* Shelfmark: fix internal bypasser under the gevent worker
The internal captcha bypasser never worked on this install. Shelfmark is served
by gunicorn's GeventWebSocketWorker, and DOCKERMODE controls whether the bypass
browser runs in a helper process "isolated from gunicorn/gevent" (upstream's
_get_via_subprocess). With DOCKERMODE=false the SeleniumBase CDP browser starts
inside the monkey-patched loop, its asyncio websocket never connects, and every
bypass dies at "Pure CDP browser startup timed out after 45s" — searches then
burn their whole retry budget and surface as "mirrors are blocked".
Set DOCKERMODE=true for deployment type 1, and migrate existing installs on
update. The flag is misnamed upstream: it gates gevent isolation, not Docker.
Also drop chromium.service. Nothing in Shelfmark connects to port 9222 — the
bypasser launches its own browser on a random port — so it only consumed
~226MB. With DOCKERMODE enabled it is additionally killed by Shelfmark's
orphan-process reaper (pkill -f chromium) on every bypass and respawned by
systemd, since an LXC shares its PID namespace.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012Ln3yVj3sWHG2c6T78W1we
* Shelfmark: address review — one check, drop comments
Collapse the chromium.service removal and the DOCKERMODE migration into the
single internal-bypasser check, as every affected install has both. Guard the
disable so a second update run does not fail on the removed unit, matching
esphome.sh. Drop the explanatory comments.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012Ln3yVj3sWHG2c6T78W1we
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
* Add securo (ct)
* fix: src
* securo: enable nginx site via nginx_enable_site helper
Replaces the manual symlink + default removal + restart with the core
helper, which also runs nginx -t before restarting and enables the unit.
---------
Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com>
Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com>
Co-authored-by: MickLesk <mickey.leskowitz@gmail.com>
* Add mumble (ct)
* Update mumble.sh to source new build function
Removed local core checkout instructions and added new source for build.func.
---------
Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com>
Co-authored-by: CanbiZ (MickLesk) <47820557+MickLesk@users.noreply.github.com>
* Add newt (ct)
* Modify build function source and var_arm64 default
Updated source for build function and changed default value for var_arm64.
---------
Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com>
Co-authored-by: CanbiZ (MickLesk) <47820557+MickLesk@users.noreply.github.com>
Ampache 8.0.0 dropped the php8.4 prebuilt zip in favor of php8.5, so
new installs and updates could no longer find a matching release
asset. Install script now provisions PHP 8.5; update script detects
existing PHP 8.4 containers and upgrades them to 8.5 before fetching
the new release.
Closes#16482
libreoffice-listener.service binds 127.0.0.1:2002, and unoserver — started
with no --uno-port — defaults to the same port and launches its own
LibreOffice. The second soffice.bin cannot bind and spins in its URP Acceptor
thread indefinitely, burning a full core from boot.
It stays invisible because unoserver's client side dials 127.0.0.1:2002 and
reaches the listener's instance, so conversions succeed and systemctl --failed
stays empty.
unoserver supervises its own LibreOffice, so the separate listener is
redundant; port 2002 is still served after the change. Both
Requires=libreoffice-listener lines are dropped with it, and update_script()
migrates existing installs, which all still carry the collision.
* networkoptimizer: mitigate dotnet publish hang in LXC
* Optimize networkoptimizer.sh by removing duplicate restore
Removed redundant restore_backup call after deployment.
* Clean up comments in networkoptimizer-install.sh
Removed comments about MSBuild issues in the installation script.
* CouchDB: generate an Erlang-safe (hex) cookie
ERLANG_COOKIE was generated with `openssl rand -base64 32`, whose output
contains +, / and = (e.g. "+w2dDazB/CrIZMsZu8edX4hn55QeRXOCi+hom25Lmm8=").
CouchDB writes the cookie into /opt/couchdb/etc/vm.args as
`-setcookie '<cookie>'`, and those characters break Erlang's vm.args
parsing, so couchdb.service fails to start on a fresh install (#16360).
Use `openssl rand -hex 32` instead: a 64-char hex string is alphanumeric,
needs no quoting, and is always a valid Erlang cookie. (Same 256-bit
entropy as the base64 of 32 bytes.)
Closes#16360
* Update install/apache-couchdb-install.sh
---------
Co-authored-by: Sam Heinz <sam@samheinz.com>
CanbiZ (MickLesk)