Apply suggestion from @tremor021

Updated the source line to always use the latest build.func script from the community scripts repository.

.github/changelogs/2026/07.md

@@ -1,3 +1,165 @@
+## 2026-07-31
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Docmost: cleanup folder at update [@MickLesk](https://github.com/MickLesk) ([#16177](https://github.com/community-scripts/ProxmoxVE/pull/16177))
+    - Firecrawl: Add dependency [@tremor021](https://github.com/tremor021) ([#16174](https://github.com/community-scripts/ProxmoxVE/pull/16174))
+
+## 2026-07-30
+
+### 🆕 New Scripts
+
+  - Firecrawl ([#16156](https://github.com/community-scripts/ProxmoxVE/pull/16156))
+- OmniRoute ([#16155](https://github.com/community-scripts/ProxmoxVE/pull/16155))
+- PegaProx ([#16154](https://github.com/community-scripts/ProxmoxVE/pull/16154))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Immich: Pin version to 3.1.0 [@vhsdream](https://github.com/vhsdream) ([#16170](https://github.com/community-scripts/ProxmoxVE/pull/16170))
+    - romm: remove stale 1.x alembic migrations on update [@Darkatek7](https://github.com/Darkatek7) ([#16101](https://github.com/community-scripts/ProxmoxVE/pull/16101))
+
+  - #### 🔧 Refactor
+
+    - Medusa: convert the non-free unrar source to deb822 format [@angusmaul](https://github.com/angusmaul) ([#16093](https://github.com/community-scripts/ProxmoxVE/pull/16093))
+
+### 💾 Core
+
+  - #### ✨ New Features
+
+    - tools.func: support dynamic gitlab URL | add setup_mysql_db function [@MickLesk](https://github.com/MickLesk) ([#16166](https://github.com/community-scripts/ProxmoxVE/pull/16166))
+    - core: add configurable host CA inheritance during bootstrap [@MickLesk](https://github.com/MickLesk) ([#15889](https://github.com/community-scripts/ProxmoxVE/pull/15889))
+
+## 2026-07-29
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - backup virtual printer in bambuddy [@asylumexp](https://github.com/asylumexp) ([#16142](https://github.com/community-scripts/ProxmoxVE/pull/16142))
+    - ImmichFrame: check .NET SDK before update deployment [@aidaskni](https://github.com/aidaskni) ([#16104](https://github.com/community-scripts/ProxmoxVE/pull/16104))
+
+  - #### ✨ New Features
+
+    - Bichon: Migration for V2 Release [@MickLesk](https://github.com/MickLesk) ([#16145](https://github.com/community-scripts/ProxmoxVE/pull/16145))
+
+### 💾 Core
+
+  - #### ✨ New Features
+
+    - core: Harden remote func bootstrapping with dns issues [@MickLesk](https://github.com/MickLesk) ([#16146](https://github.com/community-scripts/ProxmoxVE/pull/16146))
+
+## 2026-07-28
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Create search directory in wanderer-install.sh [@Isnubi](https://github.com/Isnubi) ([#16134](https://github.com/community-scripts/ProxmoxVE/pull/16134))
+    - npmplus: Remove duplicate msg_info for container recreation [@MickLesk](https://github.com/MickLesk) ([#16122](https://github.com/community-scripts/ProxmoxVE/pull/16122))
+    - fix Node.js version drift [@asylumexp](https://github.com/asylumexp) ([#16111](https://github.com/community-scripts/ProxmoxVE/pull/16111))
+    - UmlautAdaptarr: use the Debian 13 Microsoft repo with its 2025 signing key [@angusmaul](https://github.com/angusmaul) ([#16077](https://github.com/community-scripts/ProxmoxVE/pull/16077))
+    - fix(bazarr): store data in /var/lib/bazarr instead of inside /opt/bazarr [@angusmaul](https://github.com/angusmaul) ([#16098](https://github.com/community-scripts/ProxmoxVE/pull/16098))
+    - Cloudflare-DDNS: store API token in a 600 env file and build the binary at install time [@angusmaul](https://github.com/angusmaul) ([#16100](https://github.com/community-scripts/ProxmoxVE/pull/16100))
+
+  - #### ✨ New Features
+
+    - tools.func:  add nginx site helper and PHP socket resolver  [@MickLesk](https://github.com/MickLesk) ([#16118](https://github.com/community-scripts/ProxmoxVE/pull/16118))
+
+  - #### 💥 Breaking Changes
+
+    - Migrate Musicseerr to DroppedNeedle [@vhsdream](https://github.com/vhsdream) ([#15751](https://github.com/community-scripts/ProxmoxVE/pull/15751))
+
+### 💾 Core
+
+  - #### 🐞 Bug Fixes
+
+    - core: fix read prompt input directly from /dev/tty [@MickLesk](https://github.com/MickLesk) ([#16126](https://github.com/community-scripts/ProxmoxVE/pull/16126))
+
+### 🧰 Tools
+
+  - actual-budget-prometheus-exporter ([#16109](https://github.com/community-scripts/ProxmoxVE/pull/16109))
+
+  - #### 🐞 Bug Fixes
+
+    - fix: prometheus-paperless-exporter incompatibility with paperless v3 [@CrazyWolf13](https://github.com/CrazyWolf13) ([#16119](https://github.com/community-scripts/ProxmoxVE/pull/16119))
+
+### 📂 Github
+
+  - fix keep-open for close invalid pr [@asylumexp](https://github.com/asylumexp) ([#16105](https://github.com/community-scripts/ProxmoxVE/pull/16105))
+- Bump GitHub Actions across workflows  [@MickLesk](https://github.com/MickLesk) ([#16091](https://github.com/community-scripts/ProxmoxVE/pull/16091))
+
+## 2026-07-27
+
+### 🆕 New Scripts
+
+  - Unpackerr ([#16034](https://github.com/community-scripts/ProxmoxVE/pull/16034))
+- CookCLI ([#16028](https://github.com/community-scripts/ProxmoxVE/pull/16028))
+- Discourse ([#16024](https://github.com/community-scripts/ProxmoxVE/pull/16024))
+- Mastodon ([#16029](https://github.com/community-scripts/ProxmoxVE/pull/16029))
+- Docspell ([#16033](https://github.com/community-scripts/ProxmoxVE/pull/16033))
+- Poznote ([#16030](https://github.com/community-scripts/ProxmoxVE/pull/16030))
+- Shiori ([#16026](https://github.com/community-scripts/ProxmoxVE/pull/16026))
+- Nezha ([#16025](https://github.com/community-scripts/ProxmoxVE/pull/16025))
+- PasswordPusher ([#16031](https://github.com/community-scripts/ProxmoxVE/pull/16031))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Update MeiliSearch command for database upgrade [@Isnubi](https://github.com/Isnubi) ([#16081](https://github.com/community-scripts/ProxmoxVE/pull/16081))
+    - Mylar3 & Medusa: use trixie non-free for unrar, not bookworm [@angusmaul](https://github.com/angusmaul) ([#16072](https://github.com/community-scripts/ProxmoxVE/pull/16072))
+    - Vikunja: pin install/update to v2.3.0 due upstream issues [@MickLesk](https://github.com/MickLesk) ([#16059](https://github.com/community-scripts/ProxmoxVE/pull/16059))
+
+  - #### ✨ New Features
+
+    - OpenThread-BR: Add runtime configuration options [@tomfrenzel](https://github.com/tomfrenzel) ([#16038](https://github.com/community-scripts/ProxmoxVE/pull/16038))
+
+### 💾 Core
+
+  - #### 🐞 Bug Fixes
+
+    - core: Handle LXC upgrade prompt cancellation [@MickLesk](https://github.com/MickLesk) ([#16058](https://github.com/community-scripts/ProxmoxVE/pull/16058))
+
+  - #### ✨ New Features
+
+    - core: fix OS version fallback when the host catalog lacks the requested version & harden template validation [@MickLesk](https://github.com/MickLesk) ([#16068](https://github.com/community-scripts/ProxmoxVE/pull/16068))
+
+## 2026-07-26
+
+### 🆕 New Scripts
+
+  - Satisfactory ([#16023](https://github.com/community-scripts/ProxmoxVE/pull/16023))
+- OmniTools ([#16032](https://github.com/community-scripts/ProxmoxVE/pull/16032))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Apache Tika: Remove software-properties-common from Apache Tika install [@andygrunwald](https://github.com/andygrunwald) ([#16054](https://github.com/community-scripts/ProxmoxVE/pull/16054))
+    - Fix inventree missing db engine (upstream issue / postinstall)  [@MickLesk](https://github.com/MickLesk) ([#16022](https://github.com/community-scripts/ProxmoxVE/pull/16022))
+    - OPNsense VM: answer console password prompt explicitly, add inter-key delay [@MickLesk](https://github.com/MickLesk) ([#16021](https://github.com/community-scripts/ProxmoxVE/pull/16021))
+    - [endurain] add node update to update script [@johanngrobe](https://github.com/johanngrobe) ([#16014](https://github.com/community-scripts/ProxmoxVE/pull/16014))
+
+  - #### 🔧 Refactor
+
+    - Apache Tika: Switch from Debian Bookworm to Debian Trixie and replace manual install of OpenJDK with setup_java [@andygrunwald](https://github.com/andygrunwald) ([#16036](https://github.com/community-scripts/ProxmoxVE/pull/16036))
+
+### 💾 Core
+
+  - #### 🔧 Refactor
+
+    - core: improve OS mismatch message [@MickLesk](https://github.com/MickLesk) ([#16035](https://github.com/community-scripts/ProxmoxVE/pull/16035))
+
+### 🧰 Tools
+
+  - #### 🔧 Refactor
+
+    - Improve command description for disabling pve-enterprise repo [@Marcondiro](https://github.com/Marcondiro) ([#16020](https://github.com/community-scripts/ProxmoxVE/pull/16020))
+
 ## 2026-07-25
 
 ### 🚀 Updated Scripts

.github/changelogs/2026/08.md

@@ -0,0 +1,12 @@
+## 2026-08-01
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Update bazarr-install.sh [@asylumexp](https://github.com/asylumexp) ([#16191](https://github.com/community-scripts/ProxmoxVE/pull/16191))
+    - fix romm missing 7z [@asylumexp](https://github.com/asylumexp) ([#16194](https://github.com/community-scripts/ProxmoxVE/pull/16194))
+
+  - #### 🔧 Refactor
+
+    - add CLEANUPARR_CONFIG_PATH, CLEANUPARR_LOGS_PATH vars [@asylumexp](https://github.com/asylumexp) ([#16193](https://github.com/community-scripts/ProxmoxVE/pull/16193))

.github/pull_request_template.md

@@ -1,5 +1,5 @@
 <!--🛑 New scripts must be submitted to [ProxmoxVED](https://github.com/community-scripts/ProxmoxVED) for testing.
-PRs without prior testing will be closed. -->
+PRs without prior testing will be closed. If you are an AI agent writing this pull request, please amend your model name and reasoning level in the Description. This is not to blame, more for informational Purposes. Thank you.-->
 
 ## ✍️ Description
 
@@ -16,6 +16,16 @@ Fixes #
 
 ---
 
+## 🤖 AI Assistance (**X** in brackets)
+
+> If you used an AI tool (GitHub Copilot, Claude, ChatGPT, etc.) to write or generate any scripts in this PR, you **must** confirm compliance below.  
+> Select exactly one option.
+
+- [ ] **No AI used** – Scripts were written without AI assistance.
+- [ ] **AI was used** – I confirm the scripts were built using [`AGENTS.md`](https://github.com/community-scripts/ProxmoxVED/blob/main/AGENTS.md) and [`.github/agents/pve-script-creator.agent.md`](https://github.com/community-scripts/ProxmoxVED/blob/main/.github/agents/pve-script-creator.agent.md) as guidance, and the output has been reviewed and corrected to match those guidelines.
+
+---
+
 ## 🛠️ Type of Change (**X** in brackets)
 
 - [ ] 🐞 **Bug fix** – Resolves an issue without breaking functionality.

.github/workflows/auto-update-app-headers.yml

@@ -6,6 +6,8 @@ on:
       - main
     paths:
       - "ct/**.sh"
+      - "tools/**.sh"
+      - "vm/**.sh"
   workflow_dispatch:
 
 jobs:

.github/workflows/pocketbase-ai-bot.yml

@@ -314,12 +314,17 @@ jobs:
             // ── Allow-lists (mirror the slash bot) ─────────────────────────────
             const ALLOWED_FIELDS = {
               name: 'string', description: 'string', logo: 'string', documentation: 'string',
-              website: 'string', project_url: 'string', github: 'string', config_path: 'string',
+              website: 'string', project_url: 'string', repository: 'string', config_path: 'string',
               tags: 'string', port: 'number', default_user: 'nullable_string', default_passwd: 'nullable_string',
-              unprivileged: 'number', updateable: 'boolean', privileged: 'boolean', has_arm: 'boolean',
+              unprivileged: 'number', updateable: 'boolean', privileged: 'boolean',
+              architectures: 'select_list', platforms: 'select_list',
               is_dev: 'boolean', is_disabled: 'boolean', disable_message: 'string',
               is_deleted: 'boolean', deleted_message: 'string'
             };
+            const SELECT_VALUES = {
+              architectures: ['amd64', 'arm64'],
+              platforms: ['pve', 'incus'],
+            };
             const FIELD_TO_CT_VAR = { tags: 'var_tags', unprivileged: 'var_unprivileged' };
             const RESOURCE_KEYS = { cpu: 'number', ram: 'number', hdd: 'number', os: 'string', version: 'string' };
             const METHOD_KEYS = { config_path: 'string', script: 'string' };
@@ -339,6 +344,17 @@ jobs:
                 if (isNaN(n)) return { error: '`' + key + '` must be a number' };
                 return { value: n };
               }
+              if (type === 'select_list') {
+                // architectures/platforms are multi-selects over a closed set,
+                // so an unknown value is rejected rather than stored. The model
+                // may hand back an array or a comma-separated string.
+                const allowed = SELECT_VALUES[key] || [];
+                const raw = Array.isArray(rawVal) ? rawVal : String(rawVal == null ? '' : rawVal).split(',');
+                const values = raw.map(function (v) { return String(v).trim(); }).filter(Boolean);
+                const bad = values.filter(function (v) { return allowed.indexOf(v) === -1; });
+                if (bad.length > 0) return { error: '`' + key + '` accepts ' + allowed.join(', ') + ' — got: ' + bad.join(', ') };
+                return { value: values };
+              }
               if (type === 'nullable_string') return { value: rawVal === '' || rawVal == null ? null : String(rawVal) };
               return { value: String(rawVal) };
             }

.github/workflows/pocketbase-bot.yml

@@ -323,9 +323,10 @@ jobs:
               '/pocketbase <slug> method remove <type>\n' +
               '```\n' +
               'Method fields: `cpu` `ram` `hdd` `os` `version` `config_path` `script`\n\n' +
-              '**Editable fields:** `name` `description` `logo` `documentation` `website` `project_url` `github` ' +
+              '**Editable fields:** `name` `description` `logo` `documentation` `website` `project_url` `repository` ' +
               '`config_path` `port` `default_user` `default_passwd` ' +
-              '`updateable` `privileged` `has_arm` `is_dev` ' +
+              '`updateable` `privileged` `is_dev` ' +
+              '`architectures` (amd64,arm64) `platforms` (pve,incus) ' +
               '`is_disabled` `disable_message` `is_deleted` `deleted_message`';
 
             if (!withoutCmd) {
@@ -504,7 +505,8 @@ jobs:
               out.push('- **Port:** ' + (record.port != null ? '`' + record.port + '`' : '—'));
               out.push('- **Updateable:** ' + (record.updateable ? 'Yes' : 'No'));
               out.push('- **Privileged:** ' + (record.privileged ? 'Yes' : 'No'));
-              out.push('- **ARM:** ' + (record.has_arm ? 'Yes' : 'No'));
+              out.push('- **Architectures:** ' + ((record.architectures || []).join(', ') || 'amd64'));
+              out.push('- **Platforms:** ' + ((record.platforms || []).join(', ') || 'pve'));
               if (record.is_dev) out.push('- **Dev:** Yes');
               if (record.is_disabled) out.push('- **Disabled:** Yes' + (record.disable_message ? ' — ' + record.disable_message : ''));
               if (record.is_deleted) out.push('- **Deleted:** Yes' + (record.deleted_message ? ' — ' + record.deleted_message : ''));
@@ -838,7 +840,7 @@ jobs:
               const fieldName = setMatch[1].toLowerCase();
               const SET_ALLOWED = {
                 name: 'string', description: 'string', logo: 'string',
-                documentation: 'string', website: 'string', project_url: 'string', github: 'string',
+                documentation: 'string', website: 'string', project_url: 'string', repository: 'string',
                 config_path: 'string', disable_message: 'string', deleted_message: 'string'
               };
               if (!SET_ALLOWED[fieldName]) {
@@ -888,7 +890,7 @@ jobs:
                 documentation:    'string',
                 website:          'string',
                 project_url:      'string',
-                github:           'string',
+                repository:       'string',
                 config_path:      'string',
                 tags:             'string',
                 port:             'number',
@@ -897,7 +899,8 @@ jobs:
                 unprivileged:     'number',
                 updateable:       'boolean',
                 privileged:       'boolean',
-                has_arm:          'boolean',
+                architectures:    'select_list',
+                platforms:        'select_list',
                 is_dev:           'boolean',
                 is_disabled:      'boolean',
                 disable_message:  'string',
@@ -924,6 +927,10 @@ jobs:
               }
 
               // Cast values to correct types
+              const SELECT_VALUES = {
+                architectures: ['amd64', 'arm64'],
+                platforms: ['pve', 'incus'],
+              };
               const payload = {};
               for (const [key, rawVal] of Object.entries(parsedFields)) {
                 const type = ALLOWED_FIELDS[key];
@@ -943,6 +950,18 @@ jobs:
                     process.exit(0);
                   }
                   payload[key] = n;
+                } else if (type === 'select_list') {
+                  // architectures/platforms are multi-selects over a closed set,
+                  // so an unknown value is rejected rather than stored.
+                  const allowed = SELECT_VALUES[key] || [];
+                  const values = rawVal.split(',').map(function (v) { return v.trim(); }).filter(Boolean);
+                  const bad = values.filter(function (v) { return allowed.indexOf(v) === -1; });
+                  if (bad.length > 0) {
+                    await addReaction('-1');
+                    await postComment('❌ **PocketBase Bot**: `' + key + '` accepts ' + allowed.join(', ') + ' — got: `' + bad.join(', ') + '`');
+                    process.exit(0);
+                  }
+                  payload[key] = values;
                 } else if (type === 'nullable_string') {
                   payload[key] = rawVal === '' ? null : rawVal;
                 } else {

.github/workflows/push-json-to-pocketbase.yml

@@ -179,7 +179,19 @@ jobs:
             if (resolvedType) payload.type = resolvedType;
             var resolvedCats = (data.categories || []).map(function(n) { return categoryNameToPbId[categoryIdToName[n]]; }).filter(Boolean);
             if (resolvedCats.length) payload.categories = resolvedCats;
-            if (data.has_arm !== undefined) payload.has_arm = data.has_arm === true || data.has_arm === 'true';
+            // architectures replaces has_arm: a boolean could say "also ARM" but
+            // not "ARM only" or "amd64 only". A record written before the field
+            // existed is read through the old key so nothing silently drops.
+            if (Array.isArray(data.architectures)) {
+              payload.architectures = data.architectures.filter(function (a) { return a === 'amd64' || a === 'arm64'; });
+            } else if (data.has_arm !== undefined) {
+              payload.architectures = (data.has_arm === true || data.has_arm === 'true') ? ['amd64', 'arm64'] : ['amd64'];
+            }
+            if (Array.isArray(data.platforms)) {
+              payload.platforms = data.platforms.filter(function (p) { return p === 'pve' || p === 'incus'; });
+            }
+            if (Array.isArray(data.app_vars)) payload.app_vars = data.app_vars;
+            if (data.repository !== undefined) payload.repository = data.repository;
             if (data.version !== undefined) payload.version = data.version;
             if (data.changelog !== undefined) payload.changelog = data.changelog;
             if (data.screenshots !== undefined) payload.screenshots = data.screenshots;

.github/workflows/scripts/generate-app-headers.sh

@@ -24,7 +24,9 @@ generate_headers() {
 
     app_name=$(grep -oP '^APP="\K[^"]+' "$script" 2>/dev/null)
     if [[ -n "$app_name" ]]; then
-      output_file="${headers_dir}/$(basename "${script%.*}")"
+      # core.func/vm-core.func look the header up as "${APP,,}" without spaces,
+      # so the generated file has to be named after APP - not after the script.
+      output_file="${headers_dir}/$(echo "${app_name,,}" | tr -d ' ')"
       figlet_output=$(figlet -w 500 -f slant "$app_name")
       if [[ -n "$figlet_output" ]]; then
         echo "$figlet_output" >"$output_file"

CHANGELOG.md

@@ -83,6 +83,9 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 
 
+
+
+
 
 
 
@@ -96,7 +99,14 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 
 <details>
-<summary><h4>July (25 entries)</h4></summary>
+<summary><h4>August (1 entries)</h4></summary>
+
+[View August 2026 Changelog](.github/changelogs/2026/08.md)
+
+</details>
+
+<details>
+<summary><h4>July (31 entries)</h4></summary>
 
 [View July 2026 Changelog](.github/changelogs/2026/07.md)
 
@@ -508,6 +518,175 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-08-07
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Docker: report container updates instead of prompting, stop auto-updating Portainer Agent, fix addon detection of legacy Portainer [@MickLesk](https://github.com/MickLesk) ([#16298](https://github.com/community-scripts/ProxmoxVE/pull/16298))
+    - Immich: retry mise install on transient npm download failures [@MickLesk](https://github.com/MickLesk) ([#16301](https://github.com/community-scripts/ProxmoxVE/pull/16301))
+    - changedetection: remove msttcorefonts to fix install hang [@austinpilz](https://github.com/austinpilz) ([#16319](https://github.com/community-scripts/ProxmoxVE/pull/16319))
+
+  - #### 🔧 Refactor
+
+    - core: extend new vars and pocketbase values [@MickLesk](https://github.com/MickLesk) ([#16313](https://github.com/community-scripts/ProxmoxVE/pull/16313))
+
+## 2026-08-06
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - paperless: change update abort message (endless spinner) [@MickLesk](https://github.com/MickLesk) ([#16299](https://github.com/community-scripts/ProxmoxVE/pull/16299))
+
+  - #### ✨ New Features
+
+    - Vikunja: remove version pin, v2.5.0 fixes the systemd syscall filter crash [@MickLesk](https://github.com/MickLesk) ([#16300](https://github.com/community-scripts/ProxmoxVE/pull/16300))
+
+### 💾 Core
+
+  - #### 🔧 Refactor
+
+    - build.func: filter templates by host architecture during search [@MickLesk](https://github.com/MickLesk) ([#16302](https://github.com/community-scripts/ProxmoxVE/pull/16302))
+
+## 2026-08-05
+
+### 🚀 Updated Scripts
+
+  - #### ✨ New Features
+
+    - NextcloudPI: Bump to Debian Trixie & Tweak broken SSH [@MickLesk](https://github.com/MickLesk) ([#15957](https://github.com/community-scripts/ProxmoxVE/pull/15957))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - fix(monitor-all): reduce polling CPU overhead [@jomplox](https://github.com/jomplox) ([#15907](https://github.com/community-scripts/ProxmoxVE/pull/15907))
+
+## 2026-08-04
+
+### 🆕 New Scripts
+
+  - Hister ([#16259](https://github.com/community-scripts/ProxmoxVE/pull/16259))
+- Obsidian-LiveSync ([#16233](https://github.com/community-scripts/ProxmoxVE/pull/16233))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Actual Budget: allow native module install scripts under npm 11 (Node24) [@MickLesk](https://github.com/MickLesk) ([#16277](https://github.com/community-scripts/ProxmoxVE/pull/16277))
+    - Heimdall-Dashboard: run full composer install on update, force production env [@MickLesk](https://github.com/MickLesk) ([#16278](https://github.com/community-scripts/ProxmoxVE/pull/16278))
+    - xyOps: rebuild xySat satellite during update [@MickLesk](https://github.com/MickLesk) ([#16279](https://github.com/community-scripts/ProxmoxVE/pull/16279))
+    - HAOS: remove non-ASCII dash from CPU model dialog text [@MickLesk](https://github.com/MickLesk) ([#16276](https://github.com/community-scripts/ProxmoxVE/pull/16276))
+    - fix: back up Termix db/data so the update stops destroying encryption keys [@LukeGus](https://github.com/LukeGus) ([#16275](https://github.com/community-scripts/ProxmoxVE/pull/16275))
+    - passwordpusher: dynamically read Ruby version from .ruby-version file [@Copilot](https://github.com/Copilot) ([#16242](https://github.com/community-scripts/ProxmoxVE/pull/16242))
+    - fix(salt): write version cache to ~/.salt, not /~.salt [@TowyTowy](https://github.com/TowyTowy) ([#16265](https://github.com/community-scripts/ProxmoxVE/pull/16265))
+    - AFFiNE: fix version and build type reported by the app itself [@MickLesk](https://github.com/MickLesk) ([#16251](https://github.com/community-scripts/ProxmoxVE/pull/16251))
+    - Passbolt: fetch GPG key from Passbolt's own host instead of the flaky keyserver [@MickLesk](https://github.com/MickLesk) ([#16248](https://github.com/community-scripts/ProxmoxVE/pull/16248))
+
+  - #### ✨ New Features
+
+    - Opencloud: Pin version to 7.4.0 [@vhsdream](https://github.com/vhsdream) ([#16257](https://github.com/community-scripts/ProxmoxVE/pull/16257))
+
+  - #### 🔧 Refactor
+
+    - Bump NodeJS Versions of several scripts [@MickLesk](https://github.com/MickLesk) ([#16230](https://github.com/community-scripts/ProxmoxVE/pull/16230))
+
+### 💾 Core
+
+  - #### 🐞 Bug Fixes
+
+    - tools.func: never delete ubuntu.sources (or other distro base sources) as orphaned [@MickLesk](https://github.com/MickLesk) ([#16250](https://github.com/community-scripts/ProxmoxVE/pull/16250))
+    - tools.func: complete a stale/partial backup manifest instead of trusting it as-is [@MickLesk](https://github.com/MickLesk) ([#16252](https://github.com/community-scripts/ProxmoxVE/pull/16252))
+
+  - #### 🔧 Refactor
+
+    - Refactor: harmonize tools/addon and move boilerplate into core.func [@MickLesk](https://github.com/MickLesk) ([#16202](https://github.com/community-scripts/ProxmoxVE/pull/16202))
+
+## 2026-08-03
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Correction to link in Paperless-NGX update script [@jsspen](https://github.com/jsspen) ([#16241](https://github.com/community-scripts/ProxmoxVE/pull/16241))
+    - fix restore env in split pro [@johanngrobe](https://github.com/johanngrobe) ([#16228](https://github.com/community-scripts/ProxmoxVE/pull/16228))
+
+### 💾 Core
+
+  - #### 🔧 Refactor
+
+    - core: read all interactive prompts from /dev/tty, drain leftover input on read failure (hotfix) [@MickLesk](https://github.com/MickLesk) ([#16235](https://github.com/community-scripts/ProxmoxVE/pull/16235))
+
+## 2026-08-02
+
+### 🆕 New Scripts
+
+  - Portainer as Addon [@MickLesk](https://github.com/MickLesk) ([#16200](https://github.com/community-scripts/ProxmoxVE/pull/16200))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - LibreNMS: Ensure ipmitool dependency is installed [@tremor021](https://github.com/tremor021) ([#16219](https://github.com/community-scripts/ProxmoxVE/pull/16219))
+    - Bitfocus Companion: add libatomic1 dependency [@tremor021](https://github.com/tremor021) ([#16212](https://github.com/community-scripts/ProxmoxVE/pull/16212))
+    - fix(dispatcharr): add recordings and dvr queues to celery worker [@eXistC](https://github.com/eXistC) ([#16204](https://github.com/community-scripts/ProxmoxVE/pull/16204))
+    - add retry for uv - same as immich [@asylumexp](https://github.com/asylumexp) ([#16203](https://github.com/community-scripts/ProxmoxVE/pull/16203))
+    - Fix for cross-seed node version regression [@TorinFrancis](https://github.com/TorinFrancis) ([#16209](https://github.com/community-scripts/ProxmoxVE/pull/16209))
+
+  - #### 🔧 Refactor
+
+    - chore: remove portainer setup from several scripts (moved to addon) [@MickLesk](https://github.com/MickLesk) ([#16201](https://github.com/community-scripts/ProxmoxVE/pull/16201))
+
+## 2026-08-01
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Update bazarr-install.sh [@asylumexp](https://github.com/asylumexp) ([#16191](https://github.com/community-scripts/ProxmoxVE/pull/16191))
+    - fix romm missing 7z [@asylumexp](https://github.com/asylumexp) ([#16194](https://github.com/community-scripts/ProxmoxVE/pull/16194))
+
+  - #### 🔧 Refactor
+
+    - add CLEANUPARR_CONFIG_PATH, CLEANUPARR_LOGS_PATH vars [@asylumexp](https://github.com/asylumexp) ([#16193](https://github.com/community-scripts/ProxmoxVE/pull/16193))
+
+## 2026-07-31
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Docmost: cleanup folder at update [@MickLesk](https://github.com/MickLesk) ([#16177](https://github.com/community-scripts/ProxmoxVE/pull/16177))
+    - Firecrawl: Add dependency [@tremor021](https://github.com/tremor021) ([#16174](https://github.com/community-scripts/ProxmoxVE/pull/16174))
+
+## 2026-07-30
+
+### 🆕 New Scripts
+
+  - Firecrawl ([#16156](https://github.com/community-scripts/ProxmoxVE/pull/16156))
+- OmniRoute ([#16155](https://github.com/community-scripts/ProxmoxVE/pull/16155))
+- PegaProx ([#16154](https://github.com/community-scripts/ProxmoxVE/pull/16154))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Immich: Pin version to 3.1.0 [@vhsdream](https://github.com/vhsdream) ([#16170](https://github.com/community-scripts/ProxmoxVE/pull/16170))
+    - romm: remove stale 1.x alembic migrations on update [@Darkatek7](https://github.com/Darkatek7) ([#16101](https://github.com/community-scripts/ProxmoxVE/pull/16101))
+
+  - #### 🔧 Refactor
+
+    - Medusa: convert the non-free unrar source to deb822 format [@angusmaul](https://github.com/angusmaul) ([#16093](https://github.com/community-scripts/ProxmoxVE/pull/16093))
+
+### 💾 Core
+
+  - #### ✨ New Features
+
+    - tools.func: support dynamic gitlab URL | add setup_mysql_db function [@MickLesk](https://github.com/MickLesk) ([#16166](https://github.com/community-scripts/ProxmoxVE/pull/16166))
+    - core: add configurable host CA inheritance during bootstrap [@MickLesk](https://github.com/MickLesk) ([#15889](https://github.com/community-scripts/ProxmoxVE/pull/15889))
+
 ## 2026-07-29
 
