The service ran `java -jar` without the JAVA_BASE_OPTS from .env, and inside
LXC the JVM cannot see the container's memory limit, so it sized its heap from
host RAM (16 GB in a 2 GB CT on a 64 GB host) and the container thrashed and got
OOM-killed. Pass the .env options, set -XX:MaxRAM from /proc/meminfo (lxcfs
reports the CT limit), lower MaxRAMPercentage to 50 for LibreOffice/tesseract
headroom, and migrate existing units on update (also drops the broken
ExecStop=/bin/kill -15 %n left from before #16813).
Fixes#18291
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
VictoriaLogs only accepts syslog when -syslog.listenAddr.tcp/udp are set,
so network gear that ships logs over syslog (UniFi, firewalls, switches)
had nowhere to send them. Add both listeners to the service and migrate
existing installs on update.
The ExecStart migration only ran when ~/.authentik reported a version
below 2026.8. Installs whose marker already reads 2026.8.x but whose
units were never migrated kept pointing to the removed
/opt/authentik/authentik-server binary and failed with 203/EXEC.
Also run the migration when the server unit still has the old path.
Fixes#18306
Since Dawarich 1.15.1 the importmap pins maplibre-gl to
/maplibre/<version>/maplibre-gl.mjs in public/. Debian's nginx
mime.types has no mjs entry, so the vhost served it as
application/octet-stream and browsers refused to load the module:
blank map, map controllers fail.
Add a .mjs location (text/javascript, as Rails serves it upstream) to
the install heredoc, and insert it into existing vhosts from
update_script() before the release check, applied via nginx_enable_site.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* fix(vm/opnsense): increase startup wait from 90 to 180 seconds
* Remove error redirection from bridge interface setup
Should fix :
⠴ Bridge interfaces are being added.update VM 101: -net0 virtio,bridge=vmbr1,macaddr=XX:XX:XX:XX:XX:XX,firewall=0,queues=4
⠙ Bridge interfaces are being added.update VM 101: -net1 virtio,bridge=vmbr0,macaddr=XX:XX:XX:XX:XX:XX,firewall=0,queues=4
✔️ Bridge interfaces have been successfully added.
The A-B refactor (#15075) moved the backup to create_backup but kept the
old hand-written restore, which reads $BACKUP_DIR. Nothing sets it any
more, so the first restore cp failed after the install dir was wiped:
the update aborted with Tomcat stopped and the config left in
/opt/apache-tomcat.backup.
Restore conf and webapps with restore_backup, which also removes the
store. lib gets a store of its own so only the jars the new release lacks
(JDBC drivers and the like) are copied back; restoring it whole would
put the old Tomcat jars over the new ones.
Co-authored-by: Matt Daleo <12395090+mazelado@users.noreply.github.com>
Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>
The update overlaid the release tarball, so files removed upstream survived. v0.13.1 moved the frontend config into vite.config.ts, and the leftover svelte.config.js fails pnpm build under SvelteKit 3 (config_file_unsupported) after the services are already stopped. Deploy with CLEAN_INSTALL=1, keep backend/server/media in place, and back up both .env files.
The djangorestframework<3.15 pin (#13194) worked around rest_framework.schemas.coreapi, which AdventureLog stopped using in v0.13.0. v0.13.1 requires djangorestframework>=3.18.3,<3.19, so the pin now downgrades DRF below the app's own requirement.
When a merged PR came from a DevScripts migration, the telemetry service
re-attributes that script's DevScripts records. Needs the
TELEMETRY_ADMIN_TOKEN secret; without it the step is skipped.
Stalwart v1.0.0 (26 Oct 2026) ships a new data store layout, so v0.16.x
deployments cannot be upgraded in place. Data has to be copied into a new,
empty v1 store with stalwartlabs/stalwart-migrate, which requires v0.16.27
as its source version and needs an interactive prepare step plus an offline
final cutover.
The update path pulled "latest" and would have swapped the binary for v1 on
existing containers, leaving the mail server unable to start on its old store.
Pin install and update to v0.16.27 instead and surface the reason through
check_for_gh_release. Containers that already pulled v1.0.0 are put back on
v0.16.27 by the next update run.
community-scripts-pr-app[bot]