* Tunarr: drop binary rename for the new release folder layout
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* Tunarr: track the latest ErsatzTV-ffmpeg and link ffmpeg into /usr/bin
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
update_script never wrote ~/.openobserve, so check_for_gh_release reported
an update on every run and reinstalled the release. Write the version after
extraction, as other ct scripts do, and overwrite instead of append at install.
The unit ExecStop=killall failed with 203/EXEC because psmisc is never
installed. OpenObserve treats SIGQUIT and SIGTERM alike, so drop ExecStop
and remove it from existing units during update.
Co-authored-by: BadFlo <7882184+BadFlo@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
The release tarball stores the binary as uid/gid 1001. Extracted as root,
GNU tar keeps that owner, so /opt/openobserve/openobserve ended up owned by
a non-existent uid after install and every update.
Co-authored-by: BadFlo <7882184+BadFlo@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(immich): download before stopping, and clear maintenance mode after an interrupted update
setup_uv and the Immich release fetch ran after maintenance mode, the service stop and rm -rf app/*, so a failed download (e.g. a GitHub releases/download 504) left the container with no app at all. They now run first, while the old install is still serving.
The fetch writes the new version to ~/.immich, so the old version is put back until the update finishes and a failed run can still be retried.
Maintenance mode is now disabled whenever immich-admin exists at the end, not only when this run enabled it. Since #17798 a re-run after an interrupted update skips the enable, so it skipped the disable too and left the web UI on the maintenance page.
* fix(immich): trim comments to the AGENTS.md limit
* fix(immich): rely on the core pending marker, and only clear maintenance mode this run owns
fetch_and_deploy_release already keeps ~/.immich.pending until a clean exit and redoes the update while it exists, so the hand-rolled version swap is dropped; PREV_IMMICH now reads CS_PREVIOUS_VERSION so a redo sees the real old version.
Maintenance mode is disabled when this run enabled it, or when app/ was empty at the start (an interrupted run left it on), rather than whenever immich-admin exists.
* immich: drop comment per review
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* kan: bump Node.js from 20 to 24
* Set NODE_VERSION and NODE_MODULE before setup
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: CanbiZ (MickLesk) <47820557+MickLesk@users.noreply.github.com>
The build runs with BUILD_TESTING=OFF, but the recursive submodule update also cloned the large testdata repo, and two installs died on network errors inside it. Only third_party is fetched now; libjxl at Immich's pinned revision configures and builds without it.
3.65 moved the entry point to cmd/databasus and embeds the API spec and migrations, so swag failed and every install since 2026-11-05 broke. It now builds like the upstream image: bundled client tools, the verification agent for amd64 and arm64, and APP_VERSION set to the release. Valkey, goose and the client symlinks are gone because 3.65 uses none of them. Closes#18493.
The player location's COOP/COEP add_header never fires: try_files
internally redirects /rom/<id>/ejs to /index.html, served by
"location /" — so SharedArrayBuffer cores (PSP/DS) fail with a
misleading "must be run over HTTPS" error.
Apply upstream RomM's own fix (docker nginx template): map
$request_uri — which survives the redirect — to header values for the
ejs and jsdos player paths, emit them from "location /", and drop the
dead player location. Also restore upstream's Cache-Control "no-cache"
on the SPA shell, without which a cached index.html hides the headers
and stale frontends survive RomM updates.
Widen the updater's migration gate so existing installs converge.
The version came from scraping technitium.com, which failed for some hosts ("Command substitution exited with status 1", 6 runs on 4 hosts in three days) and has no rate-limit fallback. The GitHub release carries the same version and goes through the engine's release lookup.
* fix(caddy): skip the xCaddy test build below 2 GB RAM
The container defaults to 512 MB (256 MB on Alpine), and Go's linker was
killed in xcaddy build: 14 runs on 6 hosts in a week. The build only
produced an unused binary, so below 2 GB xCaddy is installed without it
and a warning says why; install and update alike.
* Change directory to /opt before building xCaddy
The install replaced the file, which dropped JAVA_OPTS with install.data_dir, so creating a tenant failed. The DB settings are now appended, and an update restores the defaults on existing containers. The package upgrade keeps the edited file. Fixes#18483.
