Radicale: enable the extras only once the code defines them

argon2 is an extra since v3.5.4 and uv refuses unknown extras, so patching
before the release update broke older installs. Patch after it instead,
and only when pyproject.toml defines the extra.

CHANGELOG.md

@@ -569,24 +569,10 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ### 🚀 Updated Scripts
 
-  - #### 🐞 Bug Fixes
-
-    - OpenCloud: fix Collabora embedding with Collabora 26.04.4 [@SimKaiLong](https://github.com/SimKaiLong) ([#17810](https://github.com/community-scripts/ProxmoxVE/pull/17810))
-
   - #### 🔧 Refactor
 
     - Immich: survive an interrupted update and a failing ML build [@MickLesk](https://github.com/MickLesk) ([#17798](https://github.com/community-scripts/ProxmoxVE/pull/17798))
 
-### 💾 Core
-
-  - check_for_release: compare against the release marked as latest [@MickLesk](https://github.com/MickLesk) ([core#125](https://github.com/community-scripts/core/pull/125))
-
-### 🧰 Tools
-
-  - #### ✨ New Features
-
-    - FileBrowser Quantum: migrate the config and database to v2 [@MickLesk](https://github.com/MickLesk) ([#17815](https://github.com/community-scripts/ProxmoxVE/pull/17815))
-
 ## 2026-10-08
 
 ### 🆕 New Scripts

ct/opencloud.sh

@@ -31,15 +31,6 @@ function update_script() {
     exit
   fi
 
-  # Collabora 26.04.4 ignores frame-ancestors in content_security_policy; outside the release
-  # check so installs already on the current release get it too
-  if [[ -f /etc/coolwsd/coolwsd.xml ]] && ! grep -q '<frame_ancestors[^>]*>[^<[:space:]]' /etc/coolwsd/coolwsd.xml; then
-    msg_info "Allowing OpenCloud to embed Collabora"
-    $STD sudo -u cool coolconfig set net.frame_ancestors "$(sed -n 's/^OC_URL=//p' /etc/opencloud/opencloud.env)"
-    systemctl restart coolwsd
-    msg_ok "Allowed OpenCloud to embed Collabora"
-  fi
-
   RELEASE="v8.1.0"
   if check_for_gh_release "OpenCloud" "opencloud-eu/opencloud" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
     OLD_VERSION="$(cat ~/.opencloud 2>/dev/null)"

ct/radicale.sh

@@ -41,7 +41,7 @@ function update_script() {
     if grep -q 'start.sh' /etc/systemd/system/radicale.service; then
       sed -i -e '/^Description/i[Unit]' \
         -e '\|^ExecStart|iWorkingDirectory=/opt/radicale' \
-        -e 's|^ExecStart=.*|ExecStart=/usr/local/bin/uv run -m radicale --config /etc/radicale/config|' /etc/systemd/system/radicale.service
+        -e 's|^ExecStart=.*|ExecStart=/usr/local/bin/uv run --extra bcrypt --extra argon2 -m radicale --config /etc/radicale/config|' /etc/systemd/system/radicale.service
       systemctl daemon-reload
     fi
     if [[ ! -f /etc/radicale/config ]]; then
@@ -70,6 +70,14 @@ EOF
     msg_ok "Started service"
     msg_ok "Updated Successfully!"
   fi
+
+  if grep -q 'uv run -m radicale' /etc/systemd/system/radicale.service && grep -q '^argon2 *=' /opt/radicale/pyproject.toml; then
+    msg_info "Enabling bcrypt/argon2 support"
+    sed -i 's|uv run -m radicale|uv run --extra bcrypt --extra argon2 -m radicale|' /etc/systemd/system/radicale.service
+    systemctl daemon-reload
+    systemctl restart radicale
+    msg_ok "Enabled bcrypt/argon2 support"
+  fi
   exit
 }
 

install/opencloud-install.sh

@@ -207,7 +207,7 @@ EOF
 $STD sudo -u cool coolconfig set ssl.enable false
 $STD sudo -u cool coolconfig set ssl.termination true
 $STD sudo -u cool coolconfig set ssl.ssl_verification true
-$STD sudo -u cool coolconfig set net.frame_ancestors "https://${OPENCLOUD_FQDN}"
+sed -i "s|-Policy\">|&frame-ancestors https://${OPENCLOUD_FQDN}|" /etc/coolwsd/coolwsd.xml
 useradd -r -M -s /usr/sbin/nologin opencloud
 chown -R opencloud:opencloud "$CONFIG_DIR" "$DATA_DIR"
 sudo -u opencloud opencloud init --config-path "$CONFIG_DIR" --insecure no

install/radicale-install.sh

@@ -58,7 +58,7 @@ Requires=network.target
 
 [Service]
 WorkingDirectory=/opt/radicale
-ExecStart=/usr/local/bin/uv run -m radicale --config /etc/radicale/config
+ExecStart=/usr/local/bin/uv run --extra bcrypt --extra argon2 -m radicale --config /etc/radicale/config
 Restart=on-failure
 # User=radicale
 # Deny other users access to the calendar data

tools/addon/filebrowser-quantum.sh

@@ -96,27 +96,6 @@ if [[ -f "$LEGACY_DB" || -f "$LEGACY_BIN" && ! -f "$CONFIG_PATH" ]]; then
   fi
 fi
 
