update-$(date +%Y%m%d%H%M%S).dump" 2>/dev/null; then
+      msg_ok "Backed Up Database"
+    else
+      msg_warn "Database backup failed, continuing anyway"
+    fi
+
    msg_info "Stopping Service"
    systemctl stop geopulse-backend
    msg_ok "Stopped Service"
@@ -51,7 +61,48 @@ function update_script() {
    fi

    fetch_and_deploy_gh_release "geopulse-backend" "tess1o/geopulse" "singlefile" "latest" "/opt/geopulse/backend" "${BINARY_PATTERN}"
-    fetch_and_deploy_gh_release "geopulse-frontend" "tess1o/geopulse" "prebuild" "latest" "/var/www/geopulse" "geopulse-frontend-*.tar.gz"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="avatars" fetch_and_deploy_gh_release "geopulse-frontend" "tess1o/geopulse" "prebuild" "latest" "/var/www/geopulse" "geopulse-frontend-*.tar.gz"
+
+    if [[ -f /etc/geopulse/geopulse.env ]] && grep -q "GEOPULSE_JWT_" /etc/geopulse/geopulse.env 2>/dev/null; then
+      msg_info "Removing Unused JWT Keys"
+      sed -i '/^GEOPULSE_JWT_PRIVATE_KEY_LOCATION=/d;/^GEOPULSE_JWT_PUBLIC_KEY_LOCATION=/d' /etc/geopulse/geopulse.env
+      rm -f /opt/geopulse/keys/jwt-private-key.pem /opt/geopulse/keys/jwt-public-key.pem
+      msg_ok "Removed Unused JWT Keys"
+    fi
+
+    if [[ -f /etc/nginx/sites-available/geopulse.conf ]] && ! grep -q '\.mjs\$' /etc/nginx/sites-available/geopulse.conf; then
+      msg_info "Configuring Nginx for .mjs Assets"
+      cp /etc/nginx/sites-available/geopulse.conf /etc/nginx/sites-available/geopulse.conf.pre-mjs.bak
+
+      ANCHOR_LINE="$(grep -n '    add_header Cache-Control "public, max-age=31536000";' /etc/nginx/sites-available/geopulse.conf.pre-mjs.bak | head -1 | cut -d: -f1)"
+
+      if [[ -n "$ANCHOR_LINE" ]]; then
+        INSERT_LINE=$((ANCHOR_LINE + 1))
+        {
+          head -n "$INSERT_LINE" /etc/nginx/sites-available/geopulse.conf.pre-mjs.bak
+          cat <<'MJSBLOCK'
+
+    location ~* ^/(?!osm/).*\.mjs$ {
+        types {
+            application/javascript mjs;
+        }
+        expires 1y;
+        add_header Cache-Control "public, max-age=31536000";
+    }
+MJSBLOCK
+          tail -n "+$((INSERT_LINE + 1))" /etc/nginx/sites-available/geopulse.conf.pre-mjs.bak
+        } >/etc/nginx/sites-available/geopulse.conf
+      fi
+
+      if [[ -n "$ANCHOR_LINE" ]] && grep -q '\.mjs\$' /etc/nginx/sites-available/geopulse.conf && nginx -t >/dev/null 2>&1; then
+        systemctl reload nginx
+        msg_ok "Configured Nginx for .mjs Assets"
+      else
+        cp /etc/nginx/sites-available/geopulse.conf.pre-mjs.bak /etc/nginx/sites-available/geopulse.conf
+        nginx -t >/dev/null 2>&1 && systemctl reload nginx
+        msg_warn "Could not automatically add the .mjs nginx block (customized config?) - add it manually, see the GeoPulse 2.0.0 upgrade notes"
+      fi
+    fi

    msg_info "Starting Service"
    systemctl start geopulse-backend
@@ -65,19 +65,17 @@ EOF
    msg_ok "Installed/upgraded Testing repo packages"
  fi

-  if [[ ! -f /etc/apt/sources.list.d/mise.list ]]; then
-    msg_info "Installing Mise"
-    curl -fSs https://mise.jdx.dev/gpg-key.pub | tee /etc/apt/keyrings/mise-archive-keyring.pub 1>/dev/null
-    echo "deb [signed-by=/etc/apt/keyrings/mise-archive-keyring.pub arch=$(arch_resolve)] https://mise.jdx.dev/deb stable main" >/etc/apt/sources.list.d/mise.list
-    ensure_dependencies mise
-    msg_ok "Installed Mise"
+  if ! command -v mise >/dev/null 2>&1; then
+    MISE_ARCH="x64"
+    [[ "$(arch_resolve)" == "arm64" ]] && MISE_ARCH="arm64"
+    fetch_and_deploy_gh_release "mise" "jdx/mise" "singlefile" "latest" "/usr/local/bin" "mise-v*-linux-${MISE_ARCH}"
  fi

  STAGING_DIR=/opt/staging
  BASE_DIR=${STAGING_DIR}/base-images
  SOURCE_DIR=${STAGING_DIR}/image-source
  cd /tmp
-  RELEASE="v3.3.1"
+  RELEASE="v3.3.5"
  if [[ -f ~/.intel_version ]]; then
    INTEL_SRC="https://raw.githubusercontent.com/immich-app/immich/${RELEASE}/machine-learning"
    curl -fsSL "${INTEL_SRC}/scripts/install-intel-runtime.sh" -o ./intel-runtime 2>/dev/null ||
@@ -103,10 +101,10 @@ EOF
    fi
  fi
  # Without the revision file the refresh was skipped and sharp failed on an old libvips (#17914).
-  if [[ ! -f ~/.immich_library_revisions ]]; then
-    msg_warn "No record of the compiled image-processing libraries, rebuilding all of them"
-    printf '%s: unknown\n' imagemagick jpegli libheif libjxl libraw libvips >~/.immich_library_revisions
-  fi
+  [[ -f ~/.immich_library_revisions ]] || msg_warn "No record of the compiled image-processing libraries, rebuilding all of them"
+  for lib in imagemagick jpegli libheif libjxl libraw libvips; do
+    grep -q "^${lib}:" ~/.immich_library_revisions 2>/dev/null || echo "${lib}: unknown" >>~/.immich_library_revisions
+  done
  [[ -d "$BASE_DIR/.git" ]] || $STD git clone -b main https://github.com/immich-app/base-images "$BASE_DIR"
  libraries=("libjxl" "jpegli" "libheif" "libraw" "imagemagick" "libvips")
  cd "$BASE_DIR"
@@ -31,14 +31,36 @@ function update_script() {
    exit
  fi

-  if ! grep -qE "^ID=(ubuntu)$" /etc/os-release; then
-    msg_error "Unsupported OS. InvenTree requires Ubuntu (20.04/22.04/24.04)."
+  if ! grep -qE "^ID=(ubuntu|debian)$" /etc/os-release; then
+    msg_error "Unsupported OS. InvenTree requires Ubuntu or Debian."
    exit
  fi

+  # dl.packager.io is frozen at 1.5.1 and its SHA1-bound key fails on Debian 13;
+  # go.packager.io only carries current builds for these releases
+  if grep -qs "dl.packager.io" /etc/apt/sources.list.d/inventree*; then
+    case "$(get_os_info id)/$(get_os_info version)" in
+    ubuntu/24.04 | ubuntu/26.04 | debian/13)
+      msg_info "Migrating InvenTree Repository"
+      setup_deb822_repo \
+        "inventree" \
+        "https://go.packager.io/srv/deb/inventree/InvenTree/gpg-key.asc" \
+        "https://go.packager.io/srv/deb/inventree/InvenTree/stable/$(get_os_info id)" \
+        "$(get_os_info version)" \
+        "main"
+      msg_ok "Migrated InvenTree Repository"
+      ;;
+    *)
+      msg_warn "InvenTree only publishes updates for Ubuntu 24.04/26.04 and Debian 13; staying on the frozen repository"
+      ;;
+    esac
+  fi
+
  msg_info "Updating InvenTree"
  apt_update_safe
-  $STD apt install --only-upgrade inventree -y
+  # postinst loops forever unless its parent chain reaches PID 1 (not the case under pct exec)
+  $STD systemd-run --wait --pipe --quiet --collect --setenv=DEBIAN_FRONTEND=noninteractive \
+    apt-get install --only-upgrade -y inventree
  msg_ok "Updated InvenTree"
  msg_ok "Updated successfully!"
  exit
@@ -31,6 +31,14 @@ function update_script() {
    exit
  fi

+  if [[ ! -f /etc/cron.d/invoiceshelf ]]; then
+    msg_info "Adding the Laravel scheduler"
+    cat <<'EOF' >/etc/cron.d/invoiceshelf
+* * * * * www-data cd /opt/invoiceshelf && php artisan schedule:run >> /dev/null 2>&1
+EOF
+    msg_ok "Added the Laravel scheduler"
+  fi
+
  if check_for_gh_release "invoiceshelf" "InvoiceShelf/InvoiceShelf"; then
    msg_info "Stopping Services"
    systemctl stop caddy
@@ -58,6 +58,18 @@ exec uv run mealie
 STARTEOF
    fi
    chmod +x /opt/mealie/start.sh
+    if ! grep -q "REVERSE_PROXY_AUTH_ENABLED" /opt/mealie/mealie.env; then
+      cat <<EOF >>/opt/mealie/mealie.env
+
+# Reverse proxy auth (Mealie v3.29.0+). Disabled by default.
+# To enable: set REVERSE_PROXY_AUTH_ENABLED=true, set a secret, then restart mealie.
+# REVERSE_PROXY_AUTH_ENABLED=false
+# REVERSE_PROXY_AUTH_HEADER=X-Forwarded-User
+# REVERSE_PROXY_AUTH_SIGNUP_ENABLED=false
+# REVERSE_PROXY_AUTH_SECRET=
+# REVERSE_PROXY_AUTH_SECRET_HEADER=X-Mealie-Reverse-Proxy-Secret
+EOF
+    fi
    msg_ok "Configuration restored"

    msg_info "Installing Python Dependencies with uv"
@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/autobrr/netronome
+
+APP="Netronome"
+var_tags="${var_tags:-network;monitoring;speedtest}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-512}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /usr/bin/netronome ]]; then
+    msg_error "No Netronome Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "netronome" "autobrr/netronome" "" "" "v"; then
+    msg_info "Stopping Netronome"
+    systemctl stop netronome
+    msg_ok "Stopped Netronome"
+
+    fetch_and_deploy_gh_release "netronome" "autobrr/netronome" "binary" "latest" "" "netronome_*_linux_$(arch_resolve).deb" "v"
+
+    msg_info "Starting Netronome"
+    systemctl start netronome
+    msg_ok "Started Netronome"
+    msg_ok "Updated successfully!"
+  fi
+
+  if check_for_gh_release "librespeed-cli" "librespeed/speedtest-cli"; then
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "librespeed-cli" "librespeed/speedtest-cli" "prebuild" "latest" "/opt/librespeed-cli" "librespeed-cli_*_linux_$(arch_resolve).tar.gz"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:7575${CL}"
+echo -e "${INFO}${YW}Register your account right away: the registration page accepts only the first account, and until then anyone who reaches the port can claim it.${CL}"
@@ -49,10 +49,13 @@ function update_script() {

    msg_info "Installing uv-based Open-WebUI"
    PYTHON_VERSION="3.12" setup_uv
-    for attempt in $(seq 1 3); do
-      $STD uv tool install --python 3.12 --constraint <(echo "numba>=0.60") open-webui[all] && break
-      [[ $attempt -lt 3 ]] && msg_warn "Open WebUI install attempt $attempt failed, retrying..." && sleep 10
+    installed=0
+    for attempt in 1 2; do
+      $STD uv tool install --python 3.12 open-webui[all] && { installed=1; break; }
+      msg_warn "Open WebUI install attempt $attempt failed, retrying..."
+      sleep 10
    done
+    ((installed)) || $STD uv tool install --python 3.12 open-webui[all]
    msg_ok "Installed uv-based Open-WebUI"

    msg_info "Restoring data"
@@ -125,10 +128,13 @@ EOF
      OTEL_ARGS+=(--with "$pkg")
    done < <(uv pip list --python "$OWUI_PYTHON" --format freeze 2>/dev/null | grep -i '^opentelemetry-' | cut -d= -f1)
  fi
-  for attempt in $(seq 1 3); do
-    $STD uv tool install --force --python 3.12 --constraint <(echo "numba>=0.60") "${OTEL_ARGS[@]}" open-webui[all] && break
-    [[ $attempt -lt 3 ]] && msg_warn "Open WebUI update attempt $attempt failed, retrying..." && sleep 10
+  updated=0
+  for attempt in 1 2; do
+    $STD uv tool install --force --python 3.12 "${OTEL_ARGS[@]}" open-webui[all] && { updated=1; break; }
+    msg_warn "Open WebUI update attempt $attempt failed, retrying..."
+    sleep 10
  done
+  ((updated)) || $STD uv tool install --force --python 3.12 "${OTEL_ARGS[@]}" open-webui[all]
  systemctl restart open-webui
  msg_ok "Updated Open WebUI"
  msg_ok "Updated successfully!"
@@ -41,7 +41,7 @@ function update_script() {
  ARCH=$(uname -m)

  if check_for_gh_release "deno" "denoland/deno" "v2.7.5" "Deno is pinned to 2.7.5 because the known WouldBlock: Resource temporarily unavailable (os error 11) Issue"; then
-    fetch_and_deploy_gh_release "deno" "denoland/deno" "v2.7.5" "latest" "/usr/local/bin" "deno-${ARCH}-unknown-linux-gnu.zip"
+    fetch_and_deploy_gh_release "deno" "denoland/deno" "prebuild" "v2.7.5" "/usr/local/bin" "deno-${ARCH}-unknown-linux-gnu.zip"
  fi

  if check_for_gh_release "profilarr" "Dictionarry-Hub/profilarr"; then
@@ -44,7 +44,7 @@ function update_script() {
    $STD npm ci --legacy-peer-deps --ignore-scripts
    $STD npm run build:icons
    $STD npx prisma generate
-    NODE_OPTIONS="--max-old-space-size=4608" $STD npm run build
+    PROXCENTER_SKIP_TYPECHECK=1 NODE_OPTIONS="--max-old-space-size=3072" $STD npm run build
    msg_ok "Built ProxCenter"

    msg_info "Migrating Database"
@@ -31,12 +31,13 @@ function update_script() {
    exit
  fi

-  if check_for_gh_release "silo" "pgsty/silo"; then
+  [[ -f ~/.silo ]] && mv ~/.silo ~/.silo_s3
+  if check_for_gh_release "silo_s3" "pgsty/silo"; then
    msg_info "Stopping Silo"
    systemctl stop silo
    msg_ok "Stopped Silo"

-    DPKG_FORCE_CONFOLD=1 fetch_and_deploy_gh_release "silo" "pgsty/silo" "binary"
+    DPKG_FORCE_CONFOLD=1 fetch_and_deploy_gh_release "silo_s3" "pgsty/silo" "binary"

    msg_info "Starting Silo"
    systemctl start silo
@@ -9,7 +9,7 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 APP="SparkyFitness"
 var_tags="${var_tags:-health;fitness}"
 var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
+var_ram="${var_ram:-4096}"
 var_disk="${var_disk:-7}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
@@ -31,42 +31,75 @@ function update_script() {
    exit
  fi

