Update pangolin-install.sh

Update pangolin.sh
fix env
2026-07-14 01:45:08 +02:00 · 2026-07-13 13:06:34 +02:00 · 2026-07-13 13:05:48 +02:00 · 2026-07-10 20:18:46 +02:00 · 2026-07-10 15:41:28 +02:00 · 2026-07-10 15:37:31 +02:00
28 changed files with 242 additions and 1173 deletions
@@ -1,94 +1,3 @@
-## 2026-07-11
-
-### 🆕 New Scripts
-
-  - LocalAGI ([#15687](https://github.com/community-scripts/ProxmoxVE/pull/15687))
-
-### 🚀 Updated Scripts
-
-  - fix(adventurelog): allow pnpm build scripts so install/update doesn't abort [@TowyTowy](https://github.com/TowyTowy) ([#15681](https://github.com/community-scripts/ProxmoxVE/pull/15681))
-
-  - #### 🐞 Bug Fixes
-
-    - fix(fileflows): install .NET 10 ASP.NET Core Runtime to match current release [@TowyTowy](https://github.com/TowyTowy) ([#15702](https://github.com/community-scripts/ProxmoxVE/pull/15702))
-    - Fix spacing on VLAN Input Box in haos-vm.sh [@pumrum](https://github.com/pumrum) ([#15696](https://github.com/community-scripts/ProxmoxVE/pull/15696))
-
-### 💾 Core
-
-  - #### ✨ New Features
-
-    - [tools.func]: Add function to handle deployment via GitLab release tags [@tremor021](https://github.com/tremor021) ([#15641](https://github.com/community-scripts/ProxmoxVE/pull/15641))
-
-## 2026-07-10
-
-### 🆕 New Scripts
-
-  - Squid ([#15605](https://github.com/community-scripts/ProxmoxVE/pull/15605))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Adapt to new artifact filename format for pocket id [@wollew](https://github.com/wollew) ([#15689](https://github.com/community-scripts/ProxmoxVE/pull/15689))
-    - Fireshare: Fix for install and upgrade to v1.7.3 [@tremor021](https://github.com/tremor021) ([#15673](https://github.com/community-scripts/ProxmoxVE/pull/15673))
-    - Endurain: Fix update procedure [@tremor021](https://github.com/tremor021) ([#15674](https://github.com/community-scripts/ProxmoxVE/pull/15674))
-
-## 2026-07-09
-
-### 🚀 Updated Scripts
-
-  - fix(pihole): repair Unbound DNS-over-TLS (DoT) forwarding config [@TowyTowy](https://github.com/TowyTowy) ([#15654](https://github.com/community-scripts/ProxmoxVE/pull/15654))
-
-## 2026-07-08
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Opencloud: Bump version to 7.2.1 [@vhsdream](https://github.com/vhsdream) ([#15655](https://github.com/community-scripts/ProxmoxVE/pull/15655))
-    - BabyBuddy: Harden update script [@MickLesk](https://github.com/MickLesk) ([#15642](https://github.com/community-scripts/ProxmoxVE/pull/15642))
-
-## 2026-07-07
-
-### 🆕 New Scripts
-
-  - Forgejo-Runner ([#15046](https://github.com/community-scripts/ProxmoxVE/pull/15046))
-
-## 2026-07-06
-
-### 🚀 Updated Scripts
-
-  - Fix alignment in various ct end messages [@tremor021](https://github.com/tremor021) ([#15632](https://github.com/community-scripts/ProxmoxVE/pull/15632))
- Immich: Update libvips to 8.18.4 [@vhsdream](https://github.com/vhsdream) ([#15619](https://github.com/community-scripts/ProxmoxVE/pull/15619))
-
-  - #### 🐞 Bug Fixes
-
-    - Wizarr: Build JS and CSS static assets [@vhsdream](https://github.com/vhsdream) ([#15634](https://github.com/community-scripts/ProxmoxVE/pull/15634))
-    - RustDesk Server: Update URL format in rustdeskserver.sh [@tremor021](https://github.com/tremor021) ([#15626](https://github.com/community-scripts/ProxmoxVE/pull/15626))
-    - attempt to port docker-vm to support arm64 [@asylumexp](https://github.com/asylumexp) ([#15611](https://github.com/community-scripts/ProxmoxVE/pull/15611))
-    - fix(plane): don't clobber global app var, breaking /usr/bin/update [@asylumexp](https://github.com/asylumexp) ([#15612](https://github.com/community-scripts/ProxmoxVE/pull/15612))
-
-  - #### 🔧 Refactor
-
-    - cliproxyapi: point setup message at /management.html [@austinpilz](https://github.com/austinpilz) ([#15628](https://github.com/community-scripts/ProxmoxVE/pull/15628))
-
-### 🗑️ Deleted Scripts
-
-  - Remove: FlowiseAI [@MickLesk](https://github.com/MickLesk) ([#15624](https://github.com/community-scripts/ProxmoxVE/pull/15624))
-
-## 2026-07-05
-
-### 🆕 New Scripts
-
-  - excalidash ([#15604](https://github.com/community-scripts/ProxmoxVE/pull/15604))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - fix: homarr: cli [@CrazyWolf13](https://github.com/CrazyWolf13) ([#15603](https://github.com/community-scripts/ProxmoxVE/pull/15603))
-    - immich: vacuum smart_search/face_search before VectorChord bump [@irishpadres](https://github.com/irishpadres) ([#15607](https://github.com/community-scripts/ProxmoxVE/pull/15607))
-
 ## 2026-07-04

 ### 🚀 Updated Scripts
@@ -74,9 +74,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit



-
-
-



@@ -90,7 +87,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit


 <details>
-<summary><h4>July (11 entries)</h4></summary>
+<summary><h4>July (4 entries)</h4></summary>

 [View July 2026 Changelog](.github/changelogs/2026/07.md)

@@ -502,68 +499,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 </details>

-## 2026-07-13
-
-### 🚀 Updated Scripts
-
-  - fix(hyperion): keep service running after container reboot [@TowyTowy](https://github.com/TowyTowy) ([#15653](https://github.com/community-scripts/ProxmoxVE/pull/15653))
-
-  - #### 🐞 Bug Fixes
-
-    - immich: use actual PostgreSQL version for VectorChord package lookup [@mnavon](https://github.com/mnavon) ([#15705](https://github.com/community-scripts/ProxmoxVE/pull/15705))
-    - fix storyteller release selection for stable web tags [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15736](https://github.com/community-scripts/ProxmoxVE/pull/15736))
-    - Docmost: Fix update procedure [@MickLesk](https://github.com/MickLesk) ([#15732](https://github.com/community-scripts/ProxmoxVE/pull/15732))
-    - fix(shinobi): remove obsolete --unsafe-perm npm flag [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15730](https://github.com/community-scripts/ProxmoxVE/pull/15730))
-
-  - #### 💥 Breaking Changes
-
-    - reitti: update to v5 [@CrazyWolf13](https://github.com/CrazyWolf13) ([#15635](https://github.com/community-scripts/ProxmoxVE/pull/15635))
-
-### 💾 Core
-
-  - #### 🐞 Bug Fixes
-
-    - fix(build.func): parse script status without jq dependency [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15729](https://github.com/community-scripts/ProxmoxVE/pull/15729))
-
-  - #### 🔧 Refactor
-
-    - tools.func: some improvements (sql injection / command injection / guard) [@MickLesk](https://github.com/MickLesk) ([#15661](https://github.com/community-scripts/ProxmoxVE/pull/15661))
-
-## 2026-07-12
-
-### 🆕 New Scripts
-
-  - AFFiNE ([#15690](https://github.com/community-scripts/ProxmoxVE/pull/15690))
-
-### 🚀 Updated Scripts
-
-  - Immich: Bump version to 3.0.2 [@vhsdream](https://github.com/vhsdream) ([#15668](https://github.com/community-scripts/ProxmoxVE/pull/15668))
-
-### ❔ Uncategorized
-
-  - fix(immich): correct Python indentation error in ct/immich.sh heredoc patch [@Copilot](https://github.com/Copilot) ([#15723](https://github.com/community-scripts/ProxmoxVE/pull/15723))
-
-## 2026-07-11
-
-### 🆕 New Scripts
-
-  - LocalAGI ([#15687](https://github.com/community-scripts/ProxmoxVE/pull/15687))
-
-### 🚀 Updated Scripts
-
-  - fix(adventurelog): allow pnpm build scripts so install/update doesn't abort [@TowyTowy](https://github.com/TowyTowy) ([#15681](https://github.com/community-scripts/ProxmoxVE/pull/15681))
-
-  - #### 🐞 Bug Fixes
-
-    - fix(fileflows): install .NET 10 ASP.NET Core Runtime to match current release [@TowyTowy](https://github.com/TowyTowy) ([#15702](https://github.com/community-scripts/ProxmoxVE/pull/15702))
-    - Fix spacing on VLAN Input Box in haos-vm.sh [@pumrum](https://github.com/pumrum) ([#15696](https://github.com/community-scripts/ProxmoxVE/pull/15696))
-
-### 💾 Core
-
-  - #### ✨ New Features
-
-    - [tools.func]: Add function to handle deployment via GitLab release tags [@tremor021](https://github.com/tremor021) ([#15641](https://github.com/community-scripts/ProxmoxVE/pull/15641))
-
 ## 2026-07-10

 ### 🆕 New Scripts
@@ -574,7 +509,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

  - #### 🐞 Bug Fixes

-    - Adapt to new artifact filename format for pocket id [@wollew](https://github.com/wollew) ([#15689](https://github.com/community-scripts/ProxmoxVE/pull/15689))
    - Fireshare: Fix for install and upgrade to v1.7.3 [@tremor021](https://github.com/tremor021) ([#15673](https://github.com/community-scripts/ProxmoxVE/pull/15673))
    - Endurain: Fix update procedure [@tremor021](https://github.com/tremor021) ([#15674](https://github.com/community-scripts/ProxmoxVE/pull/15674))

