Pin Go to the version each project declares in go.mod

setup_go with no GO_VERSION resolves to whatever go.dev currently serves, so
every Go app was built against a moving target. When 1.27 landed it broke
wanderer outright (#16909): PocketBase pins go 1.25.0 and stack-overflows at
startup when built with anything newer.

Two problems, both fixed here:

setup_go ran before the source was fetched in all 15 install scripts, so the
pin could not be read even if someone wanted one. It now runs after the fetch
and reads the version out of go.mod.

13 ct/ scripts rebuild with go during update. Eleven never called setup_go at
all and rebuilt with whatever the container happened to have; the other two
called it before the fetch. All 13 now use the same call as their installer,
verified identical string for string.

caddy is left alone: xcaddy fetches the Caddy source itself, so there is no
local go.mod to read, and it already pins deliberately. wanderer is in #16976.

CHANGELOG.md

@@ -530,31 +530,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
-## 2026-09-04
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Fix/poznote - 1st party Docker parity [@lucas-at-3x-eye](https://github.com/lucas-at-3x-eye) ([#17011](https://github.com/community-scripts/ProxmoxVE/pull/17011))
-    - fix-update-authentik-2026.8.1 [@thieneret](https://github.com/thieneret) ([#16999](https://github.com/community-scripts/ProxmoxVE/pull/16999))
-
-### 💾 Core
-
-  - setup_go: resolve bare major.minor versions to the latest patch release [@MickLesk](https://github.com/MickLesk) ([core#24](https://github.com/community-scripts/core/pull/24))
-
-## 2026-09-03
-
-### 🚀 Updated Scripts
-
-  - Immich: bump libheif and libraw [@vhsdream](https://github.com/vhsdream) ([#16996](https://github.com/community-scripts/ProxmoxVE/pull/16996))
-
-  - #### 🐞 Bug Fixes
-
-    - romm: allow git-based npm dependency for rom-patcher under npm v12 [@MickLesk](https://github.com/MickLesk) ([#16990](https://github.com/community-scripts/ProxmoxVE/pull/16990))
-    - Pin Go to the version each project declares in go.mod [@MickLesk](https://github.com/MickLesk) ([#16976](https://github.com/community-scripts/ProxmoxVE/pull/16976))
-    - Authentik update 2026.8.1 [@thieneret](https://github.com/thieneret) ([#16980](https://github.com/community-scripts/ProxmoxVE/pull/16980))
-
 ## 2026-09-02
 
 ### 🆕 New Scripts
@@ -582,9 +557,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ### 💾 Core
 
-  - setup_meilisearch: generate a 32-byte master key [@MickLesk](https://github.com/MickLesk) ([core#20](https://github.com/community-scripts/core/pull/20))
-- setup_meilisearch: generate a 32-byte master key [@MickLesk](https://github.com/MickLesk) ([core#19](https://github.com/community-scripts/core/pull/19))
-- setup_nodejs: restore the npm allowScripts bypass lost in the migration [@MickLesk](https://github.com/MickLesk) ([core#18](https://github.com/community-scripts/core/pull/18))
+  - setup_nodejs: restore the npm allowScripts bypass lost in the migration [@MickLesk](https://github.com/MickLesk) ([core#18](https://github.com/community-scripts/core/pull/18))
 
 ## 2026-09-01
 

ct/authentik.sh

@@ -49,7 +49,7 @@ function update_script() {
   RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
   setup_yq
 
-  AUTHENTIK_VERSION="version/2026.8.1"
+  AUTHENTIK_VERSION="version/2026.8.0"
   # Source: https://github.com/goauthentik/fips/blob/main/Makefile#L26
   XMLSEC_VERSION="1.3.12"
 
@@ -84,16 +84,6 @@ function update_script() {
     fi
     msg_ok "Stopped Services"
 
