* feat: add Docker-based tool addons for dockge, komodo, dokploy, npmplus
Create addon scripts following the arcane.sh pattern for Docker-based
tools that can be installed on any existing Docker LXC:
- dockge: Docker Compose stack manager (port 5001)
- komodo: Build/deployment system with MongoDB/FerretDB (port 9120)
- dokploy: PaaS via external installer with Redis (port 3000)
- npmplus: Nginx Proxy Manager Plus via Compose (port 81)
Each addon includes:
- Docker availability check
- Install with full configuration
- Update via docker compose pull
- Uninstall with container cleanup
- ASCII header files
Original ct/ and install/ scripts are preserved for now.
* refactor: convert Docker tools to addons, remove old scripts
Convert dockge, komodo, dokploy, coolify from standalone ct/install
scripts to addon pattern (like arcane.sh).
Added:
- tools/addon/dockge.sh (port 5001)
- tools/addon/komodo.sh (port 9120, MongoDB/FerretDB choice)
- tools/addon/dokploy.sh (port 3000, external installer)
- tools/addon/coolify.sh (port 8000, external installer)
- tools/headers/ for all 4
Removed:
- ct/dockge.sh, ct/komodo.sh, ct/alpine-komodo.sh, ct/dokploy.sh, ct/coolify.sh
- install/dockge-install.sh, install/komodo-install.sh, install/alpine-komodo-install.sh
- install/dokploy-install.sh, install/coolify-install.sh
- frontend/public/json/ for dockge, komodo, dokploy, coolify
- tools/addon/npmplus.sh (not an addon candidate)
These tools are Docker-only and fit the addon pattern: they require
an existing Docker LXC and manage containers via docker compose.
* feat: add addon JSON configs for dockge, komodo, dokploy, coolify
Recreate JSON configs with type=addon, script paths pointing to
tools/addon/*.sh, null resources (addon runs on existing Docker LXC),
and update instructions in notes.
* feat: add Runtipi addon + upgrade all addons with Proxmox host check, optional Docker install, Alpine support
- New: tools/addon/runtipi.sh with full Alpine support (gcompat for musl)
- New: tools/headers/runtipi ASCII header
- Updated: runtipi.json to addon type with null resources
- Removed: ct/runtipi.sh, install/runtipi-install.sh (migrated to addon)
- All addons (dockge, komodo, dokploy, coolify, runtipi) now have:
- check_proxmox_host(): warns when running on PVE host, default N
- check_or_install_docker(): optional Docker install (Debian+Alpine)
- Alpine-aware curl bootstrap and dependency installation
* readd ct, update information
* Create runtipi.sh
* refactor: remove inline header_info from addons, use core.func get_header()
- get_header() in core.func now maps APP_TYPE=addon to tools/headers/ path
- Removed 5 duplicate ASCII art header_info functions from addon scripts
- Addons now use the shared header_info() from core.func + tools/headers/ files
* chore(tools): add Github source links to dockge, komodo, dokploy, coolify, runtipi addons
* fix(runtipi): drop Alpine support; add OS compat notes to docker addon JSONs
* Update adguardhome-sync.sh
Better handle edge case of `curl` not being installed on Alpine.
Install `jq`, required by `fetch_and_deploy_gh_release()`, which if not installed makes the script error out with confusing stuff
Rewritten `get_ip()` to make it also work on busybox environments (Alpine).
* Update adguardhome-sync.sh
`jq` is installed by some code inside of `fetch_and_deploy_gh_release` for debian
So it doesn't make much sense to install it here.
We only do so for alpine, as if its not installed it breaks the script
Detect Alpine inside the LXC container and install Tailscale via apk (add community repo if missing), enable/start the service. Preserve Debian/Ubuntu install path but improve DNS resolution checks, temporarily override /etc/resolv.conf if DNS appears blocked, and restore it afterwards. Switch pct exec to use sh -c, tighten command existence checks and redirections, ensure curl and keyring directory are present, add Tailscale apt source and install package. Overall robustness and error-handling improvements for installing Tailscale in containers.
