Update CHANGELOG.md

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

CHANGELOG.md

@@ -524,6 +524,22 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-08-22
+
+### 🆕 New Scripts
+
+  - pve-ups ([#16670](https://github.com/community-scripts/ProxmoxVE/pull/16670))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - docuseal: use DocuSeal's patched PDFium build to fix service start [@MickLesk](https://github.com/MickLesk) ([#16673](https://github.com/community-scripts/ProxmoxVE/pull/16673))
+
+  - #### ✨ New Features
+
+    - update authentik to 2026.8.0 [@thieneret](https://github.com/thieneret) ([#16674](https://github.com/community-scripts/ProxmoxVE/pull/16674))
+
 ## 2026-08-21
 
 ### 🚀 Updated Scripts

ct/authentik.sh

@@ -32,18 +32,23 @@ function update_script() {
 
   read -r MAJOR MINOR PATCH <<<"$(sed 's/^version\///; s/\./ /g' "$HOME/.authentik")"
 
+  if [[ $MAJOR == 2026 && $MINOR -lt 5 ]]; then
+	msg_error "Updating from version ${MAJOR}.${MINOR}.${PATCH} is not supported. A minimum version of 2026.5.x is required to update. See: https://docs.goauthentik.io/releases/2026.8/"
+	exit
+  fi
+
   msg_info "Update dependencies"
   ensure_dependencies crossbuild-essential-$(arch_resolve) gcc-$(arch_resolve "x86-64" "aarch64")-linux-gnu cmake clang libunwind-18-dev
   msg_ok "Update dependencies"
 
-  NODE_VERSION="24" setup_nodejs
+  NODE_VERSION="26" NODE_MODULE=pnpm@11 setup_nodejs
   setup_go
   $STD uv cache clean
-  UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.6" setup_uv
+  UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.7" setup_uv
   RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
   setup_yq
 
-  AUTHENTIK_VERSION="version/2026.5.6"
+  AUTHENTIK_VERSION="version/2026.8.0"
   # Source: https://github.com/goauthentik/fips/blob/main/Makefile#L26
   XMLSEC_VERSION="1.3.12"
 
@@ -87,30 +92,32 @@ function update_script() {
     msg_ok "Configured rust"
 
     msg_info "Updating web"
-    cd /opt/authentik/web
     export NODE_ENV="production"
-    $STD npm install
-    $STD npm run build
-    $STD npm run build:sfe
+	  cd /opt/authentik
+	  $STD node ./scripts/node/lint-runtime.mjs ./web
+	  cd /opt/authentik/web
+	  $STD pnpm install --frozen-lockfile
+	  $STD pnpm run build
+	  $STD pnpm run build:sfe
     msg_ok "Updated web"
 
-    msg_info "Updating go proxy"
+    msg_info "Updating outposts"
     cd /opt/authentik
+	  mkdir -p /opt/authentik/bin
     export CGO_ENABLED="1"
     export CC="$(arch_resolve "x86_64" "aarch64")-linux-gnu-gcc"
     $STD go mod download
-    $STD go build -o /opt/authentik/authentik-server ./cmd/server
-    $STD go build -o /opt/authentik/ldap ./cmd/ldap
-    $STD go build -o /opt/authentik/rac ./cmd/rac
-    $STD go build -o /opt/authentik/radius ./cmd/radius
-    msg_ok "Updated go proxy"
+    $STD go build -o /opt/authentik/bin/ldap ./cmd/ldap
+    $STD go build -o /opt/authentik/bin/rac ./cmd/rac
+    $STD go build -o /opt/authentik/bin/radius ./cmd/radius
+    msg_ok "Updated outposts"
 
