Refactor kan installation script to ignore scripts during pnpm install and update tsconfig path

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

CHANGELOG.md

@@ -470,6 +470,17 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-06-01
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - kan: extend fetch_and_deploy_gh_tag to use 'latest' tag [@MickLesk](https://github.com/MickLesk) ([#14853](https://github.com/community-scripts/ProxmoxVE/pull/14853))
+    - Glance: preserve glance.yml across updates [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#14845](https://github.com/community-scripts/ProxmoxVE/pull/14845))
+    - NginxProxymanager: set Certbot version in npm.service environment variable (2.15.0) [@MickLesk](https://github.com/MickLesk) ([#14843](https://github.com/community-scripts/ProxmoxVE/pull/14843))
+    - [FileFlows] Fix service handling by using systemctl --all with quoted glob [@adrianmusante](https://github.com/adrianmusante) ([#14838](https://github.com/community-scripts/ProxmoxVE/pull/14838))
+
 ## 2026-05-31
 
 ### 🚀 Updated Scripts

ct/fileflows.sh

@@ -34,7 +34,7 @@ function update_script() {
   update_available=$(curl -fsSL -X 'GET' "http://localhost:19200/api/status/update-available" -H 'accept: application/json' | jq .UpdateAvailable)
   if [[ "${update_available}" == "true" ]]; then
     msg_info "Stopping Service"
-    systemctl stop fileflows*
+    systemctl --all stop 'fileflows*'
     msg_info "Stopped Service"
 
     msg_info "Creating Backup"
@@ -46,7 +46,7 @@ function update_script() {
     fetch_and_deploy_from_url "https://fileflows.com/downloads/zip" "/opt/fileflows"
 
     msg_info "Starting Service"
-    systemctl start fileflows*
+    systemctl --all start 'fileflows*'
     msg_ok "Started Service"
     msg_ok "Updated successfully!"
   else

ct/glance.sh

@@ -34,8 +34,20 @@ function update_script() {
     systemctl stop glance
     msg_ok "Stopped Service"
 
+    if [[ -f /opt/glance/glance.yml ]]; then
+      msg_info "Backing up glance.yml"
+      cp /opt/glance/glance.yml /tmp/glance.yml.bak
+      msg_ok "Backed up glance.yml"
+    fi
+
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "glance" "glanceapp/glance" "prebuild" "latest" "/opt/glance" "glance-linux-amd64.tar.gz"
 
+    if [[ -f /tmp/glance.yml.bak ]]; then
+      msg_info "Restoring glance.yml"
+      mv /tmp/glance.yml.bak /opt/glance/glance.yml
+      msg_ok "Restored glance.yml"
+    fi
+
     msg_info "Starting Service"
     systemctl start glance
     msg_ok "Started Service"

ct/kan.sh

@@ -39,7 +39,7 @@ function update_script() {
     cp /opt/kan/.env /opt/kan.env.bak
     msg_ok "Backed up Data"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_tag "kan" "kanbn/kan" "tarball"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_tag "kan" "kanbn/kan" "latest"
 
     msg_info "Restoring Configuration"
     cp /opt/kan.env.bak /opt/kan/.env
@@ -49,8 +49,10 @@ function update_script() {
     msg_info "Building Application"
     cd /opt/kan
     set -a && source /opt/kan/.env && set +a
-    export NEXT_PUBLIC_USE_STANDALONE_OUTPUT=true CI=true
-    $STD pnpm install
+    export NEXT_PUBLIC_USE_STANDALONE_OUTPUT=true
+    $STD pnpm install --ignore-scripts
+    export CI=true
+    sed -i 's|"@kan/tsconfig/internal-package.json"|"../../tooling/typescript/internal-package.json"|g' /opt/kan/packages/logger/tsconfig.json
     $STD pnpm build --filter=@kan/web
     unset NEXT_PUBLIC_USE_STANDALONE_OUTPUT CI
     msg_ok "Built Application"

ct/nginxproxymanager.sh

@@ -216,6 +216,12 @@ EOF
     msg_ok "Initialized Backend"
 
