cryptpad: allow git-based npm dependencies for drawio and json.sortify under npm v12

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

CHANGELOG.md

@@ -536,6 +536,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - Fix/poznote - 1st party Docker parity [@lucas-at-3x-eye](https://github.com/lucas-at-3x-eye) ([#17011](https://github.com/community-scripts/ProxmoxVE/pull/17011))
     - fix-update-authentik-2026.8.1 [@thieneret](https://github.com/thieneret) ([#16999](https://github.com/community-scripts/ProxmoxVE/pull/16999))
 
 ### 💾 Core

ct/baserow.sh

@@ -48,7 +48,7 @@ function update_script() {
 
     msg_info "Rebuilding Frontend"
     cd /opt/baserow/web-frontend
-    $STD npm install
+    $STD npm install --allow-remote=all
     $STD npm run build
     msg_ok "Rebuilt Frontend"
 

ct/bentopdf.sh

@@ -44,7 +44,7 @@ function update_script() {
 
     msg_info "Configuring BentoPDF"
     cd /opt/bentopdf
-    $STD npm ci --no-audit --no-fund
+    $STD npm ci --no-audit --no-fund --allow-remote=all
     export NODE_OPTIONS="--max-old-space-size=3072"
     export SIMPLE_MODE=true
     export VITE_USE_CDN=true

ct/cryptpad.sh

@@ -51,7 +51,7 @@ function update_script() {
 
     msg_info "Updating CryptPad"
     cd /opt/cryptpad
-    $STD npm ci
+    $STD npm ci --allow-git=all
     $STD npm run install:components
     if [ -f "/opt/cryptpad/install-onlyoffice.sh" ]; then
       $STD bash /opt/cryptpad/install-onlyoffice.sh --accept-license

ct/librechat.sh

@@ -45,7 +45,7 @@ function update_script() {
 
     msg_info "Installing Dependencies"
     cd /opt/librechat
-    $STD npm ci
+    $STD npm ci --allow-remote=all
     msg_ok "Installed Dependencies"
 
     msg_info "Building Frontend"

ct/pangolin.sh

@@ -63,7 +63,7 @@ function update_script() {
 
     msg_info "Updating Pangolin"
     cd /opt/pangolin
-    $STD npm ci
+    $STD npm ci --allow-remote=all
     $STD npm run set:pg
     $STD npm run set:oss
     rm -rf server/private

ct/poznote.sh

@@ -35,6 +35,7 @@ function update_script() {
   if check_for_gh_release "poznote" "timothepoznanski/poznote"; then
     msg_info "Stopping Service"
     systemctl stop nginx
+    systemctl stop poznote-reminder-worker poznote-s3-backup-worker 2>/dev/null || true
     msg_ok "Stopped Service"
 