-    msg_info "Building worker. It may take more than 10 minutes, please be patient."
-    export AWS_LC_FIPS_SYS_CC="clang"
-    cd /opt/authentik
-    $STD cargo build --package authentik --no-default-features --features core --locked --release --jobs 1
-    cp ./target/release/authentik /opt/authentik/authentik-worker
-    rm -r ./target
+    msg_info "Building binary. It may take more than 10 minutes, please be patient."
+	  export AWS_LC_FIPS_SYS_CC="clang"
+	  cd /opt/authentik
+	  $STD cargo build --package authentik --no-default-features --features core --locked --release
+	  cp ./target/release/authentik /opt/authentik/bin/
+	  rm -r ./target
     msg_ok "Built worker"
 
     msg_info "Updating python server"
@@ -124,126 +131,47 @@ function update_script() {
     cd /opt/authentik
     for attempt in 1 2 3; do
       if [[ $attempt -eq 3 ]]; then
-        $STD uv sync --frozen --no-install-project --no-dev
+        $STD uv sync --locked --no-install-project --no-dev
         break
       fi
-      $STD uv sync --frozen --no-install-project --no-dev && break
+      $STD uv sync --locked --no-install-project --no-dev && break
       msg_warn "uv sync attempt $attempt failed, retrying..."
       sleep $((attempt * 15))
     done
     chown -R authentik:authentik /opt/authentik
     msg_ok "Updated python server"
 
-    if [[ $MAJOR == 2026 && $MINOR -lt 5 ]]; then
-      msg_info "Updating Worker and Server config"
-      cp /etc/authentik/config.yml /etc/authentik/config.bak
-      yq -i ".postgresql.conn_max_age = 0" /etc/authentik/config.yml
-      yq -i ".postgresql.conn_health_checks = false" /etc/authentik/config.yml
-      yq -i '.listen.debug_tokio = "[::]:6669"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.console_subscriber = "info"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.h2 = "info"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.hyper_util = "warn"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.mio = "info"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.notify = "info"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.reqwest = "info"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.runtime = "info"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.rustls = "info"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.sqlx = "info"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.sqlx_postgres = "info"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.tokio = "info"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.tungstenite = "info"' /etc/authentik/config.yml
-      yq -i ".web.workers = 2" /etc/authentik/config.yml
-      mv /etc/default/authentik /etc/default/authentik.bak
-      cat <<EOF >/etc/default/authentik-server
-TMPDIR=/dev/shm/
-UV_LINK_MODE=copy
-UV_PYTHON_DOWNLOADS=0
-UV_NATIVE_TLS=1
-VENV_PATH=/opt/authentik/.venv
-PYTHONDONTWRITEBYTECODE=1
-PYTHONUNBUFFERED=1
-PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
-DJANGO_SETTINGS_MODULE=authentik.root.settings
-PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
-AUTHENTIK_LISTEN__HTTP="[::]:9000"
-AUTHENTIK_LISTEN__HTTPS="[::]:9443"
-AUTHENTIK_LISTEN__METRICS="[::]:9300"
+	  msg_info "Updating Worker and Server config"
+    cat <<EOF >>/etc/default/authentik-server
+RUST_BACKTRACE=full
 EOF
-      cat <<EOF >/etc/default/authentik-worker
-TMPDIR=/dev/shm/
-UV_LINK_MODE=copy
-UV_PYTHON_DOWNLOADS=0
-UV_NATIVE_TLS=1
-VENV_PATH=/opt/authentik/.venv
-PYTHONDONTWRITEBYTECODE=1
-PYTHONUNBUFFERED=1
-PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
-DJANGO_SETTINGS_MODULE=authentik.root.settings
-PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
-AUTHENTIK_LISTEN__HTTP="[::]:8000"
-AUTHENTIK_LISTEN__HTTPS="[::]:8443"
-AUTHENTIK_LISTEN__METRICS="[::]:8300"
+    cat <<EOF >>/etc/default/authentik-worker
+RUST_BACKTRACE=full
 EOF
-      msg_ok "Updated Worker and Server config!"
-      msg_warn "Please check /etc/default/authentik-worker and /etc/default/authentik-server config files for port configurations!"
+    msg_ok "Updated Worker and Server config!"
 