-    if [[ ! -d /opt/authentik-data/blueprints ]]; then
-      msg_info "Moving blueprints to presistent directory"
-      cp -r /opt/authentik/blueprints /opt/authentik-data/
-      rm -r /opt/authentik/blueprints
-      chown -Rf authentik:authentik /opt/authentik-data
-      yq -i ".blueprints_dir = \"/opt/authentik-data/blueprints\"" /etc/authentik/config.yml
-      msg_ok "blueprints moved to presistent directory"
-      msg_warn "The blueprints provided by authentik are always overwritten when updated! Only manually created custom blueprints remain unchanged between updates."
-    fi
-
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
     GO_VERSION="$(grep -m1 '^go ' /opt/authentik/go.mod | awk '{print $2}')" setup_go
 
@@ -153,39 +143,21 @@ function update_script() {
     chown -R authentik:authentik /opt/authentik
     msg_ok "Updated python server"
 
-    cp -r /opt/authentik/blueprints /opt/authentik-data/
-    rm -r /opt/authentik/blueprints
-    chown -Rf authentik:authentik /opt/authentik-data
-    
-    if [[ $MAJOR == 2026 && $MINOR -lt 8 ]]; then
-	    msg_info "Updating Worker and Server config (from $MAJOR.$MINOR)"
-      cat <<EOF >>/etc/default/authentik-server
+	  msg_info "Updating Worker and Server config"
+    cat <<EOF >>/etc/default/authentik-server
 RUST_BACKTRACE=full
 EOF
-      cat <<EOF >>/etc/default/authentik-worker
+    cat <<EOF >>/etc/default/authentik-worker
 RUST_BACKTRACE=full
 EOF
-      msg_ok "Updated Worker and Server config (from $MAJOR.$MINOR)"
-
-      msg_info "Updating services (from $MAJOR.$MINOR)"
-	    sed -i "s|ExecStart=/opt/authentik/authentik-server|ExecStart=/opt/authentik/bin/authentik server|g" /etc/systemd/system/authentik-server.service
-	    sed -i "s|ExecStart=/opt/authentik/authentik-worker worker|ExecStart=/opt/authentik/bin/authentik worker|g" /etc/systemd/system/authentik-worker.service
-	    sed -i "s|ExecStart=/opt/authentik/ldap|ExecStart=/opt/authentik/bin/ldap|g" /etc/systemd/system/authentik-ldap.service
-	    sed -i "s|ExecStart=/opt/authentik/radius|ExecStart=/opt/authentik/bin/radius|g" /etc/systemd/system/authentik-radius.service
-	    sed -i "s|ExecStart=/opt/authentik/rac|ExecStart=/opt/authentik/bin/rac|g" /etc/systemd/system/authentik-rac.service
-      systemctl daemon-reload
-      msg_ok "Updated services (from $MAJOR.$MINOR)"
-    fi
-
-    msg_info "Updating Worker and Server config"
-    sed -i "s|/dev/shm$|/dev/shm/authentik-server|g" /etc/default/authentik-server
-	  sed -i "s|/dev/shm$|/dev/shm/authentik-worker|g" /etc/default/authentik-worker
-    msg_ok "Updated Worker and Server config"
+    msg_ok "Updated Worker and Server config!"
 
     msg_info "Updating services"
-    sed -i 's/authentik Go Server (API Gateway)/authentik Server/g' /etc/systemd/system/authentik-server.service
-	  sed -i '/ExecStart=/i ExecStartPre=/usr/bin/mkdir -p "${TMPDIR}"' /etc/systemd/system/authentik-server.service
-    sed -i '/ExecStart=/i ExecStartPre=/usr/bin/mkdir -p "${TMPDIR}"' /etc/systemd/system/authentik-worker.service
+	  sed -i "s|ExecStart=/opt/authentik/authentik-server|ExecStart=/opt/authentik/bin/authentik server|g" /etc/systemd/system/authentik-server.service
+	  sed -i "s|ExecStart=/opt/authentik/authentik-worker worker|ExecStart=/opt/authentik/bin/authentik worker|g" /etc/systemd/system/authentik-worker.service
+	  sed -i "s|ExecStart=/opt/authentik/ldap|ExecStart=/opt/authentik/bin/ldap|g" /etc/systemd/system/authentik-ldap.service
+	  sed -i "s|ExecStart=/opt/authentik/radius|ExecStart=/opt/authentik/bin/radius|g" /etc/systemd/system/authentik-radius.service
+	  sed -i "s|ExecStart=/opt/authentik/rac|ExecStart=/opt/authentik/bin/rac|g" /etc/systemd/system/authentik-rac.service
     systemctl daemon-reload
     msg_ok "Updated services"
 