@@ -1148,4 +1082,135 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

  - #### ✨ New Features

-    - [core] Implement backup and restore functions [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15067](https://github.com/community-scripts/ProxmoxVE/pull/15067))
+    - [core] Implement backup and restore functions [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15067](https://github.com/community-scripts/ProxmoxVE/pull/15067))
+
+## 2026-06-11
+
+### 🆕 New Scripts
+
+  - Clickhouse ([#15045](https://github.com/community-scripts/ProxmoxVE/pull/15045))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Manyfold: add new dependency [@MickLesk](https://github.com/MickLesk) ([#15040](https://github.com/community-scripts/ProxmoxVE/pull/15040))
+    - OpenArchiver: switch Rebuild Function [@MickLesk](https://github.com/MickLesk) ([#15042](https://github.com/community-scripts/ProxmoxVE/pull/15042))
+    - CLIProxyAPI: Save management password to creds file [@tremor021](https://github.com/tremor021) ([#15051](https://github.com/community-scripts/ProxmoxVE/pull/15051))
+    - Jotty: Fix wrong path test in config restore [@vhsdream](https://github.com/vhsdream) ([#15038](https://github.com/community-scripts/ProxmoxVE/pull/15038))
+    - Fix for cross-seed after node upgrade [@TorinFrancis](https://github.com/TorinFrancis) ([#15025](https://github.com/community-scripts/ProxmoxVE/pull/15025))
+
+  - #### 🔧 Refactor
+
+    - Alpine-Nextcloud: Upgrade PHP and dependencies in installation script [@MickLesk](https://github.com/MickLesk) ([#15039](https://github.com/community-scripts/ProxmoxVE/pull/15039))
+    - [arm64] porting stage 1: set script arm64 statuses to yes [@asylumexp](https://github.com/asylumexp) ([#15052](https://github.com/community-scripts/ProxmoxVE/pull/15052))
+
+### 💾 Core
+
+  - #### ✨ New Features
+
+    - misc scripts: add support for arm64 [@asylumexp](https://github.com/asylumexp) ([#12639](https://github.com/community-scripts/ProxmoxVE/pull/12639))
+
+  - #### 🔧 Refactor
+
+    - [arm64] remove logic for custom debian arm64 template [@asylumexp](https://github.com/asylumexp) ([#15050](https://github.com/community-scripts/ProxmoxVE/pull/15050))
+
+### 📚 Documentation
+
+  - (github): Revise script request template [@MickLesk](https://github.com/MickLesk) ([#15058](https://github.com/community-scripts/ProxmoxVE/pull/15058))
+
+## 2026-06-10
+
+### 🆕 New Scripts
+
+  - Baserow ([#14968](https://github.com/community-scripts/ProxmoxVE/pull/14968))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Koillection: Fix update procedure [@tremor021](https://github.com/tremor021) ([#15033](https://github.com/community-scripts/ProxmoxVE/pull/15033))
+
+## 2026-06-09
+
+### 🆕 New Scripts
+
+  - paperclip ([#14990](https://github.com/community-scripts/ProxmoxVE/pull/14990))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - endurain: Install pytz package during backend setup [@MickLesk](https://github.com/MickLesk) ([#15014](https://github.com/community-scripts/ProxmoxVE/pull/15014))
+
+  - #### 🔧 Refactor
+
+    - Refactor: Proxmox Backup Server - use deb822 [@MickLesk](https://github.com/MickLesk) ([#15013](https://github.com/community-scripts/ProxmoxVE/pull/15013))
+
+## 2026-06-08
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - security: Fix HTTP to HTTPS for all package and repository downloads [@MickLesk](https://github.com/MickLesk) ([#15009](https://github.com/community-scripts/ProxmoxVE/pull/15009))
+    - homelable: preserve MCP server config across updates [@ferr079](https://github.com/ferr079) ([#14996](https://github.com/community-scripts/ProxmoxVE/pull/14996))
+    - changedetection: migrate Python install to uv venv [@ferr079](https://github.com/ferr079) ([#14995](https://github.com/community-scripts/ProxmoxVE/pull/14995))
+
+  - #### 🔧 Refactor
+
+    - Update Flowwiseai to node 24 [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#14999](https://github.com/community-scripts/ProxmoxVE/pull/14999))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - security: Fix MITM RCE vulnerability in microcode scripts (CVE) [@MickLesk](https://github.com/MickLesk) ([#15007](https://github.com/community-scripts/ProxmoxVE/pull/15007))
+
+## 2026-06-07
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Immich: use actual installed PostgreSQL version for vchord package [@MickLesk](https://github.com/MickLesk) ([#14989](https://github.com/community-scripts/ProxmoxVE/pull/14989))
+
+  - #### 🔧 Refactor
+
+    - Navidrome: remove genereic filebrowser addon setup [@MickLesk](https://github.com/MickLesk) ([#14991](https://github.com/community-scripts/ProxmoxVE/pull/14991))
+
+## 2026-06-06
+
+### 🆕 New Scripts
+
+  - Spliit ([#14966](https://github.com/community-scripts/ProxmoxVE/pull/14966))
+- Tolgee ([#14965](https://github.com/community-scripts/ProxmoxVE/pull/14965))
+- XYOps ([#14967](https://github.com/community-scripts/ProxmoxVE/pull/14967))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Photoprism: Allow env variables with spaces [@Badintral](https://github.com/Badintral) ([#14969](https://github.com/community-scripts/ProxmoxVE/pull/14969))
+
+## 2026-06-05
+
+### 🆕 New Scripts
+
+  - MatterJS-Server ([#14951](https://github.com/community-scripts/ProxmoxVE/pull/14951))
+- CyberChef ([#14952](https://github.com/community-scripts/ProxmoxVE/pull/14952))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Jackett: Create missing .env file [@tremor021](https://github.com/tremor021) ([#14959](https://github.com/community-scripts/ProxmoxVE/pull/14959))
+    - OpenThread-BR: use systemd instead of init.d [@tomfrenzel](https://github.com/tomfrenzel) ([#14942](https://github.com/community-scripts/ProxmoxVE/pull/14942))
+
+  - #### ✨ New Features
+
+    - AMD IGPU support [@Learath](https://github.com/Learath) ([#14944](https://github.com/community-scripts/ProxmoxVE/pull/14944))
+
+  - #### 💥 Breaking Changes
+
+    - update authentik to 2026.5.2 [@thieneret](https://github.com/thieneret) ([#14846](https://github.com/community-scripts/ProxmoxVE/pull/14846))
@@ -60,7 +60,6 @@ function update_script() {
    $STD .venv/bin/python -m manage migrate

    cd /opt/adventurelog/frontend
-    grep -q "^dangerouslyAllowAllBuilds:" ./pnpm-workspace.yaml 2>/dev/null || echo "dangerouslyAllowAllBuilds: true" >>./pnpm-workspace.yaml
    $STD pnpm i
    $STD pnpm build
    msg_ok "Updated AdventureLog"
@@ -1,127 +0,0 @@
-#!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/toeverything/AFFiNE
-
-APP="AFFiNE"
-var_tags="${var_tags:-knowledge;notes;workspace}"
-var_cpu="${var_cpu:-4}"
-var_ram="${var_ram:-8192}"
-var_disk="${var_disk:-20}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-no}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/affine ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "affine_app" "toeverything/AFFiNE"; then
-    msg_info "Stopping Services"
-    systemctl stop affine-web affine-worker
-    msg_ok "Stopped Services"
-
-    create_backup /root/.affine/config /root/.affine/storage
-
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "latest" "/opt/affine"
-
-    msg_info "Rebuilding Application (Patience)"
-    cd /opt/affine
-    source /root/.profile
-    export PATH="/root/.cargo/bin:/root/.rbenv/shims:$PATH"
-
-    set -a && source /opt/affine/.env && set +a
-
-    export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
-    export VITE_CORE_COMMIT_SHA=$(cat ~/.affine_app)
-
-    # Initialize git repo (required for build process)
-    $STD git init -q
-    $STD git config user.email "build@local"
-    $STD git config user.name "Build"
-    $STD git add -A
-    $STD git commit -q -m "update"
-
-    # Force Turbo to run sequentially
-    mkdir -p /opt/affine/.turbo
-    cat <<TURBO >/opt/affine/.turbo/config.json
-{
-  "concurrency": 1
-}
-TURBO
-
-    $STD corepack enable
-    $STD corepack prepare yarn@4.12.0 --activate
-    $STD yarn config set enableTelemetry 0
-
-    export NODE_OPTIONS="--max-old-space-size=2048"
-    $STD yarn install
-    $STD npm install -g typescript
-
-    $STD yarn affine @affine/native build
-    $STD yarn affine @affine/server-native build
-
-    # Create architecture-specific symlinks
-    ln -sf /opt/affine/packages/backend/native/server-native.node \
-      /opt/affine/packages/backend/native/server-native.x64.node
-    ln -sf /opt/affine/packages/backend/native/server-native.node \
-      /opt/affine/packages/backend/native/server-native.arm64.node
-    ln -sf /opt/affine/packages/backend/native/server-native.node \
-      /opt/affine/packages/backend/native/server-native.armv7.node
-
-    $STD yarn affine init
-    $STD yarn affine build -p @affine/reader
-    $STD yarn affine build -p @affine/server
-
-    export NODE_OPTIONS="--max-old-space-size=4096"
-    $STD yarn affine build -p @affine/web
-    $STD yarn affine build -p @affine/admin
-
-    # Copy web assets
-    mkdir -p /opt/affine/packages/backend/server/static
-    cp -r /opt/affine/packages/frontend/apps/web/dist/* /opt/affine/packages/backend/server/static/
-    mkdir -p /opt/affine/packages/backend/server/static/admin
-    cp -r /opt/affine/packages/frontend/admin/dist/* /opt/affine/packages/backend/server/static/admin/
-
-    # Mobile manifest placeholder
-    mkdir -p /opt/affine/packages/backend/server/static/mobile
-    echo '{"publicPath":"/","js":[],"css":[],"gitHash":"","description":""}' \
-      >/opt/affine/packages/backend/server/static/mobile/assets-manifest.json
-
-    # Run migrations
-    cd /opt/affine/packages/backend/server
-    set -a && source /opt/affine/.env && set +a
-    $STD node ./scripts/self-host-predeploy.js
-
-    restore_backup
-
-    msg_info "Starting Services"
-    systemctl start affine-web affine-worker
-    msg_ok "Started Services"
-    msg_ok "Updated Successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:3010/sign-in${CL}"
@@ -39,6 +39,7 @@ function update_script() {

    create_backup /opt/docmost/.env \
      /opt/docmost/data
+
    fetch_and_deploy_gh_release "docmost" "docmost/docmost" "tarball"

    restore_backup
@@ -53,11 +54,9 @@ function update_script() {
      sed -i '/^@Module({$/i @Global()' /opt/docmost/apps/server/src/core/core.module.ts
    fi

-    msg_info "Configuring Docmost"
-    cd /opt/docmost
    $STD pnpm install --force
    $STD pnpm build
-    msg_ok "Configured Docmost"
+    msg_ok "Updated ${APP}"

    msg_info "Starting Service"
    systemctl start docmost
@@ -43,28 +43,6 @@ function update_script() {
    tar -czf "$backup_filename" -C /opt/fileflows Data
    msg_ok "Backup Created"

-    # FileFlows tracks the latest release, whose .NET target can move (e.g. 8 -> 10);
-    # ensure the current ASP.NET Core Runtime so an existing install doesn't fail to
-    # start after updating to a newer .NET major version.
-    msg_info "Ensuring ASP.NET Core Runtime"
-    if [[ "$(arch_resolve)" == "arm64" ]]; then
-      if [[ ! -x /usr/lib/dotnet10/dotnet ]]; then
-        curl -fsSL https://dot.net/v1/dotnet-install.sh -o /tmp/dotnet-install.sh
-        $STD bash /tmp/dotnet-install.sh --channel 10.0 --runtime aspnetcore --install-dir /usr/lib/dotnet10
-        ln -sf /usr/lib/dotnet10/dotnet /usr/bin/dotnet
-        rm -f /tmp/dotnet-install.sh
-      fi
-    elif ! is_package_installed "aspnetcore-runtime-10.0"; then
-      $STD apt remove -y aspnetcore-runtime-8.0 aspnetcore-runtime-9.0 2>/dev/null || true
-      setup_deb822_repo \
-        "microsoft" \
-        "https://packages.microsoft.com/keys/microsoft-2025.asc" \
-        "https://packages.microsoft.com/debian/13/prod/" \
-        "trixie"
-      $STD apt install -y aspnetcore-runtime-10.0
-    fi
-    msg_ok "Ensured ASP.NET Core Runtime"
-
    fetch_and_deploy_from_url "https://fileflows.com/downloads/zip" "/opt/fileflows"

    msg_info "Starting Service"
@@ -1,6 +0,0 @@
-    ___    _____________ _   ________
-   /   |  / ____/ ____(_) | / / ____/
-  / /| | / /_  / /_  / /  |/ / __/   
- / ___ |/ __/ / __/ / / /|  / /___   
-/_/  |_/_/   /_/   /_/_/ |_/_____/   
-                                     
@@ -1,6 +0,0 @@
-    __                     _____   __________
-   / /   ____  _________ _/ /   | / ____/  _/
-  / /   / __ \/ ___/ __ `/ / /| |/ / __ / /  
- / /___/ /_/ / /__/ /_/ / / ___ / /_/ // /   
-/_____/\____/\___/\__,_/_/_/  |_\____/___/   
-                                             
@@ -110,7 +110,7 @@ EOF
    msg_ok "Image-processing libraries up to date"
  fi

