fix: prepare tubearchivist for v0.6.0

2026-10-24 04:05:03 +00:00 · 2026-10-11 19:34:45 +02:00
168 changed files with 1450 additions and 3322 deletions
@@ -1,155 +1,3 @@
-## 2026-10-17
-
-### 🆕 New Scripts
-
-  - ProxCenter ([#17961](https://github.com/community-scripts/ProxmoxVE/pull/17961))
- Listenarr ([#17963](https://github.com/community-scripts/ProxmoxVE/pull/17963))
- Youtarr ([#17962](https://github.com/community-scripts/ProxmoxVE/pull/17962))
- Norish ([#17964](https://github.com/community-scripts/ProxmoxVE/pull/17964))
-
-### 🚀 Updated Scripts
-
-  - #### 🔧 Refactor
-
-    - Sonarr: stay on the newest v4 (pin) [@MickLesk](https://github.com/MickLesk) ([#17958](https://github.com/community-scripts/ProxmoxVE/pull/17958))
-
-## 2026-10-16
-
-### 🆕 New Scripts
-
-  - Downtify ([#17959](https://github.com/community-scripts/ProxmoxVE/pull/17959))
- openGym ([#17960](https://github.com/community-scripts/ProxmoxVE/pull/17960))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Pelican Panel: pass the URL to p:environment:setup [@MickLesk](https://github.com/MickLesk) ([#17948](https://github.com/community-scripts/ProxmoxVE/pull/17948))
-    - OneDev: use the onedev.server unit of 16.9 [@MickLesk](https://github.com/MickLesk) ([#17949](https://github.com/community-scripts/ProxmoxVE/pull/17949))
-    - ReadMeABook: start the scheduler with the service [@MickLesk](https://github.com/MickLesk) ([#17950](https://github.com/community-scripts/ProxmoxVE/pull/17950))
-
-### 💾 Core
-
-  - Clean up after installs and updates again [@MickLesk](https://github.com/MickLesk) ([core#147](https://github.com/community-scripts/core/pull/147))
- Fix apt_conffile_report exiting 1 when uutils comm sees locale-sorted input [@BadFlo](https://github.com/BadFlo) ([core#146](https://github.com/community-scripts/core/pull/146))
-
-## 2026-10-15
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - fix(apprise-api): copy static assets into the served directory [@brokentokin](https://github.com/brokentokin) ([#17940](https://github.com/community-scripts/ProxmoxVE/pull/17940))
-    - Bytestash: modify backup process | Update Resources [@MickLesk](https://github.com/MickLesk) ([#17935](https://github.com/community-scripts/ProxmoxVE/pull/17935))
-    - Zabbix: Add '-y' flag to apt install commands [@MickLesk](https://github.com/MickLesk) ([#17933](https://github.com/community-scripts/ProxmoxVE/pull/17933))
-    - karakeep: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17087](https://github.com/community-scripts/ProxmoxVE/pull/17087))
-
-### 💾 Core
-
-  - Keep VM release lookups working without system.func [@MickLesk](https://github.com/MickLesk) ([core#144](https://github.com/community-scripts/core/pull/144))
- Stop calling exit 1 "Operation not permitted" at several steps [@MickLesk](https://github.com/MickLesk) ([core#140](https://github.com/community-scripts/core/pull/140))
-
-## 2026-10-14
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Paperclip: fall back to a non-frozen install when the release lockfile is stale [@MickLesk](https://github.com/MickLesk) ([#17922](https://github.com/community-scripts/ProxmoxVE/pull/17922))
-
-  - #### 🔧 Refactor
-
-    - Immich: rebuild the image libraries when the revision record is missing [@MickLesk](https://github.com/MickLesk) ([#17919](https://github.com/community-scripts/ProxmoxVE/pull/17919))
-
-### 💾 Core
-
-  - Show what the failing command printed, and keep verbose output in the log [@MickLesk](https://github.com/MickLesk) ([core#139](https://github.com/community-scripts/core/pull/139))
- Install jq before the release lookup and show what a non-JSON answer was [@MickLesk](https://github.com/MickLesk) ([core#138](https://github.com/community-scripts/core/pull/138))
- Refresh the NodeSource key before a same-major Node.js update [@MickLesk](https://github.com/MickLesk) ([core#137](https://github.com/community-scripts/core/pull/137))
- github: say why a forge could not be reached instead of 'connection failed' [@MickLesk](https://github.com/MickLesk) ([core#136](https://github.com/community-scripts/core/pull/136))
-
-## 2026-10-13
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Fix URL for downloading OneDev latest release [@ryansully](https://github.com/ryansully) ([#17915](https://github.com/community-scripts/ProxmoxVE/pull/17915))
-    - LocalAI: pin the CPU backends when the container has no GPU runtime [@MickLesk](https://github.com/MickLesk) ([#17909](https://github.com/community-scripts/ProxmoxVE/pull/17909))
-    - [Gluetun] Update GitHub repository source install and update. [@CerberusStyle](https://github.com/CerberusStyle) ([#17899](https://github.com/community-scripts/ProxmoxVE/pull/17899))
-    - Immich: Bump to 3.3.1 and restore (failed) geodata/countryInfo.txt on update  [@MickLesk](https://github.com/MickLesk) ([#17894](https://github.com/community-scripts/ProxmoxVE/pull/17894))
-    - WikiJS: use v2 Repo until v3 is stable [@MickLesk](https://github.com/MickLesk) ([#17895](https://github.com/community-scripts/ProxmoxVE/pull/17895))
-
-  - #### 💥 Breaking Changes
-
-    - zammad: Debian 13, new apt repo, Elasticsearch 8 [@durzo](https://github.com/durzo) ([#17836](https://github.com/community-scripts/ProxmoxVE/pull/17836))
-
-### 💾 Core
-
-  - Keep the version key parseable by jq 1.6 [@MickLesk](https://github.com/MickLesk) ([core#134](https://github.com/community-scripts/core/pull/134))
-
-## 2026-10-12
-
-### 🆕 New Scripts
-
-  - WatchState ([#17881](https://github.com/community-scripts/ProxmoxVE/pull/17881))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - chore(ct): sync wazuh defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17889](https://github.com/community-scripts/ProxmoxVE/pull/17889))
-    - Wanderer: bring back the wanderer-pb wrapper [@MickLesk](https://github.com/MickLesk) ([#17874](https://github.com/community-scripts/ProxmoxVE/pull/17874))
-    - Tracearr: install only the server's production dependencies [@MickLesk](https://github.com/MickLesk) ([#17873](https://github.com/community-scripts/ProxmoxVE/pull/17873))
-    - Paperless-ngx: QoL restart crashed services | patch regex [@MickLesk](https://github.com/MickLesk) ([#17812](https://github.com/community-scripts/ProxmoxVE/pull/17812))
-    - Splunk Enterprise: start the service as the splunk user [@rcastley](https://github.com/rcastley) ([#17816](https://github.com/community-scripts/ProxmoxVE/pull/17816))
-
-### 💾 Core
-
-  - Draw a Community Scripts banner while a script has no header of its own [@MickLesk](https://github.com/MickLesk) ([core#133](https://github.com/community-scripts/core/pull/133))
- Order pre-release labels when comparing versions [@MickLesk](https://github.com/MickLesk) ([core#132](https://github.com/community-scripts/core/pull/132))
- gh: curl_download: wait between attempts [@MickLesk](https://github.com/MickLesk) ([core#131](https://github.com/community-scripts/core/pull/131))
-
-### 🧰 Tools
-
-  - #### ✨ New Features
-
-    - Immich Public Proxy: optional visitor upload service (v4 Release) [@MickLesk](https://github.com/MickLesk) ([#17875](https://github.com/community-scripts/ProxmoxVE/pull/17875))
-
-## 2026-10-11
-
-### 🆕 New Scripts
-
-  - Cinephage ([#17852](https://github.com/community-scripts/ProxmoxVE/pull/17852))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Immich: build libvips with JPEG 2000 support [@MickLesk](https://github.com/MickLesk) ([#17864](https://github.com/community-scripts/ProxmoxVE/pull/17864))
-    - hermesagent: match the relaunched root gateway regardless of interpreter [@MickLesk](https://github.com/MickLesk) ([#17847](https://github.com/community-scripts/ProxmoxVE/pull/17847))
-    - Radicale: install the bcrypt and argon2 extras [@MickLesk](https://github.com/MickLesk) ([#17813](https://github.com/community-scripts/ProxmoxVE/pull/17813))
-    - fix(zigbee2mqtt): preserve backup stream and prevent filename collisions [@petermnt](https://github.com/petermnt) ([#17751](https://github.com/community-scripts/ProxmoxVE/pull/17751))
-
-  - #### ✨ New Features
-
-    - QoL: let var_* answer the optional add-on prompts [@MickLesk](https://github.com/MickLesk) ([#17858](https://github.com/community-scripts/ProxmoxVE/pull/17858))
-    - QoL: Confirm third-party installers through confirm_external_installer [@MickLesk](https://github.com/MickLesk) ([#17857](https://github.com/community-scripts/ProxmoxVE/pull/17857))
-    - docker: take the lxcfs toggle, TCP socket and Compose choice from app variables [@MickLesk](https://github.com/MickLesk) ([#17850](https://github.com/community-scripts/ProxmoxVE/pull/17850))
-
-  - #### 🔧 Refactor
-
-    - RustDesk Server: run the official server, make the web UI optional [@MickLesk](https://github.com/MickLesk) ([#17854](https://github.com/community-scripts/ProxmoxVE/pull/17854))
-    - Caddy: install the .deb from GitHub instead of the Cloudsmith repo [@MickLesk](https://github.com/MickLesk) ([#17862](https://github.com/community-scripts/ProxmoxVE/pull/17862))
-
-### 💾 Core
-
-  - Add confirm_external_installer [@MickLesk](https://github.com/MickLesk) ([core#130](https://github.com/community-scripts/core/pull/130))
- setup_docker: make LXC resource limits visible to nested containers [@andrebrait](https://github.com/andrebrait) ([core#9](https://github.com/community-scripts/core/pull/9))
- Incus: fix ENABLE_FUSE / TUN vars [@MickLesk](https://github.com/MickLesk) ([core#127](https://github.com/community-scripts/core/pull/127))
- Resolve a uv required-version range to the newest release inside it [@MickLesk](https://github.com/MickLesk) ([core#126](https://github.com/community-scripts/core/pull/126))
- Upgrade MongoDB in place when an app package depends on it [@MickLesk](https://github.com/MickLesk) ([core#128](https://github.com/community-scripts/core/pull/128))
-
 ## 2026-10-10

 ### 🆕 New Scripts
@@ -1,14 +1,17 @@
+# Keeps the GitHub Actions referenced in .github/workflows up to date.
+# https://docs.github.com/code-security/dependabot/working-with-dependabot/dependabot-options-reference
 version: 2
 updates:
  - package-ecosystem: "github-actions"
    directory: "/"
-    labels: []
    schedule:
      interval: "weekly"
-    target-branch: "main"
-    cooldown:
-      default-days: 7
+      day: "monday"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+    # One PR per week for all action bumps instead of one PR per action.
    groups:
-      actions:
+      github-actions:
        patterns:
          - "*"
@@ -116,9 +116,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit



-
-
-



@@ -132,7 +129,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit


 <details>
-<summary><h4>October (17 entries)</h4></summary>
+<summary><h4>October (10 entries)</h4></summary>

 [View October 2026 Changelog](.github/changelogs/2026/10.md)

@@ -565,266 +562,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 </details>

-## 2026-10-23
-
-### 🚀 Updated Scripts
-
-  - postgresql: default the version prompt and match Alpine's packages [@MickLesk](https://github.com/MickLesk) ([#18093](https://github.com/community-scripts/ProxmoxVE/pull/18093))
- Storyteller: build the runtime like upstream's Dockerfile [@MickLesk](https://github.com/MickLesk) ([#18083](https://github.com/community-scripts/ProxmoxVE/pull/18083))
-
-  - #### 🐞 Bug Fixes
-
-    - proxcenter: skip the type check and lower the build heap [@MickLesk](https://github.com/MickLesk) ([#18090](https://github.com/community-scripts/ProxmoxVE/pull/18090))
-    - hermesagent: retry the installer download, fall back to GitHub [@MickLesk](https://github.com/MickLesk) ([#18091](https://github.com/community-scripts/ProxmoxVE/pull/18091))
-    - zabbix: use the arm64 repository for 7.0 [@MickLesk](https://github.com/MickLesk) ([#18089](https://github.com/community-scripts/ProxmoxVE/pull/18089))
-    - kasm: survive a failed release lookup and answer the installer with flags [@MickLesk](https://github.com/MickLesk) ([#18092](https://github.com/community-scripts/ProxmoxVE/pull/18092))
-
-  - #### ✨ New Features
-
-    - InvoiceShelf: run the Laravel scheduler [@MickLesk](https://github.com/MickLesk) ([#18079](https://github.com/community-scripts/ProxmoxVE/pull/18079))
-
-  - #### 🔧 Refactor
-
-    - podman-homeassistant: require Debian 13 [@MickLesk](https://github.com/MickLesk) ([#18095](https://github.com/community-scripts/ProxmoxVE/pull/18095))
-    - apache-guacamole: require Debian 13 [@MickLesk](https://github.com/MickLesk) ([#18094](https://github.com/community-scripts/ProxmoxVE/pull/18094))
-    - unifi-os-server: require Debian 13 [@MickLesk](https://github.com/MickLesk) ([#18096](https://github.com/community-scripts/ProxmoxVE/pull/18096))
-    - openwebui: drop the Intel oneAPI Base Toolkit [@MickLesk](https://github.com/MickLesk) ([#18098](https://github.com/community-scripts/ProxmoxVE/pull/18098))
-    - ollama: drop the Intel oneAPI Base Toolkit [@MickLesk](https://github.com/MickLesk) ([#18097](https://github.com/community-scripts/ProxmoxVE/pull/18097))
-    - tdarr: do not let a failed or slow updater block the service start [@MickLesk](https://github.com/MickLesk) ([#18100](https://github.com/community-scripts/ProxmoxVE/pull/18100))
-    - immich: install mise from its GitHub release, retry jellyfin-ffmpeg, default the ML prompt [@MickLesk](https://github.com/MickLesk) ([#18099](https://github.com/community-scripts/ProxmoxVE/pull/18099))
-    - Refactor: pimox-haos-vm [@MickLesk](https://github.com/MickLesk) ([#18077](https://github.com/community-scripts/ProxmoxVE/pull/18077))
-
-### 💾 Core
-
-  - Telemetry: explain and categorize by the command that failed [@MickLesk](https://github.com/MickLesk) ([core#166](https://github.com/community-scripts/core/pull/166))
- error-handler: report a handled silent failure only on its own line [@MickLesk](https://github.com/MickLesk) ([core#165](https://github.com/community-scripts/core/pull/165))
- VM silent: return the failure instead of exiting [@MickLesk](https://github.com/MickLesk) ([core#164](https://github.com/community-scripts/core/pull/164))
- error-handler: keep the start explanation and the final IP lookup from failing the run [@MickLesk](https://github.com/MickLesk) ([core#163](https://github.com/community-scripts/core/pull/163))
- error output: report a failure inside a subshell once [@MickLesk](https://github.com/MickLesk) ([core#162](https://github.com/community-scripts/core/pull/162))
- general: allow Composer as root in every script [@MickLesk](https://github.com/MickLesk) ([core#161](https://github.com/community-scripts/core/pull/161))
- lxc-updater: skip the resource check when the container cannot read its RAM [@MickLesk](https://github.com/MickLesk) ([core#160](https://github.com/community-scripts/core/pull/160))
- vm-core: let vm_timezone_default survive a host without /etc/timezone [@MickLesk](https://github.com/MickLesk) ([core#159](https://github.com/community-scripts/core/pull/159))
-
-## 2026-10-22
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Zabbix: keep unattended updates on the installed series [@florianpunz](https://github.com/florianpunz) ([#18051](https://github.com/community-scripts/ProxmoxVE/pull/18051))
-
-  - #### 🔧 Refactor
-
-    - Refactor: Cryptpad [@MickLesk](https://github.com/MickLesk) ([#18065](https://github.com/community-scripts/ProxmoxVE/pull/18065))
-
-### 💾 Core
-
-  - Incus: drive a remote Incus server from the client's default remote [@MickLesk](https://github.com/MickLesk) ([core#154](https://github.com/community-scripts/core/pull/154))
- Deploy the release again when an update is redone [@MickLesk](https://github.com/MickLesk) ([core#158](https://github.com/community-scripts/core/pull/158))
-
-### ❔ Uncategorized
-
-  - chore(ct): sync sparkyfitness defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18061](https://github.com/community-scripts/ProxmoxVE/pull/18061))
-
-## 2026-10-21
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Immich: bump release version to v3.3.5 (CVE) [@CerberusStyle](https://github.com/CerberusStyle) ([#18057](https://github.com/community-scripts/ProxmoxVE/pull/18057))
-    - DroppedNeedle: pass release version to the app via COMMIT_TAG [@MickLesk](https://github.com/MickLesk) ([#18042](https://github.com/community-scripts/ProxmoxVE/pull/18042))
-
-### 💾 Core
-
-  - Keep the version an update started from across a redo [@MickLesk](https://github.com/MickLesk) ([core#156](https://github.com/community-scripts/core/pull/156))
- Redo an update whose run did not finish after the deploy [@MickLesk](https://github.com/MickLesk) ([core#155](https://github.com/community-scripts/core/pull/155))
-
-## 2026-10-20
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Plane: give Silo its own HOME [@MickLesk](https://github.com/MickLesk) ([#18028](https://github.com/community-scripts/ProxmoxVE/pull/18028))
-    - Immich: Pin version to 3.3.4 [@vhsdream](https://github.com/vhsdream) ([#18036](https://github.com/community-scripts/ProxmoxVE/pull/18036))
-    - InvenTree: run apt under systemd so postinst can finish [@MickLesk](https://github.com/MickLesk) ([#18029](https://github.com/community-scripts/ProxmoxVE/pull/18029))
-    - Profilarr: pass the deno pin as the version [@MickLesk](https://github.com/MickLesk) ([#18025](https://github.com/community-scripts/ProxmoxVE/pull/18025))
-    - Silo: keep the version file out of ~/.silo [@MickLesk](https://github.com/MickLesk) ([#18030](https://github.com/community-scripts/ProxmoxVE/pull/18030))
-    - InvenTree: move to go.packager.io [@MickLesk](https://github.com/MickLesk) ([#18015](https://github.com/community-scripts/ProxmoxVE/pull/18015))
-    - Zitadel: run init and setup in the foreground [@MickLesk](https://github.com/MickLesk) ([#18016](https://github.com/community-scripts/ProxmoxVE/pull/18016))
-
-  - #### ✨ New Features
-
-    - Zitadel: Support v1 and v2 Login [@MickLesk](https://github.com/MickLesk) ([#18031](https://github.com/community-scripts/ProxmoxVE/pull/18031))
-
-  - #### 🔧 Refactor
-
-    - Refactor: OpenWebUI (remove numba pin)  [@MickLesk](https://github.com/MickLesk) ([#18026](https://github.com/community-scripts/ProxmoxVE/pull/18026))
-
-### 💾 Core
-
-  - Only treat an NVIDIA GPU as present when its device nodes are [@MickLesk](https://github.com/MickLesk) ([core#153](https://github.com/community-scripts/core/pull/153))
-
-## 2026-10-19
-
-### 🆕 New Scripts
-
-  - Calagopus ([#18012](https://github.com/community-scripts/ProxmoxVE/pull/18012))
- Netronome ([#18011](https://github.com/community-scripts/ProxmoxVE/pull/18011))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - immich: record library revisions when the line is missing [@mazelado](https://github.com/mazelado) ([#17990](https://github.com/community-scripts/ProxmoxVE/pull/17990))
-    - Update authentik 2026.8.4 [@thieneret](https://github.com/thieneret) ([#18004](https://github.com/community-scripts/ProxmoxVE/pull/18004))
-
-  - #### ✨ New Features
-
-    - feat(mealie): add reverse proxy auth settings to mealie.env [@bferd](https://github.com/bferd) ([#18006](https://github.com/community-scripts/ProxmoxVE/pull/18006))
-
-## 2026-10-18
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Donetick: create selfhosted.yaml from the example [@MickLesk](https://github.com/MickLesk) ([#17992](https://github.com/community-scripts/ProxmoxVE/pull/17992))
-    - Wiki.js: only back up db.sqlite on SQLite installs [@MickLesk](https://github.com/MickLesk) ([#17993](https://github.com/community-scripts/ProxmoxVE/pull/17993))
-    - FlareSolverr: pass Chrome an en-US Accept-Language [@MickLesk](https://github.com/MickLesk) ([#17995](https://github.com/community-scripts/ProxmoxVE/pull/17995))
-    - 2FAuth: install the locked dependencies [@MickLesk](https://github.com/MickLesk) ([#17996](https://github.com/community-scripts/ProxmoxVE/pull/17996))
-    - Tracearr: drop the pnpm store after the update build [@gioxx](https://github.com/gioxx) ([#17869](https://github.com/community-scripts/ProxmoxVE/pull/17869))
-    - vaultwarden: build before stopping the service [@mazelado](https://github.com/mazelado) ([#17983](https://github.com/community-scripts/ProxmoxVE/pull/17983))
-
-  - #### 💥 Breaking Changes
-
-    - fix: geopulse 2.0.0 upgrade support (nginx .mjs, pg18, jwt cleanup) [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17978](https://github.com/community-scripts/ProxmoxVE/pull/17978))
-
-### 💾 Core
-
-  - Let get_current_ip reach its IPv6 fallback [@MickLesk](https://github.com/MickLesk) ([core#151](https://github.com/community-scripts/core/pull/151))
- Drop apt autoclean before apt clean [@MickLesk](https://github.com/MickLesk) ([core#152](https://github.com/community-scripts/core/pull/152))
- Silence apt's script warning in $STD [@MickLesk](https://github.com/MickLesk) ([core#150](https://github.com/community-scripts/core/pull/150))
-
-## 2026-10-17
-
-### 🆕 New Scripts
-
-  - ProxCenter ([#17961](https://github.com/community-scripts/ProxmoxVE/pull/17961))
- Listenarr ([#17963](https://github.com/community-scripts/ProxmoxVE/pull/17963))
- Youtarr ([#17962](https://github.com/community-scripts/ProxmoxVE/pull/17962))
- Norish ([#17964](https://github.com/community-scripts/ProxmoxVE/pull/17964))
-
-### 🚀 Updated Scripts
-
-  - #### 🔧 Refactor
-
-    - Sonarr: stay on the newest v4 (pin) [@MickLesk](https://github.com/MickLesk) ([#17958](https://github.com/community-scripts/ProxmoxVE/pull/17958))
-
-## 2026-10-16
-
-### 🆕 New Scripts
-
-  - Downtify ([#17959](https://github.com/community-scripts/ProxmoxVE/pull/17959))
- openGym ([#17960](https://github.com/community-scripts/ProxmoxVE/pull/17960))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Pelican Panel: pass the URL to p:environment:setup [@MickLesk](https://github.com/MickLesk) ([#17948](https://github.com/community-scripts/ProxmoxVE/pull/17948))
-    - OneDev: use the onedev.server unit of 16.9 [@MickLesk](https://github.com/MickLesk) ([#17949](https://github.com/community-scripts/ProxmoxVE/pull/17949))
-    - ReadMeABook: start the scheduler with the service [@MickLesk](https://github.com/MickLesk) ([#17950](https://github.com/community-scripts/ProxmoxVE/pull/17950))
-
-### 💾 Core
-
-  - Clean up after installs and updates again [@MickLesk](https://github.com/MickLesk) ([core#147](https://github.com/community-scripts/core/pull/147))
- Fix apt_conffile_report exiting 1 when uutils comm sees locale-sorted input [@BadFlo](https://github.com/BadFlo) ([core#146](https://github.com/community-scripts/core/pull/146))
-
-## 2026-10-15
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - fix(apprise-api): copy static assets into the served directory [@brokentokin](https://github.com/brokentokin) ([#17940](https://github.com/community-scripts/ProxmoxVE/pull/17940))
-    - Bytestash: modify backup process | Update Resources [@MickLesk](https://github.com/MickLesk) ([#17935](https://github.com/community-scripts/ProxmoxVE/pull/17935))
-    - Zabbix: Add '-y' flag to apt install commands [@MickLesk](https://github.com/MickLesk) ([#17933](https://github.com/community-scripts/ProxmoxVE/pull/17933))
-    - karakeep: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17087](https://github.com/community-scripts/ProxmoxVE/pull/17087))
-
-### 💾 Core
-
-  - Keep VM release lookups working without system.func [@MickLesk](https://github.com/MickLesk) ([core#144](https://github.com/community-scripts/core/pull/144))
- Stop calling exit 1 "Operation not permitted" at several steps [@MickLesk](https://github.com/MickLesk) ([core#140](https://github.com/community-scripts/core/pull/140))
-
-## 2026-10-14
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Paperclip: fall back to a non-frozen install when the release lockfile is stale [@MickLesk](https://github.com/MickLesk) ([#17922](https://github.com/community-scripts/ProxmoxVE/pull/17922))
-
-  - #### 🔧 Refactor
-
-    - Immich: rebuild the image libraries when the revision record is missing [@MickLesk](https://github.com/MickLesk) ([#17919](https://github.com/community-scripts/ProxmoxVE/pull/17919))
-
-### 💾 Core
-
-  - Show what the failing command printed, and keep verbose output in the log [@MickLesk](https://github.com/MickLesk) ([core#139](https://github.com/community-scripts/core/pull/139))
- Install jq before the release lookup and show what a non-JSON answer was [@MickLesk](https://github.com/MickLesk) ([core#138](https://github.com/community-scripts/core/pull/138))
- Refresh the NodeSource key before a same-major Node.js update [@MickLesk](https://github.com/MickLesk) ([core#137](https://github.com/community-scripts/core/pull/137))
- github: say why a forge could not be reached instead of 'connection failed' [@MickLesk](https://github.com/MickLesk) ([core#136](https://github.com/community-scripts/core/pull/136))
-
-## 2026-10-13
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Fix URL for downloading OneDev latest release [@ryansully](https://github.com/ryansully) ([#17915](https://github.com/community-scripts/ProxmoxVE/pull/17915))
-    - LocalAI: pin the CPU backends when the container has no GPU runtime [@MickLesk](https://github.com/MickLesk) ([#17909](https://github.com/community-scripts/ProxmoxVE/pull/17909))
-    - [Gluetun] Update GitHub repository source install and update. [@CerberusStyle](https://github.com/CerberusStyle) ([#17899](https://github.com/community-scripts/ProxmoxVE/pull/17899))
-    - Immich: Bump to 3.3.1 and restore (failed) geodata/countryInfo.txt on update  [@MickLesk](https://github.com/MickLesk) ([#17894](https://github.com/community-scripts/ProxmoxVE/pull/17894))
-    - WikiJS: use v2 Repo until v3 is stable [@MickLesk](https://github.com/MickLesk) ([#17895](https://github.com/community-scripts/ProxmoxVE/pull/17895))
-
-  - #### 💥 Breaking Changes
-
-    - zammad: Debian 13, new apt repo, Elasticsearch 8 [@durzo](https://github.com/durzo) ([#17836](https://github.com/community-scripts/ProxmoxVE/pull/17836))
-
-### 💾 Core
-
-  - Keep the version key parseable by jq 1.6 [@MickLesk](https://github.com/MickLesk) ([core#134](https://github.com/community-scripts/core/pull/134))
-
-## 2026-10-12
-
-### 🆕 New Scripts
-
-  - WatchState ([#17881](https://github.com/community-scripts/ProxmoxVE/pull/17881))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - chore(ct): sync wazuh defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17889](https://github.com/community-scripts/ProxmoxVE/pull/17889))
-    - Wanderer: bring back the wanderer-pb wrapper [@MickLesk](https://github.com/MickLesk) ([#17874](https://github.com/community-scripts/ProxmoxVE/pull/17874))
-    - Tracearr: install only the server's production dependencies [@MickLesk](https://github.com/MickLesk) ([#17873](https://github.com/community-scripts/ProxmoxVE/pull/17873))
-    - Paperless-ngx: QoL restart crashed services | patch regex [@MickLesk](https://github.com/MickLesk) ([#17812](https://github.com/community-scripts/ProxmoxVE/pull/17812))
-    - Splunk Enterprise: start the service as the splunk user [@rcastley](https://github.com/rcastley) ([#17816](https://github.com/community-scripts/ProxmoxVE/pull/17816))
-
-### 💾 Core
-
-  - Draw a Community Scripts banner while a script has no header of its own [@MickLesk](https://github.com/MickLesk) ([core#133](https://github.com/community-scripts/core/pull/133))
- Order pre-release labels when comparing versions [@MickLesk](https://github.com/MickLesk) ([core#132](https://github.com/community-scripts/core/pull/132))
- gh: curl_download: wait between attempts [@MickLesk](https://github.com/MickLesk) ([core#131](https://github.com/community-scripts/core/pull/131))
-
-### 🧰 Tools
-
-  - #### ✨ New Features
-
-    - Immich Public Proxy: optional visitor upload service (v4 Release) [@MickLesk](https://github.com/MickLesk) ([#17875](https://github.com/community-scripts/ProxmoxVE/pull/17875))
-
 ## 2026-10-11

