Update CHANGELOG.md

fix(shlink): preserve servers.json across web-client updates (#17023 )
CLEAN_INSTALL wipes /opt/shlink-web-client on every `update`, deleting the user's servers.json (and its API key) with no backup, unlike the main /opt/shlink app which already backs up/restores .env and data around its CLEAN_INSTALL. This makes the Web Client lose its configured server(s) on every update. Reuse the existing create_backup/restore_backup helpers around the web-client's CLEAN_INSTALL, mirroring the pattern already used for /opt/shlink.
2026-09-04 22:45:45 +00:00 · 2026-09-04 20:55:29 +00:00 · 2026-09-04 22:55:11 +02:00 · 2026-09-04 15:53:00 +00:00 · 2026-09-04 17:52:31 +02:00 · 2026-09-04 12:39:50 +00:00
48 changed files with 437 additions and 53 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -530,6 +530,33 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 </details>

+## 2026-09-04
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(shlink): preserve servers.json across web-client updates [@Corgei](https://github.com/Corgei) ([#17023](https://github.com/community-scripts/ProxmoxVE/pull/17023))
+    - fix-update-authentik-2026.8.1 [@thieneret](https://github.com/thieneret) ([#16999](https://github.com/community-scripts/ProxmoxVE/pull/16999))
+    - Fix npm v12 allow-git/allow-remote restrictions across affected scripts [@MickLesk](https://github.com/MickLesk) ([#17014](https://github.com/community-scripts/ProxmoxVE/pull/17014))
+    - Fix/poznote - 1st party Docker parity [@lucas-at-3x-eye](https://github.com/lucas-at-3x-eye) ([#17011](https://github.com/community-scripts/ProxmoxVE/pull/17011))
+
+### 💾 Core
+
+  - setup_go: resolve bare major.minor versions to the latest patch release [@MickLesk](https://github.com/MickLesk) ([core#24](https://github.com/community-scripts/core/pull/24))
+
+## 2026-09-03
+
+### 🚀 Updated Scripts
+
+  - Immich: bump libheif and libraw [@vhsdream](https://github.com/vhsdream) ([#16996](https://github.com/community-scripts/ProxmoxVE/pull/16996))
+
+  - #### 🐞 Bug Fixes
+
+    - romm: allow git-based npm dependency for rom-patcher under npm v12 [@MickLesk](https://github.com/MickLesk) ([#16990](https://github.com/community-scripts/ProxmoxVE/pull/16990))
+    - Pin Go to the version each project declares in go.mod [@MickLesk](https://github.com/MickLesk) ([#16976](https://github.com/community-scripts/ProxmoxVE/pull/16976))
+    - Authentik update 2026.8.1 [@thieneret](https://github.com/thieneret) ([#16980](https://github.com/community-scripts/ProxmoxVE/pull/16980))
+
 ## 2026-09-02

 ### 🆕 New Scripts
@@ -557,7 +584,9 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 ### 💾 Core

-  - setup_nodejs: restore the npm allowScripts bypass lost in the migration [@MickLesk](https://github.com/MickLesk) ([core#18](https://github.com/community-scripts/core/pull/18))
+  - setup_meilisearch: generate a 32-byte master key [@MickLesk](https://github.com/MickLesk) ([core#20](https://github.com/community-scripts/core/pull/20))
+- setup_meilisearch: generate a 32-byte master key [@MickLesk](https://github.com/MickLesk) ([core#19](https://github.com/community-scripts/core/pull/19))
+- setup_nodejs: restore the npm allowScripts bypass lost in the migration [@MickLesk](https://github.com/MickLesk) ([core#18](https://github.com/community-scripts/core/pull/18))

 ## 2026-09-01

--- a/ct/authentik.sh
+++ b/ct/authentik.sh
@@ -44,13 +44,12 @@ function update_script() {
  msg_ok "Update dependencies"

  NODE_VERSION="26" NODE_MODULE=pnpm@11 setup_nodejs
-  setup_go
  $STD uv cache clean
  UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.7" setup_uv
  RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
  setup_yq

-  AUTHENTIK_VERSION="version/2026.8.0"
+  AUTHENTIK_VERSION="version/2026.8.1"
  # Source: https://github.com/goauthentik/fips/blob/main/Makefile#L26
  XMLSEC_VERSION="1.3.12"

@@ -85,7 +84,18 @@ function update_script() {
    fi
    msg_ok "Stopped Services"

+    if [[ ! -d /opt/authentik-data/blueprints ]]; then
+      msg_info "Moving blueprints to presistent directory"
+      cp -r /opt/authentik/blueprints /opt/authentik-data/
+      rm -r /opt/authentik/blueprints
+      chown -Rf authentik:authentik /opt/authentik-data
+      yq -i ".blueprints_dir = \"/opt/authentik-data/blueprints\"" /etc/authentik/config.yml
+      msg_ok "blueprints moved to presistent directory"
+      msg_warn "The blueprints provided by authentik are always overwritten when updated! Only manually created custom blueprints remain unchanged between updates."
+    fi
+
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
+    GO_VERSION="$(grep -m1 '^go ' /opt/authentik/go.mod | awk '{print $2}')" setup_go

    msg_info "Configuring rust"
    cd /opt/authentik
@@ -143,21 +153,39 @@ function update_script() {
    chown -R authentik:authentik /opt/authentik
    msg_ok "Updated python server"

-	  msg_info "Updating Worker and Server config"
-    cat <<EOF >>/etc/default/authentik-server
+    cp -r /opt/authentik/blueprints /opt/authentik-data/
+    rm -r /opt/authentik/blueprints
+    chown -Rf authentik:authentik /opt/authentik-data
+    
+    if [[ $MAJOR == 2026 && $MINOR -lt 8 ]]; then
+	    msg_info "Updating Worker and Server config (from $MAJOR.$MINOR)"
+      cat <<EOF >>/etc/default/authentik-server
 RUST_BACKTRACE=full
 EOF
-    cat <<EOF >>/etc/default/authentik-worker
+      cat <<EOF >>/etc/default/authentik-worker
 RUST_BACKTRACE=full
 EOF
-    msg_ok "Updated Worker and Server config!"
+      msg_ok "Updated Worker and Server config (from $MAJOR.$MINOR)"
+
+      msg_info "Updating services (from $MAJOR.$MINOR)"
+	    sed -i "s|ExecStart=/opt/authentik/authentik-server|ExecStart=/opt/authentik/bin/authentik server|g" /etc/systemd/system/authentik-server.service
+	    sed -i "s|ExecStart=/opt/authentik/authentik-worker worker|ExecStart=/opt/authentik/bin/authentik worker|g" /etc/systemd/system/authentik-worker.service
+	    sed -i "s|ExecStart=/opt/authentik/ldap|ExecStart=/opt/authentik/bin/ldap|g" /etc/systemd/system/authentik-ldap.service
+	    sed -i "s|ExecStart=/opt/authentik/radius|ExecStart=/opt/authentik/bin/radius|g" /etc/systemd/system/authentik-radius.service
+	    sed -i "s|ExecStart=/opt/authentik/rac|ExecStart=/opt/authentik/bin/rac|g" /etc/systemd/system/authentik-rac.service
+      systemctl daemon-reload
+      msg_ok "Updated services (from $MAJOR.$MINOR)"
+    fi
+
+    msg_info "Updating Worker and Server config"
+    sed -i "s|/dev/shm$|/dev/shm/authentik-server|g" /etc/default/authentik-server
+	  sed -i "s|/dev/shm$|/dev/shm/authentik-worker|g" /etc/default/authentik-worker
+    msg_ok "Updated Worker and Server config"

