onetimesecret: use nginx_enable_site

Uncomment var_arm64 variable and clean up echo statements.

ct/headers/onetimesecret

@@ -0,0 +1,6 @@
+   ____           _______               _____                     __ 
+  / __ \____  ___/_  __(_)___ ___  ___ / ___/___  _____________  / /_
+ / / / / __ \/ _ \/ / / / __ `__ \/ _ \\__ \/ _ \/ ___/ ___/ _ \/ __/
+/ /_/ / / / /  __/ / / / / / / / /  __/__/ /  __/ /__/ /  /  __/ /_  
+\____/_/ /_/\___/_/ /_/_/ /_/ /_/\___/____/\___/\___/_/   \___/\__/  
+                                                                     

ct/headers/safebucket

@@ -1,6 +0,0 @@
-   _____       ____     __               __        __ 
-  / ___/____ _/ __/__  / /_  __  _______/ /_____  / /_
-  \__ \/ __ `/ /_/ _ \/ __ \/ / / / ___/ //_/ _ \/ __/
- ___/ / /_/ / __/  __/ /_/ / /_/ / /__/ ,< /  __/ /_  
-/____/\__,_/_/  \___/_.___/\__,_/\___/_/|_|\___/\__/  
-                                                      

ct/onetimesecret.sh

@@ -0,0 +1,101 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Hai Tran (epiHATR)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://onetimesecret.com/ | Github: https://github.com/onetimesecret/onetimesecret
+
+APP="OneTimeSecret"
+var_tags="${var_tags:-security;privacy;secrets}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  SSL_VALUE="${OTS_SSL:-}"
+  if [[ -n "${SSL_VALUE}" ]]; then
+    case "${SSL_VALUE,,}" in
+    1 | true | yes | on) SSL_VALUE="true" ;;
+    0 | false | no | off) SSL_VALUE="false" ;;
+    *)
+      msg_error "Invalid OTS_SSL value '${OTS_SSL}' (use true/false)"
+      exit 1
+      ;;
+    esac
+  fi
+
+  if [[ ! -d /opt/onetimesecret ]] || [[ ! -f /opt/onetimesecret/.env ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "onetimesecret" "onetimesecret/onetimesecret"; then
+    msg_info "Stopping Service"
+    systemctl stop onetimesecret
+    msg_ok "Stopped Service"
+
+    create_backup /opt/onetimesecret/.env
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "onetimesecret" "onetimesecret/onetimesecret" "tarball"
+    RUBY_VERSION=$(tr -d ' \n' </opt/onetimesecret/.ruby-version 2>/dev/null)
+    RUBY_VERSION="${RUBY_VERSION:-3.4.10}" setup_ruby
+
+    PNPM_VERSION=$(sed -n 's/.*"packageManager": "pnpm@\([^"]*\)".*/\1/p' /opt/onetimesecret/package.json)
+    NODE_VERSION=$(tr -d ' \n' </opt/onetimesecret/.nvmrc 2>/dev/null)
+    NODE_VERSION="${NODE_VERSION:-25}" NODE_MODULE="pnpm@${PNPM_VERSION:-11.1.2}" setup_nodejs
+
+    restore_backup
+
+    msg_info "Reconciling Application"
+    systemctl enable -q --now redis-server
+    cd /opt/onetimesecret
+    mkdir -p tmp/pids log
+    $STD bash bin/setup reconcile
+    msg_ok "Reconciled Application"
+
+    msg_info "Building Frontend"
+    cd /opt/onetimesecret
+    $STD pnpm run build
+    msg_ok "Built Frontend"
+
+    msg_info "Starting Service"
+    systemctl start onetimesecret
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+DISPLAY_HOST="${OTS_HOST:-$IP}"
+case "${OTS_SSL:-false,,}" in
+1 | true | yes | on)
+  DISPLAY_SCHEME="https"
+  ;;
+*)
+  DISPLAY_SCHEME="http"
+  ;;
+esac
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}${DISPLAY_SCHEME}://${DISPLAY_HOST}${CL}"

ct/safebucket.sh

@@ -1,63 +0,0 @@
-#!/usr/bin/env bash
-_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: renizmy
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/safebucket/safebucket
-
-APP="Safebucket"
-var_tags="${var_tags:-files;sharing}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-1024}"
-var_disk="${var_disk:-10}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -f /opt/safebucket/safebucket ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit 1
-  fi
-
-  if check_for_gh_release "safebucket" "safebucket/safebucket"; then
-    msg_info "Stopping Service"
-    systemctl stop safebucket
-    msg_ok "Stopped Service"
-
-    create_backup /opt/safebucket/config.yaml /opt/safebucket/data/
-    fetch_and_deploy_gh_release "safebucket" "safebucket/safebucket" "singlefile" "latest" "/opt/safebucket" "safebucket-linux-$(arch_resolve)"
-    restore_backup
-
-    msg_info "Configuring Safebucket"
-    chown -R safebucket:safebucket /opt/safebucket
-    msg_ok "Configured Safebucket"
-
-    msg_info "Starting Service"
-    systemctl start safebucket
-    msg_ok "Started Service"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:8080${CL}"