-  NODE_VERSION="24" NODE_MODULE="corepack,yarn" setup_nodejs
+  NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs

  if check_for_gl_release "storyteller" "storyteller-platform/storyteller" "" "" "web-v2"; then
    msg_info "Stopping Service"
    systemctl stop storyteller
    msg_ok "Stopped Service"

+    ensure_dependencies cmake argon2 libcurl4t64 libxml2
+    fetch_and_deploy_gh_release "readium" "readium/cli" "prebuild" "v0.9.1" "/opt/readium" "readium_linux_$(arch_resolve "x86_64" "arm64").tar.gz"
+
    create_backup /opt/storyteller/.env
-
-    CLEAN_INSTALL=1 fetch_and_deploy_gl_release "storyteller" "storyteller-platform/storyteller" "tarball" "latest" "/opt/storyteller" "" "web-v2"
-
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="data" fetch_and_deploy_gl_release "storyteller" "storyteller-platform/storyteller" "tarball" "latest" "/opt/storyteller" "" "web-v2"
    restore_backup

-    msg_info "Rebuilding Storyteller"
+    msg_info "Building Storyteller (Patience)"
    cd /opt/storyteller
-    export NODE_OPTIONS="--max-old-space-size=4096"
-
-    $STD corepack yarn install --network-timeout 600000
-    $STD gcc -g -fPIC -rdynamic -shared web/sqlite/uuid.c -o web/sqlite/uuid.c.so
-    export CI=1
+    $STD corepack yarn install
    export NODE_ENV=production
    export NEXT_TELEMETRY_DISABLED=1
    export SQLITE_NATIVE_BINDING=/opt/storyteller/node_modules/better-sqlite3/build/Release/better_sqlite3.node
    $STD corepack yarn workspaces foreach -Rpt --from @storyteller-platform/web --exclude @storyteller-platform/eslint run build
-    mkdir -p /opt/storyteller/web/.next/standalone/web/.next/static
-    cp -rT /opt/storyteller/web/.next/static /opt/storyteller/web/.next/standalone/web/.next/static
-    if [[ -d /opt/storyteller/web/public ]]; then
-      mkdir -p /opt/storyteller/web/.next/standalone/web/public
-      cp -rT /opt/storyteller/web/public /opt/storyteller/web/.next/standalone/web/public
+    STANDALONE=/opt/storyteller/applications/web/.next/standalone
+    WEB_DIR="$STANDALONE/applications/web"
+    mkdir -p "$WEB_DIR"/{public,.next/static,.next/cache,migrations,sqlite,scripts}
+    cp -rT applications/web/public "$WEB_DIR/public"
+    cp -rT applications/web/.next/static "$WEB_DIR/.next/static"
+    cp -rT applications/web/migrations "$WEB_DIR/migrations"
+    cp applications/web/sqlite/uuid.c.so "$WEB_DIR/sqlite/"
+    cp docker-scripts/reset-password.sh "$WEB_DIR/scripts/"
+    cp -r applications/web/work-dist applications/web/file-write-dist "$WEB_DIR/"
+    mkdir -p "$WEB_DIR/work-dist/@storyteller-platform/align/prebuilds"
+    cp -r "libraries/align/prebuilds/linux-$(arch_resolve "x64" "arm64")" "$WEB_DIR/work-dist/@storyteller-platform/align/prebuilds/"
+    cp node_modules/@echogarden/icu-segmentation-wasm/wasm/*.wasm "$WEB_DIR/work-dist/"
+    cp -rT node_modules/@parcel "$STANDALONE/node_modules/@parcel"
+    cp -rT node_modules/kuromoji "$STANDALONE/node_modules/kuromoji"
+    ln -sf /opt/storyteller/.env "$WEB_DIR/.env"
+    msg_ok "Built Storyteller"
+
+    msg_info "Updating Whisper"
+    WHISPER_VARIANT="linux-$(arch_resolve "x64" "arm64")-cpu"
+    $STD node /opt/storyteller/libraries/ghost-story/dist/cli/bin.js install binary "$WHISPER_VARIANT"
+    $STD node /opt/storyteller/libraries/ghost-story/dist/cli/bin.js install model tiny.en
+    if [[ "$WHISPER_VARIANT" == "linux-x64-cpu" ]]; then
+      $STD node /opt/storyteller/libraries/ghost-story/dist/cli/bin.js install binary linux-x64-cpu-legacy
    fi
-    mkdir -p /opt/storyteller/web/.next/standalone/web/migrations
-    cp -rT /opt/storyteller/web/migrations /opt/storyteller/web/.next/standalone/web/migrations
-    mkdir -p /opt/storyteller/web/.next/standalone/web/sqlite
-    cp -rT /opt/storyteller/web/sqlite /opt/storyteller/web/.next/standalone/web/sqlite
-    ln -sf /opt/storyteller/.env /opt/storyteller/web/.next/standalone/web/.env
-    msg_ok "Rebuilt Storyteller"
+    msg_ok "Updated Whisper"
+
+    cat <<EOF >/etc/systemd/system/storyteller.service
+[Unit]
+Description=Storyteller
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=${WEB_DIR}
+EnvironmentFile=/opt/storyteller/.env
+Environment=SQLITE_NATIVE_BINDING=${STANDALONE}/node_modules/better-sqlite3/build/Release/better_sqlite3.node
+Environment=ERROR_ALIGN_NATIVE_BINDING=${WEB_DIR}/work-dist/@storyteller-platform/align/
+Environment=STORYTELLER_WORKER=worker.mjs
+Environment=STORYTELLER_FILE_WRITE_WORKER=fileWriteWorker.mjs
+ExecStart=/usr/bin/node --enable-source-maps server.js
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+    systemctl daemon-reload

    msg_info "Starting Service"
    systemctl start storyteller
@@ -75,7 +108,6 @@ function update_script() {
  fi
  exit
 }
-
 start
 build_container
 description
@@ -146,6 +146,7 @@ EOF
    rm -rf /opt/tracearr.build
    cd /opt/tracearr
    $STD pnpm install --prod --frozen-lockfile --ignore-scripts --filter @tracearr/server...
+    rm -rf "$(pnpm store path)"
    $STD chown -R tracearr:tracearr /opt/tracearr
    msg_ok "Built Tracearr"

@@ -53,10 +53,6 @@ update_deb_based() {
      printf '%s\n' "$INSTALLED_VERSION" >"$HOME/.vaultwarden"
    fi
    if check_for_gh_release "vaultwarden" "dani-garcia/vaultwarden"; then
-      msg_info "Stopping Service"
-      systemctl stop vaultwarden
-      msg_ok "Stopped Service"
-
      fetch_and_deploy_gh_release "vaultwarden" "dani-garcia/vaultwarden" "tarball" "latest" "/tmp/vaultwarden-src"

      msg_info "Updating VaultWarden to $VAULT (Patience)"
@@ -64,6 +60,12 @@ update_deb_based() {
      VW_VERSION="$VAULT"
      export VW_VERSION
      CARGO_BUILD_JOBS="$(get_parallel_jobs)" CARGO_PROFILE_RELEASE_LTO=false CARGO_PROFILE_RELEASE_CODEGEN_UNITS=16 $STD cargo build --features "sqlite,mysql,postgresql" --release
+      msg_ok "Built VaultWarden ${VAULT}"
+
+      msg_info "Stopping Service"
+      systemctl stop vaultwarden
+      msg_ok "Stopped Service"
+
      if [[ -f /usr/bin/vaultwarden ]]; then
        cp target/release/vaultwarden /usr/bin/
      else
@@ -33,22 +33,18 @@ function update_script() {
  NODE_VERSION="26" NODE_MODULE="yarn,node-gyp" setup_nodejs

  if check_for_gh_release "wikijs" "requarks/wiki-v2"; then
-    #msg_info "Verifying whether ${APP}' new release is v3.x+ and current install uses SQLite."
-    #SQLITE_INSTALL=$([ -f /opt/wikijs/db.sqlite ] && echo "true" || echo "false")
-    #if [[ "${SQLITE_INSTALL}" == "true" && "${CHECK_UPDATE_RELEASE}" =~ ^3.* ]]; then
-    #  echo "SQLite is not supported in v3.x+, currently there is no update path availble."
-    #  exit
-    #fi
-    #msg_ok "There is an update path available for ${APP}"
+    # Installs before February 2025 use SQLite, newer ones PostgreSQL
+    SQLITE_INSTALL=$([[ -f /opt/wikijs/db.sqlite ]] && echo "true" || echo "false")

    msg_info "Stopping Service"
    systemctl stop wikijs
    msg_ok "Stopped Service"

    msg_info "Backing up Data"
-    mkdir /opt/wikijs-backup
-    #$SQLITE_INSTALL && 
-    cp /opt/wikijs/db.sqlite /opt/wikijs-backup
+    mkdir -p /opt/wikijs-backup
+    if [[ "$SQLITE_INSTALL" == "true" ]]; then
+      cp /opt/wikijs/db.sqlite /opt/wikijs-backup
+    fi
    cp -R /opt/wikijs/{config.yml,/data} /opt/wikijs-backup
    msg_ok "Backed up Data"

@@ -56,8 +52,9 @@ function update_script() {

    msg_info "Restoring Data"
    cp -R /opt/wikijs-backup/* /opt/wikijs
-    #$SQLITE_INSTALL && 
-    $STD npm rebuild sqlite3
+    if [[ "$SQLITE_INSTALL" == "true" ]]; then
+      $STD npm rebuild sqlite3
+    fi
    rm -rf /opt/wikijs-backup
    msg_ok "Restored Data"

@@ -46,24 +46,36 @@ function update_script() {
    msg_warn "No Zabbix Agent service found, skipping agent actions"
  fi

+  ZABBIX_SERIES="$(dpkg-query -W -f='${Version}' zabbix-release 2>/dev/null || true)"
+  ZABBIX_SERIES="${ZABBIX_SERIES#*:}"
+  ZABBIX_SERIES="${ZABBIX_SERIES%%[!0-9.]*}"
+  if [[ "${PHS_SILENT:-0}" == "1" ]]; then
+    if [[ ! "$ZABBIX_SERIES" =~ ^[0-9]+\.[0-9]+$ ]]; then
+      msg_warn "Could not detect the installed Zabbix series - skipping update, requires an interactive run"
+      exit 75
+    fi
+    ZABBIX_VERSION="$ZABBIX_SERIES"
+    msg_warn "Unattended update: staying on Zabbix ${ZABBIX_VERSION}"
+  else
+    read -rp "Choose Zabbix version [1] 7.0 LTS  [2] 7.4 (Latest Stable)  [3] Latest available (default: 2): " ZABBIX_CHOICE
+    ZABBIX_CHOICE=${ZABBIX_CHOICE:-2}
+    case "$ZABBIX_CHOICE" in
+    1) ZABBIX_VERSION="7.0" ;;
+    2) ZABBIX_VERSION="7.4" ;;
+    3) ZABBIX_VERSION=$(curl -fsSL https://repo.zabbix.com/zabbix/ |
+      grep -oP '(?<=href=")[0-9]+\.[0-9]+(?=/")' | sort -V | tail -n1) ;;
+    *)
+      ZABBIX_VERSION="7.4"
+      echo "Invalid choice. Defaulting to 7.4."
+      ;;
+    esac
+  fi
+
  msg_info "Stopping Services"
  systemctl stop zabbix-server
  [[ -n "$AGENT_SERVICE" ]] && systemctl stop "$AGENT_SERVICE"
  msg_ok "Stopped Services"

-  read -rp "Choose Zabbix version [1] 7.0 LTS  [2] 7.4 (Latest Stable)  [3] Latest available (default: 2): " ZABBIX_CHOICE
-  ZABBIX_CHOICE=${ZABBIX_CHOICE:-2}
-  case "$ZABBIX_CHOICE" in
-  1) ZABBIX_VERSION="7.0" ;;
-  2) ZABBIX_VERSION="7.4" ;;
-  3) ZABBIX_VERSION=$(curl -fsSL https://repo.zabbix.com/zabbix/ |
-    grep -oP '(?<=href=")[0-9]+\.[0-9]+(?=/")' | sort -V | tail -n1) ;;
-  *)
-    ZABBIX_VERSION="7.4"
-    echo "Invalid choice. Defaulting to 7.4."
-    ;;
-  esac
-
  msg_info "Updating Zabbix to $ZABBIX_VERSION"
  mkdir -p /opt/zabbix-backup/
  cp /etc/zabbix/zabbix_server.conf /opt/zabbix-backup/
@@ -73,8 +85,10 @@ function update_script() {
  rm -Rf /etc/apt/sources.list.d/zabbix.list
  cd /tmp

+  ZABBIX_REPO_DIR="debian"
+  [[ "$ZABBIX_VERSION" == "7.0" && "$(arch_resolve)" == "arm64" ]] && ZABBIX_REPO_DIR="debian-arm64"
  if [[ "$ZABBIX_VERSION" == "7.0" ]]; then
-    ZABBIX_DEB_URL="https://repo.zabbix.com/zabbix/${ZABBIX_VERSION}/debian/pool/main/z/zabbix-release/zabbix-release_latest_${ZABBIX_VERSION}+debian13_all.deb"
+    ZABBIX_DEB_URL="https://repo.zabbix.com/zabbix/${ZABBIX_VERSION}/${ZABBIX_REPO_DIR}/pool/main/z/zabbix-release/zabbix-release_latest_${ZABBIX_VERSION}+debian13_all.deb"
    ZABBIX_DEB_FILE="zabbix-release_latest_${ZABBIX_VERSION}+debian13_all.deb"
  else
    ZABBIX_DEB_URL="https://repo.zabbix.com/zabbix/${ZABBIX_VERSION}/release/debian/pool/main/z/zabbix-release/zabbix-release_latest+debian13_all.deb"
@@ -2,7 +2,7 @@
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
-# Author: dave-yap (dave-yap)
+# Author: dave-yap (dave-yap) | Co-Author: remz1337, MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://zitadel.com/ | Github: https://github.com/zitadel/zitadel

@@ -16,11 +16,23 @@ var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

+if [[ -z "${var_zitadel_login:-}" ]] && command -v pveversion >/dev/null 2>&1; then
+  var_zitadel_login=$(msg_menu "Choose the Zitadel login UI" \
+    "v2" "Login V2, Zitadel's default (HTTPS, self-signed certificate)" \
+    "v1" "Login V1, the classic login built into the API (HTTP)")
+fi
+export var_zitadel_login="${var_zitadel_login:-v2}"
+
 header_info "$APP"
 variables
 color
 catch_errors

+if [[ ! "${var_zitadel_login}" =~ ^v[12]$ ]]; then
+  msg_error "var_zitadel_login must be v1 or v2"
+  exit 1
+fi
+
 function update_script() {
  header_info
  check_container_storage
@@ -31,20 +43,29 @@ function update_script() {
  fi

  if check_for_gh_release "zitadel" "zitadel/zitadel"; then
-    msg_info "Stopping Service"
+    msg_info "Stopping Zitadel"
+    if [[ -f /etc/systemd/system/zitadel-login.service ]]; then
+      systemctl stop zitadel-login
+    fi
    systemctl stop zitadel
-    msg_ok "Stopped Service"
+    msg_ok "Stopped Zitadel"

