Rename CI credentials to org-wide names, demote non-secrets to variables

Four GitHub Apps were reachable under three different key suffixes
(_PRIVATE_KEY, _KEY_, _SECRET) and their ids sat half in secrets, half
in variables. Each app now reads <APP>_ID from variables and
<APP>_PRIVATE_KEY from secrets:

  vars.APP_ID / secrets.APP_PRIVATE_KEY   -> GHAPP_HEADERS_*
  secrets.APP_{ID,KEY}_APPROVE_AND_MERGE  -> GHAPP_MERGEBOT_*
  vars.PUSH_MAIN_APP_ID / secrets.PUSH_MAIN_APP_SECRET -> GHAPP_SYNC_*
  secrets.PB_BOT_APP_{ID,PRIVATE_KEY}     -> GHAPP_PBBOT_*

Values that are not credentials become variables, so a failing run shows
what it talked to instead of ***:

  secrets.POCKETBASE_URL        -> vars.POCKETBASE_URL
  secrets.POCKETBASE_COLLECTION -> vars.POCKETBASE_COLLECTION
  secrets.FRONTEND_URL          -> vars.FRONTEND_URL (also replaces vars.SITE_URL)

The frontend endpoints shared three secrets where two suffice. Cache
revalidation and screenshot import have the same blast radius and merge;
the advisory ingest keeps its own secret because it feeds the update
helper on user systems:

  REVALIDATE_SECRET, SCREENSHOT_IMPORT_SECRET -> FRONTEND_INGEST_SECRET
  BREAKING_CHANGE_INGEST_SECRET               -> FRONTEND_ADVISORY_SECRET

PAT_MICHEL ties infrastructure to one person and existed at both org and
repo level, so the repo copy silently shadowed the org one; it becomes
GH_CROSS_REPO_TOKEN.

.github/workflows/auto-update-app-headers.yml

@@ -24,15 +24,15 @@ jobs:
         id: generate-token
         uses: actions/create-github-app-token@v3
         with:
-          app-id: ${{ vars.APP_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          app-id: ${{ vars.GHAPP_HEADERS_ID }}
+          private-key: ${{ secrets.GHAPP_HEADERS_PRIVATE_KEY }}
 
       - name: Generate a token for PR approval and merge
         id: generate-token-merge
         uses: actions/create-github-app-token@v3
         with:
-          app-id: ${{ secrets.APP_ID_APPROVE_AND_MERGE }}
-          private-key: ${{ secrets.APP_KEY_APPROVE_AND_MERGE }}
+          app-id: ${{ vars.GHAPP_MERGEBOT_ID }}
+          private-key: ${{ secrets.GHAPP_MERGEBOT_PRIVATE_KEY }}
 
       # Step 1: Checkout repository
       - name: Checkout repository

.github/workflows/changelog-archive.yml

@@ -21,15 +21,15 @@ jobs:
         id: generate-token
         uses: actions/create-github-app-token@v3
         with:
-          app-id: ${{ vars.APP_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          app-id: ${{ vars.GHAPP_HEADERS_ID }}
+          private-key: ${{ secrets.GHAPP_HEADERS_PRIVATE_KEY }}
 
       - name: Generate a token for PR approval and merge
         id: generate-token-merge
         uses: actions/create-github-app-token@v3
         with:
-          app-id: ${{ secrets.APP_ID_APPROVE_AND_MERGE }}
-          private-key: ${{ secrets.APP_KEY_APPROVE_AND_MERGE }}
+          app-id: ${{ vars.GHAPP_MERGEBOT_ID }}
+          private-key: ${{ secrets.GHAPP_MERGEBOT_PRIVATE_KEY }}
 
       - name: Checkout code
         uses: actions/checkout@v7

.github/workflows/changelog-pr.yml

@@ -26,15 +26,15 @@ jobs:
         id: generate-token
         uses: actions/create-github-app-token@v3
         with:
-          app-id: ${{ vars.APP_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          app-id: ${{ vars.GHAPP_HEADERS_ID }}
+          private-key: ${{ secrets.GHAPP_HEADERS_PRIVATE_KEY }}
 