 ### 🆕 New Scripts
@@ -835,26 +572,17 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

  - #### 🐞 Bug Fixes

-    - Immich: build libvips with JPEG 2000 support [@MickLesk](https://github.com/MickLesk) ([#17864](https://github.com/community-scripts/ProxmoxVE/pull/17864))
    - hermesagent: match the relaunched root gateway regardless of interpreter [@MickLesk](https://github.com/MickLesk) ([#17847](https://github.com/community-scripts/ProxmoxVE/pull/17847))
    - Radicale: install the bcrypt and argon2 extras [@MickLesk](https://github.com/MickLesk) ([#17813](https://github.com/community-scripts/ProxmoxVE/pull/17813))
    - fix(zigbee2mqtt): preserve backup stream and prevent filename collisions [@petermnt](https://github.com/petermnt) ([#17751](https://github.com/community-scripts/ProxmoxVE/pull/17751))

  - #### ✨ New Features

-    - QoL: let var_* answer the optional add-on prompts [@MickLesk](https://github.com/MickLesk) ([#17858](https://github.com/community-scripts/ProxmoxVE/pull/17858))
-    - QoL: Confirm third-party installers through confirm_external_installer [@MickLesk](https://github.com/MickLesk) ([#17857](https://github.com/community-scripts/ProxmoxVE/pull/17857))
    - docker: take the lxcfs toggle, TCP socket and Compose choice from app variables [@MickLesk](https://github.com/MickLesk) ([#17850](https://github.com/community-scripts/ProxmoxVE/pull/17850))

-  - #### 🔧 Refactor
-
-    - RustDesk Server: run the official server, make the web UI optional [@MickLesk](https://github.com/MickLesk) ([#17854](https://github.com/community-scripts/ProxmoxVE/pull/17854))
-    - Caddy: install the .deb from GitHub instead of the Cloudsmith repo [@MickLesk](https://github.com/MickLesk) ([#17862](https://github.com/community-scripts/ProxmoxVE/pull/17862))
-
 ### 💾 Core

-  - Add confirm_external_installer [@MickLesk](https://github.com/MickLesk) ([core#130](https://github.com/community-scripts/core/pull/130))
- setup_docker: make LXC resource limits visible to nested containers [@andrebrait](https://github.com/andrebrait) ([core#9](https://github.com/community-scripts/core/pull/9))
+  - setup_docker: make LXC resource limits visible to nested containers [@andrebrait](https://github.com/andrebrait) ([core#9](https://github.com/community-scripts/core/pull/9))
 - Incus: fix ENABLE_FUSE / TUN vars [@MickLesk](https://github.com/MickLesk) ([core#127](https://github.com/community-scripts/core/pull/127))
 - Resolve a uv required-version range to the newest release inside it [@MickLesk](https://github.com/MickLesk) ([core#126](https://github.com/community-scripts/core/pull/126))
 - Upgrade MongoDB in place when an app package depends on it [@MickLesk](https://github.com/MickLesk) ([core#128](https://github.com/community-scripts/core/pull/128))
@@ -1399,4 +1127,175 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 ### 📚 Documentation

-  - chore: fix PR template help [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17364](https://github.com/community-scripts/ProxmoxVE/pull/17364))
+  - chore: fix PR template help [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17364](https://github.com/community-scripts/ProxmoxVE/pull/17364))
+
+## 2026-09-17
+
+### 🆕 New Scripts
+
+  - Alpine-VM ([#17324](https://github.com/community-scripts/ProxmoxVE/pull/17324))
+- Allstarlink ([#17321](https://github.com/community-scripts/ProxmoxVE/pull/17321))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - changedetection: update: various fixes [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17331](https://github.com/community-scripts/ProxmoxVE/pull/17331))
+    - sparkyfitness: run the Better Auth migration during the update [@MickLesk](https://github.com/MickLesk) ([#17318](https://github.com/community-scripts/ProxmoxVE/pull/17318))
+    - poznote: follow init.sh into docker/ [@MickLesk](https://github.com/MickLesk) ([#17316](https://github.com/community-scripts/ProxmoxVE/pull/17316))
+
+  - #### ✨ New Features
+
+    - romm: make the library paths follow ROMM_BASE_PATH [@MickLesk](https://github.com/MickLesk) ([#17279](https://github.com/community-scripts/ProxmoxVE/pull/17279))
+    - Debian-VM: Refactor | Support Debian 11, 12, 13 [@MickLesk](https://github.com/MickLesk) ([#17325](https://github.com/community-scripts/ProxmoxVE/pull/17325))
+
+### 💾 Core
+
+  - Ask before replacing a cached image that no longer matches [@MickLesk](https://github.com/MickLesk) ([core#44](https://github.com/community-scripts/core/pull/44))
+
+## 2026-09-16
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Immich: Pin to v3.2.2 [@vhsdream](https://github.com/vhsdream) ([#17307](https://github.com/community-scripts/ProxmoxVE/pull/17307))
+    - Dispatcharr: Bump to 4G RAM [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17302](https://github.com/community-scripts/ProxmoxVE/pull/17302))
+    - navidrome: repair root-owned data folders left by 0.61.x [@MickLesk](https://github.com/MickLesk) ([#17275](https://github.com/community-scripts/ProxmoxVE/pull/17275))
+    - tor-snowflake: read the Go version from the module root [@MickLesk](https://github.com/MickLesk) ([#17276](https://github.com/community-scripts/ProxmoxVE/pull/17276))
+    - docmost: stop corepack asking for confirmation during the build [@MickLesk](https://github.com/MickLesk) ([#17282](https://github.com/community-scripts/ProxmoxVE/pull/17282))
+
+  - #### ✨ New Features
+
+    - Refactor: TrueNAS VM (core / improve functions / performance) [@MickLesk](https://github.com/MickLesk) ([#17277](https://github.com/community-scripts/ProxmoxVE/pull/17277))
+    - Frigate: Bump to 0.18.0 [@MickLesk](https://github.com/MickLesk) ([#17273](https://github.com/community-scripts/ProxmoxVE/pull/17273))
+    - Refactor: HomeAssistant-OS (core / improve functions / performance) [@MickLesk](https://github.com/MickLesk) ([#17281](https://github.com/community-scripts/ProxmoxVE/pull/17281))
+
+### 💾 Core
+
+  - Read the IGC version compute-runtime pins, instead of taking the newest [@MickLesk](https://github.com/MickLesk) ([core#43](https://github.com/community-scripts/core/pull/43))
+- Install the Intel driver dependency before the .deb that needs it [@MickLesk](https://github.com/MickLesk) ([core#42](https://github.com/community-scripts/core/pull/42))
+
+### 📚 Documentation
+
+  - pocketbase-bot: accept the var_ names and two missing fields [@MickLesk](https://github.com/MickLesk) ([#17305](https://github.com/community-scripts/ProxmoxVE/pull/17305))
+
+## 2026-09-15
+
+### 🆕 New Scripts
+
+  - valhalla ([#17231](https://github.com/community-scripts/ProxmoxVE/pull/17231))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - borg-ui: missing dependency `sshpass` [@christian-forgacs](https://github.com/christian-forgacs) ([#17286](https://github.com/community-scripts/ProxmoxVE/pull/17286))
+    - tracearr: copy packages/emails into the deploy tree [@connorgallopo](https://github.com/connorgallopo) ([#17268](https://github.com/community-scripts/ProxmoxVE/pull/17268))
+    - Immich: Pin to v3.2.1 [@vhsdream](https://github.com/vhsdream) ([#17264](https://github.com/community-scripts/ProxmoxVE/pull/17264))
+
+### 💾 Core
+
+  - Add vm_extract_image, which two VM scripts already call [@MickLesk](https://github.com/MickLesk) ([core#40](https://github.com/community-scripts/core/pull/40))
+- Releases: rank releases on their numbers, not on sort -V over the raw tag [@MickLesk](https://github.com/MickLesk) ([core#39](https://github.com/community-scripts/core/pull/39))
+
+### 🧰 Tools
+
+  - #### 🔧 Refactor
+
+    - Refactor: monitor-all (decide on flag values, not on key presence) [@MickLesk](https://github.com/MickLesk) ([#17261](https://github.com/community-scripts/ProxmoxVE/pull/17261))
+
+## 2026-09-14
+
+### 🆕 New Scripts
+
+  - Borg-UI ([#17258](https://github.com/community-scripts/ProxmoxVE/pull/17258))
+
+### 🚀 Updated Scripts
+
+  - SparkyFitness: substitute NGINX_RATE_LIMIT in nginx config [@RafBorrelli](https://github.com/RafBorrelli) ([#17256](https://github.com/community-scripts/ProxmoxVE/pull/17256))
+
+  - #### 🐞 Bug Fixes
+
+    - spliit: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17250](https://github.com/community-scripts/ProxmoxVE/pull/17250))
+
+## 2026-09-13
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Downgrade iobroker to Node 24 [@Copilot](https://github.com/Copilot) ([#17229](https://github.com/community-scripts/ProxmoxVE/pull/17229))
+
+### 💾 Core
+
+  - Pick the highest release version, not the newest published one [@MickLesk](https://github.com/MickLesk) ([core#38](https://github.com/community-scripts/core/pull/38))
+
+## 2026-09-12
+
+### 🆕 New Scripts
+
+  - Elasticsearch ([#17188](https://github.com/community-scripts/ProxmoxVE/pull/17188))
+- Hammer ([#17189](https://github.com/community-scripts/ProxmoxVE/pull/17189))
+- gotenberg ([#17205](https://github.com/community-scripts/ProxmoxVE/pull/17205))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(dispatcharr): add comskip installation and build dependencies [@eXistC](https://github.com/eXistC) ([#16224](https://github.com/community-scripts/ProxmoxVE/pull/16224))
+    - poznote: serve from src/public docroot [@MickLesk](https://github.com/MickLesk) ([#17187](https://github.com/community-scripts/ProxmoxVE/pull/17187))
+    - calibre-web: use calibreweb release identifier to avoid version file collision [@MickLesk](https://github.com/MickLesk) ([#17186](https://github.com/community-scripts/ProxmoxVE/pull/17186))
+
+  - #### ✨ New Features
+
+    - Docker VM: Feature Bump - Refactor script for improved functionality [@MickLesk](https://github.com/MickLesk) ([#17216](https://github.com/community-scripts/ProxmoxVE/pull/17216))
+    - feat(jitsi-meet): optional public setup (FQDN, Let's Encrypt, NAT, secure domain) [@klanghans](https://github.com/klanghans) ([#17132](https://github.com/community-scripts/ProxmoxVE/pull/17132))
+
+  - #### 🔧 Refactor
+
+    - Paperless-NGX: add --no-sync to uv run services [@MickLesk](https://github.com/MickLesk) ([#17210](https://github.com/community-scripts/ProxmoxVE/pull/17210))
+
+### 💾 Core
+
+  - VM's: show the selected CPU model instead of doubling it [@MickLesk](https://github.com/MickLesk) ([core#37](https://github.com/community-scripts/core/pull/37))
+- Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#36](https://github.com/community-scripts/core/pull/36))
+
+## 2026-09-11
+
+### 🆕 New Scripts
+
+  - Lemonade-Server ([#17190](https://github.com/community-scripts/ProxmoxVE/pull/17190))
+- OneTimeSecret ([#17097](https://github.com/community-scripts/ProxmoxVE/pull/17097))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - update authentik to 2026.8.2 [@thieneret](https://github.com/thieneret) ([#17198](https://github.com/community-scripts/ProxmoxVE/pull/17198))
+    - passwordpusher: restore data before running migrations [@MickLesk](https://github.com/MickLesk) ([#17141](https://github.com/community-scripts/ProxmoxVE/pull/17141))
+    - paperclip: install the rust toolchain needed by the runner build [@MickLesk](https://github.com/MickLesk) ([#17142](https://github.com/community-scripts/ProxmoxVE/pull/17142))
+    - homepage: run next directly instead of through pnpm [@MickLesk](https://github.com/MickLesk) ([#17155](https://github.com/community-scripts/ProxmoxVE/pull/17155))
+    - changedetection: fix: pin browserless [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17163](https://github.com/community-scripts/ProxmoxVE/pull/17163))
+
+### 💾 Core
+
+  - #### 🐞 Bug Fixes
+
+    - core.func: fall back to a usable HOME when the shell has none [@MickLesk](https://github.com/MickLesk) ([#17154](https://github.com/community-scripts/ProxmoxVE/pull/17154))
+
+### 🧰 Tools
+
+  - Dockhand ([#17191](https://github.com/community-scripts/ProxmoxVE/pull/17191))
+
+  - #### 🐞 Bug Fixes
+
+    - update-apps: rewrite the retired Gitea base in every container before updating it [@MickLesk](https://github.com/MickLesk) ([#17156](https://github.com/community-scripts/ProxmoxVE/pull/17156))
+
+  - #### 🔧 Refactor
+
+    - Rename lxc-delete.sh to guest-delete.sh [@MickLesk](https://github.com/MickLesk) ([#17152](https://github.com/community-scripts/ProxmoxVE/pull/17152))
+
+### 📚 Documentation
+
+  - issue template: add PVE release, execution context and phase; refresh distro list / pve versions [@MickLesk](https://github.com/MickLesk) ([#17160](https://github.com/community-scripts/ProxmoxVE/pull/17160))
@@ -46,7 +46,7 @@ function update_script() {
    $STD uv venv /opt/apprise/.venv
    $STD uv pip install -r requirements.txt gunicorn supervisor -p /opt/apprise/.venv/bin/python
    ln -sf /opt/apprise/.venv/bin/supervisord /opt/apprise/.venv/bin/gunicorn /usr/local/bin/
-    cp -fr apprise_api/static/. /usr/share/nginx/html/s/
+    cp -fr apprise_api/static /usr/share/nginx/html/s/
    mv apprise_api/ webapp
    touch /etc/nginx/server-override.conf
    touch /etc/nginx/location-override.conf
@@ -47,7 +47,7 @@ function update_script() {
  RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
  setup_yq

-  AUTHENTIK_VERSION="version/2026.8.4"
+  AUTHENTIK_VERSION="version/2026.8.3"
  # Source: https://github.com/goauthentik/fips/blob/main/Makefile#L26
  XMLSEC_VERSION="1.3.12"

@@ -9,8 +9,8 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 APP="ByteStash"
 var_tags="${var_tags:-code}"
 var_disk="${var_disk:-4}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-1024}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
@@ -35,8 +35,9 @@ function update_script() {
    systemctl stop bytestash-backend bytestash-frontend
    msg_ok "Services Stopped"

+    [[ -d /opt/bytestash/data ]] && create_backup /opt/bytestash/data
    [[ -d /opt/data ]] && create_backup /opt/data
-    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="data" fetch_and_deploy_gh_release "bytestash" "jordan-dalby/ByteStash" "tarball"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "bytestash" "jordan-dalby/ByteStash" "tarball"
    restore_backup

    msg_info "Configuring ByteStash"
@@ -49,6 +50,7 @@ function update_script() {
    msg_info "Starting Services"
    systemctl start bytestash-backend bytestash-frontend
    msg_ok "Started Services"
+
    msg_ok "Updated successfully!"
  fi
  exit
@@ -38,18 +38,11 @@ update_deb_based() {
    exit
  fi

-  cleanup_old_repo_files "caddy"
  msg_info "Updating Caddy LXC"
  apt_update_safe
  $STD apt upgrade -y
  msg_ok "Updated Caddy LXC"

