First of the alpine pairs moved over. The two scripts become one with a section
per OS, the same shape as valkey in ProxmoxVED: setup_deb_based/setup_alpine in
the install script, update_deb_based/update_alpine in the ct script, dispatched
by run_os_setup and run_os_update.
The bootstrap now points at community-scripts/core rather than this repo's
misc/build.func, which is where those two dispatchers live. Nothing in misc/ is
touched.
_CS_DEFAULT_URL has to be set before sourcing: core resolves the scripts root
from the calling script's checkout, and when there is no checkout -- the usual
`bash -c "$(curl ...)"` -- it falls back to ProxmoxVED. A ProxmoxVE script would
then fetch its own -install.sh from the wrong repository. Setting only the
fallback keeps a local checkout and a fork resolving through their own git
remote, which is the point of that mechanism.
Verified: both files parse, the bootstrap resolves the scripts root to ProxmoxVE
and the engine to core, and the sections are the only functions defined.
ct/alpine-redis.sh and install/alpine-redis-install.sh are deliberately left in
place. They still run against misc/build.func, so bookmarked URLs keep working;
retiring them is a separate decision with user-facing consequences.
* Shelfmark: fix internal bypasser under the gevent worker
The internal captcha bypasser never worked on this install. Shelfmark is served
by gunicorn's GeventWebSocketWorker, and DOCKERMODE controls whether the bypass
browser runs in a helper process "isolated from gunicorn/gevent" (upstream's
_get_via_subprocess). With DOCKERMODE=false the SeleniumBase CDP browser starts
inside the monkey-patched loop, its asyncio websocket never connects, and every
bypass dies at "Pure CDP browser startup timed out after 45s" — searches then
burn their whole retry budget and surface as "mirrors are blocked".
Set DOCKERMODE=true for deployment type 1, and migrate existing installs on
update. The flag is misnamed upstream: it gates gevent isolation, not Docker.
Also drop chromium.service. Nothing in Shelfmark connects to port 9222 — the
bypasser launches its own browser on a random port — so it only consumed
~226MB. With DOCKERMODE enabled it is additionally killed by Shelfmark's
orphan-process reaper (pkill -f chromium) on every bypass and respawned by
systemd, since an LXC shares its PID namespace.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012Ln3yVj3sWHG2c6T78W1we
* Shelfmark: address review — one check, drop comments
Collapse the chromium.service removal and the DOCKERMODE migration into the
single internal-bypasser check, as every affected install has both. Guard the
disable so a second update run does not fail on the removed unit, matching
esphome.sh. Drop the explanatory comments.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012Ln3yVj3sWHG2c6T78W1we
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Skip mount points during backup and clean install
Prevent accidental deletion or backup of mount points:
- In create_backup(), skip paths that are mount points with a warning
- In _deploy_source_tarball(), _deploy_unpacked_archive(), and fetch_and_deploy_from_url(), use find with mountpoint pruning to avoid deleting mount point directories during CLEAN_INSTALL
* change comments for new variant
Update `_deploy_source_tarball` and related helper comments to note that CLEAN_INSTALL wipes target contents including dotfiles while preserving mount points. This improves guidance around backup/restore of config dotfiles during source deployments.
* Add securo (ct)
* fix: src
* securo: enable nginx site via nginx_enable_site helper
Replaces the manual symlink + default removal + restart with the core
helper, which also runs nginx -t before restarting and enables the unit.
---------
Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com>
Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com>
Co-authored-by: MickLesk <mickey.leskowitz@gmail.com>
MickLesk