Remove explanatory comments from speed test build steps

Co-authored-by: MickLesk <47820557+MickLesk@users.noreply.github.com>

.github/changelogs/2026/08.md

@@ -1,3 +1,142 @@
+## 2026-08-08
+
+### 🆕 New Scripts
+
+  - Ignis ([#16330](https://github.com/community-scripts/ProxmoxVE/pull/16330))
+
+### 💾 Core
+
+  - #### ✨ New Features
+
+    - core - setup_nodejs: bypass npm allowScripts policy globally on npm >=11 [@MickLesk](https://github.com/MickLesk) ([#16280](https://github.com/community-scripts/ProxmoxVE/pull/16280))
+
+## 2026-08-07
+
+### 🆕 New Scripts
+
+  - NetworkOptimizer ([#16328](https://github.com/community-scripts/ProxmoxVE/pull/16328))
+- Orb ([#16329](https://github.com/community-scripts/ProxmoxVE/pull/16329))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - HortusFox: start applying db migrations [@tomfrenzel](https://github.com/tomfrenzel) ([#16324](https://github.com/community-scripts/ProxmoxVE/pull/16324))
+    - Docker: report container updates instead of prompting, stop auto-updating Portainer Agent, fix addon detection of legacy Portainer [@MickLesk](https://github.com/MickLesk) ([#16298](https://github.com/community-scripts/ProxmoxVE/pull/16298))
+    - Immich: retry mise install on transient npm download failures [@MickLesk](https://github.com/MickLesk) ([#16301](https://github.com/community-scripts/ProxmoxVE/pull/16301))
+    - changedetection: remove msttcorefonts to fix install hang [@austinpilz](https://github.com/austinpilz) ([#16319](https://github.com/community-scripts/ProxmoxVE/pull/16319))
+
+  - #### 🔧 Refactor
+
+    - core: extend new vars and pocketbase values [@MickLesk](https://github.com/MickLesk) ([#16313](https://github.com/community-scripts/ProxmoxVE/pull/16313))
+
+## 2026-08-06
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - paperless: change update abort message (endless spinner) [@MickLesk](https://github.com/MickLesk) ([#16299](https://github.com/community-scripts/ProxmoxVE/pull/16299))
+
+  - #### ✨ New Features
+
+    - Vikunja: remove version pin, v2.5.0 fixes the systemd syscall filter crash [@MickLesk](https://github.com/MickLesk) ([#16300](https://github.com/community-scripts/ProxmoxVE/pull/16300))
+
+### 💾 Core
+
+  - #### 🔧 Refactor
+
+    - build.func: filter templates by host architecture during search [@MickLesk](https://github.com/MickLesk) ([#16302](https://github.com/community-scripts/ProxmoxVE/pull/16302))
+
+## 2026-08-05
+
+### 🚀 Updated Scripts
+
+  - #### ✨ New Features
+
+    - NextcloudPI: Bump to Debian Trixie & Tweak broken SSH [@MickLesk](https://github.com/MickLesk) ([#15957](https://github.com/community-scripts/ProxmoxVE/pull/15957))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - fix(monitor-all): reduce polling CPU overhead [@jomplox](https://github.com/jomplox) ([#15907](https://github.com/community-scripts/ProxmoxVE/pull/15907))
+
+## 2026-08-04
+
+### 🆕 New Scripts
+
+  - Hister ([#16259](https://github.com/community-scripts/ProxmoxVE/pull/16259))
+- Obsidian-LiveSync ([#16233](https://github.com/community-scripts/ProxmoxVE/pull/16233))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Actual Budget: allow native module install scripts under npm 11 (Node24) [@MickLesk](https://github.com/MickLesk) ([#16277](https://github.com/community-scripts/ProxmoxVE/pull/16277))
+    - Heimdall-Dashboard: run full composer install on update, force production env [@MickLesk](https://github.com/MickLesk) ([#16278](https://github.com/community-scripts/ProxmoxVE/pull/16278))
+    - xyOps: rebuild xySat satellite during update [@MickLesk](https://github.com/MickLesk) ([#16279](https://github.com/community-scripts/ProxmoxVE/pull/16279))
+    - HAOS: remove non-ASCII dash from CPU model dialog text [@MickLesk](https://github.com/MickLesk) ([#16276](https://github.com/community-scripts/ProxmoxVE/pull/16276))
+    - fix: back up Termix db/data so the update stops destroying encryption keys [@LukeGus](https://github.com/LukeGus) ([#16275](https://github.com/community-scripts/ProxmoxVE/pull/16275))
+    - passwordpusher: dynamically read Ruby version from .ruby-version file [@Copilot](https://github.com/Copilot) ([#16242](https://github.com/community-scripts/ProxmoxVE/pull/16242))
+    - fix(salt): write version cache to ~/.salt, not /~.salt [@TowyTowy](https://github.com/TowyTowy) ([#16265](https://github.com/community-scripts/ProxmoxVE/pull/16265))
+    - AFFiNE: fix version and build type reported by the app itself [@MickLesk](https://github.com/MickLesk) ([#16251](https://github.com/community-scripts/ProxmoxVE/pull/16251))
+    - Passbolt: fetch GPG key from Passbolt's own host instead of the flaky keyserver [@MickLesk](https://github.com/MickLesk) ([#16248](https://github.com/community-scripts/ProxmoxVE/pull/16248))
+
+  - #### ✨ New Features
+
+    - Opencloud: Pin version to 7.4.0 [@vhsdream](https://github.com/vhsdream) ([#16257](https://github.com/community-scripts/ProxmoxVE/pull/16257))
+
+  - #### 🔧 Refactor
+
+    - Bump NodeJS Versions of several scripts [@MickLesk](https://github.com/MickLesk) ([#16230](https://github.com/community-scripts/ProxmoxVE/pull/16230))
+
+### 💾 Core
+
+  - #### 🐞 Bug Fixes
+
+    - tools.func: never delete ubuntu.sources (or other distro base sources) as orphaned [@MickLesk](https://github.com/MickLesk) ([#16250](https://github.com/community-scripts/ProxmoxVE/pull/16250))
+    - tools.func: complete a stale/partial backup manifest instead of trusting it as-is [@MickLesk](https://github.com/MickLesk) ([#16252](https://github.com/community-scripts/ProxmoxVE/pull/16252))
+
+  - #### 🔧 Refactor
+
+    - Refactor: harmonize tools/addon and move boilerplate into core.func [@MickLesk](https://github.com/MickLesk) ([#16202](https://github.com/community-scripts/ProxmoxVE/pull/16202))
+
+## 2026-08-03
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Correction to link in Paperless-NGX update script [@jsspen](https://github.com/jsspen) ([#16241](https://github.com/community-scripts/ProxmoxVE/pull/16241))
+    - fix restore env in split pro [@johanngrobe](https://github.com/johanngrobe) ([#16228](https://github.com/community-scripts/ProxmoxVE/pull/16228))
+
+### 💾 Core
+
+  - #### 🔧 Refactor
+
+    - core: read all interactive prompts from /dev/tty, drain leftover input on read failure (hotfix) [@MickLesk](https://github.com/MickLesk) ([#16235](https://github.com/community-scripts/ProxmoxVE/pull/16235))
+
+## 2026-08-02
+
+### 🆕 New Scripts
+
+  - Portainer as Addon [@MickLesk](https://github.com/MickLesk) ([#16200](https://github.com/community-scripts/ProxmoxVE/pull/16200))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - LibreNMS: Ensure ipmitool dependency is installed [@tremor021](https://github.com/tremor021) ([#16219](https://github.com/community-scripts/ProxmoxVE/pull/16219))
+    - Bitfocus Companion: add libatomic1 dependency [@tremor021](https://github.com/tremor021) ([#16212](https://github.com/community-scripts/ProxmoxVE/pull/16212))
+    - fix(dispatcharr): add recordings and dvr queues to celery worker [@eXistC](https://github.com/eXistC) ([#16204](https://github.com/community-scripts/ProxmoxVE/pull/16204))
+    - add retry for uv - same as immich [@asylumexp](https://github.com/asylumexp) ([#16203](https://github.com/community-scripts/ProxmoxVE/pull/16203))
+    - Fix for cross-seed node version regression [@TorinFrancis](https://github.com/TorinFrancis) ([#16209](https://github.com/community-scripts/ProxmoxVE/pull/16209))
+
+  - #### 🔧 Refactor
+
+    - chore: remove portainer setup from several scripts (moved to addon) [@MickLesk](https://github.com/MickLesk) ([#16201](https://github.com/community-scripts/ProxmoxVE/pull/16201))
+
 ## 2026-08-01
 
 ### 🚀 Updated Scripts

.github/workflows/pocketbase-ai-bot.yml

@@ -314,12 +314,17 @@ jobs:
             // ── Allow-lists (mirror the slash bot) ─────────────────────────────
             const ALLOWED_FIELDS = {
               name: 'string', description: 'string', logo: 'string', documentation: 'string',
-              website: 'string', project_url: 'string', github: 'string', config_path: 'string',
+              website: 'string', project_url: 'string', repository: 'string', config_path: 'string',
               tags: 'string', port: 'number', default_user: 'nullable_string', default_passwd: 'nullable_string',
-              unprivileged: 'number', updateable: 'boolean', privileged: 'boolean', has_arm: 'boolean',
+              unprivileged: 'number', updateable: 'boolean', privileged: 'boolean',
+              architectures: 'select_list', platforms: 'select_list',
               is_dev: 'boolean', is_disabled: 'boolean', disable_message: 'string',
               is_deleted: 'boolean', deleted_message: 'string'
             };
+            const SELECT_VALUES = {
+              architectures: ['amd64', 'arm64'],
+              platforms: ['pve', 'incus'],
+            };
             const FIELD_TO_CT_VAR = { tags: 'var_tags', unprivileged: 'var_unprivileged' };
             const RESOURCE_KEYS = { cpu: 'number', ram: 'number', hdd: 'number', os: 'string', version: 'string' };
             const METHOD_KEYS = { config_path: 'string', script: 'string' };
@@ -339,6 +344,17 @@ jobs:
                 if (isNaN(n)) return { error: '`' + key + '` must be a number' };
                 return { value: n };
               }
+              if (type === 'select_list') {
+                // architectures/platforms are multi-selects over a closed set,
+                // so an unknown value is rejected rather than stored. The model
+                // may hand back an array or a comma-separated string.
+                const allowed = SELECT_VALUES[key] || [];
+                const raw = Array.isArray(rawVal) ? rawVal : String(rawVal == null ? '' : rawVal).split(',');
+                const values = raw.map(function (v) { return String(v).trim(); }).filter(Boolean);
+                const bad = values.filter(function (v) { return allowed.indexOf(v) === -1; });
+                if (bad.length > 0) return { error: '`' + key + '` accepts ' + allowed.join(', ') + ' — got: ' + bad.join(', ') };
+                return { value: values };
+              }
               if (type === 'nullable_string') return { value: rawVal === '' || rawVal == null ? null : String(rawVal) };
               return { value: String(rawVal) };
             }

.github/workflows/pocketbase-bot.yml

@@ -323,9 +323,10 @@ jobs:
               '/pocketbase <slug> method remove <type>\n' +
               '```\n' +
               'Method fields: `cpu` `ram` `hdd` `os` `version` `config_path` `script`\n\n' +
-              '**Editable fields:** `name` `description` `logo` `documentation` `website` `project_url` `github` ' +
+              '**Editable fields:** `name` `description` `logo` `documentation` `website` `project_url` `repository` ' +
               '`config_path` `port` `default_user` `default_passwd` ' +
-              '`updateable` `privileged` `has_arm` `is_dev` ' +
+              '`updateable` `privileged` `is_dev` ' +
+              '`architectures` (amd64,arm64) `platforms` (pve,incus) ' +
               '`is_disabled` `disable_message` `is_deleted` `deleted_message`';
 
             if (!withoutCmd) {
@@ -504,7 +505,8 @@ jobs:
               out.push('- **Port:** ' + (record.port != null ? '`' + record.port + '`' : '—'));
               out.push('- **Updateable:** ' + (record.updateable ? 'Yes' : 'No'));
               out.push('- **Privileged:** ' + (record.privileged ? 'Yes' : 'No'));
-              out.push('- **ARM:** ' + (record.has_arm ? 'Yes' : 'No'));
+              out.push('- **Architectures:** ' + ((record.architectures || []).join(', ') || 'amd64'));
+              out.push('- **Platforms:** ' + ((record.platforms || []).join(', ') || 'pve'));
               if (record.is_dev) out.push('- **Dev:** Yes');
               if (record.is_disabled) out.push('- **Disabled:** Yes' + (record.disable_message ? ' — ' + record.disable_message : ''));
               if (record.is_deleted) out.push('- **Deleted:** Yes' + (record.deleted_message ? ' — ' + record.deleted_message : ''));
@@ -838,7 +840,7 @@ jobs:
               const fieldName = setMatch[1].toLowerCase();
               const SET_ALLOWED = {
                 name: 'string', description: 'string', logo: 'string',
-                documentation: 'string', website: 'string', project_url: 'string', github: 'string',
+                documentation: 'string', website: 'string', project_url: 'string', repository: 'string',
                 config_path: 'string', disable_message: 'string', deleted_message: 'string'
               };
               if (!SET_ALLOWED[fieldName]) {
@@ -888,7 +890,7 @@ jobs:
                 documentation:    'string',
                 website:          'string',
                 project_url:      'string',
-                github:           'string',
+                repository:       'string',
                 config_path:      'string',
                 tags:             'string',
                 port:             'number',
@@ -897,7 +899,8 @@ jobs:
                 unprivileged:     'number',
                 updateable:       'boolean',
                 privileged:       'boolean',
-                has_arm:          'boolean',
+                architectures:    'select_list',
+                platforms:        'select_list',
                 is_dev:           'boolean',
                 is_disabled:      'boolean',
                 disable_message:  'string',
@@ -924,6 +927,10 @@ jobs:
               }
 
               // Cast values to correct types
+              const SELECT_VALUES = {
+                architectures: ['amd64', 'arm64'],
+                platforms: ['pve', 'incus'],
+              };
               const payload = {};
               for (const [key, rawVal] of Object.entries(parsedFields)) {
                 const type = ALLOWED_FIELDS[key];
@@ -943,6 +950,18 @@ jobs:
                     process.exit(0);
                   }
                   payload[key] = n;
+                } else if (type === 'select_list') {
+                  // architectures/platforms are multi-selects over a closed set,
+                  // so an unknown value is rejected rather than stored.
+                  const allowed = SELECT_VALUES[key] || [];
+                  const values = rawVal.split(',').map(function (v) { return v.trim(); }).filter(Boolean);
+                  const bad = values.filter(function (v) { return allowed.indexOf(v) === -1; });
+                  if (bad.length > 0) {
+                    await addReaction('-1');
+                    await postComment('❌ **PocketBase Bot**: `' + key + '` accepts ' + allowed.join(', ') + ' — got: `' + bad.join(', ') + '`');
+                    process.exit(0);
+                  }
+                  payload[key] = values;
                 } else if (type === 'nullable_string') {
                   payload[key] = rawVal === '' ? null : rawVal;
                 } else {

.github/workflows/push-json-to-pocketbase.yml

@@ -179,7 +179,19 @@ jobs:
             if (resolvedType) payload.type = resolvedType;
             var resolvedCats = (data.categories || []).map(function(n) { return categoryNameToPbId[categoryIdToName[n]]; }).filter(Boolean);
             if (resolvedCats.length) payload.categories = resolvedCats;
-            if (data.has_arm !== undefined) payload.has_arm = data.has_arm === true || data.has_arm === 'true';
+            // architectures replaces has_arm: a boolean could say "also ARM" but
+            // not "ARM only" or "amd64 only". A record written before the field
+            // existed is read through the old key so nothing silently drops.
+            if (Array.isArray(data.architectures)) {
+              payload.architectures = data.architectures.filter(function (a) { return a === 'amd64' || a === 'arm64'; });
+            } else if (data.has_arm !== undefined) {
+              payload.architectures = (data.has_arm === true || data.has_arm === 'true') ? ['amd64', 'arm64'] : ['amd64'];
+            }
+            if (Array.isArray(data.platforms)) {
+              payload.platforms = data.platforms.filter(function (p) { return p === 'pve' || p === 'incus'; });
+            }
+            if (Array.isArray(data.app_vars)) payload.app_vars = data.app_vars;
+            if (data.repository !== undefined) payload.repository = data.repository;
             if (data.version !== undefined) payload.version = data.version;
             if (data.changelog !== undefined) payload.changelog = data.changelog;
             if (data.screenshots !== undefined) payload.screenshots = data.screenshots;

CHANGELOG.md

@@ -86,6 +86,9 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 
 
+
+
+
 
 
 
@@ -99,7 +102,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 
 <details>
-<summary><h4>August (1 entries)</h4></summary>
+<summary><h4>August (8 entries)</h4></summary>
 
 [View August 2026 Changelog](.github/changelogs/2026/08.md)
 
