Update CHANGELOG.md

Update CHANGELOG.md (#18246 )
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-10-26 23:45:13 +01:00 · 2026-10-26 16:50:03 +00:00 · 2026-10-26 16:48:27 +00:00 · 2026-10-26 17:48:05 +01:00 · 2026-10-26 16:47:55 +00:00 · 2026-10-26 17:47:22 +01:00
169 changed files with 3162 additions and 1280 deletions
@@ -1,3 +1,171 @@
+## 2026-10-24
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - patchmon: avoids systemd environment secret leaks via D-Bus/subprocesses. [@rhclayto](https://github.com/rhclayto) ([#18074](https://github.com/community-scripts/ProxmoxVE/pull/18074))
+    - fix: Linkwarden - clear Yarn berry cache after install and update- #18115 [@bferd](https://github.com/bferd) ([#18116](https://github.com/community-scripts/ProxmoxVE/pull/18116))
+    - Borg-UI: recreate the borg venvs with --clear [@MickLesk](https://github.com/MickLesk) ([#18118](https://github.com/community-scripts/ProxmoxVE/pull/18118))
+    - SnapOtter: recreate the AI venv with --clear [@MickLesk](https://github.com/MickLesk) ([#18119](https://github.com/community-scripts/ProxmoxVE/pull/18119))
+    - Update authentik version to 2026.8.5 [@thieneret](https://github.com/thieneret) ([#18125](https://github.com/community-scripts/ProxmoxVE/pull/18125))
+
+  - #### ✨ New Features
+
+    - Frigate: bump to v0.18.2 [@MickLesk](https://github.com/MickLesk) ([#18120](https://github.com/community-scripts/ProxmoxVE/pull/18120))
+
+  - #### 🔧 Refactor
+
+    - install: answer every prompt from the environment, survive a closed stdin [@MickLesk](https://github.com/MickLesk) ([#18121](https://github.com/community-scripts/ProxmoxVE/pull/18121))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - fix(addons): use catch_errors so the update marker is cleared [@mazelado](https://github.com/mazelado) ([#18128](https://github.com/community-scripts/ProxmoxVE/pull/18128))
+
+## 2026-10-23
+
+### 🚀 Updated Scripts
+
+  - postgresql: default the version prompt and match Alpine's packages [@MickLesk](https://github.com/MickLesk) ([#18093](https://github.com/community-scripts/ProxmoxVE/pull/18093))
+- Storyteller: build the runtime like upstream's Dockerfile [@MickLesk](https://github.com/MickLesk) ([#18083](https://github.com/community-scripts/ProxmoxVE/pull/18083))
+
+  - #### 🐞 Bug Fixes
+
+    - proxcenter: skip the type check and lower the build heap [@MickLesk](https://github.com/MickLesk) ([#18090](https://github.com/community-scripts/ProxmoxVE/pull/18090))
+    - hermesagent: retry the installer download, fall back to GitHub [@MickLesk](https://github.com/MickLesk) ([#18091](https://github.com/community-scripts/ProxmoxVE/pull/18091))
+    - zabbix: use the arm64 repository for 7.0 [@MickLesk](https://github.com/MickLesk) ([#18089](https://github.com/community-scripts/ProxmoxVE/pull/18089))
+    - kasm: survive a failed release lookup and answer the installer with flags [@MickLesk](https://github.com/MickLesk) ([#18092](https://github.com/community-scripts/ProxmoxVE/pull/18092))
+
+  - #### ✨ New Features
+
+    - InvoiceShelf: run the Laravel scheduler [@MickLesk](https://github.com/MickLesk) ([#18079](https://github.com/community-scripts/ProxmoxVE/pull/18079))
+
+  - #### 🔧 Refactor
+
+    - podman-homeassistant: require Debian 13 [@MickLesk](https://github.com/MickLesk) ([#18095](https://github.com/community-scripts/ProxmoxVE/pull/18095))
+    - apache-guacamole: require Debian 13 [@MickLesk](https://github.com/MickLesk) ([#18094](https://github.com/community-scripts/ProxmoxVE/pull/18094))
+    - unifi-os-server: require Debian 13 [@MickLesk](https://github.com/MickLesk) ([#18096](https://github.com/community-scripts/ProxmoxVE/pull/18096))
+    - openwebui: drop the Intel oneAPI Base Toolkit [@MickLesk](https://github.com/MickLesk) ([#18098](https://github.com/community-scripts/ProxmoxVE/pull/18098))
+    - ollama: drop the Intel oneAPI Base Toolkit [@MickLesk](https://github.com/MickLesk) ([#18097](https://github.com/community-scripts/ProxmoxVE/pull/18097))
+    - tdarr: do not let a failed or slow updater block the service start [@MickLesk](https://github.com/MickLesk) ([#18100](https://github.com/community-scripts/ProxmoxVE/pull/18100))
+    - immich: install mise from its GitHub release, retry jellyfin-ffmpeg, default the ML prompt [@MickLesk](https://github.com/MickLesk) ([#18099](https://github.com/community-scripts/ProxmoxVE/pull/18099))
+    - Refactor: pimox-haos-vm [@MickLesk](https://github.com/MickLesk) ([#18077](https://github.com/community-scripts/ProxmoxVE/pull/18077))
+
+### 💾 Core
+
+  - Telemetry: explain and categorize by the command that failed [@MickLesk](https://github.com/MickLesk) ([core#166](https://github.com/community-scripts/core/pull/166))
+- error-handler: report a handled silent failure only on its own line [@MickLesk](https://github.com/MickLesk) ([core#165](https://github.com/community-scripts/core/pull/165))
+- VM silent: return the failure instead of exiting [@MickLesk](https://github.com/MickLesk) ([core#164](https://github.com/community-scripts/core/pull/164))
+- error-handler: keep the start explanation and the final IP lookup from failing the run [@MickLesk](https://github.com/MickLesk) ([core#163](https://github.com/community-scripts/core/pull/163))
+- error output: report a failure inside a subshell once [@MickLesk](https://github.com/MickLesk) ([core#162](https://github.com/community-scripts/core/pull/162))
+- general: allow Composer as root in every script [@MickLesk](https://github.com/MickLesk) ([core#161](https://github.com/community-scripts/core/pull/161))
+- lxc-updater: skip the resource check when the container cannot read its RAM [@MickLesk](https://github.com/MickLesk) ([core#160](https://github.com/community-scripts/core/pull/160))
+- vm-core: let vm_timezone_default survive a host without /etc/timezone [@MickLesk](https://github.com/MickLesk) ([core#159](https://github.com/community-scripts/core/pull/159))
+
+## 2026-10-22
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Zabbix: keep unattended updates on the installed series [@florianpunz](https://github.com/florianpunz) ([#18051](https://github.com/community-scripts/ProxmoxVE/pull/18051))
+
+  - #### 🔧 Refactor
+
+    - Refactor: Cryptpad [@MickLesk](https://github.com/MickLesk) ([#18065](https://github.com/community-scripts/ProxmoxVE/pull/18065))
+
+### 💾 Core
+
+  - Incus: drive a remote Incus server from the client's default remote [@MickLesk](https://github.com/MickLesk) ([core#154](https://github.com/community-scripts/core/pull/154))
+- Deploy the release again when an update is redone [@MickLesk](https://github.com/MickLesk) ([core#158](https://github.com/community-scripts/core/pull/158))
+
+### ❔ Uncategorized
+
+  - chore(ct): sync sparkyfitness defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18061](https://github.com/community-scripts/ProxmoxVE/pull/18061))
+
+## 2026-10-21
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Immich: bump release version to v3.3.5 (CVE) [@CerberusStyle](https://github.com/CerberusStyle) ([#18057](https://github.com/community-scripts/ProxmoxVE/pull/18057))
+    - DroppedNeedle: pass release version to the app via COMMIT_TAG [@MickLesk](https://github.com/MickLesk) ([#18042](https://github.com/community-scripts/ProxmoxVE/pull/18042))
+
+### 💾 Core
+
+  - Keep the version an update started from across a redo [@MickLesk](https://github.com/MickLesk) ([core#156](https://github.com/community-scripts/core/pull/156))
+- Redo an update whose run did not finish after the deploy [@MickLesk](https://github.com/MickLesk) ([core#155](https://github.com/community-scripts/core/pull/155))
+
+## 2026-10-20
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Plane: give Silo its own HOME [@MickLesk](https://github.com/MickLesk) ([#18028](https://github.com/community-scripts/ProxmoxVE/pull/18028))
+    - Immich: Pin version to 3.3.4 [@vhsdream](https://github.com/vhsdream) ([#18036](https://github.com/community-scripts/ProxmoxVE/pull/18036))
+    - InvenTree: run apt under systemd so postinst can finish [@MickLesk](https://github.com/MickLesk) ([#18029](https://github.com/community-scripts/ProxmoxVE/pull/18029))
+    - Profilarr: pass the deno pin as the version [@MickLesk](https://github.com/MickLesk) ([#18025](https://github.com/community-scripts/ProxmoxVE/pull/18025))
+    - Silo: keep the version file out of ~/.silo [@MickLesk](https://github.com/MickLesk) ([#18030](https://github.com/community-scripts/ProxmoxVE/pull/18030))
+    - InvenTree: move to go.packager.io [@MickLesk](https://github.com/MickLesk) ([#18015](https://github.com/community-scripts/ProxmoxVE/pull/18015))
+    - Zitadel: run init and setup in the foreground [@MickLesk](https://github.com/MickLesk) ([#18016](https://github.com/community-scripts/ProxmoxVE/pull/18016))
+
+  - #### ✨ New Features
+
+    - Zitadel: Support v1 and v2 Login [@MickLesk](https://github.com/MickLesk) ([#18031](https://github.com/community-scripts/ProxmoxVE/pull/18031))
+
+  - #### 🔧 Refactor
+
+    - Refactor: OpenWebUI (remove numba pin)  [@MickLesk](https://github.com/MickLesk) ([#18026](https://github.com/community-scripts/ProxmoxVE/pull/18026))
+
+### 💾 Core
+
+  - Only treat an NVIDIA GPU as present when its device nodes are [@MickLesk](https://github.com/MickLesk) ([core#153](https://github.com/community-scripts/core/pull/153))
+
+## 2026-10-19
+
+### 🆕 New Scripts
+
+  - Calagopus ([#18012](https://github.com/community-scripts/ProxmoxVE/pull/18012))
+- Netronome ([#18011](https://github.com/community-scripts/ProxmoxVE/pull/18011))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - immich: record library revisions when the line is missing [@mazelado](https://github.com/mazelado) ([#17990](https://github.com/community-scripts/ProxmoxVE/pull/17990))
+    - Update authentik 2026.8.4 [@thieneret](https://github.com/thieneret) ([#18004](https://github.com/community-scripts/ProxmoxVE/pull/18004))
+
+  - #### ✨ New Features
+
+    - feat(mealie): add reverse proxy auth settings to mealie.env [@bferd](https://github.com/bferd) ([#18006](https://github.com/community-scripts/ProxmoxVE/pull/18006))
+
+## 2026-10-18
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Donetick: create selfhosted.yaml from the example [@MickLesk](https://github.com/MickLesk) ([#17992](https://github.com/community-scripts/ProxmoxVE/pull/17992))
+    - Wiki.js: only back up db.sqlite on SQLite installs [@MickLesk](https://github.com/MickLesk) ([#17993](https://github.com/community-scripts/ProxmoxVE/pull/17993))
+    - FlareSolverr: pass Chrome an en-US Accept-Language [@MickLesk](https://github.com/MickLesk) ([#17995](https://github.com/community-scripts/ProxmoxVE/pull/17995))
+    - 2FAuth: install the locked dependencies [@MickLesk](https://github.com/MickLesk) ([#17996](https://github.com/community-scripts/ProxmoxVE/pull/17996))
+    - Tracearr: drop the pnpm store after the update build [@gioxx](https://github.com/gioxx) ([#17869](https://github.com/community-scripts/ProxmoxVE/pull/17869))
+    - vaultwarden: build before stopping the service [@mazelado](https://github.com/mazelado) ([#17983](https://github.com/community-scripts/ProxmoxVE/pull/17983))
+
+  - #### 💥 Breaking Changes
+
+    - fix: geopulse 2.0.0 upgrade support (nginx .mjs, pg18, jwt cleanup) [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17978](https://github.com/community-scripts/ProxmoxVE/pull/17978))
+
+### 💾 Core
+
+  - Let get_current_ip reach its IPv6 fallback [@MickLesk](https://github.com/MickLesk) ([core#151](https://github.com/community-scripts/core/pull/151))
+- Drop apt autoclean before apt clean [@MickLesk](https://github.com/MickLesk) ([core#152](https://github.com/community-scripts/core/pull/152))
+- Silence apt's script warning in $STD [@MickLesk](https://github.com/MickLesk) ([core#150](https://github.com/community-scripts/core/pull/150))
+
 ## 2026-10-17

 ### 🆕 New Scripts
@@ -119,6 +119,9 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit



+
+
+



@@ -132,7 +135,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit


 <details>
-<summary><h4>October (17 entries)</h4></summary>
+<summary><h4>October (24 entries)</h4></summary>

 [View October 2026 Changelog](.github/changelogs/2026/10.md)

@@ -565,6 +568,201 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 </details>

+## 2026-10-26
+
+### 🆕 New Scripts
+
+  - Vane ([#18168](https://github.com/community-scripts/ProxmoxVE/pull/18168))
+- HomeTube ([#18172](https://github.com/community-scripts/ProxmoxVE/pull/18172))
+- Honcho ([#18169](https://github.com/community-scripts/ProxmoxVE/pull/18169))
+- YTPTube ([#18174](https://github.com/community-scripts/ProxmoxVE/pull/18174))
+- Stump ([#18173](https://github.com/community-scripts/ProxmoxVE/pull/18173))
+- Casdoor ([#18170](https://github.com/community-scripts/ProxmoxVE/pull/18170))
+- Streamystats ([#18171](https://github.com/community-scripts/ProxmoxVE/pull/18171))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Immich: lock only this platform when mise installs the plugin tools [@MickLesk](https://github.com/MickLesk) ([#18241](https://github.com/community-scripts/ProxmoxVE/pull/18241))
+    - Fix service name case for Splunkd [@CerberusStyle](https://github.com/CerberusStyle) ([#18238](https://github.com/community-scripts/ProxmoxVE/pull/18238))
+    - VMs: pass the machine type, CPU, disk cache and discard settings to qm [@MickLesk](https://github.com/MickLesk) ([#18232](https://github.com/community-scripts/ProxmoxVE/pull/18232))
+    - excalidash: bump Node.js from 20 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18213](https://github.com/community-scripts/ProxmoxVE/pull/18213))
+    - readmeabook: bump Node.js from 20 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18217](https://github.com/community-scripts/ProxmoxVE/pull/18217))
+    - homepage: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18214](https://github.com/community-scripts/ProxmoxVE/pull/18214))
+    - remove old -install.sh (verdaccio) [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18218](https://github.com/community-scripts/ProxmoxVE/pull/18218))
+    - meshcentral: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18215](https://github.com/community-scripts/ProxmoxVE/pull/18215))
+
+  - #### ✨ New Features
+
+    - MeshCentral: update the npm package, not just the OS [@MickLesk](https://github.com/MickLesk) ([#18243](https://github.com/community-scripts/ProxmoxVE/pull/18243))
+
+### 💾 Core
+
+  - feat: let an install survive a closed console / dont sighup installs [@MickLesk](https://github.com/MickLesk) ([core#167](https://github.com/community-scripts/core/pull/167))
+- feat: create containers from the linuxcontainers.org catalog when Proxmox has no template [@MickLesk](https://github.com/MickLesk) ([core#25](https://github.com/community-scripts/core/pull/25))
+
+### 📚 Documentation
+
+  - Ref: Docs / Readme [@MickLesk](https://github.com/MickLesk) ([#18233](https://github.com/community-scripts/ProxmoxVE/pull/18233))
+
+## 2026-10-25
+
+### 🆕 New Scripts
+
+  - Dreeve ([#18167](https://github.com/community-scripts/ProxmoxVE/pull/18167))
+- TaskView ([#18166](https://github.com/community-scripts/ProxmoxVE/pull/18166))
+- EmDash ([#18165](https://github.com/community-scripts/ProxmoxVE/pull/18165))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(mealie): install ffmpeg for video recipe import [@clartek](https://github.com/clartek) ([#18210](https://github.com/community-scripts/ProxmoxVE/pull/18210))
+    - Termix: step through 2.9.2 when updating from 2.8 or older [@MickLesk](https://github.com/MickLesk) ([#18158](https://github.com/community-scripts/ProxmoxVE/pull/18158))
+    - Element Synapse: remove the registration line by its text, not line 34 [@MickLesk](https://github.com/MickLesk) ([#18201](https://github.com/community-scripts/ProxmoxVE/pull/18201))
+    - Element Synapse: drop the ::1 listener so a container without IPv6 starts [@MickLesk](https://github.com/MickLesk) ([#18180](https://github.com/community-scripts/ProxmoxVE/pull/18180))
+    - Heimdall: generate the app key without the production prompt [@MickLesk](https://github.com/MickLesk) ([#18156](https://github.com/community-scripts/ProxmoxVE/pull/18156))
+    - Frigate: fetch the Intel graphics key with retries before building the media driver [@MickLesk](https://github.com/MickLesk) ([#18192](https://github.com/community-scripts/ProxmoxVE/pull/18192))
+    - Pterodactyl Panel: default the admin's first and last name when left empty [@MickLesk](https://github.com/MickLesk) ([#18177](https://github.com/community-scripts/ProxmoxVE/pull/18177))
+    - Jellyseerr: point fresh installs to Seerr instead of a missing install script [@MickLesk](https://github.com/MickLesk) ([#18183](https://github.com/community-scripts/ProxmoxVE/pull/18183))
+    - Pi-hole: download the installer before running it [@MickLesk](https://github.com/MickLesk) ([#18182](https://github.com/community-scripts/ProxmoxVE/pull/18182))
+    - OmniTools: give the build a git commit to read [@MickLesk](https://github.com/MickLesk) ([#18181](https://github.com/community-scripts/ProxmoxVE/pull/18181))
+    - iVentoy: stop early in an unprivileged container [@MickLesk](https://github.com/MickLesk) ([#18179](https://github.com/community-scripts/ProxmoxVE/pull/18179))
+    - Immich: stop early on Debian 12 instead of failing at apt [@MickLesk](https://github.com/MickLesk) ([#18178](https://github.com/community-scripts/ProxmoxVE/pull/18178))
+    - paperless-ngx: fix missing index folder [@Segelzwerg](https://github.com/Segelzwerg) ([#18142](https://github.com/community-scripts/ProxmoxVE/pull/18142))
+    - Anytype Server: keep the .env across updates and recreate a lost one [@MickLesk](https://github.com/MickLesk) ([#18155](https://github.com/community-scripts/ProxmoxVE/pull/18155))
+    - changedetection: build Browserless from its lockfile on update [@MickLesk](https://github.com/MickLesk) ([#18157](https://github.com/community-scripts/ProxmoxVE/pull/18157))
+    - Zitadel: identify the machine by hostname when it has no private IPv4 [@MickLesk](https://github.com/MickLesk) ([#18139](https://github.com/community-scripts/ProxmoxVE/pull/18139))
+    - fix(bar-assistant): publish starter media catalog so new bars provision [@och29](https://github.com/och29) ([#18130](https://github.com/community-scripts/ProxmoxVE/pull/18130))
+
+  - #### ✨ New Features
+
+    - Gramps-Web: run the Celery task queue with Redis [@MickLesk](https://github.com/MickLesk) ([#18141](https://github.com/community-scripts/ProxmoxVE/pull/18141))
+
+  - #### 💥 Breaking Changes
+
+    - Hermes Agent: install, update and run everything as the hermes user [@MickLesk](https://github.com/MickLesk) ([#18203](https://github.com/community-scripts/ProxmoxVE/pull/18203))
+    - tubearchivist: fix: prepare tubearchivist for v0.6.0 [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17867](https://github.com/community-scripts/ProxmoxVE/pull/17867))
+
+  - #### 🔧 Refactor
+
+    - TREK: build 5.0 with 4 GB RAM and without dependency install scripts [@MickLesk](https://github.com/MickLesk) ([#18194](https://github.com/community-scripts/ProxmoxVE/pull/18194))
+
+### 💾 Core
+
+  - alpine: fix uv release url [@mfelipe](https://github.com/mfelipe) ([core#168](https://github.com/community-scripts/core/pull/168))
+- Set npm's script and git policy for root too, so --prefix keeps it [@MickLesk](https://github.com/MickLesk) ([core#170](https://github.com/community-scripts/core/pull/170))
+- Upgrade Node.js in place when an app package depends on it [@MickLesk](https://github.com/MickLesk) ([core#169](https://github.com/community-scripts/core/pull/169))
+
+### 🧰 Tools
+
+  - #### ✨ New Features
+
+    - post-pmg-install: hide the subscription nag in the PMG 9 mobile quarantine [@MickLesk](https://github.com/MickLesk) ([#18140](https://github.com/community-scripts/ProxmoxVE/pull/18140))
+    - post-pve-install: hide the mobile subscription nag in every UI language [@MickLesk](https://github.com/MickLesk) ([#18143](https://github.com/community-scripts/ProxmoxVE/pull/18143))
+
+## 2026-10-24
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - patchmon: avoids systemd environment secret leaks via D-Bus/subprocesses. [@rhclayto](https://github.com/rhclayto) ([#18074](https://github.com/community-scripts/ProxmoxVE/pull/18074))
+    - fix: Linkwarden - clear Yarn berry cache after install and update- #18115 [@bferd](https://github.com/bferd) ([#18116](https://github.com/community-scripts/ProxmoxVE/pull/18116))
+    - Borg-UI: recreate the borg venvs with --clear [@MickLesk](https://github.com/MickLesk) ([#18118](https://github.com/community-scripts/ProxmoxVE/pull/18118))
+    - SnapOtter: recreate the AI venv with --clear [@MickLesk](https://github.com/MickLesk) ([#18119](https://github.com/community-scripts/ProxmoxVE/pull/18119))
+    - Update authentik version to 2026.8.5 [@thieneret](https://github.com/thieneret) ([#18125](https://github.com/community-scripts/ProxmoxVE/pull/18125))
+
+  - #### ✨ New Features
+
+    - Frigate: bump to v0.18.2 [@MickLesk](https://github.com/MickLesk) ([#18120](https://github.com/community-scripts/ProxmoxVE/pull/18120))
+
+  - #### 🔧 Refactor
+
+    - install: answer every prompt from the environment, survive a closed stdin [@MickLesk](https://github.com/MickLesk) ([#18121](https://github.com/community-scripts/ProxmoxVE/pull/18121))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - fix(addons): use catch_errors so the update marker is cleared [@mazelado](https://github.com/mazelado) ([#18128](https://github.com/community-scripts/ProxmoxVE/pull/18128))
+
+## 2026-10-23
+
+### 🚀 Updated Scripts
+
+  - postgresql: default the version prompt and match Alpine's packages [@MickLesk](https://github.com/MickLesk) ([#18093](https://github.com/community-scripts/ProxmoxVE/pull/18093))
+- Storyteller: build the runtime like upstream's Dockerfile [@MickLesk](https://github.com/MickLesk) ([#18083](https://github.com/community-scripts/ProxmoxVE/pull/18083))
+
+  - #### 🐞 Bug Fixes
+
+    - proxcenter: skip the type check and lower the build heap [@MickLesk](https://github.com/MickLesk) ([#18090](https://github.com/community-scripts/ProxmoxVE/pull/18090))
+    - hermesagent: retry the installer download, fall back to GitHub [@MickLesk](https://github.com/MickLesk) ([#18091](https://github.com/community-scripts/ProxmoxVE/pull/18091))
+    - zabbix: use the arm64 repository for 7.0 [@MickLesk](https://github.com/MickLesk) ([#18089](https://github.com/community-scripts/ProxmoxVE/pull/18089))
+    - kasm: survive a failed release lookup and answer the installer with flags [@MickLesk](https://github.com/MickLesk) ([#18092](https://github.com/community-scripts/ProxmoxVE/pull/18092))
+
+  - #### ✨ New Features
+
+    - InvoiceShelf: run the Laravel scheduler [@MickLesk](https://github.com/MickLesk) ([#18079](https://github.com/community-scripts/ProxmoxVE/pull/18079))
+
+  - #### 🔧 Refactor
+
+    - podman-homeassistant: require Debian 13 [@MickLesk](https://github.com/MickLesk) ([#18095](https://github.com/community-scripts/ProxmoxVE/pull/18095))
+    - apache-guacamole: require Debian 13 [@MickLesk](https://github.com/MickLesk) ([#18094](https://github.com/community-scripts/ProxmoxVE/pull/18094))
+    - unifi-os-server: require Debian 13 [@MickLesk](https://github.com/MickLesk) ([#18096](https://github.com/community-scripts/ProxmoxVE/pull/18096))
+    - openwebui: drop the Intel oneAPI Base Toolkit [@MickLesk](https://github.com/MickLesk) ([#18098](https://github.com/community-scripts/ProxmoxVE/pull/18098))
+    - ollama: drop the Intel oneAPI Base Toolkit [@MickLesk](https://github.com/MickLesk) ([#18097](https://github.com/community-scripts/ProxmoxVE/pull/18097))
+    - tdarr: do not let a failed or slow updater block the service start [@MickLesk](https://github.com/MickLesk) ([#18100](https://github.com/community-scripts/ProxmoxVE/pull/18100))
+    - immich: install mise from its GitHub release, retry jellyfin-ffmpeg, default the ML prompt [@MickLesk](https://github.com/MickLesk) ([#18099](https://github.com/community-scripts/ProxmoxVE/pull/18099))
+    - Refactor: pimox-haos-vm [@MickLesk](https://github.com/MickLesk) ([#18077](https://github.com/community-scripts/ProxmoxVE/pull/18077))
+
+### 💾 Core
+
+  - Telemetry: explain and categorize by the command that failed [@MickLesk](https://github.com/MickLesk) ([core#166](https://github.com/community-scripts/core/pull/166))
+- error-handler: report a handled silent failure only on its own line [@MickLesk](https://github.com/MickLesk) ([core#165](https://github.com/community-scripts/core/pull/165))
+- VM silent: return the failure instead of exiting [@MickLesk](https://github.com/MickLesk) ([core#164](https://github.com/community-scripts/core/pull/164))
+- error-handler: keep the start explanation and the final IP lookup from failing the run [@MickLesk](https://github.com/MickLesk) ([core#163](https://github.com/community-scripts/core/pull/163))
+- error output: report a failure inside a subshell once [@MickLesk](https://github.com/MickLesk) ([core#162](https://github.com/community-scripts/core/pull/162))
+- general: allow Composer as root in every script [@MickLesk](https://github.com/MickLesk) ([core#161](https://github.com/community-scripts/core/pull/161))
+- lxc-updater: skip the resource check when the container cannot read its RAM [@MickLesk](https://github.com/MickLesk) ([core#160](https://github.com/community-scripts/core/pull/160))
+- vm-core: let vm_timezone_default survive a host without /etc/timezone [@MickLesk](https://github.com/MickLesk) ([core#159](https://github.com/community-scripts/core/pull/159))
+
+## 2026-10-22
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Zabbix: keep unattended updates on the installed series [@florianpunz](https://github.com/florianpunz) ([#18051](https://github.com/community-scripts/ProxmoxVE/pull/18051))
+
+  - #### 🔧 Refactor
+
+    - Refactor: Cryptpad [@MickLesk](https://github.com/MickLesk) ([#18065](https://github.com/community-scripts/ProxmoxVE/pull/18065))
+
+### 💾 Core
+
+  - Incus: drive a remote Incus server from the client's default remote [@MickLesk](https://github.com/MickLesk) ([core#154](https://github.com/community-scripts/core/pull/154))
+- Deploy the release again when an update is redone [@MickLesk](https://github.com/MickLesk) ([core#158](https://github.com/community-scripts/core/pull/158))
+
+### ❔ Uncategorized
+
+  - chore(ct): sync sparkyfitness defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18061](https://github.com/community-scripts/ProxmoxVE/pull/18061))
+
+## 2026-10-21
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Immich: bump release version to v3.3.5 (CVE) [@CerberusStyle](https://github.com/CerberusStyle) ([#18057](https://github.com/community-scripts/ProxmoxVE/pull/18057))
+    - DroppedNeedle: pass release version to the app via COMMIT_TAG [@MickLesk](https://github.com/MickLesk) ([#18042](https://github.com/community-scripts/ProxmoxVE/pull/18042))
+
+### 💾 Core
+
+  - Keep the version an update started from across a redo [@MickLesk](https://github.com/MickLesk) ([core#156](https://github.com/community-scripts/core/pull/156))
+- Redo an update whose run did not finish after the deploy [@MickLesk](https://github.com/MickLesk) ([core#155](https://github.com/community-scripts/core/pull/155))
+
 ## 2026-10-20

