The setup_deb822_repo function was only checking for the literal './'
suite value, but should reject any suite ending with '/', which
indicates a flat repository that must not include Components in the
DEB822 format.
This fix aligns ProxmoxVE with the correct behavior already present
in ProxmoxVED.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* feat(nodejs): auto-size NODE_OPTIONS heap and apply in Termix updates
- setup_nodejs now sets NODE_OPTIONS only when not already set
- Heap size is auto-derived from NODE_MAX_OLD_SPACE_SIZE, var_ram, or MemTotal
- Auto heap is clamped to 1024..4096 MB to avoid too-small or too-large defaults
- Termix update path now calls setup_nodejs before frontend/backend builds so
Node heap defaults are applied consistently during updates
* feat(error-handler): add actionable Node.js heap OOM guidance
Detect probable Node.js heap out-of-memory failures from log patterns and
common build exit codes, then print targeted remediation hints instead of
only a generic SIGABRT/SIGKILL message.
- Detect OOM patterns in last log lines (Reached heap limit, JS heap OOM)
- Treat node build contexts with exit 134/137/243 as likely heap issues
- Suggest computed --max-old-space-size based on NODE_OPTIONS, var_ram,
or MemTotal (clamped to 1024..4096 MB)
- Recommend calling setup_nodejs before build steps so defaults apply
* refactor(node-heap): raise auto cap to 12GB and simplify OOM hint
- Increase setup_nodejs auto heap clamp from 4GB to 12GB for heavy frontend builds
- Keep lower bound at 1GB and preserve user override precedence
- Simplify error_handler Node OOM output to a single concise hint
- Align error_handler heap suggestion clamp to 12GB
In setup_nodejs() Scenario 1 (major version already matches), only npm
was refreshed - apt never upgraded the nodejs package itself. This left
existing LXCs stuck on older minor releases (e.g. 22.13.1) even though
NodeSource ships newer ones (e.g. 22.19+).
Fix: add pt-get install -y --only-upgrade nodejs before the npm pin
so the latest minor/patch from the already-configured NodeSource repo is
always installed.
Fixes: seerr update failing with ERR_PNPM_UNSUPPORTED_ENGINE because
seerr 3.2.0 requires Node >=22.19.0 but installed was v22.13.1 (#13955)
* fix(tools): prevent script crash when entering GitHub token after rate limit
fetch_and_deploy_gh_release set attempt=0 after accepting a token, then
immediately ran ((0++)) which evaluates to 0 (falsy) causing exit code 1
and killing the script under set -e.
Fix: set attempt=1 and continue to restart the retry loop cleanly,
giving the full max_retries budget with the new token.
Also fix fetch_and_deploy_codeberg_release: replace ((attempt++)) with
attempt=\ to avoid the same zero-evaluation crash on
the first connection timeout (attempt starts at 0 in that loop).
Fixes#13635
* feat(tools): add var_github_token support with token validation
- Add var_github_token to all VAR_WHITELIST arrays in build.func so the
token can be set via default.vars, app.vars, or environment variable
- Map var_github_token -> GITHUB_TOKEN in default_var_settings() (env
variable takes precedence over the var file value)
- Add commented var_github_token example to the default.vars template
- Add validate_github_token() to tools.func:
* Calls GET /user to verify the token is accepted
* Reports expiry date from x-oauth-expiry header (fine-grained PATs)
* Warns when classic PAT is missing public_repo scope
* Returns distinct exit codes: 0=valid, 1=invalid/expired, 2=no scope, 3=error
- Update prompt_for_github_token():
* Non-interactive path now picks up var_github_token automatically
* Interactive path also picks up var_github_token without prompting
* Validates token immediately after entry; loops until valid or Ctrl+C
Node.js 22.22.2 ships with a broken npm self-upgrade path where 'npm install -g npm@latest' fails with MODULE_NOT_FOUND for promise-retry. Pin to npm@11.11.0 as a known-good version until the upstream issue is resolved. Ref: nodejs/node#62425, npm/cli#9151
Add defensive fallbacks (|| true) to multiple command substitutions to prevent non-zero exits when commands produce no output or are unavailable. Changes touch misc/api.func, misc/build.func and misc/tools.func and cover places like lspci, /proc/cpuinfo parsing, /etc/os-release reads, hostname -I usage, grep reads from vars files and maps, pct config parsing, storage/template lookups, tool version detection, NVIDIA driver version extraction, and MeiliSearch config parsing. These edits do not change functional behavior aside from ensuring the scripts continue running (variables will be empty) instead of failing in stricter shells or when commands return non-zero status.
* Display pin reason in release-check messages
Add an optional pin_reason parameter to check_for_gh_release and check_for_codeberg_release and update the no-update messaging to show the provided reason. If no reason is supplied, show a default message indicating the update is temporarily held back due to issues with newer releases. This improves user feedback when versions are intentionally pinned.
* Add informational args to release checks
Pass extra informational strings to check_for_gh_release calls to surface release-specific notes. Updated ct/immich.sh (notes for Immich and VectorChord releases), ct/opencloud.sh (note for OpenCloud), and ct/plant-it.sh (note about web frontend presence). These messages clarify testing/compatibility expectations when checking/releases.