-      msg_info "Updating services"
-      cat <<EOF >/etc/systemd/system/authentik-server.service
-[Unit]
-Description=authentik Go Server (API Gateway)
-After=network.target
-Wants=postgresql.service
+    msg_info "Updating services"
+	  sed -i "s|ExecStart=/opt/authentik/authentik-server|ExecStart=/opt/authentik/bin/authentik server|g" /etc/systemd/system/authentik-server.service
+	  sed -i "s|ExecStart=/opt/authentik/authentik-worker worker|ExecStart=/opt/authentik/bin/authentik worker|g" /etc/systemd/system/authentik-worker.service
+	  sed -i "s|ExecStart=/opt/authentik/ldap|ExecStart=/opt/authentik/bin/ldap|g" /etc/systemd/system/authentik-ldap.service
+	  sed -i "s|ExecStart=/opt/authentik/radius|ExecStart=/opt/authentik/bin/radius|g" /etc/systemd/system/authentik-radius.service
+	  sed -i "s|ExecStart=/opt/authentik/rac|ExecStart=/opt/authentik/bin/rac|g" /etc/systemd/system/authentik-rac.service
+    systemctl daemon-reload
+    msg_ok "Updated services"
 
-[Service]
-User=authentik
-Group=authentik
-ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
-ExecStart=/opt/authentik/authentik-server
-WorkingDirectory=/opt/authentik/
-Restart=always
-RestartSec=5
-EnvironmentFile=/etc/default/authentik-server
-
-[Install]
-WantedBy=multi-user.target
-EOF
-
-      cat <<EOF >/etc/systemd/system/authentik-worker.service
-[Unit]
-Description=authentik Worker
-After=network.target postgresql.service
-
-[Service]
-User=authentik
-Group=authentik
-Type=simple
-EnvironmentFile=/etc/default/authentik-worker
-ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
-ExecStart=/opt/authentik/authentik-worker worker
-WorkingDirectory=/opt/authentik
-Restart=always
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-      systemctl daemon-reload
-      msg_ok "Updated services"
-    fi
+  	msg_info "Starting Services"
+  	systemctl start authentik-server authentik-worker
+  	if [[ $(systemctl is-enabled authentik-ldap) == enabled ]]; then
+	    systemctl start authentik-ldap
+  	fi
+  	if [[ $(systemctl is-enabled authentik-rac) == enabled ]]; then
+	    systemctl start authentik-rac
+  	fi
+  	if [[ $(systemctl is-enabled authentik-radius) == enabled ]]; then
+	    systemctl start authentik-radius
+  	fi
+  	msg_ok "Started Services"
   fi
-
-  msg_info "Starting Services"
-  systemctl start authentik-server authentik-worker
-  if [[ $(systemctl is-enabled authentik-ldap) == enabled ]]; then
-    systemctl start authentik-ldap
-  fi
-  if [[ $(systemctl is-enabled authentik-rac) == enabled ]]; then
-    systemctl start authentik-rac
-  fi
-  if [[ $(systemctl is-enabled authentik-radius) == enabled ]]; then
-    systemctl start authentik-radius
-  fi
-  msg_ok "Started Services"
   msg_ok "Updated successfully!"
   exit
 }

ct/docuseal.sh

@@ -30,6 +30,18 @@ function update_script() {
     exit
   fi
 
+  ensure_dependencies musl
+  [[ -f /opt/pdfium/lib/libpdfium.so ]] || rm -f "$HOME/.pdfium"
+  fetch_and_deploy_gh_release "pdfium" "docusealco/pdfium-binaries" "prebuild" "latest" "/opt/pdfium" "pdfium-musl-$(arch_resolve "x86_64" "aarch64").zip"
+  if ! cmp -s /opt/pdfium/lib/libpdfium.so /usr/lib/libpdfium.so; then
+    msg_info "Updating PDFium"
+    install -m 644 /opt/pdfium/lib/libpdfium.so /usr/lib/libpdfium.so
+    echo "/usr/lib/$(arch_resolve "x86_64" "aarch64")-linux-musl" >/etc/ld.so.conf.d/musl.conf
+    ldconfig
+    systemctl restart docuseal docuseal-sidekiq
+    msg_ok "Updated PDFium"
+  fi
+
   if check_for_gh_release "docuseal" "docusealco/docuseal"; then
     msg_info "Stopping Services"
     systemctl stop docuseal docuseal-sidekiq

ct/headers/pve-ups

@@ -0,0 +1,6 @@
+    ____ _    ________     __  ______  _____
+   / __ \ |  / / ____/    / / / / __ \/ ___/
+  / /_/ / | / / __/______/ / / / /_/ /\__ \ 
+ / ____/| |/ / /__/_____/ /_/ / ____/___/ / 
+/_/     |___/_____/     \____/_/    /____/  
+                                            

