Update CHANGELOG.md

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

CHANGELOG.md

@@ -545,10 +545,17 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ## 2026-09-18
 
+### 🆕 New Scripts
+
+  - Almalinux-VM ([#17349](https://github.com/community-scripts/ProxmoxVE/pull/17349))
+
 ### 🚀 Updated Scripts
 
   - #### 🐞 Bug Fixes
 
+    - crafty-controller: chown after restore_backup so restored data keeps ownership [@MickLesk](https://github.com/MickLesk) ([#17348](https://github.com/community-scripts/ProxmoxVE/pull/17348))
+    - databasus, domain-monitor, poznote: chown after restore_backup so restored data keeps its owner [@MickLesk](https://github.com/MickLesk) ([#17350](https://github.com/community-scripts/ProxmoxVE/pull/17350))
+    - alpine-vm: ask for the Cloud-Init credentials [@MickLesk](https://github.com/MickLesk) ([#17355](https://github.com/community-scripts/ProxmoxVE/pull/17355))
     - suggestarr: keep the data where the app actually reads it [@MickLesk](https://github.com/MickLesk) ([#17317](https://github.com/community-scripts/ProxmoxVE/pull/17317))
     - immichframe: set the admin password the new admin UI requires [@MickLesk](https://github.com/MickLesk) ([#17315](https://github.com/community-scripts/ProxmoxVE/pull/17315))
 
@@ -562,7 +569,9 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ### 💾 Core
 
-  - github api: retry a 200 that is not a usable release payload [@MickLesk](https://github.com/MickLesk) ([core#45](https://github.com/community-scripts/core/pull/45))
+  - Stop a modified conffile from aborting the whole update [@MickLesk](https://github.com/MickLesk) ([core#47](https://github.com/community-scripts/core/pull/47))
+- Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#46](https://github.com/community-scripts/core/pull/46))
+- github api: retry a 200 that is not a usable release payload [@MickLesk](https://github.com/MickLesk) ([core#45](https://github.com/community-scripts/core/pull/45))
 
 ## 2026-09-17
 

ct/crafty-controller.sh

@@ -46,8 +46,8 @@ function update_script() {
 
     CLEAN_INSTALL=1 fetch_and_deploy_gl_release "Crafty-Controller" "crafty-controller/crafty-4" "tarball" "latest" "/opt/crafty-controller/crafty/crafty-4"
 
-    chown -R crafty:crafty /opt/crafty-controller
     restore_backup
+    chown -R crafty:crafty /opt/crafty-controller
 
     msg_info "Updating TemurinJDK"
     setup_java

ct/databasus.sh

@@ -87,10 +87,10 @@ function update_script() {
     mkdir -p /opt/databasus/ui/build
     cp -r /opt/databasus/frontend/dist/* /opt/databasus/ui/build/
     cp -r /opt/databasus/backend/migrations /opt/databasus/
-    chown -R postgres:postgres /opt/databasus
     msg_ok "Updated Databasus"
 
     restore_backup
+    chown -R postgres:postgres /opt/databasus
 
     if ! grep -q "EnvironmentFile=/.env" /etc/systemd/system/databasus.service; then
       msg_info "Updating Service"

ct/domain-monitor.sh

@@ -53,10 +53,10 @@ function update_script() {
     msg_info "Updating Domain Monitor"
     cd /opt/domain-monitor
     $STD composer install
-    chown -R www-data:www-data /opt/domain-monitor
     msg_ok "Updated Domain Monitor"
 
     restore_backup
+    chown -R www-data:www-data /opt/domain-monitor
 
     msg_info "Restarting Services"
     systemctl start apache2

ct/poznote.sh

@@ -44,10 +44,10 @@ function update_script() {
 
     msg_info "Deploying New Version"
     cp -r /opt/poznote/src/. /var/www/html/
-    chown -R www-data:www-data /var/www/html
     msg_ok "Deployed New Version"
 
     restore_backup
+    chown -R www-data:www-data /var/www/html
 
     msg_info "Running Poznote Initialization"
     POZNOTE_INIT=/opt/poznote/docker/init.sh

install/plane-install.sh

@@ -43,61 +43,34 @@ $STD rabbitmqctl add_user plane "${RABBITMQ_PASS}"
 $STD rabbitmqctl set_permissions -p plane plane ".*" ".*" ".*"
 msg_ok "Configured RabbitMQ"
 