-    rm -f /usr/local/bin/zitadel
-    fetch_and_deploy_gh_release "zitadel" "zitadel/zitadel" "prebuild" "latest" "/usr/local/bin" "zitadel-linux-$(arch_resolve).tar.gz"
+    fetch_and_deploy_gh_release "zitadel" "zitadel/zitadel" "prebuild" "${CHECK_UPDATE_RELEASE}" "/usr/local/bin" "zitadel-linux-$(arch_resolve).tar.gz"
+    if [[ -f /etc/systemd/system/zitadel-login.service ]]; then
+      NODE_VERSION="24" setup_nodejs
+      CLEAN_INSTALL=1 fetch_and_deploy_gh_release "zitadel-login" "zitadel/zitadel" "prebuild" "${CHECK_UPDATE_RELEASE}" "/opt/zitadel-login" "zitadel-login.tar.gz"
+    fi

-    msg_info "Updating Zitadel"
+    msg_info "Migrating Zitadel Database"
    $STD zitadel setup --masterkeyFile /opt/zitadel/.masterkey --config /opt/zitadel/config.yaml --init-projections=true
-    msg_ok "Updated Zitadel"
+    msg_ok "Migrated Zitadel Database"

-    msg_info "Starting Service"
+    msg_info "Starting Zitadel"
    systemctl start zitadel
-    msg_ok "Started Service"
+    if [[ -f /etc/systemd/system/zitadel-login.service ]]; then
+      systemctl start zitadel-login
+    fi
+    msg_ok "Started Zitadel"
    msg_ok "Updated successfully!"
  fi
  exit
@@ -57,4 +78,9 @@ description
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:8080/ui/console${CL}"
+if [[ "${var_zitadel_login}" == "v1" ]]; then
+  echo -e "${GATEWAY}${BGN}http://${IP}:8080/ui/console${CL}"
+else
+  echo -e "${GATEWAY}${BGN}https://${IP}:8080/ui/console${CL}"
+fi
+echo -e "${INFO}${YW}Admin credentials: ~/zitadel.creds (inside the container)${CL}"
@@ -36,7 +36,6 @@ sed -i -e "s|^APP_URL=.*|APP_URL=http://$LOCAL_IP|" \
  -e "s|^DB_USERNAME=$|DB_USERNAME=$MARIADB_DB_USER|" \
  -e "s|^DB_PASSWORD=$|DB_PASSWORD=$MARIADB_DB_PASS|" .env
 export COMPOSER_ALLOW_SUPERUSER=1
-$STD composer update --no-plugins --no-scripts
 $STD composer install --no-dev --prefer-dist --no-plugins --no-scripts
 $STD php artisan key:generate --force
 $STD php artisan migrate:refresh
@@ -12,6 +12,11 @@ setting_up_container
 network_check
 update_os

+if is_debian && [[ "$(get_os_version_major)" -lt 13 ]]; then
+  msg_error "Apache Guacamole needs Debian 13: freerdp3-dev is not available on Debian 12."
+  exit 238
+fi
+
 msg_info "Installing Dependencies"
 $STD apt install -y \
  build-essential \
@@ -13,12 +13,14 @@ setting_up_container
 network_check
 update_os

-read -r -p "${TAB3}Which Tomcat version would you like to install? (9, 10.1, 11): " version
+version="${var_apache_tomcat_version:-}"
+[[ -n "$version" ]] || read -r -p "${TAB3}Which Tomcat version would you like to install? (9, 10.1, 11): " version || true
+jdk_version="${var_apache_tomcat_jdk_version:-}"
 case $version in
 9)
  TOMCAT_VERSION="9"
  echo "Which LTS Java version would you like to use? (8, 11, 17, 21): "
-  read -r jdk_version
+  [[ -n "$jdk_version" ]] || read -r jdk_version || true
  case $jdk_version in
  8 | 11 | 17 | 21)
    JAVA_VERSION="$jdk_version" setup_java
@@ -32,7 +34,7 @@ case $version in
 10 | 10.1)
  TOMCAT_VERSION="10"
  echo "Which LTS Java version would you like to use? (11, 17, 21): "
-  read -r jdk_version
+  [[ -n "$jdk_version" ]] || read -r jdk_version || true
  case $jdk_version in
  11 | 17 | 21)
    JAVA_VERSION="$jdk_version" setup_java
@@ -46,7 +48,7 @@ case $version in
 11)
  TOMCAT_VERSION="11"
  echo "Which LTS Java version would you like to use? (17, 21): "
-  read -r jdk_version
+  [[ -n "$jdk_version" ]] || read -r jdk_version || true
  case $jdk_version in
  17 | 21)
    JAVA_VERSION="$jdk_version" setup_java
@@ -18,7 +18,7 @@ $STD apt install -y aria2
 msg_ok "Installed Aria2"

 prompt="${var_aria2_ariang:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add AriaNG? <y/N> " prompt
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add AriaNG? <y/N> " prompt || true
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  msg_info "Installing Dependencies"
  $STD apt install -y nginx
@@ -47,7 +47,8 @@ Choose Asterisk version to install:
 2) Latest LTS ($LTS_VERSION)
 3) Latest Certified ($CERT_VERSION)
 EOF
-read -rp "Enter choice [1-3]: " ASTERISK_CHOICE
+ASTERISK_CHOICE="${var_asterisk_version:-}"
+[[ -n "$ASTERISK_CHOICE" ]] || read -rp "Enter choice [1-3]: " ASTERISK_CHOICE || true

 CERTIFIED=0
 case "$ASTERISK_CHOICE" in
@@ -17,9 +17,10 @@ fetch_and_deploy_gh_release "authelia" "authelia/authelia" "binary"

 MAX_ATTEMPTS=3
 attempt=0
+DOMAIN="${var_authelia_domain:-}"
 while true; do
  attempt=$((attempt + 1))
-  read -rp "${TAB3}Enter your domain or IP (ex. example.com or 192.168.1.100): " DOMAIN
+  [[ -n "$DOMAIN" ]] || read -rp "${TAB3}Enter your domain or IP (ex. example.com or 192.168.1.100): " DOMAIN || true
  if [[ -z "$DOMAIN" ]]; then
    if ((attempt >= MAX_ATTEMPTS)); then
      DOMAIN="${LOCAL_IP:-localhost}"
@@ -40,11 +41,13 @@ while true; do
      break
    else
      msg_warn "Invalid IP address!"
+      DOMAIN=""
    fi
  elif [[ "$DOMAIN" =~ ^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*\.[a-zA-Z]{2,}$ ]]; then
    break
  else
    msg_warn "Invalid domain format!"
+    DOMAIN=""
  fi
 done
 msg_info "Setting Authelia up"
@@ -57,7 +57,7 @@ PG_VERSION="17" setup_postgresql
 PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db

 XMLSEC_VERSION="1.3.12"
-AUTHENTIK_VERSION="version/2026.8.3"
+AUTHENTIK_VERSION="version/2026.8.4"
 fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec"
 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
 GO_VERSION="$(grep -m1 '^go ' /opt/authentik/go.mod | awk '{print $2}')" setup_go
@@ -15,7 +15,8 @@ update_os

 fetch_and_deploy_gh_release "bichon" "rustmailer/bichon" "prebuild" "latest" "/opt/bichon" "bichon-*-$(arch_resolve "x86_64" "aarch64")-unknown-linux-gnu.tar.gz"

-read -r -p "${TAB3}Enter the public URL for Bichon (e.g., https://bichon.yourdomain.com) or leave empty to use container IP: " bichon_url
+bichon_url="${var_bichon_url:-}"
+[[ -n "$bichon_url" ]] || read -r -p "${TAB3}Enter the public URL for Bichon (e.g., https://bichon.yourdomain.com) or leave empty to use container IP: " bichon_url || true
 if [[ -z "$bichon_url" ]]; then
  msg_info "No URL provided"
  BICHON_PUBLIC_URL="http://$LOCAL_IP:15630"
@@ -34,7 +34,8 @@ setup_deb_based() {
  chmod +x bitmagnet
  msg_ok "Configured bitmagnet"

-  read -r -p "${TAB3}Enter your TMDB API key if you have one: " tmdbapikey
+  tmdbapikey="${var_bitmagnet_tmdb_api_key:-}"
+  [[ -n "$tmdbapikey" ]] || read -r -p "${TAB3}Enter your TMDB API key if you have one: " tmdbapikey || true

  cat <<EOF >/etc/bitmagnet.env
 POSTGRES_HOST=localhost
@@ -99,7 +100,8 @@ setup_alpine() {
  $STD su - postgres -c "psql -c 'CREATE DATABASE bitmagnet;'"
  msg_ok "Built bitmagnet"

-  read -rp "${TAB3}Enter your TMDB API key if you have one: " tmdbapikey
+  tmdbapikey="${var_bitmagnet_tmdb_api_key:-}"
+  [[ -n "$tmdbapikey" ]] || read -rp "${TAB3}Enter your TMDB API key if you have one: " tmdbapikey || true

  msg_info "Enabling bitmagnet Service"
  cat <<EOF >/etc/init.d/bitmagnet
@@ -25,7 +25,7 @@ $STD npm install
 msg_ok "Installed ByteStash"

 allowreg="${var_bytestash_registration:-}"
-[[ -n "$allowreg" ]] || read -rp "${TAB3}Do you want to allow registration of multiple accounts? [y/n]: " allowreg
+[[ -n "$allowreg" ]] || read -rp "${TAB3}Do you want to allow registration of multiple accounts? [y/n]: " allowreg || true

 msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/bytestash-backend.service
@@ -18,7 +18,7 @@ setup_deb_based() {
  systemctl enable -q --now caddy

  prompt="${var_caddy_xcaddy:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install xCaddy Addon? <y/N> " prompt
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install xCaddy Addon? <y/N> " prompt || true
  if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
    setup_go
    fetch_and_deploy_gh_release "xcaddy" "caddyserver/xcaddy" "binary"
@@ -64,7 +64,7 @@ EOF
  msg_ok "Installed Caddy"

  prompt="${var_caddy_xcaddy:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install xCaddy Addon? <y/N> " prompt
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install xCaddy Addon? <y/N> " prompt || true
  if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
    GO_VERSION="$(curl -fsSL https://go.dev/VERSION?m=text | head -1 | cut -c3-)" setup_go
    fetch_and_deploy_gh_release "xcaddy" "caddyserver/xcaddy" "prebuild" "latest" "/opt/xcaddy" "xcaddy_*_linux_$(arch_resolve).tar.gz"
@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Jelcoo
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://calagopus.com/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y valkey
+systemctl enable -q --now valkey-server
+msg_ok "Installed Dependencies"
+
+PG_VERSION="18" setup_postgresql
+PG_DB_NAME="panel" PG_DB_USER="calagopus" setup_postgresql_db
+
+setup_docker
+
+fetch_and_deploy_gh_release "calagopus-panel" "calagopus/panel" "singlefile" "latest" "/usr/local/bin" "panel-rs-aio-$(arch_resolve x86_64 aarch64)-linux"
+
+msg_info "Configuring Calagopus"
+mkdir -p /etc/calagopus /var/lib/calagopus /var/log/calagopus
+mkdir -p /etc/calagopus-wings /var/lib/calagopus-wings /var/log/calagopus-wings /tmp/calagopus-wings
+
+APP_ENCRYPTION_KEY=$(openssl rand -hex 16)
+cat <<EOF >/etc/calagopus/.env
+DATABASE_URL=postgresql://${PG_DB_USER}:${PG_DB_PASS}@localhost:5432/${PG_DB_NAME}
+DATABASE_MIGRATE=true
+REDIS_URL=redis://localhost
+PORT=8000
+APP_ENCRYPTION_KEY=${APP_ENCRYPTION_KEY}
+APP_LOG_DIRECTORY=/var/log/calagopus
+APP_PRIMARY=true
+APP_ENABLE_WINGS_PROXY=true
+APP_USE_DECRYPTION_CACHE=true
+APP_USE_INTERNAL_CACHE=true
+AIO_BASE_WINGS_CONFIGURATION=/etc/calagopus/wings-config.yml
+EOF
+chmod 600 /etc/calagopus/.env
+
+cat <<EOF >/etc/calagopus/wings-config.yml
+app_name: Calagopus
+EOF
+msg_ok "Configured Calagopus"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/calagopus-panel.service
+[Unit]
+Description=Calagopus Panel
+After=network.target postgresql.service valkey-server.service docker.service
+Requires=postgresql.service valkey-server.service docker.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/etc/calagopus
+EnvironmentFile=/etc/calagopus/.env
+ExecStart=/usr/local/bin/calagopus-panel
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now calagopus-panel
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc
@@ -13,15 +13,18 @@ setting_up_container
 network_check
 update_os

-var_cf_api_token="default"
-read -rp "${TAB3}Enter the Cloudflare API token: " var_cf_api_token
+var_cf_api_token="${var_cf_api_token:-}"
+[[ -n "$var_cf_api_token" ]] || read -rp "${TAB3}Enter the Cloudflare API token: " var_cf_api_token || true
+[[ -n "$var_cf_api_token" ]] || { msg_error "No Cloudflare API token given; set var_cf_api_token or answer the prompt"; exit 64; }

-var_cf_domains="default"
-read -rp "${TAB3}Enter the domains separated with a comma (*.example.org,www.example.org) " var_cf_domains
+var_cf_domains="${var_cf_domains:-}"
+[[ -n "$var_cf_domains" ]] || read -rp "${TAB3}Enter the domains separated with a comma (*.example.org,www.example.org) " var_cf_domains || true
+[[ -n "$var_cf_domains" ]] || { msg_error "No domains given; set var_cf_domains or answer the prompt"; exit 64; }

 var_cf_proxied="false"
+answer="${var_cloudflare_ddns_proxied:-}"
 while true; do
-  read -rp "${TAB3}Proxied? (y/n): " answer
+  [[ -n "$answer" ]] || read -rp "${TAB3}Proxied? (y/n): " answer || answer="n"
  case "$answer" in
  [Yy]*)
    var_cf_proxied="true"
@@ -31,12 +34,13 @@ while true; do
    var_cf_proxied="false"
    break
    ;;
-  *) echo "Please answer y or n." ;;
+  *) echo "Please answer y or n."; answer="" ;;
  esac
 done
 var_cf_ip6_provider="none"
+answer="${var_cloudflare_ddns_ipv6:-}"
 while true; do
-  read -rp "${TAB3}Enable IPv6 support? (y/n): " answer
+  [[ -n "$answer" ]] || read -rp "${TAB3}Enable IPv6 support? (y/n): " answer || answer="n"
  case "$answer" in
  [Yy]*)
    var_cf_ip6_provider="cloudflare.trace"
@@ -46,7 +50,7 @@ while true; do
    var_cf_ip6_provider="none"
    break
    ;;
-  *) echo "Please answer y or n." ;;
+  *) echo "Please answer y or n."; answer="" ;;
  esac
 done
 msg_ok "Configured Application"
@@ -33,7 +33,7 @@ msg_ok "Installed Cockpit"
 # 45Drives only publishes amd64 packages
 if [[ "$(arch_resolve)" != "arm64" ]]; then
  prompt="${var_cockpit_45drives:-}"
-  [[ -n "$prompt" ]] || read -r -p "Would you like to install 45Drives' cockpit-file-sharing, cockpit-identities, and cockpit-navigator  <y/N> " prompt
+  [[ -n "$prompt" ]] || read -r -p "Would you like to install 45Drives' cockpit-file-sharing, cockpit-identities, and cockpit-navigator  <y/N> " prompt || true
 fi
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
  msg_info "Installing 45Drives' cockpit extensions"
@@ -17,7 +17,8 @@ setup_hwaccel
 echo
 echo "${TAB3}Choose the GPU type for ComfyUI:"
 echo "${TAB3}[1]-None  [2]-NVIDIA  [3]-AMD  [4]-Intel"
-read -rp "${TAB3}Enter your choice [1-4] (default: 1): " gpu_choice
+gpu_choice="${var_comfyui_gpu_type:-}"
+[[ -n "$gpu_choice" ]] || read -rp "${TAB3}Enter your choice [1-4] (default: 1): " gpu_choice || true
 gpu_choice=${gpu_choice:-1}
 case "$gpu_choice" in
 1) comfyui_gpu_type="none" ;;
@@ -20,7 +20,7 @@ msg_ok "Installed Dependencies"
 NODE_VERSION="22" setup_nodejs

