Update CHANGELOG.md (#15936 )

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
core-refactor: single-reporter telemetry rewrite (#15933 )
2026-07-21 13:25:06 +02:00 · 2026-07-20 18:33:05 +00:00 · 2026-07-20 20:32:36 +02:00 · 2026-07-20 18:23:30 +00:00 · 2026-07-20 20:23:05 +02:00 · 2026-07-20 19:56:29 +02:00
35 changed files with 1510 additions and 2396 deletions
@@ -1,3 +1,173 @@
+## 2026-07-18
+
+### 💾 Core
+
+  - #### ✨ New Features
+
+    - core: add configurable host CA inheritance during bootstrap [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15840](https://github.com/community-scripts/ProxmoxVE/pull/15840))
+
+  - #### 🔧 Refactor
+
+    - tools.func: Safe Delete Directorys & Update PYTHON_VERSION with setup_uv [@MickLesk](https://github.com/MickLesk) ([#15870](https://github.com/community-scripts/ProxmoxVE/pull/15870))
+
+### 🧰 Tools
+
+  - #### ✨ New Features
+
+    - [tools.update-lxcs] feat: optional reporting success/failures to heathchecks.io (or others) [@sir106](https://github.com/sir106) ([#15701](https://github.com/community-scripts/ProxmoxVE/pull/15701))
+
+## 2026-07-17
+
+### 🆕 New Scripts
+
+  - Invidious ([#15824](https://github.com/community-scripts/ProxmoxVE/pull/15824))
+- OxiCloud ([#15823](https://github.com/community-scripts/ProxmoxVE/pull/15823))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - webtrees: initialize database schema before admin user creation [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15837](https://github.com/community-scripts/ProxmoxVE/pull/15837))
+    - Fix DocuSeal missing Leptonica deps on install and update [@Copilot](https://github.com/Copilot) ([#15858](https://github.com/community-scripts/ProxmoxVE/pull/15858))
+    - apache-guacamole: detect installed extensions during update [@TowyTowy](https://github.com/TowyTowy) ([#15841](https://github.com/community-scripts/ProxmoxVE/pull/15841))
+    - CLIProxyAPI: fix update deleting config.yaml [@austinpilz](https://github.com/austinpilz) ([#15834](https://github.com/community-scripts/ProxmoxVE/pull/15834))
+    - esphome: install libusb-1.0-0 for ESP-IDF native builds [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15838](https://github.com/community-scripts/ProxmoxVE/pull/15838))
+
+  - #### ✨ New Features
+
+    - AFFiNE: Bump to 0.27.0 [@MickLesk](https://github.com/MickLesk) ([#15848](https://github.com/community-scripts/ProxmoxVE/pull/15848))
+    - n8n: unpin / use latest release [@MickLesk](https://github.com/MickLesk) ([#15817](https://github.com/community-scripts/ProxmoxVE/pull/15817))
+    - Pin Opencloud to v7.3.0 [@vhsdream](https://github.com/vhsdream) ([#15826](https://github.com/community-scripts/ProxmoxVE/pull/15826))
+
+  - #### 🔧 Refactor
+
+    - SFTPGo: Update APT Repo & Re-Enable Script [@MickLesk](https://github.com/MickLesk) ([#15829](https://github.com/community-scripts/ProxmoxVE/pull/15829))
+
+### 💾 Core
+
+  - #### ✨ New Features
+
+    - tools.func: enhance rbenv with profile updates / bundle in bashrc [@MickLesk](https://github.com/MickLesk) ([#15822](https://github.com/community-scripts/ProxmoxVE/pull/15822))
+    - feat(build.func): notify users when already on a pinned script version [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15819](https://github.com/community-scripts/ProxmoxVE/pull/15819))
+
+  - #### 💥 Breaking Changes
+
+    - MongoDB: Implement kernel version check and patch [@MickLesk](https://github.com/MickLesk) ([#15821](https://github.com/community-scripts/ProxmoxVE/pull/15821))
+
+### 🧰 Tools
+
+  - #### ✨ New Features
+
+    - update-lxc: autoremove and autoclean after apt full-upgrade [@soupy-boy](https://github.com/soupy-boy) ([#15831](https://github.com/community-scripts/ProxmoxVE/pull/15831))
+
+## 2026-07-16
+
+### 🆕 New Scripts
+
+  - Sync-In ([#15812](https://github.com/community-scripts/ProxmoxVE/pull/15812))
+- Beaverhabits ([#15813](https://github.com/community-scripts/ProxmoxVE/pull/15813))
+- Notediscovery ([#15811](https://github.com/community-scripts/ProxmoxVE/pull/15811))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Pin Immich to v3.0.3 [@vhsdream](https://github.com/vhsdream) ([#15790](https://github.com/community-scripts/ProxmoxVE/pull/15790))
+
+## 2026-07-15
+
+### 🆕 New Scripts
+
+  - Nexterm ([#15688](https://github.com/community-scripts/ProxmoxVE/pull/15688))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - 2fauth: minor fixes for 8.0.0 [@MickLesk](https://github.com/MickLesk) ([#15795](https://github.com/community-scripts/ProxmoxVE/pull/15795))
+    - SnapOtter: refactor update process to prebuild [@MickLesk](https://github.com/MickLesk) ([#15797](https://github.com/community-scripts/ProxmoxVE/pull/15797))
+
+### 💾 Core
+
+  - #### 🔧 Refactor
+
+    - tools.func: default Docker setup to official repo [@MickLesk](https://github.com/MickLesk) ([#15794](https://github.com/community-scripts/ProxmoxVE/pull/15794))
+
+## 2026-07-14
+
+### 🆕 New Scripts
+
+  - Grav ([#15773](https://github.com/community-scripts/ProxmoxVE/pull/15773))
+- Yuvomi ([#15772](https://github.com/community-scripts/ProxmoxVE/pull/15772))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Lychee: Preserve uploads and ownership during update [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15768](https://github.com/community-scripts/ProxmoxVE/pull/15768))
+    - Wanderer: Clean deploy and install plugins for v0.20.0 update [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15759](https://github.com/community-scripts/ProxmoxVE/pull/15759))
+    - FileFlows: Handle update API 401, force update, and Node install [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15766](https://github.com/community-scripts/ProxmoxVE/pull/15766))
+    - BirdNET-Go: Match new upstream release asset naming [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15758](https://github.com/community-scripts/ProxmoxVE/pull/15758))
+    - [Upstream Fix] Immich: Fix loader priority [@vhsdream](https://github.com/vhsdream) ([#15755](https://github.com/community-scripts/ProxmoxVE/pull/15755))
+
+  - #### ✨ New Features
+
+    - Bump OpenCloud version to v7.2.2 [@MickLesk](https://github.com/MickLesk) ([#15769](https://github.com/community-scripts/ProxmoxVE/pull/15769))
+    - Silverbullet: Add optional Runtime API install via Chromium [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15761](https://github.com/community-scripts/ProxmoxVE/pull/15761))
+
+  - #### 💥 Breaking Changes
+
+    - Pangolin: Bump to 1.20.0 | BREAKING: Switch to PostgreSQL [@MickLesk](https://github.com/MickLesk) ([#15682](https://github.com/community-scripts/ProxmoxVE/pull/15682))
+
+  - #### 🔧 Refactor
+
+    - AFFiNE: Pin to v0.26.3 [@MickLesk](https://github.com/MickLesk) ([#15782](https://github.com/community-scripts/ProxmoxVE/pull/15782))
+
+## 2026-07-13
+
+### 🆕 New Scripts
+
+  - LeafWiki ([#15748](https://github.com/community-scripts/ProxmoxVE/pull/15748))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(hyperion): keep service running after container reboot [@TowyTowy](https://github.com/TowyTowy) ([#15653](https://github.com/community-scripts/ProxmoxVE/pull/15653))
+    - Change sign-in URL to admin URL in affine.sh [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15741](https://github.com/community-scripts/ProxmoxVE/pull/15741))
+    - immich: use actual PostgreSQL version for VectorChord package lookup [@mnavon](https://github.com/mnavon) ([#15705](https://github.com/community-scripts/ProxmoxVE/pull/15705))
+    - fix storyteller release selection for stable web tags [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15736](https://github.com/community-scripts/ProxmoxVE/pull/15736))
+    - Docmost: Fix update procedure [@MickLesk](https://github.com/MickLesk) ([#15732](https://github.com/community-scripts/ProxmoxVE/pull/15732))
+    - fix(shinobi): remove obsolete --unsafe-perm npm flag [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15730](https://github.com/community-scripts/ProxmoxVE/pull/15730))
+
+  - #### 💥 Breaking Changes
+
+    - reitti: update to v5 [@CrazyWolf13](https://github.com/CrazyWolf13) ([#15635](https://github.com/community-scripts/ProxmoxVE/pull/15635))
+
+### 💾 Core
+
+  - #### 🐞 Bug Fixes
+
+    - fix(build.func): parse script status without jq dependency [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15729](https://github.com/community-scripts/ProxmoxVE/pull/15729))
+
+  - #### 🔧 Refactor
+
+    - tools.func: some improvements (sql injection / command injection / guard) [@MickLesk](https://github.com/MickLesk) ([#15661](https://github.com/community-scripts/ProxmoxVE/pull/15661))
+
+## 2026-07-12
+
+### 🆕 New Scripts
+
+  - AFFiNE ([#15690](https://github.com/community-scripts/ProxmoxVE/pull/15690))
+
+### 🚀 Updated Scripts
+
+  - Immich: Bump version to 3.0.2 [@vhsdream](https://github.com/vhsdream) ([#15668](https://github.com/community-scripts/ProxmoxVE/pull/15668))
+
+### ❔ Uncategorized
+
+  - fix(immich): correct Python indentation error in ct/immich.sh heredoc patch [@Copilot](https://github.com/Copilot) ([#15723](https://github.com/community-scripts/ProxmoxVE/pull/15723))
+
 ## 2026-07-11

 ### 🆕 New Scripts
@@ -77,6 +77,9 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit



+
+
+



@@ -90,7 +93,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit


 <details>
-<summary><h4>July (11 entries)</h4></summary>
+<summary><h4>July (18 entries)</h4></summary>

 [View July 2026 Changelog](.github/changelogs/2026/07.md)

@@ -502,6 +505,79 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 </details>

+## 2026-07-20
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - RomM: use backup helpers in update / clear folder [@MickLesk](https://github.com/MickLesk) ([#15915](https://github.com/community-scripts/ProxmoxVE/pull/15915))
+    - fix: vikunja: asset selection [@CrazyWolf13](https://github.com/CrazyWolf13) ([#15929](https://github.com/community-scripts/ProxmoxVE/pull/15929))
+    - Zammad : bind Elasticsearch to 127.0.0.1 [@MickLesk](https://github.com/MickLesk) ([#15909](https://github.com/community-scripts/ProxmoxVE/pull/15909))
+    - Omada: fix package version extraction [@MickLesk](https://github.com/MickLesk) ([#15908](https://github.com/community-scripts/ProxmoxVE/pull/15908))
+    - fix(wanderer): use PocketBase-relative plugin symlink in unprivileged LXC [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15911](https://github.com/community-scripts/ProxmoxVE/pull/15911))
+
+  - #### ✨ New Features
+
+    - AFFiNE: Bump version to v0.27.2 [@MickLesk](https://github.com/MickLesk) ([#15930](https://github.com/community-scripts/ProxmoxVE/pull/15930))
+
+  - #### 💥 Breaking Changes
+
+    - Gotify: Migration to v3 [@MickLesk](https://github.com/MickLesk) ([#15912](https://github.com/community-scripts/ProxmoxVE/pull/15912))
+
+### 💾 Core
+
+  - #### ✨ New Features
+
+    - core: refactor to single-reporter telemetry and better error_handling [@MickLesk](https://github.com/MickLesk) ([#15933](https://github.com/community-scripts/ProxmoxVE/pull/15933))
+    - tools.func: add support for extracting 7z archives [@MickLesk](https://github.com/MickLesk) ([#15919](https://github.com/community-scripts/ProxmoxVE/pull/15919))
+    - Meilisearch : use dumpless Meilisearch upgrades [@MickLesk](https://github.com/MickLesk) ([#15921](https://github.com/community-scripts/ProxmoxVE/pull/15921))
+
+  - #### 🔧 Refactor
+
+    - core: Improve GPU detection and mapping logic [@MickLesk](https://github.com/MickLesk) ([#15918](https://github.com/community-scripts/ProxmoxVE/pull/15918))
+
+## 2026-07-19
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - change trek repo to liketrek/TREK [@asylumexp](https://github.com/asylumexp) ([#15893](https://github.com/community-scripts/ProxmoxVE/pull/15893))
+    - update authentik to 2026.5.5 [@thieneret](https://github.com/thieneret) ([#15855](https://github.com/community-scripts/ProxmoxVE/pull/15855))
+    - [FIX] BookOrbit: add missing `restore_backup` during update [@vhsdream](https://github.com/vhsdream) ([#15881](https://github.com/community-scripts/ProxmoxVE/pull/15881))
+
+  - #### ✨ New Features
+
+    - tools.func: centralize deploy tail + trap-based tmpdir cleanup [@MickLesk](https://github.com/MickLesk) ([#15872](https://github.com/community-scripts/ProxmoxVE/pull/15872))
+    - Update OPNsense from 26.1 to 26.7 [@tdn131](https://github.com/tdn131) ([#15895](https://github.com/community-scripts/ProxmoxVE/pull/15895))
+
+### 💾 Core
+
+  - Revert "core: add configurable host CA inheritance during bootstrap" [@MickLesk](https://github.com/MickLesk) ([#15886](https://github.com/community-scripts/ProxmoxVE/pull/15886))
+
+  - #### 🐞 Bug Fixes
+
+    - fix(build.func): expand glob in SSH key "Scan Folder/Glob" so it can find keys [@TowyTowy](https://github.com/TowyTowy) ([#15873](https://github.com/community-scripts/ProxmoxVE/pull/15873))
+
+## 2026-07-18
+
+### 💾 Core
+
+  - #### ✨ New Features
+
+    - core: add configurable host CA inheritance during bootstrap [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15840](https://github.com/community-scripts/ProxmoxVE/pull/15840))
+
+  - #### 🔧 Refactor
+
+    - tools.func: Safe Delete Directorys & Update PYTHON_VERSION with setup_uv [@MickLesk](https://github.com/MickLesk) ([#15870](https://github.com/community-scripts/ProxmoxVE/pull/15870))
+
+### 🧰 Tools
+
+  - #### ✨ New Features
+
+    - [tools.update-lxcs] feat: optional reporting success/failures to heathchecks.io (or others) [@sir106](https://github.com/sir106) ([#15701](https://github.com/community-scripts/ProxmoxVE/pull/15701))
+
 ## 2026-07-17

