Refactor storyteller.sh for improved deployment process

python3 ships with the template, update uses ensure_dependencies, no comments.

CHANGELOG.md

@@ -565,12 +565,43 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-10-23
+
+### 💾 Core
+
+  - error output: report a failure inside a subshell once [@MickLesk](https://github.com/MickLesk) ([core#162](https://github.com/community-scripts/core/pull/162))
+- general: allow Composer as root in every script [@MickLesk](https://github.com/MickLesk) ([core#161](https://github.com/community-scripts/core/pull/161))
+- lxc-updater: skip the resource check when the container cannot read its RAM [@MickLesk](https://github.com/MickLesk) ([core#160](https://github.com/community-scripts/core/pull/160))
+- vm-core: let vm_timezone_default survive a host without /etc/timezone [@MickLesk](https://github.com/MickLesk) ([core#159](https://github.com/community-scripts/core/pull/159))
+
+## 2026-10-22
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Zabbix: keep unattended updates on the installed series [@florianpunz](https://github.com/florianpunz) ([#18051](https://github.com/community-scripts/ProxmoxVE/pull/18051))
+
+  - #### 🔧 Refactor
+
+    - Refactor: Cryptpad [@MickLesk](https://github.com/MickLesk) ([#18065](https://github.com/community-scripts/ProxmoxVE/pull/18065))
+
+### 💾 Core
+
+  - Incus: drive a remote Incus server from the client's default remote [@MickLesk](https://github.com/MickLesk) ([core#154](https://github.com/community-scripts/core/pull/154))
+- Deploy the release again when an update is redone [@MickLesk](https://github.com/MickLesk) ([core#158](https://github.com/community-scripts/core/pull/158))
+
+### ❔ Uncategorized
+
+  - chore(ct): sync sparkyfitness defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18061](https://github.com/community-scripts/ProxmoxVE/pull/18061))
+
 ## 2026-10-21
 
 ### 🚀 Updated Scripts
 
   - #### 🐞 Bug Fixes
 
+    - Immich: bump release version to v3.3.5 (CVE) [@CerberusStyle](https://github.com/CerberusStyle) ([#18057](https://github.com/community-scripts/ProxmoxVE/pull/18057))
     - DroppedNeedle: pass release version to the app via COMMIT_TAG [@MickLesk](https://github.com/MickLesk) ([#18042](https://github.com/community-scripts/ProxmoxVE/pull/18042))
 
 ### 💾 Core

ct/cryptpad.sh

@@ -30,12 +30,14 @@ function update_script() {
     msg_error "No ${APP} Installation Found!"
     exit
   fi
+  # Updates to 2026.10.0 finished without infra.js; run them again so it gets written
+  [[ -f /opt/cryptpad/config/infra.example.js && ! -f /opt/cryptpad/config/infra.js ]] && rm -f ~/.cryptpad
   if check_for_gh_release "cryptpad" "cryptpad/cryptpad"; then
     msg_info "Stopping Service"
     systemctl stop cryptpad
     msg_ok "Stopped Service"
 
-    create_backup /opt/cryptpad/config/config.js /opt/cryptpad/www/common/onlyoffice/dist
+    create_backup /opt/cryptpad/config/config.js /opt/cryptpad/config/infra.js /opt/cryptpad/www/common/onlyoffice/dist
 
     CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="blob block customize data datastore onlyoffice-conf" fetch_and_deploy_gh_release "cryptpad" "cryptpad/cryptpad" "tarball"
 