 ### 🚀 Updated Scripts
@@ -1174,154 +1372,4 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

  - Incus: make prompts visible for end-user [@MickLesk](https://github.com/MickLesk) ([core#73](https://github.com/community-scripts/core/pull/73))
 - incus: do not let an install script block on an invisible prompt [@MickLesk](https://github.com/MickLesk) ([core#71](https://github.com/community-scripts/core/pull/71))
- tel: report progress from installs only, not updates [@MickLesk](https://github.com/MickLesk) ([core#72](https://github.com/community-scripts/core/pull/72))
-
-## 2026-09-24
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Declare the RomM filesystem structure required since 5.3.0 [@MickLesk](https://github.com/MickLesk) ([#17480](https://github.com/community-scripts/ProxmoxVE/pull/17480))
-    - general: use apt_update_safe instead of aborting on a failed apt update [@MickLesk](https://github.com/MickLesk) ([#17462](https://github.com/community-scripts/ProxmoxVE/pull/17462))
-
-  - #### 🔧 Refactor
-
-    - Journiv: Serve Node Frontend and add HTTP Auth .env [@MickLesk](https://github.com/MickLesk) ([#17479](https://github.com/community-scripts/ProxmoxVE/pull/17479))
-
-### 💾 Core
-
-  - core: accept an off-subnet gateway for /31 and /32 [@MickLesk](https://github.com/MickLesk) ([core#70](https://github.com/community-scripts/core/pull/70))
-
-## 2026-09-23
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - fix(signoz): install the histogramQuantile ClickHouse function [@maksimtech](https://github.com/maksimtech) ([#17386](https://github.com/community-scripts/ProxmoxVE/pull/17386))
-    - omniroute: bump to 4 GB for the npm install [@MickLesk](https://github.com/MickLesk) ([#17461](https://github.com/community-scripts/ProxmoxVE/pull/17461))
-    - Run Borg-UI with a single gunicorn worker [@MickLesk](https://github.com/MickLesk) ([#17445](https://github.com/community-scripts/ProxmoxVE/pull/17445))
-    - immich: keep geodata linked and the build deps present on update [@MickLesk](https://github.com/MickLesk) ([#17438](https://github.com/community-scripts/ProxmoxVE/pull/17438))
-
-  - #### 🔧 Refactor
-
-    - Refactor: Scanopy [@MickLesk](https://github.com/MickLesk) ([#16797](https://github.com/community-scripts/ProxmoxVE/pull/16797))
-
-### 💾 Core
-
-  - stop a partial find from aborting the caller under pipefail [@MickLesk](https://github.com/MickLesk) ([core#68](https://github.com/community-scripts/core/pull/68))
- core: give RHEL-family containers an ostype PVE accepts [@MickLesk](https://github.com/MickLesk) ([core#67](https://github.com/community-scripts/core/pull/67))
- core: do not abort on a failed apt update [@MickLesk](https://github.com/MickLesk) ([core#66](https://github.com/community-scripts/core/pull/66))
- VM's: report a finished VM as done, not aborted [@MickLesk](https://github.com/MickLesk) ([core#65](https://github.com/community-scripts/core/pull/65))
- VM-Core: decide console autologin from the image, not USE_CLOUD_INIT [@MickLesk](https://github.com/MickLesk) ([core#63](https://github.com/community-scripts/core/pull/63))
- VM-Core: report failed image steps and restore tty1 autologin without cloud-init [@MickLesk](https://github.com/MickLesk) ([core#62](https://github.com/community-scripts/core/pull/62))
- tools: raise pnpm/yarn fetch timeout and lower network concurrency [@MickLesk](https://github.com/MickLesk) ([core#59](https://github.com/community-scripts/core/pull/59))
- VM-Core: stop discarding cloud-init error messages [@MickLesk](https://github.com/MickLesk) ([core#60](https://github.com/community-scripts/core/pull/60))
-
-## 2026-09-22
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - fix(invoiceshelf): re-link storage during update [@owenvoke](https://github.com/owenvoke) ([#17431](https://github.com/community-scripts/ProxmoxVE/pull/17431))
-    - fix(alpine-it-tools): write the version file after a successful update [@Houtek](https://github.com/Houtek) ([#17421](https://github.com/community-scripts/ProxmoxVE/pull/17421))
-    - Umami: Align pnpm with engines.pnpm on update [@ReneNulschDE](https://github.com/ReneNulschDE) ([#17404](https://github.com/community-scripts/ProxmoxVE/pull/17404))
-
-  - #### 🔧 Refactor
-
-    - several scripts: let uv see the project before syncing it | refactor some scripts that use uv [@MickLesk](https://github.com/MickLesk) ([#17436](https://github.com/community-scripts/ProxmoxVE/pull/17436))
-
-### 💾 Core
-
-  - setup_uv: honour a project's required-version pin [@MickLesk](https://github.com/MickLesk) ([core#58](https://github.com/community-scripts/core/pull/58))
- fix(motd): repair legacy 00_lxc-details.sh header and dead color placeholders [@BadFlo](https://github.com/BadFlo) ([core#53](https://github.com/community-scripts/core/pull/53))
- meilisearch: take the raw binary, not the .deb [@MickLesk](https://github.com/MickLesk) ([core#57](https://github.com/community-scripts/core/pull/57))
-
-### 📚 Documentation
-
-  - github: Stop generating header filenames with a newline in them [@MickLesk](https://github.com/MickLesk) ([#17435](https://github.com/community-scripts/ProxmoxVE/pull/17435))
-
-### ❔ Uncategorized
-
-  - chore(ct): sync cloudflare-ddns defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17446](https://github.com/community-scripts/ProxmoxVE/pull/17446))
-
-## 2026-09-21
-
-### 🆕 New Scripts
-
-  - AudioMuse-AI ([#17415](https://github.com/community-scripts/ProxmoxVE/pull/17415))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - fix(portabase): meet the default admin password rules [@maksimtech](https://github.com/maksimtech) ([#17384](https://github.com/community-scripts/ProxmoxVE/pull/17384))
-    - truenas-vm: strip the G before the storage allocation [@MickLesk](https://github.com/MickLesk) ([#17407](https://github.com/community-scripts/ProxmoxVE/pull/17407))
-    - Librenms - Fix local snmpd community string setup [@dopch](https://github.com/dopch) ([#17363](https://github.com/community-scripts/ProxmoxVE/pull/17363))
-    - fix(iventoy): preserve release data and migrate legacy service launchers [@Msprg](https://github.com/Msprg) ([#17161](https://github.com/community-scripts/ProxmoxVE/pull/17161))
-    - xyops: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17398](https://github.com/community-scripts/ProxmoxVE/pull/17398))
-
-### 💾 Core
-
-  - Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#56](https://github.com/community-scripts/core/pull/56))
- github-api: take the release the maintainer marked as latest [@MickLesk](https://github.com/MickLesk) ([core#55](https://github.com/community-scripts/core/pull/55))
- general: prune old Rust toolchains [@MickLesk](https://github.com/MickLesk) ([core#52](https://github.com/community-scripts/core/pull/52))
- Ask when the preselected storage cannot hold the content [@MickLesk](https://github.com/MickLesk) ([core#51](https://github.com/community-scripts/core/pull/51))
-
-## 2026-09-20
-
-### 🆕 New Scripts
-
-  - Your-Spotify ([#17376](https://github.com/community-scripts/ProxmoxVE/pull/17376))
-
-## 2026-09-19
-
-### 🆕 New Scripts
-
-  - qBit-Manage ([#17377](https://github.com/community-scripts/ProxmoxVE/pull/17377))
- Ubuntu-VM: AIO | new core | performance | remove old wrappers [@MickLesk](https://github.com/MickLesk) ([#17354](https://github.com/community-scripts/ProxmoxVE/pull/17354))
-
-### 💾 Core
-
-  - Fall back to the unversioned banner slug [@MickLesk](https://github.com/MickLesk) ([core#48](https://github.com/community-scripts/core/pull/48))
-
-### ❔ Uncategorized
-
-  - chore(ct): sync immichframe defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17373](https://github.com/community-scripts/ProxmoxVE/pull/17373))
-
-## 2026-09-18
-
-### 🆕 New Scripts
-
-  - Almalinux-VM ([#17349](https://github.com/community-scripts/ProxmoxVE/pull/17349))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - update authentik to 2026.8.3 [@thieneret](https://github.com/thieneret) ([#17366](https://github.com/community-scripts/ProxmoxVE/pull/17366))
-    - crafty-controller: chown after restore_backup so restored data keeps ownership [@MickLesk](https://github.com/MickLesk) ([#17348](https://github.com/community-scripts/ProxmoxVE/pull/17348))
-    - databasus, domain-monitor, poznote: chown after restore_backup so restored data keeps its owner [@MickLesk](https://github.com/MickLesk) ([#17350](https://github.com/community-scripts/ProxmoxVE/pull/17350))
-    - alpine-vm: ask for the Cloud-Init credentials [@MickLesk](https://github.com/MickLesk) ([#17355](https://github.com/community-scripts/ProxmoxVE/pull/17355))
-    - suggestarr: keep the data where the app actually reads it [@MickLesk](https://github.com/MickLesk) ([#17317](https://github.com/community-scripts/ProxmoxVE/pull/17317))
-    - immichframe: set the admin password the new admin UI requires [@MickLesk](https://github.com/MickLesk) ([#17315](https://github.com/community-scripts/ProxmoxVE/pull/17315))
-
-  - #### ✨ New Features
-
-    - pangolin: Bump to 1.23.0 [@MickLesk](https://github.com/MickLesk) ([#17343](https://github.com/community-scripts/ProxmoxVE/pull/17343))
-
-  - #### 🔧 Refactor
-
-    - Refactor: Oxicloud [@MickLesk](https://github.com/MickLesk) ([#17338](https://github.com/community-scripts/ProxmoxVE/pull/17338))
-
-### 💾 Core
-
-  - Stop a modified conffile from aborting the whole update [@MickLesk](https://github.com/MickLesk) ([core#47](https://github.com/community-scripts/core/pull/47))
- Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#46](https://github.com/community-scripts/core/pull/46))
- github api: retry a 200 that is not a usable release payload [@MickLesk](https://github.com/MickLesk) ([core#45](https://github.com/community-scripts/core/pull/45))
-
-### 📚 Documentation
-
-  - chore: fix PR template help [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17364](https://github.com/community-scripts/ProxmoxVE/pull/17364))
+- tel: report progress from installs only, not updates [@MickLesk](https://github.com/MickLesk) ([core#72](https://github.com/community-scripts/core/pull/72))
@@ -191,7 +191,6 @@ create` still ran and the container was still built.
 ## Notes

 - **Website metadata** (name, description, logo, tags) is managed via the website — use the "Report Issue" link on any script page to request changes. Do not submit metadata changes via repo files.
- **JSON files** in `json/` define script properties used by the website. See existing files for structure reference.
 - Keep PRs small and focused. One fix or feature per PR is ideal.
 - PRs with **new scripts** opened against ProxmoxVE will be closed — submit them to [DevScripts](https://github.com/community-scripts/DevScripts) instead.
 - PRs that fail CI checks will not be merged.
@@ -1,16 +1,17 @@
 <div align="center">
-  <img src="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/images/logo-81x112.png" height="112px" alt="Proxmox VE Helper-Scripts Logo" />
+  <a href="misc/images/community-scripts.svg"><img src="misc/images/community-scripts.png" width="112" height="112" alt="Community Scripts — Proxmox VE logo" /></a>
+  <!-- Editable artwork: misc/images/community-scripts.svg; PNG export: 512 × 512. -->

-  <h1>Proxmox VE Helper-Scripts</h1>
-  <p><strong>One-command installations for services, containers, and VMs on Proxmox VE</strong><br/>
+  <h1>Community Scripts — Proxmox VE</h1>
+  <p><strong>One-command installations for services, containers and VMs on Proxmox VE</strong><br/>
  A community project — built on the foundation of <a href="https://github.com/tteck">@tteck</a>'s original work</p>

  <p>
-    <a href="https://community-scripts.org"><img src="https://img.shields.io/badge/Website-community--scripts.org-4c9b3f?style=flat-square" /></a>
-    <a href="https://discord.gg/3AnUqsXnmK"><img src="https://img.shields.io/badge/Discord-Join_us-7289da?style=flat-square&logo=discord&logoColor=white" /></a>
-    <a href="https://github.com/community-scripts/ProxmoxVE/stargazers"><img src="https://img.shields.io/github/stars/community-scripts/ProxmoxVE?style=flat-square&label=Stars&color=f5a623" /></a>
-    <a href="https://github.com/community-scripts/ProxmoxVE/blob/main/CHANGELOG.md"><img src="https://img.shields.io/badge/Changelog-view-6c5ce7?style=flat-square" /></a>
-    <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-blue?style=flat-square" /></a>
+    <a href="https://community-scripts.org"><img src="https://img.shields.io/badge/Website-community--scripts.org-4c9b3f?style=flat-square" alt="Website" /></a>
+    <a href="https://discord.gg/3AnUqsXnmK"><img src="https://img.shields.io/badge/Discord-Join_us-7289da?style=flat-square&logo=discord&logoColor=white" alt="Discord" /></a>
+    <a href="https://github.com/community-scripts/ProxmoxVE/stargazers"><img src="https://img.shields.io/github/stars/community-scripts/ProxmoxVE?style=flat-square&label=Stars&color=f5a623" alt="Stars" /></a>
+    <a href="https://github.com/community-scripts/ProxmoxVE/blob/main/CHANGELOG.md"><img src="https://img.shields.io/badge/Changelog-view-6c5ce7?style=flat-square" alt="Changelog" /></a>
+    <a href="LICENSE"><img src="https://img.shields.io/badge/License-MIT-blue?style=flat-square" alt="License" /></a>
  </p>
 </div>

@@ -18,94 +19,147 @@

 ## What is this?

-**Simplify your Proxmox VE setup with community-driven automation scripts.**
+**The canonical application scripts.** More than 700 of them, covering home
+automation, media, networking, databases, monitoring, security and developer
+tooling. Paste one command into your Proxmox shell and the container or VM is
+built, configured and running.

-Install and configure popular self-hosted services with a single command — no manual package hunting, no config file archaeology. Paste a command into your Proxmox shell, answer a few prompts, and your container or VM is up and running.
+A script only describes *what* to install. Creating the container, asking the
+questions and handling the errors is the job of the shared engine in
+[core](https://github.com/community-scripts/core), which every script loads at
+start-up. The same scripts run unchanged on an Incus host through
+[the Incus repository](https://github.com/community-scripts/Incus).

-The collection covers hundreds of services across categories like home automation, media servers, networking tools, databases, monitoring stacks, and more.
+Ready-made commands for every application are on
+[community-scripts.org](https://community-scripts.org).
+
+---
+
+## Getting started
+
+1. Go to **[community-scripts.org](https://community-scripts.org)**
+2. Search for the service you want — Home Assistant, Nginx Proxy Manager, Jellyfin
+3. Copy the one-line install command from the script page
+4. Open your **Proxmox shell** and paste it
+5. Choose **Default** or **Advanced** and follow the prompts
+
+Each script page lists what the container includes, the default resources and
+the post-install notes.
+
+> These commands run as root on your host. Every script is readable in this
+> repository, and each script page links to its source — read it before you
+> paste it, as you would with any installer.
+
+---
+
+## How scripts work
+
+**Default** picks sensible resources and asks only what it has to. Most installs
+finish in a few minutes.
+
+**Advanced** hands you container settings, networking, storage backend and
+application options before anything is created.
+
+Every container gets an `update` command. Type it in the container console:
+
+```bash
+update
+```
+
+It updates the installed application and reaches settings that would otherwise
+mean editing config files by hand. VM scripts have no built-in updater — use the
+guest's own package manager.

 ---

 ## Requirements

-| Component      | Details                                          |
-| -------------- | ------------------------------------------------ |
-| **Proxmox VE** | Version 8.4, 9.0, 9.1, or 9.2                    |
-| **Host OS**    | Proxmox VE (Debian-based)                        |
-| **Access**     | Root shell access on the Proxmox host            |
-| **Network**    | Internet connection required during installation |
+| Component | Details |
+| --------- | ------- |
+| **Proxmox VE** | 8.0 – 8.4, or 9.0 – 9.2 |
+| **Access** | Root shell on the Proxmox host |
+| **Network** | Internet access during installation |
+
+Virtual machine scripts need the same versions as containers.

 ---

-## Getting Started
+## Repository map

-The fastest way to find and run scripts:
-
-1. Go to **[community-scripts.org](https://community-scripts.org)**
-2. Search for the service you want (e.g. "Home Assistant", "Nginx Proxy Manager", "Jellyfin")
-3. Copy the one-line install command from the script page
-4. Open your **Proxmox Shell** and paste it
-5. Choose between **Default** or **Advanced** setup and follow the prompts
-
-Each script page documents what the container includes, default resource allocation, and post-install notes.
+| Repository | Contains |
+| ---------- | -------- |
+| [core](https://github.com/community-scripts/core) | The engine — container and VM creation, the wizard, error handling |
+| **ProxmoxVE** (this repo) | Canonical application scripts, plus `tools/pve/`, `vm/` and `turnkey/` |
+| [Incus](https://github.com/community-scripts/Incus) | The same scripts on an Incus host, plus Incus VMs and host tooling |
+| [DevScripts](https://github.com/community-scripts/DevScripts) | Where new scripts are tested before they land here |

 ---

-## How Scripts Work
+## Layout

-Every script follows the same pattern:
+| Folder | Contents |
+| ------ | -------- |
+| `ct/` | Application scripts — the command you paste |
+| `install/` | What each script installs inside the container |
+| `vm/` | Virtual machine scripts |
+| `tools/pve/` | Host tooling: post-install, hardware passthrough, maintenance |
+| `turnkey/` | TurnKey Linux appliance helper |
+| `misc/` | Legacy engine copies — current scripts load [core](https://github.com/community-scripts/core) at runtime, so changes here never reach a running install |

-**Default mode** — Picks sensible resource defaults (CPU, RAM, storage) and asks only the minimum required questions. Most installs finish in under five minutes.
-
-**Advanced mode** — Gives you full control over container settings, networking, storage backends, and application-level configuration before anything is installed.
-
-After installation, each container ships with a **post-install helper** accessible from the Proxmox shell. It handles common tasks like:
-
- Applying updates to the installed service
- Changing application settings without manually editing config files
- Basic troubleshooting and log access
+Application metadata — name, description, logo, tags — is managed on the website,
+not in this repository. Use the **Report Issue** link on any script page to
+request a change.