-msg_info "Installing Garage"
-ensure_dependencies jq
-GARAGE_RELEASE=$(curl -fsSL https://api.github.com/repos/deuxfleurs-org/garage/tags | jq -r '.[0].name')
-curl -fsSL "https://garagehq.deuxfleurs.fr/_releases/${GARAGE_RELEASE}/$(arch_resolve "x86_64" "aarch64")-unknown-linux-musl/garage" -o /usr/local/bin/garage
-chmod +x /usr/local/bin/garage
-mkdir -p /var/lib/garage/{data,meta,snapshots}
-S3_ACCESS_KEY="GK$(openssl rand -hex 16)"
-S3_SECRET_KEY=$(openssl rand -hex 32)
-GARAGE_RPC_SECRET=$(openssl rand -hex 32)
-cat <<EOF >/etc/garage.toml
-metadata_dir = "/var/lib/garage/meta"
-data_dir = "/var/lib/garage/data"
-db_engine = "sqlite"
-replication_factor = 1
-
-rpc_bind_addr = "127.0.0.1:3901"
-rpc_public_addr = "127.0.0.1:3901"
-rpc_secret = "${GARAGE_RPC_SECRET}"
-
-[s3_api]
-s3_region = "us-east-1"
-api_bind_addr = "127.0.0.1:3900"
+msg_info "Installing MinIO"
+curl -fsSL https://dl.min.io/server/minio/release/linux-$(arch_resolve)/minio -o /usr/local/bin/minio
+chmod +x /usr/local/bin/minio
+mkdir -p /opt/minio/data
+MINIO_ACCESS_KEY=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c16)
+MINIO_SECRET_KEY=$(openssl rand -base64 36 | tr -dc 'a-zA-Z0-9' | head -c32)
+cat <<EOF >/etc/default/minio
+MINIO_ROOT_USER="${MINIO_ACCESS_KEY}"
+MINIO_ROOT_PASSWORD="${MINIO_SECRET_KEY}"
+MINIO_VOLUMES="/opt/minio/data"
 EOF
-cat <<EOF >/etc/default/garage
-GARAGE_DEFAULT_ACCESS_KEY=${S3_ACCESS_KEY}
-GARAGE_DEFAULT_SECRET_KEY=${S3_SECRET_KEY}
-GARAGE_DEFAULT_BUCKET=uploads
-EOF
-cat <<EOF >/etc/systemd/system/garage.service
+cat <<EOF >/etc/systemd/system/minio.service
 [Unit]
-Description=Garage Object Storage
-After=network-online.target
-Wants=network-online.target
+Description=MinIO Object Storage
+After=network.target
 
 [Service]
 Type=simple
-EnvironmentFile=/etc/default/garage
-ExecStart=/usr/local/bin/garage -c /etc/garage.toml server --single-node --default-bucket
+EnvironmentFile=/etc/default/minio
+ExecStart=/usr/local/bin/minio server \$MINIO_VOLUMES --console-address ":9090"
 Restart=on-failure
 RestartSec=5
-LimitNOFILE=65536
 
 [Install]
 WantedBy=multi-user.target
 EOF
-systemctl enable -q --now garage
-for i in {1..30}; do
-    curl -s -o /dev/null "http://127.0.0.1:3900" && break
-    if [[ $i -eq 30 ]]; then
-        msg_error "Garage did not become ready"
-        exit 1
-    fi
-    sleep 1
-done
-msg_ok "Installed Garage"
+systemctl enable -q --now minio
+msg_ok "Installed MinIO"
 
 fetch_and_deploy_gh_release "plane" "makeplane/plane" "tarball"
 