@@ -45,8 +47,30 @@ function update_script() {
     cd /opt/cryptpad
     $STD npm ci --allow-git=all
     $STD npm run install:components
-    if [ -f "/opt/cryptpad/install-onlyoffice.sh" ]; then
-      $STD bash /opt/cryptpad/install-onlyoffice.sh --accept-license
+    if [[ -d /opt/cryptpad/www/common/onlyoffice/dist ]]; then
+      $STD bash /opt/cryptpad/install-office.sh --accept-license
+    fi
+    if [[ ! -f /opt/cryptpad/config/infra.js ]]; then
+      # 2026.10.0 reads the network settings from infra.js and no longer derives the sandbox origin
+      LOCAL_IP="$LOCAL_IP" node - <<'EOF'
+const c = require("/opt/cryptpad/config/config.js");
+const i = require("/opt/cryptpad/config/infra.example.js");
+const port = c.httpPort || i.public.httpPort;
+const safePort = c.httpSafePort || port + 1;
+const origin = (c.httpUnsafeOrigin || `http://${process.env.LOCAL_IP}:${port}`).replace(/\/+$/, "");
+const sandbox = new URL(origin);
+sandbox.port = safePort;
+Object.assign(i.public, {
+  origin,
+  sandboxOrigin: (c.httpSafeOrigin || sandbox.origin).replace(/\/+$/, ""),
+  httpHost: c.httpAddress || (c.httpUnsafeOrigin ? i.public.httpHost : "0.0.0.0"),
+  httpPort: port,
+  httpSafePort: safePort,
+  externalWebsocketURL: c.externalWebsocketURL,
+  fileHost: c.fileHost,
+});
+require("fs").writeFileSync("/opt/cryptpad/config/infra.js", "module.exports = " + JSON.stringify(i, null, 4) + ";\n");
+EOF
     fi
     $STD npm run build
     msg_ok "Updated CryptaPad"

ct/immich.sh

@@ -77,7 +77,7 @@ EOF
   BASE_DIR=${STAGING_DIR}/base-images
   SOURCE_DIR=${STAGING_DIR}/image-source
   cd /tmp
-  RELEASE="v3.3.4"
+  RELEASE="v3.3.5"
   if [[ -f ~/.intel_version ]]; then
     INTEL_SRC="https://raw.githubusercontent.com/immich-app/immich/${RELEASE}/machine-learning"
     curl -fsSL "${INTEL_SRC}/scripts/install-intel-runtime.sh" -o ./intel-runtime 2>/dev/null ||

ct/sparkyfitness.sh

@@ -9,7 +9,7 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 APP="SparkyFitness"
 var_tags="${var_tags:-health;fitness}"
 var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
+var_ram="${var_ram:-4096}"
 var_disk="${var_disk:-7}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"

ct/storyteller.sh

@@ -31,42 +31,75 @@ function update_script() {
     exit
   fi
 
-  NODE_VERSION="24" NODE_MODULE="corepack,yarn" setup_nodejs
+  NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs
 
   if check_for_gl_release "storyteller" "storyteller-platform/storyteller" "" "" "web-v2"; then
     msg_info "Stopping Service"
     systemctl stop storyteller
     msg_ok "Stopped Service"
 
+    ensure_dependencies cmake argon2 libcurl4t64 libxml2
+    fetch_and_deploy_gh_release "readium" "readium/cli" "prebuild" "v0.9.1" "/opt/readium" "readium_linux_$(arch_resolve "x86_64" "arm64").tar.gz"
+
     create_backup /opt/storyteller/.env
-
-    CLEAN_INSTALL=1 fetch_and_deploy_gl_release "storyteller" "storyteller-platform/storyteller" "tarball" "latest" "/opt/storyteller" "" "web-v2"
-
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="data" fetch_and_deploy_gl_release "storyteller" "storyteller-platform/storyteller" "tarball" "latest" "/opt/storyteller" "" "web-v2"
     restore_backup
 