    msg_info "Updating services"
-	  sed -i "s|ExecStart=/opt/authentik/authentik-server|ExecStart=/opt/authentik/bin/authentik server|g" /etc/systemd/system/authentik-server.service
-	  sed -i "s|ExecStart=/opt/authentik/authentik-worker worker|ExecStart=/opt/authentik/bin/authentik worker|g" /etc/systemd/system/authentik-worker.service
-	  sed -i "s|ExecStart=/opt/authentik/ldap|ExecStart=/opt/authentik/bin/ldap|g" /etc/systemd/system/authentik-ldap.service
-	  sed -i "s|ExecStart=/opt/authentik/radius|ExecStart=/opt/authentik/bin/radius|g" /etc/systemd/system/authentik-radius.service
-	  sed -i "s|ExecStart=/opt/authentik/rac|ExecStart=/opt/authentik/bin/rac|g" /etc/systemd/system/authentik-rac.service
+    sed -i 's/authentik Go Server (API Gateway)/authentik Server/g' /etc/systemd/system/authentik-server.service
+	  sed -i '/ExecStart=/i ExecStartPre=/usr/bin/mkdir -p "${TMPDIR}"' /etc/systemd/system/authentik-server.service
+    sed -i '/ExecStart=/i ExecStartPre=/usr/bin/mkdir -p "${TMPDIR}"' /etc/systemd/system/authentik-worker.service
    systemctl daemon-reload
    msg_ok "Updated services"

@@ -198,8 +226,9 @@ done
 $STD pct exec "$CTID" -- bash -c "mkdir -p /opt/authentik-data/{certs,media,geoip,templates}; \
  cp /opt/authentik/tests/GeoLite2-ASN-Test.mmdb /opt/authentik-data/geoip/GeoLite2-ASN.mmdb; \
  cp /opt/authentik/tests/GeoLite2-City-Test.mmdb /opt/authentik-data/geoip/GeoLite2-City.mmdb; \
-  chown authentik:authentik /opt/authentik-data; \
-  chown -R authentik:authentik /opt/authentik-data/{certs,media,geoip,templates}"
+  cp -r /opt/authentik/blueprints /opt/authentik-data/; \
+  rm -r /opt/authentik/blueprints; \
+  chown -Rf authentik:authentik /opt/authentik-data"
 msg_ok "Attached data storage volume"

 msg_info "Starting Services"
--- a/ct/baserow.sh
+++ b/ct/baserow.sh
@@ -48,7 +48,7 @@ function update_script() {

    msg_info "Rebuilding Frontend"
    cd /opt/baserow/web-frontend
-    $STD npm install
+    $STD npm install --allow-remote=all
    $STD npm run build
    msg_ok "Rebuilt Frontend"

--- a/ct/bentopdf.sh
+++ b/ct/bentopdf.sh
@@ -44,7 +44,7 @@ function update_script() {

    msg_info "Configuring BentoPDF"
    cd /opt/bentopdf
-    $STD npm ci --no-audit --no-fund
+    $STD npm ci --no-audit --no-fund --allow-remote=all
    export NODE_OPTIONS="--max-old-space-size=3072"
    export SIMPLE_MODE=true
    export VITE_USE_CDN=true
--- a/ct/bitmagnet.sh
+++ b/ct/bitmagnet.sh
@@ -71,6 +71,7 @@ update_deb_based() {
    msg_ok "Data backed up"

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "bitmagnet" "bitmagnet-io/bitmagnet" "tarball"
+    GO_VERSION="$(grep -m1 '^go ' /opt/bitmagnet/go.mod | awk '{print $2}')" setup_go
    restore_backup

    msg_info "Configuring Bitmagnet"
--- a/ct/cloudflare-ddns.sh
+++ b/ct/cloudflare-ddns.sh
@@ -37,8 +37,8 @@ function update_script() {
    systemctl stop cloudflare-ddns
    msg_ok "Stopped Service"

-    setup_go
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "cloudflare-ddns" "favonia/cloudflare-ddns" "tarball"
+    GO_VERSION="$(grep -m1 '^go ' /opt/cloudflare-ddns/go.mod | awk '{print $2}')" setup_go

    msg_info "Updating ${APP}"
    cd /opt/cloudflare-ddns
--- a/ct/cryptpad.sh
+++ b/ct/cryptpad.sh
@@ -51,7 +51,7 @@ function update_script() {

    msg_info "Updating CryptPad"
    cd /opt/cryptpad
-    $STD npm ci
+    $STD npm ci --allow-git=all
    $STD npm run install:components
    if [ -f "/opt/cryptpad/install-onlyoffice.sh" ]; then
      $STD bash /opt/cryptpad/install-onlyoffice.sh --accept-license
--- a/ct/databasus.sh
+++ b/ct/databasus.sh
@@ -70,6 +70,7 @@ function update_script() {
    msg_ok "Ensured Database Clients"

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "databasus" "databasus/databasus" "tarball" "latest" "/opt/databasus"
+    GO_VERSION="$(grep -m1 '^go ' /opt/databasus/backend/go.mod | awk '{print $2}')" setup_go

    msg_info "Updating Databasus"
    export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
--- a/ct/firecrawl.sh
+++ b/ct/firecrawl.sh
@@ -42,6 +42,7 @@ function update_script() {
    create_backup /opt/firecrawl/.env

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "firecrawl" "firecrawl/firecrawl" "tarball" "latest" "/opt/firecrawl"
+    GO_VERSION="$(grep -m1 '^go ' /opt/firecrawl/apps/api/sharedLibs/go-html-to-md/go.mod | awk '{print $2}')" setup_go

    restore_backup

--- a/ct/gluetun.sh
+++ b/ct/gluetun.sh
@@ -39,6 +39,7 @@ function update_script() {
    msg_ok "Stopped Service"