 ---

-## What's Included
+## Testing a fork or branch

-The repository covers a wide range of categories. A few examples:
+Engine and scripts resolve independently, so either can point somewhere else.
+Put the variable on the command itself — nothing needs exporting.

-| Category        | Examples                                            |
-| --------------- | --------------------------------------------------- |
-| Home Automation | Home Assistant, Zigbee2MQTT, ESPHome, Node-RED      |
-| Media           | Jellyfin, Plex, Radarr, Sonarr, Immich              |
-| Networking      | AdGuard Home, Nginx Proxy Manager, Pi-hole, Traefik |
-| Monitoring      | Grafana, Prometheus, Uptime Kuma, Netdata           |
-| Databases       | PostgreSQL, MariaDB, Redis, InfluxDB                |
-| Security        | Vaultwarden, CrowdSec, Authentik                    |
-| Dev & Tools     | Gitea, Portainer, VS Code Server, n8n               |
+To run your own copy of the scripts:

-> Browse the full list at **[community-scripts.org/categories](https://community-scripts.org/categories)** — new scripts are added regularly.
+```bash
+COMMUNITY_SCRIPTS_URL=https://raw.githubusercontent.com/YOU/ProxmoxVE/my-branch \
+  bash -c "$(curl -fsSL https://raw.githubusercontent.com/YOU/ProxmoxVE/my-branch/ct/debian.sh)"
+```
+
+A `ct/` script fetched with `curl` cannot tell the engine where it came from, so
+without that variable it would look for its `install/` half upstream.
+
+Only when you are changing the engine itself:
+
+```bash
+COMMUNITY_SCRIPTS_CORE_URL=https://raw.githubusercontent.com/YOU/core/my-branch \
+  bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/debian.sh)"
+```
+
+A local checkout of core wins over both — point at it with
+`COMMUNITY_SCRIPTS_CORE_DIR`.

 ---

 ## Contributing

-This project runs on community contributions. Whether you want to write new scripts, improve existing ones, or just report a bug — every bit helps.
+This project runs on community contributions. New scripts, fixes, bug reports —
+all of it helps.

-### Where to start
-
-| I want to…                            | Go here                                                                                           |
-| ------------------------------------- | ------------------------------------------------------------------------------------------------- |
-| Add a **new** script                  | [DevScripts](https://github.com/community-scripts/DevScripts) — new scripts are tested here first |
-| Fix or improve an **existing** script | [Contributing Guidelines](CONTRIBUTING.md) — open a PR in this repo                               |
-| Report a bug or broken script         | [Issues](https://github.com/community-scripts/ProxmoxVE/issues)                                   |
-| Request a new script or feature       | [Discussions](https://github.com/community-scripts/ProxmoxVE/discussions)                         |
-| Report a security vulnerability       | [Security Policy](SECURITY.md)                                                                    |
-| Get help or chat with other users     | [Discord](https://discord.gg/3AnUqsXnmK)                                                          |
+| I want to… | Go here |
+| ---------- | ------- |
+| Add a **new** script | [DevScripts](https://github.com/community-scripts/DevScripts) — new scripts are tested there first |
+| Fix or improve an **existing** script | [Contributing Guidelines](CONTRIBUTING.md) — open a PR here |
+| Change how containers are built | [core](https://github.com/community-scripts/core) |
+| Report a bug or a broken script | [Issues](https://github.com/community-scripts/ProxmoxVE/issues) |
+| Request a script or a feature | [Discussions](https://github.com/community-scripts/ProxmoxVE/discussions) |
+| Report a security vulnerability | [Security Policy](SECURITY.md) |
+| Ask a question | [Discord](https://discord.gg/3AnUqsXnmK) |

 ### Before you open a PR

- **New scripts go to [DevScripts](https://github.com/community-scripts/DevScripts), not here.** PRs with new scripts opened directly against this repo will be closed.
- Bug fixes and improvements to existing scripts belong in this repo — read the [Contributing Guidelines](CONTRIBUTING.md) first.
- Keep PRs focused. One fix or feature per PR.
- Document what your script installs and any non-obvious decisions in the corresponding JSON metadata file.
+- **New scripts go to [DevScripts](https://github.com/community-scripts/DevScripts), not here.** PRs adding new scripts to this repository will be closed.
+- Keep a PR to one fix or one feature.
+- A bug that also happens on Incus is an application or engine bug — say so in the report.
+- Read the [Contributing Guidelines](CONTRIBUTING.md) before your first PR.

 ---

@@ -137,6 +191,8 @@ This project runs on community contributions. Whether you want to write new scri
        <sub><b>CrazyWolf13</b></sub>
      </a>
    </td>
+  </tr>
+  <tr>
    <td align="center">
      <a href="https://github.com/tremor021">
        <img src="https://github.com/tremor021.png" width="80" height="80" style="border-radius:50%" alt="tremor021" /><br/>
@@ -155,6 +211,7 @@ This project runs on community contributions. Whether you want to write new scri
        <sub><b>asylumexp</b></sub>
      </a>
    </td>
+    <td></td>
  </tr>
 </table>

@@ -194,9 +251,11 @@ This project runs on community contributions. Whether you want to write new scri

 ## Support the Project

-This project is maintained by volunteers. All infrastructure costs come out of pocket, and the work is done in people's spare time.
+This project is maintained by volunteers. Infrastructure costs come out of
+pocket and the work happens in people's spare time.

-**30% of all donations are forwarded directly to cancer research and hospice care** — a cause that was important to tteck.
+**30% of all donations are forwarded directly to cancer research and hospice
+care** — a cause that was important to tteck.

 <div align="center">
  <a href="https://ko-fi.com/community_scripts">
@@ -212,14 +271,13 @@ This project is maintained by volunteers. All infrastructure costs come out of p

 ## License

-This project is licensed under the [MIT License](LICENSE) — free to use, modify, and redistribute for personal and commercial purposes.
-
-See the full license text in [LICENSE](LICENSE).
+MIT — free to use, modify and redistribute, for personal and commercial
+purposes. See [LICENSE](LICENSE).

 ---

 <div align="center">
  <sub>Built on the foundation of <a href="https://github.com/tteck">tteck</a>'s original work · <a href="https://github.com/tteck/Proxmox">Original Repository</a></sub><br/>
  <sub>Maintained and expanded by the community · In memory of tteck</sub><br/>
-  <sub><i>Proxmox® is a registered trademark of <a href="https://www.proxmox.com/en/about/company">Proxmox Server Solutions GmbH</a></i></sub>
+  <sub><i>This is an independent community project. <b>Proxmox</b>® is a registered trademark of <a href="https://www.proxmox.com/en/about/company">Proxmox Server Solutions GmbH</a>.</i></sub>
 </div>
@@ -37,13 +37,25 @@ function update_script() {
    systemctl stop anytype
    msg_ok "Stopped Service"

-    create_backup /opt/anytype/data
+    create_backup /opt/anytype/data /opt/anytype/.env

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "anytype" "grishy/any-sync-bundle" "prebuild" "latest" "/opt/anytype" "any-sync-bundle_*_linux_$(arch_resolve).tar.gz"
    chmod +x /opt/anytype/any-sync-bundle

    restore_backup

+    if [[ ! -f /opt/anytype/.env ]]; then
+      cat <<EOF >/opt/anytype/.env
+ANY_SYNC_BUNDLE_CONFIG=/opt/anytype/data/bundle-config.yml
+ANY_SYNC_BUNDLE_CLIENT_CONFIG=/opt/anytype/data/client-config.yml
+ANY_SYNC_BUNDLE_INIT_STORAGE=/opt/anytype/data/storage/
+ANY_SYNC_BUNDLE_INIT_EXTERNAL_ADDRS=$(hostname -I | awk '{print $1}')
+ANY_SYNC_BUNDLE_INIT_MONGO_URI=mongodb://127.0.0.1:27017/
+ANY_SYNC_BUNDLE_INIT_REDIS_URI=redis://127.0.0.1:6379/
+ANY_SYNC_BUNDLE_LOG_LEVEL=info
+EOF
+    fi
+
    msg_info "Starting Service"
    systemctl start anytype
    msg_ok "Started Service"
@@ -47,7 +47,7 @@ function update_script() {
  RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
  setup_yq

-  AUTHENTIK_VERSION="version/2026.8.4"
+  AUTHENTIK_VERSION="version/2026.8.5"
  # Source: https://github.com/goauthentik/fips/blob/main/Makefile#L26
  XMLSEC_VERSION="1.3.12"

@@ -46,11 +46,19 @@ function update_script() {

    restore_backup

+    msg_info "Refreshing Bar-Assistant data pack"
+    rm -rf /opt/bar-assistant/resources/data
+    mkdir -p /opt/bar-assistant/resources/data
+    curl -fsSL https://github.com/bar-assistant/data/archive/refs/heads/v5.tar.gz | tar -xz --strip-components=1 -C /opt/bar-assistant/resources/data
+    chown -R www-data:www-data /opt/bar-assistant/resources/data
+    msg_ok "Refreshed Bar-Assistant data pack"
+
    msg_info "Configuring Bar-Assistant"
    cd /opt/bar-assistant
    $STD composer install --no-interaction
    $STD php artisan migrate --force
    $STD php artisan storage:link
+    $STD php artisan starter-media:publish
    $STD php artisan bar:setup-meilisearch
    $STD php artisan scout:sync-index-settings
    $STD php artisan config:cache
@@ -69,7 +69,7 @@ function update_script() {

    if [[ "$(cat /opt/borg1-venv/.pinned_version 2>/dev/null)" != "$BORG1_VERSION" ]]; then
      msg_info "Installing Borg ${BORG1_VERSION} (Patience)"
-      $STD uv venv --python "$BORG_PYTHON" /opt/borg1-venv
+      $STD uv venv --clear --python "$BORG_PYTHON" /opt/borg1-venv
      $STD uv pip install --python /opt/borg1-venv pyfuse3 "borgbackup==${BORG1_VERSION}"
      echo "$BORG1_VERSION" >/opt/borg1-venv/.pinned_version
      ln -sf /opt/borg1-venv/bin/borg /usr/local/bin/borg
@@ -78,7 +78,7 @@ function update_script() {

    if [[ "$(cat /opt/borg2-venv/.pinned_version 2>/dev/null)" != "${BORG2_VERSION}-${BORGSTORE_VERSION}" ]]; then
      msg_info "Installing Borg ${BORG2_VERSION} (Patience)"
-      $STD uv venv --python "$BORG_PYTHON" /opt/borg2-venv
+      $STD uv venv --clear --python "$BORG_PYTHON" /opt/borg2-venv
      $STD uv pip install --python /opt/borg2-venv pyfuse3 "borgbackup==${BORG2_VERSION}" "borgstore[rclone,sftp,rest,s3,blake3]==${BORGSTORE_VERSION}"
      echo "${BORG2_VERSION}-${BORGSTORE_VERSION}" >/opt/borg2-venv/.pinned_version
      ln -sf /opt/borg2-venv/bin/borg /usr/local/bin/borg2
@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/casdoor/casdoor
+
+APP="Casdoor"
+var_tags="${var_tags:-auth;sso;iam}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-1024}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/casdoor ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "casdoor" "casdoor/casdoor"; then
+    msg_info "Stopping Casdoor"
+    systemctl stop casdoor
+    msg_ok "Stopped Casdoor"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "casdoor" "casdoor/casdoor" "prebuild" "latest" "/opt/casdoor" "casdoor_Linux_$(arch_resolve "x86_64" "arm64").tar.gz"
+
+    msg_info "Starting Casdoor"
+    systemctl start casdoor
+    msg_ok "Started Casdoor"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8000${CL}"
@@ -77,7 +77,6 @@ function update_script() {
    msg_info "Updating Browserless (Patience)"
    $STD git -C /opt/browserless/ fetch --all
    $STD git -C /opt/browserless/ reset --hard origin/main
-    $STD npm update --prefix /opt/browserless
    $STD npm ci --include=optional --include=dev --prefix /opt/browserless
    $STD npm install --save-exact playwright-core@1.62.1 --prefix /opt/browserless
    $STD /opt/browserless/node_modules/playwright-core/cli.js install --with-deps
@@ -30,12 +30,14 @@ function update_script() {
    msg_error "No ${APP} Installation Found!"
    exit
  fi
+  # Updates to 2026.10.0 finished without infra.js; run them again so it gets written
+  [[ -f /opt/cryptpad/config/infra.example.js && ! -f /opt/cryptpad/config/infra.js ]] && rm -f ~/.cryptpad
  if check_for_gh_release "cryptpad" "cryptpad/cryptpad"; then
    msg_info "Stopping Service"
    systemctl stop cryptpad
    msg_ok "Stopped Service"

-    create_backup /opt/cryptpad/config/config.js /opt/cryptpad/www/common/onlyoffice/dist
+    create_backup /opt/cryptpad/config/config.js /opt/cryptpad/config/infra.js /opt/cryptpad/www/common/onlyoffice/dist

    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="blob block customize data datastore onlyoffice-conf" fetch_and_deploy_gh_release "cryptpad" "cryptpad/cryptpad" "tarball"

@@ -45,8 +47,30 @@ function update_script() {
    cd /opt/cryptpad
    $STD npm ci --allow-git=all
    $STD npm run install:components
-    if [ -f "/opt/cryptpad/install-onlyoffice.sh" ]; then
-      $STD bash /opt/cryptpad/install-onlyoffice.sh --accept-license
+    if [[ -d /opt/cryptpad/www/common/onlyoffice/dist ]]; then
+      $STD bash /opt/cryptpad/install-office.sh --accept-license
+    fi
+    if [[ ! -f /opt/cryptpad/config/infra.js ]]; then
+      # 2026.10.0 reads the network settings from infra.js and no longer derives the sandbox origin
+      LOCAL_IP="$LOCAL_IP" node - <<'EOF'
+const c = require("/opt/cryptpad/config/config.js");
+const i = require("/opt/cryptpad/config/infra.example.js");
+const port = c.httpPort || i.public.httpPort;
+const safePort = c.httpSafePort || port + 1;
+const origin = (c.httpUnsafeOrigin || `http://${process.env.LOCAL_IP}:${port}`).replace(/\/+$/, "");
+const sandbox = new URL(origin);
+sandbox.port = safePort;
+Object.assign(i.public, {
+  origin,
+  sandboxOrigin: (c.httpSafeOrigin || sandbox.origin).replace(/\/+$/, ""),
+  httpHost: c.httpAddress || (c.httpUnsafeOrigin ? i.public.httpHost : "0.0.0.0"),
+  httpPort: port,
+  httpSafePort: safePort,
+  externalWebsocketURL: c.externalWebsocketURL,
+  fileHost: c.fileHost,
+});
+require("fs").writeFileSync("/opt/cryptpad/config/infra.js", "module.exports = " + JSON.stringify(i, null, 4) + ";\n");
+EOF
    fi
    $STD npm run build
    msg_ok "Updated CryptaPad"
@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/dreeveapp/dreeve
+
+APP="Dreeve"
+var_tags="${var_tags:-fitness;dashboard}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/dreeve ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "dreeve" "dreeveapp/dreeve"; then
+    msg_info "Stopping Service"
+    systemctl stop dreeve
+    msg_ok "Stopped Service"
+
+    create_backup /opt/dreeve/.env.local /opt/dreeve/Caddyfile
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "dreeve" "dreeveapp/dreeve" "tarball"
+
+    restore_backup
+
+    msg_info "Installing PHP Dependencies (Patience)"
+    cd /opt/dreeve
+    export COMPOSER_ALLOW_SUPERUSER=1
+    export APP_ENV=prod
+    $STD /opt/frankenphp/frankenphp php-cli /usr/local/bin/composer install --no-dev --optimize-autoloader --no-interaction --no-scripts
+    msg_ok "Installed PHP Dependencies"
+
+    msg_info "Running Migrations"
+    mkdir -p /opt/dreeve/var/{cache,log}
+    set -a
+    source /opt/dreeve/.env.local
+    set +a
+    $STD /opt/frankenphp/frankenphp php-cli bin/console app:db:migrate --no-interaction
+    $STD /opt/frankenphp/frankenphp php-cli bin/console assets:install public --no-interaction
+    rm -rf /opt/dreeve/var/cache/prod
+    $STD /opt/frankenphp/frankenphp php-cli bin/console cache:warmup --env=prod
+    msg_ok "Ran Migrations"
+
+    msg_info "Starting Service"
+    systemctl start dreeve
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8080${CL}"
+echo -e "${INFO}${YW}Admin credentials: ~/dreeve.creds (inside the container)${CL}"
+echo -e "${INFO}${YW}Add your Strava API credentials to /opt/dreeve/.env.local first${CL}"
@@ -91,6 +91,7 @@ User=root
 WorkingDirectory=/opt/droppedneedle/backend
 Environment=ROOT_APP_DIR=/opt/droppedneedle/backend
 Environment=PORT=8688
+Environment=COMMIT_TAG=v$(<~/.droppedneedle)
 # Environment=SLSKD_DOWNLOADS_PATH=<path-to-slskd-downloads>
 ExecStart=/opt/droppedneedle/venv/bin/python -m maintenance.automatic_upgrade --start-target
 Restart=on-failure
@@ -106,6 +107,11 @@ EOF
        sed -i '\|=8688$|a# Environment=SLSKD_DOWNLOADS_PATH=<path-to-slskd-downloads>' /etc/systemd/system/droppedneedle.service
      fi
      sed -i 's|^ExecStart=.*|ExecStart=/opt/droppedneedle/venv/bin/python -m maintenance.automatic_upgrade --start-target|' /etc/systemd/system/droppedneedle.service
+      if grep -q '^Environment=COMMIT_TAG=' /etc/systemd/system/droppedneedle.service; then
+        sed -i "s|^Environment=COMMIT_TAG=.*|Environment=COMMIT_TAG=v$(<~/.droppedneedle)|" /etc/systemd/system/droppedneedle.service
+      else
+        sed -i "\|=8688$|a Environment=COMMIT_TAG=v$(<~/.droppedneedle)" /etc/systemd/system/droppedneedle.service
+      fi
    fi

    systemctl daemon-reload
@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/emdash-cms/emdash
+
+APP="EmDash"
+var_tags="${var_tags:-cms;blog}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-3072}"
+var_disk="${var_disk:-6}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+export var_emdash_url="${var_emdash_url:-}"
+export var_emdash_template="${var_emdash_template:-}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/emdash ]]; then
+    msg_error "No EmDash Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "emdash" "emdash-cms/emdash" "" "" "emdash@"; then
+    msg_info "Stopping EmDash"
+    systemctl stop emdash
+    msg_ok "Stopped EmDash"
+
+    NODE_VERSION="24" NODE_MODULE="pnpm@11" setup_nodejs
+
+    msg_info "Updating EmDash"
+    cd /opt/emdash
+    set -a && source /opt/emdash_data/.env && set +a
+    $STD pnpm add "${CHECK_UPDATE_RELEASE}"
+    $STD pnpm build
+    $STD pnpm store prune
+    cat <<EOF >~/.emdash
+${CHECK_UPDATE_RELEASE}
+EOF
+    msg_ok "Updated EmDash"
+
+    msg_info "Starting EmDash"
+    systemctl start emdash
+    msg_ok "Started EmDash"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:4321${CL}"
+echo -e "${INFO}${YW}The admin at /_emdash/admin signs in with passkeys only, and browsers allow those on HTTPS with a domain or on localhost, never on an IP address.${CL}"
+echo -e "${INFO}${YW}Put EmDash behind a reverse proxy with a trusted certificate, set EMDASH_SITE_URL in /opt/emdash_data/.env to that address and rebuild (see the notes), then create the admin there.${CL}"
@@ -35,7 +35,8 @@ function update_script() {
    msg_info "Stopping Service"
    systemctl stop excalidash
    msg_ok "Stopped Service"
-
+    
+    NODE_VERSION="24" setup_nodejs
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "excalidash" "ZimengXiong/ExcaliDash" "tarball"
    ln -sf /opt/excalidash_data/.env /opt/excalidash/backend/.env
    set -a && source /opt/excalidash_data/.env && set +a
@@ -34,9 +34,43 @@ function update_script() {
  PYTHON_VERSION="3.12" setup_uv
  NODE_VERSION="22" NODE_MODULE="corepack" setup_nodejs

+  if ! grep -q '^CELERY_CONFIG=' /opt/gramps-web/config/config.cfg; then
+    msg_info "Setting up Celery Task Queue"
+    ensure_dependencies redis-server
+    cat <<EOF >>/opt/gramps-web/config/config.cfg
+CELERY_CONFIG={"broker_url":"redis://127.0.0.1:6379/0","result_backend":"redis://127.0.0.1:6379/0"}
+RATELIMIT_STORAGE_URI="redis://127.0.0.1:6379/1"
+EOF
+    cat <<EOF >/etc/systemd/system/gramps-web-celery.service
+[Unit]
+Description=Gramps Web Celery Worker
+After=network.target redis-server.service
+Wants=redis-server.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/gramps-web-api
+Environment=GRAMPS_API_CONFIG=/opt/gramps-web/config/config.cfg
+Environment=GRAMPSHOME=/opt/gramps-web/data
+Environment=GRAMPS_DATABASE_PATH=/opt/gramps-web/data/gramps/grampsdb
+Environment=PATH=/opt/gramps-web/venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+ExecStart=/opt/gramps-web/venv/bin/celery -A gramps_webapi.celery worker --loglevel=INFO --concurrency=2
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+    systemctl daemon-reload
+    systemctl enable -q --now redis-server gramps-web-celery
+    systemctl restart gramps-web
+    msg_ok "Set up Celery Task Queue"
+  fi
+
  if check_for_gh_release "gramps-web-api" "gramps-project/gramps-web-api"; then
    msg_info "Stopping Service"
-    systemctl stop gramps-web
+    systemctl stop gramps-web gramps-web-celery
    msg_ok "Stopped Service"

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "gramps-web-api" "gramps-project/gramps-web-api" "tarball" "latest" "/opt/gramps-web-api"
@@ -71,7 +105,7 @@ function update_script() {
    msg_ok "Updated Gramps Addons"

    msg_info "Starting Service"
-    systemctl start gramps-web
+    systemctl start gramps-web gramps-web-celery
    msg_ok "Started Service"
  fi

@@ -33,36 +33,60 @@ function update_script() {

  confirm_external_installer "https://hermes-agent.nousresearch.com/" "hermes update (https://hermes-agent.nousresearch.com/)"