 onlyoffice="${var_cryptpad_onlyoffice:-}"
-[[ -n "$onlyoffice" ]] || read -rp "${TAB3}Install OnlyOffice components instead of CKEditor? (Y/N): " onlyoffice
+[[ -n "$onlyoffice" ]] || read -rp "${TAB3}Install OnlyOffice components instead of CKEditor? (Y/N): " onlyoffice || true
 fetch_and_deploy_gh_release "cryptpad" "cryptpad/cryptpad" "tarball"

 msg_info "Setup CryptPad"
@@ -28,11 +28,15 @@ cd /opt/cryptpad
 $STD npm ci --allow-git=all
 $STD npm run install:components
 if [[ "${onlyoffice,,}" =~ ^(y|yes)$ ]]; then
-  $STD bash -c "./install-onlyoffice.sh --accept-license"
+  $STD bash -c "./install-office.sh --accept-license"
 fi
 cp config/config.example.js config/config.js
-sed -i "51s/localhost/${LOCAL_IP}/g" /opt/cryptpad/config/config.js
-sed -i "80s#//httpAddress: 'localhost'#httpAddress: '0.0.0.0'#g" /opt/cryptpad/config/config.js
+cp config/infra.example.js config/infra.js
+sed -i \
+  -e "s|origin: \"http://localhost:3000\"|origin: \"http://${LOCAL_IP}:3000\"|" \
+  -e "s|sandboxOrigin: \"http://localhost:3001\"|sandboxOrigin: \"http://${LOCAL_IP}:3001\"|" \
+  -e "s|httpHost: \"localhost\"|httpHost: \"0.0.0.0\"|" \
+  config/infra.js
 $STD npm run build
 msg_ok "Setup CryptPad"

@@ -15,11 +15,8 @@ update_os

 setup_deb_based() {
  setup_docker
-  if [[ -n "${var_docker_socket:-}" ]]; then
-    socket_choice="$var_docker_socket"
-  else
-    read -r -p "${TAB3}Expose Docker TCP socket (insecure) ? [n = No, l = Local only (127.0.0.1), a = All interfaces (0.0.0.0)] <n/l/a>: " socket_choice
-  fi
+  socket_choice="${var_docker_socket:-}"
+  [[ -n "$socket_choice" ]] || read -r -p "${TAB3}Expose Docker TCP socket (insecure) ? [n = No, l = Local only (127.0.0.1), a = All interfaces (0.0.0.0)] <n/l/a>: " socket_choice || true
  case "${socket_choice,,}" in
  l | local)
    socket="tcp://127.0.0.1:2375"
@@ -70,11 +67,8 @@ setup_alpine() {
  msg_ok "Installed Docker"

  DOCKER_COMPOSE_LATEST_VERSION=$(get_latest_github_release "docker/compose" false)
-  if [[ -n "${var_docker_compose:-}" ]]; then
-    prompt="$var_docker_compose"
-  else
-    read -r -p "${TAB3}Would you like to add Docker Compose? <y/N> " prompt
-  fi
+  prompt="${var_docker_compose:-}"
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Docker Compose? <y/N> " prompt || true
  if [[ "${prompt,,}" =~ ^(y|yes|true)$ ]]; then
    msg_info "Installing Docker Compose $DOCKER_COMPOSE_LATEST_VERSION"
    DOCKER_CONFIG=${DOCKER_CONFIG:-$HOME/.docker}
@@ -83,11 +77,8 @@ setup_alpine() {
    chmod +x "$DOCKER_CONFIG"/cli-plugins/docker-compose
    msg_ok "Installed Docker Compose $DOCKER_COMPOSE_LATEST_VERSION"
  fi
-  if [[ -n "${var_docker_socket:-}" ]]; then
-    prompt="$var_docker_socket"
-  else
-    read -r -p "${TAB3}Would you like to expose the Docker TCP socket? <y/N> " prompt
-  fi
+  prompt="${var_docker_socket:-}"
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to expose the Docker TCP socket? <y/N> " prompt || true
  case "${prompt,,}" in
  y | yes | a | all) socket="tcp://0.0.0.0:2375" ;;
  l | local) socket="tcp://127.0.0.1:2375" ;;
@@ -21,6 +21,7 @@ fetch_and_deploy_gh_release "donetick" "donetick/donetick" "prebuild" "latest" "

 msg_info "Setup Donetick"
 cd /opt/donetick
+[[ -f config/selfhosted.yaml ]] || cp config/selfhosted.yaml.example config/selfhosted.yaml
 TOKEN=$(openssl rand -hex 16)
 sed -i -e "s/change_this_to_a_secure_random_string_32_characters_long/${TOKEN}/g" config/selfhosted.yaml
 msg_ok "Setup Donetick"
@@ -26,8 +26,9 @@ $STD apt install -y \
  nginx
 msg_ok "Installed Dependencies"

-var_project_name="default"
-read -r -p "${TAB3}Type the assembly name of the project: " var_project_name
+var_project_name="${var_project_name:-}"
+[[ -n "$var_project_name" ]] || read -r -p "${TAB3}Type the assembly name of the project: " var_project_name || true
+[[ -n "$var_project_name" ]] || { msg_error "No assembly name given; set var_project_name or answer the prompt"; exit 64; }

 msg_info "Setting up FTP Server"
 useradd ftpuser
@@ -44,6 +44,7 @@ User=root
 WorkingDirectory=/opt/droppedneedle/backend
 Environment=ROOT_APP_DIR=/opt/droppedneedle/backend
 Environment=PORT=8688
+Environment=COMMIT_TAG=v$(<~/.droppedneedle)
 # Environment=SLSKD_DOWNLOADS_PATH=<path-to-slskd-downloads>
 ExecStart=/opt/droppedneedle/venv/bin/python -m maintenance.automatic_upgrade --start-target
 Restart=on-failure
@@ -23,7 +23,9 @@ NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs

 echo "${TAB3}It is important to choose the name for your server before you install Synapse, because it cannot be changed later."
 echo "${TAB3}The server name determines the “domain” part of user-ids for users on your server: these will all be of the format @user:my.domain.name. It also determines how other matrix servers will reach yours for federation."
-read -p "${TAB3}Please enter the name for your server: " servername
+servername="${var_elementsynapse_server_name:-}"
+[[ -n "$servername" ]] || read -r -p "${TAB3}Please enter the name for your server: " servername || true
+[[ -n "$servername" ]] || { msg_error "No server name given; set var_elementsynapse_server_name or answer the prompt"; exit 64; }

 msg_info "Installing Element Synapse"
 setup_deb822_repo "matrix-org" \
@@ -39,7 +39,7 @@ echo "$LATEST_VERSION" >~/.emqx
 msg_ok "Installed EMQX"

 prompt="${var_emqx_disable_mq:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to disable the EMQX MQ feature? (reduces disk/CPU usage) <y/N> " prompt
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to disable the EMQX MQ feature? (reduces disk/CPU usage) <y/N> " prompt || true
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  msg_info "Disabling EMQX MQ feature"
  mkdir -p /etc/emqx
@@ -45,7 +45,8 @@ $STD ln -svf /usr/bin/ffmpeg /usr/local/bin/ffmpeg
 $STD ln -svf /usr/bin/ffprobe /usr/local/bin/ffprobe
 $STD rm -rf /opt/fileflows/Server/runtimes/win-*

-read -r -p "${TAB3}Do you want to install FileFlows Server or Agent? (S/A): " install_server
+install_server="${var_fileflows_mode:-}"
+[[ -n "$install_server" ]] || read -r -p "${TAB3}Do you want to install FileFlows Server or Agent? (S/A): " install_server || true

 if [[ "$install_server" =~ ^[Ss]$ ]]; then
  msg_info "Installing FileFlows Server"
@@ -54,9 +55,10 @@ if [[ "$install_server" =~ ^[Ss]$ ]]; then
  systemctl enable -q --now fileflows
  msg_ok "Installed FileFlows Server"
 else
-  read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url
+  server_url="${var_fileflows_server_url:-}"
+  [[ -n "$server_url" ]] || read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url || true
  while [[ -z "${server_url// /}" ]]; do
-    read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url
+    read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url || { msg_error "No FileFlows Server URL given; set var_fileflows_server_url or answer the prompt"; exit 64; }
  done
  msg_info "Installing FileFlows Agent"
  cd /opt/fileflows/Agent
@@ -48,6 +48,7 @@ RestartSec=5
 Type=simple
 Environment="LOG_LEVEL=info"
 Environment="CAPTCHA_SOLVER=none"
+Environment="LANG=en-US"
 WorkingDirectory=/opt/flaresolverr
 ExecStart=/opt/flaresolverr/flaresolverr
 TimeoutStopSec=30
@@ -15,12 +15,12 @@ update_os
 setup_yq

 if [[ -z "${var_forgejo_instance:-}" ]]; then
-  read -r -p "${TAB3}Forgejo Instance URL (e.g. https://codeberg.org): " var_forgejo_instance
+  read -r -p "${TAB3}Forgejo Instance URL (e.g. https://codeberg.org): " var_forgejo_instance || true
  var_forgejo_instance="${var_forgejo_instance:-https://codeberg.org}"
 fi

 if [[ -z "${var_forgejo_runner_uuid:-}" ]]; then
-  read -r -p "${TAB3}Forgejo Runner UUID: " var_forgejo_runner_uuid
+  read -r -p "${TAB3}Forgejo Runner UUID: " var_forgejo_runner_uuid || true
 fi

 if [[ -z "${var_forgejo_runner_uuid:-}" ]]; then
@@ -29,7 +29,7 @@ if [[ -z "${var_forgejo_runner_uuid:-}" ]]; then
 fi

 if [[ -z "${var_forgejo_runner_token:-}" ]]; then
-  read -r -p "${TAB3}Forgejo Runner Token: " var_forgejo_runner_token
+  read -r -p "${TAB3}Forgejo Runner Token: " var_forgejo_runner_token || true
 fi

 if [[ -z "${var_forgejo_runner_token:-}" ]]; then
@@ -39,7 +39,7 @@ fi

 DEFAULT_RUNNER_LABELS="linux-amd64:docker://node:22-bookworm"
 if [[ -z "${var_runner_labels:-}" ]]; then
-  read -r -p "${TAB3}Additional runner labels (comma-separated, or leave blank for default only): " var_runner_labels
+  read -r -p "${TAB3}Additional runner labels (comma-separated, or leave blank for default only): " var_runner_labels || true
 fi
 if [[ -n "${var_runner_labels:-}" ]]; then
  RUNNER_LABELS="${DEFAULT_RUNNER_LABELS},${var_runner_labels}"
@@ -19,17 +19,15 @@ $STD apt install -y \
  nginx
 msg_ok "Installed Dependencies"

-PG_VERSION="17" PG_MODULES="postgis" setup_postgresql
+PG_VERSION="18" PG_MODULES="postgis" setup_postgresql
 PG_DB_NAME="geopulse" PG_DB_USER="geopulse" PG_DB_EXTENSIONS="postgis,postgis_topology" setup_postgresql_db

 msg_info "Generating Security Keys"
 mkdir -p /opt/geopulse/{backend,keys}
 mkdir -p /etc/geopulse /var/www/geopulse /var/lib/geopulse/dumps
 mkdir -p /var/log/geopulse/{backend,nginx}
-openssl genpkey -algorithm RSA -out /opt/geopulse/keys/jwt-private-key.pem 2>/dev/null
-openssl rsa -pubout -in /opt/geopulse/keys/jwt-private-key.pem -out /opt/geopulse/keys/jwt-public-key.pem 2>/dev/null
 openssl rand -base64 32 >/opt/geopulse/keys/ai-encryption-key.txt
-chmod 640 /opt/geopulse/keys/jwt-private-key.pem /opt/geopulse/keys/jwt-public-key.pem /opt/geopulse/keys/ai-encryption-key.txt
+chmod 640 /opt/geopulse/keys/ai-encryption-key.txt
 msg_ok "Generated Security Keys"

 if [[ "$(uname -m)" == "aarch64" ]]; then
@@ -62,8 +60,6 @@ GEOPULSE_POSTGRES_PORT=5432
 GEOPULSE_POSTGRES_DB=${PG_DB_NAME}
 GEOPULSE_POSTGRES_USERNAME=${PG_DB_USER}
 GEOPULSE_POSTGRES_PASSWORD=${PG_DB_PASS}
-GEOPULSE_JWT_PRIVATE_KEY_LOCATION=file:/opt/geopulse/keys/jwt-private-key.pem
-GEOPULSE_JWT_PUBLIC_KEY_LOCATION=file:/opt/geopulse/keys/jwt-public-key.pem
 GEOPULSE_AI_ENCRYPTION_KEY_LOCATION=file:/opt/geopulse/keys/ai-encryption-key.txt
 QUARKUS_LOG_FILE_ENABLE=true
 QUARKUS_LOG_FILE_PATH=/var/log/geopulse/backend/geopulse.log
@@ -128,6 +124,14 @@ server {
        add_header Cache-Control "public, max-age=31536000";
    }

+    location ~* ^/(?!osm/).*\.mjs$ {
+        types {
+            application/javascript mjs;
+        }
+        expires 1y;
+        add_header Cache-Control "public, max-age=31536000";
+    }
+
    location ^~ /osm/tiles/ {
        resolver 8.8.8.8 valid=300s;
        resolver_timeout 10s;
@@ -51,8 +51,10 @@ echo -e ""
 msg_custom "🪙" "$YW" "CoinGecko API keys are optional but provide better cryptocurrency data."
 msg_custom "🪙" "$YW" "You can skip this and add them later by editing /opt/ghostfolio/.env"
 echo -e ""
-read -rp "${TAB3}CoinGecko Demo API key (press Enter to skip): " COINGECKO_DEMO_KEY
-read -rp "${TAB3}CoinGecko Pro API key (press Enter to skip): " COINGECKO_PRO_KEY
+COINGECKO_DEMO_KEY="${var_ghostfolio_coingecko_demo_key:-}"
+[[ -n "$COINGECKO_DEMO_KEY" ]] || read -rp "${TAB3}CoinGecko Demo API key (press Enter to skip): " COINGECKO_DEMO_KEY || true
+COINGECKO_PRO_KEY="${var_ghostfolio_coingecko_pro_key:-}"
+[[ -n "$COINGECKO_PRO_KEY" ]] || read -rp "${TAB3}CoinGecko Pro API key (press Enter to skip): " COINGECKO_PRO_KEY || true

 msg_info "Setting up Environment"
 cat <<EOF >/opt/ghostfolio/.env
@@ -16,7 +16,7 @@ update_os
 fetch_and_deploy_gh_release "headscale" "juanfont/headscale" "binary"

 prompt="${var_headscale_admin:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add headscale-admin UI? <y/N> " prompt
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add headscale-admin UI? <y/N> " prompt || true
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  fetch_and_deploy_gh_release "headscale-admin" "GoodiesHQ/headscale-admin" "prebuild" "latest" "/opt/headscale-admin" "admin.zip"

