Vikunja: remove version pin, v2.5.0 fixes the systemd syscall filter crash

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

CHANGELOG.md

@@ -518,6 +518,20 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-08-05
+
+### 🚀 Updated Scripts
+
+  - #### ✨ New Features
+
+    - NextcloudPI: Bump to Debian Trixie & Tweak broken SSH [@MickLesk](https://github.com/MickLesk) ([#15957](https://github.com/community-scripts/ProxmoxVE/pull/15957))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - fix(monitor-all): reduce polling CPU overhead [@jomplox](https://github.com/jomplox) ([#15907](https://github.com/community-scripts/ProxmoxVE/pull/15907))
+
 ## 2026-08-04
 
 ### 🆕 New Scripts

ct/nextcloudpi.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-8}"
 var_os="${var_os:-debian}"
-var_version="${var_version:-12}"
+var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/vikunja.sh

@@ -46,8 +46,7 @@ function update_script() {
     [[ "$CONFIRM2" =~ ^[yY]$ ]] || exit 0
   fi
 
-  RELEASE="v2.3.0"
-  if check_for_gh_release "vikunja" "go-vikunja/vikunja" "${RELEASE}" "v2.4.0 is killed at startup by the systemd SystemCallFilter shipped in the .deb (upstream go-vikunja/vikunja#3252); pinned until a fixed release is out"; then
+  if check_for_gh_release "vikunja" "go-vikunja/vikunja"; then
     echo
     msg_warn "The package update may include config file changes."
     echo -e "${TAB}${YW}How do you want to handle /etc/vikunja/config.yml?${CL}"
@@ -66,7 +65,7 @@ function update_script() {
     systemctl stop vikunja
     msg_ok "Stopped Service"
 
-    fetch_and_deploy_gh_release "vikunja" "go-vikunja/vikunja" "binary" "${RELEASE}" "" "vikunja-*-$(arch_resolve "x86_64" "aarch64").deb"
+    fetch_and_deploy_gh_release "vikunja" "go-vikunja/vikunja" "binary" "latest" "" "vikunja-*-$(arch_resolve "x86_64" "aarch64").deb"
     $STD systemctl daemon-reload
 
     msg_info "Starting Service"

install/nextcloudpi-install.sh

@@ -24,6 +24,16 @@ if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
   exit 10
 fi
 
+msg_info "Making ssh.service reloads behave like restarts"
+mkdir -p /etc/systemd/system/ssh.service.d
+cat <<'EOF' >/etc/systemd/system/ssh.service.d/reload-as-restart.conf
+[Service]
+ExecReload=
+ExecReload=/usr/bin/systemd-run --no-block --quiet /bin/systemctl restart ssh.service
+EOF
+systemctl daemon-reload
+msg_ok "Made ssh.service reloads behave like restarts"
+
 msg_info "Installing NextCloudPi (Patience)"
 $STD bash <(curl -fsSL https://raw.githubusercontent.com/nextcloud/nextcloudpi/master/install.sh)
 msg_ok "Installed NextCloudPi"

install/vikunja-install.sh

@@ -13,8 +13,7 @@ setting_up_container
 network_check
 update_os
 
-RELEASE="v2.3.0"
-fetch_and_deploy_gh_release "vikunja" "go-vikunja/vikunja" "binary" "${RELEASE}" "" "vikunja-*-$(arch_resolve "x86_64" "aarch64").deb"
+fetch_and_deploy_gh_release "vikunja" "go-vikunja/vikunja" "binary" "latest" "" "vikunja-*-$(arch_resolve "x86_64" "aarch64").deb"
 
 msg_info "Setting up Vikunja"
 sed -i 's|^# \(service:\)|\1|' /etc/vikunja/config.yml

misc/build.func

@@ -5200,15 +5200,11 @@ EOF
     # TSTP = Ctrl+Z, TTIN = bg read from tty, TTOU = bg write to tty (tostop)
     trap '' TSTP TTIN TTOU
 
-    # lxc-attach takes the controlling terminal while the install runs and does
-    # not hand it back, leaving us in a background process group. Reading from
-    # the terminal then returns EIO instead of blocking, because SIGTTIN is
-    # ignored above - so every recovery prompt fails before the user can answer.
-    # Redirecting to /dev/tty does not help: the rule applies to the terminal,
-    # not the file descriptor. Claim the foreground group back; SIGTTOU is
-    # ignored too, so tcsetpgrp() succeeds instead of stopping us. No-op when we
-    # already are in the foreground. perl is a hard dependency of Proxmox VE.
-    perl -e 'use POSIX; open(my $t, "+<", "/dev/tty") or exit 1; POSIX::tcsetpgrp(fileno($t), getpgrp()) or exit 1;' 2>/dev/null || true
+    # lxc-attach left us in a background process group - claim the terminal back
+    # before we print anything. Note this does NOT hold: the log collection
+    # below uses pct pull/exec, which take it away again, so every interactive
+    # prompt has to reclaim it again right before its read.
+    reclaim_tty
 
     msg_error "Installation failed in container ${CTID} (exit code: ${install_exit_code})"
 