ct/pve-ups.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+# Engine comes from community-scripts/core; this repo only ships the scripts.
+# A local core checkout wins (COMMUNITY_SCRIPTS_CORE_DIR, else a sibling ../core),
+# so a fork or branch of core can be tested without editing this file.
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: CrazyWolf13
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/ffind-dev/pve-ups
+
+APP="PVE-UPS"
+var_tags="${var_tags:-proxmox;ups;monitoring;network}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-512}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/pve-usv ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "pve-usv" "ffind-dev/pve-ups"; then
+    msg_info "Stopping Services"
+    systemctl stop pve-usv pve-usv-agent.path pve-usv-agent.timer
+    msg_ok "Stopped Services"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "pve-usv" "ffind-dev/pve-ups" "tarball"
+
+    msg_info "Updating Application"
+    cd /opt/pve-usv
+    $STD uv venv --clear venv
+    $STD uv pip install --python venv/bin/python .
+    chown -R pveusv:pveusv /opt/pve-usv
+    chmod 0755 deploy/pve-usv-agent.sh
+    install -m 0644 deploy/pve-usv.service /etc/systemd/system/pve-usv.service
+    install -m 0644 deploy/pve-usv-agent.service /etc/systemd/system/pve-usv-agent.service
+    install -m 0644 deploy/pve-usv-agent.path /etc/systemd/system/pve-usv-agent.path
+    install -m 0644 deploy/pve-usv-agent.timer /etc/systemd/system/pve-usv-agent.timer
+    systemctl daemon-reload
+    msg_ok "Updated Application"
+
+    msg_info "Starting Services"
+    systemctl start pve-usv pve-usv-agent.path pve-usv-agent.timer
+    msg_ok "Started Services"
+    msg_ok "Updated ${APP}"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:8080${CL}"

install/authentik-install.sh

@@ -50,16 +50,16 @@ $STD apt install -y \
   git
 msg_ok "Installed Dependencies"
 
-NODE_VERSION="24" setup_nodejs
+NODE_VERSION="26" NODE_MODULE=pnpm@11 setup_nodejs
 setup_yq
 setup_go
 RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
-UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.6" setup_uv
+UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.7" setup_uv
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db
 
 XMLSEC_VERSION="1.3.12"
-AUTHENTIK_VERSION="version/2026.5.6"
+AUTHENTIK_VERSION="version/2026.8.0"
 fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec"
 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
 fetch_and_deploy_gh_release "geoipupdate" "maxmind/geoipupdate" "binary"
@@ -80,23 +80,25 @@ $STD rustup default "$(sed -n 's/channel = "\(.*\)"/\1/p' rust-toolchain.toml)"
 msg_ok "Configured rust"
 
 msg_info "Setting up web"
-cd /opt/authentik/web
 export NODE_ENV="production"
-$STD npm install
-$STD npm run build
-$STD npm run build:sfe
+cd /opt/authentik
+$STD node ./scripts/node/lint-runtime.mjs ./web
+cd /opt/authentik/web
+$STD pnpm install --frozen-lockfile
+$STD pnpm run build
+$STD pnpm run build:sfe
 msg_ok "Setup web"
 
-msg_info "Setting up go proxy"
+msg_info "Building outposts"
 cd /opt/authentik
+mkdir -p /opt/authentik/bin
 export CGO_ENABLED="1"
 export CC="$(arch_resolve "x86_64" "aarch64")-linux-gnu-gcc"
 $STD go mod download
-$STD go build -o /opt/authentik/authentik-server ./cmd/server
-$STD go build -o /opt/authentik/ldap ./cmd/ldap
-$STD go build -o /opt/authentik/rac ./cmd/rac
-$STD go build -o /opt/authentik/radius ./cmd/radius
-msg_ok "Setup go proxy"
+$STD go build -o /opt/authentik/bin/ldap ./cmd/ldap
+$STD go build -o /opt/authentik/bin/rac ./cmd/rac
+$STD go build -o /opt/authentik/bin/radius ./cmd/radius
+msg_ok "Built outposts"
 
 cat <<EOF >/usr/local/etc/GeoIP.conf
 AccountID ChangeME
@@ -109,13 +111,13 @@ EOF
 
 echo "#39 19 * * 6,4 /usr/bin/geoipupdate -f /usr/local/etc/GeoIP.conf" | crontab -
 