@@ -518,6 +521,206 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-08-14
+
+### 🆕 New Scripts
+
+  - RSS-Bridge ([#16471](https://github.com/community-scripts/ProxmoxVE/pull/16471))
+- GoDoxy ([#16470](https://github.com/community-scripts/ProxmoxVE/pull/16470))
+- Mumble ([#16474](https://github.com/community-scripts/ProxmoxVE/pull/16474))
+- Fleet ([#16472](https://github.com/community-scripts/ProxmoxVE/pull/16472))
+- Newt ([#16473](https://github.com/community-scripts/ProxmoxVE/pull/16473))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - calibre-web: install as package for 0.6.27's src-layout restructure [@MickLesk](https://github.com/MickLesk) ([#16480](https://github.com/community-scripts/ProxmoxVE/pull/16480))
+    - Wanderer: Refactor of Services / Installation / Paths [@johanngrobe](https://github.com/johanngrobe) ([#16487](https://github.com/community-scripts/ProxmoxVE/pull/16487))
+    - pelican-panel: set APP_URL to container IP [@MickLesk](https://github.com/MickLesk) ([#16488](https://github.com/community-scripts/ProxmoxVE/pull/16488))
+    - fix(ampache): update to PHP 8.5 asset, auto-upgrade PHP on update [@CervezaStallone](https://github.com/CervezaStallone) ([#16484](https://github.com/community-scripts/ProxmoxVE/pull/16484))
+
+  - #### ✨ New Features
+
+    - projectsend: rewrite for 2.0.0 (Laravel, nginx, MariaDB) [@MickLesk](https://github.com/MickLesk) ([#16477](https://github.com/community-scripts/ProxmoxVE/pull/16477))
+    - Homepage v2.0 [@vhsdream](https://github.com/vhsdream) ([#16500](https://github.com/community-scripts/ProxmoxVE/pull/16500))
+
+  - #### 🔧 Refactor
+
+    - Refactor: PowerDNS move poweradmin database outside the web root [@MickLesk](https://github.com/MickLesk) ([#16476](https://github.com/community-scripts/ProxmoxVE/pull/16476))
+    - paperless-ngx: run services with uv --no-sync to avoid startup network dependency [@MickLesk](https://github.com/MickLesk) ([#16479](https://github.com/community-scripts/ProxmoxVE/pull/16479))
+
+## 2026-08-13
+
+### 🆕 New Scripts
+
+  - SuggestArr ([#16449](https://github.com/community-scripts/ProxmoxVE/pull/16449))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(stirling-pdf): LibreOffice listener collides with unoserver on UNO port 2002, burning a core [@angusmaul](https://github.com/angusmaul) ([#16460](https://github.com/community-scripts/ProxmoxVE/pull/16460))
+    - fix(reitti): enable SNI for tile cache [@kylemd](https://github.com/kylemd) ([#16463](https://github.com/community-scripts/ProxmoxVE/pull/16463))
+    - [wanderer] refactor [@johanngrobe](https://github.com/johanngrobe) ([#16448](https://github.com/community-scripts/ProxmoxVE/pull/16448))
+
+  - #### ✨ New Features
+
+    - feat: Update koillection-install.sh to support API usage [@Crazy-Duck](https://github.com/Crazy-Duck) ([#16425](https://github.com/community-scripts/ProxmoxVE/pull/16425))
+
+## 2026-08-12
+
+### 🆕 New Scripts
+
+  - Stalwart ([#16388](https://github.com/community-scripts/ProxmoxVE/pull/16388))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - networkoptimizer: mitigate dotnet publish hang in LXC [@MickLesk](https://github.com/MickLesk) ([#16436](https://github.com/community-scripts/ProxmoxVE/pull/16436))
+    - lazylibrarian: reinstall deps after git pull on update [@MickLesk](https://github.com/MickLesk) ([#16435](https://github.com/community-scripts/ProxmoxVE/pull/16435))
+    - wanderer: fix deprecated meilisearch upgrade flag [@MickLesk](https://github.com/MickLesk) ([#16434](https://github.com/community-scripts/ProxmoxVE/pull/16434))
+    - calibre-web: fix release asset filename pattern [@MickLesk](https://github.com/MickLesk) ([#16433](https://github.com/community-scripts/ProxmoxVE/pull/16433))
+    - fix(stirling-pdf): unoserver installed into the venv, and login mode truncates .env [@angusmaul](https://github.com/angusmaul) ([#16439](https://github.com/community-scripts/ProxmoxVE/pull/16439))
+    - fix(pulse): keep the container recoverable when an update fails [@rcourtman](https://github.com/rcourtman) ([#16311](https://github.com/community-scripts/ProxmoxVE/pull/16311))
+
+  - #### 🔧 Refactor
+
+    - ConvertX: add some new dependencies [@MickLesk](https://github.com/MickLesk) ([#16437](https://github.com/community-scripts/ProxmoxVE/pull/16437))
+
+## 2026-08-11
+
+### 🚀 Updated Scripts
+
+  - Update source URL for Reactive Resume [@MickLesk](https://github.com/MickLesk) ([#16407](https://github.com/community-scripts/ProxmoxVE/pull/16407))
+
+  - #### 🐞 Bug Fixes
+
+    - Pelican-Panel: add php artisan p:environment:database [@MickLesk](https://github.com/MickLesk) ([#16397](https://github.com/community-scripts/ProxmoxVE/pull/16397))
+    - outline: fix URL sed matching wrong line in .env.sample // refactor .env generation [@MickLesk](https://github.com/MickLesk) ([#16408](https://github.com/community-scripts/ProxmoxVE/pull/16408))
+    - paperless-ngx: reindex Tantivy search index on webserver start [@MickLesk](https://github.com/MickLesk) ([#16395](https://github.com/community-scripts/ProxmoxVE/pull/16395))
+    - karakeep: pin Node.js to 22 LTS, avoid Node 24.19 better-sqlite3 crash [@MickLesk](https://github.com/MickLesk) ([#16396](https://github.com/community-scripts/ProxmoxVE/pull/16396))
+
+  - #### ✨ New Features
+
+    - Open WebUI: add optional OpenTelemetry package install [@irishpadres](https://github.com/irishpadres) ([#16415](https://github.com/community-scripts/ProxmoxVE/pull/16415))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - fix(add-tailscale-lxc): stop spinner before whiptail menu [@halcycon](https://github.com/halcycon) ([#16402](https://github.com/community-scripts/ProxmoxVE/pull/16402))
+
+  - #### 🔧 Refactor
+
+    - arcane: fix projects/builds dir ownership for non-root container UID [@MickLesk](https://github.com/MickLesk) ([#16411](https://github.com/community-scripts/ProxmoxVE/pull/16411))
+
+## 2026-08-10
+
+### 🆕 New Scripts
+
+  - GitLab ([#16386](https://github.com/community-scripts/ProxmoxVE/pull/16386))
+- TeslaMate ([#16385](https://github.com/community-scripts/ProxmoxVE/pull/16385))
+- tor-snowflake ([#15684](https://github.com/community-scripts/ProxmoxVE/pull/15684))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - ErsatzTV: update ffmpeg to 8.1 version [@MickLesk](https://github.com/MickLesk) ([#16383](https://github.com/community-scripts/ProxmoxVE/pull/16383))
+
+### 🧰 Tools
+
+  - post-pdm-install ([#16368](https://github.com/community-scripts/ProxmoxVE/pull/16368))
+
+## 2026-08-09
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Fix: CouchDB Erlang cookie breaks vm.args (use hex) [@fudianchn](https://github.com/fudianchn) ([#16361](https://github.com/community-scripts/ProxmoxVE/pull/16361))
+    - SparkyFitness: Install Git for frontend builds [@MickLesk](https://github.com/MickLesk) ([#16352](https://github.com/community-scripts/ProxmoxVE/pull/16352))
+    - Byparr: Use invisible-playwright browser setup [@MickLesk](https://github.com/MickLesk) ([#16353](https://github.com/community-scripts/ProxmoxVE/pull/16353))
+    - Crafty Controller: Restore ownership after updates [@MickLesk](https://github.com/MickLesk) ([#16354](https://github.com/community-scripts/ProxmoxVE/pull/16354))
+    - Webtrees: Fix schema check in silent mode [@MickLesk](https://github.com/MickLesk) ([#16355](https://github.com/community-scripts/ProxmoxVE/pull/16355))
+    - SigNoz: Allow legacy metadata schema on ClickHouse 26 [@MickLesk](https://github.com/MickLesk) ([#16356](https://github.com/community-scripts/ProxmoxVE/pull/16356))
+
+### 🧰 Tools
+
+  - #### ✨ New Features
+
+    - Portainer: Update existing CE and BE installations [@MickLesk](https://github.com/MickLesk) ([#16357](https://github.com/community-scripts/ProxmoxVE/pull/16357))
+
+### 📚 Documentation
+
+  - github: update Star History links and image sources [@MickLesk](https://github.com/MickLesk) ([#16367](https://github.com/community-scripts/ProxmoxVE/pull/16367))
+
+## 2026-08-08
+
+### 🆕 New Scripts
+
+  - Ignis ([#16330](https://github.com/community-scripts/ProxmoxVE/pull/16330))
+
+### 💾 Core
+
+  - #### ✨ New Features
+
+    - core - setup_nodejs: bypass npm allowScripts policy globally on npm >=11 [@MickLesk](https://github.com/MickLesk) ([#16280](https://github.com/community-scripts/ProxmoxVE/pull/16280))
+
+## 2026-08-07
+
+### 🆕 New Scripts
+
+  - NetworkOptimizer ([#16328](https://github.com/community-scripts/ProxmoxVE/pull/16328))
+- Orb ([#16329](https://github.com/community-scripts/ProxmoxVE/pull/16329))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - HortusFox: start applying db migrations [@tomfrenzel](https://github.com/tomfrenzel) ([#16324](https://github.com/community-scripts/ProxmoxVE/pull/16324))
+    - Docker: report container updates instead of prompting, stop auto-updating Portainer Agent, fix addon detection of legacy Portainer [@MickLesk](https://github.com/MickLesk) ([#16298](https://github.com/community-scripts/ProxmoxVE/pull/16298))
+    - Immich: retry mise install on transient npm download failures [@MickLesk](https://github.com/MickLesk) ([#16301](https://github.com/community-scripts/ProxmoxVE/pull/16301))
+    - changedetection: remove msttcorefonts to fix install hang [@austinpilz](https://github.com/austinpilz) ([#16319](https://github.com/community-scripts/ProxmoxVE/pull/16319))
+
+  - #### 🔧 Refactor
+
+    - core: extend new vars and pocketbase values [@MickLesk](https://github.com/MickLesk) ([#16313](https://github.com/community-scripts/ProxmoxVE/pull/16313))
+
+## 2026-08-06
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - paperless: change update abort message (endless spinner) [@MickLesk](https://github.com/MickLesk) ([#16299](https://github.com/community-scripts/ProxmoxVE/pull/16299))
+
+  - #### ✨ New Features
+
+    - Vikunja: remove version pin, v2.5.0 fixes the systemd syscall filter crash [@MickLesk](https://github.com/MickLesk) ([#16300](https://github.com/community-scripts/ProxmoxVE/pull/16300))
+
+### 💾 Core
+
+  - #### 🔧 Refactor
+
+    - build.func: filter templates by host architecture during search [@MickLesk](https://github.com/MickLesk) ([#16302](https://github.com/community-scripts/ProxmoxVE/pull/16302))
+
+## 2026-08-05
+
+### 🚀 Updated Scripts
+
+  - #### ✨ New Features
+
+    - NextcloudPI: Bump to Debian Trixie & Tweak broken SSH [@MickLesk](https://github.com/MickLesk) ([#15957](https://github.com/community-scripts/ProxmoxVE/pull/15957))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - fix(monitor-all): reduce polling CPU overhead [@jomplox](https://github.com/jomplox) ([#15907](https://github.com/community-scripts/ProxmoxVE/pull/15907))
+
 ## 2026-08-04
 
 ### 🆕 New Scripts
@@ -1102,94 +1305,4 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
     - Adapt to new artifact filename format for pocket id [@wollew](https://github.com/wollew) ([#15689](https://github.com/community-scripts/ProxmoxVE/pull/15689))
     - Fireshare: Fix for install and upgrade to v1.7.3 [@tremor021](https://github.com/tremor021) ([#15673](https://github.com/community-scripts/ProxmoxVE/pull/15673))
-    - Endurain: Fix update procedure [@tremor021](https://github.com/tremor021) ([#15674](https://github.com/community-scripts/ProxmoxVE/pull/15674))
+    - Endurain: Fix update procedure [@tremor021](https://github.com/tremor021) ([#15674](https://github.com/community-scripts/ProxmoxVE/pull/15674))
-
-## 2026-07-09
-
-### 🚀 Updated Scripts
-
-  - fix(pihole): repair Unbound DNS-over-TLS (DoT) forwarding config [@TowyTowy](https://github.com/TowyTowy) ([#15654](https://github.com/community-scripts/ProxmoxVE/pull/15654))
-
-## 2026-07-08
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Opencloud: Bump version to 7.2.1 [@vhsdream](https://github.com/vhsdream) ([#15655](https://github.com/community-scripts/ProxmoxVE/pull/15655))
-    - BabyBuddy: Harden update script [@MickLesk](https://github.com/MickLesk) ([#15642](https://github.com/community-scripts/ProxmoxVE/pull/15642))
-
-## 2026-07-07
-
-### 🆕 New Scripts
-
-  - Forgejo-Runner ([#15046](https://github.com/community-scripts/ProxmoxVE/pull/15046))
-
-## 2026-07-06
-
-### 🚀 Updated Scripts
-
-  - Fix alignment in various ct end messages [@tremor021](https://github.com/tremor021) ([#15632](https://github.com/community-scripts/ProxmoxVE/pull/15632))
-- Immich: Update libvips to 8.18.4 [@vhsdream](https://github.com/vhsdream) ([#15619](https://github.com/community-scripts/ProxmoxVE/pull/15619))
-
-  - #### 🐞 Bug Fixes
-
-    - Wizarr: Build JS and CSS static assets [@vhsdream](https://github.com/vhsdream) ([#15634](https://github.com/community-scripts/ProxmoxVE/pull/15634))
-    - RustDesk Server: Update URL format in rustdeskserver.sh [@tremor021](https://github.com/tremor021) ([#15626](https://github.com/community-scripts/ProxmoxVE/pull/15626))
-    - attempt to port docker-vm to support arm64 [@asylumexp](https://github.com/asylumexp) ([#15611](https://github.com/community-scripts/ProxmoxVE/pull/15611))
-    - fix(plane): don't clobber global app var, breaking /usr/bin/update [@asylumexp](https://github.com/asylumexp) ([#15612](https://github.com/community-scripts/ProxmoxVE/pull/15612))
-
-  - #### 🔧 Refactor
-
-    - cliproxyapi: point setup message at /management.html [@austinpilz](https://github.com/austinpilz) ([#15628](https://github.com/community-scripts/ProxmoxVE/pull/15628))
-
-### 🗑️ Deleted Scripts
-
-  - Remove: FlowiseAI [@MickLesk](https://github.com/MickLesk) ([#15624](https://github.com/community-scripts/ProxmoxVE/pull/15624))
-
-## 2026-07-05
-
-### 🆕 New Scripts
-
-  - excalidash ([#15604](https://github.com/community-scripts/ProxmoxVE/pull/15604))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - fix: homarr: cli [@CrazyWolf13](https://github.com/CrazyWolf13) ([#15603](https://github.com/community-scripts/ProxmoxVE/pull/15603))
-    - immich: vacuum smart_search/face_search before VectorChord bump [@irishpadres](https://github.com/irishpadres) ([#15607](https://github.com/community-scripts/ProxmoxVE/pull/15607))
-
-## 2026-07-04
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Element Synapse: Fix heredoc syntax in elementsynapse-install.sh [@tremor021](https://github.com/tremor021) ([#15594](https://github.com/community-scripts/ProxmoxVE/pull/15594))
-    - Twenty: Fix backup restore [@tremor021](https://github.com/tremor021) ([#15586](https://github.com/community-scripts/ProxmoxVE/pull/15586))
-    - fix(endurain): update frontend dist path after upstream restructure [@joaovitoriasilva](https://github.com/joaovitoriasilva) ([#15590](https://github.com/community-scripts/ProxmoxVE/pull/15590))
-
-## 2026-07-03
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Immich: handle mise monorepo_root rename correctly | bump to 3.0.1 [@MickLesk](https://github.com/MickLesk) ([#15557](https://github.com/community-scripts/ProxmoxVE/pull/15557))
-
-  - #### ✨ New Features
-
-    - Opencloud: bump to v7.2.0 [@vhsdream](https://github.com/vhsdream) ([#15575](https://github.com/community-scripts/ProxmoxVE/pull/15575))
-
-### 💾 Core
-
-  - #### 🔧 Refactor
-
-    - tools.func: fix corepack/pnpm install flow in setup_nodejs [@MickLesk](https://github.com/MickLesk) ([#15579](https://github.com/community-scripts/ProxmoxVE/pull/15579))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - Removed deprecated parameter in Filebrowser Quantum configuration [@alpargatagazer](https://github.com/alpargatagazer) ([#15573](https://github.com/community-scripts/ProxmoxVE/pull/15573))

CONTRIBUTING.md

@@ -103,6 +103,55 @@ Key rules at a glance:
 - Quote all variables: `"$VAR"` not `$VAR`
 - Use lowercase variable names
 - Do not hardcode credentials or sensitive values
+- Never prompt without an escape hatch — see below
+
+### Answering a prompt up front
+
+An install script that only asks cannot be deployed unattended. Read the
+variable first and prompt only when it is unset:
+
+```bash
+if [[ -z "${var_admin_user:-}" ]]; then
+  read -r -p "${TAB3}Admin username: " var_admin_user
+fi
+var_admin_user="${var_admin_user:-admin}"
+```
+
+Name them `var_<something>`, the same namespace the container variables use.
+`install/forgejo-runner-install.sh`, `install/pangolin-install.sh`, and `install/docker-install.sh` all
+follow this.
+
+The variable also has to be exported from `ct/<app>.sh`, or it never reaches
+the container — `lxc-attach` carries the caller's environment, but only for
+what was actually exported:
+
+```bash
+export var_admin_user="${var_admin_user:-}"
+```
+
+Declare them on the script's PocketBase record in `app_vars` so the website's
+generator can offer them as fields:
+
+```json
+"app_vars": [
+  {
+    "name": "var_admin_user",
+    "label": "Admin Username",
+    "type": "text",
+    "default": "admin"
+  },
+  {
+    "name": "var_admin_pass",
+    "label": "Admin Password",
+    "type": "password",
+    "secret": true
+  }
+]
+```
+
+`type` is one of `text`, `password`, `number`, `boolean` (`yes`/`no`) or
+`select` (with `options`). Mark anything credential-like `secret` — the
+generator keeps those out of shareable links and out of the on-screen summary.
 
 Full standards and examples: **[community-scripts.org/docs/contribution](https://community-scripts.org/docs/contribution)**
 
@@ -123,8 +172,19 @@ dev_mode="trace,keep" bash -c "$(curl -fsSL https://raw.githubusercontent.com/co
 | `pause`      | Pauses execution at key points before customization          |
 | `breakpoint` | Drops to a shell at hardcoded `breakpoint` calls in scripts  |
 | `logs`       | Saves detailed build logs to `/var/log/community-scripts/`   |
-| `dryrun`     | Bypasses actual container creation (limited support)         |
 | `motd`       | Forces an update of the Message of the Day                   |
+| `net`        | Logs every engine fetch: HTTP status, duration and URL       |
+| `timing`     | Times each step and lists the slowest ones at the end        |
+
+Any flag also prints the resolved context first — where the engine came from,
+both roots and URLs, the app, platform and versions — and repaints the greens
+red, so a dev run is never mistaken for a normal install.
+
+Setting `dev_mode` without naming a flag (`dev_mode=`, `=1`, `=ask`) opens a
+picker before the install menu.
+
+`dryrun` was removed: it only intercepted the `silent()` wrapper, so `pct
+create` still ran and the container was still built.
 
 ---
 

README.md

@@ -171,11 +171,21 @@ This project runs on community contributions. Whether you want to write new scri
 </p>
 
 <p align="center">
-  <a href="https://star-history.com/#community-scripts/ProxmoxVE&Date">
+  <a href="https://www.star-history.com/?repos=community-scripts%2FProxmoxVE&type=date&legend=top-left">
     <picture>
-      <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=community-scripts/ProxmoxVE&type=Date&theme=dark" />
+      <source
-      <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=community-scripts/ProxmoxVE&type=Date" />
+        media="(prefers-color-scheme: dark)"
-      <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=community-scripts/ProxmoxVE&type=Date" width="700" />
+        srcset="https://api.star-history.com/chart?repos=community-scripts/ProxmoxVE&type=date&theme=dark&legend=top-left&sealed_token=-lUy2KH6pJryUyLCbiWRwFz3ilXMDFVFHm0lJcqh-Hl5e0QNNKjINNcXzULhaZVpBugN_TDaxOawEAuzwBc5Sjqa2mCRw9K6TdCioKRDsS_qXUwhkLQSCMRSg1schCdl4rQD8qEj7PWBjin-fyHnDm7NnM6akZp59jndG7qV7PrvG8nLBgDIuuA-wAI3"
+      />
+      <source
+        media="(prefers-color-scheme: light)"
+        srcset="https://api.star-history.com/chart?repos=community-scripts/ProxmoxVE&type=date&legend=top-left&sealed_token=-lUy2KH6pJryUyLCbiWRwFz3ilXMDFVFHm0lJcqh-Hl5e0QNNKjINNcXzULhaZVpBugN_TDaxOawEAuzwBc5Sjqa2mCRw9K6TdCioKRDsS_qXUwhkLQSCMRSg1schCdl4rQD8qEj7PWBjin-fyHnDm7NnM6akZp59jndG7qV7PrvG8nLBgDIuuA-wAI3"
+      />
+      <img
+        alt="Star History Chart"
+        src="https://api.star-history.com/chart?repos=community-scripts/ProxmoxVE&type=date&legend=top-left&sealed_token=-lUy2KH6pJryUyLCbiWRwFz3ilXMDFVFHm0lJcqh-Hl5e0QNNKjINNcXzULhaZVpBugN_TDaxOawEAuzwBc5Sjqa2mCRw9K6TdCioKRDsS_qXUwhkLQSCMRSg1schCdl4rQD8qEj7PWBjin-fyHnDm7NnM6akZp59jndG7qV7PrvG8nLBgDIuuA-wAI3"
+        width="700"
+      />
     </picture>
   </a>
 </p>

ct/ampache.sh

@@ -39,7 +39,15 @@ function update_script() {
       /opt/ampache/public/play/.htaccess \
       /opt/ampache/advanced-config
 
-    fetch_and_deploy_gh_release "Ampache" "ampache/ampache" "prebuild" "latest" "/opt/ampache" "ampache-*_all_php8.4.zip"
+    if ! dpkg -l 2>/dev/null | grep -q "libapache2-mod-php8.5"; then
+      PHP_VERSION="8.5" PHP_APACHE="YES" setup_php
+      sed -i -e 's/upload_max_filesize = .*/upload_max_filesize = 100M/' \
+        -e 's/post_max_size = .*/post_max_size = 100M/' \
+        -e 's/max_execution_time = .*/max_execution_time = 600/' \
+        -e 's/memory_limit = .*/memory_limit = 512M/' /etc/php/8.5/apache2/php.ini
+    fi
+
+    fetch_and_deploy_gh_release "Ampache" "ampache/ampache" "prebuild" "latest" "/opt/ampache" "ampache-*_all_php8.5.zip"
 
     restore_backup
     chmod 664 /opt/ampache/public/rest/.htaccess /opt/ampache/public/play/.htaccess

ct/byparr.sh

@@ -81,7 +81,7 @@ function update_script() {
     msg_info "Configuring Byparr"
     cd /opt/Byparr
     $STD uv sync --link-mode copy
-    $STD uv run camoufox fetch
+    $STD uv run python -m invisible_playwright fetch
     msg_ok "Configured Byparr"
 
     msg_info "Starting Service"

ct/calibre-web.sh

@@ -38,16 +38,19 @@ function update_script() {
     create_backup /opt/calibre-web/app.db \
       /opt/calibre-web/data
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Calibre-Web" "janeczku/calibre-web" "prebuild" "latest" "/opt/calibre-web" "calibre-web*.tar.gz"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Calibre-Web" "janeczku/calibre-web" "prebuild" "latest" "/opt/calibre-web" "calibreweb*.tar.gz"
     setup_uv
 
     msg_info "Installing Dependencies"
     cd /opt/calibre-web
     $STD uv venv --clear /opt/calibre-web/.venv
     $STD uv pip install --python /opt/calibre-web/.venv/bin/python --no-cache-dir --upgrade pip setuptools wheel
-    $STD uv pip install --python /opt/calibre-web/.venv/bin/python --no-cache-dir -r requirements.txt
+    $STD uv pip install --python /opt/calibre-web/.venv/bin/python --no-cache-dir .
     msg_ok "Installed Dependencies"
 
+    sed -i 's|^ExecStart=.*|ExecStart=/opt/calibre-web/.venv/bin/cps|' /etc/systemd/system/calibre-web.service
+    $STD systemctl daemon-reload
+
     restore_backup
 
     msg_info "Starting Service"

ct/convertx.sh

@@ -34,7 +34,19 @@ function update_script() {
     systemctl stop convertx
     msg_info "Stopped Service"
 
