Update CHANGELOG.md

* Add dockhand (addon)

* Revise copyright and license details in dockhand.sh

---------

Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com>
Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com>

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -6,13 +6,17 @@ body:
     attributes:
       value: |
         ## ⚠️ **IMPORTANT - READ FIRST**
-        - 🔍 **Search first:** Before submitting, check if the issue has already been reported or resolved in [closed issues](https://github.com/community-scripts/ProxmoxVE/issues?q=is%3Aissue+is%3Aclosed). If found, comment on that issue instead of creating a new one.  
-        Alternatively, check the **[Discussions](https://github.com/community-scripts/ProxmoxVE/discussions)** under the *"Announcement"* or *"Guide"* categories for relevant information.  
-        - 🔎 If you encounter `[ERROR] in line 23: exit code *: while executing command "$@" > /dev/null 2>&1`, rerun the script with verbose mode before submitting the issue.  
-        - 📜 **Read the script:** Familiarize yourself with the script's content and its purpose. This will help you understand the issue better and provide more relevant information
 
-        Thank you for taking the time to report an issue! Please provide as much detail as possible to help us address the problem efficiently.  
+        **1. Reproduce the issue with verbose mode - this is mandatory.**
+        Set `var_verbose=yes` (or *Advanced Settings → Verbose Mode*) and run the script again.
+        Only a verbose log shows what actually failed - a bare `[ERROR] in line 23: exit code *` tells us nothing.
+        **Reports without a verbose log will most likely be closed.**
 
+        **2. Search before you post.**
+        Check the [closed issues](https://github.com/community-scripts/ProxmoxVE/issues?q=is%3Aissue+is%3Aclosed) and the [Discussions](https://github.com/community-scripts/ProxmoxVE/discussions) (*Announcement* / *Guide*). If it is already known, comment there instead of opening a new issue.
+
+        **3. Read the script.**
+        Knowing what it does makes it much easier to describe the problem - and often to solve it yourself.
 
   - type: input
     id: guidelines
@@ -28,7 +32,6 @@ body:
       label: 🔎 Did you run the script with verbose mode enabled?
       description: "Required for debugging any script issue. A verbose log is mandatory."
       options:
-        - ""
         - "Yes, verbose mode was enabled and the output is included below"
         - "No (this issue will likely be closed automatically)"
     validations:
@@ -50,6 +53,32 @@ body:
     validations:
       required: true
 
+  - type: dropdown
+    id: issue_phase
+    attributes:
+      label: 🕒 When does the issue occur?
+      options:
+        - "Initial creation / installation"
+        - "Update of an existing container"
+        - "While the application is running"
+    validations:
+      required: true
+
+  - type: dropdown
+    id: execution_context
+    attributes:
+      label: 🖱️ Where did you run the command?
+      description: "The shell matters — the Proxmox web console starts without some environment variables that a normal login shell sets."
+      options:
+        - "Proxmox web UI → node → Shell"
+        - "Proxmox web UI → LXC → Console"
+        - "SSH into the Proxmox host"
+        - "SSH into the container"
+        - "pct enter from the host"
+        - "Other / not listed"
+    validations:
+      required: true
+
   - type: checkboxes
     validations:
       required: true
@@ -64,18 +93,31 @@ body:
       value: "💡 **Tip:** If you are using Advanced Settings, please test with Default Settings before submitting an issue."
 
   - type: dropdown
-    id: linux_distribution
+    id: os_distribution
     attributes:
-      label: 🖥️ Which Linux distribution are you using?
+      label: 🖥️ Which Linux distribution is the container running?
       options:
-        - 
+        - Debian
+        - Ubuntu
         - Alpine
-        - Debian 11
+        - Devuan
-        - Debian 12
+        - AlmaLinux
-        - Debian 13
+        - Rocky Linux
-        - Ubuntu 22.04
+        - CentOS Stream
-        - Ubuntu 24.04
+        - Fedora
-        - Ubuntu 24.10
+        - openSUSE
+        - openEuler
+        - Gentoo
+        - Other / not listed
+    validations:
+      required: true
+
+  - type: input
+    id: os_version
+    attributes:
+      label: 🔢 Which version of that distribution?
+      description: "Run `cat /etc/os-release` inside the container if unsure."
+      placeholder: "e.g. 13 (Debian), 24.04 (Ubuntu), 3.22 (Alpine)"
     validations:
       required: true
 
@@ -85,16 +127,27 @@ body:
       label: 🧱 Is this Proxmox host running arm64?
       description: "Run `dpkg --print-architecture` on your Proxmox host if unsure."
       options:
-        - ""
         - "No"
         - "Yes"
     validations:
       required: true
 
+  - type: dropdown
+    id: pve_major
+    attributes:
+      label: 📈 Which Proxmox VE release are you on?
+      options:
+        - "Proxmox VE 9"
+        - "Proxmox VE 8"
+        - "Proxmox VE 7 or older (end of life)"
+    validations:
+      required: true
+
   - type: input
     id: pve_version
     attributes:
-      label: 📈 Which Proxmox version are you on?
+      label: 🔢 Exact Proxmox version and kernel
+      description: "Both matter — several issues turned out to be kernel-specific."
       placeholder: "run pveversion in your PVE node console"
     validations:
       required: true

.github/pull_request_template.md

@@ -14,6 +14,9 @@ Fixes #
 - [ ] **Tested thoroughly** – Changes work as expected.
 - [ ] **No security risks** – No hardcoded secrets, unnecessary privilege escalations, or permission issues.
 