-  msg_info "Stopping Services"
-  systemctl stop hermes-dashboard
-  msg_ok "Stopped Services"
-
-  msg_info "Updating Hermes Agent"
-  $STD setsid --wait bash -c '
-    set -a; source /etc/default/hermes; set +a
-    /home/hermes/.local/bin/hermes update --yes
-  '
-  mapfile -t root_gateway_pids < <(ps -eo user=,pid=,args= | awk '$1 == "root" && /\/home\/hermes\/\.hermes\// && /hermes_cli[.]main/ && / gateway run --replace$/ { print $2 }')
-  if ((${#root_gateway_pids[@]})); then
-    kill -TERM "${root_gateway_pids[@]}"
-    for pid in "${root_gateway_pids[@]}"; do
-      while kill -0 "$pid" 2>/dev/null; do
-        sleep 0.1
+  if [[ -f /etc/systemd/system/hermes-dashboard.service ]]; then
+    msg_info "Moving Hermes to its own user"
+    systemctl disable -q --now hermes-dashboard
+    rm -f /etc/systemd/system/hermes-dashboard.service
+    systemctl daemon-reload
+    mapfile -t root_hermes_pids < <(ps -eo user=,pid=,args= | awk '$1 == "root" && /\/home\/hermes\/\.hermes\// && /hermes_cli[.]main/ { print $2 }')
+    if ((${#root_hermes_pids[@]})); then
+      kill -TERM "${root_hermes_pids[@]}" 2>/dev/null || true
+      for pid in "${root_hermes_pids[@]}"; do
+        while kill -0 "$pid" 2>/dev/null; do
+          sleep 0.1
+        done
      done
-    done
-  fi
-  if ps -eo user=,args= | awk '$1 == "root" && /\/home\/hermes\/\.hermes\// { found = 1 } END { exit !found }'; then
-    msg_warn "A root-owned Hermes process is still running; it may keep writing root-owned files"
+    fi
+    ensure_dependencies libatomic1
+    sed -i '/^HOME=/d' /etc/default/hermes
+    grep -q '^GATEWAY_HEALTH_URL=' /etc/default/hermes || echo "GATEWAY_HEALTH_URL=http://127.0.0.1:8642/health" >>/etc/default/hermes
+    mkdir -p /home/hermes/.config/systemd/user
+    cat <<EOF >/home/hermes/.config/systemd/user/hermes-dashboard.service
+[Unit]
+Description=Hermes Agent Web Dashboard
+After=network-online.target
+
+[Service]
+Type=simple
+UMask=0077
+WorkingDirectory=%h
+EnvironmentFile=/etc/default/hermes
+ExecStart=%h/.local/bin/hermes dashboard --host 127.0.0.1 --port 9119 --no-open
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=default.target
+EOF
+    msg_ok "Moved Hermes to its own user"
  fi
+
  # A writer racing chown makes files vanish between readdir and chown; one retry covers it.
  if ! chown -R hermes:hermes /home/hermes 2>/dev/null; then
    sleep 1
    chown -R hermes:hermes /home/hermes || msg_warn "Could not take ownership of everything under /home/hermes"
  fi
+  $STD runuser -l hermes -c 'systemctl --user daemon-reload && systemctl --user enable hermes-dashboard'
+
+  msg_info "Updating Hermes Agent"
+  $STD setsid --wait runuser -l hermes -c '
+    set -a; source /etc/default/hermes; set +a
+    hermes update --yes
+  '
  msg_ok "Updated Hermes Agent"

  msg_info "Starting Services"
-  systemctl start hermes-dashboard
+  $STD runuser -l hermes -c 'systemctl --user start hermes-dashboard'
  msg_ok "Started Services"
  msg_ok "Updated successfully!"
  exit
@@ -30,7 +30,7 @@ function update_script() {
    exit
  fi

-  NODE_VERSION="22" NODE_MODULE="pnpm@latest" setup_nodejs
+  NODE_VERSION="24" NODE_MODULE="pnpm@latest" setup_nodejs
  ensure_dependencies jq

  if check_for_gh_release "homepage" "gethomepage/homepage"; then
@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/EgalitarianMonkey/hometube
+
+APP="HomeTube"
+var_tags="${var_tags:-media;youtube;downloader}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-1024}"
+var_disk="${var_disk:-20}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/hometube ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  msg_info "Updating yt-dlp"
+  $STD yt-dlp -U
+  msg_ok "Updated yt-dlp"
+
+  fetch_and_deploy_gh_release "deno" "denoland/deno" "prebuild" "latest" "/usr/local/bin" "deno-$(arch_resolve "x86_64" "aarch64")-unknown-linux-gnu.zip"
+
+  if check_for_gh_release "hometube" "EgalitarianMonkey/hometube"; then
+    msg_info "Stopping HomeTube"
+    systemctl stop hometube
+    msg_ok "Stopped HomeTube"
+
+    PYTHON_VERSION="3.13" setup_uv
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "hometube" "EgalitarianMonkey/hometube" "tarball"
+
+    msg_info "Updating HomeTube"
+    cd /opt/hometube
+    $STD uv sync --locked --no-dev --no-install-project --no-install-package pyarrow
+    msg_ok "Updated HomeTube"
+
+    msg_info "Starting HomeTube"
+    systemctl start hometube
+    msg_ok "Started HomeTube"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8501${CL}"
@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/plastic-labs/honcho
+
+APP="Honcho"
+var_tags="${var_tags:-ai;memory;agents}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-6}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+export var_honcho_provider="${var_honcho_provider:-}"
+export var_honcho_api_key="${var_honcho_api_key:-}"
+export var_honcho_base_url="${var_honcho_base_url:-}"
+export var_honcho_model="${var_honcho_model:-}"
+export var_honcho_embedding_key="${var_honcho_embedding_key:-}"
+export var_honcho_embedding_model="${var_honcho_embedding_model:-}"
+export var_honcho_embedding_dims="${var_honcho_embedding_dims:-}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+if [[ -n "${var_honcho_provider}" && ! "${var_honcho_provider}" =~ ^(openai|anthropic|gemini)$ ]]; then
+  msg_error "var_honcho_provider must be openai, anthropic or gemini"
+  exit 1
+fi
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/honcho ]]; then
+    msg_error "No Honcho Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "honcho" "plastic-labs/honcho" "" "" "v"; then
+    msg_info "Stopping Honcho"
+    systemctl stop honcho-deriver honcho
+    msg_ok "Stopped Honcho"
+
+    PYTHON_VERSION="3.13" setup_uv
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP=".env" fetch_and_deploy_gh_release "honcho" "plastic-labs/honcho" "tarball" "latest" "/opt/honcho" "" "v"
+
+    msg_info "Updating Honcho"
+    cd /opt/honcho
+    $STD uv sync --frozen --no-dev
+    $STD .venv/bin/python scripts/provision_db.py
+    msg_ok "Updated Honcho"
+
+    if systemctl is-enabled -q honcho; then
+      msg_info "Starting Honcho"
+      systemctl start honcho honcho-deriver
+      msg_ok "Started Honcho"
+    fi
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access the API (interactive docs at /docs) using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8000${CL}"
+echo -e "${INFO}${YW}Admin key, sent as Authorization: Bearer <key> (more with: cd /opt/honcho && .venv/bin/python scripts/generate_jwt.py --admin):${CL}"
+echo -e "${INFO}${YW}Without an LLM provider key Honcho stays stopped: set one in /opt/honcho_data/.env, then run: systemctl enable --now honcho honcho-deriver${CL}"
@@ -65,19 +65,17 @@ EOF
    msg_ok "Installed/upgraded Testing repo packages"
  fi

-  if [[ ! -f /etc/apt/sources.list.d/mise.list ]]; then
-    msg_info "Installing Mise"
-    curl -fSs https://mise.jdx.dev/gpg-key.pub | tee /etc/apt/keyrings/mise-archive-keyring.pub 1>/dev/null
-    echo "deb [signed-by=/etc/apt/keyrings/mise-archive-keyring.pub arch=$(arch_resolve)] https://mise.jdx.dev/deb stable main" >/etc/apt/sources.list.d/mise.list
-    ensure_dependencies mise
-    msg_ok "Installed Mise"
+  if ! command -v mise >/dev/null 2>&1; then
+    MISE_ARCH="x64"
+    [[ "$(arch_resolve)" == "arm64" ]] && MISE_ARCH="arm64"
+    fetch_and_deploy_gh_release "mise" "jdx/mise" "singlefile" "latest" "/usr/local/bin" "mise-v*-linux-${MISE_ARCH}"
  fi

  STAGING_DIR=/opt/staging
  BASE_DIR=${STAGING_DIR}/base-images
  SOURCE_DIR=${STAGING_DIR}/image-source
  cd /tmp
-  RELEASE="v3.3.4"
+  RELEASE="v3.3.5"
  if [[ -f ~/.intel_version ]]; then
    INTEL_SRC="https://raw.githubusercontent.com/immich-app/immich/${RELEASE}/machine-learning"
    curl -fsSL "${INTEL_SRC}/scripts/install-intel-runtime.sh" -o ./intel-runtime 2>/dev/null ||
@@ -235,6 +233,7 @@ EOF
    cd "$SRC_DIR"
    export MISE_TRUSTED_CONFIG_PATHS="$SRC_DIR"/mise.toml
    export MISE_DISABLE_TOOLS=github:jellyfin/jellyfin-ffmpeg
+    export MISE_LOCKFILE_MODE=merge MISE_LOCKFILE_PLATFORMS="linux-$(arch_resolve x64 arm64)"
    mise_ok=0
    for i in 1 2 3; do
      $STD mise install && {
@@ -31,6 +31,14 @@ function update_script() {
    exit
  fi

+  if [[ ! -f /etc/cron.d/invoiceshelf ]]; then
+    msg_info "Adding the Laravel scheduler"
+    cat <<'EOF' >/etc/cron.d/invoiceshelf
+* * * * * www-data cd /opt/invoiceshelf && php artisan schedule:run >> /dev/null 2>&1
+EOF
+    msg_ok "Added the Laravel scheduler"
+  fi
+
  if check_for_gh_release "invoiceshelf" "InvoiceShelf/InvoiceShelf"; then
    msg_info "Stopping Services"
    systemctl stop caddy
@@ -96,6 +96,12 @@ EOF
  exit
 }

+if [[ ! -d /opt/jellyseerr ]]; then
+  msg_error "Jellyseerr is now Seerr and can no longer be installed with this script."
+  msg_warn "Install Seerr instead: https://community-scripts.org/scripts/seerr"
+  exit 1
+fi
+
 start
 build_container
 description
@@ -64,6 +64,7 @@ function update_script() {
    $STD yarn prisma:deploy
    rm -rf ~/.cargo/registry ~/.cargo/git ~/.cargo/.package-cache
    rm -rf /root/.cache/yarn
+    rm -rf /root/.yarn/berry/cache
    rm -rf /opt/linkwarden/.next/cache
    msg_ok "Updated Linkwarden"

@@ -30,6 +30,9 @@ function update_script() {
    msg_error "No ${APP} Installation Found!"
    exit
  fi
+
+  ensure_dependencies ffmpeg
+
  if check_for_gh_release "mealie" "mealie-recipes/mealie"; then

    msg_info "Stopping Service"
@@ -22,18 +22,40 @@ color
 catch_errors

 function update_script() {
-    header_info
-    check_container_storage
-    check_container_resources
-    if [[ ! -d /opt/meshcentral ]]; then
-        msg_error "No ${APP} Installation Found!"
-        exit
-    fi
-    msg_info "Updating ${APP} LXC"
-    apt_update_safe
-    $STD apt -y upgrade
-    msg_ok "Updated successfully!"
+  header_info
+  check_container_storage
+  check_container_resources
+  if [[ ! -d /opt/meshcentral ]]; then
+    msg_error "No ${APP} Installation Found!"
    exit
+  fi
+
+  NODE_VERSION="24" setup_nodejs
+
+  CURRENT=$(node -p "require('/opt/meshcentral/node_modules/meshcentral/package.json').version" 2>/dev/null)
+  LATEST=$(npm view meshcentral version 2>/dev/null)
+  if [[ -z "$LATEST" ]]; then
+    msg_error "Could not determine the latest MeshCentral version from npm"
+    exit 250
+  fi
+  if [[ "$CURRENT" != "$LATEST" ]]; then
+    msg_info "Stopping Service"
+    systemctl stop meshcentral
+    msg_ok "Stopped Service"
+
+    msg_info "Updating ${APP} from v${CURRENT} to v${LATEST}"
+    cd /opt/meshcentral
+    $STD npm install "meshcentral@${LATEST}"
+    msg_ok "Updated ${APP} to v${LATEST}"
+
+    msg_info "Starting Service"
+    systemctl start meshcentral
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  else
+    msg_ok "${APP} is already at v${CURRENT}"
+  fi
+  exit
 }

 start
@@ -34,12 +34,15 @@ function update_script() {
  NODE_VERSION="24" setup_nodejs

  if check_for_gh_release "omnitools" "iib0011/omni-tools"; then
+    ensure_dependencies git
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "omnitools" "iib0011/omni-tools" "tarball"

    msg_info "Building OmniTools"
    cd /opt/omnitools
    export HUSKY=0
    $STD npm ci --allow-remote=all
+    $STD git init -q
+    $STD git -c user.name=build -c user.email=build@localhost commit -q --allow-empty -m build
    $STD npm run build
    msg_ok "Built OmniTools"

@@ -44,7 +44,7 @@ function update_script() {
    $STD npm ci --legacy-peer-deps --ignore-scripts
    $STD npm run build:icons
    $STD npx prisma generate
-    NODE_OPTIONS="--max-old-space-size=4608" $STD npm run build
+    PROXCENTER_SKIP_TYPECHECK=1 NODE_OPTIONS="--max-old-space-size=3072" $STD npm run build
    msg_ok "Built ProxCenter"

    msg_info "Migrating Database"
@@ -86,7 +86,7 @@ EOF

    msg_info "Updating SnapOtter"
    $STD uv python install 3.11
-    $STD uv venv --seed --python 3.11 /opt/snapotter_data/ai/venv
+    $STD uv venv --clear --seed --python 3.11 /opt/snapotter_data/ai/venv
    if [[ "$(arch_resolve)" == "arm64" ]]; then
      $STD uv pip install --python /opt/snapotter_data/ai/venv/bin/python \
        numpy==1.26.4 Pillow==12.3.0 opencv-python-headless==4.10.0.84 fonttools \
@@ -9,7 +9,7 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 APP="SparkyFitness"
 var_tags="${var_tags:-health;fitness}"
 var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
+var_ram="${var_ram:-4096}"
 var_disk="${var_disk:-7}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
@@ -31,42 +31,75 @@ function update_script() {
    exit
  fi

-  NODE_VERSION="24" NODE_MODULE="corepack,yarn" setup_nodejs
+  NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs

  if check_for_gl_release "storyteller" "storyteller-platform/storyteller" "" "" "web-v2"; then
    msg_info "Stopping Service"
    systemctl stop storyteller
    msg_ok "Stopped Service"

+    ensure_dependencies cmake argon2 libcurl4t64 libxml2
+    fetch_and_deploy_gh_release "readium" "readium/cli" "prebuild" "v0.9.1" "/opt/readium" "readium_linux_$(arch_resolve "x86_64" "arm64").tar.gz"
+
    create_backup /opt/storyteller/.env
-
-    CLEAN_INSTALL=1 fetch_and_deploy_gl_release "storyteller" "storyteller-platform/storyteller" "tarball" "latest" "/opt/storyteller" "" "web-v2"
-
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="data" fetch_and_deploy_gl_release "storyteller" "storyteller-platform/storyteller" "tarball" "latest" "/opt/storyteller" "" "web-v2"
    restore_backup

-    msg_info "Rebuilding Storyteller"
+    msg_info "Building Storyteller (Patience)"
    cd /opt/storyteller
-    export NODE_OPTIONS="--max-old-space-size=4096"
-
-    $STD corepack yarn install --network-timeout 600000
-    $STD gcc -g -fPIC -rdynamic -shared web/sqlite/uuid.c -o web/sqlite/uuid.c.so
-    export CI=1
+    $STD corepack yarn install
    export NODE_ENV=production
    export NEXT_TELEMETRY_DISABLED=1
    export SQLITE_NATIVE_BINDING=/opt/storyteller/node_modules/better-sqlite3/build/Release/better_sqlite3.node
    $STD corepack yarn workspaces foreach -Rpt --from @storyteller-platform/web --exclude @storyteller-platform/eslint run build
-    mkdir -p /opt/storyteller/web/.next/standalone/web/.next/static
-    cp -rT /opt/storyteller/web/.next/static /opt/storyteller/web/.next/standalone/web/.next/static
-    if [[ -d /opt/storyteller/web/public ]]; then
-      mkdir -p /opt/storyteller/web/.next/standalone/web/public
-      cp -rT /opt/storyteller/web/public /opt/storyteller/web/.next/standalone/web/public
+    STANDALONE=/opt/storyteller/applications/web/.next/standalone
+    WEB_DIR="$STANDALONE/applications/web"
+    mkdir -p "$WEB_DIR"/{public,.next/static,.next/cache,migrations,sqlite,scripts}
+    cp -rT applications/web/public "$WEB_DIR/public"
+    cp -rT applications/web/.next/static "$WEB_DIR/.next/static"
+    cp -rT applications/web/migrations "$WEB_DIR/migrations"
+    cp applications/web/sqlite/uuid.c.so "$WEB_DIR/sqlite/"
+    cp docker-scripts/reset-password.sh "$WEB_DIR/scripts/"
+    cp -r applications/web/work-dist applications/web/file-write-dist "$WEB_DIR/"
+    mkdir -p "$WEB_DIR/work-dist/@storyteller-platform/align/prebuilds"
+    cp -r "libraries/align/prebuilds/linux-$(arch_resolve "x64" "arm64")" "$WEB_DIR/work-dist/@storyteller-platform/align/prebuilds/"
+    cp node_modules/@echogarden/icu-segmentation-wasm/wasm/*.wasm "$WEB_DIR/work-dist/"
+    cp -rT node_modules/@parcel "$STANDALONE/node_modules/@parcel"
+    cp -rT node_modules/kuromoji "$STANDALONE/node_modules/kuromoji"
+    ln -sf /opt/storyteller/.env "$WEB_DIR/.env"
+    msg_ok "Built Storyteller"
+
+    msg_info "Updating Whisper"
+    WHISPER_VARIANT="linux-$(arch_resolve "x64" "arm64")-cpu"
+    $STD node /opt/storyteller/libraries/ghost-story/dist/cli/bin.js install binary "$WHISPER_VARIANT"
+    $STD node /opt/storyteller/libraries/ghost-story/dist/cli/bin.js install model tiny.en
+    if [[ "$WHISPER_VARIANT" == "linux-x64-cpu" ]]; then
+      $STD node /opt/storyteller/libraries/ghost-story/dist/cli/bin.js install binary linux-x64-cpu-legacy
    fi
-    mkdir -p /opt/storyteller/web/.next/standalone/web/migrations
-    cp -rT /opt/storyteller/web/migrations /opt/storyteller/web/.next/standalone/web/migrations
-    mkdir -p /opt/storyteller/web/.next/standalone/web/sqlite
-    cp -rT /opt/storyteller/web/sqlite /opt/storyteller/web/.next/standalone/web/sqlite
-    ln -sf /opt/storyteller/.env /opt/storyteller/web/.next/standalone/web/.env
-    msg_ok "Rebuilt Storyteller"
+    msg_ok "Updated Whisper"
+
+    cat <<EOF >/etc/systemd/system/storyteller.service
+[Unit]
+Description=Storyteller
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=${WEB_DIR}
+EnvironmentFile=/opt/storyteller/.env
+Environment=SQLITE_NATIVE_BINDING=${STANDALONE}/node_modules/better-sqlite3/build/Release/better_sqlite3.node
+Environment=ERROR_ALIGN_NATIVE_BINDING=${WEB_DIR}/work-dist/@storyteller-platform/align/
+Environment=STORYTELLER_WORKER=worker.mjs
+Environment=STORYTELLER_FILE_WRITE_WORKER=fileWriteWorker.mjs
+ExecStart=/usr/bin/node --enable-source-maps server.js
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+    systemctl daemon-reload

    msg_info "Starting Service"
    systemctl start storyteller
@@ -75,7 +108,6 @@ function update_script() {
  fi
  exit
 }
-
 start
 build_container
 description
@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/fredrikburmester/streamystats
+
+APP="Streamystats"
+var_tags="${var_tags:-analytics;jellyfin}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-3072}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/streamystats ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "streamystats" "fredrikburmester/streamystats"; then
+    msg_info "Stopping Streamystats"
+    systemctl stop streamystats-nextjs-app streamystats-job-server
+    msg_ok "Stopped Streamystats"
+
+    msg_info "Updating Bun"
+    $STD bun upgrade
+    msg_ok "Updated Bun"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "streamystats" "fredrikburmester/streamystats" "tarball"
+
+    msg_info "Building Streamystats"
+    cd /opt/streamystats
+    $STD bun install --frozen-lockfile
+    NEXT_TELEMETRY_DISABLED=1 NEXT_PUBLIC_VERSION="v$(cat ~/.streamystats)" $STD bun run build
+    msg_ok "Built Streamystats"
+
+    msg_info "Migrating Streamystats Database"
+    $STD bun --env-file=/opt/streamystats_data/.env run db:migrate
+    msg_ok "Migrated Streamystats Database"
+
+    msg_info "Starting Streamystats"
+    systemctl start streamystats-job-server streamystats-nextjs-app
+    msg_ok "Started Streamystats"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"
@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/stumpapp/stump
+
+APP="Stump"
+var_tags="${var_tags:-comics;manga;ebook}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-1024}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/stump ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "stump" "stumpapp/stump"; then
+    msg_info "Stopping Stump"
+    systemctl stop stump
+    msg_ok "Stopped Stump"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "stump" "stumpapp/stump" "prebuild" "latest" "/opt/stump" "linux-build-results.zip"
+    chmod +x /opt/stump/stump_server
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "pdfium" "bblanchon/pdfium-binaries" "prebuild" "latest" "/opt/pdfium" "pdfium-linux-x64.tgz"
+
+    msg_info "Starting Stump"
+    systemctl start stump
+    msg_ok "Started Stump"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:10801${CL}"
@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Gimanh/taskview-community
+
+APP="TaskView"
+var_tags="${var_tags:-project-management;tasks;kanban}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-6144}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/taskview ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "taskview" "Gimanh/taskview-community"; then
+    msg_info "Stopping TaskView"
+    systemctl stop taskview
+    msg_ok "Stopped TaskView"
+
+    NODE_VERSION="24" NODE_MODULE="pnpm" setup_nodejs
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "taskview" "Gimanh/taskview-community" "tarball"
+
+    msg_info "Building TaskView"
+    cd /opt/taskview
+    $STD pnpm install --frozen-lockfile
+    cd /opt/taskview/api
+    $STD pnpm run build:docker
+    $STD pnpm run build:migration
+    cp -r src/migrations/taskview dist-migration/
+    cd /opt/taskview/web
+    $STD pnpm run build:packages
+    $STD pnpm run build-only
+    msg_ok "Built TaskView"
+
+    msg_info "Migrating TaskView Database"
+    cd /opt/taskview_data
+    $STD node /opt/taskview/api/dist-migration/taskview-db-migration.js
+    msg_ok "Migrated TaskView Database"
+
+    msg_info "Starting TaskView"
+    systemctl start taskview
+    msg_ok "Started TaskView"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}${CL}"
@@ -108,6 +108,12 @@ EOF
  fi

  if check_for_gh_release "termix" "Termix-SSH/Termix"; then
+    TERMIX_RELEASE="latest"
+    if [[ "$CS_PREVIOUS_VERSION" =~ ^(release-)?([0-9]+)\.([0-9]+)\. ]] && ((BASH_REMATCH[2] * 100 + BASH_REMATCH[3] < 209)); then
+      TERMIX_RELEASE="release-2.9.2-tag"
+      msg_warn "Termix ${CS_PREVIOUS_VERSION} has to run 2.9.2 once before newer releases accept its database"
+    fi
+
    msg_info "Stopping Termix"
    systemctl stop termix
    msg_ok "Stopped Termix"
@@ -165,7 +171,7 @@ EOF