* fix(error-handler): prevent silent() from re-enabling error handling during recovery
Root cause: silent() (core.func) unconditionally calls set -Eeuo pipefail
and trap 'error_handler' ERR after every command. When build_container()
intentionally disables error handling for its recovery section, any
intermediate call through silent()/ re-enables it. This causes the
grep/sed pipeline for missing_cmd extraction to trigger error_handler
(grep returns exit code 1 on no match + pipefail = fatal).
Fixes:
1. silent(): Save errexit state before disabling, only restore if it was
active. Callers that intentionally disabled error handling (e.g.
build_container recovery) are no longer silently re-enabled.
2. build.func: Add || true to missing_cmd grep pipeline as defense-in-depth
against pipeline failure propagation.
3. build.func: Add explicit set +Eeuo pipefail / trap - ERR after
post_update_to_api() call, before error classification grep/sed section.
4. build.func: Remove stale global combined_log variable from variables()
that used a different path format (/tmp/install-SESSION-combined.log)
than the actual local variable (/tmp/NSAPP-CTID-SESSION.log). The global
was never written to and caused confusion when error_handler displayed it.
* Update build.func
* chore(install): add Github source links to all setup_nodejs scripts
52 install scripts had a project website in '# Source:' but no GitHub
link. Merged the GitHub repo URL into the Source header as:
# Source: https://website.com/ | Github: https://github.com/OWNER/REPO
Repos sourced from fetch_and_deploy_gh_release calls, get_latest_github_release
calls, or known project repos for npm/pip installed apps.
Two scripts (fumadocs, pve-scripts-local) had no Source line at all —
added one. Shinobi skipped (GitLab-only, no GitHub repo).
* chore(install): add Github source links to all fetch_and_deploy scripts
77 additional install scripts had fetch_and_deploy_gh_release calls but
no GitHub link in the Source header. Merged the primary app repo into
the Source header as:
# Source: https://website.com/ | Github: https://github.com/OWNER/REPO
Where multiple fetch_and_deploy calls existed (app + dependency), the
primary app repo was selected:
- ersatztv: ErsatzTV/ErsatzTV (not ffmpeg)
- firefly: firefly-iii/firefly-iii (not data-importer)
- komga: gotson/komga (not kepubify dep)
- sabnzbd: sabnzbd/sabnzbd (not par2cmdline-turbo dep)
- signoz: SigNoz/signoz (not otel-collector)
- tunarr: chrisbenincasa/tunarr (not ffmpeg dep)
Also fixed cosmos-install.sh double https:// in Source URL.
Skipped: autocaliweb (source already on codeberg, GitHub repos are deps only)
* revert: restore misc/build.func and misc/core.func to main state
These error-handler fixes belong to fix/error-handler-recovery, not to
this sources-only branch.
* chore(ct,tools): sync Source headers with install/ and add Github links to addon scripts
* fix: send telemetry BEFORE log collection in signal handlers
- Swap ensure_log_on_host/post_update_to_api order in on_interrupt, on_terminate, api_exit_script, and inline SIGHUP/SIGINT/SIGTERM traps
- For signal exits (>128): send telemetry immediately, then best-effort log collection
- Add 2>/dev/null || true to all I/O in signal handlers to prevent SIGPIPE
- Fix on_exit: exit_code=0 now reports 'done' instead of 'failed 1'
- Root cause: pct pull hangs on dying containers blocked telemetry updates, leaving 595+ records stuck in 'installing' daily
* feat: add execution_id to all telemetry payloads
- Generate EXECUTION_ID from RANDOM_UUID in variables()
- Export EXECUTION_ID to container environment
- Add execution_id field to all 8 API payloads in api.func
- Add execution_id to post_progress_to_api in install.func and alpine-install.func
- Fallback to RANDOM_UUID when EXECUTION_ID not set (backward compat)
* fix: correct telemetry type values for PVE and addon scripts
- PVE scripts (tools/pve/*): change type 'tool' -> 'pve'
- Addon scripts (tools/addon/*): fix 4 scripts that wrongly used 'tool' -> 'addon'