@@ -36,7 +36,8 @@ msg_ok "Configured Service Environment"
 confirm_external_installer "https://hermes-agent.nousresearch.com/" "https://hermes-agent.nousresearch.com/install.sh"

 msg_info "Installing Hermes Agent"
-curl -fsSL https://hermes-agent.nousresearch.com/install.sh -o /tmp/hermes-install.sh
+curl_with_retry "https://hermes-agent.nousresearch.com/install.sh" /tmp/hermes-install.sh ||
+  curl_with_retry "https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scripts/install.sh" /tmp/hermes-install.sh
 $STD setsid --wait bash -c '
  set -a; source /etc/default/hermes; set +a
  export npm_config_yes=true
@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os

-RELEASE="v3.3.1"
+RELEASE="v3.3.5"
 if lscpu | grep -q 'GenuineIntel'; then
  echo ""
  echo ""
@@ -25,7 +25,7 @@ if lscpu | grep -q 'GenuineIntel'; then
  echo " 2) **NEW** Intel OpenVINO CPU or iGPU"
  echo ""

-  read -r -p "${TAB3}Select machine-learning type [1]: " ML_TYPE
+  read -r -p "${TAB3}Select machine-learning type [1]: " ML_TYPE || true
  ML_TYPE="${ML_TYPE:-1}"
  if [[ "$ML_TYPE" == "2" ]]; then
    touch ~/.openvino
@@ -110,7 +110,7 @@ setup_deb822_repo \
  "https://repo.jellyfin.org/jellyfin_team.gpg.key" \
  "https://repo.jellyfin.org/debian" \
  "$(get_os_info codename)"
-$STD apt install -y jellyfin-ffmpeg7
+install_packages_with_retry jellyfin-ffmpeg7
 ln -sf /usr/lib/jellyfin-ffmpeg/ffmpeg /usr/bin/ffmpeg
 ln -sf /usr/lib/jellyfin-ffmpeg/ffprobe /usr/bin/ffprobe

@@ -124,12 +124,9 @@ if [[ "$CTTYPE" == "0" && -d /dev/dri ]]; then
 fi
 msg_ok "Dependencies Installed"

-msg_info "Installing Mise"
-curl -fSs https://mise.jdx.dev/gpg-key.pub | tee /etc/apt/keyrings/mise-archive-keyring.pub 1>/dev/null
-echo "deb [signed-by=/etc/apt/keyrings/mise-archive-keyring.pub arch=$(arch_resolve)] https://mise.jdx.dev/deb stable main" >/etc/apt/sources.list.d/mise.list
-apt_update_safe
-$STD apt install -y mise
-msg_ok "Installed Mise"
+MISE_ARCH="x64"
+[[ "$(arch_resolve)" == "arm64" ]] && MISE_ARCH="arm64"
+fetch_and_deploy_gh_release "mise" "jdx/mise" "singlefile" "latest" "/usr/local/bin" "mise-v*-linux-${MISE_ARCH}"

 msg_info "Configuring Debian Testing Repo"
 if [[ -f /etc/apt/sources.list.d/debian.sources ]]; then
@@ -21,7 +21,8 @@ setup_deb822_repo \
  "stable"
 msg_ok "Set up InfluxDB Repository"

-read -r -p "${TAB3}Which version of InfluxDB to install? (1, 2 or 3) " prompt
+prompt="${var_influxdb_version:-}"
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Which version of InfluxDB to install? (1, 2 or 3) " prompt || true
 if [[ $prompt == "3" ]]; then
  INFLUX="3"
 elif [[ $prompt == "2" ]]; then
@@ -51,7 +52,7 @@ fi
 msg_ok "Installed InfluxDB"

 prompt="${var_influxdb_telegraf:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Telegraf? <y/N> " prompt
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Telegraf? <y/N> " prompt || true
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
  msg_info "Installing Telegraf"
  $STD apt install -y telegraf
@@ -16,15 +16,17 @@ update_os
 msg_info "Setting up InvenTree Repository"
 setup_deb822_repo \
  "inventree" \
-  "https://dl.packager.io/srv/inventree/InvenTree/key" \
-  "https://dl.packager.io/srv/deb/inventree/InvenTree/stable/$(get_os_info id)" \
+  "https://go.packager.io/srv/deb/inventree/InvenTree/gpg-key.asc" \
+  "https://go.packager.io/srv/deb/inventree/InvenTree/stable/$(get_os_info id)" \
  "$(get_os_info version)" \
  "main"
 msg_ok "Set up InvenTree Repository"

 msg_info "Installing InvenTree (Patience)"
-export SETUP_NO_CALLS=true
-$STD apt install -y inventree
+# The package's postinst walks parent PIDs until it reaches PID 1; under pct exec the chain ends at 0
+# and since 1.6.0 that loops forever, so apt runs as a child of systemd
+$STD systemd-run --wait --pipe --quiet --collect --setenv=SETUP_NO_CALLS=true --setenv=DEBIAN_FRONTEND=noninteractive \
+  apt-get install -y inventree
 msg_ok "Installed InvenTree"

 msg_info "Configuring InvenTree"
@@ -52,6 +52,9 @@ chown -R www-data:www-data /opt/invoiceshelf
 chmod -R 775 storage bootstrap/cache
 $STD php artisan migrate --force
 $STD php artisan storage:link
+cat <<'EOF' >/etc/cron.d/invoiceshelf
+* * * * * www-data cd /opt/invoiceshelf && php artisan schedule:run >> /dev/null 2>&1
+EOF
 msg_ok "Set up InvoiceShelf"

 msg_info "Configuring Caddy"
@@ -37,10 +37,10 @@ fi
 msg_ok "Installed Docker"

 msg_info "Detecting latest Kasm Workspaces release"
-KASM_URL=$(curl -s https://kasm.com/downloads \
+KASM_URL=$(curl -s --max-time 30 https://kasm.com/downloads \
  | grep -oP 'https://kasm-static-content\.s3\.amazonaws\.com/kasm_release_\d+\.\d+\.\d+-latest\.tar\.gz' \
-  | head -1)
-KASM_VERSION=$(echo "$KASM_URL" | grep -oP '\d+\.\d+\.\d+(?=-latest)')
+  | head -1 || true)
+KASM_VERSION=$(echo "$KASM_URL" | grep -oP '\d+\.\d+\.\d+(?=-latest)' || true)

 # Fallback to predefined version if online lookup failed.
 if [[ -z "$KASM_VERSION" ]] || [[ -z "$KASM_URL" ]]; then
@@ -63,7 +63,7 @@ curl_download "/opt/kasm_release_${KASM_VERSION}.tar.gz" "$KASM_URL"
 cd /opt
 tar -xf "kasm_release_${KASM_VERSION}.tar.gz"
 chmod +x /opt/kasm_release/install.sh
-printf 'y\ny\ny\n4\n' | bash /opt/kasm_release/install.sh --ignore-dep-failures >~/kasm-install.output 2>&1
+bash /opt/kasm_release/install.sh --accept-eula --no-swap-check --no-check-disk --ignore-dep-failures >~/kasm-install.output 2>&1
 awk '
  /^Kasm UI Login Credentials$/ {capture=1}
  capture {print}
@@ -28,9 +28,15 @@ mkdir -p config/assets
 cp config/config.yml.template config/config.yml
 msg_ok "Setup Kometa"

-read -r -p "${TAB3}Enter your TMDb API key: " TMDBKEY
-read -r -p "${TAB3}Enter your Plex URL: " PLEXURL
-read -r -p "${TAB3}Enter your Plex token: " PLEXTOKEN
+TMDBKEY="${var_kometa_tmdb_key:-}"
+[[ -n "$TMDBKEY" ]] || read -r -p "${TAB3}Enter your TMDb API key: " TMDBKEY || true
+[[ -n "$TMDBKEY" ]] || { msg_error "No TMDb API key given; set var_kometa_tmdb_key or answer the prompt"; exit 64; }
+PLEXURL="${var_kometa_plex_url:-}"
+[[ -n "$PLEXURL" ]] || read -r -p "${TAB3}Enter your Plex URL: " PLEXURL || true
+[[ -n "$PLEXURL" ]] || { msg_error "No Plex URL given; set var_kometa_plex_url or answer the prompt"; exit 64; }
+PLEXTOKEN="${var_kometa_plex_token:-}"
+[[ -n "$PLEXTOKEN" ]] || read -r -p "${TAB3}Enter your Plex token: " PLEXTOKEN || true
+[[ -n "$PLEXTOKEN" ]] || { msg_error "No Plex token given; set var_kometa_plex_token or answer the prompt"; exit 64; }
 sed -i '/^plex:/,/^[^ ]/{s|  url:.*|  url: '"$PLEXURL"'|}' /opt/kometa/config/config.yml
 sed -i '/^plex:/,/^[^ ]/{s|  token:.*|  token: '"$PLEXTOKEN"'|}' /opt/kometa/config/config.yml
 sed -i '/^tmdb:/,/^[^ ]/{s|  apikey:.*|  apikey: '"$TMDBKEY"'|}' /opt/kometa/config/config.yml
@@ -15,7 +15,8 @@ update_os

 echo "${TAB3}How would you like to handle SSL termination?"
 echo "${TAB3}[i]-Internal (self-signed SSL Certificate)   [e]-External (use your own reverse proxy)"
-read -rp "${TAB3}Enter your choice <i/e> (default: i): " ssl_choice
+ssl_choice="${var_kutt_ssl:-}"
+[[ -n "$ssl_choice" ]] || read -rp "${TAB3}Enter your choice <i/e> (default: i): " ssl_choice || true
 ssl_choice=${ssl_choice:-i}
 case "${ssl_choice,,}" in
 i)
@@ -32,7 +33,9 @@ EOF
  msg_ok "Configured Caddy"
  ;;
 e)
-  read -r -p "${TAB3}Enter the hostname you want to use for Kutt (eg. kutt.example.com): " custom_host
+  custom_host="${var_kutt_hostname:-}"
+  [[ -n "$custom_host" ]] || read -r -p "${TAB3}Enter the hostname you want to use for Kutt (eg. kutt.example.com): " custom_host || true
+  [[ -n "$custom_host" ]] || { msg_error "No hostname given; set var_kutt_hostname or answer the prompt"; exit 64; }
  if [[ "$custom_host" ]]; then
    DEFAULT_HOST="$custom_host"
  fi
@@ -29,12 +29,12 @@ rm -f /tmp/LanguageTool-stable.zip
 msg_ok "Setup LanguageTool"

 ngram_dir=""
-lang_code=""
+lang_code="${var_languagetool_ngram_lang:-}"
 max_attempts=3
 attempt=0

 while [[ $attempt -lt $max_attempts ]]; do
-  read -r -p "${TAB3}Enter language code (en, de, es, fr, nl) to download ngrams or press ENTER to skip: " lang_code
+  [[ -n "$lang_code" ]] || read -r -p "${TAB3}Enter language code (en, de, es, fr, nl) to download ngrams or press ENTER to skip: " lang_code || lang_code=""

  if [[ -z "$lang_code" ]]; then
    break
@@ -43,11 +43,11 @@ while [[ $attempt -lt $max_attempts ]]; do
  if [[ "$lang_code" =~ [[:space:]] ]]; then
    ((attempt++))
    remaining=$((max_attempts - attempt))
+    lang_code=""
    if [[ $remaining -gt 0 ]]; then
      msg_error "Please enter only ONE language code. You have $remaining attempt(s) remaining."
    else
      msg_error "Maximum attempts reached. Continuing without ngrams."
-      lang_code=""
    fi
    continue
  fi
@@ -25,7 +25,7 @@ RUST_CRATES="monolith" setup_rust
 PG_DB_NAME="linkwardendb" PG_DB_USER="linkwarden" setup_postgresql_db

 prompt="${var_linkwarden_adminer:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Adminer? <y/N> " prompt
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Adminer? <y/N> " prompt || true
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
  setup_adminer
 fi
@@ -22,7 +22,7 @@ setup_deb_based() {
  msg_ok "Setup MariaDB"

  prompt="${var_mariadb_phpmyadmin:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add PhpMyAdmin? <y/N> " prompt
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add PhpMyAdmin? <y/N> " prompt || true
  if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
    msg_info "Installing phpMyAdmin"
    $STD apt install -y \
@@ -60,7 +60,7 @@ setup_alpine() {
  msg_ok "MariaDB Configured"

  prompt="${var_mariadb_adminer:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install Adminer with lighttpd? <y/N>: " prompt
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install Adminer with lighttpd? <y/N>: " prompt || true
  if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
    msg_info "Installing Adminer and dependencies"
    $STD apk add --no-cache \
@@ -98,6 +98,14 @@ PRODUCTION=true
 HOST=0.0.0.0
 PORT=9000
 BASE_URL=http://${LOCAL_IP}:9000
+
+# Reverse proxy auth (Mealie v3.29.0+). Disabled by default.
+# To enable: set REVERSE_PROXY_AUTH_ENABLED=true, set a secret, then restart mealie.
+# REVERSE_PROXY_AUTH_ENABLED=false
+# REVERSE_PROXY_AUTH_HEADER=X-Forwarded-User
+# REVERSE_PROXY_AUTH_SIGNUP_ENABLED=false
+# REVERSE_PROXY_AUTH_SECRET=
+# REVERSE_PROXY_AUTH_SECRET_HEADER=X-Mealie-Reverse-Proxy-Secret
 EOF
 msg_ok "Wrote Environment File"

@@ -13,7 +13,9 @@ setting_up_container
 network_check
 update_os

-read -r -p "${TAB3}Enter the email address of your first admin user: " admin_email
+admin_email="${var_mediamanager_admin_email:-}"
+[[ -n "$admin_email" ]] || read -r -p "${TAB3}Enter the email address of your first admin user: " admin_email || true
+[[ -n "$admin_email" ]] || { msg_error "No admin e-mail given; set var_mediamanager_admin_email or answer the prompt"; exit 64; }
 if [[ "$admin_email" ]]; then
  EMAIL="$admin_email"
 fi
@@ -16,7 +16,7 @@ update_os
 MEILISEARCH_BIND="0.0.0.0:7700" setup_meilisearch

 prompt="${var_meilisearch_ui:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Do you want add meilisearch-ui? [y/n]: " prompt
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Do you want add meilisearch-ui? [y/n]: " prompt || true
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  NODE_VERSION="22" NODE_MODULE="pnpm@latest" setup_nodejs
  fetch_and_deploy_gh_release "meilisearch-ui" "riccox/meilisearch-ui" "tarball"
@@ -16,8 +16,9 @@ update_os
 if [[ "$(arch_resolve)" == "arm64" ]]; then
  MONGO_VERSION="8.0" setup_mongodb
 else
-  read -p "${TAB3}Do you want to install MongoDB 8.0 instead of 7.0? [y/N]: " install_mongodb_8
-  if [[ "$install_mongodb_8" =~ ^[Yy]$ ]]; then
+  install_mongodb_8="${var_mongodb_8:-}"
+  [[ -n "$install_mongodb_8" ]] || read -r -p "${TAB3}Do you want to install MongoDB 8.0 instead of 7.0? [y/N]: " install_mongodb_8 || true
+  if [[ "$install_mongodb_8" =~ ^[Yy]([Ee][Ss])?$ ]]; then
    MONGO_VERSION="8.0" setup_mongodb
  else
    MONGO_VERSION="7.0" setup_mongodb
@@ -21,7 +21,8 @@ msg_ok "Installed Dependencies"