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "gluetun" "qdm12/gluetun" "tarball"
+    GO_VERSION="$(grep -m1 '^go ' /opt/gluetun/go.mod | awk '{print $2}')" setup_go

    msg_info "Building Gluetun"
    cd /opt/gluetun
--- a/ct/immich.sh
+++ b/ct/immich.sh
@@ -477,7 +477,7 @@ function compile_jpegli() {
 function compile_libheif() {
  SOURCE=${SOURCE_DIR}/libheif
  ensure_dependencies libaom-dev
-  LIBHEIF_REVISION="62f1b8c76ed4d8305071fdacbe74ef9717bacac5"
+  LIBHEIF_REVISION="ac1cb05c39008f01525c991ff8b88f84ddf70fd2"
  # : "${LIBHEIF_REVISION:=$(jq -cr '.revision' "$BASE_DIR"/server/sources/libheif.json)}"
  if [[ "${update:-}" ]] || [[ "$LIBHEIF_REVISION" != "$(grep 'libheif' ~/.immich_library_revisions | awk '{print $2}')" ]]; then
    msg_info "Recompiling libheif"
@@ -509,7 +509,7 @@ function compile_libheif() {

 function compile_libraw() {
  SOURCE=${SOURCE_DIR}/libraw
-  LIBRAW_REVISION="b860248a89d9082b8e0a1e202e516f46af9adb29"
+  LIBRAW_REVISION="e419de08001de28ae6988ecb22df47e52b9c5eaa"
  # : "${LIBRAW_REVISION:=$(jq -cr '.revision' "$BASE_DIR"/server/sources/libraw.json)}"
  if [[ "$LIBRAW_REVISION" != "$(grep 'libraw' ~/.immich_library_revisions | awk '{print $2}')" ]]; then
    msg_info "Recompiling libraw"
--- a/ct/koffan.sh
+++ b/ct/koffan.sh
@@ -40,6 +40,7 @@ function update_script() {

    create_backup /opt/koffan/data
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "koffan" "PanSalut/Koffan" "tarball"
+    GO_VERSION="$(grep -m1 '^go ' /opt/koffan/go.mod | awk '{print $2}')" setup_go
    restore_backup

    msg_info "Rebuilding Koffan"
--- a/ct/librechat.sh
+++ b/ct/librechat.sh
@@ -45,7 +45,7 @@ function update_script() {

    msg_info "Installing Dependencies"
    cd /opt/librechat
-    $STD npm ci
+    $STD npm ci --allow-remote=all
    msg_ok "Installed Dependencies"

    msg_info "Building Frontend"
--- a/ct/localagi.sh
+++ b/ct/localagi.sh
@@ -40,6 +40,7 @@ function update_script() {

    create_backup /opt/localagi/.env
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "localagi" "mudler/LocalAGI" "tarball" "latest" "/opt/localagi"
+    GO_VERSION="$(grep -m1 '^go ' /opt/localagi/go.mod | awk '{print $2}')" setup_go
    restore_backup

    msg_info "Building LocalAGI"
--- a/ct/networkoptimizer.sh
+++ b/ct/networkoptimizer.sh
@@ -39,6 +39,7 @@ function update_script() {

    create_backup /opt/networkoptimizer/networkoptimizer.env
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "networkoptimizer" "Ozark-Connect/NetworkOptimizer" "tarball"
+    GO_VERSION="$(grep -m1 '^go ' /opt/networkoptimizer/src/uwnspeedtest/go.mod | awk '{print $2}')" setup_go
    restore_backup

    msg_info "Rebuilding NetworkOptimizer"
--- a/ct/pangolin.sh
+++ b/ct/pangolin.sh
@@ -63,7 +63,7 @@ function update_script() {

    msg_info "Updating Pangolin"
    cd /opt/pangolin
-    $STD npm ci
+    $STD npm ci --allow-remote=all
    $STD npm run set:pg
    $STD npm run set:oss
    rm -rf server/private
--- a/ct/paperless-gpt.sh
+++ b/ct/paperless-gpt.sh
@@ -41,6 +41,7 @@ function update_script() {
    fi

    fetch_and_deploy_gh_release "paperless-gpt" "icereed/paperless-gpt" "tarball"
+    GO_VERSION="$(grep -m1 '^go ' /opt/paperless-gpt/go.mod | awk '{print $2}')" setup_go

    msg_info "Updating Paperless-GPT"
    cd /opt/paperless-gpt/web-app
--- a/ct/poznote.sh
+++ b/ct/poznote.sh
@@ -35,6 +35,7 @@ function update_script() {
  if check_for_gh_release "poznote" "timothepoznanski/poznote"; then
    msg_info "Stopping Service"
    systemctl stop nginx
+    systemctl stop poznote-reminder-worker poznote-s3-backup-worker 2>/dev/null || true
    msg_ok "Stopped Service"