       - name: Generate a token for PR approval and merge
         id: generate-token-merge
         uses: actions/create-github-app-token@v3
         with:
-          app-id: ${{ secrets.APP_ID_APPROVE_AND_MERGE }}
-          private-key: ${{ secrets.APP_KEY_APPROVE_AND_MERGE }}
+          app-id: ${{ vars.GHAPP_MERGEBOT_ID }}
+          private-key: ${{ secrets.GHAPP_MERGEBOT_PRIVATE_KEY }}
 
       - name: Checkout code
         uses: actions/checkout@v7

.github/workflows/close_issue_in_dev.yaml

@@ -128,7 +128,7 @@ jobs:
         if: steps.find_issue.outputs.issue_numbers != ''
         shell: bash
         env:
-          GH_TOKEN: ${{ secrets.PAT_MICHEL }}
+          GH_TOKEN: ${{ secrets.GH_CROSS_REPO_TOKEN }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
           ISSUE_NUMBERS: ${{ steps.find_issue.outputs.issue_numbers }}
         run: |
@@ -147,8 +147,8 @@ jobs:
       - name: Set is_dev to false in PocketBase
         if: steps.get_slugs.outputs.count != '0'
         env:
-          POCKETBASE_URL: ${{ secrets.POCKETBASE_URL }}
-          POCKETBASE_COLLECTION: ${{ secrets.POCKETBASE_COLLECTION }}
+          POCKETBASE_URL: ${{ vars.POCKETBASE_URL }}
+          POCKETBASE_COLLECTION: ${{ vars.POCKETBASE_COLLECTION }}
           POCKETBASE_ADMIN_EMAIL: ${{ secrets.POCKETBASE_ADMIN_EMAIL }}
           POCKETBASE_ADMIN_PASSWORD: ${{ secrets.POCKETBASE_ADMIN_PASSWORD }}
           PR_URL: ${{ github.server_url }}/${{ github.repository }}/pull/${{ github.event.pull_request.number }}

.github/workflows/delete-pocketbase-entry-on-removal.yml

@@ -75,8 +75,8 @@ jobs:
       - name: Mark as deleted in PocketBase
         if: steps.slugs.outputs.count != '0'
         env:
-          POCKETBASE_URL: ${{ secrets.POCKETBASE_URL }}
-          POCKETBASE_COLLECTION: ${{ secrets.POCKETBASE_COLLECTION }}
+          POCKETBASE_URL: ${{ vars.POCKETBASE_URL }}
+          POCKETBASE_COLLECTION: ${{ vars.POCKETBASE_COLLECTION }}
           POCKETBASE_ADMIN_EMAIL: ${{ secrets.POCKETBASE_ADMIN_EMAIL }}
           POCKETBASE_ADMIN_PASSWORD: ${{ secrets.POCKETBASE_ADMIN_PASSWORD }}
         run: |
@@ -175,8 +175,8 @@ jobs:
       - name: Generate CT stubs for deleted scripts
         if: steps.slugs.outputs.count != '0'
         env:
-          POCKETBASE_URL: ${{ secrets.POCKETBASE_URL }}
-          POCKETBASE_COLLECTION: ${{ secrets.POCKETBASE_COLLECTION }}
+          POCKETBASE_URL: ${{ vars.POCKETBASE_URL }}
+          POCKETBASE_COLLECTION: ${{ vars.POCKETBASE_COLLECTION }}
           POCKETBASE_ADMIN_EMAIL: ${{ secrets.POCKETBASE_ADMIN_EMAIL }}
           POCKETBASE_ADMIN_PASSWORD: ${{ secrets.POCKETBASE_ADMIN_PASSWORD }}
         run: |

.github/workflows/notify-breaking-change.yml

@@ -33,8 +33,8 @@ jobs:
     steps:
       - name: Notify site of breaking change
         env:
-          INGEST_SECRET: ${{ secrets.BREAKING_CHANGE_INGEST_SECRET }}
-          SITE_URL: ${{ secrets.FRONTEND_URL || vars.SITE_URL || 'https://community-scripts.org' }}
+          INGEST_SECRET: ${{ secrets.FRONTEND_ADVISORY_SECRET }}
+          SITE_URL: ${{ vars.FRONTEND_URL || 'https://community-scripts.org' }}
           PR: ${{ github.event.pull_request.number }}
         run: |
           set -euo pipefail