 ### 🆕 New Scripts
@@ -1135,128 +1211,4 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

  - chore(ct): sync coredns defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#15182](https://github.com/community-scripts/ProxmoxVE/pull/15182))
 - chore(ct): sync gatus defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#15184](https://github.com/community-scripts/ProxmoxVE/pull/15184))
- chore(ct): sync bitmagnet defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#15183](https://github.com/community-scripts/ProxmoxVE/pull/15183))
-
-## 2026-06-18
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - flowise: add deps / uv / python 3.11 [@MickLesk](https://github.com/MickLesk) ([#15177](https://github.com/community-scripts/ProxmoxVE/pull/15177))
-
-  - #### 💥 Breaking Changes
-
-    - refactor: crafty-controller [@CrazyWolf13](https://github.com/CrazyWolf13) ([#15178](https://github.com/community-scripts/ProxmoxVE/pull/15178))
-
-## 2026-06-17
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - kasm: fix release detection [@CrazyWolf13](https://github.com/CrazyWolf13) ([#15151](https://github.com/community-scripts/ProxmoxVE/pull/15151))
-
-  - #### ✨ New Features
-
-    - trek: update install and upgrade workflow for v3.1.0 [@MickLesk](https://github.com/MickLesk) ([#15165](https://github.com/community-scripts/ProxmoxVE/pull/15165))
-
-  - #### 💥 Breaking Changes
-
-    - TREK: Pin version [@tremor021](https://github.com/tremor021) ([#15156](https://github.com/community-scripts/ProxmoxVE/pull/15156))
-
-  - #### 🔧 Refactor
-
-    - chore(paperless-ngx): pin version to prevent v3 update [@tomfrenzel](https://github.com/tomfrenzel) ([#15171](https://github.com/community-scripts/ProxmoxVE/pull/15171))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - immich public proxy: replace npm install with npm ci for consistent dependency installation [@MickLesk](https://github.com/MickLesk) ([#15166](https://github.com/community-scripts/ProxmoxVE/pull/15166))
-
-## 2026-06-16
-
-### 🆕 New Scripts
-
-  - Feishin ([#15130](https://github.com/community-scripts/ProxmoxVE/pull/15130))
- Kiwix ([#15131](https://github.com/community-scripts/ProxmoxVE/pull/15131))
- Add runtime status guard and deleted script stubs [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15125](https://github.com/community-scripts/ProxmoxVE/pull/15125))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - fix(degoog): use localhost for valkey url [@ethan-hgwr](https://github.com/ethan-hgwr) ([#15149](https://github.com/community-scripts/ProxmoxVE/pull/15149))
-    - Fix InvoiceShelf install/update Yarn package manager mismatch [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15141](https://github.com/community-scripts/ProxmoxVE/pull/15141))
-    - fix storyteller install failure with yarn 4 corepack [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15140](https://github.com/community-scripts/ProxmoxVE/pull/15140))
-    - fix: generate policy-compliant OpenObserve root password [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15137](https://github.com/community-scripts/ProxmoxVE/pull/15137))
-
-## 2026-06-15
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Watcharr: Clean install on update [@tremor021](https://github.com/tremor021) ([#15119](https://github.com/community-scripts/ProxmoxVE/pull/15119))
-    - Vaultwarden: extend version check for VaultWarden update [@MickLesk](https://github.com/MickLesk) ([#15105](https://github.com/community-scripts/ProxmoxVE/pull/15105))
-
-  - #### ✨ New Features
-
-    - degoog: add curl-impersonate to script [@MickLesk](https://github.com/MickLesk) ([#15117](https://github.com/community-scripts/ProxmoxVE/pull/15117))
-
-### 💾 Core
-
-  - #### ✨ New Features
-
-    - tools.func: extend mesa-vulkan-drivers and vulkan-tools to installation for ARC GPU's [@MickLesk](https://github.com/MickLesk) ([#15106](https://github.com/community-scripts/ProxmoxVE/pull/15106))
-
-  - #### 🔧 Refactor
-
-    - core: improve mirror selection and error handling [@MickLesk](https://github.com/MickLesk) ([#15108](https://github.com/community-scripts/ProxmoxVE/pull/15108))
-    - core: implement gateway validation for DHCP and static networks [@MickLesk](https://github.com/MickLesk) ([#15107](https://github.com/community-scripts/ProxmoxVE/pull/15107))
-
-## 2026-06-14
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Iinvoiceninja: fix nginx setup assets port [@MickLesk](https://github.com/MickLesk) ([#15090](https://github.com/community-scripts/ProxmoxVE/pull/15090))
-    - CheckMK: remove stale backup site before creating new backup during update [@MickLesk](https://github.com/MickLesk) ([#15088](https://github.com/community-scripts/ProxmoxVE/pull/15088))
-
-  - #### 🔧 Refactor
-
-    - Refactor: Implement backup functions for scripts C-D [@tremor021](https://github.com/tremor021) ([#15096](https://github.com/community-scripts/ProxmoxVE/pull/15096))
-
-## 2026-06-13
-
-### 🆕 New Scripts
-
-  - BookOrbit ([#15080](https://github.com/community-scripts/ProxmoxVE/pull/15080))
-
-### 🚀 Updated Scripts
-
-  - Update authentik version to 2026.5.3 [@thieneret](https://github.com/thieneret) ([#15093](https://github.com/community-scripts/ProxmoxVE/pull/15093))
-
-  - #### 🐞 Bug Fixes
-
-    - Immich: Update image-processing libraries [@vhsdream](https://github.com/vhsdream) ([#15082](https://github.com/community-scripts/ProxmoxVE/pull/15082))
-    - HomeBox: Support v0.26.0 [@tomfrenzel](https://github.com/tomfrenzel) ([#15086](https://github.com/community-scripts/ProxmoxVE/pull/15086))
-
-  - #### 🔧 Refactor
-
-    - Refactor: Implement backup functions for scripts A-B [@tremor021](https://github.com/tremor021) ([#15075](https://github.com/community-scripts/ProxmoxVE/pull/15075))
-
-## 2026-06-12
-
-### 🆕 New Scripts
-
-  - Twenty ([#15047](https://github.com/community-scripts/ProxmoxVE/pull/15047))
- Alpine-Cinny ([#15044](https://github.com/community-scripts/ProxmoxVE/pull/15044))
-
-### 💾 Core
-
-  - #### ✨ New Features
-
-    - [core] Implement backup and restore functions [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15067](https://github.com/community-scripts/ProxmoxVE/pull/15067))
+- chore(ct): sync bitmagnet defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#15183](https://github.com/community-scripts/ProxmoxVE/pull/15183))
@@ -30,7 +30,7 @@ function update_script() {
    exit
  fi

-  RELEASE="v0.27.0"
+  RELEASE="v0.27.2"
  if check_for_gh_release "affine_app" "toeverything/AFFiNE" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
    msg_info "Stopping Services"
    systemctl stop affine-web affine-worker
@@ -38,10 +38,19 @@ function update_script() {

    ensure_dependencies cmake

-    create_backup /root/.affine/config /root/.affine/storage
+    create_backup /opt/affine/.env /root/.affine/config /root/.affine/storage

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "${RELEASE}" "/opt/affine"

+    # Restore BEFORE the build: CLEAN_INSTALL wiped /opt/affine including .env,
+    # and the build below sources it
+    restore_backup
+
+    if [[ ! -f /opt/affine/.env ]]; then
+      msg_error "/opt/affine/.env is missing (lost by an earlier update). Recreate it before retrying — see the AFFiNE install script for the expected variables."
+      exit 1
+    fi
+
    msg_info "Rebuilding Application (Patience ~25 mins, don't close the console!)"
    cd /opt/affine
    source /root/.profile
@@ -111,8 +120,6 @@ TURBO
    set -a && source /opt/affine/.env && set +a
    $STD node ./scripts/self-host-predeploy.js

-    restore_backup
-
    msg_info "Starting Services"
    systemctl start affine-web affine-worker
    msg_ok "Started Services"
@@ -38,13 +38,14 @@ function update_script() {

  NODE_VERSION="24" setup_nodejs
  setup_go
-  UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.3" setup_uv
+  $STD uv cache clean
+  UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.6" setup_uv
  RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
  setup_yq

-  AUTHENTIK_VERSION="version/2026.5.3"
+  AUTHENTIK_VERSION="version/2026.5.5"
  # Source: https://github.com/goauthentik/fips/blob/main/Makefile#L26
-  XMLSEC_VERSION="1.3.11"
+  XMLSEC_VERSION="1.3.12"

  if check_for_gh_release "geoipupdate" "maxmind/geoipupdate"; then
    fetch_and_deploy_gh_release "geoipupdate" "maxmind/geoipupdate" "binary"
@@ -53,6 +53,7 @@ function update_script() {
    mkdir -p /opt/bookorbit/server/migrations
    cp -r /opt/bookorbit/server/src/db/migrations/. /opt/bookorbit/server/migrations/
    chmod +x /opt/bookorbit/server/bin/kepubify/*
+    restore_backup
    APP_VER=$(cat ~/.bookorbit)
    sed -i "s/^APP_VERSION=.*/APP_VERSION=v$APP_VER/" /opt/bookorbit/.env
    msg_ok "Rebuilt Application"
@@ -36,6 +36,30 @@ function update_script() {
    fetch_and_deploy_gh_release "gotify" "gotify/server" "prebuild" "latest" "/opt/gotify" "gotify-linux-$(arch_resolve).zip"
    chmod +x /opt/gotify/gotify-linux-$(arch_resolve)

+    if [[ ! -f /opt/gotify/gotify-server.env ]]; then
+      gotify_old_config=""
+      for f in /opt/gotify/config.yml /etc/gotify/config.yml; do
+        [[ -f "$f" ]] && gotify_old_config="$f" && break
+      done
+      if [[ -n "$gotify_old_config" ]]; then
+        msg_info "Migrating ${gotify_old_config} to env format (Gotify 3.x)"
+        if /opt/gotify/gotify-linux-$(arch_resolve) migrate-config "$gotify_old_config" >/opt/gotify/gotify-server.env 2>/dev/null; then
+          mv "$gotify_old_config" "${gotify_old_config}.bak"
+          msg_ok "Migrated config to /opt/gotify/gotify-server.env (backup: ${gotify_old_config}.bak)"
+        else
+          rm -f /opt/gotify/gotify-server.env
+          msg_warn "Config migration failed — left ${gotify_old_config} in place, review manually"
+        fi
+      fi
+    fi
+
+    if ! grep -qE '^ExecStart=.* serve' /etc/systemd/system/gotify.service 2>/dev/null; then
+      msg_info "Migrating service to serve subcommand (Gotify 3.x)"
+      sed -i -E 's|^(ExecStart=/opt/gotify/.*gotify-linux-[^ ]+)$|\1 serve|' /etc/systemd/system/gotify.service
+      systemctl daemon-reload
+      msg_ok "Migrated service to serve subcommand"
+    fi
+
    msg_info "Starting Service"
    systemctl start gotify
    msg_ok "Started Service"
@@ -42,6 +42,9 @@ function update_script() {

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "nametag" "mattogodoy/nametag" "tarball" "latest" "/opt/nametag"

+    # Restore .env BEFORE the build: CLEAN_INSTALL wiped it and the build sources it
+    cp /opt/nametag.env.bak /opt/nametag/.env
+
    msg_info "Rebuilding Application"
    cd /opt/nametag
    $STD npm ci
@@ -43,7 +43,7 @@ function update_script() {
    grep -o 'https://static\.tp-link\.com/upload/software/[^"]*linux_x64[^"]*\.deb' |
    head -n1)
  OMADA_PKG=$(basename "${OMADA_URL}")
-  VERSION=$(sed -n 's/.*_v\([0-9.]*\)_.*_\([0-9]\{14\}\)\.deb$/\1-\2/p' <<<"${OMADA_PKG}")
+  VERSION=$(sed -n 's/.*_v\([0-9.]*\)_linux.*/\1/p' <<<"${OMADA_PKG}")

  CURRENT_VERSION=$(cat $HOME/.omada 2>/dev/null || echo "0")

@@ -41,9 +41,12 @@ function update_script() {

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "postiz" "gitroomhq/postiz-app" "tarball"

+    # Restore BEFORE the build: CLEAN_INSTALL wiped /opt/postiz including .env,
+    # and the build below sources it
+    restore_backup
+
    msg_info "Building Application"
    cd /opt/postiz
-    cp /opt/postiz_env.bak /opt/postiz/.env
    set -a && source /opt/postiz/.env && set +a
    export NODE_OPTIONS="--max-old-space-size=4096"
    $STD pnpm install
@@ -57,7 +60,6 @@ function update_script() {
    msg_ok "Ran Database Migrations"

    mkdir -p /opt/postiz/uploads
-    restore_backup

    msg_info "Starting Services"
    systemctl start postiz-backend postiz-frontend postiz-orchestrator
@@ -37,18 +37,29 @@ function update_script() {
    systemctl stop romm-backend romm-worker romm-scheduler romm-watcher
    msg_ok "Stopped Services"

-    msg_info "Backing up configuration"
-    cp /opt/romm/.env /opt/romm/.env.backup
-    msg_ok "Backed up configuration"
+    create_backup /opt/romm/.env
+    BACKUP_DIR=/opt/romm-players.backup create_backup \
+      /opt/romm/frontend/dist/assets/emulatorjs \
+      /opt/romm/frontend/dist/assets/ruffle

-    fetch_and_deploy_gh_release "romm" "rommapp/romm" "tarball" "latest" "/opt/romm"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "romm" "rommapp/romm" "tarball" "latest" "/opt/romm"
+
+    restore_backup

    msg_info "Updating ROMM"
-    cp /opt/romm/.env.backup /opt/romm/.env
    cd /opt/romm
    $STD uv sync --all-extras
    cd /opt/romm/backend
    $STD uv run alembic upgrade head
+    if [[ -f /opt/romm/backend/utils/rom_patcher/package.json ]]; then
+      cd /opt/romm/backend/utils/rom_patcher
+      $STD npm install --ignore-scripts --no-audit --no-fund
+      if [[ -d node_modules/rom-patcher/rom-patcher-js ]]; then
+        rm -rf rom-patcher-js
+        cp -r node_modules/rom-patcher/rom-patcher-js ./rom-patcher-js
+      fi
+      rm -rf node_modules
+    fi
    cd /opt/romm/frontend
    $STD npm install
    $STD npm run build
@@ -73,6 +84,12 @@ function update_script() {
    msg_ok "Started Services"
    msg_ok "Updated successfully"
  fi
+
+  if check_for_gh_release "EmulatorJS" "EmulatorJS/EmulatorJS" "v4.2.3"; then
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "EmulatorJS" "EmulatorJS/EmulatorJS" "prebuild" "v4.2.3" "/opt/romm/frontend/dist/assets/emulatorjs" "4.2.3.7z"
+    systemctl restart romm-backend romm-worker romm-scheduler romm-watcher
+    msg_ok "Updated EmulatorJS successfully"
+  fi
  exit
 }

@@ -3,7 +3,7 @@ source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxV
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/mauriceboe/TREK
+# Source: https://github.com/liketrek/TREK

 APP="TREK"
 var_tags="${var_tags:-travel;planning;collaboration}"
@@ -32,7 +32,7 @@ function update_script() {

  NODE_VERSION="24" setup_nodejs

-  if check_for_gh_release "trek" "mauriceboe/TREK"; then
+  if check_for_gh_release "trek" "liketrek/TREK"; then
    MIGRATION=0
    grep -qF "ExecStart=/usr/bin/node --import tsx src/index.ts" \
      /etc/systemd/system/trek.service && MIGRATION=1
@@ -47,7 +47,7 @@ function update_script() {
      /opt/trek/data \
      /opt/trek/uploads

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "trek" "mauriceboe/TREK" "tarball"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "trek" "liketrek/TREK" "tarball"

    msg_info "Building TREK"
    cd /opt/trek
@@ -79,7 +79,7 @@ function update_script() {
      cat <<EOF >/etc/systemd/system/trek.service
 [Unit]
 Description=TREK Travel Planner
-Documentation=https://github.com/mauriceboe/TREK
+Documentation=https://github.com/liketrek/TREK
 After=network-online.target
 Wants=network-online.target

@@ -65,7 +65,7 @@ function update_script() {
    systemctl stop vikunja
    msg_ok "Stopped Service"

-    fetch_and_deploy_gh_release "vikunja" "go-vikunja/vikunja" "binary"
+    fetch_and_deploy_gh_release "vikunja" "go-vikunja/vikunja" "binary" "latest" "" "vikunja-*-$(arch_resolve "x86_64" "aarch64").deb"
    $STD systemctl daemon-reload

    msg_info "Starting Service"
@@ -46,8 +46,8 @@ function update_script() {
    cd /opt/wanderer/source/web
    $STD npm ci
    $STD npm run build
-    mkdir -p /opt/wanderer/data/plugins
-    [[ -e /data/plugins ]] || ln -sfn /opt/wanderer/data/plugins /data/plugins
+    mkdir -p /opt/wanderer/data/plugins /opt/wanderer/source/db/data
+    [[ -e /opt/wanderer/source/db/data/plugins ]] || ln -sfn /opt/wanderer/data/plugins /opt/wanderer/source/db/data/plugins
    msg_info "Installing wanderer plugins"
    for plugin in hammerhead komoot strava; do
      fetch_and_deploy_gh_release "wanderer-plugin-${plugin}" "open-wanderer/wanderer" "prebuild" "${CHECK_UPDATE_RELEASE:-latest}" "/opt/wanderer/data/plugins" "wanderer-plugin-${plugin}.tar.gz" || msg_warn "Failed to install wanderer plugin: ${plugin}"
@@ -31,7 +31,7 @@ PG_DB_NAME="affine" PG_DB_USER="affine" setup_postgresql_db
 NODE_VERSION="22" setup_nodejs
 setup_rust

-fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "v0.27.0" "/opt/affine"
+fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "v0.27.2" "/opt/affine"

 msg_info "Setting up Directories"
 rm -rf /root/.affine
@@ -54,12 +54,12 @@ NODE_VERSION="24" setup_nodejs
 setup_yq
 setup_go
 RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
-UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.3" setup_uv
+UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.6" setup_uv
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db

-XMLSEC_VERSION="1.3.11"
-AUTHENTIK_VERSION="version/2026.5.3"
+XMLSEC_VERSION="1.3.12"
+AUTHENTIK_VERSION="version/2026.5.5"
 fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec"
 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
 fetch_and_deploy_gh_release "geoipupdate" "maxmind/geoipupdate" "binary"
@@ -27,7 +27,7 @@ After=network.target
 Type=simple
 User=root
 WorkingDirectory=/opt/gotify
-ExecStart=/opt/gotify/./gotify-linux-$(arch_resolve)
+ExecStart=/opt/gotify/gotify-linux-$(arch_resolve) serve
 Restart=always
 RestartSec=3

@@ -31,13 +31,14 @@ NODE_VERSION="24" NODE_MODULE="corepack,yarn" setup_nodejs

 fetch_and_deploy_gh_release "manyfold" "manyfold3d/manyfold" "tarball" "latest" "/opt/manyfold/app"