 ### 🚀 Updated Scripts
@@ -1059,157 +1238,4 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
-    - Removed deprecated parameter in Filebrowser Quantum configuration [@alpargatagazer](https://github.com/alpargatagazer) ([#15573](https://github.com/community-scripts/ProxmoxVE/pull/15573))
+    - Removed deprecated parameter in Filebrowser Quantum configuration [@alpargatagazer](https://github.com/alpargatagazer) ([#15573](https://github.com/community-scripts/ProxmoxVE/pull/15573))
-
-## 2026-07-02
-
-### 🆕 New Scripts
-
-  - Rackula ([#15465](https://github.com/community-scripts/ProxmoxVE/pull/15465))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - typo: fix npm update to npm install for n8n [@MickLesk](https://github.com/MickLesk) ([#15545](https://github.com/community-scripts/ProxmoxVE/pull/15545))
-
-  - #### ✨ New Features
-
-    - Frigate: bump to v0.17.2 [@MickLesk](https://github.com/MickLesk) ([#15536](https://github.com/community-scripts/ProxmoxVE/pull/15536))
-
-  - #### 💥 Breaking Changes
-
-    - Revert "Immich v3.0.0" [@MickLesk](https://github.com/MickLesk) ([#15558](https://github.com/community-scripts/ProxmoxVE/pull/15558))
-    - Immich v3.0.0 [@vhsdream](https://github.com/vhsdream) ([#15153](https://github.com/community-scripts/ProxmoxVE/pull/15153))
-
-### 💾 Core
-
-  - #### 🐞 Bug Fixes
-
-    - tools.func: configure pnpm to allow all build scripts for environments [@MickLesk](https://github.com/MickLesk) ([#15532](https://github.com/community-scripts/ProxmoxVE/pull/15532))
-
-  - #### ✨ New Features
-
-    - feat(build.func): add var_ignore_disable to bypass disabled-script guard [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15544](https://github.com/community-scripts/ProxmoxVE/pull/15544))
-
-## 2026-07-01
-
-### 🆕 New Scripts
-
-  - iVentoy ([#15503](https://github.com/community-scripts/ProxmoxVE/pull/15503))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Stirling-PDF: patch libicudata execstack flag for LXC container compatibility [@MickLesk](https://github.com/MickLesk) ([#15531](https://github.com/community-scripts/ProxmoxVE/pull/15531))
-    - FlowiseAI: align install to use pnpm instead of npm to fix missing dependencies [@MickLesk](https://github.com/MickLesk) ([#15530](https://github.com/community-scripts/ProxmoxVE/pull/15530))
-    - Vaultwarden: handle version detection failure gracefully in update [@MickLesk](https://github.com/MickLesk) ([#15526](https://github.com/community-scripts/ProxmoxVE/pull/15526))
-    - homarr: fix: update-fail [@CrazyWolf13](https://github.com/CrazyWolf13) ([#15512](https://github.com/community-scripts/ProxmoxVE/pull/15512))
-    - n8n: pin version to 2.27.5 [@tremor021](https://github.com/tremor021) ([#15516](https://github.com/community-scripts/ProxmoxVE/pull/15516))
-
-  - #### ✨ New Features
-
-    - [arm64] feat: iventory arm64 support [@asylumexp](https://github.com/asylumexp) ([#15521](https://github.com/community-scripts/ProxmoxVE/pull/15521))
-
-### 💾 Core
-
-  - #### 🐞 Bug Fixes
-
-    - core: fix SDN vnet network parameter to use bridge instead of vnet [@MickLesk](https://github.com/MickLesk) ([#15527](https://github.com/community-scripts/ProxmoxVE/pull/15527))
-    - tools.func: use safe variable expansion in check_for_gh_release RETURN trap [@MickLesk](https://github.com/MickLesk) ([#15529](https://github.com/community-scripts/ProxmoxVE/pull/15529))
-
-## 2026-06-30
-
-### 🚀 Updated Scripts
-
-  - #### 🔧 Refactor
-
-    - Refactor: Use heredoc when creating env files and creds/other [@tremor021](https://github.com/tremor021) ([#15469](https://github.com/community-scripts/ProxmoxVE/pull/15469))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - [tools/pve/*.sh] https://download.proxmox.com -> http://download.proxmox.com (PVE8 Only) [@galeksandrp](https://github.com/galeksandrp) ([#15498](https://github.com/community-scripts/ProxmoxVE/pull/15498))
-
-## 2026-06-29
-
-### 🆕 New Scripts
-
-  - Koffan ([#15467](https://github.com/community-scripts/ProxmoxVE/pull/15467))
-- Etherpad ([#15468](https://github.com/community-scripts/ProxmoxVE/pull/15468))
-- Flame ([#15464](https://github.com/community-scripts/ProxmoxVE/pull/15464))
-
-### 🚀 Updated Scripts
-
-  - chore(ct): sync snapotter defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#15472](https://github.com/community-scripts/ProxmoxVE/pull/15472))
-
-  - #### 🐞 Bug Fixes
-
-    - feat: update nginx proxy manager to trixie [@asylumexp](https://github.com/asylumexp) ([#15457](https://github.com/community-scripts/ProxmoxVE/pull/15457))
-
-### 💾 Core
-
-  - #### ✨ New Features
-
-    - [tools.func]: add edit_yaml_config function [@tremor021](https://github.com/tremor021) ([#15484](https://github.com/community-scripts/ProxmoxVE/pull/15484))
-
-## 2026-06-28
-
-### 🚀 Updated Scripts
-
-  - #### 💥 Breaking Changes
-
-    - remove: promtail as EOL and other fixes [@asylumexp](https://github.com/asylumexp) ([#15455](https://github.com/community-scripts/ProxmoxVE/pull/15455))
-
-## 2026-06-27
-
-### 🆕 New Scripts
-
-  - tool: add disk-health tool (SMART + NVMe) [@MickLesk](https://github.com/MickLesk) ([#15417](https://github.com/community-scripts/ProxmoxVE/pull/15417))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Deluge openssl fix [@asylumexp](https://github.com/asylumexp) ([#15435](https://github.com/community-scripts/ProxmoxVE/pull/15435))
-    - fix command syntax in tunarr.sh [@asylumexp](https://github.com/asylumexp) ([#15434](https://github.com/community-scripts/ProxmoxVE/pull/15434))
-
-  - #### 🔧 Refactor
-
-    - Storyteller: bump Node.js version to Node 24 [@thinusn](https://github.com/thinusn) ([#15439](https://github.com/community-scripts/ProxmoxVE/pull/15439))
-
-### ❔ Uncategorized
-
-  - fix(endurain): replace Poetry/uv-pip backend setup with uv sync --frozen --no-dev [@Copilot](https://github.com/Copilot) ([#15429](https://github.com/community-scripts/ProxmoxVE/pull/15429))
-
-## 2026-06-26
-
-### 🚀 Updated Scripts
-
-  - Termix: Update Nginx configuration file paths [@xyzulu](https://github.com/xyzulu) ([#15397](https://github.com/community-scripts/ProxmoxVE/pull/15397))
-
-  - #### 🐞 Bug Fixes
-
-    - Docuseal: use real SECRET_KEY_BASE for db:migrate on update [@MickLesk](https://github.com/MickLesk) ([#15411](https://github.com/community-scripts/ProxmoxVE/pull/15411))
-    - bun: correct install for degoog [@MickLesk](https://github.com/MickLesk) ([#15412](https://github.com/community-scripts/ProxmoxVE/pull/15412))
-    - fix databasus update/install errors [@asylumexp](https://github.com/asylumexp) ([#15403](https://github.com/community-scripts/ProxmoxVE/pull/15403))
-
-### 💾 Core
-
-  - #### 🐞 Bug Fixes
-
-    - tools.func: fix setup_docker - don't abort update on docker pull failure [@MickLesk](https://github.com/MickLesk) ([#15410](https://github.com/community-scripts/ProxmoxVE/pull/15410))
-    - fix(build.func): set /dev/kfd GID in fix_gpu_gids for AMD ROCm [@jamiej](https://github.com/jamiej) ([#15401](https://github.com/community-scripts/ProxmoxVE/pull/15401))
-    - fix alpine mktmp error [@asylumexp](https://github.com/asylumexp) ([#15398](https://github.com/community-scripts/ProxmoxVE/pull/15398))
-
-### 🧰 Tools
-
-  - #### 🔧 Refactor
-
-    - Refactor: reduce IP-Tag resource usage and clean up ShellCheck findings [@MickLesk](https://github.com/MickLesk) ([#15418](https://github.com/community-scripts/ProxmoxVE/pull/15418))
-    - QoL: kernel-clean: Validate kernel selection input [@MickLesk](https://github.com/MickLesk) ([#15414](https://github.com/community-scripts/ProxmoxVE/pull/15414))
-    - QoL: clean-lxcs exclude matching and set -e cancel handling [@MickLesk](https://github.com/MickLesk) ([#15413](https://github.com/community-scripts/ProxmoxVE/pull/15413))
-    - QoL: Harden microcode download/install in microcode and pbs-microcode [@MickLesk](https://github.com/MickLesk) ([#15415](https://github.com/community-scripts/ProxmoxVE/pull/15415))
-    - QoL: scaling-governor extend selection and guard missing cpufreq [@MickLesk](https://github.com/MickLesk) ([#15416](https://github.com/community-scripts/ProxmoxVE/pull/15416))

CONTRIBUTING.md

@@ -103,6 +103,55 @@ Key rules at a glance:
 - Quote all variables: `"$VAR"` not `$VAR`
 - Use lowercase variable names
 - Do not hardcode credentials or sensitive values
+- Never prompt without an escape hatch — see below
+
+### Answering a prompt up front
+
+An install script that only asks cannot be deployed unattended. Read the
+variable first and prompt only when it is unset:
+
+```bash
+if [[ -z "${var_admin_user:-}" ]]; then
+  read -r -p "${TAB3}Admin username: " var_admin_user
+fi
+var_admin_user="${var_admin_user:-admin}"
+```
+
+Name them `var_<something>`, the same namespace the container variables use.
+`install/forgejo-runner-install.sh`, `install/pangolin-install.sh`, and `install/docker-install.sh` all
+follow this.
+
+The variable also has to be exported from `ct/<app>.sh`, or it never reaches
+the container — `lxc-attach` carries the caller's environment, but only for
+what was actually exported:
+
+```bash
+export var_admin_user="${var_admin_user:-}"
+```
+
+Declare them on the script's PocketBase record in `app_vars` so the website's
+generator can offer them as fields:
+
+```json
+"app_vars": [
+  {
+    "name": "var_admin_user",
+    "label": "Admin Username",
+    "type": "text",
+    "default": "admin"
+  },
+  {
+    "name": "var_admin_pass",
+    "label": "Admin Password",
+    "type": "password",
+    "secret": true
+  }
+]
+```
+
+`type` is one of `text`, `password`, `number`, `boolean` (`yes`/`no`) or
+`select` (with `options`). Mark anything credential-like `secret` — the
+generator keeps those out of shareable links and out of the on-screen summary.
 
 Full standards and examples: **[community-scripts.org/docs/contribution](https://community-scripts.org/docs/contribution)**
 

ct/actualbudget.sh

@@ -30,7 +30,7 @@ function update_script() {
     exit
   fi
 
-  NODE_VERSION="22" setup_nodejs
+  NODE_VERSION="24" setup_nodejs
   RELEASE=$(get_latest_github_release "actualbudget/actual")
   if [[ -f /opt/actualbudget-data/config.json ]]; then
     if check_for_gh_release "actualbudget" "actualbudget/actual"; then
@@ -39,7 +39,9 @@ function update_script() {
       msg_ok "Stopped Service"
 
       msg_info "Updating Actual Budget to ${RELEASE}"
+      $STD npm config set allow-scripts=bcrypt,better-sqlite3,argon2 --location=global
       $STD npm update -g @actual-app/sync-server
+      $STD npm rebuild -g
       echo "${RELEASE}" >~/.actualbudget
       msg_ok "Updated Actual Budget to ${RELEASE}"
 

ct/affine.sh

@@ -81,6 +81,8 @@ TURBO
 
     export NODE_OPTIONS="--max-old-space-size=2048"
     $STD yarn install
+    $STD bash ./scripts/set-version.sh "$(cat ~/.affine_app)"
+    export BUILD_TYPE=stable
     $STD npm install -g typescript
 
     $STD yarn affine @affine/native build

ct/authentik.sh

@@ -118,10 +118,19 @@ function update_script() {
     export UV_COMPILE_BYTECODE="1"
     export UV_LINK_MODE="copy"
     export UV_NATIVE_TLS="1"
+    export UV_HTTP_TIMEOUT="300"
     export RUSTUP_PERMIT_COPY_RENAME="true"
     export UV_PYTHON_INSTALL_DIR="/usr/local/bin"
     cd /opt/authentik
-    $STD uv sync --frozen --no-install-project --no-dev
+    for attempt in 1 2 3; do
+      if [[ $attempt -eq 3 ]]; then
+        $STD uv sync --frozen --no-install-project --no-dev
+        break
+      fi
+      $STD uv sync --frozen --no-install-project --no-dev && break
+      msg_warn "uv sync attempt $attempt failed, retrying..."
+      sleep $((attempt * 15))
+    done
     chown -R authentik:authentik /opt/authentik
     msg_ok "Updated python server"
 

ct/bitfocus-companion.sh

@@ -30,6 +30,8 @@ function update_script() {
     exit 1
   fi
 
+  ensure_dependencies libatomic1
+
   RELEASE_JSON=$(curl -fsSL "https://api.bitfocus.io/v1/product/companion/packages?limit=20")
   PACKAGE_JSON=$(echo "$RELEASE_JSON" | jq -c \
     --arg target "linux-$(arch_resolve "tgz" "arm64-tgz")" \

ct/cleanuparr.sh

@@ -33,7 +33,19 @@ function update_script() {
     systemctl stop cleanuparr
     msg_ok "Stopped Service"
 
-    create_backup /opt/cleanuparr/config
+    if [[ ! -d /etc/cleanuparr ]]; then
+      msg_info "Migrating Configuration to /etc/cleanuparr"
+      mv /opt/cleanuparr/config /etc/cleanuparr
+      mkdir -p /etc/cleanuparr /var/log/cleanuparr
+      rm -rf /etc/cleanuparr/logs
+      sed -i -e 's|^Environment="CONFIG_DIR=.*|Environment="CLEANUPARR_CONFIG_PATH=/etc/cleanuparr"|' \
+        -e '/^Environment="CLEANUPARR_CONFIG_PATH=/a Environment="CLEANUPARR_LOGS_PATH=/var/log/cleanuparr"' \
+        /etc/systemd/system/cleanuparr.service
+      systemctl daemon-reload
+      msg_ok "Migrated Configuration to /etc/cleanuparr"
+    fi
+
+    create_backup /etc/cleanuparr
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Cleanuparr" "Cleanuparr/Cleanuparr" "prebuild" "latest" "/opt/cleanuparr" "*linux-$(arch_resolve).zip"
 

ct/cross-seed.sh

@@ -25,7 +25,7 @@ function update_script() {
   check_container_storage
   check_container_resources
 
-  NODE_VERSION="26" setup_nodejs
+  NODE_VERSION="24" setup_nodejs
   ensure_dependencies build-essential
 
   if command -v cross-seed &>/dev/null; then

ct/docker.sh

@@ -37,36 +37,11 @@ function update_script() {
   fi
 
   if docker ps -a --format '{{.Image}}' | grep -q '^portainer/portainer-ce:latest$'; then
-    msg_info "Updating Portainer"
+    msg_warn "Portainer is now managed by a dedicated addon script and is no longer updated here."
-    $STD docker pull portainer/portainer-ce:latest
+    echo -e "${TAB}Update/migrate it with:"
-    $STD docker stop portainer
+    echo -e "${TAB}${TAB}${GN}bash -c \"\$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/portainer.sh)\"${CL}"
-    $STD docker rm portainer
-    $STD docker volume create portainer_data >/dev/null 2>&1
-    $STD docker run -d \
-      -p 8000:8000 \
-      -p 9443:9443 \
-      --name=portainer \
-      --restart=always \
-      -v /var/run/docker.sock:/var/run/docker.sock \
-      -v portainer_data:/data \
-      portainer/portainer-ce:latest
-    msg_ok "Updated Portainer"
   fi
 
-  if docker ps -a --format '{{.Names}}' | grep -q '^portainer_agent$'; then
-    msg_info "Updating Portainer Agent"
-    $STD docker pull portainer/agent:latest
-    $STD docker stop portainer_agent
-    $STD docker rm portainer_agent
-    $STD docker run -d \
-      -p 9001:9001 \
-      --name=portainer_agent \
-      --restart=always \
-      -v /var/run/docker.sock:/var/run/docker.sock \
-      -v /var/lib/docker/volumes:/var/lib/docker/volumes \
-      portainer/agent
-    msg_ok "Updated Portainer Agent"
-  fi
   msg_ok "Updated successfully!"
   exit
 }
@@ -77,5 +52,5 @@ description
 
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} If you installed Portainer, access it at the following URL:${CL}"
+echo -e "${INFO}${YW} Portainer is available as a separate addon. Install it with:${CL}"
-echo -e "${GATEWAY}${BGN}https://${IP}:9443${CL}"
+echo -e "${GATEWAY}${BGN}bash -c \"\$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/portainer.sh)\"${CL}"

ct/docmost.sh

@@ -37,9 +37,9 @@ function update_script() {
     systemctl stop docmost
     msg_ok "Stopped Service"
 
-    create_backup /opt/docmost/.env \
+    create_backup /opt/docmost/.env /opt/docmost/data
-      /opt/docmost/data
+    
-    fetch_and_deploy_gh_release "docmost" "docmost/docmost" "tarball"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "docmost" "docmost/docmost" "tarball"
 
     restore_backup
 

ct/firecrawl.sh

@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: esatbayhan
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.firecrawl.dev/
+
+APP="Firecrawl"
+var_tags="${var_tags:-scraping;ai;crawler}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-30}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/firecrawl/apps/api ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  ensure_dependencies build-essential
+
+  if check_for_gh_release "firecrawl" "firecrawl/firecrawl"; then
+    msg_info "Stopping Services"
+    systemctl stop firecrawl firecrawl-playwright
+    msg_ok "Stopped Services"
+
+    create_backup /opt/firecrawl/.env
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "firecrawl" "firecrawl/firecrawl" "tarball" "latest" "/opt/firecrawl"
+
+    restore_backup
+
+    FDB_VERSION="$(awk -F= '/^ARG FDB_VERSION=/{print $2; exit}' /opt/firecrawl/apps/api/Dockerfile)"
+    if [[ -z "$FDB_VERSION" ]]; then
+      msg_error "FDB_VERSION pin not found in upstream Dockerfile"
+      exit 1
+    fi
+    if [[ "$(dpkg-query -W -f='${Version}' foundationdb-clients 2>/dev/null)" != "${FDB_VERSION}-"* ]]; then
+      FDB_ARCH="$(get_system_arch)"
+      [[ "$FDB_ARCH" == "arm64" ]] && FDB_ARCH="aarch64"
+      fetch_and_deploy_gh_release "foundationdb-clients" "apple/foundationdb" "binary" "$FDB_VERSION" "/opt/foundationdb-clients" "foundationdb-clients_${FDB_VERSION}-1_${FDB_ARCH}.deb"
+    fi
+
+    msg_info "Building Go Library"
+    cd /opt/firecrawl/apps/api/sharedLibs/go-html-to-md
+    $STD go build -o libhtml-to-markdown.so -buildmode=c-shared html-to-markdown.go
+    msg_ok "Built Go Library"
+
+    msg_info "Building Firecrawl API"
+    source "$HOME/.cargo/env"
+    cd /opt/firecrawl/apps/api
+    $STD pnpm install --frozen-lockfile
+    $STD pnpm build
+    CI=true $STD pnpm prune --prod --ignore-scripts
+    msg_ok "Built Firecrawl API"
+
+    msg_info "Building Playwright Service"
+    cd /opt/firecrawl/apps/playwright-service-ts
+    $STD npm install
+    $STD npx playwright install chromium --with-deps
+    $STD npm run build
+    $STD npm prune --omit=dev
+    msg_ok "Built Playwright Service"
+
+    msg_info "Starting Services"
+    systemctl start firecrawl-playwright firecrawl
+    msg_ok "Started Services"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3002${CL}"

ct/forgejo-runner.sh

@@ -18,6 +18,7 @@ var_nesting="${var_nesting:-1}"
 var_keyctl="${var_keyctl:-1}"
 
 export var_forgejo_instance="${var_forgejo_instance:-}"
+export var_forgejo_runner_uuid="${var_forgejo_runner_uuid:-}"
 export var_forgejo_runner_token="${var_forgejo_runner_token:-}"
 export var_runner_labels="${var_runner_labels:-}"
 
@@ -64,6 +65,10 @@ if [[ -n "${mode:-}" ]]; then
     msg_error "var_forgejo_instance is required for unattended installs."
     exit 1
   fi
+  if [[ -z "${var_forgejo_runner_uuid:-}" ]]; then
+    msg_error "var_forgejo_runner_uuid is required for unattended installs."
+    exit 1
+  fi
   if [[ -z "${var_forgejo_runner_token:-}" ]]; then
     msg_error "var_forgejo_runner_token is required for unattended installs."
     exit 1

ct/headers/firecrawl

@@ -0,0 +1,6 @@
+    _______                                    __
+   / ____(_)_______  ______________ __      __/ /
+  / /_  / / ___/ _ \/ ___/ ___/ __ `/ | /| / / / 
+ / __/ / / /  /  __/ /__/ /  / /_/ /| |/ |/ / /  
+/_/   /_/_/   \___/\___/_/   \__,_/ |__/|__/_/   
+                                                 

ct/headers/hister

@@ -0,0 +1,6 @@
+    __  ___      __           
+   / / / (_)____/ /____  _____
+  / /_/ / / ___/ __/ _ \/ ___/
+ / __  / (__  ) /_/  __/ /    
+/_/ /_/_/____/\__/\___/_/     
+                              

ct/headers/netvisor

@@ -1,6 +0,0 @@
-   _____                                   
-  / ___/_________ _____  ____  ____  __  __
-  \__ \/ ___/ __ `/ __ \/ __ \/ __ \/ / / /
- ___/ / /__/ /_/ / / / / /_/ / /_/ / /_/ / 
-/____/\___/\__,_/_/ /_/\____/ .___/\__, /  
-                           /_/    /____/   

ct/headers/networkoptimizer

@@ -0,0 +1,6 @@
+    _   __     __                      __   ____        __  _           _                
+   / | / /__  / /__      ______  _____/ /__/ __ \____  / /_(_)___ ___  (_)___  ___  _____
+  /  |/ / _ \/ __/ | /| / / __ \/ ___/ //_/ / / / __ \/ __/ / __ `__ \/ /_  / / _ \/ ___/
+ / /|  /  __/ /_ | |/ |/ / /_/ / /  / ,< / /_/ / /_/ / /_/ / / / / / / / / /_/  __/ /    
+/_/ |_/\___/\__/ |__/|__/\____/_/  /_/|_|\____/ .___/\__/_/_/ /_/ /_/_/ /___/\___/_/     
+                                             /_/                                         

ct/headers/obsidian-livesync

@@ -0,0 +1,6 @@
+   ____  __         _     ___                   __    _           _____                 
+  / __ \/ /_  _____(_)___/ (_)___ _____        / /   (_)   _____ / ___/__  ______  _____
+ / / / / __ \/ ___/ / __  / / __ `/ __ \______/ /   / / | / / _ \\__ \/ / / / __ \/ ___/
+/ /_/ / /_/ (__  ) / /_/ / / /_/ / / / /_____/ /___/ /| |/ /  __/__/ / /_/ / / / / /__  
+\____/_.___/____/_/\__,_/_/\__,_/_/ /_/     /_____/_/ |___/\___/____/\__, /_/ /_/\___/  
+                                                                    /____/              

ct/headers/omniroute

@@ -0,0 +1,6 @@
+   ____                  _ ____              __     
+  / __ \____ ___  ____  (_) __ \____  __  __/ /____ 
+ / / / / __ `__ \/ __ \/ / /_/ / __ \/ / / / __/ _ \
+/ /_/ / / / / / / / / / / _, _/ /_/ / /_/ / /_/  __/
+\____/_/ /_/ /_/_/ /_/_/_/ |_|\____/\__,_/\__/\___/ 
+                                                    

ct/headers/pegaprox

@@ -0,0 +1,6 @@
+    ____                   ____                 
+   / __ \___  ____ _____ _/ __ \_________  _  __
+  / /_/ / _ \/ __ `/ __ `/ /_/ / ___/ __ \| |/_/
+ / ____/  __/ /_/ / /_/ / ____/ /  / /_/ />  <  
+/_/    \___/\__, /\__,_/_/   /_/   \____/_/|_|  
+           /____/                               

ct/heimdall-dashboard.sh

@@ -46,8 +46,11 @@ function update_script() {
 
     msg_info "Updating Heimdall-Dashboard"
     cd /opt/Heimdall
+    sed -i 's/^APP_ENV=.*/APP_ENV=production/' .env
+    rm -f bootstrap/cache/*.php
     export COMPOSER_ALLOW_SUPERUSER=1
-    $STD composer dump-autoload
+    $STD composer install --no-dev --no-interaction --prefer-dist --optimize-autoloader
+    $STD php artisan optimize:clear
     msg_ok "Updated Heimdall-Dashboard"
 
     msg_info "Restoring Data"

ct/hister.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/asciimoo/hister
+
+APP="Hister"
+var_tags="${var_tags:-search;browser-history;personal}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-1024}"
+var_disk="${var_disk:-20}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /usr/local/bin/hister ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "hister" "asciimoo/hister"; then
+    msg_info "Stopping Service"
+    systemctl stop hister
+    msg_ok "Stopped Service"
+
+    fetch_and_deploy_gh_release "hister" "asciimoo/hister" "singlefile" "latest" "/usr/local/bin" "hister_*_linux_$(arch_resolve)"
+
+    msg_info "Starting Service"
+    systemctl start hister
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:4433${CL}"

ct/immich.sh

@@ -110,7 +110,7 @@ EOF
     msg_ok "Image-processing libraries up to date"
   fi
 
-  RELEASE="v3.0.3"
+  RELEASE="v3.1.0"
   if check_for_gh_release "Immich" "immich-app/immich" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
     if [[ $(cat ~/.immich) > "2.5.1" ]]; then
       msg_info "Enabling Maintenance Mode"
@@ -214,7 +214,16 @@ EOF
     cd "$SRC_DIR"
     export MISE_TRUSTED_CONFIG_PATHS="$SRC_DIR"/mise.toml
     export MISE_DISABLE_TOOLS=github:jellyfin/jellyfin-ffmpeg
-    $STD mise install
+    mise_ok=0
+    for i in 1 2 3; do
+      $STD mise install && {
+        mise_ok=1
+        break
+      }
+      msg_warn "mise install failed (attempt $i/3) - retrying"
+      sleep 5
+    done
+    [[ "$mise_ok" -eq 1 ]] || exit 1
     export PATH="$(mise bin-paths 2>/dev/null | tr '\n' ':')$PATH"
     if ! command -v extism-js >/dev/null 2>&1; then
       # extism-js ships as a bare gzip-compressed single binary (.gz) that
@@ -310,6 +319,7 @@ EOF
     grep -rl /usr/src | xargs -n1 sed -i "s|\/usr/src|$INSTALL_DIR|g"
     grep -rlE "'/build'" | xargs -n1 sed -i "s|'/build'|'$APP_DIR'|g"
     sed -i "s@\"/cache\"@\"$INSTALL_DIR/cache\"@g" "$ML_DIR"/immich_ml/config.py
+    [[ ! -f "$GEO_DIR/countryInfo.txt" ]] && curl_with_retry "https://download.geonames.org/export/dump/countryInfo.txt" "countryInfo.txt"
     ln -s "${UPLOAD_DIR:-/opt/immich/upload}" "$APP_DIR"/upload
     ln -s "${UPLOAD_DIR:-/opt/immich/upload}" "$ML_DIR"/upload
     ln -s "$GEO_DIR" "$APP_DIR"

ct/librenms.sh

@@ -28,6 +28,9 @@ function update_script() {
     msg_error "No ${APP} Installation Found!"
     exit
   fi
+  
+  ensure_dependencies ipmitool
+  
   if check_for_gh_release "librenms" "librenms/librenms"; then
     msg_info "Stopping Services"
     systemctl stop php8.4-fpm librenms-scheduler.timer

ct/networkoptimizer.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Ozark-Connect/NetworkOptimizer
+
+APP="NetworkOptimizer"
+var_tags="${var_tags:-network;monitoring;unifi}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-12}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/networkoptimizer ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "networkoptimizer" "Ozark-Connect/NetworkOptimizer"; then
+    msg_info "Stopping Service"
+    systemctl stop networkoptimizer
+    msg_ok "Stopped Service"
+
+    create_backup /opt/networkoptimizer/networkoptimizer.env
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "networkoptimizer" "Ozark-Connect/NetworkOptimizer" "tarball"
+
+    msg_info "Rebuilding NetworkOptimizer"
+    RID="linux-x64"
+    [[ "$(dpkg --print-architecture)" == "arm64" ]] && RID="linux-arm64"
+    cd /opt/networkoptimizer
+    $STD dotnet publish src/NetworkOptimizer.Web -c Release -r "$RID" --self-contained -o /opt/networkoptimizer/publish
+    chmod +x /opt/networkoptimizer/publish/NetworkOptimizer.Web
+    mkdir -p /opt/networkoptimizer/publish/tools
+    cd /opt/networkoptimizer/src/uwnspeedtest
+    CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $STD go build -trimpath -ldflags "-s -w" -o /opt/networkoptimizer/publish/tools/uwnspeedtest-linux-arm64 .
+    msg_ok "Rebuilt NetworkOptimizer"
+
+    restore_backup
+
+    msg_info "Starting Service"
+    systemctl start networkoptimizer
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8042${CL}"

ct/nextcloudpi.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-8}"
 var_os="${var_os:-debian}"
-var_version="${var_version:-12}"
+var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/obsidian-livesync.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/vrtmrz/obsidian-livesync | https://couchdb.apache.org/
+
+APP="Obsidian-LiveSync"
+var_tags="${var_tags:-documents;notes}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-1024}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /opt/couchdb/etc/local.d/obsidian-livesync.ini ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  msg_info "Stopping CouchDB"
+  systemctl stop couchdb
+  msg_ok "Stopped CouchDB"
+
+  create_backup /var/lib/couchdb /opt/couchdb/etc/local.d/obsidian-livesync.ini /opt/obsidian-livesync/.env
+
+  msg_info "Updating Container OS"
+  $STD apt update
+  $STD apt upgrade -y
+  msg_ok "Updated Container OS"
+
+  systemctl stop couchdb
+  restore_backup
+
+  msg_info "Starting CouchDB"
+  systemctl start couchdb
+  msg_ok "Started CouchDB"
+  msg_ok "Updated successfully!"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Configure the Self-hosted LiveSync plugin with the credentials in /opt/obsidian-livesync/.env${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:5984/_utils/${CL}"

ct/omniroute.sh

@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/diegosouzapw/OmniRoute
+
+APP="OmniRoute"
+var_tags="${var_tags:-ai;gateway;llm}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/omniroute ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  msg_info "Checking for Updates"
+  local LATEST
+  LATEST=$(npm view omniroute version 2>/dev/null)
+  if [[ -z "$LATEST" ]]; then
+    msg_error "Could not determine latest OmniRoute version"
+    exit
+  fi
+  if [[ "$LATEST" == "$(omniroute --version 2>/dev/null)" ]]; then
+    msg_ok "Already up to date (${LATEST})"
+    exit
+  fi
+  msg_ok "New version available: ${LATEST}"
+
+  NODE_VERSION="26" setup_nodejs
+  
+  msg_info "Stopping Service"
+  systemctl stop omniroute
+  msg_ok "Stopped Service"
+
+  msg_info "Updating OmniRoute to ${LATEST}"
+  $STD npm install -g omniroute@latest
+  msg_ok "Updated OmniRoute to ${LATEST}"
+
+  msg_info "Starting Service"
+  systemctl start omniroute
+  msg_ok "Started Service"
+  msg_ok "Updated successfully!"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:20128${CL}"
+echo -e "${INFO}${YW} The admin password is stored in /opt/omniroute/.env (INITIAL_PASSWORD)${CL}"

ct/opencloud.sh

@@ -30,7 +30,7 @@ function update_script() {
     exit
   fi
 
-  RELEASE="v7.3.0"
+  RELEASE="v7.4.0"
   if check_for_gh_release "OpenCloud" "opencloud-eu/opencloud" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
     msg_info "Stopping services"
     systemctl stop opencloud opencloud-wopi

ct/pangolin.sh

@@ -17,6 +17,9 @@ var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 var_tun="${var_tun:-1}"
 