The server unpacks its frontend into /tmp/nexterm-sea-*. systemd-tmpfiles removes it after 10 days while the process keeps running, and every page returns 404. Fixes#18488.
npm 12 rejects --prod, and --production still starts PLANKA through nodemon. Starting node app.js directly needs HOME: Sails 1.5.18 only looks for the project's .sailsrc when HOME is set, and systemd sets none without User=, so the app lifted with the wrong paths and returned 503. The unit now sets NODE_ENV and HOME, and an update repairs existing units even without a new release. Follow-up to #18477.
* MeTube: install Deno without its shell setup
With -y, deno's install.sh also fetches jsr:@deno/installer-shell-setup to edit the shell profile, and when jsr.io did not answer the install stopped ("JSR package manifest ... failed to load"). Deno goes to /usr/local/bin, which is on PATH, so the shell setup is not needed; CI=1 keeps the installer from asking for it on a terminal.
* Modify Deno installation command
Update Deno installation command to include CI environment variable.
* fix(immich): take the watchfiles wheel and retry GeoNames longer
The v3.3.5 lock pins watchfiles 0.21.0, which has no wheel for the
Python 3.13 machine-learning venv, so every ML install downloaded a Rust
toolchain and compiled it. Where static.rust-lang.org reset the
connection, uv sync failed three times. --upgrade-package watchfiles
takes 1.3.0, an abi3 wheel; only uvicorn's reload mode uses it.
download.geonames.org dropped connections on 11-03/04 and the first file
failed after three 10 s connects; those four calls now retry six times
with a 30 s connect timeout.
* Immich: bump release version to v3.3.6
v3.3.6 disables onnxruntime's telemetry in immich_ml, which runs from
source here, so nothing else changes. The lock still pins watchfiles
0.21.0, so the wheel upgrade stays.
Tududi 2.0.0 dropped SQLite and refuses to start next to a populated 1.x
database. New installs set up PostgreSQL and let start.sh create the
schema; db:init would sync the tables without SequelizeMeta and make
db-prepare treat the database as an old 1.x one. Installs without
DATABASE_URL stay on 1.15.0, the final SQLite release, which also brings
back installs that already updated to 2.0.0.
Uploads lived in backend/uploads, which CLEAN_INSTALL wiped on every
update; they move to /opt/tududi-uploads.
n8n-nodes-base 2.46.0 moved @napi-rs/canvas-linux-arm64-musl and
-linux-x64-musl from optional into hard dependencies. npm enforces
os/cpu/libc on those, and no combination satisfies both arm64 and x64,
so every install fails with EBADPLATFORM. n8n 2.46.4 reached the latest
tag on 2026-11-03 and the failures started four minutes later.
--force skips the platform check. The matching gnu binary is still
installed through @napi-rs/canvas's own optional dependencies, so canvas
keeps working.
* Wiki.js: install 3.x
Wiki.js 3 lives in requarks/wiki, needs Node.js 26 and creates its own ltree and pg_trgm extensions in the wiki schema, and starts with node --no-experimental-webstorage backend. dataPath moves out of the app folder, which every update replaces; the admin password is generated and saved to ~/wikijs.creds. Updates follow upstream's guide and put Puppeteer back when it was installed. 2.x containers keep getting 2.x updates from requarks/wiki-v2, since 3.x cannot upgrade them in place, and are told how to export and import.
* Refactor credential output to use heredoc syntax
Cinephage depends on camoufox instead of camoufox-js, whose bin is called camoufox, so the install stopped at "node_modules/.bin/camoufox-js: No such file or directory" (6 runs in three days).
- VectorChord moved to supervc-stack/VectorChord. With the GitHub API
rate limited, core reads the release from github.com, finds no asset
under the old name and stops with "No suitable .deb asset found".
- mise installed every tool in Immich's mise.toml. Java (for the Dart
OpenAPI generator), terragrunt and opentofu are not needed for the
plugin build, and the Java index timed out on slow links.
- GeoNames failed after the 1-3 h library build; it now downloads first.
- Stop on x86-64 CPUs without SSE4.2: the web build ends there with
"Illegal instruction" after the libraries are built.