@@ -226,9 +198,8 @@ done
 $STD pct exec "$CTID" -- bash -c "mkdir -p /opt/authentik-data/{certs,media,geoip,templates}; \
   cp /opt/authentik/tests/GeoLite2-ASN-Test.mmdb /opt/authentik-data/geoip/GeoLite2-ASN.mmdb; \
   cp /opt/authentik/tests/GeoLite2-City-Test.mmdb /opt/authentik-data/geoip/GeoLite2-City.mmdb; \
-  cp -r /opt/authentik/blueprints /opt/authentik-data/; \
-  rm -r /opt/authentik/blueprints; \
-  chown -Rf authentik:authentik /opt/authentik-data"
+  chown authentik:authentik /opt/authentik-data; \
+  chown -R authentik:authentik /opt/authentik-data/{certs,media,geoip,templates}"
 msg_ok "Attached data storage volume"
 
 msg_info "Starting Services"

ct/immich.sh

@@ -477,7 +477,7 @@ function compile_jpegli() {
 function compile_libheif() {
   SOURCE=${SOURCE_DIR}/libheif
   ensure_dependencies libaom-dev
-  LIBHEIF_REVISION="ac1cb05c39008f01525c991ff8b88f84ddf70fd2"
+  LIBHEIF_REVISION="62f1b8c76ed4d8305071fdacbe74ef9717bacac5"
   # : "${LIBHEIF_REVISION:=$(jq -cr '.revision' "$BASE_DIR"/server/sources/libheif.json)}"
   if [[ "${update:-}" ]] || [[ "$LIBHEIF_REVISION" != "$(grep 'libheif' ~/.immich_library_revisions | awk '{print $2}')" ]]; then
     msg_info "Recompiling libheif"
@@ -509,7 +509,7 @@ function compile_libheif() {
 
 function compile_libraw() {
   SOURCE=${SOURCE_DIR}/libraw
-  LIBRAW_REVISION="e419de08001de28ae6988ecb22df47e52b9c5eaa"
+  LIBRAW_REVISION="b860248a89d9082b8e0a1e202e516f46af9adb29"
   # : "${LIBRAW_REVISION:=$(jq -cr '.revision' "$BASE_DIR"/server/sources/libraw.json)}"
   if [[ "$LIBRAW_REVISION" != "$(grep 'libraw' ~/.immich_library_revisions | awk '{print $2}')" ]]; then
     msg_info "Recompiling libraw"

ct/poznote.sh

@@ -35,7 +35,6 @@ function update_script() {
   if check_for_gh_release "poznote" "timothepoznanski/poznote"; then
     msg_info "Stopping Service"
     systemctl stop nginx
-    systemctl stop poznote-reminder-worker poznote-s3-backup-worker 2>/dev/null || true
     msg_ok "Stopped Service"
 