+export var_pangolin_url="${var_pangolin_url:-}"
+export var_pangolin_email="${var_pangolin_email:-}"
+
 header_info "$APP"
 variables
 color

ct/paperless-ngx.sh

@@ -42,7 +42,7 @@ function update_script() {
       echo -e ""
       msg_custom "🔄" "Migration required to new data structure (/opt/paperless_data/)"
       msg_custom "📖" "Please follow the migration guide:"
-      echo -e "${GATEWAY}${BGN}https://github.com/community-scripts/ProxmoxVE/discussions/9223${CL}"
+      echo -e "${GATEWAY}${BGN}https://github.com/community-scripts/ProxmoxVE/pull/9223${CL}"
       echo -e ""
       msg_custom "⚠️" "Update aborted. Please migrate your data first."
       exit 253
@@ -65,7 +65,7 @@ function update_script() {
       read -rp "Do you want to continue with the update? (y/N): " MIGRATE
       echo
       if [[ ! "$MIGRATE" =~ ^[Yy]$ ]]; then
-        msg_info "Update aborted. Decrypt all documents before upgrading to v3."
+        msg_custom "⚠️" "Update aborted. Decrypt all documents before upgrading to v3."
         exit 0
       fi
     fi

ct/passwordpusher.sh

@@ -38,6 +38,7 @@ function update_script() {
     create_backup /opt/passwordpusher/storage /opt/passwordpusher/.env.production
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "passwordpusher" "pglombardo/PasswordPusher" "tarball"
+    RUBY_VERSION="$(cat /opt/passwordpusher/.ruby-version)" RUBY_INSTALL_RAILS="false" setup_ruby
 
     msg_info "Installing Gem Dependencies"
     cd /opt/passwordpusher

ct/pegaprox.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/PegaProx/project-pegaprox
+
+APP="PegaProx"
+var_tags="${var_tags:-proxmox;management}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/pegaprox ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "pegaprox" "PegaProx/project-pegaprox"; then
+    msg_info "Stopping Service"
+    systemctl stop pegaprox
+    msg_ok "Stopped Service"
+
+    create_backup /opt/pegaprox/config /etc/pegaprox/secret.key
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "pegaprox" "PegaProx/project-pegaprox" "tarball"
+
+    msg_info "Updating Python Environment"
+    $STD uv venv --python 3.12 /opt/pegaprox/venv
+    $STD uv pip install --python /opt/pegaprox/venv/bin/python -r /opt/pegaprox/requirements.txt
+    msg_ok "Updated Python Environment"
+
+    restore_backup
+
+    msg_info "Starting Service"
+    systemctl start pegaprox
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}https://${IP}:5000${CL}"

ct/romm.sh

@@ -30,6 +30,12 @@ function update_script() {
     exit
   fi
 
+  if [[ ! -x /usr/bin/7zz || ! -x /usr/bin/bsdtar ]]; then
+    msg_info "Installing Archive Tools"
+    $STD apt install -y 7zip-standalone libarchive-tools
+    msg_ok "Installed Archive Tools"
+  fi
+
   NODE_VERSION="24" setup_nodejs
 
   if check_for_gh_release "romm" "rommapp/romm"; then
@@ -44,6 +50,10 @@ function update_script() {
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "romm" "rommapp/romm" "tarball" "latest" "/opt/romm"
 
+    find /opt/romm/backend/alembic/versions -maxdepth 1 -type f -name '1.*.py' -delete 2>/dev/null || true
+    find /opt/romm/backend/alembic/versions -maxdepth 1 -type f -name '2.0.0_.py' -delete 2>/dev/null || true
+    find /opt/romm/backend -name '__pycache__' -type d -prune -exec rm -rf {} + 2>/dev/null || true
+
     restore_backup
 
     msg_info "Updating ROMM"

ct/salt.sh

@@ -36,7 +36,7 @@ function update_script() {
     sed -i "s/^\(Pin: version \).*/\1${RELEASE}/" /etc/apt/preferences.d/salt-pin-1001
     $STD apt update
     $STD apt upgrade -y
-    echo "${RELEASE}" >/~.salt
+    echo "${RELEASE}" >~/.salt
     msg_ok "Updated successfully!"
   fi
   exit

ct/split-pro.sh

@@ -35,18 +35,16 @@ function update_script() {
     systemctl stop split-pro
     msg_ok "Stopped Service"
 
-    msg_info "Backing up Data"
+    create_backup /opt/split-pro/.env
-    cp /opt/split-pro/.env /opt/split-pro.env
-    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "split-pro" "oss-apps/split-pro" "tarball"
 
+    restore_backup
+
     msg_info "Building Application"
     cd /opt/split-pro
     $STD pnpm install --frozen-lockfile
     $STD pnpm build
-    cp /opt/split-pro.env /opt/split-pro/.env
-    rm -f /opt/split-pro.env
     ln -sf /opt/split-pro_data/uploads /opt/split-pro/uploads
     $STD pnpm exec prisma migrate deploy
     msg_ok "Built Application"

ct/termix.sh

@@ -112,14 +112,33 @@ EOF
     msg_ok "Stopped Termix"
 
     msg_info "Migrating Configuration"
-    if [[ ! -f /opt/termix/.env ]]; then
+    mkdir -p /opt/termix/db/data
-      cat <<EOF >/opt/termix/.env
+
+    if [[ -f /opt/termix/data/db.sqlite.encrypted && ! -f /opt/termix/db/data/db.sqlite.encrypted ]]; then
+      cp -a /opt/termix/data/db.sqlite.encrypted /opt/termix/db/data/db.sqlite.encrypted
+      [[ -f /opt/termix/data/db.sqlite.encrypted.meta ]] &&
+        cp -a /opt/termix/data/db.sqlite.encrypted.meta /opt/termix/db/data/db.sqlite.encrypted.meta
+      [[ -f /opt/termix/data/db.sqlite ]] &&
+        cp -a /opt/termix/data/db.sqlite /opt/termix/db/data/db.sqlite
+    fi
+
+    if [[ -f /opt/termix/data/.env && ! -f /opt/termix/db/data/.env ]]; then
+      cp -a /opt/termix/data/.env /opt/termix/db/data/.env
+    fi
+
+    for sub in ssl session_logs session_recordings acme-webroot certbot uploads; do
+      if [[ -d /opt/termix/data/$sub && ! -d /opt/termix/db/data/$sub ]]; then
+        cp -a "/opt/termix/data/$sub" "/opt/termix/db/data/$sub"
+      fi
+    done
+
+    cat <<EOF >/opt/termix/.env
 NODE_ENV=production
-DATA_DIR=/opt/termix/data
+DATA_DIR=/opt/termix/db/data
 GUACD_HOST=127.0.0.1
 GUACD_PORT=4822
 EOF
-    fi
+
     if ! grep -q "EnvironmentFile" /etc/systemd/system/termix.service 2>/dev/null; then
       cat <<EOF >/etc/systemd/system/termix.service
 [Unit]
@@ -143,7 +162,11 @@ EOF
     fi
     msg_ok "Migrated Configuration"
 
-    create_backup /opt/termix/data /opt/termix/uploads
+    create_backup \
+      /opt/termix/db/data \
+      /opt/termix/data \
+      /opt/termix/uploads \
+      /opt/termix/.env
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "termix" "Termix-SSH/Termix" "tarball"
 
@@ -158,10 +181,10 @@ EOF
       /opt/termix/db/data
     msg_ok "Recreated Directories"
 
-    if [[ -f /opt/termix/data/db.sqlite.encrypted && ! -f /opt/termix/db/data/db.sqlite.encrypted ]]; then
+    if [[ -f /opt/termix/db/data/db.sqlite.encrypted && ! -f /opt/termix/db/data/.env ]]; then
-      msg_info "Migrating Database to new layout"
+      msg_error "Encrypted database restored without its keys (/opt/termix/db/data/.env is missing)"
-      cp -a /opt/termix/data/db.sqlite.encrypted /opt/termix/db/data/db.sqlite.encrypted
+      msg_custom "🛟" "Restore the container from a backup and report this at https://github.com/community-scripts/ProxmoxVE/issues"
-      msg_ok "Migrated Database to new layout"
+      exit 1
     fi
 
     msg_info "Building Frontend"
@@ -237,7 +260,12 @@ EOF
     fi
 
     msg_info "Starting Termix"
-    systemctl start termix
+    systemctl daemon-reload
+    if ! systemctl start termix; then
+      msg_error "Termix failed to start"
+      journalctl -u termix -n 30 --no-pager || true
+      exit 1
+    fi
     msg_ok "Started Termix"
     msg_ok "Updated successfully!"
   fi

ct/vikunja.sh

@@ -46,8 +46,7 @@ function update_script() {
     [[ "$CONFIRM2" =~ ^[yY]$ ]] || exit 0
   fi
 
-  RELEASE="v2.3.0"
+  if check_for_gh_release "vikunja" "go-vikunja/vikunja"; then
-  if check_for_gh_release "vikunja" "go-vikunja/vikunja" "${RELEASE}" "v2.4.0 is killed at startup by the systemd SystemCallFilter shipped in the .deb (upstream go-vikunja/vikunja#3252); pinned until a fixed release is out"; then
     echo
     msg_warn "The package update may include config file changes."
     echo -e "${TAB}${YW}How do you want to handle /etc/vikunja/config.yml?${CL}"
@@ -66,7 +65,7 @@ function update_script() {
     systemctl stop vikunja
     msg_ok "Stopped Service"
 
-    fetch_and_deploy_gh_release "vikunja" "go-vikunja/vikunja" "binary" "${RELEASE}" "" "vikunja-*-$(arch_resolve "x86_64" "aarch64").deb"
+    fetch_and_deploy_gh_release "vikunja" "go-vikunja/vikunja" "binary" "latest" "" "vikunja-*-$(arch_resolve "x86_64" "aarch64").deb"
     $STD systemctl daemon-reload
 
     msg_info "Starting Service"

ct/watcharr.sh

@@ -34,6 +34,8 @@ function update_script() {
     systemctl stop watcharr
     msg_ok "Stopped Service"
 
+    NODE_VERSION="24" setup_nodejs
+
     create_backup /opt/watcharr/server/data
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "watcharr" "sbondCo/Watcharr" "tarball"
     restore_backup

ct/xyops.sh

@@ -48,6 +48,13 @@ function update_script() {
     chmod 644 /opt/xyops/node_modules/useragent-ng/lib/regexps.js
     msg_ok "Rebuilt Application"
 
+    fetch_and_deploy_gh_release "xysat" "pixlcore/xysat" "tarball" "latest" "/opt/xyops/satellite"
+
+    msg_info "Building xySat Satellite"
+    cd /opt/xyops/satellite
+    $STD npm install
+    msg_ok "Built xySat Satellite"
+
     msg_info "Starting Service"
     systemctl start xyops
     msg_ok "Started Service"

install/actualbudget-install.sh

@@ -19,7 +19,7 @@ $STD apt install -y \
   g++
 msg_ok "Installed Dependencies"
 
-NODE_VERSION="22" setup_nodejs
+NODE_VERSION="24" setup_nodejs
 create_self_signed_cert
 
 msg_info "Installing Actual Budget"
@@ -51,6 +51,7 @@ cat <<EOF >/opt/actualbudget-data/config.json
 EOF
 mkdir -p /opt/actualbudget
 cd /opt/actualbudget
+$STD npm config set allow-scripts=bcrypt,better-sqlite3,argon2 --location=global
 $STD npm install --location=global @actual-app/sync-server
 echo "${RELEASE}" >~/.actualbudget
 msg_ok "Installed Actual Budget"

install/affine-install.sh

@@ -78,6 +78,8 @@ $STD yarn config set enableTelemetry 0
 export NODE_OPTIONS="--max-old-space-size=4096"
 export TSC_COMPILE_ON_ERROR=true
 $STD yarn install
+$STD bash ./scripts/set-version.sh "$(cat ~/.affine_app)"
+export BUILD_TYPE=stable
 $STD npm install -g typescript
 $STD yarn affine @affine/native build
 $STD yarn affine @affine/server-native build

install/alpine-docker-install.sh

@@ -26,23 +26,21 @@ msg_ok "Installed Docker"
 get_latest_release() {
   curl -fsSL https://api.github.com/repos/"$1"/releases/latest | grep '"tag_name":' | cut -d'"' -f4
 }
-PORTAINER_LATEST_VERSION=$(get_latest_release "portainer/portainer")
 DOCKER_COMPOSE_LATEST_VERSION=$(get_latest_release "docker/compose")
 PORTAINER_AGENT_LATEST_VERSION=$(get_latest_release "portainer/agent")
 
-read -r -p "${TAB3}Would you like to add Portainer? <y/N> " prompt
+read -r -p "${TAB3}Would you like to add Docker Compose? <y/N> " prompt
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
-  msg_info "Installing Portainer $PORTAINER_LATEST_VERSION"
+  msg_info "Installing Docker Compose $DOCKER_COMPOSE_LATEST_VERSION"
-  docker volume create portainer_data >/dev/null
+  DOCKER_CONFIG=${DOCKER_CONFIG:-$HOME/.docker}
-  $STD docker run -d \
+  mkdir -p "$DOCKER_CONFIG"/cli-plugins
-    -p 8000:8000 \
+  curl -fsSL https://github.com/docker/compose/releases/download/"$DOCKER_COMPOSE_LATEST_VERSION"/docker-compose-linux-$(arch_resolve "x86_64" "aarch64") -o ~/.docker/cli-plugins/docker-compose
-    -p 9443:9443 \
+  chmod +x "$DOCKER_CONFIG"/cli-plugins/docker-compose
-    --name=portainer \
+  msg_ok "Installed Docker Compose $DOCKER_COMPOSE_LATEST_VERSION"
-    --restart=always \
+fi
-    -v /var/run/docker.sock:/var/run/docker.sock \
+
-    -v portainer_data:/data \
+if prompt_confirm "${TAB3}Would you like to install Portainer (UI) via the community-scripts addon?" "n" 60; then
-    portainer/portainer-ce:latest
+  bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/portainer.sh)" <<<"y"
-  msg_ok "Installed Portainer $PORTAINER_LATEST_VERSION"
 else
   read -r -p "${TAB3}Would you like to add the Portainer Agent? <y/N> " prompt
   if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
@@ -57,21 +55,12 @@ else
     msg_ok "Installed Portainer Agent $PORTAINER_AGENT_LATEST_VERSION"
   fi
 fi
-read -r -p "${TAB3}Would you like to add Docker Compose? <y/N> " prompt
-if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
-  msg_info "Installing Docker Compose $DOCKER_COMPOSE_LATEST_VERSION"
-  DOCKER_CONFIG=${DOCKER_CONFIG:-$HOME/.docker}
-  mkdir -p "$DOCKER_CONFIG"/cli-plugins
-  curl -fsSL https://github.com/docker/compose/releases/download/"$DOCKER_COMPOSE_LATEST_VERSION"/docker-compose-linux-$(arch_resolve "x86_64" "aarch64") -o ~/.docker/cli-plugins/docker-compose
-  chmod +x "$DOCKER_CONFIG"/cli-plugins/docker-compose
-  msg_ok "Installed Docker Compose $DOCKER_COMPOSE_LATEST_VERSION"
-fi
 
 read -r -p "${TAB3}Would you like to expose the Docker TCP socket? <y/N> " prompt
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
   msg_info "Exposing Docker TCP socket"
   $STD mkdir -p /etc/docker
-  $STD echo '{ "hosts": ["unix:///var/run/docker.sock", "tcp://0.0.0.0:2375"] }' > /etc/docker/daemon.json
+  $STD echo '{ "hosts": ["unix:///var/run/docker.sock", "tcp://0.0.0.0:2375"] }' >/etc/docker/daemon.json
   $STD rc-service docker restart
   msg_ok "Exposed Docker TCP socket at tcp://+:2375"
 fi

install/authentik-install.sh

@@ -122,9 +122,18 @@ export UV_NO_BINARY_PACKAGE="cryptography lxml python-kadmin-rs xmlsec"
 export UV_COMPILE_BYTECODE="1"
 export UV_LINK_MODE="copy"
 export UV_NATIVE_TLS="1"
+export UV_HTTP_TIMEOUT="300"
 export UV_PYTHON_INSTALL_DIR="/usr/local/bin"
 cd /opt/authentik
-$STD uv sync --frozen --no-install-project --no-dev
+for attempt in 1 2 3; do
+  if [[ $attempt -eq 3 ]]; then
+    $STD uv sync --frozen --no-install-project --no-dev
+    break
+  fi
+  $STD uv sync --frozen --no-install-project --no-dev && break
+  msg_warn "uv sync attempt $attempt failed, retrying..."
+  sleep $((attempt * 15))
+done
 cp /opt/authentik/authentik/sources/kerberos/krb5.conf /etc/krb5.conf
 msg_ok "Setup python server"
 

install/bazarr-install.sh

@@ -22,6 +22,7 @@ chmod 775 /opt/bazarr /var/lib/bazarr/
 sed -i.bak 's/--only-binary=Pillow//g' /opt/bazarr/requirements.txt
 $STD uv venv --clear /opt/bazarr/venv --python 3.12
 $STD uv pip install -r /opt/bazarr/requirements.txt --python /opt/bazarr/venv/bin/python3
+$STD uv pip install psycopg2-binary --python /opt/bazarr/venv/bin/python3
 msg_ok "Installed Bazarr"
 
 msg_info "Creating Service"

install/bitfocus-companion-install.sh

@@ -14,7 +14,9 @@ network_check
 update_os
 
 msg_info "Installing Dependencies"
-$STD apt install -y libusb-1.0-0
+$STD apt install -y \
+  libusb-1.0-0 \
+  libatomic1
 msg_ok "Installed Dependencies"
 
 msg_info "Fetching Latest Bitfocus Companion Release"

install/changedetection-install.sh

@@ -83,7 +83,6 @@ $STD apt-get install -y \
   fonts-kacst fonts-liberation \
   fonts-noto-cjk \
   fonts-noto-color-emoji \
-  msttcorefonts \
   fonts-roboto \
   fonts-thai-tlwg \
   fonts-wqy-zenhei

install/cleanuparr-install.sh

@@ -16,6 +16,7 @@ update_os
 fetch_and_deploy_gh_release "Cleanuparr" "Cleanuparr/Cleanuparr" "prebuild" "latest" "/opt/cleanuparr" "*linux-$(arch_resolve).zip"
 
 msg_info "Creating Service"
+mkdir -p /etc/cleanuparr /var/log/cleanuparr
 cat <<EOF >/etc/systemd/system/cleanuparr.service
 [Unit]
 Description=Cleanuparr Daemon
@@ -29,7 +30,8 @@ ExecStart=/opt/cleanuparr/Cleanuparr
 Restart=on-failure
 RestartSec=5
 Environment="PORT=11011"
-Environment="CONFIG_DIR=/opt/cleanuparr/config"
+Environment="CLEANUPARR_CONFIG_PATH=/etc/cleanuparr"
+Environment="CLEANUPARR_LOGS_PATH=/var/log/cleanuparr"
 
 [Install]
 WantedBy=multi-user.target

install/cross-seed-install.sh

@@ -17,7 +17,7 @@ msg_info "Installing Dependencies"
 $STD apt install -y build-essential
 msg_ok "Installed Dependencies"
 
-NODE_VERSION="26" setup_nodejs
+NODE_VERSION="24" setup_nodejs
 
 msg_info "Setup Cross-Seed"
 $STD npm install cross-seed@latest -g

install/dispatcharr-install.sh

@@ -174,7 +174,7 @@ cd /opt/dispatcharr
 set -a
 source .env
 set +a
-exec uv run celery -A dispatcharr worker -l info -c 4
+exec uv run celery -A dispatcharr worker -l info -c 4 -Q celery,recordings,dvr,default
 EOF
 chmod +x /opt/dispatcharr/start-celery.sh
 

install/docker-install.sh

@@ -15,11 +15,11 @@ update_os
 
 PORTAINER_AGENT_LATEST_VERSION=$(get_latest_github_release "portainer/agent")
 
-read -r -p "${TAB3}Would you like to add Portainer (UI)? <y/N> " prompt
+setup_docker
-if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
+
-  DOCKER_PORTAINER="true" setup_docker
+if prompt_confirm "${TAB3}Would you like to install Portainer (UI) via the community-scripts addon?" "n" 60; then
+  bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/portainer.sh)" <<<"y"
 else
-  setup_docker
   read -r -p "${TAB3}Would you like to install the Portainer Agent (for remote management)? <y/N> " prompt_agent
   if [[ ${prompt_agent,,} =~ ^(y|yes)$ ]]; then
     msg_info "Installing Portainer Agent $PORTAINER_AGENT_LATEST_VERSION"

install/firecrawl-install.sh

@@ -0,0 +1,230 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: esatbayhan
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.firecrawl.dev/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  build-essential \
+  cmake \
+  git \
+  nftables \
+  pkg-config \
+  procps \
+  python3 \
+  rabbitmq-server \
+  redis-server
+msg_ok "Installed Dependencies"
+
+NODE_VERSION="22" NODE_MODULE="pnpm@11.4.0" setup_nodejs
+setup_go
+RUST_PROFILE="minimal" setup_rust
+PG_VERSION="17" PG_MODULES="cron" setup_postgresql
+
+fetch_and_deploy_gh_release "firecrawl" "firecrawl/firecrawl" "tarball" "latest" "/opt/firecrawl"
+
+msg_info "Configuring FDB"
+FDB_VERSION="$(awk -F= '/^ARG FDB_VERSION=/{print $2; exit}' /opt/firecrawl/apps/api/Dockerfile)"
+if [[ -z "$FDB_VERSION" ]]; then
+  msg_error "FDB_VERSION pin not found in upstream Dockerfile"
+  exit 1
+fi
+FDB_ARCH="$(get_system_arch)"
+[[ "$FDB_ARCH" == "arm64" ]] && FDB_ARCH="aarch64"
+fetch_and_deploy_gh_release "foundationdb-clients" "apple/foundationdb" "binary" "$FDB_VERSION" "/opt/foundationdb-clients" "foundationdb-clients_${FDB_VERSION}-1_${FDB_ARCH}.deb"
+msg_ok "Configured FDB"
+
+PG_DB_NAME="firecrawl" PG_DB_USER="firecrawl" PG_DB_EXTENSIONS="pgcrypto,pg_cron" PG_DB_CREDS_FILE="/dev/null" setup_postgresql_db
+
+msg_info "Configuring pg_cron"
+$STD runuser -u postgres -- psql -c "ALTER SYSTEM SET cron.use_background_workers = 'on';"
+systemctl restart postgresql
+until runuser -u postgres -- psql -c "SELECT 1;" &>/dev/null; do sleep 1; done
+msg_ok "Configured pg_cron"
+
+msg_info "Configuring RabbitMQ"
+systemctl enable -q --now rabbitmq-server
+until rabbitmqctl status &>/dev/null; do sleep 1; done
+RABBITMQ_PASSWORD="$(openssl rand -base64 32 | tr -dc 'a-zA-Z0-9' | head -c24)"
+$STD rabbitmqctl add_user firecrawl "$RABBITMQ_PASSWORD"
+$STD rabbitmqctl set_permissions -p / firecrawl ".*" ".*" ".*"
+msg_ok "Configured RabbitMQ"
+
+systemctl enable -q --now redis-server
+
+msg_info "Importing NuQ Schema"
+$STD runuser -u postgres -- psql -d firecrawl -f /opt/firecrawl/apps/nuq-postgres/nuq.sql
+$STD runuser -u postgres -- psql -d firecrawl -c "GRANT USAGE ON SCHEMA nuq TO firecrawl;"
+$STD runuser -u postgres -- psql -d firecrawl -c "GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA nuq TO firecrawl;"
+$STD runuser -u postgres -- psql -d firecrawl -c "GRANT USAGE, SELECT, UPDATE ON ALL SEQUENCES IN SCHEMA nuq TO firecrawl;"
+$STD runuser -u postgres -- psql -d firecrawl -c "ALTER DEFAULT PRIVILEGES IN SCHEMA nuq GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO firecrawl;"
+$STD runuser -u postgres -- psql -d firecrawl -c "ALTER DEFAULT PRIVILEGES IN SCHEMA nuq GRANT USAGE, SELECT, UPDATE ON SEQUENCES TO firecrawl;"
+msg_ok "Imported NuQ Schema"
+
+msg_info "Generating Configuration"
+cat <<EOF >/opt/firecrawl/.env
+ENV=local
+HOST=0.0.0.0
+PORT=3002
+USE_DB_AUTHENTICATION=false
+BULL_AUTH_KEY=$(openssl rand -hex 32)
+JWT_SECRET=$(openssl rand -hex 32)
+
+REDIS_URL=redis://127.0.0.1:6379
+REDIS_RATE_LIMIT_URL=redis://127.0.0.1:6379
+
+PLAYWRIGHT_MICROSERVICE_URL=http://127.0.0.1:3000/scrape
+
+POSTGRES_HOST=127.0.0.1
+POSTGRES_PORT=5432
+POSTGRES_USER=${PG_DB_USER}
+POSTGRES_PASSWORD=${PG_DB_PASS}
+POSTGRES_DB=${PG_DB_NAME}
+NUQ_DATABASE_URL=postgresql://${PG_DB_USER}:${PG_DB_PASS}@127.0.0.1:5432/${PG_DB_NAME}
+NUQ_DATABASE_URL_LISTEN=postgresql://${PG_DB_USER}:${PG_DB_PASS}@127.0.0.1:5432/${PG_DB_NAME}
+
+NUQ_BACKEND=pg
+NUQ_RABBITMQ_URL=amqp://firecrawl:${RABBITMQ_PASSWORD}@127.0.0.1:5672/%2f
+
+WORKER_PORT=3005
+EXTRACT_WORKER_PORT=3004
+NUQ_WORKER_START_PORT=3006
+NUQ_WORKER_COUNT=5
+NUQ_PREFETCH_WORKER_PORT=3011
+NUQ_RECONCILER_WORKER_PORT=3012
+HARNESS_STARTUP_TIMEOUT_MS=60000
+
+LOGGING_LEVEL=INFO
+MAX_CONCURRENT_PAGES=10
+ALLOW_LOCAL_WEBHOOKS=false
+BLOCK_MEDIA=false
+
+OPENAI_API_KEY=
+OPENAI_BASE_URL=
+OLLAMA_BASE_URL=
+MODEL_NAME=
+MODEL_EMBEDDING_NAME=
+SEARXNG_ENDPOINT=
+SEARXNG_ENGINES=
+SEARXNG_CATEGORIES=
+PROXY_SERVER=
+PROXY_USERNAME=
+PROXY_PASSWORD=
+SELF_HOSTED_WEBHOOK_URL=
+SELF_HOSTED_WEBHOOK_HMAC_SECRET=
+EOF
+chmod 600 /opt/firecrawl/.env
+msg_ok "Generated Configuration"
+
+msg_info "Building Go Library"
+cd /opt/firecrawl/apps/api/sharedLibs/go-html-to-md
+$STD go build -o libhtml-to-markdown.so -buildmode=c-shared html-to-markdown.go
+msg_ok "Built Go Library"
+
+msg_info "Building Firecrawl API"
+cd /opt/firecrawl/apps/api
+$STD pnpm install --frozen-lockfile
+$STD pnpm build
+CI=true $STD pnpm prune --prod --ignore-scripts
+msg_ok "Built Firecrawl API"
+
+msg_info "Building Playwright Service"
+cd /opt/firecrawl/apps/playwright-service-ts
+$STD npm install
+$STD npx playwright install chromium --with-deps
+$STD npm run build
+$STD npm prune --omit=dev
+msg_ok "Built Playwright Service"
+
+msg_info "Creating Services"
+cat <<EOF >/etc/systemd/system/firecrawl-playwright.service
+[Unit]
+Description=Firecrawl Playwright Service
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/firecrawl/apps/playwright-service-ts
+EnvironmentFile=/opt/firecrawl/.env
+Environment=PORT=3000
+# /opt/firecrawl/.env also contains the API PORT=3002; force Playwright's private port here.
+ExecStart=/usr/bin/env PORT=3000 /usr/bin/node /opt/firecrawl/apps/playwright-service-ts/dist/api.js
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+cat <<EOF >/etc/systemd/system/firecrawl.service
+[Unit]
+Description=Firecrawl API and Workers
+After=network.target postgresql.service redis-server.service rabbitmq-server.service firecrawl-playwright.service
+Requires=postgresql.service redis-server.service rabbitmq-server.service firecrawl-playwright.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/firecrawl/apps/api
+EnvironmentFile=/opt/firecrawl/.env
+Environment=NODE_ENV=production
+# Upstream uses --start-docker to skip install/build and start compiled node dist entrypoints.
+ExecStart=/usr/bin/node /opt/firecrawl/apps/api/dist/src/harness.js --start-docker
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now firecrawl-playwright
+systemctl enable -q --now firecrawl
+msg_ok "Created Services"
+
+msg_info "Configuring Firewall"
+cat <<'EOF' >/etc/nftables.conf
+#!/usr/sbin/nft -f
+
+flush ruleset
+
+table inet firecrawl_filter {
+  chain input {
+    type filter hook input priority 0; policy drop;
+
+    iif "lo" accept
+    ct state established,related accept
+
+    ip protocol icmp accept
+    ip6 nexthdr icmpv6 accept
+    udp sport 67 udp dport 68 accept
+    udp sport 547 udp dport 546 accept
+
+    tcp dport { 22, 3002 } accept
+  }
+
+  chain forward {
+    type filter hook forward priority 0; policy drop;
+  }
+
+  chain output {
+    type filter hook output priority 0; policy accept;
+  }
+}
+EOF
+systemctl enable -q nftables
+systemctl restart nftables
+msg_ok "Configured Firewall"
+
+motd_ssh
+customize
+cleanup_lxc

install/heimdall-dashboard-install.sh

@@ -24,6 +24,7 @@ fetch_and_deploy_gh_release "Heimdall" "linuxserver/Heimdall" "tarball"
 msg_info "Setting up Heimdall-Dashboard"
 cd /opt/Heimdall
 cp .env.example .env
+sed -i 's/^APP_ENV=.*/APP_ENV=production/' .env
 $STD php artisan key:generate
 msg_ok "Setup Heimdall-Dashboard"
 

install/hister-install.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/asciimoo/hister
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+fetch_and_deploy_gh_release "hister" "asciimoo/hister" "singlefile" "latest" "/usr/local/bin" "hister_*_linux_$(arch_resolve)"
+
+msg_info "Configuring Hister"
+mkdir -p /opt/hister/data /etc/hister
+LOCAL_IP=$(hostname -I | awk '{print $1}')
+cat <<EOF >/etc/hister/config.yaml
+app:
+  directory: '/opt/hister/data'
+server:
+  address: '0.0.0.0:4433'
+  base_url: 'http://${LOCAL_IP}:4433'
+EOF
+msg_ok "Configured Hister"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/hister.service
+[Unit]
+Description=Hister Search Engine
+After=network.target
+
+[Service]
+Type=simple
+User=root
+ExecStart=/usr/local/bin/hister listen --config /etc/hister/config.yaml
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now hister
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/homeassistant-install.sh