* fix(tdarr): use curl_with_retry and verify binaries before enabling service
Tdarr_Updater downloads the actual server/node binaries from tdarr.io at
runtime. If tdarr.io is blocked by local DNS (e.g. OPNsense OISD blocklists),
the updater exits silently with code 0, leaving no binaries on disk. The
subsequent systemctl enable then fails with 'Operation not permitted' (exit 1)
because the ExecStart paths don't exist.
Changes:
- Replace bare curl with curl_with_retry for versions.json and Tdarr_Updater.zip
downloads to gain retry logic, DNS pre-check and exponential backoff
- Add msg_info before Tdarr_Updater run so users see this step in the log
- Check that Tdarr_Server and Tdarr_Node binaries exist after the updater
runs; fail immediately with a clear message pointing to tdarr.io connectivity
instead of letting systemctl fail with a confusing 'Operation not permitted'
Fixes: #13030
* Improve Tdarr installer error handling
Refine post-update validation and failure behavior in tdarr-install.sh: remove a redundant status message, simplify the updater check to only require the Tdarr_Server binary, and replace the previous fatal path with msg_error plus an explicit exit 250. This makes failures (for example when tdarr.io is blocked by local DNS) clearer and avoids false negatives from the Tdarr_Node existence check.
* Use curl_with_retry and handle updater failure
Replace direct curl calls with curl_with_retry for fetching versions.json and downloading Tdarr_Updater.zip to improve network reliability. Add a post-update check that verifies /opt/tdarr/Tdarr_Server/Tdarr_Server exists; if missing, log an error suggesting possible DNS blocking and exit with code 250. Minor cleanup of updater artifacts remains unchanged.
* Reorder hwaccel setup and adjust GPU group usermod
Move setup_hwaccel invocations in emby, jellyfin, ollama, and plex installers to occur after package installation/configuration so GPU drivers/repos are present before enabling hardware acceleration. Update _setup_gpu_permissions to call usermod directly (remove $STD wrapper) when adding service users to render/video groups. Includes minor whitespace/ordering cleanups in the installer scripts.
improve hardware-acceleration setup to centralize service user group management. Install scripts (emby, plex, ollama, channels) now pass a service user to setup_hwaccel (or no user for channels) and have had inline /etc/group sed/usermod tweaks removed. misc/tools.func updated: setup_hwaccel accepts an optional service_user and forwards it to _setup_gpu_permissions, which now adds the service user to render and video groups if provided. This consolidates GPU permission changes in one place and removes duplicated per-service group edits.
* tools.func Implement check_for_gh_tag function
Adds a function to check for new GitHub tags for repositories without releases. (needed for termix / guacd-server)
* Update documentation for check_for_gh_tag function
* tools.func: Implement fetch_and_deploy_gh_tag function
Adds function to fetch and deploy GitHub tag-based source tarballs.
* Refactor fetch_and_deploy_gh_tag function and comments
Updated the function to fetch and deploy GitHub tags, enhancing its description and usage instructions.
* cleanuo
AMD APUs (Radeon 780M/760M/740M and similar integrated graphics) do not
benefit from the full ROCm compute stack in LXC containers. ROCm is a
multi-GB GPGPU framework primarily designed for discrete AMD GPUs and
ML/AI workloads, not for video transcoding with integrated graphics.
For APUs the Mesa VA-API drivers (mesa-va-drivers, mesa-opencl-icd) and
firmware (firmware-amd-graphics) provide all the hardware acceleration
needed for media tasks. Installing ROCm on top adds ~4GB of packages
that frequently fail or time out for this class of hardware.
Discrete AMD GPUs (GPU_TYPE=AMD) are unaffected and still receive ROCm.
When repo.radeon.com has broken metadata, apt update fails with
exit code 100 and kills the entire install. Make it non-fatal so
the script can continue with cached packages or skip ROCm gracefully.
Fixes#12879
Add clearer architecture error messages and gate arm64 usage, plus implement architecture-aware behavior across the toolkit. Changes include: update exit-code messages to reference amd64/arm64, refuse arm64 unless explicitly enabled, show architecture in summaries, and use arch-specific package lists when installing in containers. Make downloads for FFmpeg and yq choose the correct amd64/arm64 binaries, tighten template download error handling and formatting, and clean up minor whitespace/comment issues. These changes aim to make arm64 handling explicit and downloads/installations more robust for non-amd64 systems.
The full 'rocm' meta-package includes 15GB+ of dev tools (compilers,
debuggers, dev headers) which are unnecessary in LXC containers.
Install only runtime packages: rocm-opencl-runtime, rocm-hip-runtime,
rocm-smi-lib. Reduce disk resize from +8GB to +4GB accordingly.
When a GitHub API call fails with HTTP 401 (invalid token) or HTTP 403
(rate limit exceeded), the user is now prompted interactively to enter a
GitHub Personal Access Token (PAT). The token is validated (no empty
input, no whitespace) before being set and the API call is retried.
This applies to both github_api_call() and fetch_and_deploy_gh_release().
Closes#12615
Pass an explicit empty second argument when downloading MongoDB tools and update fetch_and_deploy_from_url to default the directory parameter to an empty string. This avoids unset/ambiguous directory handling at the call site and ensures the function has a defined directory variable even when none is provided.