install/onetimesecret-install.sh

@@ -0,0 +1,138 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Hai Tran (epiHATR)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://onetimesecret.com/ | Github: https://github.com/onetimesecret/onetimesecret
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  build-essential \
+  git \
+  libffi-dev \
+  libgmp-dev \
+  libpq-dev \
+  libreadline-dev \
+  libsodium23 \
+  libsqlite3-dev \
+  libssl-dev \
+  libxml2-dev \
+  libxslt1-dev \
+  libyaml-dev \
+  nginx \
+  pkg-config \
+  python3 \
+  redis-server \
+  zlib1g-dev
+msg_ok "Installed Dependencies"
+
+fetch_and_deploy_gh_release "onetimesecret" "onetimesecret/onetimesecret" "tarball"
+
+RUBY_VERSION=$(tr -d ' \n' </opt/onetimesecret/.ruby-version 2>/dev/null)
+RUBY_VERSION="${RUBY_VERSION:-3.4.10}" setup_ruby
+PNPM_VERSION=$(sed -n 's/.*"packageManager": "pnpm@\([^"]*\)".*/\1/p' /opt/onetimesecret/package.json)
+NODE_VERSION=$(tr -d ' \n' </opt/onetimesecret/.nvmrc 2>/dev/null)
+NODE_VERSION="${NODE_VERSION:-25}" NODE_MODULE="pnpm@${PNPM_VERSION:-11.1.2}" setup_nodejs
+HOST_VALUE="${OTS_HOST:-$LOCAL_IP}"
+SSL_VALUE="${OTS_SSL:-false}"
+case "${SSL_VALUE,,}" in
+1 | true | yes | on) SSL_VALUE="true" ;;
+0 | false | no | off | "") SSL_VALUE="false" ;;
+*)
+  msg_error "Invalid OTS_SSL value '${OTS_SSL}' (use true/false)"
+  exit 1
+  ;;
+esac
+
+msg_info "Configuring Application"
+systemctl enable -q --now redis-server
+cd /opt/onetimesecret
+$STD bash bin/setup init
+sed -i \
+  -e "s|^REDIS_URL=.*|REDIS_URL=redis://127.0.0.1:6379/0|" \
+  -e "s|^HOST=.*|HOST=${HOST_VALUE//&/\\&}|" \
+  -e "s|^SSL=.*|SSL=${SSL_VALUE}|" \
+  /opt/onetimesecret/.env
+if grep -q '^RACK_ENV=' /opt/onetimesecret/.env; then
+  sed -i 's|^RACK_ENV=.*|RACK_ENV=production|' /opt/onetimesecret/.env
+else
+  echo "RACK_ENV=production" >>/opt/onetimesecret/.env
+fi
+if grep -q '^AUTHENTICATION_MODE=' /opt/onetimesecret/.env; then
+  sed -i 's|^AUTHENTICATION_MODE=.*|AUTHENTICATION_MODE=simple|' /opt/onetimesecret/.env
+else
+  echo "AUTHENTICATION_MODE=simple" >>/opt/onetimesecret/.env
+fi
+if ! grep -q '^PORT=' /opt/onetimesecret/.env; then
+  echo "PORT=3000" >>/opt/onetimesecret/.env
+fi
+chmod 600 /opt/onetimesecret/.env
+mkdir -p /opt/onetimesecret/tmp/pids /opt/onetimesecret/log
+msg_ok "Configured Application"
+
+msg_info "Reconciling Application"
+cd /opt/onetimesecret
+$STD bash bin/setup reconcile
+msg_ok "Reconciled Application"
+
+msg_info "Building Frontend"
+cd /opt/onetimesecret
+$STD pnpm run build
+msg_ok "Built Frontend"
+
+msg_info "Creating Service"
+cat <<'EOF' >/etc/systemd/system/onetimesecret.service
+[Unit]
+Description=Onetime Secret Service
+After=network.target redis-server.service
+Requires=redis-server.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/onetimesecret
+Environment=HOME=/root
+Environment=PATH=/root/.rbenv/shims:/root/.rbenv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+EnvironmentFile=/opt/onetimesecret/.env
+ExecStart=/root/.rbenv/shims/bundle exec puma -C etc/puma.rb
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now onetimesecret
+msg_ok "Created Service"
+
+msg_info "Configuring Nginx"
+cat <<'EOF' >/etc/nginx/sites-available/onetimesecret
+server {
+  listen 80 default_server;
+  server_name _;
+
+  location / {
+    proxy_pass http://127.0.0.1:3000;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+  }
+}
+EOF
+nginx_enable_site onetimesecret
+msg_ok "Configured Nginx"
+
+motd_ssh
+customize
+cleanup_lxc