 RELEASE_REPO="mysql-8.0"
 RELEASE_AUTH="mysql_native_password"
-read -r -p "${TAB3}Would you like to install the MySQL 8.4 LTS release instead of MySQL 8.0 (bug fix track; EOL April-2026)? <y/N> " prompt
+prompt="${var_mysql_lts:-}"
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install the MySQL 8.4 LTS release instead of MySQL 8.0 (bug fix track; EOL April-2026)? <y/N> " prompt || true
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
  RELEASE_REPO="mysql-8.4-lts"
  RELEASE_AUTH="caching_sha2_password"
@@ -61,7 +62,8 @@ echo -e "MySQL user: root" >>~/mysql.creds
 echo -e "MySQL password: $ADMIN_PASS" >>~/mysql.creds
 msg_ok "MySQL Server configured"

-read -r -p "${TAB3}Would you like to add PhpMyAdmin? <y/N> " prompt
+prompt="${var_mysql_phpmyadmin:-}"
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add PhpMyAdmin? <y/N> " prompt || true
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/phpmyadmin.sh)"
 fi
@@ -36,7 +36,8 @@ echo " 1) NetBird Managed (default) - Use NetBird's managed service"
 echo " 2) Self-Hosted - Use your own NetBird management server"
 echo ""

-read -r -p "${TAB3}Select deployment type [1]: " DEPLOYMENT_TYPE
+DEPLOYMENT_TYPE="${var_netbird_deployment:-}"
+[[ -n "$DEPLOYMENT_TYPE" ]] || read -r -p "${TAB3}Select deployment type [1]: " DEPLOYMENT_TYPE || true
 DEPLOYMENT_TYPE="${DEPLOYMENT_TYPE:-1}"

 NETBIRD_MGMT_URL=""
@@ -51,7 +52,8 @@ case "$DEPLOYMENT_TYPE" in
    echo "Enter your NetBird management server URL."
    echo "Example: https://management.example.com"
    echo ""
-    read -r -p "Management URL: " NETBIRD_MGMT_URL
+    NETBIRD_MGMT_URL="${var_netbird_mgmt_url:-}"
+    [[ -n "$NETBIRD_MGMT_URL" ]] || read -r -p "Management URL: " NETBIRD_MGMT_URL || true

    if [[ -z "$NETBIRD_MGMT_URL" ]]; then
      msg_warn "No management URL provided. Run 'netbird up --management-url <url>' to connect."
@@ -81,7 +83,8 @@ else
 fi
 echo ""

-read -r -p "Select authentication method [1]: " AUTH_METHOD
+AUTH_METHOD="${var_netbird_auth:-}"
+[[ -n "$AUTH_METHOD" ]] || read -r -p "Select authentication method [1]: " AUTH_METHOD || true
 AUTH_METHOD="${AUTH_METHOD:-1}"

 if [[ "$DEPLOYMENT_TYPE" == "1" ]]; then
@@ -90,7 +93,8 @@ if [[ "$DEPLOYMENT_TYPE" == "1" ]]; then
      echo ""
      echo "Enter your NetBird setup key from the NetBird dashboard."
      echo ""
-      read -r -p "Setup key: " NETBIRD_SETUP_KEY
+      NETBIRD_SETUP_KEY="${var_netbird_setup_key:-}"
+      [[ -n "$NETBIRD_SETUP_KEY" ]] || read -r -p "Setup key: " NETBIRD_SETUP_KEY || true
      echo ""

      if [[ -z "$NETBIRD_SETUP_KEY" ]]; then
@@ -136,7 +140,8 @@ else
      echo ""
      echo "Enter your NetBird setup key from the NetBird dashboard."
      echo ""
-      read -r -p "Setup key: " NETBIRD_SETUP_KEY
+      NETBIRD_SETUP_KEY="${var_netbird_setup_key:-}"
+      [[ -n "$NETBIRD_SETUP_KEY" ]] || read -r -p "Setup key: " NETBIRD_SETUP_KEY || true
      echo ""

      if [[ -z "$NETBIRD_SETUP_KEY" ]]; then
@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/autobrr/netronome
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  iperf3 \
+  iputils-ping \
+  mtr-tiny \
+  traceroute
+msg_ok "Installed Dependencies"
+
+fetch_and_deploy_gh_release "librespeed-cli" "librespeed/speedtest-cli" "prebuild" "latest" "/opt/librespeed-cli" "librespeed-cli_*_linux_$(arch_resolve).tar.gz"
+ln -sf /opt/librespeed-cli/librespeed-cli /usr/local/bin/librespeed-cli
+fetch_and_deploy_gh_release "netronome" "autobrr/netronome" "binary" "latest" "" "netronome_*_linux_$(arch_resolve).deb" "v"
+
+msg_info "Configuring Netronome"
+mkdir -p /opt/netronome_data /root/.config
+$STD netronome generate-config --config /opt/netronome_data/config.toml
+sed -i 's/^host = "127.0.0.1"$/host = "0.0.0.0"/' /opt/netronome_data/config.toml
+chmod 600 /opt/netronome_data/config.toml
+ln -s /opt/netronome_data /root/.config/netronome
+msg_ok "Configured Netronome"
+
+msg_info "Creating Netronome Service"
+cat <<EOF >/etc/systemd/system/netronome.service
+[Unit]
+Description=Netronome
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/netronome_data
+ExecStart=/usr/bin/netronome serve --config /opt/netronome_data/config.toml
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now netronome
+msg_ok "Created Netronome Service"
+
+motd_ssh
+customize
+cleanup_lxc
@@ -16,16 +16,15 @@ update_os
 fetch_and_deploy_gh_release "newt" "fosrl/newt" "singlefile" "latest" "/opt/newt" "newt_linux_$(arch_resolve)"
 ln -sf /opt/newt/newt /usr/local/bin/newt

-if [[ -z "${NEWT_ID:-}" ]]; then
-  read -rp "Newt ID (from your Pangolin dashboard): " NEWT_ID
-fi
-if [[ -z "${NEWT_SECRET:-}" ]]; then
-  read -rsp "Newt Secret: " NEWT_SECRET
+NEWT_ID="${NEWT_ID:-${var_newt_id:-}}"
+[[ -n "$NEWT_ID" ]] || read -rp "Newt ID (from your Pangolin dashboard): " NEWT_ID || true
+NEWT_SECRET="${NEWT_SECRET:-${var_newt_secret:-}}"
+if [[ -z "$NEWT_SECRET" ]]; then
+  read -rsp "Newt Secret: " NEWT_SECRET || true
  echo
 fi
-if [[ -z "${PANGOLIN_ENDPOINT:-}" ]]; then
-  read -rp "Pangolin endpoint (e.g. https://pangolin.example.com): " PANGOLIN_ENDPOINT
-fi
+PANGOLIN_ENDPOINT="${PANGOLIN_ENDPOINT:-${var_newt_endpoint:-}}"
+[[ -n "$PANGOLIN_ENDPOINT" ]] || read -rp "Pangolin endpoint (e.g. https://pangolin.example.com): " PANGOLIN_ENDPOINT || true

 if [[ -z "$NEWT_ID" || -z "$NEWT_SECRET" || -z "$PANGOLIN_ENDPOINT" ]]; then
  msg_error "Newt ID, Secret and Endpoint are all required. Aborting."
@@ -38,12 +38,14 @@ curl -fsSL "https://raw.githubusercontent.com/ZoeyVid/NPMplus/refs/heads/develop
 msg_ok "Fetched NPMplus"

 attempts=0
+TZ_INPUT="${var_npmplus_tz:-}"
 while true; do
-  read -r -p "${TAB3}Enter your TZ Identifier (e.g., Europe/Berlin): " TZ_INPUT
+  [[ -n "$TZ_INPUT" ]] || read -r -p "${TAB3}Enter your TZ Identifier (e.g., Europe/Berlin): " TZ_INPUT || { msg_error "No TZ identifier given; set var_npmplus_tz or answer the prompt"; exit 64; }
  if validate_tz "$TZ_INPUT"; then
    break
  fi
  msg_error "Invalid timezone! Please enter a valid TZ identifier."
+  TZ_INPUT=""

  attempts=$((attempts + 1))
  if [[ "$attempts" -ge 3 ]]; then
@@ -52,7 +54,9 @@ while true; do
  fi
 done

-read -r -p "${TAB3}Enter your ACME Email: " ACME_EMAIL_INPUT
+ACME_EMAIL_INPUT="${var_npmplus_acme_email:-}"
+[[ -n "$ACME_EMAIL_INPUT" ]] || read -r -p "${TAB3}Enter your ACME Email: " ACME_EMAIL_INPUT || true
+[[ -n "$ACME_EMAIL_INPUT" ]] || { msg_error "No ACME e-mail given; set var_npmplus_acme_email or answer the prompt"; exit 64; }

 yq -i "
  .services.npmplus.environment |=
@@ -57,10 +57,6 @@ else
  }
 fi
 msg_ok "Installed Intel® Level Zero"
-
-msg_info "Installing Intel® oneAPI Base Toolkit (Patience)"
-$STD apt install -y --no-install-recommends intel-basekit-2024.1
-msg_ok "Installed Intel® oneAPI Base Toolkit"
 fi

 msg_info "Installing Ollama (Patience)"
@@ -17,19 +17,23 @@ MAX_ATTEMPTS=3
 servers=("opencloud" "collabora" "wopi")
 attempt=0
 for server in "${servers[@]}"; do
+  fqdn_var="var_opencloud_${server}_fqdn"
+  fqdn="${!fqdn_var:-}"
  until ((attempt >= MAX_ATTEMPTS)); do
    attempt=$((attempt + 1))
-    read -rp "${TAB3}Enter the FQDN of your ${server^} server (ATTEMPT $attempt/$MAX_ATTEMPTS) (eg $server.domain.tld): " fqdn
+    [[ -n "$fqdn" ]] || read -rp "${TAB3}Enter the FQDN of your ${server^} server (ATTEMPT $attempt/$MAX_ATTEMPTS) (eg $server.domain.tld): " fqdn || { msg_error "No ${server^} FQDN given; set ${fqdn_var} or answer the prompt"; exit 64; }
    if [[ -z "$fqdn" ]]; then
      msg_warn "Domain cannot be empty!"
    elif [[ "$fqdn" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]]; then
      msg_warn "IP address not allowed! Please use a FQDN"
+      fqdn=""
    elif [[ "$fqdn" =~ ^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*\.[a-zA-Z]{2,}$ ]]; then
      export ${server^^}_FQDN="$fqdn"
      attempt=0
      break
    else
      msg_warn "Invalid domain format!"
+      fqdn=""
    fi
  done
  if ((attempt >= MAX_ATTEMPTS)); then
@@ -27,7 +27,7 @@ PYTHON_VERSION="3.12" setup_uv

 OTEL_ARGS=()
 prompt="${var_openwebui_otel:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install OpenTelemetry instrumentation packages (requires manual .env configuration)? <y/N> " prompt
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install OpenTelemetry instrumentation packages (requires manual .env configuration)? <y/N> " prompt || true
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  for pkg in \
    opentelemetry-api \
@@ -47,14 +47,17 @@ if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
 fi

 msg_info "Installing Open WebUI"
-for attempt in $(seq 1 3); do
-  $STD uv tool install --python 3.12 --constraint <(echo "numba>=0.60") "${OTEL_ARGS[@]}" open-webui[all] && break
-  [[ $attempt -lt 3 ]] && msg_warn "Open WebUI install attempt $attempt failed, retrying..." && sleep 10
+installed=0
+for attempt in 1 2; do
+  $STD uv tool install --python 3.12 "${OTEL_ARGS[@]}" open-webui[all] && { installed=1; break; }
+  msg_warn "Open WebUI install attempt $attempt failed, retrying..."
+  sleep 10
 done
+((installed)) || $STD uv tool install --python 3.12 "${OTEL_ARGS[@]}" open-webui[all]
 msg_ok "Installed Open WebUI"

 prompt="${var_openwebui_ollama:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Ollama? <y/N> " prompt
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Ollama? <y/N> " prompt || true
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  if [[ "$(arch_resolve)" == "amd64" ]]; then
  msg_info "Setting up Intel® Repositories"
@@ -93,10 +96,6 @@ EOF
    }
  fi
  msg_ok "Installed Intel® Level Zero"
-
-  msg_info "Installing Intel® oneAPI Base Toolkit (Patience)"
-  $STD apt install -y --no-install-recommends intel-basekit-2024.1 2>/dev/null || true
-  msg_ok "Installed Intel® oneAPI Base Toolkit"
  fi

  msg_info "Installing Ollama"
@@ -27,17 +27,22 @@ apt_update_safe
 $STD apt install -y openziti-controller openziti-console </dev/null
 msg_ok "Installed openziti"

-read -r -p "${TAB3}Would you like to go through the auto configuration now? <y/N>" prompt
+prompt="${var_openziti_controller_autoconfig:-}"
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to go through the auto configuration now? <y/N>" prompt || true
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  GEN_FQDN="controller.${LOCAL_IP}.sslip.io"
-  read -r -p "${TAB3}Please enter the controller FQDN [${GEN_FQDN}]: " ZITI_CTRL_ADVERTISED_ADDRESS
+  ZITI_CTRL_ADVERTISED_ADDRESS="${var_openziti_controller_fqdn:-}"
+  [[ -n "$ZITI_CTRL_ADVERTISED_ADDRESS" ]] || read -r -p "${TAB3}Please enter the controller FQDN [${GEN_FQDN}]: " ZITI_CTRL_ADVERTISED_ADDRESS || true
  ZITI_CTRL_ADVERTISED_ADDRESS=${ZITI_CTRL_ADVERTISED_ADDRESS:-$GEN_FQDN}
-  read -r -p "${TAB3}Please enter the controller port [1280]: " ZITI_CTRL_ADVERTISED_PORT
+  ZITI_CTRL_ADVERTISED_PORT="${var_openziti_controller_port:-}"
+  [[ -n "$ZITI_CTRL_ADVERTISED_PORT" ]] || read -r -p "${TAB3}Please enter the controller port [1280]: " ZITI_CTRL_ADVERTISED_PORT || true
  ZITI_CTRL_ADVERTISED_PORT=${ZITI_CTRL_ADVERTISED_PORT:-1280}
-  read -r -p "${TAB3}Please enter the controller admin user [admin]: " ZITI_USER
+  ZITI_USER="${var_openziti_controller_user:-}"
+  [[ -n "$ZITI_USER" ]] || read -r -p "${TAB3}Please enter the controller admin user [admin]: " ZITI_USER || true
  ZITI_USER=${ZITI_USER:-admin}
  GEN_PWD=$(head -c128 /dev/urandom | LC_ALL=C tr -dc 'A-Za-z0-9!@#$%^*_+~' | cut -c 1-12)
-  read -r -p "${TAB3}Please enter the controller admin password [${GEN_PWD}]:" ZITI_PWD
+  ZITI_PWD="${var_openziti_controller_password:-}"
+  [[ -n "$ZITI_PWD" ]] || read -r -p "${TAB3}Please enter the controller admin password [${GEN_PWD}]:" ZITI_PWD || true
  ZITI_PWD=${ZITI_PWD:-$GEN_PWD}
  CONFIG_FILE="/opt/openziti/etc/controller/bootstrap.env"
  sed -i "s|^ZITI_CTRL_ADVERTISED_ADDRESS=.*|ZITI_CTRL_ADVERTISED_ADDRESS='${ZITI_CTRL_ADVERTISED_ADDRESS}'|" "$CONFIG_FILE"
@@ -29,7 +29,8 @@ sed -i '0,/^ExecStart/ { /^ExecStart/ { n; s|^ExecStart.*|ExecStart=/opt/openzit
 systemctl daemon-reload
 msg_ok "Installed openziti"