-    ensure_dependencies libreoffice-writer
+    ensure_dependencies libreoffice-writer dasel graphicsmagick libemail-outlook-message-perl libheif-examples libjxl-tools resvg
+
+    if ! command -v markitdown &>/dev/null; then
+      setup_uv
+      msg_info "Installing markitdown"
+      export UV_TOOL_BIN_DIR=/usr/local/bin
+      $STD uv tool install "markitdown[all]"
+      msg_ok "Installed markitdown"
+    fi
+
+    if ! command -v vtracer &>/dev/null; then
+      fetch_and_deploy_gh_release "vtracer" "visioncortex/vtracer" "prebuild" "0.6.4" "/usr/local/bin" "vtracer-$(arch_resolve "x86_64" "aarch64")-unknown-linux-musl.tar.gz"
+    fi
 
     create_backup /opt/convertx/data
 

ct/crafty-controller.sh

@@ -44,6 +44,7 @@ function update_script() {
 
     CLEAN_INSTALL=1 fetch_and_deploy_gl_release "Crafty-Controller" "crafty-controller/crafty-4" "tarball" "latest" "/opt/crafty-controller/crafty/crafty-4"
 
+    chown -R crafty:crafty /opt/crafty-controller
     restore_backup
 
     msg_info "Updating TemurinJDK"
@@ -53,7 +54,6 @@ function update_script() {
     msg_ok "Updated TemurinJDK"
 
     msg_info "Updating Python dependencies"
-    chown -R crafty:crafty /opt/crafty-controller
     cd /opt/crafty-controller/crafty/crafty-4
     $STD sudo -u crafty bash -c '
       source /opt/crafty-controller/crafty/.venv/bin/activate

ct/docker.sh

@@ -42,20 +42,6 @@ function update_script() {
     echo -e "${TAB}${TAB}${GN}bash -c \"\$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/portainer.sh)\"${CL}"
   fi
 
-  if docker ps -a --format '{{.Names}}' | grep -q '^portainer_agent$'; then
-    msg_info "Updating Portainer Agent"
-    $STD docker pull portainer/agent:latest
-    $STD docker stop portainer_agent
-    $STD docker rm portainer_agent
-    $STD docker run -d \
-      -p 9001:9001 \
-      --name=portainer_agent \
-      --restart=always \
-      -v /var/run/docker.sock:/var/run/docker.sock \
-      -v /var/lib/docker/volumes:/var/lib/docker/volumes \
-      portainer/agent
-    msg_ok "Updated Portainer Agent"
-  fi
   msg_ok "Updated successfully!"
   exit
 }

ct/ersatztv.sh

@@ -47,7 +47,7 @@ function update_script() {
     systemctl stop ersatzTV
     msg_ok "Stopped ErsatzTV"
 
-    fetch_and_deploy_gh_release "ersatztv-ffmpeg" "ErsatzTV/ErsatzTV-ffmpeg" "prebuild" "latest" "/opt/ErsatzTV-ffmpeg" "*-$(arch_resolve "linux64" "linuxarm64")-gpl-7.1.tar.xz"
+    fetch_and_deploy_gh_release "ersatztv-ffmpeg" "ErsatzTV/ErsatzTV-ffmpeg" "prebuild" "latest" "/opt/ErsatzTV-ffmpeg" "*-$(arch_resolve "linux64" "linuxarm64")-gpl-8.1.tar.xz"
 
     msg_info "Set ErsatzTV-ffmpeg links"
     chmod +x /opt/ErsatzTV-ffmpeg/bin/*

ct/fleet.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/fleetdm/fleet
+
+APP="Fleet"
+var_tags="${var_tags:-monitoring;device-management;security}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-ubuntu}"
+var_version="${var_version:-24.04}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /opt/fleet/fleet ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "fleet" "fleetdm/fleet"; then
+    msg_info "Stopping Service"
+    systemctl stop fleet
+    msg_ok "Stopped Service"
+
+    fetch_and_deploy_gh_release "fleet" "fleetdm/fleet" "prebuild" "latest" "/opt/fleet" "fleet_v*_linux.tar.gz"
+    chmod +x /opt/fleet/fleet
+
+    msg_info "Running Database Migrations"
+    set -a && source /opt/fleet/.env && set +a
+    $STD /opt/fleet/fleet prepare db --no-prompt
+    msg_ok "Ran Database Migrations"
+
+    msg_info "Starting Service"
+    systemctl start fleet
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8080${CL}"
+echo -e "${INFO}${YW} Admin Email:${CL} ${BGN}admin@fleet.local${CL}"
+echo -e "${INFO}${YW} Admin Password:${CL} ${BGN}Check inside the container: cat /opt/fleet/.env${CL}"

ct/forgejo-runner.sh

@@ -18,6 +18,7 @@ var_nesting="${var_nesting:-1}"
 var_keyctl="${var_keyctl:-1}"
 
 export var_forgejo_instance="${var_forgejo_instance:-}"
+export var_forgejo_runner_uuid="${var_forgejo_runner_uuid:-}"
 export var_forgejo_runner_token="${var_forgejo_runner_token:-}"
 export var_runner_labels="${var_runner_labels:-}"
 
@@ -64,6 +65,10 @@ if [[ -n "${mode:-}" ]]; then
     msg_error "var_forgejo_instance is required for unattended installs."
     exit 1
   fi
+  if [[ -z "${var_forgejo_runner_uuid:-}" ]]; then
+    msg_error "var_forgejo_runner_uuid is required for unattended installs."
+    exit 1
+  fi
   if [[ -z "${var_forgejo_runner_token:-}" ]]; then
     msg_error "var_forgejo_runner_token is required for unattended installs."
     exit 1

ct/gitlab.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://about.gitlab.com/
+
+APP="GitLab"
+var_tags="${var_tags:-git;devtools}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-8192}"
+var_disk="${var_disk:-40}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/gitlab ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  msg_info "Updating GitLab (Patience)"
+  $STD apt update
+  $STD apt install -y gitlab-ce
+  msg_ok "Updated GitLab"
+
+  msg_info "Reconfiguring GitLab (Patience)"
+  $STD gitlab-ctl reconfigure
+  msg_ok "Reconfigured GitLab"
+  msg_ok "Updated successfully!"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}${CL}"
+echo -e "${INFO}${YW}The initial root password is valid for 24 hours:${CL}"
+echo -e "${TAB}${DEFAULT}${BGN}cat /etc/gitlab/initial_root_password${CL}"

ct/godoxy.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ) | Co-Authors: yusing
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/yusing/godoxy
+
+APP="GoDoxy"
+var_tags="${var_tags:-reverse-proxy;webserver;network}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-512}"
+var_disk="${var_disk:-2}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /opt/godoxy/godoxy ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "godoxy" "yusing/godoxy"; then
+    msg_info "Stopping Service"
+    systemctl stop godoxy
+    msg_ok "Stopped Service"
+
+    create_backup \
+      /opt/godoxy/config \
+      /opt/godoxy/data \
+      /opt/godoxy/error_pages \
+      /etc/godoxy.env \
+      /etc/ssl/godoxy
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "godoxy" "yusing/godoxy" "singlefile" "latest" "/opt/godoxy" "godoxy-linux-$(arch_resolve)"
+    restore_backup
+
+    msg_info "Starting Service"
+    systemctl start godoxy
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}https://${IP}${CL}"
+echo -e "${INFO}${YW}Login as admin; the generated password is stored in /etc/godoxy.env.${CL}"

ct/headers/fleet

@@ -0,0 +1,6 @@
+    ________          __ 
+   / ____/ /__  ___  / /_
+  / /_  / / _ \/ _ \/ __/
+ / __/ / /  __/  __/ /_  
+/_/   /_/\___/\___/\__/  
+                         

ct/headers/gitlab

@@ -0,0 +1,6 @@
+   _______ __  __          __  
+  / ____(_) /_/ /   ____ _/ /_ 
+ / / __/ / __/ /   / __ `/ __ \
+/ /_/ / / /_/ /___/ /_/ / /_/ /
+\____/_/\__/_____/\__,_/_.___/ 
+                               

ct/headers/godoxy

@@ -0,0 +1,6 @@
+   ______      ____                  
+  / ____/___  / __ \____  _  ____  __
+ / / __/ __ \/ / / / __ \| |/_/ / / /
+/ /_/ / /_/ / /_/ / /_/ />  </ /_/ / 
+\____/\____/_____/\____/_/|_|\__, /  
+                            /____/   

ct/headers/ignis

@@ -0,0 +1,6 @@
+    ____            _     
+   /  _/___ _____  (_)____
+   / // __ `/ __ \/ / ___/
+ _/ // /_/ / / / / (__  ) 
+/___/\__, /_/ /_/_/____/  
+    /____/                

ct/headers/mumble

@@ -0,0 +1,6 @@
+    __  ___                __    __   
+   /  |/  /_  ______ ___  / /_  / /__ 
+  / /|_/ / / / / __ `__ \/ __ \/ / _ \
+ / /  / / /_/ / / / / / / /_/ / /  __/
+/_/  /_/\__,_/_/ /_/ /_/_.___/_/\___/ 
+                                      

ct/headers/networkoptimizer

@@ -0,0 +1,6 @@
+    _   __     __                      __   ____        __  _           _                
+   / | / /__  / /__      ______  _____/ /__/ __ \____  / /_(_)___ ___  (_)___  ___  _____
+  /  |/ / _ \/ __/ | /| / / __ \/ ___/ //_/ / / / __ \/ __/ / __ `__ \/ /_  / / _ \/ ___/
+ / /|  /  __/ /_ | |/ |/ / /_/ / /  / ,< / /_/ / /_/ / /_/ / / / / / / / / /_/  __/ /    
+/_/ |_/\___/\__/ |__/|__/\____/_/  /_/|_|\____/ .___/\__/_/_/ /_/ /_/_/ /___/\___/_/     
+                                             /_/                                         

ct/headers/newt

@@ -0,0 +1,6 @@
+    _   __             __ 
+   / | / /__ _      __/ /_
+  /  |/ / _ \ | /| / / __/
+ / /|  /  __/ |/ |/ / /_  
+/_/ |_/\___/|__/|__/\__/  
+                          

ct/headers/orb

@@ -0,0 +1,6 @@
+   ____       __  
+  / __ \_____/ /_ 
+ / / / / ___/ __ \
+/ /_/ / /  / /_/ /
+\____/_/  /_.___/ 
+                  

ct/headers/rss-bridge

@@ -0,0 +1,6 @@
+    ____  __________       ____       _     __         
+   / __ \/ ___/ ___/      / __ )_____(_)___/ /___ ____ 
+  / /_/ /\__ \\__ \______/ __  / ___/ / __  / __ `/ _ \
+ / _, _/___/ /__/ /_____/ /_/ / /  / / /_/ / /_/ /  __/
+/_/ |_|/____/____/     /_____/_/  /_/\__,_/\__, /\___/ 
+                                          /____/       

ct/headers/stalwart

@@ -0,0 +1,6 @@
+   _____ __        __                    __ 
+  / ___// /_____ _/ /      ______ ______/ /_
+  \__ \/ __/ __ `/ / | /| / / __ `/ ___/ __/
+ ___/ / /_/ /_/ / /| |/ |/ / /_/ / /  / /_  
+/____/\__/\__,_/_/ |__/|__/\__,_/_/   \__/  
+                                            

ct/headers/suggestarr

@@ -0,0 +1,6 @@
+   _____                             __  ___             
+  / ___/__  ______ _____ ____  _____/ /_/   |  __________
+  \__ \/ / / / __ `/ __ `/ _ \/ ___/ __/ /| | / ___/ ___/
+ ___/ / /_/ / /_/ / /_/ /  __(__  ) /_/ ___ |/ /  / /    
+/____/\__,_/\__, /\__, /\___/____/\__/_/  |_/_/  /_/     
+           /____//____/                                  

ct/headers/teslamate

@@ -0,0 +1,6 @@
+  ______          __      __  ___      __     
+ /_  __/__  _____/ /___ _/  |/  /___ _/ /____ 
+  / / / _ \/ ___/ / __ `/ /|_/ / __ `/ __/ _ \
+ / / /  __(__  ) / /_/ / /  / / /_/ / /_/  __/
+/_/  \___/____/_/\__,_/_/  /_/\__,_/\__/\___/ 
+                                              

ct/headers/tor-snowflake

@@ -0,0 +1,6 @@
+   __                                            ______      __      
+  / /_____  _____      _________  ____ _      __/ __/ /___ _/ /_____ 
+ / __/ __ \/ ___/_____/ ___/ __ \/ __ \ | /| / / /_/ / __ `/ //_/ _ \
+/ /_/ /_/ / /  /_____(__  ) / / / /_/ / |/ |/ / __/ / /_/ / ,< /  __/
+\__/\____/_/        /____/_/ /_/\____/|__/|__/_/ /_/\__,_/_/|_|\___/ 
+                                                                     

ct/homepage.sh

@@ -39,15 +39,15 @@ function update_script() {
 
     create_backup /opt/homepage/.env /opt/homepage/config
     BACKUP_DIR=/opt/homepage-assets.backup create_backup /opt/homepage/public/images /opt/homepage/public/icons
-    
+
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "homepage" "gethomepage/homepage" "tarball"
-    
+
     restore_backup
 
     msg_info "Updating Homepage (Patience)"
     RELEASE=$(get_latest_github_release "gethomepage/homepage")
     cd /opt/homepage
-    echo 'onlyBuiltDependencies=*' >> .npmrc
+    echo 'onlyBuiltDependencies=*' >>.npmrc
     $STD pnpm install
     $STD pnpm update --no-save caniuse-lite
     export NEXT_PUBLIC_VERSION="v$RELEASE"
@@ -56,6 +56,27 @@ function update_script() {
     export NEXT_TELEMETRY_DISABLED=1
     $STD pnpm build
     BACKUP_DIR=/opt/homepage-assets.backup restore_backup
+    if ! grep -q 'AUTH' /opt/homepage/.env; then
+      msg_info "Updating .env"
+      cp /opt/homepage/.env /opt/homepage/env.bak
+      cat <<EOF >>/opt/homepage/.env
+## Optional Authentication
+# HOMEPAGE_AUTH_ENABLED=true
+# HOMEPAGE_AUTH_SECRET="$(openssl rand -base64 32)"
+# HOMEPAGE_EXTERNAL_URL=<your-external-url>
+## Uncomment below and use strong, unique password for password login
+# HOMEPAGE_AUTH_PASSWORD=
+## Uncomment and fill in below for OIDC login
+# HOMEPAGE_OIDC_ISSUER=
+# HOMEPAGE_OIDC_CLIENT_ID=
+# HOMEPAGE_OIDC_CLIENT_SECRET=
+# HOMEPAGE_OIDC_SCOPE=openid email profile
+# HOMEPAGE_OIDC_NAME=
+EOF
+      msg_ok "Updated .env"
+      rm /opt/homepage/env.bak
+      chmod 600 /opt/homepage/.env
+    fi
     msg_ok "Updated Homepage"
 
     msg_info "Starting service"

ct/hortusfox.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
 # Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
+# Author: MickLesk (CanbiZ) | Co-Author: Tom Frenzel (tomfrenzel)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://github.com/danielbrendel/hortusfox-web
 
@@ -34,29 +34,56 @@ function update_script() {
     systemctl stop apache2
     msg_ok "Stopped Service"
 
-    msg_info "Backing up current HortusFox installation"
+    cd /opt/hortusfox
-    cd /opt
+    if [[ ! -s app/migrations/migrations.list ]]; then
-    mv /opt/hortusfox/ /opt/hortusfox-backup
+      msg_info "Rebuilding HortusFox migration history"
-    msg_ok "Backed up current HortusFox installation"
+      local database_tables
+      database_tables="$(mariadb -u root -D hortusfox -NBe "SELECT TABLE_NAME FROM information_schema.TABLES WHERE TABLE_SCHEMA = DATABASE();")"
+      : >app/migrations/migrations.list
+      local migration migration_file table_name
+      for migration in app/migrations/*.php; do
+        migration_file="${migration##*/}"
+        table_name="${migration_file%.php}"
+        if [[ "$migration_file" == "VersionModel.php" ]] || grep -Fxq "$table_name" <<<"$database_tables"; then
+          php -r 'echo hash("sha512", $argv[1]), PHP_EOL;' -- "$migration_file" >>app/migrations/migrations.list
+        fi
+      done
+      msg_ok "Rebuilt HortusFox migration history"
+    fi
+    if [[ ! -f app/migrations/verhist.json && -f ~/.hortusfox ]]; then
+      printf '["%s"]\n' "$(<~/.hortusfox)" >app/migrations/verhist.json
+    fi
+
+    create_backup \
+      /opt/hortusfox/.env \
+      /opt/hortusfox/app/migrations/migrations.list \
+      /opt/hortusfox/app/migrations/verhist.json \
+      /opt/hortusfox/public/img \
+      /opt/hortusfox/public/attachments \
+      /opt/hortusfox/public/backup \
+      /opt/hortusfox/public/exports \
+      /opt/hortusfox/public/snd \
+      /opt/hortusfox/public/themes
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "hortusfox" "danielbrendel/hortusfox-web" "tarball"
+    restore_backup
 
     msg_info "Updating HortusFox"
     cd /opt/hortusfox
-    cp /opt/hortusfox-backup/.env /opt/hortusfox/.env
-    cp -a /opt/hortusfox-backup/public/img/. /opt/hortusfox/public/img/
     export COMPOSER_ALLOW_SUPERUSER=1
     $STD composer install --no-dev --optimize-autoloader
+    $STD php asatru migrate:list
     $STD php asatru migrate:upgrade
-    $STD php asatru plants:attributes
     $STD php asatru calendar:classes
+    $STD php asatru plants:attributes
+    $STD php asatru aquashell:config
     chown -R www-data:www-data /opt/hortusfox
-    rm -r /opt/hortusfox-backup
     msg_ok "Updated HortusFox"
 
     msg_info "Starting Service"
     systemctl start apache2
     msg_ok "Started Service"
+
     msg_ok "Updated successfully!"
   fi
   exit

ct/ignis.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Nystik-gh/ignis
+
+APP="Ignis"
+var_tags="${var_tags:-notes;obsidian}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_unprivileged="${var_unprivileged:-1}"
+var_arm64="${var_arm64:-yes}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/ignis ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "ignis" "Nystik-gh/ignis"; then
+    msg_info "Stopping Service"
+    systemctl stop ignis
+    msg_ok "Stopped Service"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "ignis" "Nystik-gh/ignis" "tarball"
+
+    msg_info "Building Ignis"
+    cd /opt/ignis
+    export NODE_OPTIONS="--max-old-space-size=4096"
+    export IGNIS_BUILD="$(cat ~/.ignis)"
+    $STD npm ci --ignore-scripts
+    $STD npm run build
+    $STD npm install -g @electron/asar
+    msg_ok "Built Ignis"
+
+    msg_info "Checking Obsidian Web Assets"
+    OBSIDIAN_VERSION=$(grep -oP 'OBSIDIAN_VERSION=\K[0-9.]+' /opt/ignis/apps/ignis-server/Dockerfile | head -n1)
+    [[ -z "$OBSIDIAN_VERSION" ]] && OBSIDIAN_VERSION="$(cat /opt/ignis_data/obsidian.version 2>/dev/null)"
+    if [[ -n "$OBSIDIAN_VERSION" && "$OBSIDIAN_VERSION" != "$(cat /opt/ignis_data/obsidian.version 2>/dev/null)" ]]; then
+      rm -rf /opt/ignis_data/obsidian-app
+      mkdir -p /opt/ignis_data/obsidian-app
+      curl -fsSL -o /tmp/obsidian.asar.gz "https://github.com/obsidianmd/obsidian-releases/releases/download/v${OBSIDIAN_VERSION}/obsidian-${OBSIDIAN_VERSION}.asar.gz"
+      gunzip -f /tmp/obsidian.asar.gz
+      $STD asar extract /tmp/obsidian.asar /opt/ignis_data/obsidian-app
+      rm -f /tmp/obsidian.asar
+      echo "${OBSIDIAN_VERSION}" >/opt/ignis_data/obsidian.version
+    fi
+    msg_ok "Checked Obsidian Web Assets"
+
+    msg_info "Starting Service"
+    systemctl start ignis
+    systemctl reload nginx
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}https://${IP}${CL}"

ct/immich.sh

@@ -214,7 +214,16 @@ EOF
     cd "$SRC_DIR"
     export MISE_TRUSTED_CONFIG_PATHS="$SRC_DIR"/mise.toml
     export MISE_DISABLE_TOOLS=github:jellyfin/jellyfin-ffmpeg
-    $STD mise install
+    mise_ok=0
+    for i in 1 2 3; do
+      $STD mise install && {
+        mise_ok=1
+        break
+      }
+      msg_warn "mise install failed (attempt $i/3) - retrying"
+      sleep 5
+    done
+    [[ "$mise_ok" -eq 1 ]] || exit 1
     export PATH="$(mise bin-paths 2>/dev/null | tr '\n' ':')$PATH"
     if ! command -v extism-js >/dev/null 2>&1; then
       # extism-js ships as a bare gzip-compressed single binary (.gz) that

ct/karakeep.sh

@@ -88,8 +88,9 @@ EOF
       $STD corepack disable
     fi
     sed -i "s/^SERVER_VERSION=.*$/SERVER_VERSION=${CHECK_UPDATE_RELEASE#v}/" /etc/karakeep/karakeep.env
+    # Node 24.19.x crashes better-sqlite3 on cleanup (karakeep-app/karakeep#2989); stay on 22 LTS until upstream reverts.
     MODULE_VERSION="$(jq -r '.packageManager | split("@")[1]' /opt/karakeep/package.json)"
-    NODE_VERSION="24" NODE_MODULE="corepack,pnpm@${MODULE_VERSION}" setup_nodejs
+    NODE_VERSION="22" NODE_MODULE="corepack,pnpm@${MODULE_VERSION}" setup_nodejs
     setup_meilisearch
 