-  [[ -f ~/.caddy ]] || dpkg-query -W -f='${Version}' caddy >~/.caddy 2>/dev/null || true
-  if check_for_gh_release "caddy" "caddyserver/caddy"; then
-    DPKG_FORCE_CONFOLD=1 fetch_and_deploy_gh_release "caddy" "caddyserver/caddy" "binary" "latest" "/opt/caddy" "caddy_*_linux_$(arch_resolve).deb"
-    systemctl restart caddy
-  fi
-
  if command -v xcaddy >/dev/null 2>&1; then
    if check_for_gh_release "xcaddy" "caddyserver/xcaddy"; then
      setup_go
@@ -1,60 +0,0 @@
-#!/usr/bin/env bash
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: Jelcoo
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://calagopus.com/
-
-APP="Calagopus"
-var_tags="${var_tags:-panel;game-server}"
-var_cpu="${var_cpu:-4}"
-var_ram="${var_ram:-4096}"
-var_disk="${var_disk:-40}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -f /usr/local/bin/calagopus-panel ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "calagopus-panel" "calagopus/panel"; then
-    msg_info "Stopping Service"
-    systemctl stop calagopus-panel
-    msg_ok "Stopped Service"
-
-    create_backup /etc/calagopus/.env /var/lib/calagopus
-
-    fetch_and_deploy_gh_release "calagopus-panel" "calagopus/panel" "singlefile" "latest" "/usr/local/bin" "panel-rs-aio-$(arch_resolve x86_64 aarch64)-linux"
-
-    restore_backup
-
-    msg_info "Starting Service"
-    systemctl start calagopus-panel
-    msg_ok "Started Service"
-    msg_ok "Updated Successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:8000${CL}"
@@ -30,14 +30,12 @@ function update_script() {
    msg_error "No ${APP} Installation Found!"
    exit
  fi
-  # Updates to 2026.10.0 finished without infra.js; run them again so it gets written
-  [[ -f /opt/cryptpad/config/infra.example.js && ! -f /opt/cryptpad/config/infra.js ]] && rm -f ~/.cryptpad
  if check_for_gh_release "cryptpad" "cryptpad/cryptpad"; then
    msg_info "Stopping Service"
    systemctl stop cryptpad
    msg_ok "Stopped Service"

-    create_backup /opt/cryptpad/config/config.js /opt/cryptpad/config/infra.js /opt/cryptpad/www/common/onlyoffice/dist
+    create_backup /opt/cryptpad/config/config.js /opt/cryptpad/www/common/onlyoffice/dist

    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="blob block customize data datastore onlyoffice-conf" fetch_and_deploy_gh_release "cryptpad" "cryptpad/cryptpad" "tarball"

@@ -47,30 +45,8 @@ function update_script() {
    cd /opt/cryptpad
    $STD npm ci --allow-git=all
    $STD npm run install:components
-    if [[ -d /opt/cryptpad/www/common/onlyoffice/dist ]]; then
-      $STD bash /opt/cryptpad/install-office.sh --accept-license
-    fi
-    if [[ ! -f /opt/cryptpad/config/infra.js ]]; then
-      # 2026.10.0 reads the network settings from infra.js and no longer derives the sandbox origin
-      LOCAL_IP="$LOCAL_IP" node - <<'EOF'
-const c = require("/opt/cryptpad/config/config.js");
-const i = require("/opt/cryptpad/config/infra.example.js");
-const port = c.httpPort || i.public.httpPort;
-const safePort = c.httpSafePort || port + 1;
-const origin = (c.httpUnsafeOrigin || `http://${process.env.LOCAL_IP}:${port}`).replace(/\/+$/, "");
-const sandbox = new URL(origin);
-sandbox.port = safePort;
-Object.assign(i.public, {
-  origin,
-  sandboxOrigin: (c.httpSafeOrigin || sandbox.origin).replace(/\/+$/, ""),
-  httpHost: c.httpAddress || (c.httpUnsafeOrigin ? i.public.httpHost : "0.0.0.0"),
-  httpPort: port,
-  httpSafePort: safePort,
-  externalWebsocketURL: c.externalWebsocketURL,
-  fileHost: c.fileHost,
-});
-require("fs").writeFileSync("/opt/cryptpad/config/infra.js", "module.exports = " + JSON.stringify(i, null, 4) + ";\n");
-EOF
+    if [ -f "/opt/cryptpad/install-onlyoffice.sh" ]; then
+      $STD bash /opt/cryptpad/install-onlyoffice.sh --accept-license
    fi
    $STD npm run build
    msg_ok "Updated CryptaPad"
@@ -1,69 +0,0 @@
-#!/usr/bin/env bash
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/henriquesebastiao/downtify
-
-APP="Downtify"
-var_tags="${var_tags:-music;downloader}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-1024}"
-var_disk="${var_disk:-8}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/downtify ]]; then
-    msg_error "No Downtify Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "downtify" "henriquesebastiao/downtify"; then
-    msg_info "Stopping Downtify"
-    systemctl stop downtify
-    msg_ok "Stopped Downtify"
-
-    PYTHON_VERSION="3.14" setup_uv
-    NODE_VERSION="26" setup_nodejs
-    fetch_and_deploy_gh_release "deno" "denoland/deno" "prebuild" "latest" "/usr/local/bin" "deno-$(arch_resolve "x86_64" "aarch64")-unknown-linux-gnu.zip"
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "downtify" "henriquesebastiao/downtify" "tarball"
-
-    msg_info "Building Downtify"
-    cd /opt/downtify/frontend
-    $STD npm ci
-    $STD npm run build
-    rm -rf /opt/downtify/frontend/node_modules
-    cd /opt/downtify
-    $STD uv sync --frozen --no-dev --python 3.14
-    msg_ok "Built Downtify"
-
-    msg_info "Starting Downtify"
-    systemctl start downtify
-    msg_ok "Started Downtify"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:8000${CL}"
-echo -e "${INFO}${YW}Sign in as admin / downtify and change the password right away${CL}"
@@ -91,7 +91,6 @@ User=root
 WorkingDirectory=/opt/droppedneedle/backend
 Environment=ROOT_APP_DIR=/opt/droppedneedle/backend
 Environment=PORT=8688
-Environment=COMMIT_TAG=v$(<~/.droppedneedle)
 # Environment=SLSKD_DOWNLOADS_PATH=<path-to-slskd-downloads>
 ExecStart=/opt/droppedneedle/venv/bin/python -m maintenance.automatic_upgrade --start-target
 Restart=on-failure
@@ -107,11 +106,6 @@ EOF
        sed -i '\|=8688$|a# Environment=SLSKD_DOWNLOADS_PATH=<path-to-slskd-downloads>' /etc/systemd/system/droppedneedle.service
      fi
      sed -i 's|^ExecStart=.*|ExecStart=/opt/droppedneedle/venv/bin/python -m maintenance.automatic_upgrade --start-target|' /etc/systemd/system/droppedneedle.service
-      if grep -q '^Environment=COMMIT_TAG=' /etc/systemd/system/droppedneedle.service; then
-        sed -i "s|^Environment=COMMIT_TAG=.*|Environment=COMMIT_TAG=v$(<~/.droppedneedle)|" /etc/systemd/system/droppedneedle.service
-      else
-        sed -i "\|=8688$|a Environment=COMMIT_TAG=v$(<~/.droppedneedle)" /etc/systemd/system/droppedneedle.service
-      fi
    fi

    systemctl daemon-reload
@@ -35,12 +35,6 @@ function update_script() {
    msg_error "You must upgrade your LXC to Debian Trixie before updating."
    exit
  fi
-  # FlareSolverr hands LANG to Chrome as Accept-Language, which needs a tag like en-US, not a locale (#17987)
-  if ! grep -q '^Environment="LANG=' /etc/systemd/system/flaresolverr.service; then
-    sed -i '/^Environment="CAPTCHA_SOLVER=/a Environment="LANG=en-US"' /etc/systemd/system/flaresolverr.service
-    systemctl daemon-reload
-    systemctl restart flaresolverr
-  fi
  if check_for_gh_release "flaresolverr" "FlareSolverr/FlareSolverr"; then
    msg_info "Stopping service"
    systemctl stop flaresolverr
@@ -10,7 +10,7 @@ APP="GeoPulse"
 var_tags="${var_tags:-location;tracking;gps}"
 var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-1024}"
-var_disk="${var_disk:-12}"
+var_disk="${var_disk:-8}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
@@ -32,16 +32,6 @@ function update_script() {
  fi

  if check_for_gh_release "geopulse-backend" "tess1o/geopulse"; then
-    msg_info "Backing Up Database"
-    mkdir -p /var/lib/geopulse/dumps
-    DB_NAME="$(grep -oP '^GEOPULSE_POSTGRES_DB=\K.*' /etc/geopulse/geopulse.env 2>/dev/null)"
-    DB_NAME="${DB_NAME:-geopulse}"
-    if sudo -u postgres pg_dump -Fc "${DB_NAME}" >"/var/lib/geopulse/dumps/${DB_NAME}-pre-update-$(date +%Y%m%d%H%M%S).dump" 2>/dev/null; then
-      msg_ok "Backed Up Database"
-    else
-      msg_warn "Database backup failed, continuing anyway"
-    fi
-
    msg_info "Stopping Service"
    systemctl stop geopulse-backend
    msg_ok "Stopped Service"
@@ -61,48 +51,7 @@ function update_script() {
    fi

    fetch_and_deploy_gh_release "geopulse-backend" "tess1o/geopulse" "singlefile" "latest" "/opt/geopulse/backend" "${BINARY_PATTERN}"
-    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="avatars" fetch_and_deploy_gh_release "geopulse-frontend" "tess1o/geopulse" "prebuild" "latest" "/var/www/geopulse" "geopulse-frontend-*.tar.gz"
-
-    if [[ -f /etc/geopulse/geopulse.env ]] && grep -q "GEOPULSE_JWT_" /etc/geopulse/geopulse.env 2>/dev/null; then
-      msg_info "Removing Unused JWT Keys"
-      sed -i '/^GEOPULSE_JWT_PRIVATE_KEY_LOCATION=/d;/^GEOPULSE_JWT_PUBLIC_KEY_LOCATION=/d' /etc/geopulse/geopulse.env
-      rm -f /opt/geopulse/keys/jwt-private-key.pem /opt/geopulse/keys/jwt-public-key.pem
-      msg_ok "Removed Unused JWT Keys"
-    fi
-
-    if [[ -f /etc/nginx/sites-available/geopulse.conf ]] && ! grep -q '\.mjs\$' /etc/nginx/sites-available/geopulse.conf; then
-      msg_info "Configuring Nginx for .mjs Assets"
-      cp /etc/nginx/sites-available/geopulse.conf /etc/nginx/sites-available/geopulse.conf.pre-mjs.bak
-
-      ANCHOR_LINE="$(grep -n '    add_header Cache-Control "public, max-age=31536000";' /etc/nginx/sites-available/geopulse.conf.pre-mjs.bak | head -1 | cut -d: -f1)"
-
-      if [[ -n "$ANCHOR_LINE" ]]; then
-        INSERT_LINE=$((ANCHOR_LINE + 1))
-        {
-          head -n "$INSERT_LINE" /etc/nginx/sites-available/geopulse.conf.pre-mjs.bak
-          cat <<'MJSBLOCK'
-
-    location ~* ^/(?!osm/).*\.mjs$ {
-        types {
-            application/javascript mjs;
-        }
-        expires 1y;
-        add_header Cache-Control "public, max-age=31536000";
-    }
-MJSBLOCK
-          tail -n "+$((INSERT_LINE + 1))" /etc/nginx/sites-available/geopulse.conf.pre-mjs.bak
-        } >/etc/nginx/sites-available/geopulse.conf
-      fi
-
-      if [[ -n "$ANCHOR_LINE" ]] && grep -q '\.mjs\$' /etc/nginx/sites-available/geopulse.conf && nginx -t >/dev/null 2>&1; then
-        systemctl reload nginx
-        msg_ok "Configured Nginx for .mjs Assets"
-      else
-        cp /etc/nginx/sites-available/geopulse.conf.pre-mjs.bak /etc/nginx/sites-available/geopulse.conf
-        nginx -t >/dev/null 2>&1 && systemctl reload nginx
-        msg_warn "Could not automatically add the .mjs nginx block (customized config?) - add it manually, see the GeoPulse 2.0.0 upgrade notes"
-      fi
-    fi
+    fetch_and_deploy_gh_release "geopulse-frontend" "tess1o/geopulse" "prebuild" "latest" "/var/www/geopulse" "geopulse-frontend-*.tar.gz"

    msg_info "Starting Service"
    systemctl start geopulse-backend
@@ -32,7 +32,7 @@ function update_script() {
    exit
  fi

-  if check_for_gh_release "gluetun" "passteque/gluetun"; then
+  if check_for_gh_release "gluetun" "qdm12/gluetun"; then
    msg_info "Stopping Service"
    systemctl stop gluetun
    msg_ok "Stopped Service"
@@ -31,7 +31,16 @@ function update_script() {
    exit
  fi

-  confirm_external_installer "https://hermes-agent.nousresearch.com/" "hermes update (https://hermes-agent.nousresearch.com/)"
+  msg_warn "WARNING: This script will run an external installer from a third-party source (https://hermes-agent.nousresearch.com/)."
+  msg_warn "The following code is NOT maintained or audited by our repository."
+  msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+  msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  hermes update (https://hermes-agent.nousresearch.com/)"
+  echo
+  read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+  if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+    msg_error "Aborted by user. No changes have been made."
+    exit 10
+  fi

  msg_info "Stopping Services"
  systemctl stop hermes-dashboard
@@ -65,17 +65,19 @@ EOF
    msg_ok "Installed/upgraded Testing repo packages"
  fi

-  if ! command -v mise >/dev/null 2>&1; then
-    MISE_ARCH="x64"
-    [[ "$(arch_resolve)" == "arm64" ]] && MISE_ARCH="arm64"
-    fetch_and_deploy_gh_release "mise" "jdx/mise" "singlefile" "latest" "/usr/local/bin" "mise-v*-linux-${MISE_ARCH}"
+  if [[ ! -f /etc/apt/sources.list.d/mise.list ]]; then
+    msg_info "Installing Mise"
+    curl -fSs https://mise.jdx.dev/gpg-key.pub | tee /etc/apt/keyrings/mise-archive-keyring.pub 1>/dev/null
+    echo "deb [signed-by=/etc/apt/keyrings/mise-archive-keyring.pub arch=$(arch_resolve)] https://mise.jdx.dev/deb stable main" >/etc/apt/sources.list.d/mise.list
+    ensure_dependencies mise
+    msg_ok "Installed Mise"
  fi

  STAGING_DIR=/opt/staging
  BASE_DIR=${STAGING_DIR}/base-images
  SOURCE_DIR=${STAGING_DIR}/image-source
  cd /tmp
-  RELEASE="v3.3.5"
+  RELEASE="v3.3.0"
  if [[ -f ~/.intel_version ]]; then
    INTEL_SRC="https://raw.githubusercontent.com/immich-app/immich/${RELEASE}/machine-learning"
    curl -fsSL "${INTEL_SRC}/scripts/install-intel-runtime.sh" -o ./intel-runtime 2>/dev/null ||
@@ -100,33 +102,16 @@ EOF
      msg_ok "Updated Intel OpenVINO dependencies"
    fi
  fi
-  # Without the revision file the refresh was skipped and sharp failed on an old libvips (#17914).
-  [[ -f ~/.immich_library_revisions ]] || msg_warn "No record of the compiled image-processing libraries, rebuilding all of them"
-  for lib in imagemagick jpegli libheif libjxl libraw libvips; do
-    grep -q "^${lib}:" ~/.immich_library_revisions 2>/dev/null || echo "${lib}: unknown" >>~/.immich_library_revisions
-  done
-  [[ -d "$BASE_DIR/.git" ]] || $STD git clone -b main https://github.com/immich-app/base-images "$BASE_DIR"
-  libraries=("libjxl" "jpegli" "libheif" "libraw" "imagemagick" "libvips")
-  cd "$BASE_DIR"
-  msg_warn "Checking for updates to custom image-processing libraries (recompile time: 2-15min per library)"
-  ensure_dependencies liblcms2-dev libjpeg62-turbo-dev libspng-dev libexif-dev libopenjp2-7-dev
-  $STD git pull
-  for library in "${libraries[@]}"; do
-    compile_"$library"
-  done
-  msg_ok "Image-processing libraries up to date"
-
-  # 3.3.0 reads geodata/countryInfo.txt; the update before #17823 saved it into app/ instead.
-  if [[ -d /opt/immich/geodata && ! -s /opt/immich/geodata/countryInfo.txt ]]; then
-    msg_info "Restoring geodata/countryInfo.txt"
-    if [[ -s /opt/immich/app/countryInfo.txt ]]; then
-      mv /opt/immich/app/countryInfo.txt /opt/immich/geodata/countryInfo.txt
-    else
-      curl_with_retry "https://download.geonames.org/export/dump/countryInfo.txt" /opt/immich/geodata/countryInfo.txt
-    fi
-    chown immich:immich /opt/immich/geodata/countryInfo.txt
-    systemctl restart immich-web
-    msg_ok "Restored geodata/countryInfo.txt"
+  if [[ -f ~/.immich_library_revisions ]]; then
+    libraries=("libjxl" "jpegli" "libheif" "libraw" "imagemagick" "libvips")
+    cd "$BASE_DIR"
+    msg_warn "Checking for updates to custom image-processing libraries (recompile time: 2-15min per library)"
+    ensure_dependencies liblcms2-dev libjpeg62-turbo-dev libspng-dev libexif-dev
+    $STD git pull
+    for library in "${libraries[@]}"; do
+      compile_"$library"
+    done
+    msg_ok "Image-processing libraries up to date"
  fi

  if check_for_gh_release "Immich" "immich-app/immich" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
@@ -504,7 +489,8 @@ function compile_jpegli() {
 function compile_libheif() {
  SOURCE=${SOURCE_DIR}/libheif
  ensure_dependencies libaom-dev
-  LIBHEIF_REVISION="$(jq -cr '.revision' "$BASE_DIR"/server/sources/libheif.json)"
+  LIBHEIF_REVISION="ac1cb05c39008f01525c991ff8b88f84ddf70fd2"
+  # : "${LIBHEIF_REVISION:=$(jq -cr '.revision' "$BASE_DIR"/server/sources/libheif.json)}"
  if [[ "${update:-}" ]] || [[ "$LIBHEIF_REVISION" != "$(grep 'libheif' ~/.immich_library_revisions | awk '{print $2}')" ]]; then
    msg_info "Recompiling libheif"
    [[ -d "$SOURCE" ]] && rm -rf "$SOURCE"
@@ -579,8 +565,7 @@ function compile_imagemagick() {
 function compile_libvips() {
  SOURCE=$SOURCE_DIR/libvips
  LIBVIPS_REVISION="$(jq -cr '.revision' "$BASE_DIR"/server/sources/libvips.json)"
-  if [[ "$LIBVIPS_REVISION" != "$(grep 'libvips' ~/.immich_library_revisions | awk '{print $2}')" ]] ||
-    [[ "$(vips -l foreign 2>/dev/null)" != *jp2kload* ]]; then
+  if [[ "$LIBVIPS_REVISION" != "$(grep 'libvips' ~/.immich_library_revisions | awk '{print $2}')" ]]; then
    msg_info "Recompiling libvips"
    [[ -d "$SOURCE" ]] && rm -rf "$SOURCE"
    $STD git clone https://github.com/libvips/libvips.git "$SOURCE"
@@ -31,36 +31,14 @@ function update_script() {
    exit
  fi

-  if ! grep -qE "^ID=(ubuntu|debian)$" /etc/os-release; then
-    msg_error "Unsupported OS. InvenTree requires Ubuntu or Debian."
+  if ! grep -qE "^ID=(ubuntu)$" /etc/os-release; then
+    msg_error "Unsupported OS. InvenTree requires Ubuntu (20.04/22.04/24.04)."
    exit
  fi

-  # dl.packager.io is frozen at 1.5.1 and its SHA1-bound key fails on Debian 13;
-  # go.packager.io only carries current builds for these releases
-  if grep -qs "dl.packager.io" /etc/apt/sources.list.d/inventree*; then
-    case "$(get_os_info id)/$(get_os_info version)" in
-    ubuntu/24.04 | ubuntu/26.04 | debian/13)
-      msg_info "Migrating InvenTree Repository"
-      setup_deb822_repo \
-        "inventree" \
-        "https://go.packager.io/srv/deb/inventree/InvenTree/gpg-key.asc" \
-        "https://go.packager.io/srv/deb/inventree/InvenTree/stable/$(get_os_info id)" \
-        "$(get_os_info version)" \
-        "main"
-      msg_ok "Migrated InvenTree Repository"
-      ;;
-    *)
-      msg_warn "InvenTree only publishes updates for Ubuntu 24.04/26.04 and Debian 13; staying on the frozen repository"
-      ;;
-    esac
-  fi
-
  msg_info "Updating InvenTree"
  apt_update_safe
-  # postinst loops forever unless its parent chain reaches PID 1 (not the case under pct exec)
-  $STD systemd-run --wait --pipe --quiet --collect --setenv=DEBIAN_FRONTEND=noninteractive \
-    apt-get install --only-upgrade -y inventree
+  $STD apt install --only-upgrade inventree -y
  msg_ok "Updated InvenTree"
  msg_ok "Updated successfully!"
  exit
@@ -31,14 +31,6 @@ function update_script() {
    exit
  fi

-  if [[ ! -f /etc/cron.d/invoiceshelf ]]; then
-    msg_info "Adding the Laravel scheduler"
-    cat <<'EOF' >/etc/cron.d/invoiceshelf
-* * * * * www-data cd /opt/invoiceshelf && php artisan schedule:run >> /dev/null 2>&1
-EOF
-    msg_ok "Added the Laravel scheduler"
-  fi
-
  if check_for_gh_release "invoiceshelf" "InvoiceShelf/InvoiceShelf"; then
    msg_info "Stopping Services"
    systemctl stop caddy
@@ -91,7 +91,7 @@ EOF
    sed -i "s/^SERVER_VERSION=.*$/SERVER_VERSION=${CHECK_UPDATE_RELEASE#v}/" /etc/karakeep/karakeep.env
    # Node 24.19.x crashes better-sqlite3 on cleanup (karakeep-app/karakeep#2989); stay on 22 LTS until upstream reverts.
    MODULE_VERSION="$(jq -r '.packageManager | split("@")[1]' /opt/karakeep/package.json)"
-    NODE_VERSION="24" NODE_MODULE="corepack,pnpm@${MODULE_VERSION}" setup_nodejs
+    NODE_VERSION="22" NODE_MODULE="corepack,pnpm@${MODULE_VERSION}" setup_nodejs
    setup_meilisearch

    msg_info "Updating Karakeep"
@@ -62,7 +62,16 @@ function update_script() {
    msg_info "Updating Kasm"
    cd /tmp