+useradd -m -s /usr/bin/bash manyfold
+
 RUBY_INSTALL_VERSION=$(cat /opt/manyfold/app/.ruby-version)
 RUBY_VERSION=${RUBY_INSTALL_VERSION} RUBY_INSTALL_RAILS="true" HOME=/home/manyfold setup_ruby

 msg_info "Configuring Manyfold"
 YARN_VERSION=$(grep '"packageManager":' /opt/manyfold/app/package.json | sed -E 's/.*"(yarn@[0-9\.]+)".*/\1/')
 RELEASE=$(get_latest_github_release "manyfold3d/manyfold")
-useradd -m -s /usr/bin/bash manyfold
 cat <<EOF >/opt/manyfold/.env
 export APP_VERSION=${RELEASE}
 export GUID=1002
@@ -42,7 +42,7 @@ OMADA_PKG=$(basename "${OMADA_URL}")
 curl_download "${OMADA_PKG}" "${OMADA_URL}"
 $STD dpkg -i "${OMADA_PKG}"
 rm -rf "${OMADA_PKG}"
-VERSION=$(sed -n 's/.*_v\([0-9.]*\)_.*_\([0-9]\{14\}\)\.deb$/\1-\2/p' <<<"${OMADA_PKG}")
+VERSION=$(sed -n 's/.*_v\([0-9.]*\)_linux.*/\1/p' <<<"${OMADA_PKG}")
 echo "${VERSION}" >$HOME/.omada
 msg_ok "Installed Omada Controller"

@@ -134,6 +134,8 @@ else
 fi

 fetch_and_deploy_gh_release "romm" "rommapp/romm" "tarball"
+fetch_and_deploy_gh_release "ruffle" "ruffle-rs/ruffle" "prebuild" "latest" "/opt/romm/frontend/dist/assets/ruffle" "ruffle-*-web-selfhosted.zip"
+fetch_and_deploy_gh_release "EmulatorJS" "EmulatorJS/EmulatorJS" "prebuild" "v4.2.3" "/opt/romm/frontend/dist/assets/emulatorjs" "4.2.3.7z"

 msg_info "Creating environment file"
 sed -i 's/^supervised no/supervised systemd/' /etc/redis/redis.conf
@@ -159,6 +161,9 @@ ROMM_AUTH_SECRET_KEY=$AUTH_SECRET_KEY
 DISABLE_DOWNLOAD_ENDPOINT_AUTH=false
 DISABLE_CSRF_PROTECTION=false

+SCREENSCRAPER_DEV_ID=
+SCREENSCRAPER_DEV_PASSWORD=
+
 ENABLE_RESCAN_ON_FILESYSTEM_CHANGE=true
 RESCAN_ON_FILESYSTEM_CHANGE_DELAY=5

@@ -181,6 +186,18 @@ cd /opt/romm/backend
 $STD uv run alembic upgrade head
 msg_ok "Set up RomM Backend"

+if [[ -f /opt/romm/backend/utils/rom_patcher/package.json ]]; then
+  msg_info "Building ROM Patcher helper"
+  cd /opt/romm/backend/utils/rom_patcher
+  $STD npm install --ignore-scripts --no-audit --no-fund
+  if [[ -d node_modules/rom-patcher/rom-patcher-js ]]; then
+    rm -rf rom-patcher-js
+    cp -r node_modules/rom-patcher/rom-patcher-js ./rom-patcher-js
+  fi
+  rm -rf node_modules
+  msg_ok "Built ROM Patcher helper"
+fi
+
 msg_info "Setting up RomM Frontend"
 cd /opt/romm/frontend
 $STD npm install
@@ -3,7 +3,7 @@
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/mauriceboe/TREK
+# Source: https://github.com/liketrek/TREK

 source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
 color
@@ -20,7 +20,7 @@ $STD apt install -y \
 msg_ok "Installed Dependencies"

 NODE_VERSION="24" setup_nodejs
-fetch_and_deploy_gh_release "trek" "mauriceboe/TREK" "tarball"
+fetch_and_deploy_gh_release "trek" "liketrek/TREK" "tarball"

 msg_info "Setup TREK"
 cd /opt/trek
@@ -78,7 +78,7 @@ msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/trek.service
 [Unit]
 Description=TREK Travel Planner
-Documentation=https://github.com/mauriceboe/TREK
+Documentation=https://github.com/liketrek/TREK
 After=network-online.target
 Wants=network-online.target

@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os

-fetch_and_deploy_gh_release "vikunja" "go-vikunja/vikunja" "binary"
+fetch_and_deploy_gh_release "vikunja" "go-vikunja/vikunja" "binary" "latest" "" "vikunja-*-$(arch_resolve "x86_64" "aarch64").deb"

 msg_info "Setting up Vikunja"
 sed -i 's|^# \(service:\)|\1|' /etc/vikunja/config.yml
@@ -21,8 +21,9 @@ else
  fetch_and_deploy_gh_release "meilisearch" "meilisearch/meilisearch" "binary" "latest" "/opt/wanderer/source/search"
 fi
 mkdir -p /opt/wanderer/{source,data/pb_data,data/meili_data,data/plugins}
-[[ -e /data/plugins ]] || ln -sfn /opt/wanderer/data/plugins /data/plugins
 fetch_and_deploy_gh_release "wanderer" "open-wanderer/wanderer" "tarball" "latest" "/opt/wanderer/source"
+mkdir -p /opt/wanderer/source/db/data
+[[ -e /opt/wanderer/source/db/data/plugins ]] || ln -sfn /opt/wanderer/data/plugins /opt/wanderer/source/db/data/plugins

 msg_info "Installing wanderer (patience)"
 cd /opt/wanderer/source/db
@@ -31,7 +31,10 @@ $STD apt install -y elasticsearch
 sed -i 's/^#\{0,2\} *-Xms[0-9]*g.*/-Xms2g/' /etc/elasticsearch/jvm.options
 sed -i 's/^#\{0,2\} *-Xmx[0-9]*g.*/-Xmx2g/' /etc/elasticsearch/jvm.options
 cat <<EOF >/etc/elasticsearch/elasticsearch.yml
+path.data: /var/lib/elasticsearch
+path.logs: /var/log/elasticsearch
 discovery.type: single-node
+network.host: 127.0.0.1
 xpack.security.enabled: false
 bootstrap.memory_lock: false
 EOF
@@ -40,7 +43,7 @@ systemctl daemon-reload
 systemctl enable -q elasticsearch
 systemctl restart -q elasticsearch
 for i in $(seq 1 30); do
-  if curl -s http://localhost:9200 >/dev/null 2>&1; then
+  if curl -s http://127.0.0.1:9200 >/dev/null 2>&1; then
    break
  fi
  sleep 2
@@ -55,7 +58,7 @@ setup_deb822_repo \
  "$(get_os_info version_id)" \
  "main"
 $STD apt install -y zammad
-$STD zammad run rails r "Setting.set('es_url', 'http://localhost:9200')"
+$STD zammad run rails r "Setting.set('es_url', 'http://127.0.0.1:9200')"
 $STD zammad run rake zammad:searchindex:rebuild
 msg_ok "Installed Zammad"

@@ -6,6 +6,10 @@
 if ! command -v curl >/dev/null 2>&1; then
  apk update && apk add curl >/dev/null 2>&1
 fi
+# Mark container context BEFORE error handling starts: error_handler/on_exit
+# must write local failure artifacts instead of talking to the telemetry API
+# (the host is the single telemetry reporter).
+export TELEMETRY_CONTEXT="container"
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/core.func)
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/error_handler.func)
 load_functions
@@ -41,7 +45,7 @@ post_progress_to_api() {

  curl -fsS -m 5 -X POST "https://telemetry.community-scripts.org/telemetry" \
    -H "Content-Type: application/json" \
-    -d "{\"random_id\":\"${RANDOM_UUID}\",\"execution_id\":\"${EXECUTION_ID:-${RANDOM_UUID}}\",\"type\":\"lxc\",\"nsapp\":\"${app:-unknown}\",\"status\":\"${progress_status}\"}" &>/dev/null || true
+    -d "{\"random_id\":\"${RANDOM_UUID}\",\"execution_id\":\"${EXECUTION_ID:-${RANDOM_UUID}}\",\"type\":\"lxc\",\"nsapp\":\"${app:-unknown}\",\"status\":\"${progress_status}\",\"platform\":\"${TELEMETRY_PLATFORM:-}\",\"repo_source\":\"${REPO_SOURCE:-}\",\"repo_slug\":\"${REPO_SLUG:-}\"}" &>/dev/null || true
 }

 # This function enables IPv6 if it's not disabled and sets verbose mode
@@ -3600,9 +3600,9 @@ configure_ssh_settings() {
    glob_path=$(whiptail --backtitle "$backtitle" \
      --inputbox "Enter a folder or glob to scan (e.g. /root/.ssh/*.pub)" 10 72 --title "Scan Folder/Glob" 3>&1 1>&2 2>&3)
    if [[ -n "$glob_path" ]]; then
-      shopt -s nullglob
-      read -r -a _scan_files <<<"$glob_path"
-      shopt -u nullglob
+      [[ -d "$glob_path" ]] && glob_path="${glob_path%/}/*"
+      local -a _scan_files
+      mapfile -t _scan_files < <(compgen -G "$glob_path")
      if [[ "${#_scan_files[@]}" -gt 0 ]]; then
        ssh_build_choices_from_files "${_scan_files[@]}"
        if [[ "$COUNT" -gt 0 ]]; then
@@ -4072,6 +4072,11 @@ build_container() {
  export RANDOM_UUID="$RANDOM_UUID"
  export EXECUTION_ID="$EXECUTION_ID"
  export SESSION_ID="$SESSION_ID"
+  # Repo attribution + platform for container-side progress pings (the
+  # container inherits the host's detection instead of re-detecting)
+  export REPO_SOURCE="${REPO_SOURCE:-}"
+  export REPO_SLUG="${REPO_SLUG:-}"
+  export TELEMETRY_PLATFORM="pve"
  export CACHER="$APT_CACHER"
  export CACHER_IP="$APT_CACHER_IP"
  if [[ -n "${HTTP_PROXY:-}" ]]; then
@@ -4233,27 +4238,31 @@ $PCT_OPTIONS_STRING"
      return 0
    fi

-    # Check for Intel GPU - look for Intel vendor ID [8086]
-    if grep -q "\[8086:" <<<"$pci_vga_info"; then
-      msg_custom "🎮" "${BL}" "Detected Intel GPU"
-      if [[ -d /dev/dri ]]; then
-        for d in /dev/dri/renderD* /dev/dri/card*; do
-          [[ -e "$d" ]] && INTEL_DEVICES+=("$d")
-        done
-      fi
+    # Map each DRI render/card node to its owning GPU via the PCI vendor ID
+    # exposed in sysfs (/sys/class/drm/<node>/device/vendor). This is required
+    # on multi-GPU hosts: globbing every /dev/dri node onto the first detected
+    # vendor would pass through *both* GPUs and skip the selection prompt.
+    if [[ -d /dev/dri ]]; then
+      for d in /dev/dri/renderD* /dev/dri/card*; do
+        [[ -e "$d" ]] || continue
+        local node vendor
+        node=$(basename "$d")
+        vendor=$(cat "/sys/class/drm/${node}/device/vendor" 2>/dev/null || true)
+        case "$vendor" in
+        0x8086) INTEL_DEVICES+=("$d") ;;        # Intel
+        0x1002 | 0x1022) AMD_DEVICES+=("$d") ;; # AMD/ATI
+        0x10de) ;;                              # NVIDIA - handled via /dev/nvidia* below
+        *) msg_debug "Unmapped GPU vendor '${vendor:-unknown}' for $d" ;;
+        esac
+      done
    fi

-    # Check for AMD GPU - look for AMD vendor IDs [1002] (AMD/ATI) or [1022] (AMD)
-    if grep -qE "\[1002:|\[1022:" <<<"$pci_vga_info"; then
-      msg_custom "🎮" "${RD}" "Detected AMD GPU"
-      if [[ -d /dev/dri ]]; then
-        # Only add if not already claimed by Intel
-        if [[ ${#INTEL_DEVICES[@]} -eq 0 ]]; then
-          for d in /dev/dri/renderD* /dev/dri/card* /dev/kfd; do
-            [[ -e "$d" ]] && AMD_DEVICES+=("$d")
-          done
-        fi
-      fi
+    [[ ${#INTEL_DEVICES[@]} -gt 0 ]] && msg_custom "🎮" "${BL}" "Detected Intel GPU"
+    [[ ${#AMD_DEVICES[@]} -gt 0 ]] && msg_custom "🎮" "${RD}" "Detected AMD GPU"
+
+    # AMD compute (ROCm) additionally needs /dev/kfd alongside the render nodes
+    if [[ ${#AMD_DEVICES[@]} -gt 0 && -e /dev/kfd ]]; then
+      AMD_DEVICES+=("/dev/kfd")
    fi

    # Check for NVIDIA GPU - look for NVIDIA vendor ID [10de]
@@ -4891,6 +4900,16 @@ EOF
        # Point INSTALL_LOG to combined log so get_full_log() finds it
        INSTALL_LOG="$combined_log"
      fi
+
+      # Pull the structured error capture (.errinfo) from the container.
+      # It contains EXACTLY the output of the command that failed (written by
+      # silent()/error_handler inside the container) and is the primary source
+      # for the telemetry error trace - instead of a generic log tail.
+      local host_errinfo="/tmp/.errinfo-${SESSION_ID}"
+      if timeout 8 pct pull "$CTID" "/root/.install-${SESSION_ID}.log.errinfo" "$host_errinfo" 2>/dev/null && [[ -s "$host_errinfo" ]]; then
+        TELEMETRY_ERRINFO="$host_errinfo"
+        export TELEMETRY_ERRINFO
+      fi
    fi

    # Defense-in-depth: Ensure error handling stays disabled during recovery.
@@ -5166,6 +5185,8 @@ EOF
        echo -e "  Verbose: ${GN}enabled${CL}"
        echo ""
        msg_info "Restarting installation..."
+        # New telemetry execution for the retry (previous one keeps its "failed")
+        declare -f telemetry_new_attempt &>/dev/null && telemetry_new_attempt
        # Re-run build_container
        build_container
        return $?
@@ -5205,6 +5226,10 @@ EOF
          echo ""
          msg_info "Re-running installation script..."

+          # New telemetry execution for the in-place retry
+          declare -f telemetry_new_attempt &>/dev/null && telemetry_new_attempt
+          declare -f post_to_api &>/dev/null && post_to_api 2>/dev/null || true
+
          # Re-run install script in existing container (don't destroy/recreate)
          set +Eeuo pipefail
          trap - ERR
@@ -5268,6 +5293,7 @@ EOF
          echo -e "  Verbose: ${GN}enabled${CL}"
          echo ""
          msg_info "Restarting installation..."
+          declare -f telemetry_new_attempt &>/dev/null && telemetry_new_attempt
          build_container
          return $?
        fi
@@ -5297,6 +5323,7 @@ EOF
          echo -e "  Verbose: ${GN}enabled${CL}"
          echo ""
          msg_info "Restarting installation..."
+          declare -f telemetry_new_attempt &>/dev/null && telemetry_new_attempt
          build_container
          return $?
        fi
@@ -5321,6 +5348,7 @@ EOF
          echo -e "  Verbose: ${GN}enabled${CL}"
          echo ""
          msg_info "Restarting installation..."
+          declare -f telemetry_new_attempt &>/dev/null && telemetry_new_attempt
          build_container
          return $?
        fi
@@ -6995,6 +7023,16 @@ ensure_log_on_host() {
        rm -f "$temp_log"
      fi
    fi
+    # Also pull the structured error capture (.errinfo) so the telemetry error
+    # trace shows the failing command's exact output (signal-exit paths reach
+    # this via on_exit before/instead of the recovery flow)
+    if [[ -z "${TELEMETRY_ERRINFO:-}" || ! -s "${TELEMETRY_ERRINFO:-}" ]]; then
+      local host_errinfo="/tmp/.errinfo-${SESSION_ID}"
+      if timeout 8 pct pull "$CTID" "/root/.install-${SESSION_ID}.log.errinfo" "$host_errinfo" 2>/dev/null && [[ -s "$host_errinfo" ]]; then
+        TELEMETRY_ERRINFO="$host_errinfo"
+        export TELEMETRY_ERRINFO
+      fi
+    fi
    if [[ -s "$combined_log" ]]; then
      INSTALL_LOG="$combined_log"
    fi
@@ -546,6 +546,12 @@ silent() {
  set +Eeuo pipefail
  trap - ERR

+  # Byte offset BEFORE the command runs - everything the log grows by is
+  # exactly this command's output (used for the .errinfo telemetry capture)
+  local start_bytes=0
+  [[ -f "$logfile" ]] && start_bytes=$(stat -c%s "$logfile" 2>/dev/null || echo 0)
+  [[ ! "$start_bytes" =~ ^[0-9]+$ ]] && start_bytes=0
+
  "$@" >>"$logfile" 2>&1
  local rc=$?