-read -r -p "${TAB3}Please paste an identity enrollment token(JTW)" prompt
+prompt="${var_openziti_tunnel_enrollment_token:-}"
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Please paste an identity enrollment token(JTW)" prompt || true
 if [[ ${prompt} ]]; then
  msg_info "Adding identity"
  echo "${prompt}" >/opt/openziti/etc/identities/identity.jwt
@@ -27,15 +27,13 @@ fetch_and_deploy_gh_release "gerbil" "fosrl/gerbil" "singlefile" "latest" "/usr/
 fetch_and_deploy_gh_release "traefik" "traefik/traefik" "prebuild" "latest" "/usr/bin" "traefik_v*_linux_$(arch_resolve).tar.gz"

 pango_url="${var_pangolin_url:-}"
-if [[ -z "$pango_url" ]]; then
-  read -rp "${TAB3}Enter your Pangolin URL (ex: https://pangolin.example.com): " pango_url
-fi
+[[ -n "$pango_url" ]] || read -rp "${TAB3}Enter your Pangolin URL (ex: https://pangolin.example.com): " pango_url || true
+[[ -n "$pango_url" ]] || { msg_error "No Pangolin URL given; set var_pangolin_url or answer the prompt"; exit 64; }
 [[ "$pango_url" != https://* && "$pango_url" != http://* ]] && pango_url="https://${pango_url}"

 pango_email="${var_pangolin_email:-}"
-if [[ -z "$pango_email" ]]; then
-  read -rp "${TAB3}Enter your email address: " pango_email
-fi
+[[ -n "$pango_email" ]] || read -rp "${TAB3}Enter your email address: " pango_email || true
+[[ -n "$pango_email" ]] || { msg_error "No email address given; set var_pangolin_email or answer the prompt"; exit 64; }

 msg_info "Setup Pangolin"
 SECRET_KEY=$(random_password 32)
@@ -38,16 +38,22 @@ CGO_ENABLED=1 go build -tags musl -o paperless-gpt .
 msg_ok "Setup Paperless-GPT"

 mkdir -p /opt/paperless-gpt-data
-read -rp "${TAB3}Do you want to enter the Paperless local URL now? (y/n) " input_url
-if [[ $input_url =~ ^[Yy]$ ]]; then
-  read -rp "${TAB3}Enter your Paperless-NGX instance URL (e.g., http://192.168.1.100:8000): " PAPERLESS_BASE_URL
+input_url="${var_paperless_gpt_enter_url:-}"
+[[ -n "$input_url" ]] || read -rp "${TAB3}Do you want to enter the Paperless local URL now? (y/n) " input_url || true
+if [[ $input_url =~ ^[Yy]([Ee][Ss])?$ ]]; then
+  PAPERLESS_BASE_URL="${var_paperless_gpt_url:-}"
+  [[ -n "$PAPERLESS_BASE_URL" ]] || read -rp "${TAB3}Enter your Paperless-NGX instance URL (e.g., http://192.168.1.100:8000): " PAPERLESS_BASE_URL || true
+  [[ -n "$PAPERLESS_BASE_URL" ]] || { msg_error "No Paperless-NGX URL given; set var_paperless_gpt_url or answer the prompt"; exit 64; }
 else
  PAPERLESS_BASE_URL="http://your_paperless_ngx_url"
 fi

-read -rp "${TAB3}Do you want to enter the Paperless API token now? (y/n) " input_token
-if [[ $input_token =~ ^[Yy]$ ]]; then
-  read -rp "${TAB3}Enter your Paperless API token: " PAPERLESS_API_TOKEN
+input_token="${var_paperless_gpt_enter_token:-}"
+[[ -n "$input_token" ]] || read -rp "${TAB3}Do you want to enter the Paperless API token now? (y/n) " input_token || true
+if [[ $input_token =~ ^[Yy]([Ee][Ss])?$ ]]; then
+  PAPERLESS_API_TOKEN="${var_paperless_gpt_api_token:-}"
+  [[ -n "$PAPERLESS_API_TOKEN" ]] || read -rp "${TAB3}Enter your Paperless API token: " PAPERLESS_API_TOKEN || true
+  [[ -n "$PAPERLESS_API_TOKEN" ]] || { msg_error "No Paperless API token given; set var_paperless_gpt_api_token or answer the prompt"; exit 64; }
 else
  PAPERLESS_API_TOKEN="your_paperless_api_token"
 fi
@@ -172,7 +172,7 @@ systemctl enable -q --now paperless-webserver paperless-scheduler paperless-task
 msg_ok "Created Services"

 prompt="${var_paperless_ngx_adminer:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Adminer? <y/N> " prompt
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Adminer? <y/N> " prompt || true
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
  setup_adminer
 fi
@@ -57,10 +57,10 @@ systemctl restart pihole-FTL.service
 msg_ok "Installed Pi-hole"

 prompt="${var_pihole_unbound:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Unbound? <y/N> " prompt
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Unbound? <y/N> " prompt || true
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  prompt="${var_pihole_unbound_dot:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Unbound is configured as a recursive DNS server by default, would you like it to be configured as a forwarding DNS server (using DNS-over-TLS (DoT)) instead? <y/N> " prompt
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Unbound is configured as a recursive DNS server by default, would you like it to be configured as a forwarding DNS server (using DNS-over-TLS (DoT)) instead? <y/N> " prompt || true
  msg_info "Installing Unbound"
  mkdir -p /etc/unbound/unbound.conf.d
  cat <<EOF >/etc/unbound/unbound.conf.d/pi-hole.conf
@@ -43,7 +43,7 @@ $STD rabbitmqctl add_user plane "${RABBITMQ_PASS}"
 $STD rabbitmqctl set_permissions -p plane plane ".*" ".*" ".*"
 msg_ok "Configured RabbitMQ"

-fetch_and_deploy_gh_release "silo" "pgsty/silo" "prebuild" "latest" "/opt/silo" "silo_*_linux_$(arch_resolve).tar.gz"
+fetch_and_deploy_gh_release "silo_s3" "pgsty/silo" "prebuild" "latest" "/opt/silo" "silo_*_linux_$(arch_resolve).tar.gz"
 fetch_and_deploy_gh_release "silo_mcli" "pgsty/mc" "prebuild" "latest" "/opt/mcli" "mcli_*_linux_$(arch_resolve).tar.gz"

 msg_info "Configuring Silo"
@@ -13,7 +13,9 @@ setting_up_container
 network_check
 update_os

-read -r -p "${TAB3}What public URL do you want to use (e.g. pocketid.mydomain.com)? " public_url
+public_url="${var_pocketid_url:-}"
+[[ -n "$public_url" ]] || read -r -p "${TAB3}What public URL do you want to use (e.g. pocketid.mydomain.com)? " public_url || true
+[[ -n "$public_url" ]] || { msg_error "No public URL given; set var_pocketid_url or answer the prompt"; exit 64; }
 fetch_and_deploy_gh_release "pocket-id" "pocket-id/pocket-id" "singlefile" "latest" "/opt/pocket-id/" "pocket-id_linux_$(arch_resolve)"

 msg_info "Configuring Pocket ID"
@@ -13,6 +13,11 @@ setting_up_container
 network_check
 update_os

+if is_debian && [[ "$(get_os_version_major)" -lt 13 ]]; then
+  msg_error "Podman Home Assistant needs Debian 13: its Quadlet units require Podman 4.4 or newer."
+  exit 238
+fi
+
 PORTAINER_LATEST_VERSION=$(get_latest_github_release "portainer/portainer")
 PORTAINER_AGENT_LATEST_VERSION=$(get_latest_github_release "portainer/agent")

@@ -49,7 +54,7 @@ msg_ok "Installed Podman"
 mkdir -p /etc/containers/systemd

 prompt="${var_podman_homeassistant_portainer:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Portainer? <y/N> " prompt
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Portainer? <y/N> " prompt || true
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  msg_info "Installing Portainer $PORTAINER_LATEST_VERSION"
  podman volume create portainer_data >/dev/null
@@ -77,7 +82,7 @@ EOF
  msg_ok "Installed Portainer $PORTAINER_LATEST_VERSION"
 else
  prompt="${var_podman_homeassistant_portainer_agent:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add the Portainer Agent? <y/N> " prompt
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add the Portainer Agent? <y/N> " prompt || true
  if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
    msg_info "Installing Portainer agent $PORTAINER_AGENT_LATEST_VERSION"
    cat <<EOF >/etc/containers/systemd/portainer-agent.container
@@ -49,7 +49,7 @@ msg_ok "Installed Podman"
 mkdir -p /etc/containers/systemd

 prompt="${var_podman_portainer:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Portainer? <y/N> " prompt
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Portainer? <y/N> " prompt || true
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  msg_info "Installing Portainer $PORTAINER_LATEST_VERSION"
  podman volume create portainer_data >/dev/null
@@ -78,7 +78,7 @@ EOF
  msg_ok "Installed Portainer $PORTAINER_LATEST_VERSION"
 else
  prompt="${var_podman_portainer_agent:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add the Portainer Agent? <y/N> " prompt
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add the Portainer Agent? <y/N> " prompt || true
  if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
    msg_info "Installing Portainer agent $PORTAINER_AGENT_LATEST_VERSION"
    $STD podman pull docker.io/portainer/agent:latest
@@ -14,9 +14,11 @@ network_check
 update_os

 setup_deb_based() {
-  read -r -p "${TAB3}Enter PostgreSQL version (15/16/17/18): " ver
+  ver="${var_postgresql_version:-}"
+  [[ -n "$ver" ]] || read -r -p "${TAB3}Enter PostgreSQL version (15/16/17/18) [17]: " ver || true
+  ver="${ver:-17}"
  [[ $ver =~ ^(15|16|17|18)$ ]] || {
-    echo "Invalid version"
+    msg_error "Invalid PostgreSQL version: ${ver} (expected 15, 16, 17 or 18)"
    exit 64
  }
  PG_VERSION=$ver setup_postgresql
@@ -136,8 +138,13 @@ EOF
 }

 setup_alpine() {
-  read -r -p "${TAB3}Enter PostgreSQL version (15/16/17): " ver
-  [[ $ver =~ ^(15|16|17)$ ]] || { echo "Invalid version"; exit 64; }
+  ver="${var_postgresql_version:-}"
+  [[ -n "$ver" ]] || read -r -p "${TAB3}Enter PostgreSQL version (16/17/18) [17]: " ver || true
+  ver="${ver:-17}"
+  [[ $ver =~ ^(16|17|18)$ ]] || {
+    msg_error "Invalid PostgreSQL version: ${ver} (expected 16, 17 or 18)"
+    exit 64
+  }

  msg_info "Installing PostgreSQL ${ver}"
  $STD apk add --no-cache postgresql${ver} postgresql${ver}-contrib postgresql${ver}-openrc sudo
@@ -24,7 +24,7 @@ cd /opt/proxcenter/frontend
 $STD npm ci --legacy-peer-deps --ignore-scripts
 $STD npm run build:icons
 $STD npx prisma generate
-NODE_OPTIONS="--max-old-space-size=4608" $STD npm run build
+PROXCENTER_SKIP_TYPECHECK=1 NODE_OPTIONS="--max-old-space-size=3072" $STD npm run build
 msg_ok "Built ProxCenter"

 msg_info "Configuring ProxCenter"
@@ -47,9 +47,15 @@ msg_ok "Installed PHP"

 MARIADB_DB_NAME="panel" MARIADB_DB_USER="pterodactyl" MARIADB_DB_CREDS_FILE="$HOME/pterodactyl-panel.creds" setup_mariadb_db

-read -p "${TAB3}Provide an email address for admin login, this should be a valid email address: " ADMIN_EMAIL
-read -p "${TAB3}Enter your First Name: " NAME_FIRST
-read -p "${TAB3}Enter your Last Name: " NAME_LAST
+ADMIN_EMAIL="${var_pterodactyl_panel_admin_email:-}"
+[[ -n "$ADMIN_EMAIL" ]] || read -r -p "${TAB3}Provide an email address for admin login, this should be a valid email address: " ADMIN_EMAIL || true
+[[ -n "$ADMIN_EMAIL" ]] || { msg_error "No admin email given; set var_pterodactyl_panel_admin_email or answer the prompt"; exit 64; }
+NAME_FIRST="${var_pterodactyl_panel_first_name:-}"
+[[ -n "$NAME_FIRST" ]] || read -r -p "${TAB3}Enter your First Name: " NAME_FIRST || true
+[[ -n "$NAME_FIRST" ]] || { msg_error "No first name given; set var_pterodactyl_panel_first_name or answer the prompt"; exit 64; }
+NAME_LAST="${var_pterodactyl_panel_last_name:-}"
+[[ -n "$NAME_LAST" ]] || read -r -p "${TAB3}Enter your Last Name: " NAME_LAST || true
+[[ -n "$NAME_LAST" ]] || { msg_error "No last name given; set var_pterodactyl_panel_last_name or answer the prompt"; exit 64; }

 fetch_and_deploy_gh_release "pterodactyl-panel" "pterodactyl/panel" "prebuild" "latest" "/opt/pterodactyl-panel" "panel.tar.gz"

@@ -13,11 +13,8 @@ setting_up_container
 network_check
 update_os

-if [[ -n "${var_rustdesk_api:-}" ]]; then
-  prompt="$var_rustdesk_api"
-else
-  read -r -p "${TAB3}Would you like to add the RustDesk API web UI (lejianwen/rustdesk-api, unmaintained since 09/2025)? <y/N> " prompt
-fi
+prompt="${var_rustdesk_api:-}"
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add the RustDesk API web UI (lejianwen/rustdesk-api, unmaintained since 09/2025)? <y/N> " prompt || true
 INSTALL_API=0
 [[ "${prompt,,}" =~ ^(y|yes|true)$ ]] && INSTALL_API=1
 API_PASS="$(random_password 16)"
@@ -41,7 +41,7 @@ $STD uv pip install -r /opt/sabnzbd/requirements.txt --python=/opt/sabnzbd/venv/
 msg_ok "Installed SABnzbd"

 prompt="${var_sabnzbd_par2_turbo:-}"
-[[ -n "$prompt" ]] || read -r -p "Would you like to install par2cmdline-turbo? <y/N> " prompt
+[[ -n "$prompt" ]] || read -r -p "Would you like to install par2cmdline-turbo? <y/N> " prompt || true
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
  mv /usr/bin/par2 /usr/bin/par2.old
  fetch_and_deploy_gh_release "par2cmdline-turbo" "animetosho/par2cmdline-turbo" "prebuild" "latest" "/usr/bin/" "*-linux-$(arch_resolve).zip"
@@ -47,7 +47,8 @@ echo " 3) Use an existing Flaresolverr/Byparr LXC"
 echo " 4) Disable captcha bypassing altogether (not recommended)"
 echo ""