    create_backup /var/www/html/data
@@ -48,8 +49,178 @@ function update_script() {

    restore_backup

+    msg_info "Running Poznote Initialization"
+    chmod +x /opt/poznote/init.sh
+    $STD /opt/poznote/init.sh
+    msg_ok "Initialized Poznote Data Directory"
+
+    msg_info "Updating Nginx Configuration"
+    [[ -f /etc/nginx/sites-available/poznote ]] && cp /etc/nginx/sites-available/poznote /etc/nginx/sites-available/poznote.bak
+    PHP_SOCK=$(get_php_fpm_socket)
+    cat <<EOF >/etc/nginx/sites-available/poznote
+# The Excalidraw editor must keep its window.opener relationship with
+# libraries.excalidraw.com so "Add to Excalidraw" can hand the chosen library
+# back to the already-open editor tab; COOP same-origin would sever it.
+map \$uri \$poznote_coop {
+    default                  "same-origin";
+    /excalidraw_editor.php   "unsafe-none";
+}
+
+server {
+    listen 8040;
+    root /var/www/html;
+    index index.php index.html;
+
+    gzip on;
+    gzip_comp_level 5;
+    gzip_min_length 1024;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_types text/css application/javascript text/javascript application/json
+               image/svg+xml application/manifest+json font/ttf font/otf;
+
+    location ~* \.webmanifest$ {
+        default_type application/manifest+json;
+        try_files \$uri =404;
+    }
+
+    client_max_body_size 800M;
+
+    location /api/v1 {
+        try_files \$uri \$uri/ /api/v1/index.php?\$query_string;
+    }
+
+    location = /api/health {
+        rewrite ^ /api_health.php last;
+    }
+
+    location = /api/info {
+        rewrite ^ /api_health.php last;
+    }
+
+    location / {
+        try_files \$uri \$uri/ @poznote_public;
+    }
+
+    location @poznote_public {
+        rewrite ^/folder/([^/]+)/?$ /public_folder.php?token=\$1 last;
+        rewrite ^/workspace/([^/]+)/?$ /public_note.php?token=\$1 last;
+        rewrite ^/([^/]+)/?$ /public_slug.php?slug=\$1 last;
+    }
+
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Cross-Origin-Opener-Policy \$poznote_coop always;
+    add_header Cross-Origin-Resource-Policy "same-origin" always;
+    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;
+
+    location ~* ^/data/.*\.(php[0-9]?|phtml|phar|pht)$ {
+        deny all;
+    }
+
+    location ~ \.php$ {
+        include fastcgi_params;
+        fastcgi_pass unix:${PHP_SOCK};
+        fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
+        fastcgi_param DOCUMENT_ROOT \$document_root;
+        fastcgi_param PATH_INFO \$fastcgi_path_info;
+
+        fastcgi_param HTTP_X_FORWARDED_FOR \$http_x_forwarded_for;
+        fastcgi_param HTTP_X_FORWARDED_PROTO \$http_x_forwarded_proto;
+        fastcgi_param HTTP_X_FORWARDED_HOST \$http_x_forwarded_host;
+        fastcgi_param HTTP_X_FORWARDED_PORT \$http_x_forwarded_port;
+        fastcgi_param HTTP_X_REAL_IP \$http_x_real_ip;
+        fastcgi_param HTTPS \$https if_not_empty;
+
+        # fastcgi_read_timeout 600;
+        # fastcgi_send_timeout 600;
+        # Left at nginx's 60s default, not Docker's 600s:
+        # a stalled git-sync request can hold the PHP session lock, otherwise
+    }
+
+    location ~ /\. {
+        deny all;
+    }
+
+    location ~ ^/data/users/[0-9]+/backgrounds/ {
+        try_files \$uri =404;
+    }
+
+    location ~ ^/data/css/[A-Za-z0-9._-]+\.css$ {
+        try_files \$uri =404;
+    }
+
+    location ~ ^/(data|config)/ {
+        deny all;
+    }
+
+    location ~* ^/pwa/poznote(-[0-9]+)?\.png$ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Cross-Origin-Resource-Policy "cross-origin" always;
+        try_files \$uri =404;
+    }
+
+    location ~* \.(?:js|css|png|jpg|jpeg|gif|svg|ico|woff2?|ttf|otf|eot|webp|webmanifest)$ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Cross-Origin-Resource-Policy "same-origin" always;
+        try_files \$uri =404;
+    }
+}
+EOF
+    msg_ok "Updated Nginx Configuration"
+
+    if [[ ! -f /etc/systemd/system/poznote-reminder-worker.service ]]; then
+      msg_info "Creating Reminder Worker Service"
+      cat <<EOF >/etc/systemd/system/poznote-reminder-worker.service
+[Unit]
+Description=Poznote Reminder Email Worker
+After=network.target
+
+[Service]
+Type=simple
+User=www-data
+Group=www-data
+Restart=always
+ExecStart=/usr/bin/php /var/www/html/workers/reminder-email-worker.php
+WorkingDirectory=/var/www/html
+
+[Install]
+WantedBy=multi-user.target
+EOF
+      systemctl daemon-reload
+      msg_ok "Created Reminder Worker Service"
+    fi
+
+    if [[ ! -f /etc/systemd/system/poznote-s3-backup-worker.service ]]; then
+      msg_info "Creating S3 Backup Worker Service"
+      cat <<EOF >/etc/systemd/system/poznote-s3-backup-worker.service
+[Unit]
+Description=Poznote S3 Backup Worker
+After=network.target
+
+[Service]
+Type=simple
+User=www-data
+Group=www-data
+Restart=always
+ExecStart=/usr/bin/php /var/www/html/workers/s3-backup-worker.php
+WorkingDirectory=/var/www/html
+
+[Install]
+WantedBy=multi-user.target
+EOF
+      systemctl daemon-reload
+      msg_ok "Created S3 Backup Worker Service"
+    fi
+
    msg_info "Starting Service"
    systemctl start nginx
+    systemctl enable -q --now poznote-reminder-worker poznote-s3-backup-worker
    msg_ok "Started Service"
    msg_ok "Updated successfully!"
  fi
--- a/ct/romm.sh
+++ b/ct/romm.sh
@@ -65,7 +65,7 @@ function update_script() {
    $STD uv run alembic upgrade head
    if [[ -f /opt/romm/backend/utils/rom_patcher/package.json ]]; then
      cd /opt/romm/backend/utils/rom_patcher
-      $STD npm install --ignore-scripts --no-audit --no-fund
+      $STD npm install --ignore-scripts --no-audit --no-fund --allow-git=all
      if [[ -d node_modules/rom-patcher/rom-patcher-js ]]; then
        rm -rf rom-patcher-js
        cp -r node_modules/rom-patcher/rom-patcher-js ./rom-patcher-js
--- a/ct/shlink.sh
+++ b/ct/shlink.sh
@@ -61,7 +61,12 @@ function update_script() {

  if [[ -d /opt/shlink-web-client ]]; then
    if check_for_gh_release "shlink-web-client" "shlinkio/shlink-web-client"; then
+      create_backup /opt/shlink-web-client/servers.json
+
      CLEAN_INSTALL=1 fetch_and_deploy_gh_release "shlink-web-client" "shlinkio/shlink-web-client" "prebuild" "latest" "/opt/shlink-web-client" "shlink-web-client_*_dist.zip"
+
+      restore_backup
+
      msg_ok "Updated Web Client"
    fi
  fi
--- a/ct/tor-snowflake.sh
+++ b/ct/tor-snowflake.sh
@@ -44,6 +44,7 @@ function update_script() {
    msg_ok "Stopped Service"

    CLEAN_INSTALL=1 GITLAB_URL="https://gitlab.torproject.org" fetch_and_deploy_gl_release "tor-snowflake" "tpo/anti-censorship/pluggable-transports/snowflake" "tarball"
+    GO_VERSION="$(grep -m1 '^go ' /opt/tor-snowflake/proxy/go.mod | awk '{print $2}')" setup_go

    msg_info "Building Snowflake"
    cd /opt/tor-snowflake/proxy
--- a/ct/wanderer.sh
+++ b/ct/wanderer.sh
@@ -158,6 +158,8 @@ EOF
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "wanderer" "open-wanderer/wanderer" "tarball" "latest"
    restore_backup

+    GO_VERSION="$(grep -m1 '^go ' /opt/wanderer/db/go.mod | awk '{print $2}')" setup_go
+
    msg_info "Updating wanderer"
    cd /opt/wanderer/db
    $STD go mod tidy
--- a/ct/watcharr.sh
+++ b/ct/watcharr.sh
@@ -40,6 +40,7 @@ function update_script() {

    create_backup /opt/watcharr/server/data
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "watcharr" "sbondCo/Watcharr" "tarball"
+    GO_VERSION="$(grep -m1 '^go ' /opt/watcharr/server/go.mod | awk '{print $2}')" setup_go
    restore_backup

    msg_info "Updating Watcharr"
--- a/ct/yopass.sh
+++ b/ct/yopass.sh
@@ -38,6 +38,7 @@ function update_script() {
    msg_ok "Stopped Service"

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "yopass" "jhaals/yopass" "tarball"
+    GO_VERSION="$(grep -m1 '^go ' /opt/yopass/go.mod | awk '{print $2}')" setup_go

    msg_info "Building Yopass"
    cd /opt/yopass
--- a/install/authentik-install.sh
+++ b/install/authentik-install.sh
@@ -52,16 +52,16 @@ msg_ok "Installed Dependencies"