-    msg_info "Rebuilding Storyteller"
+    msg_info "Building Storyteller (Patience)"
     cd /opt/storyteller
-    export NODE_OPTIONS="--max-old-space-size=4096"
-
-    $STD corepack yarn install --network-timeout 600000
-    $STD gcc -g -fPIC -rdynamic -shared web/sqlite/uuid.c -o web/sqlite/uuid.c.so
-    export CI=1
+    $STD corepack yarn install
     export NODE_ENV=production
     export NEXT_TELEMETRY_DISABLED=1
     export SQLITE_NATIVE_BINDING=/opt/storyteller/node_modules/better-sqlite3/build/Release/better_sqlite3.node
     $STD corepack yarn workspaces foreach -Rpt --from @storyteller-platform/web --exclude @storyteller-platform/eslint run build
-    mkdir -p /opt/storyteller/web/.next/standalone/web/.next/static
-    cp -rT /opt/storyteller/web/.next/static /opt/storyteller/web/.next/standalone/web/.next/static
-    if [[ -d /opt/storyteller/web/public ]]; then
-      mkdir -p /opt/storyteller/web/.next/standalone/web/public
-      cp -rT /opt/storyteller/web/public /opt/storyteller/web/.next/standalone/web/public
+    STANDALONE=/opt/storyteller/applications/web/.next/standalone
+    WEB_DIR="$STANDALONE/applications/web"
+    mkdir -p "$WEB_DIR"/{public,.next/static,.next/cache,migrations,sqlite,scripts}
+    cp -rT applications/web/public "$WEB_DIR/public"
+    cp -rT applications/web/.next/static "$WEB_DIR/.next/static"
+    cp -rT applications/web/migrations "$WEB_DIR/migrations"
+    cp applications/web/sqlite/uuid.c.so "$WEB_DIR/sqlite/"
+    cp docker-scripts/reset-password.sh "$WEB_DIR/scripts/"
+    cp -r applications/web/work-dist applications/web/file-write-dist "$WEB_DIR/"
+    mkdir -p "$WEB_DIR/work-dist/@storyteller-platform/align/prebuilds"
+    cp -r "libraries/align/prebuilds/linux-$(arch_resolve "x64" "arm64")" "$WEB_DIR/work-dist/@storyteller-platform/align/prebuilds/"
+    cp node_modules/@echogarden/icu-segmentation-wasm/wasm/*.wasm "$WEB_DIR/work-dist/"
+    cp -rT node_modules/@parcel "$STANDALONE/node_modules/@parcel"
+    cp -rT node_modules/kuromoji "$STANDALONE/node_modules/kuromoji"
+    ln -sf /opt/storyteller/.env "$WEB_DIR/.env"
+    msg_ok "Built Storyteller"
+
+    msg_info "Updating Whisper"
+    WHISPER_VARIANT="linux-$(arch_resolve "x64" "arm64")-cpu"
+    $STD node /opt/storyteller/libraries/ghost-story/dist/cli/bin.js install binary "$WHISPER_VARIANT"
+    $STD node /opt/storyteller/libraries/ghost-story/dist/cli/bin.js install model tiny.en
+    if [[ "$WHISPER_VARIANT" == "linux-x64-cpu" ]]; then
+      $STD node /opt/storyteller/libraries/ghost-story/dist/cli/bin.js install binary linux-x64-cpu-legacy
     fi
-    mkdir -p /opt/storyteller/web/.next/standalone/web/migrations
-    cp -rT /opt/storyteller/web/migrations /opt/storyteller/web/.next/standalone/web/migrations
-    mkdir -p /opt/storyteller/web/.next/standalone/web/sqlite
-    cp -rT /opt/storyteller/web/sqlite /opt/storyteller/web/.next/standalone/web/sqlite
-    ln -sf /opt/storyteller/.env /opt/storyteller/web/.next/standalone/web/.env
-    msg_ok "Rebuilt Storyteller"
+    msg_ok "Updated Whisper"
+
+    cat <<EOF >/etc/systemd/system/storyteller.service
+[Unit]
+Description=Storyteller
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=${WEB_DIR}
+EnvironmentFile=/opt/storyteller/.env
+Environment=SQLITE_NATIVE_BINDING=${STANDALONE}/node_modules/better-sqlite3/build/Release/better_sqlite3.node
+Environment=ERROR_ALIGN_NATIVE_BINDING=${WEB_DIR}/work-dist/@storyteller-platform/align/
+Environment=STORYTELLER_WORKER=worker.mjs
+Environment=STORYTELLER_FILE_WRITE_WORKER=fileWriteWorker.mjs
+ExecStart=/usr/bin/node --enable-source-maps server.js
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+    systemctl daemon-reload
 
     msg_info "Starting Service"
     systemctl start storyteller
@@ -75,7 +108,6 @@ function update_script() {
   fi
   exit
 }
-
 start
 build_container
 description

ct/zabbix.sh

@@ -46,24 +46,36 @@ function update_script() {
     msg_warn "No Zabbix Agent service found, skipping agent actions"
   fi
 