-  RELEASE="v3.0.2"
+  RELEASE="v3.0.1"
  if check_for_gh_release "Immich" "immich-app/immich" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
    if [[ $(cat ~/.immich) > "2.5.1" ]]; then
      msg_info "Enabling Maintenance Mode"
@@ -124,9 +124,7 @@ EOF
    systemctl stop immich-web
    systemctl stop immich-ml
    msg_ok "Stopped Services"
-    VCHORD_RELEASE="1.1.1"
-    PG_VERSION=$(ls /etc/postgresql/ 2>/dev/null | sort -V | tail -1)
-    PG_VERSION=${PG_VERSION:-16}
+    VCHORD_RELEASE="1.0.0"
    [[ -f ~/.vchord_version ]] && mv ~/.vchord_version ~/.vectorchord
    if check_for_gh_release "VectorChord" "tensorchord/VectorChord" "${VCHORD_RELEASE}" "updated together with Immich after testing"; then
      # dead tuples in smart_search/face_search make the REINDEX below fail with
@@ -134,7 +132,7 @@ EOF
      # while still on the old extension version, a post-upgrade vacuum errors instead
      $STD sudo -u postgres psql -d immich -c "VACUUM (ANALYZE) smart_search;"
      $STD sudo -u postgres psql -d immich -c "VACUUM (ANALYZE) face_search;"
-      fetch_and_deploy_gh_release "VectorChord" "tensorchord/VectorChord" "binary" "${VCHORD_RELEASE}" "/tmp" "postgresql-${PG_VERSION}-vchord_*_$(arch_resolve).deb"
+      fetch_and_deploy_gh_release "VectorChord" "tensorchord/VectorChord" "binary" "${VCHORD_RELEASE}" "/tmp" "postgresql-16-vchord_*_$(arch_resolve).deb"
      systemctl restart postgresql
      $STD sudo -u postgres psql -d immich -c "ALTER EXTENSION vector UPDATE;"
      $STD sudo -u postgres psql -d immich -c "ALTER EXTENSION vchord UPDATE;"
@@ -330,27 +328,6 @@ EOF
      systemctl daemon-reload
    fi

-    # MickLesk temporary patch for HEIC thumbnail gen
-    msg_info "Patching media.repository.js"
-    MEDIA_REPO_JS="/opt/immich/app/dist/repositories/media.repository.js"
-    if [[ -f "$MEDIA_REPO_JS" ]]; then
-      python3 - <<'PY'
-from pathlib import Path
-p = Path('/opt/immich/app/dist/repositories/media.repository.js')
-s = p.read_text()
-old = "(0, sharp_1.default)(input).metadata()"
-new = "(0, sharp_1.default)(input, { unlimited: true, limitInputPixels: false }).metadata()"
-if new in s:
-    print('hotfix already there')
-elif old in s:
-    p.write_text(s.replace(old, new, 1))
-    print('hotfix applied')
-else:
-    print('pattern not found, skipped')
-PY
-    fi
-    msg_ok "Patched media.repository.js"
-
    # chown excluding upload dir contents (may be a mount with restricted permissions)
    chown immich:immich "$INSTALL_DIR"
    find "$INSTALL_DIR" -maxdepth 1 -mindepth 1 ! -name upload -exec chown -R immich:immich {} +
@@ -1,67 +0,0 @@
-#!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: BillyOutlast
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/mudler/LocalAGI
-
-APP="LocalAGI"
-var_tags="${var_tags:-ai}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-4096}"
-var_disk="${var_disk:-20}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-no}"
-var_unprivileged="${var_unprivileged:-1}"
-var_gpu="${var_gpu:-no}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/localagi ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "localagi" "mudler/LocalAGI"; then
-    msg_info "Stopping Service"
-    systemctl stop localagi
-    msg_ok "Stopped Service"
-
-    create_backup /opt/localagi/.env
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "localagi" "mudler/LocalAGI" "tarball" "latest" "/opt/localagi"
-    restore_backup
-
-    msg_info "Building LocalAGI"
-    cd /opt/localagi/webui/react-ui
-    $STD bun install
-    $STD bun run build
-    cd /opt/localagi
-    $STD go build -o /usr/local/bin/localagi
-    msg_ok "Updated LocalAGI successfully"
-
-    msg_info "Starting Service"
-    systemctl start localagi
-    msg_ok "Started Service"
-    msg_ok "Updated successfully!"
-    exit
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"
@@ -6,7 +6,7 @@ source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxV
 # Source: https://pangolin.net/ | Github: https://github.com/fosrl/pangolin

 APP="Pangolin"
-PANGOLIN_VERSION="${PANGOLIN_VERSION:-1.18.4}"
+PANGOLIN_VERSION="${PANGOLIN_VERSION:-1.20.0}"
 var_tags="${var_tags:-proxy}"
 var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-4096}"
@@ -33,6 +33,15 @@ function update_script() {

  ensure_dependencies build-essential python3

+  if ! command -v psql &>/dev/null; then
+    msg_error "This installation uses SQLite and cannot be upgraded to Pangolin ${PANGOLIN_VERSION}."
+    echo -e "${INFO}${YW}Starting with Pangolin 1.20.0, PostgreSQL is required as the database backend.${CL}"
+    echo -e "${INFO}${YW}An automatic migration of your existing SQLite data is not supported.${CL}"
+    echo -e "${INFO}${YW}Please create a new LXC with the Pangolin install script, which sets up PostgreSQL automatically.${CL}"
+    echo -e "${INFO}${YW}Your current data is preserved in this container and can be manually migrated if needed.${CL}"
+    exit 1
+  fi
+
  NODE_VERSION="24" setup_nodejs

  if check_for_gh_release "pangolin" "fosrl/pangolin" "$PANGOLIN_VERSION" "Pinned to a tested release because Pangolin's schema changes have repeatedly broken unattended updates. To try a newer version at your own risk, run: 'export PANGOLIN_VERSION=<tag>' and re-run update. If it breaks, please open an issue at https://github.com/community-scripts/ProxmoxVE/issues with the error log."; then
@@ -41,13 +50,8 @@ function update_script() {
    systemctl stop gerbil
    msg_info "Service stopped"

-    msg_info "Creating backup"
-    tar -czf /opt/pangolin_config_backup.tar.gz -C /opt/pangolin config
-    if [[ -f /opt/pangolin/config/db/db.sqlite ]]; then
-      cp -a /opt/pangolin/config/db/db.sqlite \
-        "/opt/pangolin/config/db/db.sqlite.pre-${PANGOLIN_VERSION}-$(date +%Y%m%d-%H%M%S).bak"
-    fi
-    msg_ok "Created backup"
+    DB_URL=$(sed -n 's/.*connection_string: "\(.*\)".*/\1/p' /opt/pangolin/config/config.yml)
+    create_backup /opt/pangolin/config

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "pangolin" "fosrl/pangolin" "tarball" "$PANGOLIN_VERSION"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "gerbil" "fosrl/gerbil" "singlefile" "latest" "/usr/bin" "gerbil_linux_$(arch_resolve)"
@@ -55,23 +59,21 @@ function update_script() {
    msg_info "Updating Pangolin"
    cd /opt/pangolin
    $STD npm ci
-    $STD npm run set:sqlite
+    $STD npm run set:pg
    $STD npm run set:oss
    rm -rf server/private
-    $STD npm run db:generate
+    DATABASE_URL="$DB_URL" $STD npm run db:generate
    $STD npm run build
    $STD npm run build:cli
    cp -R .next/standalone ./
+    cp -r server/migrations ./dist/init
    chmod +x ./dist/cli.mjs
    cp server/db/names.json ./dist/names.json
    cp server/db/ios_models.json ./dist/ios_models.json
    cp server/db/mac_models.json ./dist/mac_models.json
    msg_ok "Updated Pangolin"

-    msg_info "Restoring config"
-    tar -xzf /opt/pangolin_config_backup.tar.gz -C /opt/pangolin --overwrite
-    rm -f /opt/pangolin_config_backup.tar.gz
-    msg_ok "Restored config"
+    restore_backup

    if ! grep -q '^ExecStartPre=/usr/bin/node dist/migrations.mjs' /etc/systemd/system/pangolin.service 2>/dev/null; then
      msg_info "Adding migration step to pangolin.service"
@@ -82,13 +84,8 @@ function update_script() {

    msg_info "Running database migrations"
    cd /opt/pangolin
-    SQLITE_DB="/opt/pangolin/config/db/db.sqlite"
-    if [[ -f "$SQLITE_DB" ]]; then
-      if ! sqlite3 "$SQLITE_DB" ".tables" 2>/dev/null | tr ' ' '\n' | grep -qx "statusHistory"; then
-        sqlite3 "$SQLITE_DB" "DELETE FROM versionMigrations;" 2>/dev/null || true
-      fi
-    fi
    ENVIRONMENT=prod $STD node dist/migrations.mjs
+
    msg_ok "Ran database migrations"

    msg_info "Updating Badger plugin version"
@@ -112,4 +109,4 @@ description
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}https://<YOUR_PANGOLIN_URL>${CL}"
+echo -e "${GATEWAY}${BGN}https://<YOUR_PANGOLIN_URL> or http://${IP}:3002${CL}"
@@ -71,7 +71,7 @@ function update_script() {
      cp /opt/pocket-id/.env /opt/env
    fi

-    fetch_and_deploy_gh_release "pocket-id" "pocket-id/pocket-id" "singlefile" "latest" "/opt/pocket-id/" "pocket-id_linux_$(arch_resolve)"
+    fetch_and_deploy_gh_release "pocket-id" "pocket-id/pocket-id" "singlefile" "latest" "/opt/pocket-id/" "pocket-id-linux-$(arch_resolve)"
    mv /opt/env /opt/pocket-id/.env

    msg_info "Starting Service"
@@ -106,6 +106,13 @@ spring.servlet.multipart.max-file-size=5GB
 spring.servlet.multipart.max-request-size=5GB
 server.tomcat.max-part-count=100

+# Rqueue configuration
+rqueue.web.enable=false
+rqueue.job.enabled=false
+rqueue.message.durability.in-terminal-state=0
+rqueue.key.prefix=\${spring.cache.redis.key-prefix}
+rqueue.message.converter.provider.class=com.dedicatedcode.reitti.config.RQueueCustomMessageConverter
+
 # Application-specific settings
 reitti.server.advertise-uri=

@@ -161,81 +168,6 @@ PROPEOF
    msg_ok "Rewrote application.properties (backup: application.properties.bak)"
  fi