+**Tested on:** <!-- e.g. PVE 9.2 / Debian 13 / fresh install + update. Write "not tested" if you could not run it. -->
+
+
 ---
 
 ## 🤖 AI Assistance (**X** in brackets)

CHANGELOG.md

@@ -540,16 +540,57 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-09-11
+
+### 🆕 New Scripts
+
+  - OneTimeSecret ([#17097](https://github.com/community-scripts/ProxmoxVE/pull/17097))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - passwordpusher: restore data before running migrations [@MickLesk](https://github.com/MickLesk) ([#17141](https://github.com/community-scripts/ProxmoxVE/pull/17141))
+    - paperclip: install the rust toolchain needed by the runner build [@MickLesk](https://github.com/MickLesk) ([#17142](https://github.com/community-scripts/ProxmoxVE/pull/17142))
+    - homepage: run next directly instead of through pnpm [@MickLesk](https://github.com/MickLesk) ([#17155](https://github.com/community-scripts/ProxmoxVE/pull/17155))
+    - changedetection: fix: pin browserless [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17163](https://github.com/community-scripts/ProxmoxVE/pull/17163))
+
+### 💾 Core
+
+  - #### 🐞 Bug Fixes
+
+    - core.func: fall back to a usable HOME when the shell has none [@MickLesk](https://github.com/MickLesk) ([#17154](https://github.com/community-scripts/ProxmoxVE/pull/17154))
+
+### 🧰 Tools
+
+  - Dockhand ([#17191](https://github.com/community-scripts/ProxmoxVE/pull/17191))
+
+  - #### 🐞 Bug Fixes
+
+    - update-apps: rewrite the retired Gitea base in every container before updating it [@MickLesk](https://github.com/MickLesk) ([#17156](https://github.com/community-scripts/ProxmoxVE/pull/17156))
+
+  - #### 🔧 Refactor
+
+    - Rename lxc-delete.sh to guest-delete.sh [@MickLesk](https://github.com/MickLesk) ([#17152](https://github.com/community-scripts/ProxmoxVE/pull/17152))
+
+### 📚 Documentation
+
+  - issue template: add PVE release, execution context and phase; refresh distro list / pve versions [@MickLesk](https://github.com/MickLesk) ([#17160](https://github.com/community-scripts/ProxmoxVE/pull/17160))
+
 ## 2026-09-10
 
 ### 🆕 New Scripts
 
+  - Chevereto ([#17131](https://github.com/community-scripts/ProxmoxVE/pull/17131))
+- Portabase ([#17111](https://github.com/community-scripts/ProxmoxVE/pull/17111))
+- Logseq ([#17112](https://github.com/community-scripts/ProxmoxVE/pull/17112))
 - Safebucket ([#17096](https://github.com/community-scripts/ProxmoxVE/pull/17096))
 
 ### 🚀 Updated Scripts
 
   - #### 🐞 Bug Fixes
 
+    - Immich v3.2.0 [@vhsdream](https://github.com/vhsdream) ([#17137](https://github.com/community-scripts/ProxmoxVE/pull/17137))
     - fix(solidtime): prevent composer install from hanging on root prompt [@supersoju](https://github.com/supersoju) ([#17146](https://github.com/community-scripts/ProxmoxVE/pull/17146))
     - fix(hermesagent): wait for root gateway cleanup [@steveonjava](https://github.com/steveonjava) ([#17147](https://github.com/community-scripts/ProxmoxVE/pull/17147))
 

ct/chevereto.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://chevereto.com/
+
+APP="Chevereto"
+var_tags="${var_tags:-image-hosting;gallery;media}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/chevereto ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "chevereto" "chevereto/chevereto"; then
+    PHP_FPM_SERVICE="$(basename "$(get_php_fpm_socket)" .sock)"
+
+    msg_info "Stopping Services"
+    systemctl stop nginx "$PHP_FPM_SERVICE"
+    msg_ok "Stopped Services"
+
+    create_backup /opt/chevereto/app/env.php \
+      /opt/chevereto/images \
+      /opt/chevereto/content
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "chevereto" "chevereto/chevereto" "tarball"
+
+    restore_backup
+
+    msg_info "Updating Chevereto"
+    cd /opt/chevereto/app
+    export COMPOSER_ALLOW_SUPERUSER=1
+    $STD composer install --no-dev --prefer-dist --no-interaction --optimize-autoloader
+    chown -R www-data:www-data /opt/chevereto
+    chmod -R 775 /opt/chevereto/images /opt/chevereto/content
+    msg_ok "Updated Chevereto"
+
+    msg_info "Starting Services"
+    systemctl start "$PHP_FPM_SERVICE" nginx
+    msg_ok "Started Services"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}${CL}"

ct/headers/chevereto

@@ -0,0 +1,6 @@
+   ________                             __      
+  / ____/ /_  ___ _   _____  ________  / /_____ 
+ / /   / __ \/ _ \ | / / _ \/ ___/ _ \/ __/ __ \
+/ /___/ / / /  __/ |/ /  __/ /  /  __/ /_/ /_/ /
+\____/_/ /_/\___/|___/\___/_/   \___/\__/\____/ 
+                                                

ct/headers/logseq

@@ -0,0 +1,6 @@
+    __                               
+   / /   ____  ____ _________  ____ _
+  / /   / __ \/ __ `/ ___/ _ \/ __ `/
+ / /___/ /_/ / /_/ (__  )  __/ /_/ / 
+/_____/\____/\__, /____/\___/\__, /  
+            /____/             /_/   

ct/headers/onetimesecret

@@ -0,0 +1,6 @@
+   ____           _______               _____                     __ 
+  / __ \____  ___/_  __(_)___ ___  ___ / ___/___  _____________  / /_
+ / / / / __ \/ _ \/ / / / __ `__ \/ _ \\__ \/ _ \/ ___/ ___/ _ \/ __/
+/ /_/ / / / /  __/ / / / / / / / /  __/__/ /  __/ /__/ /  /  __/ /_  
+\____/_/ /_/\___/_/ /_/_/ /_/ /_/\___/____/\___/\___/_/   \___/\__/  
+                                                                     