@@ -32,7 +32,8 @@ get_latest_release() {
 
 CORE_LATEST_VERSION=$(get_latest_release "home-assistant/core")
 
-DOCKER_PORTAINER="true" setup_docker
+setup_docker
+bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/portainer.sh)" <<<"y"
 
 msg_info "Pulling Home Assistant $CORE_LATEST_VERSION Image"
 $STD docker pull ghcr.io/home-assistant/home-assistant:stable

install/immich-install.sh

@@ -312,7 +312,7 @@ ML_DIR="${APP_DIR}/machine-learning"
 GEO_DIR="${INSTALL_DIR}/geodata"
 mkdir -p {"${APP_DIR}","${UPLOAD_DIR}","${GEO_DIR}","${INSTALL_DIR}"/cache}
 
-fetch_and_deploy_gh_release "Immich" "immich-app/immich" "tarball" "v3.0.3" "$SRC_DIR"
+fetch_and_deploy_gh_release "Immich" "immich-app/immich" "tarball" "v3.1.0" "$SRC_DIR"
 PNPM_VERSION="$(jq -r '.packageManager | split("@")[1] | split("+")[0]' ${SRC_DIR}/package.json)"
 export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
 NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs
@@ -355,7 +355,16 @@ cp LICENSE "$APP_DIR"
 cd "$SRC_DIR"
 export MISE_TRUSTED_CONFIG_PATHS="$SRC_DIR"/mise.toml
 export MISE_DISABLE_TOOLS=github:jellyfin/jellyfin-ffmpeg
-$STD mise install
+mise_ok=0
+for i in 1 2 3; do
+  $STD mise install && {
+    mise_ok=1
+    break
+  }
+  msg_warn "mise install failed (attempt $i/3) - retrying"
+  sleep 5
+done
+[[ "$mise_ok" -eq 1 ]] || exit 1
 export PATH="$(mise bin-paths 2>/dev/null | tr '\n' ':')$PATH"
 if ! command -v extism-js >/dev/null 2>&1; then
   # extism-js is published as a bare gzip-compressed single binary (.gz), which
@@ -429,6 +438,7 @@ msg_info "Installing GeoNames data"
 cd "$GEO_DIR"
 curl_with_retry "https://download.geonames.org/export/dump/admin1CodesASCII.txt" "admin1CodesASCII.txt"
 curl_with_retry "https://download.geonames.org/export/dump/admin2Codes.txt" "admin2Codes.txt"
+curl_with_retry "https://download.geonames.org/export/dump/countryInfo.txt" "countryInfo.txt"
 curl_with_retry "https://download.geonames.org/export/dump/cities500.zip" "cities500.zip"
 curl_with_retry "https://raw.githubusercontent.com/nvkelso/natural-earth-vector/v5.1.2/geojson/ne_10m_admin_0_countries.geojson" "ne_10m_admin_0_countries.geojson"
 unzip -q cities500.zip

install/librenms-install.sh

@@ -25,7 +25,8 @@ $STD apt install -y \
   rrdtool \
   snmp \
   snmpd \
-  whois
+  whois \
+  ipmitool
 msg_ok "Installed Dependencies"
 
 msg_info "Installing Python Dependencies"

install/medusa-install.sh

@@ -19,12 +19,16 @@ $STD apt install -y \
   git-core \
   mediainfo
 
-cat <<EOF >/etc/apt/sources.list.d/non-free.list
+cat <<EOF >/etc/apt/sources.list.d/non-free.sources
-deb https://deb.debian.org/debian trixie main contrib non-free non-free-firmware
+Types: deb
+URIs: https://deb.debian.org/debian
+Suites: trixie
+Components: non-free non-free-firmware
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
 EOF
 $STD apt update
 $STD apt install -y unrar
-rm /etc/apt/sources.list.d/non-free.list
+rm /etc/apt/sources.list.d/non-free.sources
 msg_ok "Installed Dependencies"
 
 msg_info "Installing Medusa"

install/networkoptimizer-install.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Ozark-Connect/NetworkOptimizer
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  git \
+  sshpass \
+  iperf3
+setup_deb822_repo \
+  "microsoft" \
+  "https://packages.microsoft.com/keys/microsoft-2025.asc" \
+  "https://packages.microsoft.com/debian/13/prod/" \
+  "trixie"
+$STD apt install -y dotnet-sdk-10.0
+msg_ok "Installed Dependencies"
+
+setup_go
+
+fetch_and_deploy_gh_release "networkoptimizer" "Ozark-Connect/NetworkOptimizer" "tarball"
+
+msg_info "Building NetworkOptimizer"
+RID="linux-x64"
+[[ "$(dpkg --print-architecture)" == "arm64" ]] && RID="linux-arm64"
+cd /opt/networkoptimizer
+export MinVerVersionOverride="$(cat ~/.networkoptimizer)"
+$STD dotnet publish src/NetworkOptimizer.Web -c Release -r "$RID" --self-contained -o /opt/networkoptimizer/publish
+chmod +x /opt/networkoptimizer/publish/NetworkOptimizer.Web
+msg_ok "Built NetworkOptimizer"
+
+msg_info "Building Gateway Speed Test Binary"
+mkdir -p /opt/networkoptimizer/publish/tools
+cd /opt/networkoptimizer/src/uwnspeedtest
+CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $STD go build -trimpath -ldflags "-s -w" -o /opt/networkoptimizer/publish/tools/uwnspeedtest-linux-arm64 .
+msg_ok "Built Gateway Speed Test Binary"
+
+msg_info "Configuring NetworkOptimizer"
+cat <<EOF >/opt/networkoptimizer/networkoptimizer.env
+ASPNETCORE_URLS=http://*:8042
+HOST_IP=${LOCAL_IP}
+Iperf3Server__Enabled=true
+EOF
+msg_ok "Configured NetworkOptimizer"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/networkoptimizer.service
+[Unit]
+Description=NetworkOptimizer
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/networkoptimizer/publish
+EnvironmentFile=/opt/networkoptimizer/networkoptimizer.env
+ExecStart=/opt/networkoptimizer/publish/NetworkOptimizer.Web
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now networkoptimizer
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/nextcloudpi-install.sh

@@ -24,6 +24,16 @@ if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
   exit 10
 fi
 
+msg_info "Making ssh.service reloads behave like restarts"
+mkdir -p /etc/systemd/system/ssh.service.d
+cat <<'EOF' >/etc/systemd/system/ssh.service.d/reload-as-restart.conf
+[Service]
+ExecReload=
+ExecReload=/usr/bin/systemd-run --no-block --quiet /bin/systemctl restart ssh.service
+EOF
+systemctl daemon-reload
+msg_ok "Made ssh.service reloads behave like restarts"
+
 msg_info "Installing NextCloudPi (Patience)"
 $STD bash <(curl -fsSL https://raw.githubusercontent.com/nextcloud/nextcloudpi/master/install.sh)
 msg_ok "Installed NextCloudPi"

install/obsidian-livesync-install.sh

@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/vrtmrz/obsidian-livesync | https://couchdb.apache.org/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+setup_deb822_repo \
+  "couchdb" \
+  "https://couchdb.apache.org/repo/keys.asc" \
+  "https://apache.jfrog.io/artifactory/couchdb-deb/" \
+  "$(get_os_info codename)" \
+  "main"
+
+msg_info "Installing CouchDB"
+COUCHDB_ADMIN_USER="admin"
+COUCHDB_PASSWORD="$(openssl rand -hex 24)"
+COUCHDB_COOKIE="$(openssl rand -hex 16)"
+
+cat <<EOF | debconf-set-selections
+couchdb couchdb/mode select standalone
+couchdb couchdb/mode seen true
+couchdb couchdb/bindaddress string 0.0.0.0
+couchdb couchdb/bindaddress seen true
+couchdb couchdb/cookie string ${COUCHDB_COOKIE}
+couchdb couchdb/cookie seen true
+couchdb couchdb/adminpass password ${COUCHDB_PASSWORD}
+couchdb couchdb/adminpass seen true
+couchdb couchdb/adminpass_again password ${COUCHDB_PASSWORD}
+couchdb couchdb/adminpass_again seen true
+EOF
+DEBIAN_FRONTEND=noninteractive $STD apt-get install -y couchdb
+
+cat <<EOF >/root/.couchdb.credentials
+COUCHDB_ADMIN_USER="${COUCHDB_ADMIN_USER}"
+COUCHDB_ADMIN_PASSWORD="${COUCHDB_PASSWORD}"
+COUCHDB_COOKIE="${COUCHDB_COOKIE}"
+EOF
+msg_ok "Installed CouchDB"
+
+msg_info "Configuring CouchDB"
+mkdir -p /opt/couchdb/etc/local.d /opt/obsidian-livesync
+cat <<EOF >/opt/couchdb/etc/local.d/obsidian-livesync.ini
+[couchdb]
+single_node = true
+max_document_size = 50000000
+
+[admins]
+admin = ${COUCHDB_PASSWORD}
+
+[chttpd]
+bind_address = 0.0.0.0
+port = 5984
+max_http_request_size = 4294967296
+
+[chttpd_auth]
+require_valid_user = true
+
+[httpd]
+enable_cors = true
+WWW-Authenticate = Basic realm="couchdb"
+
+[cors]
+credentials = true
+origins = app://obsidian.md,capacitor://localhost,http://localhost
+headers = accept, authorization, content-type, origin, referer
+methods = GET, PUT, POST, HEAD, DELETE
+max_age = 3600
+EOF
+cat <<EOF >/opt/obsidian-livesync/.env
+COUCHDB_URL=http://${LOCAL_IP}:5984
+COUCHDB_USER=admin
+COUCHDB_PASSWORD=${COUCHDB_PASSWORD}
+COUCHDB_DATABASE=obsidiannotes
+EOF
+chmod 600 /opt/obsidian-livesync/.env
+msg_ok "Configured CouchDB"
+
+msg_info "Creating LiveSync Database"
+systemctl enable -q couchdb
+systemctl restart couchdb
+for _ in {1..30}; do
+  curl -fsS -u "admin:${COUCHDB_PASSWORD}" -X PUT http://127.0.0.1:5984/obsidiannotes >/dev/null 2>&1 && break
+  sleep 1
+done
+msg_ok "Created LiveSync Database"
+
+motd_ssh
+customize
+cleanup_lxc

install/omniroute-install.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/diegosouzapw/OmniRoute
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+NODE_VERSION="26" setup_nodejs
+
+msg_info "Installing OmniRoute"
+$STD npm install -g omniroute@latest
+msg_ok "Installed OmniRoute"
+
+msg_info "Configuring OmniRoute"
+mkdir -p /opt/omniroute
+cat <<EOF >/opt/omniroute/.env
+JWT_SECRET=$(openssl rand -base64 48)
+API_KEY_SECRET=$(openssl rand -hex 32)
+STORAGE_ENCRYPTION_KEY=$(openssl rand -hex 32)
+STORAGE_ENCRYPTION_KEY_VERSION=v1
+INITIAL_PASSWORD=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-20)
+PORT=20128
+OMNIROUTE_SERVER_HOST=0.0.0.0
+EOF
+chmod 600 /opt/omniroute/.env
+msg_ok "Configured OmniRoute"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/omniroute.service
+[Unit]
+Description=OmniRoute AI Gateway
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/omniroute
+Environment=DATA_DIR=/opt/omniroute
+ExecStart=/usr/bin/omniroute
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now omniroute
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/opencloud-install.sh

@@ -64,7 +64,7 @@ $STD sudo -u cool coolconfig set-admin-password --user=admin --password="$COOLPA
 echo "$COOLPASS" >~/.coolpass
 msg_ok "Installed Collabora Online"
 
-fetch_and_deploy_gh_release "OpenCloud" "opencloud-eu/opencloud" "singlefile" "v7.3.0" "/usr/bin" "opencloud-*-linux-$(arch_resolve)"
+fetch_and_deploy_gh_release "OpenCloud" "opencloud-eu/opencloud" "singlefile" "v7.4.0" "/usr/bin" "opencloud-*-linux-$(arch_resolve)"
 mv /usr/bin/OpenCloud /usr/bin/opencloud
 
 msg_info "Configuring OpenCloud"

install/pangolin-install.sh

@@ -27,9 +27,18 @@ fetch_and_deploy_gh_release "pangolin" "fosrl/pangolin" "tarball" "$PANGOLIN_VER
 fetch_and_deploy_gh_release "gerbil" "fosrl/gerbil" "singlefile" "latest" "/usr/bin" "gerbil_linux_$(arch_resolve)"
 fetch_and_deploy_gh_release "traefik" "traefik/traefik" "prebuild" "latest" "/usr/bin" "traefik_v*_linux_$(arch_resolve).tar.gz"
 
-read -rp "${TAB3}Enter your Pangolin URL (ex: https://pangolin.example.com): " pango_url
+# Read the variable first and prompt only when it is unset, so the install can
+# be supplied up front. Same convention as install/forgejo-runner-install.sh.
+pango_url="${var_pangolin_url:-}"
+if [[ -z "$pango_url" ]]; then
+  read -rp "${TAB3}Enter your Pangolin URL (ex: https://pangolin.example.com): " pango_url
+fi
 [[ "$pango_url" != https://* && "$pango_url" != http://* ]] && pango_url="https://${pango_url}"
-read -rp "${TAB3}Enter your email address: " pango_email
+
+pango_email="${var_pangolin_email:-}"
+if [[ -z "$pango_email" ]]; then
+  read -rp "${TAB3}Enter your email address: " pango_email
+fi
 
 msg_info "Setup Pangolin"
 SECRET_KEY=$(openssl rand -base64 48 | tr -dc 'A-Za-z0-9' | head -c 32)

install/passbolt-install.sh

@@ -26,7 +26,7 @@ create_self_signed_cert
 
 setup_deb822_repo \
   "passbolt" \
-  "https://keys.openpgp.org/pks/lookup?op=get&options=mr&search=0x3D1A0346C8E1802F774AEF21DE8B853FC155581D" \
+  "https://download.passbolt.com/pub.key" \
   "https://download.passbolt.com/ce/debian" \
   "buster" \
   "stable"

install/passwordpusher-install.sh

@@ -22,12 +22,13 @@ $STD apt install -y \
   pkg-config
 msg_ok "Installed Dependencies"
 
-RUBY_VERSION="4.0.5" RUBY_INSTALL_RAILS="false" setup_ruby
 NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
-export PATH="$HOME/.rbenv/shims:$HOME/.rbenv/bin:$PATH"
 
 fetch_and_deploy_gh_release "passwordpusher" "pglombardo/PasswordPusher" "tarball"
 
+RUBY_VERSION="$(cat /opt/passwordpusher/.ruby-version)" RUBY_INSTALL_RAILS="false" setup_ruby
+export PATH="$HOME/.rbenv/shims:$HOME/.rbenv/bin:$PATH"
+
 msg_info "Installing Gem Dependencies"
 cd /opt/passwordpusher
 $STD bundle config set --local without 'development test'

install/pegaprox-install.sh

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/PegaProx/project-pegaprox
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y sshpass
+msg_ok "Installed Dependencies"
+
+PYTHON_VERSION="3.12" setup_uv
+
+fetch_and_deploy_gh_release "pegaprox" "PegaProx/project-pegaprox" "tarball"
+
+msg_info "Setting up Python Environment"
+$STD uv venv --python 3.12 /opt/pegaprox/venv
+$STD uv pip install --python /opt/pegaprox/venv/bin/python -r /opt/pegaprox/requirements.txt
+msg_ok "Set up Python Environment"
+
+msg_info "Generating Master Key"
+mkdir -p /etc/pegaprox
+cat <<EOF >/etc/pegaprox/secret.key
+$(openssl rand -base64 32 | tr '+/' '-_')
+EOF
+chmod 600 /etc/pegaprox/secret.key
+msg_ok "Generated Master Key"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/pegaprox.service
+[Unit]
+Description=PegaProx - Multi-Cluster Proxmox VE Management
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/pegaprox
+ExecStart=/opt/pegaprox/venv/bin/python /opt/pegaprox/pegaprox_multi_cluster.py
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now pegaprox
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/romm-install.sh

@@ -37,6 +37,8 @@ $STD apt install -y \
   redis-server \
   redis-tools \
   p7zip-full \
+  7zip-standalone \
+  libarchive-tools \
   tzdata
 msg_ok "Installed Dependencies"
 

install/salt-install.sh

@@ -29,7 +29,7 @@ Pin: version ${RELEASE}
 Pin-Priority: 1001
 EOF
 $STD apt install -y salt-master
-echo "${RELEASE}" >/~.salt
+echo "${RELEASE}" >~/.salt
 msg_ok "Installed Salt"
 
 motd_ssh

install/termix-install.sh

@@ -125,7 +125,7 @@ EOF
 
 cat <<EOF >/opt/termix/.env
 NODE_ENV=production
-DATA_DIR=/opt/termix/data
+DATA_DIR=/opt/termix/db/data
 GUACD_HOST=127.0.0.1
 GUACD_PORT=4822
 EOF

install/vikunja-install.sh

@@ -13,8 +13,7 @@ setting_up_container
 network_check
 update_os
 
-RELEASE="v2.3.0"
+fetch_and_deploy_gh_release "vikunja" "go-vikunja/vikunja" "binary" "latest" "" "vikunja-*-$(arch_resolve "x86_64" "aarch64").deb"
-fetch_and_deploy_gh_release "vikunja" "go-vikunja/vikunja" "binary" "${RELEASE}" "" "vikunja-*-$(arch_resolve "x86_64" "aarch64").deb"
 
 msg_info "Setting up Vikunja"
 sed -i 's|^# \(service:\)|\1|' /etc/vikunja/config.yml

install/watcharr-install.sh

@@ -18,7 +18,7 @@ $STD apt install -y gcc
 msg_ok "Installed Dependencies"
 
 setup_go
-NODE_VERSION="22" setup_nodejs
+NODE_VERSION="24" setup_nodejs
 fetch_and_deploy_gh_release "watcharr" "sbondCo/Watcharr" "tarball"
 
 msg_info "Setup Watcharr"

misc/alpine-install.func

@@ -126,7 +126,7 @@ network_check() {
   fi
 
   if [[ $ipv4_connected == false ]]; then
-    read -r -p "No Internet detected, would you like to continue anyway? <y/N> " prompt
+    read -r -p "No Internet detected, would you like to continue anyway? <y/N> " prompt </dev/tty
     if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
       echo -e "${INFO}${RD}Expect Issues Without Internet${CL}"
     else

misc/build.func

@@ -922,8 +922,10 @@ choose_and_set_storage_for_file() {
 _list_os_versions() {
   local ostype="${1:-}"
   [[ -n "$ostype" ]] || return 0
+  local arch
+  arch="$(dpkg --print-architecture 2>/dev/null || echo amd64)"
   pveam available -section system 2>/dev/null |
-    grep -E '\.(tar\.zst|tar\.xz|tar\.gz)$' |
+    grep -E "_${arch}\.(tar\.zst|tar\.xz|tar\.gz)([[:space:]]|$)" |
     awk '{print $2}' |
     sed -nE "s/^${ostype}-([0-9]+(\.[0-9]+)?).*/\1/p" |
     sort -u -V || true
@@ -936,8 +938,10 @@ _list_os_versions() {
 _list_templates() {
   local search="${1:-}" pattern="${2:-}"
   [[ -n "$search" ]] || return 0
+  local arch
+  arch="$(dpkg --print-architecture 2>/dev/null || echo amd64)"
   pveam available -section system 2>/dev/null |
-    grep -E '\.(tar\.zst|tar\.xz|tar\.gz)$' |
+    grep -E "_${arch}\.(tar\.zst|tar\.xz|tar\.gz)([[:space:]]|$)" |
     awk '{print $2}' |
     grep -E "^${search}.*${pattern}" |
     sort -t - -k 2 -V || true
@@ -1130,6 +1134,7 @@ base_settings() {
 
   APT_CACHER=${var_apt_cacher:-""}
   APT_CACHER_IP=${var_apt_cacher_ip:-""}
+  INHERIT_HOST_CA="${var_inherit_host_ca:-no}"
 
   # Runtime check: Verify APT cacher is reachable if configured
   if [[ -n "$APT_CACHER_IP" && "$APT_CACHER" == "yes" ]]; then
@@ -1212,7 +1217,7 @@ load_vars_file() {
 
   # Allowed var_* keys
   local VAR_WHITELIST=(
-    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_keyctl
+    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_inherit_host_ca var_keyctl
     var_gateway var_hostname var_ipv6_method var_mac var_mknod var_mount_fs var_mtu
     var_net var_nesting var_ns var_os var_protection var_pw var_ram var_tags var_timezone var_tun var_unprivileged
     var_verbose var_version var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage var_searchdomain
@@ -1409,6 +1414,12 @@ load_vars_file() {
             continue
           fi
           ;;
+        var_inherit_host_ca)
+          if [[ "$var_val" != "yes" && "$var_val" != "no" && "$var_val" != "auto" ]]; then
+            msg_warn "Invalid host CA inheritance value '$var_val' in $file (must be yes/no/auto), ignoring"
+            continue
+          fi
+          ;;
         var_container_storage | var_template_storage)
           # Validate that the storage exists and is active on the current node
           local _storage_status
@@ -1448,7 +1459,7 @@ default_var_settings() {
   # Allowed var_* keys (alphabetically sorted)
   # Note: Removed var_ctid (can only exist once), var_ipv6_static (static IPs are unique)
   local VAR_WHITELIST=(
-    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_keyctl
+    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_inherit_host_ca var_keyctl
     var_gateway var_hostname var_ipv6_method var_mac var_mknod var_mount_fs var_mtu
     var_net var_nesting var_ns var_os var_protection var_pw var_ram var_tags var_timezone var_tun var_unprivileged
     var_verbose var_version var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage
@@ -1531,6 +1542,7 @@ var_ssh=no
 # HTTP/HTTPS proxy (optional - for networks requiring a proxy)
 # var_http_proxy=http://proxy.local:8080
 # var_http_no_proxy=localhost,127.0.0.1,.local
+# var_inherit_host_ca=no
 
 # Features/Tags/verbosity
 var_fuse=no
@@ -1631,7 +1643,7 @@ get_app_defaults_path() {
 if ! declare -p VAR_WHITELIST >/dev/null 2>&1; then
   # Note: Removed var_ctid (can only exist once), var_ipv6_static (static IPs are unique)
   declare -ag VAR_WHITELIST=(
-    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_keyctl
+    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_inherit_host_ca var_keyctl
     var_gateway var_hostname var_ipv6_method var_mac var_mknod var_mount_fs var_mtu
     var_net var_nesting var_ns var_os var_protection var_pw var_ram var_tags var_timezone var_tun var_unprivileged
     var_verbose var_version var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage var_searchdomain
@@ -1781,6 +1793,7 @@ _build_current_app_vars_tmp() {
   _apt_cacher_ip="${APT_CACHER_IP:-}"
   _http_proxy="${HTTP_PROXY:-${var_http_proxy:-}}"
   _http_no_proxy="${HTTP_NO_PROXY:-${var_http_no_proxy:-}}"
+  _inherit_host_ca="${INHERIT_HOST_CA:-${var_inherit_host_ca:-no}}"
   _fuse="${ENABLE_FUSE:-no}"
   _tun="${ENABLE_TUN:-no}"
   _gpu="${ENABLE_GPU:-no}"
@@ -1834,6 +1847,7 @@ _build_current_app_vars_tmp() {
     [ -n "$_apt_cacher_ip" ] && echo "var_apt_cacher_ip=$(_sanitize_value "$_apt_cacher_ip")"
     [ -n "$_http_proxy" ] && echo "var_http_proxy=$(_sanitize_value "$_http_proxy")"
     [ -n "$_http_no_proxy" ] && echo "var_http_no_proxy=$(_sanitize_value "$_http_no_proxy")"
+    [ -n "$_inherit_host_ca" ] && echo "var_inherit_host_ca=$(_sanitize_value "$_inherit_host_ca")"
 
     [ -n "$_fuse" ] && echo "var_fuse=$(_sanitize_value "$_fuse")"
     [ -n "$_tun" ] && echo "var_tun=$(_sanitize_value "$_tun")"
@@ -1998,7 +2012,7 @@ advanced_settings() {
     TAGS="community-script${var_tags:+;${var_tags}}"
   fi
   local STEP=1
-  local MAX_STEP=30
+  local MAX_STEP=31
 
   # Store values for back navigation - inherit from var_* app defaults
   local _ct_type="${var_unprivileged:-1}"
@@ -2020,6 +2034,7 @@ advanced_settings() {
   local _apt_cacher_ip="${var_apt_cacher_ip:-}"
   local _http_proxy="${var_http_proxy:-}"
   local _http_no_proxy="${var_http_no_proxy:-}"
+  local _inherit_host_ca="${var_inherit_host_ca:-no}"
   local _mtu="${var_mtu:-}"
   local _sd="${var_searchdomain:-}"
   local _ns="${var_ns:-}"
@@ -2849,9 +2864,47 @@ advanced_settings() {
       ;;
 
     # ═══════════════════════════════════════════════════════════════════════════
-    # STEP 25: Container Timezone
+    # STEP 25: Host CA Inheritance
     # ═══════════════════════════════════════════════════════════════════════════
     25)
+      local host_ca_count=0
+      local host_ca_dir="/usr/local/share/ca-certificates"
+      local cert
+      shopt -s nullglob
+      for cert in "$host_ca_dir"/*.crt; do
+        host_ca_count=$((host_ca_count + 1))
+      done
+      shopt -u nullglob
+
+      if [[ $host_ca_count -eq 0 ]]; then
+        _inherit_host_ca="no"
+        ((STEP++))
+        continue
+      fi
+
+      local host_ca_default_flag="--defaultno"
+      [[ "$_inherit_host_ca" == "yes" ]] && host_ca_default_flag=""
+      if whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
+        --title "HOST CA INHERITANCE" \
+        --ok-button "Next" --cancel-button "Back" \
+        $host_ca_default_flag \
+        --yesno "\nInherit host CA certificates into this container?\n\nDetected on host: ${host_ca_count} certificate(s) in:\n${host_ca_dir}\n\nRecommended for private PKI / TLS-inspection environments.\n\n(App default: ${var_inherit_host_ca:-no})" 16 72; then
+        _inherit_host_ca="yes"
+      else
+        if [ $? -eq 1 ]; then
+          _inherit_host_ca="no"
+        else
+          ((STEP--))
+          continue
+        fi
+      fi
+      ((STEP++))
+      ;;
+
+    # ═══════════════════════════════════════════════════════════════════════════
+    # STEP 26: Container Timezone
+    # ═══════════════════════════════════════════════════════════════════════════
+    26)
       local tz_hint="$_ct_timezone"
       [[ -z "$tz_hint" ]] && tz_hint="(empty - will use host timezone)"
 
@@ -2874,9 +2927,9 @@ advanced_settings() {
       ;;
 
     # ═══════════════════════════════════════════════════════════════════════════
-    # STEP 26: Container Protection
+    # STEP 27: Container Protection
     # ═══════════════════════════════════════════════════════════════════════════
-    26)
+    27)
       local protect_default_flag="--defaultno"
       [[ "$_protect_ct" == "yes" || "$_protect_ct" == "1" ]] && protect_default_flag=""
 
@@ -2898,9 +2951,9 @@ advanced_settings() {
       ;;
 
     # ═══════════════════════════════════════════════════════════════════════════
-    # STEP 27: Device Node Creation (mknod)
+    # STEP 28: Device Node Creation (mknod)
     # ═══════════════════════════════════════════════════════════════════════════
-    27)
+    28)
       local mknod_default_flag="--defaultno"
       [[ "$_enable_mknod" == "1" ]] && mknod_default_flag=""
 
@@ -2922,9 +2975,9 @@ advanced_settings() {
       ;;
 
     # ═══════════════════════════════════════════════════════════════════════════
-    # STEP 28: Mount Filesystems
+    # STEP 29: Mount Filesystems
     # ═══════════════════════════════════════════════════════════════════════════
-    28)
+    29)
       local mount_hint=""
       [[ -n "$_mount_fs" ]] && mount_hint="$_mount_fs" || mount_hint="(none)"
 
@@ -2945,9 +2998,9 @@ advanced_settings() {
       ;;
 
     # ═══════════════════════════════════════════════════════════════════════════
-    # STEP 29: Optional host-side post-install hook (path on the Proxmox HOST)
+    # STEP 30: Optional host-side post-install hook (path on the Proxmox HOST)
     # ═══════════════════════════════════════════════════════════════════════════
-    29)
+    30)
       local _hook_prompt="Optional: absolute path to a *.sh file ON THE PROXMOX HOST.
 
