post-pve-install: hide the mobile subscription nag in every UI language

The mobile UI patch removed the dialog and card only when their text
contained "subscription", so translated UIs (de: "Subskription", fr:
"Abonnement", ...) kept the nag. It also deleted DOM nodes Yew still
owns and polled every 300 ms for good.

The helper now injects a fetch wrapper into the mobile index template
that fills the empty subscription level of each node in the /nodes
response, so the app never shows the alert or card. The API response
itself is unchanged; the node list shows "-" instead of "No
subscription". The mobile UI package is reinstalled alongside the widget
toolkit so old blocks are dropped, and "no" also removes the helper.

CHANGELOG.md

@@ -571,6 +571,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - patchmon: avoids systemd environment secret leaks via D-Bus/subprocesses. [@rhclayto](https://github.com/rhclayto) ([#18074](https://github.com/community-scripts/ProxmoxVE/pull/18074))
     - fix: Linkwarden - clear Yarn berry cache after install and update- #18115 [@bferd](https://github.com/bferd) ([#18116](https://github.com/community-scripts/ProxmoxVE/pull/18116))
     - Borg-UI: recreate the borg venvs with --clear [@MickLesk](https://github.com/MickLesk) ([#18118](https://github.com/community-scripts/ProxmoxVE/pull/18118))
     - SnapOtter: recreate the AI venv with --clear [@MickLesk](https://github.com/MickLesk) ([#18119](https://github.com/community-scripts/ProxmoxVE/pull/18119))

ct/gramps-web.sh

@@ -34,43 +34,9 @@ function update_script() {
   PYTHON_VERSION="3.12" setup_uv
   NODE_VERSION="22" NODE_MODULE="corepack" setup_nodejs
 
-  if ! grep -q '^CELERY_CONFIG=' /opt/gramps-web/config/config.cfg; then
-    msg_info "Setting up Celery Task Queue"
-    ensure_dependencies redis-server
-    cat <<EOF >>/opt/gramps-web/config/config.cfg
-CELERY_CONFIG={"broker_url":"redis://127.0.0.1:6379/0","result_backend":"redis://127.0.0.1:6379/0"}
-RATELIMIT_STORAGE_URI="redis://127.0.0.1:6379/1"
-EOF
-    cat <<EOF >/etc/systemd/system/gramps-web-celery.service
-[Unit]
-Description=Gramps Web Celery Worker
-After=network.target redis-server.service
-Wants=redis-server.service
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=/opt/gramps-web-api
-Environment=GRAMPS_API_CONFIG=/opt/gramps-web/config/config.cfg
-Environment=GRAMPSHOME=/opt/gramps-web/data
-Environment=GRAMPS_DATABASE_PATH=/opt/gramps-web/data/gramps/grampsdb
-Environment=PATH=/opt/gramps-web/venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
-ExecStart=/opt/gramps-web/venv/bin/celery -A gramps_webapi.celery worker --loglevel=INFO --concurrency=2
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-    systemctl daemon-reload
-    systemctl enable -q --now redis-server gramps-web-celery
-    systemctl restart gramps-web
-    msg_ok "Set up Celery Task Queue"
-  fi
-
   if check_for_gh_release "gramps-web-api" "gramps-project/gramps-web-api"; then
     msg_info "Stopping Service"
-    systemctl stop gramps-web gramps-web-celery
+    systemctl stop gramps-web
     msg_ok "Stopped Service"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "gramps-web-api" "gramps-project/gramps-web-api" "tarball" "latest" "/opt/gramps-web-api"
@@ -105,7 +71,7 @@ EOF
     msg_ok "Updated Gramps Addons"
 
     msg_info "Starting Service"
-    systemctl start gramps-web gramps-web-celery
+    systemctl start gramps-web
     msg_ok "Started Service"
   fi
 

install/gramps-web-install.sh

@@ -34,7 +34,6 @@ $STD apt install -y \
   pkg-config \
   poppler-utils \
   python3-dev \
-  redis-server \
   tesseract-ocr
 msg_ok "Installed Dependencies"
 
@@ -71,8 +70,6 @@ REQUEST_CACHE_CONFIG={"CACHE_TYPE":"FileSystemCache","CACHE_DIR":"/opt/gramps-we
 PERSISTENT_CACHE_CONFIG={"CACHE_TYPE":"FileSystemCache","CACHE_DIR":"/opt/gramps-web/data/cache/persistent","CACHE_THRESHOLD":0,"CACHE_DEFAULT_TIMEOUT":0}
 REPORT_DIR="/opt/gramps-web/data/cache/report"
 EXPORT_DIR="/opt/gramps-web/data/cache/export"
-CELERY_CONFIG={"broker_url":"redis://127.0.0.1:6379/0","result_backend":"redis://127.0.0.1:6379/0"}
-RATELIMIT_STORAGE_URI="redis://127.0.0.1:6379/1"
 EOF
 $STD uv venv -c -p python3.12 /opt/gramps-web/venv
 source /opt/gramps-web/venv/bin/activate
@@ -110,8 +107,7 @@ msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/gramps-web.service
 [Unit]
 Description=Gramps Web Service
-After=network.target redis-server.service
-Wants=redis-server.service
+After=network.target
 