    create_backup /opt/termix/.env

-    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="db/data data uploads" fetch_and_deploy_gh_release "termix" "Termix-SSH/Termix" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="db/data data uploads" fetch_and_deploy_gh_release "termix" "Termix-SSH/Termix" "tarball" "$TERMIX_RELEASE"

    restore_backup

@@ -258,12 +264,24 @@ EOF

    msg_info "Starting Termix"
    systemctl daemon-reload
+    TERMIX_START=$(date +%s)
    if ! systemctl start termix; then
      msg_error "Termix failed to start"
      journalctl -u termix -n 30 --no-pager || true
      exit 1
    fi
    msg_ok "Started Termix"
+    if [[ "$TERMIX_RELEASE" != "latest" ]]; then
+      msg_info "Waiting for Termix 2.9.2 to migrate the database"
+      if ! timeout 300 bash -c "until journalctl -u termix --since @${TERMIX_START} --no-pager | grep -q 'Termix backend started successfully'; do sleep 2; done"; then
+        msg_error "Termix 2.9.2 did not finish starting, so the database was not migrated"
+        journalctl -u termix -n 30 --no-pager || true
+        exit 1
+      fi
+      msg_ok "Migrated the database with Termix 2.9.2"
+      msg_warn "Run update again to continue to the current Termix release"
+      exit
+    fi
    msg_ok "Updated successfully!"
  fi
  exit
@@ -9,7 +9,7 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 APP="TREK"
 var_tags="${var_tags:-travel;planning;collaboration}"
 var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
+var_ram="${var_ram:-4096}"
 var_disk="${var_disk:-8}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
@@ -43,6 +43,7 @@ function update_script() {
    msg_ok "Stopped Service"

    ensure_dependencies "libkitinerary-bin"
+    ln -sf "$(find /usr/lib -name kitinerary-extractor -type f | head -1)" /usr/local/bin/kitinerary-extractor

    create_backup /opt/trek/server/.env \
      /opt/trek/data \
@@ -52,7 +53,7 @@ function update_script() {

    msg_info "Building TREK"
    cd /opt/trek
-    $STD npm ci
+    $STD npm ci --ignore-scripts
    $STD npm run build --workspace=shared
    $STD npm run build --workspace=client
    $STD npm run build --workspace=server
@@ -72,7 +73,7 @@ function update_script() {

    rm -rf /opt/trek/node_modules
    cd /opt/trek
-    $STD npm ci --workspace=server --omit=dev
+    $STD npm ci --workspace=server --omit=dev --ignore-scripts
    msg_ok "Set up TREK Workspace"

    if [[ "$MIGRATION" == "1" ]]; then
@@ -71,6 +71,41 @@ EOF

    restore_backup

+    if grep -q '^TA_BACKEND_PORT=' /opt/tubearchivist/.env 2>/dev/null; then
+      msg_info "Migrating to v0.6.0 (dropping Nginx)"
+      systemctl disable -q --now nginx
+      $STD apt autoremove --purge -y nginx
+      sed -i 's/^TA_BACKEND_PORT=.*/TA_PORT=8000/' /opt/tubearchivist/.env
+      cat <<'RUNEOF' >/opt/tubearchivist/backend/run.sh
+#!/bin/bash
+set -e
+cd /opt/tubearchivist/backend
+set -a
+source /opt/tubearchivist/.env
+set +a
+PYTHON=/opt/tubearchivist/.venv/bin/python
+
+echo "Waiting for ElasticSearch..."
+for i in $(seq 1 30); do
+  if curl -sf http://localhost:9200/_cluster/health >/dev/null 2>&1; then
+    break
+  fi
+  sleep 2
+done
+
+$PYTHON manage.py ta_stop_on_error
+$PYTHON manage.py migrate
+$PYTHON manage.py collectstatic --noinput -c
+$PYTHON manage.py ta_envcheck
+$PYTHON manage.py ta_connection
+$PYTHON manage.py ta_startup
+
+exec $PYTHON backend_start.py
+RUNEOF
+      chmod +x /opt/tubearchivist/backend/run.sh
+      msg_ok "Migrated to v0.6.0 (dropping Nginx)"
+    fi
+
    msg_info "Rebuilding Tube Archivist"
    cd /opt/tubearchivist/frontend
    $STD npm install
@@ -113,7 +148,6 @@ EOF

    msg_info "Starting Services"
    systemctl start bgutil-provider tubearchivist tubearchivist-celery tubearchivist-beat
-    systemctl reload nginx
    msg_ok "Started Services"
    msg_ok "Updated successfully!"
  fi
@@ -128,3 +162,5 @@ msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
 echo -e "${GATEWAY}${BGN}http://${IP}:8000${CL}"
+echo -e "${INFO}${YW}Admin credentials saved to ~/tubearchivist.creds${CL}"
+echo -e "${INFO}${YW}The WebUI may take a couple of minutes to become available on first start, while Elasticsearch and the backend initialize.${CL}"
@@ -0,0 +1,89 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/ItzCrazyKns/Vane
+
+APP="Vane"
+var_tags="${var_tags:-ai;search}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-12}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/vane ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "vane" "ItzCrazyKns/Vane"; then
+    msg_info "Stopping Vane"
+    systemctl stop vane
+    msg_ok "Stopped Vane"
+
+    NODE_VERSION="24" NODE_MODULE="yarn" setup_nodejs
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "vane" "ItzCrazyKns/Vane" "tarball"
+
+    msg_info "Building Vane"
+    cd /opt/vane
+    $STD yarn install --frozen-lockfile --network-timeout 600000
+    $STD yarn build
+    $STD yarn cache clean
+    rm -rf .next/cache
+    cp -r public .next/standalone/
+    cp -r .next/static .next/standalone/.next/
+    cp -r drizzle .next/standalone/
+    ln -s /opt/vane_data .next/standalone/data
+    $STD npx playwright install --with-deps --only-shell chromium
+    msg_ok "Built Vane"
+
+    msg_info "Starting Vane"
+    systemctl start vane
+    msg_ok "Started Vane"
+    msg_ok "Updated Vane successfully!"
+  fi
+
+  if check_for_gh_branch "searxng" "searxng/searxng" "master"; then
+    msg_info "Stopping SearXNG"
+    systemctl stop searxng
+    msg_ok "Stopped SearXNG"
+
+    PYTHON_VERSION="3.13" setup_uv
+    fetch_and_deploy_gh_branch "searxng" "searxng/searxng" "master"
+
+    msg_info "Updating SearXNG"
+    cd /opt/searxng
+    $STD uv pip install -p /opt/searxng/.venv/bin/python -r requirements.txt -r requirements-server.txt
+    msg_ok "Updated SearXNG"
+
+    msg_info "Starting SearXNG"
+    systemctl start searxng
+    msg_ok "Started SearXNG"
+    msg_ok "Updated SearXNG successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"
@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/arabcoders/ytptube
+
+APP="YTPTube"
+var_tags="${var_tags:-media;youtube;downloader}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-3072}"
+var_disk="${var_disk:-20}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_gpu="${var_gpu:-yes}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/ytptube ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  fetch_and_deploy_gh_release "deno" "denoland/deno" "prebuild" "latest" "/usr/local/bin" "deno-$(arch_resolve "x86_64" "aarch64")-unknown-linux-gnu.zip"
+
+  if check_for_gh_release "ytptube" "arabcoders/ytptube"; then
+    msg_info "Stopping YTPTube"
+    systemctl stop ytptube
+    msg_ok "Stopped YTPTube"
+
+    NODE_VERSION="24" NODE_MODULE="bun" setup_nodejs
+    PYTHON_VERSION="3.13" setup_uv
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "ytptube" "arabcoders/ytptube" "tarball"
+
+    msg_info "Building YTPTube"
+    cd /opt/ytptube/ui
+    $STD bun install --frozen-lockfile --production
+    NODE_ENV=production $STD bun run generate
+    rm -rf /opt/ytptube/ui/node_modules
+    cd /opt/ytptube
+    sed -i "s/^APP_VERSION = .*/APP_VERSION = \"v$(cat ~/.ytptube)\"/" app/library/version.py
+    $STD uv sync --locked --no-dev
+    $STD uv pip install --python .venv/bin/python pip
+    msg_ok "Built YTPTube"
+
+    msg_info "Starting YTPTube"
+    systemctl start ytptube
+    msg_ok "Started YTPTube"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8081${CL}"
+echo -e "${INFO}${YW}The first visitor creates the admin account - open the URL right away${CL}"
@@ -46,24 +46,36 @@ function update_script() {
    msg_warn "No Zabbix Agent service found, skipping agent actions"
  fi

+  ZABBIX_SERIES="$(dpkg-query -W -f='${Version}' zabbix-release 2>/dev/null || true)"
+  ZABBIX_SERIES="${ZABBIX_SERIES#*:}"
+  ZABBIX_SERIES="${ZABBIX_SERIES%%[!0-9.]*}"
+  if [[ "${PHS_SILENT:-0}" == "1" ]]; then
+    if [[ ! "$ZABBIX_SERIES" =~ ^[0-9]+\.[0-9]+$ ]]; then
+      msg_warn "Could not detect the installed Zabbix series - skipping update, requires an interactive run"
+      exit 75
+    fi
+    ZABBIX_VERSION="$ZABBIX_SERIES"
+    msg_warn "Unattended update: staying on Zabbix ${ZABBIX_VERSION}"
+  else
+    read -rp "Choose Zabbix version [1] 7.0 LTS  [2] 7.4 (Latest Stable)  [3] Latest available (default: 2): " ZABBIX_CHOICE
+    ZABBIX_CHOICE=${ZABBIX_CHOICE:-2}
+    case "$ZABBIX_CHOICE" in
+    1) ZABBIX_VERSION="7.0" ;;
+    2) ZABBIX_VERSION="7.4" ;;
+    3) ZABBIX_VERSION=$(curl -fsSL https://repo.zabbix.com/zabbix/ |
+      grep -oP '(?<=href=")[0-9]+\.[0-9]+(?=/")' | sort -V | tail -n1) ;;
+    *)
+      ZABBIX_VERSION="7.4"
+      echo "Invalid choice. Defaulting to 7.4."
+      ;;
+    esac
+  fi
+
  msg_info "Stopping Services"
  systemctl stop zabbix-server
  [[ -n "$AGENT_SERVICE" ]] && systemctl stop "$AGENT_SERVICE"
  msg_ok "Stopped Services"

-  read -rp "Choose Zabbix version [1] 7.0 LTS  [2] 7.4 (Latest Stable)  [3] Latest available (default: 2): " ZABBIX_CHOICE
-  ZABBIX_CHOICE=${ZABBIX_CHOICE:-2}
-  case "$ZABBIX_CHOICE" in
-  1) ZABBIX_VERSION="7.0" ;;
-  2) ZABBIX_VERSION="7.4" ;;
-  3) ZABBIX_VERSION=$(curl -fsSL https://repo.zabbix.com/zabbix/ |
-    grep -oP '(?<=href=")[0-9]+\.[0-9]+(?=/")' | sort -V | tail -n1) ;;
-  *)
-    ZABBIX_VERSION="7.4"
-    echo "Invalid choice. Defaulting to 7.4."
-    ;;
-  esac
-
  msg_info "Updating Zabbix to $ZABBIX_VERSION"
  mkdir -p /opt/zabbix-backup/
  cp /etc/zabbix/zabbix_server.conf /opt/zabbix-backup/
@@ -73,8 +85,10 @@ function update_script() {
  rm -Rf /etc/apt/sources.list.d/zabbix.list
  cd /tmp

+  ZABBIX_REPO_DIR="debian"
+  [[ "$ZABBIX_VERSION" == "7.0" && "$(arch_resolve)" == "arm64" ]] && ZABBIX_REPO_DIR="debian-arm64"
  if [[ "$ZABBIX_VERSION" == "7.0" ]]; then
-    ZABBIX_DEB_URL="https://repo.zabbix.com/zabbix/${ZABBIX_VERSION}/debian/pool/main/z/zabbix-release/zabbix-release_latest_${ZABBIX_VERSION}+debian13_all.deb"
+    ZABBIX_DEB_URL="https://repo.zabbix.com/zabbix/${ZABBIX_VERSION}/${ZABBIX_REPO_DIR}/pool/main/z/zabbix-release/zabbix-release_latest_${ZABBIX_VERSION}+debian13_all.deb"
    ZABBIX_DEB_FILE="zabbix-release_latest_${ZABBIX_VERSION}+debian13_all.deb"
  else
    ZABBIX_DEB_URL="https://repo.zabbix.com/zabbix/${ZABBIX_VERSION}/release/debian/pool/main/z/zabbix-release/zabbix-release_latest+debian13_all.deb"
@@ -12,6 +12,11 @@ setting_up_container
 network_check
 update_os

+if is_debian && [[ "$(get_os_version_major)" -lt 13 ]]; then
+  msg_error "Apache Guacamole needs Debian 13: freerdp3-dev is not available on Debian 12."
+  exit 238
+fi
+
 msg_info "Installing Dependencies"
 $STD apt install -y \
  build-essential \
@@ -13,12 +13,14 @@ setting_up_container
 network_check
 update_os

-read -r -p "${TAB3}Which Tomcat version would you like to install? (9, 10.1, 11): " version
+version="${var_apache_tomcat_version:-}"
+[[ -n "$version" ]] || read -r -p "${TAB3}Which Tomcat version would you like to install? (9, 10.1, 11): " version || true
+jdk_version="${var_apache_tomcat_jdk_version:-}"
 case $version in
 9)
  TOMCAT_VERSION="9"
  echo "Which LTS Java version would you like to use? (8, 11, 17, 21): "
-  read -r jdk_version
+  [[ -n "$jdk_version" ]] || read -r jdk_version || true
  case $jdk_version in
  8 | 11 | 17 | 21)
    JAVA_VERSION="$jdk_version" setup_java
@@ -32,7 +34,7 @@ case $version in
 10 | 10.1)
  TOMCAT_VERSION="10"
  echo "Which LTS Java version would you like to use? (11, 17, 21): "
-  read -r jdk_version
+  [[ -n "$jdk_version" ]] || read -r jdk_version || true
  case $jdk_version in
  11 | 17 | 21)
    JAVA_VERSION="$jdk_version" setup_java
@@ -46,7 +48,7 @@ case $version in
 11)
  TOMCAT_VERSION="11"
  echo "Which LTS Java version would you like to use? (17, 21): "
-  read -r jdk_version
+  [[ -n "$jdk_version" ]] || read -r jdk_version || true
  case $jdk_version in
  17 | 21)
    JAVA_VERSION="$jdk_version" setup_java
@@ -18,7 +18,7 @@ $STD apt install -y aria2
 msg_ok "Installed Aria2"

 prompt="${var_aria2_ariang:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add AriaNG? <y/N> " prompt
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add AriaNG? <y/N> " prompt || true
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  msg_info "Installing Dependencies"
  $STD apt install -y nginx
@@ -47,7 +47,8 @@ Choose Asterisk version to install:
 2) Latest LTS ($LTS_VERSION)
 3) Latest Certified ($CERT_VERSION)
 EOF
-read -rp "Enter choice [1-3]: " ASTERISK_CHOICE
+ASTERISK_CHOICE="${var_asterisk_version:-}"
+[[ -n "$ASTERISK_CHOICE" ]] || read -rp "Enter choice [1-3]: " ASTERISK_CHOICE || true

 CERTIFIED=0
 case "$ASTERISK_CHOICE" in
@@ -17,9 +17,10 @@ fetch_and_deploy_gh_release "authelia" "authelia/authelia" "binary"

 MAX_ATTEMPTS=3
 attempt=0
+DOMAIN="${var_authelia_domain:-}"
 while true; do
  attempt=$((attempt + 1))
-  read -rp "${TAB3}Enter your domain or IP (ex. example.com or 192.168.1.100): " DOMAIN
+  [[ -n "$DOMAIN" ]] || read -rp "${TAB3}Enter your domain or IP (ex. example.com or 192.168.1.100): " DOMAIN || true
  if [[ -z "$DOMAIN" ]]; then
    if ((attempt >= MAX_ATTEMPTS)); then
      DOMAIN="${LOCAL_IP:-localhost}"
@@ -40,11 +41,13 @@ while true; do
      break
    else
      msg_warn "Invalid IP address!"
+      DOMAIN=""
    fi
  elif [[ "$DOMAIN" =~ ^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*\.[a-zA-Z]{2,}$ ]]; then
    break
  else
    msg_warn "Invalid domain format!"
+    DOMAIN=""
  fi
 done
 msg_info "Setting Authelia up"
@@ -57,7 +57,7 @@ PG_VERSION="17" setup_postgresql
 PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db

 XMLSEC_VERSION="1.3.12"
-AUTHENTIK_VERSION="version/2026.8.4"
+AUTHENTIK_VERSION="version/2026.8.5"
 fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec"
 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
 GO_VERSION="$(grep -m1 '^go ' /opt/authentik/go.mod | awk '{print $2}')" setup_go
@@ -52,6 +52,7 @@ $STD php artisan key:generate
 touch storage/bar-assistant/database.ba3.sqlite
 $STD php artisan migrate --force
 $STD php artisan storage:link
+$STD php artisan starter-media:publish
 $STD php artisan bar:setup-meilisearch
 $STD php artisan scout:sync-index-settings
 $STD php artisan config:cache
@@ -15,7 +15,8 @@ update_os

 fetch_and_deploy_gh_release "bichon" "rustmailer/bichon" "prebuild" "latest" "/opt/bichon" "bichon-*-$(arch_resolve "x86_64" "aarch64")-unknown-linux-gnu.tar.gz"

-read -r -p "${TAB3}Enter the public URL for Bichon (e.g., https://bichon.yourdomain.com) or leave empty to use container IP: " bichon_url
+bichon_url="${var_bichon_url:-}"
+[[ -n "$bichon_url" ]] || read -r -p "${TAB3}Enter the public URL for Bichon (e.g., https://bichon.yourdomain.com) or leave empty to use container IP: " bichon_url || true
 if [[ -z "$bichon_url" ]]; then
  msg_info "No URL provided"
  BICHON_PUBLIC_URL="http://$LOCAL_IP:15630"
@@ -34,7 +34,8 @@ setup_deb_based() {
  chmod +x bitmagnet
  msg_ok "Configured bitmagnet"

-  read -r -p "${TAB3}Enter your TMDB API key if you have one: " tmdbapikey
+  tmdbapikey="${var_bitmagnet_tmdb_api_key:-}"
+  [[ -n "$tmdbapikey" ]] || read -r -p "${TAB3}Enter your TMDB API key if you have one: " tmdbapikey || true

  cat <<EOF >/etc/bitmagnet.env
 POSTGRES_HOST=localhost
@@ -99,7 +100,8 @@ setup_alpine() {
  $STD su - postgres -c "psql -c 'CREATE DATABASE bitmagnet;'"
  msg_ok "Built bitmagnet"

-  read -rp "${TAB3}Enter your TMDB API key if you have one: " tmdbapikey
+  tmdbapikey="${var_bitmagnet_tmdb_api_key:-}"
+  [[ -n "$tmdbapikey" ]] || read -rp "${TAB3}Enter your TMDB API key if you have one: " tmdbapikey || true

  msg_info "Enabling bitmagnet Service"
  cat <<EOF >/etc/init.d/bitmagnet
@@ -25,7 +25,7 @@ $STD npm install
 msg_ok "Installed ByteStash"

 allowreg="${var_bytestash_registration:-}"
-[[ -n "$allowreg" ]] || read -rp "${TAB3}Do you want to allow registration of multiple accounts? [y/n]: " allowreg
+[[ -n "$allowreg" ]] || read -rp "${TAB3}Do you want to allow registration of multiple accounts? [y/n]: " allowreg || true

 msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/bytestash-backend.service
@@ -18,7 +18,7 @@ setup_deb_based() {
  systemctl enable -q --now caddy

  prompt="${var_caddy_xcaddy:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install xCaddy Addon? <y/N> " prompt
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install xCaddy Addon? <y/N> " prompt || true
  if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
    setup_go
    fetch_and_deploy_gh_release "xcaddy" "caddyserver/xcaddy" "binary"
@@ -64,7 +64,7 @@ EOF
  msg_ok "Installed Caddy"

  prompt="${var_caddy_xcaddy:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install xCaddy Addon? <y/N> " prompt
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install xCaddy Addon? <y/N> " prompt || true
  if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
    GO_VERSION="$(curl -fsSL https://go.dev/VERSION?m=text | head -1 | cut -c3-)" setup_go
    fetch_and_deploy_gh_release "xcaddy" "caddyserver/xcaddy" "prebuild" "latest" "/opt/xcaddy" "xcaddy_*_linux_$(arch_resolve).tar.gz"
@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/casdoor/casdoor
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+PG_VERSION="17" setup_postgresql
+PG_DB_NAME="casdoor" PG_DB_USER="casdoor" setup_postgresql_db
+
+fetch_and_deploy_gh_release "casdoor" "casdoor/casdoor" "prebuild" "latest" "/opt/casdoor" "casdoor_Linux_$(arch_resolve "x86_64" "arm64").tar.gz"
+
+msg_info "Configuring Casdoor"
+mkdir -p /opt/casdoor_data/conf
+cat <<EOF >/opt/casdoor_data/conf/app.conf
+appname = casdoor
+httpport = 8000
+runmode = prod
+copyrequestbody = true
+driverName = postgres
+dataSourceName = user=casdoor password=${PG_DB_PASS} host=localhost port=5432 sslmode=disable dbname=casdoor
+dbName = casdoor
+tableNamePrefix =
+showSql = false
+redisEndpoint =
+defaultStorageProvider =
+isCloudIntranet = false
+authState = "casdoor"
+socks5Proxy =
+verificationCodeTimeout = 10
+initScore = 0
+logPostOnly = true
+isUsernameLowered = false
+origin = http://${LOCAL_IP}:8000
+originFrontend =
+staticBaseUrl = "https://cdn.casbin.org"
+isDemoMode = false
+batchSize = 100
+showGithubCorner = false
+forceLanguage = ""
+defaultLanguage = "en"
+defaultApplication = "app-built-in"
+maxItemsForFlatMenu = 7
+enableErrorMask = false
+enableGzip = true
+inactiveTimeoutMinutes =
+ldapServerPort = 389
+ldapsCertId = ""
+ldapsServerPort = 636
+radiusServerPort = 1812
+radiusDefaultOrganization = "built-in"
+radiusSecret = "$(random_password)"
+quota = {"organization": -1, "user": -1, "application": -1, "provider": -1}
+logConfig = {"adapter":"console", "color":false}
+initDataNewOnly = false
+initDataFile = "./init_data.json"
+frontendBaseDir = "/opt/casdoor/web/build"
+EOF
+chmod 600 /opt/casdoor_data/conf/app.conf
+msg_ok "Configured Casdoor"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/casdoor.service
+[Unit]
+Description=Casdoor
+After=network.target postgresql.service
+Requires=postgresql.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/casdoor_data
+ExecStart=/opt/casdoor/casdoor
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now casdoor
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc
@@ -13,15 +13,18 @@ setting_up_container
 network_check
 update_os

-var_cf_api_token="default"
-read -rp "${TAB3}Enter the Cloudflare API token: " var_cf_api_token
+var_cf_api_token="${var_cf_api_token:-}"
+[[ -n "$var_cf_api_token" ]] || read -rp "${TAB3}Enter the Cloudflare API token: " var_cf_api_token || true
+[[ -n "$var_cf_api_token" ]] || { msg_error "No Cloudflare API token given; set var_cf_api_token or answer the prompt"; exit 64; }