.github/workflows/pocketbase-ai-bot.yml

@@ -28,26 +28,26 @@ jobs:
         id: app-token
         uses: actions/create-github-app-token@v3
         with:
-          app-id: ${{ secrets.PB_BOT_APP_ID }}
-          private-key: ${{ secrets.PB_BOT_APP_PRIVATE_KEY }}
+          app-id: ${{ vars.GHAPP_PBBOT_ID }}
+          private-key: ${{ secrets.GHAPP_PBBOT_PRIVATE_KEY }}
 
       - name: Run PocketBase AI bot
         env:
           # GitHub REST as the bot identity
           GH_APP_TOKEN: ${{ steps.app-token.outputs.token }}
-          PB_BOT_APP_ID: ${{ secrets.PB_BOT_APP_ID }}
+          PB_BOT_APP_ID: ${{ vars.GHAPP_PBBOT_ID }}
           # GitHub Models inference uses the built-in token (needs models: read)
           MODELS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # Built-in token for git/PR ops (CT-defaults sync), mirroring the slash bot
           GH_DEFAULT_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           AI_MODEL: openai/gpt-4o
           # PocketBase
-          POCKETBASE_URL: ${{ secrets.POCKETBASE_URL }}
-          POCKETBASE_COLLECTION: ${{ secrets.POCKETBASE_COLLECTION }}
+          POCKETBASE_URL: ${{ vars.POCKETBASE_URL }}
+          POCKETBASE_COLLECTION: ${{ vars.POCKETBASE_COLLECTION }}
           POCKETBASE_ADMIN_EMAIL: ${{ secrets.POCKETBASE_ADMIN_EMAIL }}
           POCKETBASE_ADMIN_PASSWORD: ${{ secrets.POCKETBASE_ADMIN_PASSWORD }}
-          FRONTEND_URL: ${{ secrets.FRONTEND_URL }}
-          REVALIDATE_SECRET: ${{ secrets.REVALIDATE_SECRET }}
+          FRONTEND_URL: ${{ vars.FRONTEND_URL }}
+          REVALIDATE_SECRET: ${{ secrets.FRONTEND_INGEST_SECRET }}
           # Event context
           COMMENT_BODY: ${{ github.event.comment.body }}
           COMMENT_ID: ${{ github.event.comment.id }}

.github/workflows/pocketbase-bot.yml

@@ -19,8 +19,8 @@ jobs:
     steps:
       - name: Execute PocketBase bot command
         env:
-          POCKETBASE_URL: ${{ secrets.POCKETBASE_URL }}
-          POCKETBASE_COLLECTION: ${{ secrets.POCKETBASE_COLLECTION }}
+          POCKETBASE_URL: ${{ vars.POCKETBASE_URL }}
+          POCKETBASE_COLLECTION: ${{ vars.POCKETBASE_COLLECTION }}
           POCKETBASE_ADMIN_EMAIL: ${{ secrets.POCKETBASE_ADMIN_EMAIL }}
           POCKETBASE_ADMIN_PASSWORD: ${{ secrets.POCKETBASE_ADMIN_PASSWORD }}
           COMMENT_BODY: ${{ github.event.comment.body }}
@@ -31,12 +31,12 @@ jobs:
           ACTOR: ${{ github.event.comment.user.login }}
           ACTOR_ASSOCIATION: ${{ github.event.comment.author_association }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          FRONTEND_URL: ${{ secrets.FRONTEND_URL }}
-          REVALIDATE_SECRET: ${{ secrets.REVALIDATE_SECRET }}
+          FRONTEND_URL: ${{ vars.FRONTEND_URL }}
+          REVALIDATE_SECRET: ${{ secrets.FRONTEND_INGEST_SECRET }}
           # Screenshot attaching is delegated to the frontend, which owns the
           # fetching and validation. Without this the subcommand says so rather
           # than failing halfway.
-          SCREENSHOT_IMPORT_SECRET: ${{ secrets.SCREENSHOT_IMPORT_SECRET }}
+          SCREENSHOT_IMPORT_SECRET: ${{ secrets.FRONTEND_INGEST_SECRET }}
         run: |
           node << 'ENDSCRIPT'
           (async function () {