     create_backup /var/www/html/data
@@ -48,8 +49,178 @@ function update_script() {
 
     restore_backup
 
+    msg_info "Running Poznote Initialization"
+    chmod +x /opt/poznote/init.sh
+    $STD /opt/poznote/init.sh
+    msg_ok "Initialized Poznote Data Directory"
+
+    msg_info "Updating Nginx Configuration"
+    [[ -f /etc/nginx/sites-available/poznote ]] && cp /etc/nginx/sites-available/poznote /etc/nginx/sites-available/poznote.bak
+    PHP_SOCK=$(get_php_fpm_socket)
+    cat <<EOF >/etc/nginx/sites-available/poznote
+# The Excalidraw editor must keep its window.opener relationship with
+# libraries.excalidraw.com so "Add to Excalidraw" can hand the chosen library
+# back to the already-open editor tab; COOP same-origin would sever it.
+map \$uri \$poznote_coop {
+    default                  "same-origin";
+    /excalidraw_editor.php   "unsafe-none";
+}
+
+server {
+    listen 8040;
+    root /var/www/html;
+    index index.php index.html;
+
+    gzip on;
+    gzip_comp_level 5;
+    gzip_min_length 1024;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_types text/css application/javascript text/javascript application/json
+               image/svg+xml application/manifest+json font/ttf font/otf;
+
+    location ~* \.webmanifest$ {
+        default_type application/manifest+json;
+        try_files \$uri =404;
+    }
+
+    client_max_body_size 800M;
+
+    location /api/v1 {
+        try_files \$uri \$uri/ /api/v1/index.php?\$query_string;
+    }
+
+    location = /api/health {
+        rewrite ^ /api_health.php last;
+    }
+
+    location = /api/info {
+        rewrite ^ /api_health.php last;
+    }
+
+    location / {
+        try_files \$uri \$uri/ @poznote_public;
+    }
+
+    location @poznote_public {
+        rewrite ^/folder/([^/]+)/?$ /public_folder.php?token=\$1 last;
+        rewrite ^/workspace/([^/]+)/?$ /public_note.php?token=\$1 last;
+        rewrite ^/([^/]+)/?$ /public_slug.php?slug=\$1 last;
+    }
+
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Cross-Origin-Opener-Policy \$poznote_coop always;
+    add_header Cross-Origin-Resource-Policy "same-origin" always;
+    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;
+
+    location ~* ^/data/.*\.(php[0-9]?|phtml|phar|pht)$ {
+        deny all;
+    }
+
+    location ~ \.php$ {
+        include fastcgi_params;
+        fastcgi_pass unix:${PHP_SOCK};
+        fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
+        fastcgi_param DOCUMENT_ROOT \$document_root;
+        fastcgi_param PATH_INFO \$fastcgi_path_info;
+
+        fastcgi_param HTTP_X_FORWARDED_FOR \$http_x_forwarded_for;
+        fastcgi_param HTTP_X_FORWARDED_PROTO \$http_x_forwarded_proto;
+        fastcgi_param HTTP_X_FORWARDED_HOST \$http_x_forwarded_host;
+        fastcgi_param HTTP_X_FORWARDED_PORT \$http_x_forwarded_port;
+        fastcgi_param HTTP_X_REAL_IP \$http_x_real_ip;
+        fastcgi_param HTTPS \$https if_not_empty;
+
+        # fastcgi_read_timeout 600;
+        # fastcgi_send_timeout 600;
+        # Left at nginx's 60s default, not Docker's 600s:
+        # a stalled git-sync request can hold the PHP session lock, otherwise
+    }
+
+    location ~ /\. {
+        deny all;
+    }
+
+    location ~ ^/data/users/[0-9]+/backgrounds/ {
+        try_files \$uri =404;
+    }
+
+    location ~ ^/data/css/[A-Za-z0-9._-]+\.css$ {
+        try_files \$uri =404;
+    }
+
+    location ~ ^/(data|config)/ {
+        deny all;
+    }
+
+    location ~* ^/pwa/poznote(-[0-9]+)?\.png$ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Cross-Origin-Resource-Policy "cross-origin" always;
+        try_files \$uri =404;
+    }
+
+    location ~* \.(?:js|css|png|jpg|jpeg|gif|svg|ico|woff2?|ttf|otf|eot|webp|webmanifest)$ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Cross-Origin-Resource-Policy "same-origin" always;
+        try_files \$uri =404;
+    }
+}
+EOF
+    msg_ok "Updated Nginx Configuration"
+
+    if [[ ! -f /etc/systemd/system/poznote-reminder-worker.service ]]; then
+      msg_info "Creating Reminder Worker Service"
+      cat <<EOF >/etc/systemd/system/poznote-reminder-worker.service
+[Unit]
+Description=Poznote Reminder Email Worker
+After=network.target
+
+[Service]
+Type=simple
+User=www-data
+Group=www-data
+Restart=always
+ExecStart=/usr/bin/php /var/www/html/workers/reminder-email-worker.php
+WorkingDirectory=/var/www/html
+
+[Install]
+WantedBy=multi-user.target
+EOF
+      systemctl daemon-reload
+      msg_ok "Created Reminder Worker Service"
+    fi
+
+    if [[ ! -f /etc/systemd/system/poznote-s3-backup-worker.service ]]; then
+      msg_info "Creating S3 Backup Worker Service"
+      cat <<EOF >/etc/systemd/system/poznote-s3-backup-worker.service
+[Unit]
+Description=Poznote S3 Backup Worker
+After=network.target
+
+[Service]
+Type=simple
+User=www-data
+Group=www-data
+Restart=always
+ExecStart=/usr/bin/php /var/www/html/workers/s3-backup-worker.php
+WorkingDirectory=/var/www/html
+
+[Install]
+WantedBy=multi-user.target
+EOF
+      systemctl daemon-reload
+      msg_ok "Created S3 Backup Worker Service"
+    fi
+
     msg_info "Starting Service"
     systemctl start nginx
+    systemctl enable -q --now poznote-reminder-worker poznote-s3-backup-worker
     msg_ok "Started Service"
     msg_ok "Updated successfully!"
   fi

install/baserow-install.sh

@@ -45,7 +45,7 @@ msg_ok "Installed Backend Dependencies"
 
 msg_info "Building Frontend"
 cd /opt/baserow/web-frontend
-NODE_OPTIONS="--max-old-space-size=4096" $STD npm install --legacy-peer-deps
+NODE_OPTIONS="--max-old-space-size=4096" $STD npm install --legacy-peer-deps --allow-remote=all
 NODE_OPTIONS="--max-old-space-size=4096" $STD npm run build
 msg_ok "Built Frontend"
 

install/bentopdf-install.sh

@@ -24,7 +24,7 @@ fetch_and_deploy_gh_release "bentopdf" "alam00000/bentopdf" "tarball" "latest" "
 