-var_cf_domains="default"
-read -rp "${TAB3}Enter the domains separated with a comma (*.example.org,www.example.org) " var_cf_domains
+var_cf_domains="${var_cf_domains:-}"
+[[ -n "$var_cf_domains" ]] || read -rp "${TAB3}Enter the domains separated with a comma (*.example.org,www.example.org) " var_cf_domains || true
+[[ -n "$var_cf_domains" ]] || { msg_error "No domains given; set var_cf_domains or answer the prompt"; exit 64; }

 var_cf_proxied="false"
+answer="${var_cloudflare_ddns_proxied:-}"
 while true; do
-  read -rp "${TAB3}Proxied? (y/n): " answer
+  [[ -n "$answer" ]] || read -rp "${TAB3}Proxied? (y/n): " answer || answer="n"
  case "$answer" in
  [Yy]*)
    var_cf_proxied="true"
@@ -31,12 +34,13 @@ while true; do
    var_cf_proxied="false"
    break
    ;;
-  *) echo "Please answer y or n." ;;
+  *) echo "Please answer y or n."; answer="" ;;
  esac
 done
 var_cf_ip6_provider="none"
+answer="${var_cloudflare_ddns_ipv6:-}"
 while true; do
-  read -rp "${TAB3}Enable IPv6 support? (y/n): " answer
+  [[ -n "$answer" ]] || read -rp "${TAB3}Enable IPv6 support? (y/n): " answer || answer="n"
  case "$answer" in
  [Yy]*)
    var_cf_ip6_provider="cloudflare.trace"
@@ -46,7 +50,7 @@ while true; do
    var_cf_ip6_provider="none"
    break
    ;;
-  *) echo "Please answer y or n." ;;
+  *) echo "Please answer y or n."; answer="" ;;
  esac
 done
 msg_ok "Configured Application"
@@ -33,7 +33,7 @@ msg_ok "Installed Cockpit"
 # 45Drives only publishes amd64 packages
 if [[ "$(arch_resolve)" != "arm64" ]]; then
  prompt="${var_cockpit_45drives:-}"
-  [[ -n "$prompt" ]] || read -r -p "Would you like to install 45Drives' cockpit-file-sharing, cockpit-identities, and cockpit-navigator  <y/N> " prompt
+  [[ -n "$prompt" ]] || read -r -p "Would you like to install 45Drives' cockpit-file-sharing, cockpit-identities, and cockpit-navigator  <y/N> " prompt || true
 fi
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
  msg_info "Installing 45Drives' cockpit extensions"
@@ -17,7 +17,8 @@ setup_hwaccel
 echo
 echo "${TAB3}Choose the GPU type for ComfyUI:"
 echo "${TAB3}[1]-None  [2]-NVIDIA  [3]-AMD  [4]-Intel"
-read -rp "${TAB3}Enter your choice [1-4] (default: 1): " gpu_choice
+gpu_choice="${var_comfyui_gpu_type:-}"
+[[ -n "$gpu_choice" ]] || read -rp "${TAB3}Enter your choice [1-4] (default: 1): " gpu_choice || true
 gpu_choice=${gpu_choice:-1}
 case "$gpu_choice" in
 1) comfyui_gpu_type="none" ;;
@@ -20,7 +20,7 @@ msg_ok "Installed Dependencies"
 NODE_VERSION="22" setup_nodejs

 onlyoffice="${var_cryptpad_onlyoffice:-}"
-[[ -n "$onlyoffice" ]] || read -rp "${TAB3}Install OnlyOffice components instead of CKEditor? (Y/N): " onlyoffice
+[[ -n "$onlyoffice" ]] || read -rp "${TAB3}Install OnlyOffice components instead of CKEditor? (Y/N): " onlyoffice || true
 fetch_and_deploy_gh_release "cryptpad" "cryptpad/cryptpad" "tarball"

 msg_info "Setup CryptPad"
@@ -28,11 +28,15 @@ cd /opt/cryptpad
 $STD npm ci --allow-git=all
 $STD npm run install:components
 if [[ "${onlyoffice,,}" =~ ^(y|yes)$ ]]; then
-  $STD bash -c "./install-onlyoffice.sh --accept-license"
+  $STD bash -c "./install-office.sh --accept-license"
 fi
 cp config/config.example.js config/config.js
-sed -i "51s/localhost/${LOCAL_IP}/g" /opt/cryptpad/config/config.js
-sed -i "80s#//httpAddress: 'localhost'#httpAddress: '0.0.0.0'#g" /opt/cryptpad/config/config.js
+cp config/infra.example.js config/infra.js
+sed -i \
+  -e "s|origin: \"http://localhost:3000\"|origin: \"http://${LOCAL_IP}:3000\"|" \
+  -e "s|sandboxOrigin: \"http://localhost:3001\"|sandboxOrigin: \"http://${LOCAL_IP}:3001\"|" \
+  -e "s|httpHost: \"localhost\"|httpHost: \"0.0.0.0\"|" \
+  config/infra.js
 $STD npm run build
 msg_ok "Setup CryptPad"

@@ -15,11 +15,8 @@ update_os

 setup_deb_based() {
  setup_docker
-  if [[ -n "${var_docker_socket:-}" ]]; then
-    socket_choice="$var_docker_socket"
-  else
-    read -r -p "${TAB3}Expose Docker TCP socket (insecure) ? [n = No, l = Local only (127.0.0.1), a = All interfaces (0.0.0.0)] <n/l/a>: " socket_choice
-  fi
+  socket_choice="${var_docker_socket:-}"
+  [[ -n "$socket_choice" ]] || read -r -p "${TAB3}Expose Docker TCP socket (insecure) ? [n = No, l = Local only (127.0.0.1), a = All interfaces (0.0.0.0)] <n/l/a>: " socket_choice || true
  case "${socket_choice,,}" in
  l | local)
    socket="tcp://127.0.0.1:2375"
@@ -70,11 +67,8 @@ setup_alpine() {
  msg_ok "Installed Docker"

  DOCKER_COMPOSE_LATEST_VERSION=$(get_latest_github_release "docker/compose" false)
-  if [[ -n "${var_docker_compose:-}" ]]; then
-    prompt="$var_docker_compose"
-  else
-    read -r -p "${TAB3}Would you like to add Docker Compose? <y/N> " prompt
-  fi
+  prompt="${var_docker_compose:-}"
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Docker Compose? <y/N> " prompt || true
  if [[ "${prompt,,}" =~ ^(y|yes|true)$ ]]; then
    msg_info "Installing Docker Compose $DOCKER_COMPOSE_LATEST_VERSION"
    DOCKER_CONFIG=${DOCKER_CONFIG:-$HOME/.docker}
@@ -83,11 +77,8 @@ setup_alpine() {
    chmod +x "$DOCKER_CONFIG"/cli-plugins/docker-compose
    msg_ok "Installed Docker Compose $DOCKER_COMPOSE_LATEST_VERSION"
  fi
-  if [[ -n "${var_docker_socket:-}" ]]; then
-    prompt="$var_docker_socket"
-  else
-    read -r -p "${TAB3}Would you like to expose the Docker TCP socket? <y/N> " prompt
-  fi
+  prompt="${var_docker_socket:-}"
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to expose the Docker TCP socket? <y/N> " prompt || true
  case "${prompt,,}" in
  y | yes | a | all) socket="tcp://0.0.0.0:2375" ;;
  l | local) socket="tcp://127.0.0.1:2375" ;;
@@ -26,8 +26,9 @@ $STD apt install -y \
  nginx
 msg_ok "Installed Dependencies"

-var_project_name="default"
-read -r -p "${TAB3}Type the assembly name of the project: " var_project_name
+var_project_name="${var_project_name:-}"
+[[ -n "$var_project_name" ]] || read -r -p "${TAB3}Type the assembly name of the project: " var_project_name || true
+[[ -n "$var_project_name" ]] || { msg_error "No assembly name given; set var_project_name or answer the prompt"; exit 64; }

 msg_info "Setting up FTP Server"
 useradd ftpuser
@@ -0,0 +1,136 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/dreeveapp/dreeve
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  libsqlite3-0 \
+  libcap2-bin \
+  ca-certificates
+msg_ok "Installed Dependencies"
+
+# 1.13.0's php-cli shifts the script into argv[1], which breaks composer and bin/console (php/frankenphp#2690); unpin once 1.13.1 is out
+fetch_and_deploy_gh_release "frankenphp" "php/frankenphp" "singlefile" "v1.12.7" "/opt/frankenphp" "frankenphp-linux-$(arch_resolve x86_64 aarch64)-gnu"
+fetch_and_deploy_gh_release "dreeve" "dreeveapp/dreeve" "tarball"
+
+msg_info "Providing php CLI"
+cat <<'EOF' >/usr/local/bin/php
+#!/usr/bin/env bash
+exec /opt/frankenphp/frankenphp php-cli "$@"
+EOF
+chmod +x /usr/local/bin/php
+msg_ok "Provided php CLI"
+
+msg_info "Installing Composer"
+curl -fsSL https://getcomposer.org/installer -o /tmp/composer-setup.php
+$STD /opt/frankenphp/frankenphp php-cli /tmp/composer-setup.php --install-dir=/usr/local/bin --filename=composer
+rm -f /tmp/composer-setup.php
+msg_ok "Installed Composer"
+
+msg_info "Installing PHP Dependencies (Patience)"
+cd /opt/dreeve
+export COMPOSER_ALLOW_SUPERUSER=1
+export APP_ENV=prod
+$STD /opt/frankenphp/frankenphp php-cli /usr/local/bin/composer install --no-dev --optimize-autoloader --no-interaction --no-scripts
+msg_ok "Installed PHP Dependencies"
+
+msg_info "Configuring Dreeve"
+mkdir -p /opt/dreeve_data /opt/dreeve/var/{cache,log}
+DREEVE_PASSWORD=$(openssl rand -base64 18)
+DREEVE_HASH=$(DREEVE_PASSWORD="$DREEVE_PASSWORD" /opt/frankenphp/frankenphp php-cli -r 'echo password_hash(getenv("DREEVE_PASSWORD"), PASSWORD_BCRYPT, ["cost" => 13]);')
+[[ "$DREEVE_HASH" =~ ^\$2y\$ ]] || {
+  msg_error "Could not generate the admin password hash"
+  exit 1
+}
+cat <<EOF >/opt/dreeve/.env.local
+APP_ENV=prod
+APP_DEBUG=0
+APP_SECRET=$(openssl rand -hex 32)
+APP_URL=http://${LOCAL_IP}:8080
+DATABASE_DIRECTORY=/opt/dreeve_data
+ADMIN_USERNAME=admin
+ADMIN_PASSWORD_HASH='${DREEVE_HASH}'
+TZ=UTC
+
+# Create an API application at https://www.strava.com/settings/api
+STRAVA_CLIENT_ID=replace-me
+STRAVA_CLIENT_SECRET=replace-me
+STRAVA_REFRESH_TOKEN=replace-me
+EOF
+chmod 600 /opt/dreeve/.env.local
+
+cat <<EOF >~/dreeve.creds
+Dreeve Admin
+Username: admin
+Password: ${DREEVE_PASSWORD}
+EOF
+chmod 600 ~/dreeve.creds
+
+cat <<EOF >/opt/dreeve/Caddyfile
+{
+	http_port 8080
+	auto_https off
+
+	frankenphp {
+		num_threads 3
+		worker {
+			num 2
+			file /opt/dreeve/public/index.php
+		}
+	}
+}
+
+:8080 {
+	root /opt/dreeve/public
+	encode zstd br gzip
+	php_server
+}
+EOF
+msg_ok "Configured Dreeve"
+
+msg_info "Initializing Database"
+cd /opt/dreeve
+set -a
+source /opt/dreeve/.env.local
+set +a
+$STD /opt/frankenphp/frankenphp php-cli bin/console app:db:migrate --no-interaction
+$STD /opt/frankenphp/frankenphp php-cli bin/console assets:install public --no-interaction
+$STD /opt/frankenphp/frankenphp php-cli bin/console cache:warmup --env=prod
+msg_ok "Initialized Database"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/dreeve.service
+[Unit]
+Description=Dreeve
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/dreeve
+EnvironmentFile=/opt/dreeve/.env.local
+ExecStart=/opt/frankenphp/frankenphp run --config /opt/dreeve/Caddyfile
+Restart=on-failure
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now dreeve
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc
@@ -44,6 +44,7 @@ User=root
 WorkingDirectory=/opt/droppedneedle/backend
 Environment=ROOT_APP_DIR=/opt/droppedneedle/backend
 Environment=PORT=8688
+Environment=COMMIT_TAG=v$(<~/.droppedneedle)
 # Environment=SLSKD_DOWNLOADS_PATH=<path-to-slskd-downloads>
 ExecStart=/opt/droppedneedle/venv/bin/python -m maintenance.automatic_upgrade --start-target
 Restart=on-failure
@@ -23,7 +23,9 @@ NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs

 echo "${TAB3}It is important to choose the name for your server before you install Synapse, because it cannot be changed later."
 echo "${TAB3}The server name determines the “domain” part of user-ids for users on your server: these will all be of the format @user:my.domain.name. It also determines how other matrix servers will reach yours for federation."
-read -p "${TAB3}Please enter the name for your server: " servername
+servername="${var_elementsynapse_server_name:-}"
+[[ -n "$servername" ]] || read -r -p "${TAB3}Please enter the name for your server: " servername || true
+[[ -n "$servername" ]] || { msg_error "No server name given; set var_elementsynapse_server_name or answer the prompt"; exit 64; }

 msg_info "Installing Element Synapse"
 setup_deb822_repo "matrix-org" \
@@ -38,7 +40,7 @@ chmod +x /usr/sbin/policy-rc.d
 $STD apt install matrix-synapse-py3 -y
 rm -f /usr/sbin/policy-rc.d
 sed -i 's/127.0.0.1/0.0.0.0/g' /etc/matrix-synapse/homeserver.yaml
-sed -i 's/'\''::1'\'', //g' /etc/matrix-synapse/homeserver.yaml
+sed -i '/^ *- ::1$/d' /etc/matrix-synapse/homeserver.yaml
 SECRET=$(openssl rand -hex 32)
 ADMIN_PASS="$(random_password 13)"
 echo "enable_registration_without_verification: true" >>/etc/matrix-synapse/homeserver.yaml
@@ -69,7 +71,7 @@ Admin username: admin
 Admin password: $ADMIN_PASS
 EOF
 systemctl stop matrix-synapse
-sed -i '34d' /etc/matrix-synapse/homeserver.yaml
+sed -i '/^enable_registration_without_verification: true$/d' /etc/matrix-synapse/homeserver.yaml
 systemctl start matrix-synapse
 msg_ok "Installed Element Synapse"

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/emdash-cms/emdash
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+NODE_VERSION="24" NODE_MODULE="pnpm@11" setup_nodejs
+
+msg_info "Creating EmDash Site"
+cd /opt
+$STD pnpm dlx create-emdash@latest emdash --platform node --template "${var_emdash_template:-blog}" --pm pnpm --no-install --yes
+mkdir -p /opt/emdash_data/uploads
+mv /opt/emdash/.env /opt/emdash_data/.env
+sed -i -e 's|file:./data.db|file:/opt/emdash_data/data.db|' -e 's|"./uploads"|"/opt/emdash_data/uploads"|' /opt/emdash/astro.config.mjs
+cat <<EOF >>/opt/emdash_data/.env
+HOST=0.0.0.0
+PORT=4321
+# The address in the browser bar. Passkeys are bound to its hostname, and the build bakes it in for image optimization:
+# after a change run cd /opt/emdash && set -a && . /opt/emdash_data/.env && set +a && pnpm build && systemctl restart emdash
+EMDASH_SITE_URL=${var_emdash_url:-http://${LOCAL_IP}:4321}
+EOF
+chmod 600 /opt/emdash_data/.env
+msg_ok "Created EmDash Site"
+
+msg_info "Building EmDash"
+cd /opt/emdash
+# pnpm keeps Astro's sharp out of the site's reach, and every /_image request then fails with MissingSharp
+$STD pnpm add sharp
+set -a && source /opt/emdash_data/.env && set +a
+$STD pnpm build
+cat <<EOF >~/.emdash
+emdash@$(node -p 'require("/opt/emdash/node_modules/emdash/package.json").version')
+EOF
+msg_ok "Built EmDash"
+
+msg_info "Creating EmDash Service"
+cat <<EOF >/etc/systemd/system/emdash.service
+[Unit]
+Description=EmDash
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/emdash
+EnvironmentFile=/opt/emdash_data/.env
+Environment=NODE_ENV=production
+ExecStart=/usr/bin/node /opt/emdash/dist/server/entry.mjs
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now emdash
+msg_ok "Created EmDash Service"
+
+motd_ssh
+customize
+cleanup_lxc
@@ -39,7 +39,7 @@ echo "$LATEST_VERSION" >~/.emqx
 msg_ok "Installed EMQX"

 prompt="${var_emqx_disable_mq:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to disable the EMQX MQ feature? (reduces disk/CPU usage) <y/N> " prompt
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to disable the EMQX MQ feature? (reduces disk/CPU usage) <y/N> " prompt || true
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  msg_info "Disabling EMQX MQ feature"
  mkdir -p /etc/emqx
@@ -19,7 +19,7 @@ $STD apt install -y \
  nginx
 msg_ok "Installed Dependencies"

-NODE_VERSION="20" setup_nodejs
+NODE_VERSION="24" setup_nodejs
 PG_VERSION="18" setup_postgresql
 PG_DB_NAME="excalidash" PG_DB_USER="excalidash" setup_postgresql_db

@@ -45,7 +45,8 @@ $STD ln -svf /usr/bin/ffmpeg /usr/local/bin/ffmpeg
 $STD ln -svf /usr/bin/ffprobe /usr/local/bin/ffprobe
 $STD rm -rf /opt/fileflows/Server/runtimes/win-*

-read -r -p "${TAB3}Do you want to install FileFlows Server or Agent? (S/A): " install_server
+install_server="${var_fileflows_mode:-}"
+[[ -n "$install_server" ]] || read -r -p "${TAB3}Do you want to install FileFlows Server or Agent? (S/A): " install_server || true

 if [[ "$install_server" =~ ^[Ss]$ ]]; then
  msg_info "Installing FileFlows Server"
@@ -54,9 +55,10 @@ if [[ "$install_server" =~ ^[Ss]$ ]]; then
  systemctl enable -q --now fileflows
  msg_ok "Installed FileFlows Server"
 else
-  read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url
+  server_url="${var_fileflows_server_url:-}"
+  [[ -n "$server_url" ]] || read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url || true
  while [[ -z "${server_url// /}" ]]; do
-    read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url
+    read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url || { msg_error "No FileFlows Server URL given; set var_fileflows_server_url or answer the prompt"; exit 64; }
  done
  msg_info "Installing FileFlows Agent"
  cd /opt/fileflows/Agent
@@ -15,12 +15,12 @@ update_os
 setup_yq

 if [[ -z "${var_forgejo_instance:-}" ]]; then
-  read -r -p "${TAB3}Forgejo Instance URL (e.g. https://codeberg.org): " var_forgejo_instance
+  read -r -p "${TAB3}Forgejo Instance URL (e.g. https://codeberg.org): " var_forgejo_instance || true
  var_forgejo_instance="${var_forgejo_instance:-https://codeberg.org}"
 fi

 if [[ -z "${var_forgejo_runner_uuid:-}" ]]; then
-  read -r -p "${TAB3}Forgejo Runner UUID: " var_forgejo_runner_uuid
+  read -r -p "${TAB3}Forgejo Runner UUID: " var_forgejo_runner_uuid || true
 fi

 if [[ -z "${var_forgejo_runner_uuid:-}" ]]; then
@@ -29,7 +29,7 @@ if [[ -z "${var_forgejo_runner_uuid:-}" ]]; then
 fi

 if [[ -z "${var_forgejo_runner_token:-}" ]]; then
-  read -r -p "${TAB3}Forgejo Runner Token: " var_forgejo_runner_token
+  read -r -p "${TAB3}Forgejo Runner Token: " var_forgejo_runner_token || true
 fi

 if [[ -z "${var_forgejo_runner_token:-}" ]]; then
@@ -39,7 +39,7 @@ fi

 DEFAULT_RUNNER_LABELS="linux-amd64:docker://node:22-bookworm"
 if [[ -z "${var_runner_labels:-}" ]]; then
-  read -r -p "${TAB3}Additional runner labels (comma-separated, or leave blank for default only): " var_runner_labels
+  read -r -p "${TAB3}Additional runner labels (comma-separated, or leave blank for default only): " var_runner_labels || true
 fi
 if [[ -n "${var_runner_labels:-}" ]]; then
  RUNNER_LABELS="${DEFAULT_RUNNER_LABELS},${var_runner_labels}"
@@ -110,7 +110,7 @@ export AUTOGRAPH_VERBOSITY=0
 export GLOG_minloglevel=3
 export GLOG_logtostderr=0

-fetch_and_deploy_gh_release "frigate" "blakeblackshear/frigate" "tarball" "v0.18.0" "/opt/frigate"
+fetch_and_deploy_gh_release "frigate" "blakeblackshear/frigate" "tarball" "v0.18.2" "/opt/frigate"

 msg_info "Building Nginx"
 $STD bash /opt/frigate/docker/main/build_nginx.sh
@@ -124,6 +124,8 @@ msg_ok "Built SQLite Extensions"

 if [[ "$(arch_resolve)" == "amd64" ]]; then
  msg_info "Building Intel Media Driver (Patience)"
+  download_gpg_key "https://repositories.intel.com/gpu/intel-graphics.key" "/usr/share/keyrings/intel-graphics.gpg" "dearmor"
+  sed -i '/intel-graphics.key/d' /opt/frigate/docker/main/build_intel_media_driver.sh
  $STD bash /opt/frigate/docker/main/build_intel_media_driver.sh
  cp -a /rootfs/. /
  rm -rf /rootfs
@@ -51,8 +51,10 @@ echo -e ""
 msg_custom "🪙" "$YW" "CoinGecko API keys are optional but provide better cryptocurrency data."
 msg_custom "🪙" "$YW" "You can skip this and add them later by editing /opt/ghostfolio/.env"
 echo -e ""
-read -rp "${TAB3}CoinGecko Demo API key (press Enter to skip): " COINGECKO_DEMO_KEY
-read -rp "${TAB3}CoinGecko Pro API key (press Enter to skip): " COINGECKO_PRO_KEY
+COINGECKO_DEMO_KEY="${var_ghostfolio_coingecko_demo_key:-}"
+[[ -n "$COINGECKO_DEMO_KEY" ]] || read -rp "${TAB3}CoinGecko Demo API key (press Enter to skip): " COINGECKO_DEMO_KEY || true
+COINGECKO_PRO_KEY="${var_ghostfolio_coingecko_pro_key:-}"
+[[ -n "$COINGECKO_PRO_KEY" ]] || read -rp "${TAB3}CoinGecko Pro API key (press Enter to skip): " COINGECKO_PRO_KEY || true

 msg_info "Setting up Environment"
 cat <<EOF >/opt/ghostfolio/.env
@@ -34,6 +34,7 @@ $STD apt install -y \
  pkg-config \
  poppler-utils \
  python3-dev \
+  redis-server \
  tesseract-ocr
 msg_ok "Installed Dependencies"