@@ -567,12 +573,43 @@ silent() {
    export _SILENT_FAILED_LINE="$caller_line"
    export _SILENT_FAILED_LOG="$logfile"

+    # ── Structured error capture (.errinfo) for telemetry ──
+    # Extract exactly THIS command's output (from the recorded byte offset),
+    # strip ANSI/progress noise, keep the last 60 lines. The host builds the
+    # telemetry error trace from this file (pulled from the container on
+    # failure). Self-contained - containers don't source api.func.
+    {
+      local flat_cmd
+      flat_cmd=$(printf '%s' "$cmd" | tr '\n' ' ' | head -c 300)
+      echo "EXIT_CODE=${rc}"
+      echo "LINE=${caller_line}"
+      echo "COMMAND=${flat_cmd}"
+      echo "--- OUTPUT ---"
+      if [[ -s "$logfile" ]]; then
+        local segment
+        segment=$(tail -c +"$((start_bytes + 1))" "$logfile" 2>/dev/null |
+          sed 's/\r$//' |
+          sed 's/\x1b\[[0-9;]*[a-zA-Z]//g' |
+          grep -avE '^(Get:|Hit:|Ign:|Fetched |Reading package lists|Reading state information|Building dependency tree|Selecting previously|Preparing to unpack|Unpacking |Processing triggers for|\(Reading database|[0-9]+%[[:space:]]*\[)' |
+          grep -avE '^[[:space:]]*$' |
+          tail -n 60)
+        # If the noise filter swallowed everything, fall back to the raw tail
+        if [[ -z "$segment" ]]; then
+          segment=$(tail -c +"$((start_bytes + 1))" "$logfile" 2>/dev/null |
+            sed 's/\r$//' | sed 's/\x1b\[[0-9;]*[a-zA-Z]//g' | tail -n 60)
+        fi
+        printf '%s' "$segment" | head -c 10240
+      fi
+    } >"${logfile}.errinfo" 2>/dev/null || true
+
    return "$rc"
  fi

  # Clear stale flags on success (prevents false positives if a previous
  # $STD cmd || true failed and a later non-silent command triggers error_handler)
  unset _SILENT_FAILED_RC _SILENT_FAILED_CMD _SILENT_FAILED_LINE _SILENT_FAILED_LOG 2>/dev/null || true
+  # Also drop a stale .errinfo from a previously tolerated failure ($STD cmd || true)
+  rm -f "${logfile}.errinfo" 2>/dev/null || true
 }

 # ------------------------------------------------------------------------------
@@ -7,12 +7,17 @@
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # ------------------------------------------------------------------------------
 #
-# Provides comprehensive error handling and signal management for all scripts.
-# Includes:
-#   - Exit code explanations (shell, package managers, databases, custom codes)
-#   - Error handler with detailed logging
-#   - Signal handlers (EXIT, INT, TERM)
-#   - Initialization function for trap setup
+# Provides error handling and signal management for all scripts.
+#
+# TELEMETRY CONTRACT:
+#   - HOST context: this file reports terminal statuses via post_update_to_api
+#     (full metadata + focused error trace).
+#   - CONTAINER context: this file NEVER talks to the telemetry API. It writes
+#     two local artifacts that the host picks up after lxc-attach returns:
+#       /root/.install-<SESSION_ID>.failed        → exit code (flag file)
+#       /root/.install-<SESSION_ID>.log.errinfo   → structured error capture
+#     This guarantees the server only ever sees ONE terminal event per
+#     execution - the host's complete one.
 #
 # Usage:
 #   source <(curl -fsSL .../error_handler.func)
@@ -21,15 +26,14 @@
 # ------------------------------------------------------------------------------

 # ==============================================================================
-# SECTION 1: EXIT CODE EXPLANATIONS
+# SECTION 1: EXIT CODE EXPLANATIONS (fallback)
 # ==============================================================================

 # ------------------------------------------------------------------------------
 # explain_exit_code()
 #
-# - Canonical version is defined in api.func (sourced before this file)
-# - This section only provides a fallback if api.func was not loaded
-# - See api.func SECTION 1 for the authoritative exit code mappings
+# - Canonical version lives in api.func (sourced before this file on the host)
+# - This fallback covers the container context where api.func is not sourced
 # ------------------------------------------------------------------------------
 if ! declare -f explain_exit_code &>/dev/null; then
  explain_exit_code() {
@@ -94,8 +98,6 @@ if ! declare -f explain_exit_code &>/dev/null; then
    100) echo "APT: Package manager error (broken packages / dependency problems)" ;;
    101) echo "APT: Configuration error (bad sources.list, malformed config)" ;;
    102) echo "APT: Lock held by another process (dpkg/apt still running)" ;;
-
-    # --- Script Validation & Setup (103-123) ---
    103) echo "Validation: Shell is not Bash" ;;
    104) echo "Validation: Not running as root (or invoked via sudo)" ;;
    105) echo "Validation: Proxmox VE version not supported" ;;
@@ -177,9 +179,8 @@ if ! declare -f explain_exit_code &>/dev/null; then
    223) echo "Proxmox: Template not available after download" ;;
    224) echo "Proxmox: PBS storage is for backups only" ;;
    225) echo "Proxmox: No template available for OS/Version" ;;
+    226) echo "Proxmox: VM disk import or post-creation setup failed" ;;
    231) echo "Proxmox: LXC stack upgrade failed" ;;
-
-    # --- Tools & Addon Scripts (232-238) ---
    232) echo "Tools: Wrong execution environment (run on PVE host, not inside LXC)" ;;
    233) echo "Tools: Application not installed (update prerequisite missing)" ;;
    234) echo "Tools: No LXC containers found or available" ;;
@@ -187,7 +188,6 @@ if ! declare -f explain_exit_code &>/dev/null; then
    236) echo "Tools: Required hardware not detected" ;;
    237) echo "Tools: Dependency package installation failed" ;;
    238) echo "Tools: OS or distribution not supported for this addon" ;;
-
    239) echo "npm/Node.js: Unexpected runtime error or dependency failure" ;;
    243) echo "Node.js: Out of memory (JavaScript heap out of memory)" ;;
    245) echo "Node.js: Invalid command-line option" ;;
@@ -195,14 +195,11 @@ if ! declare -f explain_exit_code &>/dev/null; then
    247) echo "Node.js: Fatal internal error" ;;
    248) echo "Node.js: Invalid C++ addon / N-API failure" ;;
    249) echo "npm/pnpm/yarn: Unknown fatal error" ;;
-
-    # --- Application Install/Update Errors (250-254) ---
    250) echo "App: Download failed or version not determined" ;;
    251) echo "App: File extraction failed (corrupt or incomplete archive)" ;;
    252) echo "App: Required file or resource not found" ;;
    253) echo "App: Data migration required — update aborted" ;;
    254) echo "App: User declined prompt or input timed out" ;;
-
    255) echo "DPKG: Fatal internal error" ;;
    *) echo "Unknown error" ;;
    esac
@@ -210,24 +207,98 @@ if ! declare -f explain_exit_code &>/dev/null; then
 fi

 # ==============================================================================
-# SECTION 2: ERROR HANDLERS
+# SECTION 2: CONTEXT DETECTION & CONTAINER ARTIFACTS
+# ==============================================================================
+
+# ------------------------------------------------------------------------------
+# _is_container_context()
+#
+# - Returns 0 (true) when running INSIDE the LXC container being installed
+# - TELEMETRY_CONTEXT can override the heuristic ("host" / "container");
+#   install.func sets TELEMETRY_CONTEXT=container during bootstrap
+# ------------------------------------------------------------------------------
+_is_container_context() {
+  case "${TELEMETRY_CONTEXT:-}" in
+  container) return 0 ;;
+  host) return 1 ;;
+  esac
+  # Proxmox/Incus tooling exists only on the host
+  command -v pveversion &>/dev/null && return 1
+  command -v pct &>/dev/null && return 1
+  command -v incus &>/dev/null && return 1
+  # systemd-detect-virt reports lxc inside containers
+  if command -v systemd-detect-virt &>/dev/null; then
+    case "$(systemd-detect-virt -c 2>/dev/null)" in
+    lxc | lxc-libvirt | openvz) return 0 ;;
+    esac
+  fi
+  # PCT_OSTYPE is exported into the install environment by the host
+  [[ -n "${PCT_OSTYPE:-}" ]] && return 0
+  return 1
+}
+
+# ------------------------------------------------------------------------------
+# _container_write_failure()
+#
+# - Writes the failure artifacts inside the container for the host to pick up:
+#   * flag file with the exit code
+#   * .errinfo capture (if silent() has not already written a better one)
+#   * copy of the install log
+# - This REPLACES any direct telemetry send from the container
+# - Arguments: $1 = exit_code, $2 = command (optional), $3 = line (optional)
+# ------------------------------------------------------------------------------
+_container_write_failure() {
+  local exit_code="${1:-1}"
+  local command="${2:-}"
+  local line="${3:-}"
+  local sid="${SESSION_ID:-error}"
+
+  # Flag file with exit code (host reads this after lxc-attach returns)
+  echo "$exit_code" >"/root/.install-${sid}.failed" 2>/dev/null || true
+
+  # Keep the install log where the host expects it
+  if [[ -n "${INSTALL_LOG:-}" && -f "${INSTALL_LOG}" && "${INSTALL_LOG}" != "/root/.install-${sid}.log" ]]; then
+    cp "${INSTALL_LOG}" "/root/.install-${sid}.log" 2>/dev/null || true
+  fi
+
+  # Structured error capture (skip if silent() already wrote the exact
+  # output segment of the failing command - that one is always better).
+  # Self-contained: api.func is NOT sourced inside containers.
+  local errinfo="${INSTALL_LOG:-/root/.install-${sid}.log}.errinfo"
+  if [[ ! -s "$errinfo" ]]; then
+    local flat_cmd
+    flat_cmd=$(printf '%s' "${command:-unknown}" | tr '\n' ' ' | head -c 300)
+    {
+      echo "EXIT_CODE=${exit_code}"
+      echo "LINE=${line:-0}"
+      echo "COMMAND=${flat_cmd}"
+      echo "--- OUTPUT ---"
+      if [[ -n "${INSTALL_LOG:-}" && -s "${INSTALL_LOG}" ]]; then
+        tail -n 80 "${INSTALL_LOG}" 2>/dev/null |
+          sed 's/\r$//' |
+          sed 's/\x1b\[[0-9;]*[a-zA-Z]//g' |
+          grep -avE '^(Get:|Hit:|Ign:|Fetched |Reading package lists|Reading state information|Building dependency tree|Selecting previously|Preparing to unpack|Unpacking |Processing triggers for|\(Reading database|[0-9]+%[[:space:]]*\[)' |
+          grep -avE '^[[:space:]]*$' |
+          tail -n 60 | head -c 10240
+      fi
+    } >"$errinfo" 2>/dev/null || true
+  fi
+}
+
+# ==============================================================================
+# SECTION 3: ERROR HANDLER
 # ==============================================================================

 # ------------------------------------------------------------------------------
 # error_handler()
 #
 # - Main error handler triggered by ERR trap
-# - Arguments: exit_code, command, line_number
-# - Behavior:
-#   * Returns silently if exit_code is 0 (success)
-#   * Sources explain_exit_code() for detailed error description
-#   * Displays error message with:
-#     - Line number where error occurred
-#     - Exit code with explanation
-#     - Command that failed
-#   * Shows last 20 lines of SILENT_LOGFILE if available
-#   * Copies log to container /root for later inspection
-#   * Exits with original exit code
+# - Displays error message with line number, exit code, explanation, command
+# - Shows last 20 lines of the active log
+# - Emits actionable hints for common failure patterns (OOM, APT, network...)
+# - HOST: reports "failed" to telemetry (full payload via api.func)
+# - CONTAINER: writes failure artifacts, sends nothing
+# - Exits with original exit code
 # ------------------------------------------------------------------------------
 error_handler() {
  local exit_code=${1:-$?}
@@ -237,12 +308,10 @@ error_handler() {
  command="${command//\$STD/}"

  # If error originated from silent(), use its captured metadata
-  # This provides the actual command and line number instead of "silent ..."
  if [[ -n "${_SILENT_FAILED_RC:-}" ]]; then
    exit_code="$_SILENT_FAILED_RC"
    command="$_SILENT_FAILED_CMD"
    line_number="$_SILENT_FAILED_LINE"
-    # Clear flags to prevent stale data on subsequent errors
    unset _SILENT_FAILED_RC _SILENT_FAILED_CMD _SILENT_FAILED_LINE
  fi

@@ -250,8 +319,12 @@ error_handler() {
    return 0
  fi

-  # Stop spinner and restore cursor FIRST — before any output
-  # This prevents spinner text overlapping with error messages
+  # Export the failure location so telemetry can include the "where"
+  FAILED_COMMAND="$command"
+  FAILED_LINE="$line_number"
+  export FAILED_COMMAND FAILED_LINE
+
+  # Stop spinner and restore cursor FIRST - before any output
  if declare -f stop_spinner >/dev/null 2>&1; then
    stop_spinner 2>/dev/null || true
  fi
@@ -259,18 +332,18 @@ error_handler() {

  local explanation
  explanation="$(explain_exit_code "$exit_code")"
-
-  # ALWAYS report failure to API immediately - don't wait for container checks
-  # This ensures we capture failures that occur before/after container exists
-  if declare -f post_update_to_api &>/dev/null; then
-    post_update_to_api "failed" "$exit_code" 2>/dev/null || true
-  else
-    # Container context: post_update_to_api not available (api.func not sourced)
-    # Send status directly via curl so container failures are never lost
-    _send_abort_telemetry "$exit_code" 2>/dev/null || true
+  if [[ "$explanation" == curl:* && ! "$command" =~ (^|[[:space:]])([^[:space:]]*/)?curl([[:space:]]|$) ]]; then
+    explanation="Command failed with exit status ${exit_code}"
  fi

-  # Use msg_error if available, fallback to echo
+  # ── Telemetry / failure artifacts ──
+  if _is_container_context; then
+    _container_write_failure "$exit_code" "$command" "$line_number"
+  elif declare -f post_update_to_api &>/dev/null; then
+    post_update_to_api "failed" "$exit_code" 2>/dev/null || true
+  fi
+
+  # ── Display ──
  if declare -f msg_error >/dev/null 2>&1; then
    msg_error "in line ${line_number}: exit code ${exit_code} (${explanation}): while executing command ${command}"
  else
@@ -288,8 +361,7 @@ error_handler() {
    } >>"$DEBUG_LOGFILE"
  fi

-  # Get active log file (BUILD_LOG or INSTALL_LOG)
-  # Prefer silent()'s logfile when available (contains the actual command output)
+  # Get active log file (prefer silent()'s logfile when available)
  local active_log=""
  if [[ -n "${_SILENT_FAILED_LOG:-}" && -s "${_SILENT_FAILED_LOG}" ]]; then
    active_log="$_SILENT_FAILED_LOG"
@@ -300,21 +372,17 @@ error_handler() {
    active_log="$SILENT_LOGFILE"
  fi

-  # If active_log points to a container-internal path that doesn't exist on host,
-  # fall back to BUILD_LOG (host-side log)
  if [[ -n "$active_log" && ! -s "$active_log" && -n "${BUILD_LOG:-}" && -s "${BUILD_LOG}" ]]; then
    active_log="$BUILD_LOG"
  fi

-  # Show last log lines if available
  if [[ -n "$active_log" && -s "$active_log" ]]; then
    echo -e "\n${TAB}--- Last 20 lines of log ---"
    tail -n 20 "$active_log"
    echo -e "${TAB}-----------------------------------\n"
  fi

-  # Detect probable Node.js heap OOM and print actionable guidance.
-  # This avoids generic SIGABRT/SIGKILL confusion for frontend build failures.
+  # ── Node.js heap OOM detection with actionable guidance ──
  local node_oom_detected="false"
  local node_build_context="false"
  if [[ "$command" =~ (npm|pnpm|yarn|node|vite|turbo) ]]; then
@@ -331,7 +399,6 @@ error_handler() {
  if [[ "$node_oom_detected" == "true" ]] || { [[ "$node_build_context" == "true" ]] && [[ "$exit_code" =~ ^(134|137)$ ]]; }; then
    local heap_hint_mb=""

-    # If explicitly configured, prefer the current value for troubleshooting output.
    if [[ -n "${NODE_OPTIONS:-}" ]] && [[ "${NODE_OPTIONS}" =~ max-old-space-size=([0-9]+) ]]; then
      heap_hint_mb="${BASH_REMATCH[1]}"
    elif [[ -n "${var_ram:-}" ]] && [[ "${var_ram}" =~ ^[0-9]+$ ]]; then
@@ -358,14 +425,13 @@ error_handler() {
    fi
  fi