     create_backup /var/www/html/data
@@ -49,178 +48,8 @@ function update_script() {
 
     restore_backup
 
-    msg_info "Running Poznote Initialization"
-    chmod +x /opt/poznote/init.sh
-    $STD /opt/poznote/init.sh
-    msg_ok "Initialized Poznote Data Directory"
-
-    msg_info "Updating Nginx Configuration"
-    [[ -f /etc/nginx/sites-available/poznote ]] && cp /etc/nginx/sites-available/poznote /etc/nginx/sites-available/poznote.bak
-    PHP_SOCK=$(get_php_fpm_socket)
-    cat <<EOF >/etc/nginx/sites-available/poznote
-# The Excalidraw editor must keep its window.opener relationship with
-# libraries.excalidraw.com so "Add to Excalidraw" can hand the chosen library
-# back to the already-open editor tab; COOP same-origin would sever it.
-map \$uri \$poznote_coop {
-    default                  "same-origin";
-    /excalidraw_editor.php   "unsafe-none";
-}
-
-server {
-    listen 8040;
-    root /var/www/html;
-    index index.php index.html;
-
-    gzip on;
-    gzip_comp_level 5;
-    gzip_min_length 1024;
-    gzip_vary on;
-    gzip_proxied any;
-    gzip_types text/css application/javascript text/javascript application/json
-               image/svg+xml application/manifest+json font/ttf font/otf;
-
-    location ~* \.webmanifest$ {
-        default_type application/manifest+json;
-        try_files \$uri =404;
-    }
-
-    client_max_body_size 800M;
-
-    location /api/v1 {
-        try_files \$uri \$uri/ /api/v1/index.php?\$query_string;
-    }
-
-    location = /api/health {
-        rewrite ^ /api_health.php last;
-    }
-
-    location = /api/info {
-        rewrite ^ /api_health.php last;
-    }
-
-    location / {
-        try_files \$uri \$uri/ @poznote_public;
-    }
-
-    location @poznote_public {
-        rewrite ^/folder/([^/]+)/?$ /public_folder.php?token=\$1 last;
-        rewrite ^/workspace/([^/]+)/?$ /public_note.php?token=\$1 last;
-        rewrite ^/([^/]+)/?$ /public_slug.php?slug=\$1 last;
-    }
-
-    add_header X-Frame-Options "SAMEORIGIN" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header X-XSS-Protection "1; mode=block" always;
-    add_header Cross-Origin-Opener-Policy \$poznote_coop always;
-    add_header Cross-Origin-Resource-Policy "same-origin" always;
-    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;
-
-    location ~* ^/data/.*\.(php[0-9]?|phtml|phar|pht)$ {
-        deny all;
-    }
-
-    location ~ \.php$ {
-        include fastcgi_params;
-        fastcgi_pass unix:${PHP_SOCK};
-        fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
-        fastcgi_param DOCUMENT_ROOT \$document_root;
-        fastcgi_param PATH_INFO \$fastcgi_path_info;
-
-        fastcgi_param HTTP_X_FORWARDED_FOR \$http_x_forwarded_for;
-        fastcgi_param HTTP_X_FORWARDED_PROTO \$http_x_forwarded_proto;