.github/workflows/push-json-to-pocketbase.yml

@@ -37,8 +37,8 @@ jobs:
       - name: Push to PocketBase
         if: steps.changed.outputs.count != '0'
         env:
-          POCKETBASE_URL: ${{ secrets.POCKETBASE_URL }}
-          POCKETBASE_COLLECTION: ${{ secrets.POCKETBASE_COLLECTION }}
+          POCKETBASE_URL: ${{ vars.POCKETBASE_URL }}
+          POCKETBASE_COLLECTION: ${{ vars.POCKETBASE_COLLECTION }}
           POCKETBASE_ADMIN_EMAIL: ${{ secrets.POCKETBASE_ADMIN_EMAIL }}
           POCKETBASE_ADMIN_PASSWORD: ${{ secrets.POCKETBASE_ADMIN_PASSWORD }}
         run: |

.github/workflows/sync-to-incus.yml

@@ -10,8 +10,8 @@ name: Sync ct/install to Incus
 # script. We therefore only fire a repository_dispatch and let that single
 # source of truth do the work (and auto-approve + merge its own PR).
 #
-# Auth: the "push-app-to-main" GitHub App (vars.PUSH_MAIN_APP_ID /
-# secrets.PUSH_MAIN_APP_SECRET), scoped to community-scripts/Incus. It has
+# Auth: the "push-app-to-main" GitHub App (vars.GHAPP_SYNC_ID /
+# secrets.GHAPP_SYNC_PRIVATE_KEY), scoped to community-scripts/Incus. It has
 # contents:write, which repository_dispatch requires (community-scripts-pr-app
 # only has pull_requests:write, so it cannot dispatch). The app must be
 # installed on the Incus repo.
@@ -38,8 +38,8 @@ jobs:
         id: token
         uses: actions/create-github-app-token@v3
         with:
-          app-id: ${{ vars.PUSH_MAIN_APP_ID }}
-          private-key: ${{ secrets.PUSH_MAIN_APP_SECRET }}
+          app-id: ${{ vars.GHAPP_SYNC_ID }}
+          private-key: ${{ secrets.GHAPP_SYNC_PRIVATE_KEY }}
           owner: community-scripts
           repositories: Incus
 

.github/workflows/update-script-timestamp-on-sh-change.yml

@@ -69,8 +69,8 @@ jobs:
       - name: Update script timestamps in PocketBase
         if: steps.slugs.outputs.count != '0'
         env:
-          POCKETBASE_URL: ${{ secrets.POCKETBASE_URL }}
-          POCKETBASE_COLLECTION: ${{ secrets.POCKETBASE_COLLECTION }}
+          POCKETBASE_URL: ${{ vars.POCKETBASE_URL }}
+          POCKETBASE_COLLECTION: ${{ vars.POCKETBASE_COLLECTION }}
           POCKETBASE_ADMIN_EMAIL: ${{ secrets.POCKETBASE_ADMIN_EMAIL }}
           POCKETBASE_ADMIN_PASSWORD: ${{ secrets.POCKETBASE_ADMIN_PASSWORD }}
           COMMIT_URL: ${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }}

CHANGELOG.md

@@ -532,10 +532,16 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ## 2026-08-31
 
+### 🆕 New Scripts
+
+  - Aurral ([#16908](https://github.com/community-scripts/ProxmoxVE/pull/16908))
+
 ### 🚀 Updated Scripts
 
   - #### 🐞 Bug Fixes
 
+    - bambuddy: force asyncio loop, uvloop breaks camera proxy handlers [@MickLesk](https://github.com/MickLesk) ([#16904](https://github.com/community-scripts/ProxmoxVE/pull/16904))
+    - bookorbit: raise service start timeout, migration can exceed systemd default [@MickLesk](https://github.com/MickLesk) ([#16860](https://github.com/community-scripts/ProxmoxVE/pull/16860))
     - node-red: remove --unsafe-perm flag [@MickLesk](https://github.com/MickLesk) ([#16859](https://github.com/community-scripts/ProxmoxVE/pull/16859))
     - directus: add build-essential dependency [@MickLesk](https://github.com/MickLesk) ([#16858](https://github.com/community-scripts/ProxmoxVE/pull/16858))
 