@@ -156,9 +129,9 @@ RABBITMQ_VHOST=plane
 AMQP_URL=amqp://plane:${RABBITMQ_PASS}@localhost:5672/plane
 
 AWS_REGION=us-east-1
-AWS_ACCESS_KEY_ID=${S3_ACCESS_KEY}
-AWS_SECRET_ACCESS_KEY=${S3_SECRET_KEY}
-AWS_S3_ENDPOINT_URL=http://localhost:3900
+AWS_ACCESS_KEY_ID=${MINIO_ACCESS_KEY}
+AWS_SECRET_ACCESS_KEY=${MINIO_SECRET_KEY}
+AWS_S3_ENDPOINT_URL=http://localhost:9000
 AWS_S3_BUCKET_NAME=uploads
 FILE_SIZE_LIMIT=104857600
 
@@ -202,11 +175,17 @@ $STD /opt/plane-venv/bin/python manage.py configure_instance
 $STD /opt/plane-venv/bin/python manage.py register_instance "${MACHINE_SIG}"
 msg_ok "Ran Database Migrations"
 
-msg_info "Creating Services"
+msg_info "Creating Services and MinIO Bucket"
+curl -fsSL https://dl.min.io/client/mc/release/linux-$(arch_resolve)/mc -o /usr/local/bin/mcli
+chmod +x /usr/local/bin/mcli
+$STD /usr/local/bin/mcli alias set plane http://localhost:9000 "${MINIO_ACCESS_KEY}" "${MINIO_SECRET_KEY}"
+$STD /usr/local/bin/mcli mb plane/uploads --ignore-existing
+$STD /usr/local/bin/mcli anonymous set download plane/uploads
+
 cat <<EOF >/etc/systemd/system/plane-api.service
 [Unit]
 Description=Plane API
-After=network.target postgresql.service redis-server.service rabbitmq-server.service garage.service
+After=network.target postgresql.service redis-server.service rabbitmq-server.service minio.service
 
 [Service]
 Type=simple
@@ -295,12 +274,12 @@ systemctl enable -q --now plane-api plane-worker plane-beat plane-live plane-spa
 cat <<EOF >~/plane.creds
 RabbitMQ User: plane
 RabbitMQ Password: ${RABBITMQ_PASS}
-S3 Access Key: ${S3_ACCESS_KEY}
-S3 Secret Key: ${S3_SECRET_KEY}
+MinIO Access Key: ${MINIO_ACCESS_KEY}
+MinIO Secret Key: ${MINIO_SECRET_KEY}
 Secret Key: ${SECRET_KEY}
 Config: /opt/plane/apps/api/.env
 EOF
-msg_ok "Created Services"
+msg_ok "Created Services and MinIO Bucket"
 
 msg_info "Configuring Nginx"
 cat <<'EOF' >/etc/nginx/sites-available/plane.conf
@@ -316,8 +295,8 @@ upstream plane-space {
     server 127.0.0.1:3002;
 }
 
-upstream plane-garage {
-    server 127.0.0.1:3900;
+upstream plane-minio {
+    server 127.0.0.1:9000;
 }
 
 server {
@@ -357,14 +336,14 @@ server {
     }
 
     location = /uploads {
-        proxy_pass http://plane-garage;
+        proxy_pass http://plane-minio;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     }
 
     location /uploads/ {
-        proxy_pass http://plane-garage;
+        proxy_pass http://plane-minio;
         proxy_set_header Host $host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