     msg_info "Updating Karakeep"
@@ -101,8 +102,9 @@ EOF
     cd /opt/karakeep/apps/web 
     $STD pnpm install --frozen-lockfile
     $STD pnpm build
-    cd /opt/karakeep/apps/workers 
+    cd /opt/karakeep/apps/workers
     $STD pnpm install --frozen-lockfile
+    $STD pnpm rebuild better-sqlite3
     $STD pnpm build
     cd /opt/karakeep/apps/cli 
     $STD pnpm install --frozen-lockfile

ct/lazylibrarian.sh

@@ -34,6 +34,7 @@ function update_script() {
 
     msg_info "Updating $APP LXC"
     $STD git -C /opt/LazyLibrarian pull origin master
+    $STD pip install --break-system-packages /opt/LazyLibrarian
     msg_ok "Updated $APP LXC"
 
     msg_info "Starting LazyLibrarian"

ct/mumble.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.mumble.info/
+
+APP="Mumble"
+var_tags="${var_tags:-voice;chat;gaming}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-512}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /etc/mumble/mumble-server.ini ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "mumble" "mumble-voip/mumble"; then
+    msg_info "Stopping Service"
+    systemctl stop mumble-server
+    msg_ok "Stopped Service"
+
+    create_backup /etc/mumble/mumble-server.ini /var/lib/mumble-server/mumble-server.sqlite
+
+    msg_info "Updating Mumble"
+    $STD apt update
+    $STD apt install -y mumble-server
+    cat <<EOF >~/.mumble
+$(get_latest_github_release "mumble-voip/mumble")
+EOF
+    msg_ok "Updated Mumble"
+
+    restore_backup
+
+    msg_info "Starting Service"
+    systemctl start mumble-server
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Connect using:${CL}"
+echo -e "${GATEWAY}${BGN}${IP}:64738${CL}"

ct/networkoptimizer.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Ozark-Connect/NetworkOptimizer
+
+APP="NetworkOptimizer"
+var_tags="${var_tags:-network;monitoring;unifi}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-12}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/networkoptimizer ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "networkoptimizer" "Ozark-Connect/NetworkOptimizer"; then
+    msg_info "Stopping Service"
+    systemctl stop networkoptimizer
+    msg_ok "Stopped Service"
+
+    create_backup /opt/networkoptimizer/networkoptimizer.env
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "networkoptimizer" "Ozark-Connect/NetworkOptimizer" "tarball"
+    restore_backup
+
+    msg_info "Rebuilding NetworkOptimizer"
+    RID="linux-x64"
+    [[ "$(dpkg --print-architecture)" == "arm64" ]] && RID="linux-arm64"
+    cd /opt/networkoptimizer
+    export MSBUILDDISABLENODEREUSE=1
+    export DOTNET_CLI_TELEMETRY_OPTOUT=1
+    export DOTNET_SYSTEM_NET_DISABLEIPV6=1
+    $STD dotnet publish src/NetworkOptimizer.Web -c Release -r "$RID" --self-contained -o /opt/networkoptimizer/publish
+    chmod +x /opt/networkoptimizer/publish/NetworkOptimizer.Web
+    mkdir -p /opt/networkoptimizer/publish/tools
+    cd /opt/networkoptimizer/src/uwnspeedtest
+    CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $STD go build -trimpath -ldflags "-s -w" -o /opt/networkoptimizer/publish/tools/uwnspeedtest-linux-arm64 .
+    SERVER_ARCH="$(arch_resolve)"
+    if [[ "$SERVER_ARCH" != "arm64" ]]; then
+      CGO_ENABLED=0 GOOS=linux GOARCH="$SERVER_ARCH" $STD go build -trimpath -ldflags "-s -w" -o "/opt/networkoptimizer/publish/tools/uwnspeedtest-linux-${SERVER_ARCH}" .
+    fi
+    msg_ok "Rebuilt NetworkOptimizer"
+
+    msg_info "Starting Service"
+    systemctl start networkoptimizer
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8042${CL}"

ct/newt.sh

@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Arubinu
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/fosrl/newt
+
+APP="Newt"
+var_tags="${var_tags:-network;tunnel}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-256}"
+var_disk="${var_disk:-2}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /etc/newt/newt.env ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "newt" "fosrl/newt"; then
+    msg_info "Stopping Service"
+    systemctl stop newt
+    msg_ok "Stopped Service"
+
+    fetch_and_deploy_gh_release "newt" "fosrl/newt" "singlefile" "latest" "/opt/newt" "newt_linux_$(arch_resolve)"
+    ln -sf /opt/newt/newt /usr/local/bin/newt
+
+    msg_info "Starting Service"
+    systemctl start newt
+    msg_ok "Started Service"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${INFO}${YW} Check the site status in your Pangolin dashboard.${CL}"

ct/nextcloudpi.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-8}"
 var_os="${var_os:-debian}"
-var_version="${var_version:-12}"
+var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/openwebui.sh

@@ -114,7 +114,14 @@ EOF
 
   msg_info "Updating Open WebUI via uv"
   PYTHON_VERSION="3.12" setup_uv
-  $STD uv tool install --force --python 3.12 --constraint <(echo "numba>=0.60") open-webui[all]
+  OWUI_PYTHON="/root/.local/share/uv/tools/open-webui/bin/python3.12"
+  OTEL_ARGS=()
+  if [[ -x "$OWUI_PYTHON" ]]; then
+    while IFS= read -r pkg; do
+      OTEL_ARGS+=(--with "$pkg")
+    done < <(uv pip list --python "$OWUI_PYTHON" --format freeze 2>/dev/null | grep -i '^opentelemetry-' | cut -d= -f1)
+  fi
+  $STD uv tool install --force --python 3.12 --constraint <(echo "numba>=0.60") "${OTEL_ARGS[@]}" open-webui[all]
   systemctl restart open-webui
   msg_ok "Updated Open WebUI"
   msg_ok "Updated successfully!"

ct/orb.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: angusmaul
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://orb.net/
+
+APP="Orb"
+var_tags="${var_tags:-network;monitoring}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-512}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if ! dpkg -s orb >/dev/null 2>&1; then
+    msg_error "No ${APP} Installation Found!"
+    exit 233
+  fi
+
+  msg_info "Updating Orb"
+  $STD apt update
+  $STD apt install -y --only-upgrade orb
+  msg_ok "Updated successfully!"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}To link the sensor to your orb account run:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}pct exec ${CTID} -- runuser -u orb -- orb link${CL}"

ct/pangolin.sh

@@ -17,6 +17,9 @@ var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 var_tun="${var_tun:-1}"
 
+export var_pangolin_url="${var_pangolin_url:-}"
+export var_pangolin_email="${var_pangolin_email:-}"
+
 header_info "$APP"
 variables
 color

ct/paperless-ngx.sh

@@ -65,7 +65,7 @@ function update_script() {
       read -rp "Do you want to continue with the update? (y/N): " MIGRATE
       echo
       if [[ ! "$MIGRATE" =~ ^[Yy]$ ]]; then
-        msg_info "Update aborted. Decrypt all documents before upgrading to v3."
+        msg_custom "⚠️" "Update aborted. Decrypt all documents before upgrading to v3."
         exit 0
       fi
     fi
@@ -165,7 +165,9 @@ function update_script() {
 
       msg_info "Updating Paperless-ngx"
       if ((BRIDGE_UPDATE == 0)); then
-        sed -i 's|^ExecStart=.*|ExecStart=uv run -- granian --interface asginl --ws --loop uvloop "paperless.asgi:application"|' /etc/systemd/system/paperless-webserver.service
+        sed -i 's|^ExecStart=.*|ExecStart=uv run --no-sync -- granian --interface asginl --ws --loop uvloop "paperless.asgi:application"|' /etc/systemd/system/paperless-webserver.service
+        grep -q "document_index reindex" /etc/systemd/system/paperless-webserver.service ||
+          sed -i '/^ExecStart=/i ExecStartPre=uv run -- python manage.py document_index reindex --if-needed --no-progress-bar' /etc/systemd/system/paperless-webserver.service
         $STD systemctl daemon-reload
       fi
       cd /opt/paperless
@@ -205,10 +207,10 @@ function update_script() {
       msg_ok "Backup completed to $BACKUP_DIR"
 
       declare -A PATCHES=(
-        ["paperless-consumer.service"]="ExecStart=uv run -- python manage.py document_consumer"
+        ["paperless-consumer.service"]="ExecStart=uv run --no-sync -- python manage.py document_consumer"
-        ["paperless-scheduler.service"]="ExecStart=uv run -- celery --app paperless beat --loglevel INFO"
+        ["paperless-scheduler.service"]="ExecStart=uv run --no-sync -- celery --app paperless beat --loglevel INFO"
-        ["paperless-task-queue.service"]="ExecStart=uv run -- celery --app paperless worker --loglevel INFO"
+        ["paperless-task-queue.service"]="ExecStart=uv run --no-sync -- celery --app paperless worker --loglevel INFO"
-        ["paperless-webserver.service"]="ExecStart=uv run -- granian --interface asgi --ws \"paperless.asgi:application\""
+        ["paperless-webserver.service"]="ExecStart=uv run --no-sync -- granian --interface asgi --ws \"paperless.asgi:application\""
       )
 
       for svc in "${!PATCHES[@]}"; do

ct/pelican-panel.sh

@@ -50,16 +50,17 @@ function update_script() {
     cp -a /opt/pelican-panel/.env /opt/backup
     mkdir -p /opt/backup/storage/app/
     cp -a /opt/pelican-panel/storage/app/public /opt/backup/storage/app/
-    
+
     SQLITE_INSTALL=$(ls /opt/pelican-panel/database/*.sqlite 1>/dev/null 2>&1 && echo "true" || echo "false")
     $SQLITE_INSTALL && cp -r /opt/pelican-panel/database/*.sqlite /opt/backup
-    
+
     find /opt/pelican-panel -mindepth 1 -maxdepth 1 ! -name 'backup' ! -name 'plugins' -exec rm -rf {} +
-    
+
     fetch_and_deploy_gh_release "pelican-panel" "pelican-dev/panel" "prebuild" "latest" "/opt/pelican-panel" "panel.tar.gz"
 
     msg_info "Updating Pelican Panel"
     cp -a /opt/backup/.env /opt/pelican-panel/
+    grep -q "^APP_URL=http://panel.test$" /opt/pelican-panel/.env && sed -i "s|^APP_URL=.*|APP_URL=http://${LOCAL_IP}|" /opt/pelican-panel/.env
     $SQLITE_INSTALL && mv /opt/backup/*.sqlite /opt/pelican-panel/database/
     cp -a /opt/backup/storage/app/public /opt/pelican-panel/storage/app/
 

ct/powerdns.sh

@@ -30,13 +30,26 @@ function update_script() {
     exit
   fi
 
+  if [[ -f /opt/poweradmin/powerdns.db ]]; then
+    msg_info "Moving PowerDNS database out of the web root"
+    systemctl stop pdns apache2
+    mkdir -p /var/lib/powerdns
+    mv /opt/poweradmin/powerdns.db /var/lib/powerdns/powerdns.db
+    sed -i 's#/opt/poweradmin/powerdns.db#/var/lib/powerdns/powerdns.db#' \
+      /etc/powerdns/pdns.d/gsqlite3.conf /opt/poweradmin/config/settings.php
+    chown pdns:pdns /var/lib/powerdns/powerdns.db
+    chmod 664 /var/lib/powerdns/powerdns.db
+    systemctl start pdns apache2
+    msg_ok "Moved PowerDNS database out of the web root"
+  fi
+
   msg_info "Updating PowerDNS"
   $STD apt update
   $STD apt install -y --only-upgrade pdns-server pdns-backend-sqlite3
   msg_ok "Updated PowerDNS"
 
   if check_for_gh_release "poweradmin" "poweradmin/poweradmin"; then
-    create_backup /opt/poweradmin/config/settings.php /opt/poweradmin/powerdns.db
+    create_backup /opt/poweradmin/config/settings.php
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "poweradmin" "poweradmin/poweradmin" "tarball"
 
@@ -46,8 +59,6 @@ function update_script() {
     rm -rf /opt/poweradmin/install
     chown -R www-data:pdns /opt/poweradmin
     chmod 775 /opt/poweradmin
-    chown pdns:pdns /opt/poweradmin/powerdns.db
-    chmod 664 /opt/poweradmin/powerdns.db
     msg_ok "Updated Poweradmin"
 
     msg_info "Restarting Services"

ct/projectsend.sh

@@ -28,27 +28,37 @@ function update_script() {
     msg_error "No ${APP} Installation Found!"
     exit
   fi
-  setup_mariadb
+
+  if [[ -f /opt/projectsend/includes/sys.config.php ]]; then
+    msg_error "This container runs ProjectSend Legacy (pre-2.0)."
+    msg_error "2.0 is a new application, not an update - there is no in-place upgrade."
+    msg_error "Set up a fresh ProjectSend container and use projectsend/v1-migration-tool to bring your data across."
+    exit
+  fi
 
   if check_for_gh_release "projectsend" "projectsend/projectsend"; then
-    msg_info "Stopping Service"
+    msg_info "Stopping Services"
-    systemctl stop apache2
+    systemctl stop nginx projectsend-worker
-    msg_ok "Stopped Service"
+    msg_ok "Stopped Services"
 
-    php_ver=$(php -v | head -n 1 | awk '{print $2}')
+    create_backup /opt/projectsend/.env /opt/projectsend/storage/app/files
-    if [[ ! $php_ver == "8.4"* ]]; then
-      PHP_VERSION="8.4" PHP_APACHE="YES" setup_php
-    fi
 
-    mv /opt/projectsend/includes/sys.config.php /opt/sys.config.php
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "projectsend" "projectsend/projectsend" "prebuild" "latest" "/opt/projectsend"
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "projectsend" "projectsend/projectsend" "prebuild" "latest" "/opt/projectsend" "projectsend-r*.zip"
+
-    mv /opt/sys.config.php /opt/projectsend/includes/sys.config.php
+    restore_backup
+
+    msg_info "Updating ProjectSend"
+    cd /opt/projectsend
     chown -R www-data:www-data /opt/projectsend
-    chmod -R 775 /opt/projectsend
+    chmod -R 775 /opt/projectsend/storage /opt/projectsend/bootstrap/cache
+    $STD sudo -u www-data php artisan migrate --force
+    $STD sudo -u www-data php artisan projectsend:ensure-roles
+    $STD sudo -u www-data php artisan optimize:clear
+    msg_ok "Updated ProjectSend"
 
-    msg_info "Starting Service"
+    msg_info "Starting Services"
-    systemctl start apache2
+    systemctl start nginx projectsend-worker
-    msg_ok "Started Service"
+    msg_ok "Started Services"
     msg_ok "Updated successfully!"
   fi
   exit
@@ -61,4 +71,5 @@ description
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}/install for the initial setup${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}${CL}"
+echo -e "${INFO}${YW}Admin credentials saved to ~/projectsend.creds${CL}"

ct/pulse.sh

@@ -35,22 +35,34 @@ function update_script() {
     systemctl stop pulse*.service
     msg_ok "Stopped Services"
 
-    if [[ -f /opt/pulse/pulse ]]; then
+    if ! CLEAN_INSTALL=1 fetch_and_deploy_gh_release "pulse" "rcourtman/Pulse" "prebuild" "latest" "/opt/pulse" "pulse-v*-linux-$(arch_resolve).tar.gz"; then
-      rm -f /opt/pulse/pulse
+      msg_error "Download or deployment failed - check network connectivity and GitHub API availability"
+      if systemctl start pulse 2>/dev/null || systemctl start pulse-backend 2>/dev/null; then
+        msg_ok "Restarted the previously installed ${APP}"
+      else
+        msg_error "${APP} could not be restarted - reinstall it or restore the container from a backup"
+      fi
+      exit 250
     fi
-
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "pulse" "rcourtman/Pulse" "prebuild" "latest" "/opt/pulse" "pulse-v*-linux-$(arch_resolve).tar.gz"
     ln -sf /opt/pulse/bin/pulse /usr/local/bin/pulse
     mkdir -p /etc/pulse
     chown pulse:pulse /etc/pulse
     chown -R pulse:pulse /opt/pulse
     chmod 700 /etc/pulse
+    UNIT_WAS_ENABLED=0
     if [[ -f "$SERVICE_PATH"/pulse-backend.service ]]; then
+      if [[ $(systemctl is-enabled pulse-backend) == enabled ]]; then
+        UNIT_WAS_ENABLED=1
+      fi
+      systemctl disable -q pulse-backend.service 2>/dev/null || true
       mv "$SERVICE_PATH"/pulse-backend.service "$SERVICE_PATH"/pulse.service
     fi
     sed -i -e 's|pulse/pulse|pulse/bin/pulse|' \
       -e 's/^Environment="API.*$//' "$SERVICE_PATH"/pulse.service
     systemctl daemon-reload
+    if [[ "$UNIT_WAS_ENABLED" == "1" ]]; then
+      systemctl enable -q pulse
+    fi
     if grep -q 'pulse-home:/bin/bash' /etc/passwd; then
       usermod -s /usr/sbin/nologin pulse
     fi

ct/reactive-resume.sh

@@ -3,7 +3,7 @@ source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxV
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: vhsdream | MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://rxresume.org | Github: https://github.com/amruthpillai/reactive-resume
+# Source: https://rxresu.me/ | Github: https://github.com/amruthpillai/reactive-resume
 
 APP="Reactive-Resume"
 var_tags="${var_tags:-documents}"
@@ -45,7 +45,6 @@ function update_script() {
     msg_info "Updating Reactive Resume (Patience)"
     cd /opt/reactive-resume
     export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
-
     corepack prepare --activate
     export CI="true"
     export NODE_ENV="production"

ct/reitti.sh

@@ -223,6 +223,8 @@ http {
       proxy_pass $upstream_url;
       proxy_set_header Host $proxy_host;
       proxy_set_header User-Agent "Reitti/1.0";
+      proxy_ssl_server_name on;
+      proxy_ssl_name $proxy_host;
       proxy_cache tiles;
       proxy_cache_key $upstream_url;
       proxy_cache_valid 200 30d;

ct/rss-bridge.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://rss-bridge.org/
+
+APP="RSS-Bridge"
+var_tags="${var_tags:-rss;feed;bridge}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-512}"
+var_disk="${var_disk:-2}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/rss-bridge ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "rss-bridge" "RSS-Bridge/rss-bridge"; then
+    create_backup /opt/rss-bridge/config.ini.php
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "rss-bridge" "RSS-Bridge/rss-bridge" "tarball"
+
+    restore_backup
+
+    msg_info "Updating Application"
+    cd /opt/rss-bridge
+    $STD composer install --no-dev --optimize-autoloader
+    chown -R www-data:www-data /opt/rss-bridge
+    systemctl restart caddy
+    msg_ok "Updated Application"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}${CL}"

ct/sparkyfitness.sh

@@ -30,6 +30,7 @@ function update_script() {
     exit
   fi
 
+  ensure_dependencies git
   if check_for_gh_release "sparkyfitness" "CodeWithCJ/SparkyFitness"; then
     msg_info "Stopping Services"
     systemctl stop sparkyfitness-server nginx

ct/stalwart.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/stalwartlabs/stalwart
+
+APP="Stalwart"
+var_tags="${var_tags:-mail;smtp;imap}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-20}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/stalwart ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "stalwart" "stalwartlabs/stalwart"; then
+    msg_info "Stopping Service"
+    systemctl stop stalwart
+    msg_ok "Stopped Service"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "stalwart" "stalwartlabs/stalwart" "prebuild" "latest" "/opt/stalwart" "stalwart-$(arch_resolve x86_64 aarch64)-unknown-linux-gnu.tar.gz"
+    chmod +x /opt/stalwart/stalwart
+
+    msg_info "Starting Service"
+    systemctl start stalwart
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8080/admin${CL}"
+echo -e "${INFO}${YW}The bootstrap admin password was printed to the service log:${CL}"
+echo -e "${TAB}${DEFAULT}${BGN}journalctl -u stalwart | grep -A8 'bootstrap mode'${CL}"

ct/stirling-pdf.sh

@@ -43,8 +43,20 @@ function update_script() {
     find /usr/lib -name "libicudata.so.*" -exec patchelf --clear-execstack {} \; || true
     msg_ok "Patched Native Libraries"
 