@@ -70,6 +71,8 @@ REQUEST_CACHE_CONFIG={"CACHE_TYPE":"FileSystemCache","CACHE_DIR":"/opt/gramps-we
 PERSISTENT_CACHE_CONFIG={"CACHE_TYPE":"FileSystemCache","CACHE_DIR":"/opt/gramps-web/data/cache/persistent","CACHE_THRESHOLD":0,"CACHE_DEFAULT_TIMEOUT":0}
 REPORT_DIR="/opt/gramps-web/data/cache/report"
 EXPORT_DIR="/opt/gramps-web/data/cache/export"
+CELERY_CONFIG={"broker_url":"redis://127.0.0.1:6379/0","result_backend":"redis://127.0.0.1:6379/0"}
+RATELIMIT_STORAGE_URI="redis://127.0.0.1:6379/1"
 EOF
 $STD uv venv -c -p python3.12 /opt/gramps-web/venv
 source /opt/gramps-web/venv/bin/activate
@@ -107,7 +110,8 @@ msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/gramps-web.service
 [Unit]
 Description=Gramps Web Service
-After=network.target
+After=network.target redis-server.service
+Wants=redis-server.service

 [Service]
 Type=simple
@@ -124,7 +128,28 @@ RestartSec=5
 [Install]
 WantedBy=multi-user.target
 EOF
-systemctl enable -q --now gramps-web
+cat <<EOF >/etc/systemd/system/gramps-web-celery.service
+[Unit]
+Description=Gramps Web Celery Worker
+After=network.target redis-server.service
+Wants=redis-server.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/gramps-web-api
+Environment=GRAMPS_API_CONFIG=/opt/gramps-web/config/config.cfg
+Environment=GRAMPSHOME=/opt/gramps-web/data
+Environment=GRAMPS_DATABASE_PATH=/opt/gramps-web/data/gramps/grampsdb
+Environment=PATH=/opt/gramps-web/venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+ExecStart=/opt/gramps-web/venv/bin/celery -A gramps_webapi.celery worker --loglevel=INFO --concurrency=2
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now gramps-web gramps-web-celery
 msg_ok "Created Service"

 motd_ssh
@@ -16,7 +16,7 @@ update_os
 fetch_and_deploy_gh_release "headscale" "juanfont/headscale" "binary"

 prompt="${var_headscale_admin:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add headscale-admin UI? <y/N> " prompt
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add headscale-admin UI? <y/N> " prompt || true
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  fetch_and_deploy_gh_release "headscale-admin" "GoodiesHQ/headscale-admin" "prebuild" "latest" "/opt/headscale-admin" "admin.zip"

@@ -25,7 +25,7 @@ msg_info "Setting up Heimdall-Dashboard"
 cd /opt/Heimdall
 cp .env.example .env
 sed -i 's/^APP_ENV=.*/APP_ENV=production/' .env
-$STD php artisan key:generate
+$STD php artisan key:generate --force
 msg_ok "Setup Heimdall-Dashboard"

 msg_info "Creating Service"
@@ -14,7 +14,9 @@ network_check
 update_os

 msg_info "Installing Dependencies"
-$STD apt install -y git
+$STD apt install -y \
+  git \
+  libatomic1
 msg_ok "Installed Dependencies"

 NODE_VERSION="22" setup_nodejs
@@ -27,78 +29,71 @@ msg_ok "Created Hermes User"

 msg_info "Configuring Service Environment"
 cat <<EOF >/etc/default/hermes
-HOME=/home/hermes
 PATH=/home/hermes/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 NODE_OPTIONS=${NODE_OPTIONS}
+GATEWAY_HEALTH_URL=http://127.0.0.1:8642/health
 EOF
 msg_ok "Configured Service Environment"

 confirm_external_installer "https://hermes-agent.nousresearch.com/" "https://hermes-agent.nousresearch.com/install.sh"

 msg_info "Installing Hermes Agent"
-curl -fsSL https://hermes-agent.nousresearch.com/install.sh -o /tmp/hermes-install.sh
-$STD setsid --wait bash -c '
+curl_with_retry "https://hermes-agent.nousresearch.com/install.sh" /tmp/hermes-install.sh ||
+  curl_with_retry "https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scripts/install.sh" /tmp/hermes-install.sh
+chmod 644 /tmp/hermes-install.sh
+$STD setsid --wait runuser -l hermes -c '
  set -a; source /etc/default/hermes; set +a
  export npm_config_yes=true
-  bash /tmp/hermes-install.sh --skip-setup --hermes-home /home/hermes/.hermes --dir /home/hermes/.hermes/hermes-agent
+  bash /tmp/hermes-install.sh --skip-setup --hermes-home ~/.hermes --dir ~/.hermes/hermes-agent
 '
 rm -f /tmp/hermes-install.sh
-chown -R hermes:hermes /home/hermes
 chmod 750 /home/hermes
 chmod 700 /home/hermes/.hermes
-git config --system --add safe.directory /home/hermes/.hermes/hermes-agent 2>/dev/null || true
 msg_ok "Installed Hermes Agent"

 msg_info "Configuring API Server"
 API_SERVER_KEY=$(random_password 32)
-mkdir -p /home/hermes/.hermes
 cat <<EOF >/home/hermes/.hermes/.env
 API_SERVER_ENABLED=true
 API_SERVER_HOST=0.0.0.0
 API_SERVER_PORT=8642
 API_SERVER_KEY=${API_SERVER_KEY}
 EOF
+chown hermes:hermes /home/hermes/.hermes/.env
 chmod 600 /home/hermes/.hermes/.env
 msg_ok "Configured API Server"

 msg_info "Creating Dashboard Service"
-cat <<EOF >/etc/systemd/system/hermes-dashboard.service
+mkdir -p /home/hermes/.config/systemd/user
+cat <<EOF >/home/hermes/.config/systemd/user/hermes-dashboard.service
 [Unit]
 Description=Hermes Agent Web Dashboard
 After=network-online.target
-Wants=network-online.target

 [Service]
 Type=simple
-User=hermes
-Group=hermes
 UMask=0077
-WorkingDirectory=/home/hermes
-ExecStart=/home/hermes/.local/bin/hermes dashboard --host 127.0.0.1 --port 9119 --no-open
+WorkingDirectory=%h
 EnvironmentFile=/etc/default/hermes
+ExecStart=%h/.local/bin/hermes dashboard --host 127.0.0.1 --port 9119 --no-open
 Restart=on-failure
 RestartSec=5
-ProtectProc=invisible
-ProcSubset=pid

 [Install]
-WantedBy=multi-user.target
+WantedBy=default.target
 EOF
-systemctl enable -q --now hermes-dashboard
+chown -R hermes:hermes /home/hermes/.config
+$STD runuser -l hermes -c 'systemctl --user daemon-reload && systemctl --user enable --now hermes-dashboard'
 msg_ok "Created Dashboard Service"

 msg_info "Creating Setup Helper"
 cat <<'SETUP' >/usr/bin/hermes-setup
 #!/usr/bin/env bash
-set -a; source /etc/default/hermes; set +a
-/home/hermes/.local/bin/hermes setup
-chown -R hermes:hermes /home/hermes
-chmod 750 /home/hermes
-chmod 700 /home/hermes/.hermes
+su - hermes -c 'set -a; source /etc/default/hermes; set +a; hermes setup'
 if [[ -f /home/hermes/.config/systemd/user/hermes-gateway.service ]]; then
  su - hermes -c 'systemctl --user enable --now hermes-gateway'
 fi
-echo "Hermes setup complete. File permissions restored."
+echo "Hermes setup complete."
 SETUP
 chmod +x /usr/bin/hermes-setup
 msg_ok "Created Setup Helper"
@@ -17,7 +17,7 @@ msg_info "Installing Dependencies"
 $STD apt install -y jq
 msg_ok "Installed Dependencies"

-NODE_VERSION="22" NODE_MODULE="pnpm@latest" setup_nodejs
+NODE_VERSION="24" NODE_MODULE="pnpm@latest" setup_nodejs
 fetch_and_deploy_gh_release "homepage" "gethomepage/homepage" "tarball"
 RELEASE=$(get_latest_github_release "gethomepage/homepage")

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/EgalitarianMonkey/hometube
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+setup_ffmpeg
+PYTHON_VERSION="3.13" setup_uv
+fetch_and_deploy_gh_release "deno" "denoland/deno" "prebuild" "latest" "/usr/local/bin" "deno-$(arch_resolve "x86_64" "aarch64")-unknown-linux-gnu.zip"
+fetch_and_deploy_gh_release "yt-dlp" "yt-dlp/yt-dlp" "singlefile" "latest" "/usr/local/bin" "yt-dlp_$(arch_resolve "linux" "linux_aarch64")"
+fetch_and_deploy_gh_release "hometube" "EgalitarianMonkey/hometube" "tarball"
+
+msg_info "Installing HomeTube"
+cd /opt/hometube
+$STD uv sync --locked --no-dev --no-install-project --no-install-package pyarrow
+mkdir -p /opt/hometube_data/{videos,tmp,cookies}
+cat <<EOF >/opt/hometube_data/.env
+VIDEOS_FOLDER=/opt/hometube_data/videos
+TMP_DOWNLOAD_FOLDER=/opt/hometube_data/tmp
+YOUTUBE_COOKIES_FILE_PATH=/opt/hometube_data/cookies/youtube_cookies.txt
+REMOVE_TMP_FILES_AFTER_DOWNLOAD=true
+EOF
+msg_ok "Installed HomeTube"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/hometube.service
+[Unit]
+Description=HomeTube
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/hometube
+EnvironmentFile=/opt/hometube_data/.env
+Environment=PYTHONUNBUFFERED=1
+ExecStartPre=-/usr/local/bin/yt-dlp -U
+ExecStart=/opt/hometube/.venv/bin/python -m streamlit run app/main.py --server.port=8501 --server.address=0.0.0.0 --server.headless=true --server.enableCORS=false --server.enableXsrfProtection=false
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now hometube
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc
@@ -0,0 +1,168 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/plastic-labs/honcho
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y redis-server
+msg_ok "Installed Dependencies"
+
+PG_VERSION="17" PG_MODULES="pgvector" setup_postgresql
+PG_DB_NAME="honcho" PG_DB_USER="honcho" PG_DB_EXTENSIONS="vector,pg_trgm" setup_postgresql_db
+PYTHON_VERSION="3.13" setup_uv
+fetch_and_deploy_gh_release "honcho" "plastic-labs/honcho" "tarball" "latest" "/opt/honcho" "" "v"
+
+msg_info "Installing Honcho"
+cd /opt/honcho
+$STD uv sync --frozen --no-dev
+msg_ok "Installed Honcho"
+
+if [[ -t 0 && -z "${var_honcho_provider:-}${var_honcho_api_key:-}${var_honcho_base_url:-}" ]]; then
+  echo -e "${INFO}${YW} Honcho needs an LLM provider for memory, embeddings and chat; without a key it is installed but not started.${CL}"
+  read -t 300 -rsp "${TAB3}OpenAI API key (Enter to set up a provider later): " var_honcho_api_key || true
+  echo
+fi
+
+declare -A HONCHO_KEY=([openai]="" [anthropic]="" [gemini]="")
+case "${var_honcho_provider:-openai}" in
+anthropic)
+  HONCHO_TRANSPORT="anthropic" HONCHO_MODEL="${var_honcho_model:-claude-haiku-4-5}"
+  HONCHO_EMBEDDING="openai" HONCHO_EMBEDDING_MODEL="${var_honcho_embedding_model:-text-embedding-3-small}"
+  HONCHO_KEY[anthropic]="${var_honcho_api_key:-}"
+  HONCHO_KEY[openai]="${var_honcho_embedding_key:-}"
+  ;;
+gemini)
+  HONCHO_TRANSPORT="gemini" HONCHO_MODEL="${var_honcho_model:-gemini-2.5-flash}"
+  HONCHO_EMBEDDING="gemini" HONCHO_EMBEDDING_MODEL="${var_honcho_embedding_model:-gemini-embedding-001}"
+  HONCHO_KEY[gemini]="${var_honcho_api_key:-}"
+  ;;
+*)
+  HONCHO_TRANSPORT="openai" HONCHO_MODEL="${var_honcho_model:-gpt-5.4-mini}"
+  HONCHO_EMBEDDING="openai" HONCHO_EMBEDDING_MODEL="${var_honcho_embedding_model:-text-embedding-3-small}"
+  HONCHO_KEY[openai]="${var_honcho_api_key:-${var_honcho_base_url:+not-needed}}"
+  ;;
+esac
+
+msg_info "Configuring Honcho"
+mkdir -p /opt/honcho_data
+cat <<EOF >/opt/honcho_data/.env
+DB_CONNECTION_URI=postgresql+psycopg://honcho:${PG_DB_PASS}@localhost:5432/honcho
+CACHE_ENABLED=true
+CACHE_URL=redis://localhost:6379/0?suppress=true
+
+# Every /v3 API request needs a JWT signed with this secret. Mint one with:
+# cd /opt/honcho && .venv/bin/python scripts/generate_jwt.py --admin
+AUTH_USE_AUTH=true
+AUTH_JWT_SECRET=$(openssl rand -hex 32)
+WEBHOOK_SECRET=$(openssl rand -hex 32)
+
+# Transports: openai (OpenAI or any OpenAI-compatible endpoint), anthropic, gemini.
+# Embeddings run on openai or gemini only. Apply changes with: systemctl restart honcho honcho-deriver
+LLM_OPENAI_API_KEY=${HONCHO_KEY[openai]}
+LLM_ANTHROPIC_API_KEY=${HONCHO_KEY[anthropic]}
+LLM_GEMINI_API_KEY=${HONCHO_KEY[gemini]}
+
+# An OpenAI-compatible endpoint (OpenRouter, Ollama, vLLM, LiteLLM) replaces api.openai.com through both lines:
+#LLM_OPENAI_BASE_URL=http://192.168.1.50:11434/v1
+#EMBEDDING_MODEL_CONFIG__OVERRIDES__BASE_URL=http://192.168.1.50:11434/v1
+# Endpoints without OpenAI Structured Outputs need:
+#DERIVER_MODEL_CONFIG__STRUCTURED_OUTPUT_MODE=json_object
+
+EMBEDDING_MODEL_CONFIG__TRANSPORT=${HONCHO_EMBEDDING}
+EMBEDDING_MODEL_CONFIG__MODEL=${HONCHO_EMBEDDING_MODEL}
+# A model with another vector size works only while nothing is embedded yet: set it here, then run
+# cd /opt/honcho && .venv/bin/python scripts/configure_embeddings.py --yes
+#EMBEDDING_VECTOR_DIMENSIONS=1536
+
+# The deriver waits for about 512 new tokens per peer, or 30 minutes, before it calls the LLM
+#DERIVER_FLUSH_ENABLED=true
+
+# Models for the deriver, summaries, dreams and dialectic chat; they must support tool calling
+EOF
+for prefix in DERIVER SUMMARY DREAM_DEDUCTION DREAM_INDUCTION DIALECTIC_LEVELS__{minimal,low,medium,high,max}_; do
+  cat <<EOF >>/opt/honcho_data/.env
+${prefix}_MODEL_CONFIG__TRANSPORT=${HONCHO_TRANSPORT}
+${prefix}_MODEL_CONFIG__MODEL=${HONCHO_MODEL}
+EOF
+done
+if [[ -n "${var_honcho_base_url:-}" ]]; then
+  cat <<EOF >>/opt/honcho_data/.env
+
+LLM_OPENAI_BASE_URL=${var_honcho_base_url}
+EMBEDDING_MODEL_CONFIG__OVERRIDES__BASE_URL=${var_honcho_base_url}
+EOF
+fi
+if [[ -n "${var_honcho_embedding_dims:-}" ]]; then
+  cat <<EOF >>/opt/honcho_data/.env
+EMBEDDING_VECTOR_DIMENSIONS=${var_honcho_embedding_dims}
+EOF
+fi
+chmod 600 /opt/honcho_data/.env
+ln -sf /opt/honcho_data/.env /opt/honcho/.env
+msg_ok "Configured Honcho"
+
+msg_info "Migrating Honcho Database"
+$STD .venv/bin/python scripts/provision_db.py
+$STD .venv/bin/python scripts/configure_embeddings.py --yes
+msg_ok "Migrated Honcho Database"
+
+msg_info "Creating Honcho Services"
+cat <<EOF >/etc/systemd/system/honcho.service
+[Unit]
+Description=Honcho API
+After=network.target postgresql.service redis-server.service
+Requires=postgresql.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/honcho
+Environment=PYTHONUNBUFFERED=1
+ExecStart=/opt/honcho/.venv/bin/fastapi run --host 0.0.0.0 --port 8000 src/main.py
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+cat <<EOF >/etc/systemd/system/honcho-deriver.service
+[Unit]
+Description=Honcho Deriver
+After=network.target postgresql.service redis-server.service honcho.service
+Requires=postgresql.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/honcho
+Environment=PYTHONUNBUFFERED=1
+ExecStart=/opt/honcho/.venv/bin/python -m src.deriver
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+msg_ok "Created Honcho Services"
+
+if [[ -n "${HONCHO_KEY[$HONCHO_TRANSPORT]}" && -n "${HONCHO_KEY[$HONCHO_EMBEDDING]}" ]]; then
+  msg_info "Starting Honcho"
+  systemctl enable -q --now honcho honcho-deriver
+  msg_ok "Started Honcho"
+else
+  msg_warn "No LLM provider key (with Anthropic also an OpenAI key for embeddings): Honcho stays stopped until it is set in /opt/honcho_data/.env"
+fi
+
+motd_ssh
+customize
+cleanup_lxc
@@ -13,7 +13,12 @@ setting_up_container
 network_check
 update_os

-RELEASE="v3.3.4"
+if is_debian && [[ "$(get_os_version_major)" -lt 13 ]]; then
+  msg_error "Immich needs Debian 13: its build dependencies and Intel runtime packages are not available on Debian 12."
+  exit 238
+fi
+
+RELEASE="v3.3.5"
 if lscpu | grep -q 'GenuineIntel'; then
  echo ""
  echo ""
@@ -25,7 +30,7 @@ if lscpu | grep -q 'GenuineIntel'; then
  echo " 2) **NEW** Intel OpenVINO CPU or iGPU"
  echo ""

-  read -r -p "${TAB3}Select machine-learning type [1]: " ML_TYPE
+  read -r -p "${TAB3}Select machine-learning type [1]: " ML_TYPE || true
  ML_TYPE="${ML_TYPE:-1}"
  if [[ "$ML_TYPE" == "2" ]]; then
    touch ~/.openvino
@@ -110,7 +115,7 @@ setup_deb822_repo \
  "https://repo.jellyfin.org/jellyfin_team.gpg.key" \
  "https://repo.jellyfin.org/debian" \
  "$(get_os_info codename)"
-$STD apt install -y jellyfin-ffmpeg7
+install_packages_with_retry jellyfin-ffmpeg7
 ln -sf /usr/lib/jellyfin-ffmpeg/ffmpeg /usr/bin/ffmpeg
 ln -sf /usr/lib/jellyfin-ffmpeg/ffprobe /usr/bin/ffprobe

@@ -124,12 +129,9 @@ if [[ "$CTTYPE" == "0" && -d /dev/dri ]]; then
 fi
 msg_ok "Dependencies Installed"

-msg_info "Installing Mise"
-curl -fSs https://mise.jdx.dev/gpg-key.pub | tee /etc/apt/keyrings/mise-archive-keyring.pub 1>/dev/null
-echo "deb [signed-by=/etc/apt/keyrings/mise-archive-keyring.pub arch=$(arch_resolve)] https://mise.jdx.dev/deb stable main" >/etc/apt/sources.list.d/mise.list
-apt_update_safe
-$STD apt install -y mise
-msg_ok "Installed Mise"
+MISE_ARCH="x64"
+[[ "$(arch_resolve)" == "arm64" ]] && MISE_ARCH="arm64"
+fetch_and_deploy_gh_release "mise" "jdx/mise" "singlefile" "latest" "/usr/local/bin" "mise-v*-linux-${MISE_ARCH}"

 msg_info "Configuring Debian Testing Repo"
 if [[ -f /etc/apt/sources.list.d/debian.sources ]]; then
@@ -395,6 +397,7 @@ cp LICENSE "$APP_DIR"
 cd "$SRC_DIR"
 export MISE_TRUSTED_CONFIG_PATHS="$SRC_DIR"/mise.toml
 export MISE_DISABLE_TOOLS=github:jellyfin/jellyfin-ffmpeg
+export MISE_LOCKFILE_MODE=merge MISE_LOCKFILE_PLATFORMS="linux-$(arch_resolve x64 arm64)"
 mise_ok=0
 for i in 1 2 3; do
  $STD mise install && {
@@ -21,7 +21,8 @@ setup_deb822_repo \
  "stable"
 msg_ok "Set up InfluxDB Repository"

-read -r -p "${TAB3}Which version of InfluxDB to install? (1, 2 or 3) " prompt
+prompt="${var_influxdb_version:-}"
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Which version of InfluxDB to install? (1, 2 or 3) " prompt || true
 if [[ $prompt == "3" ]]; then
  INFLUX="3"
 elif [[ $prompt == "2" ]]; then
@@ -51,7 +52,7 @@ fi
 msg_ok "Installed InfluxDB"

 prompt="${var_influxdb_telegraf:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Telegraf? <y/N> " prompt
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Telegraf? <y/N> " prompt || true
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
  msg_info "Installing Telegraf"
  $STD apt install -y telegraf
@@ -52,6 +52,9 @@ chown -R www-data:www-data /opt/invoiceshelf
 chmod -R 775 storage bootstrap/cache
 $STD php artisan migrate --force
 $STD php artisan storage:link
+cat <<'EOF' >/etc/cron.d/invoiceshelf
+* * * * * www-data cd /opt/invoiceshelf && php artisan schedule:run >> /dev/null 2>&1
+EOF
 msg_ok "Set up InvoiceShelf"

 msg_info "Configuring Caddy"
@@ -13,6 +13,12 @@ setting_up_container
 network_check
 update_os

+if [[ "${CTTYPE:-1}" != "0" ]]; then
+  msg_error "iVentoy requires a privileged LXC container."
+  msg_error "Recreate the container with unprivileged=0."
+  exit 10
+fi
+
 fetch_and_deploy_gh_release "iventoy" "ventoy/PXE" "prebuild" "latest" "/opt/iventoy" "iventoy-*-linux-$(arch_resolve x86_64-free arm64-trial).tar.gz"
 mkdir -p /opt/iventoy/{data,iso}

@@ -37,10 +37,10 @@ fi
 msg_ok "Installed Docker"

 msg_info "Detecting latest Kasm Workspaces release"
-KASM_URL=$(curl -s https://kasm.com/downloads \
+KASM_URL=$(curl -s --max-time 30 https://kasm.com/downloads \
  | grep -oP 'https://kasm-static-content\.s3\.amazonaws\.com/kasm_release_\d+\.\d+\.\d+-latest\.tar\.gz' \
-  | head -1)
-KASM_VERSION=$(echo "$KASM_URL" | grep -oP '\d+\.\d+\.\d+(?=-latest)')
+  | head -1 || true)
+KASM_VERSION=$(echo "$KASM_URL" | grep -oP '\d+\.\d+\.\d+(?=-latest)' || true)