-  # ── Log-pattern analysis: detect common failure causes and emit actionable hints ──
+  # ── Log-pattern analysis: actionable hints for common failure causes ──
  if [[ -n "$active_log" && -s "$active_log" ]]; then
    local _log_tail
    _log_tail=$(tail -n 60 "$active_log" 2>/dev/null || true)

    # 1. APT/dpkg dependency conflict
    if echo "$_log_tail" | grep -qE "Depends:|depends on.*but.*not installed|broken packages|unmet dep|dependency problems"; then
-      # Check for PostgreSQL-specific version mismatch (most actionable)
      local _pg_conflict
      _pg_conflict=$(echo "$_log_tail" | grep -oE 'postgresql-[0-9]+ but.*installed' | head -1 || true)
      if [[ -n "$_pg_conflict" ]]; then
@@ -386,7 +452,7 @@ error_handler() {
        msg_warn "Hint: A repository GPG key may be missing, expired, or the keyring file is not yet present (/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc etc.)."
        msg_warn "Hint: Install the 'postgresql-common' package first, or re-add the repository with its correct signing key."
      fi
-    # 3. Network / DNS failure during apt-get or curl
+    # 3. Network / DNS failure
    elif echo "$_log_tail" | grep -qE "Could not resolve|Failed to fetch|Unable to connect|Name or service not known|Network is unreachable|curl.*resolve"; then
      if declare -f msg_warn >/dev/null 2>&1; then
        msg_warn "Network or DNS failure detected."
@@ -407,17 +473,12 @@ error_handler() {
    fi
  fi

-  # Detect context: Container (INSTALL_LOG set + inside container /root) vs Host
-  if [[ -n "${INSTALL_LOG:-}" && -f "${INSTALL_LOG:-}" && -d /root ]]; then
-    # CONTAINER CONTEXT: Copy log and create flag file for host
-    local container_log="/root/.install-${SESSION_ID:-error}.log"
-    cp "${INSTALL_LOG}" "$container_log" 2>/dev/null || true
-
-    # Create error flag file with exit code for host detection
-    echo "$exit_code" >"/root/.install-${SESSION_ID:-error}.failed" 2>/dev/null || true
-    # Log path is shown by host as combined log - no need to show container path
+  # ── Context-specific cleanup ──
+  if _is_container_context; then
+    # Container: artifacts already written above; nothing more to do
+    :
  else
-    # HOST CONTEXT: Show local log path and offer container cleanup
+    # HOST: show log path and offer container cleanup
    if [[ -n "$active_log" && -s "$active_log" ]]; then
      if declare -f msg_custom >/dev/null 2>&1; then
        msg_custom "📋" "${YW}" "Full log: ${active_log}"
@@ -435,7 +496,6 @@ error_handler() {
        echo -en "${YW}Remove broken container ${CTID}? (Y/n) [auto-remove in 60s]: ${CL}"
      fi

-      # Read user response
      local response=""
      if read -t 60 -r response; then
        if [[ -z "$response" || "$response" =~ ^[Yy]$ ]]; then
@@ -476,12 +536,6 @@ error_handler() {
          echo -e "${GN}✔${CL} Container ${CTID} removed"
        fi
      fi
-
-      # Force one final status update attempt after cleanup
-      # This ensures status is updated even if the first attempt failed (e.g., HTTP 400)
-      if declare -f post_update_to_api &>/dev/null; then
-        post_update_to_api "failed" "$exit_code" "force"
-      fi
    fi
  fi

@@ -489,106 +543,33 @@ error_handler() {
 }

 # ==============================================================================
-# SECTION 3: TELEMETRY & CLEANUP HELPERS FOR SIGNAL HANDLERS
+# SECTION 4: TELEMETRY & CLEANUP HELPERS FOR SIGNAL HANDLERS
 # ==============================================================================

 # ------------------------------------------------------------------------------
-# _send_abort_telemetry()
+# _send_abort_telemetry()  (compatibility name)
 #
-# - Sends failure/abort status to telemetry API
-# - Works in BOTH host context (post_update_to_api available) and
-#   container context (only curl available, api.func not sourced)
-# - Container context is critical: without this, container-side failures
-#   and signal exits are never reported, leaving records stuck in
-#   "installing" or "configuring" forever
+# - HOST: reports via post_update_to_api (signals map to "aborted" there)
+# - CONTAINER: writes failure artifacts instead of sending anything
 # - Arguments: $1 = exit_code
 # ------------------------------------------------------------------------------
 _send_abort_telemetry() {
  local exit_code="${1:-1}"
-  # Try full API function first (host context - api.func sourced)
+  if _is_container_context; then
+    _container_write_failure "$exit_code"
+    return 0
+  fi
  if declare -f post_update_to_api &>/dev/null; then
    post_update_to_api "failed" "$exit_code" 2>/dev/null || true
-    return
  fi
-  # Fallback: direct curl (container context - api.func NOT sourced)
-  # This is the ONLY way containers can report failures to telemetry
-  command -v curl &>/dev/null || return 0
-  [[ "${DIAGNOSTICS:-no}" == "no" ]] && return 0
-  [[ -z "${RANDOM_UUID:-}" ]] && return 0
-
-  # Collect last 200 log lines for error diagnosis (best-effort)
-  # Container context has no get_full_log(), so we gather as much as possible
-  local error_text=""
-  local logfile=""
-  if [[ -n "${INSTALL_LOG:-}" && -s "${INSTALL_LOG}" ]]; then
-    logfile="${INSTALL_LOG}"
-  elif [[ -n "${SILENT_LOGFILE:-}" && -s "${SILENT_LOGFILE}" ]]; then
-    logfile="${SILENT_LOGFILE}"
-  fi
-
-  if [[ -n "$logfile" ]]; then
-    error_text=$(tail -n 200 "$logfile" 2>/dev/null | sed 's/\x1b\[[0-9;]*[a-zA-Z]//g; s/\\/\\\\/g; s/"/\\"/g; s/\r//g' | tr '\n' '|' | sed 's/|$//' | head -c 16384 | tr -d '\000-\010\013\014\016-\037\177') || true
-  fi
-
-  # Prepend exit code explanation header (like build_error_string does on host)
-  local explanation=""
-  if declare -f explain_exit_code &>/dev/null; then
-    explanation=$(explain_exit_code "$exit_code" 2>/dev/null) || true
-  fi
-  if [[ -n "$explanation" && -n "$error_text" ]]; then
-    error_text="exit_code=${exit_code} | ${explanation}|---|${error_text}"
-  elif [[ -n "$explanation" && -z "$error_text" ]]; then
-    error_text="exit_code=${exit_code} | ${explanation}"
-  fi
-
-  # Calculate duration if start time is available
-  local duration=""
-  if [[ -n "${DIAGNOSTICS_START_TIME:-}" ]]; then
-    duration=$(($(date +%s) - DIAGNOSTICS_START_TIME))
-  fi
-
-  # Categorize error if function is available (may not be in minimal container context)
-  local error_category=""
-  if declare -f categorize_error &>/dev/null; then
-    error_category=$(categorize_error "$exit_code" 2>/dev/null) || true
-  fi
-
-  # Build JSON payload with error context
-  local payload
-  payload="{\"random_id\":\"${RANDOM_UUID}\",\"execution_id\":\"${EXECUTION_ID:-${RANDOM_UUID}}\",\"type\":\"${TELEMETRY_TYPE:-lxc}\",\"nsapp\":\"${NSAPP:-${app:-unknown}}\",\"status\":\"failed\",\"exit_code\":${exit_code}"
-  [[ -n "$error_text" ]] && payload="${payload},\"error\":\"${error_text}\""
-  [[ -n "$error_category" ]] && payload="${payload},\"error_category\":\"${error_category}\""
-  [[ -n "$duration" ]] && payload="${payload},\"duration\":${duration}"
-  payload="${payload}}"
-
-  local api_url="${TELEMETRY_URL:-https://telemetry.community-scripts.org/telemetry}"
-
-  # 2 attempts (retry once on failure) — original had no retry
-  local attempt
-  for attempt in 1 2; do
-    if curl -fsS -m 5 -X POST "$api_url" \
-      -H "Content-Type: application/json" \
-      -d "$payload" &>/dev/null; then
-      return 0
-    fi
-    [[ $attempt -eq 1 ]] && sleep 1
-  done
  return 0
 }

 # ------------------------------------------------------------------------------
 # _stop_container_if_installing()
 #
-# - Stops the LXC container if we're in the install phase
+# - Stops the LXC container if we're in the install phase (host only)
 # - Prevents orphaned container processes when the host exits due to a signal
-#   (SSH disconnect, Ctrl+C, SIGTERM) — without this, the container keeps
-#   running and may send "configuring" status AFTER the host already sent
-#   "failed", leaving records permanently stuck in "configuring"
-# - Only acts when:
-#   * CONTAINER_INSTALLING flag is set (during lxc-attach in build_container)
-#   * CTID is set (container was created)
-#   * pct command is available (we're on the Proxmox host, not inside a container)
-# - Does NOT destroy the container — just stops it for potential debugging
 # ------------------------------------------------------------------------------
 _stop_container_if_installing() {
  [[ "${CONTAINER_INSTALLING:-}" == "true" ]] || return 0
@@ -598,51 +579,47 @@ _stop_container_if_installing() {
 }

 # ==============================================================================
-# SECTION 4: SIGNAL HANDLERS
+# SECTION 5: SIGNAL HANDLERS
 # ==============================================================================

 # ------------------------------------------------------------------------------
 # on_exit()
 #
 # - EXIT trap handler — runs on EVERY script termination
-# - Catches orphaned "installing"/"configuring" records:
-#   * If post_to_api sent "installing" but post_update_to_api never ran
-#   * Reports final status to prevent records stuck forever
-# - Best-effort log collection for failed installs
-# - Stops orphaned container processes on failure
-# - Cleans up lock files
+# - CONTAINER: ensures failure artifacts exist on non-zero exit (this also
+#   covers silent()'s direct `exit $rc`, which bypasses the ERR trap)
+# - HOST: catches executions that never sent a final status:
+#   * non-zero exit → "failed" (signal codes map to "aborted")
+#   * zero exit with an "installing" record but no final → "aborted"
+#     (e.g. user cancelled a whiptail dialog, script exited cleanly)
 # ------------------------------------------------------------------------------
 on_exit() {
  local exit_code=$?

-  # Report orphaned telemetry records
-  # Two scenarios handled:
-  # 1. POST_TO_API_DONE=true but POST_UPDATE_DONE=false: Record was created but
-  #    never got a final status update → send abort/done now.
-  # 2. POST_TO_API_DONE=false but DIAGNOSTICS=yes: Initial post failed (server
-  #    unreachable/timeout), but the server has fallback create-on-update logic,
-  #    so a status update can still create the record. Worth one last try.
-  if [[ "${POST_UPDATE_DONE:-}" != "true" ]]; then
-    if [[ "${POST_TO_API_DONE:-}" == "true" || "${DIAGNOSTICS:-no}" == "yes" ]]; then
+  if _is_container_context; then
+    if [[ $exit_code -ne 0 ]]; then
+      _container_write_failure "$exit_code" "${FAILED_COMMAND:-}" "${FAILED_LINE:-}"
+    fi
+  else
+    if [[ "${POST_UPDATE_DONE:-}" != "true" ]] && declare -f post_update_to_api >/dev/null 2>&1; then
      if [[ $exit_code -ne 0 ]]; then
-        _send_abort_telemetry "$exit_code"
-      elif [[ "${INSTALL_COMPLETE:-}" == "true" ]] && declare -f post_update_to_api >/dev/null 2>&1; then
-        # Only report success if the install was explicitly marked complete.
-        # Without this guard, early bailouts (e.g. user cancelled) with exit 0
-        # would be falsely reported as successful installations.
-        post_update_to_api "done" "0" 2>/dev/null || true
+        post_update_to_api "failed" "$exit_code" 2>/dev/null || true
+      elif [[ "${POST_TO_API_DONE:-}" == "true" ]]; then
+        # Clean exit but no success was ever reported: the user backed out
+        # somewhere. Report as aborted so the record doesn't stay "installing".
+        post_update_to_api "aborted" "0" 2>/dev/null || true
      fi
    fi
-  fi

-  # Best-effort log collection on failure (non-critical, telemetry already sent)
-  if [[ $exit_code -ne 0 ]] && declare -f ensure_log_on_host >/dev/null 2>&1; then
-    ensure_log_on_host 2>/dev/null || true
-  fi
+    # Best-effort log collection on failure
+    if [[ $exit_code -ne 0 ]] && declare -f ensure_log_on_host >/dev/null 2>&1; then
+      ensure_log_on_host 2>/dev/null || true
+    fi

-  # Stop orphaned container if we're in the install phase and exiting with error
-  if [[ $exit_code -ne 0 ]]; then
-    _stop_container_if_installing
+    # Stop orphaned container if we're in the install phase
+    if [[ $exit_code -ne 0 ]]; then
+      _stop_container_if_installing
+    fi
  fi

  [[ -n "${lockfile:-}" && -e "$lockfile" ]] && rm -f "$lockfile"
@@ -650,21 +627,19 @@ on_exit() {
 }

 # ------------------------------------------------------------------------------
-# on_interrupt()
-#
-# - SIGINT (Ctrl+C) trap handler
-# - Reports status FIRST (time-critical: container may be dying)
-# - Stops orphaned container to prevent "configuring" ghost records
-# - Exits with code 130 (128 + SIGINT=2)
+# on_interrupt() - SIGINT (Ctrl+C)
 # ------------------------------------------------------------------------------
 on_interrupt() {
-  # Stop spinner and restore cursor before any output
  if declare -f stop_spinner >/dev/null 2>&1; then
    stop_spinner 2>/dev/null || true
  fi
  printf "\e[?25h" 2>/dev/null || true

-  _send_abort_telemetry "130"
+  if _is_container_context; then
+    _container_write_failure "130"
+  elif declare -f post_update_to_api &>/dev/null; then
+    post_update_to_api "aborted" "130" 2>/dev/null || true
+  fi
  _stop_container_if_installing
  if declare -f msg_error >/dev/null 2>&1; then
    msg_error "Interrupted by user (SIGINT)" 2>/dev/null || true
@@ -675,21 +650,19 @@ on_interrupt() {
 }

 # ------------------------------------------------------------------------------
-# on_terminate()
-#
-# - SIGTERM trap handler
-# - Reports status FIRST (time-critical: process being killed)
-# - Stops orphaned container to prevent "configuring" ghost records
-# - Exits with code 143 (128 + SIGTERM=15)
+# on_terminate() - SIGTERM
 # ------------------------------------------------------------------------------
 on_terminate() {
-  # Stop spinner and restore cursor before any output
  if declare -f stop_spinner >/dev/null 2>&1; then
    stop_spinner 2>/dev/null || true
  fi
  printf "\e[?25h" 2>/dev/null || true

-  _send_abort_telemetry "143"
+  if _is_container_context; then
+    _container_write_failure "143"
+  elif declare -f post_update_to_api &>/dev/null; then
+    post_update_to_api "aborted" "143" 2>/dev/null || true
+  fi
  _stop_container_if_installing
  if declare -f msg_error >/dev/null 2>&1; then
    msg_error "Terminated by signal (SIGTERM)" 2>/dev/null || true
@@ -700,45 +673,32 @@ on_terminate() {
 }

 # ------------------------------------------------------------------------------
-# on_hangup()
-#
-# - SIGHUP trap handler (SSH disconnect, terminal closed)
-# - CRITICAL: This was previously MISSING from catch_errors(), causing
-#   container processes to become orphans on SSH disconnect — the #1 cause
-#   of records stuck in "installing" and "configuring" states
-# - Reports status via direct curl (terminal is already closed, no output)
-# - Stops orphaned container to prevent ghost records
-# - Exits with code 129 (128 + SIGHUP=1)
+# on_hangup() - SIGHUP (SSH disconnect, terminal closed)
 # ------------------------------------------------------------------------------
 on_hangup() {
-  # Stop spinner (no cursor restore needed — terminal is already gone)
  if declare -f stop_spinner >/dev/null 2>&1; then
    stop_spinner 2>/dev/null || true
  fi

-  _send_abort_telemetry "129"
+  if _is_container_context; then
+    _container_write_failure "129"
+  elif declare -f post_update_to_api &>/dev/null; then
+    post_update_to_api "aborted" "129" 2>/dev/null || true
+  fi
  _stop_container_if_installing
  exit 129
 }

 # ==============================================================================
-# SECTION 5: INITIALIZATION
+# SECTION 6: INITIALIZATION
 # ==============================================================================