-# v2 rejects v1 config keys and imports the BoltDB on its first start
-migrate_v1_config() {
-  local dir="/usr/local/community-scripts" db=0
-  [[ -s "$dir/database.db" && ! -s "$dir/filebrowser.sqlite" ]] && db=1
-  ((db)) || grep -qE 'conditionals:|indexingIntervalMinutes:' "$CONFIG_PATH" || return 0
-  cp "$CONFIG_PATH" "${CONFIG_PATH}.v1.bak"
-  ((db)) && mv "$dir/database.db" "$dir/database.db.old"
-  awk -v db="$db" '
-    { match($0, /^ */); ind = RLENGTH }
-    /^[^ #]/ { top = $1 }
-    cond && ind > ci { print substr($0, 3); next }
-    { cond = 0 }
-    /^[[:space:]]*conditionals:[[:space:]]*$/ { cond = 1; ci = ind; next }
-    /^[[:space:]]*indexingIntervalMinutes:/ { next }
-    top == "server:" && /^  port:/ { port = $2; next }
-    { print }
-    /^server:/ && db { print "  database:"; print "    migrateFrom: \"database.db.old\"" }
-    END { if (port != "") { print "http:"; print "  port: " port } }
-  ' "${CONFIG_PATH}.v1.bak" >"$CONFIG_PATH"
-}
-
 # Existing installation
 if [[ -f "$INSTALL_PATH" ]]; then
   msg_warn "${APP} is already installed."
@@ -147,7 +126,6 @@ if [[ -f "$INSTALL_PATH" ]]; then
       mv -f /usr/local/bin/filebrowser-quantum "$INSTALL_PATH"
       if [[ -f "$CONFIG_PATH" ]]; then
         sed -i '/^\s*disableIndexing:/d' "$CONFIG_PATH"
-        migrate_v1_config
       fi
       if [[ "$OS" == "Debian" ]]; then
         systemctl restart filebrowser.service
@@ -195,21 +173,22 @@ read -r noauth_prompt
 # === YAML CONFIG GENERATION ===
 if [[ "${noauth_prompt,,}" =~ ^(y|yes)$ ]]; then
   cat <<EOF >"$CONFIG_PATH"
-http:
-  port: $PORT
 server:
+  port: $PORT
   sources:
     - path: "$SRC_DIR"
       name: "RootFS"
       config:
         denyByDefault: false
-        rules:
-          - neverWatchPath: "/proc"
-          - neverWatchPath: "/sys"
-          - neverWatchPath: "/dev"
-          - neverWatchPath: "/run"
-          - neverWatchPath: "/tmp"
-          - neverWatchPath: "/lost+found"
+        indexingIntervalMinutes: 240
+        conditionals:
+          rules:
+            - neverWatchPath: "/proc"
+            - neverWatchPath: "/sys"
+            - neverWatchPath: "/dev"
+            - neverWatchPath: "/run"
+            - neverWatchPath: "/tmp"
+            - neverWatchPath: "/lost+found"
 auth:
   methods:
     noauth: true
@@ -217,21 +196,22 @@ EOF
   msg_ok "Configured with no authentication"
 else
   cat <<EOF >"$CONFIG_PATH"
-http:
-  port: $PORT
 server:
+  port: $PORT
   sources:
     - path: "$SRC_DIR"
       name: "RootFS"
       config:
         denyByDefault: false
-        rules:
-          - neverWatchPath: "/proc"
-          - neverWatchPath: "/sys"
-          - neverWatchPath: "/dev"
-          - neverWatchPath: "/run"
-          - neverWatchPath: "/tmp"
-          - neverWatchPath: "/lost+found"
+        indexingIntervalMinutes: 240
+        conditionals:
+          rules:
+            - neverWatchPath: "/proc"
+            - neverWatchPath: "/sys"
+            - neverWatchPath: "/dev"
+            - neverWatchPath: "/run"
+            - neverWatchPath: "/tmp"
+            - neverWatchPath: "/lost+found"
 auth:
   adminUsername: admin
   adminPassword: community-scripts.org