-msg_info "Building worker. It may take more than 10 minutes, please be patient."
+msg_info "Building binary. It may take more than 10 minutes, please be patient."
 export AWS_LC_FIPS_SYS_CC="clang"
 cd /opt/authentik
-$STD cargo build --package authentik --no-default-features --features core --locked --release --jobs 1
-cp ./target/release/authentik /opt/authentik/authentik-worker
+$STD cargo build --package authentik --no-default-features --features core --locked --release
+cp ./target/release/authentik /opt/authentik/bin/
 rm -r ./target
-msg_ok "Built worker"
+msg_ok "Built binary"
 
 msg_info "Setting up python server"
 export UV_NO_BINARY_PACKAGE="cryptography lxml python-kadmin-rs xmlsec"
@@ -127,10 +129,10 @@ export UV_PYTHON_INSTALL_DIR="/usr/local/bin"
 cd /opt/authentik
 for attempt in 1 2 3; do
   if [[ $attempt -eq 3 ]]; then
-    $STD uv sync --frozen --no-install-project --no-dev
+    $STD uv sync --locked --no-install-project --no-dev
     break
   fi
-  $STD uv sync --frozen --no-install-project --no-dev && break
+  $STD uv sync --locked --no-install-project --no-dev && break
   msg_warn "uv sync attempt $attempt failed, retrying..."
   sleep $((attempt * 15))
 done
@@ -159,6 +161,7 @@ UV_NATIVE_TLS=1
 VENV_PATH=/opt/authentik/.venv
 PYTHONDONTWRITEBYTECODE=1
 PYTHONUNBUFFERED=1
+RUST_BACKTRACE=full
 PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
 DJANGO_SETTINGS_MODULE=authentik.root.settings
 PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
@@ -174,6 +177,7 @@ UV_NATIVE_TLS=1
 VENV_PATH=/opt/authentik/.venv
 PYTHONDONTWRITEBYTECODE=1
 PYTHONUNBUFFERED=1
+RUST_BACKTRACE=full
 PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
 DJANGO_SETTINGS_MODULE=authentik.root.settings
 PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
@@ -201,7 +205,7 @@ msg_ok "Created authentik config"
 msg_info "Creating services"
 cat <<EOF >/etc/systemd/system/authentik-server.service
 [Unit]
-Description=authentik Go Server (API Gateway)
+Description=authentik Server
 After=network.target
 Wants=postgresql.service
 
@@ -210,7 +214,7 @@ User=authentik
 Group=authentik
 EnvironmentFile=/etc/default/authentik-server
 ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
-ExecStart=/opt/authentik/authentik-server
+ExecStart=/opt/authentik/bin/authentik server
 WorkingDirectory=/opt/authentik/
 Restart=always
 RestartSec=5
@@ -230,7 +234,7 @@ Group=authentik
 Type=simple
 EnvironmentFile=/etc/default/authentik-worker
 ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
-ExecStart=/opt/authentik/authentik-worker worker
+ExecStart=/opt/authentik/bin/authentik worker
 WorkingDirectory=/opt/authentik
 Restart=always
 RestartSec=5
@@ -248,7 +252,7 @@ Wants=postgresql.service
 [Service]
 User=authentik
 Group=authentik
-ExecStart=/opt/authentik/ldap
+ExecStart=/opt/authentik/bin/ldap
 WorkingDirectory=/opt/authentik/
 Restart=always
 RestartSec=5
@@ -267,7 +271,7 @@ Wants=postgresql.service
 [Service]
 User=authentik
 Group=authentik
-ExecStart=/opt/authentik/rac
+ExecStart=/opt/authentik/bin/rac
 WorkingDirectory=/opt/authentik/
 Restart=always
 RestartSec=5
@@ -286,7 +290,7 @@ Wants=postgresql.service
 [Service]
 User=authentik
 Group=authentik
-ExecStart=/opt/authentik/radius
+ExecStart=/opt/authentik/bin/radius
 WorkingDirectory=/opt/authentik/
 Restart=always
 RestartSec=5

install/docuseal-install.sh

@@ -29,16 +29,16 @@ $STD apt install -y \
   libvips-dev \
   libheif1 \
   redis-server \
-  fontconfig
+  fontconfig \
+  musl
 msg_ok "Installed Dependencies"
 
 NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="docuseal" PG_DB_USER="docuseal" setup_postgresql_db
 
-msg_info "Downloading Fonts and PDFium"
+msg_info "Downloading Fonts"
 mkdir -p /opt/fonts /usr/share/fonts/noto
-ARCH=$(uname -m | sed 's/x86_64/x64/;s/aarch64/arm64/')
 curl -fsSL -o /opt/fonts/GoNotoKurrent-Regular.ttf \
   https://github.com/satbyy/go-noto-universal/releases/download/v7.0/GoNotoKurrent-Regular.ttf
 curl -fsSL -o /opt/fonts/GoNotoKurrent-Bold.ttf \
@@ -48,12 +48,15 @@ curl -fsSL -o /opt/fonts/DancingScript-Regular.otf \
 ln -sf /opt/fonts/GoNotoKurrent-Regular.ttf /usr/share/fonts/noto/
 ln -sf /opt/fonts/GoNotoKurrent-Bold.ttf /usr/share/fonts/noto/
 $STD fc-cache -f
-curl -fsSL -o /tmp/pdfium.tgz \
-  "https://github.com/bblanchon/pdfium-binaries/releases/latest/download/pdfium-linux-${ARCH}.tgz"
-mkdir -p /tmp/pdfium && tar -xzf /tmp/pdfium.tgz -C /tmp/pdfium
-cp /tmp/pdfium/lib/libpdfium.so /usr/lib/libpdfium.so
-rm -rf /tmp/pdfium /tmp/pdfium.tgz
-msg_ok "Downloaded Fonts and PDFium"
+msg_ok "Downloaded Fonts"
+
+fetch_and_deploy_gh_release "pdfium" "docusealco/pdfium-binaries" "prebuild" "latest" "/opt/pdfium" "pdfium-musl-$(arch_resolve "x86_64" "aarch64").zip"
+
+msg_info "Installing PDFium"
+install -m 644 /opt/pdfium/lib/libpdfium.so /usr/lib/libpdfium.so
+echo "/usr/lib/$(arch_resolve "x86_64" "aarch64")-linux-musl" >/etc/ld.so.conf.d/musl.conf
+ldconfig
+msg_ok "Installed PDFium"
 
 fetch_and_deploy_gh_release "docuseal" "docusealco/docuseal" "tarball"
 

install/pve-ups-install.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: CrazyWolf13
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/ffind-dev/pve-ups
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+setup_uv
+
+fetch_and_deploy_gh_release "pve-usv" "ffind-dev/pve-ups" "tarball"
+
+msg_info "Setting up Application"
+useradd --system --home /opt/pve-usv --shell /usr/sbin/nologin pveusv
+install -d -o pveusv -g pveusv -m 0750 \
+  /etc/pve-usv \
+  /var/lib/pve-usv \
+  /var/lib/pve-usv/agent \
+  /var/lib/pve-usv/agent/queue \
+  /var/lib/pve-usv/updates
+chown -R pveusv:pveusv /opt/pve-usv
+cd /opt/pve-usv
+$STD uv venv --clear venv
+$STD uv pip install --python venv/bin/python .
+chmod 0755 deploy/pve-usv-agent.sh
+msg_ok "Set up Application"
+
+msg_info "Creating Services"
+install -m 0644 /opt/pve-usv/deploy/pve-usv.service /etc/systemd/system/pve-usv.service
+install -m 0644 /opt/pve-usv/deploy/pve-usv-agent.service /etc/systemd/system/pve-usv-agent.service
+install -m 0644 /opt/pve-usv/deploy/pve-usv-agent.path /etc/systemd/system/pve-usv-agent.path
+install -m 0644 /opt/pve-usv/deploy/pve-usv-agent.timer /etc/systemd/system/pve-usv-agent.timer
+systemctl enable -q --now pve-usv pve-usv-agent.path pve-usv-agent.timer
+msg_ok "Created Services"
+
+motd_ssh
+customize
+cleanup_lxc