Upstream derives everything from one setting:
ROMM_BASE_PATH = _get_env("ROMM_BASE_PATH", "/romm")
LIBRARY_BASE_PATH = f"{ROMM_BASE_PATH}/library"
There is no separate library setting; config.yml's roms_folder is only
a folder name inside the library. So ROMM_BASE_PATH in /opt/romm/.env
is the single lever, and everything that names a path has to follow it.
Two places did not. The watcher unit had /var/lib/romm/library written
into ExecStart, so a moved library was still watched at the default and
rescans never fired. It now uses ${ROMM_BASE_PATH}/library, which
systemd expands from the EnvironmentFile the unit already loads.
The Angie alias was derived from the env file, but only while the
install or an update ran. Editing ROMM_BASE_PATH afterwards left the
internal /library/ location pointing at the old path, and since the
backend serves content through X-Accel-Redirect, every download and
every play returned 404 while scanning and metadata kept working.
Re-sync it from an ExecStartPre on angie, so a restart is enough.
Update installs both for existing containers and rewrites the watcher
unit in place.
Reported in #17263. The suggested fix there was to template the alias,
which the scripts already did; the gap was that nothing re-applied it.
* sparkyfitness: run the Better Auth migration during the update
1.7.1 ships a Better Auth version whose schema has columns 1.6.5 never
created, and nothing in the update adds them. The backend starts, then
refuses every sign-in:
Database schema mismatch
Missing columns session.impersonated_by two_factor.verified ...
Run `npx auth migrate` to add the missing tables and columns.
Run exactly that after the backend dependencies are in place, with the
config Better Auth looks for, SparkyFitnessServer/auth.ts, and the
database credentials from /etc/sparkyfitness/.env. Users who hit this
were left running the server by hand to get the columns created.
A failure warns instead of aborting: the rest of the update has already
succeeded at that point, and the message names the remaining step.
* sparkyfitness: start the server through the entrypoint that migrates
The Better Auth CLI added in the previous commit is the wrong tool. It
generates sso_provider.user_id as text and cannot reference this
schema's uuid user.id:
foreign key constraint "sso_provider_user_id_fkey" cannot be
implemented [...] incompatible types: text and uuid
The real cause is one line up in the unit. It ran
tsx SparkyFitnessServer.js
which imports the application module directly and never applies the
schema migrations. Upstream starts through index.ts - nodemon.json has
exec: tsx index.ts - and that file runs applyMigrations() and
applyRlsPolicies() before importing anything, with a comment naming this
exact failure:
Better Auth validates the database schema eagerly, the moment
betterAuth() is constructed at auth.ts module scope [...] When
migrations ran later (from inside SparkyFitnessServer.ts) that check
read the pre-migration schema on the first boot after an upgrade, so
every /api/auth request failed until the container was restarted.
Point both the install and the update at index.ts and drop the CLI call.
index.ts exits non-zero when a migration fails, so systemd surfaces that
instead of serving a broken login.
6.87.0 moved init.sh from the repository root to docker/init.sh, so the
update stopped at
chmod: cannot access '/opt/poznote/init.sh': No such file or directory
The file itself is byte for byte the same and uses absolute paths only,
so running it from the new location changes nothing. Prefer docker/ and
fall back to the old path, since a container pinned to an older release
still has it there.
* frigate: move to 0.18.0
Bump the pinned release and follow the four build changes that matter
outside of Docker.
ffmpeg: 0.18 ships 8.0 as the default and keeps 7.0 and 5.0 alongside
it, so /etc/frigate.env has to name all three or the s6 run script
resolves a version that install_deps.sh never downloaded.
go2rtc: pin to v1.9.14, the version the Dockerfile fetches. "latest"
happened to work but shipped whatever AlexxIT had tagged that day
rather than the build Frigate was tested against.
OpenVINO: requirements-ov.txt dropped tensorflow and openvino-dev, and
build_ov_model.py no longer uses the Model Optimizer. omz_tools is
therefore gone, which left the first two branches of the labelmap
lookup dead; download coco_91cl_bkgr.txt the way the Dockerfile does.
Intel media driver: 0.18 builds intel-media-va-driver-non-free from
source for Battlemage, because the prebuilt noble/trixie packages need
a glibc that bookworm does not have. Run it before install_deps.sh, as
the deps-rootfs stage does, and drop the jammy repo the build adds so
the later trixie pull for libva2 is not resolved against it.
The remaining build scripts and requirement files changed too, but
those come from the checked-out tree and follow the version bump on
their own.
* frigate: stop the detector config from replacing the base config
The install wrote a config with mqtt, cameras, auth and detect, then the
detector branch wrote the file again instead of adding to it. Both
branches used a single redirect, so everything above them was discarded
and the result had neither mqtt nor cameras. frigate/config/config.py
declares both as Field() without a default, in 0.17.2 as well as in
0.18.0, so Frigate rejected the file and came up in safe mode:
mqtt - Field required
cameras - Field required
Move hwaccel_args into the base block, since both branches set it, and
append the detector and model sections instead of overwriting.
Checked by generating both branches and parsing the result: the OpenVINO
path yields auth, cameras, detect, detectors, ffmpeg, model, mqtt, the
CPU path the same without detectors, and the test camera survives in
both.
* frigate: write the config in one place
Only the detector and model section depends on the CPU check, but the
file was assembled in three heredocs writing to the same path. That
shape is what produced the safe-mode config: both branches used a plain
redirect and discarded everything above them.
