Update CHANGELOG.md (#9921)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

CHANGELOG.md

@@ -12,6 +12,17 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ## 2025-12-13
 
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - [HOTFIX] NetVisor: backup OIDC config before update [@vhsdream](https://github.com/vhsdream) ([#9895](https://github.com/community-scripts/ProxmoxVE/pull/9895))
+    - Update OPNsense download URL to version 14.3 [@jaredcarling42-design](https://github.com/jaredcarling42-design) ([#9899](https://github.com/community-scripts/ProxmoxVE/pull/9899))
+
+  - #### ✨ New Features
+
+    - Add optional TLS setup to Valkey installer [@pshankinclarke](https://github.com/pshankinclarke) ([#9789](https://github.com/community-scripts/ProxmoxVE/pull/9789))
+
 ## 2025-12-12
 
 ### 🆕 New Scripts

ct/netvisor.sh

@@ -36,6 +36,9 @@ function update_script() {
 
     msg_info "Backing up configurations"
     cp /opt/netvisor/.env /opt/netvisor.env.bak
+    if [[ -f /opt/netvisor/oidc.toml ]]; then
+      cp /opt/netvisor/oidc.toml /opt/netvisor.oidc.toml
+    fi
     msg_ok "Backed up configurations"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "netvisor" "netvisor-io/netvisor" "tarball" "latest" "/opt/netvisor"
@@ -49,7 +52,10 @@ function update_script() {
     TOOLCHAIN="$(grep "channel" /opt/netvisor/backend/rust-toolchain.toml | awk -F\" '{print $2}')"
     RUST_TOOLCHAIN=$TOOLCHAIN setup_rust
 
-    cp /opt/netvisor.env.bak /opt/netvisor/.env
+    mv /opt/netvisor.env.bak /opt/netvisor/.env
+    if [[ -f /opt/netvisor.oidc.toml ]]; then
+      mv /opt/netvisor.oidc.toml /opt/netvisor/oidc.toml
+    fi
     LOCAL_IP="$(hostname -I | awk '{print $1}')"
     if ! grep -q "PUBLIC_URL" /opt/netvisor/.env; then
       sed -i "\|_PATH=|a\NETVISOR_PUBLIC_URL=http://${LOCAL_IP}:60072" /opt/netvisor/.env

install/valkey-install.sh

@@ -32,10 +32,46 @@ echo "# Memory-optimized settings for small-scale deployments" >> /etc/valkey/va
 echo "maxmemory ${MAXMEMORY_MB}mb" >> /etc/valkey/valkey.conf
 echo "maxmemory-policy allkeys-lru" >> /etc/valkey/valkey.conf
 echo "maxmemory-samples 10" >> /etc/valkey/valkey.conf
+msg_ok "Installed Valkey"
+
+echo
+read -r -p "${TAB3}Enable TLS for Valkey (Sentinel mode does not supported)? [y/N]: " prompt
+if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
+    read -r -p "${TAB3}Use TLS-only mode (disable TCP port 6379)? [y/N]: " tls_only
+    msg_info "Configuring TLS for Valkey..."
+
+    create_self_signed_cert "Valkey"
+    TLS_DIR="/etc/ssl/valkey"
+    TLS_CERT="$TLS_DIR/valkey.crt"
+    TLS_KEY="$TLS_DIR/valkey.key"
+    chown valkey:valkey "$TLS_CERT" "$TLS_KEY"
+
+    if [[ ${tls_only,,} =~ ^(y|yes)$ ]]; then
+    {
+      echo ""
+      echo "# TLS configuration generated by Proxmox VE Valkey helper-script"
+      echo "port 0"
+      echo "tls-port 6379"
+      echo "tls-cert-file $TLS_DIR/valkey.crt"
+      echo "tls-key-file $TLS_DIR/valkey.key"
+      echo "tls-auth-clients no"
+    } >> /etc/valkey/valkey.conf
+    msg_ok "Enabled TLS-only mode on port 6379"
+    else
+    {
+      echo ""
+      echo "# TLS configuration generated by Proxmox VE Valkey helper-script"
+      echo "tls-port 6380"
+      echo "tls-cert-file $TLS_DIR/valkey.crt"
+      echo "tls-key-file $TLS_DIR/valkey.key"
+      echo "tls-auth-clients no"
+    } >> /etc/valkey/valkey.conf
+    msg_ok "Enabled TLS on port 6380 and TCP on 6379"
+    fi
+fi
 
 systemctl enable -q --now valkey-server
 systemctl restart valkey-server
-msg_ok "Installed Valkey"
 
 motd_ssh
 customize

vm/opnsense-vm.sh

@@ -578,7 +578,7 @@ fi
 msg_ok "Using ${CL}${BL}$STORAGE${CL} ${GN}for Storage Location."
 msg_ok "Virtual Machine ID is ${CL}${BL}$VMID${CL}."
 msg_info "Retrieving the URL for the OPNsense Qcow2 Disk Image"
-URL="https://download.freebsd.org/releases/VM-IMAGES/14.2-RELEASE/amd64/Latest/FreeBSD-14.2-RELEASE-amd64.qcow2.xz"
+URL="https://download.freebsd.org/releases/VM-IMAGES/14.3-RELEASE/amd64/Latest/FreeBSD-14.3-RELEASE-amd64.qcow2.xz"
 msg_ok "Download URL: ${CL}${BL}${URL}${CL}"
 curl -f#SL -o "$(basename "$URL")" "$URL"
 echo -en "\e[1A\e[0K"