@@ -545,6 +551,8 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🔧 Refactor
 
+    - kima-hub/maintainerr/planka/spliit: bump NODE_VERSION [@MickLesk](https://github.com/MickLesk) ([#16905](https://github.com/community-scripts/ProxmoxVE/pull/16905))
+    - gatus: pin Go toolchain to gatus's own go.mod version [@MickLesk](https://github.com/MickLesk) ([#16893](https://github.com/community-scripts/ProxmoxVE/pull/16893))
     - immich: tolerate enable-maintenance-mode crash, same as disable-maintenance-mode [@MickLesk](https://github.com/MickLesk) ([#16866](https://github.com/community-scripts/ProxmoxVE/pull/16866))
     - move the hardware-accelerated scripts onto new core [@MickLesk](https://github.com/MickLesk) ([#16864](https://github.com/community-scripts/ProxmoxVE/pull/16864))
     - ntopng: use ntop.org's documented apt repo per Debian codename, not always apt-stable [@MickLesk](https://github.com/MickLesk) ([#16862](https://github.com/community-scripts/ProxmoxVE/pull/16862))
@@ -552,7 +560,15 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ### 💾 Core
 
-  - Lift the settings summary and the mode fork into vm-core [@MickLesk](https://github.com/MickLesk) ([core#12](https://github.com/community-scripts/core/pull/12))
+  - Refactor VM script settings and fix load_functions errors [@MickLesk](https://github.com/MickLesk) ([core#13](https://github.com/community-scripts/core/pull/13))
+- Ask ProxmoxVE to refresh its changelog on merge [@MickLesk](https://github.com/MickLesk) ([core#11](https://github.com/community-scripts/core/pull/11))
+- Lift the settings summary and the mode fork into vm-core [@MickLesk](https://github.com/MickLesk) ([core#12](https://github.com/community-scripts/core/pull/12))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - filebrowser-quantum: strip removed disableIndexing key on update, restart service [@MickLesk](https://github.com/MickLesk) ([#16892](https://github.com/community-scripts/ProxmoxVE/pull/16892))
 
 ### 📚 Documentation
 

ct/aurral.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/lklynet/aurral
+
+APP="Aurral"
+var_tags="${var_tags:-music;lidarr;discovery}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/aurral ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "aurral" "lklynet/aurral"; then
+    msg_info "Stopping Service"
+    systemctl stop aurral
+    msg_ok "Stopped Service"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "aurral" "lklynet/aurral" "tarball"
+
+    msg_info "Updating Aurral"
+    cd /opt/aurral
+    export VITE_APP_VERSION="$(cat ~/.aurral)"
+    export VITE_GITHUB_REPO="lklynet/aurral"
+    export VITE_RELEASE_CHANNEL="stable"
+    $STD npm ci --workspace frontend --include-workspace-root=false
+    $STD npm run build --workspace frontend
+    $STD npm ci --workspace backend --omit=dev --include=optional --include-workspace-root=false
+    mkdir -p /opt/aurral_data
+    cat <<EOF >/opt/aurral/aurral.env
+NODE_ENV=production
+PORT=3001
+AURRAL_DATA_DIR=/opt/aurral_data
+APP_VERSION=$(cat ~/.aurral)
+EOF
+    msg_ok "Updated Aurral"
+
+    msg_info "Starting Service"
+    systemctl start aurral
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3001${CL}"

ct/bambuddy.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: Adrian-RDA
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
@@ -62,6 +64,11 @@ function update_script() {
 
     restore_backup
 
+    if ! grep -q -- '--loop asyncio' /etc/systemd/system/bambuddy.service; then
+      sed -i 's|^ExecStart=.*|ExecStart=/opt/bambuddy/.venv/bin/uvicorn backend.app.main:app --host 0.0.0.0 --port 8000 --loop asyncio|' /etc/systemd/system/bambuddy.service
+      systemctl daemon-reload
+    fi
+
     msg_info "Starting Service"
     systemctl start bambuddy
     msg_ok "Started Service"