ct/headers/portabase

@@ -0,0 +1,6 @@
+    ____             __        __                  
+   / __ \____  _____/ /_____ _/ /_  ____ _________ 
+  / /_/ / __ \/ ___/ __/ __ `/ __ \/ __ `/ ___/ _ \
+ / ____/ /_/ / /  / /_/ /_/ / /_/ / /_/ (__  )  __/
+/_/    \____/_/   \__/\__,_/_.___/\__,_/____/\___/ 
+                                                   

ct/homepage.sh

@@ -83,6 +83,10 @@ EOF
       sed -i '/^ExecStart=/i Environment=CI=true' /etc/systemd/system/homepage.service
       systemctl daemon-reload
     fi
+    if grep -q '^ExecStart=pnpm start' /etc/systemd/system/homepage.service; then
+      sed -i 's|^ExecStart=pnpm start$|ExecStart=/opt/homepage/node_modules/.bin/next start|' /etc/systemd/system/homepage.service
+      systemctl daemon-reload
+    fi
     msg_ok "Updated Homepage"
 
     msg_info "Starting service"

ct/immich.sh

@@ -112,7 +112,7 @@ EOF
     msg_ok "Image-processing libraries up to date"
   fi
 
-  RELEASE="v3.1.0"
+  RELEASE="v3.2.0"
   if check_for_gh_release "Immich" "immich-app/immich" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
     if [[ $(cat ~/.immich) > "2.5.1" ]]; then
       msg_info "Enabling Maintenance Mode"
@@ -187,11 +187,10 @@ EOF
     msg_info "Updating Immich web and microservices"
     cd "$SRC_DIR"/server
     # server build
-    export SHARP_IGNORE_GLOBAL_LIBVIPS=true
     $STD pnpm --filter @immich/sdk --filter @immich/plugin-sdk --filter immich build
-    unset SHARP_IGNORE_GLOBAL_LIBVIPS
-    export SHARP_FORCE_GLOBAL_LIBVIPS=true
     $STD pnpm --filter immich --prod --no-optional deploy "$APP_DIR"
+    export SHARP_FORCE_GLOBAL_LIBVIPS=true
+    $STD pnpm --dir "$APP_DIR/node_modules/sharp" exec npm run build
 
     # Patch helmet.json: disable upgrade-insecure-requests for HTTP access
     if [[ -f "$APP_DIR/helmet.json" ]]; then
@@ -205,7 +204,6 @@ EOF
     cd "$SRC_DIR"
     echo "packageImportMethod: hardlink" >>./pnpm-workspace.yaml
     unset SHARP_FORCE_GLOBAL_LIBVIPS
-    export SHARP_IGNORE_GLOBAL_LIBVIPS=true
     $STD pnpm --filter @immich/sdk --filter immich-web --filter @immich/cli build
     $STD pnpm --filter @immich/cli --prod --no-optional deploy "$APP_DIR"/cli
     cp -a web/build "$APP_DIR"/www

ct/logseq.sh

@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://logseq.com/
+
+APP="Logseq"
+var_tags="${var_tags:-notes;knowledge-base}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-8192}"
+var_disk="${var_disk:-16}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/logseq ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "logseq" "logseq/logseq"; then
+    NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs
+    JAVA_VERSION="21" setup_java
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "logseq" "logseq/logseq" "tarball"
+
+    msg_info "Building Logseq Web App (Patience)"
+    cd /opt/logseq
+    export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+    export NODE_OPTIONS="--max-old-space-size=4096"
+    export JAVA_TOOL_OPTIONS="-Xmx4g"
+    $STD corepack enable
+    $STD pnpm install --config.network-timeout=240000
+    $STD pnpm release
+    msg_ok "Built Logseq Web App"
+
+    msg_info "Reloading Webserver"
+    systemctl reload nginx
+    msg_ok "Reloaded Webserver"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}${CL}"

ct/onetimesecret.sh

@@ -0,0 +1,101 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Hai Tran (epiHATR)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://onetimesecret.com/ | Github: https://github.com/onetimesecret/onetimesecret
+
+APP="OneTimeSecret"
+var_tags="${var_tags:-security;privacy;secrets}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  SSL_VALUE="${OTS_SSL:-}"
+  if [[ -n "${SSL_VALUE}" ]]; then
+    case "${SSL_VALUE,,}" in
+    1 | true | yes | on) SSL_VALUE="true" ;;
+    0 | false | no | off) SSL_VALUE="false" ;;
+    *)
+      msg_error "Invalid OTS_SSL value '${OTS_SSL}' (use true/false)"
+      exit 1
+      ;;
+    esac
+  fi
+
+  if [[ ! -d /opt/onetimesecret ]] || [[ ! -f /opt/onetimesecret/.env ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "onetimesecret" "onetimesecret/onetimesecret"; then
+    msg_info "Stopping Service"
+    systemctl stop onetimesecret
+    msg_ok "Stopped Service"
+
+    create_backup /opt/onetimesecret/.env
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "onetimesecret" "onetimesecret/onetimesecret" "tarball"
+    RUBY_VERSION=$(tr -d ' \n' </opt/onetimesecret/.ruby-version 2>/dev/null)
+    RUBY_VERSION="${RUBY_VERSION:-3.4.10}" setup_ruby
+
+    PNPM_VERSION=$(sed -n 's/.*"packageManager": "pnpm@\([^"]*\)".*/\1/p' /opt/onetimesecret/package.json)
+    NODE_VERSION=$(tr -d ' \n' </opt/onetimesecret/.nvmrc 2>/dev/null)
+    NODE_VERSION="${NODE_VERSION:-25}" NODE_MODULE="pnpm@${PNPM_VERSION:-11.1.2}" setup_nodejs
+
+    restore_backup
+
+    msg_info "Reconciling Application"
+    systemctl enable -q --now redis-server
+    cd /opt/onetimesecret
+    mkdir -p tmp/pids log
+    $STD bash bin/setup reconcile
+    msg_ok "Reconciled Application"
+
+    msg_info "Building Frontend"
+    cd /opt/onetimesecret
+    $STD pnpm run build
+    msg_ok "Built Frontend"
+
+    msg_info "Starting Service"
+    systemctl start onetimesecret
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+DISPLAY_HOST="${OTS_HOST:-$IP}"
+case "${OTS_SSL:-false,,}" in
+1 | true | yes | on)
+  DISPLAY_SCHEME="https"
+  ;;
+*)
+  DISPLAY_SCHEME="http"
+  ;;
+esac
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}${DISPLAY_SCHEME}://${DISPLAY_HOST}${CL}"