install/safebucket-install.sh

@@ -1,231 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: renizmy
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/safebucket/safebucket
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-msg_info "Installing Dependencies"
-$STD apt install -y awscli
-msg_ok "Installed Dependencies"
-
-msg_info "Installing Garage"
-useradd --system --no-create-home --shell /usr/sbin/nologin garage 2>/dev/null || true
-GARAGE_VERSION=$(get_latest_gh_tag "deuxfleurs-org/garage" "v")
-if [[ -z "$GARAGE_VERSION" ]]; then
-  msg_error "Could not determine latest stable Garage version"
-  exit 1
-fi
-curl_download "/usr/local/bin/garage" "https://garagehq.deuxfleurs.fr/_releases/${GARAGE_VERSION}/$(arch_resolve "x86_64-unknown-linux-musl" "aarch64-unknown-linux-musl")/garage"
-chmod +x /usr/local/bin/garage
-mkdir -p /opt/garage/{data,meta}
-RPC_SECRET=$(openssl rand -hex 32)
-ADMIN_TOKEN=$(openssl rand -base64 32)
-cat <<EOF >/opt/garage/garage.toml
-metadata_dir = "/opt/garage/meta"
-data_dir = "/opt/garage/data"
-db_engine = "lmdb"
-replication_factor = 1
-
-rpc_bind_addr = "[::]:3901"
-rpc_public_addr = "127.0.0.1:3901"
-rpc_secret = "${RPC_SECRET}"
-
-[s3_api]
-s3_region = "garage"
-api_bind_addr = "[::]:3900"
-root_domain = ".s3.garage.localhost"
-
-[admin]
-api_bind_addr = "[::]:3903"
-admin_token = "${ADMIN_TOKEN}"
-EOF
-chmod 600 /opt/garage/garage.toml
-chown -R garage:garage /opt/garage
-cat <<EOF >/etc/systemd/system/garage.service
-[Unit]
-Description=Garage Object Storage
-After=network.target
-
-[Service]
-Type=simple
-User=garage
-Group=garage
-WorkingDirectory=/opt/garage
-ExecStart=/usr/local/bin/garage -c /opt/garage/garage.toml server
-Restart=on-failure
-RestartSec=5
-LimitNOFILE=65536
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now garage
-msg_ok "Installed Garage"
-
-msg_info "Configuring Garage Bucket"
-RETRIES=0
-until garage -c /opt/garage/garage.toml status &>/dev/null; do
-  RETRIES=$((RETRIES + 1))
-  if [[ $RETRIES -ge 60 ]]; then
-    msg_error "Garage did not become ready within 60 seconds"
-    exit 1
-  fi
-  sleep 1
-done
-NODE_ID=$(garage -c /opt/garage/garage.toml status 2>/dev/null | awk '/^[0-9a-f]/{print $1; exit}')
-if [[ -z "$NODE_ID" ]]; then
-  msg_error "Could not determine Garage node ID from cluster status"
-  exit 1
-fi
-GARAGE_CAPACITY="${GARAGE_CAPACITY:-$(df -BG --output=avail /opt/garage | awk 'NR==2{gsub(/G/,"",$1); v=$1-1; print (v<1?1:v)"G"}')}"
-$STD garage -c /opt/garage/garage.toml layout assign -z dc1 -c "${GARAGE_CAPACITY}" "${NODE_ID}"
-$STD garage -c /opt/garage/garage.toml layout apply --version 1
-GARAGE_KEY_INFO=$(garage -c /opt/garage/garage.toml key create safebucket-key)
-GARAGE_ACCESS_KEY=$(echo "$GARAGE_KEY_INFO" | awk '/Key ID:/{print $3}')
-GARAGE_SECRET_KEY=$(echo "$GARAGE_KEY_INFO" | awk '/Secret key:/{print $3}')
-$STD garage -c /opt/garage/garage.toml bucket create safebucket
-$STD garage -c /opt/garage/garage.toml bucket allow --read --write --owner safebucket --key safebucket-key
-msg_ok "Configured Garage Bucket"
-
-msg_info "Applying CORS Policy to Bucket"
-export AWS_ACCESS_KEY_ID="${GARAGE_ACCESS_KEY}"
-export AWS_SECRET_ACCESS_KEY="${GARAGE_SECRET_KEY}"
-export AWS_DEFAULT_REGION="garage"
-if aws s3api put-bucket-cors \
-  --bucket safebucket \