 NODE_VERSION="26" NODE_MODULE=pnpm@11 setup_nodejs
 setup_yq
-setup_go
 RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
 UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.7" setup_uv
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db

 XMLSEC_VERSION="1.3.12"
-AUTHENTIK_VERSION="version/2026.8.0"
+AUTHENTIK_VERSION="version/2026.8.1"
 fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec"
 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
+GO_VERSION="$(grep -m1 '^go ' /opt/authentik/go.mod | awk '{print $2}')" setup_go
 fetch_and_deploy_gh_release "geoipupdate" "maxmind/geoipupdate" "binary"

 msg_info "Setting up xmlsec"
@@ -146,7 +146,7 @@ yq -i ".secret_key = \"$(openssl rand -base64 128 | tr -dc 'a-zA-Z0-9' | head -c
 yq -i ".postgresql.password = \"${PG_DB_PASS}\"" /etc/authentik/config.yml
 yq -i ".events.context_processors.geoip = \"/opt/authentik-data/geoip/GeoLite2-City.mmdb\"" /etc/authentik/config.yml
 yq -i ".events.context_processors.asn = \"/opt/authentik-data/geoip/GeoLite2-ASN.mmdb\"" /etc/authentik/config.yml
-yq -i ".blueprints_dir = \"/opt/authentik/blueprints\"" /etc/authentik/config.yml
+yq -i ".blueprints_dir = \"/opt/authentik-data/blueprints\"" /etc/authentik/config.yml
 yq -i ".cert_discovery_dir = \"/opt/authentik-data/certs\"" /etc/authentik/config.yml
 yq -i ".email.template_dir = \"/opt/authentik-data/templates\"" /etc/authentik/config.yml
 yq -i ".storage.file.path = \"/opt/authentik-data\"" /etc/authentik/config.yml
@@ -154,7 +154,7 @@ yq -i ".disable_startup_analytics = \"true\"" /etc/authentik/config.yml
 $STD useradd -U -s /usr/sbin/nologin -r -M -d /opt/authentik authentik
 chown -R authentik:authentik /opt/authentik
 cat <<EOF >/etc/default/authentik-server
-TMPDIR=/dev/shm/
+TMPDIR=/dev/shm/authentik-server
 UV_LINK_MODE=copy
 UV_PYTHON_DOWNLOADS=0
 UV_NATIVE_TLS=1
@@ -170,7 +170,7 @@ AUTHENTIK_LISTEN__HTTPS="[::]:9443"
 AUTHENTIK_LISTEN__METRICS="[::]:9300"
 EOF
 cat <<EOF >/etc/default/authentik-worker
-TMPDIR=/dev/shm/
+TMPDIR=/dev/shm/authentik-worker
 UV_LINK_MODE=copy
 UV_PYTHON_DOWNLOADS=0
 UV_NATIVE_TLS=1
@@ -214,6 +214,7 @@ User=authentik
 Group=authentik
 EnvironmentFile=/etc/default/authentik-server
 ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
+ExecStartPre=/usr/bin/mkdir -p "\${TMPDIR}"
 ExecStart=/opt/authentik/bin/authentik server
 WorkingDirectory=/opt/authentik/
 Restart=always
@@ -234,6 +235,7 @@ Group=authentik
 Type=simple
 EnvironmentFile=/etc/default/authentik-worker
 ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
+ExecStartPre=/usr/bin/mkdir -p "\${TMPDIR}"
 ExecStart=/opt/authentik/bin/authentik worker
 WorkingDirectory=/opt/authentik
 Restart=always
--- a/install/baserow-install.sh
+++ b/install/baserow-install.sh
@@ -45,7 +45,7 @@ msg_ok "Installed Backend Dependencies"

 msg_info "Building Frontend"
 cd /opt/baserow/web-frontend
-NODE_OPTIONS="--max-old-space-size=4096" $STD npm install --legacy-peer-deps
+NODE_OPTIONS="--max-old-space-size=4096" $STD npm install --legacy-peer-deps --allow-remote=all
 NODE_OPTIONS="--max-old-space-size=4096" $STD npm run build
 msg_ok "Built Frontend"

--- a/install/bentopdf-install.sh
+++ b/install/bentopdf-install.sh
@@ -24,7 +24,7 @@ fetch_and_deploy_gh_release "bentopdf" "alam00000/bentopdf" "tarball" "latest" "

 msg_info "Setup BentoPDF"
 cd /opt/bentopdf
-$STD npm ci --no-audit --no-fund
+$STD npm ci --no-audit --no-fund --allow-remote=all
 cp ./.env.example ./.env.production
 export NODE_OPTIONS="--max-old-space-size=3072"
 export SIMPLE_MODE=true
--- a/install/bitmagnet-install.sh
+++ b/install/bitmagnet-install.sh
@@ -23,9 +23,9 @@ setup_deb_based() {

  PG_VERSION="16" setup_postgresql
  PG_DB_NAME="bitmagnet" PG_DB_USER="bitmagnet" setup_postgresql_db
-  setup_go

  fetch_and_deploy_gh_release "bitmagnet" "bitmagnet-io/bitmagnet" "tarball"
+  GO_VERSION="$(grep -m1 '^go ' /opt/bitmagnet/go.mod | awk '{print $2}')" setup_go
  RELEASE=$(cat ~/.bitmagnet)

  msg_info "Configuring bitmagnet"
--- a/install/cloudflare-ddns-install.sh
+++ b/install/cloudflare-ddns-install.sh
@@ -51,8 +51,8 @@ while true; do
 done
 msg_ok "Configured Application"

-setup_go
 fetch_and_deploy_gh_release "cloudflare-ddns" "favonia/cloudflare-ddns" "tarball"
+GO_VERSION="$(grep -m1 '^go ' /opt/cloudflare-ddns/go.mod | awk '{print $2}')" setup_go

 msg_info "Building ${APPLICATION}"
 cd /opt/cloudflare-ddns
--- a/install/cryptpad-install.sh
+++ b/install/cryptpad-install.sh
@@ -24,7 +24,7 @@ fetch_and_deploy_gh_release "cryptpad" "cryptpad/cryptpad" "tarball"

 msg_info "Setup CryptPad"
 cd /opt/cryptpad
-$STD npm ci
+$STD npm ci --allow-git=all
 $STD npm run install:components
 if [[ "$onlyoffice" =~ ^[Yy]$ ]]; then
  $STD bash -c "./install-onlyoffice.sh --accept-license"
--- a/install/databasus-install.sh
+++ b/install/databasus-install.sh
@@ -22,7 +22,6 @@ $STD apt install -y \
 msg_ok "Installed Dependencies"