ct/bookorbit.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
@@ -56,6 +58,10 @@ function update_script() {
     restore_backup
     APP_VER=$(cat ~/.bookorbit)
     sed -i "s/^APP_VERSION=.*/APP_VERSION=v$APP_VER/" /opt/bookorbit/.env
+    if ! grep -q '^TimeoutStartSec=' /etc/systemd/system/bookorbit.service; then
+      sed -i '/^\[Service\]/a TimeoutStartSec=infinity' /etc/systemd/system/bookorbit.service
+      systemctl daemon-reload
+    fi
     msg_ok "Rebuilt Application"
 
     msg_info "Updating Kobo Python Runtime"

ct/gatus.sh

@@ -45,6 +45,7 @@ update_deb_based() {
 
     mv /opt/gatus/config/config.yaml /opt
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "gatus" "TwiN/gatus" "tarball"
+    GO_VERSION="$(grep -m1 '^go ' /opt/gatus/go.mod | awk '{print $2}')" setup_go
 
     msg_info "Updating Gatus"
     cd /opt/gatus
@@ -66,27 +67,20 @@ update_alpine() {
     msg_error "No ${APP} Installation Found!"
     exit
   fi
-  RELEASE=$(curl -s https://api.github.com/repos/TwiN/gatus/releases/latest | grep "tag_name" | awk '{print substr($2, 3, length($2)-4) }')
-  if [ "${RELEASE}" != "$(cat /opt/gatus_version.txt)" ] || [ ! -f /opt/gatus_version.txt ]; then
-    msg_info "Updating ${APP} LXC"
+  if check_for_gh_release "gatus" "TwiN/gatus"; then
+    msg_info "Updating ${APP}"
     $STD apk -U upgrade
     $STD service gatus stop
     mv /opt/gatus/config/config.yaml /opt
-    rm -rf /opt/gatus/*
-    temp_file=$(mktemp)
-    curl -fsSL "https://github.com/TwiN/gatus/archive/refs/tags/v${RELEASE}.tar.gz" -o "$temp_file"
-    tar zxf "$temp_file" --strip-components=1 -C /opt/gatus
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "gatus" "TwiN/gatus" "tarball"
     cd /opt/gatus
+    $STD go get golang.org/x/net@v0.55.0
     $STD go mod tidy
     CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o gatus .
     setcap CAP_NET_RAW+ep gatus
     mv /opt/config.yaml config
-    rm -f "$temp_file"
-    echo "${RELEASE}" >/opt/gatus_version.txt
     $STD service gatus start
     msg_ok "Updated successfully!"
-  else
-    msg_ok "No update required. ${APP} is already at ${RELEASE}"
   fi
 }
 

ct/headers/aurral

@@ -0,0 +1,6 @@
+    ___                         __
+   /   | __  ________________ _/ /
+  / /| |/ / / / ___/ ___/ __ `/ / 
+ / ___ / /_/ / /  / /  / /_/ / /  
+/_/  |_\__,_/_/  /_/   \__,_/_/   
+                                  

install/aurral-install.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/lklynet/aurral
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  build-essential \
+  python3 \
+  ffmpeg \
+  fontconfig \
+  fonts-dejavu-core
+msg_ok "Installed Dependencies"
+
+NODE_VERSION="22" setup_nodejs
+
+fetch_and_deploy_gh_release "yt-dlp" "yt-dlp/yt-dlp" "singlefile" "latest" "/usr/local/bin" "yt-dlp"
+fetch_and_deploy_gh_release "aurral" "lklynet/aurral" "tarball"
+
+msg_info "Building Aurral"
+cd /opt/aurral
+export VITE_APP_VERSION="$(cat ~/.aurral)"
+export VITE_GITHUB_REPO="lklynet/aurral"
+export VITE_RELEASE_CHANNEL="stable"
+$STD npm ci --workspace frontend --include-workspace-root=false
+$STD npm run build --workspace frontend
+$STD npm ci --workspace backend --omit=dev --include=optional --include-workspace-root=false
+msg_ok "Built Aurral"
+
+msg_info "Creating Service"
+mkdir -p /opt/aurral_data
+cat <<EOF >/opt/aurral/aurral.env
+NODE_ENV=production
+PORT=3001
+AURRAL_DATA_DIR=/opt/aurral_data
+APP_VERSION=$(cat ~/.aurral)
+EOF
+cat <<EOF >/etc/systemd/system/aurral.service
+[Unit]
+Description=Aurral Service
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/aurral
+EnvironmentFile=/opt/aurral/aurral.env
+ExecStart=/usr/bin/node backend/server.js
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now aurral
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/bambuddy-install.sh