 # ------------------------------------------------------------------------------
 # catch_errors()
 #
 # - Initializes error handling and signal traps
-# - Enables strict error handling:
-#   * set -Ee: Exit on error, inherit ERR trap in functions
-#   * set -o pipefail: Pipeline fails if any command fails
-#   * set -u: (optional) Exit on undefined variable (if STRICT_UNSET=1)
-# - Sets up traps:
-#   * ERR  → error_handler (script errors)
-#   * EXIT → on_exit      (any termination — cleanup + orphan detection)
-#   * INT  → on_interrupt  (Ctrl+C)
-#   * TERM → on_terminate  (kill / systemd stop)
-#   * HUP  → on_hangup     (SSH disconnect / terminal closed)
+# - set -Ee -o pipefail (+ set -u when STRICT_UNSET=1)
+# - Traps: ERR → error_handler, EXIT → on_exit, INT/TERM/HUP → signal handlers
 # - Call this function early in every script
 # ------------------------------------------------------------------------------
 catch_errors() {
@@ -32,6 +32,11 @@ if ! command -v curl >/dev/null 2>&1; then
  apt update >/dev/null 2>&1
  apt install -y curl >/dev/null 2>&1
 fi
+# Mark container context BEFORE error handling starts: error_handler/on_exit
+# must write local failure artifacts instead of talking to the telemetry API
+# (the host is the single telemetry reporter).
+export TELEMETRY_CONTEXT="container"
+
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/core.func)
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/error_handler.func)
 load_functions
@@ -65,9 +70,12 @@ post_progress_to_api() {

  local progress_status="${1:-configuring}"

+  # Progress pings are the ONLY telemetry a container sends (terminal statuses
+  # are reported by the host). Include execution_id + platform + repo
+  # attribution (exported by the host) so the server can correlate and filter.
  curl -fsS -m 5 -X POST "https://telemetry.community-scripts.org/telemetry" \
    -H "Content-Type: application/json" \
-    -d "{\"random_id\":\"${RANDOM_UUID}\",\"execution_id\":\"${EXECUTION_ID:-${RANDOM_UUID}}\",\"type\":\"lxc\",\"nsapp\":\"${app:-unknown}\",\"status\":\"${progress_status}\"}" &>/dev/null || true
+    -d "{\"random_id\":\"${RANDOM_UUID}\",\"execution_id\":\"${EXECUTION_ID:-${RANDOM_UUID}}\",\"type\":\"lxc\",\"nsapp\":\"${app:-unknown}\",\"status\":\"${progress_status}\",\"platform\":\"${TELEMETRY_PLATFORM:-}\",\"repo_source\":\"${REPO_SOURCE:-}\",\"repo_slug\":\"${REPO_SLUG:-}\"}" &>/dev/null || true
 }

 # ==============================================================================
@@ -573,8 +573,10 @@ cleanup() {
      if [[ $exit_code -ne 0 ]]; then
        post_update_to_api "failed" "$exit_code"
      else
-        # Exited cleanly but description()/success was never called — shouldn't happen
-        post_update_to_api "failed" "1"
+        # Exited cleanly but description()/success was never called: the user
+        # backed out of a dialog. Report as aborted - NOT "failed 1" (which
+        # produced meaningless 'General error' records with no error text).
+        post_update_to_api "aborted" "0"
      fi
    fi
  fi
@@ -116,6 +116,9 @@ add() {
 # Add container IDs to exclude from updates (comma-separated):
 # EXCLUDE=100,101,102
 EXCLUDE=
+
+# Healthchecks.io Ping URL (optional)
+# PING_URL=
 CONF
    ok "Created config ${CONF_FILE}"
  fi
@@ -235,9 +238,11 @@ view_cron_config() {
  fi
  if [[ -f "$CONF_FILE" ]]; then
    echo -e " \e[36mConfig file:\e[0m ${CONF_FILE}"
-    local excludes
+    local excludes ping_url
    excludes=$(grep -oP '^\s*EXCLUDE\s*=\s*\K.*' "$CONF_FILE" 2>/dev/null || true)
+    ping_url=$(grep -oP '^\s*PING_URL\s*=\s*\K.*' "$CONF_FILE" 2>/dev/null | tr -d '"' | tr -d "'" || true)
    echo -e " \e[36mExcluded:\e[0m    ${excludes:-(none)}"
+    echo -e " \e[36mPing URL:\e[0m    ${ping_url:-(none)}"
    echo ""
    echo -e " \e[90m--- ${CONF_FILE} ---\e[0m"
    cat "$CONF_FILE"
@@ -284,9 +289,11 @@ show_status() {
  fi

  if [[ -f "$CONF_FILE" ]]; then
-    local excludes
+    local excludes ping_url
    excludes=$(grep -oP '^\s*EXCLUDE\s*=\s*\K.*' "$CONF_FILE" 2>/dev/null || echo "(none)")
+    ping_url=$(grep -oP '^\s*PING_URL\s*=\s*\K.*' "$CONF_FILE" 2>/dev/null | tr -d '"' | tr -d "'" || echo "(none)")
    echo -e "   \e[36mExcluded:\e[0m  ${excludes:-"(none)"}"
+    echo -e "   \e[36mPing URL:\e[0m  ${ping_url:-"(none)"}"
  fi