vm/almalinux-vm.sh

@@ -0,0 +1,239 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Agent-Fennec
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+
+COMMUNITY_SCRIPTS_URL="${COMMUNITY_SCRIPTS_URL:-https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main}"
+source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/api/api.func")
+source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/pve/vm-core.func")
+source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/vm/cloud-init.func") || true
+load_functions
+
+APP="AlmaLinux"
+APP_TYPE="vm"
+NSAPP="almalinux-vm"
+var_os="almalinux"
+var_version="10"
+
+GEN_MAC=02:$(openssl rand -hex 5 | awk '{print toupper($0)}' | sed 's/\(..\)/\1:/g; s/.$//')
+RANDOM_UUID="$(cat /proc/sys/kernel/random/uuid)"
+METHOD=""
+THIN="discard=on,ssd=1,"
+
+set -e
+trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
+trap cleanup EXIT
+trap 'post_update_to_api "failed" "INTERRUPTED"' SIGINT
+trap 'post_update_to_api "failed" "TERMINATED"' SIGTERM
+
+function error_handler() {
+  local exit_code="$?"
+  local line_number="$1"
+  local command="$2"
+  local error_message="${RD}[ERROR]${CL} in line ${RD}$line_number${CL}: exit code ${RD}$exit_code${CL}: while executing command ${YW}$command${CL}"
+  post_update_to_api "failed" "${command}"
+  echo -e "\n$error_message\n"
+  cleanup_vmid
+}
+
+TEMP_DIR=$(mktemp -d)
+pushd "$TEMP_DIR" >/dev/null
+
+if [[ "${VM_UNATTENDED:-0}" == "1" ]]; then
+  var_version="${VM_OS_VERSION:-$var_version}"
+elif vm_dialog radiolist "ALMALINUX VERSION" "Choose the AlmaLinux release to install" --cancel-button Exit-Script 12 58 3 \
+  "10" "AlmaLinux 10 (Purple Lion)" ON \
+  "9" "AlmaLinux 9 (Seafoam Ocelot)" OFF \
+  "8" "AlmaLinux 8 (Sapphire Caracal)" OFF; then
+  var_version="$VM_DIALOG_RESULT"
+else
+  exit_script
+fi
+
+# glibc aborts with exit 127 when the CPU is below the release baseline, which
+# the kernel then reports as "Attempted to kill init". kvm64 is only v1, so 9
+# and 10 both need a model named here. The baselines are x86-only, so on
+# aarch64 the default model stands.
+case "$var_version" in
+10) ALMA_CPU="$(vm_arch_resolve " -cpu x86-64-v3" "")" ;;
+9) ALMA_CPU="$(vm_arch_resolve " -cpu x86-64-v2-AES" "")" ;;
+8) ALMA_CPU="" ;;
+*)
+  msg_error "Unsupported AlmaLinux version '${var_version}'"
+  exit 1
+  ;;
+esac
+APP="AlmaLinux ${var_version} VM"
+
+# The GenericCloud image sets no password and has no console login, so the only
+# question is which credentials.
+CLOUDINIT_REQUIRED=1
+vm_prompt_cloud_init "almalinux"
+
+function default_settings() {
+  vm_apply_machine_type "q35"
+  VMID=$(get_valid_nextid)
+  DISK_SIZE="10G"
+  DISK_CACHE=""
+  HN="almalinux"
+  CPU_TYPE="$ALMA_CPU"
+  CORE_COUNT="2"
+  RAM_SIZE="2048"
+  BRG="vmbr0"
+  MAC="$GEN_MAC"
+  VLAN=""
+  MTU=""
+  START_VM="yes"
+  METHOD="default"
+  echo -e "${CLOUD}${BOLD}${DGN}Cloud-Init: ${BGN}${USE_CLOUD_INIT}${CL}"
+  vm_echo_default_settings
+}
+