+  ZABBIX_SERIES="$(dpkg-query -W -f='${Version}' zabbix-release 2>/dev/null || true)"
+  ZABBIX_SERIES="${ZABBIX_SERIES#*:}"
+  ZABBIX_SERIES="${ZABBIX_SERIES%%[!0-9.]*}"
+  if [[ "${PHS_SILENT:-0}" == "1" ]]; then
+    if [[ ! "$ZABBIX_SERIES" =~ ^[0-9]+\.[0-9]+$ ]]; then
+      msg_warn "Could not detect the installed Zabbix series - skipping update, requires an interactive run"
+      exit 75
+    fi
+    ZABBIX_VERSION="$ZABBIX_SERIES"
+    msg_warn "Unattended update: staying on Zabbix ${ZABBIX_VERSION}"
+  else
+    read -rp "Choose Zabbix version [1] 7.0 LTS  [2] 7.4 (Latest Stable)  [3] Latest available (default: 2): " ZABBIX_CHOICE
+    ZABBIX_CHOICE=${ZABBIX_CHOICE:-2}
+    case "$ZABBIX_CHOICE" in
+    1) ZABBIX_VERSION="7.0" ;;
+    2) ZABBIX_VERSION="7.4" ;;
+    3) ZABBIX_VERSION=$(curl -fsSL https://repo.zabbix.com/zabbix/ |
+      grep -oP '(?<=href=")[0-9]+\.[0-9]+(?=/")' | sort -V | tail -n1) ;;
+    *)
+      ZABBIX_VERSION="7.4"
+      echo "Invalid choice. Defaulting to 7.4."
+      ;;
+    esac
+  fi
+
   msg_info "Stopping Services"
   systemctl stop zabbix-server
   [[ -n "$AGENT_SERVICE" ]] && systemctl stop "$AGENT_SERVICE"
   msg_ok "Stopped Services"
 
-  read -rp "Choose Zabbix version [1] 7.0 LTS  [2] 7.4 (Latest Stable)  [3] Latest available (default: 2): " ZABBIX_CHOICE
-  ZABBIX_CHOICE=${ZABBIX_CHOICE:-2}
-  case "$ZABBIX_CHOICE" in
-  1) ZABBIX_VERSION="7.0" ;;
-  2) ZABBIX_VERSION="7.4" ;;
-  3) ZABBIX_VERSION=$(curl -fsSL https://repo.zabbix.com/zabbix/ |
-    grep -oP '(?<=href=")[0-9]+\.[0-9]+(?=/")' | sort -V | tail -n1) ;;
-  *)
-    ZABBIX_VERSION="7.4"
-    echo "Invalid choice. Defaulting to 7.4."
-    ;;
-  esac
-
   msg_info "Updating Zabbix to $ZABBIX_VERSION"
   mkdir -p /opt/zabbix-backup/
   cp /etc/zabbix/zabbix_server.conf /opt/zabbix-backup/

install/cryptpad-install.sh

@@ -28,11 +28,15 @@ cd /opt/cryptpad
 $STD npm ci --allow-git=all
 $STD npm run install:components
 if [[ "${onlyoffice,,}" =~ ^(y|yes)$ ]]; then
-  $STD bash -c "./install-onlyoffice.sh --accept-license"
+  $STD bash -c "./install-office.sh --accept-license"
 fi
 cp config/config.example.js config/config.js
-sed -i "51s/localhost/${LOCAL_IP}/g" /opt/cryptpad/config/config.js
-sed -i "80s#//httpAddress: 'localhost'#httpAddress: '0.0.0.0'#g" /opt/cryptpad/config/config.js
+cp config/infra.example.js config/infra.js
+sed -i \
+  -e "s|origin: \"http://localhost:3000\"|origin: \"http://${LOCAL_IP}:3000\"|" \
+  -e "s|sandboxOrigin: \"http://localhost:3001\"|sandboxOrigin: \"http://${LOCAL_IP}:3001\"|" \
+  -e "s|httpHost: \"localhost\"|httpHost: \"0.0.0.0\"|" \
+  config/infra.js
 $STD npm run build
 msg_ok "Setup CryptPad"
 