  if [[ -f "$LOG_FILE" ]]; then
@@ -1,693 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/refs/heads/main/misc/core.func)
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/api.func) 2>/dev/null || true
-load_functions
-declare -f init_tool_telemetry &>/dev/null && init_tool_telemetry "storage-share-helper" "pve"
-
-set -eEuo pipefail
-
-function header_info() {
-  clear
-  cat <<"EOF"
-    _____ __                                 ___    _________ 
-   / ___// /_____  _________ _____ ____     /   |  /  _/ __ \
-   \__ \/ __/ __ \/ ___/ __ `/ __ `/ _ \   / /| |  / // / / /
-  ___/ / /_/ /_/ / /  / /_/ / /_/ /  __/  / ___ |_/ // /_/ / 
- /____/\__/\____/_/   \__,_/\__, /\___/  /_/  |_/___/_____/  
-                            /____/                            
-
- Proxmox Storage Allrounder
- SMB | NFS | iSCSI | LVM-on-iSCSI | LXC Mountpoints | Host Shares
-EOF
-}
-
-pause() {
-  read -r -p "Press Enter to continue..." _
-}
-
-require_pve() {
-  if ! command -v pct >/dev/null 2>&1 || ! command -v pvesm >/dev/null 2>&1; then
-    msg_error "This script must run on a Proxmox VE host (pct/pvesm missing)."
-    exit 1
-  fi
-}
-
-ensure_packages() {
-  local packages=()
-
-  command -v whiptail >/dev/null 2>&1 || packages+=("whiptail")
-  command -v mount.cifs >/dev/null 2>&1 || packages+=("cifs-utils")
-  command -v showmount >/dev/null 2>&1 || packages+=("nfs-common")
-  command -v iscsiadm >/dev/null 2>&1 || packages+=("open-iscsi")
-
-  if [[ ${#packages[@]} -gt 0 ]]; then
-    msg_info "Installing required packages: ${packages[*]}"
-    apt update >/dev/null 2>&1
-    apt install -y "${packages[@]}" >/dev/null 2>&1
-    msg_ok "Dependencies installed"
-  fi
-}
-
-confirm_start() {
-  whiptail --backtitle "Proxmox VE Helper Scripts" --title "Storage Share Allrounder" \
-    --yesno "This AIO wizard can test and configure SMB/NFS/iSCSI, create/remove Proxmox storages, manage LXC mountpoints and optionally create host shares. Proceed?" 13 100
-}
-
-read_input() {
-  local title="$1"
-  local prompt="$2"
-  local default_value="${3:-}"
-
-  whiptail --backtitle "Proxmox VE Helper Scripts" --title "$title" \
-    --inputbox "$prompt" 11 100 "$default_value" 3>&1 1>&2 2>&3
-}
-
-read_password() {
-  local title="$1"
-  local prompt="$2"
-
-  whiptail --backtitle "Proxmox VE Helper Scripts" --title "$title" \
-    --passwordbox "$prompt" 11 100 3>&1 1>&2 2>&3
-}
-
-confirm_yes_no() {
-  local title="$1"
-  local prompt="$2"
-  local height="${3:-11}"
-  local width="${4:-100}"
-
-  whiptail --backtitle "Proxmox VE Helper Scripts" --title "$title" \
-    --yesno "$prompt" "$height" "$width"
-}
-
-# Destructive confirmation: defaults to "No" so a stray Enter never removes anything.
-confirm_danger() {
-  local title="$1"
-  local prompt="$2"
-  local height="${3:-15}"
-  local width="${4:-100}"
-
-  whiptail --backtitle "Proxmox VE Helper Scripts" --title "$title" \
-    --defaultno --yesno "$prompt" "$height" "$width"
-}
-
-# Shown before slow data gathering. Goes to stderr: inside $(...) captures, stdout is
-# swallowed — stderr is the real terminal.
-show_loading() {
-  echo -e "${YW}Loading... gathering data, this can take a moment (CTRL+C to abort)${CL}" >&2
-}
-
-# Info popup that stays visible inside $(...) captures: whiptail draws its UI on
-# stdout, so without 1>&2 the dialog would be captured and the script appears hung.
-notice_box() {
-  local title="$1"
-  local text="$2"
-  whiptail --backtitle "Proxmox VE Helper Scripts" --title "$title" \
-    --msgbox "$text" 10 80 1>&2
-}
-
-# Interactive container picker (read-only): returns the chosen CTID on stdout.
-pick_container() {
-  local title="$1"
-  local -a rows=()
-  local ctid status name label
-
-  show_loading
-  while IFS=$'\t' read -r ctid status name; do
-    [[ -z "$ctid" ]] && continue
-    label=$(printf '%-58s' "${name:-<no-name>} [${status}]")
-    rows+=("$ctid" "$label")
-  done < <(pct list 2>/dev/null | awk 'NR>1 {print $1"\t"$2"\t"$NF}')
-
-  if [[ ${#rows[@]} -eq 0 ]]; then
-    notice_box "$title" "No LXC containers found on this host."
-    return 1
-  fi
-
-  whiptail --backtitle "Proxmox VE Helper Scripts" --title "$title" \
-    --menu "Select a container:" 24 80 16 "${rows[@]}" 3>&1 1>&2 2>&3
-}
-
-# Interactive multi-select picker over ALL mountpoints across ALL containers (read-only).
-# Returns chosen entries as "<ctid>:<mpX>" tokens on stdout.
-# Reads /etc/pve/lxc/*.conf directly (one 'pct config' per CT is far too slow);
-# awk stops at the first '[section]' so snapshot mp entries are not listed.
-pick_all_mountpoints_multi() {
-  local title="$1"
-  local -a rows=()
-  local conf ctid name line key def label
-
-  show_loading
-  for conf in /etc/pve/lxc/*.conf; do
-    [[ -e "$conf" ]] || continue
-    ctid="$(basename "$conf" .conf)"
-    name=$(awk '/^\[/{exit} $1=="hostname:"{print $2; exit}' "$conf")
-    while IFS= read -r line; do
-      [[ -z "$line" ]] && continue
-      key="${line%%:*}"
-      def="${line#*: }"
-      label=$(printf '%-86s' "CT ${ctid} ${name:-<no-name>} | ${key}: ${def}")
-      rows+=("${ctid}:${key}" "$label" "OFF")
-    done < <(awk '/^\[/{exit} /^mp[0-9]+:/{print}' "$conf")
-  done
-
-  if [[ ${#rows[@]} -eq 0 ]]; then
-    notice_box "$title" "No LXC mountpoints found on any container."
-    return 1
-  fi
-
-  whiptail --backtitle "Proxmox VE Helper Scripts" --title "$title" \
-    --checklist "Select mountpoint(s) to remove across all containers (Space to toggle, Enter to confirm):" \
-    24 112 16 "${rows[@]}" 3>&1 1>&2 2>&3
-}
-
-# Interactive multi-select storage picker (read-only): returns chosen storage IDs on stdout.
-pick_storages_multi() {
-  local title="$1"
-  local -a rows=()
-  local stype sid label
-
-  show_loading
-  while read -r stype sid; do
-    [[ -z "$sid" ]] && continue
-    label=$(printf '%-58s' "[${stype}]")
-    rows+=("$sid" "$label" "OFF")
-  done < <(awk -F': ' '/^[a-z]+: /{print $1, $2}' /etc/pve/storage.cfg 2>/dev/null)
-
-  if [[ ${#rows[@]} -eq 0 ]]; then
-    notice_box "$title" "No storages found in /etc/pve/storage.cfg."
-    return 1
-  fi
-
-  whiptail --backtitle "Proxmox VE Helper Scripts" --title "$title" \
-    --checklist "Select storage(s) to remove (Space to toggle, Enter to confirm):" \
-    24 80 16 "${rows[@]}" 3>&1 1>&2 2>&3
-}
-
-# Interactive multi-select container picker (read-only): returns chosen CTIDs on stdout.
-pick_containers_multi() {
-  local title="$1"
-  local -a rows=()
-  local ctid status name label
-
-  show_loading
-  while IFS=$'\t' read -r ctid status name; do
-    [[ -z "$ctid" ]] && continue
-    label=$(printf '%-58s' "${name:-<no-name>} [${status}]")
-    rows+=("$ctid" "$label" "OFF")
-  done < <(pct list 2>/dev/null | awk 'NR>1 {print $1"\t"$2"\t"$NF}')
-
-  if [[ ${#rows[@]} -eq 0 ]]; then
-    notice_box "$title" "No LXC containers found on this host."
-    return 1
-  fi
-
-  whiptail --backtitle "Proxmox VE Helper Scripts" --title "$title" \
-    --checklist "Select one or more containers (Space to toggle, Enter to confirm):" \
-    24 80 16 "${rows[@]}" 3>&1 1>&2 2>&3
-}
-
-manual_smb_test() {
-  header_info
-  local server share username password domain vers mount_dir mount_opts
-
-  server=$(read_input "SMB Test" "SMB server/IP (e.g. 10.0.1.9)") || return
-  share=$(read_input "SMB Test" "Share name (without leading //)" "Proxmox") || return
-  username=$(read_input "SMB Test" "Username" "proxmox") || return
-  password=$(read_password "SMB Test" "Password for ${username}") || return
-  domain=$(read_input "SMB Test" "Domain/Workgroup (optional, leave empty if not needed)") || return
-  vers=$(read_input "SMB Test" "SMB version (e.g. 3.0, 3.1.1)" "3.1.1") || return
-  mount_dir="/mnt/test-smb"
-
-  mkdir -p "$mount_dir"
-
-  mount_opts="username=${username},password=${password},vers=${vers},sec=ntlmssp"
-  if [[ -n "$domain" ]]; then
-    mount_opts+=";domain=${domain}"
-  fi
-
-  msg_info "Testing SMB mount on ${mount_dir}"
-  if mount -t cifs "//${server}/${share}" "$mount_dir" -o "${mount_opts//;/,}" >/dev/null 2>&1; then
-    touch "${mount_dir}/smb-test-$(date +%s)" >/dev/null 2>&1 || true
-    umount "$mount_dir" >/dev/null 2>&1 || true
-    msg_ok "SMB test successful"
-  else
-    msg_error "SMB test failed. Check network/firewall/credentials/share permissions."
-  fi
-
-  pause
-}
-
-manual_nfs_test() {
-  header_info
-  local server export_path mount_dir
-
-  server=$(read_input "NFS Test" "NFS server/IP (e.g. 10.0.6.159)") || return
-  export_path=$(read_input "NFS Test" "NFS export path (e.g. /srv/proxmox-nfs)") || return
-  mount_dir="/mnt/test-nfs"
-
-  mkdir -p "$mount_dir"
-
-  msg_info "Testing NFS mount on ${mount_dir}"
-  if mount -t nfs "${server}:${export_path}" "$mount_dir" >/dev/null 2>&1; then
-    touch "${mount_dir}/nfs-test-$(date +%s)" >/dev/null 2>&1 || true
-    umount "$mount_dir" >/dev/null 2>&1 || true
-    msg_ok "NFS test successful"
-  else
-    msg_error "NFS test failed. Check export/firewall/network permissions."
-  fi
-
-  pause
-}
-
-manual_iscsi_discovery() {
-  header_info
-  local portal
-
-  portal=$(read_input "iSCSI Discovery" "iSCSI portal IP/FQDN (e.g. 10.0.1.20)") || return
-  msg_info "Running iSCSI target discovery on ${portal}"
-  if iscsiadm -m discovery -t sendtargets -p "$portal"; then
-    msg_ok "iSCSI discovery completed"
-  else
-    msg_error "iSCSI discovery failed"
-  fi
-
-  pause
-}
-
-add_smb_storage() {
-  header_info
-  local storage_id server share username password content nodes options
-
-  storage_id=$(read_input "Add SMB/CIFS Storage" "Storage ID (unique, e.g. smb-media)") || return
-  server=$(read_input "Add SMB/CIFS Storage" "SMB server/IP") || return
-  share=$(read_input "Add SMB/CIFS Storage" "Share name (without //)") || return
-  username=$(read_input "Add SMB/CIFS Storage" "Username") || return
-  password=$(read_password "Add SMB/CIFS Storage" "Password for ${username}") || return
-  content=$(read_input "Add SMB/CIFS Storage" "Content types (comma separated)" "backup,iso,vztmpl,snippets") || return
-  nodes=$(read_input "Add SMB/CIFS Storage" "Nodes (optional, comma separated)") || return
-  options=$(read_input "Add SMB/CIFS Storage" "Mount options (optional, e.g. vers=3.1.1,domain=WORKGROUP)") || return
-
-  local cmd=(pvesm add cifs "$storage_id" --server "$server" --share "$share" --username "$username" --password "$password" --content "$content")
-  [[ -n "$nodes" ]] && cmd+=(--nodes "$nodes")
-  [[ -n "$options" ]] && cmd+=(--options "$options")
-
-  if "${cmd[@]}" >/dev/null 2>&1; then
-    msg_ok "SMB storage '${storage_id}' added"
-  else
-    msg_error "Failed to add SMB storage '${storage_id}'"
-  fi
-
-  pause
-}
-
-add_nfs_storage() {
-  header_info
-  local storage_id server export_path content nodes options
-
-  storage_id=$(read_input "Add NFS Storage" "Storage ID (unique, e.g. nfs-vmdata)") || return
-  server=$(read_input "Add NFS Storage" "NFS server/IP") || return
-  export_path=$(read_input "Add NFS Storage" "Export path") || return
-  content=$(read_input "Add NFS Storage" "Content types (comma separated)" "images,rootdir") || return
-  nodes=$(read_input "Add NFS Storage" "Nodes (optional, comma separated)") || return
-  options=$(read_input "Add NFS Storage" "Mount options (optional)") || return
-
-  local cmd=(pvesm add nfs "$storage_id" --server "$server" --export "$export_path" --content "$content")
-  [[ -n "$nodes" ]] && cmd+=(--nodes "$nodes")
-  [[ -n "$options" ]] && cmd+=(--options "$options")
-
-  if "${cmd[@]}" >/dev/null 2>&1; then
-    msg_ok "NFS storage '${storage_id}' added"
-  else
-    msg_error "Failed to add NFS storage '${storage_id}'"
-  fi
-
-  pause
-}
-
-add_iscsi_storage() {
-  header_info
-  local storage_id portal target nodes
-
-  storage_id=$(read_input "Add iSCSI Storage" "Storage ID (unique, e.g. iscsi-synology)") || return
-  portal=$(read_input "Add iSCSI Storage" "Portal IP/FQDN") || return
-  target=$(read_input "Add iSCSI Storage" "Target IQN (e.g. iqn.2000-01.com.synology:...)") || return
-  nodes=$(read_input "Add iSCSI Storage" "Nodes (optional, comma separated)") || return
-
-  local cmd=(pvesm add iscsi "$storage_id" --portal "$portal" --target "$target")
-  [[ -n "$nodes" ]] && cmd+=(--nodes "$nodes")
-
-  if "${cmd[@]}" >/dev/null 2>&1; then
-    msg_ok "iSCSI storage '${storage_id}' added"
-  else
-    msg_error "Failed to add iSCSI storage '${storage_id}'"
-  fi
-
-  pause
-}
-
-add_lvm_on_base_storage() {
-  header_info
-  local storage_id base_storage vgname content shared
-
-  storage_id=$(read_input "Add LVM Storage" "LVM Storage ID (unique, e.g. lvm-iscsi01)") || return
-  base_storage=$(read_input "Add LVM Storage" "Base storage ID (usually iSCSI storage ID)") || return
-  vgname=$(read_input "Add LVM Storage" "Volume Group name on target") || return
-  content=$(read_input "Add LVM Storage" "Content types (comma separated)" "images,rootdir") || return
-  shared=$(read_input "Add LVM Storage" "Shared across nodes? 1=yes, 0=no" "1") || return
-
-  local cmd=(pvesm add lvm "$storage_id" --base "$base_storage" --vgname "$vgname" --content "$content" --shared "$shared")
-  if "${cmd[@]}" >/dev/null 2>&1; then
-    msg_ok "LVM storage '${storage_id}' added"
-  else
-    msg_error "Failed to add LVM storage '${storage_id}'"
-  fi
-
-  pause
-}
-
-remove_storage() {
-  header_info
-  local selection storage_id
-  local -a results=()
-
-  selection=$(pick_storages_multi "Remove Storage") || return
-  if [[ -z "$selection" ]]; then
-    msg_warn "No storage selected."
-    pause
-    return
-  fi
-
-  # Confirm each selected storage separately (defaults to No).
-  for storage_id in $selection; do
-    storage_id="${storage_id//\"/}"
-    [[ -z "$storage_id" ]] && continue
-
-    if confirm_danger "Remove Storage" \
-      "Really remove storage '${storage_id}' from the Proxmox config?
-
-This removes the storage definition only.
-Data on the underlying share/target is NOT deleted."; then
-      if pvesm remove "$storage_id" >/dev/null 2>&1; then
-        results+=("removed  ${storage_id}")
-      else
-        results+=("FAILED   ${storage_id}")
-      fi
-    else
-      results+=("skipped  ${storage_id}")
-    fi
-  done
-
-  header_info
-  echo -e "${BL}Remove storage — result${CL}\n"
-  printf '  %s\n' "${results[@]}"
-  echo
-  pause
-}
-
-find_next_mp_slot() {
-  local ctid="$1"
-  local used
-
-  used=$(pct config "$ctid" | awk -F: '/^mp[0-9]+:/ {gsub("mp", "", $1); print $1}')
-  for i in $(seq 0 255); do
-    if ! grep -qx "$i" <<<"$used"; then
-      echo "$i"
-      return
-    fi
-  done
-
-  echo ""
-}
-
-add_lxc_mountpoint() {
-  header_info
-  local ctid host_path ct_path mp_slot
-
-  ctid=$(pick_container "LXC: add mountpoint") || return
-  host_path=$(read_input "LXC Mountpoint" "Host path (must exist, e.g. /mnt/pve/smb-media)") || return
-  ct_path=$(read_input "LXC Mountpoint" "Container path (e.g. /mnt/media)") || return
-
-  if [[ ! -d "$host_path" ]]; then
-    msg_error "Host path does not exist: ${host_path}"
-    pause
-    return
-  fi
-
-  mp_slot=$(find_next_mp_slot "$ctid")
-  if [[ -z "$mp_slot" ]]; then
-    msg_error "No free mp slot available for container ${ctid}"
-    pause
-    return
-  fi
-
-  confirm_yes_no "LXC: add mountpoint" \
-    "Add mp${mp_slot} to CT ${ctid}?
-
-  ${host_path}  ->  ${ct_path}" 13 100 || return
-
-  if pct set "$ctid" -mp"$mp_slot" "$host_path",mp="$ct_path" >/dev/null 2>&1; then
-    msg_ok "Added mp${mp_slot}: ${host_path} -> ${ct_path} on CT ${ctid}"
-    msg_warn "If CT is unprivileged, ensure UID/GID mapping and filesystem permissions fit your workload."
-  else
-    msg_error "Failed to add mountpoint to CT ${ctid}"
-  fi
-
-  pause
-}
-
-remove_lxc_mountpoint() {
-  header_info
-  local selection entry ctid mp_key mp_def
-  local -a results=()
-
-  selection=$(pick_all_mountpoints_multi "LXC: remove mountpoint") || return
-  if [[ -z "$selection" ]]; then
-    msg_warn "No mountpoint selected."
-    pause
-    return
-  fi
-
-  # Confirm each selected mountpoint separately (defaults to No).
-  for entry in $selection; do
-    entry="${entry//\"/}"
-    [[ -z "$entry" ]] && continue
-    ctid="${entry%%:*}"
-    mp_key="${entry#*:}"
-    mp_def=$(pct config "$ctid" | awk -F': ' -v k="$mp_key" '$1==k{print $2}')
-
-    if confirm_danger "LXC: remove mountpoint" \
-      "Remove ${mp_key} from CT ${ctid}?
-
-  ${mp_key}: ${mp_def}
-
-This only detaches the mountpoint from the container.
-Data on the host is NOT deleted."; then
-      if pct set "$ctid" -delete "$mp_key" >/dev/null 2>&1; then
-        results+=("removed  CT ${ctid}  ${mp_key}")
-      else
-        results+=("FAILED   CT ${ctid}  ${mp_key}")
-      fi
-    else
-      results+=("skipped  CT ${ctid}  ${mp_key}")
-    fi
-  done
-
-  header_info
-  echo -e "${BL}Remove mountpoint — result${CL}\n"
-  printf '  %s\n' "${results[@]}"
-  echo
-  pause
-}
-
-list_lxc_mountpoints() {
-  header_info
-  local selection ctid mps
-
-  selection=$(pick_containers_multi "LXC: list mountpoints") || return
-  if [[ -z "$selection" ]]; then
-    msg_warn "No container selected."
-    pause
-    return
-  fi
-
-  for ctid in $selection; do
-    ctid="${ctid//\"/}"
-    [[ -z "$ctid" ]] && continue
-    echo -e "${BL}Mountpoints for CT ${ctid}${CL}"
-    mps=$(pct config "$ctid" | awk '/^mp[0-9]+:/{print}')
-    if [[ -n "$mps" ]]; then
-      echo "$mps"
-    else
-      echo "  (no mountpoints configured)"
-    fi
-    echo
-  done
-
-  pause
-}
-
-host_create_samba_share() {
-  header_info
-  local share_name share_path user_name user_pass
-
-  share_name=$(read_input "Host Samba Share" "Share name (e.g. data)") || return
-  share_path=$(read_input "Host Samba Share" "Share path on host (e.g. /srv/samba/data)" "/srv/samba/${share_name}") || return
-  user_name=$(read_input "Host Samba Share" "Linux/Samba username") || return
-  user_pass=$(read_password "Host Samba Share" "Password for ${user_name}") || return
-
-  msg_info "Installing Samba on host if needed"
-  apt update >/dev/null 2>&1
-  apt install -y samba >/dev/null 2>&1
-
-  mkdir -p "$share_path"
-  getent group sambashare >/dev/null 2>&1 || groupadd sambashare
-  id "$user_name" >/dev/null 2>&1 || useradd -M -s /usr/sbin/nologin -G sambashare "$user_name"
-  usermod -aG sambashare "$user_name"
-  chown -R root:sambashare "$share_path"
-  chmod 2775 "$share_path"
-
-  if ! (
-    echo "$user_pass"
-    echo "$user_pass"
-  ) | smbpasswd -s -a "$user_name" >/dev/null 2>&1; then
-    msg_error "Failed to set Samba password for ${user_name}"
-    pause
-    return
-  fi
-
-  if ! grep -q "^\[${share_name}\]" /etc/samba/smb.conf; then
-    cat <<EOF >>/etc/samba/smb.conf
-
-[${share_name}]
-   comment = Proxmox Host Share (${share_name})
-   path = ${share_path}
-   browseable = yes
-   read only = no
-   guest ok = no
-   create mask = 0664
-   directory mask = 2775
-   valid users = @sambashare
-EOF
-  fi
-
-  testparm -s >/dev/null 2>&1 || {
-    msg_error "Samba config validation failed (testparm). Check /etc/samba/smb.conf"
-    pause
-    return
-  }
-
-  systemctl enable --now smbd nmbd >/dev/null 2>&1
-  systemctl restart smbd nmbd >/dev/null 2>&1
-
-  msg_ok "Host SMB share created: //$(hostname -I | awk '{print $1}')/${share_name}"
-  msg_warn "Best practice: prefer running Samba in a dedicated LXC/VM for cleaner host separation."
-
-  pause
-}
-
-host_create_nfs_export() {
-  header_info
-  local export_path subnet options
-
-  export_path=$(read_input "Host NFS Export" "Export path on host (e.g. /srv/proxmox-nfs)" "/srv/proxmox-nfs") || return
-  subnet=$(read_input "Host NFS Export" "Allowed subnet/CIDR (e.g. 10.0.0.0/16)") || return
-  options=$(read_input "Host NFS Export" "Export options" "rw,sync,no_subtree_check,no_root_squash") || return
-
-  msg_info "Installing NFS server on host if needed"
-  apt update >/dev/null 2>&1
-  apt install -y nfs-kernel-server >/dev/null 2>&1
-
-  mkdir -p "$export_path"
-  chmod 0770 "$export_path"
-
-  if ! grep -qE "^${export_path//\//\/}[[:space:]]+${subnet//\//\/}\(" /etc/exports; then
-    echo "${export_path} ${subnet}(${options})" >>/etc/exports
-  fi
-
-  exportfs -ra >/dev/null 2>&1
-  systemctl enable --now nfs-kernel-server >/dev/null 2>&1
-
-  msg_ok "Host NFS export created: ${export_path} ${subnet}(${options})"
-  msg_warn "Best practice: use host exports carefully; dedicated storage VM/LXC is often cleaner."
-  pause
-}
-
-show_status() {
-  header_info
-  echo -e "${BL}pvesm status${CL}"
-  pvesm status || true
-  echo
-  echo -e "${BL}Mounted /mnt/pve paths${CL}"
-  mount | grep /mnt/pve || true
-  echo
-  echo -e "${BL}Mounted CIFS/NFS/iSCSI related paths${CL}"
-  mount | grep -E ' type (cifs|nfs|nfs4)' || true
-  echo
-  echo -e "${BL}iSCSI sessions${CL}"
-  iscsiadm -m session 2>/dev/null || true
-  echo
-  pause
-}
-
-main_menu() {
-  while true; do
-    local choice
-    choice=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "Storage Share Allrounder" \
-      --menu "Select action  (read-only actions are safe; write/remove actions ask for confirmation):" 30 116 22 \
-      " " "──────────  READ-ONLY (safe, no changes)  ──────────" \
-      "1" "Test   | SMB: manual mount test" \
-      "2" "Test   | NFS: manual mount test" \
-      "3" "Test   | iSCSI: discovery test" \
-      "4" "Read   | LXC: list mountpoints" \
-      "5" "Read   | Show storage/mount/iSCSI status" \
-      "  " "──────────  WRITE (modifies config / host)  ──────────" \
-      "6" "Write  | Proxmox: add SMB/CIFS storage" \
-      "7" "Write  | Proxmox: add NFS storage" \
-      "8" "Write  | Proxmox: add iSCSI storage" \
-      "9" "Write  | Proxmox: add LVM on base storage (e.g. iSCSI)" \
-      "10" "Write  | LXC: add bind mountpoint (pct set -mpX)" \
-      "11" "Write  | Host: install Samba + create SMB share" \
-      "12" "Write  | Host: install NFS server + create export" \
-      "   " "──────────  REMOVE (destructive, defaults to No)  ──────────" \
-      "13" "Remove | Proxmox: remove storage definition" \
-      "14" "Remove | LXC: remove mountpoint (pct set -delete mpX)" \
-      "0" "Exit" 3>&1 1>&2 2>&3) || break
-
-    # '|| true' so a cancelled sub-dialog (whiptail returns non-zero) returns to the
-    # menu instead of tripping 'set -e' and exiting the whole script.
-    case "$choice" in
-    1) manual_smb_test || true ;;
-    2) manual_nfs_test || true ;;
-    3) manual_iscsi_discovery || true ;;
-    4) list_lxc_mountpoints || true ;;
-    5) show_status || true ;;
-    6) add_smb_storage || true ;;
-    7) add_nfs_storage || true ;;
-    8) add_iscsi_storage || true ;;
-    9) add_lvm_on_base_storage || true ;;
-    10) add_lxc_mountpoint || true ;;
-    11) host_create_samba_share || true ;;
-    12) host_create_nfs_export || true ;;
-    13) remove_storage || true ;;
-    14) remove_lxc_mountpoint || true ;;
-    0) break ;;
-    *) ;;
-    esac
-  done
-}
-
-header_info
-root_check
-pve_check
-require_pve
-ensure_packages
-confirm_start || exit 0
-main_menu
-
-header_info
-msg_ok "Finished."
@@ -11,14 +11,15 @@
 export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

 CONF_FILE="/etc/update-lxcs.conf"
-
-echo -e "\n $(date)"
+LOG_FILE="/var/log/update-lxcs-cron.log"
+PING_URL=""

 # Collect excluded containers from arguments
 excluded_containers=("$@")

-# Merge exclusions from config file if it exists
+# Merge exclusions and healthchecks URL from config file if it exists
 if [[ -f "$CONF_FILE" ]]; then
+  PING_URL=$(grep -oP '^\s*PING_URL\s*=\s*\K.+' "$CONF_FILE" 2>/dev/null | tr -d '"' | tr -d "'" || true)
  conf_exclude=$(grep -oP '^\s*EXCLUDE\s*=\s*\K[0-9,]+' "$CONF_FILE" 2>/dev/null || true)
  IFS=',' read -ra conf_ids <<<"$conf_exclude"
  for id in "${conf_ids[@]}"; do
@@ -27,6 +28,17 @@ if [[ -f "$CONF_FILE" ]]; then
  done
 fi