ct/paperclip.sh

@@ -43,6 +43,8 @@ function update_script() {
 
     restore_backup
 
+    setup_rust
+
     msg_info "Rebuilding Paperclip"
     cd /opt/paperclip-ai
     export HUSKY=0

ct/passwordpusher.sh

@@ -40,6 +40,9 @@ function update_script() {
     create_backup /opt/passwordpusher/storage /opt/passwordpusher/.env.production
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "passwordpusher" "pglombardo/PasswordPusher" "tarball"
+
+    restore_backup
+
     RUBY_VERSION="$(cat /opt/passwordpusher/.ruby-version)" RUBY_INSTALL_RAILS="false" setup_ruby
 
     msg_info "Installing Gem Dependencies"
@@ -62,8 +65,6 @@ function update_script() {
     RAILS_ENV=production SECRET_KEY_BASE_DUMMY=1 $STD bundle exec rails assets:precompile
     msg_ok "Precompiled Assets"
 
-    restore_backup
-
     msg_info "Starting Service"
     systemctl start passwordpusher
     msg_ok "Started Service"

ct/portabase.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://portabase.io
+
+APP="Portabase"
+var_tags="${var_tags:-database;backup}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-8192}"
+var_disk="${var_disk:-15}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/portabase ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "portabase" "Portabase/portabase"; then
+    msg_info "Stopping Services"
+    systemctl stop portabase portabase-tusd
+    msg_ok "Stopped Services"
+
+    create_backup /opt/portabase/.env
+
+    NODE_VERSION="22" NODE_MODULE="pnpm@11.8.0" setup_nodejs
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "portabase" "Portabase/portabase" "tarball"
+
+    restore_backup
+
+    msg_info "Building Portabase"
+    cd /opt/portabase
+    export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+    export NEXT_TELEMETRY_DISABLED=1
+    $STD pnpm install --frozen-lockfile
+    $STD pnpm run build
+    cp -r /opt/portabase/.next/static /opt/portabase/.next/standalone/.next/static
+    cp -r /opt/portabase/public /opt/portabase/.next/standalone/public
+    mkdir -p /opt/portabase/.next/standalone/src/db
+    cp -r /opt/portabase/src/db/migrations /opt/portabase/.next/standalone/src/db/migrations
+    ln -sf /opt/portabase/.env /opt/portabase/.next/standalone/.env
+    msg_ok "Built Portabase"
+
+    msg_info "Starting Services"
+    systemctl start portabase-tusd portabase
+    msg_ok "Started Services"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"

install/chevereto-install.sh

@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://chevereto.com/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  nginx \
+  exiftran \
+  libimage-exiftool-perl
+msg_ok "Installed Dependencies"
+
+PHP_VERSION="8.3" PHP_FPM="YES" PHP_UPLOAD_MAX_FILESIZE="512M" PHP_POST_MAX_SIZE="512M" PHP_MAX_EXECUTION_TIME="600" setup_php
+setup_composer
+setup_mariadb
+setup_ffmpeg
+MARIADB_DB_NAME="chevereto" MARIADB_DB_USER="chevereto" setup_mariadb_db
+
+fetch_and_deploy_gh_release "chevereto" "chevereto/chevereto" "tarball"
+
+msg_info "Installing Chevereto Dependencies"
+cd /opt/chevereto/app
+export COMPOSER_ALLOW_SUPERUSER=1
+$STD composer install --no-dev --prefer-dist --no-interaction --optimize-autoloader
+msg_ok "Installed Chevereto Dependencies"
+
+msg_info "Configuring Chevereto"
+cat <<EOF >/opt/chevereto/app/env.php
+<?php
+
+return [
+    'CHEVERETO_DB_HOST' => 'localhost',
+    'CHEVERETO_DB_PORT' => '3306',
+    'CHEVERETO_DB_NAME' => '${MARIADB_DB_NAME}',
+    'CHEVERETO_DB_USER' => '${MARIADB_DB_USER}',
+    'CHEVERETO_DB_PASS' => '${MARIADB_DB_PASS}',
+    'CHEVERETO_DB_TABLE_PREFIX' => 'chv_',
+    'CHEVERETO_HOSTNAME' => '${LOCAL_IP}',
+];
+EOF
+chown -R www-data:www-data /opt/chevereto
+chmod -R 775 /opt/chevereto/images /opt/chevereto/content
+msg_ok "Configured Chevereto"
+
+msg_info "Configuring Nginx"
+cat <<'EOF' >/etc/nginx/sites-available/chevereto
+server {
+    listen 80;
+    server_name _;
+    root /opt/chevereto;
+    index index.php;
+
+    charset utf-8;
+    client_max_body_size 512M;
+
+    add_header X-Frame-Options "SAMEORIGIN";
+    add_header X-Content-Type-Options "nosniff";
+
+    location / {
+        try_files $uri $uri/ /index.php$is_args$args;
+    }
+
+    location = /favicon.ico { access_log off; log_not_found off; }
+    location = /robots.txt  { access_log off; log_not_found off; }
+
+    location ~* ^/images/.+\.(gif|jpe?g|png|bmp|webp)$ {
+        try_files $uri =404;
+    }
+
+    location = /index.php {
+        include fastcgi_params;
+        fastcgi_pass unix:__PHP_FPM_SOCK__;
+        fastcgi_param SCRIPT_FILENAME $document_root/index.php;
+        fastcgi_read_timeout 600;
+    }
+
+    location ~ \.php$ {
+        deny all;
+    }
+
+    location ^~ /app/ {
+        deny all;
+    }
+
+    location ~ /\.(?!well-known).* {
+        deny all;
+    }
+}
+EOF
+sed -i "s|__PHP_FPM_SOCK__|$(get_php_fpm_socket)|" /etc/nginx/sites-available/chevereto
+nginx_enable_site chevereto
+msg_ok "Configured Nginx"
+
+motd_ssh
+customize
+cleanup_lxc