 # Fallback to predefined version if online lookup failed.
 if [[ -z "$KASM_VERSION" ]] || [[ -z "$KASM_URL" ]]; then
@@ -63,7 +63,7 @@ curl_download "/opt/kasm_release_${KASM_VERSION}.tar.gz" "$KASM_URL"
 cd /opt
 tar -xf "kasm_release_${KASM_VERSION}.tar.gz"
 chmod +x /opt/kasm_release/install.sh
-printf 'y\ny\ny\n4\n' | bash /opt/kasm_release/install.sh --ignore-dep-failures >~/kasm-install.output 2>&1
+bash /opt/kasm_release/install.sh --accept-eula --no-swap-check --no-check-disk --ignore-dep-failures >~/kasm-install.output 2>&1
 awk '
  /^Kasm UI Login Credentials$/ {capture=1}
  capture {print}
@@ -28,9 +28,15 @@ mkdir -p config/assets
 cp config/config.yml.template config/config.yml
 msg_ok "Setup Kometa"

-read -r -p "${TAB3}Enter your TMDb API key: " TMDBKEY
-read -r -p "${TAB3}Enter your Plex URL: " PLEXURL
-read -r -p "${TAB3}Enter your Plex token: " PLEXTOKEN
+TMDBKEY="${var_kometa_tmdb_key:-}"
+[[ -n "$TMDBKEY" ]] || read -r -p "${TAB3}Enter your TMDb API key: " TMDBKEY || true
+[[ -n "$TMDBKEY" ]] || { msg_error "No TMDb API key given; set var_kometa_tmdb_key or answer the prompt"; exit 64; }
+PLEXURL="${var_kometa_plex_url:-}"
+[[ -n "$PLEXURL" ]] || read -r -p "${TAB3}Enter your Plex URL: " PLEXURL || true
+[[ -n "$PLEXURL" ]] || { msg_error "No Plex URL given; set var_kometa_plex_url or answer the prompt"; exit 64; }
+PLEXTOKEN="${var_kometa_plex_token:-}"
+[[ -n "$PLEXTOKEN" ]] || read -r -p "${TAB3}Enter your Plex token: " PLEXTOKEN || true
+[[ -n "$PLEXTOKEN" ]] || { msg_error "No Plex token given; set var_kometa_plex_token or answer the prompt"; exit 64; }
 sed -i '/^plex:/,/^[^ ]/{s|  url:.*|  url: '"$PLEXURL"'|}' /opt/kometa/config/config.yml
 sed -i '/^plex:/,/^[^ ]/{s|  token:.*|  token: '"$PLEXTOKEN"'|}' /opt/kometa/config/config.yml
 sed -i '/^tmdb:/,/^[^ ]/{s|  apikey:.*|  apikey: '"$TMDBKEY"'|}' /opt/kometa/config/config.yml
@@ -15,7 +15,8 @@ update_os

 echo "${TAB3}How would you like to handle SSL termination?"
 echo "${TAB3}[i]-Internal (self-signed SSL Certificate)   [e]-External (use your own reverse proxy)"
-read -rp "${TAB3}Enter your choice <i/e> (default: i): " ssl_choice
+ssl_choice="${var_kutt_ssl:-}"
+[[ -n "$ssl_choice" ]] || read -rp "${TAB3}Enter your choice <i/e> (default: i): " ssl_choice || true
 ssl_choice=${ssl_choice:-i}
 case "${ssl_choice,,}" in
 i)
@@ -32,7 +33,9 @@ EOF
  msg_ok "Configured Caddy"
  ;;
 e)
-  read -r -p "${TAB3}Enter the hostname you want to use for Kutt (eg. kutt.example.com): " custom_host
+  custom_host="${var_kutt_hostname:-}"
+  [[ -n "$custom_host" ]] || read -r -p "${TAB3}Enter the hostname you want to use for Kutt (eg. kutt.example.com): " custom_host || true
+  [[ -n "$custom_host" ]] || { msg_error "No hostname given; set var_kutt_hostname or answer the prompt"; exit 64; }
  if [[ "$custom_host" ]]; then
    DEFAULT_HOST="$custom_host"
  fi
@@ -29,12 +29,12 @@ rm -f /tmp/LanguageTool-stable.zip
 msg_ok "Setup LanguageTool"

 ngram_dir=""
-lang_code=""
+lang_code="${var_languagetool_ngram_lang:-}"
 max_attempts=3
 attempt=0

 while [[ $attempt -lt $max_attempts ]]; do
-  read -r -p "${TAB3}Enter language code (en, de, es, fr, nl) to download ngrams or press ENTER to skip: " lang_code
+  [[ -n "$lang_code" ]] || read -r -p "${TAB3}Enter language code (en, de, es, fr, nl) to download ngrams or press ENTER to skip: " lang_code || lang_code=""

  if [[ -z "$lang_code" ]]; then
    break
@@ -43,11 +43,11 @@ while [[ $attempt -lt $max_attempts ]]; do
  if [[ "$lang_code" =~ [[:space:]] ]]; then
    ((attempt++))
    remaining=$((max_attempts - attempt))
+    lang_code=""
    if [[ $remaining -gt 0 ]]; then
      msg_error "Please enter only ONE language code. You have $remaining attempt(s) remaining."
    else
      msg_error "Maximum attempts reached. Continuing without ngrams."
-      lang_code=""
    fi
    continue
  fi
@@ -25,7 +25,7 @@ RUST_CRATES="monolith" setup_rust
 PG_DB_NAME="linkwardendb" PG_DB_USER="linkwarden" setup_postgresql_db

 prompt="${var_linkwarden_adminer:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Adminer? <y/N> " prompt
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Adminer? <y/N> " prompt || true
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
  setup_adminer
 fi
@@ -61,6 +61,7 @@ $STD yarn web:build
 $STD yarn prisma:deploy
 rm -rf ~/.cargo/registry ~/.cargo/git ~/.cargo/.package-cache
 rm -rf /root/.cache/yarn
+rm -rf /root/.yarn/berry/cache
 rm -rf /opt/linkwarden/.next/cache
 msg_ok "Installed Linkwarden"

@@ -22,7 +22,7 @@ setup_deb_based() {
  msg_ok "Setup MariaDB"

  prompt="${var_mariadb_phpmyadmin:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add PhpMyAdmin? <y/N> " prompt
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add PhpMyAdmin? <y/N> " prompt || true
  if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
    msg_info "Installing phpMyAdmin"
    $STD apt install -y \
@@ -60,7 +60,7 @@ setup_alpine() {
  msg_ok "MariaDB Configured"

  prompt="${var_mariadb_adminer:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install Adminer with lighttpd? <y/N>: " prompt
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install Adminer with lighttpd? <y/N>: " prompt || true
  if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
    msg_info "Installing Adminer and dependencies"
    $STD apk add --no-cache \
@@ -23,6 +23,7 @@ $STD apt install -y \
  libldap-common \
  libssl-dev \
  libldap2 \
+  ffmpeg \
  gosu \
  iproute2
 msg_ok "Installed Dependencies"
@@ -13,7 +13,9 @@ setting_up_container
 network_check
 update_os

-read -r -p "${TAB3}Enter the email address of your first admin user: " admin_email
+admin_email="${var_mediamanager_admin_email:-}"
+[[ -n "$admin_email" ]] || read -r -p "${TAB3}Enter the email address of your first admin user: " admin_email || true
+[[ -n "$admin_email" ]] || { msg_error "No admin e-mail given; set var_mediamanager_admin_email or answer the prompt"; exit 64; }
 if [[ "$admin_email" ]]; then
  EMAIL="$admin_email"
 fi
@@ -16,7 +16,7 @@ update_os
 MEILISEARCH_BIND="0.0.0.0:7700" setup_meilisearch

 prompt="${var_meilisearch_ui:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Do you want add meilisearch-ui? [y/n]: " prompt
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Do you want add meilisearch-ui? [y/n]: " prompt || true
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  NODE_VERSION="22" NODE_MODULE="pnpm@latest" setup_nodejs
  fetch_and_deploy_gh_release "meilisearch-ui" "riccox/meilisearch-ui" "tarball"
@@ -17,7 +17,7 @@ msg_info "Installing Dependencies"
 $STD apt install -y ca-certificates
 msg_ok "Installed Dependencies"

-NODE_VERSION="22" setup_nodejs
+NODE_VERSION="24" setup_nodejs

 msg_info "Installing MeshCentral"
 mkdir /opt/meshcentral
@@ -16,8 +16,9 @@ update_os
 if [[ "$(arch_resolve)" == "arm64" ]]; then
  MONGO_VERSION="8.0" setup_mongodb
 else
-  read -p "${TAB3}Do you want to install MongoDB 8.0 instead of 7.0? [y/N]: " install_mongodb_8
-  if [[ "$install_mongodb_8" =~ ^[Yy]$ ]]; then
+  install_mongodb_8="${var_mongodb_8:-}"
+  [[ -n "$install_mongodb_8" ]] || read -r -p "${TAB3}Do you want to install MongoDB 8.0 instead of 7.0? [y/N]: " install_mongodb_8 || true
+  if [[ "$install_mongodb_8" =~ ^[Yy]([Ee][Ss])?$ ]]; then
    MONGO_VERSION="8.0" setup_mongodb
  else
    MONGO_VERSION="7.0" setup_mongodb
@@ -21,7 +21,8 @@ msg_ok "Installed Dependencies"

 RELEASE_REPO="mysql-8.0"
 RELEASE_AUTH="mysql_native_password"
-read -r -p "${TAB3}Would you like to install the MySQL 8.4 LTS release instead of MySQL 8.0 (bug fix track; EOL April-2026)? <y/N> " prompt
+prompt="${var_mysql_lts:-}"
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install the MySQL 8.4 LTS release instead of MySQL 8.0 (bug fix track; EOL April-2026)? <y/N> " prompt || true
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
  RELEASE_REPO="mysql-8.4-lts"
  RELEASE_AUTH="caching_sha2_password"
@@ -61,7 +62,8 @@ echo -e "MySQL user: root" >>~/mysql.creds
 echo -e "MySQL password: $ADMIN_PASS" >>~/mysql.creds
 msg_ok "MySQL Server configured"

-read -r -p "${TAB3}Would you like to add PhpMyAdmin? <y/N> " prompt
+prompt="${var_mysql_phpmyadmin:-}"
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add PhpMyAdmin? <y/N> " prompt || true
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/phpmyadmin.sh)"
 fi
@@ -36,7 +36,8 @@ echo " 1) NetBird Managed (default) - Use NetBird's managed service"
 echo " 2) Self-Hosted - Use your own NetBird management server"
 echo ""

-read -r -p "${TAB3}Select deployment type [1]: " DEPLOYMENT_TYPE
+DEPLOYMENT_TYPE="${var_netbird_deployment:-}"
+[[ -n "$DEPLOYMENT_TYPE" ]] || read -r -p "${TAB3}Select deployment type [1]: " DEPLOYMENT_TYPE || true
 DEPLOYMENT_TYPE="${DEPLOYMENT_TYPE:-1}"

 NETBIRD_MGMT_URL=""
@@ -51,7 +52,8 @@ case "$DEPLOYMENT_TYPE" in
    echo "Enter your NetBird management server URL."
    echo "Example: https://management.example.com"
    echo ""
-    read -r -p "Management URL: " NETBIRD_MGMT_URL
+    NETBIRD_MGMT_URL="${var_netbird_mgmt_url:-}"
+    [[ -n "$NETBIRD_MGMT_URL" ]] || read -r -p "Management URL: " NETBIRD_MGMT_URL || true

    if [[ -z "$NETBIRD_MGMT_URL" ]]; then
      msg_warn "No management URL provided. Run 'netbird up --management-url <url>' to connect."
@@ -81,7 +83,8 @@ else
 fi
 echo ""

-read -r -p "Select authentication method [1]: " AUTH_METHOD
+AUTH_METHOD="${var_netbird_auth:-}"
+[[ -n "$AUTH_METHOD" ]] || read -r -p "Select authentication method [1]: " AUTH_METHOD || true
 AUTH_METHOD="${AUTH_METHOD:-1}"

 if [[ "$DEPLOYMENT_TYPE" == "1" ]]; then
@@ -90,7 +93,8 @@ if [[ "$DEPLOYMENT_TYPE" == "1" ]]; then
      echo ""
      echo "Enter your NetBird setup key from the NetBird dashboard."
      echo ""
-      read -r -p "Setup key: " NETBIRD_SETUP_KEY
+      NETBIRD_SETUP_KEY="${var_netbird_setup_key:-}"
+      [[ -n "$NETBIRD_SETUP_KEY" ]] || read -r -p "Setup key: " NETBIRD_SETUP_KEY || true
      echo ""

      if [[ -z "$NETBIRD_SETUP_KEY" ]]; then
@@ -136,7 +140,8 @@ else
      echo ""
      echo "Enter your NetBird setup key from the NetBird dashboard."
      echo ""
-      read -r -p "Setup key: " NETBIRD_SETUP_KEY
+      NETBIRD_SETUP_KEY="${var_netbird_setup_key:-}"
+      [[ -n "$NETBIRD_SETUP_KEY" ]] || read -r -p "Setup key: " NETBIRD_SETUP_KEY || true
      echo ""

      if [[ -z "$NETBIRD_SETUP_KEY" ]]; then
@@ -16,16 +16,15 @@ update_os
 fetch_and_deploy_gh_release "newt" "fosrl/newt" "singlefile" "latest" "/opt/newt" "newt_linux_$(arch_resolve)"
 ln -sf /opt/newt/newt /usr/local/bin/newt

-if [[ -z "${NEWT_ID:-}" ]]; then
-  read -rp "Newt ID (from your Pangolin dashboard): " NEWT_ID
-fi
-if [[ -z "${NEWT_SECRET:-}" ]]; then
-  read -rsp "Newt Secret: " NEWT_SECRET
+NEWT_ID="${NEWT_ID:-${var_newt_id:-}}"
+[[ -n "$NEWT_ID" ]] || read -rp "Newt ID (from your Pangolin dashboard): " NEWT_ID || true
+NEWT_SECRET="${NEWT_SECRET:-${var_newt_secret:-}}"
+if [[ -z "$NEWT_SECRET" ]]; then
+  read -rsp "Newt Secret: " NEWT_SECRET || true
  echo
 fi
-if [[ -z "${PANGOLIN_ENDPOINT:-}" ]]; then
-  read -rp "Pangolin endpoint (e.g. https://pangolin.example.com): " PANGOLIN_ENDPOINT
-fi
+PANGOLIN_ENDPOINT="${PANGOLIN_ENDPOINT:-${var_newt_endpoint:-}}"
+[[ -n "$PANGOLIN_ENDPOINT" ]] || read -rp "Pangolin endpoint (e.g. https://pangolin.example.com): " PANGOLIN_ENDPOINT || true

 if [[ -z "$NEWT_ID" || -z "$NEWT_SECRET" || -z "$PANGOLIN_ENDPOINT" ]]; then
  msg_error "Newt ID, Secret and Endpoint are all required. Aborting."
@@ -38,12 +38,14 @@ curl -fsSL "https://raw.githubusercontent.com/ZoeyVid/NPMplus/refs/heads/develop
 msg_ok "Fetched NPMplus"

 attempts=0
+TZ_INPUT="${var_npmplus_tz:-}"
 while true; do
-  read -r -p "${TAB3}Enter your TZ Identifier (e.g., Europe/Berlin): " TZ_INPUT
+  [[ -n "$TZ_INPUT" ]] || read -r -p "${TAB3}Enter your TZ Identifier (e.g., Europe/Berlin): " TZ_INPUT || { msg_error "No TZ identifier given; set var_npmplus_tz or answer the prompt"; exit 64; }
  if validate_tz "$TZ_INPUT"; then
    break
  fi
  msg_error "Invalid timezone! Please enter a valid TZ identifier."
+  TZ_INPUT=""

  attempts=$((attempts + 1))
  if [[ "$attempts" -ge 3 ]]; then
@@ -52,7 +54,9 @@ while true; do
  fi
 done

-read -r -p "${TAB3}Enter your ACME Email: " ACME_EMAIL_INPUT
+ACME_EMAIL_INPUT="${var_npmplus_acme_email:-}"
+[[ -n "$ACME_EMAIL_INPUT" ]] || read -r -p "${TAB3}Enter your ACME Email: " ACME_EMAIL_INPUT || true
+[[ -n "$ACME_EMAIL_INPUT" ]] || { msg_error "No ACME e-mail given; set var_npmplus_acme_email or answer the prompt"; exit 64; }

 yq -i "
  .services.npmplus.environment |=
@@ -57,10 +57,6 @@ else
  }
 fi
 msg_ok "Installed Intel® Level Zero"
-
-msg_info "Installing Intel® oneAPI Base Toolkit (Patience)"
-$STD apt install -y --no-install-recommends intel-basekit-2024.1
-msg_ok "Installed Intel® oneAPI Base Toolkit"
 fi

 msg_info "Installing Ollama (Patience)"
@@ -14,7 +14,9 @@ network_check
 update_os

 msg_info "Installing Dependencies"
-$STD apt install -y nginx
+$STD apt install -y \
+  git \
+  nginx
 msg_ok "Installed Dependencies"

 NODE_VERSION="24" setup_nodejs
@@ -24,6 +26,8 @@ msg_info "Building OmniTools"
 cd /opt/omnitools
 export HUSKY=0
 $STD npm ci --allow-remote=all
+$STD git init -q
+$STD git -c user.name=build -c user.email=build@localhost commit -q --allow-empty -m build
 $STD npm run build
 msg_ok "Built OmniTools"

@@ -17,19 +17,23 @@ MAX_ATTEMPTS=3
 servers=("opencloud" "collabora" "wopi")
 attempt=0
 for server in "${servers[@]}"; do
+  fqdn_var="var_opencloud_${server}_fqdn"
+  fqdn="${!fqdn_var:-}"
  until ((attempt >= MAX_ATTEMPTS)); do
    attempt=$((attempt + 1))
-    read -rp "${TAB3}Enter the FQDN of your ${server^} server (ATTEMPT $attempt/$MAX_ATTEMPTS) (eg $server.domain.tld): " fqdn
+    [[ -n "$fqdn" ]] || read -rp "${TAB3}Enter the FQDN of your ${server^} server (ATTEMPT $attempt/$MAX_ATTEMPTS) (eg $server.domain.tld): " fqdn || { msg_error "No ${server^} FQDN given; set ${fqdn_var} or answer the prompt"; exit 64; }
    if [[ -z "$fqdn" ]]; then
      msg_warn "Domain cannot be empty!"
    elif [[ "$fqdn" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]]; then
      msg_warn "IP address not allowed! Please use a FQDN"
+      fqdn=""
    elif [[ "$fqdn" =~ ^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*\.[a-zA-Z]{2,}$ ]]; then
      export ${server^^}_FQDN="$fqdn"
      attempt=0
      break
    else
      msg_warn "Invalid domain format!"
+      fqdn=""
    fi
  done
  if ((attempt >= MAX_ATTEMPTS)); then
@@ -27,7 +27,7 @@ PYTHON_VERSION="3.12" setup_uv

 OTEL_ARGS=()
 prompt="${var_openwebui_otel:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install OpenTelemetry instrumentation packages (requires manual .env configuration)? <y/N> " prompt
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install OpenTelemetry instrumentation packages (requires manual .env configuration)? <y/N> " prompt || true
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  for pkg in \
    opentelemetry-api \
@@ -57,7 +57,7 @@ done
 msg_ok "Installed Open WebUI"

 prompt="${var_openwebui_ollama:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Ollama? <y/N> " prompt
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Ollama? <y/N> " prompt || true
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  if [[ "$(arch_resolve)" == "amd64" ]]; then
  msg_info "Setting up Intel® Repositories"
@@ -96,10 +96,6 @@ EOF
    }
  fi
  msg_ok "Installed Intel® Level Zero"
-
-  msg_info "Installing Intel® oneAPI Base Toolkit (Patience)"
-  $STD apt install -y --no-install-recommends intel-basekit-2024.1 2>/dev/null || true
-  msg_ok "Installed Intel® oneAPI Base Toolkit"
  fi

  msg_info "Installing Ollama"
@@ -27,17 +27,22 @@ apt_update_safe
 $STD apt install -y openziti-controller openziti-console </dev/null
 msg_ok "Installed openziti"

-read -r -p "${TAB3}Would you like to go through the auto configuration now? <y/N>" prompt
+prompt="${var_openziti_controller_autoconfig:-}"
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to go through the auto configuration now? <y/N>" prompt || true
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  GEN_FQDN="controller.${LOCAL_IP}.sslip.io"
-  read -r -p "${TAB3}Please enter the controller FQDN [${GEN_FQDN}]: " ZITI_CTRL_ADVERTISED_ADDRESS
+  ZITI_CTRL_ADVERTISED_ADDRESS="${var_openziti_controller_fqdn:-}"
+  [[ -n "$ZITI_CTRL_ADVERTISED_ADDRESS" ]] || read -r -p "${TAB3}Please enter the controller FQDN [${GEN_FQDN}]: " ZITI_CTRL_ADVERTISED_ADDRESS || true
  ZITI_CTRL_ADVERTISED_ADDRESS=${ZITI_CTRL_ADVERTISED_ADDRESS:-$GEN_FQDN}
-  read -r -p "${TAB3}Please enter the controller port [1280]: " ZITI_CTRL_ADVERTISED_PORT
+  ZITI_CTRL_ADVERTISED_PORT="${var_openziti_controller_port:-}"
+  [[ -n "$ZITI_CTRL_ADVERTISED_PORT" ]] || read -r -p "${TAB3}Please enter the controller port [1280]: " ZITI_CTRL_ADVERTISED_PORT || true
  ZITI_CTRL_ADVERTISED_PORT=${ZITI_CTRL_ADVERTISED_PORT:-1280}
-  read -r -p "${TAB3}Please enter the controller admin user [admin]: " ZITI_USER
+  ZITI_USER="${var_openziti_controller_user:-}"
+  [[ -n "$ZITI_USER" ]] || read -r -p "${TAB3}Please enter the controller admin user [admin]: " ZITI_USER || true
  ZITI_USER=${ZITI_USER:-admin}
  GEN_PWD=$(head -c128 /dev/urandom | LC_ALL=C tr -dc 'A-Za-z0-9!@#$%^*_+~' | cut -c 1-12)
-  read -r -p "${TAB3}Please enter the controller admin password [${GEN_PWD}]:" ZITI_PWD
+  ZITI_PWD="${var_openziti_controller_password:-}"
+  [[ -n "$ZITI_PWD" ]] || read -r -p "${TAB3}Please enter the controller admin password [${GEN_PWD}]:" ZITI_PWD || true
  ZITI_PWD=${ZITI_PWD:-$GEN_PWD}
  CONFIG_FILE="/opt/openziti/etc/controller/bootstrap.env"
  sed -i "s|^ZITI_CTRL_ADVERTISED_ADDRESS=.*|ZITI_CTRL_ADVERTISED_ADDRESS='${ZITI_CTRL_ADVERTISED_ADDRESS}'|" "$CONFIG_FILE"
@@ -29,7 +29,8 @@ sed -i '0,/^ExecStart/ { /^ExecStart/ { n; s|^ExecStart.*|ExecStart=/opt/openzit
 systemctl daemon-reload
 msg_ok "Installed openziti"

-read -r -p "${TAB3}Please paste an identity enrollment token(JTW)" prompt
+prompt="${var_openziti_tunnel_enrollment_token:-}"
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Please paste an identity enrollment token(JTW)" prompt || true
 if [[ ${prompt} ]]; then
  msg_info "Adding identity"
  echo "${prompt}" >/opt/openziti/etc/identities/identity.jwt
--- a/Show More
+++ b/Show More