+# Overwrite logfile on each run when healthchecks is used
+if [[ -n "$PING_URL" ]]; then
+  true > "$LOG_FILE"
+fi
+
+if [[ -n "$PING_URL" ]]; then
+  curl -fsS -m 10 --retry 5 "${PING_URL}/start" -o /dev/null 2>/dev/null || true
+fi
+
+echo -e "\n $(date)"
+
 function update_container() {
  local container=$1
  local name
@@ -38,12 +50,36 @@ function update_container() {
  alpine) pct exec "$container" -- ash -c "apk -U upgrade" ;;
  archlinux) pct exec "$container" -- bash -c "pacman -Syyu --noconfirm" ;;
  fedora | rocky | centos | alma) pct exec "$container" -- bash -c "dnf -y update && dnf -y upgrade" ;;
-  ubuntu | debian | devuan) pct exec "$container" -- bash -c "apt-get update && DEBIAN_FRONTEND=noninteractive apt-get -o Dpkg::Options::='--force-confold' dist-upgrade -y; rm -rf /usr/lib/python3.*/EXTERNALLY-MANAGED" ;;
+  ubuntu | debian | devuan) pct exec "$container" -- bash -c "apt-get update; DEBIAN_FRONTEND=noninteractive apt-get -o Dpkg::Options::='--force-confold' dist-upgrade -y; status=\$?; rm -rf /usr/lib/python3.*/EXTERNALLY-MANAGED || true; exit \$status" ;;
  opensuse) pct exec "$container" -- bash -c "zypper ref && zypper --non-interactive dup" ;;
  *) echo " [Warn] Unknown OS type '$os' for container $container, skipping" ;;
  esac
 }

+update_status=0
+
+# Define exit handler to send healthchecks.io status (with logfile on failure/success)
+function exit_handler() {
+  local exit_code=$?
+  if [[ -n "$PING_URL" ]]; then
+    sync
+    if [[ $exit_code -ne 0 || $update_status -ne 0 ]]; then
+      if [[ -f "$LOG_FILE" ]]; then
+        curl -fsS -m 10 --retry 5 --data-binary @"$LOG_FILE" "${PING_URL}/fail" -o /dev/null 2>/dev/null || true
+      else
+        curl -fsS -m 10 --retry 5 "${PING_URL}/fail" -o /dev/null 2>/dev/null || true
+      fi
+    else
+      if [[ -f "$LOG_FILE" ]]; then
+        curl -fsS -m 10 --retry 5 --data-binary @"$LOG_FILE" "$PING_URL" -o /dev/null 2>/dev/null || true
+      else
+        curl -fsS -m 10 --retry 5 "$PING_URL" -o /dev/null 2>/dev/null || true
+      fi
+    fi
+  fi
+}
+trap exit_handler EXIT
+
 for container in $(pct list | awk '{if(NR>1) print $1}'); do
  excluded=false
  for excluded_container in "${excluded_containers[@]}"; do
@@ -65,7 +101,7 @@ for container in $(pct list | awk '{if(NR>1) print $1}'); do
      echo -e "[Info] Starting $container"
      pct start "$container"
      sleep 5
-      update_container "$container" || echo " [Error] Update failed for $container"
+      update_container "$container" || { echo " [Error] Update failed for $container"; update_status=1; }
      # check if patchmon agent is present in container and run a report if found
      if pct exec "$container" -- [ -e "/usr/local/bin/patchmon-agent" ]; then
        echo -e "${BL}[Info]${GN} patchmon-agent found in ${BL} $container ${CL}, triggering report. \n"
@@ -74,7 +110,7 @@ for container in $(pct list | awk '{if(NR>1) print $1}'); do
      echo -e "[Info] Shutting down $container"
      pct shutdown "$container" --timeout 60 &
    elif [ "$status" == "status: running" ]; then
-      update_container "$container" || echo " [Error] Update failed for $container"
+      update_container "$container" || { echo " [Error] Update failed for $container"; update_status=1; }
      # check if patchmon agent is present in container and run a report if found
      if pct exec "$container" -- [ -e "/usr/local/bin/patchmon-agent" ]; then
        echo -e "${BL}[Info]${GN} patchmon-agent found in ${BL} $container ${CL}, triggering report. \n"
@@ -24,7 +24,7 @@ RANDOM_UUID="$(cat /proc/sys/kernel/random/uuid)"
 METHOD=""
 NSAPP="opnsense-vm"
 var_os="opnsense"
-var_version="26.1"
+var_version="26.7"
 #
 GEN_MAC=02:$(openssl rand -hex 5 | awk '{print toupper($0)}' | sed 's/\(..\)/\1:/g; s/.$//')
 GEN_MAC_LAN=02:$(openssl rand -hex 5 | awk '{print toupper($0)}' | sed 's/\(..\)/\1:/g; s/.$//')
@@ -814,7 +814,7 @@ if [ -n "$WAN_BRG" ]; then
  msg_ok "WAN interface added"
  sleep 5 # Brief pause after adding network interface
 fi
-send_line_to_vm "sh ./opnsense-bootstrap.sh.in -y -f -r 26.1"
+send_line_to_vm "sh ./opnsense-bootstrap.sh.in -y -f -r 26.7"
 msg_ok "OPNsense VM is being installed, do not close the terminal, or the installation will fail."
 #We need to wait for the OPNsense build proccess to finish, this takes a few minutes
 sleep 1000
Author	SHA1	Message	Date
community-scripts-pr-app[bot]	1cfddc4c9c	Update CHANGELOG.md (#15936 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-20 18:33:05 +00:00
CanbiZ (MickLesk)	6f04a9787f	core-refactor: single-reporter telemetry rewrite (#15933 ) Overhaul the telemetry system to enforce a single-reporter model where only the HOST sends terminal statuses (success/failed/aborted) to the API. Containers now write local artifact files (.failed flag + .errinfo) that the host picks up after lxc-attach returns, preventing the race condition where a metadata-less container payload would win over the full host payload. Key changes: - Add TELEMETRY_CONTEXT=container export in install.func/alpine-install.func to mark container context before error handling starts - Introduce _is_container_context() heuristic and _container_write_failure() artifact writer in error_handler.func - Refactor api.func: unified _tm_payload() builder (full metadata on every send), _tm_send() curl wrapper, _tm_enabled() gate, telemetry_collect_sysinfo() cached collector - Add structured .errinfo capture in silent() (core.func) using byte-offset to extract exactly the failing command's output - Pull .errinfo from container in build.func after lxc-attach for precise error traces - Add categorize_error(), telemetry_new_attempt(), detect_arm(), REPO_SLUG tracking - Signal exits (129/130/143) now report as 'aborted' instead of 'failed' - Remove post_update_to_api_extended() (superseded by unified _tm_payload) - Export REPO_SOURCE, REPO_SLUG, TELEMETRY_PLATFORM into container environment	2026-07-20 20:32:36 +02:00
community-scripts-pr-app[bot]	b889e8d05e	Update CHANGELOG.md (#15935 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-20 18:23:30 +00:00
MickLesk	bd834f690a	Fix CLEAN_INSTALL to wipe dotfiles too CLEAN_INSTALL now removes dotfiles (e.g. .env) along with other files, using `find -mindepth 1 -delete` instead of `rm -rf *`. Update scripts for affine, nametag, and postiz are updated to explicitly back up and restore .env (via create_backup/restore_backup or cp) BEFORE the build step that sources it, rather than relying on the wipe preserving dotfiles.	2026-07-20 20:23:05 +02:00
MickLesk	a5a0b90643	hotfix: preserve .env	2026-07-20 19:56:29 +02:00
community-scripts-pr-app[bot]	aa8352bfd5	Update CHANGELOG.md (#15932 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-20 15:57:41 +00:00
CanbiZ (MickLesk)	3b8f57672e	AFFiNE: Bump version to v0.27.2 (#15930 )	2026-07-20 17:57:16 +02:00
community-scripts-pr-app[bot]	9028029ea0	Update CHANGELOG.md (#15931 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-20 15:21:26 +00:00
Tobias	0d3ee851d0	fix: vikunja: asset selection (#15929 ) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-21 01:20:54 +10:00
community-scripts-pr-app[bot]	6408653564	Update CHANGELOG.md (#15928 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-20 12:39:57 +00:00
CanbiZ (MickLesk)	e925e29966	RomM: use backup helpers in update / clear folder (#15915 ) * RomM: use backup helpers in update / clear folder Replace manual .env backup/restore with create_backup and restore_backup helpers, and add CLEAN_INSTALL=1 flag to fetch_and_deploy_gh_release. * add screenscraper env * add rom_patcher * add ruffle and emulatorJS	2026-07-20 14:39:29 +02:00
MickLesk	8505d28429	Set explicit Elasticsearch paths Define `path.data` and `path.logs` in the Zammad install script's Elasticsearch config so the service uses the expected data and log directories when running in the single-node local setup.	2026-07-20 12:15:57 +02:00
community-scripts-pr-app[bot]	f15e9c320b	Update CHANGELOG.md (#15926 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-20 09:58:10 +00:00
CanbiZ (MickLesk)	5b4e526329	tools.func: add support for extracting 7z archives (#15919 )	2026-07-20 11:57:41 +02:00
community-scripts-pr-app[bot]	a61dc9c585	Update CHANGELOG.md (#15925 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-20 09:55:26 +00:00
CanbiZ (MickLesk)	f8cc69e244	Gotify: Migration to v3 (#15912 )	2026-07-20 11:55:01 +02:00
community-scripts-pr-app[bot]	1dba4eb2ee	Update CHANGELOG.md (#15924 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-20 09:54:29 +00:00
CanbiZ (MickLesk)	fa9377cd45	Zammad : bind Elasticsearch to 127.0.0.1 (#15909 )	2026-07-20 11:54:04 +02:00
community-scripts-pr-app[bot]	b6a8ca1a3a	Update CHANGELOG.md (#15923 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-20 09:53:51 +00:00
CanbiZ (MickLesk)	2c13cb6a38	Meilisearch : use dumpless Meilisearch upgrades (#15921 )	2026-07-20 11:53:27 +02:00
community-scripts-pr-app[bot]	beeb497519	Update CHANGELOG.md (#15922 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-20 09:46:56 +00:00
CanbiZ (MickLesk)	9ea82fa992	core: Improve GPU detection and mapping logic (#15918 ) Refactor GPU detection logic to map DRI nodes to their owning GPUs based on vendor IDs. Update messages for detected Intel and AMD GPUs.	2026-07-20 11:46:33 +02:00
community-scripts-pr-app[bot]	d6cd545e98	Update CHANGELOG.md (#15920 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-20 09:43:57 +00:00
CanbiZ (MickLesk)	31b7024997	Fix Omada package version extraction (#15908 ) Update both `ct/omada.sh` and `install/omada-install.sh` to parse the Omada version directly from the `_v..._linux` segment of the Debian filename. This removes the old dependency on a timestamp suffix format and ensures `.omada` gets a valid version when TP-Link package naming varies.	2026-07-20 11:43:34 +02:00
community-scripts-pr-app[bot]	a6a608614f	Update CHANGELOG.md (#15916 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-20 08:29:28 +00:00
Michel Roegl-Brunner	3042cd5cee	fix(wanderer): use PocketBase-relative plugin symlink in unprivileged LXC (#15911 ) The /data/plugins symlink fails in default unprivileged containers with Operation not permitted. Link plugins via /opt/wanderer/source/db/data/plugins instead so PluginDir() can discover them without root-level symlinks. Fixes #15799	2026-07-20 10:29:05 +02:00
community-scripts-pr-app[bot]	026fd25e7a	Update CHANGELOG.md (#15904 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-19 17:02:04 +00:00
TowyTowy	e1ce55b547	fix(build.func): expand glob in SSH key "Scan Folder/Glob" so it can find keys (#15873 ) Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: Sam Heinz <sam@samheinz.com>	2026-07-19 19:01:41 +02:00
community-scripts-pr-app[bot]	d81c9f3ed2	Update CHANGELOG.md (#15900 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-19 12:54:11 +00:00
CanbiZ (MickLesk)	b098501a37	tools.func: centralize deploy tail + trap-based tmpdir cleanup (#15872 ) * tools.func: replace rm -rf with find for safer directory cleanup * tools.func: replace rm -rf with find for safer directory cleanup * refactor(tools.func): centralize deploy tail + trap-based tmpdir cleanup Extract the duplicated post-download logic of the fetch_and_deploy_* helpers into two shared functions and switch per-branch cleanup to a single RETURN trap. - _deploy_source_tarball: shared source-tarball tail (6 call sites) - _deploy_unpacked_archive: shared prebuild-archive tail (3 call sites) - RETURN trap per function guarantees tmpdir/unpack_tmp cleanup on every return path, replacing ~40 manual `rm -rf "$tmpdir"` lines - CLEAN_INSTALL now lives in the helpers instead of 12 copies Behavior-preserving except: codeberg prebuild gains .txz support and uses helper return codes; from_url resets shopt on error paths. * Add _download_source_tarball with retry/validation Introduce `_download_source_tarball` helper that validates gzip integrity after download and retries up to 3 times. This guards against truncated-but-valid-HTTP responses from GitHub/GitLab/Codeberg on-the-fly archive generation. Replace ad-hoc curl/curl_download calls in fetch_and_deploy_* functions with the new helper. Also remove redundant tmpdir cleanup before early returns (tmpdir is cleaned up at function exit). * Fix Manyfold Ruby setup home initialization Create the `manyfold` service user before calling `setup_ruby` so `/home/manyfold` exists when rbenv profile snippets are written. Also harden `setup_ruby` by creating `$HOME` if missing, preventing profile-write failures for installers that pass a home directory before creating the user. * Update install/manyfold-install.sh --------- Co-authored-by: Sam Heinz <sam@samheinz.com>	2026-07-19 22:53:46 +10:00
community-scripts-pr-app[bot]	a1058256be	Update CHANGELOG.md (#15899 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-19 12:53:02 +00:00
tdn131	e425d9c02c	Update OPNsense from 26.1 to 26.7 (#15895 )	2026-07-19 22:52:42 +10:00
community-scripts-pr-app[bot]	0dbea508d3	Update CHANGELOG.md (#15898 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-19 12:03:22 +00:00
Sam Heinz	787e27a4ac	change trek repo to liketrek/TREK (#15893 )	2026-07-19 14:02:56 +02:00
community-scripts-pr-app[bot]	8f0083850e	Update CHANGELOG.md (#15896 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-19 11:21:43 +00:00
thieneret	8f9c4eb13b	update authentik to 2026.5.5 (#15855 )	2026-07-19 13:21:14 +02:00
community-scripts-pr-app[bot]	beacf9e43a	Update CHANGELOG.md (#15892 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-19 09:17:11 +00:00
Chris	b2898debce	[FIX] BookOrbit: add missing `restore_backup` during update (#15881 ) - Otherwise the `.env` file is not restored and the sed command fails	2026-07-19 19:16:44 +10:00
community-scripts-pr-app[bot]	8c7da1e036	Update CHANGELOG.md (#15887 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-19 07:42:15 +00:00
CanbiZ (MickLesk)	bbd5a3f522	Revert "add configurable host CA inheritance for LXC bootstrap (#15840 )" (#15886 ) This reverts commit `eb5a5b2cb7`.	2026-07-19 09:41:52 +02:00
community-scripts-pr-app[bot]	c07dc4a4c3	Update CHANGELOG.md (#15884 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-19 00:17:46 +00:00
community-scripts-pr-app[bot]	e7f6a6d4cd	Archive old changelog entries (#15883 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-19 00:17:24 +00:00
community-scripts-pr-app[bot]	3242b9a2d1	Update CHANGELOG.md (#15879 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-18 22:10:27 +00:00
CanbiZ (MickLesk)	38ed344e0a	tools.func: Safe Delete Directorys & Update PYTHON_VERSION with setup_uv (#15870 )	2026-07-19 00:10:06 +02:00
community-scripts-pr-app[bot]	658aad229a	Update CHANGELOG.md (#15878 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-18 21:21:41 +00:00
Michel Roegl-Brunner	eb5a5b2cb7	add configurable host CA inheritance for LXC bootstrap (#15840 ) Introduce host CA certificate propagation in the shared LXC build flow so containers can trust enterprise/private PKI roots during early package bootstrap. Add an advanced-install toggle with default auto behavior so unattended installs remain seamless while interactive users can explicitly opt out. Co-authored-by: Michel Roegl-Brunner <michel.roegl-brunner@example.com>	2026-07-18 23:21:19 +02:00
community-scripts-pr-app[bot]	09c85021fc	Update CHANGELOG.md (#15877 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-18 20:19:59 +00:00
Sir106	7f1b0ead93	[tools.update-lxcs] feat: optional reporting success/failures to heathchecks.io (or others) (#15701 ) * feat: add task monitoring option via e.g. healthchecks.io. To be configured via PING variable in config file. * attach logfile on failure to healthcheck.io message * fixed error status when updating lxc even if finished successful --------- Co-authored-by: Sir106 <sir106@id-e.de>	2026-07-18 22:19:31 +02:00