-    confirm_external_installer "https://www.kasmweb.com/" "upgrade.sh inside tar.gz $KASM_URL"
+    msg_warn "WARNING: This script will run an external installer from a third-party source (https://www.kasmweb.com/)."
+    msg_warn "The following code is NOT maintained or audited by our repository."
+    msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+    msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  upgrade.sh inside tar.gz $KASM_URL"
+    echo
+    read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+    if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+      msg_error "Aborted by user. No changes have been made."
+      exit 10
+    fi
    curl_download "/tmp/kasm_release_${KASM_VERSION}.tar.gz" "$KASM_URL"
    tar -xf "kasm_release_${KASM_VERSION}.tar.gz"
    chmod +x /tmp/kasm_release/install.sh
@@ -1,56 +0,0 @@
-#!/usr/bin/env bash
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/Listenarrs/Listenarr
-
-APP="Listenarr"
-var_tags="${var_tags:-arr;audiobook}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
-var_disk="${var_disk:-8}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-no}" # upstream publishes a linux-x64 build only
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/listenarr ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if GH_INCLUDE_PRERELEASE=1 check_for_gh_release "listenarr" "Listenarrs/Listenarr"; then
-    msg_info "Stopping Listenarr"
-    systemctl stop listenarr
-    msg_ok "Stopped Listenarr"
-
-    GH_INCLUDE_PRERELEASE=1 CLEAN_INSTALL=1 fetch_and_deploy_gh_release "listenarr" "Listenarrs/Listenarr" "prebuild" "latest" "/opt/listenarr" "listenarr-*-linux-x64.zip"
-
-    msg_info "Starting Listenarr"
-    systemctl start listenarr
-    msg_ok "Started Listenarr"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:4545${CL}"
@@ -37,15 +37,6 @@ function update_script() {
    exit
  fi

-  # Older installs have no CPU pin; on a host with a GPU but no driver in the
-  # container every model then ends in "backend not found".
-  if ! grep -q '^LOCALAI_FORCE_META_BACKEND_CAPABILITY=' /opt/localai.env 2>/dev/null &&
-    ! ldconfig -p 2>/dev/null | grep -qE 'libcuda[.]so|libamdhip64[.]so|libze_intel_gpu[.]so|libze_loader[.]so'; then
-    echo "LOCALAI_FORCE_META_BACKEND_CAPABILITY=default" >>/opt/localai.env
-    systemctl restart localai
-    msg_ok "Pinned LocalAI to the CPU backends (no GPU runtime in the container)"
-  fi
-
  if check_for_gh_release "localai" "mudler/LocalAI"; then
    msg_info "Stopping Service"
    systemctl stop localai
@@ -58,18 +58,6 @@ exec uv run mealie
 STARTEOF
    fi
    chmod +x /opt/mealie/start.sh
-    if ! grep -q "REVERSE_PROXY_AUTH_ENABLED" /opt/mealie/mealie.env; then
-      cat <<EOF >>/opt/mealie/mealie.env
-
-# Reverse proxy auth (Mealie v3.29.0+). Disabled by default.
-# To enable: set REVERSE_PROXY_AUTH_ENABLED=true, set a secret, then restart mealie.
-# REVERSE_PROXY_AUTH_ENABLED=false
-# REVERSE_PROXY_AUTH_HEADER=X-Forwarded-User
-# REVERSE_PROXY_AUTH_SIGNUP_ENABLED=false
-# REVERSE_PROXY_AUTH_SECRET=
-# REVERSE_PROXY_AUTH_SECRET_HEADER=X-Mealie-Reverse-Proxy-Secret
-EOF
-    fi
    msg_ok "Configuration restored"

    msg_info "Installing Python Dependencies with uv"
@@ -1,61 +0,0 @@
-#!/usr/bin/env bash
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/autobrr/netronome
-
-APP="Netronome"
-var_tags="${var_tags:-network;monitoring;speedtest}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-512}"
-var_disk="${var_disk:-4}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -f /usr/bin/netronome ]]; then
-    msg_error "No Netronome Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "netronome" "autobrr/netronome" "" "" "v"; then
-    msg_info "Stopping Netronome"
-    systemctl stop netronome
-    msg_ok "Stopped Netronome"
-
-    fetch_and_deploy_gh_release "netronome" "autobrr/netronome" "binary" "latest" "" "netronome_*_linux_$(arch_resolve).deb" "v"
-
-    msg_info "Starting Netronome"
-    systemctl start netronome
-    msg_ok "Started Netronome"
-    msg_ok "Updated successfully!"
-  fi
-
-  if check_for_gh_release "librespeed-cli" "librespeed/speedtest-cli"; then
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "librespeed-cli" "librespeed/speedtest-cli" "prebuild" "latest" "/opt/librespeed-cli" "librespeed-cli_*_linux_$(arch_resolve).tar.gz"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:7575${CL}"
-echo -e "${INFO}${YW}Register your account right away: the registration page accepts only the first account, and until then anyone who reaches the port can claim it.${CL}"
@@ -1,68 +0,0 @@
-#!/usr/bin/env bash
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/norish-recipes/norish
-
-APP="Norish"
-var_tags="${var_tags:-recipes;meal-planning}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-6144}"
-var_disk="${var_disk:-12}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/norish ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "norish" "norish-recipes/norish"; then
-    msg_info "Stopping Norish"
-    systemctl stop norish obscura
-    msg_ok "Stopped Norish"
-
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "norish" "norish-recipes/norish" "tarball"
-    NODE_VERSION="22" NODE_MODULE="pnpm@$(jq -r '.packageManager | split("@")[1]' /opt/norish/package.json)" setup_nodejs
-    PYTHON_VERSION="3.14" setup_uv
-    fetch_and_deploy_gh_release "obscura" "h4ckf0r0day/obscura" "prebuild" "v$(sed -n 's/^OBSCURA_VERSION=//p' /opt/norish/docker/obscura/pin.env)" "/opt/obscura" "obscura-$(arch_resolve "x86_64" "aarch64")-linux-stealth.tar.gz"
-    fetch_and_deploy_gh_release "yt-dlp" "yt-dlp/yt-dlp" "singlefile" "latest" "/usr/local/bin" "$(arch_resolve "yt-dlp_linux" "yt-dlp_linux_aarch64")"
-
-    msg_info "Building Norish"
-    cd /opt/norish
-    $STD pnpm install --frozen-lockfile --filter "@norish/web..." --filter norish
-    $STD uv sync --project /opt/norish/apps/parser-api --locked
-    NODE_ENV=production SKIP_ENV_VALIDATION=1 NEXT_TELEMETRY_DISABLED=1 $STD pnpm turbo run build --filter "@norish/web"
-    rm -rf /opt/norish/apps/web/.next/cache /opt/norish/apps/web/.next/standalone
-    msg_ok "Built Norish"
-
-    msg_info "Starting Norish"
-    systemctl start obscura norish
-    msg_ok "Started Norish"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"
@@ -25,10 +25,7 @@ function update_script() {
  check_container_storage
  check_container_resources

-  # Installs from before 16.9.0 keep their onedev.service; newer ones get onedev.server.service
-  SERVICE="onedev.server"
-  [[ -f /etc/systemd/system/onedev.service ]] && SERVICE="onedev"
-  if [[ ! -f "/etc/systemd/system/${SERVICE}.service" ]]; then
+  if [[ ! -f /etc/systemd/system/onedev.service ]]; then
    msg_error "No ${APP} Installation Found!"
    exit
  fi
@@ -37,12 +34,12 @@ function update_script() {
    JAVA_VERSION="21" setup_java

    msg_info "Stopping Service"
-    systemctl stop "$SERVICE"
+    systemctl stop onedev
    msg_ok "Stopped Service"

    msg_info "Updating OneDev"
    cd /opt
-    curl -fsSL "https://code.onedev.io/onedev/server/~sites/public/onedev-latest.tar.gz" -o onedev-latest.tar.gz
+    curl -fsSL "https://code.onedev.io/onedev/server/~site/onedev-latest.tar.gz" -o onedev-latest.tar.gz
    tar -xzf onedev-latest.tar.gz
    $STD /opt/onedev-latest/bin/upgrade.sh /opt/onedev
    rm -rf /opt/onedev-latest
@@ -51,7 +48,7 @@ function update_script() {
    msg_ok "Updated OneDev"

    msg_info "Starting Service"
-    systemctl start "$SERVICE"
+    systemctl start onedev
    msg_ok "Started Service"
    msg_ok "Updated successfully!"
    exit
@@ -1,68 +0,0 @@
-#!/usr/bin/env bash
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/DuarteSantos8/openGym
-
-APP="openGym"
-var_tags="${var_tags:-health;fitness}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
-var_disk="${var_disk:-4}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/opengym ]]; then
-    msg_error "No openGym Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "opengym" "DuarteSantos8/openGym" "" "" "v"; then
-    msg_info "Stopping openGym"
-    systemctl stop nginx opengym
-    msg_ok "Stopped openGym"
-
-    NODE_VERSION="22" setup_nodejs
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "opengym" "DuarteSantos8/openGym" "tarball" "latest" "/opt/opengym" "" "v"
-
-    msg_info "Building openGym"
-    cd /opt/opengym/api
-    $STD npm ci --omit=dev --omit=optional
-    cd /opt/opengym/frontend
-    $STD npm ci --ignore-scripts
-    $STD npm run build
-    rm -rf /opt/opengym/frontend/node_modules ~/.npm
-    msg_ok "Built openGym"
-
-    msg_info "Starting openGym"
-    systemctl start opengym nginx
-    msg_ok "Started openGym"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}${CL}"
-echo -e "${INFO}${YW}Sign-in is by password over plain HTTP. Create your profile right away: the first one becomes the admin.${CL}"
-echo -e "${INFO}${YW}For passkeys, serve it over HTTPS on a hostname through a reverse proxy, then set RP_ID and ORIGIN in /opt/opengym_data/.env and run systemctl restart opengym. Changing RP_ID later invalidates existing passkeys.${CL}"
@@ -49,13 +49,10 @@ function update_script() {

    msg_info "Installing uv-based Open-WebUI"
    PYTHON_VERSION="3.12" setup_uv
-    installed=0
-    for attempt in 1 2; do
-      $STD uv tool install --python 3.12 open-webui[all] && { installed=1; break; }
-      msg_warn "Open WebUI install attempt $attempt failed, retrying..."
-      sleep 10
+    for attempt in $(seq 1 3); do
+      $STD uv tool install --python 3.12 --constraint <(echo "numba>=0.60") open-webui[all] && break
+      [[ $attempt -lt 3 ]] && msg_warn "Open WebUI install attempt $attempt failed, retrying..." && sleep 10
    done
-    ((installed)) || $STD uv tool install --python 3.12 open-webui[all]
    msg_ok "Installed uv-based Open-WebUI"

    msg_info "Restoring data"
@@ -128,13 +125,10 @@ EOF
      OTEL_ARGS+=(--with "$pkg")
    done < <(uv pip list --python "$OWUI_PYTHON" --format freeze 2>/dev/null | grep -i '^opentelemetry-' | cut -d= -f1)
  fi
-  updated=0
-  for attempt in 1 2; do
-    $STD uv tool install --force --python 3.12 "${OTEL_ARGS[@]}" open-webui[all] && { updated=1; break; }
-    msg_warn "Open WebUI update attempt $attempt failed, retrying..."
-    sleep 10
+  for attempt in $(seq 1 3); do
+    $STD uv tool install --force --python 3.12 --constraint <(echo "numba>=0.60") "${OTEL_ARGS[@]}" open-webui[all] && break
+    [[ $attempt -lt 3 ]] && msg_warn "Open WebUI update attempt $attempt failed, retrying..." && sleep 10
  done
-  ((updated)) || $STD uv tool install --force --python 3.12 "${OTEL_ARGS[@]}" open-webui[all]
  systemctl restart open-webui
  msg_ok "Updated Open WebUI"
  msg_ok "Updated successfully!"
@@ -50,10 +50,7 @@ function update_script() {
    cd /opt/paperclip-ai
    export HUSKY=0
    export NODE_OPTIONS="--max-old-space-size=8192"
-    $STD pnpm install --frozen-lockfile || {
-      msg_warn "The lockfile of this release is out of date, resolving dependencies without it"
-      $STD pnpm install --no-frozen-lockfile
-    }
+    $STD pnpm install --frozen-lockfile
    $STD pnpm build
    unset NODE_OPTIONS
    msg_ok "Rebuilt Paperclip"
@@ -157,6 +157,8 @@ function update_script() {
            sed -i '$a\PAPERLESS_ARCHIVE_FILE_GENERATION=never' "$PAPERLESS_CONF"
          fi
        fi
+        [[ -n "$(sed -n '/^PAPERLESS_CONSUMER_IGNORE_PATTERNS=/p' "$PAPERLESS_CONF")" ]] &&
+          msg_warn "PAPERLESS_CONSUMER_IGNORE_PATTERNS now uses regex patterns; please verify custom values."
        [[ -n "$(sed -n '/^PAPERLESS_PRE_CONSUME_SCRIPT=/p;/^PAPERLESS_POST_CONSUME_SCRIPT=/p' "$PAPERLESS_CONF")" ]] &&
          msg_warn "Pre/post consume scripts no longer receive positional arguments in v3; please verify custom scripts."
        msg_ok "Migrated Paperless-ngx configuration"
@@ -170,9 +172,7 @@ function update_script() {
      fi
      for svc in consumer scheduler task-queue webserver; do
        unit="/etc/systemd/system/paperless-${svc}.service"
-        [[ -f "$unit" ]] || continue
-        sed -i 's|uv run -- |uv run --no-sync -- |g' "$unit"
-        grep -q '^Restart=' "$unit" || sed -i '/^\[Service\]/a Restart=on-failure\nRestartSec=5' "$unit"
+        [[ -f "$unit" ]] && sed -i 's|uv run -- |uv run --no-sync -- |g' "$unit"
      done
      $STD systemctl daemon-reload
      cd /opt/paperless
@@ -181,34 +181,6 @@ function update_script() {
      $STD uv run -- python manage.py migrate
      msg_ok "Updated Paperless-ngx"

-      if ((BRIDGE_UPDATE == 0)); then
-        IGNORE_FIXED="$(
-          /opt/paperless/.venv/bin/python - /opt/paperless/paperless.conf <<'EOF'
-import json, re, sys
-key = "PAPERLESS_CONSUMER_IGNORE_PATTERNS="
-lines = open(sys.argv[1]).read().splitlines(True)
-
-def is_glob(p):
-    if p.startswith("^") or p.endswith("$"):
-        return False
-    try:
-        return bool(re.search(p, "scan.pdf"))
-    except re.error:
-        return True
-
-for i, line in enumerate(lines):
-    if line.startswith(key):
-        patterns = json.loads(line[len(key):].strip().strip("'"))
-        fixed = ["^" + re.escape(p).replace(r"\*", ".*").replace(r"\?", ".") + "$" if is_glob(p) else p for p in patterns]
-        if fixed != patterns:
-            lines[i] = key + json.dumps(fixed) + "\n"
-            print(json.dumps(fixed))
-open(sys.argv[1], "w").writelines(lines)
-EOF
-        )" || IGNORE_FIXED=""
-        [[ -n "$IGNORE_FIXED" ]] && msg_warn "Converted glob PAPERLESS_CONSUMER_IGNORE_PATTERNS to regex (required since v3): ${IGNORE_FIXED}"
-      fi
-
      if ((BRIDGE_UPDATE == 0)) && [[ "$PAPERLESS_INSTALLED_VERSION" == "2.20.15" ]]; then
        $STD apt -y purge libzbar0t64 libzbar0 2>/dev/null || true
        $STD apt -y autoremove 2>/dev/null || true
@@ -66,8 +66,7 @@ function update_script() {
    cp -a /opt/backup/storage/app/public /opt/pelican-panel/storage/app/

    $STD composer install --no-dev --optimize-autoloader --no-interaction
-    PANEL_URL="$(sed -n 's/^APP_URL=//p' /opt/pelican-panel/.env | tr -d "\"'")"
-    $STD php artisan p:environment:setup --url="$PANEL_URL"
+    $STD php artisan p:environment:setup
    $STD php artisan view:clear
    $STD php artisan config:clear
    $STD php artisan filament:optimize
@@ -41,7 +41,7 @@ function update_script() {
  ARCH=$(uname -m)

  if check_for_gh_release "deno" "denoland/deno" "v2.7.5" "Deno is pinned to 2.7.5 because the known WouldBlock: Resource temporarily unavailable (os error 11) Issue"; then
-    fetch_and_deploy_gh_release "deno" "denoland/deno" "prebuild" "v2.7.5" "/usr/local/bin" "deno-${ARCH}-unknown-linux-gnu.zip"
+    fetch_and_deploy_gh_release "deno" "denoland/deno" "v2.7.5" "latest" "/usr/local/bin" "deno-${ARCH}-unknown-linux-gnu.zip"
  fi

  if check_for_gh_release "profilarr" "Dictionarry-Hub/profilarr"; then
@@ -1,71 +0,0 @@
-#!/usr/bin/env bash
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/adminsyspro/proxcenter-ui
-
-APP="ProxCenter"
-var_tags="${var_tags:-proxmox;management}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-6144}"
-var_disk="${var_disk:-10}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/proxcenter ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "proxcenter" "adminsyspro/proxcenter-ui"; then
-    msg_info "Stopping ProxCenter"
-    systemctl stop proxcenter
-    msg_ok "Stopped ProxCenter"
-
-    NODE_VERSION="26" setup_nodejs
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "proxcenter" "adminsyspro/proxcenter-ui" "tarball"
-
-    msg_info "Building ProxCenter"
-    cd /opt/proxcenter/frontend
-    $STD npm ci --legacy-peer-deps --ignore-scripts
-    $STD npm run build:icons
-    $STD npx prisma generate
-    PROXCENTER_SKIP_TYPECHECK=1 NODE_OPTIONS="--max-old-space-size=3072" $STD npm run build
-    msg_ok "Built ProxCenter"
-
-    msg_info "Migrating Database"
-    set -a && source /opt/proxcenter_data/.env && set +a
-    $STD npx prisma migrate deploy
-    $STD npx prisma db seed
-    msg_ok "Migrated Database"
-
-    msg_info "Starting ProxCenter"
-    systemctl start proxcenter
-    msg_ok "Started ProxCenter"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"
@@ -31,28 +31,6 @@ function update_script() {
    exit
  fi

-  if ! grep -q '^ExecStartPost=-/usr/local/bin/readmeabook-init$' /etc/systemd/system/readmeabook.service; then
-    msg_info "Starting the scheduler with the service"
-    cat <<'EOF' >/usr/local/bin/readmeabook-init
-#!/usr/bin/env bash
-# Upstream's image calls /api/init after every start: it creates the scheduled jobs and starts the scheduler
-url="http://127.0.0.1:${PORT:-3030}"
-for _ in $(seq 1 60); do curl -sf -o /dev/null "$url/api/health" && break; sleep 1; done
-for _ in $(seq 1 30); do [[ "$(redis-cli ping 2>/dev/null)" == PONG ]] && break; sleep 1; done
-for attempt in 1 2 3 4 5; do
-  curl -sf -o /dev/null "$url/api/init" && exit 0
-  sleep "$attempt"
-done
-echo "ReadMeABook did not answer /api/init, scheduled jobs will not run" >&2
-exit 1
-EOF
-    chmod +x /usr/local/bin/readmeabook-init
-    sed -i '/^ExecStart=/a ExecStartPost=-/usr/local/bin/readmeabook-init\nTimeoutStartSec=180' /etc/systemd/system/readmeabook.service
-    systemctl daemon-reload
-    systemctl restart readmeabook
-    msg_ok "Started the scheduler with the service"
-  fi
-
  if check_for_gh_release "readmeabook" "kikootwo/ReadMeABook"; then
    msg_info "Stopping Service"
    systemctl stop readmeabook
@@ -11,7 +11,6 @@ var_tags="${var_tags:-remote-desktop}"
 var_cpu="${var_cpu:-1}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
-export var_rustdesk_api="${var_rustdesk_api:-}"
 if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
  var_os=$(msg_menu "Choose the container OS" \
    "debian" "Debian 13" \
@@ -39,32 +38,25 @@ update_deb_based() {
    exit
  fi

-  if check_for_gh_release "rustdesk-hbbs" "rustdesk/rustdesk-server"; then
-    msg_info "Stopping RustDesk Server"
-    systemctl stop rustdesk-hbbr rustdesk-hbbs
-    msg_ok "Stopped RustDesk Server"
-
-    fetch_and_deploy_gh_release "rustdesk-hbbr" "rustdesk/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-hbbr*$(arch_resolve).deb"
-    fetch_and_deploy_gh_release "rustdesk-hbbs" "rustdesk/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-hbbs*$(arch_resolve).deb"
-    fetch_and_deploy_gh_release "rustdesk-utils" "rustdesk/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-utils*$(arch_resolve).deb"
-
-    msg_info "Starting RustDesk Server"
-    systemctl start rustdesk-hbbs rustdesk-hbbr
-    msg_ok "Started RustDesk Server"
-    msg_ok "Updated RustDesk Server"
-  fi
-
-  if [[ -f /lib/systemd/system/rustdesk-api.service ]] && check_for_gh_release "rustdesk-api" "lejianwen/rustdesk-api"; then
-    msg_info "Stopping RustDesk API"
-    systemctl stop rustdesk-api
-    msg_ok "Stopped RustDesk API"
+  if check_for_gh_release "rustdesk-hbbs" "lejianwen/rustdesk-server"; then
+    msg_info "Stopping Service"
+    systemctl stop rustdesk-hbbr
+    systemctl stop rustdesk-hbbs
+    if [[ -f /lib/systemd/system/rustdesk-api.service ]]; then
+      systemctl stop rustdesk-api
+    fi
+    msg_ok "Stopped Service"

