The ExecStart migration only ran when ~/.authentik reported a version
below 2026.8. Installs whose marker already reads 2026.8.x but whose
units were never migrated kept pointing to the removed
/opt/authentik/authentik-server binary and failed with 203/EXEC.
Also run the migration when the server unit still has the old path.
Fixes#18306
Since Dawarich 1.15.1 the importmap pins maplibre-gl to
/maplibre/<version>/maplibre-gl.mjs in public/. Debian's nginx
mime.types has no mjs entry, so the vhost served it as
application/octet-stream and browsers refused to load the module:
blank map, map controllers fail.
Add a .mjs location (text/javascript, as Rails serves it upstream) to
the install heredoc, and insert it into existing vhosts from
update_script() before the release check, applied via nginx_enable_site.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
The A-B refactor (#15075) moved the backup to create_backup but kept the
old hand-written restore, which reads $BACKUP_DIR. Nothing sets it any
more, so the first restore cp failed after the install dir was wiped:
the update aborted with Tomcat stopped and the config left in
/opt/apache-tomcat.backup.
Restore conf and webapps with restore_backup, which also removes the
store. lib gets a store of its own so only the jars the new release lacks
(JDBC drivers and the like) are copied back; restoring it whole would
put the old Tomcat jars over the new ones.
Co-authored-by: Matt Daleo <12395090+mazelado@users.noreply.github.com>
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
The update overlaid the release tarball, so files removed upstream survived. v0.13.1 moved the frontend config into vite.config.ts, and the leftover svelte.config.js fails pnpm build under SvelteKit 3 (config_file_unsupported) after the services are already stopped. Deploy with CLEAN_INSTALL=1, keep backend/server/media in place, and back up both .env files.
The djangorestframework<3.15 pin (#13194) worked around rest_framework.schemas.coreapi, which AdventureLog stopped using in v0.13.0. v0.13.1 requires djangorestframework>=3.18.3,<3.19, so the pin now downgrades DRF below the app's own requirement.
Stalwart v1.0.0 (26 Oct 2026) ships a new data store layout, so v0.16.x
deployments cannot be upgraded in place. Data has to be copied into a new,
empty v1 store with stalwartlabs/stalwart-migrate, which requires v0.16.27
as its source version and needs an interactive prepare step plus an offline
final cutover.
The update path pulled "latest" and would have swapped the binary for v1 on
existing containers, leaving the mail server unable to start on its old store.
Pin install and update to v0.16.27 instead and surface the reason through
check_for_gh_release. Containers that already pulled v1.0.0 are put back on
v0.16.27 by the next update run.
update_script ran apt upgrade and reported success while MeshCentral stayed on the version it was installed with, so 1.1.x installs never got 1.3.1, which fixes an actively exploited flaw. Compare the installed package with npm and install the newer one. Fixes#18205
mise 2026.10.19 defaults lockfile_mode to generate, which locks every platform during mise install. Immich's mise.toml enables the lockfile, and Java 21.0.2 has no linux-arm64-musl build, so the update failed on any host. Fixes#18236
* Add honcho (ct)
* Clean up comments in honcho-install.sh
Removed comments about Dockerfile and Honcho client build conditions for clarity.
* Remove admin key printing from setup output
Removed the command to print the admin key from the setup output.
---------
Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com>
Co-authored-by: CanbiZ (MickLesk) <47820557+MickLesk@users.noreply.github.com>
The official Mealie image installs ffmpeg. This script's apt list
did not, so yt-dlp could not extract reel audio (ffprobe missing).
ensure_dependencies on update covers existing containers.
hermes update refuses a checkout its caller does not own, so the
root-run update stopped working for every install. The installer and
hermes update now run as hermes, and the dashboard becomes a user unit
next to the gateways, so Hermes Desktop and the dashboard can update
and restart it themselves. libatomic1 is installed up front, the one
package Hermes would otherwise ask sudo for.
update moves existing containers over once: the system unit becomes a
user unit, leftover root processes are stopped and /home/hermes is
handed back to hermes.
tsc on the 5.0 server needs about 3 GB of heap; the 2 GB default left it 2.3 GB and the update died in the build. npm ci runs with --ignore-scripts like upstream, so better-sqlite3 keeps its prebuilt binary instead of an addon built against the running Node's headers. kitinerary-extractor sits in libexec on Debian, so link it into PATH where TREK looks for it.