+function advanced_settings() {
+  METHOD="advanced"
+  vm_prompt_vmid "${VMID:-$(get_valid_nextid)}"
+  vm_prompt_machine_type "q35"
+  vm_prompt_disk_size "10G"
+  vm_prompt_disk_cache "none"
+  vm_prompt_hostname "almalinux"
+  vm_prompt_cpu_model "kvm64"
+  if [[ -z "${CPU_TYPE:-}" && -n "$ALMA_CPU" ]]; then
+    CPU_TYPE="$ALMA_CPU"
+    msg_warn "AlmaLinux ${var_version} will not boot on kvm64 - keeping ${CPU_TYPE# -cpu }"
+  fi
+  vm_prompt_cpu_cores "2"
+  vm_prompt_ram "2048"
+  vm_prompt_bridge "vmbr0"
+  vm_prompt_mac "$GEN_MAC"
+  vm_prompt_vlan
+  vm_prompt_mtu
+  vm_prompt_verbose "no"
+  vm_prompt_start_vm "yes"
+
+  if vm_confirm_advanced_settings "Ready to create a ${APP}?"; then
+    echo -e "${CREATING}${BOLD}${DGN}Creating a ${APP} using the above advanced settings${CL}"
+  else
+    header_info
+    echo -e "${ADVANCED}${BOLD}${RD}Using Advanced Settings${CL}"
+    advanced_settings
+  fi
+}
+
+
+vm_start_script "Use Default Settings?\n\nDefaults:\n• 2 CPU Cores\n• 2 GB RAM\n• 10 GB Disk\n• Cloud-Init enabled" 14 58
+post_to_api_vm
+
+vm_select_storage "$HN"
+
+# ==============================================================================
+# PREREQUISITES
+# ==============================================================================
+if ! command -v virt-customize &>/dev/null; then
+  msg_info "Installing libguestfs-tools"
+  $STD apt-get update
+  $STD apt-get install -y libguestfs-tools
+  msg_ok "Installed libguestfs-tools"
+fi
+
+msg_info "Retrieving the URL for the ${APP} Qcow2 Disk Image"
+ALMA_ARCH="$(vm_arch_resolve x86_64 aarch64)"
+URL="https://repo.almalinux.org/almalinux/${var_version}/cloud/${ALMA_ARCH}/images/AlmaLinux-${var_version}-GenericCloud-latest.${ALMA_ARCH}.qcow2"
+sleep 2
+msg_ok "${CL}${BL}${URL}${CL}"
+CACHE_FILE="$(vm_image_cache_path "$URL")"
+vm_fetch_image "$URL" "$CACHE_FILE" --cache --min-bytes $((100 * 1024 * 1024)) || exit 115
+FILE="$(basename "$CACHE_FILE")"
+
+# ==============================================================================
+# IMAGE CUSTOMIZATION
+# ==============================================================================
+WORK_FILE=$(mktemp --suffix=.qcow2)
+cp "$CACHE_FILE" "$WORK_FILE"
+popd >/dev/null
+rm -rf "$TEMP_DIR"
+# vm_prepare_cloud_image draws its own spinner, so this one has to start after
+# it -- otherwise the three calls below run with nothing on screen.
+vm_prepare_cloud_image "$WORK_FILE" "$HN" || true
+
+msg_info "Customizing ${FILE} image"
+virt-customize -q -a "$WORK_FILE" --run-command "systemctl disable systemd-firstboot.service 2>/dev/null; rm -f /etc/systemd/system/sysinit.target.wants/systemd-firstboot.service; ln -sf /dev/null /etc/systemd/system/systemd-firstboot.service" >/dev/null 2>&1 || true
+virt-customize -q -a "$WORK_FILE" --run-command "systemctl enable serial-getty@ttyS0.service" >/dev/null 2>&1 || true
+virt-customize -q -a "$WORK_FILE" --selinux-relabel >/dev/null 2>&1 || true
+msg_ok "Customized image"
+