(netdata, add-tailscale-lxc, add-netbird-lxc, all-templates)
- api.func: post_tool_to_api sends type='pve', default fallback 'pve'
- Aligns with PocketBase categories: lxc, vm, pve, addon
* fix: persist diagnostics opt-in inside containers for addon telemetry
- install.func + alpine-install.func: create /usr/local/community-scripts/diagnostics
inside the container when DIAGNOSTICS=yes (from build.func export)
- Enables addon scripts running later inside containers to find the opt-in
- Update init_tool_telemetry default type from 'tool' to 'pve'
* refactor: clean up diagnostics/telemetry opt-in system
- diagnostics_check(): deduplicate heredoc (was 2x 22 lines), improve whiptail
text with clear what/what-not collected, add telemetry + privacy links
- diagnostics_menu(): better UX with current status, clear enable/disable
buttons, note about existing containers
- variables(): change DIAGNOSTICS default from 'yes' to 'no' (safe: no
telemetry before user consents via diagnostics_check)
- install.func + alpine-install.func: persist BOTH yes AND no in container
so opt-out is explicit (not just missing file = no)
- Fix typo 'menue' -> 'menu' in config file comments
* fix: no pre-selection in telemetry dialog, link to telemetry-service README
- Add --defaultno so 'No, opt out' is focused by default (user must Tab to Yes)
- Change privacy link from discussions/1836 to telemetry-service#privacy--compliance
* fix: use radiolist for telemetry dialog (no pre-selection)
- Replace --yesno with --radiolist: user must actively SPACE-select an option
- Both options start as OFF (no pre-selection)
- Cancel/Exit defaults to 'no' (opt-out)
* simplify: inline telemetry dialog text like other whiptail dialogs
* improve: telemetry dialog with more detail, link to PRIVACY.md
- Add what we collect / don't collect sections back to dialog
- Link to telemetry-service/docs/PRIVACY.md instead of README anchor
- Update config file comment with same link
* core: add progress; fix exit status
Introduce post_progress_to_api() in alpine-install.func and install.func to send a lightweight, fire-and-forget telemetry ping (HTTP POST) that updates an existing telemetry record to "configuring" when DIAGNOSTICS=yes and RANDOM_UUID is set. The function is non-blocking (curl -m 5, errors ignored) and is invoked during container setup and after OS updates to signal active progress. Also adjust api_exit_script() in build.func to report success (post_update_to_api "done" "0") for cases where the script exited normally but a completion status wasn't posted, instead of reporting failure.
* Safer tools.func load and improved error handling
Replace process-substitution sourcing of tools.func with an explicit curl -> variable -> source via /dev/stdin, adding failure messages and a check that expected functions (e.g. fetch_and_deploy_gh_release) are present (misc/alpine-install.func, misc/install.func). Add categorize_error mapping for exit code 10 -> "config" (misc/api.func). Tweak build.func: minor pipeline formatting and change the ERR trap to capture the actual exit code and only call ensure_log_on_host/post_update on non-zero exits, preventing erroneous failure reporting.
* tools: add data init and auto-reporting to tools and pve section
Introduce telemetry helpers in misc/api.func: _telemetry_report_exit (reports success/failure via post_tool_to_api/post_addon_to_api) and init_tool_telemetry (reads DIAGNOSTICS, starts install timer and installs an EXIT trap to auto-report). Integrate telemetry into many tools/addon and tools/pve scripts by sourcing the remote api.func and calling init_tool_telemetry (guarded with declare -f). Also apply a minor arithmetic formatting tweak in misc/build.func for RECOVERY_ATTEMPT.
Introduce create_service() to generate the immich-proxy systemd unit and run systemctl daemon-reload. Replace duplicated heredoc service blocks in install with a call to create_service, and invoke create_service during update before starting the service. Adjust unit WorkingDirectory to ${INSTALL_PATH}/app and ExecStart to run dist/index.js.