install/homepage-install.sh

@@ -64,7 +64,7 @@ RestartSec=1
 User=root
 WorkingDirectory=/opt/homepage/
 Environment=CI=true
-ExecStart=pnpm start
+ExecStart=/opt/homepage/node_modules/.bin/next start
 
 [Install]
 WantedBy=multi-user.target

install/immich-install.sh

@@ -353,7 +353,7 @@ ML_DIR="${APP_DIR}/machine-learning"
 GEO_DIR="${INSTALL_DIR}/geodata"
 mkdir -p {"${APP_DIR}","${UPLOAD_DIR}","${GEO_DIR}","${INSTALL_DIR}"/cache}
 
-fetch_and_deploy_gh_release "Immich" "immich-app/immich" "tarball" "v3.1.0" "$SRC_DIR"
+fetch_and_deploy_gh_release "Immich" "immich-app/immich" "tarball" "v3.2.0" "$SRC_DIR"
 PNPM_VERSION="$(jq -r '.packageManager | split("@")[1] | split("+")[0]' ${SRC_DIR}/package.json)"
 export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
 NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs
@@ -370,11 +370,10 @@ export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
 export CI=1
 
 # server build
-export SHARP_IGNORE_GLOBAL_LIBVIPS=true
 $STD pnpm --filter @immich/sdk --filter @immich/plugin-sdk --filter immich build
-unset SHARP_IGNORE_GLOBAL_LIBVIPS
-export SHARP_FORCE_GLOBAL_LIBVIPS=true
 $STD pnpm --filter immich --prod --no-optional deploy "$APP_DIR"
+export SHARP_FORCE_GLOBAL_LIBVIPS=true
+$STD pnpm --dir "$APP_DIR/node_modules/sharp" exec npm run build
 
 # Patch helmet.json: disable upgrade-insecure-requests for HTTP access
 if [[ -f "$APP_DIR/helmet.json" ]]; then
@@ -388,7 +387,6 @@ sed -i "s|^start|${APP_DIR}/bin/start|" "$APP_DIR"/bin/immich-admin
 cd "$SRC_DIR"
 echo "packageImportMethod: hardlink" >>./pnpm-workspace.yaml
 unset SHARP_FORCE_GLOBAL_LIBVIPS
-export SHARP_IGNORE_GLOBAL_LIBVIPS=true
 $STD pnpm --filter @immich/sdk --filter immich-web --filter @immich/cli build
 $STD pnpm --filter @immich/cli --prod --no-optional deploy "$APP_DIR"/cli
 cp -a web/build "$APP_DIR"/www

install/logseq-install.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://logseq.com/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  git \
+  nginx \
+  build-essential \
+  libcairo2-dev \
+  libpango1.0-dev \
+  libjpeg-dev \
+  libgif-dev \
+  librsvg2-dev
+msg_ok "Installed Dependencies"
+
+NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs
+JAVA_VERSION="21" setup_java
+
+msg_info "Installing Clojure CLI"
+cd /tmp
+curl_download "linux-install.sh" "https://github.com/clojure/brew-install/releases/latest/download/linux-install.sh"
+$STD bash linux-install.sh
+rm -f linux-install.sh
+msg_ok "Installed Clojure CLI"
+
+fetch_and_deploy_gh_release "logseq" "logseq/logseq" "tarball"
+
+msg_info "Building Logseq Web App (Patience)"
+cd /opt/logseq
+export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+export NODE_OPTIONS="--max-old-space-size=4096"
+export JAVA_TOOL_OPTIONS="-Xmx4g"
+$STD corepack enable
+$STD pnpm install --config.network-timeout=240000
+$STD pnpm release
+msg_ok "Built Logseq Web App"
+
+msg_info "Generating Self-Signed Certificate"
+create_self_signed_cert "logseq"
+msg_ok "Generated Self-Signed Certificate"
+
+msg_info "Configuring Nginx"
+cat <<'EOF' >/etc/nginx/sites-available/logseq
+server {
+    listen 80 default_server;
+    server_name _;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl default_server;
+    http2 on;
+    server_name _;
+
+    ssl_certificate /etc/ssl/logseq/logseq.crt;
+    ssl_certificate_key /etc/ssl/logseq/logseq.key;
+
+    root /opt/logseq/static;
+    index index.html;
+
+    add_header Cross-Origin-Opener-Policy same-origin always;
+    add_header Cross-Origin-Embedder-Policy require-corp always;
+
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+}
+EOF
+nginx_enable_site logseq
+msg_ok "Configured Nginx"
+
+motd_ssh
+customize
+cleanup_lxc