@@ -52,7 +52,7 @@ After=network.target
 [Service]
 Type=simple
 WorkingDirectory=/opt/bambuddy
-ExecStart=/opt/bambuddy/.venv/bin/uvicorn backend.app.main:app --host 0.0.0.0 --port 8000
+ExecStart=/opt/bambuddy/.venv/bin/uvicorn backend.app.main:app --host 0.0.0.0 --port 8000 --loop asyncio
 Restart=on-failure
 RestartSec=5
 

install/bookorbit-install.sh

@@ -81,6 +81,7 @@ Requires=postgresql.service
 [Service]
 Type=simple
 User=root
+TimeoutStartSec=infinity
 WorkingDirectory=/opt/bookorbit/server
 EnvironmentFile=/opt/bookorbit/.env
 ExecStartPre=/usr/bin/node /opt/bookorbit/server/dist/scripts/migrate.js

install/gatus-install.sh

@@ -20,8 +20,8 @@ setup_deb_based() {
     libcap2-bin
   msg_ok "Installed Dependencies"
 
-  setup_go
   fetch_and_deploy_gh_release "gatus" "TwiN/gatus" "tarball"
+  GO_VERSION="$(grep -m1 '^go ' /opt/gatus/go.mod | awk '{print $2}')" setup_go
 
   msg_info "Configuring gatus"
   cd /opt/gatus
@@ -59,19 +59,16 @@ setup_alpine() {
   $STD apk add --no-cache --repository=https://dl-cdn.alpinelinux.org/alpine/edge/community go
   msg_ok "Installed dependencies"
 
-  RELEASE=$(curl -s https://api.github.com/repos/TwiN/gatus/releases/latest | grep "tag_name" | awk '{print substr($2, 3, length($2)-4) }')
-  msg_info "Installing gatus v${RELEASE}"
-  temp_file=$(mktemp)
-  mkdir -p /opt/gatus
-  curl -fsSL "https://github.com/TwiN/gatus/archive/refs/tags/v${RELEASE}.tar.gz" -o "$temp_file"
-  tar zxf "$temp_file" --strip-components=1 -C /opt/gatus
+  fetch_and_deploy_gh_release "gatus" "TwiN/gatus" "tarball"
+
+  msg_info "Configuring gatus"
   cd /opt/gatus
+  $STD go get golang.org/x/net@v0.55.0
   $STD go mod tidy
   CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o gatus .
   setcap CAP_NET_RAW+ep gatus
   mv config.yaml config
-  echo "${RELEASE}" >/opt/gatus_version.txt
-  msg_ok "Installed gatus v${RELEASE}"
+  msg_ok "Configured gatus"
 
   msg_info "Enabling gatus Service"
   cat <<EOF >/etc/init.d/gatus
@@ -99,8 +96,6 @@ EOF
   msg_info "Starting gatus"
   $STD service gatus start
   msg_ok "Started gatus"
-
-  rm -f "$temp_file"
 }
 
 run_os_setup

tools/addon/filebrowser-quantum.sh

@@ -124,6 +124,14 @@ if [[ -f "$INSTALL_PATH" ]]; then
       if ! command -v curl &>/dev/null; then $STD $PKG_MANAGER curl; fi
       fetch_and_deploy_gh_release "filebrowser-quantum" "gtsteffaniak/filebrowser" "singlefile" "latest" "/usr/local/bin" "linux-$(arch_resolve)-filebrowser"
       mv -f /usr/local/bin/filebrowser-quantum "$INSTALL_PATH"
+      if [[ -f "$CONFIG_PATH" ]]; then
+        sed -i '/^\s*disableIndexing:/d' "$CONFIG_PATH"
+      fi
+      if [[ "$OS" == "Debian" ]]; then
+        systemctl restart filebrowser.service
+      else
+        rc-service filebrowser restart
+      fi
       msg_ok "Updated ${APP}"
     fi
     exit 0