-  # Migrate v4 -> v5: Remove Rqueue configuration (replaced by Quartz Scheduler)
-  if grep -q "^rqueue\." /opt/reitti/application.properties 2>/dev/null; then
-    msg_info "Migrating to v5: Removing Rqueue configuration"
-    sed -i '/^# Rqueue configuration$/d; /^rqueue\./d' /opt/reitti/application.properties
-    msg_ok "Removed Rqueue configuration"
-  fi
-
-  # Migrate v4 -> v5: Update application.properties and nginx tile cache for v5 compatibility
-  if grep -q "^reitti\.process-data\.schedule=" /opt/reitti/application.properties 2>/dev/null; then
-    msg_info "Migrating to v5: Updating application.properties"
-    sed -i '/^reitti\.process-data\.schedule=/d' /opt/reitti/application.properties
-    sed -i 's/^reitti\.import\.processing-idle-start-time=.*/reitti.import.grace-time-seconds=30/' /opt/reitti/application.properties
-    sed -i 's/^spring\.datasource\.hikari\.maximum-pool-size=20$/spring.datasource.hikari.maximum-pool-size=30/' /opt/reitti/application.properties
-    grep -q "devices" /opt/reitti/application.properties || \
-      sed -i 's/^spring\.cache\.cache-names=\(.*\)$/spring.cache.cache-names=\1,devices,mapStyles,mapStyleJson/' /opt/reitti/application.properties
-    grep -q "org.quartz.core.ErrorLogger" /opt/reitti/application.properties || \
-      sed -i '/^logging\.level\.com\.dedicatedcode\.reitti=/a logging.level.org.quartz.core.ErrorLogger=FATAL' /opt/reitti/application.properties
-    grep -q "^spring.servlet.multipart.resolve-lazily=" /opt/reitti/application.properties || \
-      sed -i '/^spring\.servlet\.multipart\.max-request-size=/a spring.servlet.multipart.resolve-lazily=true' /opt/reitti/application.properties
-    grep -q "^spring.mvc.async.request-timeout=" /opt/reitti/application.properties || \
-      echo "spring.mvc.async.request-timeout=600000" >>/opt/reitti/application.properties
-    if ! grep -q "^spring.quartz" /opt/reitti/application.properties; then
-      cat >>/opt/reitti/application.properties <<'QUARTZEOF'
-
-# Quartz Scheduler configuration
-spring.quartz.job-store-type=jdbc
-spring.quartz.jdbc.initialize-schema=never
-spring.quartz.properties.org.quartz.jobStore.driverDelegateClass=org.quartz.impl.jdbcjobstore.PostgreSQLDelegate
-spring.quartz.properties.org.quartz.jobStore.isClustered=false
-spring.quartz.properties.org.quartz.jobStore.tablePrefix=qrtz_
-spring.quartz.properties.org.quartz.threadPool.threadCount=5
-QUARTZEOF
-    fi
-    grep -q "^reitti.import.staging.cleanup.cron=" /opt/reitti/application.properties || \
-      echo "reitti.import.staging.cleanup.cron=0 0 4 * * *" >>/opt/reitti/application.properties
-    grep -q "^reitti.batching.max-batch-size=" /opt/reitti/application.properties || \
-      printf "reitti.batching.max-batch-size=100\nreitti.batching.max-wait-time=5\n" >>/opt/reitti/application.properties
-    grep -q "^reitti.jobs.cleanup.cron=" /opt/reitti/application.properties || \
-      printf "reitti.jobs.cleanup.cron=0 0 4 * * ?\nreitti.jobs.cleanup.max-age-hours=24\n" >>/opt/reitti/application.properties
-    grep -q "^reitti.db-janitor.schedule=" /opt/reitti/application.properties || \
-      echo "reitti.db-janitor.schedule=0 0 4 * * ?" >>/opt/reitti/application.properties
-    msg_ok "Updated application.properties for v5"
-
-    if [[ -f /etc/nginx/nginx.conf ]]; then
-      msg_info "Migrating to v5: Updating nginx tile cache configuration"
-      cp /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bak.v5
-      cat >/etc/nginx/nginx.conf <<'NGINXEOF'
-user www-data;
-
-events {
-  worker_connections 1024;
-}
-http {
-  resolver 1.1.1.1 8.8.8.8 valid=30s ipv6=off;
-  proxy_cache_path /var/cache/nginx/tiles levels=1:2 keys_zone=tiles:10m max_size=1g inactive=30d use_temp_path=off;
-  server {
-    listen 80;
-    location /custom/ {
-      set $upstream_url $http_x_reitti_upstream_url;
-      proxy_pass $upstream_url;
-      proxy_set_header Host $proxy_host;
-      proxy_set_header User-Agent "Reitti/1.0";
-      proxy_cache tiles;
-      proxy_cache_key $upstream_url;
-      proxy_cache_valid 200 30d;
-      proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
-    }
-  }
-}
-NGINXEOF
-      systemctl reload nginx
-      msg_ok "Updated nginx tile cache configuration"
-    fi
-  fi
-
  if check_for_gh_release "reitti" "dedicatedcode/reitti"; then
    msg_info "Stopping Service"
    systemctl stop reitti
@@ -247,12 +179,10 @@ NGINXEOF
    USE_ORIGINAL_FILENAME="true" fetch_and_deploy_gh_release "reitti" "dedicatedcode/reitti" "singlefile" "latest" "/opt/reitti" "reitti-app.jar"
    mv /opt/reitti/reitti-*.jar /opt/reitti/reitti.jar

-    msg_warn "v5 runs a one-time database migration on first start (GPS points → device table). This may take several minutes on large datasets — do not interrupt the container."
    msg_info "Starting Service"
    systemctl start reitti
    msg_ok "Started Service"
    msg_ok "Updated successfully!"
-    msg_warn "Post-upgrade: Verify each API token has a Device assigned in Settings → API Tokens. Tokens without a device cannot ingest location data in v5."
  fi
  exit
 }
@@ -32,7 +32,7 @@ function update_script() {

  NODE_VERSION="24" NODE_MODULE="corepack,yarn" setup_nodejs

-  if check_for_gl_release "storyteller" "storyteller-platform/storyteller" "" "" "web-v2"; then
+  if check_for_gl_release "storyteller" "storyteller-platform/storyteller"; then
    msg_info "Stopping Service"
    systemctl stop storyteller
    msg_ok "Stopped Service"
@@ -41,7 +41,7 @@ function update_script() {
    cp /opt/storyteller/.env /opt/storyteller_env.bak
    msg_ok "Backed up Data"

-    CLEAN_INSTALL=1 fetch_and_deploy_gl_release "storyteller" "storyteller-platform/storyteller" "tarball" "latest" "/opt/storyteller" "" "web-v2"
+    CLEAN_INSTALL=1 fetch_and_deploy_gl_release "storyteller" "storyteller-platform/storyteller" "tarball" "latest" "/opt/storyteller"

    msg_info "Restoring Configuration"
    mv /opt/storyteller_env.bak /opt/storyteller/.env
@@ -72,7 +72,6 @@ BODY_SIZE_LIMIT=Infinity
 ORIGIN='http://$LOCAL_IP:3000'
 EOF
 cd /opt/adventurelog/frontend
-grep -q "^dangerouslyAllowAllBuilds:" ./pnpm-workspace.yaml 2>/dev/null || echo "dangerouslyAllowAllBuilds: true" >>./pnpm-workspace.yaml
 $STD pnpm i
 $STD pnpm build
 msg_ok "Installed AdventureLog"
@@ -1,215 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/toeverything/AFFiNE
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-msg_info "Installing Dependencies"
-$STD apt install -y \
-  build-essential \
-  git \
-  pkg-config \
-  openssl \
-  libssl-dev \
-  libjemalloc2 \
-  redis-server \
-  nginx
-msg_ok "Installed Dependencies"
-
-PG_VERSION="16" PG_MODULES="pgvector" setup_postgresql
-PG_DB_NAME="affine" PG_DB_USER="affine" setup_postgresql_db
-NODE_VERSION="22" setup_nodejs
-setup_rust
-
-fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "latest" "/opt/affine"
-
-msg_info "Setting up Directories"
-rm -rf /root/.affine
-mkdir -p /root/.affine/{storage,config}
-msg_ok "Set up Directories"
-
-msg_info "Configuring Environment"
-SECRET_KEY=$(openssl rand -hex 32)
-cat <<EOF >/opt/affine/.env
-NODE_ENV=production
-AFFINE_SERVER_PORT=3010
-AFFINE_SERVER_HOST=${LOCAL_IP}
-AFFINE_SERVER_EXTERNAL_URL=http://${LOCAL_IP}
-DATABASE_URL=postgresql://${PG_DB_USER}:${PG_DB_PASS}@localhost:5432/${PG_DB_NAME}
-REDIS_SERVER_HOST=localhost
-REDIS_SERVER_PORT=6379
-AFFINE_INDEXER_ENABLED=false
-SECRET_KEY=${SECRET_KEY}
-EOF
-msg_ok "Configured Environment"
-
-msg_info "Building AFFiNE (Patience)"
-cd /opt/affine
-source /root/.profile
-export PATH="/root/.cargo/bin:$PATH"
-export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
-export VITE_CORE_COMMIT_SHA=$(cat ~/.affine_app)
-# # Initialize git repo (required for build process)
-$STD git init -q
-$STD git config user.email "build@local"
-$STD git config user.name "Build"
-$STD git add -A
-$STD git commit -q -m "initial"
-mkdir -p /opt/affine/.turbo
-cat <<TURBO >/opt/affine/.turbo/config.json
-{
-  "concurrency": 1
-}
-TURBO
-$STD corepack enable
-$STD corepack prepare yarn@4.12.0 --activate
-$STD yarn config set enableTelemetry 0
-export NODE_OPTIONS="--max-old-space-size=4096"
-export TSC_COMPILE_ON_ERROR=true
-$STD yarn install
-$STD npm install -g typescript
-$STD yarn affine @affine/native build
-$STD yarn affine @affine/server-native build
-
-# Create architecture-specific symlinks for server-native
-ln -sf /opt/affine/packages/backend/native/server-native.node \
-  /opt/affine/packages/backend/native/server-native.x64.node
-ln -sf /opt/affine/packages/backend/native/server-native.node \
-  /opt/affine/packages/backend/native/server-native.arm64.node
-ln -sf /opt/affine/packages/backend/native/server-native.node \
-  /opt/affine/packages/backend/native/server-native.armv7.node
-
-$STD yarn affine init
-$STD yarn affine build -p @affine/reader
-$STD yarn affine build -p @affine/server
-export NODE_OPTIONS="--max-old-space-size=4096"
-$STD yarn affine build -p @affine/web
-$STD yarn affine build -p @affine/admin
-mkdir -p /opt/affine/packages/backend/server/static
-cp -r /opt/affine/packages/frontend/apps/web/dist/* /opt/affine/packages/backend/server/static/
-mkdir -p /opt/affine/packages/backend/server/static/admin
-cp -r /opt/affine/packages/frontend/admin/dist/* /opt/affine/packages/backend/server/static/admin/
-# Create empty mobile manifest (server expects it but we don't build mobile)
-mkdir -p /opt/affine/packages/backend/server/static/mobile
-cat <<'MANIFEST' >/opt/affine/packages/backend/server/static/mobile/assets-manifest.json
-{"publicPath":"/","js":[],"css":[],"gitHash":"","description":""}
-MANIFEST
-msg_ok "Built AFFiNE"
-
-msg_info "Running Initial Migration"
-cd /opt/affine/packages/backend/server
-set -a && source /opt/affine/.env && set +a
-$STD node ./scripts/self-host-predeploy.js
-msg_ok "Ran Initial Migration"
-
-msg_info "Creating Services"
-cat <<EOF >/etc/systemd/system/affine-web.service
-[Unit]
-Description=AFFiNE Web Server
-After=network.target postgresql.service redis-server.service
-Requires=postgresql.service redis-server.service
-
-[Service]
-Type=simple
-WorkingDirectory=/opt/affine/packages/backend/server
-EnvironmentFile=/opt/affine/.env
-Environment=LD_PRELOAD=libjemalloc.so.2
-Environment=NODE_OPTIONS=--max-old-space-size=1024
-ExecStart=/usr/bin/node ./dist/main.js
-Restart=always
-RestartSec=10
-
-[Install]
-WantedBy=multi-user.target
-EOF
-
-cat <<EOF >/etc/systemd/system/affine-worker.service
-[Unit]
-Description=AFFiNE Background Worker
-After=network.target postgresql.service redis-server.service
-Requires=postgresql.service redis-server.service
-
-[Service]
-Type=simple
-WorkingDirectory=/opt/affine/packages/backend/server
-EnvironmentFile=/opt/affine/.env
-Environment=LD_PRELOAD=libjemalloc.so.2
-Environment=NODE_OPTIONS=--max-old-space-size=1024
-ExecStart=/usr/bin/node ./dist/main.js --worker
-Restart=always
-RestartSec=10
-
-[Install]
-WantedBy=multi-user.target
-EOF
-
-systemctl enable -q --now redis-server affine-web affine-worker
-msg_ok "Created Services"
-
-msg_info "Creating Admin User"
-ADMIN_PASS=$(openssl rand -base64 12)
-for i in {1..30}; do
-  if curl -s http://localhost:3010/info >/dev/null 2>&1; then
-    break
-  fi
-  sleep 2
-done
-# Create admin via API
-ADMIN_RESPONSE=$(curl -s -X POST http://localhost:3010/api/setup/create-admin-user \
-  -H "Content-Type: application/json" \
-  -d "{\"email\":\"admin@affine.local\",\"password\":\"${ADMIN_PASS}\"}")
-if echo "$ADMIN_RESPONSE" | grep -q '"id"'; then
-  {
-    echo "AFFiNE Credentials"
-    echo "=================="
-    echo "Email: admin@affine.local"
-    echo "Password: ${ADMIN_PASS}"
-  } >~/affine.creds
-  msg_ok "Created Admin User"
-else
-  msg_warn "Admin creation skipped (may already exist)"
-fi
-
-msg_info "Configuring Nginx"
-cat <<EOF >/etc/nginx/sites-available/affine.conf
-upstream affine_backend {
-    server 127.0.0.1:3010;
-}
-
-server {
-    listen 80;
-    server_name _;
-
-    client_max_body_size 100M;
-
-    location / {
-        proxy_pass http://affine_backend;
-        proxy_http_version 1.1;
-        proxy_set_header Host \$host;
-        proxy_set_header X-Real-IP \$remote_addr;
-        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto \$scheme;
-        proxy_set_header Upgrade \$http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_redirect off;
-        proxy_buffering off;
-    }
-}
-EOF
-ln -sf /etc/nginx/sites-available/affine.conf /etc/nginx/sites-enabled/
-rm -f /etc/nginx/sites-enabled/default
-systemctl enable -q --now nginx
-msg_ok "Configured Nginx"
-
-motd_ssh
-customize
-cleanup_lxc
@@ -26,8 +26,8 @@ msg_info "Installing ASP.NET Core Runtime"
 if [[ "$(arch_resolve)" == "arm64" ]]; then
  # packages.microsoft.com only ships amd64 debs for Debian; use dotnet-install on arm64
  curl -fsSL https://dot.net/v1/dotnet-install.sh -o /tmp/dotnet-install.sh
-  $STD bash /tmp/dotnet-install.sh --channel 10.0 --runtime aspnetcore --install-dir /usr/lib/dotnet10
-  ln -sf /usr/lib/dotnet10/dotnet /usr/bin/dotnet
+  $STD bash /tmp/dotnet-install.sh --channel 8.0 --runtime aspnetcore --install-dir /usr/lib/dotnet8
+  ln -sf /usr/lib/dotnet8/dotnet /usr/bin/dotnet
  rm -f /tmp/dotnet-install.sh
 else
  setup_deb822_repo \
@@ -35,7 +35,7 @@ else
    "https://packages.microsoft.com/keys/microsoft-2025.asc" \
    "https://packages.microsoft.com/debian/13/prod/" \
    "trixie"
-  $STD apt install -y aspnetcore-runtime-10.0
+  $STD apt install -y aspnetcore-runtime-8.0
 fi
 msg_ok "Installed ASP.NET Core Runtime"