* fix(tailscale-addon): fix DNS check and keyrings directory issues
- Source /etc/os-release instead of grep to handle quoted values properly
- Use VERSION_CODENAME variable instead of VER for correct URL
- Add fallback DNS resolution methods (host, nslookup, getent) when dig is missing
- Create /usr/share/keyrings directory if it doesn't exist
- Skip DNS check gracefully when no DNS tools are available
Fixes installation failures with 'dig: command not found' and
'No such file or directory' for keyrings path
* Update tools/addon/add-tailscale-lxc.sh
Co-authored-by: Chris <punk.sand7393@fastmail.com>
* Update tools/addon/add-tailscale-lxc.sh
Co-authored-by: Chris <punk.sand7393@fastmail.com>
---------
Co-authored-by: Chris <punk.sand7393@fastmail.com>
When Docker is installed in the same LXC, Docker sets the FORWARD chain
policy to DROP on startup. If Netbird starts before Docker finishes
initializing its iptables rules, Docker overrides the Netbird routing
rules, causing traffic routing to fail despite the tunnel being up.
Add a systemd drop-in override that ensures netbird.service starts after
docker.service (only if Docker is installed). This prevents the race
condition and ensures correct iptables ordering after reboot.
Closes#11354
* Rename import_local_ip to get_local_ip
Replaces all references to the helper function import_local_ip with get_local_ip across scripts and documentation for consistency. Updates usage examples and comments to reflect the new function name.
* Rename get_local_ip to get_lxc_ip and update usage
Replaces all references to get_local_ip with get_lxc_ip across scripts, documentation, and templates for clarity and consistency. Updates the implementation in core.func to improve IP detection for LXC containers, and adjusts helper functions in addon scripts accordingly.
* feat: validate container ID before pct create to prevent failures
Add validation to ensure container IDs are not already in use before attempting to create containers. This prevents pct create failures when an ID is already assigned to a VM/LXC or used in LVM volumes.
Changes:
- Add validate_container_id() and get_valid_container_id() functions to build.func
- Validate ID in base_settings() for default installation method
- Validate ID in advanced_settings() dialog with user prompt for next available ID
- Add validation to turnkey.sh with interactive dialog
- Add validation to all-templates.sh with automatic ID correction
Checks performed:
- Container config file existence (/etc/pve/lxc/*.conf)
- VM config file existence (/etc/pve/qemu-server/*.conf)
- LVM logical volume usage
Fixes issue where container creation would fail if the suggested/chosen ID was already in use.
* feat: validate container ID before pct create to prevent failures
Add validation to ensure container IDs are not already in use before attempting to create containers. This prevents pct create failures when an ID is already assigned to a VM/LXC or used in LVM volumes.
Changes:
- Add validate_container_id() and get_valid_container_id() functions to build.func
- Validate ID in base_settings() for default installation method
- Validate ID in advanced_settings() dialog with user prompt for next available ID
- Add validation to turnkey.sh with interactive dialog
- Add validation to all-templates.sh with automatic ID correction
Checks performed:
- Container config file existence (/etc/pve/lxc/*.conf)
- VM config file existence (/etc/pve/qemu-server/*.conf)
- LVM logical volume usage
Fixes issue where container creation would fail if the suggested/chosen ID was already in use.
* Update turnkey.sh
* Update build.func
Corrected references from 'ProxmoxVED' to 'ProxmoxVE' in sourced URLs across livebook.sh, glances.sh, and pve-privilege-converter.sh to ensure scripts use the correct repository.
* FileBrowser Quantum: safer update (tmp download + atomic replace + arch autodetect)
**What**
Safer updater for FileBrowser Quantum addon:
- Download to temp file, then atomic `mv` into INSTALL_PATH
- Stop/start service around the swap
- CPU arch autodetect (amd64/arm64/armv7/armv6)
- Proper error handling & version verification before printing success
**Why**
Current update streams `curl` directly to `/usr/local/bin/filebrowser` and prints success even if `curl` fails.
I hit:
* fix(filebrowser-quantum): add missing `fi` before install section
Closes the conditional started with `if [[ -f "$INSTALL_PATH" ]]` so the script doesn’t hit a bash syntax error when reaching the install path.
* refactor(update): minimal fix - temp file + atomic mv; amd64 only
* style(update): remove comments/blank lines; drop restart (alpine-safe)