install/immich-install.sh

@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os
 
-RELEASE="v3.3.4"
+RELEASE="v3.3.5"
 if lscpu | grep -q 'GenuineIntel'; then
   echo ""
   echo ""

install/storyteller-install.sh

@@ -17,24 +17,55 @@ msg_info "Installing Dependencies"
 $STD apt install -y \
   build-essential \
   git \
-  pkg-config \
-  libsqlite3-dev \
+  cmake \
   sqlite3 \
-  python3-setuptools \
-  ffmpeg
+  libsqlite3-dev \
+  argon2 \
+  ffmpeg \
+  libcurl4t64 \
+  libxml2
 msg_ok "Installed Dependencies"
 
-NODE_VERSION="24" NODE_MODULE="corepack,yarn" setup_nodejs
+NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs
 
-fetch_and_deploy_gh_release "readium" "readium/cli" "prebuild" "latest" "/opt/readium" "readium_linux_$(arch_resolve "x86_64" "arm64").tar.gz"
+fetch_and_deploy_gh_release "readium" "readium/cli" "prebuild" "v0.9.1" "/opt/readium" "readium_linux_$(arch_resolve "x86_64" "arm64").tar.gz"
 ln -sf /opt/readium/readium /usr/local/bin/readium
 fetch_and_deploy_gl_release "storyteller" "storyteller-platform/storyteller" "tarball" "latest" "/opt/storyteller" "" "web-v2"
 
-msg_info "Setting up Storyteller"
+msg_info "Building Storyteller (Patience)"
 cd /opt/storyteller
+$STD corepack yarn install
+export NODE_ENV=production
+export NEXT_TELEMETRY_DISABLED=1
+export SQLITE_NATIVE_BINDING=/opt/storyteller/node_modules/better-sqlite3/build/Release/better_sqlite3.node
+$STD corepack yarn workspaces foreach -Rpt --from @storyteller-platform/web --exclude @storyteller-platform/eslint run build
+STANDALONE=/opt/storyteller/applications/web/.next/standalone
+WEB_DIR="$STANDALONE/applications/web"
+mkdir -p "$WEB_DIR"/{public,.next/static,.next/cache,migrations,sqlite,scripts}
+cp -rT applications/web/public "$WEB_DIR/public"
+cp -rT applications/web/.next/static "$WEB_DIR/.next/static"
+cp -rT applications/web/migrations "$WEB_DIR/migrations"
+cp applications/web/sqlite/uuid.c.so "$WEB_DIR/sqlite/"
+cp docker-scripts/reset-password.sh "$WEB_DIR/scripts/"
+cp -r applications/web/work-dist applications/web/file-write-dist "$WEB_DIR/"
+mkdir -p "$WEB_DIR/work-dist/@storyteller-platform/align/prebuilds"
+cp -r "libraries/align/prebuilds/linux-$(arch_resolve "x64" "arm64")" "$WEB_DIR/work-dist/@storyteller-platform/align/prebuilds/"
+cp node_modules/@echogarden/icu-segmentation-wasm/wasm/*.wasm "$WEB_DIR/work-dist/"
+cp -rT node_modules/@parcel "$STANDALONE/node_modules/@parcel"
+cp -rT node_modules/kuromoji "$STANDALONE/node_modules/kuromoji"
+msg_ok "Built Storyteller"
 