 It runs as root on the HOST (NOT in the LXC) after the container
@@ -2997,9 +3050,9 @@ Leave empty to skip."
       ;;
 
     # ═══════════════════════════════════════════════════════════════════════════
-    # STEP 30: Verbose Mode & Confirmation
+    # STEP 31: Verbose Mode & Confirmation
     # ═══════════════════════════════════════════════════════════════════════════
-    30)
+    31)
       local verbose_default_flag="--defaultno"
       [[ "$_verbose" == "yes" ]] && verbose_default_flag=""
 
@@ -3028,6 +3081,7 @@ Leave empty to skip."
       local apt_display="${_apt_cacher:-no}"
       [[ "$_apt_cacher" == "yes" && -n "$_apt_cacher_ip" ]] && apt_display="$_apt_cacher_ip"
       local http_proxy_display="${_http_proxy:-(none)}"
+      local inherit_ca_display="${_inherit_host_ca:-no}"
 
       local post_install_display="${_post_install:-(none)}"
       local post_install_warn=""
@@ -3058,6 +3112,7 @@ Advanced:
   Timezone: $tz_display
   APT Cacher: $apt_display
   HTTP Proxy: $http_proxy_display
+  Inherit Host CAs: $inherit_ca_display
   Verbose: $_verbose
   Post-Install Script: ${post_install_display}${post_install_warn}"
 
@@ -3103,6 +3158,7 @@ Advanced:
   APT_CACHER_IP="$_apt_cacher_ip"
   HTTP_PROXY="$_http_proxy"
   HTTP_NO_PROXY="$_http_no_proxy"
+  INHERIT_HOST_CA="$_inherit_host_ca"
   VERBOSE="$_verbose"
   var_post_install="$_post_install"
 
@@ -3121,6 +3177,7 @@ Advanced:
   var_sdn_vnet="$_sdn_vnet"
   var_http_proxy="$_http_proxy"
   var_http_no_proxy="$_http_no_proxy"
+  var_inherit_host_ca="$_inherit_host_ca"
 
   # Format optional values
   [[ -n "$_mtu" ]] && MTU=",mtu=$_mtu" || MTU=""
@@ -3864,7 +3921,7 @@ run_addon_updates() {
     name="${a##*/update_}"
     printf 'Do you also want to update addon "%s"? (y/N) [60s]: ' "$name"
     ans=""
-    if read -r -t 60 ans; then :; else echo; fi
+    if read -r -t 60 ans </dev/tty; then :; else echo; fi
     case "${ans,,}" in
     y | yes)
       bash "$a" || msg_warn "Addon update for $name failed (rc=$?)"
@@ -4160,6 +4217,83 @@ EOF
   msg_ok "Applied HTTP proxy in container"
 }
 
+# ------------------------------------------------------------------------------
+# _apply_host_ca_certs_in_container()
+#
+# - Copies administrator-provided CA certificates from the Proxmox host into the
+#   container before base package bootstrap
+# - Source: /usr/local/share/ca-certificates/*.crt (Debian convention)
+# - Refreshes the container trust store when update-ca-certificates is available
+# - No-op when no host certificates are present; failures are non-fatal
+# ------------------------------------------------------------------------------
+_apply_host_ca_certs_in_container() {
+  local host_ca_dir="/usr/local/share/ca-certificates"
+  [[ -z "${CTID:-}" ]] && return 0
+  local inherit_host_ca="${INHERIT_HOST_CA:-${var_inherit_host_ca:-no}}"
+
+  local -a host_certs=()
+  local cert
+  shopt -s nullglob
+  for cert in "$host_ca_dir"/*.crt; do
+    host_certs+=("$cert")
+  done
+  shopt -u nullglob
+
+  [[ ${#host_certs[@]} -eq 0 ]] && return 0
+
+  # Opt-in only: copy host CA certs solely when explicitly enabled.
+  # Any other value (no/auto/unset) is a silent no-op to preserve LXC isolation.
+  case "${inherit_host_ca,,}" in
+  yes | true | 1 | on) ;;
+  *)
+    return 0
+    ;;
+  esac
+
+  msg_info "Inheriting host CA certificates into container"
+
+  local found=${#host_certs[@]}
+  local copied=0
+  local skipped=0
+  local cert_name
+
+  pct exec "$CTID" -- mkdir -p /usr/local/share/ca-certificates >/dev/null 2>&1 || {
+    msg_warn "Failed to create CA certificate directory in container"
+    return 0
+  }
+
+  for cert in "${host_certs[@]}"; do
+    cert_name="$(basename "$cert")"
+    if [[ ! -r "$cert" || "$cert_name" != *.crt ]]; then
+      msg_warn "Skipping invalid or unreadable host CA certificate: ${cert_name}"
+      skipped=$((skipped + 1))
+      continue
+    fi
+
+    if pct push "$CTID" "$cert" "/usr/local/share/ca-certificates/${cert_name}" >/dev/null 2>&1; then
+      pct exec "$CTID" -- chmod 644 "/usr/local/share/ca-certificates/${cert_name}" >/dev/null 2>&1 || true
+      copied=$((copied + 1))
+    else
+      msg_warn "Failed to push host CA certificate: ${cert_name}"
+      skipped=$((skipped + 1))
+    fi
+  done
+
+  if [[ $copied -eq 0 ]]; then
+    msg_warn "No host CA certificates were copied (${found} found, ${skipped} skipped)"
+    return 0
+  fi
+
+  local refresh_shell="bash"
+  [[ "$var_os" == "alpine" ]] && refresh_shell="ash"
+
+  if pct exec "$CTID" -- "$refresh_shell" -c 'command -v update-ca-certificates >/dev/null 2>&1 && update-ca-certificates' >/dev/null 2>&1; then
+    msg_ok "Inherited ${copied} host CA certificate(s) and updated trust store (${skipped} skipped)"
+  else
+    msg_warn "Copied ${copied} host CA certificate(s), but trust store update failed or update-ca-certificates is unavailable (${skipped} skipped)"
+  fi
+}
+
 # ------------------------------------------------------------------------------
 # build_container()
 #
@@ -4789,6 +4923,7 @@ EOF
   local install_exit_code=0
 
   _apply_http_proxy_in_container
+  _apply_host_ca_certs_in_container
 
   # Continue with standard container setup
   if [ "$var_os" == "alpine" ]; then
@@ -5069,6 +5204,12 @@ EOF
     # TSTP = Ctrl+Z, TTIN = bg read from tty, TTOU = bg write to tty (tostop)
     trap '' TSTP TTIN TTOU
 
+    # lxc-attach left us in a background process group - claim the terminal back
+    # before we print anything. Note this does NOT hold: the log collection
+    # below uses pct pull/exec, which take it away again, so every interactive
+    # prompt has to reclaim it again right before its read.
+    reclaim_tty
+
     msg_error "Installation failed in container ${CTID} (exit code: ${install_exit_code})"
 
     # Copy install log from container BEFORE API call so get_error_text() can read it
@@ -5197,6 +5338,7 @@ EOF
       pct enter "$CTID"
       echo ""
       echo -en "${YW}Container ${CTID} still running. Remove now? (y/N): ${CL}"
+      reclaim_tty
       if read -r response </dev/tty && [[ "$response" =~ ^[Yy]$ ]]; then
         pct stop "$CTID" &>/dev/null || true
         pct destroy "$CTID" &>/dev/null || true
@@ -5356,6 +5498,7 @@ EOF
 
     local response=""
     local read_rc
+    reclaim_tty
     read -t 60 -r response </dev/tty
     read_rc=$?
     if [[ $read_rc -eq 0 ]]; then
@@ -5588,6 +5731,7 @@ EOF
       # read itself failed (e.g. broken/closed stdin, I/O error) rather than
       # timing out - don't guess and destroy the container on a read we
       # couldn't actually capture; keep it since that's the reversible choice.
+      while read -r -t 0.1 -n 1 _ </dev/tty 2>/dev/null; do :; done
       echo ""
       msg_error "Could not read your response (stdin error) - keeping container ${CTID} for safety."
       msg_error "Remove it manually if not needed: pct destroy ${CTID}"
@@ -5619,6 +5763,7 @@ destroy_lxc() {
   trap 'echo; msg_error "Aborted by user (SIGINT/SIGQUIT)"; return 130' INT QUIT
 
   local prompt
+  reclaim_tty
   if ! read -rp "Remove this Container? <y/N> " prompt </dev/tty; then
     # read returns non-zero on Ctrl-D/ESC
     msg_error "Aborted input (Ctrl-D/ESC)"
@@ -6580,7 +6725,8 @@ create_lxc_container() {
     # Step 1: Check local templates first (instant)
     mapfile -t LOCAL_TEMPLATES < <(
       pveam list "$TEMPLATE_STORAGE" 2>/dev/null |
-        awk -v search="${TEMPLATE_SEARCH}" -v pattern="${TEMPLATE_PATTERN}" '$1 ~ search && $1 ~ pattern {print $1}' |
+        awk -v search="${TEMPLATE_SEARCH}" -v pattern="${TEMPLATE_PATTERN}" -v arch="${ARCH}" \
+          '$1 ~ search && $1 ~ pattern && $1 ~ ("_" arch "\\.(tar\\.zst|tar\\.xz|tar\\.gz)$") {print $1}' |
         sed 's|.*/||' | sort -t - -k 2 -V
     )
 

misc/core.func

@@ -299,6 +299,72 @@ root_check() {
   fi
 }
 
+# ------------------------------------------------------------------------------
+# on_pve_host()
+#
+# - Returns 0 when executed on a Proxmox VE node, 1 otherwise
+# - Cheap probe used by the guards below; never exits on its own
+# ------------------------------------------------------------------------------
+on_pve_host() {
+  command -v pveversion &>/dev/null
+}
+
+# ------------------------------------------------------------------------------
+# require_pve_host()
+#
+# - Guard for tools that drive the node itself (pct/pveam/pvesm/pvesh/qm)
+# - Aborts when not on a PVE node, then validates the PVE version
+# ------------------------------------------------------------------------------
+require_pve_host() {
+  if ! on_pve_host; then
+    msg_error "${APP:-This script} must be run on the Proxmox VE host."
+    msg_error "Proxmox tooling (pct/pveam/pvesm/qm) is not available here."
+    exit 232
+  fi
+  pve_check
+}
+
+# ------------------------------------------------------------------------------
+# confirm_not_pve_host()
+#
+# - Guard for tools that belong inside an LXC/VM but would technically run
+#   on the node as well
+# - Warns and asks for confirmation instead of hard-failing
+# ------------------------------------------------------------------------------
+confirm_not_pve_host() {
+  on_pve_host || return 0
+
+  msg_error "Running on the Proxmox VE host is NOT recommended!"
+  msg_error "${APP:-This script} is meant to be executed inside an LXC container."
+  echo ""
+  echo -n "${TAB:-  }Continue anyway? (y/N): "
+  local confirm
+  read -r confirm
+  if [[ ! "${confirm,,}" =~ ^(y|yes)$ ]]; then
+    msg_warn "Aborted. Please run this inside an LXC container."
+    exit 0
+  fi
+  msg_warn "Proceeding on the Proxmox VE host at your own risk!"
+}
+
+# ------------------------------------------------------------------------------
+# require_debian_like()
+#
+# - Guard for addons that have no Alpine code path
+# - Aborts early instead of failing halfway through with apt/systemd errors
+# ------------------------------------------------------------------------------
+require_debian_like() {
+  if is_alpine; then
+    msg_error "${APP:-This script} does not support Alpine Linux."
+    msg_error "Please use a Debian or Ubuntu based LXC container."
+    exit 238
+  fi
+  if ! command -v apt-get &>/dev/null; then
+    msg_error "${APP:-This script} requires a Debian or Ubuntu based system."
+    exit 238
+  fi
+}
+
 # ------------------------------------------------------------------------------
 # pve_check()
 #
@@ -308,6 +374,10 @@ root_check() {
 # ------------------------------------------------------------------------------
 pve_check() {
   local PVE_VER
+  if ! on_pve_host; then
+    msg_error "${APP:-This script} must be run on the Proxmox VE host."
+    exit 232
+  fi
   PVE_VER="$(pveversion | awk -F'/' '{print $2}' | awk -F'-' '{print $1}')"
 
   # Check for Proxmox VE 8.x: allow 8.0–8.9
@@ -754,7 +824,7 @@ msg_info() {
     # Pause mode: Wait for Enter after each step
     if [[ "${DEV_MODE_PAUSE:-false}" == "true" ]]; then
       echo -en "\n${YWB}[PAUSE]${CL} Press Enter to continue..." >&2
-      read -r
+      read -r </dev/tty
     fi
     return
   fi
@@ -769,7 +839,7 @@ msg_info() {
   if [[ "${DEV_MODE_PAUSE:-false}" == "true" ]]; then
     stop_spinner
     echo -en "\n${YWB}[PAUSE]${CL} Press Enter to continue..." >&2
-    read -r
+    read -r </dev/tty
   fi
 }
 
@@ -972,6 +1042,39 @@ ensure_tput() {
   fi
 }
 
+# ------------------------------------------------------------------------------
+# reclaim_tty()
+#
+# - Reclaims the controlling terminal's foreground process group
+# - lxc-attach takes the terminal and does not hand it back, leaving us in a
+#   background process group. Reading from the terminal then returns EIO
+#   instead of blocking, because SIGTTIN is ignored during recovery - so the
+#   prompt fails before the user can answer and their keystroke leaks into the
+#   parent shell. Redirecting to /dev/tty does not help: the rule applies to
+#   the terminal, not to the file descriptor.
+# - pct exec/pull/enter use lxc-attach internally, so the terminal can be taken
+#   away again at any point. Call this immediately before each interactive
+#   read, not once after the install.
+# - SIGTTOU is ignored inside perl so tcsetpgrp() succeeds instead of stopping
+#   us. No-op when we already are in the foreground or there is no terminal.
+#   perl is a hard dependency of Proxmox VE.
+# ------------------------------------------------------------------------------
+reclaim_tty() {
+  command -v perl >/dev/null 2>&1 || return 0
+  [[ -e /dev/tty ]] || return 0
+
+  local pgid
+  pgid=$(ps -o pgid= -p $$ 2>/dev/null | tr -d ' ') || true
+
+  perl -e '
+    use POSIX;
+    $SIG{TTOU} = "IGNORE";
+    my $pgid = $ARGV[0] || POSIX::getpgrp();
+    open(my $t, "+<", "/dev/tty") or exit 1;
+    POSIX::tcsetpgrp(fileno($t), $pgid) or exit 1;
+  ' "${pgid:-0}" 2>/dev/null || true
+}
+
 # ------------------------------------------------------------------------------
 # is_alpine()
 #
@@ -1217,7 +1320,7 @@ prompt_confirm() {
   # Interactive prompt with timeout
   echo -en "${YW}${message} ${hint} (auto-${default} in ${timeout}s): ${CL}"
 
-  if read -t "$timeout" -r response; then
+  if read -t "$timeout" -r response </dev/tty; then
     # User provided input
     response="${response,,}" # lowercase
     case "$response" in
@@ -1310,7 +1413,7 @@ prompt_input() {
   # Interactive prompt with timeout
   echo -en "${YW}${message}${hint} (auto-default in ${timeout}s): ${CL}" >&2
 
-  if read -t "$timeout" -r response; then
+  if read -t "$timeout" -r response </dev/tty; then
     # User provided input (or pressed Enter for empty)
     if [[ -n "$response" ]]; then
       echo "$response"
@@ -1412,7 +1515,7 @@ prompt_input_required() {
 
     echo -en "${YW}${message} (required, timeout ${timeout}s): ${CL}" >&2
 
-    if read -t "$timeout" -r response; then
+    if read -t "$timeout" -r response </dev/tty; then
       if [[ -z "$response" ]]; then
         echo -e "${YW}This field is required. Please enter a value. (attempt ${attempts}/3)${CL}" >&2
       fi
@@ -1507,7 +1610,7 @@ prompt_select() {
   echo -en "${YW}Select [1-${num_options}] (auto-select ${default} in ${timeout}s): ${CL}" >&2
 
   local response
-  if read -t "$timeout" -r response; then
+  if read -t "$timeout" -r response </dev/tty; then
     if [[ -z "$response" ]]; then
       # Empty response, use default
       echo "${options[$((default - 1))]}"
@@ -1590,7 +1693,7 @@ prompt_password() {
   # Interactive prompt with timeout (silent input)
   echo -en "${YW}${message}${hint} (timeout ${timeout}s): ${CL}" >&2
 
-  if read -t "$timeout" -rs response; then
+  if read -t "$timeout" -rs response </dev/tty; then
     echo "" >&2 # Newline after hidden input
     if [[ -n "$response" ]]; then
       # Validate minimum length

misc/error_handler.func

@@ -499,7 +499,8 @@ error_handler() {
 
       local response=""
       local read_rc
-      read -t 60 -r response
+      declare -f reclaim_tty >/dev/null 2>&1 && reclaim_tty
+      read -t 60 -r response </dev/tty
       read_rc=$?
       if [[ $read_rc -eq 0 ]]; then
         if [[ -z "$response" || "$response" =~ ^[Yy]$ ]]; then
@@ -543,6 +544,7 @@ error_handler() {
         # read itself failed (e.g. broken/closed stdin, I/O error) rather than
         # timing out - don't guess and destroy the container on a read we
         # couldn't actually capture; keep it since that's the reversible choice.
+        while read -r -t 0.1 -n 1 _ </dev/tty 2>/dev/null; do :; done
         echo ""
         if declare -f msg_error >/dev/null 2>&1; then
           msg_error "Could not read your response (stdin error) - keeping container ${CTID} for safety."

misc/install.func

@@ -201,7 +201,7 @@ network_check() {
 
   # If both IPv4 and IPv6 checks fail, prompt the user
   if [[ $ipv4_connected == false && $ipv6_connected == false ]]; then
-    read -r -p "No Internet detected, would you like to continue anyway? <y/N> " prompt
+    read -r -p "No Internet detected, would you like to continue anyway? <y/N> " prompt </dev/tty
     if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
       echo -e "${INFO}${RD}Expect Issues Without Internet${CL}"
     else

misc/tools.func

@@ -1292,14 +1292,17 @@ create_temp_dir() {
 #   - Copies each given file/directory into a persistent store at
 #     /opt/<NSAPP>.backup, mirroring its absolute path inside the store, and
 #     records it in a manifest so restore_backup needs no arguments.
-#   - Idempotent: if a store from a previous (failed) run already exists, it is
+#   - Idempotent per path: a path already recorded in the manifest (from this
-#     left untouched and no new backup is taken. This keeps the last-known-good
+#     run or a previous failed one) is left untouched, keeping the
-#     data instead of overwriting it with now-partially-updated data on retry.
+#     last-known-good copy instead of overwriting it with now-partially-updated
+#     data on retry. Any requested path NOT yet in the manifest is backed up
+#     now and appended - so a manifest left incomplete by an interrupted prior
+#     run gets completed instead of silently missing paths on restore.
 #   - Missing source paths are skipped with a warning (not fatal).
 #   - Aborts the update on copy failure: if any file/dir cannot be backed up,
-#     the half-written store is removed and the script exits, so the update
+#     the script exits before the update runs against unprotected data (the
-#     never runs against unprotected data (and a retry re-attempts a clean
+#     paths already recorded are left in place, so a retry only redoes the one
-#     backup rather than skipping it).
+#     that failed).
 #
 # restore_backup
 #   - Copies every path recorded in the manifest back to its origin (replacing
@@ -1318,19 +1321,17 @@ create_backup() {
     return 0
   }
 
-  if [[ -f "$manifest" ]]; then
+  if ! mkdir -p "$store" || ! touch "$manifest"; then
-    msg_ok "Existing backup found at ${store}, skipping backup"
+    msg_error "Backup failed: could not create store at ${store} - aborting update"
-    return 0
+    exit 1
   fi
 
   msg_info "Backing up data"
-  if ! mkdir -p "$store" || ! : >"$manifest"; then
-    msg_error "Backup failed: could not create store at ${store} - aborting update"
-    rm -rf "$store"
-    exit 1
-  fi
   for path in "$@"; do
     path="${path%/}"
+    if grep -qxF "$path" "$manifest" 2>/dev/null; then
+      continue
+    fi
     if [[ ! -e "$path" ]]; then
       msg_warn "Skipping backup of '${path}' (not found)"
       continue
@@ -1338,7 +1339,6 @@ create_backup() {
     dest="${store}/files${path}"
     if ! mkdir -p "$(dirname "$dest")" || ! cp -a "$path" "$dest"; then
       msg_error "Backup of '${path}' failed - aborting update"
-      rm -rf "$store"
       exit 1
     fi
     echo "$path" >>"$manifest"
@@ -1466,7 +1466,7 @@ prompt_for_github_token() {
   fi
 
   local reply
-  read -rp "${TAB}Would you like to enter a GitHub Personal Access Token (PAT)? [y/N]: " reply
+  read -rp "${TAB}Would you like to enter a GitHub Personal Access Token (PAT)? [y/N]: " reply </dev/tty
   reply="${reply:-n}"
 
   if [[ ! "${reply,,}" =~ ^(y|yes)$ ]]; then
@@ -1475,7 +1475,7 @@ prompt_for_github_token() {
 
   local token
   while true; do
-    read -rp "${TAB}Enter your GitHub PAT: " token
+    read -rp "${TAB}Enter your GitHub PAT: " token </dev/tty
     # Trim leading/trailing whitespace
     token="$(echo "$token" | xargs)"
     if [[ -z "$token" ]]; then
@@ -2040,8 +2040,9 @@ cleanup_orphaned_sources() {
     local basename_file
     basename_file=$(basename "$sources_file")
 
-    # NEVER remove debian.sources - this is the standard Debian repository
+    # NEVER remove the distro's own base sources file (debian.sources,
-    if [[ "$basename_file" == "debian.sources" ]]; then
+    # ubuntu.sources, ...)
+    if [[ "$basename_file" == "$(get_os_info id).sources" ]]; then
       continue
     fi
 
@@ -2113,7 +2114,7 @@ ensure_apt_working() {
       # Step 4: More aggressive - remove all third-party sources
       msg_warn "APT update still failing, removing third-party sources"
       find /etc/apt/sources.list.d/ -type f \( -name "*.sources" -o -name "*.list" \) \
-        ! -name "debian.sources" -delete 2>/dev/null || true
+        ! -name "$(get_os_info id).sources" -delete 2>/dev/null || true
 
       # Final attempt
       if ! $STD apt update; then
@@ -2575,11 +2576,6 @@ _deploy_unpacked_archive() {
   local archive="$1" target="$2" workdir="$3"
   local filename="${archive##*/}"
 
-  mkdir -p "$target"
-  if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-    find "${target:?}" -mindepth 1 -delete
-  fi
-
   if [[ "$filename" == *.zip ]]; then
     ensure_dependencies unzip
     unzip -q "$archive" -d "$workdir" || {
@@ -2606,38 +2602,44 @@ _deploy_unpacked_archive() {
     return 65
   fi
 
-  local top_entries inner_dir
+  local top_entries inner_dir source_dir
   top_entries=$(find "$workdir" -mindepth 1 -maxdepth 1)
   if [[ "$(echo "$top_entries" | wc -l)" -eq 1 && -d "$top_entries" ]]; then
     inner_dir="$top_entries"
-    shopt -s dotglob nullglob
+    source_dir="$inner_dir"
-    if compgen -G "$inner_dir/*" >/dev/null; then
-      cp -r "$inner_dir"/* "$target/" || {
-        msg_error "Failed to copy contents from $inner_dir to $target"
-        shopt -u dotglob nullglob
-        return 252
-      }
-    else
-      msg_error "Inner directory is empty: $inner_dir"
-      shopt -u dotglob nullglob
-      return 252
-    fi
-    shopt -u dotglob nullglob
   else
-    shopt -s dotglob nullglob
+    source_dir="$workdir"
-    if compgen -G "$workdir/*" >/dev/null; then
+  fi
-      cp -r "$workdir"/* "$target/" || {
+
-        msg_error "Failed to copy contents to $target"
+  shopt -s dotglob nullglob
-        shopt -u dotglob nullglob
+  if ! compgen -G "$source_dir/*" >/dev/null; then
-        return 252
+    if [[ -n "$inner_dir" ]]; then
-      }
+      msg_error "Inner directory is empty: $inner_dir"
     else
       msg_error "Unpacked archive is empty"
-      shopt -u dotglob nullglob
-      return 252
     fi
     shopt -u dotglob nullglob
+    return 252
   fi
+
+  # <target> is only touched once the payload is known good. Wiping earlier left
+  # CLEAN_INSTALL callers with an empty target directory whenever the download
+  # was truncated, the archive was unreadable, or it unpacked to nothing.
+  mkdir -p "$target"
+  if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
+    find "${target:?}" -mindepth 1 -delete
+  fi
+
+  if ! cp -r "$source_dir"/* "$target/"; then
+    if [[ -n "$inner_dir" ]]; then
+      msg_error "Failed to copy contents from $inner_dir to $target"
+    else
+      msg_error "Failed to copy contents to $target"
+    fi
+    shopt -u dotglob nullglob
+    return 252
+  fi
+  shopt -u dotglob nullglob
   return 0
 }
 
@@ -2736,7 +2738,8 @@ get_latest_gl_tag() {
   local repo_encoded
   repo_encoded=$(printf '%s' "$repo" | sed 's|/|%2F|g')
 
-  local api_base="https://gitlab.com/api/v4/projects/${repo_encoded}/repository/tags"
+  local gitlab_url="${GITLAB_URL:-https://gitlab.com}"
+  local api_base="${gitlab_url}/api/v4/projects/${repo_encoded}/repository/tags"
   local api_timeout="--connect-timeout 10 --max-time 60"
 
   local header=()
@@ -2818,6 +2821,7 @@ get_latest_gl_tag() {
 # Notes:
 #   - Supports CLEAN_INSTALL=1 to wipe target before extracting
 #   - Supports GITLAB_TOKEN for private/rate-limited projects
+#   - Supports GITLAB_URL for self-hosted GitLab (default: https://gitlab.com)
 #   - For repos that only publish tags, not formal GitLab Releases
 #     (use fetch_and_deploy_gl_release for proper Releases with assets)
 # ------------------------------------------------------------------------------
@@ -2861,8 +2865,9 @@ fetch_and_deploy_gl_tag() {
   repo_encoded=$(printf '%s' "$repo" | sed 's|/|%2F|g')
 
   # GitLab source tarball URL (no release needed, works for any tag).
+  local gitlab_url="${GITLAB_URL:-https://gitlab.com}"
   local version_safe="${resolved_tag//\//-}"
-  local tarball_url="https://gitlab.com/${repo}/-/archive/${resolved_tag}/${app_lc}-${version_safe}.tar.gz"
+  local tarball_url="${gitlab_url}/${repo}/-/archive/${resolved_tag}/${app_lc}-${version_safe}.tar.gz"
 
   local tmpdir
   tmpdir=$(mktemp -d) || return 1
@@ -3970,7 +3975,7 @@ _gh_scan_older_releases() {
       local use_fallback="y"
       if [[ -t 0 ]]; then
         msg_warn "Release ${skip_tag} has no matching asset. Previous release ${rel_tag} has a compatible asset."
-        read -rp "Use version ${rel_tag} instead? [Y/n] (auto-yes in 60s): " -t 60 use_fallback || use_fallback="y"
+        read -rp "Use version ${rel_tag} instead? [Y/n] (auto-yes in 60s): " -t 60 use_fallback </dev/tty || use_fallback="y"
         use_fallback="${use_fallback:-y}"
       fi
 