+    fetch_and_deploy_gh_release "rustdesk-hbbr" "lejianwen/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-hbbr*$(arch_resolve).deb"
+    fetch_and_deploy_gh_release "rustdesk-hbbs" "lejianwen/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-hbbs*$(arch_resolve).deb"
+    fetch_and_deploy_gh_release "rustdesk-utils" "lejianwen/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-utils*$(arch_resolve).deb"
    fetch_and_deploy_gh_release "rustdesk-api" "lejianwen/rustdesk-api" "binary" "latest" "/opt/rustdesk" "rustdesk-api-server*$(arch_resolve).deb"

-    msg_info "Starting RustDesk API"
-    systemctl start rustdesk-api
-    msg_ok "Started RustDesk API"
-    msg_ok "Updated RustDesk API"
+    msg_info "Starting services"
+    systemctl start -q rustdesk-*
+    msg_ok "Services started"
+
+    msg_ok "Updated successfully!"
  fi
 }

@@ -74,26 +66,21 @@ update_alpine() {
    exit
  fi

-  msg_info "Updating Alpine Packages"
-  $STD apk -U upgrade
-  msg_ok "Updated Alpine Packages"
-
-  if check_for_gh_release "rustdesk-server" "rustdesk/rustdesk-server"; then
+  if check_for_gh_release "rustdesk-server" "lejianwen/rustdesk-server"; then
    msg_info "Stopping RustDesk Server"
+    $STD apk -U upgrade
    $STD service rustdesk-server-hbbs stop
    $STD service rustdesk-server-hbbr stop
    msg_ok "Stopped RustDesk Server"

-    fetch_and_deploy_gh_release "rustdesk-server" "rustdesk/rustdesk-server" "prebuild" "latest" "/opt/rustdesk-server" "rustdesk-server-linux-$(arch_resolve "amd64" "arm64v8").zip"
+    fetch_and_deploy_gh_release "rustdesk-server" "lejianwen/rustdesk-server" "prebuild" "latest" "/opt/rustdesk-server" "rustdesk-server-linux-$(arch_resolve "amd64" "arm64v8").zip"

    msg_info "Starting RustDesk Server"
    $STD service rustdesk-server-hbbs start
    $STD service rustdesk-server-hbbr start
    msg_ok "Started RustDesk Server"
-    msg_ok "Updated RustDesk Server"
  fi
-
-  if [[ -x /opt/rustdesk-api/apimain ]] && check_for_gh_release "rustdesk-api" "lejianwen/rustdesk-api"; then
+  if check_for_gh_release "rustdesk-api" "lejianwen/rustdesk-api"; then
    msg_info "Stopping RustDesk API"
    $STD service rustdesk-api stop
    msg_ok "Stopped RustDesk API"
@@ -103,8 +90,8 @@ update_alpine() {
    msg_info "Starting RustDesk API"
    $STD service rustdesk-api start
    msg_ok "Started RustDesk API"
-    msg_ok "Updated RustDesk API"
  fi
+  msg_ok "Updated successfully!"
 }

 function update_script() {
@@ -120,7 +107,5 @@ description

 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Set this as ID server in the RustDesk client, the key is in ~/rustdesk.creds:${CL}"
-echo -e "${GATEWAY}${BGN}${IP}${CL}"
-echo -e "${INFO}${YW}Web UI, if selected during setup:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:21114/_admin/${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:21114${CL}"
@@ -31,13 +31,12 @@ function update_script() {
    exit
  fi

-  [[ -f ~/.silo ]] && mv ~/.silo ~/.silo_s3
-  if check_for_gh_release "silo_s3" "pgsty/silo"; then
+  if check_for_gh_release "silo" "pgsty/silo"; then
    msg_info "Stopping Silo"
    systemctl stop silo
    msg_ok "Stopped Silo"

-    DPKG_FORCE_CONFOLD=1 fetch_and_deploy_gh_release "silo_s3" "pgsty/silo" "binary"
+    DPKG_FORCE_CONFOLD=1 fetch_and_deploy_gh_release "silo" "pgsty/silo" "binary"

    msg_info "Starting Silo"
    systemctl start silo
@@ -31,13 +31,12 @@ function update_script() {
    exit
  fi

-  # v5 reworks a lot; stay on the newest v4 until it is tested
-  if check_for_gh_release "Sonarr" "Sonarr/Sonarr" "" "" "v4."; then
+  if check_for_gh_release "Sonarr" "Sonarr/Sonarr"; then
    msg_info "Stopping Service"
    systemctl stop sonarr
    msg_ok "Stopped Service"

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Sonarr" "Sonarr/Sonarr" "prebuild" "latest" "/opt/Sonarr" "Sonarr.main.*.linux-$(arch_resolve "x64" "arm64").tar.gz" "v4."
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Sonarr" "Sonarr/Sonarr" "prebuild" "latest" "/opt/Sonarr" "Sonarr.main.*.linux-$(arch_resolve "x64" "arm64").tar.gz"

    msg_info "Starting Service"
    systemctl start sonarr
@@ -9,7 +9,7 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 APP="SparkyFitness"
 var_tags="${var_tags:-health;fitness}"
 var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-4096}"
+var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-7}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
@@ -31,75 +31,42 @@ function update_script() {
    exit
  fi

-  NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs
+  NODE_VERSION="24" NODE_MODULE="corepack,yarn" setup_nodejs

  if check_for_gl_release "storyteller" "storyteller-platform/storyteller" "" "" "web-v2"; then
    msg_info "Stopping Service"
    systemctl stop storyteller
    msg_ok "Stopped Service"

-    ensure_dependencies cmake argon2 libcurl4t64 libxml2
-    fetch_and_deploy_gh_release "readium" "readium/cli" "prebuild" "v0.9.1" "/opt/readium" "readium_linux_$(arch_resolve "x86_64" "arm64").tar.gz"
-
    create_backup /opt/storyteller/.env
-    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="data" fetch_and_deploy_gl_release "storyteller" "storyteller-platform/storyteller" "tarball" "latest" "/opt/storyteller" "" "web-v2"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gl_release "storyteller" "storyteller-platform/storyteller" "tarball" "latest" "/opt/storyteller" "" "web-v2"
+
    restore_backup

-    msg_info "Building Storyteller (Patience)"
+    msg_info "Rebuilding Storyteller"
    cd /opt/storyteller
-    $STD corepack yarn install
+    export NODE_OPTIONS="--max-old-space-size=4096"
+
+    $STD corepack yarn install --network-timeout 600000
+    $STD gcc -g -fPIC -rdynamic -shared web/sqlite/uuid.c -o web/sqlite/uuid.c.so
+    export CI=1
    export NODE_ENV=production
    export NEXT_TELEMETRY_DISABLED=1
    export SQLITE_NATIVE_BINDING=/opt/storyteller/node_modules/better-sqlite3/build/Release/better_sqlite3.node
    $STD corepack yarn workspaces foreach -Rpt --from @storyteller-platform/web --exclude @storyteller-platform/eslint run build
-    STANDALONE=/opt/storyteller/applications/web/.next/standalone
-    WEB_DIR="$STANDALONE/applications/web"
-    mkdir -p "$WEB_DIR"/{public,.next/static,.next/cache,migrations,sqlite,scripts}
-    cp -rT applications/web/public "$WEB_DIR/public"
-    cp -rT applications/web/.next/static "$WEB_DIR/.next/static"
-    cp -rT applications/web/migrations "$WEB_DIR/migrations"
-    cp applications/web/sqlite/uuid.c.so "$WEB_DIR/sqlite/"
-    cp docker-scripts/reset-password.sh "$WEB_DIR/scripts/"
-    cp -r applications/web/work-dist applications/web/file-write-dist "$WEB_DIR/"
-    mkdir -p "$WEB_DIR/work-dist/@storyteller-platform/align/prebuilds"
-    cp -r "libraries/align/prebuilds/linux-$(arch_resolve "x64" "arm64")" "$WEB_DIR/work-dist/@storyteller-platform/align/prebuilds/"
-    cp node_modules/@echogarden/icu-segmentation-wasm/wasm/*.wasm "$WEB_DIR/work-dist/"
-    cp -rT node_modules/@parcel "$STANDALONE/node_modules/@parcel"
-    cp -rT node_modules/kuromoji "$STANDALONE/node_modules/kuromoji"
-    ln -sf /opt/storyteller/.env "$WEB_DIR/.env"
-    msg_ok "Built Storyteller"
-
-    msg_info "Updating Whisper"
-    WHISPER_VARIANT="linux-$(arch_resolve "x64" "arm64")-cpu"
-    $STD node /opt/storyteller/libraries/ghost-story/dist/cli/bin.js install binary "$WHISPER_VARIANT"
-    $STD node /opt/storyteller/libraries/ghost-story/dist/cli/bin.js install model tiny.en
-    if [[ "$WHISPER_VARIANT" == "linux-x64-cpu" ]]; then
-      $STD node /opt/storyteller/libraries/ghost-story/dist/cli/bin.js install binary linux-x64-cpu-legacy
+    mkdir -p /opt/storyteller/web/.next/standalone/web/.next/static
+    cp -rT /opt/storyteller/web/.next/static /opt/storyteller/web/.next/standalone/web/.next/static
+    if [[ -d /opt/storyteller/web/public ]]; then
+      mkdir -p /opt/storyteller/web/.next/standalone/web/public
+      cp -rT /opt/storyteller/web/public /opt/storyteller/web/.next/standalone/web/public
    fi
-    msg_ok "Updated Whisper"
-
-    cat <<EOF >/etc/systemd/system/storyteller.service
-[Unit]
-Description=Storyteller
-After=network.target
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=${WEB_DIR}
-EnvironmentFile=/opt/storyteller/.env
-Environment=SQLITE_NATIVE_BINDING=${STANDALONE}/node_modules/better-sqlite3/build/Release/better_sqlite3.node
-Environment=ERROR_ALIGN_NATIVE_BINDING=${WEB_DIR}/work-dist/@storyteller-platform/align/
-Environment=STORYTELLER_WORKER=worker.mjs
-Environment=STORYTELLER_FILE_WRITE_WORKER=fileWriteWorker.mjs
-ExecStart=/usr/bin/node --enable-source-maps server.js
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-    systemctl daemon-reload
+    mkdir -p /opt/storyteller/web/.next/standalone/web/migrations
+    cp -rT /opt/storyteller/web/migrations /opt/storyteller/web/.next/standalone/web/migrations
+    mkdir -p /opt/storyteller/web/.next/standalone/web/sqlite
+    cp -rT /opt/storyteller/web/sqlite /opt/storyteller/web/.next/standalone/web/sqlite
+    ln -sf /opt/storyteller/.env /opt/storyteller/web/.next/standalone/web/.env
+    msg_ok "Rebuilt Storyteller"

    msg_info "Starting Service"
    systemctl start storyteller
@@ -108,6 +75,7 @@ EOF
  fi
  exit
 }
+
 start
 build_container
 description
@@ -125,7 +125,7 @@ EOF
    $STD ./scripts/fetch-basemap.sh || msg_warn "Basemap download failed, keeping the existing map"
    [[ -d /opt/tracearr/data ]] && mv /opt/tracearr/data /opt/tracearr.data
    rm -rf /opt/tracearr
-    mkdir -p /opt/tracearr/{packages/shared,packages/emails,apps/server,apps/web,apps/server/src/db,assets}
+    mkdir -p /opt/tracearr/{packages/shared,packages/emails,apps/server,apps/web,apps/server/src/db}
    cp -rf package.json /opt/tracearr/
    cp -rf pnpm-workspace.yaml /opt/tracearr/
    cp -rf pnpm-lock.yaml /opt/tracearr/
@@ -138,15 +138,13 @@ EOF
    cp -rf packages/emails/package.json /opt/tracearr/packages/emails/
    cp -rf packages/emails/dist /opt/tracearr/packages/emails/dist
    cp -rf apps/server/src/db/migrations /opt/tracearr/apps/server/src/db/migrations
-    cp -f assets/logo.png /opt/tracearr/assets/
    [[ -d /opt/tracearr.data ]] && mv /opt/tracearr.data /opt/tracearr/data
    mkdir -p /opt/tracearr/data
    cp -rf data/. /opt/tracearr/data/
    mkdir -p /opt/tracearr/data/image-cache
    rm -rf /opt/tracearr.build
    cd /opt/tracearr
-    $STD pnpm install --prod --frozen-lockfile --ignore-scripts --filter @tracearr/server...
-    rm -rf "$(pnpm store path)"
+    $STD pnpm install --prod --frozen-lockfile --ignore-scripts
    $STD chown -R tracearr:tracearr /opt/tracearr
    msg_ok "Built Tracearr"

@@ -71,6 +71,41 @@ EOF

    restore_backup

+    if grep -q '^TA_BACKEND_PORT=' /opt/tubearchivist/.env 2>/dev/null; then
+      msg_info "Migrating to v0.6.0 (dropping Nginx)"
+      systemctl disable -q --now nginx
+      $STD apt autoremove --purge -y nginx
+      sed -i 's/^TA_BACKEND_PORT=.*/TA_PORT=8000/' /opt/tubearchivist/.env
+      cat <<'RUNEOF' >/opt/tubearchivist/backend/run.sh
+#!/bin/bash
+set -e
+cd /opt/tubearchivist/backend
+set -a
+source /opt/tubearchivist/.env
+set +a
+PYTHON=/opt/tubearchivist/.venv/bin/python
+
+echo "Waiting for ElasticSearch..."
+for i in $(seq 1 30); do
+  if curl -sf http://localhost:9200/_cluster/health >/dev/null 2>&1; then
+    break
+  fi
+  sleep 2
+done
+
+$PYTHON manage.py ta_stop_on_error
+$PYTHON manage.py migrate
+$PYTHON manage.py collectstatic --noinput -c
+$PYTHON manage.py ta_envcheck
+$PYTHON manage.py ta_connection
+$PYTHON manage.py ta_startup
+
+exec $PYTHON backend_start.py
+RUNEOF
+      chmod +x /opt/tubearchivist/backend/run.sh
+      msg_ok "Migrated to v0.6.0 (dropping Nginx)"
+    fi
+
    msg_info "Rebuilding Tube Archivist"
    cd /opt/tubearchivist/frontend
    $STD npm install
@@ -113,7 +148,6 @@ EOF

    msg_info "Starting Services"
    systemctl start bgutil-provider tubearchivist tubearchivist-celery tubearchivist-beat
-    systemctl reload nginx
    msg_ok "Started Services"
    msg_ok "Updated successfully!"
  fi
@@ -53,6 +53,10 @@ update_deb_based() {
      printf '%s\n' "$INSTALLED_VERSION" >"$HOME/.vaultwarden"
    fi
    if check_for_gh_release "vaultwarden" "dani-garcia/vaultwarden"; then
+      msg_info "Stopping Service"
+      systemctl stop vaultwarden
+      msg_ok "Stopped Service"
+
      fetch_and_deploy_gh_release "vaultwarden" "dani-garcia/vaultwarden" "tarball" "latest" "/tmp/vaultwarden-src"

      msg_info "Updating VaultWarden to $VAULT (Patience)"
@@ -60,12 +64,6 @@ update_deb_based() {
      VW_VERSION="$VAULT"
      export VW_VERSION
      CARGO_BUILD_JOBS="$(get_parallel_jobs)" CARGO_PROFILE_RELEASE_LTO=false CARGO_PROFILE_RELEASE_CODEGEN_UNITS=16 $STD cargo build --features "sqlite,mysql,postgresql" --release
-      msg_ok "Built VaultWarden ${VAULT}"
-
-      msg_info "Stopping Service"
-      systemctl stop vaultwarden
-      msg_ok "Stopped Service"
-
      if [[ -f /usr/bin/vaultwarden ]]; then
        cp target/release/vaultwarden /usr/bin/
      else
@@ -100,6 +100,7 @@ EOF
      -e "s|^MEILI_DB_PATH=.*|MEILI_DB_PATH=/opt/wanderer_data/meili_data|" \
      /opt/wanderer/.env
    sed -i "s|^db_path =.*|db_path = \"/opt/wanderer_data/meili_data\"|" /etc/meilisearch.toml
+    rm -f /usr/local/bin/wanderer-pb

    cat <<EOF >/etc/systemd/system/wanderer-pocketbase.service
 [Unit]
@@ -154,16 +155,6 @@ EOF
    msg_ok "Added POCKETBASE_PROXY_SECRET"
  fi

-  cat <<'EOF' >/usr/local/bin/wanderer-pb
-#!/usr/bin/env bash
-set -a
-source /opt/wanderer/.env
-set +a
-cd /opt/wanderer/db
-exec ./pocketbase "$@" --dir="$PB_DB_LOCATION"
-EOF
-  chmod +x /usr/local/bin/wanderer-pb
-
  if [[ -f /opt/wanderer_data/plugins/plugin.json ]]; then
    msg_info "Reinstalling wanderer plugins, one directory each"
    find /opt/wanderer_data/plugins -maxdepth 1 -type f -delete
@@ -1,77 +0,0 @@
-#!/usr/bin/env bash
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/arabcoders/watchstate
-
-APP="WatchState"
-var_tags="${var_tags:-media;plex;jellyfin;emby}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
-var_disk="${var_disk:-6}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/watchstate ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "watchstate" "arabcoders/watchstate" "" "" "v"; then
-    msg_info "Stopping WatchState"
-    systemctl stop watchstate-worker php8.5-fpm
-    msg_ok "Stopped WatchState"
-
-    create_backup /opt/watchstate/.env
-    setup_composer
-    NODE_VERSION="24" NODE_MODULE="bun" setup_nodejs
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "watchstate" "arabcoders/watchstate" "tarball" "latest" "/opt/watchstate" "" "v"
-    restore_backup
-
-    msg_info "Building WatchState"
-    cd /opt/watchstate
-    sed -i "s/'version' => 'dev-master'/'version' => 'v$(cat ~/.watchstate)'/" config/config.php
-    $STD composer install --no-dev --optimize-autoloader --no-interaction
-    cd /opt/watchstate/frontend
-    $STD bun install --frozen-lockfile --production
-    NODE_ENV=production $STD bun run generate
-    mv /opt/watchstate/frontend/exported /opt/watchstate/public/exported
-    rm -rf /opt/watchstate/frontend/node_modules /opt/watchstate/frontend/.nuxt
-    msg_ok "Built WatchState"
-
-    msg_info "Migrating WatchState Database"
-    $STD php /opt/watchstate/bin/console db:migrate --execute
-    $STD php /opt/watchstate/bin/console db:index
-    chown -R www-data:www-data /opt/watchstate_data
-    msg_ok "Migrated WatchState Database"
-
-    msg_info "Starting WatchState"
-    systemctl start php8.5-fpm watchstate-worker
-    msg_ok "Started WatchState"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:8080${CL}"
@@ -10,7 +10,7 @@ APP="Wazuh"
 var_tags="${var_tags:-security;monitoring}"
 var_cpu="${var_cpu:-4}"
 var_ram="${var_ram:-4096}"
-var_disk="${var_disk:-35}"
+var_disk="${var_disk:-25}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
@@ -32,29 +32,30 @@ function update_script() {

  NODE_VERSION="26" NODE_MODULE="yarn,node-gyp" setup_nodejs

-  if check_for_gh_release "wikijs" "requarks/wiki-v2"; then
-    # Installs before February 2025 use SQLite, newer ones PostgreSQL
-    SQLITE_INSTALL=$([[ -f /opt/wikijs/db.sqlite ]] && echo "true" || echo "false")
+  if check_for_gh_release "wikijs" "requarks/wiki"; then
+    msg_info "Verifying whether ${APP}' new release is v3.x+ and current install uses SQLite."
+    SQLITE_INSTALL=$([ -f /opt/wikijs/db.sqlite ] && echo "true" || echo "false")
+    if [[ "${SQLITE_INSTALL}" == "true" && "${CHECK_UPDATE_RELEASE}" =~ ^3.* ]]; then
+      echo "SQLite is not supported in v3.x+, currently there is no update path availble."
+      exit
+    fi
+    msg_ok "There is an update path available for ${APP}"

    msg_info "Stopping Service"
    systemctl stop wikijs
    msg_ok "Stopped Service"

    msg_info "Backing up Data"
-    mkdir -p /opt/wikijs-backup
-    if [[ "$SQLITE_INSTALL" == "true" ]]; then
-      cp /opt/wikijs/db.sqlite /opt/wikijs-backup
-    fi
+    mkdir /opt/wikijs-backup
+    $SQLITE_INSTALL && cp /opt/wikijs/db.sqlite /opt/wikijs-backup
    cp -R /opt/wikijs/{config.yml,/data} /opt/wikijs-backup
    msg_ok "Backed up Data"

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "wikijs" "requarks/wiki-v2" "prebuild" "latest" "/opt/wikijs" "wiki-js.tar.gz"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "wikijs" "requarks/wiki" "prebuild" "latest" "/opt/wikijs" "wiki-js.tar.gz"

    msg_info "Restoring Data"
    cp -R /opt/wikijs-backup/* /opt/wikijs
-    if [[ "$SQLITE_INSTALL" == "true" ]]; then
-      $STD npm rebuild sqlite3
-    fi
+    $SQLITE_INSTALL && $STD npm rebuild sqlite3
    rm -rf /opt/wikijs-backup
    msg_ok "Restored Data"

@@ -1,74 +0,0 @@
-#!/usr/bin/env bash
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/DialmasterOrg/Youtarr
-
-APP="Youtarr"
-var_tags="${var_tags:-media;youtube;downloader}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
-var_disk="${var_disk:-20}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/youtarr ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  msg_info "Updating yt-dlp"
-  $STD yt-dlp -U
-  msg_ok "Updated yt-dlp"
-
-  if check_for_gh_release "youtarr" "DialmasterOrg/Youtarr"; then
-    msg_info "Stopping Youtarr"
-    systemctl stop youtarr
-    msg_ok "Stopped Youtarr"
-
-    NODE_VERSION="24" setup_nodejs
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "youtarr" "DialmasterOrg/Youtarr" "tarball"
-
-    msg_info "Building Youtarr"
-    cd /opt/youtarr/client
-    $STD npm ci --ignore-scripts
-    $STD npm run build
-    rm -rf /opt/youtarr/client/node_modules
-    cd /opt/youtarr
-    $STD npm ci --omit=dev --ignore-scripts
-    mv /opt/youtarr/config/config.example.json /opt/youtarr/server/
-    rm -rf /opt/youtarr/config
-    ln -sfn /opt/youtarr_data/config /opt/youtarr/config
-    msg_ok "Built Youtarr"
-
-    msg_info "Starting Youtarr"
-    systemctl start youtarr
-    msg_ok "Started Youtarr"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:3011${CL}"
-echo -e "${INFO}${YW}First login asks for the setup token in /opt/youtarr_data/config/setup-token${CL}"
@@ -46,36 +46,24 @@ function update_script() {
    msg_warn "No Zabbix Agent service found, skipping agent actions"
  fi