 [Service]
 Type=simple
@@ -128,28 +124,7 @@ RestartSec=5
 [Install]
 WantedBy=multi-user.target
 EOF
-cat <<EOF >/etc/systemd/system/gramps-web-celery.service
-[Unit]
-Description=Gramps Web Celery Worker
-After=network.target redis-server.service
-Wants=redis-server.service
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=/opt/gramps-web-api
-Environment=GRAMPS_API_CONFIG=/opt/gramps-web/config/config.cfg
-Environment=GRAMPSHOME=/opt/gramps-web/data
-Environment=GRAMPS_DATABASE_PATH=/opt/gramps-web/data/gramps/grampsdb
-Environment=PATH=/opt/gramps-web/venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
-ExecStart=/opt/gramps-web/venv/bin/celery -A gramps_webapi.celery worker --loglevel=INFO --concurrency=2
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now gramps-web gramps-web-celery
+systemctl enable -q --now gramps-web
 msg_ok "Created Service"
 
 motd_ssh

install/patchmon-install.sh

@@ -107,7 +107,7 @@ ExecStart=/opt/patchmon/patchmon-server
 Restart=always
 RestartSec=10
 Environment=PATH=/usr/bin:/usr/local/bin
-EnvironmentFile=/opt/patchmon/.env
+Environment=ENV_FILE=/opt/patchmon/.env
 NoNewPrivileges=true
 PrivateTmp=true
 ProtectSystem=strict

tools/pve/post-pve-install.sh

@@ -565,42 +565,23 @@ if [ -s "$WEB_JS" ] && ! grep -q NoMoreNagging "$WEB_JS"; then
 fi
 
 MOBILE_TPL=/usr/share/pve-yew-mobile-gui/index.html.tpl
-MARKER="<!-- MANAGED BLOCK FOR MOBILE NAG -->"
-if [ -f "$MOBILE_TPL" ] && ! grep -q "$MARKER" "$MOBILE_TPL"; then
+if [ -s "$MOBILE_TPL" ] && ! grep -q NoMoreNagging "$MOBILE_TPL"; then
     echo "Patching Mobile UI nag..."
-    printf "%s\n" \
-      "$MARKER" \
-      "<script>" \
-      "  function removeSubscriptionElements() {" \
-      "    // --- Remove subscription dialogs ---" \
-      "    const dialogs = document.querySelectorAll('dialog.pwt-outer-dialog');" \
-      "    dialogs.forEach(dialog => {" \
-      "      const text = (dialog.textContent || '').toLowerCase();" \
-      "      if (text.includes('subscription')) {" \
-      "        dialog.remove();" \
-      "        console.log('Removed subscription dialog');" \
-      "      }" \
-      "    });" \
-      "" \
-      "    // --- Remove subscription cards, but keep Reboot/Shutdown/Console ---" \
-      "    const cards = document.querySelectorAll('.pwt-card.pwt-p-2.pwt-d-flex.pwt-interactive.pwt-justify-content-center');" \
-      "    cards.forEach(card => {" \
-      "      const text = (card.textContent || '').toLowerCase();" \
-      "      const hasButton = card.querySelector('button');" \
-      "      if (!hasButton && text.includes('subscription')) {" \
-      "        card.remove();" \
-      "        console.log('Removed subscription card');" \
-      "      }" \
-      "    });" \
-      "  }" \
-      "" \
-      "  const observer = new MutationObserver(removeSubscriptionElements);" \
-      "  observer.observe(document.body, { childList: true, subtree: true });" \
-      "  removeSubscriptionElements();" \
-      "  setInterval(removeSubscriptionElements, 300);" \
-      "  setTimeout(() => {observer.disconnect();}, 10000);" \
-      "</script>" \
-      "" >> "$MOBILE_TPL"
+    sed -i '/<head>/r /dev/stdin' "$MOBILE_TPL" <<'HTML'
+  <script>
+    // NoMoreNagging
+    const nativeFetch = window.fetch.bind(window);
+    window.fetch = async (...args) => {
+      const res = await nativeFetch(...args);
+      const path = new URL(String(args[0]?.url ?? args[0]), location.href).pathname;
+      if (!['/api2/json/nodes', '/api2/extjs/nodes'].includes(path)) return res;
+      const body = await res.clone().json().catch(() => null);
+      if (!Array.isArray(body?.data)) return res;
+      body.data.forEach((node) => { if (!node.level) node.level = 'NoMoreNagging'; });
+      return new Response(JSON.stringify(body), { status: res.status, headers: res.headers });
+    };
+  </script>
+HTML
 fi
 EOF
     chmod 755 /usr/local/bin/pve-remove-nag.sh
@@ -615,10 +596,13 @@ EOF
   no)
     whiptail --backtitle "Proxmox VE Helper Scripts" --msgbox --title "Support Subscriptions" "Supporting the software's development team is essential. Check their official website's Support Subscriptions for pricing. Without their dedicated work, we wouldn't have this exceptional software." 10 58
     msg_error "Selected no to Disabling subscription nag"
-    [[ -f /etc/apt/apt.conf.d/no-nag-script ]] && rm /etc/apt/apt.conf.d/no-nag-script
+    rm -f /etc/apt/apt.conf.d/no-nag-script /usr/local/bin/pve-remove-nag.sh
     ;;
   esac
   apt --reinstall install proxmox-widget-toolkit &>/dev/null || msg_error "Widget toolkit reinstall failed"
+  if dpkg -s pve-yew-mobile-gui &>/dev/null; then
+    apt --reinstall install pve-yew-mobile-gui &>/dev/null || msg_error "Mobile UI reinstall failed"
+  fi
   if ! systemctl is-active --quiet pve-ha-lrm; then
     CHOICE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "HIGH AVAILABILITY" --menu "Enable high availability?" 10 58 2 \
       "yes" " " \