 PG_VERSION="17" setup_postgresql
-setup_go
 NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs

 msg_info "Installing Database Clients"
@@ -52,6 +51,7 @@ done
 msg_ok "Installed Database Clients"

 fetch_and_deploy_gh_release "databasus" "databasus/databasus" "tarball" "latest" "/opt/databasus"
+GO_VERSION="$(grep -m1 '^go ' /opt/databasus/backend/go.mod | awk '{print $2}')" setup_go

 msg_info "Building Databasus (Patience)"
 export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
--- a/install/firecrawl-install.sh
+++ b/install/firecrawl-install.sh
@@ -28,11 +28,11 @@ $STD apt install -y \
 msg_ok "Installed Dependencies"

 NODE_VERSION="22" NODE_MODULE="pnpm@11.4.0" setup_nodejs
-setup_go
 RUST_PROFILE="minimal" setup_rust
 PG_VERSION="17" PG_MODULES="cron" setup_postgresql

 fetch_and_deploy_gh_release "firecrawl" "firecrawl/firecrawl" "tarball" "latest" "/opt/firecrawl"
+GO_VERSION="$(grep -m1 '^go ' /opt/firecrawl/apps/api/sharedLibs/go-html-to-md/go.mod | awk '{print $2}')" setup_go

 msg_info "Configuring FDB"
 FDB_VERSION="$(awk -F= '/^ARG FDB_VERSION=/{print $2; exit}' /opt/firecrawl/apps/api/Dockerfile)"
--- a/install/gluetun-install.sh
+++ b/install/gluetun-install.sh
@@ -26,9 +26,9 @@ $STD update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
 ln -sf /usr/sbin/openvpn /usr/sbin/openvpn2.6
 msg_ok "Configured iptables"

-setup_go

 fetch_and_deploy_gh_release "gluetun" "qdm12/gluetun" "tarball"
+GO_VERSION="$(grep -m1 '^go ' /opt/gluetun/go.mod | awk '{print $2}')" setup_go

 msg_info "Building Gluetun"
 cd /opt/gluetun
--- a/install/immich-install.sh
+++ b/install/immich-install.sh
@@ -266,7 +266,7 @@ msg_ok "(2/6) Compiled jpegli"

 msg_info "(3/6) Compiling libheif"
 SOURCE=${SOURCE_DIR}/libheif
-LIBHEIF_REVISION="62f1b8c76ed4d8305071fdacbe74ef9717bacac5"
+LIBHEIF_REVISION="ac1cb05c39008f01525c991ff8b88f84ddf70fd2"
 # : "${LIBHEIF_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libheif.json)}"
 $STD git clone https://github.com/strukturag/libheif.git "$SOURCE"
 cd "$SOURCE"
@@ -292,7 +292,7 @@ msg_ok "(3/6) Compiled libheif"

 msg_info "(4/6) Compiling libraw"
 SOURCE=${SOURCE_DIR}/libraw
-LIBRAW_REVISION="b860248a89d9082b8e0a1e202e516f46af9adb29"
+LIBRAW_REVISION="e419de08001de28ae6988ecb22df47e52b9c5eaa"
 # : "${LIBRAW_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libraw.json)}"
 $STD git clone https://github.com/LibRaw/LibRaw.git "$SOURCE"
 cd "$SOURCE"
--- a/install/koffan-install.sh
+++ b/install/koffan-install.sh
@@ -17,8 +17,8 @@ msg_info "Installing Dependencies"
 $STD apt install -y build-essential
 msg_ok "Installed Dependencies"

-setup_go
 fetch_and_deploy_gh_release "koffan" "PanSalut/Koffan" "tarball"
+GO_VERSION="$(grep -m1 '^go ' /opt/koffan/go.mod | awk '{print $2}')" setup_go

 msg_info "Building Koffan"
 cd /opt/koffan
--- a/install/librechat-install.sh
+++ b/install/librechat-install.sh
@@ -25,7 +25,7 @@ fetch_and_deploy_gh_release "rag-api" "danny-avila/rag_api" "tarball"

 msg_info "Installing LibreChat Dependencies"
 cd /opt/librechat
-$STD npm ci
+$STD npm ci --allow-remote=all
 msg_ok "Installed LibreChat Dependencies"

 msg_info "Building Frontend"
--- a/install/localagi-install.sh
+++ b/install/localagi-install.sh
@@ -19,7 +19,6 @@ $STD apt install -y build-essential
 msg_ok "Installed Dependencies"

 NODE_VERSION="24" setup_nodejs
-setup_go

 msg_info "Installing Bun"
 export BUN_INSTALL="/root/.bun"
@@ -29,6 +28,7 @@ ln -sf /root/.bun/bin/bunx /usr/local/bin/bunx
 msg_ok "Installed Bun"

 fetch_and_deploy_gh_release "localagi" "mudler/LocalAGI" "tarball" "latest" "/opt/localagi"
+GO_VERSION="$(grep -m1 '^go ' /opt/localagi/go.mod | awk '{print $2}')" setup_go

 msg_info "Configuring LocalAGI"
 mkdir -p /opt/localagi/pool
--- a/install/neko-install.sh
+++ b/install/neko-install.sh
@@ -48,9 +48,9 @@ $STD apt install -y \
 msg_ok "Installed Build Dependencies"

 NODE_VERSION="22" setup_nodejs
-setup_go

 fetch_and_deploy_gh_release "neko" "m1k1o/neko" "tarball"
+GO_VERSION="$(grep -m1 '^go ' /opt/neko/server/go.mod | awk '{print $2}')" setup_go

 msg_info "Building Client"
 cd /opt/neko/client
--- a/install/networkoptimizer-install.sh
+++ b/install/networkoptimizer-install.sh
@@ -27,9 +27,9 @@ setup_deb822_repo \
 $STD apt install -y dotnet-sdk-10.0
 msg_ok "Installed Dependencies"

-setup_go

 fetch_and_deploy_gh_release "networkoptimizer" "Ozark-Connect/NetworkOptimizer" "tarball"
+GO_VERSION="$(grep -m1 '^go ' /opt/networkoptimizer/src/uwnspeedtest/go.mod | awk '{print $2}')" setup_go

 msg_info "Building NetworkOptimizer"
 RID="linux-x64"
--- a/install/pangolin-install.sh
+++ b/install/pangolin-install.sh
@@ -45,7 +45,7 @@ SECRET_KEY=$(openssl rand -base64 48 | tr -dc 'A-Za-z0-9' | head -c 32)
 BADGER_VERSION=$(get_latest_github_release "fosrl/badger" "false")
 cd /opt/pangolin
 mkdir -p /opt/pangolin/config/{traefik,db,letsencrypt,logs}
-$STD npm ci
+$STD npm ci --allow-remote=all
 $STD npm run set:pg
 $STD npm run set:oss
 rm -rf server/private
--- a/install/paperless-gpt-install.sh
+++ b/install/paperless-gpt-install.sh
@@ -23,8 +23,8 @@ $STD apt install -y \
 msg_ok "Installed Dependencies"