-        fastcgi_param HTTP_X_FORWARDED_HOST \$http_x_forwarded_host;
-        fastcgi_param HTTP_X_FORWARDED_PORT \$http_x_forwarded_port;
-        fastcgi_param HTTP_X_REAL_IP \$http_x_real_ip;
-        fastcgi_param HTTPS \$https if_not_empty;
-
-        # fastcgi_read_timeout 600;
-        # fastcgi_send_timeout 600;
-        # Left at nginx's 60s default, not Docker's 600s:
-        # a stalled git-sync request can hold the PHP session lock, otherwise
-    }
-
-    location ~ /\. {
-        deny all;
-    }
-
-    location ~ ^/data/users/[0-9]+/backgrounds/ {
-        try_files \$uri =404;
-    }
-
-    location ~ ^/data/css/[A-Za-z0-9._-]+\.css$ {
-        try_files \$uri =404;
-    }
-
-    location ~ ^/(data|config)/ {
-        deny all;
-    }
-
-    location ~* ^/pwa/poznote(-[0-9]+)?\.png$ {
-        expires 1y;
-        add_header Cache-Control "public, immutable";
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Cross-Origin-Resource-Policy "cross-origin" always;
-        try_files \$uri =404;
-    }
-
-    location ~* \.(?:js|css|png|jpg|jpeg|gif|svg|ico|woff2?|ttf|otf|eot|webp|webmanifest)$ {
-        expires 1y;
-        add_header Cache-Control "public, immutable";
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Cross-Origin-Resource-Policy "same-origin" always;
-        try_files \$uri =404;
-    }
-}
-EOF
-    msg_ok "Updated Nginx Configuration"
-
-    if [[ ! -f /etc/systemd/system/poznote-reminder-worker.service ]]; then
-      msg_info "Creating Reminder Worker Service"
-      cat <<EOF >/etc/systemd/system/poznote-reminder-worker.service
-[Unit]
-Description=Poznote Reminder Email Worker
-After=network.target
-
-[Service]
-Type=simple
-User=www-data
-Group=www-data
-Restart=always
-ExecStart=/usr/bin/php /var/www/html/workers/reminder-email-worker.php
-WorkingDirectory=/var/www/html
-
-[Install]
-WantedBy=multi-user.target
-EOF
-      systemctl daemon-reload
-      msg_ok "Created Reminder Worker Service"
-    fi
-
-    if [[ ! -f /etc/systemd/system/poznote-s3-backup-worker.service ]]; then
-      msg_info "Creating S3 Backup Worker Service"
-      cat <<EOF >/etc/systemd/system/poznote-s3-backup-worker.service
-[Unit]
-Description=Poznote S3 Backup Worker
-After=network.target
-
-[Service]
-Type=simple
-User=www-data
-Group=www-data
-Restart=always
-ExecStart=/usr/bin/php /var/www/html/workers/s3-backup-worker.php
-WorkingDirectory=/var/www/html
-
-[Install]
-WantedBy=multi-user.target
-EOF
-      systemctl daemon-reload
-      msg_ok "Created S3 Backup Worker Service"
-    fi
-
     msg_info "Starting Service"
     systemctl start nginx
-    systemctl enable -q --now poznote-reminder-worker poznote-s3-backup-worker
     msg_ok "Started Service"
     msg_ok "Updated successfully!"
   fi