install/onetimesecret-install.sh

@@ -0,0 +1,138 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Hai Tran (epiHATR)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://onetimesecret.com/ | Github: https://github.com/onetimesecret/onetimesecret
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  build-essential \
+  git \
+  libffi-dev \
+  libgmp-dev \
+  libpq-dev \
+  libreadline-dev \
+  libsodium23 \
+  libsqlite3-dev \
+  libssl-dev \
+  libxml2-dev \
+  libxslt1-dev \
+  libyaml-dev \
+  nginx \
+  pkg-config \
+  python3 \
+  redis-server \
+  zlib1g-dev
+msg_ok "Installed Dependencies"
+
+fetch_and_deploy_gh_release "onetimesecret" "onetimesecret/onetimesecret" "tarball"
+
+RUBY_VERSION=$(tr -d ' \n' </opt/onetimesecret/.ruby-version 2>/dev/null)
+RUBY_VERSION="${RUBY_VERSION:-3.4.10}" setup_ruby
+PNPM_VERSION=$(sed -n 's/.*"packageManager": "pnpm@\([^"]*\)".*/\1/p' /opt/onetimesecret/package.json)
+NODE_VERSION=$(tr -d ' \n' </opt/onetimesecret/.nvmrc 2>/dev/null)
+NODE_VERSION="${NODE_VERSION:-25}" NODE_MODULE="pnpm@${PNPM_VERSION:-11.1.2}" setup_nodejs
+HOST_VALUE="${OTS_HOST:-$LOCAL_IP}"
+SSL_VALUE="${OTS_SSL:-false}"
+case "${SSL_VALUE,,}" in
+1 | true | yes | on) SSL_VALUE="true" ;;
+0 | false | no | off | "") SSL_VALUE="false" ;;
+*)
+  msg_error "Invalid OTS_SSL value '${OTS_SSL}' (use true/false)"
+  exit 1
+  ;;
+esac
+
+msg_info "Configuring Application"
+systemctl enable -q --now redis-server
+cd /opt/onetimesecret
+$STD bash bin/setup init
+sed -i \
+  -e "s|^REDIS_URL=.*|REDIS_URL=redis://127.0.0.1:6379/0|" \
+  -e "s|^HOST=.*|HOST=${HOST_VALUE//&/\\&}|" \
+  -e "s|^SSL=.*|SSL=${SSL_VALUE}|" \
+  /opt/onetimesecret/.env
+if grep -q '^RACK_ENV=' /opt/onetimesecret/.env; then
+  sed -i 's|^RACK_ENV=.*|RACK_ENV=production|' /opt/onetimesecret/.env
+else
+  echo "RACK_ENV=production" >>/opt/onetimesecret/.env
+fi
+if grep -q '^AUTHENTICATION_MODE=' /opt/onetimesecret/.env; then
+  sed -i 's|^AUTHENTICATION_MODE=.*|AUTHENTICATION_MODE=simple|' /opt/onetimesecret/.env
+else
+  echo "AUTHENTICATION_MODE=simple" >>/opt/onetimesecret/.env
+fi
+if ! grep -q '^PORT=' /opt/onetimesecret/.env; then
+  echo "PORT=3000" >>/opt/onetimesecret/.env
+fi
+chmod 600 /opt/onetimesecret/.env
+mkdir -p /opt/onetimesecret/tmp/pids /opt/onetimesecret/log
+msg_ok "Configured Application"
+
+msg_info "Reconciling Application"
+cd /opt/onetimesecret
+$STD bash bin/setup reconcile
+msg_ok "Reconciled Application"
+
+msg_info "Building Frontend"
+cd /opt/onetimesecret
+$STD pnpm run build
+msg_ok "Built Frontend"
+
+msg_info "Creating Service"
+cat <<'EOF' >/etc/systemd/system/onetimesecret.service
+[Unit]
+Description=Onetime Secret Service
+After=network.target redis-server.service
+Requires=redis-server.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/onetimesecret
+Environment=HOME=/root
+Environment=PATH=/root/.rbenv/shims:/root/.rbenv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+EnvironmentFile=/opt/onetimesecret/.env
+ExecStart=/root/.rbenv/shims/bundle exec puma -C etc/puma.rb
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now onetimesecret
+msg_ok "Created Service"
+
+msg_info "Configuring Nginx"
+cat <<'EOF' >/etc/nginx/sites-available/onetimesecret
+server {
+  listen 80 default_server;
+  server_name _;
+
+  location / {
+    proxy_pass http://127.0.0.1:3000;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+  }
+}
+EOF
+nginx_enable_site onetimesecret
+msg_ok "Configured Nginx"
+
+motd_ssh
+customize
+cleanup_lxc

install/paperclip-install.sh

@@ -23,6 +23,7 @@ msg_ok "Installed Dependencies"
 NODE_VERSION="24" NODE_MODULE="pnpm" setup_nodejs
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="paperclip" PG_DB_USER="paperclip" setup_postgresql_db
+setup_rust
 
 fetch_and_deploy_gh_release "paperclip-ai" "paperclipai/paperclip" "tarball"
 