 NODE_VERSION="24" setup_nodejs
-setup_go
 fetch_and_deploy_gh_release "paperless-gpt" "icereed/paperless-gpt" "tarball"
+GO_VERSION="$(grep -m1 '^go ' /opt/paperless-gpt/go.mod | awk '{print $2}')" setup_go

 msg_info "Setup Paperless-GPT"
 cd /opt/paperless-gpt/web-app
--- a/install/poznote-install.sh
+++ b/install/poznote-install.sh
@@ -28,16 +28,73 @@ touch /var/www/html/data/database/poznote.db
 chown -R www-data:www-data /var/www/html
 msg_ok "Deployed Poznote"

+msg_info "Running Poznote Initialization"
+chmod +x /opt/poznote/init.sh
+$STD /opt/poznote/init.sh
+msg_ok "Initialized Poznote Data Directory"
+
 msg_info "Configuring Nginx"
 PHP_SOCK=$(get_php_fpm_socket)
 cat <<EOF >/etc/nginx/sites-available/poznote
+# The Excalidraw editor must keep its window.opener relationship with
+# libraries.excalidraw.com so "Add to Excalidraw" can hand the chosen library
+# back to the already-open editor tab; COOP same-origin would sever it.
+map \$uri \$poznote_coop {
+    default                  "same-origin";
+    /excalidraw_editor.php   "unsafe-none";
+}
+
 server {
    listen 8040;
    root /var/www/html;
    index index.php index.html;

+    gzip on;
+    gzip_comp_level 5;
+    gzip_min_length 1024;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_types text/css application/javascript text/javascript application/json
+               image/svg+xml application/manifest+json font/ttf font/otf;
+
+    location ~* \.webmanifest$ {
+        default_type application/manifest+json;
+        try_files \$uri =404;
+    }
+
+    client_max_body_size 800M;
+
+    location /api/v1 {
+        try_files \$uri \$uri/ /api/v1/index.php?\$query_string;
+    }
+
+    location = /api/health {
+        rewrite ^ /api_health.php last;
+    }
+
+    location = /api/info {
+        rewrite ^ /api_health.php last;
+    }
+
    location / {
-        try_files \$uri \$uri/ /index.php?\$query_string;
+        try_files \$uri \$uri/ @poznote_public;
+    }
+
+    location @poznote_public {
+        rewrite ^/folder/([^/]+)/?$ /public_folder.php?token=\$1 last;
+        rewrite ^/workspace/([^/]+)/?$ /public_note.php?token=\$1 last;
+        rewrite ^/([^/]+)/?$ /public_slug.php?slug=\$1 last;
+    }
+
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Cross-Origin-Opener-Policy \$poznote_coop always;
+    add_header Cross-Origin-Resource-Policy "same-origin" always;
+    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;
+
+    location ~* ^/data/.*\.(php[0-9]?|phtml|phar|pht)$ {
+        deny all;
    }

    location ~ \.php$ {
@@ -45,16 +102,93 @@ server {
        fastcgi_pass unix:${PHP_SOCK};
        fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
        fastcgi_param DOCUMENT_ROOT \$document_root;
+        fastcgi_param PATH_INFO \$fastcgi_path_info;
+
+        fastcgi_param HTTP_X_FORWARDED_FOR \$http_x_forwarded_for;
+        fastcgi_param HTTP_X_FORWARDED_PROTO \$http_x_forwarded_proto;
+        fastcgi_param HTTP_X_FORWARDED_HOST \$http_x_forwarded_host;
+        fastcgi_param HTTP_X_FORWARDED_PORT \$http_x_forwarded_port;
+        fastcgi_param HTTP_X_REAL_IP \$http_x_real_ip;
+        fastcgi_param HTTPS \$https if_not_empty;
+
+        # fastcgi_read_timeout 600;
+        # fastcgi_send_timeout 600;
+        # Left at nginx's 60s default, not Docker's 600s:
+        # a stalled git-sync request can hold the PHP session lock, otherwise
    }

-    location ~ /\.ht {
+    location ~ /\. {
        deny all;
    }
+
+    location ~ ^/data/users/[0-9]+/backgrounds/ {
+        try_files \$uri =404;
+    }
+
+    location ~ ^/data/css/[A-Za-z0-9._-]+\.css$ {
+        try_files \$uri =404;
+    }
+
+    location ~ ^/(data|config)/ {
+        deny all;
+    }
+
+    location ~* ^/pwa/poznote(-[0-9]+)?\.png$ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Cross-Origin-Resource-Policy "cross-origin" always;
+        try_files \$uri =404;
+    }
+
+    location ~* \.(?:js|css|png|jpg|jpeg|gif|svg|ico|woff2?|ttf|otf|eot|webp|webmanifest)$ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Cross-Origin-Resource-Policy "same-origin" always;
+        try_files \$uri =404;
+    }
 }
 EOF
 nginx_enable_site poznote
 msg_ok "Configured Nginx"

+msg_info "Creating Background Worker Services"
+cat <<EOF >/etc/systemd/system/poznote-reminder-worker.service
+[Unit]
+Description=Poznote Reminder Email Worker
+After=network.target
+
+[Service]
+Type=simple
+User=www-data
+Group=www-data
+Restart=always
+ExecStart=/usr/bin/php /var/www/html/workers/reminder-email-worker.php
+WorkingDirectory=/var/www/html
+
+[Install]
+WantedBy=multi-user.target
+EOF
+cat <<EOF >/etc/systemd/system/poznote-s3-backup-worker.service
+[Unit]
+Description=Poznote S3 Backup Worker
+After=network.target
+
+[Service]
+Type=simple
+User=www-data
+Group=www-data
+Restart=always
+ExecStart=/usr/bin/php /var/www/html/workers/s3-backup-worker.php
+WorkingDirectory=/var/www/html
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now poznote-reminder-worker poznote-s3-backup-worker
+msg_ok "Created Background Worker Services"
+
 motd_ssh
 customize
 cleanup_lxc
--- a/install/romm-install.sh
+++ b/install/romm-install.sh
@@ -214,7 +214,7 @@ msg_ok "Set up RomM Backend"
 if [[ -f /opt/romm/backend/utils/rom_patcher/package.json ]]; then
  msg_info "Building ROM Patcher helper"
  cd /opt/romm/backend/utils/rom_patcher
-  $STD npm install --ignore-scripts --no-audit --no-fund
+  $STD npm install --ignore-scripts --no-audit --no-fund --allow-git=all
  if [[ -d node_modules/rom-patcher/rom-patcher-js ]]; then
    rm -rf rom-patcher-js
    cp -r node_modules/rom-patcher/rom-patcher-js ./rom-patcher-js
--- a/install/seelf-install.sh
+++ b/install/seelf-install.sh
@@ -19,9 +19,9 @@ $STD apt install -y \
  gcc
 msg_ok "Installed Dependencies"

-setup_go
 NODE_VERSION="22" setup_nodejs
 fetch_and_deploy_gh_release "seelf" "YuukanOO/seelf" "tarball"
+GO_VERSION="$(grep -m1 '^go ' /opt/seelf/go.mod | awk '{print $2}')" setup_go

 msg_info "Setting up seelf. Patience"
 cd /opt/seelf
--- a/install/tor-snowflake-install.sh
+++ b/install/tor-snowflake-install.sh
@@ -13,10 +13,10 @@ setting_up_container
 network_check
 update_os