     msg_info "Starting Services"
+    CERTBOT_VER=$(/opt/certbot/bin/certbot --version 2>&1 | awk '{print $NF}')
+    if grep -q "Environment=CERTBOT_VERSION" /lib/systemd/system/npm.service; then
+      sed -i "s|Environment=CERTBOT_VERSION=.*|Environment=CERTBOT_VERSION=${CERTBOT_VER}|" /lib/systemd/system/npm.service
+    else
+      sed -i "/Environment=NODE_ENV=production/a Environment=CERTBOT_VERSION=${CERTBOT_VER}" /lib/systemd/system/npm.service
+    fi
     sed -i 's/user npm/user root/g; s/^pid/#pid/g' /usr/local/openresty/nginx/conf/nginx.conf
     sed -r -i 's/^([[:space:]]*)su npm npm/\1#su npm npm/g;' /etc/logrotate.d/nginx-proxy-manager
     systemctl daemon-reload

install/kan-install.sh

@@ -23,7 +23,7 @@ PG_VERSION="16" setup_postgresql
 PG_DB_NAME="kan" PG_DB_USER="kan" setup_postgresql_db
 NODE_VERSION="20" NODE_MODULE="pnpm" setup_nodejs
 
-fetch_and_deploy_gh_tag "kan" "kanbn/kan" "tarball"
+fetch_and_deploy_gh_tag "kan" "kanbn/kan" "latest"
 
 msg_info "Configuring Application"
 AUTH_SECRET=$(openssl rand -base64 32)
@@ -45,8 +45,9 @@ msg_info "Building Application"
 cd /opt/kan
 set -a && source /opt/kan/.env && set +a
 export NEXT_PUBLIC_USE_STANDALONE_OUTPUT=true NEXT_PUBLIC_BASE_URL BETTER_AUTH_TRUSTED_ORIGINS NEXT_PUBLIC_ALLOW_CREDENTIALS BETTER_AUTH_SECRET
+$STD pnpm install --ignore-scripts
 export CI=true
-$STD pnpm install
+sed -i 's|"@kan/tsconfig/internal-package.json"|"../../tooling/typescript/internal-package.json"|g' /opt/kan/packages/logger/tsconfig.json
 $STD pnpm build --filter=@kan/web
 unset NEXT_PUBLIC_USE_STANDALONE_OUTPUT CI
 msg_ok "Built Application"

install/nginxproxymanager-install.sh

@@ -160,7 +160,8 @@ $STD yarn install --network-timeout 600000
 msg_ok "Initialized Backend"
 
 msg_info "Creating Service"
-cat <<'EOF' >/lib/systemd/system/npm.service
+CERTBOT_VER=$(/opt/certbot/bin/certbot --version 2>&1 | awk '{print $NF}')
+cat <<EOF >/lib/systemd/system/npm.service
 [Unit]
 Description=Nginx Proxy Manager
 After=network.target
@@ -169,6 +170,7 @@ Wants=openresty.service
 [Service]
 Type=simple
 Environment=NODE_ENV=production
+Environment=CERTBOT_VERSION=${CERTBOT_VER}
 ExecStartPre=-mkdir -p /tmp/nginx/body /data/letsencrypt-acme-challenge
 ExecStart=/usr/bin/node index.js --abort_on_uncaught_exception --max_old_space_size=250
 WorkingDirectory=/app

install/webtrees-install.sh

@@ -41,12 +41,12 @@ cat <<EOF >/etc/caddy/Caddyfile
 }
 EOF
 usermod -aG www-data caddy
-msg_ok "Configured Caddy"
-
 systemctl enable -q --now php${PHP_VER}-fpm
 systemctl restart caddy
+msg_ok "Configured Caddy"
 
 msg_info "Automating Webtrees Setup"
+cd /opt/webtrees
 WT_ADMIN_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c15)
 $STD sudo -u www-data php /opt/webtrees/index.php config-ini \
   --dbhost=127.0.0.1 \