@@ -4596,20 +4601,17 @@ setup_composer() {
 #   - By default uses distro repository (docker.io) for stability
 #   - Optionally uses official Docker repository for latest features
 #   - Detects and migrates old Docker installations
-#   - Optional: Installs/Updates Portainer CE
 #   - Updates running containers interactively
 #   - Cleans up legacy repository files
 #
 # Usage:
 #   setup_docker                              # Uses official Docker repo (recommended)
 #   USE_DOCKER_REPO=false setup_docker        # Uses distro docker.io package
-#   DOCKER_PORTAINER="true" setup_docker
 #   DOCKER_LOG_DRIVER="json-file" setup_docker
 #
 # Variables:
 #   USE_DOCKER_REPO        - Set to "false" to use distro docker.io package
 #                            (default: true, uses official Docker repository)
-#   DOCKER_PORTAINER       - Install Portainer CE (optional, "true" to enable)
 #   DOCKER_LOG_DRIVER      - Log driver (optional, default: "journald")
 #   DOCKER_SKIP_UPDATES    - Skip container update check (optional, "true" to skip)
 #
@@ -4620,16 +4622,62 @@ setup_composer() {
 #   - Interactive per-container update prompt (Y/N, 60 s auto-no)
 #   - Compose-managed containers: full restart via docker compose
 #   - Standalone containers: image pull only, no destructive stop/rm
-#   - Portainer installation and update support
+#   - Portainer is no longer managed here; use tools/addon/portainer.sh
 #   - Set DOCKER_NONINTERACTIVE=1 to skip interactive prompts (CI/unattended)
 # ------------------------------------------------------------------------------
 _docker_is_noninteractive() {
   [[ "${DOCKER_NONINTERACTIVE:-}" == "1" || "${DOCKER_NONINTERACTIVE:-}" == "true" || "${DOCKER_NONINTERACTIVE:-}" == "TRUE" ]] || [[ ! -t 0 ]]
 }
 
+# ------------------------------------------------------------------------------
+# ensure_docker()
+#
+# - Docker precondition for addon scripts that ship a compose stack
+# - Reuses an existing installation, otherwise offers to install Docker
+#   (Debian/Ubuntu via setup_docker, Alpine via apk)
+# - Aborts when the user declines or Compose is unavailable afterwards
+# ------------------------------------------------------------------------------
+ensure_docker() {
+  if command -v docker &>/dev/null; then
+    msg_ok "Docker $(docker --version | cut -d' ' -f3 | tr -d ',') is available"
+    if docker compose version &>/dev/null; then
+      msg_ok "Docker Compose is available"
+      return 0
+    fi
+    msg_error "Docker Compose plugin is not available. Please install it."
+    exit 237
+  fi
+
+  msg_warn "Docker is not installed."
+  echo -n "${TAB:-  }Install Docker now? (y/N): "
+  local install_docker_prompt
+  read -r install_docker_prompt
+  if [[ ! "${install_docker_prompt,,}" =~ ^(y|yes)$ ]]; then
+    msg_error "Docker is required for ${APP:-this script}. Exiting."
+    exit 254
+  fi
+
+  if is_alpine; then
+    msg_info "Installing Docker"
+    $STD apk add --no-cache docker docker-cli-compose
+    $STD rc-update add docker default
+    $STD rc-service docker start
+    msg_ok "Installed Docker"
+  else
+    setup_docker || {
+      msg_error "Docker installation failed."
+      exit 237
+    }
+  fi
+
+  if ! command -v docker &>/dev/null || ! docker compose version &>/dev/null; then
+    msg_error "Docker or the Compose plugin is still unavailable after installation."
+    exit 237
+  fi
+}
+
 setup_docker() {
   local docker_installed=false
-  local portainer_installed=false
   local USE_DOCKER_REPO="${USE_DOCKER_REPO:-true}"
 
   # Check if Docker is already installed
@@ -4639,12 +4687,6 @@ setup_docker() {
     msg_info "Docker $DOCKER_CURRENT_VERSION detected"
   fi
 
-  # Check if Portainer is running
-  if docker ps --format '{{.Names}}' 2>/dev/null | grep -q '^portainer$'; then
-    portainer_installed=true
-    msg_info "Portainer container detected"
-  fi
-
   # Scenario 1: Use distro repository (opt-out via USE_DOCKER_REPO=false)
   if [[ "$USE_DOCKER_REPO" != "true" && "$USE_DOCKER_REPO" != "TRUE" && "$USE_DOCKER_REPO" != "1" ]]; then
 
@@ -4758,58 +4800,10 @@ EOF
     systemctl enable -q --now docker
   fi
 
-  # Portainer Management (common for both modes)
-  if [[ "${DOCKER_PORTAINER:-}" == "true" ]]; then
-    if [ "$portainer_installed" = true ]; then
-      msg_info "Checking for Portainer updates"
-      PORTAINER_CURRENT=$(docker inspect portainer --format='{{.Config.Image}}' 2>/dev/null | cut -d':' -f2)
-      PORTAINER_LATEST=$(curl -fsSL https://registry.hub.docker.com/v2/repositories/portainer/portainer-ce/tags?page_size=100 | grep -oP '"name":"\K[0-9]+\.[0-9]+\.[0-9]+"' | head -1 | tr -d '"')
-
-      if [ "$PORTAINER_CURRENT" != "$PORTAINER_LATEST" ]; then
-        if _docker_is_noninteractive; then
-          msg_info "Skipping Portainer update prompt (non-interactive)"
-        else
-          read -r -p "${TAB3}Update Portainer $PORTAINER_CURRENT → $PORTAINER_LATEST? <y/N> " prompt
-          if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
-            msg_info "Updating Portainer"
-            docker stop portainer
-            docker rm portainer
-            docker pull portainer/portainer-ce:latest
-            docker run -d \
-              -p 9000:9000 \
-              -p 9443:9443 \
-              --name=portainer \
-              --restart=always \
-              -v /var/run/docker.sock:/var/run/docker.sock \
-              -v portainer_data:/data \
-              portainer/portainer-ce:latest
-            msg_ok "Updated Portainer to $PORTAINER_LATEST"
-          fi
-        fi
-      else
-        msg_ok "Portainer is up-to-date ($PORTAINER_CURRENT)"
-      fi
-    else
-      msg_info "Installing Portainer"
-      docker volume create portainer_data
-      docker run -d \
-        -p 9000:9000 \
-        -p 9443:9443 \
-        --name=portainer \
-        --restart=always \
-        -v /var/run/docker.sock:/var/run/docker.sock \
-        -v portainer_data:/data \
-        portainer/portainer-ce:latest
-
-      LOCAL_IP=$(hostname -I | awk '{print $1}')
-      msg_ok "Installed Portainer (http://${LOCAL_IP}:9000)"
-    fi
-  fi
-
   # Container Update Check
   # - Skipped entirely when running unattended / non-interactive
-  # - Compose-managed containers: offered via Y/N → docker compose pull + up -d
+  # - Lists containers with a newer image available and the command to update
-  # - Standalone containers: offered via Y/N → image pull only (no stop/rm)
+  #   them; does not pull/recreate anything itself
   if [ "$docker_installed" = true ] && ! _docker_is_noninteractive; then
     msg_info "Checking for container updates"
 
@@ -4821,7 +4815,7 @@ EOF
       name=$(echo "$line" | awk '{print $1}')
       image=$(echo "$line" | awk '{print $2}')
 
-      # Portainer containers are handled by the dedicated block above
+      # Portainer is managed by its own addon script, not this generic loop
       [[ "$name" == "portainer" || "$name" == "portainer_agent" ]] && continue
 
       current_digest=$(docker inspect "$name" --format='{{.Image}}' 2>/dev/null | cut -d':' -f2 | cut -c1-12)
@@ -4847,41 +4841,14 @@ EOF
     if [[ ${#compose_updates[@]} -eq 0 && ${#standalone_updates[@]} -eq 0 ]]; then
       msg_ok "All containers are up-to-date"
     else
-      local reply
+      msg_warn "Updates available (not applied automatically):"
       for entry in "${compose_updates[@]}"; do
         IFS='|' read -r name image compose_workdir compose_service <<<"$entry"
-        reply=""
+        echo -e "${TAB3}${name} (${image}) — update via: cd ${compose_workdir} && docker compose pull ${compose_service} && docker compose up -d ${compose_service}"
-        if read -r -t 60 -p "${TAB3}Update ${name} (${image}) via Compose? <y/N> (auto-no in 60s): " reply; then
-          echo ""
-        else
-          echo ""
-        fi
-        if [[ "${reply,,}" =~ ^(y|yes)$ ]]; then
-          msg_info "Updating $name"
-          if (cd "$compose_workdir" && $STD docker compose pull "$compose_service" && $STD docker compose up -d "$compose_service"); then
-            msg_ok "Updated $name"
-          else
-            msg_warn "Could not update $name — try manually in $compose_workdir"
-          fi
-        fi
       done
-
       for entry in "${standalone_updates[@]}"; do
         IFS='|' read -r name image <<<"$entry"
-        reply=""
+        echo -e "${TAB3}${name} (${image}) — update via: docker pull ${image} && docker restart ${name}"
-        if read -r -t 60 -p "${TAB3}Pull new image for ${name} (${image})? <y/N> (auto-no in 60s): " reply; then
-          echo ""
-        else
-          echo ""
-        fi
-        if [[ "${reply,,}" =~ ^(y|yes)$ ]]; then
-          msg_info "Pulling new image for $name"
-          if $STD docker pull "$image"; then
-            msg_ok "New image available for $name — recreate the container to apply the update"
-          else
-            msg_warn "Failed to pull image for $name"
-          fi
-        fi
       done
     fi
   fi
@@ -5464,7 +5431,7 @@ setup_hwaccel() {
     # Read with 60 second timeout
     local selection=""
     echo -n "Select GPU(s) to configure (1-${gpu_count}, A=all) [timeout 60s, default=all]: "
-    if read -r -t 60 selection; then
+    if read -r -t 60 selection </dev/tty; then
       selection="${selection^^}" # uppercase
     else
       echo ""
@@ -5512,7 +5479,7 @@ setup_hwaccel() {
       echo ""
       msg_custom "🎮" "${GN}" "NVIDIA GPU passthrough detected"
       local nvidia_reply=""
-      read -r -t 60 -p "${TAB3}⚙️ Install NVIDIA driver libraries in the container? [Y/n] (auto-yes in 60s): " nvidia_reply || nvidia_reply=""
+      read -r -t 60 -p "${TAB3}⚙️ Install NVIDIA driver libraries in the container? [Y/n] (auto-yes in 60s): " nvidia_reply </dev/tty || nvidia_reply=""
       case "${nvidia_reply,,}" in
       n | no) install_nvidia_drivers="no" ;;
       *) install_nvidia_drivers="yes" ;;
@@ -6947,6 +6914,60 @@ setup_mariadb_db() {
   export MARIADB_DB_PASS
 }
 
+# ------------------------------------------------------------------------------
+# Creates a MySQL database and user (for apps that require MySQL, not MariaDB).
+#
+# Description:
+#   - Creates database, user and grants using the mysql root socket login
+#   - The user is created with host '%' because MySQL treats 'localhost'
+#     (socket) and '127.0.0.1' (TCP) as distinct hosts; apps connecting over
+#     TCP to 127.0.0.1 would not match a 'localhost' account. mysql-server
+#     binds to 127.0.0.1 by default, so '%' stays local-only.
+#
+# Variables:
+#   MYSQL_DB_NAME   - Database name (required)
+#   MYSQL_DB_USER   - Database user (required)
+#   MYSQL_DB_PASS   - Password (optional, generated if unset)
+#
+# Exports:
+#   MYSQL_DB_NAME, MYSQL_DB_USER, MYSQL_DB_PASS
+#
+# Example:
+#   MYSQL_DB_NAME="fleet" MYSQL_DB_USER="fleet" setup_mysql_db
+# ------------------------------------------------------------------------------
+setup_mysql_db() {
+  if [[ -z "${MYSQL_DB_NAME:-}" || -z "${MYSQL_DB_USER:-}" ]]; then
+    msg_error "MYSQL_DB_NAME and MYSQL_DB_USER must be set before calling setup_mysql_db"
+    return 65
+  fi
+
+  if [[ -z "${MYSQL_DB_PASS:-}" ]]; then
+    MYSQL_DB_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
+  fi
+
+  msg_info "Setting up MySQL Database"
+
+  $STD mysql -u root -e "CREATE DATABASE \`${MYSQL_DB_NAME//\`/\`\`}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
+  $STD mysql -u root -e "CREATE USER '${MYSQL_DB_USER//\'/\'\'}'@'%' IDENTIFIED BY '${MYSQL_DB_PASS//\'/\'\'}';"
+  $STD mysql -u root -e "GRANT ALL ON \`${MYSQL_DB_NAME//\`/\`\`}\`.* TO '${MYSQL_DB_USER//\'/\'\'}'@'%';"
+  $STD mysql -u root -e "FLUSH PRIVILEGES;"
+
+  local app_name="${APPLICATION,,}"
+  local CREDS_FILE="${MYSQL_DB_CREDS_FILE:-${HOME}/${app_name}.creds}"
+  {
+    echo "MySQL Credentials"
+    echo "Database: $MYSQL_DB_NAME"
+    echo "User: $MYSQL_DB_USER"
+    echo "Password: $MYSQL_DB_PASS"
+  } >>"$CREDS_FILE"
+
+  msg_ok "Set up MySQL Database"
+
+  export MYSQL_DB_NAME
+  export MYSQL_DB_USER
+  export MYSQL_DB_PASS
+}
+
 # ------------------------------------------------------------------------------
 # Installs or updates MeiliSearch search engine.
 #
@@ -8195,22 +8216,17 @@ EOF
 # ------------------------------------------------------------------------------
 get_php_fpm_socket() {
   local sock
-
   if [[ -n "${PHP_VERSION:-}" && -S "/run/php/php${PHP_VERSION}-fpm.sock" ]]; then
     echo "/run/php/php${PHP_VERSION}-fpm.sock"
     return 0
   fi
-
   sock=$(find /run/php -maxdepth 1 -name "php*-fpm.sock" -type s 2>/dev/null | sort -V | tail -1)
-
   if [[ -z "$sock" ]]; then
     msg_error "No active PHP-FPM socket found under /run/php"
     return 1
   fi
-
   echo "$sock"
 }
-
 # ------------------------------------------------------------------------------
 # Enables an nginx site, validates the configuration and reloads the service.
 #
@@ -8232,25 +8248,20 @@ get_php_fpm_socket() {
 # ------------------------------------------------------------------------------
 nginx_enable_site() {
   local site="${1:-}"
-
   if [[ -z "$site" ]]; then
     msg_error "nginx_enable_site: no site name given"
     return 1
   fi
-
   if [[ ! -f "/etc/nginx/sites-available/${site}" ]]; then
     msg_error "nginx site config not found: /etc/nginx/sites-available/${site}"
     return 1
   fi
-
   rm -f /etc/nginx/sites-enabled/default /etc/nginx/sites-available/default
   ln -sf "/etc/nginx/sites-available/${site}" "/etc/nginx/sites-enabled/${site}"
-
   if ! $STD nginx -t; then
     msg_error "nginx configuration test failed for site '${site}'"
     return 1
   fi
-
   $STD systemctl enable -q nginx
   safe_service_restart nginx
 }
@@ -9447,11 +9458,12 @@ get_latest_gitlab_release() {
   local temp_file
   temp_file=$(mktemp)
 
+  local gitlab_url="${GITLAB_URL:-https://gitlab.com}"
   local http_code
   http_code=$(curl --connect-timeout 10 --max-time 30 -sSL \
     -w "%{http_code}" -o "$temp_file" \
     "${header[@]}" \
-    "https://gitlab.com/api/v4/projects/$repo_encoded/releases?per_page=1&order_by=released_at&sort=desc" 2>/dev/null) || true
+    "${gitlab_url}/api/v4/projects/$repo_encoded/releases?per_page=1&order_by=released_at&sort=desc" 2>/dev/null) || true
 
   if [[ "$http_code" != "200" ]]; then
     rm -f "$temp_file"
@@ -9493,6 +9505,7 @@ get_latest_gitlab_release() {
 # Notes:
 #   - Requires `jq` (auto-installed if missing)
 #   - Supports GITLAB_TOKEN env var for private/rate-limited repos
+#   - Supports GITLAB_URL for self-hosted GitLab (default: https://gitlab.com)
 #   - Does not modify anything, only checks version state
 # ------------------------------------------------------------------------------
 check_for_gl_release() {
@@ -9504,11 +9517,15 @@ check_for_gl_release() {
   local app_lc="${app,,}"
   local current_file="$HOME/.${app_lc}"
 
+  local gitlab_url="${GITLAB_URL:-https://gitlab.com}"
+  local gitlab_hostname="${gitlab_url#*://}"
+  gitlab_hostname="${gitlab_hostname%%/*}"
+
   msg_info "Checking for update: ${app}"
 
   # DNS check
-  if ! getent hosts gitlab.com >/dev/null 2>&1; then
+  if ! getent hosts "$gitlab_hostname" >/dev/null 2>&1; then
-    msg_error "Network error: cannot resolve gitlab.com"
+    msg_error "Network error: cannot resolve $gitlab_hostname"
     return 6
   fi
 
@@ -9531,7 +9548,7 @@ check_for_gl_release() {
     local pinned_encoded="${pinned_version_in//\//%2F}"
     http_code=$(curl -sSL --max-time 20 -w "%{http_code}" -o "$gl_check_json" \
       "${header[@]}" \
-      "https://gitlab.com/api/v4/projects/$repo_encoded/releases/$pinned_encoded" 2>/dev/null) || true
+      "${gitlab_url}/api/v4/projects/$repo_encoded/releases/$pinned_encoded" 2>/dev/null) || true
     if [[ "$http_code" == "200" ]] && [[ -s "$gl_check_json" ]]; then
       releases_json="[$(<"$gl_check_json")]"
     fi
@@ -9542,7 +9559,7 @@ check_for_gl_release() {
   if [[ -z "$releases_json" ]]; then
     http_code=$(curl -sSL --max-time 20 -w "%{http_code}" -o "$gl_check_json" \
       "${header[@]}" \
-      "https://gitlab.com/api/v4/projects/$repo_encoded/releases?per_page=100&order_by=released_at&sort=desc" 2>/dev/null) || true
+      "${gitlab_url}/api/v4/projects/$repo_encoded/releases?per_page=100&order_by=released_at&sort=desc" 2>/dev/null) || true
 
     if [[ "$http_code" == "200" ]] && [[ -s "$gl_check_json" ]]; then
       releases_json=$(<"$gl_check_json")
@@ -9566,7 +9583,7 @@ check_for_gl_release() {
       return 22
     elif [[ "$http_code" == "000" || -z "$http_code" ]]; then
       msg_error "GitLab API connection failed (no response)."
-      msg_error "Check your network/DNS: curl -sSL https://gitlab.com/api/v4/version"
+      msg_error "Check your network/DNS: curl -sSL ${gitlab_url}/api/v4/version"
       rm -f "$gl_check_json"
       return 7
     else
@@ -9760,7 +9777,7 @@ _gl_scan_older_releases() {
       local use_fallback="y"
       if [[ -t 0 ]]; then
         msg_warn "Release ${skip_tag} has no matching asset. Previous release ${rel_tag} has a compatible asset."
-        read -rp "Use version ${rel_tag} instead? [Y/n] (auto-yes in 60s): " -t 60 use_fallback || use_fallback="y"
+        read -rp "Use version ${rel_tag} instead? [Y/n] (auto-yes in 60s): " -t 60 use_fallback </dev/tty || use_fallback="y"
         use_fallback="${use_fallback:-y}"
       fi
 
@@ -9811,7 +9828,8 @@ fetch_and_deploy_gl_release() {
   local repo_encoded
   repo_encoded=$(printf '%s' "$repo" | sed 's|/|%2F|g')
 
-  local api_base="https://gitlab.com/api/v4/projects/$repo_encoded/releases"
+  local gitlab_url="${GITLAB_URL:-https://gitlab.com}"
+  local api_base="${gitlab_url}/api/v4/projects/$repo_encoded/releases"
   local api_url
   if [[ "$version" != "latest" ]]; then
     api_url="$api_base/$version"
@@ -9860,7 +9878,7 @@ fetch_and_deploy_gl_release() {
       msg_error "  export GITLAB_TOKEN=\"glpat-your_token_here\""
     elif [[ "$http_code" == "000" || -z "$http_code" ]]; then
       msg_error "GitLab API connection failed (no response)."
-      msg_error "Check your network/DNS: curl -sSL https://gitlab.com/api/v4/version"
+      msg_error "Check your network/DNS: curl -sSL ${gitlab_url}/api/v4/version"
     else
       msg_error "Failed to fetch release metadata (HTTP $http_code)"
     fi
@@ -9915,7 +9933,7 @@ fetch_and_deploy_gl_release() {
 
   ### Tarball Mode ###
   if [[ "$mode" == "tarball" || "$mode" == "source" ]]; then
-    local direct_tarball_url="https://gitlab.com/$repo/-/archive/$tag_name/${app_lc}-${version_safe}.tar.gz"
+    local direct_tarball_url="${gitlab_url}/$repo/-/archive/$tag_name/${app_lc}-${version_safe}.tar.gz"
     filename="${app_lc}-${version_safe}.tar.gz"
 
     _download_source_tarball "$direct_tarball_url" "$tmpdir/$filename" "${header[@]}" || {
@@ -9963,7 +9981,7 @@ fetch_and_deploy_gl_release() {
 
     if [[ -z "$url_match" ]]; then
       local fallback_json
-      if fallback_json=$(_gl_scan_older_releases "$repo" "$repo_encoded" "https://gitlab.com" "binary" "$asset_pattern" "$tag_name"); then
+      if fallback_json=$(_gl_scan_older_releases "$repo" "$repo_encoded" "$gitlab_url" "binary" "$asset_pattern" "$tag_name"); then
         json="$fallback_json"
         tag_name=$(echo "$json" | jq -r '.tag_name // empty')
         [[ "$tag_name" =~ ^v[0-9] ]] && version="${tag_name:1}" || version="$tag_name"
@@ -10035,7 +10053,7 @@ fetch_and_deploy_gl_release() {
 
     if [[ -z "$asset_url" ]]; then
       local fallback_json
-      if fallback_json=$(_gl_scan_older_releases "$repo" "$repo_encoded" "https://gitlab.com" "prebuild" "$pattern" "$tag_name"); then
+      if fallback_json=$(_gl_scan_older_releases "$repo" "$repo_encoded" "$gitlab_url" "prebuild" "$pattern" "$tag_name"); then
         json="$fallback_json"
         tag_name=$(echo "$json" | jq -r '.tag_name // empty')
         [[ "$tag_name" =~ ^v[0-9] ]] && version="${tag_name:1}" || version="$tag_name"
@@ -10088,7 +10106,7 @@ fetch_and_deploy_gl_release() {
 
     if [[ -z "$asset_url" ]]; then
       local fallback_json
-      if fallback_json=$(_gl_scan_older_releases "$repo" "$repo_encoded" "https://gitlab.com" "singlefile" "$pattern" "$tag_name"); then
+      if fallback_json=$(_gl_scan_older_releases "$repo" "$repo_encoded" "$gitlab_url" "singlefile" "$pattern" "$tag_name"); then
         json="$fallback_json"
         tag_name=$(echo "$json" | jq -r '.tag_name // empty')
         [[ "$tag_name" =~ ^v[0-9] ]] && version="${tag_name:1}" || version="$tag_name"

tools/addon/actual-budget-prometheus-exporter.sh

@@ -7,8 +7,13 @@
 
 if ! command -v curl &>/dev/null; then
   printf "\r\e[2K%b" '\033[93m Setup Source \033[m' >&2
-  apt-get update >/dev/null 2>&1
+  if [[ -f /etc/alpine-release ]]; then
-  apt-get install -y curl >/dev/null 2>&1
+    apk update >/dev/null 2>&1
+    apk add --no-cache curl >/dev/null 2>&1
+  else
+    apt-get update >/dev/null 2>&1
+    apt-get install -y curl >/dev/null 2>&1
+  fi
 fi
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/core.func)
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/tools.func)
@@ -20,6 +25,7 @@ declare -f init_tool_telemetry &>/dev/null && init_tool_telemetry "actual-budget
 set -Eeuo pipefail
 trap 'error_handler' ERR
 load_functions
+require_debian_like
 
 # ==============================================================================
 # CONFIGURATION
@@ -31,14 +37,6 @@ INSTALL_PATH="/opt/actual-budget-prometheus-exporter"
 CONFIG_PATH="/opt/actual-budget-prometheus-exporter.env"
 SERVICE_PATH="/etc/systemd/system/actual-budget-prometheus-exporter.service"
 
-# ==============================================================================
-# OS DETECTION
-# ==============================================================================
-if ! grep -qE 'ID=debian|ID=ubuntu' /etc/os-release 2>/dev/null; then
-  echo -e "${CROSS} Unsupported OS detected. This script only supports Debian and Ubuntu."
-  exit 238
-fi
-
 # ==============================================================================
 # UNINSTALL
 # ==============================================================================

tools/addon/add-netbird-lxc.sh

@@ -6,39 +6,45 @@
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://netbird.io/ | Github: https://github.com/netbirdio/netbird
 
-function header_info {
+APP="add-netbird-lxc"
-  clear
+APP_TYPE="addon"
-  cat <<"EOF"
-    _   __     __  ____  _          __
-   / | / /__  / /_/ __ )(_)________/ /
-  /  |/ / _ \/ __/ __  / / ___/ __  / 
- / /|  /  __/ /_/ /_/ / / /  / /_/ / 
-/_/ |_/\___/\__/_____/_/_/   \__,_/  
 
-EOF
+if ! command -v curl &>/dev/null; then
-}
+  printf "\r\e[2K%b" '\033[93m Setup Source \033[m' >&2
-header_info
+  if [[ -f /etc/alpine-release ]]; then
-set -e
+    apk update >/dev/null 2>&1
-
+    apk add --no-cache curl >/dev/null 2>&1
-# Telemetry
+  else
+    apt-get update >/dev/null 2>&1
+    apt-get install -y curl >/dev/null 2>&1
+  fi
+fi
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/core.func)
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/tools.func)
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/error_handler.func)
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/api.func) 2>/dev/null || true
 declare -f init_tool_telemetry &>/dev/null && init_tool_telemetry "add-netbird-lxc" "addon"
 
+# Enable error handling
+set -Eeuo pipefail
+trap 'error_handler' ERR
+
+# Initialize all core functions (colors, formatting, icons, STD mode)
+load_functions
+
+header_info
+require_pve_host
+
 while true; do
-  read -p "This will add NetBird to an existing LXC Container ONLY. Proceed(y/n)?" yn
+  read -r -p "This will add NetBird to an existing LXC Container ONLY. Proceed(y/n)? " yn
   case $yn in
   [Yy]*) break ;;
-  [Nn]*) exit ;;
+  [Nn]*) exit 0 ;;
   *) echo "Please answer yes or no." ;;
   esac
 done
-header_info
-echo "Loading..."
 
-function msg() {
+echo -e "Loading container list..."
-  local TEXT="$1"
-  echo -e "$TEXT"
-}
 
 NODE=$(hostname)
 MSG_MAX_LENGTH=0
@@ -61,37 +67,51 @@ done
 
 LXC_STATUS=$(pct status "$CTID" | awk '{print $2}')
 if [[ "$LXC_STATUS" != "running" ]]; then
-  msg "\e[1;33m The container $CTID is not running. Starting it now...\e[0m"
+  msg_info "Container $CTID is not running. Starting it now..."
   pct start "$CTID"
   while [[ "$(pct status "$CTID" | awk '{print $2}')" != "running" ]]; do
-    msg "\e[1;33m Waiting for the container to start...\e[0m"
+    msg_info "Waiting for the container to start..."
     sleep 2
   done
-  msg "\e[1;32m Container $CTID is now running.\e[0m"
+  msg_ok "Container $CTID is now running."
 fi
 
 DISTRO=$(pct exec "$CTID" -- cat /etc/os-release | grep -w "ID" | cut -d'=' -f2 | tr -d '"')
 if [[ "$DISTRO" != "debian" && "$DISTRO" != "ubuntu" ]]; then
-  msg "\e[1;31m Error: This script only supports Debian or Ubuntu LXC containers. Detected: $DISTRO. Aborting...\e[0m"
+  msg_error "This script only supports Debian or Ubuntu LXC containers. Detected: $DISTRO. Aborting..."
   exit 238
 fi
 
-CTID_CONFIG_PATH=/etc/pve/lxc/${CTID}.conf
+CTID_CONFIG_PATH="/etc/pve/lxc/${CTID}.conf"
-cat <<EOF >>$CTID_CONFIG_PATH
+cat <<EOF >>"$CTID_CONFIG_PATH"
 lxc.cgroup2.devices.allow: c 10:200 rwm
 lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file
 EOF
-header_info
+
-msg "Installing NetBird..."
+msg_info "Installing NetBird"
 pct exec "$CTID" -- bash -c '
+set -e
 if ! command -v curl &>/dev/null; then
   apt-get update -qq
   apt-get install -y curl >/dev/null
 fi
-apt install -y ca-certificates gpg &>/dev/null
+apt-get install -y ca-certificates gpg &>/dev/null
-curl -fsSL "https://pkgs.netbird.io/debian/public.key" | gpg --dearmor >/usr/share/keyrings/netbird-archive-keyring.gpg
+
-echo "deb [signed-by=/usr/share/keyrings/netbird-archive-keyring.gpg] https://pkgs.netbird.io/debian stable main" >/etc/apt/sources.list.d/netbird.list
+# Reuse the shared repository helper instead of hand-rolling the sources entry
-apt-get update &>/dev/null
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/core.func)
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/tools.func)
+load_functions
+
+# Drop the legacy keyring from the pre-deb822 layout
+rm -f /usr/share/keyrings/netbird-archive-keyring.gpg
+
+setup_deb822_repo \
+  "netbird" \
+  "https://pkgs.netbird.io/debian/public.key" \
+  "https://pkgs.netbird.io/debian" \
+  "stable" \
+  "main"
+
 apt-get install -y netbird-ui &>/dev/null
 if systemctl list-unit-files docker.service &>/dev/null; then
   mkdir -p /etc/systemd/system/netbird.service.d
@@ -103,6 +123,5 @@ OVERRIDE
   systemctl daemon-reload
 fi
 '
-msg "\e[1;32m ✔ Installed NetBird.\e[0m"
+msg_ok "Installed NetBird."
-sleep 2
+echo -e "${YW}Reboot ${CTID} LXC${CL} to apply the changes, then run 'netbird up' in the LXC console"
-msg "\e[1;31m Reboot ${CTID} LXC to apply the changes, then run netbird up in the LXC console\e[0m"

tools/addon/add-tailscale-lxc.sh

@@ -5,35 +5,34 @@
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://tailscale.com/ | Github: https://github.com/tailscale/tailscale
 
-set -Eeuo pipefail
+APP="add-tailscale-lxc"
-trap 'echo -e "\n[ERROR] in line $LINENO: exit code $?"' ERR
+APP_TYPE="addon"
 
-function header_info() {
+if ! command -v curl &>/dev/null; then
-  clear
+  printf "\r\e[2K%b" '\033[93m Setup Source \033[m' >&2
-  cat <<"EOF"
+  if [[ -f /etc/alpine-release ]]; then
-  ______      _ __                __
+    apk update >/dev/null 2>&1
- /_  __/___ _(_) /_____________ _/ /__
+    apk add --no-cache curl >/dev/null 2>&1
-  / / / __ `/ / / ___/ ___/ __ `/ / _ \
+  else
- / / / /_/ / / (__  ) /__/ /_/ / /  __/
+    apt-get update >/dev/null 2>&1
-/_/  \__,_/_/_/____/\___/\__,_/_/\___/
+    apt-get install -y curl >/dev/null 2>&1
-
+  fi
-EOF
+fi
-}
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/core.func)
-
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/tools.func)
-function msg_info() { echo -e " \e[1;36m➤\e[0m $1"; }
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/error_handler.func)
-function msg_ok() { echo -e " \e[1;32m✔\e[0m $1"; }
-function msg_error() { echo -e " \e[1;31m✖\e[0m $1"; }
-
-# Telemetry
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/api.func) 2>/dev/null || true
 declare -f init_tool_telemetry &>/dev/null && init_tool_telemetry "add-tailscale-lxc" "addon"
 
-header_info
+# Enable error handling
+set -Eeuo pipefail
+trap 'error_handler' ERR
 
-if ! command -v pveversion &>/dev/null; then
+# Initialize all core functions (colors, formatting, icons, STD mode)
-  msg_error "This script must be run on the Proxmox VE host (not inside an LXC container)"
+load_functions
-  exit 232
+
-fi
+header_info
+require_pve_host
 
 while true; do
   read -rp "This will add Tailscale to an existing LXC Container ONLY. Proceed (y/n)? " yn
@@ -44,7 +43,6 @@ while true; do
   esac
 done
 
-header_info
 msg_info "Loading container list..."
 