install/portabase-install.sh

@@ -0,0 +1,163 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://portabase.io
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  build-essential \
+  git \
+  nginx
+msg_ok "Installed Dependencies"
+
+NODE_VERSION="22" NODE_MODULE="pnpm@11.8.0" setup_nodejs
+PG_VERSION="17" setup_postgresql
+PG_DB_NAME="portabase" PG_DB_USER="portabase" setup_postgresql_db
+
+fetch_and_deploy_gh_release "portabase" "Portabase/portabase" "tarball"
+fetch_and_deploy_gh_release "tusd" "tus/tusd" "prebuild" "latest" "/opt/tusd" "tusd_linux_$(arch_resolve).tar.gz"
+
+msg_info "Configuring Portabase"
+mkdir -p /opt/portabase-data/uploads/tmp
+mv -f "/opt/tusd/tusd_linux_$(arch_resolve)/tusd" /opt/tusd/tusd
+rm -rf "/opt/tusd/tusd_linux_$(arch_resolve)"
+chmod +x /opt/tusd/tusd
+PROJECT_SECRET=$(openssl rand -hex 32)
+ADMIN_PASSWORD=$(openssl rand -base64 18 | tr -dc 'A-Za-z0-9' | head -c 16)
+cat <<EOF >/opt/portabase/.env
+LOG_LEVEL=info
+DATABASE_URL=postgresql://${PG_DB_USER}:${PG_DB_PASS}@127.0.0.1:5432/${PG_DB_NAME}
+PROJECT_NAME=Portabase
+PROJECT_URL=http://${LOCAL_IP}:3000
+PROJECT_SECRET=${PROJECT_SECRET}
+TRUSTED_DOMAINS=http://${LOCAL_IP}:3000
+PRIVATE_PATH=/opt/portabase-data
+AUTH_DEFAULT_USER_NAME=Portabase Admin
+AUTH_DEFAULT_USER=admin@example.com
+AUTH_DEFAULT_PASSWORD=${ADMIN_PASSWORD}
+AUTH_EMAIL_PASSWORD_ENABLED=true
+AUTH_SIGNUP_ENABLED=true
+RETENTION_CRON=0 7 * * *
+TUSD_BEHIND_PROXY=true
+TELEMETRY=false
+EOF
+cat <<EOF >~/portabase.creds
+Portabase Admin
+Username: admin@example.com
+Password: ${ADMIN_PASSWORD}
+EOF
+msg_ok "Configured Portabase"
+
+msg_info "Building Portabase"
+cd /opt/portabase
+export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+export NEXT_TELEMETRY_DISABLED=1
+$STD pnpm install --frozen-lockfile
+$STD pnpm run build
+cp -r /opt/portabase/.next/static /opt/portabase/.next/standalone/.next/static
+cp -r /opt/portabase/public /opt/portabase/.next/standalone/public
+mkdir -p /opt/portabase/.next/standalone/src/db
+cp -r /opt/portabase/src/db/migrations /opt/portabase/.next/standalone/src/db/migrations
+ln -sf /opt/portabase/.env /opt/portabase/.next/standalone/.env
+msg_ok "Built Portabase"
+
+msg_info "Creating Services"
+cat <<EOF >/etc/systemd/system/portabase-tusd.service
+[Unit]
+Description=Portabase tusd Upload Server
+After=network.target
+Before=portabase.service
+
+[Service]
+Type=simple
+ExecStart=/opt/tusd/tusd --base-path /tus/files/ --upload-dir /opt/portabase-data/uploads/tmp --hooks-http http://127.0.0.1:8887/api/tus/hooks --port 1080 --max-size 21474836480 --behind-proxy
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+cat <<EOF >/etc/systemd/system/portabase.service
+[Unit]
+Description=Portabase
+After=network.target postgresql.service portabase-tusd.service
+Wants=postgresql.service
+
+[Service]
+Type=simple
+WorkingDirectory=/opt/portabase/.next/standalone
+Environment=NODE_ENV=production
+Environment=PORT=8887
+Environment=HOSTNAME=127.0.0.1
+ExecStart=/usr/bin/node /opt/portabase/.next/standalone/server.js
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now portabase-tusd portabase
+msg_ok "Created Services"
+
+msg_info "Configuring Nginx"
+cat <<'EOF' >/etc/nginx/sites-available/portabase
+map $http_x_forwarded_proto $forwarded_proto {
+    default $scheme;
+    "~*^\s*(https?)\s*(?:,|$)" $1;
+}
+
+server {
+    listen 3000;
+    server_name _;
+
+    client_max_body_size 20G;
+    ignore_invalid_headers off;
+
+    location /tus/ {
+        proxy_pass http://127.0.0.1:1080/tus/;
+        proxy_pass_request_headers on;
+        proxy_request_buffering off;
+        proxy_buffering off;
+        proxy_http_version 1.1;
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Forwarded-Host $http_host;
+        proxy_set_header X-Forwarded-Proto $forwarded_proto;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    location = /api/tus/hooks {
+        deny all;
+        return 404;
+    }
+
+    location / {
+        proxy_pass http://127.0.0.1:8887;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Forwarded-Host $http_host;
+        proxy_set_header X-Forwarded-Proto $forwarded_proto;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    }
+}
+EOF
+nginx_enable_site portabase
+msg_ok "Configured Nginx"
+
+motd_ssh
+customize
+cleanup_lxc

misc/core.func

@@ -15,6 +15,11 @@
 [[ -n "${_CORE_FUNC_LOADED:-}" ]] && return
 _CORE_FUNC_LOADED=1
 