-  ZABBIX_SERIES="$(dpkg-query -W -f='${Version}' zabbix-release 2>/dev/null || true)"
-  ZABBIX_SERIES="${ZABBIX_SERIES#*:}"
-  ZABBIX_SERIES="${ZABBIX_SERIES%%[!0-9.]*}"
-  if [[ "${PHS_SILENT:-0}" == "1" ]]; then
-    if [[ ! "$ZABBIX_SERIES" =~ ^[0-9]+\.[0-9]+$ ]]; then
-      msg_warn "Could not detect the installed Zabbix series - skipping update, requires an interactive run"
-      exit 75
-    fi
-    ZABBIX_VERSION="$ZABBIX_SERIES"
-    msg_warn "Unattended update: staying on Zabbix ${ZABBIX_VERSION}"
-  else
-    read -rp "Choose Zabbix version [1] 7.0 LTS  [2] 7.4 (Latest Stable)  [3] Latest available (default: 2): " ZABBIX_CHOICE
-    ZABBIX_CHOICE=${ZABBIX_CHOICE:-2}
-    case "$ZABBIX_CHOICE" in
-    1) ZABBIX_VERSION="7.0" ;;
-    2) ZABBIX_VERSION="7.4" ;;
-    3) ZABBIX_VERSION=$(curl -fsSL https://repo.zabbix.com/zabbix/ |
-      grep -oP '(?<=href=")[0-9]+\.[0-9]+(?=/")' | sort -V | tail -n1) ;;
-    *)
-      ZABBIX_VERSION="7.4"
-      echo "Invalid choice. Defaulting to 7.4."
-      ;;
-    esac
-  fi
-
  msg_info "Stopping Services"
  systemctl stop zabbix-server
  [[ -n "$AGENT_SERVICE" ]] && systemctl stop "$AGENT_SERVICE"
  msg_ok "Stopped Services"

+  read -rp "Choose Zabbix version [1] 7.0 LTS  [2] 7.4 (Latest Stable)  [3] Latest available (default: 2): " ZABBIX_CHOICE
+  ZABBIX_CHOICE=${ZABBIX_CHOICE:-2}
+  case "$ZABBIX_CHOICE" in
+  1) ZABBIX_VERSION="7.0" ;;
+  2) ZABBIX_VERSION="7.4" ;;
+  3) ZABBIX_VERSION=$(curl -fsSL https://repo.zabbix.com/zabbix/ |
+    grep -oP '(?<=href=")[0-9]+\.[0-9]+(?=/")' | sort -V | tail -n1) ;;
+  *)
+    ZABBIX_VERSION="7.4"
+    echo "Invalid choice. Defaulting to 7.4."
+    ;;
+  esac
+
  msg_info "Updating Zabbix to $ZABBIX_VERSION"
  mkdir -p /opt/zabbix-backup/
  cp /etc/zabbix/zabbix_server.conf /opt/zabbix-backup/
@@ -85,10 +73,8 @@ function update_script() {
  rm -Rf /etc/apt/sources.list.d/zabbix.list
  cd /tmp

-  ZABBIX_REPO_DIR="debian"
-  [[ "$ZABBIX_VERSION" == "7.0" && "$(arch_resolve)" == "arm64" ]] && ZABBIX_REPO_DIR="debian-arm64"
  if [[ "$ZABBIX_VERSION" == "7.0" ]]; then
-    ZABBIX_DEB_URL="https://repo.zabbix.com/zabbix/${ZABBIX_VERSION}/${ZABBIX_REPO_DIR}/pool/main/z/zabbix-release/zabbix-release_latest_${ZABBIX_VERSION}+debian13_all.deb"
+    ZABBIX_DEB_URL="https://repo.zabbix.com/zabbix/${ZABBIX_VERSION}/debian/pool/main/z/zabbix-release/zabbix-release_latest_${ZABBIX_VERSION}+debian13_all.deb"
    ZABBIX_DEB_FILE="zabbix-release_latest_${ZABBIX_VERSION}+debian13_all.deb"
  else
    ZABBIX_DEB_URL="https://repo.zabbix.com/zabbix/${ZABBIX_VERSION}/release/debian/pool/main/z/zabbix-release/zabbix-release_latest+debian13_all.deb"
@@ -100,16 +86,16 @@ function update_script() {
  rm -rf /tmp/zabbix-release_*.deb
  apt_update_safe

-  $STD apt install --only-upgrade -y zabbix-server-pgsql zabbix-frontend-php php8.4-pgsql
+  $STD apt install --only-upgrade zabbix-server-pgsql zabbix-frontend-php php8.4-pgsql

  if [[ "$AGENT_SERVICE" == "zabbix-agent2" ]]; then
-    $STD apt install --only-upgrade -y zabbix-agent2 zabbix-agent2-plugin-postgresql
+    $STD apt install --only-upgrade zabbix-agent2 zabbix-agent2-plugin-postgresql
    if [ -f /etc/zabbix/zabbix_agent2.d/plugins.d/nvidia.conf ]; then
      sed -i 's|^Plugins.NVIDIA.System.Path=.*|# Plugins.NVIDIA.System.Path=/usr/libexec/zabbix/zabbix-agent2-plugin-nvidia-gpu|' \
        /etc/zabbix/zabbix_agent2.d/plugins.d/nvidia.conf
    fi
  elif [[ "$AGENT_SERVICE" == "zabbix-agent" ]]; then
-    $STD apt install --only-upgrade -y zabbix-agent
+    $STD apt install --only-upgrade zabbix-agent
  fi

  if command -v fping >/dev/null 2>&1; then
@@ -12,7 +12,7 @@ var_disk="${var_disk:-8}"
 var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-4096}"
 var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
+var_version="${var_version:-12}"
 var_arm64="${var_arm64:-no}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -34,64 +34,6 @@ function update_script() {
  systemctl stop zammad
  msg_ok "Stopped Service"

-  if grep -qs "dl.packager.io" /etc/apt/sources.list.d/zammad*; then
-    msg_info "Migrating Zammad Repository"
-    rm -f /etc/apt/keyrings/pkgr-zammad.gpg
-    setup_deb822_repo \
-      "zammad" \
-      "https://go.packager.io/srv/deb/zammad/zammad/gpg-key.asc" \
-      "https://go.packager.io/srv/deb/zammad/zammad/stable/debian" \
-      "$(get_os_info version_id)" \
-      "main"
-    msg_ok "Migrated Zammad Repository"
-  fi
-
-  REBUILD_INDEX=false
-  if [[ "$(dpkg-query -W -f='${Version}' elasticsearch 2>/dev/null)" == 7.* ]]; then
-    msg_info "Upgrading Elasticsearch to 8.x"
-    systemctl stop elasticsearch
-    if /usr/share/elasticsearch/bin/elasticsearch-plugin list 2>/dev/null | grep -q "ingest-attachment"; then
-      $STD /usr/share/elasticsearch/bin/elasticsearch-plugin remove ingest-attachment
-    fi
-    rm -f /etc/apt/sources.list.d/elastic-7.x.list /usr/share/keyrings/elasticsearch-keyring.gpg
-    setup_deb822_repo \
-      "elasticsearch" \
-      "https://artifacts.elastic.co/GPG-KEY-elasticsearch" \
-      "https://artifacts.elastic.co/packages/8.x/apt" \
-      "stable" \
-      "main"
-    ES_JAVA_OPTS="-Xms1g -Xmx1g" $STD apt install -y elasticsearch
-    if [[ -f /etc/elasticsearch/jvm.options.dpkg-dist ]]; then
-      mv /etc/elasticsearch/jvm.options.dpkg-dist /etc/elasticsearch/jvm.options
-    fi
-    rm -f /etc/elasticsearch/elasticsearch.yml.dpkg-dist
-    rm -rf /var/lib/elasticsearch/*
-    cat <<EOF >/etc/elasticsearch/jvm.options.d/heap.options
-Xms2g
-Xmx2g
-EOF
-    cat <<EOF >/etc/elasticsearch/elasticsearch.yml
-path.data: /var/lib/elasticsearch
-path.logs: /var/log/elasticsearch
-discovery.type: single-node
-network.host: 127.0.0.1
-xpack.security.enabled: false
-xpack.security.transport.ssl.enabled: false
-xpack.security.http.ssl.enabled: false
-bootstrap.memory_lock: false
-EOF
-    systemctl daemon-reload
-    systemctl restart -q elasticsearch
-    for i in $(seq 1 30); do
-      if curl -s http://127.0.0.1:9200 >/dev/null 2>&1; then
-        break
-      fi
-      sleep 2
-    done
-    REBUILD_INDEX=true
-    msg_ok "Upgraded Elasticsearch to 8.x"
-  fi
-
  msg_info "Updating Zammad"
  apt_update_safe
  $STD apt-mark hold zammad
@@ -100,12 +42,6 @@ EOF
  $STD apt upgrade -y
  msg_ok "Updated Zammad"

-  if [[ "$REBUILD_INDEX" == true ]]; then
-    msg_info "Rebuilding Search Index"
-    $STD zammad run rake zammad:searchindex:rebuild
-    msg_ok "Rebuilt Search Index"
-  fi
-
  msg_info "Starting Service"
  systemctl start zammad
  msg_ok "Started Service"
@@ -2,7 +2,7 @@
 _cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
 source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
 # Copyright (c) 2021-2026 community-scripts ORG
-# Author: dave-yap (dave-yap) | Co-Author: remz1337, MickLesk (CanbiZ)
+# Author: dave-yap (dave-yap)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://zitadel.com/ | Github: https://github.com/zitadel/zitadel

@@ -16,23 +16,11 @@ var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

-if [[ -z "${var_zitadel_login:-}" ]] && command -v pveversion >/dev/null 2>&1; then
-  var_zitadel_login=$(msg_menu "Choose the Zitadel login UI" \
-    "v2" "Login V2, Zitadel's default (HTTPS, self-signed certificate)" \
-    "v1" "Login V1, the classic login built into the API (HTTP)")
-fi
-export var_zitadel_login="${var_zitadel_login:-v2}"
-
 header_info "$APP"
 variables
 color
 catch_errors

-if [[ ! "${var_zitadel_login}" =~ ^v[12]$ ]]; then
-  msg_error "var_zitadel_login must be v1 or v2"
-  exit 1
-fi
-
 function update_script() {
  header_info
  check_container_storage
@@ -43,29 +31,20 @@ function update_script() {
  fi

  if check_for_gh_release "zitadel" "zitadel/zitadel"; then
-    msg_info "Stopping Zitadel"
-    if [[ -f /etc/systemd/system/zitadel-login.service ]]; then
-      systemctl stop zitadel-login
-    fi
+    msg_info "Stopping Service"
    systemctl stop zitadel
-    msg_ok "Stopped Zitadel"
+    msg_ok "Stopped Service"

-    fetch_and_deploy_gh_release "zitadel" "zitadel/zitadel" "prebuild" "${CHECK_UPDATE_RELEASE}" "/usr/local/bin" "zitadel-linux-$(arch_resolve).tar.gz"
-    if [[ -f /etc/systemd/system/zitadel-login.service ]]; then
-      NODE_VERSION="24" setup_nodejs
-      CLEAN_INSTALL=1 fetch_and_deploy_gh_release "zitadel-login" "zitadel/zitadel" "prebuild" "${CHECK_UPDATE_RELEASE}" "/opt/zitadel-login" "zitadel-login.tar.gz"
-    fi
+    rm -f /usr/local/bin/zitadel
+    fetch_and_deploy_gh_release "zitadel" "zitadel/zitadel" "prebuild" "latest" "/usr/local/bin" "zitadel-linux-$(arch_resolve).tar.gz"

-    msg_info "Migrating Zitadel Database"
+    msg_info "Updating Zitadel"
    $STD zitadel setup --masterkeyFile /opt/zitadel/.masterkey --config /opt/zitadel/config.yaml --init-projections=true
-    msg_ok "Migrated Zitadel Database"
+    msg_ok "Updated Zitadel"

-    msg_info "Starting Zitadel"
+    msg_info "Starting Service"
    systemctl start zitadel
-    if [[ -f /etc/systemd/system/zitadel-login.service ]]; then
-      systemctl start zitadel-login
-    fi
-    msg_ok "Started Zitadel"
+    msg_ok "Started Service"
    msg_ok "Updated successfully!"
  fi
  exit
@@ -78,9 +57,4 @@ description
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-if [[ "${var_zitadel_login}" == "v1" ]]; then
-  echo -e "${GATEWAY}${BGN}http://${IP}:8080/ui/console${CL}"
-else
-  echo -e "${GATEWAY}${BGN}https://${IP}:8080/ui/console${CL}"
-fi
-echo -e "${INFO}${YW}Admin credentials: ~/zitadel.creds (inside the container)${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8080/ui/console${CL}"
@@ -36,6 +36,7 @@ sed -i -e "s|^APP_URL=.*|APP_URL=http://$LOCAL_IP|" \
  -e "s|^DB_USERNAME=$|DB_USERNAME=$MARIADB_DB_USER|" \
  -e "s|^DB_PASSWORD=$|DB_PASSWORD=$MARIADB_DB_PASS|" .env
 export COMPOSER_ALLOW_SUPERUSER=1
+$STD composer update --no-plugins --no-scripts
 $STD composer install --no-dev --prefer-dist --no-plugins --no-scripts
 $STD php artisan key:generate --force
 $STD php artisan migrate:refresh
@@ -12,11 +12,6 @@ setting_up_container
 network_check
 update_os

-if is_debian && [[ "$(get_os_version_major)" -lt 13 ]]; then
-  msg_error "Apache Guacamole needs Debian 13: freerdp3-dev is not available on Debian 12."
-  exit 238
-fi
-
 msg_info "Installing Dependencies"
 $STD apt install -y \
  build-essential \
@@ -13,14 +13,12 @@ setting_up_container
 network_check
 update_os

-version="${var_apache_tomcat_version:-}"
-[[ -n "$version" ]] || read -r -p "${TAB3}Which Tomcat version would you like to install? (9, 10.1, 11): " version || true
-jdk_version="${var_apache_tomcat_jdk_version:-}"
+read -r -p "${TAB3}Which Tomcat version would you like to install? (9, 10.1, 11): " version
 case $version in
 9)
  TOMCAT_VERSION="9"
  echo "Which LTS Java version would you like to use? (8, 11, 17, 21): "
-  [[ -n "$jdk_version" ]] || read -r jdk_version || true
+  read -r jdk_version
  case $jdk_version in
  8 | 11 | 17 | 21)
    JAVA_VERSION="$jdk_version" setup_java
@@ -34,7 +32,7 @@ case $version in
 10 | 10.1)
  TOMCAT_VERSION="10"
  echo "Which LTS Java version would you like to use? (11, 17, 21): "
-  [[ -n "$jdk_version" ]] || read -r jdk_version || true
+  read -r jdk_version
  case $jdk_version in
  11 | 17 | 21)
    JAVA_VERSION="$jdk_version" setup_java
@@ -48,7 +46,7 @@ case $version in
 11)
  TOMCAT_VERSION="11"
  echo "Which LTS Java version would you like to use? (17, 21): "
-  [[ -n "$jdk_version" ]] || read -r jdk_version || true
+  read -r jdk_version
  case $jdk_version in
  17 | 21)
    JAVA_VERSION="$jdk_version" setup_java
@@ -29,7 +29,7 @@ cp ./requirements.txt /etc/requirements.txt
 $STD uv venv /opt/apprise/.venv
 $STD uv pip install -r requirements.txt gunicorn supervisor -p /opt/apprise/.venv/bin/python
 ln -sf /opt/apprise/.venv/bin/supervisord /opt/apprise/.venv/bin/gunicorn /usr/local/bin/
-cp -fr apprise_api/static/. /usr/share/nginx/html/s/
+cp -fr apprise_api/static /usr/share/nginx/html/s/
 mv apprise_api/ webapp
 touch /etc/nginx/server-override.conf
 touch /etc/nginx/location-override.conf
@@ -17,8 +17,7 @@ msg_info "Installing Aria2"
 $STD apt install -y aria2
 msg_ok "Installed Aria2"

-prompt="${var_aria2_ariang:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add AriaNG? <y/N> " prompt || true
+read -r -p "${TAB3}Would you like to add AriaNG? <y/N> " prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  msg_info "Installing Dependencies"
  $STD apt install -y nginx
@@ -47,8 +47,7 @@ Choose Asterisk version to install:
 2) Latest LTS ($LTS_VERSION)
 3) Latest Certified ($CERT_VERSION)
 EOF
-ASTERISK_CHOICE="${var_asterisk_version:-}"
-[[ -n "$ASTERISK_CHOICE" ]] || read -rp "Enter choice [1-3]: " ASTERISK_CHOICE || true
+read -rp "Enter choice [1-3]: " ASTERISK_CHOICE

 CERTIFIED=0
 case "$ASTERISK_CHOICE" in
@@ -17,10 +17,9 @@ fetch_and_deploy_gh_release "authelia" "authelia/authelia" "binary"

 MAX_ATTEMPTS=3
 attempt=0
-DOMAIN="${var_authelia_domain:-}"
 while true; do
  attempt=$((attempt + 1))
-  [[ -n "$DOMAIN" ]] || read -rp "${TAB3}Enter your domain or IP (ex. example.com or 192.168.1.100): " DOMAIN || true
+  read -rp "${TAB3}Enter your domain or IP (ex. example.com or 192.168.1.100): " DOMAIN
  if [[ -z "$DOMAIN" ]]; then
    if ((attempt >= MAX_ATTEMPTS)); then
      DOMAIN="${LOCAL_IP:-localhost}"
@@ -41,13 +40,11 @@ while true; do
      break
    else
      msg_warn "Invalid IP address!"
-      DOMAIN=""
    fi
  elif [[ "$DOMAIN" =~ ^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*\.[a-zA-Z]{2,}$ ]]; then
    break
  else
    msg_warn "Invalid domain format!"
-    DOMAIN=""
  fi
 done
 msg_info "Setting Authelia up"
@@ -57,7 +57,7 @@ PG_VERSION="17" setup_postgresql
 PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db

 XMLSEC_VERSION="1.3.12"
-AUTHENTIK_VERSION="version/2026.8.4"
+AUTHENTIK_VERSION="version/2026.8.3"
 fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec"
 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
 GO_VERSION="$(grep -m1 '^go ' /opt/authentik/go.mod | awk '{print $2}')" setup_go
@@ -15,8 +15,7 @@ update_os

 fetch_and_deploy_gh_release "bichon" "rustmailer/bichon" "prebuild" "latest" "/opt/bichon" "bichon-*-$(arch_resolve "x86_64" "aarch64")-unknown-linux-gnu.tar.gz"

-bichon_url="${var_bichon_url:-}"
-[[ -n "$bichon_url" ]] || read -r -p "${TAB3}Enter the public URL for Bichon (e.g., https://bichon.yourdomain.com) or leave empty to use container IP: " bichon_url || true
+read -r -p "${TAB3}Enter the public URL for Bichon (e.g., https://bichon.yourdomain.com) or leave empty to use container IP: " bichon_url
 if [[ -z "$bichon_url" ]]; then
  msg_info "No URL provided"
  BICHON_PUBLIC_URL="http://$LOCAL_IP:15630"
@@ -34,8 +34,7 @@ setup_deb_based() {
  chmod +x bitmagnet
  msg_ok "Configured bitmagnet"

-  tmdbapikey="${var_bitmagnet_tmdb_api_key:-}"
-  [[ -n "$tmdbapikey" ]] || read -r -p "${TAB3}Enter your TMDB API key if you have one: " tmdbapikey || true
+  read -r -p "${TAB3}Enter your TMDB API key if you have one: " tmdbapikey

  cat <<EOF >/etc/bitmagnet.env
 POSTGRES_HOST=localhost
@@ -100,8 +99,7 @@ setup_alpine() {
  $STD su - postgres -c "psql -c 'CREATE DATABASE bitmagnet;'"
  msg_ok "Built bitmagnet"

-  tmdbapikey="${var_bitmagnet_tmdb_api_key:-}"
-  [[ -n "$tmdbapikey" ]] || read -rp "${TAB3}Enter your TMDB API key if you have one: " tmdbapikey || true
+  read -rp "${TAB3}Enter your TMDB API key if you have one: " tmdbapikey

  msg_info "Enabling bitmagnet Service"
  cat <<EOF >/etc/init.d/bitmagnet
@@ -20,7 +20,16 @@ $STD apt install -y \
 msg_ok "Installed Dependencies"

 RELEASE=$(get_latest_github_release "bunkerity/bunkerweb")
-confirm_external_installer "install-bunkerweb.sh" "https://github.com/bunkerity/bunkerweb/raw/v${RELEASE}/misc/install-bunkerweb.sh"
+msg_warn "WARNING: This script will run an external installer from a third-party source (install-bunkerweb.sh)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://github.com/bunkerity/bunkerweb/raw/v${RELEASE}/misc/install-bunkerweb.sh"
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi
 msg_info "Installing BunkerWeb (Patience)"
 curl -fsSL -o install-bunkerweb.sh "https://github.com/bunkerity/bunkerweb/raw/v${RELEASE}/misc/install-bunkerweb.sh"
 chmod +x install-bunkerweb.sh
@@ -24,8 +24,7 @@ cd /opt/bytestash/client
 $STD npm install
 msg_ok "Installed ByteStash"

-allowreg="${var_bytestash_registration:-}"
-[[ -n "$allowreg" ]] || read -rp "${TAB3}Do you want to allow registration of multiple accounts? [y/n]: " allowreg || true
+read -rp "${TAB3}Do you want to allow registration of multiple accounts? [y/n]: " allowreg

 msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/bytestash-backend.service
@@ -43,7 +42,7 @@ Environment=JWT_SECRET=$JWT_SECRET
 WantedBy=multi-user.target
 EOF