ct/romm.sh

@@ -65,7 +65,7 @@ function update_script() {
     $STD uv run alembic upgrade head
     if [[ -f /opt/romm/backend/utils/rom_patcher/package.json ]]; then
       cd /opt/romm/backend/utils/rom_patcher
-      $STD npm install --ignore-scripts --no-audit --no-fund --allow-git=all
+      $STD npm install --ignore-scripts --no-audit --no-fund
       if [[ -d node_modules/rom-patcher/rom-patcher-js ]]; then
         rm -rf rom-patcher-js
         cp -r node_modules/rom-patcher/rom-patcher-js ./rom-patcher-js

ct/wanderer.sh

@@ -158,8 +158,6 @@ EOF
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "wanderer" "open-wanderer/wanderer" "tarball" "latest"
     restore_backup
 
-    GO_VERSION="$(grep -m1 '^go ' /opt/wanderer/db/go.mod | awk '{print $2}')" setup_go
-
     msg_info "Updating wanderer"
     cd /opt/wanderer/db
     $STD go mod tidy

install/authentik-install.sh

@@ -58,7 +58,7 @@ PG_VERSION="17" setup_postgresql
 PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db
 
 XMLSEC_VERSION="1.3.12"
-AUTHENTIK_VERSION="version/2026.8.1"
+AUTHENTIK_VERSION="version/2026.8.0"
 fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec"
 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
 GO_VERSION="$(grep -m1 '^go ' /opt/authentik/go.mod | awk '{print $2}')" setup_go
@@ -146,7 +146,7 @@ yq -i ".secret_key = \"$(openssl rand -base64 128 | tr -dc 'a-zA-Z0-9' | head -c
 yq -i ".postgresql.password = \"${PG_DB_PASS}\"" /etc/authentik/config.yml
 yq -i ".events.context_processors.geoip = \"/opt/authentik-data/geoip/GeoLite2-City.mmdb\"" /etc/authentik/config.yml
 yq -i ".events.context_processors.asn = \"/opt/authentik-data/geoip/GeoLite2-ASN.mmdb\"" /etc/authentik/config.yml
-yq -i ".blueprints_dir = \"/opt/authentik-data/blueprints\"" /etc/authentik/config.yml
+yq -i ".blueprints_dir = \"/opt/authentik/blueprints\"" /etc/authentik/config.yml
 yq -i ".cert_discovery_dir = \"/opt/authentik-data/certs\"" /etc/authentik/config.yml
 yq -i ".email.template_dir = \"/opt/authentik-data/templates\"" /etc/authentik/config.yml
 yq -i ".storage.file.path = \"/opt/authentik-data\"" /etc/authentik/config.yml
@@ -154,7 +154,7 @@ yq -i ".disable_startup_analytics = \"true\"" /etc/authentik/config.yml
 $STD useradd -U -s /usr/sbin/nologin -r -M -d /opt/authentik authentik
 chown -R authentik:authentik /opt/authentik
 cat <<EOF >/etc/default/authentik-server
-TMPDIR=/dev/shm/authentik-server
+TMPDIR=/dev/shm/
 UV_LINK_MODE=copy
 UV_PYTHON_DOWNLOADS=0
 UV_NATIVE_TLS=1
@@ -170,7 +170,7 @@ AUTHENTIK_LISTEN__HTTPS="[::]:9443"
 AUTHENTIK_LISTEN__METRICS="[::]:9300"
 EOF
 cat <<EOF >/etc/default/authentik-worker
-TMPDIR=/dev/shm/authentik-worker
+TMPDIR=/dev/shm/
 UV_LINK_MODE=copy
 UV_PYTHON_DOWNLOADS=0
 UV_NATIVE_TLS=1
@@ -214,7 +214,6 @@ User=authentik
 Group=authentik
 EnvironmentFile=/etc/default/authentik-server
 ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
-ExecStartPre=/usr/bin/mkdir -p "\${TMPDIR}"
 ExecStart=/opt/authentik/bin/authentik server
 WorkingDirectory=/opt/authentik/
 Restart=always
@@ -235,7 +234,6 @@ Group=authentik
 Type=simple
 EnvironmentFile=/etc/default/authentik-worker
 ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
-ExecStartPre=/usr/bin/mkdir -p "\${TMPDIR}"
 ExecStart=/opt/authentik/bin/authentik worker
 WorkingDirectory=/opt/authentik
 Restart=always

install/immich-install.sh

@@ -266,7 +266,7 @@ msg_ok "(2/6) Compiled jpegli"
 
 msg_info "(3/6) Compiling libheif"
 SOURCE=${SOURCE_DIR}/libheif
-LIBHEIF_REVISION="ac1cb05c39008f01525c991ff8b88f84ddf70fd2"
+LIBHEIF_REVISION="62f1b8c76ed4d8305071fdacbe74ef9717bacac5"
 # : "${LIBHEIF_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libheif.json)}"
 $STD git clone https://github.com/strukturag/libheif.git "$SOURCE"
 cd "$SOURCE"
@@ -292,7 +292,7 @@ msg_ok "(3/6) Compiled libheif"
 
 msg_info "(4/6) Compiling libraw"
 SOURCE=${SOURCE_DIR}/libraw
-LIBRAW_REVISION="e419de08001de28ae6988ecb22df47e52b9c5eaa"
+LIBRAW_REVISION="b860248a89d9082b8e0a1e202e516f46af9adb29"
 # : "${LIBRAW_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libraw.json)}"
 $STD git clone https://github.com/LibRaw/LibRaw.git "$SOURCE"
 cd "$SOURCE"

install/poznote-install.sh

@@ -28,73 +28,16 @@ touch /var/www/html/data/database/poznote.db
 chown -R www-data:www-data /var/www/html
 msg_ok "Deployed Poznote"
 