+if [[ -z "${HOME:-}" ]]; then
+  HOME="$(getent passwd "$(id -u)" 2>/dev/null | cut -d: -f6)"
+  export HOME="${HOME:-/root}"
+fi
+
 # ==============================================================================
 # SECTION 1: INITIALIZATION & SETUP
 # ==============================================================================

tools/addon/dockhand.sh

@@ -0,0 +1,111 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Finsys/dockhand
+
+if command -v curl >/dev/null 2>&1; then
+  source <(curl -fsSL ${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/core.func)
+  load_functions
+elif command -v wget >/dev/null 2>&1; then
+  source <(wget -qO- ${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/core.func)
+  load_functions
+fi
+source <(curl -fsSL ${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/lib/tools.func)
+
+color
+catch_errors
+
+APP="Dockhand"
+APP_TYPE="addon"
+INSTALL_PATH="/opt/dockhand"
+COMPOSE_FILE="${INSTALL_PATH}/docker-compose.yaml"
+DEFAULT_PORT=3000
+
+header_info "$APP"
+
+IP=$(_get_current_ip)
+
+function check_docker() {
+  if ! command -v docker >/dev/null 2>&1; then
+    msg_error "Docker is not installed. This addon requires an existing Docker host/LXC. Exiting."
+    exit 1
+  fi
+  if ! docker compose version >/dev/null 2>&1; then
+    msg_error "Docker Compose plugin is not available. Install it before running this addon. Exiting."
+    exit 1
+  fi
+  msg_ok "Docker $(docker --version | cut -d' ' -f3 | tr -d ',') and Docker Compose are available"
+}
+
+function install_dockhand() {
+  local port="${1:-$DEFAULT_PORT}"
+  check_docker
+
+  msg_info "Creating Compose Project"
+  mkdir -p "$INSTALL_PATH"
+  cat <<EOF >"$COMPOSE_FILE"
+services:
+  dockhand:
+    image: fnsys/dockhand:latest
+    container_name: dockhand
+    restart: unless-stopped
+    ports:
+      - ${port}:3000
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - dockhand_data:/app/data
+
+volumes:
+  dockhand_data:
+EOF
+  msg_ok "Created Compose Project"
+
+  msg_info "Starting ${APP}"
+  cd "$INSTALL_PATH"
+  $STD docker compose up -d
+  msg_ok "Started ${APP}"
+
+  msg_ok "${APP} is reachable at http://${IP}:${port}"
+  echo -e "${TAB}Open the URL and complete the first-run setup wizard to create the admin account."
+}
+
+function update_dockhand() {
+  msg_info "Pulling latest ${APP} image"
+  cd "$INSTALL_PATH"
+  $STD docker compose pull
+  msg_ok "Pulled latest image"
+
+  msg_info "Restarting ${APP}"
+  $STD docker compose up -d --remove-orphans
+  msg_ok "Restarted ${APP}"
+
+  msg_ok "${APP} updated successfully"
+}
+
+function uninstall_dockhand() {
+  msg_info "Removing ${APP}"
+  cd "$INSTALL_PATH"
+  $STD docker compose down --remove-orphans
+  cd /
+  rm -rf "$INSTALL_PATH"
+  msg_ok "${APP} uninstalled (the dockhand_data volume was kept; remove it with: docker volume rm dockhand_data)"
+}
+
+if [[ -f "$COMPOSE_FILE" ]]; then
+  read -r -p "Update (1), Uninstall (2), Cancel (3)? [1/2/3]: " action
+  action="${action//[[:space:]]/}"
+  case "$action" in
+  1) update_dockhand ;;
+  2) uninstall_dockhand ;;
+  3) msg_info "Cancelled" ;;
+  *) msg_error "Invalid input" ;;
+  esac
+else
+  read -r -p "Enter port number (default: ${DEFAULT_PORT}): " PORT_INPUT
+  PORT="${PORT_INPUT:-$DEFAULT_PORT}"
+  read -r -p "Install ${APP}? (y/n): " answer
+  answer="${answer//[[:space:]]/}"
+  [[ "${answer,,}" =~ ^(y|yes)$ ]] && install_dockhand "$PORT" || msg_info "Installation skipped"
+fi

tools/pve/guest-delete.sh

@@ -40,7 +40,7 @@ CM="${TAB}✔️${TAB}${CL}"
 
 # Telemetry
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/api.func) 2>/dev/null || true
-declare -f init_tool_telemetry &>/dev/null && init_tool_telemetry "lxc-delete" "pve"
+declare -f init_tool_telemetry &>/dev/null && init_tool_telemetry "guest-delete" "pve"
 
 GUEST_LOG=$(mktemp)
 trap 'rm -f "$GUEST_LOG"' EXIT

tools/pve/update-apps.sh

@@ -178,6 +178,24 @@ function resolve_service_script() {
   return 1
 }
 
+# The retired Gitea mirror. The old entrypoint pulls ct/<app>.sh straight from
+# it and never reaches the update helper that would repair itself, so rewrite it
+# here. Only host and /raw/<kind>/ change; owner, repo and ref are kept.
+function repair_update_url() {
+  local container="$1"
+  pct exec "$container" -- sh -c '
+    [ -f /usr/bin/update ] || exit 1
+    grep -q git.community-scripts.org /usr/bin/update || exit 1
+    sed -i \
+      -e "s|https://git[.]community-scripts[.]org/|https://raw.githubusercontent.com/|g" \
+      -e "s|/raw/branch/|/|g" -e "s|/raw/tag/|/|g" -e "s|/raw/commit/|/|g" \
+      /usr/bin/update
+  ' >/dev/null 2>&1 || return 1
+
+  echo -e "${BL}[INFO]${CL} Repaired update URL (Gitea -> GitHub) in container $container"
+  log_write "Container $container: rewrote the retired Gitea base in /usr/bin/update"
+}
+
 function detect_service() {
   local container="$1"
   local tmpdir update_file
@@ -489,6 +507,9 @@ for container in $CHOICE; do
     sleep 5
   fi
 
+  #0.5) Rewrite a retired Gitea base before anything reads it.
+  repair_update_url "$container"
+
   #1) Detect service using the service name in the update command
   detect_service $container