@@ -5338,6 +5334,7 @@ EOF
       pct enter "$CTID"
       echo ""
       echo -en "${YW}Container ${CTID} still running. Remove now? (y/N): ${CL}"
+      reclaim_tty
       if read -r response </dev/tty && [[ "$response" =~ ^[Yy]$ ]]; then
         pct stop "$CTID" &>/dev/null || true
         pct destroy "$CTID" &>/dev/null || true
@@ -5497,6 +5494,7 @@ EOF
 
     local response=""
     local read_rc
+    reclaim_tty
     read -t 60 -r response </dev/tty
     read_rc=$?
     if [[ $read_rc -eq 0 ]]; then
@@ -5761,6 +5759,7 @@ destroy_lxc() {
   trap 'echo; msg_error "Aborted by user (SIGINT/SIGQUIT)"; return 130' INT QUIT
 
   local prompt
+  reclaim_tty
   if ! read -rp "Remove this Container? <y/N> " prompt </dev/tty; then
     # read returns non-zero on Ctrl-D/ESC
     msg_error "Aborted input (Ctrl-D/ESC)"

misc/core.func

@@ -1042,6 +1042,39 @@ ensure_tput() {
   fi
 }
 
+# ------------------------------------------------------------------------------
+# reclaim_tty()
+#
+# - Reclaims the controlling terminal's foreground process group
+# - lxc-attach takes the terminal and does not hand it back, leaving us in a
+#   background process group. Reading from the terminal then returns EIO
+#   instead of blocking, because SIGTTIN is ignored during recovery - so the
+#   prompt fails before the user can answer and their keystroke leaks into the
+#   parent shell. Redirecting to /dev/tty does not help: the rule applies to
+#   the terminal, not to the file descriptor.
+# - pct exec/pull/enter use lxc-attach internally, so the terminal can be taken
+#   away again at any point. Call this immediately before each interactive
+#   read, not once after the install.
+# - SIGTTOU is ignored inside perl so tcsetpgrp() succeeds instead of stopping
+#   us. No-op when we already are in the foreground or there is no terminal.
+#   perl is a hard dependency of Proxmox VE.
+# ------------------------------------------------------------------------------
+reclaim_tty() {
+  command -v perl >/dev/null 2>&1 || return 0
+  [[ -e /dev/tty ]] || return 0
+
+  local pgid
+  pgid=$(ps -o pgid= -p $$ 2>/dev/null | tr -d ' ') || true
+
+  perl -e '
+    use POSIX;
+    $SIG{TTOU} = "IGNORE";
+    my $pgid = $ARGV[0] || POSIX::getpgrp();
+    open(my $t, "+<", "/dev/tty") or exit 1;
+    POSIX::tcsetpgrp(fileno($t), $pgid) or exit 1;
+  ' "${pgid:-0}" 2>/dev/null || true
+}
+
 # ------------------------------------------------------------------------------
 # is_alpine()
 #

misc/error_handler.func

@@ -499,6 +499,7 @@ error_handler() {
 
       local response=""
       local read_rc
+      declare -f reclaim_tty >/dev/null 2>&1 && reclaim_tty
       read -t 60 -r response </dev/tty
       read_rc=$?
       if [[ $read_rc -eq 0 ]]; then

tools/pve/monitor-all.sh

@@ -54,18 +54,24 @@ while true; do
       continue
     fi
 
-    # Determine type and set config command
-    if pct status $instance >/dev/null 2>&1; then
+    # Determine type and read the current config directly from Proxmox's pmxcfs.
+    # Ignore snapshot sections, matching the current config shown by pct/qm config.
+    if [ -r "/etc/pve/lxc/$instance.conf" ]; then
       type="ct"
-      config_cmd="pct config"
+      config_file="/etc/pve/lxc/$instance.conf"
     else
       type="vm"
-      config_cmd="qm config"
+      config_file="/etc/pve/qemu-server/$instance.conf"
     fi
+    config=$(sed '/^\[/,$d' "$config_file")
 
     # Skip templates and onboot-disabled
-    onboot=$($config_cmd $instance | grep -q "onboot: 0" || ( ! $config_cmd $instance | grep -q "onboot" ) && echo "true" || echo "false")
-    template=$($config_cmd $instance | grep -q "^template:" && echo "true" || echo "false")
+    if grep -q "onboot: 0" <<<"$config" || ! grep -q "onboot" <<<"$config"; then
+      onboot="true"
+    else
+      onboot="false"
+    fi
+    template=$(grep -q "^template:" <<<"$config" && echo "true" || echo "false")
 
     if [ "$onboot" == "true" ]; then
       echo "Skipping $instance because it is set not to boot"
@@ -76,7 +82,7 @@ while true; do
     fi
 
     # Check for mon-restart tag
-    has_tag=$($config_cmd $instance | grep -q "tags:.*mon-restart" && echo "true" || echo "false")
+    has_tag=$(grep -q "tags:.*mon-restart" <<<"$config" && echo "true" || echo "false")
     if [ "$has_tag" != "true" ]; then
       echo "Skipping $instance because it does not have 'mon-restart' tag"
       continue