@@ -24,12 +24,6 @@ msg_ok "Set up Hyperion repository"

 msg_info "Installing Hyperion"
 $STD apt install -y hyperion
-mkdir -p /etc/systemd/system/hyperion@.service.d
-cat <<EOF >/etc/systemd/system/hyperion@.service.d/override.conf
-[Unit]
-Requisite=
-EOF
-systemctl daemon-reload
 systemctl enable -q --now hyperion@root
 msg_ok "Installed Hyperion"

@@ -162,7 +162,7 @@ PG_VERSION="16" PG_MODULES="pgvector" setup_postgresql
 ACTUAL_PG_VERSION=$(ls /etc/postgresql/ 2>/dev/null | sort -V | tail -1)
 ACTUAL_PG_VERSION=${ACTUAL_PG_VERSION:-16}

-VCHORD_RELEASE="1.1.1"
+VCHORD_RELEASE="1.0.0"
 fetch_and_deploy_gh_release "VectorChord" "tensorchord/VectorChord" "binary" "${VCHORD_RELEASE}" "/tmp" "postgresql-${ACTUAL_PG_VERSION}-vchord_*_$(arch_resolve).deb"

 sed -i "s/^#shared_preload.*/shared_preload_libraries = 'vchord.so'/" /etc/postgresql/${ACTUAL_PG_VERSION}/main/postgresql.conf
@@ -311,7 +311,7 @@ ML_DIR="${APP_DIR}/machine-learning"
 GEO_DIR="${INSTALL_DIR}/geodata"
 mkdir -p {"${APP_DIR}","${UPLOAD_DIR}","${GEO_DIR}","${INSTALL_DIR}"/cache}

-fetch_and_deploy_gh_release "Immich" "immich-app/immich" "tarball" "v3.0.2" "$SRC_DIR"
+fetch_and_deploy_gh_release "Immich" "immich-app/immich" "tarball" "v3.0.1" "$SRC_DIR"
 PNPM_VERSION="$(jq -r '.packageManager | split("@")[1] | split("+")[0]' ${SRC_DIR}/package.json)"
 export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
 NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs
@@ -437,27 +437,6 @@ cd "$INSTALL_DIR"
 ln -s "$GEO_DIR" "$APP_DIR"
 msg_ok "Installed GeoNames data"

-# MickLesk temporary patch for HEIC thumbnail gen
-msg_info "Patching media.repository.js"
-MEDIA_REPO_JS="/opt/immich/app/dist/repositories/media.repository.js"
-if [[ -f "$MEDIA_REPO_JS" ]]; then
-  python3 - <<'PY'
-from pathlib import Path
-p = Path('/opt/immich/app/dist/repositories/media.repository.js')
-s = p.read_text()
-old = "(0, sharp_1.default)(input).metadata()"
-new = "(0, sharp_1.default)(input, { unlimited: true, limitInputPixels: false }).metadata()"
-if new in s:
-    print('hotfix already there')
-elif old in s:
-    p.write_text(s.replace(old, new, 1))
-    print('hotfix applied')
-else:
-    print('pattern not found, skipped')
-PY
-fi
-msg_ok "Patched media.repository.js"
-
 mkdir -p /var/log/immich
 touch /var/log/immich/{web.log,ml.log}
 msg_ok "Installed Immich"
@@ -1,75 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: BillyOutlast
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/mudler/LocalAGI
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-APP="LocalAGI"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-msg_info "Installing Dependencies"
-$STD apt install -y build-essential
-msg_ok "Installed Dependencies"
-
-NODE_VERSION="24" setup_nodejs
-setup_go
-
-msg_info "Installing Bun"
-export BUN_INSTALL="/root/.bun"
-curl -fsSL https://bun.sh/install | $STD bash
-ln -sf /root/.bun/bin/bun /usr/local/bin/bun
-ln -sf /root/.bun/bin/bunx /usr/local/bin/bunx
-msg_ok "Installed Bun"
-
-fetch_and_deploy_gh_release "localagi" "mudler/LocalAGI" "tarball" "latest" "/opt/localagi"
-
-msg_info "Configuring LocalAGI"
-mkdir -p /opt/localagi/pool
-cat <<'EOF' >/opt/localagi/.env
-LOCALAGI_MODEL=gemma-3-4b-it-qat
-LOCALAGI_MULTIMODAL_MODEL=moondream2-20250414
-LOCALAGI_IMAGE_MODEL=sd-1.5-ggml
-LOCALAGI_LLM_API_URL=http://127.0.0.1:11434/v1
-LOCALAGI_STATE_DIR=/opt/localagi/pool
-EOF
-msg_ok "Configured LocalAGI"
-
-msg_info "Setting up LocalAGI"
-cd /opt/localagi/webui/react-ui
-$STD bun install
-$STD bun run build
-cd /opt/localagi
-$STD go build -o /usr/local/bin/localagi
-msg_ok "Set up LocalAGI"
-
-msg_info "Creating LocalAGI systemd service"
-cat <<EOF >/etc/systemd/system/localagi.service
-[Unit]
-Description=LocalAGI
-After=network.target
-
-[Service]
-User=root
-Type=simple
-EnvironmentFile=/opt/localagi/.env
-
-WorkingDirectory=/opt/localagi
-ExecStart=/usr/local/bin/localagi
-Restart=on-failure
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now localagi
-msg_ok "Created LocalAGI systemd service"
-
-motd_ssh
-customize
-cleanup_lxc
@@ -16,18 +16,19 @@ update_os
 msg_info "Installing Dependencies"
 $STD apt install -y \
  build-essential \
-  python3 \
-  sqlite3 \
  iptables
 msg_ok "Installed Dependencies"

 NODE_VERSION="24" setup_nodejs
-PANGOLIN_VERSION="${PANGOLIN_VERSION:-1.18.4}"
+PG_VERSION="17" setup_postgresql
+PG_DB_NAME="pangolin" PG_DB_USER="pangolin" setup_postgresql_db
+PANGOLIN_VERSION="${PANGOLIN_VERSION:-1.20.0}"
 fetch_and_deploy_gh_release "pangolin" "fosrl/pangolin" "tarball" "$PANGOLIN_VERSION"
 fetch_and_deploy_gh_release "gerbil" "fosrl/gerbil" "singlefile" "latest" "/usr/bin" "gerbil_linux_$(arch_resolve)"
 fetch_and_deploy_gh_release "traefik" "traefik/traefik" "prebuild" "latest" "/usr/bin" "traefik_v*_linux_$(arch_resolve).tar.gz"

 read -rp "${TAB3}Enter your Pangolin URL (ex: https://pangolin.example.com): " pango_url
+[[ "$pango_url" != https://* && "$pango_url" != http://* ]] && pango_url="https://${pango_url}"
 read -rp "${TAB3}Enter your email address: " pango_email

 msg_info "Setup Pangolin"
@@ -36,13 +37,14 @@ BADGER_VERSION=$(get_latest_github_release "fosrl/badger" "false")
 cd /opt/pangolin
 mkdir -p /opt/pangolin/config/{traefik,db,letsencrypt,logs}
 $STD npm ci
-$STD npm run set:sqlite
+$STD npm run set:pg
 $STD npm run set:oss
 rm -rf server/private
-$STD npm run db:generate
+DATABASE_URL="postgresql://pangolin:${PG_DB_PASS}@localhost:5432/pangolin" $STD npm run db:generate
 $STD npm run build
 $STD npm run build:cli
 cp -R .next/standalone ./
+cp -r server/migrations ./dist/init

 cat <<EOF >/usr/local/bin/pangctl
 #!/bin/sh
@@ -74,6 +76,9 @@ flags:
  require_email_verification: false
  disable_signup_without_invite: false
  disable_user_create_org: false
+
+postgres:
+  connection_string: "postgresql://pangolin:${PG_DB_PASS}@localhost:5432/pangolin"
 EOF

 cat <<EOF >/opt/pangolin/config/traefik/traefik_config.yml
@@ -181,7 +186,8 @@ http:
        servers:
          - url: "http://$LOCAL_IP:3000"
 EOF
-$STD npm run db:push
+export ENVIRONMENT=prod
+$STD node dist/migrations.mjs

