cleanup(tools.func): remove 22 unused functions (~546 lines dead code)

Removed functions with 0 external callers:
- get_default_php_version, get_default_python_version, get_default_nodejs_version
- is_apt_locked, wait_for_apt
- start_timer, end_timer (was also buggy - silent)
- verify_gpg_fingerprint
- hold_package_version, unhold_package_version
- get_parallel_jobs
- enable_and_start_service, is_service_enabled, is_service_running
- should_upgrade
- verify_package_source, is_lts_version
- download_with_progress
- curl_api_with_retry
- get_cached_version (write-only cache - never read)
- setup_local_ip_helper
- get_latest_gitlab_release

CHANGELOG.md

@@ -499,19 +499,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
-## 2026-07-10
-
-### 🆕 New Scripts
-
-  - Squid ([#15605](https://github.com/community-scripts/ProxmoxVE/pull/15605))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Fireshare: Fix for install and upgrade to v1.7.3 [@tremor021](https://github.com/tremor021) ([#15673](https://github.com/community-scripts/ProxmoxVE/pull/15673))
-    - Endurain: Fix update procedure [@tremor021](https://github.com/tremor021) ([#15674](https://github.com/community-scripts/ProxmoxVE/pull/15674))
-
 ## 2026-07-09
 
 ### 🚀 Updated Scripts

ct/affine.sh

@@ -1,127 +0,0 @@
-#!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/toeverything/AFFiNE
-
-APP="AFFiNE"
-var_tags="${var_tags:-knowledge;notes;workspace}"
-var_cpu="${var_cpu:-4}"
-var_ram="${var_ram:-8192}"
-var_disk="${var_disk:-20}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-no}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/affine ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "affine_app" "toeverything/AFFiNE"; then
-    msg_info "Stopping Services"
-    systemctl stop affine-web affine-worker
-    msg_ok "Stopped Services"
-
-    create_backup /root/.affine/config /root/.affine/storage
-
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "latest" "/opt/affine"
-
-    msg_info "Rebuilding Application (Patience)"
-    cd /opt/affine
-    source /root/.profile
-    export PATH="/root/.cargo/bin:/root/.rbenv/shims:$PATH"
-
-    set -a && source /opt/affine/.env && set +a
-
-    export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
-    export VITE_CORE_COMMIT_SHA=$(cat ~/.affine_app)
-
-    # Initialize git repo (required for build process)
-    $STD git init -q
-    $STD git config user.email "build@local"
-    $STD git config user.name "Build"
-    $STD git add -A
-    $STD git commit -q -m "update"
-
-    # Force Turbo to run sequentially
-    mkdir -p /opt/affine/.turbo
-    cat <<TURBO >/opt/affine/.turbo/config.json
-{
-  "concurrency": 1
-}
-TURBO
-
-    $STD corepack enable
-    $STD corepack prepare yarn@4.12.0 --activate
-    $STD yarn config set enableTelemetry 0
-
-    export NODE_OPTIONS="--max-old-space-size=2048"
-    $STD yarn install
-    $STD npm install -g typescript
-
-    $STD yarn affine @affine/native build
-    $STD yarn affine @affine/server-native build
-
-    # Create architecture-specific symlinks
-    ln -sf /opt/affine/packages/backend/native/server-native.node \
-      /opt/affine/packages/backend/native/server-native.x64.node
-    ln -sf /opt/affine/packages/backend/native/server-native.node \
-      /opt/affine/packages/backend/native/server-native.arm64.node
-    ln -sf /opt/affine/packages/backend/native/server-native.node \
-      /opt/affine/packages/backend/native/server-native.armv7.node
-
-    $STD yarn affine init
-    $STD yarn affine build -p @affine/reader
-    $STD yarn affine build -p @affine/server
-
-    export NODE_OPTIONS="--max-old-space-size=4096"
-    $STD yarn affine build -p @affine/web
-    $STD yarn affine build -p @affine/admin
-
-    # Copy web assets
-    mkdir -p /opt/affine/packages/backend/server/static
-    cp -r /opt/affine/packages/frontend/apps/web/dist/* /opt/affine/packages/backend/server/static/
-    mkdir -p /opt/affine/packages/backend/server/static/admin
-    cp -r /opt/affine/packages/frontend/admin/dist/* /opt/affine/packages/backend/server/static/admin/
-
-    # Mobile manifest placeholder
-    mkdir -p /opt/affine/packages/backend/server/static/mobile
-    echo '{"publicPath":"/","js":[],"css":[],"gitHash":"","description":""}' \
-      >/opt/affine/packages/backend/server/static/mobile/assets-manifest.json
-
-    # Run migrations
-    cd /opt/affine/packages/backend/server
-    set -a && source /opt/affine/.env && set +a
-    $STD node ./scripts/self-host-predeploy.js
-
-    restore_backup
-
-    msg_info "Starting Services"
-    systemctl start affine-web affine-worker
-    msg_ok "Started Services"
-    msg_ok "Updated Successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:3010/sign-in${CL}"

ct/endurain.sh

@@ -34,22 +34,31 @@ function update_script() {
     systemctl stop endurain
     msg_ok "Stopped Service"
 