-read -r -p "${TAB3}Select deployment type [1]: " DEPLOYMENT_TYPE
+DEPLOYMENT_TYPE="${var_shelfmark_deployment_type:-}"
+[[ -n "$DEPLOYMENT_TYPE" ]] || read -r -p "${TAB3}Select deployment type [1]: " DEPLOYMENT_TYPE || true
 DEPLOYMENT_TYPE="${DEPLOYMENT_TYPE:-1}"
 if [[ "$(arch_resolve)" == "arm64" && "$DEPLOYMENT_TYPE" == "2" ]]; then
  msg_warn "FlareSolverr has no arm64 build; using Shelfmark's internal bypasser instead"
@@ -69,7 +70,8 @@ case "$DEPLOYMENT_TYPE" in
  echo "Example: http://flaresoverr.homelab.lan:8191 or"
  echo "http://192.168.10.99:8191"
  echo ""
-  read -r -p "FlareSolverr/Byparr URL: " BYPASSER_URL
+  BYPASSER_URL="${var_shelfmark_bypasser_url:-}"
+  [[ -n "$BYPASSER_URL" ]] || read -r -p "FlareSolverr/Byparr URL: " BYPASSER_URL || true

  if [[ -z "$BYPASSER_URL" ]]; then
    msg_warn "No Flaresolverr/Byparr URL provided. Falling back to Shelfmark's internal bypasser."
@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os

-fetch_and_deploy_gh_release "silo" "pgsty/silo" "binary"
+fetch_and_deploy_gh_release "silo_s3" "pgsty/silo" "binary"

 msg_info "Configuring Silo"
 mkdir -p /opt/silo_data
@@ -18,7 +18,7 @@ mkdir -p /opt/silverbullet/space

 RUNTIME_API_ENV=""
 runtime_api_prompt="${var_silverbullet_runtime_api:-}"
-[[ -n "$runtime_api_prompt" ]] || read -rp "${TAB3}Enable Silverbullet Runtime API? Requires Chromium (~700MB). Uses ~200MB extra RAM. (y/N): " runtime_api_prompt
+[[ -n "$runtime_api_prompt" ]] || read -rp "${TAB3}Enable Silverbullet Runtime API? Requires Chromium (~700MB). Uses ~200MB extra RAM. (y/N): " runtime_api_prompt || true
 if [[ "${runtime_api_prompt,,}" =~ ^(y|yes)$ ]]; then
  msg_info "Installing Chromium for Runtime API"
  $STD apt install -y chromium
@@ -37,7 +37,7 @@ sed -i \
 msg_ok "Configured Slskd"

 soularr="${var_slskd_soularr:-}"
-[[ -n "$soularr" ]] || read -rp "${TAB3}Do you want to install Soularr? y/N " soularr
+[[ -n "$soularr" ]] || read -rp "${TAB3}Do you want to install Soularr? y/N " soularr || true
 if [[ ${soularr,,} =~ ^(y|yes)$ ]]; then
  PYTHON_VERSION="3.11" setup_uv
  fetch_and_deploy_gh_release "Soularr" "mrusse/soularr" "tarball" "latest" "/opt/soularr"
@@ -46,7 +46,8 @@ echo 'export PATH="$PATH:/opt/mssql-tools18/bin"' >>~/.bash_profile
 source ~/.bash_profile
 msg_ok "Installed SQL Server Tools"

-read -r -p "${TAB3}Do you want to run the SQL server setup now? (Later is also possible) <y/N>" prompt
+prompt="${var_sqlserver2022_setup_now:-}"
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Do you want to run the SQL server setup now? (Later is also possible) <y/N>" prompt || true
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
  /opt/mssql/bin/mssql-conf setup
 else
@@ -46,7 +46,8 @@ echo 'export PATH="$PATH:/opt/mssql-tools18/bin"' >>~/.bash_profile
 source ~/.bash_profile
 msg_ok "Installed SQL Server Tools"

-read -r -p "${TAB3}Do you want to run the SQL Server setup now? (Later is also possible) <y/N>" prompt
+prompt="${var_sqlserver2025_setup_now:-}"
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Do you want to run the SQL Server setup now? (Later is also possible) <y/N>" prompt || true
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
  /opt/mssql/bin/mssql-conf setup
 else
@@ -17,24 +17,55 @@ msg_info "Installing Dependencies"
 $STD apt install -y \
  build-essential \
  git \
-  pkg-config \
-  libsqlite3-dev \
+  cmake \
  sqlite3 \
-  python3-setuptools \
-  ffmpeg
+  libsqlite3-dev \
+  argon2 \
+  ffmpeg \
+  libcurl4t64 \
+  libxml2
 msg_ok "Installed Dependencies"

-NODE_VERSION="24" NODE_MODULE="corepack,yarn" setup_nodejs
+NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs

-fetch_and_deploy_gh_release "readium" "readium/cli" "prebuild" "latest" "/opt/readium" "readium_linux_$(arch_resolve "x86_64" "arm64").tar.gz"
+fetch_and_deploy_gh_release "readium" "readium/cli" "prebuild" "v0.9.1" "/opt/readium" "readium_linux_$(arch_resolve "x86_64" "arm64").tar.gz"
 ln -sf /opt/readium/readium /usr/local/bin/readium
 fetch_and_deploy_gl_release "storyteller" "storyteller-platform/storyteller" "tarball" "latest" "/opt/storyteller" "" "web-v2"

-msg_info "Setting up Storyteller"
+msg_info "Building Storyteller (Patience)"
 cd /opt/storyteller
+$STD corepack yarn install
+export NODE_ENV=production
+export NEXT_TELEMETRY_DISABLED=1
+export SQLITE_NATIVE_BINDING=/opt/storyteller/node_modules/better-sqlite3/build/Release/better_sqlite3.node
+$STD corepack yarn workspaces foreach -Rpt --from @storyteller-platform/web --exclude @storyteller-platform/eslint run build
+STANDALONE=/opt/storyteller/applications/web/.next/standalone
+WEB_DIR="$STANDALONE/applications/web"
+mkdir -p "$WEB_DIR"/{public,.next/static,.next/cache,migrations,sqlite,scripts}
+cp -rT applications/web/public "$WEB_DIR/public"
+cp -rT applications/web/.next/static "$WEB_DIR/.next/static"
+cp -rT applications/web/migrations "$WEB_DIR/migrations"
+cp applications/web/sqlite/uuid.c.so "$WEB_DIR/sqlite/"
+cp docker-scripts/reset-password.sh "$WEB_DIR/scripts/"
+cp -r applications/web/work-dist applications/web/file-write-dist "$WEB_DIR/"
+mkdir -p "$WEB_DIR/work-dist/@storyteller-platform/align/prebuilds"
+cp -r "libraries/align/prebuilds/linux-$(arch_resolve "x64" "arm64")" "$WEB_DIR/work-dist/@storyteller-platform/align/prebuilds/"
+cp node_modules/@echogarden/icu-segmentation-wasm/wasm/*.wasm "$WEB_DIR/work-dist/"
+cp -rT node_modules/@parcel "$STANDALONE/node_modules/@parcel"
+cp -rT node_modules/kuromoji "$STANDALONE/node_modules/kuromoji"
+msg_ok "Built Storyteller"

-$STD corepack yarn install --network-timeout 600000
-$STD gcc -g -fPIC -rdynamic -shared applications/web/sqlite/uuid.c -o applications/web/sqlite/uuid.c.so
+msg_info "Installing Whisper"
+WHISPER_VARIANT="linux-$(arch_resolve "x64" "arm64")-cpu"
+$STD node /opt/storyteller/libraries/ghost-story/dist/cli/bin.js install binary "$WHISPER_VARIANT"
+$STD node /opt/storyteller/libraries/ghost-story/dist/cli/bin.js install model tiny.en
+if [[ "$WHISPER_VARIANT" == "linux-x64-cpu" ]]; then
+  $STD node /opt/storyteller/libraries/ghost-story/dist/cli/bin.js install binary linux-x64-cpu-legacy
+fi
+msg_ok "Installed Whisper"
+
+msg_info "Configuring Storyteller"
+mkdir -p /opt/storyteller/data
 STORYTELLER_SECRET_KEY=$(openssl rand -base64 32)
 cat <<EOF >/opt/storyteller/.env
 STORYTELLER_SECRET_KEY=${STORYTELLER_SECRET_KEY}
@@ -45,33 +76,14 @@ READIUM_PORT=9000
 NODE_ENV=production
 NEXT_TELEMETRY_DISABLED=1
 EOF
-mkdir -p /opt/storyteller/data
+chmod 600 /opt/storyteller/.env
+ln -sf /opt/storyteller/.env "$WEB_DIR/.env"
 cat <<EOF >~/storyteller.creds
 Storyteller Credentials
 =======================
 Secret Key: ${STORYTELLER_SECRET_KEY}
 EOF
-msg_ok "Set up Storyteller"
-
-msg_info "Building Storyteller"
-cd /opt/storyteller
-export CI=1
-export NODE_ENV=production
-export NEXT_TELEMETRY_DISABLED=1
-export SQLITE_NATIVE_BINDING=/opt/storyteller/node_modules/better-sqlite3/build/Release/better_sqlite3.node
-$STD corepack yarn workspaces foreach -Rpt --from @storyteller-platform/web --exclude @storyteller-platform/eslint run build
-mkdir -p /opt/storyteller/applications/web/.next/standalone/applications/web/.next/static
-cp -rT /opt/storyteller/applications/web/.next/static /opt/storyteller/applications/web/.next/standalone/applications/web/.next/static
-if [[ -d /opt/storyteller/applications/web/public ]]; then
-  mkdir -p /opt/storyteller/applications/web/.next/standalone/applications/web/public
-  cp -rT /opt/storyteller/applications/web/public /opt/storyteller/applications/web/.next/standalone/applications/web/public
-fi
-mkdir -p /opt/storyteller/applications/web/.next/standalone/applications/web/migrations
-cp -rT /opt/storyteller/applications/web/migrations /opt/storyteller/applications/web/.next/standalone/applications/web/migrations
-mkdir -p /opt/storyteller/applications/web/.next/standalone/applications/web/sqlite
-cp -rT /opt/storyteller/applications/web/sqlite /opt/storyteller/applications/web/.next/standalone/applications/web/sqlite
-ln -sf /opt/storyteller/.env /opt/storyteller/applications/web/.next/standalone/applications/web/.env
-msg_ok "Built Storyteller"
+msg_ok "Configured Storyteller"

 msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/storyteller.service
@@ -82,8 +94,12 @@ After=network.target
 [Service]
 Type=simple
 User=root
-WorkingDirectory=/opt/storyteller/applications/web/.next/standalone/applications/web
+WorkingDirectory=${WEB_DIR}
 EnvironmentFile=/opt/storyteller/.env
+Environment=SQLITE_NATIVE_BINDING=${STANDALONE}/node_modules/better-sqlite3/build/Release/better_sqlite3.node
+Environment=ERROR_ALIGN_NATIVE_BINDING=${WEB_DIR}/work-dist/@storyteller-platform/align/
+Environment=STORYTELLER_WORKER=worker.mjs
+Environment=STORYTELLER_FILE_WRITE_WORKER=fileWriteWorker.mjs
 ExecStart=/usr/bin/node --enable-source-maps server.js
 Restart=on-failure
 RestartSec=5
@@ -47,8 +47,9 @@ User=root
 Group=root
 Type=simple
 WorkingDirectory=/opt/tdarr/Tdarr_Server
-ExecStartPre=/opt/tdarr/Tdarr_Updater
+ExecStartPre=-/opt/tdarr/Tdarr_Updater
 ExecStart=/opt/tdarr/Tdarr_Server/Tdarr_Server
+TimeoutStartSec=600
 TimeoutStopSec=20
 KillMode=process
 Restart=on-failure
@@ -32,7 +32,9 @@ Password: ${PASS}
 EOF
  msg_ok "Set up Tinyauth"

-  read -r -p "${TAB3}Enter your Tinyauth subdomain (e.g. https://tinyauth.example.com): " app_url
+  app_url="${var_tinyauth_app_url:-}"
+  [[ -n "$app_url" ]] || read -r -p "${TAB3}Enter your Tinyauth subdomain (e.g. https://tinyauth.example.com): " app_url || true
+  [[ -n "$app_url" ]] || { msg_error "No Tinyauth app URL given; set var_tinyauth_app_url or answer the prompt"; exit 64; }

  msg_info "Creating Service"
  cat <<EOF >/opt/tinyauth/.env
@@ -77,7 +79,9 @@ Password: ${PASS}
 EOF
  msg_ok "Configured Tinyauth"

-  read -r -p "${TAB3}Enter your Tinyauth subdomain (e.g. https://tinyauth.example.com): " app_url
+  app_url="${var_tinyauth_app_url:-}"
+  [[ -n "$app_url" ]] || read -r -p "${TAB3}Enter your Tinyauth subdomain (e.g. https://tinyauth.example.com): " app_url || true
+  [[ -n "$app_url" ]] || { msg_error "No Tinyauth app URL given; set var_tinyauth_app_url or answer the prompt"; exit 64; }

  cat <<EOF >/opt/tinyauth/.env
 TINYAUTH_DATABASE_PATH=/opt/tinyauth/database.db
@@ -106,7 +106,7 @@ setup_alpine() {
  msg_ok "Installed Traefik"

  enable_webui="${var_traefik_webui:-}"
-  [[ -n "$enable_webui" ]] || read -p "${TAB3}Enable Traefik WebUI (Port 8080)? [y/N]: " enable_webui
+  [[ -n "$enable_webui" ]] || read -r -p "${TAB3}Enable Traefik WebUI (Port 8080)? [y/N]: " enable_webui || true
  if [[ "${enable_webui,,}" =~ ^(y|yes)$ ]]; then
    msg_info "Configuring Traefik WebUI"
    sed -i 's/localhost//g' /etc/traefik/traefik.yaml
@@ -14,17 +14,17 @@ network_check
 update_os

 install -d -m 0700 /etc/twingate
-access_token=""
-refresh_token=""
-network=""
+access_token="${var_twingate_connector_access_token:-}"
+refresh_token="${var_twingate_connector_refresh_token:-}"
+network="${var_twingate_connector_network:-}"
 while [[ -z "$access_token" ]]; do
-  read -rp "${TAB3}Please enter your access token: " access_token
+  read -rp "${TAB3}Please enter your access token: " access_token || { msg_error "No access token given; set var_twingate_connector_access_token or answer the prompt"; exit 64; }
 done
 while [[ -z "$refresh_token" ]]; do
-  read -rp "${TAB3}Please enter your refresh token: " refresh_token
+  read -rp "${TAB3}Please enter your refresh token: " refresh_token || { msg_error "No refresh token given; set var_twingate_connector_refresh_token or answer the prompt"; exit 64; }
 done
 while [[ -z "$network" ]]; do
-  read -rp "${TAB3}Please enter your network name: " network
+  read -rp "${TAB3}Please enter your network name: " network || { msg_error "No network name given; set var_twingate_connector_network or answer the prompt"; exit 64; }
 done

 msg_info "Setup Twingate Repository"