 NODE=$(hostname)
@@ -73,10 +71,9 @@ CTID_CONFIG_PATH="/etc/pve/lxc/${CTID}.conf"
 grep -q "lxc.cgroup2.devices.allow: c 10:200 rwm" "$CTID_CONFIG_PATH" || echo "lxc.cgroup2.devices.allow: c 10:200 rwm" >>"$CTID_CONFIG_PATH"
 grep -q "lxc.mount.entry: /dev/net/tun" "$CTID_CONFIG_PATH" || echo "lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file" >>"$CTID_CONFIG_PATH"
 
-header_info
 msg_info "Installing Tailscale in CT $CTID"
 
-pct exec "$CTID" -- sh -c '
+pct exec "$CTID" -- bash -c '
 set -e
 
 # Detect OS inside container
@@ -144,16 +141,21 @@ else
     apt-get install -y curl >/dev/null
   fi
 
-  # Ensure keyrings directory exists
+  # Reuse the shared repository helper instead of hand-rolling the sources entry
-  mkdir -p /usr/share/keyrings
+  source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/core.func)
+  source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/tools.func)
+  load_functions
 
-  curl -fsSL "https://pkgs.tailscale.com/stable/${ID}/${VERSION_CODENAME}.noarmor.gpg" \
+  # Drop the legacy keyring from the pre-deb822 layout
-    | tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null
+  rm -f /usr/share/keyrings/tailscale-archive-keyring.gpg
 
-  echo "deb [signed-by=/usr/share/keyrings/tailscale-archive-keyring.gpg] https://pkgs.tailscale.com/stable/${ID} ${VERSION_CODENAME} main" \
+  setup_deb822_repo \
-    >/etc/apt/sources.list.d/tailscale.list
+    "tailscale" \
+    "https://pkgs.tailscale.com/stable/${ID}/${VERSION_CODENAME}.noarmor.gpg" \
+    "https://pkgs.tailscale.com/stable/${ID}" \
+    "${VERSION_CODENAME}" \
+    "main"
 
-  apt-get update -qq
   apt-get install -y tailscale >/dev/null
 
   if [ -f /tmp/resolv.conf.backup ]; then
@@ -168,4 +170,4 @@ TAGS="${TAGS:+$TAGS; }tailscale"
 pct set "$CTID" -tags "$TAGS"
 
 msg_ok "Tailscale installed on CT $CTID"
-msg_info "Reboot the container, then run 'tailscale up' inside the container to activate."
+echo -e "${YW}Reboot the container${CL}, then run 'tailscale up' inside the container to activate."

tools/addon/adguardhome-sync.sh

@@ -7,8 +7,9 @@
 
 if ! command -v curl &>/dev/null; then
   printf "\r\e[2K%b" '\033[93m Setup Source \033[m' >&2
-  if [[ -f "/etc/alpine-release" ]]; then
+  if [[ -f /etc/alpine-release ]]; then
-    apk -U add curl >/dev/null 2>&1
+    apk update >/dev/null 2>&1
+    apk add --no-cache curl >/dev/null 2>&1
   else
     apt-get update >/dev/null 2>&1
     apt-get install -y curl >/dev/null 2>&1
@@ -36,28 +37,6 @@ DEFAULT_PORT=8080
 # Initialize all core functions (colors, formatting, icons, STD mode)
 load_functions
 
-# ==============================================================================
-# HEADER
-# ==============================================================================
-function header_info {
-  clear
-  cat <<"EOF"
-    ___       __                          ____  __                        _____
-   /   | ____/ /___ ___  ______ __________/ / / / /___  ____ ___  ___     / ___/__  ______  _____
-  / /| |/ __  / __ `/ / / / __ `/ ___/ __  / /_/ / __ \/ __ `__ \/ _ \    \__ \/ / / / __ \/ ___/
- / ___ / /_/ / /_/ / /_/ / /_/ / /  / /_/ / __  / /_/ / / / / / /  __/   ___/ / /_/ / / / / /__
-/_/  |_\__,_/\__, /\__,_/\__,_/_/   \__,_/_/ /_/\____/_/ /_/ /_/\___/   /____/\__, /_/ /_/\___/
-            /____/                                                           /____/
-EOF
-}
-
-# ==============================================================================
-# HELPER FUNCTIONS
-# ==============================================================================
-get_ip() {
-  hostname -I 2>/dev/null | awk '{print $1}' || ip -4 addr show scope global 2>/dev/null | awk '/inet / {print $2}' | cut -d/ -f1 | head -n1 || echo "127.0.0.1"
-}
-
 # ==============================================================================
 # OS DETECTION
 # ==============================================================================
@@ -114,16 +93,12 @@ function update() {
     fi
     msg_ok "Stopped service"
 
-    msg_info "Backing up configuration"
+    BACKUP_DIR="/opt/adguardhome-sync_backup"
-    cp "$CONFIG_PATH" /tmp/adguardhome-sync.yaml.bak 2>/dev/null || true
+    create_backup "$CONFIG_PATH"
-    msg_ok "Backed up configuration"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "adguardhome-sync" "bakito/adguardhome-sync" "prebuild" "latest" "$INSTALL_PATH" "adguardhome-sync_*_linux_amd64.tar.gz"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "adguardhome-sync" "bakito/adguardhome-sync" "prebuild" "latest" "$INSTALL_PATH" "adguardhome-sync_*_linux_$(arch_resolve).tar.gz"
 
-    msg_info "Restoring configuration"
+    restore_backup
-    cp /tmp/adguardhome-sync.yaml.bak "$CONFIG_PATH" 2>/dev/null || true
-    rm -f /tmp/adguardhome-sync.yaml.bak
-    msg_ok "Restored configuration"
 
     msg_info "Starting service"
     if [[ "$OS" == "Alpine" ]]; then
@@ -141,10 +116,7 @@ function update() {
 # INSTALL
 # ==============================================================================
 function install() {
-  local ip
+  fetch_and_deploy_gh_release "adguardhome-sync" "bakito/adguardhome-sync" "prebuild" "latest" "$INSTALL_PATH" "adguardhome-sync_*_linux_$(arch_resolve).tar.gz"
-  ip=$(get_ip)
-
-  fetch_and_deploy_gh_release "adguardhome-sync" "bakito/adguardhome-sync" "prebuild" "latest" "$INSTALL_PATH" "adguardhome-sync_*_linux_amd64.tar.gz"
 
   # Gather configuration from user
   echo ""
@@ -153,7 +125,7 @@ function install() {
   echo ""
 
   # Origin instance
-  echo -e "${YW}── Origin (Primary) Instance ──${CL}"
+  echo -e "${YW}── Origin (Primary) Instance ──${CL}"
   local origin_url origin_user origin_pass
   read -rp "  Origin URL (e.g., http://192.168.1.1): " origin_url
   origin_url="${origin_url:-http://192.168.1.1}"
@@ -167,7 +139,7 @@ function install() {
 
   # Replica instance
   echo ""
-  echo -e "${YW}── Replica Instance ──${CL}"
+  echo -e "${YW}── Replica Instance ──${CL}"
   local replica_url replica_user replica_pass
   read -rp "  Replica URL (e.g., http://192.168.1.2): " replica_url
   replica_url="${replica_url:-http://192.168.1.2}"
@@ -293,7 +265,7 @@ UPDATEEOF
 
   echo ""
   msg_ok "${APP} installed successfully"
-  msg_ok "Web UI: ${BL}http://${ip}:${DEFAULT_PORT}${CL}"
+  msg_ok "Web UI: ${BL}http://${IP}:${DEFAULT_PORT}${CL}"
   msg_ok "Config: ${BL}${CONFIG_PATH}${CL}"
   echo ""
   msg_warn "Edit the config file to add your AdGuardHome instances!"
@@ -319,7 +291,8 @@ fi
 
 header_info
 
-IP=$(get_ip)
+get_lxc_ip
+IP="$LOCAL_IP"
 
 # Check if already installed
 if [[ -d "$INSTALL_PATH" && -f "$INSTALL_PATH/adguardhome-sync" ]]; then

tools/addon/all-templates.sh

@@ -1,52 +1,40 @@
 #!/usr/bin/env bash
+
 # Copyright (c) 2021-2026 tteck
 # Author: tteck (tteckster)
-# License: MIT
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 
-function header_info {
+APP="all-templates"
-  clear
+APP_TYPE="addon"
-  cat <<"EOF"
-   ___   ____  ______               __     __
-  / _ | / / / /_  __/__ __ _  ___  / /__ _/ /____ ___
- / __ |/ / /   / / / -_)  ' \/ _ \/ / _ `/ __/ -_|_-<
-/_/ |_/_/_/   /_/  \__/_/_/_/ .__/_/\_,_/\__/\__/___/
-                           /_/
-EOF
-}
 
-set -eEuo pipefail
+if ! command -v curl &>/dev/null; then
-shopt -s expand_aliases
+  printf "\r\e[2K%b" '\033[93m Setup Source \033[m' >&2
-alias die='EXIT=$? LINE=$LINENO error_exit'
+  if [[ -f /etc/alpine-release ]]; then
-trap die ERR
+    apk update >/dev/null 2>&1
-function error_exit() {
+    apk add --no-cache curl >/dev/null 2>&1
-  trap - ERR
+  else
-  local DEFAULT='Unknown failure occured.'
+    apt-get update >/dev/null 2>&1
-  local REASON="\e[97m${1:-$DEFAULT}\e[39m"
+    apt-get install -y curl >/dev/null 2>&1
-  local FLAG="\e[91m[ERROR] \e[93m$EXIT@$LINE"
+  fi
-  msg "$FLAG $REASON" 1>&2
+fi
-  [ ! -z ${CTID-} ] && cleanup_ctid
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/core.func)
-  exit $EXIT
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/tools.func)
-}
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/error_handler.func)
-function warn() {
-  local REASON="\e[97m$1\e[39m"
-  local FLAG="\e[93m[WARNING]\e[39m"
-  msg "$FLAG $REASON"
-}
-function info() {
-  local REASON="$1"
-  local FLAG="\e[36m[INFO]\e[39m"
-  msg "$FLAG $REASON"
-}
-function msg() {
-  local TEXT="$1"
-  echo -e "$TEXT"
-}
-
-# Telemetry
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/api.func) 2>/dev/null || true
 declare -f init_tool_telemetry &>/dev/null && init_tool_telemetry "all-templates" "addon"
 
+# Enable error handling; destroy any partially-created container before reporting the error
+set -Eeuo pipefail
+function _cleanup_on_error() {
+  local ec=$? cmd="$BASH_COMMAND"
+  [[ -n "${CTID:-}" ]] && cleanup_ctid
+  error_handler "$ec" "$cmd"
+}
+trap '_cleanup_on_error' ERR
+
+# Initialize all core functions (colors, formatting, icons, STD mode)
+load_functions
+
 function validate_container_id() {
   local ctid="$1"
   # Check if ID is numeric
@@ -79,12 +67,14 @@ function cleanup_ctid() {
   fi
 }
 
+header_info
+require_pve_host
+
 # Stop Proxmox VE Monitor-All if running
 if systemctl is-active -q ping-instances.service; then
   systemctl stop ping-instances.service
 fi
-header_info
+msg_info "Loading"
-echo "Loading..."
 pveam update >/dev/null 2>&1
 whiptail --backtitle "Proxmox VE Helper Scripts" --title "All Templates" --yesno "This will allow for the creation of one of the many Template LXC Containers. Proceed?" 10 68
 TEMPLATE_MENU=()
@@ -97,8 +87,8 @@ done < <(pveam available)
 TEMPLATE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "All Template LXCs" --radiolist "\nSelect a Template LXC to create:\n" 16 $((MSG_MAX_LENGTH + 58)) 10 "${TEMPLATE_MENU[@]}" 3>&1 1>&2 2>&3 | tr -d '"')
 [ -z "$TEMPLATE" ] && {
   whiptail --backtitle "Proxmox VE Helper Scripts" --title "No Template LXC Selected" --msgbox "It appears that no Template LXC container was selected" 10 68
-  msg "Done"
+  echo "Done"
-  exit
+  exit 0
 }
 
 # Setup script environment
@@ -108,9 +98,9 @@ PASS="$(openssl rand -base64 8)"
 # Get valid Container ID
 CTID=$(pvesh get /cluster/nextid)
 if ! validate_container_id "$CTID"; then
-  warn "Container ID $CTID is already in use."
+  msg_warn "Container ID $CTID is already in use."
   CTID=$(get_valid_container_id "$CTID")
-  info "Using next available ID: $CTID"
+  msg_info "Using next available ID: $CTID"
 fi
 
 PCT_OPTIONS="
@@ -142,7 +132,10 @@ function select_storage() {
     CONTENT='vztmpl'
     CONTENT_LABEL='Container template'
     ;;
-  *) false || die "Invalid storage class." ;;
+  *)
+    msg_error "Invalid storage class."
+    exit 112
+    ;;
   esac
 
   # Query all storage locations
@@ -161,8 +154,9 @@ function select_storage() {
 
   # Select storage location
   if [ $((${#MENU[@]} / 3)) -eq 0 ]; then
-    warn "'$CONTENT_LABEL' needs to be selected for at least one storage location."
+    msg_warn "'$CONTENT_LABEL' needs to be selected for at least one storage location."
-    die "Unable to detect valid storage location."
+    msg_error "Unable to detect valid storage location."
+    if [[ "$CONTENT" == "rootdir" ]]; then exit 119; else exit 120; fi
   elif [ $((${#MENU[@]} / 3)) -eq 1 ]; then
     printf ${MENU[0]}
   else
@@ -171,43 +165,54 @@ function select_storage() {
       STORAGE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "Storage Pools" --radiolist \
         "Which storage pool would you like to use for the ${CONTENT_LABEL,,}?\n\n" \
         16 $(($MSG_MAX_LENGTH + 23)) 6 \
-        "${MENU[@]}" 3>&1 1>&2 2>&3) || die "Menu aborted."
+        "${MENU[@]}" 3>&1 1>&2 2>&3) || {
+        msg_error "Menu aborted."
+        exit 254
+      }
     done
     printf $STORAGE
   fi
 }
-header_info
+
 # Get template storage
 TEMPLATE_STORAGE=$(select_storage template)
-info "Using '$TEMPLATE_STORAGE' for template storage."
+msg_info "Using '$TEMPLATE_STORAGE' for template storage."
 
 # Get container storage
 CONTAINER_STORAGE=$(select_storage container)
-info "Using '$CONTAINER_STORAGE' for container storage."
+msg_info "Using '$CONTAINER_STORAGE' for container storage."
 
 # Download template
-msg "Downloading LXC template (Patience)..."
+msg_info "Downloading LXC template (Patience)"
-pveam download $TEMPLATE_STORAGE $TEMPLATE >/dev/null || die "A problem occured while downloading the LXC template."
+pveam download $TEMPLATE_STORAGE $TEMPLATE >/dev/null || {
+  msg_error "A problem occured while downloading the LXC template."
+  exit 222
+}
+msg_ok "Downloaded LXC template"
 
 # Create variable for 'pct' options
 PCT_OPTIONS=(${PCT_OPTIONS[@]:-${DEFAULT_PCT_OPTIONS[@]}})
-[[ " ${PCT_OPTIONS[@]} " =~ " -rootfs " ]] || PCT_OPTIONS+=(-rootfs $CONTAINER_STORAGE:${PCT_DISK_SIZE:-8})
+[[ " ${PCT_OPTIONS[*]} " =~ " -rootfs " ]] || PCT_OPTIONS+=(-rootfs $CONTAINER_STORAGE:${PCT_DISK_SIZE:-8})
 
 # Create LXC
-msg "Creating LXC container..."
+msg_info "Creating LXC container"
-pct create $CTID ${TEMPLATE_STORAGE}:vztmpl/${TEMPLATE} ${PCT_OPTIONS[@]} >/dev/null ||
+pct create $CTID ${TEMPLATE_STORAGE}:vztmpl/${TEMPLATE} "${PCT_OPTIONS[@]}" >/dev/null || {
-  die "A problem occured while trying to create container."
+  msg_error "A problem occured while trying to create container."
+  exit 209
+}
+msg_ok "Created LXC container"
 
 # Save password
 echo "$NAME password: ${PASS}" >>~/$NAME.creds # file is located in the Proxmox root directory
 
 # Start container
-msg "Starting LXC Container..."
+msg_info "Starting LXC Container"
 pct start "$CTID"
 sleep 5
+msg_ok "Started LXC Container"
 
 # Get container IP
-set +eEuo pipefail
+set +Eeuo pipefail
 max_attempts=5
 attempt=1
 IP=""
@@ -216,30 +221,29 @@ while [[ $attempt -le $max_attempts ]]; do
   if [[ -n $IP ]]; then
     break
   else
-    warn "Attempt $attempt: IP address not found. Pausing for 5 seconds..."
+    msg_warn "Attempt $attempt: IP address not found. Pausing for 5 seconds..."
     sleep 5
     ((attempt++))
   fi
 done
 
 if [[ -z $IP ]]; then
-  warn "Maximum number of attempts reached. IP address not found."
+  msg_warn "Maximum number of attempts reached. IP address not found."
   IP="NOT FOUND"
 fi
 
-set -eEuo pipefail
+set -Eeuo pipefail
 # Start Proxmox VE Monitor-All if available
 if [[ -f /etc/systemd/system/ping-instances.service ]]; then
   systemctl start ping-instances.service
 fi
 
 # Success message
-header_info
 echo
-info "LXC container '$CTID' was successfully created, and its IP address is ${IP}."
+msg_ok "LXC container '$CTID' was successfully created, and its IP address is ${IP}."
 echo
-info "Proceed to the LXC console to complete the setup."
+echo -e "${YW}Proceed to the LXC console to complete the setup.${CL}"
 echo
-info "login: root"
+echo -e "${YW}login: root${CL}"
-info "password: $PASS"
+echo -e "${YW}password: $PASS${CL}"
 echo

tools/addon/arcane.sh

@@ -6,8 +6,13 @@
 # Source: https://github.com/getarcaneapp/arcane
 if ! command -v curl &>/dev/null; then
   printf "\r\e[2K%b" '\033[93m Setup Source \033[m' >&2
-  apt-get update >/dev/null 2>&1
+  if [[ -f /etc/alpine-release ]]; then
-  apt-get install -y curl >/dev/null 2>&1
+    apk update >/dev/null 2>&1
+    apk add --no-cache curl >/dev/null 2>&1
+  else
+    apt-get update >/dev/null 2>&1
+    apt-get install -y curl >/dev/null 2>&1
+  fi
 fi
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/core.func)
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/tools.func)
@@ -32,21 +37,6 @@ DEFAULT_PORT=3552
 # Initialize all core functions (colors, formatting, icons, STD mode)
 load_functions
 
-# ==============================================================================
-# HEADER
-# ==============================================================================
-function header_info {
-  clear
-  cat <<"EOF"
-    ___    ____  _________    _   ________
-   /   |  / __ \/ ____/   |  / | / / ____/
-  / /| | / /_/ / /   / /| | /  |/ / __/
- / ___ |/ _, _/ /___/ ___ |/ /|  / /___
-/_/  |_/_/ |_|\____/_/  |_/_/ |_/_____/
-
-EOF
-}
-
 # ==============================================================================
 # UNINSTALL
 # ==============================================================================
@@ -82,26 +72,11 @@ function update() {
   exit
 }
 
-# ==============================================================================
-# CHECK DOCKER
-# ==============================================================================
-function check_docker() {
-  if ! command -v docker &>/dev/null; then
-    msg_error "Docker is not installed. This script requires an existing Docker LXC. Exiting."
-    exit 10
-  fi
-  if ! docker compose version &>/dev/null; then
-    msg_error "Docker Compose plugin is not available. Please install it before running this script. Exiting."
-    exit 10
-  fi
-  msg_ok "Docker $(docker --version | cut -d' ' -f3 | tr -d ',') and Docker Compose are available"
-}
-
 # ==============================================================================
 # INSTALL
 # ==============================================================================
 function install() {
-  check_docker
+  ensure_docker
 
   msg_info "Creating install directory"
   mkdir -p "$INSTALL_PATH"
@@ -178,6 +153,7 @@ if [[ "${type:-}" == "update" ]]; then
 fi
 
 header_info
+confirm_not_pve_host
 get_lxc_ip
 
 # Check if already installed

tools/addon/coder-code-server.sh

@@ -5,62 +5,153 @@
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://coder.com/ | Github: https://github.com/coder/code-server
 
-function header_info {
+if ! command -v curl &>/dev/null; then
-  cat <<"EOF"
+  printf "\r\e[2K%b" '\033[93m Setup Source \033[m' >&2
-   ______          __        _____                          
+  if [[ -f /etc/alpine-release ]]; then
-  / ____/___  ____/ /__     / ___/___  ______   _____  _____
+    apk update >/dev/null 2>&1
- / /   / __ \/ __  / _ \    \__ \/ _ \/ ___/ | / / _ \/ ___/
+    apk add --no-cache curl >/dev/null 2>&1
-/ /___/ /_/ / /_/ /  __/   ___/ /  __/ /   | |/ /  __/ /    
+  else
-\____/\____/\__,_/\___/   /____/\___/_/    |___/\___/_/     
+    apt-get update >/dev/null 2>&1
- 
+    apt-get install -y curl >/dev/null 2>&1
-EOF
+  fi
-}
+fi
-IP=$(hostname -I | awk '{print $1}')
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/core.func)
-YW=$(echo "\033[33m")
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/tools.func)
-BL=$(echo "\033[36m")
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/error_handler.func)
-RD=$(echo "\033[01;31m")
-BGN=$(echo "\033[4;92m")
-GN=$(echo "\033[1;92m")
-DGN=$(echo "\033[32m")
-CL=$(echo "\033[m")
-BFR="\\r\\033[K"
-HOLD="-"
-CM="${GN}✓${CL}"
-APP="Coder Code Server"
-hostname="$(hostname)"
-
-# Telemetry
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/api.func) 2>/dev/null || true
 declare -f init_tool_telemetry &>/dev/null && init_tool_telemetry "coder-code-server" "addon"
 
-set -o errexit
+# Enable error handling
-set -o errtrace
+set -Eeuo pipefail
-set -o nounset
+trap 'error_handler' ERR
-set -o pipefail
+
-shopt -s expand_aliases
+APP="Coder Code Server"
-alias die='EXIT=$? LINE=$LINENO error_exit'
+APP_TYPE="addon"
-trap die ERR
+
+# Initialize all core functions (colors, formatting, icons, STD mode)
+load_functions
 
-function error_exit() {
-  trap - ERR
-  local reason="Unknown failure occured."
-  local msg="${1:-$reason}"
-  local flag="${RD}‼ ERROR ${CL}$EXIT@$LINE"
-  echo -e "$flag $msg" 1>&2
-  exit "$EXIT"
-}
-clear
 header_info
-if command -v pveversion >/dev/null 2>&1; then
+ensure_usr_local_bin_persist
-  echo -e "⚠️  Can't Install on Proxmox "
+get_lxc_ip
-  exit
+IP="$LOCAL_IP"
+
+confirm_not_pve_host
+require_debian_like
+
+# ==============================================================================
+# UNINSTALL
+# ==============================================================================
+function uninstall() {
+  msg_info "Uninstalling ${APP}"
+  systemctl disable --now code-server@"$USER" &>/dev/null || true
+  $STD apt remove -y code-server
+  rm -f "$HOME/.coder-code-server"
+  msg_ok "${APP} has been uninstalled"
+}
+
+# ==============================================================================
+# UPDATE
+# ==============================================================================
+function update() {
+  if check_for_gh_release "coder-code-server" "coder/code-server"; then
+    msg_info "Updating ${APP}"
+    fetch_and_deploy_gh_release "coder-code-server" "coder/code-server" "binary" "latest" "/opt/coder-code-server" "code-server_*_$(arch_resolve).deb"
+    systemctl restart code-server@"$USER"
+    msg_ok "Updated successfully!"
+    exit
+  fi
+}
+
+# ==============================================================================
+# INSTALL
+# ==============================================================================
+function install() {
+  msg_info "Installing Dependencies"
+  $STD apt update
+  $STD apt install -y \
+    curl \
+    git
+  msg_ok "Installed Dependencies"
+
+  msg_info "Installing ${APP}"
+  config_path="${HOME}/.config/code-server/config.yaml"
+  preexisting_config=false
+  if [ -f "$config_path" ]; then
+    preexisting_config=true
+  fi
+
+  fetch_and_deploy_gh_release "coder-code-server" "coder/code-server" "binary" "latest" "/opt/coder-code-server" "code-server_*_$(arch_resolve).deb"
+  mkdir -p "${HOME}/.config/code-server/"
+
+  if [ "$preexisting_config" = false ]; then
+    cat <<EOF >"$config_path"
+bind-addr: 0.0.0.0:8680
+auth: none
+password: 
+cert: false
+EOF
+  fi
+  systemctl enable -q --now code-server@"$USER"
+  systemctl restart code-server@"$USER"
+  if ! systemctl is-active --quiet code-server@"$USER"; then
+    msg_error "code-server service failed to start."
+    exit 150
+  fi
+  msg_ok "Installed ${APP}"
+
+  msg_info "Creating update script"
+  ensure_usr_local_bin_persist
+  cat <<'EOF' >/usr/local/bin/update_coder-code-server
+#!/usr/bin/env bash
+# Coder Code Server Update Script
+type=update bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/coder-code-server.sh)"
+EOF
+  chmod +x /usr/local/bin/update_coder-code-server
+  msg_ok "Created update script (/usr/local/bin/update_coder-code-server)"
+
+  echo -e "${APP} should be reachable by going to the following URL.
+         ${BL}http://${IP}:8680${CL} \n"
+}
+
+# ==============================================================================
+# MAIN
+# ==============================================================================
+
+# Handle type=update (called from update script)
+if [[ "${type:-}" == "update" ]]; then
+  if command -v code-server &>/dev/null; then
+    update
+  else
+    msg_error "${APP} is not installed. Nothing to update."
+    exit 233
+  fi
+  exit 0
 fi
-if [ -e /etc/alpine-release ]; then
+
-  echo -e "⚠️  Can't Install on Alpine"
+if [[ -d "$HOME" && -f "$HOME/.coder-code-server" ]] || command -v code-server &>/dev/null; then
-  exit
+  msg_warn "${APP} is already installed."
+  echo -n "${TAB}Uninstall ${APP}? (y/N): "
+  read -r uninstall_prompt
+  if [[ "${uninstall_prompt,,}" =~ ^(y|yes)$ ]]; then
+    uninstall
+    exit 0
+  fi
+
+  echo -n "${TAB}Update ${APP}? (y/N): "
+  read -r update_prompt
+  if [[ "${update_prompt,,}" =~ ^(y|yes)$ ]]; then
+    update
+    exit 0
+  fi
+
+  msg_warn "No action selected. Exiting."
+  exit 0
 fi
+
 while true; do
-  read -p "This will Install ${APP} on $hostname. Proceed(y/n)?" yn
+  echo -n "${TAB}This will Install ${APP}. Proceed (y/n)? "
+  read -r yn
   case $yn in
   [Yy]*) break ;;
   [Nn]*) exit ;;
@@ -68,53 +159,4 @@ while true; do
   esac
 done
 