 msg_info "Setup BentoPDF"
 cd /opt/bentopdf
-$STD npm ci --no-audit --no-fund
+$STD npm ci --no-audit --no-fund --allow-remote=all
 cp ./.env.example ./.env.production
 export NODE_OPTIONS="--max-old-space-size=3072"
 export SIMPLE_MODE=true

install/cryptpad-install.sh

@@ -24,7 +24,7 @@ fetch_and_deploy_gh_release "cryptpad" "cryptpad/cryptpad" "tarball"
 
 msg_info "Setup CryptPad"
 cd /opt/cryptpad
-$STD npm ci
+$STD npm ci --allow-git=all
 $STD npm run install:components
 if [[ "$onlyoffice" =~ ^[Yy]$ ]]; then
   $STD bash -c "./install-onlyoffice.sh --accept-license"

install/fileflows-install.sh

@@ -45,7 +45,7 @@ $STD ln -svf /usr/bin/ffmpeg /usr/local/bin/ffmpeg
 $STD ln -svf /usr/bin/ffprobe /usr/local/bin/ffprobe
 $STD rm -rf /opt/fileflows/Server/runtimes/win-*
 
-read -r -p "${TAB3}Do you want to install FileFlows Server or Agent? (S/A): " install_server
+read -r -p "${TAB3}Do you want to install FileFlows Server or Node? (S/N): " install_server
 
 if [[ "$install_server" =~ ^[Ss]$ ]]; then
   msg_info "Installing FileFlows Server"
@@ -54,23 +54,15 @@ if [[ "$install_server" =~ ^[Ss]$ ]]; then
   systemctl enable -q --now fileflows
   msg_ok "Installed FileFlows Server"
 else
-  msg_info "Installing FileFlows Agent"
-  stop_spinner
+  msg_info "Installing FileFlows Node"
   read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url
   while [[ -z "${server_url// /}" ]]; do
     read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url
   done
-  cd /opt/fileflows/Agent
-  before_units="$(systemctl list-unit-files 'fileflows*' --no-legend 2>/dev/null | awk '{print $1}' | sort || true)"
-  $STD dotnet FileFlows.Agent.dll --server "$server_url" --systemd install --root true
-  after_units="$(systemctl list-unit-files 'fileflows*' --no-legend 2>/dev/null | awk '{print $1}' | sort || true)"
-  agent_unit="$(comm -13 <(echo "$before_units") <(echo "$after_units") | head -n1)"
-  if [[ -n "$agent_unit" ]]; then
-    systemctl enable -q --now "$agent_unit"
-  else
-    msg_warn "Could not detect the FileFlows Agent systemd unit; start it manually (systemctl list-unit-files 'fileflows*')."
-  fi
-  msg_ok "Installed FileFlows Agent"
+  cd /opt/fileflows/Node
+  $STD dotnet FileFlows.Node.dll --server "$server_url" --systemd install --root true
+  systemctl enable -q --now fileflows-node
+  msg_ok "Installed FileFlows Node"
 fi
 
 motd_ssh

install/librechat-install.sh

@@ -25,7 +25,7 @@ fetch_and_deploy_gh_release "rag-api" "danny-avila/rag_api" "tarball"
 
 msg_info "Installing LibreChat Dependencies"
 cd /opt/librechat
-$STD npm ci
+$STD npm ci --allow-remote=all
 msg_ok "Installed LibreChat Dependencies"
 
 msg_info "Building Frontend"

install/pangolin-install.sh

@@ -45,7 +45,7 @@ SECRET_KEY=$(openssl rand -base64 48 | tr -dc 'A-Za-z0-9' | head -c 32)
 BADGER_VERSION=$(get_latest_github_release "fosrl/badger" "false")
 cd /opt/pangolin
 mkdir -p /opt/pangolin/config/{traefik,db,letsencrypt,logs}
-$STD npm ci
+$STD npm ci --allow-remote=all
 $STD npm run set:pg
 $STD npm run set:oss
 rm -rf server/private

install/poznote-install.sh

@@ -28,16 +28,73 @@ touch /var/www/html/data/database/poznote.db
 chown -R www-data:www-data /var/www/html
 msg_ok "Deployed Poznote"
 
+msg_info "Running Poznote Initialization"
+chmod +x /opt/poznote/init.sh
+$STD /opt/poznote/init.sh
+msg_ok "Initialized Poznote Data Directory"
+
 msg_info "Configuring Nginx"
 PHP_SOCK=$(get_php_fpm_socket)
 cat <<EOF >/etc/nginx/sites-available/poznote
+# The Excalidraw editor must keep its window.opener relationship with
+# libraries.excalidraw.com so "Add to Excalidraw" can hand the chosen library
+# back to the already-open editor tab; COOP same-origin would sever it.
+map \$uri \$poznote_coop {
+    default                  "same-origin";
+    /excalidraw_editor.php   "unsafe-none";
+}
+
 server {
     listen 8040;
     root /var/www/html;
     index index.php index.html;
 