+    if [[ -f /etc/systemd/system/libreoffice-listener.service ]]; then
+      msg_info "Removing Conflicting LibreOffice Listener"
+      systemctl disable -q --now libreoffice-listener
+      rm -f /etc/systemd/system/libreoffice-listener.service
+      sed -i '/^Requires=libreoffice-listener.service$/d' /etc/systemd/system/stirlingpdf.service /etc/systemd/system/unoserver.service
+      sed -i 's/^After=syslog.target network.target libreoffice-listener.service$/After=syslog.target network.target unoserver.service/' /etc/systemd/system/stirlingpdf.service
+      sed -i 's/^After=libreoffice-listener.service$/After=network.target/' /etc/systemd/system/unoserver.service
+      systemctl daemon-reload
+      systemctl reset-failed libreoffice-listener.service 2>/dev/null || true
+      msg_ok "Removed Conflicting LibreOffice Listener"
+    fi
+
     msg_info "Stopping Services"
-    systemctl stop stirlingpdf libreoffice-listener unoserver
+    systemctl stop stirlingpdf unoserver
     msg_ok "Stopped Services"
 
     if [[ -f ~/.Stirling-PDF-login ]]; then
@@ -59,7 +71,7 @@ function update_script() {
     msg_ok "Font Cache Updated"
 
     msg_info "Starting Services"
-    systemctl start stirlingpdf libreoffice-listener unoserver
+    systemctl start unoserver stirlingpdf
     msg_ok "Started Services"
     msg_ok "Updated successfully!"
   fi

ct/suggestarr.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/giuseppe99barchetta/SuggestArr
+
+APP="SuggestArr"
+var_tags="${var_tags:-arr;media}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/suggestarr ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "suggestarr" "giuseppe99barchetta/SuggestArr"; then
+    msg_info "Stopping Service"
+    systemctl stop suggestarr
+    msg_ok "Stopped Service"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "suggestarr" "giuseppe99barchetta/SuggestArr" "tarball"
+
+    msg_info "Building Frontend"
+    cd /opt/suggestarr/client
+    $STD npm install
+    $STD npm run build
+    mkdir -p /opt/suggestarr/static
+    cp -r /opt/suggestarr/client/dist/* /opt/suggestarr/static/
+    cp -r /opt/suggestarr/client/node_modules/swagger-ui-dist /opt/suggestarr/static/swagger-ui
+    msg_ok "Built Frontend"
+
+    msg_info "Updating Python Environment"
+    cd /opt/suggestarr
+    $STD uv venv --python 3.12 /opt/suggestarr/.venv
+    $STD uv pip install --python /opt/suggestarr/.venv -r /opt/suggestarr/api_service/requirements.txt
+    msg_ok "Updated Python Environment"
+
+    msg_info "Starting Service"
+    systemctl start suggestarr
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:5000${CL}"

ct/teslamate.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/teslamate-org/teslamate
+
+APP="TeslaMate"
+var_tags="${var_tags:-car;monitoring}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-16}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/teslamate ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "teslamate" "teslamate-org/teslamate"; then
+    msg_info "Stopping Service"
+    systemctl stop teslamate
+    msg_ok "Stopped Service"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "teslamate" "teslamate-org/teslamate" "tarball"
+
+    msg_info "Building TeslaMate (Patience)"
+    cd /opt/teslamate
+    export MIX_ENV=prod
+    $STD mix local.hex --force
+    $STD mix local.rebar --force
+    $STD mix deps.get --only prod
+    $STD npm install --prefix ./assets
+    $STD npm run deploy --prefix ./assets
+    $STD mix do phx.digest, release --overwrite
+    msg_ok "Built TeslaMate"
+
+    msg_info "Starting Service"
+    systemctl start teslamate
+    systemctl restart grafana-server
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:4000${CL}"
+echo -e "${INFO}${YW}Grafana dashboards (admin/admin):${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:3000${CL}"

ct/tor-snowflake.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2025 community-scripts ORG
+# Author: KernelSailor
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://snowflake.torproject.org/
+
+APP="tor-snowflake"
+var_tags="${var_tags:-privacy;proxy;tor}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-512}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+var_nesting="${var_nesting:-0}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  msg_info "Updating Container OS"
+  $STD apt update
+  $STD apt upgrade -y
+  msg_ok "Updated Container OS"
+
+  if [[ ! -d /opt/tor-snowflake ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if GITLAB_URL="https://gitlab.torproject.org" check_for_gl_release "tor-snowflake" "tpo/anti-censorship/pluggable-transports/snowflake"; then
+    msg_info "Stopping Service"
+    systemctl stop snowflake-proxy
+    msg_ok "Stopped Service"
+
+    CLEAN_INSTALL=1 GITLAB_URL="https://gitlab.torproject.org" fetch_and_deploy_gl_release "tor-snowflake" "tpo/anti-censorship/pluggable-transports/snowflake" "tarball"
+
+    msg_info "Building Snowflake"
+    cd /opt/tor-snowflake/proxy
+    $STD go build -o snowflake-proxy .
+    msg_ok "Built Snowflake"
+
+    msg_info "Starting Service"
+    systemctl start snowflake-proxy
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+

ct/vikunja.sh

@@ -46,8 +46,7 @@ function update_script() {
     [[ "$CONFIRM2" =~ ^[yY]$ ]] || exit 0
   fi
 
-  RELEASE="v2.3.0"
+  if check_for_gh_release "vikunja" "go-vikunja/vikunja"; then
-  if check_for_gh_release "vikunja" "go-vikunja/vikunja" "${RELEASE}" "v2.4.0 is killed at startup by the systemd SystemCallFilter shipped in the .deb (upstream go-vikunja/vikunja#3252); pinned until a fixed release is out"; then
     echo
     msg_warn "The package update may include config file changes."
     echo -e "${TAB}${YW}How do you want to handle /etc/vikunja/config.yml?${CL}"
@@ -66,7 +65,7 @@ function update_script() {
     systemctl stop vikunja
     msg_ok "Stopped Service"
 
-    fetch_and_deploy_gh_release "vikunja" "go-vikunja/vikunja" "binary" "${RELEASE}" "" "vikunja-*-$(arch_resolve "x86_64" "aarch64").deb"
+    fetch_and_deploy_gh_release "vikunja" "go-vikunja/vikunja" "binary" "latest" "" "vikunja-*-$(arch_resolve "x86_64" "aarch64").deb"
     $STD systemctl daemon-reload
 
     msg_info "Starting Service"

ct/wanderer.sh

@@ -25,32 +25,149 @@ function update_script() {
   check_container_storage
   check_container_resources
 
-  if [[ ! -f /opt/wanderer/start.sh ]]; then
+  if [[ ! -d /opt/wanderer/source && ! -d /opt/wanderer/db ]]; then
     msg_error "No wanderer Installation Found!"
     exit
   fi
 
+  if [[ ! -f /etc/systemd/system/meilisearch.service ]]; then
+    msg_info "Migrating MeiliSearch"
+    systemctl stop wanderer-web
+
+    rm -rf /opt/wanderer/source/search
+    mkdir -p /opt/wanderer_data
+    [[ -d /opt/wanderer/data/meili_data ]] && cp -r /opt/wanderer/data/meili_data /opt/wanderer_data/
+    mkdir -p /opt/wanderer_data/meili_data
+    rm -rf /opt/wanderer/data/meili_data
+    MEILI_MASTER_KEY_VAL=$(grep -oP '^MEILI_MASTER_KEY=\K.*' /opt/wanderer/.env)
+    cat <<EOF >/etc/meilisearch.toml
+env = "production"
+master_key = "$MEILI_MASTER_KEY_VAL"
+db_path = "/opt/wanderer_data/meili_data"
+dump_dir = "/var/lib/meilisearch/dumps"
+snapshot_dir = "/var/lib/meilisearch/snapshots"
+no_analytics = true
+http_addr = "127.0.0.1:7700"
+EOF
+    mkdir -p /var/lib/meilisearch/dumps /var/lib/meilisearch/snapshots
+
+    cat <<EOF >/etc/systemd/system/meilisearch.service
+[Unit]
+Description=Meilisearch
+After=network.target
+
+[Service]
+ExecStart=/usr/bin/meilisearch --config-file-path /etc/meilisearch.toml
+Restart=always
+
+[Install]
+WantedBy=multi-user.target
+EOF
+    systemctl daemon-reload
+    systemctl enable -q --now meilisearch
+
+    sed -i \
+      -e "s|^MEILI_HTTP_ADDR=.*|MEILI_HTTP_ADDR=127.0.0.1:7700|" \
+      -e "s|^MEILI_URL=.*|MEILI_URL=http://127.0.0.1:7700|" \
+      /opt/wanderer/.env
+
+    msg_ok "Migrated Meilisearch"
+  fi
+
+  setup_meilisearch
+
+  if [[ -f /opt/wanderer/start.sh || -d /opt/wanderer/source ]]; then
+    msg_info "Migrating wanderer services"
+    systemctl stop wanderer-web
+    rm -f /opt/wanderer/start.sh
+
+    mkdir -p /opt/wanderer_data
+    [[ -d /opt/wanderer/data/pb_data ]] && cp -r /opt/wanderer/data/pb_data /opt/wanderer_data/
+    [[ -d /opt/wanderer/data/plugins ]] && cp -r /opt/wanderer/data/plugins /opt/wanderer_data/
+    mkdir -p /opt/wanderer_data/{pb_data,plugins}
+    rm -rf /opt/wanderer/data
+
+    [[ -d /opt/wanderer/source ]] && cp -r /opt/wanderer/source/. /opt/wanderer/
+    rm -rf /opt/wanderer/source
+
+    if [[ -d /opt/wanderer/db/data ]]; then
+      [[ -e /opt/wanderer/db/data/plugins ]] || ln -sfn /opt/wanderer_data/plugins /opt/wanderer/db/data/plugins
+    fi
+
+    sed -i \
+      -e "s|^PB_DB_LOCATION=.*|PB_DB_LOCATION=/opt/wanderer_data/pb_data|" \
+      -e "s|^MEILI_DB_PATH=.*|MEILI_DB_PATH=/opt/wanderer_data/meili_data|" \
+      /opt/wanderer/.env
+    sed -i "s|^db_path =.*|db_path = \"/opt/wanderer_data/meili_data\"|" /etc/meilisearch.toml
+    rm -f /usr/local/bin/wanderer-pb
+
+    cat <<EOF >/etc/systemd/system/wanderer-pocketbase.service
+[Unit]
+Description=wanderer PocketBase
+Wants=network.target
+After=network.target
+PartOf=wanderer-web.service
+StartLimitIntervalSec=10
+StartLimitBurst=5
+
+[Service]
+Type=simple
+WorkingDirectory=/opt/wanderer/db
+EnvironmentFile=/opt/wanderer/.env
+ExecStart=/opt/wanderer/db/pocketbase serve --http=\${PB_URL} --dir=\${PB_DB_LOCATION}
+Restart=always
+RestartSec=1
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+    cat <<EOF >/etc/systemd/system/wanderer-web.service
+[Unit]
+Description=wanderer
+Wants=network.target meilisearch.service wanderer-pocketbase.service
+After=network.target meilisearch.service wanderer-pocketbase.service
+StartLimitIntervalSec=10
+StartLimitBurst=5
+
+[Service]
+Type=simple
+WorkingDirectory=/opt/wanderer/web
+EnvironmentFile=/opt/wanderer/.env
+ExecStart=/usr/bin/node build
+Restart=always
+RestartSec=1
+
+[Install]
+WantedBy=multi-user.target
+EOF
+    systemctl daemon-reload
+    systemctl enable -q wanderer-pocketbase
+    systemctl start wanderer-web
+    msg_ok "Migrated wanderer services"
+  fi
+
   if check_for_gh_release "wanderer" "open-wanderer/wanderer"; then
     msg_info "Stopping service"
     systemctl stop wanderer-web
     msg_ok "Stopped service"
 
-    create_backup /opt/wanderer/source/search
+    create_backup /opt/wanderer/.env
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "wanderer" "open-wanderer/wanderer" "tarball" "latest" "/opt/wanderer/source"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "wanderer" "open-wanderer/wanderer" "tarball" "latest"
     restore_backup
 
     msg_info "Updating wanderer"
-    cd /opt/wanderer/source/db
+    cd /opt/wanderer/db
     $STD go mod tidy
     $STD go build
-    cd /opt/wanderer/source/web
+    cd /opt/wanderer/web
     $STD npm ci
     $STD npm run build
-    mkdir -p /opt/wanderer/data/plugins /opt/wanderer/source/db/data
+    mkdir -p /opt/wanderer_data/plugins /opt/wanderer/db/data
-    [[ -e /opt/wanderer/source/db/data/plugins ]] || ln -sfn /opt/wanderer/data/plugins /opt/wanderer/source/db/data/plugins
+    [[ -e /opt/wanderer/db/data/plugins ]] || ln -sfn /opt/wanderer_data/plugins /opt/wanderer/db/data/plugins
     msg_info "Installing wanderer plugins"
     for plugin in hammerhead komoot strava; do
-      fetch_and_deploy_gh_release "wanderer-plugin-${plugin}" "open-wanderer/wanderer" "prebuild" "${CHECK_UPDATE_RELEASE:-latest}" "/opt/wanderer/data/plugins" "wanderer-plugin-${plugin}.tar.gz" || msg_warn "Failed to install wanderer plugin: ${plugin}"
+      fetch_and_deploy_gh_release "wanderer-plugin-${plugin}" "open-wanderer/wanderer" "prebuild" "${CHECK_UPDATE_RELEASE:-latest}" "/opt/wanderer_data/plugins" "wanderer-plugin-${plugin}.tar.gz" || msg_warn "Failed to install wanderer plugin: ${plugin}"
     done
     msg_ok "Installed wanderer plugins"
     msg_ok "Updated wanderer"
@@ -60,19 +177,6 @@ function update_script() {
     msg_ok "Started service"
     msg_ok "Update Successful"
   fi
-  if check_for_gh_release "meilisearch" "meilisearch/meilisearch"; then
-    msg_info "Stopping service"
-    systemctl stop wanderer-web
-    msg_ok "Stopped service"
-
-    fetch_and_deploy_gh_release "meilisearch" "meilisearch/meilisearch" "binary" "latest" "/opt/wanderer/source/search"
-    grep -q -- '--experimental-dumpless-upgrade' /opt/wanderer/start.sh || sed -i 's|meilisearch --master-key|meilisearch --experimental-dumpless-upgrade --master-key|' /opt/wanderer/start.sh
-
-    msg_info "Starting service"
-    systemctl start wanderer-web
-    msg_ok "Started service"
-    msg_ok "Update Successful"
-  fi
   exit
 }
 

install/ampache-install.sh

@@ -27,11 +27,11 @@ $STD apt install -y \
   libvpx-dev
 msg_ok "Installed dependencies"
 
-PHP_VERSION="8.4" PHP_APACHE="YES" setup_php
+PHP_VERSION="8.5" PHP_APACHE="YES" setup_php
 setup_mariadb
 MARIADB_DB_USER="ampache" MARIADB_DB_NAME="ampache" setup_mariadb_db
 
-fetch_and_deploy_gh_release "ampache" "ampache/ampache" "prebuild" "latest" "/opt/ampache" "ampache-*_all_php8.4.zip"
+fetch_and_deploy_gh_release "ampache" "ampache/ampache" "prebuild" "latest" "/opt/ampache" "ampache-*_all_php8.5.zip"
 
 msg_info "Setting up Ampache"
 rm -rf /var/www/html
@@ -58,7 +58,7 @@ msg_info "Configuring PHP"
 sed -i -e 's/upload_max_filesize = .*/upload_max_filesize = 100M/' \
   -e 's/post_max_size = .*/post_max_size = 100M/' \
   -e 's/max_execution_time = .*/max_execution_time = 600/' \
-  -e 's/memory_limit = .*/memory_limit = 512M/' /etc/php/8.4/apache2/php.ini
+  -e 's/memory_limit = .*/memory_limit = 512M/' /etc/php/8.5/apache2/php.ini
 $STD a2enmod rewrite
 $STD systemctl restart apache2
 msg_ok "Configured PHP"

install/apache-couchdb-install.sh

@@ -14,7 +14,7 @@ network_check
 update_os
 
 msg_info "Installing Apache CouchDB"
-ERLANG_COOKIE=$(openssl rand -base64 32)
+ERLANG_COOKIE=$(openssl rand -hex 32)
 ADMIN_PASS="$(openssl rand -base64 18 | cut -c1-13)"
 debconf-set-selections <<<"couchdb couchdb/cookie string $ERLANG_COOKIE"
 debconf-set-selections <<<"couchdb couchdb/mode select standalone"

install/byparr-install.sh

@@ -58,7 +58,7 @@ fetch_and_deploy_gh_release "Byparr" "ThePhaseless/Byparr" "tarball" "latest"
 msg_info "Configuring Byparr"
 cd /opt/Byparr
 $STD uv sync --link-mode copy
-$STD uv run camoufox fetch
+$STD uv run python -m invisible_playwright fetch
 msg_ok "Configured Byparr"
 
 msg_info "Creating Service"

install/calibre-web-install.sh

@@ -32,14 +32,14 @@ msg_info "Installing Calibre (for eBook conversion)"
 $STD apt install -y calibre
 msg_ok "Installed Calibre"
 
-fetch_and_deploy_gh_release "Calibre-Web" "janeczku/calibre-web" "prebuild" "latest" "/opt/calibre-web" "calibre-web*.tar.gz"
+fetch_and_deploy_gh_release "Calibre-Web" "janeczku/calibre-web" "prebuild" "latest" "/opt/calibre-web" "calibreweb*.tar.gz"
 setup_uv
 
 msg_info "Installing Python Dependencies"
 cd /opt/calibre-web
 $STD uv venv
 $STD uv pip install --python /opt/calibre-web/.venv/bin/python --no-cache-dir --upgrade pip setuptools wheel
-$STD uv pip install --python /opt/calibre-web/.venv/bin/python --no-cache-dir -r requirements.txt
+$STD uv pip install --python /opt/calibre-web/.venv/bin/python --no-cache-dir .
 msg_ok "Installed Python Dependencies"
 
 msg_info "Creating Service"
@@ -54,7 +54,7 @@ Type=simple
 User=root
 Environment="QTWEBENGINE_CHROMIUM_FLAGS=--no-sandbox"
 WorkingDirectory=/opt/calibre-web
-ExecStart=/opt/calibre-web/.venv/bin/python /opt/calibre-web/cps.py
+ExecStart=/opt/calibre-web/.venv/bin/cps
 Restart=on-failure
 RestartSec=5
 

install/changedetection-install.sh

@@ -83,7 +83,6 @@ $STD apt-get install -y \
   fonts-kacst fonts-liberation \
   fonts-noto-cjk \
   fonts-noto-color-emoji \
-  msttcorefonts \
   fonts-roboto \
   fonts-thai-tlwg \
   fonts-wqy-zenhei

install/convertx-install.sh

@@ -20,10 +20,15 @@ msg_info "Installing Dependencies"
 $STD apt install -y \
   assimp-utils \
   calibre \
+  dasel \
   dcraw \
   dvisvgm \
   ffmpeg \
+  graphicsmagick \
   inkscape \
+  libemail-outlook-message-perl \
+  libheif-examples \
+  libjxl-tools \
   libreoffice-writer \
   libva2 \
   libvips-tools \
@@ -33,6 +38,7 @@ $STD apt install -y \
   poppler-utils \
   potrace \
   python3-numpy \
+  resvg \
   texlive \
   texlive-fonts-recommended \
   texlive-latex-extra \
@@ -40,6 +46,15 @@ $STD apt install -y \
   texlive-xetex
 msg_ok "Installed Dependencies"
 