-  --endpoint-url "http://127.0.0.1:3900" \
-  --cors-configuration '{"CORSRules":[{"AllowedHeaders":["*"],"AllowedMethods":["GET","PUT","POST","DELETE","HEAD"],"AllowedOrigins":["http://'"${LOCAL_IP}"':8080"],"ExposeHeaders":["ETag"]}]}' &>/dev/null; then
-  msg_ok "Applied CORS Policy to Bucket"
-else
-  msg_warn "Could not apply CORS policy automatically; direct browser uploads may fail until CORS is configured manually"
-fi
-unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_DEFAULT_REGION
-
-fetch_and_deploy_gh_release "safebucket" "safebucket/safebucket" "singlefile" "latest" "/opt/safebucket" "safebucket-linux-$(arch_resolve)"
-
-msg_info "Configuring Safebucket"
-useradd --system --no-create-home --shell /usr/sbin/nologin safebucket 2>/dev/null || true
-mkdir -p /opt/safebucket/data/{notifications,activity}
-TOKEN_SECRET=$(openssl rand -base64 32)
-MFA_KEY=$(openssl rand -base64 48 | tr -dc 'a-zA-Z0-9' | cut -c1-32)
-ADMIN_PASSWORD=$(openssl rand -hex 12)
-cat <<EOF >/opt/safebucket/config.yaml
-app:
-  profile: default
-  log_level: info
-  api_url: http://${LOCAL_IP}:8080
-  web_url: http://${LOCAL_IP}:8080
-  allowed_origins:
-    - http://${LOCAL_IP}:8080
-  port: 8080
-  token_secret: "${TOKEN_SECRET}"
-  mfa_encryption_key: "${MFA_KEY}"
-  mfa_required: false
-  admin_email: admin@safebucket.io
-  admin_password: "${ADMIN_PASSWORD}"
-  trash_retention_days: 7
-  max_upload_size: 5368709120
-  trusted_proxies:
-    - 10.0.0.0/8
-    - 172.16.0.0/12
-    - 192.168.0.0/16
-    - 127.0.0.0/8
-    - ::1/128
-    - fc00::/7
-  static_files:
-    enabled: true
-
-database:
-  type: sqlite
-  sqlite:
-    path: /opt/safebucket/data/safebucket.db
-
-cache:
-  type: memory
-
-storage:
-  type: s3
-  s3:
-    bucket_name: safebucket
-    endpoint: 127.0.0.1:3900
-    external_endpoint: http://${LOCAL_IP}:3900
-    access_key: ${GARAGE_ACCESS_KEY}
-    secret_key: ${GARAGE_SECRET_KEY}
-    region: garage
-    force_path_style: true
-    use_tls: false
-
-events:
-  type: memory
-  queues:
-    notifications:
-      name: safebucket-notifications
-    object_deletion:
-      name: safebucket-object-deletion
-    bucket_events:
-      name: safebucket-bucket-events
-
-notifier:
-  type: filesystem
-  filesystem:
-    directory: /opt/safebucket/data/notifications
-
-activity:
-  type: filesystem
-  filesystem:
-    directory: /opt/safebucket/data/activity
-
-auth:
-  providers:
-    local:
-      name: local
-      type: local
-      sharing:
-        allowed: true
-        domains: []
-EOF
-chmod 600 /opt/safebucket/config.yaml
-chown -R safebucket:safebucket /opt/safebucket
-cat <<EOF >~/safebucket.creds
-Safebucket Admin
-Username: admin@safebucket.io
-Password: ${ADMIN_PASSWORD}
-EOF
-msg_ok "Configured Safebucket"
-
-msg_info "Creating Service"
-cat <<EOF >/etc/systemd/system/safebucket.service
-[Unit]
-Description=Safebucket File Sharing Platform
-After=network-online.target garage.service
-Wants=network-online.target
-Requires=garage.service
-
-[Service]
-Type=simple
-User=safebucket
-Group=safebucket
-WorkingDirectory=/opt/safebucket
-Environment=CONFIG_FILE_PATH=/opt/safebucket/config.yaml
-ExecStart=/opt/safebucket/safebucket
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now safebucket
-msg_ok "Created Service"
-
-motd_ssh
-customize
-cleanup_lxc