-if [[ "${allowreg,,}" =~ ^(y|yes)$ ]]; then
+if [[ "$allowreg" =~ ^[Yy]$ ]]; then
  sed -i '8i\Environment=ALLOW_NEW_ACCOUNTS=true' /etc/systemd/system/bytestash-backend.service
 fi

@@ -14,11 +14,23 @@ network_check
 update_os

 setup_deb_based() {
-  fetch_and_deploy_gh_release "caddy" "caddyserver/caddy" "binary" "latest" "/opt/caddy" "caddy_*_linux_$(arch_resolve).deb"
-  systemctl enable -q --now caddy
+  msg_info "Installing Dependencies"
+  $STD apt install -y \
+    debian-keyring \
+    debian-archive-keyring \
+    apt-transport-https
+  msg_ok "Installed Dependencies"

-  prompt="${var_caddy_xcaddy:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install xCaddy Addon? <y/N> " prompt || true
+  msg_info "Installing Caddy"
+  setup_deb822_repo \
+    "caddy" \
+    "https://dl.cloudsmith.io/public/caddy/stable/gpg.key" \
+    "https://dl.cloudsmith.io/public/caddy/stable/deb/debian" \
+    "any-version"
+  $STD apt install -y caddy
+  msg_ok "Installed Caddy"
+
+  read -r -p "${TAB3}Would you like to install xCaddy Addon? <y/N> " prompt
  if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
    setup_go
    fetch_and_deploy_gh_release "xcaddy" "caddyserver/xcaddy" "binary"
@@ -63,8 +75,7 @@ EOF
 EOF
  msg_ok "Installed Caddy"

-  prompt="${var_caddy_xcaddy:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install xCaddy Addon? <y/N> " prompt || true
+  read -r -p "${TAB3}Would you like to install xCaddy Addon? <y/N> " prompt
  if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
    GO_VERSION="$(curl -fsSL https://go.dev/VERSION?m=text | head -1 | cut -c3-)" setup_go
    fetch_and_deploy_gh_release "xcaddy" "caddyserver/xcaddy" "prebuild" "latest" "/opt/xcaddy" "xcaddy_*_linux_$(arch_resolve).tar.gz"
@@ -1,77 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: Jelcoo
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://calagopus.com/
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-msg_info "Installing Dependencies"
-$STD apt install -y valkey
-systemctl enable -q --now valkey-server
-msg_ok "Installed Dependencies"
-
-PG_VERSION="18" setup_postgresql
-PG_DB_NAME="panel" PG_DB_USER="calagopus" setup_postgresql_db
-
-setup_docker
-
-fetch_and_deploy_gh_release "calagopus-panel" "calagopus/panel" "singlefile" "latest" "/usr/local/bin" "panel-rs-aio-$(arch_resolve x86_64 aarch64)-linux"
-
-msg_info "Configuring Calagopus"
-mkdir -p /etc/calagopus /var/lib/calagopus /var/log/calagopus
-mkdir -p /etc/calagopus-wings /var/lib/calagopus-wings /var/log/calagopus-wings /tmp/calagopus-wings
-
-APP_ENCRYPTION_KEY=$(openssl rand -hex 16)
-cat <<EOF >/etc/calagopus/.env
-DATABASE_URL=postgresql://${PG_DB_USER}:${PG_DB_PASS}@localhost:5432/${PG_DB_NAME}
-DATABASE_MIGRATE=true
-REDIS_URL=redis://localhost
-PORT=8000
-APP_ENCRYPTION_KEY=${APP_ENCRYPTION_KEY}
-APP_LOG_DIRECTORY=/var/log/calagopus
-APP_PRIMARY=true
-APP_ENABLE_WINGS_PROXY=true
-APP_USE_DECRYPTION_CACHE=true
-APP_USE_INTERNAL_CACHE=true
-AIO_BASE_WINGS_CONFIGURATION=/etc/calagopus/wings-config.yml
-EOF
-chmod 600 /etc/calagopus/.env
-
-cat <<EOF >/etc/calagopus/wings-config.yml
-app_name: Calagopus
-EOF
-msg_ok "Configured Calagopus"
-
-msg_info "Creating Service"
-cat <<EOF >/etc/systemd/system/calagopus-panel.service
-[Unit]
-Description=Calagopus Panel
-After=network.target postgresql.service valkey-server.service docker.service
-Requires=postgresql.service valkey-server.service docker.service
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=/etc/calagopus
-EnvironmentFile=/etc/calagopus/.env
-ExecStart=/usr/local/bin/calagopus-panel
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now calagopus-panel
-msg_ok "Created Service"
-
-motd_ssh
-customize
-cleanup_lxc
@@ -13,7 +13,16 @@ setting_up_container
 network_check
 update_os

-confirm_external_installer "https://casaos.zimaspace.com/" "https://get.casaos.io/"
+msg_warn "WARNING: This script will run an external installer from a third-party source (https://casaos.zimaspace.com/)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://get.casaos.io/"
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi
 msg_info "Installing CasaOS (Patience)"
 DOCKER_CONFIG_PATH='/etc/docker/daemon.json'
 mkdir -p $(dirname $DOCKER_CONFIG_PATH)
@@ -19,7 +19,16 @@ $STD apt install -y \
  xvfb
 msg_ok "Installed Dependencies"

-confirm_external_installer "https://getchannels.com" "https://getchannels.com/dvr/setup.sh"
+msg_warn "WARNING: This script will run an external installer from a third-party source (https://getchannels.com)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://getchannels.com/dvr/setup.sh"
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi

 setup_hwaccel

@@ -13,18 +13,15 @@ setting_up_container
 network_check
 update_os

-var_cf_api_token="${var_cf_api_token:-}"
-[[ -n "$var_cf_api_token" ]] || read -rp "${TAB3}Enter the Cloudflare API token: " var_cf_api_token || true
-[[ -n "$var_cf_api_token" ]] || { msg_error "No Cloudflare API token given; set var_cf_api_token or answer the prompt"; exit 64; }
+var_cf_api_token="default"
+read -rp "${TAB3}Enter the Cloudflare API token: " var_cf_api_token

-var_cf_domains="${var_cf_domains:-}"
-[[ -n "$var_cf_domains" ]] || read -rp "${TAB3}Enter the domains separated with a comma (*.example.org,www.example.org) " var_cf_domains || true
-[[ -n "$var_cf_domains" ]] || { msg_error "No domains given; set var_cf_domains or answer the prompt"; exit 64; }
+var_cf_domains="default"
+read -rp "${TAB3}Enter the domains separated with a comma (*.example.org,www.example.org) " var_cf_domains

 var_cf_proxied="false"
-answer="${var_cloudflare_ddns_proxied:-}"
 while true; do
-  [[ -n "$answer" ]] || read -rp "${TAB3}Proxied? (y/n): " answer || answer="n"
+  read -rp "${TAB3}Proxied? (y/n): " answer
  case "$answer" in
  [Yy]*)
    var_cf_proxied="true"
@@ -34,13 +31,12 @@ while true; do
    var_cf_proxied="false"
    break
    ;;
-  *) echo "Please answer y or n."; answer="" ;;
+  *) echo "Please answer y or n." ;;
  esac
 done
 var_cf_ip6_provider="none"
-answer="${var_cloudflare_ddns_ipv6:-}"
 while true; do
-  [[ -n "$answer" ]] || read -rp "${TAB3}Enable IPv6 support? (y/n): " answer || answer="n"
+  read -rp "${TAB3}Enable IPv6 support? (y/n): " answer
  case "$answer" in
  [Yy]*)
    var_cf_ip6_provider="cloudflare.trace"
@@ -50,7 +46,7 @@ while true; do
    var_cf_ip6_provider="none"
    break
    ;;
-  *) echo "Please answer y or n."; answer="" ;;
+  *) echo "Please answer y or n." ;;
  esac
 done
 msg_ok "Configured Application"
@@ -31,10 +31,7 @@ sed -i "s/root//g" /etc/cockpit/disallowed-users
 msg_ok "Installed Cockpit"

 # 45Drives only publishes amd64 packages
-if [[ "$(arch_resolve)" != "arm64" ]]; then
-  prompt="${var_cockpit_45drives:-}"
-  [[ -n "$prompt" ]] || read -r -p "Would you like to install 45Drives' cockpit-file-sharing, cockpit-identities, and cockpit-navigator  <y/N> " prompt || true
-fi
+[[ "$(arch_resolve)" == "arm64" ]] || read -r -p "Would you like to install 45Drives' cockpit-file-sharing, cockpit-identities, and cockpit-navigator  <y/N> " prompt
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
  msg_info "Installing 45Drives' cockpit extensions"
  setup_deb822_repo "45drives" \
@@ -17,8 +17,7 @@ setup_hwaccel
 echo
 echo "${TAB3}Choose the GPU type for ComfyUI:"
 echo "${TAB3}[1]-None  [2]-NVIDIA  [3]-AMD  [4]-Intel"
-gpu_choice="${var_comfyui_gpu_type:-}"
-[[ -n "$gpu_choice" ]] || read -rp "${TAB3}Enter your choice [1-4] (default: 1): " gpu_choice || true
+read -rp "${TAB3}Enter your choice [1-4] (default: 1): " gpu_choice
 gpu_choice=${gpu_choice:-1}
 case "$gpu_choice" in
 1) comfyui_gpu_type="none" ;;
@@ -19,24 +19,19 @@ msg_ok "Installed Dependencies"

 NODE_VERSION="22" setup_nodejs

-onlyoffice="${var_cryptpad_onlyoffice:-}"
-[[ -n "$onlyoffice" ]] || read -rp "${TAB3}Install OnlyOffice components instead of CKEditor? (Y/N): " onlyoffice || true
+read -rp "${TAB3}Install OnlyOffice components instead of CKEditor? (Y/N): " onlyoffice
 fetch_and_deploy_gh_release "cryptpad" "cryptpad/cryptpad" "tarball"

 msg_info "Setup CryptPad"
 cd /opt/cryptpad
 $STD npm ci --allow-git=all
 $STD npm run install:components
-if [[ "${onlyoffice,,}" =~ ^(y|yes)$ ]]; then
-  $STD bash -c "./install-office.sh --accept-license"
+if [[ "$onlyoffice" =~ ^[Yy]$ ]]; then
+  $STD bash -c "./install-onlyoffice.sh --accept-license"
 fi
 cp config/config.example.js config/config.js
-cp config/infra.example.js config/infra.js
-sed -i \
-  -e "s|origin: \"http://localhost:3000\"|origin: \"http://${LOCAL_IP}:3000\"|" \
-  -e "s|sandboxOrigin: \"http://localhost:3001\"|sandboxOrigin: \"http://${LOCAL_IP}:3001\"|" \
-  -e "s|httpHost: \"localhost\"|httpHost: \"0.0.0.0\"|" \
-  config/infra.js
+sed -i "51s/localhost/${LOCAL_IP}/g" /opt/cryptpad/config/config.js
+sed -i "80s#//httpAddress: 'localhost'#httpAddress: '0.0.0.0'#g" /opt/cryptpad/config/config.js
 $STD npm run build
 msg_ok "Setup CryptPad"

@@ -15,8 +15,11 @@ update_os

 setup_deb_based() {
  setup_docker
-  socket_choice="${var_docker_socket:-}"
-  [[ -n "$socket_choice" ]] || read -r -p "${TAB3}Expose Docker TCP socket (insecure) ? [n = No, l = Local only (127.0.0.1), a = All interfaces (0.0.0.0)] <n/l/a>: " socket_choice || true
+  if [[ -n "${var_docker_socket:-}" ]]; then
+    socket_choice="$var_docker_socket"
+  else
+    read -r -p "${TAB3}Expose Docker TCP socket (insecure) ? [n = No, l = Local only (127.0.0.1), a = All interfaces (0.0.0.0)] <n/l/a>: " socket_choice
+  fi
  case "${socket_choice,,}" in
  l | local)
    socket="tcp://127.0.0.1:2375"
@@ -67,8 +70,11 @@ setup_alpine() {
  msg_ok "Installed Docker"

  DOCKER_COMPOSE_LATEST_VERSION=$(get_latest_github_release "docker/compose" false)
-  prompt="${var_docker_compose:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Docker Compose? <y/N> " prompt || true
+  if [[ -n "${var_docker_compose:-}" ]]; then
+    prompt="$var_docker_compose"
+  else
+    read -r -p "${TAB3}Would you like to add Docker Compose? <y/N> " prompt
+  fi
  if [[ "${prompt,,}" =~ ^(y|yes|true)$ ]]; then
    msg_info "Installing Docker Compose $DOCKER_COMPOSE_LATEST_VERSION"
    DOCKER_CONFIG=${DOCKER_CONFIG:-$HOME/.docker}
@@ -77,8 +83,11 @@ setup_alpine() {
    chmod +x "$DOCKER_CONFIG"/cli-plugins/docker-compose
    msg_ok "Installed Docker Compose $DOCKER_COMPOSE_LATEST_VERSION"
  fi
-  prompt="${var_docker_socket:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to expose the Docker TCP socket? <y/N> " prompt || true
+  if [[ -n "${var_docker_socket:-}" ]]; then
+    prompt="$var_docker_socket"
+  else
+    read -r -p "${TAB3}Would you like to expose the Docker TCP socket? <y/N> " prompt
+  fi
  case "${prompt,,}" in
  y | yes | a | all) socket="tcp://0.0.0.0:2375" ;;
  l | local) socket="tcp://127.0.0.1:2375" ;;
@@ -21,7 +21,6 @@ fetch_and_deploy_gh_release "donetick" "donetick/donetick" "prebuild" "latest" "

 msg_info "Setup Donetick"
 cd /opt/donetick
-[[ -f config/selfhosted.yaml ]] || cp config/selfhosted.yaml.example config/selfhosted.yaml
 TOKEN=$(openssl rand -hex 16)
 sed -i -e "s/change_this_to_a_secure_random_string_32_characters_long/${TOKEN}/g" config/selfhosted.yaml
 msg_ok "Setup Donetick"
@@ -26,9 +26,8 @@ $STD apt install -y \
  nginx
 msg_ok "Installed Dependencies"

-var_project_name="${var_project_name:-}"
-[[ -n "$var_project_name" ]] || read -r -p "${TAB3}Type the assembly name of the project: " var_project_name || true
-[[ -n "$var_project_name" ]] || { msg_error "No assembly name given; set var_project_name or answer the prompt"; exit 64; }
+var_project_name="default"
+read -r -p "${TAB3}Type the assembly name of the project: " var_project_name

 msg_info "Setting up FTP Server"
 useradd ftpuser
@@ -1,66 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/henriquesebastiao/downtify
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-setup_ffmpeg
-PYTHON_VERSION="3.14" setup_uv
-NODE_VERSION="26" setup_nodejs
-# yt-dlp solves YouTube's JavaScript challenges with Deno
-fetch_and_deploy_gh_release "deno" "denoland/deno" "prebuild" "latest" "/usr/local/bin" "deno-$(arch_resolve "x86_64" "aarch64")-unknown-linux-gnu.zip"
-fetch_and_deploy_gh_release "downtify" "henriquesebastiao/downtify" "tarball"
-
-msg_info "Building Downtify"
-cd /opt/downtify/frontend
-$STD npm ci
-$STD npm run build
-rm -rf /opt/downtify/frontend/node_modules
-cd /opt/downtify
-# pyproject.toml sets [tool.uv] upgrade = true, so --locked fails whenever PyPI has anything newer than uv.lock
-$STD uv sync --frozen --no-dev --python 3.14
-msg_ok "Built Downtify"
-
-msg_info "Configuring Downtify"
-mkdir -p /opt/downtify_data/{data,downloads}
-cat <<EOF >/opt/downtify_data/.env
-DATABASE_DIR=/opt/downtify_data/data
-DOWNLOAD_DIR=/opt/downtify_data/downloads
-EOF
-msg_ok "Configured Downtify"
-
-msg_info "Creating Downtify Service"
-cat <<EOF >/etc/systemd/system/downtify.service
-[Unit]
-Description=Downtify
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=/opt/downtify
-EnvironmentFile=/opt/downtify_data/.env
-Environment=WEB_GUI_LOCATION=/opt/downtify/frontend/dist
-ExecStart=/opt/downtify/.venv/bin/python /opt/downtify/main.py web
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now downtify
-msg_ok "Created Downtify Service"
-
-motd_ssh
-customize
-cleanup_lxc
@@ -44,7 +44,6 @@ User=root
 WorkingDirectory=/opt/droppedneedle/backend
 Environment=ROOT_APP_DIR=/opt/droppedneedle/backend
 Environment=PORT=8688
-Environment=COMMIT_TAG=v$(<~/.droppedneedle)
 # Environment=SLSKD_DOWNLOADS_PATH=<path-to-slskd-downloads>
 ExecStart=/opt/droppedneedle/venv/bin/python -m maintenance.automatic_upgrade --start-target
 Restart=on-failure
@@ -23,9 +23,7 @@ NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs

 echo "${TAB3}It is important to choose the name for your server before you install Synapse, because it cannot be changed later."
 echo "${TAB3}The server name determines the “domain” part of user-ids for users on your server: these will all be of the format @user:my.domain.name. It also determines how other matrix servers will reach yours for federation."
-servername="${var_elementsynapse_server_name:-}"
-[[ -n "$servername" ]] || read -r -p "${TAB3}Please enter the name for your server: " servername || true
-[[ -n "$servername" ]] || { msg_error "No server name given; set var_elementsynapse_server_name or answer the prompt"; exit 64; }
+read -p "${TAB3}Please enter the name for your server: " servername

 msg_info "Installing Element Synapse"
 setup_deb822_repo "matrix-org" \
@@ -38,8 +38,7 @@ rm -f "$DEB_FILE"
 echo "$LATEST_VERSION" >~/.emqx
 msg_ok "Installed EMQX"

-prompt="${var_emqx_disable_mq:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to disable the EMQX MQ feature? (reduces disk/CPU usage) <y/N> " prompt || true
+read -r -p "${TAB3}Would you like to disable the EMQX MQ feature? (reduces disk/CPU usage) <y/N> " prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  msg_info "Disabling EMQX MQ feature"
  mkdir -p /etc/emqx
@@ -45,8 +45,7 @@ $STD ln -svf /usr/bin/ffmpeg /usr/local/bin/ffmpeg
 $STD ln -svf /usr/bin/ffprobe /usr/local/bin/ffprobe
 $STD rm -rf /opt/fileflows/Server/runtimes/win-*

-install_server="${var_fileflows_mode:-}"
-[[ -n "$install_server" ]] || read -r -p "${TAB3}Do you want to install FileFlows Server or Agent? (S/A): " install_server || true
+read -r -p "${TAB3}Do you want to install FileFlows Server or Agent? (S/A): " install_server

 if [[ "$install_server" =~ ^[Ss]$ ]]; then
  msg_info "Installing FileFlows Server"
@@ -55,10 +54,9 @@ if [[ "$install_server" =~ ^[Ss]$ ]]; then
  systemctl enable -q --now fileflows
  msg_ok "Installed FileFlows Server"
 else
-  server_url="${var_fileflows_server_url:-}"
-  [[ -n "$server_url" ]] || read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url || true
+  read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url
  while [[ -z "${server_url// /}" ]]; do
-    read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url || { msg_error "No FileFlows Server URL given; set var_fileflows_server_url or answer the prompt"; exit 64; }
+    read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url
  done
  msg_info "Installing FileFlows Agent"
  cd /opt/fileflows/Agent
@@ -48,7 +48,6 @@ RestartSec=5
 Type=simple
 Environment="LOG_LEVEL=info"
 Environment="CAPTCHA_SOLVER=none"
-Environment="LANG=en-US"
 WorkingDirectory=/opt/flaresolverr
 ExecStart=/opt/flaresolverr/flaresolverr
 TimeoutStopSec=30
@@ -15,12 +15,12 @@ update_os
 setup_yq

 if [[ -z "${var_forgejo_instance:-}" ]]; then
-  read -r -p "${TAB3}Forgejo Instance URL (e.g. https://codeberg.org): " var_forgejo_instance || true
+  read -r -p "${TAB3}Forgejo Instance URL (e.g. https://codeberg.org): " var_forgejo_instance
  var_forgejo_instance="${var_forgejo_instance:-https://codeberg.org}"
 fi

 if [[ -z "${var_forgejo_runner_uuid:-}" ]]; then
-  read -r -p "${TAB3}Forgejo Runner UUID: " var_forgejo_runner_uuid || true
+  read -r -p "${TAB3}Forgejo Runner UUID: " var_forgejo_runner_uuid
 fi

 if [[ -z "${var_forgejo_runner_uuid:-}" ]]; then
@@ -29,7 +29,7 @@ if [[ -z "${var_forgejo_runner_uuid:-}" ]]; then
 fi

 if [[ -z "${var_forgejo_runner_token:-}" ]]; then
-  read -r -p "${TAB3}Forgejo Runner Token: " var_forgejo_runner_token || true
+  read -r -p "${TAB3}Forgejo Runner Token: " var_forgejo_runner_token
 fi

 if [[ -z "${var_forgejo_runner_token:-}" ]]; then
@@ -39,7 +39,7 @@ fi

 DEFAULT_RUNNER_LABELS="linux-amd64:docker://node:22-bookworm"
 if [[ -z "${var_runner_labels:-}" ]]; then
-  read -r -p "${TAB3}Additional runner labels (comma-separated, or leave blank for default only): " var_runner_labels || true
+  read -r -p "${TAB3}Additional runner labels (comma-separated, or leave blank for default only): " var_runner_labels
 fi
 if [[ -n "${var_runner_labels:-}" ]]; then
  RUNNER_LABELS="${DEFAULT_RUNNER_LABELS},${var_runner_labels}"
@@ -19,15 +19,17 @@ $STD apt install -y \
  nginx
 msg_ok "Installed Dependencies"