 . /etc/os-release
 if [ "$VERSION_CODENAME" = "trixie" ]; then
@@ -197,7 +203,8 @@ msg_info "Creating Services"
 cat <<EOF >/etc/systemd/system/pangolin.service
 [Unit]
 Description=Pangolin Service
-After=network.target
+After=network.target postgresql.service
+Wants=postgresql.service

 [Service]
 Type=simple
@@ -14,7 +14,7 @@ network_check
 update_os

 read -r -p "${TAB3}What public URL do you want to use (e.g. pocketid.mydomain.com)? " public_url
-fetch_and_deploy_gh_release "pocket-id" "pocket-id/pocket-id" "singlefile" "latest" "/opt/pocket-id/" "pocket-id_linux_$(arch_resolve)"
+fetch_and_deploy_gh_release "pocket-id" "pocket-id/pocket-id" "singlefile" "latest" "/opt/pocket-id/" "pocket-id-linux-$(arch_resolve)"

 msg_info "Configuring Pocket ID"
 ENCRYPTION_KEY=$(openssl rand -base64 32)
@@ -30,30 +30,27 @@ mv /opt/reitti/reitti-*.jar /opt/reitti/reitti.jar

 msg_info "Installing Nginx Tile Cache"
 mkdir -p /var/cache/nginx/tiles
-cat <<'NGINXEOF' >/etc/nginx/nginx.conf
+cat <<EOF >/etc/nginx/nginx.conf
 user www-data;

 events {
  worker_connections 1024;
 }
 http {
-  resolver 1.1.1.1 8.8.8.8 valid=30s ipv6=off;
  proxy_cache_path /var/cache/nginx/tiles levels=1:2 keys_zone=tiles:10m max_size=1g inactive=30d use_temp_path=off;
  server {
    listen 80;
-    location /custom/ {
-      set $upstream_url $http_x_reitti_upstream_url;
-      proxy_pass $upstream_url;
-      proxy_set_header Host $proxy_host;
+    location / {
+      proxy_pass https://tile.openstreetmap.org/;
+      proxy_set_header Host tile.openstreetmap.org;
      proxy_set_header User-Agent "Reitti/1.0";
      proxy_cache tiles;
-      proxy_cache_key $upstream_url;
      proxy_cache_valid 200 30d;
      proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
    }
  }
 }
-NGINXEOF
+EOF
 chown -R www-data:www-data /var/cache/nginx
 chmod -R 750 /var/cache/nginx
 systemctl restart nginx
@@ -74,7 +71,6 @@ server.compression.mime-types=text/plain,application/json
 logging.level.root=INFO
 logging.level.org.hibernate.engine.jdbc.spi.SqlExceptionHelper=FATAL
 logging.level.com.dedicatedcode.reitti=INFO
-logging.level.org.quartz.core.ErrorLogger=FATAL

 # Internationalization
 spring.messages.basename=messages
@@ -86,7 +82,7 @@ spring.messages.fallback-to-system-locale=false
 spring.datasource.url=jdbc:postgresql://127.0.0.1:5432/$PG_DB_NAME
 spring.datasource.username=$PG_DB_USER
 spring.datasource.password=$PG_DB_PASS
-spring.datasource.hikari.maximum-pool-size=30
+spring.datasource.hikari.maximum-pool-size=20

 # Redis configuration
 spring.data.redis.host=127.0.0.1
@@ -96,23 +92,20 @@ spring.data.redis.password=
 spring.data.redis.database=0
 spring.cache.redis.key-prefix=

-spring.cache.cache-names=processed-visits,significant-places,users,magic-links,configurations,transport-mode-configs,avatarThumbnails,avatarData,user-settings,devices,mapStyles,mapStyleJson
+spring.cache.cache-names=processed-visits,significant-places,users,magic-links,configurations,transport-mode-configs,avatarThumbnails,avatarData,user-settings
 spring.cache.redis.time-to-live=1d

 # Upload configuration
 spring.servlet.multipart.max-file-size=5GB
 spring.servlet.multipart.max-request-size=5GB
-spring.servlet.multipart.resolve-lazily=true
 server.tomcat.max-part-count=100
-spring.mvc.async.request-timeout=600000

-# Quartz Scheduler configuration
-spring.quartz.job-store-type=jdbc
-spring.quartz.jdbc.initialize-schema=never
-spring.quartz.properties.org.quartz.jobStore.driverDelegateClass=org.quartz.impl.jdbcjobstore.PostgreSQLDelegate
-spring.quartz.properties.org.quartz.jobStore.isClustered=false
-spring.quartz.properties.org.quartz.jobStore.tablePrefix=qrtz_
-spring.quartz.properties.org.quartz.threadPool.threadCount=5
+# Rqueue configuration
+rqueue.web.enable=false
+rqueue.job.enabled=false
+rqueue.message.durability.in-terminal-state=0
+rqueue.key.prefix=\${spring.cache.redis.key-prefix}
+rqueue.message.converter.provider.class=com.dedicatedcode.reitti.config.RQueueCustomMessageConverter

 # Application-specific settings
 reitti.server.advertise-uri=
@@ -124,25 +117,18 @@ reitti.security.oidc.enabled=false
 reitti.security.oidc.registration.enabled=false

 reitti.import.batch-size=10000
-reitti.import.grace-time-seconds=30
-reitti.import.staging.cleanup.cron=0 0 4 * * *
-
-reitti.batching.max-batch-size=100
-reitti.batching.max-wait-time=5
+reitti.import.processing-idle-start-time=10

 reitti.geo-point-filter.max-speed-kmh=1000
 reitti.geo-point-filter.max-accuracy-meters=100
 reitti.geo-point-filter.history-lookback-hours=24
 reitti.geo-point-filter.window-size=50

+reitti.process-data.schedule=0 */10 * * * *
 reitti.process-data.refresh-views.schedule=0 0 4 * * *
 reitti.imports.schedule=0 5/10 * * * *
 reitti.imports.owntracks-recorder.schedule=\${reitti.imports.schedule}

-reitti.jobs.cleanup.cron=0 0 4 * * ?
-reitti.jobs.cleanup.max-age-hours=24
-reitti.db-janitor.schedule=0 0 4 * * ?
-
 # Geocoding service configuration
 reitti.geocoding.max-errors=10
 reitti.geocoding.photon.base-url=
@@ -54,7 +54,7 @@ cronKey=$(head -c 1024 </dev/urandom | sha256sum | awk '{print substr($1,1,29)}'
 sed -i -e 's/Shinobi/'"$cronKey"'/g' conf.json
 cp super.sample.json super.json
 $STD npm i npm -g
-$STD npm install
+$STD npm install --unsafe-perm
 $STD npm install pm2@latest -g
 chmod -R 755 .
 touch INSTALL/installed.txt
@@ -28,7 +28,7 @@ NODE_VERSION="24" NODE_MODULE="corepack,yarn" setup_nodejs

 fetch_and_deploy_gh_release "readium" "readium/cli" "prebuild" "latest" "/opt/readium" "readium_linux_$(arch_resolve "x86_64" "arm64").tar.gz"
 ln -sf /opt/readium/readium /usr/local/bin/readium
-fetch_and_deploy_gl_release "storyteller" "storyteller-platform/storyteller" "tarball" "latest" "/opt/storyteller" "" "web-v2"
+fetch_and_deploy_gl_release "storyteller" "storyteller-platform/storyteller" "tarball" "latest" "/opt/storyteller"

 msg_info "Setting up Storyteller"
 cd /opt/storyteller
@@ -3764,18 +3764,19 @@ runtime_script_status_guard() {
    return 0
  fi

-  local is_deleted is_disabled deleted_message disable_message info_url
-  if printf '%s' "$response" | grep -qE '"items":[[:space:]]*\[[[:space:]]*\]'; then
+  if ! command -v jq >/dev/null 2>&1; then
+    msg_warn "Missing jq for script status check. Continuing without status verification."
    return 0
  fi

-  # PocketBase returns a flat, fixed-field JSON blob; sed is enough here (no jq needed).
-  is_deleted=$(printf '%s' "$response" | sed -n 's/.*"is_deleted"[[:space:]]*:[[:space:]]*\(true\|false\).*/\1/p' | head -1)
-  is_disabled=$(printf '%s' "$response" | sed -n 's/.*"is_disabled"[[:space:]]*:[[:space:]]*\(true\|false\).*/\1/p' | head -1)
-  deleted_message=$(printf '%s' "$response" | sed -n 's/.*"deleted_message"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -1)
-  disable_message=$(printf '%s' "$response" | sed -n 's/.*"disable_message"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -1)
-  is_deleted=${is_deleted:-false}
-  is_disabled=${is_disabled:-false}
+  local has_record is_deleted is_disabled deleted_message disable_message info_url
+  has_record=$(printf '%s' "$response" | jq -r '.items | length')
+  [[ "$has_record" == "0" ]] && return 0
+
+  is_deleted=$(printf '%s' "$response" | jq -r '.items[0].is_deleted // false')
+  is_disabled=$(printf '%s' "$response" | jq -r '.items[0].is_disabled // false')
+  deleted_message=$(printf '%s' "$response" | jq -r '.items[0].deleted_message // ""')
+  disable_message=$(printf '%s' "$response" | jq -r '.items[0].disable_message // ""')
  info_url="https://community-scripts.org/scripts/${script_slug}"

  if [[ "$is_deleted" == "true" ]]; then
@@ -36,10 +36,6 @@
 #
 # ==============================================================================

-# Guard against double-sourcing (core.func uses the same pattern)
-[[ -n "${_TOOLS_FUNC_LOADED:-}" ]] && return 0
-_TOOLS_FUNC_LOADED=1
-
 # ------------------------------------------------------------------------------
 # Debug helper - outputs to stderr when TOOLS_DEBUG is enabled
 # Usage: debug_log "message"
@@ -95,17 +91,16 @@ curl_with_retry() {
  while [[ $attempt -le $retries ]]; do
    debug_log "curl attempt $attempt/$retries: $url"

-    # Build curl command as array to avoid command injection via extra_opts
-    local -a curl_args=(curl -fsSL --connect-timeout "$connect_timeout" --max-time "$timeout")
-    [[ -n "$extra_opts" ]] && read -ra _extra <<<"$extra_opts" && curl_args+=("${_extra[@]}")
+    local curl_cmd="curl -fsSL --connect-timeout $connect_timeout --max-time $timeout"
+    [[ -n "$extra_opts" ]] && curl_cmd="$curl_cmd $extra_opts"

    if [[ "$output" == "-" ]]; then
-      if "${curl_args[@]}" "$url"; then
+      if $curl_cmd "$url"; then
        success=true
        break
      fi
    else
-      if "${curl_args[@]}" -o "$output" "$url"; then
+      if $curl_cmd -o "$output" "$url"; then
        success=true
        break
      fi
@@ -158,16 +153,15 @@ curl_api_with_retry() {
  while [[ $attempt -le $retries ]]; do
    debug_log "curl API attempt $attempt/$retries: $url"