-setup_go

 msg_info "Building Snowflake"
 GITLAB_URL="https://gitlab.torproject.org" fetch_and_deploy_gl_release "tor-snowflake" "tpo/anti-censorship/pluggable-transports/snowflake" "tarball"
+GO_VERSION="$(grep -m1 '^go ' /opt/tor-snowflake/proxy/go.mod | awk '{print $2}')" setup_go
 cd /opt/tor-snowflake/proxy
 $STD go build -o snowflake-proxy .
 msg_ok "Built Snowflake Proxy"
--- a/install/wanderer-install.sh
+++ b/install/wanderer-install.sh
@@ -13,7 +13,6 @@ setting_up_container
 network_check
 update_os

-setup_go
 NODE_VERSION="22" setup_nodejs
 mkdir -p /opt/{wanderer,wanderer_data/pb_data,wanderer_data/meili_data,wanderer_data/plugins}
 MEILISEARCH_DB_PATH="/opt/wanderer_data/meili_data" setup_meilisearch
@@ -21,6 +20,8 @@ fetch_and_deploy_gh_release "wanderer" "open-wanderer/wanderer" "tarball" "lates
 mkdir -p /opt/wanderer/db/data
 [[ -e /opt/wanderer/db/data/plugins ]] || ln -sfn /opt/wanderer_data/plugins /opt/wanderer/db/data/plugins

+GO_VERSION="$(grep -m1 '^go ' /opt/wanderer/db/go.mod | awk '{print $2}')" setup_go
+
 msg_info "Installing wanderer (patience)"
 cd /opt/wanderer/db
 $STD go mod tidy
--- a/install/watcharr-install.sh
+++ b/install/watcharr-install.sh
@@ -17,9 +17,9 @@ msg_info "Installing Dependencies"
 $STD apt install -y gcc
 msg_ok "Installed Dependencies"

-setup_go
 NODE_VERSION="24" setup_nodejs
 fetch_and_deploy_gh_release "watcharr" "sbondCo/Watcharr" "tarball"
+GO_VERSION="$(grep -m1 '^go ' /opt/watcharr/server/go.mod | awk '{print $2}')" setup_go

 msg_info "Setup Watcharr"
 cd /opt/watcharr
--- a/install/yopass-install.sh
+++ b/install/yopass-install.sh
@@ -18,10 +18,10 @@ $STD apt install -y redis-server
 systemctl enable -q --now redis-server
 msg_ok "Installed Dependencies"

-setup_go
 NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs

 fetch_and_deploy_gh_release "yopass" "jhaals/yopass" "tarball"
+GO_VERSION="$(grep -m1 '^go ' /opt/yopass/go.mod | awk '{print $2}')" setup_go

 msg_info "Building Yopass"
 cd /opt/yopass
Author	SHA1	Message	Date
github-actions[bot]	96eef8684d	Update CHANGELOG.md	2026-09-04 20:55:29 +00:00
Corgei	06cafd68c4	fix(shlink): preserve servers.json across web-client updates (#17023 ) CLEAN_INSTALL wipes /opt/shlink-web-client on every `update`, deleting the user's servers.json (and its API key) with no backup, unlike the main /opt/shlink app which already backs up/restores .env and data around its CLEAN_INSTALL. This makes the Web Client lose its configured server(s) on every update. Reuse the existing create_backup/restore_backup helpers around the web-client's CLEAN_INSTALL, mirroring the pattern already used for /opt/shlink.	2026-09-04 22:55:11 +02:00
community-scripts-pr-app[bot]	455039d11f	Update CHANGELOG.md (#17017 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-09-04 15:53:00 +00:00
CanbiZ (MickLesk)	c272987bad	Fix npm v12 allow-git/allow-remote restrictions across affected scripts (#17014 ) * bentopdf: allow remote npm dependency for xlsx under npm v12 * librechat: allow remote npm dependency for xlsx under npm v12 * pangolin: allow remote npm dependencies for iron-remote-desktop packages under npm v12 * baserow: allow remote npm dependency for xlsx under npm v12 * cryptpad: allow git-based npm dependencies for drawio and json.sortify under npm v12	2026-09-04 17:52:31 +02:00
community-scripts-pr-app[bot]	02c54f3be5	Update CHANGELOG.md (#17013 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-09-04 12:39:50 +00:00
lucas-at-3x-eye	734e43004e	Fix/poznote - 1st party Docker parity (#17011 ) * fix(poznote): align nginx config with upstream Docker defaults * fix(poznote): run init.sh on install and update, not just in Docker * fix(poznote): add systemd units for the reminder-email and s3-backup workers * fix(poznote): retrofit nginx config and worker services on update, sanitize timeout comment * fix(poznote): silence init.sh output and consolidate worker enable/start * fix(poznote): update ct/poznote.sh to use new default bootstrapper	2026-09-04 14:39:17 +02:00
community-scripts-pr-app[bot]	205839c29a	Update CHANGELOG.md (#17004 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-09-04 07:26:41 +00:00
community-scripts-pr-app[bot]	a73f6a7e70	Update CHANGELOG.md (#17002 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-09-04 00:41:33 +00:00
thieneret	60d84967c6	fix chown (#16999 )	2026-09-04 10:41:04 +10:00
community-scripts-pr-app[bot]	ab1db4582f	Update CHANGELOG.md (#16997 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-09-03 18:22:47 +00:00
Chris	91ee0e46df	Immich: bump libheif and libraw (#16996 ) - To match upstream	2026-09-03 20:22:16 +02:00
community-scripts-pr-app[bot]	cae37ed968	Update CHANGELOG.md (#16994 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-09-03 14:05:21 +00:00
CanbiZ (MickLesk)	15b457b46d	romm: allow git-based npm dependency for rom-patcher under npm v12 (#16990 )	2026-09-03 16:04:50 +02:00
community-scripts-pr-app[bot]	bfc6bd176b	Update CHANGELOG.md (#16992 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-09-03 13:46:34 +00:00
CanbiZ (MickLesk)	d1855048f0	Pin Go to the version each project declares in go.mod (#16976 )	2026-09-03 15:45:59 +02:00
community-scripts-pr-app[bot]	7f637a474c	Update CHANGELOG.md (#16982 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-09-03 06:04:58 +00:00
thieneret	d8e436f8c5	Authentik update 2026.8.1 (#16980 ) * update-authentik-2026.8.1 * fix	2026-09-03 08:04:29 +02:00
community-scripts-pr-app[bot]	b36e0e3968	Update CHANGELOG.md (#16977 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-09-02 15:38:42 +00:00
community-scripts-pr-app[bot]	02fce11733	Update CHANGELOG.md (#16975 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-09-02 15:34:02 +00:00