+setup_uv
+
+msg_info "Installing markitdown"
+export UV_TOOL_BIN_DIR=/usr/local/bin
+$STD uv tool install "markitdown[all]"
+msg_ok "Installed markitdown"
+
+fetch_and_deploy_gh_release "vtracer" "visioncortex/vtracer" "prebuild" "0.6.4" "/usr/local/bin" "vtracer-$(arch_resolve "x86_64" "aarch64")-unknown-linux-musl.tar.gz"
+
 NODE_VERSION="22" NODE_MODULE="bun" setup_nodejs
 fetch_and_deploy_gh_release "ConvertX" "C4illin/ConvertX" "tarball" "latest" "/opt/convertx"
 

install/ersatztv-install.sh

@@ -15,7 +15,7 @@ update_os
 
 setup_hwaccel
 fetch_and_deploy_gh_release "ersatztv" "ErsatzTV/ErsatzTV" "prebuild" "latest" "/opt/ErsatzTV" "*linux-$(arch_resolve "x64" "arm64").tar.gz"
-fetch_and_deploy_gh_release "ersatztv-ffmpeg" "ErsatzTV/ErsatzTV-ffmpeg" "prebuild" "latest" "/opt/ErsatzTV-ffmpeg" "*-$(arch_resolve "linux64" "linuxarm64")-gpl-7.1.tar.xz"
+fetch_and_deploy_gh_release "ersatztv-ffmpeg" "ErsatzTV/ErsatzTV-ffmpeg" "prebuild" "latest" "/opt/ErsatzTV-ffmpeg" "*-$(arch_resolve "linux64" "linuxarm64")-gpl-8.1.tar.xz"
 
 msg_info "Set ErsatzTV-ffmpeg links"
 chmod +x /opt/ErsatzTV-ffmpeg/bin/*

install/fleet-install.sh

@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/fleetdm/fleet
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y redis-server mysql-server
+msg_ok "Installed Dependencies"
+
+MYSQL_DB_NAME="fleet" MYSQL_DB_USER="fleet" setup_mysql_db
+fetch_and_deploy_gh_release "fleet" "fleetdm/fleet" "prebuild" "latest" "/opt/fleet" "fleet_v*_linux.tar.gz"
+
+msg_info "Configuring Application"
+chmod +x /opt/fleet/fleet
+PRIVATE_KEY=$(openssl rand -hex 32)
+cat <<EOF >/opt/fleet/.env
+FLEET_MYSQL_ADDRESS=127.0.0.1:3306
+FLEET_MYSQL_DATABASE=fleet
+FLEET_MYSQL_USERNAME=fleet
+FLEET_MYSQL_PASSWORD=${MYSQL_DB_PASS}
+FLEET_SERVER_ADDRESS=0.0.0.0:8080
+FLEET_SERVER_TLS=false
+FLEET_SERVER_PRIVATE_KEY=${PRIVATE_KEY}
+FLEET_REDIS_ADDRESS=127.0.0.1:6379
+FLEET_LOGGING_JSON=true
+EOF
+msg_ok "Configured Application"
+
+msg_info "Running Database Migrations"
+set -a && source /opt/fleet/.env && set +a
+$STD /opt/fleet/fleet prepare db --no-prompt
+msg_ok "Ran Database Migrations"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/fleet.service
+[Unit]
+Description=Fleet
+After=network.target mysql.service redis-server.service
+Requires=mysql.service redis-server.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/fleet
+EnvironmentFile=/opt/fleet/.env
+ExecStart=/opt/fleet/fleet serve
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now fleet redis-server
+msg_ok "Created Service"
+
+msg_info "Initializing Fleet"
+FLEET_ADMIN_EMAIL="admin@fleet.local"
+FLEET_ADMIN_PASS="$(openssl rand -hex 8)1!"
+ELAPSED=0
+until curl -sf "http://127.0.0.1:8080/healthz" >/dev/null 2>&1; do
+  sleep 2
+  ELAPSED=$((ELAPSED + 2))
+  [[ $ELAPSED -ge 60 ]] && break
+done
+SETUP_RESPONSE=$(curl -s -X POST "http://127.0.0.1:8080/api/v1/setup" \
+  -H "Content-Type: application/json" \
+  -d "{\"admin\":{\"admin\":true,\"email\":\"${FLEET_ADMIN_EMAIL}\",\"name\":\"Admin\",\"password\":\"${FLEET_ADMIN_PASS}\"},\"org_info\":{\"org_name\":\"Fleet\",\"org_logo_url\":\"\"},\"server_url\":\"http://127.0.0.1:8080\"}")
+FLEET_TOKEN=$(echo "${SETUP_RESPONSE}" | grep -o '"token":"[^"]*"' | cut -d'"' -f4) || true
+if [[ -n "${FLEET_TOKEN}" ]]; then
+  curl -s -X PATCH "http://127.0.0.1:8080/api/latest/fleet/config" \
+    -H "Content-Type: application/json" \
+    -H "Authorization: Bearer ${FLEET_TOKEN}" \
+    -d "{\"server_settings\":{\"server_url\":\"http://${LOCAL_IP}:8080\"}}" >/dev/null
+fi
+cat <<EOF >>/opt/fleet/.env
+FLEET_ADMIN_EMAIL=${FLEET_ADMIN_EMAIL}
+FLEET_ADMIN_PASSWORD=${FLEET_ADMIN_PASS}
+EOF
+msg_ok "Initialized Fleet"
+
+motd_ssh
+customize
+cleanup_lxc

install/gitlab-install.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://about.gitlab.com/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  openssh-server \
+  perl \
+  tzdata
+msg_ok "Installed Dependencies"
+
+setup_deb822_repo \
+  "gitlab-ce" \
+  "https://packages.gitlab.com/gitlab/gitlab-ce/gpgkey" \
+  "https://packages.gitlab.com/gitlab/gitlab-ce/debian" \
+  "$(get_os_info codename)" \
+  "main"
+
+msg_info "Configuring GitLab"
+mkdir -p /etc/gitlab
+cat <<EOF >/etc/gitlab/gitlab.rb
+external_url 'http://${LOCAL_IP}'
+
+# Omnibus runs 'sysctl -e --system' during reconfigure, which fails in an
+# unprivileged LXC because most kernel keys are not writable.
+package['modify_kernel_parameters'] = false
+EOF
+msg_ok "Configured GitLab"
+
+msg_info "Installing GitLab CE (Patience)"
+$STD apt install -y gitlab-ce
+msg_ok "Installed GitLab CE"
+
+msg_info "Reconfiguring GitLab (Patience)"
+$STD gitlab-ctl reconfigure
+msg_ok "Reconfigured GitLab"
+
+motd_ssh
+customize
+cleanup_lxc

install/godoxy-install.sh

@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# Co-Authors: yusing
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/yusing/godoxy
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+fetch_and_deploy_gh_release "godoxy" "yusing/godoxy" "singlefile" "latest" "/opt/godoxy" "godoxy-linux-$(arch_resolve)"
+
+msg_info "Generating Self-Signed Certificate"
+create_self_signed_cert "godoxy"
+msg_ok "Generated Self-Signed Certificate"
+
+msg_info "Configuring GoDoxy"
+mkdir -p \
+  /opt/godoxy/config/middlewares \
+  /opt/godoxy/data \
+  /opt/godoxy/error_pages
+
+cat <<EOF >/opt/godoxy/config/config.yml
+autocert:
+  provider: local
+  cert_path: /etc/ssl/godoxy/godoxy.crt
+  key_path: /etc/ssl/godoxy/godoxy.key
+
+providers:
+  include:
+    - routes.yml
+
+webui:
+  aliases:
+    - "${LOCAL_IP}"
+EOF
+
+cat <<'EOF' >/opt/godoxy/config/routes.yml
+{}
+EOF
+
+cat <<EOF >/etc/godoxy.env
+GODOXY_API_USER="admin"
+GODOXY_API_PASSWORD="$(openssl rand -hex 16)"
+GODOXY_API_JWT_SECRET="$(openssl rand -base64 32)"
+EOF
+chmod 600 /etc/godoxy.env
+msg_ok "Configured GoDoxy"
+
+msg_info "Creating Service"
+cat <<'EOF' >/etc/systemd/system/godoxy.service
+[Unit]
+Description=GoDoxy Reverse Proxy
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=simple
+User=root
+Group=root
+WorkingDirectory=/opt/godoxy
+EnvironmentFile=/etc/godoxy.env
+ExecStart=/opt/godoxy/godoxy
+Restart=on-failure
+RestartSec=5
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=full
+ReadWritePaths=/opt/godoxy /etc/ssl/godoxy
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now godoxy
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/homepage-install.sh

@@ -25,14 +25,29 @@ msg_info "Installing Homepage (Patience)"
 mkdir -p /opt/homepage/config
 cd /opt/homepage
 cp /opt/homepage/src/skeleton/* /opt/homepage/config
-echo 'onlyBuiltDependencies=*' >> .npmrc
+echo 'onlyBuiltDependencies=*' >>.npmrc
 $STD pnpm install
 export NEXT_PUBLIC_VERSION="v$RELEASE"
 export NEXT_PUBLIC_REVISION="source"
 export NEXT_PUBLIC_BUILDTIME=$(curl -fsSL https://api.github.com/repos/gethomepage/homepage/releases/latest | jq -r '.published_at')
 export NEXT_TELEMETRY_DISABLED=1
 $STD pnpm build
-echo "HOMEPAGE_ALLOWED_HOSTS=localhost:3000,${LOCAL_IP}:3000" >/opt/homepage/.env
+cat <<EOF >/opt/homepage/.env
+HOMEPAGE_ALLOWED_HOSTS=localhost:3000,${LOCAL_IP}:3000
+## Optional Authentication
+# HOMEPAGE_AUTH_ENABLED=true
+# HOMEPAGE_AUTH_SECRET="$(openssl rand -base64 32)"
+# HOMEPAGE_EXTERNAL_URL=<your-external-url>
+## Uncomment below and use strong, unique password for password login
+# HOMEPAGE_AUTH_PASSWORD=
+## Uncomment and fill in below for OIDC login
+# HOMEPAGE_OIDC_ISSUER=
+# HOMEPAGE_OIDC_CLIENT_ID=
+# HOMEPAGE_OIDC_CLIENT_SECRET=
+# HOMEPAGE_OIDC_SCOPE=openid email profile
+# HOMEPAGE_OIDC_NAME=
+EOF
+chmod 600 /opt/homepage/.env
 msg_ok "Installed Homepage"
 
 msg_info "Creating Service"

install/hortusfox-install.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 
 # Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
+# Author: MickLesk (CanbiZ) | Co-Author: Tom Frenzel (tomfrenzel)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://github.com/danielbrendel/hortusfox-web
 
@@ -36,12 +36,15 @@ msg_ok "Composer dependencies installed"
 
 msg_info "Running DB migration"
 $STD php asatru migrate:fresh
+HORTUSFOX_VERSION="$(<~/.hortusfox)"
+printf '["%s"]\n' "$HORTUSFOX_VERSION" >/opt/hortusfox/app/migrations/verhist.json
 msg_ok "Migration finished"
 
 msg_info "Setting up HortusFox"
 $STD mariadb -u root -D $MARIADB_DB_NAME -e "INSERT IGNORE INTO AppModel (workspace, language, created_at) VALUES ('Default Workspace', 'en', NOW());"
-$STD php asatru plants:attributes
 $STD php asatru calendar:classes
+$STD php asatru plants:attributes
+$STD php asatru aquashell:config
 ADMIN_EMAIL="admin@example.com"
 ADMIN_PASS="$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)"
 ADMIN_HASH=$(php -r "echo password_hash('$ADMIN_PASS', PASSWORD_BCRYPT);")

install/ignis-install.sh

@@ -0,0 +1,113 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Nystik-gh/ignis
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y nginx
+msg_ok "Installed Dependencies"
+
+NODE_VERSION="22" setup_nodejs
+
+fetch_and_deploy_gh_release "ignis" "Nystik-gh/ignis" "tarball"
+
+msg_info "Building Ignis"
+cd /opt/ignis
+export NODE_OPTIONS="--max-old-space-size=4096"
+export IGNIS_BUILD="$(cat ~/.ignis)"
+$STD npm ci --ignore-scripts
+$STD npm run build
+$STD npm install -g @electron/asar
+msg_ok "Built Ignis"
+
+msg_info "Downloading Obsidian Web Assets"
+mkdir -p /opt/ignis_data/{obsidian-app,vaults,data}
+OBSIDIAN_VERSION=$(grep -oP 'OBSIDIAN_VERSION=\K[0-9.]+' /opt/ignis/apps/ignis-server/Dockerfile | head -n1)
+[[ -z "$OBSIDIAN_VERSION" ]] && OBSIDIAN_VERSION="1.12.7"
+curl -fsSL -o /tmp/obsidian.asar.gz "https://github.com/obsidianmd/obsidian-releases/releases/download/v${OBSIDIAN_VERSION}/obsidian-${OBSIDIAN_VERSION}.asar.gz"
+gunzip -f /tmp/obsidian.asar.gz
+$STD asar extract /tmp/obsidian.asar /opt/ignis_data/obsidian-app
+rm -f /tmp/obsidian.asar
+echo "${OBSIDIAN_VERSION}" >/opt/ignis_data/obsidian.version
+msg_ok "Downloaded Obsidian Web Assets"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/ignis.service
+[Unit]
+Description=Ignis (Obsidian in the browser)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/ignis
+Environment=NODE_ENV=production
+Environment=PORT=8080
+Environment=VAULT_ROOT=/opt/ignis_data/vaults
+Environment=DATA_ROOT=/opt/ignis_data/data
+Environment=OBSIDIAN_ASSETS_PATH=/opt/ignis_data/obsidian-app
+Environment=AUTO_CREATE_DEFAULT=true
+ExecStart=/usr/bin/node /opt/ignis/apps/ignis-server/server/index.js
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now ignis
+msg_ok "Created Service"
+
+msg_info "Generating Self-Signed Certificate"
+create_self_signed_cert "ignis"
+msg_ok "Generated Self-Signed Certificate"
+
+msg_info "Configuring Nginx"
+cat <<'EOF' >/etc/nginx/sites-available/ignis.conf
+server {
+    listen 80 default_server;
+    server_name _;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl default_server;
+    http2 on;
+    server_name _;
+
+    ssl_certificate /etc/ssl/ignis/ignis.crt;
+    ssl_certificate_key /etc/ssl/ignis/ignis.key;
+
+    client_max_body_size 1024m;
+
+    location / {
+        proxy_pass http://127.0.0.1:8080;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 3600s;
+    }
+}
+EOF
+ln -sf /etc/nginx/sites-available/ignis.conf /etc/nginx/sites-enabled/ignis.conf
+rm -f /etc/nginx/sites-enabled/default
+systemctl restart nginx
+msg_ok "Configured Nginx"
+
+motd_ssh
+customize
+cleanup_lxc

install/immich-install.sh

@@ -355,7 +355,16 @@ cp LICENSE "$APP_DIR"
 cd "$SRC_DIR"
 export MISE_TRUSTED_CONFIG_PATHS="$SRC_DIR"/mise.toml
 export MISE_DISABLE_TOOLS=github:jellyfin/jellyfin-ffmpeg
-$STD mise install
+mise_ok=0
+for i in 1 2 3; do
+  $STD mise install && {
+    mise_ok=1
+    break
+  }
+  msg_warn "mise install failed (attempt $i/3) - retrying"
+  sleep 5
+done
+[[ "$mise_ok" -eq 1 ]] || exit 1
 export PATH="$(mise bin-paths 2>/dev/null | tr '\n' ':')$PATH"
 if ! command -v extism-js >/dev/null 2>&1; then
   # extism-js is published as a bare gzip-compressed single binary (.gz), which

install/karakeep-install.sh

@@ -31,8 +31,9 @@ setup_meilisearch
 
 fetch_and_deploy_gh_release "karakeep" "karakeep-app/karakeep" "tarball"
 cd /opt/karakeep
+# Node 24.19.x crashes better-sqlite3 on cleanup (karakeep-app/karakeep#2989); stay on 22 LTS until upstream reverts.
 MODULE_VERSION="$(jq -r '.packageManager | split("@")[1]' /opt/karakeep/package.json)"
-NODE_VERSION="24" NODE_MODULE="pnpm@${MODULE_VERSION}" setup_nodejs
+NODE_VERSION="22" NODE_MODULE="pnpm@${MODULE_VERSION}" setup_nodejs
 
 msg_info "Installing external JavaScript Extension for yt-dlp"
 $STD pip install -U yt-dlp-ejs --break-system-packages

install/koillection-install.sh

@@ -38,6 +38,7 @@ export APP_RUNTIME='Symfony\Component\Runtime\SymfonyRuntime'
 $STD composer install --no-dev -o --no-interaction --classmap-authoritative
 $STD php bin/console doctrine:migrations:migrate --no-interaction
 $STD php bin/console app:translations:dump
+$STD php bin/console lexik:jwt:generate-keypair --skip-if-exists
 cd assets/
 $STD yarn install
 $STD yarn build
@@ -51,6 +52,7 @@ cat <<EOF >/etc/apache2/sites-available/koillection.conf
     ServerName koillection
     DocumentRoot /opt/koillection/public
     SetEnv APP_RUNTIME "Symfony\\Component\\Runtime\\SymfonyRuntime"
+    SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=\$1
     <Directory /opt/koillection/public>
         Options Indexes FollowSymLinks
         AllowOverride All

install/mumble-install.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.mumble.info/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Mumble"
+$STD apt install -y mumble-server
+cat <<EOF >~/.mumble
+$(get_latest_github_release "mumble-voip/mumble")
+EOF
+msg_ok "Installed Mumble"
+
+msg_info "Configuring Mumble"
+mkdir -p /var/lib/mumble-server
+cat <<EOF >/etc/mumble/mumble-server.ini
+database=/var/lib/mumble-server/mumble-server.sqlite
+sqlite_wal=2
+port=64738
+users=100
+bandwidth=558000
+allowping=true
+obfuscate=true
+ice="tcp -h 127.0.0.1 -p 6502"
+icesecretwrite=$(tr -d '-' </proc/sys/kernel/random/uuid)
+EOF
+chown -R mumble-server:mumble-server /var/lib/mumble-server
+chown root:mumble-server /etc/mumble/mumble-server.ini
+chmod 640 /etc/mumble/mumble-server.ini
+msg_ok "Configured Mumble"
+
+msg_info "Setting SuperUser Password"
+MUMBLE_PASSWORD=$(tr -d '-' </proc/sys/kernel/random/uuid)
+mumble-server -ini /etc/mumble/mumble-server.ini -supw "$MUMBLE_PASSWORD"
+chown -R mumble-server:mumble-server /var/lib/mumble-server
+msg_ok "Set SuperUser password: ${MUMBLE_PASSWORD}"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/mumble-server.service
+[Unit]
+Description=Mumble Server
+After=network.target
+
+[Service]
+Type=simple
+User=mumble-server
+Group=mumble-server
+ExecStart=/usr/bin/mumble-server -ini /etc/mumble/mumble-server.ini -fg
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now mumble-server
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/networkoptimizer-install.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Ozark-Connect/NetworkOptimizer
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  git \
+  sshpass \
+  iperf3
+setup_deb822_repo \
+  "microsoft" \
+  "https://packages.microsoft.com/keys/microsoft-2025.asc" \
+  "https://packages.microsoft.com/debian/13/prod/" \
+  "trixie"
+$STD apt install -y dotnet-sdk-10.0
+msg_ok "Installed Dependencies"
+
+setup_go
+
+fetch_and_deploy_gh_release "networkoptimizer" "Ozark-Connect/NetworkOptimizer" "tarball"
+
+msg_info "Building NetworkOptimizer"
+RID="linux-x64"
+[[ "$(dpkg --print-architecture)" == "arm64" ]] && RID="linux-arm64"
+cd /opt/networkoptimizer
+export MinVerVersionOverride="$(cat ~/.networkoptimizer)"
+export MSBUILDDISABLENODEREUSE=1
+export DOTNET_CLI_TELEMETRY_OPTOUT=1
+export DOTNET_SYSTEM_NET_DISABLEIPV6=1
+$STD dotnet publish src/NetworkOptimizer.Web -c Release -r "$RID" --self-contained -o /opt/networkoptimizer/publish
+chmod +x /opt/networkoptimizer/publish/NetworkOptimizer.Web
+msg_ok "Built NetworkOptimizer"
+
+msg_info "Building Speed Test Binaries"
+mkdir -p /opt/networkoptimizer/publish/tools
+cd /opt/networkoptimizer/src/uwnspeedtest
+CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $STD go build -trimpath -ldflags "-s -w" -o /opt/networkoptimizer/publish/tools/uwnspeedtest-linux-arm64 .
+SERVER_ARCH="$(arch_resolve)"
+if [[ "$SERVER_ARCH" != "arm64" ]]; then
+  CGO_ENABLED=0 GOOS=linux GOARCH="$SERVER_ARCH" $STD go build -trimpath -ldflags "-s -w" -o "/opt/networkoptimizer/publish/tools/uwnspeedtest-linux-${SERVER_ARCH}" .
+fi
+msg_ok "Built Speed Test Binaries"
+
+msg_info "Configuring NetworkOptimizer"
+cat <<EOF >/opt/networkoptimizer/networkoptimizer.env
+ASPNETCORE_URLS=http://*:8042
+HOST_IP=${LOCAL_IP}
+Iperf3Server__Enabled=true
+EOF
+msg_ok "Configured NetworkOptimizer"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/networkoptimizer.service
+[Unit]
+Description=NetworkOptimizer
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/networkoptimizer/publish
+EnvironmentFile=/opt/networkoptimizer/networkoptimizer.env
+ExecStart=/opt/networkoptimizer/publish/NetworkOptimizer.Web
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now networkoptimizer
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/newt-install.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Arubinu
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/fosrl/newt
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+fetch_and_deploy_gh_release "newt" "fosrl/newt" "singlefile" "latest" "/opt/newt" "newt_linux_$(arch_resolve)"
+ln -sf /opt/newt/newt /usr/local/bin/newt
+
+if [[ -z "${NEWT_ID:-}" ]]; then
+  read -rp "Newt ID (from your Pangolin dashboard): " NEWT_ID
+fi
+if [[ -z "${NEWT_SECRET:-}" ]]; then
+  read -rsp "Newt Secret: " NEWT_SECRET
+  echo
+fi
+if [[ -z "${PANGOLIN_ENDPOINT:-}" ]]; then
+  read -rp "Pangolin endpoint (e.g. https://pangolin.example.com): " PANGOLIN_ENDPOINT
+fi
+
+if [[ -z "$NEWT_ID" || -z "$NEWT_SECRET" || -z "$PANGOLIN_ENDPOINT" ]]; then
+  msg_error "Newt ID, Secret and Endpoint are all required. Aborting."
+  exit 1
+fi
+
+msg_info "Configuring Newt"
+mkdir -p /etc/newt
+cat <<EOF >/etc/newt/newt.env
+NEWT_ID=${NEWT_ID}
+NEWT_SECRET=${NEWT_SECRET}
+PANGOLIN_ENDPOINT=${PANGOLIN_ENDPOINT}
+EOF
+chmod 600 /etc/newt/newt.env
+msg_ok "Configured Newt"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/newt.service
+[Unit]
+Description=Newt (Pangolin tunnel client)
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=simple
+EnvironmentFile=/etc/newt/newt.env
+ExecStart=/usr/local/bin/newt
+Restart=always
+RestartSec=2
+UMask=0077
+PrivateTmp=true
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now newt
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/nextcloudpi-install.sh

@@ -24,6 +24,16 @@ if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
   exit 10
 fi
 