-$STD corepack yarn install --network-timeout 600000
-$STD gcc -g -fPIC -rdynamic -shared applications/web/sqlite/uuid.c -o applications/web/sqlite/uuid.c.so
+msg_info "Installing Whisper"
+WHISPER_VARIANT="linux-$(arch_resolve "x64" "arm64")-cpu"
+$STD node /opt/storyteller/libraries/ghost-story/dist/cli/bin.js install binary "$WHISPER_VARIANT"
+$STD node /opt/storyteller/libraries/ghost-story/dist/cli/bin.js install model tiny.en
+if [[ "$WHISPER_VARIANT" == "linux-x64-cpu" ]]; then
+  $STD node /opt/storyteller/libraries/ghost-story/dist/cli/bin.js install binary linux-x64-cpu-legacy
+fi
+msg_ok "Installed Whisper"
+
+msg_info "Configuring Storyteller"
+mkdir -p /opt/storyteller/data
 STORYTELLER_SECRET_KEY=$(openssl rand -base64 32)
 cat <<EOF >/opt/storyteller/.env
 STORYTELLER_SECRET_KEY=${STORYTELLER_SECRET_KEY}
@@ -45,33 +76,14 @@ READIUM_PORT=9000
 NODE_ENV=production
 NEXT_TELEMETRY_DISABLED=1
 EOF
-mkdir -p /opt/storyteller/data
+chmod 600 /opt/storyteller/.env
+ln -sf /opt/storyteller/.env "$WEB_DIR/.env"
 cat <<EOF >~/storyteller.creds
 Storyteller Credentials
 =======================
 Secret Key: ${STORYTELLER_SECRET_KEY}
 EOF
-msg_ok "Set up Storyteller"
-
-msg_info "Building Storyteller"
-cd /opt/storyteller
-export CI=1
-export NODE_ENV=production
-export NEXT_TELEMETRY_DISABLED=1
-export SQLITE_NATIVE_BINDING=/opt/storyteller/node_modules/better-sqlite3/build/Release/better_sqlite3.node
-$STD corepack yarn workspaces foreach -Rpt --from @storyteller-platform/web --exclude @storyteller-platform/eslint run build
-mkdir -p /opt/storyteller/applications/web/.next/standalone/applications/web/.next/static
-cp -rT /opt/storyteller/applications/web/.next/static /opt/storyteller/applications/web/.next/standalone/applications/web/.next/static
-if [[ -d /opt/storyteller/applications/web/public ]]; then
-  mkdir -p /opt/storyteller/applications/web/.next/standalone/applications/web/public
-  cp -rT /opt/storyteller/applications/web/public /opt/storyteller/applications/web/.next/standalone/applications/web/public
-fi
-mkdir -p /opt/storyteller/applications/web/.next/standalone/applications/web/migrations
-cp -rT /opt/storyteller/applications/web/migrations /opt/storyteller/applications/web/.next/standalone/applications/web/migrations
-mkdir -p /opt/storyteller/applications/web/.next/standalone/applications/web/sqlite
-cp -rT /opt/storyteller/applications/web/sqlite /opt/storyteller/applications/web/.next/standalone/applications/web/sqlite
-ln -sf /opt/storyteller/.env /opt/storyteller/applications/web/.next/standalone/applications/web/.env
-msg_ok "Built Storyteller"
+msg_ok "Configured Storyteller"
 
 msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/storyteller.service
@@ -82,8 +94,12 @@ After=network.target
 [Service]
 Type=simple
 User=root
-WorkingDirectory=/opt/storyteller/applications/web/.next/standalone/applications/web
+WorkingDirectory=${WEB_DIR}
 EnvironmentFile=/opt/storyteller/.env
+Environment=SQLITE_NATIVE_BINDING=${STANDALONE}/node_modules/better-sqlite3/build/Release/better_sqlite3.node
+Environment=ERROR_ALIGN_NATIVE_BINDING=${WEB_DIR}/work-dist/@storyteller-platform/align/
+Environment=STORYTELLER_WORKER=worker.mjs
+Environment=STORYTELLER_FILE_WRITE_WORKER=fileWriteWorker.mjs
 ExecStart=/usr/bin/node --enable-source-maps server.js
 Restart=on-failure
 RestartSec=5