WGDashboard builds its frontend with Vite during the install, and at 512 MB the kernel killed node: "Failed to compile frontend", then wg-dashboard would not start (11 runs in three days). The build finishes at 1 GB.
Discourse enabled libvips image processing by default and its worker refuses anything older than 8.18; Debian 13 ships 8.16, so the service failed to boot after an update and on fresh installs. Build the latest libvips release from source like discourse_docker does, on install and on update when a new release is out.
Since the release of 2026-10-28, Server/ holds only FileFlows' own assemblies and the rest comes from ../Libraries. Copying the archive over an older install left the old third-party DLLs in Server/, which the runtime loads first, and the server fails with 'Could not load file or assembly Microsoft.Data.Sqlite, Version=10.0.13.0'. Upstream's own upgrade removes Server, FlowRunner, Libraries and Agent the same way; Data stays.
* guardian: bump Node.js from 24 to 26
* Set NODE_VERSION to 26 before updating Guardian
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: CanbiZ (MickLesk) <47820557+MickLesk@users.noreply.github.com>
* nametag: bump Node.js from 20 to 24
* Update NODE_VERSION in nametag deployment script
Set NODE_VERSION to 24 during deployment process.
* Increase default RAM from 2048MB to 3072MB
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: CanbiZ (MickLesk) <47820557+MickLesk@users.noreply.github.com>
* Norish: fetch Obscura from the repo Norish pins
Norish now builds Obscura from norish-recipes/obscura (pin.env OBSCURA_REPO); the v0.2.5-norish.1 tag does not exist in h4ckf0r0day/obscura, so installs and updates stopped with a GitHub 404.
* Norish: run the v0.26 server on Node.js 26
v0.26.0 dropped dist-server and starts with node --import tsx server/index.ts from apps/web, and requires Node 26. Updates rewrite the unit.
* Aurral: build the pnpm workspace and run backend/server.ts
v2.12.0 moved from npm workspaces to pnpm and the backend entry to server.ts, so npm ci --workspace frontend found no workspace. Updates point existing units at server.ts.
* Aurral: install only the frontend and backend packages
The workspace root's prepare script runs vp config, which needs git; the upstream image filters the install to the two packages as well.
* Aurral: install git for the workspace prepare script
The root prepare script runs vp config, which aborts when git is missing and only notes the absent .git directory otherwise.
* PS5-MQTT: build the yarn workspace and run the packaged server
v1.8.0 turned the repo into a yarn 4 workspace with Plug'n'Play: ps5-mqtt/package.json is gone and npm install there fails. The server now runs from the packaged tree with its own node_modules, as upstream's image does; updates move the unit's working directory.
* PS5-MQTT: give the build 2 GB of RAM
Building the client and server bundles with rspack is killed by the OOM killer at 512 MB.
* fix(jellyseerr,overseerr): skip the Seerr migration prompt when unattended
Both scripts ask whether to migrate to Seerr before rewriting /usr/bin/update.
With PHS_SILENT=1 and stdin open the read blocks and stalls the whole batch;
with stdin closed it fails under the ERR trap, so the container is recorded as
FAILED and the backup is restored.
Skip with exit 75, which update-apps.sh already renders as "skipped - requires
interactive mode". Interactive behaviour is unchanged.
* fix(paperless-ngx): skip migration prompts when unattended
Two prompts can appear during an update: the v3 encryption confirmation and the
uv-migration snapshot confirmation. Unattended, the first either blocks or fails
the container; the second sits after the services are already stopped, so a
failure leaves Paperless down.
Guard both with exit 75. The v3 guard sits behind the encryption notices, so a
skip still logs why. The uv guard is placed before the services are stopped, so
skipping never leaves the container half-updated. Interactive behaviour is
unchanged.
* fix(vikunja): skip the 1.0 migration prompt when unattended
The 1.0 config migration asks twice with a 30 second timeout and exits 254 when
it gets no answer, which update-apps.sh treats as a failed container. The config
file choice that follows also waits up to 60 seconds.
Skip the migration prompt with exit 75 when unattended, and take the documented
default (keep the current config) for the second question without waiting.
Interactive behaviour is unchanged.
Michel Roegl-Brunner