+msg_info "Making ssh.service reloads behave like restarts"
+mkdir -p /etc/systemd/system/ssh.service.d
+cat <<'EOF' >/etc/systemd/system/ssh.service.d/reload-as-restart.conf
+[Service]
+ExecReload=
+ExecReload=/usr/bin/systemd-run --no-block --quiet /bin/systemctl restart ssh.service
+EOF
+systemctl daemon-reload
+msg_ok "Made ssh.service reloads behave like restarts"
+
 msg_info "Installing NextCloudPi (Patience)"
 $STD bash <(curl -fsSL https://raw.githubusercontent.com/nextcloud/nextcloudpi/master/install.sh)
 msg_ok "Installed NextCloudPi"

install/openwebui-install.sh

@@ -25,8 +25,28 @@ setup_hwaccel
 
 PYTHON_VERSION="3.12" setup_uv
 
+OTEL_ARGS=()
+read -r -p "${TAB3}Would you like to install OpenTelemetry instrumentation packages (requires manual .env configuration)? <y/N> " prompt
+if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
+  for pkg in \
+    opentelemetry-api \
+    opentelemetry-sdk \
+    opentelemetry-exporter-otlp \
+    opentelemetry-exporter-otlp-proto-http \
+    opentelemetry-instrumentation-fastapi \
+    opentelemetry-instrumentation-aiohttp-client \
+    opentelemetry-instrumentation-httpx \
+    opentelemetry-instrumentation-sqlalchemy \
+    opentelemetry-instrumentation-requests \
+    opentelemetry-instrumentation-logging \
+    opentelemetry-instrumentation-redis \
+    opentelemetry-instrumentation-system-metrics; do
+    OTEL_ARGS+=(--with "$pkg")
+  done
+fi
+
 msg_info "Installing Open WebUI"
-$STD uv tool install --python 3.12 --constraint <(echo "numba>=0.60") open-webui[all]
+$STD uv tool install --python 3.12 --constraint <(echo "numba>=0.60") "${OTEL_ARGS[@]}" open-webui[all]
 msg_ok "Installed Open WebUI"
 
 read -r -p "${TAB3}Would you like to add Ollama? <y/N> " prompt

install/orb-install.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: angusmaul
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://orb.net/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+setup_deb822_repo \
+  "orb" \
+  "https://pkgs.orb.net/stable/debian/orbforge.noarmor.gpg" \
+  "https://pkgs.orb.net/stable/debian" \
+  "orb" \
+  "main"
+
+msg_info "Installing Orb"
+$STD apt install -y orb
+msg_ok "Installed Orb"
+
+msg_info "Enabling Service"
+systemctl enable -q --now orb
+msg_ok "Enabled Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/outline-install.sh

@@ -28,21 +28,23 @@ fetch_and_deploy_gh_release "outline" "outline/outline" "tarball"
 
 msg_info "Configuring Outline (Patience)"
 SECRET_KEY="$(openssl rand -hex 32)"
+UTILS_SECRET="$(openssl rand -hex 32)"
 cd /opt/outline
 cp .env.sample .env
 export NODE_ENV=development
-sed -i 's/NODE_ENV=production/NODE_ENV=development/g' /opt/outline/.env
+sed -i "s#^NODE_ENV=.*#NODE_ENV=development#" /opt/outline/.env
-sed -i "s/generate_a_new_key/${SECRET_KEY}/g" /opt/outline/.env
+sed -i "s#^SECRET_KEY=.*#SECRET_KEY=${SECRET_KEY}#" /opt/outline/.env
-sed -i "s/user:pass@postgres/${PG_DB_USER}:${PG_DB_PASS}@localhost/g" /opt/outline/.env
+sed -i "s#^UTILS_SECRET=.*#UTILS_SECRET=${UTILS_SECRET}#" /opt/outline/.env
-sed -i 's/redis:6379/localhost:6379/g' /opt/outline/.env
+sed -i "s#^DATABASE_URL=.*#DATABASE_URL=postgres://${PG_DB_USER}:${PG_DB_PASS}@localhost:5432/${PG_DB_NAME}#" /opt/outline/.env
-sed -i "5s#URL=#URL=http://${LOCAL_IP}#g" /opt/outline/.env
+sed -i "s#^REDIS_URL=.*#REDIS_URL=redis://localhost:6379#" /opt/outline/.env
-sed -i 's/FORCE_HTTPS=true/FORCE_HTTPS=false/g' /opt/outline/.env
+sed -i "s#^URL=.*#URL=http://${LOCAL_IP}#" /opt/outline/.env
+sed -i "s#^FORCE_HTTPS=.*#FORCE_HTTPS=false#" /opt/outline/.env
 export NODE_OPTIONS="--max-old-space-size=3584"
 export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
 
 $STD yarn install --immutable
 export NODE_ENV=production
-sed -i 's/NODE_ENV=development/NODE_ENV=production/g' /opt/outline/.env
+sed -i "s#^NODE_ENV=.*#NODE_ENV=production#" /opt/outline/.env
 $STD yarn build
 msg_ok "Configured Outline"
 

install/pangolin-install.sh

@@ -27,9 +27,18 @@ fetch_and_deploy_gh_release "pangolin" "fosrl/pangolin" "tarball" "$PANGOLIN_VER
 fetch_and_deploy_gh_release "gerbil" "fosrl/gerbil" "singlefile" "latest" "/usr/bin" "gerbil_linux_$(arch_resolve)"
 fetch_and_deploy_gh_release "traefik" "traefik/traefik" "prebuild" "latest" "/usr/bin" "traefik_v*_linux_$(arch_resolve).tar.gz"
 
-read -rp "${TAB3}Enter your Pangolin URL (ex: https://pangolin.example.com): " pango_url
+# Read the variable first and prompt only when it is unset, so the install can
+# be supplied up front. Same convention as install/forgejo-runner-install.sh.
+pango_url="${var_pangolin_url:-}"
+if [[ -z "$pango_url" ]]; then
+  read -rp "${TAB3}Enter your Pangolin URL (ex: https://pangolin.example.com): " pango_url
+fi
 [[ "$pango_url" != https://* && "$pango_url" != http://* ]] && pango_url="https://${pango_url}"
-read -rp "${TAB3}Enter your email address: " pango_email
+
+pango_email="${var_pangolin_email:-}"
+if [[ -z "$pango_email" ]]; then
+  read -rp "${TAB3}Enter your email address: " pango_email
+fi
 
 msg_info "Setup Pangolin"
 SECRET_KEY=$(openssl rand -base64 48 | tr -dc 'A-Za-z0-9' | head -c 32)

install/paperless-ngx-install.sh

@@ -108,7 +108,7 @@ Requires=redis.service
 
 [Service]
 WorkingDirectory=/opt/paperless/src
-ExecStart=uv run -- celery --app paperless beat --loglevel INFO
+ExecStart=uv run --no-sync -- celery --app paperless beat --loglevel INFO
 
 [Install]
 WantedBy=multi-user.target
@@ -122,7 +122,7 @@ After=postgresql.service
 
 [Service]
 WorkingDirectory=/opt/paperless/src
-ExecStart=uv run -- celery --app paperless worker --loglevel INFO
+ExecStart=uv run --no-sync -- celery --app paperless worker --loglevel INFO
 
 [Install]
 WantedBy=multi-user.target
@@ -136,7 +136,7 @@ Requires=redis.service
 [Service]
 WorkingDirectory=/opt/paperless/src
 ExecStartPre=/bin/sleep 2
-ExecStart=uv run -- python manage.py document_consumer
+ExecStart=uv run --no-sync -- python manage.py document_consumer
 
 [Install]
 WantedBy=multi-user.target
@@ -151,7 +151,8 @@ Requires=redis.service
 
 [Service]
 WorkingDirectory=/opt/paperless/src
-ExecStart=uv run -- granian --interface asginl --ws --loop uvloop "paperless.asgi:application"
+#ExecStartPre=uv run -- python manage.py document_index reindex --if-needed --no-progress-bar
+ExecStart=uv run --no-sync -- granian --interface asginl --ws --loop uvloop "paperless.asgi:application"
 Environment=GRANIAN_HOST=::
 Environment=GRANIAN_PORT=8000
 Environment=GRANIAN_WORKERS=1

install/pelican-panel-install.sh

@@ -27,6 +27,8 @@ msg_info "Installing Pelican Panel"
 cd /opt/pelican-panel
 $STD composer install --no-dev --optimize-autoloader --no-interaction
 $STD php artisan p:environment:setup
+sed -i "s|^APP_URL=.*|APP_URL=http://${LOCAL_IP}|" /opt/pelican-panel/.env
+echo "yes" | $STD php artisan p:environment:database --driver mariadb --host localhost --port 3306 --database "$MARIADB_DB_NAME" --username "$MARIADB_DB_USER" --password "$MARIADB_DB_PASS"
 $STD php artisan p:environment:queue-service --no-interaction
 echo "* * * * * php /opt/pelican-panel/artisan schedule:run >> /dev/null 2>&1" | crontab -u www-data -
 chown -R www-data:www-data /opt/pelican-panel

install/powerdns-install.sh

@@ -40,24 +40,25 @@ $STD apt install -y \
   pdns-backend-sqlite3
 sed -i 's/^launch=$/# launch=/' /etc/powerdns/pdns.conf
 rm -f /etc/powerdns/pdns.d/bind.conf
+mkdir -p /var/lib/powerdns
 cat <<EOF >/etc/powerdns/pdns.d/gsqlite3.conf
 launch=gsqlite3
-gsqlite3-database=/opt/poweradmin/powerdns.db
+gsqlite3-database=/var/lib/powerdns/powerdns.db
 EOF
 msg_ok "Setup PowerDNS"
 
 fetch_and_deploy_gh_release "poweradmin" "poweradmin/poweradmin" "tarball"
 
 msg_info "Setting up Poweradmin"
-sqlite3 /opt/poweradmin/powerdns.db </opt/poweradmin/sql/poweradmin-sqlite-db-structure.sql
+sqlite3 /var/lib/powerdns/powerdns.db </opt/poweradmin/sql/poweradmin-sqlite-db-structure.sql
-sqlite3 /opt/poweradmin/powerdns.db </opt/poweradmin/sql/pdns/49/schema.sqlite3.sql
+sqlite3 /var/lib/powerdns/powerdns.db </opt/poweradmin/sql/pdns/49/schema.sqlite3.sql
 PA_ADMIN_USERNAME="admin"
 PA_ADMIN_EMAIL="admin@example.com"
 PA_ADMIN_FULLNAME="Administrator"
 PA_ADMIN_PASSWORD=$(openssl rand -base64 16 | tr -d "=+/" | cut -c1-16)
 PA_SESSION_KEY=$(openssl rand -base64 75 | tr -dc 'A-Za-z0-9^@#!(){}[]%_\-+=~' | head -c 50)
 PASSWORD_HASH=$(php -r "echo password_hash(\$argv[1], PASSWORD_DEFAULT);" -- "${PA_ADMIN_PASSWORD}" 2>/dev/null)
-sqlite3 /opt/poweradmin/powerdns.db "INSERT INTO users (username, password, fullname, email, description, perm_templ, active, use_ldap) \
+sqlite3 /var/lib/powerdns/powerdns.db "INSERT INTO users (username, password, fullname, email, description, perm_templ, active, use_ldap) \
   VALUES ('$(escape_sql "${PA_ADMIN_USERNAME}")', '$(escape_sql "${PASSWORD_HASH}")', '$(escape_sql "${PA_ADMIN_FULLNAME}")', \
   '$(escape_sql "${PA_ADMIN_EMAIL}")', 'System Administrator', 1, 1, 0);"
 
@@ -81,7 +82,7 @@ return [
      */
     'database' => [
         'type' => 'sqlite',
-        'file' => '/opt/poweradmin/powerdns.db',
+        'file' => '/var/lib/powerdns/powerdns.db',
     ],
 
     /**
@@ -133,8 +134,8 @@ EOF
 $STD a2enmod rewrite headers
 chown -R www-data:pdns /opt/poweradmin
 chmod 775 /opt/poweradmin
-chown pdns:pdns /opt/poweradmin/powerdns.db
+chown pdns:pdns /var/lib/powerdns/powerdns.db
-chmod 664 /opt/poweradmin/powerdns.db
+chmod 664 /var/lib/powerdns/powerdns.db
 usermod -aG pdns www-data
 $STD systemctl restart pdns apache2
 msg_ok "Created Service"

install/projectsend-install.sh

@@ -13,46 +13,106 @@ setting_up_container
 network_check
 update_os
 
-PHP_VERSION="8.4" PHP_APACHE="YES" setup_php
+msg_info "Installing Dependencies"
-setup_mariadb
+$STD apt install -y nginx
-MARIADB_DB_NAME="projectsend" MARIADB_DB_USER="projectsend" setup_mariadb_db
+msg_ok "Installed Dependencies"
-fetch_and_deploy_gh_release "projectsend" "projectsend/projectsend" "prebuild" "latest" "/opt/projectsend" "projectsend-r*.zip"
 
-msg_info "Installing ProjectSend"
+PHP_VERSION="8.4" PHP_FPM="YES" PHP_MODULE="ldap,pcntl" setup_php
-mv /opt/projectsend/includes/sys.config.sample.php /opt/projectsend/includes/sys.config.php
+setup_mariadb
+MARIADB_DB_NAME="projectsend"
+MARIADB_DB_USER="projectsend"
+setup_mariadb_db
+fetch_and_deploy_gh_release "projectsend" "projectsend/projectsend" "prebuild" "latest" "/opt/projectsend" "projectsend-*.zip"
+
+msg_info "Configuring ProjectSend"
+cd /opt/projectsend
+cp .env.example .env
+ADMIN_EMAIL="admin@example.com"
+ADMIN_PASSWORD=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
+sed -i \
+  -e "s|^APP_ENV=.*|APP_ENV=production|" \
+  -e "s|^APP_DEBUG=.*|APP_DEBUG=false|" \
+  -e "s|^APP_URL=.*|APP_URL=http://${LOCAL_IP}|" \
+  -e "s|^DB_HOST=.*|DB_HOST=localhost|" \
+  -e "s|^DB_DATABASE=.*|DB_DATABASE=${MARIADB_DB_NAME}|" \
+  -e "s|^DB_USERNAME=.*|DB_USERNAME=${MARIADB_DB_USER}|" \
+  -e "s|^DB_PASSWORD=.*|DB_PASSWORD=${MARIADB_DB_PASS}|" \
+  -e "s|^SESSION_DRIVER=.*|SESSION_DRIVER=database|" \
+  -e "s|^CACHE_STORE=.*|CACHE_STORE=database|" \
+  -e "s|^QUEUE_CONNECTION=.*|QUEUE_CONNECTION=database|" \
+  .env
 chown -R www-data:www-data /opt/projectsend
-chmod -R 775 /opt/projectsend
+chmod -R 775 /opt/projectsend/storage /opt/projectsend/bootstrap/cache
-chmod 644 /opt/projectsend/includes/sys.config.php
+$STD sudo -u www-data php artisan key:generate --force --no-interaction
-sed -i -e "s/\(define('DB_NAME', \).*/\1'$MARIADB_DB_NAME');/" \
+$STD sudo -u www-data php artisan migrate --force
-  -e "s/\(define('DB_USER', \).*/\1'$MARIADB_DB_USER');/" \
+$STD sudo -u www-data php artisan storage:link --force
-  -e "s/\(define('DB_PASSWORD', \).*/\1'$MARIADB_DB_PASS');/" \
+$STD sudo -u www-data php artisan projectsend:ensure-roles
-  /opt/projectsend/includes/sys.config.php
+$STD sudo -u www-data php artisan projectsend:admin --if-none \
-sed -i -e "s/^\(memory_limit = \).*/\1 256M/" \
+  --name="Administrator" \
-  -e "s/^\(post_max_size = \).*/\1 256M/" \
+  --email="${ADMIN_EMAIL}" \
-  -e "s/^\(upload_max_filesize = \).*/\1 256M/" \
+  --password="${ADMIN_PASSWORD}"
-  -e "s/^\(max_execution_time = \).*/\1 300/" \
+cat <<EOF >~/projectsend.creds
-  /etc/php/8.4/apache2/php.ini
+ProjectSend Credentials
-msg_ok "Installed projectsend"
+Admin Email: ${ADMIN_EMAIL}
+Admin Password: ${ADMIN_PASSWORD}
+EOF
+msg_ok "Configured ProjectSend"
 
 msg_info "Creating Service"
-cat <<EOF >/etc/apache2/sites-available/projectsend.conf
+PHP_SOCK=$(get_php_fpm_socket)
-<VirtualHost *:80>
+cat <<EOF >/etc/nginx/sites-available/projectsend.conf
-    ServerName projectsend
+server {
-    DocumentRoot /opt/projectsend
+    listen 80 default_server;
-    <Directory /opt/projectsend>
+    server_name _;
-        Options FollowSymLinks
+    root /opt/projectsend/public;
-        AllowOverride All
+    index index.php;
-        Require all granted
-    </Directory>
 
-    ErrorLog /var/log/apache2/projectsend_error.log
+    client_max_body_size 100m;
-    CustomLog /var/log/apache2/projectsend_access.log combined
+
-</VirtualHost>
+    location / {
+        try_files \$uri \$uri/ /index.php?\$query_string;
+    }
+
+    location /protected-files/ {
+        internal;
+        alias /opt/projectsend/storage/app/files/;
+    }
+
+    location ~ \.php\$ {
+        try_files \$uri =404;
+        fastcgi_pass unix:${PHP_SOCK};
+        fastcgi_index index.php;
+        fastcgi_param SCRIPT_FILENAME \$realpath_root\$fastcgi_script_name;
+        include fastcgi_params;
+        fastcgi_buffer_size 32k;
+        fastcgi_buffers 8 32k;
+    }
+
+    location ~ /\.(?!well-known) {
+        deny all;
+    }
+}
 EOF
-$STD a2ensite projectsend
+nginx_enable_site projectsend.conf
-$STD a2enmod rewrite
+
-$STD a2dissite 000-default.conf
+cat <<EOF >/etc/systemd/system/projectsend-worker.service
-$STD systemctl reload apache2
+[Unit]
+Description=ProjectSend queue worker
+After=network.target mariadb.service
+
+[Service]
+User=www-data
+Group=www-data
+Restart=always
+WorkingDirectory=/opt/projectsend
+ExecStart=/usr/bin/php artisan queue:work --tries=3 --backoff=3
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now projectsend-worker
+
+echo "* * * * * cd /opt/projectsend && php artisan schedule:run >> /dev/null 2>&1" | crontab -u www-data -
 msg_ok "Created Service"
 
 motd_ssh

install/reactive-resume-install.sh

@@ -3,7 +3,7 @@
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: vhsdream | Rewrite: MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://rxresume.org | Github: https://github.com/amruthpillai/reactive-resume
+# Source: https://rxresu.me/ | Github: https://github.com/amruthpillai/reactive-resume
 
 source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
 color
@@ -39,7 +39,6 @@ msg_ok "Built Reactive Resume"
 
 msg_info "Configuring Reactive Resume"
 AUTH_SECRET=$(openssl rand -hex 32)
-
 cat <<EOF >/opt/reactive-resume/.env
 # Reactive Resume v5 Configuration
 NODE_ENV=production

install/reitti-install.sh

@@ -46,6 +46,8 @@ http {
       proxy_pass $upstream_url;
       proxy_set_header Host $proxy_host;
       proxy_set_header User-Agent "Reitti/1.0";
+      proxy_ssl_server_name on;
+      proxy_ssl_name $proxy_host;
       proxy_cache tiles;
       proxy_cache_key $upstream_url;
       proxy_cache_valid 200 30d;

install/rss-bridge-install.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://rss-bridge.org/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y caddy patchelf
+msg_ok "Installed Dependencies"
+
+PHP_VERSION="8.4" PHP_FPM="YES" setup_php
+setup_composer
+
+fetch_and_deploy_gh_release "curl-impersonate" "lexiforest/curl-impersonate" "prebuild" "latest" "/usr/local/lib/curl-impersonate" "libcurl-impersonate-v*.$(arch_resolve x86_64-linux-gnu aarch64-linux-gnu).tar.gz"
+
+fetch_and_deploy_gh_release "rss-bridge" "RSS-Bridge/rss-bridge" "tarball"
+
+msg_info "Setting up RSS-Bridge"
+cd /opt/rss-bridge
+$STD composer install --no-dev --optimize-autoloader
+cp config.default.ini.php config.ini.php
+chown -R www-data:www-data /opt/rss-bridge
+msg_ok "Set up RSS-Bridge"
+
+msg_info "Configuring Caddy"
+PHP_VER=$(php -r 'echo PHP_MAJOR_VERSION . "." . PHP_MINOR_VERSION;')
+cat <<EOF >/etc/caddy/Caddyfile
+:80 {
+    root * /opt/rss-bridge
+    php_fastcgi unix//run/php/php${PHP_VER}-fpm.sock
+    file_server
+    encode gzip
+}
+EOF
+usermod -aG www-data caddy
+msg_ok "Configured Caddy"
+
+if [[ -f /usr/local/lib/curl-impersonate/libcurl-impersonate.so ]]; then
+  msg_info "Enabling curl-impersonate for PHP-FPM"
+  patchelf --set-soname libcurl.so.4 /usr/local/lib/curl-impersonate/libcurl-impersonate.so
+  mkdir -p /etc/systemd/system/php${PHP_VER}-fpm.service.d
+  cat <<EOF >/etc/systemd/system/php${PHP_VER}-fpm.service.d/curl-impersonate.conf
+[Service]
+Environment=LD_PRELOAD=/usr/local/lib/curl-impersonate/libcurl-impersonate.so
+EOF
+  cat <<EOF >>/etc/php/${PHP_VER}/fpm/pool.d/www.conf
+env[CURL_IMPERSONATE] = chrome142
+EOF
+  $STD systemctl daemon-reload
+  safe_service_restart php${PHP_VER}-fpm
+  msg_ok "Enabled curl-impersonate for PHP-FPM"
+fi
+
+systemctl enable -q --now php${PHP_VER}-fpm
+systemctl restart caddy
+
+motd_ssh
+customize
+cleanup_lxc

install/signoz-install.sh

@@ -103,6 +103,9 @@ cat <<EOF >/etc/clickhouse-server/config.d/cluster.xml
         <shard>01</shard>
         <replica>01</replica>
     </macros>
+    <merge_tree>
+      <allow_dimensions_outside_sorting_key>1</allow_dimensions_outside_sorting_key>
+    </merge_tree>
 </clickhouse>
 EOF
 systemctl enable -q --now clickhouse-server

install/sparkyfitness-install.sh

@@ -14,7 +14,7 @@ network_check
 update_os
 
 msg_info "Installing Dependencies"
-$STD apt install -y nginx
+$STD apt install -y git nginx
 msg_ok "Installed Dependencies"
 