-msg_info "Running Poznote Initialization"
-chmod +x /opt/poznote/init.sh
-$STD /opt/poznote/init.sh
-msg_ok "Initialized Poznote Data Directory"
-
 msg_info "Configuring Nginx"
 PHP_SOCK=$(get_php_fpm_socket)
 cat <<EOF >/etc/nginx/sites-available/poznote
-# The Excalidraw editor must keep its window.opener relationship with
-# libraries.excalidraw.com so "Add to Excalidraw" can hand the chosen library
-# back to the already-open editor tab; COOP same-origin would sever it.
-map \$uri \$poznote_coop {
-    default                  "same-origin";
-    /excalidraw_editor.php   "unsafe-none";
-}
-
 server {
     listen 8040;
     root /var/www/html;
     index index.php index.html;
 
-    gzip on;
-    gzip_comp_level 5;
-    gzip_min_length 1024;
-    gzip_vary on;
-    gzip_proxied any;
-    gzip_types text/css application/javascript text/javascript application/json
-               image/svg+xml application/manifest+json font/ttf font/otf;
-
-    location ~* \.webmanifest$ {
-        default_type application/manifest+json;
-        try_files \$uri =404;
-    }
-
-    client_max_body_size 800M;
-
-    location /api/v1 {
-        try_files \$uri \$uri/ /api/v1/index.php?\$query_string;
-    }
-
-    location = /api/health {
-        rewrite ^ /api_health.php last;
-    }
-
-    location = /api/info {
-        rewrite ^ /api_health.php last;
-    }
-
     location / {
-        try_files \$uri \$uri/ @poznote_public;
-    }
-
-    location @poznote_public {
-        rewrite ^/folder/([^/]+)/?$ /public_folder.php?token=\$1 last;
-        rewrite ^/workspace/([^/]+)/?$ /public_note.php?token=\$1 last;
-        rewrite ^/([^/]+)/?$ /public_slug.php?slug=\$1 last;
-    }
-
-    add_header X-Frame-Options "SAMEORIGIN" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header X-XSS-Protection "1; mode=block" always;
-    add_header Cross-Origin-Opener-Policy \$poznote_coop always;
-    add_header Cross-Origin-Resource-Policy "same-origin" always;
-    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;
-
-    location ~* ^/data/.*\.(php[0-9]?|phtml|phar|pht)$ {
-        deny all;
+        try_files \$uri \$uri/ /index.php?\$query_string;
     }
 
     location ~ \.php$ {
@@ -102,93 +45,16 @@ server {
         fastcgi_pass unix:${PHP_SOCK};
         fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
         fastcgi_param DOCUMENT_ROOT \$document_root;
-        fastcgi_param PATH_INFO \$fastcgi_path_info;
-
-        fastcgi_param HTTP_X_FORWARDED_FOR \$http_x_forwarded_for;
-        fastcgi_param HTTP_X_FORWARDED_PROTO \$http_x_forwarded_proto;
-        fastcgi_param HTTP_X_FORWARDED_HOST \$http_x_forwarded_host;
-        fastcgi_param HTTP_X_FORWARDED_PORT \$http_x_forwarded_port;
-        fastcgi_param HTTP_X_REAL_IP \$http_x_real_ip;
-        fastcgi_param HTTPS \$https if_not_empty;
-
-        # fastcgi_read_timeout 600;
-        # fastcgi_send_timeout 600;
-        # Left at nginx's 60s default, not Docker's 600s:
-        # a stalled git-sync request can hold the PHP session lock, otherwise
     }
 