+    gzip on;
+    gzip_comp_level 5;
+    gzip_min_length 1024;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_types text/css application/javascript text/javascript application/json
+               image/svg+xml application/manifest+json font/ttf font/otf;
+
+    location ~* \.webmanifest$ {
+        default_type application/manifest+json;
+        try_files \$uri =404;
+    }
+
+    client_max_body_size 800M;
+
+    location /api/v1 {
+        try_files \$uri \$uri/ /api/v1/index.php?\$query_string;
+    }
+
+    location = /api/health {
+        rewrite ^ /api_health.php last;
+    }
+
+    location = /api/info {
+        rewrite ^ /api_health.php last;
+    }
+
     location / {
-        try_files \$uri \$uri/ /index.php?\$query_string;
+        try_files \$uri \$uri/ @poznote_public;
+    }
+
+    location @poznote_public {
+        rewrite ^/folder/([^/]+)/?$ /public_folder.php?token=\$1 last;
+        rewrite ^/workspace/([^/]+)/?$ /public_note.php?token=\$1 last;
+        rewrite ^/([^/]+)/?$ /public_slug.php?slug=\$1 last;
+    }
+
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Cross-Origin-Opener-Policy \$poznote_coop always;
+    add_header Cross-Origin-Resource-Policy "same-origin" always;
+    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;
+
+    location ~* ^/data/.*\.(php[0-9]?|phtml|phar|pht)$ {
+        deny all;
     }
 
     location ~ \.php$ {
@@ -45,16 +102,93 @@ server {
         fastcgi_pass unix:${PHP_SOCK};
         fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
         fastcgi_param DOCUMENT_ROOT \$document_root;
+        fastcgi_param PATH_INFO \$fastcgi_path_info;
+
+        fastcgi_param HTTP_X_FORWARDED_FOR \$http_x_forwarded_for;
+        fastcgi_param HTTP_X_FORWARDED_PROTO \$http_x_forwarded_proto;
+        fastcgi_param HTTP_X_FORWARDED_HOST \$http_x_forwarded_host;
+        fastcgi_param HTTP_X_FORWARDED_PORT \$http_x_forwarded_port;
+        fastcgi_param HTTP_X_REAL_IP \$http_x_real_ip;
+        fastcgi_param HTTPS \$https if_not_empty;
+
+        # fastcgi_read_timeout 600;
+        # fastcgi_send_timeout 600;
+        # Left at nginx's 60s default, not Docker's 600s:
+        # a stalled git-sync request can hold the PHP session lock, otherwise
     }
 
-    location ~ /\.ht {
+    location ~ /\. {
         deny all;
     }
+
+    location ~ ^/data/users/[0-9]+/backgrounds/ {
+        try_files \$uri =404;
+    }
+
+    location ~ ^/data/css/[A-Za-z0-9._-]+\.css$ {
+        try_files \$uri =404;
+    }
+
+    location ~ ^/(data|config)/ {
+        deny all;
+    }
+
+    location ~* ^/pwa/poznote(-[0-9]+)?\.png$ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Cross-Origin-Resource-Policy "cross-origin" always;
+        try_files \$uri =404;
+    }
+
+    location ~* \.(?:js|css|png|jpg|jpeg|gif|svg|ico|woff2?|ttf|otf|eot|webp|webmanifest)$ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Cross-Origin-Resource-Policy "same-origin" always;
+        try_files \$uri =404;
+    }
 }
 EOF
 nginx_enable_site poznote
 msg_ok "Configured Nginx"
 
+msg_info "Creating Background Worker Services"
+cat <<EOF >/etc/systemd/system/poznote-reminder-worker.service
+[Unit]
+Description=Poznote Reminder Email Worker
+After=network.target
+
+[Service]
+Type=simple
+User=www-data
+Group=www-data
+Restart=always
+ExecStart=/usr/bin/php /var/www/html/workers/reminder-email-worker.php
+WorkingDirectory=/var/www/html
+
+[Install]
+WantedBy=multi-user.target
+EOF
+cat <<EOF >/etc/systemd/system/poznote-s3-backup-worker.service
+[Unit]
+Description=Poznote S3 Backup Worker
+After=network.target
+
+[Service]
+Type=simple
+User=www-data
+Group=www-data
+Restart=always
+ExecStart=/usr/bin/php /var/www/html/workers/s3-backup-worker.php
+WorkingDirectory=/var/www/html
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now poznote-reminder-worker poznote-s3-backup-worker
+msg_ok "Created Background Worker Services"
+
 motd_ssh
 customize
 cleanup_lxc