-    # Build curl command as array to avoid command injection via extra_opts
-    local -a curl_args=(curl -fsSL --connect-timeout "$connect_timeout" --max-time "$timeout" -w '%{http_code}')
-    [[ -n "$extra_opts" ]] && read -ra _extra <<<"$extra_opts" && curl_args+=("${_extra[@]}")
+    local curl_cmd="curl -fsSL --connect-timeout $connect_timeout --max-time $timeout -w '%{http_code}'"
+    [[ -n "$extra_opts" ]] && curl_cmd="$curl_cmd $extra_opts"

    if [[ -n "$body_file" ]]; then
-      http_code=$("${curl_args[@]}" -o "$body_file" "$url" 2>/dev/null) || true
+      http_code=$($curl_cmd -o "$body_file" "$url" 2>/dev/null) || true
    else
      # Capture body and http_code separately
      local tmp_body="/tmp/curl_api_body_$$"
-      http_code=$("${curl_args[@]}" -o "$tmp_body" "$url" 2>/dev/null) || true
+      http_code=$($curl_cmd -o "$tmp_body" "$url" 2>/dev/null) || true
      if [[ -f "$tmp_body" ]]; then
        cat "$tmp_body"
        rm -f "$tmp_body"
@@ -310,10 +304,7 @@ edit_yaml_config() {
    return 1
  fi

-  # Escape sed metacharacters in value (| and &) to prevent injection
-  local escaped_value="${value//|/\\|}"
-  escaped_value="${escaped_value//&/\\&}"
-  sed -i "s|^\([[:space:]]*${key}[[:space:]]*:\).*|\1 ${escaped_value}|" "$file"
+  sed -i "s|^\([[:space:]]*${key}[[:space:]]*:\).*|\1 ${value}|" "$file"
 }

 # ------------------------------------------------------------------------------
@@ -1696,6 +1687,10 @@ is_ubuntu() {
  [[ "$(get_os_info id)" == "ubuntu" ]]
 }

+is_alpine() {
+  [[ "$(get_os_info id)" == "alpine" ]]
+}
+
 # ------------------------------------------------------------------------------
 # Get Debian/Ubuntu major version
 # ------------------------------------------------------------------------------
@@ -2459,10 +2454,8 @@ start_timer() {
 end_timer() {
  local start_time="$1"
  local label="${2:-Operation}"
-  local end_time
-  end_time=$(date +%s)
+  local end_time=$(date +%s)
  local duration=$((end_time - start_time))
-  echo "${label} took ${duration}s"
 }

 # ------------------------------------------------------------------------------
@@ -2566,199 +2559,6 @@ fetch_and_deploy_gh_tag() {
  return 0
 }

-# ------------------------------------------------------------------------------
-# Get the latest GitLab repository tag matching a glob pattern.
-#
-# Description:
-#   - Queries the GitLab repository tags API (up to 100 tags per page)
-#   - Filters tag names against a shell glob pattern (e.g. "web-v*" or "mobile-v*")
-#   - Always excludes pre-release tags (those containing alpha, beta, or rc)
-#   - Sorts matching tags with `sort -V` and returns the highest one
-#   - Supports GITLAB_TOKEN for private/rate-limited projects
-#
-# Usage:
-#     get_latest_gl_tag "owner/repo" "web-v*"
-#     get_latest_gl_tag "owner/repo" "mobile-v*"
-#     get_latest_gl_tag "owner/repo"          # returns newest tag (no filter)
-#
-# Arguments:
-#   $1 - GitLab repo path (namespace/project, e.g. "mygroup/myapp")
-#   $2 - Optional glob pattern to filter tag names (e.g. "web-v*")
-#
-# Returns:
-#   Latest matching tag name on stdout, or non-zero on failure
-# ------------------------------------------------------------------------------
-get_latest_gl_tag() {
-  local repo="$1"
-  local pattern="${2:-}"
-
-  local repo_encoded
-  repo_encoded=$(printf '%s' "$repo" | sed 's|/|%2F|g')
-
-  local api_base="https://gitlab.com/api/v4/projects/${repo_encoded}/repository/tags"
-  local api_timeout="--connect-timeout 10 --max-time 60"
-
-  local header=()
-  [[ -n "${GITLAB_TOKEN:-}" ]] && header=(-H "PRIVATE-TOKEN: $GITLAB_TOKEN")
-
-  # If a pattern is given, pass it as a regex search to reduce server-side results.
-  # GitLab ?search= supports anchored regex; convert leading glob prefix to regex anchor.
-  local search_param=""
-  if [[ -n "$pattern" ]]; then
-    # Strip trailing wildcard for the search hint (server-side prefix filter).
-    local prefix="${pattern%%\**}"
-    [[ -n "$prefix" ]] && search_param="?search=^${prefix}&per_page=100" || search_param="?per_page=100"
-  else
-    search_param="?per_page=100"
-  fi
-
-  local temp_file
-  temp_file=$(mktemp) || return 1
-
-  local http_code
-  http_code=$(curl $api_timeout -sSL -w "%{http_code}" -o "$temp_file" \
-    "${header[@]}" "${api_base}${search_param}" 2>/dev/null) || true
-
-  if [[ "$http_code" != "200" ]]; then
-    rm -f "$temp_file"
-    msg_error "GitLab tags API returned HTTP $http_code for $repo"
-    return 22
-  fi
-
-  local tag=""
-  if [[ -n "$pattern" ]]; then
-    # Client-side glob filter + pre-release exclusion, then version-sort to pick the highest match.
-    tag=$(jq -r '.[].name' "$temp_file" 2>/dev/null | while IFS= read -r t; do
-      case "$t" in
-      *alpha* | *beta* | *rc*) continue ;;
-      $pattern) echo "$t" ;;
-      esac
-    done | sort -V | tail -n1)
-  else
-    # No pattern: skip pre-release tags, take the first remaining (newest) one.
-    tag=$(jq -r '.[].name' "$temp_file" 2>/dev/null |
-      grep -Eiv '(alpha|beta|rc)' |
-      head -n1)
-  fi
-
-  rm -f "$temp_file"
-
-  if [[ -z "$tag" ]]; then
-    msg_error "No tags matching '${pattern:-*}' found for ${repo}"
-    return 250
-  fi
-
-  echo "$tag"
-}
-
-# ------------------------------------------------------------------------------
-# Fetches and deploys a GitLab tag-based source tarball.
-#
-# Description:
-#   - Resolves the latest tag matching the given glob pattern via get_latest_gl_tag
-#     (or uses the exact tag if one is provided instead of "latest")
-#   - Downloads the GitLab source tarball for that tag
-#   - Extracts it to the target directory
-#   - Writes the resolved tag to ~/.<app> for update-checking
-#
-# Usage:
-#     fetch_and_deploy_gl_tag "myapp" "mygroup/myrepo" "web-v*"
-#     fetch_and_deploy_gl_tag "myapp" "mygroup/myrepo" "mobile-v*" "/opt/myapp"
-#     fetch_and_deploy_gl_tag "myapp" "mygroup/myrepo" "v*"          # any v-tag
-#     fetch_and_deploy_gl_tag "myapp" "mygroup/myrepo" "web-v3.0*"   # narrow version range
-#
-# Arguments:
-#   $1 - App name (used for version file ~/.<app> and lowercase tarball name)
-#   $2 - GitLab repo path (namespace/project, e.g. "mygroup/myapp")
-#   $3 - Tag pattern: glob (e.g. "web-v*") or exact tag (e.g. "web-v3.0.0").
-#        Use "latest" to fetch the single newest tag with no pattern filter.
-#   $4 - Target directory (default: /opt/$app)
-#
-# Notes:
-#   - Supports CLEAN_INSTALL=1 to wipe target before extracting
-#   - Supports GITLAB_TOKEN for private/rate-limited projects
-#   - For repos that only publish tags, not formal GitLab Releases
-#     (use fetch_and_deploy_gl_release for proper Releases with assets)
-# ------------------------------------------------------------------------------
-fetch_and_deploy_gl_tag() {
-  local app="$1"
-  local repo="$2"
-  local tag_pattern="${3:-latest}"
-  local target="${4:-/opt/$app}"
-
-  local app_lc=""
-  app_lc="$(echo "${app,,}" | tr -d ' ')"
-  local version_file="$HOME/.${app_lc}"
-
-  local api_timeout="--connect-timeout 10 --max-time 60"
-  local download_timeout="--connect-timeout 15 --max-time 900"
-
-  local header=()
-  [[ -n "${GITLAB_TOKEN:-}" ]] && header=(-H "PRIVATE-TOKEN: $GITLAB_TOKEN")
-
-  # Resolve the tag: if caller passed a glob/latest, query the API.
-  # If caller passed an exact tag (no wildcards), use it directly.
-  local resolved_tag="$tag_pattern"
-  if [[ "$tag_pattern" == "latest" || "$tag_pattern" == *"*"* || "$tag_pattern" == *"?"* ]]; then
-    local glob_arg=""
-    [[ "$tag_pattern" != "latest" ]] && glob_arg="$tag_pattern"
-    resolved_tag=$(get_latest_gl_tag "$repo" "$glob_arg") || {
-      msg_error "Failed to determine latest tag matching '${tag_pattern}' for ${repo}"
-      return 250
-    }
-  fi
-
-  local current_version=""
-  [[ -f "$version_file" ]] && current_version=$(<"$version_file")
-
-  if [[ "$current_version" == "$resolved_tag" ]]; then
-    msg_ok "$app is already up-to-date ($resolved_tag)"
-    return 0
-  fi
-
-  local repo_encoded
-  repo_encoded=$(printf '%s' "$repo" | sed 's|/|%2F|g')
-
-  # GitLab source tarball URL (no release needed, works for any tag).
-  local version_safe="${resolved_tag//\//-}"
-  local tarball_url="https://gitlab.com/${repo}/-/archive/${resolved_tag}/${app_lc}-${version_safe}.tar.gz"
-
-  local tmpdir
-  tmpdir=$(mktemp -d) || return 1
-  local filename="${app_lc}-${version_safe}.tar.gz"
-
-  msg_info "Fetching GitLab tag: ${app} (${resolved_tag})"
-
-  curl $download_timeout -fsSL "${header[@]}" -o "$tmpdir/$filename" "$tarball_url" || {
-    msg_error "Download failed: $tarball_url"
-    rm -rf "$tmpdir"
-    return 7
-  }
-
-  mkdir -p "$target"
-  if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-    rm -rf "${target:?}/"*
-  fi
-
-  tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
-    msg_error "Failed to extract tarball"
-    rm -rf "$tmpdir"
-    return 251
-  }
-
-  local unpack_dir
-  unpack_dir=$(find "$tmpdir" -mindepth 1 -maxdepth 1 -type d | head -n1)
-
-  shopt -s dotglob nullglob
-  cp -r "$unpack_dir"/* "$target/"
-  shopt -u dotglob nullglob
-
-  rm -rf "$tmpdir"
-  echo "$resolved_tag" >"$version_file"
-  msg_ok "Deployed ${app} ${resolved_tag} to ${target}"
-  return 0
-}
-
 # ------------------------------------------------------------------------------
 # Checks for new GitHub tag (for repos without releases).
 #
@@ -2833,7 +2633,6 @@ check_for_gh_release() {
  local source="$2"
  local pinned_version_in="${3:-}" # optional
  local pin_reason="${4:-}"        # optional reason shown to user
-  local tag_prefix="${5:-}"        # optional tag prefix filter (e.g. web-v2)
  local app_lc=""
  app_lc="$(echo "${app,,}" | tr -d ' ')"
  local current_file="$HOME/.${app_lc}"
@@ -2889,7 +2688,7 @@ check_for_gh_release() {
    rm -f "$gh_check_json"
  fi