 PG_VERSION="18" setup_postgresql

install/stalwart-install.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/stalwartlabs/stalwart
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+fetch_and_deploy_gh_release "stalwart" "stalwartlabs/stalwart" "prebuild" "latest" "/opt/stalwart" "stalwart-$(arch_resolve x86_64 aarch64)-unknown-linux-gnu.tar.gz"
+chmod +x /opt/stalwart/stalwart
+
+msg_info "Configuring Stalwart"
+mkdir -p /opt/stalwart_data/{etc,data,logs}
+cat <<EOF >/opt/stalwart_data/etc/stalwart.env
+# Uncomment and edit an entry to override its default.
+# Apply changes with: systemctl restart stalwart
+
+#STALWART_HOSTNAME=mail.example.com
+#STALWART_PUBLIC_URL=https://mail.example.com
+#STALWART_RECOVERY_MODE=true
+#STALWART_RECOVERY_ADMIN=admin:changeme
+EOF
+chmod 600 /opt/stalwart_data/etc/stalwart.env
+msg_ok "Configured Stalwart"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/stalwart.service
+[Unit]
+Description=Stalwart Mail Server
+Conflicts=postfix.service sendmail.service exim4.service
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/stalwart_data
+EnvironmentFile=-/opt/stalwart_data/etc/stalwart.env
+ExecStart=/opt/stalwart/stalwart --config=/opt/stalwart_data/etc/config.json
+LimitNOFILE=65536
+KillMode=process
+KillSignal=SIGINT
+Restart=on-failure
+RestartSec=5
+SyslogIdentifier=stalwart
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now stalwart
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/stirling-pdf-install.sh

@@ -34,7 +34,11 @@ msg_ok "Installed Dependencies"
 PYTHON_VERSION="3.12" setup_uv
 JAVA_VERSION="25" setup_java
 
-read -r -p "${TAB3}Do you want to use Stirling-PDF with Login? (no/n = without Login) [Y/n] " response
+if ! read -r -p "${TAB3}Do you want to use Stirling-PDF with Login? (no/n = without Login) [Y/n] " response; then
+  # No interactive stdin (EOF): fall back to the no-login install instead of
+  # silently selecting login, which the -z test below would otherwise do.
+  response="n"
+fi
 response=${response,,} # Convert to lowercase
 login_mode="false"
 if [[ "$response" == "y" || "$response" == "yes" || -z "$response" ]]; then
@@ -72,7 +76,10 @@ $STD uv pip install \
   pillow \
   pdf2image
 $STD apt install -y python3-uno python3-pip
-$STD pip3 install --break-system-packages --timeout=120 unoserver
+# Install unoserver for the system Python, not the venv activated above: `uno` is
+# provided by python3-uno for /usr/bin/python3 only, and unoserver.service expects
+# /usr/local/bin/unoserver. A bare `pip3` here resolves to the venv's pip.
+$STD /usr/bin/python3 -m pip install --break-system-packages --timeout=120 unoserver
 ln -sf /opt/.venv/bin/python3 /usr/local/bin/python3
 ln -sf /opt/.venv/bin/pip /usr/local/bin/pip
 msg_ok "Installed Python Dependencies"
@@ -104,7 +111,7 @@ PATH=/opt/.venv/bin:/usr/lib/libreoffice/program:/usr/local/sbin:/usr/local/bin:
 EOF
 
 if [[ "$login_mode" == "true" ]]; then
-  cat <<EOF >/opt/Stirling-PDF/.env
+  cat <<EOF >>/opt/Stirling-PDF/.env
 # activate Login
 DISABLE_ADDITIONAL_FEATURES=false
 SECURITY_ENABLELOGIN=true
@@ -125,27 +132,12 @@ $STD fc-cache -fv
 msg_ok "Font Cache Updated"
 
 msg_info "Creating Service"
-cat <<EOF >/etc/systemd/system/libreoffice-listener.service
+# unoserver starts and supervises its own LibreOffice on UNO port 2002, so a separate
-[Unit]
+# listener on that port only collides with it. Do not reintroduce one.
-Description=LibreOffice Headless Listener Service
-After=network.target
-
-[Service]
-Type=simple
-User=root
-Group=root
-ExecStart=/usr/lib/libreoffice/program/soffice --headless --invisible --nodefault --nofirststartwizard --nolockcheck --nologo --accept="socket,host=127.0.0.1,port=2002;urp;StarOffice.ComponentContext"
-Restart=always
-
-[Install]
-WantedBy=multi-user.target
-EOF
-
 cat <<EOF >/etc/systemd/system/stirlingpdf.service
 [Unit]
 Description=Stirling-PDF service
-After=syslog.target network.target libreoffice-listener.service
+After=syslog.target network.target unoserver.service
-Requires=libreoffice-listener.service
 
 [Service]
 SuccessExitStatus=143
@@ -166,8 +158,7 @@ EOF
 cat <<EOF >/etc/systemd/system/unoserver.service
 [Unit]
 Description=UnoServer RPC Interface
-After=libreoffice-listener.service
+After=network.target
-Requires=libreoffice-listener.service
 
 [Service]
 Type=simple
@@ -179,9 +170,8 @@ EnvironmentFile=/opt/Stirling-PDF/.env
 WantedBy=multi-user.target
 EOF
 
-systemctl enable -q --now libreoffice-listener
-systemctl enable -q --now stirlingpdf
 systemctl enable -q --now unoserver
+systemctl enable -q --now stirlingpdf
 msg_ok "Created Service"
 
 motd_ssh

install/suggestarr-install.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/giuseppe99barchetta/SuggestArr
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y build-essential
+msg_ok "Installed Dependencies"
+
+UV_PYTHON="3.12" setup_uv
+NODE_VERSION="22" setup_nodejs
+
+fetch_and_deploy_gh_release "suggestarr" "giuseppe99barchetta/SuggestArr" "tarball"
+
+msg_info "Building Frontend"
+cd /opt/suggestarr/client
+$STD npm install
+$STD npm run build
+mkdir -p /opt/suggestarr/static
+cp -r /opt/suggestarr/client/dist/* /opt/suggestarr/static/
+cp -r /opt/suggestarr/client/node_modules/swagger-ui-dist /opt/suggestarr/static/swagger-ui
+msg_ok "Built Frontend"
+
+msg_info "Setting up Python Environment"
+cd /opt/suggestarr
+$STD uv venv --python 3.12 /opt/suggestarr/.venv
+$STD uv pip install --python /opt/suggestarr/.venv -r /opt/suggestarr/api_service/requirements.txt
+msg_ok "Set up Python Environment"
+
+msg_info "Configuring SuggestArr"
+mkdir -p /opt/suggestarr_data
+cat <<EOF >/opt/suggestarr.env
+SUGGESTARR_PORT=5000
+LOG_LEVEL=info
+CONFIG_DIR=/opt/suggestarr_data
+EOF
+chmod 600 /opt/suggestarr.env
+msg_ok "Configured SuggestArr"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/suggestarr.service
+[Unit]
+Description=SuggestArr
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/suggestarr
+EnvironmentFile=/opt/suggestarr.env
+ExecStart=/opt/suggestarr/.venv/bin/uvicorn api_service.app:asgi_app --host 0.0.0.0 --port 5000 --log-level info
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now suggestarr
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/teslamate-install.sh

@@ -0,0 +1,183 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/teslamate-org/teslamate
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  build-essential \
+  erlang \
+  erlang-dev \
+  erlang-syntax-tools \
+  elixir \
+  mosquitto \
+  locales
+sed -i 's/^# *\(en_US.UTF-8\)/\1/' /etc/locale.gen
+$STD locale-gen
+systemctl enable -q --now mosquitto
+msg_ok "Installed Dependencies"
+
+PG_VERSION="17" setup_postgresql
+PG_DB_NAME="teslamate" PG_DB_USER="teslamate" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db
+NODE_VERSION="22" setup_nodejs
+
+setup_deb822_repo \
+  "grafana" \
+  "https://apt.grafana.com/gpg.key" \
+  "https://apt.grafana.com" \
+  "stable" \
+  "main"
+
+msg_info "Installing Grafana"
+$STD apt install -y grafana
+msg_ok "Installed Grafana"
+
+fetch_and_deploy_gh_release "teslamate" "teslamate-org/teslamate" "tarball"
+
+msg_info "Building TeslaMate (Patience)"
+cd /opt/teslamate
+export MIX_ENV=prod
+$STD mix local.hex --force
+$STD mix local.rebar --force
+$STD mix deps.get --only prod
+$STD npm install --prefix ./assets
+$STD npm run deploy --prefix ./assets
+$STD mix do phx.digest, release --overwrite
+msg_ok "Built TeslaMate"
+
+msg_info "Configuring TeslaMate"
+cat <<EOF >/opt/teslamate.env
+HOME=/opt/teslamate
+LANG=en_US.UTF-8
+LC_CTYPE=en_US.UTF-8
+TZ=UTC
+PORT=4000
+ENCRYPTION_KEY=$(openssl rand -hex 32)
+DATABASE_USER=teslamate
+DATABASE_PASS=${PG_DB_PASS}
+DATABASE_NAME=teslamate
+DATABASE_HOST=127.0.0.1
+DATABASE_PORT=5432
+MQTT_HOST=127.0.0.1
+EOF
+chmod 600 /opt/teslamate.env
+msg_ok "Configured TeslaMate"
+
+msg_info "Provisioning Grafana"
+mkdir -p /etc/grafana/provisioning/{datasources,dashboards}
+cat <<EOF >/etc/grafana/provisioning/datasources/teslamate.yml
+apiVersion: 1
+
+datasources:
+  - name: TeslaMate
+    type: postgres
+    url: 127.0.0.1:5432
+    user: teslamate
+    access: proxy
+    isDefault: true
+    secureJsonData:
+      password: ${PG_DB_PASS}
+    jsonData:
+      postgresVersion: 1700
+      sslmode: disable
+      database: teslamate
+    version: 1
+    editable: true
+EOF
+
+cat <<EOF >/etc/grafana/provisioning/dashboards/teslamate.yml
+apiVersion: 1
+
+providers:
+  - name: "teslamate"
+    orgId: 1
+    folder: TeslaMate
+    folderUid: Nr4ofiDZk
+    type: file
+    disableDeletion: false
+    allowUiUpdates: true
+    updateIntervalSeconds: 86400
+    options:
+      path: /opt/teslamate/grafana/dashboards
+      foldersFromFilesStructure: false
+  - name: "teslamate_internal"
+    orgId: 1
+    folder: Internal
+    folderUid: Nr5ofiDZk
+    type: file
+    disableDeletion: false
+    allowUiUpdates: true
+    updateIntervalSeconds: 86400
+    options:
+      path: /opt/teslamate/grafana/dashboards/internal
+  - name: "teslamate_reports"
+    orgId: 1
+    folder: Reports
+    folderUid: Nr6ofiDZk
+    type: file
+    disableDeletion: false
+    allowUiUpdates: true
+    updateIntervalSeconds: 86400
+    options:
+      path: /opt/teslamate/grafana/dashboards/reports
+EOF
+
+cat <<EOF >/etc/grafana/grafana.ini
+[analytics]
+reporting_enabled = false
+check_for_updates = false
+check_for_plugin_updates = false
+
+[security]
+allow_embedding = true
+disable_gravatar = true
+
+[users]
+allow_sign_up = false
+
+[dashboards]
+default_home_dashboard_path = /opt/teslamate/grafana/dashboards/internal/home.json
+
+[date_formats]
+use_browser_locale = true
+EOF
+systemctl enable -q --now grafana-server
+msg_ok "Provisioned Grafana"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/teslamate.service
+[Unit]
+Description=TeslaMate
+Wants=network-online.target
+After=network-online.target postgresql.service mosquitto.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/teslamate
+EnvironmentFile=/opt/teslamate.env
+ExecStartPre=/opt/teslamate/_build/prod/rel/teslamate/bin/teslamate eval "TeslaMate.Release.migrate"
+ExecStart=/opt/teslamate/_build/prod/rel/teslamate/bin/teslamate start
+ExecStop=/opt/teslamate/_build/prod/rel/teslamate/bin/teslamate stop
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now teslamate
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/tor-snowflake-install.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2025 community-scripts ORG
+# Author: KernelSailor
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://snowflake.torproject.org/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+setup_go
+
+msg_info "Building Snowflake"
+GITLAB_URL="https://gitlab.torproject.org" fetch_and_deploy_gl_release "tor-snowflake" "tpo/anti-censorship/pluggable-transports/snowflake" "tarball"
+cd /opt/tor-snowflake/proxy
+$STD go build -o snowflake-proxy .
+msg_ok "Built Snowflake Proxy"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/snowflake-proxy.service
+[Unit]
+Description=Snowflake Proxy Service
+Documentation=https://snowflake.torproject.org/
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+WorkingDirectory=/opt/tor-snowflake/proxy
+ExecStart=/opt/tor-snowflake/proxy/snowflake-proxy -verbose -unsafe-logging
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now snowflake-proxy
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/vikunja-install.sh

@@ -13,8 +13,7 @@ setting_up_container
 network_check
 update_os
 
-RELEASE="v2.3.0"
+fetch_and_deploy_gh_release "vikunja" "go-vikunja/vikunja" "binary" "latest" "" "vikunja-*-$(arch_resolve "x86_64" "aarch64").deb"
-fetch_and_deploy_gh_release "vikunja" "go-vikunja/vikunja" "binary" "${RELEASE}" "" "vikunja-*-$(arch_resolve "x86_64" "aarch64").deb"
 
 msg_info "Setting up Vikunja"
 sed -i 's|^# \(service:\)|\1|' /etc/vikunja/config.yml

install/wanderer-install.sh

@@ -15,84 +15,77 @@ update_os
 
 setup_go
 NODE_VERSION="22" setup_nodejs
-if [[ "$(arch_resolve)" == "arm64" ]]; then
+mkdir -p /opt/{wanderer,wanderer_data/pb_data,wanderer_data/meili_data,wanderer_data/plugins}
-  fetch_and_deploy_gh_release "meilisearch" "meilisearch/meilisearch" "singlefile" "latest" "/usr/local/bin" "meilisearch-linux-aarch64"
+MEILISEARCH_DB_PATH="/opt/wanderer_data/meili_data" setup_meilisearch
-else
+fetch_and_deploy_gh_release "wanderer" "open-wanderer/wanderer" "tarball" "latest"
-  fetch_and_deploy_gh_release "meilisearch" "meilisearch/meilisearch" "binary" "latest" "/opt/wanderer/source/search"
+mkdir -p /opt/wanderer/db/data
-fi
+[[ -e /opt/wanderer/db/data/plugins ]] || ln -sfn /opt/wanderer_data/plugins /opt/wanderer/db/data/plugins
-mkdir -p /opt/wanderer/{source,data/pb_data,data/meili_data,data/plugins}
-fetch_and_deploy_gh_release "wanderer" "open-wanderer/wanderer" "tarball" "latest" "/opt/wanderer/source"
-mkdir -p /opt/wanderer/source/db/data
-mkdir -p /opt/wanderer/source/search
-[[ -e /opt/wanderer/source/db/data/plugins ]] || ln -sfn /opt/wanderer/data/plugins /opt/wanderer/source/db/data/plugins
 
 msg_info "Installing wanderer (patience)"
-cd /opt/wanderer/source/db
+cd /opt/wanderer/db
 $STD go mod tidy
 $STD go build
-cd /opt/wanderer/source/web
+cd /opt/wanderer/web
 $STD npm ci
 $STD npm run build
 msg_ok "Installed wanderer"
 
 msg_info "Installing wanderer plugins"
 for plugin in hammerhead komoot strava; do
-  fetch_and_deploy_gh_release "wanderer-plugin-${plugin}" "open-wanderer/wanderer" "prebuild" "latest" "/opt/wanderer/data/plugins" "wanderer-plugin-${plugin}.tar.gz" || msg_warn "Failed to install wanderer plugin: ${plugin}"
+  fetch_and_deploy_gh_release "wanderer-plugin-${plugin}" "open-wanderer/wanderer" "prebuild" "latest" "/opt/wanderer_data/plugins" "wanderer-plugin-${plugin}.tar.gz" || msg_warn "Failed to install wanderer plugin: ${plugin}"
 done
 msg_ok "Installed wanderer plugins"
 
 msg_info "Creating Service"
-MEILI_KEY=$(openssl rand -hex 32)
 POCKETBASE_KEY=$(openssl rand -hex 16)
 
 cat <<EOF >/opt/wanderer/.env
 ORIGIN=http://${LOCAL_IP}:3000
-MEILI_HTTP_ADDR=${LOCAL_IP}:7700
+MEILI_HTTP_ADDR=127.0.0.1:7700
-MEILI_URL=http://${LOCAL_IP}:7700
+MEILI_URL=http://127.0.0.1:7700
-MEILI_MASTER_KEY=${MEILI_KEY}
+MEILI_MASTER_KEY=${MEILISEARCH_MASTER_KEY}
 PB_URL=${LOCAL_IP}:8090
 PUBLIC_POCKETBASE_URL=http://${LOCAL_IP}:8090
 PUBLIC_VALHALLA_URL=https://valhalla1.openstreetmap.de
 POCKETBASE_ENCRYPTION_KEY=${POCKETBASE_KEY}
-PB_DB_LOCATION=/opt/wanderer/data/pb_data
+PB_DB_LOCATION=/opt/wanderer_data/pb_data
-MEILI_DB_PATH=/opt/wanderer/data/meili_data
+MEILI_DB_PATH=/opt/wanderer_data/meili_data
 EOF
 
-cat <<EOF >/opt/wanderer/start.sh
+cat <<EOF >/etc/systemd/system/wanderer-pocketbase.service
-#!/usr/bin/env bash
-
-trap "kill 0" EXIT
-
-cd /opt/wanderer/source/search && meilisearch --upgrade-db --master-key \$MEILI_MASTER_KEY &
-sleep 1
-cd /opt/wanderer/source/db && ./pocketbase serve --http=\$PB_URL --dir=\$PB_DB_LOCATION &
-cd /opt/wanderer/source/web && node build &
-
-wait -n
-EOF
-chmod +x /opt/wanderer/start.sh
-
-cat <<'EOF' >/usr/local/bin/wanderer-pb
-#!/usr/bin/env bash
-set -a
-source /opt/wanderer/.env
-set +a
-cd /opt/wanderer/source/db
-exec ./pocketbase "$@" --dir="$PB_DB_LOCATION"
-EOF
-chmod +x /usr/local/bin/wanderer-pb
-
-cat <<EOF >/etc/systemd/system/wanderer-web.service
 [Unit]
-Description=wanderer
+Description=wanderer PocketBase
+Wants=network.target
 After=network.target
+PartOf=wanderer-web.service
 StartLimitIntervalSec=10
 StartLimitBurst=5
 
 [Service]
 Type=simple
+WorkingDirectory=/opt/wanderer/db
 EnvironmentFile=/opt/wanderer/.env
-ExecStart=/usr/bin/bash /opt/wanderer/start.sh
+ExecStart=/opt/wanderer/db/pocketbase serve --http=\${PB_URL} --dir=\${PB_DB_LOCATION}
+Restart=always
+RestartSec=1
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+cat <<EOF >/etc/systemd/system/wanderer-web.service
+[Unit]
+Description=wanderer
+Wants=network.target meilisearch.service wanderer-pocketbase.service
+After=network.target meilisearch.service wanderer-pocketbase.service
+StartLimitIntervalSec=10
+StartLimitBurst=5
+
+[Service]
+Type=simple
+WorkingDirectory=/opt/wanderer/web
+EnvironmentFile=/opt/wanderer/.env
+ExecStart=/usr/bin/node build
 Restart=always
 RestartSec=1
 
@@ -100,7 +93,7 @@ RestartSec=1
 WantedBy=multi-user.target
 EOF
 sleep 1
-systemctl enable -q --now wanderer-web
+systemctl enable -q --now wanderer-pocketbase wanderer-web
 msg_ok "Created Service"
 
 motd_ssh