+STORAGE_TYPE=$(pvesm status -storage "$STORAGE" | awk 'NR>1 {print $2}')
+case $STORAGE_TYPE in
+nfs | dir)
+  DISK_EXT=".qcow2"
+  DISK_REF="$VMID/"
+  DISK_IMPORT="-format qcow2"
+  THIN=""
+  ;;
+btrfs)
+  DISK_EXT=".raw"
+  DISK_REF="$VMID/"
+  DISK_IMPORT="-format raw"
+  FORMAT=",efitype=4m"
+  THIN=""
+  ;;
+*)
+  DISK_EXT=""
+  DISK_REF=""
+  DISK_IMPORT="-format raw"
+  ;;
+esac
+for i in {0,1,2}; do
+  disk="DISK$i"
+  eval DISK"${i}"=vm-"${VMID}"-disk-"${i}"${DISK_EXT:-}
+  eval DISK"${i}"_REF="${STORAGE}":"${DISK_REF:-}""${!disk}"
+done
+
+if [[ "$STORAGE_TYPE" != "nfs" && "$STORAGE_TYPE" != "dir" ]]; then
+  msg_info "Converting image to raw format"
+  RAW_FILE=$(mktemp --suffix=.raw)
+  qemu-img convert -f qcow2 -O raw "$WORK_FILE" "$RAW_FILE"
+  rm -f "$WORK_FILE"
+  WORK_FILE="$RAW_FILE"
+  msg_ok "Converted image to raw format"
+fi
+
+msg_info "Creating an ${APP}"
+qm create "$VMID" -agent 1${MACHINE} -tablet 0 -localtime 1 -bios ovmf${CPU_TYPE} -cores "$CORE_COUNT" -memory "$RAM_SIZE" \
+  -name "$HN" -tags community-script -net0 virtio,bridge="$BRG",macaddr="$MAC""$VLAN""$MTU" -onboot 1 -ostype l26 -scsihw virtio-scsi-pci
+vm_alloc_efi_disk "$DISK0"
+pvesm alloc "$STORAGE" "$VMID" "$DISK2" 4M 1>&/dev/null
+qm importdisk "$VMID" "${WORK_FILE}" "$STORAGE" ${DISK_IMPORT:-} 1>&/dev/null
+qm set "$VMID" \
+  -efidisk0 "${DISK0_REF}"${FORMAT} \
+  -scsi0 "${DISK1_REF}",${DISK_CACHE}${THIN}size="${DISK_SIZE}" \
+  -tpmstate0 "${DISK2_REF}",version=v2.0 \
+  -boot order=scsi0 \
+  -serial0 socket >/dev/null
+
+rm -f "$WORK_FILE"
+set_description
+msg_ok "Created an ${APP} ${CL}${BL}(${HN})"
+
+vm_resize_disk
+
+vm_provision "$VMID" || true
+
+if [ "$START_VM" == "yes" ]; then
+  msg_info "Starting ${APP}"
+  $STD qm start "$VMID"
+  msg_ok "Started ${APP}"
+fi
+
+post_update_to_api "done" "none"
+
+echo -e "\n${INFO}${BOLD}${GN}${APP} Configuration Summary:${CL}"
+echo -e "${TAB}${DGN}VM ID: ${BGN}${VMID}${CL}"
+echo -e "${TAB}${DGN}Hostname: ${BGN}${HN}${CL}"
+echo -e "${TAB}${DGN}Release: ${BGN}AlmaLinux ${var_version} (${ALMA_ARCH})${CL}"
+if [ -n "${CLOUDINIT_CRED_FILE:-}" ]; then
+  echo -e "${TAB}${DGN}Cloud-Init credentials: ${BGN}${CLOUDINIT_CRED_FILE}${CL}"
+fi
+
+msg_ok "Completed successfully!\n"
+

vm/alpine-vm.sh

@@ -34,6 +34,10 @@ pushd "$TEMP_DIR" >/dev/null
 
 vm_preflight
 
+# The cloud image sets no password, so the only question is which credentials.
+CLOUDINIT_REQUIRED=1
+vm_prompt_cloud_init "alpine"
+
 function default_settings() {
   VMID=$(get_valid_nextid)
   vm_apply_machine_type "q35"
@@ -49,7 +53,7 @@ function default_settings() {
   MTU=""
   START_VM="yes"
   METHOD="default"
-  USE_CLOUD_INIT="yes"
+  echo -e "${CLOUD}${BOLD}${DGN}Cloud-Init: ${BGN}${USE_CLOUD_INIT}${CL}"
   vm_echo_default_settings
 }
 
@@ -67,7 +71,6 @@ function advanced_settings() {
   vm_prompt_mac "$GEN_MAC"
   vm_prompt_vlan
   vm_prompt_mtu
-  vm_prompt_cloud_init "alpine"
   vm_prompt_verbose "no"
   vm_prompt_start_vm "yes"