Pick the variable part into DETECTOR_CONFIG first and write the file
once, so the layout is visible in one block and no branch can replace
what came before it.
Output is unchanged, verified by generating both branches from the
previous commit and from this one and diffing: byte-identical.
* Update default RAM and disk values in frigate.sh
Navidrome 0.61.x created cache, artwork and plugins under the data
folder whenever any navidrome command ran, including the ones the deb
postinstall runs as root. 0.62 stopped creating them that way but never
corrected the owner, so a container that passed through 0.61.x carries a
root-owned artwork directory. 0.64.0 is the first release to write into
it and fails with
writing image store: mkdir /var/lib/navidrome/artwork/hashed:
permission denied
which breaks newly resolved album covers and every playlist cover, since
those are composites.
Repair the three directories the same way navidrome/navidrome#6143 does:
the entries themselves only, since they were created empty, real
directories owned by root only, and chown -h, because the navidrome user
owns the data folder and could otherwise plant a symlink.
The trailing || true is not in the upstream copy and is needed here.
Their postinstall runs without set -e, while update_script runs under
catch_errors, which sets -Ee with an ERR trap. find exits 1 as soon as
one starting point is missing, so on a container without a plugins
directory the update would abort.
Fixes the report in #17247, confirmed there by the reporter's stat and
dpkg log: artwork is root-owned and dated to their 0.60.3 -> 0.61.1
upgrade.
* tor-snowflake: read the Go version from the module root
Snowflake is a single Go module with go.mod at the repository root, not
under proxy/. The install read /opt/tor-snowflake/proxy/go.mod, which
has never existed, so grep failed and the version came out empty. Go
was then fetched from
https://go.dev/dl/go.linux-amd64.tar.gz
with no version in the name, and the install aborted at that download.
Read the directive with a single awk instead of grep piped into awk.
The pipeline tripped catch_errors, which sets -Ee with pipefail and an
ERR trap, the moment the file was missing; that is the "exit code 2
while executing command awk" line that preceded the download failure.
Fall back to latest when the file cannot be read, so a future upstream
move of go.mod costs a Go version that is newer than the one pinned
rather than a failed build. setup_go already resolves latest, and also
resolves a bare major.minor to its newest patch, so a go directive
without a patch level stays fine.
Verified against v2.14.1: go.mod sits at the root and declares go
1.24.0, and the awk yields 1.24.0 from it and latest from a missing
file without tripping the ERR trap.
* Refactor GO_VERSION extraction in tor-snowflake.sh
Updated the method of extracting GO_VERSION from go.mod and set a default value if not found.
Docmost pins its package manager, so running pnpm goes through corepack,
which asks before fetching the pinned version:
Corepack is about to download .../pnpm-11.25.0.tgz
? Do you want to continue? [Y/n]
The pnpm calls run under $STD, so with verbose off the question is
never shown and the update sits on "Configuring Docmost" waiting for an
answer nobody can see. With verbose on the same update completes,
because the prompt is visible and gets answered, which is exactly what
the reporter observed.
Set COREPACK_ENABLE_DOWNLOAD_PROMPT=0 before the pnpm calls in both the
install and the update, the way fifteen other ct scripts and ten
install scripts already do.
Adds five optional var_jitsi_* settings to the install script. All default
to empty, which keeps the previous LAN-only behaviour (container IP,
self-signed certificate):
- var_jitsi_domain public hostname instead of the container IP
- var_jitsi_le_email Let's Encrypt via the packaged debconf option
- var_jitsi_public_ip static NAT mapping in jvb.conf (JVB 2.3+)
- var_jitsi_admin_user secure domain: only authenticated users create rooms
- var_jitsi_admin_pass password for that user (generated when empty)
Tested on Proxmox VE 9.2 as unprivileged Debian 13 LXC, both with all
variables set (self-signed) and with none set.
Co-authored-by: klanghans <13657862+klanghans@users.noreply.github.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
* Add gotenberg (ct)
* Update messages in gotenberg.sh for clarity
* Implement unoconverter update in gotenberg.sh
* Fix formatting and add Go version setup in script
* Update Gotenberg installation script for Go version
---------
Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com>
Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com>
* Add chevereto (ct)
* Update var_arm64 default value and cleanup messages
Changed default value of var_arm64 to 'yes' and removed setup completion message.
* Remove ffmpeg installation and add setup_ffmpeg call
* chevereto: derive php-fpm from one version, use nginx_enable_site
* chevereto: drop php modules already covered by setup_php
---------
Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com>
Co-authored-by: CanbiZ (MickLesk) <47820557+MickLesk@users.noreply.github.com>
* Add logseq (ct)
* logseq: provision corepack via setup_nodejs, use nginx helper, set up toolchains on update
---------
Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com>
Co-authored-by: MickLesk <47820557+MickLesk@users.noreply.github.com>
composer's root/superuser safety prompt blocks on stdin during update_script,
since the container's terminal isn't attached to answer it. Set
COMPOSER_ALLOW_SUPERUSER=1 to suppress the prompt, matching composer's
documented approach for running as root non-interactively.
* Add matter-hub (ct)
* Enable ARM64 support by default in matter-hub.sh
* Remove Home Assistant setup instruction
Removed instruction to set Home Assistant URL and token.
---------
Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com>
Co-authored-by: CanbiZ (MickLesk) <47820557+MickLesk@users.noreply.github.com>
Tobias