-    location ~ /\. {
+    location ~ /\.ht {
         deny all;
     }
-
-    location ~ ^/data/users/[0-9]+/backgrounds/ {
-        try_files \$uri =404;
-    }
-
-    location ~ ^/data/css/[A-Za-z0-9._-]+\.css$ {
-        try_files \$uri =404;
-    }
-
-    location ~ ^/(data|config)/ {
-        deny all;
-    }
-
-    location ~* ^/pwa/poznote(-[0-9]+)?\.png$ {
-        expires 1y;
-        add_header Cache-Control "public, immutable";
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Cross-Origin-Resource-Policy "cross-origin" always;
-        try_files \$uri =404;
-    }
-
-    location ~* \.(?:js|css|png|jpg|jpeg|gif|svg|ico|woff2?|ttf|otf|eot|webp|webmanifest)$ {
-        expires 1y;
-        add_header Cache-Control "public, immutable";
-        add_header X-Content-Type-Options "nosniff" always;
-        add_header Cross-Origin-Resource-Policy "same-origin" always;
-        try_files \$uri =404;
-    }
 }
 EOF
 nginx_enable_site poznote
 msg_ok "Configured Nginx"
 
-msg_info "Creating Background Worker Services"
-cat <<EOF >/etc/systemd/system/poznote-reminder-worker.service
-[Unit]
-Description=Poznote Reminder Email Worker
-After=network.target
-
-[Service]
-Type=simple
-User=www-data
-Group=www-data
-Restart=always
-ExecStart=/usr/bin/php /var/www/html/workers/reminder-email-worker.php
-WorkingDirectory=/var/www/html
-
-[Install]
-WantedBy=multi-user.target
-EOF
-cat <<EOF >/etc/systemd/system/poznote-s3-backup-worker.service
-[Unit]
-Description=Poznote S3 Backup Worker
-After=network.target
-
-[Service]
-Type=simple
-User=www-data
-Group=www-data
-Restart=always
-ExecStart=/usr/bin/php /var/www/html/workers/s3-backup-worker.php
-WorkingDirectory=/var/www/html
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now poznote-reminder-worker poznote-s3-backup-worker
-msg_ok "Created Background Worker Services"
-
 motd_ssh
 customize
 cleanup_lxc

install/romm-install.sh

@@ -214,7 +214,7 @@ msg_ok "Set up RomM Backend"
 if [[ -f /opt/romm/backend/utils/rom_patcher/package.json ]]; then
   msg_info "Building ROM Patcher helper"
   cd /opt/romm/backend/utils/rom_patcher
-  $STD npm install --ignore-scripts --no-audit --no-fund --allow-git=all
+  $STD npm install --ignore-scripts --no-audit --no-fund
   if [[ -d node_modules/rom-patcher/rom-patcher-js ]]; then
     rm -rf rom-patcher-js
     cp -r node_modules/rom-patcher/rom-patcher-js ./rom-patcher-js

install/wanderer-install.sh

@@ -13,6 +13,7 @@ setting_up_container
 network_check
 update_os
 
+setup_go
 NODE_VERSION="22" setup_nodejs
 mkdir -p /opt/{wanderer,wanderer_data/pb_data,wanderer_data/meili_data,wanderer_data/plugins}
 MEILISEARCH_DB_PATH="/opt/wanderer_data/meili_data" setup_meilisearch
@@ -20,8 +21,6 @@ fetch_and_deploy_gh_release "wanderer" "open-wanderer/wanderer" "tarball" "lates
 mkdir -p /opt/wanderer/db/data
 [[ -e /opt/wanderer/db/data/plugins ]] || ln -sfn /opt/wanderer_data/plugins /opt/wanderer/db/data/plugins
 
-GO_VERSION="$(grep -m1 '^go ' /opt/wanderer/db/go.mod | awk '{print $2}')" setup_go
-
 msg_info "Installing wanderer (patience)"
 cd /opt/wanderer/db
 $STD go mod tidy