-  if [[ -z "$pinned_version_in" && -z "$tag_prefix" ]]; then
+  if [[ -z "$pinned_version_in" ]]; then
    http_code=$(curl -sSL --max-time 20 -w "%{http_code}" -o "$gh_check_json" \
      -H 'Accept: application/vnd.github+json' \
      -H 'X-GitHub-Api-Version: 2022-11-28' \
@@ -2917,7 +2716,7 @@ check_for_gh_release() {
    rm -f "$gh_check_json"
  fi

-  # If no releases yet (pinned version, tag prefix, OR /latest failed), fetch up to 100
+  # If no releases yet (pinned version OR /latest failed), fetch up to 100
  if [[ -z "$releases_json" ]]; then
    http_code=$(curl -sSL --max-time 20 -w "%{http_code}" -o "$gh_check_json" \
      -H 'Accept: application/vnd.github+json' \
@@ -2955,18 +2754,9 @@ check_for_gh_release() {
    rm -f "$gh_check_json"
  fi

-  if [[ -n "$tag_prefix" ]]; then
-    mapfile -t raw_tags < <(jq -r --arg p "$tag_prefix" \
-      '.[] | select(.draft==false and .prerelease==false) | select(.tag_name | startswith($p)) | .tag_name' <<<"$releases_json")
-  else
-    mapfile -t raw_tags < <(jq -r '.[] | select(.draft==false and .prerelease==false) | .tag_name' <<<"$releases_json")
-  fi
+  mapfile -t raw_tags < <(jq -r '.[] | select(.draft==false and .prerelease==false) | .tag_name' <<<"$releases_json")
  if ((${#raw_tags[@]} == 0)); then
-    if [[ -n "$tag_prefix" ]]; then
-      msg_error "No stable releases matching prefix '${tag_prefix}' found for ${app}"
-    else
-      msg_error "No stable releases found for ${app}"
-    fi
+    msg_error "No stable releases found for ${app}"
    return 250
  fi

@@ -3970,7 +3760,6 @@ fetch_and_deploy_gh_release() {
  local version="${var_appversion:-${4:-latest}}"
  local target="${5:-/opt/$app}"
  local asset_pattern="${6:-}"
-  local tag_prefix="${7:-}"

  # Validate app name to prevent /root/. directory issues
  if [[ -z "$app" ]]; then
@@ -4000,13 +3789,7 @@ fetch_and_deploy_gh_release() {
  TOOLS_GH_REL_JSON="$gh_rel_json"

  local api_url="https://api.github.com/repos/$repo/releases"
-  if [[ "$version" != "latest" ]]; then
-    api_url="$api_url/tags/$version"
-  elif [[ -n "$tag_prefix" ]]; then
-    api_url="$api_url?per_page=100"
-  else
-    api_url="$api_url/latest"
-  fi
+  [[ "$version" != "latest" ]] && api_url="$api_url/tags/$version" || api_url="$api_url/latest"
  local header=()
  [[ -n "${GITHUB_TOKEN:-}" ]] && header=(-H "Authorization: token $GITHUB_TOKEN")

@@ -4069,14 +3852,6 @@ fetch_and_deploy_gh_release() {

  local json tag_name
  json=$(<"$gh_rel_json")
-  if [[ "$version" == "latest" && -n "$tag_prefix" ]]; then
-    json=$(echo "$json" | jq --arg p "$tag_prefix" \
-      '[.[] | select(.draft==false and .prerelease==false) | select(.tag_name | startswith($p))][0] // empty')
-    if [[ -z "$json" || "$json" == "null" ]]; then
-      msg_error "No stable release matching prefix '${tag_prefix}' found for $repo on GitHub"
-      return 1
-    fi
-  fi
  tag_name=$(echo "$json" | jq -r '.tag_name // .name // empty')
  # Only strip leading 'v' when followed by a digit (e.g. v1.2.3), not words like "version/..."
  [[ "$tag_name" =~ ^v[0-9] ]] && version="${tag_name:1}" || version="$tag_name"
@@ -6971,11 +6746,9 @@ setup_mariadb_db() {

  msg_info "Setting up MariaDB Database"

-  # Use --defaults-extra-file to pass credentials safely and escape identifiers
-  # to prevent SQL injection via DB name / user / password
-  $STD mariadb -u root -e "CREATE DATABASE \`${MARIADB_DB_NAME//\`/\`\`}\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
-  $STD mariadb -u root -e "CREATE USER '${MARIADB_DB_USER//\'/\'\'}'@'localhost' IDENTIFIED BY '${MARIADB_DB_PASS//\'/\'\'}';"
-  $STD mariadb -u root -e "GRANT ALL ON \`${MARIADB_DB_NAME//\`/\`\`}\`.* TO '${MARIADB_DB_USER//\'/\'\'}'@'localhost';"
+  $STD mariadb -u root -e "CREATE DATABASE \`$MARIADB_DB_NAME\` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;"
+  $STD mariadb -u root -e "CREATE USER '$MARIADB_DB_USER'@'localhost' IDENTIFIED BY '$MARIADB_DB_PASS';"
+  $STD mariadb -u root -e "GRANT ALL ON \`$MARIADB_DB_NAME\`.* TO '$MARIADB_DB_USER'@'localhost';"

  # Optional extra grants
  if [[ -n "${MARIADB_DB_EXTRA_GRANTS:-}" ]]; then
@@ -8605,14 +8378,8 @@ setup_postgresql_db() {
  fi

  msg_info "Setting up PostgreSQL Database"
-  # Escape single quotes in identifiers to prevent SQL injection
-  local _pg_user_escaped _pg_pass_escaped _pg_db_escaped
-  _pg_user_escaped="${PG_DB_USER//\'/\'\'}"
-  _pg_pass_escaped="${PG_DB_PASS//\'/\'\'}"
-  _pg_db_escaped="${PG_DB_NAME//\'/\'\'}"
-
-  $STD sudo -u postgres psql -c "CREATE ROLE $_pg_user_escaped WITH LOGIN PASSWORD '$_pg_pass_escaped';"
-  $STD sudo -u postgres psql -c "CREATE DATABASE $_pg_db_escaped WITH OWNER $_pg_user_escaped ENCODING 'UTF8' TEMPLATE template0;"
+  $STD sudo -u postgres psql -c "CREATE ROLE $PG_DB_USER WITH LOGIN PASSWORD '$PG_DB_PASS';"
+  $STD sudo -u postgres psql -c "CREATE DATABASE $PG_DB_NAME WITH OWNER $PG_DB_USER ENCODING 'UTF8' TEMPLATE template0;"

  # Configure pg_cron database BEFORE creating the extension (must be set before pg_cron loads)
  if [[ -n "${PG_DB_EXTENSIONS:-}" ]] && [[ ",${PG_DB_EXTENSIONS//[[:space:]]/}," == *",pg_cron,"* ]]; then
@@ -9509,7 +9276,6 @@ check_for_gl_release() {
  local source="$2"
  local pinned_version_in="${3:-}" # optional
  local pin_reason="${4:-}"        # optional reason shown to user
-  local tag_prefix="${5:-}"        # optional tag prefix filter (e.g. web-v2)
  local app_lc="${app,,}"
  local current_file="$HOME/.${app_lc}"

@@ -9586,18 +9352,9 @@ check_for_gl_release() {
    rm -f "$gl_check_json"
  fi

-  if [[ -n "$tag_prefix" ]]; then
-    mapfile -t raw_tags < <(jq -r --arg p "$tag_prefix" \
-      '.[] | select(.tag_name | startswith($p)) | .tag_name' <<<"$releases_json")
-  else
-    mapfile -t raw_tags < <(jq -r '.[] | .tag_name' <<<"$releases_json")
-  fi
+  mapfile -t raw_tags < <(jq -r '.[] | .tag_name' <<<"$releases_json")
  if ((${#raw_tags[@]} == 0)); then
-    if [[ -n "$tag_prefix" ]]; then
-      msg_error "No releases matching prefix '${tag_prefix}' found for ${app} on GitLab"
-    else
-      msg_error "No releases found for ${app} on GitLab"
-    fi
+    msg_error "No releases found for ${app} on GitLab"
    return 250
  fi

@@ -9792,7 +9549,6 @@ fetch_and_deploy_gl_release() {
  local version="${var_appversion:-${4:-latest}}"
  local target="${5:-/opt/$app}"
  local asset_pattern="${6:-}"
-  local tag_prefix="${7:-}"

  if [[ -z "$app" ]]; then
    app="${repo##*/}"
@@ -9824,8 +9580,6 @@ fetch_and_deploy_gl_release() {
  local api_url
  if [[ "$version" != "latest" ]]; then
    api_url="$api_base/$version"
-  elif [[ -n "$tag_prefix" ]]; then
-    api_url="$api_base?per_page=100&order_by=released_at&sort=desc"
  else
    api_url="$api_base?per_page=1&order_by=released_at&sort=desc"
  fi
@@ -9880,18 +9634,9 @@ fetch_and_deploy_gl_release() {
  json=$(<"$gl_rel_json")

  if [[ "$version" == "latest" ]]; then
-    if [[ -n "$tag_prefix" ]]; then
-      json=$(echo "$json" | jq --arg p "$tag_prefix" \
-        '[.[] | select(.tag_name | startswith($p))][0] // empty')
-    else
-      json=$(echo "$json" | jq '.[0] // empty')
-    fi
+    json=$(echo "$json" | jq '.[0] // empty')
    if [[ -z "$json" || "$json" == "null" ]]; then
-      if [[ -n "$tag_prefix" ]]; then
-        msg_error "No release matching prefix '${tag_prefix}' found for $repo on GitLab"
-      else
-        msg_error "No releases found for $repo on GitLab"
-      fi
+      msg_error "No releases found for $repo on GitLab"
      return 1
    fi
  fi
@@ -475,7 +475,7 @@ function advanced_settings() {
  done

  while true; do
-    if VLAN1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a Vlan (leave blank for default)" 8 58 --title "VLAN" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
+    if VLAN1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a Vlan(leave blank for default)" 8 58 --title "VLAN" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
      if [ -z "$VLAN1" ]; then
        VLAN1="Default"
        VLAN=""
Author	SHA1	Message	Date
MickLesk	4d57e74014	Update pangolin-install.sh	2026-07-13 13:06:34 +02:00
MickLesk	59baaf8075	Update pangolin.sh	2026-07-13 13:05:48 +02:00
MickLesk	0a81e7e5e5	fix env	2026-07-10 20:18:46 +02:00
MickLesk	08c84bd89d	Block Pangolin SQLite upgrades Update the Pangolin CT upgrade path to fail fast when PostgreSQL is not installed. The script now explains that upgrades to Pangolin 1.20.0+ require PostgreSQL and that SQLite data cannot be migrated automatically.	2026-07-10 15:41:28 +02:00
MickLesk	d371b5d9bd	use create_backup and restore_backup	2026-07-10 15:37:31 +02:00
MickLesk	1b1004ad86	remove old migrations	2026-07-10 15:35:37 +02:00
MickLesk	f3836df6ac	remove migration paths	2026-07-10 15:35:00 +02:00
MickLesk	5530b426a3	bump pangolin to PSQL	2026-07-10 15:33:49 +02:00
MickLesk	e3472681c9	another try...	2026-07-10 15:19:04 +02:00
MickLesk	cfa1f504e3	extend migration check...	2026-07-10 15:07:59 +02:00
MickLesk	38423262c8	Pangolin: Bump to 1.20.0 and harden SQLite migrations Bump the default Pangolin version to 1.20.0 in both CT and install scripts. Update the CT upgrade path to validate required 1.20.0 schema objects, clear stale versionMigrations markers when needed, retry migrations once, and abort with a clear error if the schema is still incomplete to avoid a broken runtime.	2026-07-10 14:44:32 +02:00