* Add host CA inheritance for container builds
Introduces `var_inherit_host_ca` (default `auto`) across variable loading, validation, defaults, and persisted app vars. The advanced settings flow now includes a dedicated Host CA Inheritance step and surfaces the selection in the final summary.
Adds `_apply_host_ca_certs_in_container()` to copy host certificates from `/usr/local/share/ca-certificates/*.crt` into the container and refresh trust with `update-ca-certificates` when available. This runs during container setup after proxy configuration, with safe no-op behavior when no host certs exist or inheritance is disabled.
* Warn when host CA inheritance is disabled
Changes the log level from info to warning when host CA inheritance is skipped by configuration, and includes the number of host certificates detected. This makes intentional skips more visible while still showing useful context.
* core: make host CA inheritance opt-in (default no)
Addresses review feedback: default to 'no' instead of 'auto' so certs are
only inherited when explicitly enabled in advanced mode, preserving LXC
isolation by default.
---------
Co-authored-by: michel.roegl-brunner@htl-braunau.at <michel.roegl-brunner@htl-braunau.at>
* Harden remote func bootstrapping
Replace bare `source <(curl ...)` calls with a `_bootstrap_source` helper that validates both the download exit code and the presence of a probe function after sourcing. This prevents silent failures when DNS is not yet available in a freshly booted container or when a download fails mid-stream. Applies to build.func, install.func, and alpine-install.func. Also adds retry flags and a connect timeout to curl/wget.
* Refactor bootstrap error handling with helper
Extract repeated fatal-error logic into a `_bootstrap_die` helper across alpine-install.func, build.func, and install.func. The helper uses `msg_error` when available, falling back to stderr, then exits with code 115. Inline error blocks are replaced with cleaner one-liner `|| _bootstrap_die` calls.
* UmlautAdaptarr: use the Debian 13 Microsoft repo with its 2025 signing key
The container is Debian 13 (var_version 13) but the script configures the
Microsoft debian/12 prod repo with suite bookworm.
The move to debian/13 was reverted in #8392 because apt reported "OpenPGP
signature verification failed" (#8385), diagnosed at the time as Microsoft
not having populated the trixie repo. The actual cause was the signing key:
debian/13/prod is signed by EE4D7792F748182B (microsoft-2025.asc), while the
script kept microsoft.asc (EB3E94ADBE1229CF). The suite and URL were changed
but the key was not.
The trixie repo carries the required packages at current patch level
(dotnet-sdk-8.0 8.0.423-1, aspnetcore-runtime-8.0 8.0.29-1).
This makes the call identical to the six other scripts already on the
Debian 13 Microsoft repo (technitiumdns, igotify, mail-archiver, rdtclient,
fileflows, immichframe).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
* UmlautAdaptarr: migrate existing containers to the Debian 13 repo on update
Per review feedback: the install-side fix only helps new containers.
Existing ones keep the Debian 12 repo indefinitely, because update_script
only fetches a GitHub release and never touches apt.
Repoints them when the stale Debian 12 repo is detected, mirroring the
conditional setup_deb822_repo calls in ct/technitiumdns.sh and
ct/fileflows.sh. The guard makes this a no-op once migrated.
setup_deb822_repo's microsoft* globs also clear the pre-#9839
microsoft-prod.sources layout; its key lived in /usr/share/keyrings,
which cleanup_old_repo_files does not cover, so it is removed explicitly
as ct/technitiumdns.sh does.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---------
Co-authored-by: Tim Moore <tim.moore@ingenuity.com.au>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
* fix(bazarr): store data in /var/lib/bazarr instead of inside /opt/bazarr
The installer creates /var/lib/bazarr and update_script() uses it as the
"is Bazarr installed" guard, but nothing pointed Bazarr at it. Bazarr
defaults its data directory to <install dir>/data, resolved from its own
source file rather than WorkingDirectory, so a stock container kept
config/ db/ backup/ cache/ log/ restore/ in /opt/bazarr/data - the
directory fetch_and_deploy_gh_release redeploys over - while
/var/lib/bazarr stayed empty.
Pass -c /var/lib/bazarr in the unit, matching the -data= flag the other
*arr scripts use. bazarr.py re-execs its child with sys.argv[1:], so the
flag survives the restart Bazarr performs while loading its config.
update_script() gains a one-time migration for existing installs. It runs
outside the release check so containers already on the latest version are
migrated too, is skipped when the unit already names a data directory,
refuses (before stopping the service) when both locations hold data, and
copies before removing so a failed migration leaves the original database
in place.
Fixes#16097
* fix(bazarr): drop explanatory comments per review
* Bump GitHub Actions across workflows
Update workflow dependencies to newer major versions in repository automation files. This upgrades `actions/checkout` to v7, `actions/github-script` to v9, `actions/create-github-app-token` to v3, and GitHub Pages actions (`upload-pages-artifact` and `deploy-pages`) to v5 to keep CI/CD and maintenance workflows current.
* add dependabot for gh actions
community-scripts-pr-app[bot]