-function msg_info() {
+install
-  local msg="$1"
-  echo -ne " ${HOLD} ${YW}${msg}..."
-}
-
-function msg_ok() {
-  local msg="$1"
-  echo -e "${BFR} ${CM} ${GN}${msg}${CL}"
-}
-
-msg_info "Installing Dependencies"
-apt-get update &>/dev/null
-apt-get install -y curl &>/dev/null
-apt-get install -y git &>/dev/null
-msg_ok "Installed Dependencies"
-
-VERSION=$(curl -fsSL https://api.github.com/repos/coder/code-server/releases/latest |
-  grep "tag_name" |
-  awk '{print substr($2, 3, length($2)-4) }')
-
-msg_info "Installing Code-Server v${VERSION}"
-config_path="${HOME}/.config/code-server/config.yaml"
-preexisting_config=false
-
-if [ -f "$config_path" ]; then
-  preexisting_config=true
-fi
-
-curl -fOL https://github.com/coder/code-server/releases/download/v"$VERSION"/code-server_"${VERSION}"_amd64.deb &>/dev/null
-dpkg -i code-server_"${VERSION}"_amd64.deb &>/dev/null
-rm -rf code-server_"${VERSION}"_amd64.deb
-mkdir -p "${HOME}/.config/code-server/"
-
-if [ "$preexisting_config" = false ]; then
-cat <<EOF >"$config_path"
-bind-addr: 0.0.0.0:8680
-auth: none
-password: 
-cert: false
-EOF
-fi
-systemctl enable -q --now code-server@"$USER"
-systemctl restart code-server@"$USER"
-if ! systemctl is-active --quiet code-server@"$USER"; then
-  error_exit "code-server service failed to start."
-fi
-msg_ok "Installed Code-Server v${VERSION} on $hostname"
-
-echo -e "${APP} should be reachable by going to the following URL.
-         ${BL}http://$IP:8680${CL} \n"

tools/addon/coolify.sh

@@ -66,66 +66,11 @@ function update() {
   exit
 }
 
-# ==============================================================================
-# PROXMOX HOST CHECK
-# ==============================================================================
-function check_proxmox_host() {
-  if command -v pveversion &>/dev/null; then
-    msg_error "Running on the Proxmox host is NOT recommended!"
-    msg_error "This should be executed inside an LXC container."
-    echo ""
-    echo -n "${TAB}Continue anyway? (y/N): "
-    read -r confirm
-    if [[ ! "${confirm,,}" =~ ^(y|yes)$ ]]; then
-      msg_warn "Aborted. Please run this inside an LXC container."
-      exit 0
-    fi
-    msg_warn "Proceeding on Proxmox host at your own risk!"
-  fi
-}
-
-# ==============================================================================
-# CHECK / INSTALL DOCKER
-# ==============================================================================
-function check_or_install_docker() {
-  if command -v docker &>/dev/null; then
-    msg_ok "Docker $(docker --version | cut -d' ' -f3 | tr -d ',') is available"
-    if docker compose version &>/dev/null; then
-      msg_ok "Docker Compose is available"
-    else
-      msg_error "Docker Compose plugin is not available. Please install it."
-      exit 10
-    fi
-    return
-  fi
-
-  msg_warn "Docker is not installed."
-  echo -n "${TAB}Install Docker now? (y/N): "
-  read -r install_docker_prompt
-  if [[ ! "${install_docker_prompt,,}" =~ ^(y|yes)$ ]]; then
-    msg_error "Docker is required for ${APP}. Exiting."
-    exit 10
-  fi
-
-  msg_info "Installing Docker"
-  if [[ -f /etc/alpine-release ]]; then
-    $STD apk add docker docker-cli-compose
-    $STD rc-service docker start
-    $STD rc-update add docker default
-  else
-    DOCKER_CONFIG_PATH='/etc/docker/daemon.json'
-    mkdir -p "$(dirname "$DOCKER_CONFIG_PATH")"
-    echo -e '{\n  "log-driver": "journald"\n}' >"$DOCKER_CONFIG_PATH"
-    $STD sh <(curl -fsSL https://get.docker.com)
-  fi
-  msg_ok "Installed Docker"
-}
-
 # ==============================================================================
 # INSTALL
 # ==============================================================================
 function install() {
-  check_or_install_docker
+  ensure_docker
 
   msg_info "Installing dependencies"
   if [[ -f /etc/alpine-release ]]; then
@@ -172,7 +117,7 @@ if [[ "${type:-}" == "update" ]]; then
 fi
 
 header_info
-check_proxmox_host
+confirm_not_pve_host
 get_lxc_ip
 
 # Check if already installed

tools/addon/copyparty.sh

@@ -7,8 +7,13 @@
 
 if ! command -v curl &>/dev/null; then
   printf "\r\e[2K%b" '\033[93m Setup Source \033[m' >&2
-  apt-get update >/dev/null 2>&1
+  if [[ -f /etc/alpine-release ]]; then
-  apt-get install -y curl >/dev/null 2>&1
+    apk update >/dev/null 2>&1
+    apk add --no-cache curl >/dev/null 2>&1
+  else
+    apt-get update >/dev/null 2>&1
+    apt-get install -y curl >/dev/null 2>&1
+  fi
 fi
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/core.func)
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/tools.func)
@@ -45,28 +50,13 @@ if [[ -f "/etc/alpine-release" ]]; then
   SERVICE_PATH="/etc/init.d/copyparty"
 elif grep -qE 'ID=debian|ID=ubuntu' /etc/os-release; then
   OS="Debian"
-  PKG_MANAGER="apt-get install -y"
+  PKG_MANAGER="apt install -y"
   SERVICE_PATH="/etc/systemd/system/copyparty.service"
 else
   msg_error "Unsupported OS detected. Exiting."
   exit 238
 fi
 
-# ==============================================================================
-# HEADER
-# ==============================================================================
-function header_info() {
-  clear
-  cat <<"EOF"
-   ______                  ____             __
-  / ____/___  ____  __  __/ __ \____ ______/ /___  __
- / /   / __ \/ __ \/ / / / /_/ / __ `/ ___/ __/ / / /
-/ /___/ /_/ / /_/ / /_/ / ____/ /_/ / /  / /_/ /_/ /
-\____/\____/ .___/\__, /_/    \__,_/_/   \__/\__, /
-          /_/    /____/                     /____/
-EOF
-}
-
 # ==============================================================================
 # HELPER FUNCTIONS
 # ==============================================================================
@@ -173,9 +163,17 @@ function install() {
 
   msg_info "Installing dependencies"
   if [[ "$OS" == "Debian" ]]; then
-    $STD $PKG_MANAGER python3 python3-pil ffmpeg curl
+    $STD $PKG_MANAGER \
+      python3 \
+      python3-pil \
+      ffmpeg \
+      curl
   else
-    $STD $PKG_MANAGER python3 py3-pillow ffmpeg curl
+    $STD $PKG_MANAGER \
+      python3 \
+      py3-pillow \
+      ffmpeg \
+      curl
   fi
   msg_ok "Dependencies installed (with thumbnail support)"
 

tools/addon/cronmaster.sh

@@ -7,8 +7,13 @@
 
 if ! command -v curl &>/dev/null; then
   printf "\r\e[2K%b" '\033[93m Setup Source \033[m' >&2
-  apt-get update >/dev/null 2>&1
+  if [[ -f /etc/alpine-release ]]; then
-  apt-get install -y curl >/dev/null 2>&1
+    apk update >/dev/null 2>&1
+    apk add --no-cache curl >/dev/null 2>&1
+  else
+    apt-get update >/dev/null 2>&1
+    apt-get install -y curl >/dev/null 2>&1
+  fi
 fi
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/core.func)
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/tools.func)
@@ -20,6 +25,7 @@ declare -f init_tool_telemetry &>/dev/null && init_tool_telemetry "cronmaster" "
 set -Eeuo pipefail
 trap 'error_handler' ERR
 load_functions
+require_debian_like
 
 # ==============================================================================
 # CONFIGURATION
@@ -31,29 +37,6 @@ CONFIG_PATH="/opt/cronmaster/.env"
 SERVICE_PATH="/etc/systemd/system/cronmaster.service"
 DEFAULT_PORT=3000
 
-# ==============================================================================
-# HEADER
-# ==============================================================================
-function header_info {
-  clear
-  cat <<"EOF"
-   ______                __  ___           __
-  / ____/________  ____ /  |/  /___ ______/ /____  _____
- / /   / ___/ __ \/ __ \/ /|_/ / __ `/ ___/ __/ _ \/ ___/
-/ /___/ /  / /_/ / / / / /  / / /_/ (__  ) /_/  __/ /
-\____/_/   \____/_/ /_/_/  /_/\__,_/____/\__/\___/_/
-
-EOF
-}
-
-# ==============================================================================
-# OS DETECTION
-# ==============================================================================
-if ! grep -qE 'ID=debian|ID=ubuntu' /etc/os-release 2>/dev/null; then
-  echo -e "${CROSS} Unsupported OS detected. This script only supports Debian and Ubuntu."
-  exit 238
-fi
-
 # ==============================================================================
 # UNINSTALL
 # ==============================================================================
@@ -77,16 +60,12 @@ function update() {
     systemctl stop cronmaster.service &>/dev/null || true
     msg_ok "Stopped service"
 
-    msg_info "Backing up configuration"
+    BACKUP_DIR="/opt/cronmaster_backup"
-    cp "$CONFIG_PATH" /tmp/cronmaster.env.bak 2>/dev/null || true
+    create_backup "$CONFIG_PATH"
-    msg_ok "Backed up configuration"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "cronmaster" "fccview/cronmaster" "prebuild" "latest" "$INSTALL_PATH" "cronmaster_*_prebuild.tar.gz"
 
-    msg_info "Restoring configuration"
+    restore_backup
-    cp /tmp/cronmaster.env.bak "$CONFIG_PATH" 2>/dev/null || true
-    rm -f /tmp/cronmaster.env.bak
-    msg_ok "Restored configuration"
 
     msg_info "Starting service"
     systemctl start cronmaster

tools/addon/crowdsec.sh

@@ -5,89 +5,61 @@
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://www.crowdsec.net/ | Github: https://github.com/crowdsecurity/crowdsec
 
-YW=$(echo "\033[33m")
-BL=$(echo "\033[36m")
-RD=$(echo "\033[01;31m")
-BGN=$(echo "\033[4;92m")
-GN=$(echo "\033[1;92m")
-DGN=$(echo "\033[32m")
-CL=$(echo "\033[m")
-BFR="\\r\\033[K"
-HOLD="-"
-CM="${GN}✓${CL}"
 APP="CrowdSec"
-hostname="$(hostname)"
+APP_TYPE="addon"
 
-# Telemetry
+if ! command -v curl &>/dev/null; then
+  printf "\r\e[2K%b" '\033[93m Setup Source \033[m' >&2
+  if [[ -f /etc/alpine-release ]]; then
+    apk update >/dev/null 2>&1
+    apk add --no-cache curl >/dev/null 2>&1
+  else
+    apt-get update >/dev/null 2>&1
+    apt-get install -y curl >/dev/null 2>&1
+  fi
+fi
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/core.func)
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/tools.func)
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/error_handler.func)
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/api.func) 2>/dev/null || true
 declare -f init_tool_telemetry &>/dev/null && init_tool_telemetry "crowdsec" "addon"
 
-set -o errexit
+# Enable error handling
-set -o errtrace
+set -Eeuo pipefail
-set -o nounset
+trap 'error_handler' ERR
-set -o pipefail
+
-shopt -s expand_aliases
+# Initialize all core functions (colors, formatting, icons, STD mode)
-alias die='EXIT=$? LINE=$LINENO error_exit'
+load_functions
-trap die ERR
+require_debian_like
+
+header_info
+confirm_not_pve_host
 
-function error_exit() {
-  trap - ERR
-  local reason="Unknown failure occured."
-  local msg="${1:-$reason}"
-  local flag="${RD}‼ ERROR ${CL}$EXIT@$LINE"
-  echo -e "$flag $msg" 1>&2
-  exit "$EXIT"
-}
-if command -v pveversion >/dev/null 2>&1; then
-  echo -e "⚠️  Can't Install on Proxmox "
-  exit
-fi
 while true; do
-  read -p "This will Install ${APP} on $hostname. Proceed(y/n)?" yn
+  echo -n "${TAB}This will Install ${APP}. Proceed (y/n)? "
+  read -r yn
   case $yn in
   [Yy]*) break ;;
   [Nn]*) exit ;;
   *) echo "Please answer yes or no." ;;
   esac
 done
-clear
-function header_info() {
-  echo -e "${BL}
-   _____                      _  _____           
-  / ____|                    | |/ ____|          
- | |     _ __ _____      ____| | (___   ___  ___ 
- | |    |  __/ _ \ \ /\ / / _  |\___ \ / _ \/ __|
- | |____| | | (_) \ V  V / (_| |____) |  __/ (__ 
-  \_____|_|  \___/ \_/\_/ \__ _|_____/ \___|\___|
-${CL}"
-}
-
-header_info
-
-function msg_info() {
-  local msg="$1"
-  echo -ne " ${HOLD} ${YW}${msg}..."
-}
-
-function msg_ok() {
-  local msg="$1"
-  echo -e "${BFR} ${CM} ${GN}${msg}${CL}"
-}
 
 msg_info "Setting up ${APP} Repository"
-apt-get update &>/dev/null
+$STD apt update
-apt-get install -y curl &>/dev/null
+$STD apt install -y \
-apt-get install -y gnupg &>/dev/null
+  curl \
-curl -fsSL "https://install.crowdsec.net" | bash &>/dev/null
+  gnupg
+$STD bash -c "curl -fsSL https://install.crowdsec.net | bash"
 msg_ok "Setup ${APP} Repository"
 
 msg_info "Installing ${APP}"
-apt-get update &>/dev/null
+$STD apt update
-apt-get install -y crowdsec &>/dev/null
+$STD apt install -y crowdsec
-msg_ok "Installed ${APP} on $hostname"
+msg_ok "Installed ${APP}"
 
 msg_info "Installing ${APP} Common Bouncer"
-apt-get install -y crowdsec-firewall-bouncer-iptables &>/dev/null
+$STD apt install -y crowdsec-firewall-bouncer-iptables
 msg_ok "Installed ${APP} Common Bouncer"
 
 msg_ok "Completed successfully!\n"

tools/addon/dockge.sh

@@ -72,66 +72,11 @@ function update() {
   exit
 }
 
-# ==============================================================================
-# PROXMOX HOST CHECK
-# ==============================================================================
-function check_proxmox_host() {
-  if command -v pveversion &>/dev/null; then
-    msg_error "Running on the Proxmox host is NOT recommended!"
-    msg_error "This should be executed inside an LXC container."
-    echo ""
-    echo -n "${TAB}Continue anyway? (y/N): "
-    read -r confirm
-    if [[ ! "${confirm,,}" =~ ^(y|yes)$ ]]; then
-      msg_warn "Aborted. Please run this inside an LXC container."
-      exit 0
-    fi
-    msg_warn "Proceeding on Proxmox host at your own risk!"
-  fi
-}
-
-# ==============================================================================
-# CHECK / INSTALL DOCKER
-# ==============================================================================
-function check_or_install_docker() {
-  if command -v docker &>/dev/null; then
-    msg_ok "Docker $(docker --version | cut -d' ' -f3 | tr -d ',') is available"
-    if docker compose version &>/dev/null; then
-      msg_ok "Docker Compose is available"
-    else
-      msg_error "Docker Compose plugin is not available. Please install it."
-      exit 10
-    fi
-    return
-  fi
-
-  msg_warn "Docker is not installed."
-  echo -n "${TAB}Install Docker now? (y/N): "
-  read -r install_docker_prompt
-  if [[ ! "${install_docker_prompt,,}" =~ ^(y|yes)$ ]]; then
-    msg_error "Docker is required for ${APP}. Exiting."
-    exit 10
-  fi
-
-  msg_info "Installing Docker"
-  if [[ -f /etc/alpine-release ]]; then
-    $STD apk add docker docker-cli-compose
-    $STD rc-service docker start
-    $STD rc-update add docker default
-  else
-    DOCKER_CONFIG_PATH='/etc/docker/daemon.json'
-    mkdir -p "$(dirname "$DOCKER_CONFIG_PATH")"
-    echo -e '{\n  "log-driver": "journald"\n}' >"$DOCKER_CONFIG_PATH"
-    $STD sh <(curl -fsSL https://get.docker.com)
-  fi
-  msg_ok "Installed Docker"
-}
-
 # ==============================================================================
 # INSTALL
 # ==============================================================================
 function install() {
-  check_or_install_docker
+  ensure_docker
 
   msg_info "Creating install directories"
   mkdir -p "$INSTALL_PATH" "$STACKS_PATH"
@@ -167,7 +112,7 @@ if [[ "${type:-}" == "update" ]]; then
 fi
 
 header_info
-check_proxmox_host
+confirm_not_pve_host
 get_lxc_ip
 
 # Check if already installed

tools/addon/dokploy.sh

@@ -65,66 +65,11 @@ function update() {
   exit
 }
 
-# ==============================================================================
-# PROXMOX HOST CHECK
-# ==============================================================================
-function check_proxmox_host() {
-  if command -v pveversion &>/dev/null; then
-    msg_error "Running on the Proxmox host is NOT recommended!"
-    msg_error "This should be executed inside an LXC container."
-    echo ""
-    echo -n "${TAB}Continue anyway? (y/N): "
-    read -r confirm
-    if [[ ! "${confirm,,}" =~ ^(y|yes)$ ]]; then
-      msg_warn "Aborted. Please run this inside an LXC container."
-      exit 0
-    fi
-    msg_warn "Proceeding on Proxmox host at your own risk!"
-  fi
-}
-
-# ==============================================================================
-# CHECK / INSTALL DOCKER
-# ==============================================================================
-function check_or_install_docker() {
-  if command -v docker &>/dev/null; then
-    msg_ok "Docker $(docker --version | cut -d' ' -f3 | tr -d ',') is available"
-    if docker compose version &>/dev/null; then
-      msg_ok "Docker Compose is available"
-    else
-      msg_error "Docker Compose plugin is not available. Please install it."
-      exit 10
-    fi
-    return
-  fi
-
-  msg_warn "Docker is not installed."
-  echo -n "${TAB}Install Docker now? (y/N): "
-  read -r install_docker_prompt
-  if [[ ! "${install_docker_prompt,,}" =~ ^(y|yes)$ ]]; then
-    msg_error "Docker is required for ${APP}. Exiting."
-    exit 10
-  fi
-
-  msg_info "Installing Docker"
-  if [[ -f /etc/alpine-release ]]; then
-    $STD apk add docker docker-cli-compose
-    $STD rc-service docker start
-    $STD rc-update add docker default
-  else
-    DOCKER_CONFIG_PATH='/etc/docker/daemon.json'
-    mkdir -p "$(dirname "$DOCKER_CONFIG_PATH")"
-    echo -e '{\n  "log-driver": "journald"\n}' >"$DOCKER_CONFIG_PATH"
-    $STD sh <(curl -fsSL https://get.docker.com)
-  fi
-  msg_ok "Installed Docker"
-}
-
 # ==============================================================================
 # INSTALL
 # ==============================================================================
 function install() {
-  check_or_install_docker
+  ensure_docker
 
   msg_info "Installing dependencies"
   if [[ -f /etc/alpine-release ]]; then
@@ -170,7 +115,7 @@ if [[ "${type:-}" == "update" ]]; then
 fi
 
 header_info
-check_proxmox_host
+confirm_not_pve_host
 get_lxc_ip
 
 # Check if already installed

tools/addon/filebrowser-quantum.sh

@@ -5,55 +5,51 @@
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://github.com/filebrowserspace/quantum
 
-function header_info() {
-  clear
-  cat <<"EOF"
-    _______ __     ____                                       ____                    __
-   / ____(_) /__  / __ )_________ _      __________  _____   / __ \__  ______ _____  / /___  ______ ___
-  / /_  / / / _ \/ __  / ___/ __ \ | /| / / ___/ _ \/ ___/  / / / / / / / __ `/ __ \/ __/ / / / __ `__ \
- / __/ / / /  __/ /_/ / /  / /_/ / |/ |/ (__  )  __/ /     / /_/ / /_/ / /_/ / / / / /_/ /_/ / / / / / /
-/_/   /_/_/\___/_____/_/   \____/|__/|__/____/\___/_/      \___\_\__,_/\__,_/_/ /_/\__/\__,_/_/ /_/ /_/
-
-EOF
-}
-
-YW=$(echo "\033[33m")
-GN=$(echo "\033[1;92m")
-RD=$(echo "\033[01;31m")
-BL=$(echo "\033[36m")
-CL=$(echo "\033[m")
-CM="${GN}✔️${CL}"
-CROSS="${RD}✖️${CL}"
-INFO="${BL}ℹ️${CL}"
-
 APP="FileBrowser Quantum"
+APP_TYPE="addon"
 INSTALL_PATH="/usr/local/bin/filebrowser"
 CONFIG_PATH="/usr/local/community-scripts/fq-config.yaml"
 DEFAULT_PORT=8080
 SRC_DIR="/"
-TMP_BIN="/tmp/filebrowser.$$"
 
-# Telemetry
+if ! command -v curl &>/dev/null; then
+  printf "\r\e[2K%b" '\033[93m Setup Source \033[m' >&2
+  if [[ -f /etc/alpine-release ]]; then
+    apk update >/dev/null 2>&1
+    apk add --no-cache curl >/dev/null 2>&1
+  else
+    apt-get update >/dev/null 2>&1
+    apt-get install -y curl >/dev/null 2>&1
+  fi
+fi
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/core.func)
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/tools.func)
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/error_handler.func)
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/api.func) 2>/dev/null || true
 declare -f init_tool_telemetry &>/dev/null && init_tool_telemetry "filebrowser-quantum" "addon"
 
-# Get primary IP
+# Enable error handling
-IFACE=$(ip -4 route | awk '/default/ {print $5; exit}')
+set -Eeuo pipefail
-IP=$(ip -4 addr show "$IFACE" | awk '/inet / {print $2}' | cut -d/ -f1 | head -n 1)
+trap 'error_handler' ERR
-[[ -z "$IP" ]] && IP=$(hostname -I | awk '{print $1}')
+
-[[ -z "$IP" ]] && IP="127.0.0.1"
+# Initialize all core functions (colors, formatting, icons, STD mode)
+load_functions
+
+header_info
+get_lxc_ip
+IP="$LOCAL_IP"
 
 # Proxmox Host Warning
 if [[ -d "/etc/pve" ]]; then
-  echo -e "${RD}⚠️  Warning: Running this addon directly on the Proxmox host is not recommended!${CL}"
+  msg_warn "Running this addon directly on the Proxmox host is not recommended!"
-  echo -e "${YW}   Only the boot disk will be visible — passthrough drives will not be indexed.${CL}"
+  msg_warn "Only the boot disk will be visible — passthrough drives will not be indexed."
-  echo -e "${YW}   This causes incorrect disk usage stats and incomplete file browsing.${CL}"
+  msg_warn "This causes incorrect disk usage stats and incomplete file browsing."
-  echo -e "${YW}   Run this addon inside an LXC or VM instead and mount your drives there.${CL}"
+  msg_warn "Run this addon inside an LXC or VM instead and mount your drives there."
   echo ""
-  echo -n "Continue anyway on the Proxmox host? (y/N): "
+  echo -n "${TAB}Continue anyway on the Proxmox host? (y/N): "
   read -r host_confirm
   if [[ ! "${host_confirm,,}" =~ ^(y|yes)$ ]]; then
-    echo -e "${YW}Aborted.${CL}"
+    msg_error "Aborted."
     exit 0
   fi
 fi
@@ -66,18 +62,12 @@ if [[ -f "/etc/alpine-release" ]]; then
 elif [[ -f "/etc/debian_version" ]]; then
   OS="Debian"
   SERVICE_PATH="/etc/systemd/system/filebrowser.service"
-  PKG_MANAGER="apt-get install -y"
+  PKG_MANAGER="apt install -y"
 else
-  echo -e "${CROSS} Unsupported OS detected. Exiting."
+  msg_error "Unsupported OS detected. Exiting."
   exit 238
 fi
 
-header_info
-
-function msg_info() { echo -e "${INFO} ${YW}$1...${CL}"; }
-function msg_ok() { echo -e "${CM} ${GN}$1${CL}"; }
-function msg_error() { echo -e "${CROSS} ${RD}$1${CL}"; }
-
 # Detect legacy FileBrowser installation
 LEGACY_DB="/usr/local/community-scripts/filebrowser.db"
 LEGACY_BIN="/usr/local/bin/filebrowser"
@@ -85,80 +75,82 @@ LEGACY_SERVICE_DEB="/etc/systemd/system/filebrowser.service"
 LEGACY_SERVICE_ALP="/etc/init.d/filebrowser"
 
 if [[ -f "$LEGACY_DB" || -f "$LEGACY_BIN" && ! -f "$CONFIG_PATH" ]]; then
-  echo -e "${YW}⚠️ Detected legacy FileBrowser installation.${CL}"
+  msg_warn "Detected legacy FileBrowser installation."
-  echo -n "Uninstall legacy FileBrowser and continue with Quantum install? (y/n): "
+  echo -n "${TAB}Uninstall legacy FileBrowser and continue with Quantum install? (y/n): "
   read -r remove_legacy
   if [[ "${remove_legacy,,}" =~ ^(y|yes)$ ]]; then
     msg_info "Uninstalling legacy FileBrowser"
     if [[ -f "$LEGACY_SERVICE_DEB" ]]; then
-      systemctl disable --now filebrowser.service &>/dev/null
+      systemctl disable --now filebrowser.service &>/dev/null || true
       rm -f "$LEGACY_SERVICE_DEB"
     elif [[ -f "$LEGACY_SERVICE_ALP" ]]; then
-      rc-service filebrowser stop &>/dev/null
+      rc-service filebrowser stop &>/dev/null || true
-      rc-update del filebrowser &>/dev/null
+      rc-update del filebrowser &>/dev/null || true
       rm -f "$LEGACY_SERVICE_ALP"
     fi
     rm -f "$LEGACY_BIN" "$LEGACY_DB"
     msg_ok "Legacy FileBrowser removed"
   else
-    echo -e "${YW}❌ Installation aborted by user.${CL}"
+    msg_error "Installation aborted by user."
     exit 0
   fi
 fi
 
 # Existing installation
 if [[ -f "$INSTALL_PATH" ]]; then
-  echo -e "${YW}⚠️ ${APP} is already installed.${CL}"
+  msg_warn "${APP} is already installed."
-  echo -n "Uninstall ${APP}? (y/N): "
+  echo -n "${TAB}Uninstall ${APP}? (y/N): "
   read -r uninstall_prompt
   if [[ "${uninstall_prompt,,}" =~ ^(y|yes)$ ]]; then
     msg_info "Uninstalling ${APP}"
     if [[ "$OS" == "Debian" ]]; then
-      systemctl disable --now filebrowser.service &>/dev/null
+      systemctl disable --now filebrowser.service &>/dev/null || true
       rm -f "$SERVICE_PATH"
     else
-      rc-service filebrowser stop &>/dev/null
+      rc-service filebrowser stop &>/dev/null || true
-      rc-update del filebrowser &>/dev/null
+      rc-update del filebrowser &>/dev/null || true
       rm -f "$SERVICE_PATH"
     fi
-    rm -f "$INSTALL_PATH" "$CONFIG_PATH"
+    rm -f "$INSTALL_PATH" "$CONFIG_PATH" "$HOME/.filebrowser-quantum"
     msg_ok "${APP} has been uninstalled."
     exit 0
   fi
 
-  echo -n "Update ${APP}? (y/N): "
+  echo -n "${TAB}Update ${APP}? (y/N): "
   read -r update_prompt
   if [[ "${update_prompt,,}" =~ ^(y|yes)$ ]]; then
-    msg_info "Updating ${APP}"
+    if check_for_gh_release "filebrowser-quantum" "gtsteffaniak/filebrowser"; then
-    if ! command -v curl &>/dev/null; then $PKG_MANAGER curl &>/dev/null; fi
+      msg_info "Updating ${APP}"
-    curl -fsSL https://github.com/gtsteffaniak/filebrowser/releases/latest/download/linux-amd64-filebrowser -o "$TMP_BIN"
+      if ! command -v curl &>/dev/null; then $STD $PKG_MANAGER curl; fi
-    chmod +x "$TMP_BIN"
+      fetch_and_deploy_gh_release "filebrowser-quantum" "gtsteffaniak/filebrowser" "singlefile" "latest" "/usr/local/bin" "linux-$(arch_resolve)-filebrowser"
-    mv -f "$TMP_BIN" /usr/local/bin/filebrowser
+      mv -f /usr/local/bin/filebrowser-quantum "$INSTALL_PATH"
-    msg_ok "Updated ${APP}"
+      msg_ok "Updated ${APP}"
+    fi
     exit 0
   else
-    echo -e "${YW}⚠️ Update skipped. Exiting.${CL}"
+    msg_warn "Update skipped. Exiting."
     exit 0
   fi
 fi
 
-echo -e "${YW}⚠️ ${APP} is not installed.${CL}"
+msg_warn "${APP} is not installed."
-echo -n "Enter port number (Default: ${DEFAULT_PORT}): "
+echo -n "${TAB}Enter port number (Default: ${DEFAULT_PORT}): "
 read -r PORT
 PORT=${PORT:-$DEFAULT_PORT}
 
-echo -n "Install ${APP}? (y/n): "
+echo -n "${TAB}Install ${APP}? (y/n): "
 read -r install_prompt
 if ! [[ "${install_prompt,,}" =~ ^(y|yes)$ ]]; then
-  echo -e "${YW}⚠️ Installation skipped. Exiting.${CL}"
+  msg_warn "Installation skipped. Exiting."
   exit 0
 fi
 
 msg_info "Installing ${APP} on ${OS}"
-$PKG_MANAGER curl ffmpeg &>/dev/null
+$STD $PKG_MANAGER \
-curl -fsSL https://github.com/gtsteffaniak/filebrowser/releases/latest/download/linux-amd64-filebrowser -o "$TMP_BIN"
+  curl \
-chmod +x "$TMP_BIN"
+  ffmpeg
-mv -f "$TMP_BIN" /usr/local/bin/filebrowser
+fetch_and_deploy_gh_release "filebrowser-quantum" "gtsteffaniak/filebrowser" "singlefile" "latest" "/usr/local/bin" "linux-$(arch_resolve)-filebrowser"
+mv -f /usr/local/bin/filebrowser-quantum "$INSTALL_PATH"
 msg_ok "Installed ${APP}"
 
 msg_info "Preparing configuration directory"
@@ -167,7 +159,7 @@ chown root:root /usr/local/community-scripts
 chmod 755 /usr/local/community-scripts
 msg_ok "Directory prepared"
 
-echo -n "Use No Authentication? (y/N): "
+echo -n "${TAB}Use No Authentication? (y/N): "
 read -r noauth_prompt
 
 # === YAML CONFIG GENERATION ===
@@ -251,9 +243,9 @@ depend() {
 }
 EOF
   chmod +x "$SERVICE_PATH"
-  rc-update add filebrowser default &>/dev/null
+  $STD rc-update add filebrowser default
-  rc-service filebrowser start &>/dev/null
+  $STD rc-service filebrowser start
 fi
 
 msg_ok "Service created successfully"
-echo -e "${CM} ${GN}${APP} is reachable at: ${BL}http://$IP:$PORT${CL}"
+msg_ok "${APP} is reachable at: ${BL}http://${IP}:${PORT}${CL}"