Bar Assistant seeds new bars from its public datapack via FromDataPack in
DataPackMediaMode::StarterCatalog, which requires the pack's starter-media-release.json
manifest AND a published starter-media catalog produced by `php artisan
starter-media:publish`. Upstream's Docker image runs that publish on every container
start; neither Proxmox script does, so creating any bar (or "Synchronize data") fails
and leaves the bar created but completely empty.
- install/bar-assistant-install.sh: publish the starter media catalog after storage:link
- ct/bar-assistant.sh: same on update, and refresh resources/data so an updated
container cannot keep a data pack older than the app (a pack predating
starter-media-release.json cannot be published at all)
starter-media:publish is idempotent: it reports "already published" and exits 0.
Fixes#18123
Upstream added PROXCENTER_SKIP_TYPECHECK for builds from a released tag;
the type check alone needs about 3 GB. A 4.6 GB heap on 6 GB of RAM got
the build killed.
* Storyteller: build the runtime like upstream's Dockerfile
Only the Next.js app was built before. The standalone server now also gets the worker and file-write-worker bundles, the native align prebuilds, the icu-segmentation wasm, @parcel/watcher and kuromoji, plus the env vars that point at them, and whisper.cpp with the tiny.en model is installed through ghost-story's CLI. Packages and the readium version follow upstream (#16628).
Update still used the pre-monorepo paths, and CLEAN_INSTALL wiped /opt/storyteller including the data directory; it now keeps data/, rebuilds the same way and rewrites the unit, so existing installs move over.
* Storyteller: follow the script conventions
python3 ships with the template, update uses ensure_dependencies, no comments.
* Refactor storyteller.sh for improved deployment process
The mise apt repository keeps one version and caches its index for a
day; with near-daily mise releases the index points at a deleted deb
and the install ends with 100 (18 a week). The binary comes from the
release instead, on new containers and on updates that have none yet.
jellyfin-ffmpeg7 failed on mirror hiccups; it goes through the retrying
installer. The machine-learning prompt ended the install without a TTY.
* CryptPad: configure 2026.10.0 through infra.js
2026.10.0 moved the origins, host and ports from config.js to infra.js and no longer derives the sandbox origin, so updated instances pointed the sandbox at the browser's own localhost and hung at 'loading drive' (#18063). Update builds infra.js once from config.js, install writes it directly (the config.js seds matched nothing anymore). install-onlyoffice.sh is now install-office.sh; update runs it only where office was installed.
* CryptPad: repair instances already on 2026.10.0
Instances updated before this fix have no infra.js but already the new version, so the migration would wait for the next release. Update runs again for them, and a config.js from the 2026.10.0 example (no origin at all) gets the container address like a fresh install.
* fix(zabbix): keep unattended updates on the installed series
update_script() asked for a Zabbix version unconditionally. update-apps.sh
exports PHS_SILENT=1 for unattended runs, so that read either blocks the
whole batch or, with stdin closed, fails the container with exit 1 after
its services were already stopped.
Resolve the installed series from the zabbix-release package before
touching systemd, and ask only when the run is interactive. Unattended
runs stay on the installed series and still get minor and patch updates;
changing series remains an attended decision. When the series cannot be
read, exit 75 so the batch logs the container as skipped instead of
failing it.
Fixes#18046
* Clean up comments in zabbix.sh
Removed comments regarding unattended runs and series changes.
---------
Co-authored-by: CanbiZ (MickLesk) <47820557+MickLesk@users.noreply.github.com>
The app reads its version from COMMIT_TAG and falls back to "dev".
Set it in the systemd unit on install, migration and update.
Fixes#18040
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Brian Rodriguez