-PG_VERSION="18" PG_MODULES="postgis" setup_postgresql
+PG_VERSION="17" PG_MODULES="postgis" setup_postgresql
 PG_DB_NAME="geopulse" PG_DB_USER="geopulse" PG_DB_EXTENSIONS="postgis,postgis_topology" setup_postgresql_db

 msg_info "Generating Security Keys"
 mkdir -p /opt/geopulse/{backend,keys}
 mkdir -p /etc/geopulse /var/www/geopulse /var/lib/geopulse/dumps
 mkdir -p /var/log/geopulse/{backend,nginx}
+openssl genpkey -algorithm RSA -out /opt/geopulse/keys/jwt-private-key.pem 2>/dev/null
+openssl rsa -pubout -in /opt/geopulse/keys/jwt-private-key.pem -out /opt/geopulse/keys/jwt-public-key.pem 2>/dev/null
 openssl rand -base64 32 >/opt/geopulse/keys/ai-encryption-key.txt
-chmod 640 /opt/geopulse/keys/ai-encryption-key.txt
+chmod 640 /opt/geopulse/keys/jwt-private-key.pem /opt/geopulse/keys/jwt-public-key.pem /opt/geopulse/keys/ai-encryption-key.txt
 msg_ok "Generated Security Keys"

 if [[ "$(uname -m)" == "aarch64" ]]; then
@@ -60,6 +62,8 @@ GEOPULSE_POSTGRES_PORT=5432
 GEOPULSE_POSTGRES_DB=${PG_DB_NAME}
 GEOPULSE_POSTGRES_USERNAME=${PG_DB_USER}
 GEOPULSE_POSTGRES_PASSWORD=${PG_DB_PASS}
+GEOPULSE_JWT_PRIVATE_KEY_LOCATION=file:/opt/geopulse/keys/jwt-private-key.pem
+GEOPULSE_JWT_PUBLIC_KEY_LOCATION=file:/opt/geopulse/keys/jwt-public-key.pem
 GEOPULSE_AI_ENCRYPTION_KEY_LOCATION=file:/opt/geopulse/keys/ai-encryption-key.txt
 QUARKUS_LOG_FILE_ENABLE=true
 QUARKUS_LOG_FILE_PATH=/var/log/geopulse/backend/geopulse.log
@@ -124,14 +128,6 @@ server {
        add_header Cache-Control "public, max-age=31536000";
    }

-    location ~* ^/(?!osm/).*\.mjs$ {
-        types {
-            application/javascript mjs;
-        }
-        expires 1y;
-        add_header Cache-Control "public, max-age=31536000";
-    }
-
    location ^~ /osm/tiles/ {
        resolver 8.8.8.8 valid=300s;
        resolver_timeout 10s;
@@ -51,10 +51,8 @@ echo -e ""
 msg_custom "🪙" "$YW" "CoinGecko API keys are optional but provide better cryptocurrency data."
 msg_custom "🪙" "$YW" "You can skip this and add them later by editing /opt/ghostfolio/.env"
 echo -e ""
-COINGECKO_DEMO_KEY="${var_ghostfolio_coingecko_demo_key:-}"
-[[ -n "$COINGECKO_DEMO_KEY" ]] || read -rp "${TAB3}CoinGecko Demo API key (press Enter to skip): " COINGECKO_DEMO_KEY || true
-COINGECKO_PRO_KEY="${var_ghostfolio_coingecko_pro_key:-}"
-[[ -n "$COINGECKO_PRO_KEY" ]] || read -rp "${TAB3}CoinGecko Pro API key (press Enter to skip): " COINGECKO_PRO_KEY || true
+read -rp "${TAB3}CoinGecko Demo API key (press Enter to skip): " COINGECKO_DEMO_KEY
+read -rp "${TAB3}CoinGecko Pro API key (press Enter to skip): " COINGECKO_PRO_KEY

 msg_info "Setting up Environment"
 cat <<EOF >/opt/ghostfolio/.env
@@ -27,7 +27,7 @@ ln -sf /usr/sbin/openvpn /usr/sbin/openvpn2.6
 msg_ok "Configured iptables"


-fetch_and_deploy_gh_release "gluetun" "passteque/gluetun" "tarball"
+fetch_and_deploy_gh_release "gluetun" "qdm12/gluetun" "tarball"
 GO_VERSION="$(grep -m1 '^go ' /opt/gluetun/go.mod | awk '{print $2}')" setup_go

 msg_info "Building Gluetun"
@@ -15,8 +15,7 @@ update_os

 fetch_and_deploy_gh_release "headscale" "juanfont/headscale" "binary"

-prompt="${var_headscale_admin:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add headscale-admin UI? <y/N> " prompt || true
+read -r -p "${TAB3}Would you like to add headscale-admin UI? <y/N> " prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  fetch_and_deploy_gh_release "headscale-admin" "GoodiesHQ/headscale-admin" "prebuild" "latest" "/opt/headscale-admin" "admin.zip"

@@ -33,11 +33,19 @@ NODE_OPTIONS=${NODE_OPTIONS}
 EOF
 msg_ok "Configured Service Environment"

-confirm_external_installer "https://hermes-agent.nousresearch.com/" "https://hermes-agent.nousresearch.com/install.sh"
+msg_warn "WARNING: This script will run an external installer from a third-party source (https://hermes-agent.nousresearch.com/)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://hermes-agent.nousresearch.com/install.sh"
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi

 msg_info "Installing Hermes Agent"
-curl_with_retry "https://hermes-agent.nousresearch.com/install.sh" /tmp/hermes-install.sh ||
-  curl_with_retry "https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scripts/install.sh" /tmp/hermes-install.sh
+curl -fsSL https://hermes-agent.nousresearch.com/install.sh -o /tmp/hermes-install.sh
 $STD setsid --wait bash -c '
  set -a; source /etc/default/hermes; set +a
  export npm_config_yes=true
@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os

-RELEASE="v3.3.5"
+RELEASE="v3.3.0"
 if lscpu | grep -q 'GenuineIntel'; then
  echo ""
  echo ""
@@ -25,7 +25,7 @@ if lscpu | grep -q 'GenuineIntel'; then
  echo " 2) **NEW** Intel OpenVINO CPU or iGPU"
  echo ""

-  read -r -p "${TAB3}Select machine-learning type [1]: " ML_TYPE || true
+  read -r -p "${TAB3}Select machine-learning type [1]: " ML_TYPE
  ML_TYPE="${ML_TYPE:-1}"
  if [[ "$ML_TYPE" == "2" ]]; then
    touch ~/.openvino
@@ -84,7 +84,6 @@ $STD apt install --no-install-recommends -y \
  liblqr-1-0 \
  libltdl7 \
  libopenjp2-7 \
-  libopenjp2-7-dev \
  meson \
  ninja-build \
  pkg-config \
@@ -110,7 +109,7 @@ setup_deb822_repo \
  "https://repo.jellyfin.org/jellyfin_team.gpg.key" \
  "https://repo.jellyfin.org/debian" \
  "$(get_os_info codename)"
-install_packages_with_retry jellyfin-ffmpeg7
+$STD apt install -y jellyfin-ffmpeg7
 ln -sf /usr/lib/jellyfin-ffmpeg/ffmpeg /usr/bin/ffmpeg
 ln -sf /usr/lib/jellyfin-ffmpeg/ffprobe /usr/bin/ffprobe

@@ -124,9 +123,12 @@ if [[ "$CTTYPE" == "0" && -d /dev/dri ]]; then
 fi
 msg_ok "Dependencies Installed"

-MISE_ARCH="x64"
-[[ "$(arch_resolve)" == "arm64" ]] && MISE_ARCH="arm64"
-fetch_and_deploy_gh_release "mise" "jdx/mise" "singlefile" "latest" "/usr/local/bin" "mise-v*-linux-${MISE_ARCH}"
+msg_info "Installing Mise"
+curl -fSs https://mise.jdx.dev/gpg-key.pub | tee /etc/apt/keyrings/mise-archive-keyring.pub 1>/dev/null
+echo "deb [signed-by=/etc/apt/keyrings/mise-archive-keyring.pub arch=$(arch_resolve)] https://mise.jdx.dev/deb stable main" >/etc/apt/sources.list.d/mise.list
+apt_update_safe
+$STD apt install -y mise
+msg_ok "Installed Mise"

 msg_info "Configuring Debian Testing Repo"
 if [[ -f /etc/apt/sources.list.d/debian.sources ]]; then
@@ -265,7 +267,8 @@ msg_ok "(2/6) Compiled jpegli"

 msg_info "(3/6) Compiling libheif"
 SOURCE=${SOURCE_DIR}/libheif
-LIBHEIF_REVISION="$(jq -cr '.revision' "$BASE_DIR"/server/sources/libheif.json)"
+LIBHEIF_REVISION="ac1cb05c39008f01525c991ff8b88f84ddf70fd2"
+# : "${LIBHEIF_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libheif.json)}"
 $STD git clone https://github.com/strukturag/libheif.git "$SOURCE"
 cd "$SOURCE"
 $STD git reset --hard "$LIBHEIF_REVISION"
@@ -21,8 +21,7 @@ setup_deb822_repo \
  "stable"
 msg_ok "Set up InfluxDB Repository"

-prompt="${var_influxdb_version:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Which version of InfluxDB to install? (1, 2 or 3) " prompt || true
+read -r -p "${TAB3}Which version of InfluxDB to install? (1, 2 or 3) " prompt
 if [[ $prompt == "3" ]]; then
  INFLUX="3"
 elif [[ $prompt == "2" ]]; then
@@ -51,8 +50,7 @@ else
 fi
 msg_ok "Installed InfluxDB"

-prompt="${var_influxdb_telegraf:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Telegraf? <y/N> " prompt || true
+read -r -p "${TAB3}Would you like to add Telegraf? <y/N> " prompt
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
  msg_info "Installing Telegraf"
  $STD apt install -y telegraf
@@ -16,17 +16,15 @@ update_os
 msg_info "Setting up InvenTree Repository"
 setup_deb822_repo \
  "inventree" \
-  "https://go.packager.io/srv/deb/inventree/InvenTree/gpg-key.asc" \
-  "https://go.packager.io/srv/deb/inventree/InvenTree/stable/$(get_os_info id)" \
+  "https://dl.packager.io/srv/inventree/InvenTree/key" \
+  "https://dl.packager.io/srv/deb/inventree/InvenTree/stable/$(get_os_info id)" \
  "$(get_os_info version)" \
  "main"
 msg_ok "Set up InvenTree Repository"

 msg_info "Installing InvenTree (Patience)"
-# The package's postinst walks parent PIDs until it reaches PID 1; under pct exec the chain ends at 0
-# and since 1.6.0 that loops forever, so apt runs as a child of systemd
-$STD systemd-run --wait --pipe --quiet --collect --setenv=SETUP_NO_CALLS=true --setenv=DEBIAN_FRONTEND=noninteractive \
-  apt-get install -y inventree
+export SETUP_NO_CALLS=true
+$STD apt install -y inventree
 msg_ok "Installed InvenTree"

 msg_info "Configuring InvenTree"
@@ -52,9 +52,6 @@ chown -R www-data:www-data /opt/invoiceshelf
 chmod -R 775 storage bootstrap/cache
 $STD php artisan migrate --force
 $STD php artisan storage:link
-cat <<'EOF' >/etc/cron.d/invoiceshelf
-* * * * * www-data cd /opt/invoiceshelf && php artisan schedule:run >> /dev/null 2>&1
-EOF
 msg_ok "Set up InvoiceShelf"

 msg_info "Configuring Caddy"
@@ -17,7 +17,16 @@ msg_info "Installing Dependencies"
 $STD apt install -y ca-certificates
 msg_ok "Installed Dependencies"

-confirm_external_installer "https://iobroker.net/" "https://iobroker.net/install.sh"
+msg_warn "WARNING: This script will run an external installer from a third-party source (https://iobroker.net/)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://iobroker.net/install.sh"
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi

 NODE_VERSION="24" NPM_VERSION="11" setup_nodejs

@@ -33,7 +33,7 @@ fetch_and_deploy_gh_release "karakeep" "karakeep-app/karakeep" "tarball"
 cd /opt/karakeep
 # Node 24.19.x crashes better-sqlite3 on cleanup (karakeep-app/karakeep#2989); stay on 22 LTS until upstream reverts.
 MODULE_VERSION="$(jq -r '.packageManager | split("@")[1]' /opt/karakeep/package.json)"
-NODE_VERSION="24" NODE_MODULE="pnpm@${MODULE_VERSION}" setup_nodejs
+NODE_VERSION="22" NODE_MODULE="pnpm@${MODULE_VERSION}" setup_nodejs

 msg_info "Installing external JavaScript Extension for yt-dlp"
 $STD pip install -U yt-dlp-ejs --break-system-packages
@@ -37,10 +37,10 @@ fi
 msg_ok "Installed Docker"

 msg_info "Detecting latest Kasm Workspaces release"
-KASM_URL=$(curl -s --max-time 30 https://kasm.com/downloads \
+KASM_URL=$(curl -s https://kasm.com/downloads \
  | grep -oP 'https://kasm-static-content\.s3\.amazonaws\.com/kasm_release_\d+\.\d+\.\d+-latest\.tar\.gz' \
-  | head -1 || true)
-KASM_VERSION=$(echo "$KASM_URL" | grep -oP '\d+\.\d+\.\d+(?=-latest)' || true)
+  | head -1)
+KASM_VERSION=$(echo "$KASM_URL" | grep -oP '\d+\.\d+\.\d+(?=-latest)')

 # Fallback to predefined version if online lookup failed.
 if [[ -z "$KASM_VERSION" ]] || [[ -z "$KASM_URL" ]]; then
@@ -56,14 +56,23 @@ if [[ -z "$KASM_VERSION" ]] || [[ -z "$KASM_URL" ]]; then
 fi
 msg_ok "Detected Kasm Workspaces version $KASM_VERSION"

-confirm_external_installer "https://www.kasmweb.com/" "install.sh inside tar.gz $KASM_URL"
+msg_warn "WARNING: This script will run an external installer from a third-party source (https://www.kasmweb.com/)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  install.sh inside tar.gz $KASM_URL"
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi

 msg_info "Installing Kasm Workspaces"
 curl_download "/opt/kasm_release_${KASM_VERSION}.tar.gz" "$KASM_URL"
 cd /opt
 tar -xf "kasm_release_${KASM_VERSION}.tar.gz"
 chmod +x /opt/kasm_release/install.sh
-bash /opt/kasm_release/install.sh --accept-eula --no-swap-check --no-check-disk --ignore-dep-failures >~/kasm-install.output 2>&1
+printf 'y\ny\ny\n4\n' | bash /opt/kasm_release/install.sh --ignore-dep-failures >~/kasm-install.output 2>&1
 awk '
  /^Kasm UI Login Credentials$/ {capture=1}
  capture {print}
@@ -28,15 +28,9 @@ mkdir -p config/assets
 cp config/config.yml.template config/config.yml
 msg_ok "Setup Kometa"

-TMDBKEY="${var_kometa_tmdb_key:-}"
-[[ -n "$TMDBKEY" ]] || read -r -p "${TAB3}Enter your TMDb API key: " TMDBKEY || true
-[[ -n "$TMDBKEY" ]] || { msg_error "No TMDb API key given; set var_kometa_tmdb_key or answer the prompt"; exit 64; }
-PLEXURL="${var_kometa_plex_url:-}"
-[[ -n "$PLEXURL" ]] || read -r -p "${TAB3}Enter your Plex URL: " PLEXURL || true
-[[ -n "$PLEXURL" ]] || { msg_error "No Plex URL given; set var_kometa_plex_url or answer the prompt"; exit 64; }
-PLEXTOKEN="${var_kometa_plex_token:-}"
-[[ -n "$PLEXTOKEN" ]] || read -r -p "${TAB3}Enter your Plex token: " PLEXTOKEN || true
-[[ -n "$PLEXTOKEN" ]] || { msg_error "No Plex token given; set var_kometa_plex_token or answer the prompt"; exit 64; }
+read -r -p "${TAB3}Enter your TMDb API key: " TMDBKEY
+read -r -p "${TAB3}Enter your Plex URL: " PLEXURL
+read -r -p "${TAB3}Enter your Plex token: " PLEXTOKEN
 sed -i '/^plex:/,/^[^ ]/{s|  url:.*|  url: '"$PLEXURL"'|}' /opt/kometa/config/config.yml
 sed -i '/^plex:/,/^[^ ]/{s|  token:.*|  token: '"$PLEXTOKEN"'|}' /opt/kometa/config/config.yml
 sed -i '/^tmdb:/,/^[^ ]/{s|  apikey:.*|  apikey: '"$TMDBKEY"'|}' /opt/kometa/config/config.yml
@@ -15,8 +15,7 @@ update_os

 echo "${TAB3}How would you like to handle SSL termination?"
 echo "${TAB3}[i]-Internal (self-signed SSL Certificate)   [e]-External (use your own reverse proxy)"
-ssl_choice="${var_kutt_ssl:-}"
-[[ -n "$ssl_choice" ]] || read -rp "${TAB3}Enter your choice <i/e> (default: i): " ssl_choice || true
+read -rp "${TAB3}Enter your choice <i/e> (default: i): " ssl_choice
 ssl_choice=${ssl_choice:-i}
 case "${ssl_choice,,}" in
 i)
@@ -33,9 +32,7 @@ EOF
  msg_ok "Configured Caddy"
  ;;
 e)
-  custom_host="${var_kutt_hostname:-}"
-  [[ -n "$custom_host" ]] || read -r -p "${TAB3}Enter the hostname you want to use for Kutt (eg. kutt.example.com): " custom_host || true
-  [[ -n "$custom_host" ]] || { msg_error "No hostname given; set var_kutt_hostname or answer the prompt"; exit 64; }
+  read -r -p "${TAB3}Enter the hostname you want to use for Kutt (eg. kutt.example.com): " custom_host
  if [[ "$custom_host" ]]; then
    DEFAULT_HOST="$custom_host"
  fi
@@ -29,12 +29,12 @@ rm -f /tmp/LanguageTool-stable.zip
 msg_ok "Setup LanguageTool"

 ngram_dir=""
-lang_code="${var_languagetool_ngram_lang:-}"
+lang_code=""
 max_attempts=3
 attempt=0

 while [[ $attempt -lt $max_attempts ]]; do
-  [[ -n "$lang_code" ]] || read -r -p "${TAB3}Enter language code (en, de, es, fr, nl) to download ngrams or press ENTER to skip: " lang_code || lang_code=""
+  read -r -p "${TAB3}Enter language code (en, de, es, fr, nl) to download ngrams or press ENTER to skip: " lang_code

  if [[ -z "$lang_code" ]]; then
    break
@@ -43,11 +43,11 @@ while [[ $attempt -lt $max_attempts ]]; do
  if [[ "$lang_code" =~ [[:space:]] ]]; then
    ((attempt++))
    remaining=$((max_attempts - attempt))
-    lang_code=""
    if [[ $remaining -gt 0 ]]; then
      msg_error "Please enter only ONE language code. You have $remaining attempt(s) remaining."
    else
      msg_error "Maximum attempts reached. Continuing without ngrams."
+      lang_code=""
    fi
    continue
  fi
@@ -24,8 +24,7 @@ PG_VERSION="16" setup_postgresql
 RUST_CRATES="monolith" setup_rust
 PG_DB_NAME="linkwardendb" PG_DB_USER="linkwarden" setup_postgresql_db

-prompt="${var_linkwarden_adminer:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Adminer? <y/N> " prompt || true
+read -r -p "${TAB3}Would you like to add Adminer? <y/N> " prompt
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
  setup_adminer
 fi
@@ -1,50 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/Listenarrs/Listenarr
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-msg_info "Installing Dependencies"
-$STD apt install -y libicu-dev
-msg_ok "Installed Dependencies"
-
-GH_INCLUDE_PRERELEASE=1 fetch_and_deploy_gh_release "listenarr" "Listenarrs/Listenarr" "prebuild" "latest" "/opt/listenarr" "listenarr-*-linux-x64.zip"
-
-msg_info "Configuring Listenarr"
-mkdir -p /opt/listenarr_data
-ln -s /opt/listenarr/wwwroot /opt/listenarr_data/wwwroot
-msg_ok "Configured Listenarr"
-
-msg_info "Creating Service"
-cat <<EOF >/etc/systemd/system/listenarr.service
-[Unit]
-Description=Listenarr
-After=network.target
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=/opt/listenarr
-Environment=LISTENARR_CONTENT_ROOT=/opt/listenarr_data
-ExecStart=/opt/listenarr/Listenarr.Api
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now listenarr
-msg_ok "Created Service"
-
-motd_ssh
-customize
-cleanup_lxc
@@ -28,7 +28,16 @@ export HOME=/opt/livebook
 $STD adduser --system --group --home /opt/livebook --shell /bin/bash livebook
 msg_ok "Created livebook user"

-confirm_external_installer "https://elixir-lang.org" "https://elixir-lang.org/install.sh"
+msg_warn "WARNING: This script will run an external installer from a third-party source (https://elixir-lang.org)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://elixir-lang.org/install.sh"
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi
 curl -fsSO https://elixir-lang.org/install.sh
 $STD sh install.sh elixir@latest otp@latest

@@ -39,12 +39,6 @@ LOCALAI_MODELS_PATH=/opt/localai_data/models
 LOCALAI_BACKENDS_PATH=/opt/localai_data/backends
 LOCALAI_LOG_LEVEL=info
 EOF
-# LocalAI picks the backend variant from the GPU it sees in sysfs, which is the
-# host's card even when no driver was installed in here, and a CUDA/ROCm/SYCL
-# backend then never starts. Pin the CPU variants unless a runtime is present.
-if ! ldconfig -p 2>/dev/null | grep -qE 'libcuda[.]so|libamdhip64[.]so|libze_intel_gpu[.]so|libze_loader[.]so'; then
-  echo "LOCALAI_FORCE_META_BACKEND_CAPABILITY=default" >>/opt/localai.env
-fi
 # LocalAI refuses to start on a wildcard bind with nothing to identify callers,
 # and binding the wildcard is what makes the container reachable at all.
 if [[ "$var_auth" == "yes" ]]; then
@@ -21,8 +21,7 @@ setup_deb_based() {
  sed -i 's/^bind-address/#bind-address/g' /etc/mysql/mariadb.conf.d/50-server.cnf
  msg_ok "Setup MariaDB"

-  prompt="${var_mariadb_phpmyadmin:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add PhpMyAdmin? <y/N> " prompt || true
+  read -r -p "${TAB3}Would you like to add PhpMyAdmin? <y/N> " prompt
  if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
    msg_info "Installing phpMyAdmin"
    $STD apt install -y \
@@ -59,8 +58,7 @@ setup_alpine() {
  $STD rc-service mariadb start
  msg_ok "MariaDB Configured"

-  prompt="${var_mariadb_adminer:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install Adminer with lighttpd? <y/N>: " prompt || true
+  read -r -p "${TAB3}Would you like to install Adminer with lighttpd? <y/N>: " prompt
  if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
    msg_info "Installing Adminer and dependencies"
    $STD apk add --no-cache \