-    create_backup /opt/endurain/.env /opt/endurain/frontend/dist/env.js
+    msg_info "Creating Backup"
+    cp /opt/endurain/.env /opt/endurain.env
+    cp /opt/endurain/frontend/dist/env.js /opt/endurain.env.js
+    msg_ok "Created Backup"
+
     CLEAN_INSTALL=1 fetch_and_deploy_codeberg_release "endurain" "endurain-project/endurain" "tarball" "latest" "/opt/endurain"
 
     msg_info "Preparing Update"
     cd /opt/endurain
-    rm -rf /opt/endurain/{docs,example.env,screenshot_01.png} /opt/endurain/docker* /opt/endurain/*.yml
+    rm -rf \
+      /opt/endurain/{docs,example.env,screenshot_01.png} \
+      /opt/endurain/docker* \
+      /opt/endurain/*.yml
+    cp /opt/endurain.env /opt/endurain/.env
+    rm /opt/endurain.env
     msg_ok "Prepared Update"
 
     msg_info "Updating Frontend"
     cd /opt/endurain/frontend
     $STD npm ci
     $STD npm run build
+    cp /opt/endurain.env.js /opt/endurain/frontend/dist/env.js
+    rm /opt/endurain.env.js
     msg_ok "Updated Frontend"
 
-    restore_backup
-
     msg_info "Updating Backend"
     cd /opt/endurain/backend
     UV_VERSION=$(grep -Po 'required-version\s*=\s*"\K[^"]+' pyproject.toml 2>/dev/null || echo "0.11.18")

ct/fireshare.sh

@@ -35,22 +35,12 @@ function update_script() {
     systemctl stop fireshare
     msg_ok "Stopped Service"
 
-    create_backup /opt/fireshare/fireshare.env
+    mv /opt/fireshare/fireshare.env /opt
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "fireshare" "ShaneIsrael/fireshare" "tarball"
-    restore_backup
+    mv /opt/fireshare.env /opt/fireshare
     rm -f /usr/local/bin/fireshare
 
-    if ! grep -q "__FIRESHARE_PORT__" /etc/nginx/nginx.conf; then
+    msg_info "Updating Fireshare"
-      cp /opt/fireshare/app/nginx/prod.conf /etc/nginx/nginx.conf
-      sed -i 's|root /processed/|root /opt/fireshare-processed/|g' /etc/nginx/nginx.conf
-      sed -i 's/^user[[:space:]]\+nginx;/user  root;/' /etc/nginx/nginx.conf
-      sed -i 's|root[[:space:]]\+/app/build;|root /opt/fireshare/app/client/build;|' /etc/nginx/nginx.conf
-      sed -i 's/__FIRESHARE_PORT__/80/g' /etc/nginx/nginx.conf
-      cp /opt/fireshare/app/nginx/error.html /etc/nginx/
-      cp /opt/fireshare/app/nginx/api_unavailable.html /etc/nginx/
-    fi
-    msg_info "Configuring Fireshare"
-
     cd /opt/fireshare
     $STD uv venv --clear
     $STD .venv/bin/python -m ensurepip --upgrade
@@ -63,10 +53,13 @@ function update_script() {
     export VIDEO_DIRECTORY=/opt/fireshare-videos
     export PROCESSED_DIRECTORY=/opt/fireshare-processed
     $STD uv run flask db upgrade
+
+    msg_info "Building Fireshare Client"
     cd /opt/fireshare/app/client
     $STD npm install
     $STD npm run build
-    msg_ok "Configured Fireshare"
+    msg_ok "Built Fireshare Client"
+    msg_ok "Updated Fireshare"
 
     msg_info "Starting Service"
     systemctl start fireshare

ct/headers/affine

@@ -1,6 +0,0 @@
-    ___    _____________ _   ________
-   /   |  / ____/ ____(_) | / / ____/
-  / /| | / /_  / /_  / /  |/ / __/   
- / ___ |/ __/ / __/ / / /|  / /___   
-/_/  |_/_/   /_/   /_/_/ |_/_____/   
-                                     

ct/headers/squid

@@ -1,6 +0,0 @@
-   _____             _     __
-  / ___/____ ___  __(_)___/ /
-  \__ \/ __ `/ / / / / __  / 
- ___/ / /_/ / /_/ / / /_/ /  
-/____/\__, /\__,_/_/\__,_/   
-        /_/                  

ct/squid.sh

@@ -1,53 +0,0 @@
-#!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: 007hacky007
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://www.squid-cache.org/
-
-APP="Squid"
-var_tags="${var_tags:-proxy}"
-var_cpu="${var_cpu:-1}"
-var_ram="${var_ram:-512}"
-var_disk="${var_disk:-4}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-  if [[ ! -f /etc/squid/squid.conf ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-  msg_info "Updating Squid"
-  $STD apt update
-  $STD apt upgrade -y
-  msg_ok "Updated Squid"
-
-  msg_info "Validating Squid Configuration"
-  $STD squid -k parse
-  msg_ok "Validated Squid Configuration"
-
-  msg_info "Restarting Squid"
-  systemctl restart squid
-  msg_ok "Restarted Squid"
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Proxy endpoint:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}${IP}:3128${CL}"

install/affine-install.sh

@@ -1,215 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/toeverything/AFFiNE
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-msg_info "Installing Dependencies"
-$STD apt install -y \
-  build-essential \
-  git \
-  pkg-config \
-  openssl \
-  libssl-dev \
-  libjemalloc2 \
-  redis-server \
-  nginx
-msg_ok "Installed Dependencies"
-
-PG_VERSION="16" PG_MODULES="pgvector" setup_postgresql
-PG_DB_NAME="affine" PG_DB_USER="affine" setup_postgresql_db
-NODE_VERSION="22" setup_nodejs
-setup_rust
-
-fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "latest" "/opt/affine"
-
-msg_info "Setting up Directories"
-rm -rf /root/.affine
-mkdir -p /root/.affine/{storage,config}
-msg_ok "Set up Directories"
-
-msg_info "Configuring Environment"
-SECRET_KEY=$(openssl rand -hex 32)
-cat <<EOF >/opt/affine/.env
-NODE_ENV=production
-AFFINE_SERVER_PORT=3010
-AFFINE_SERVER_HOST=${LOCAL_IP}
-AFFINE_SERVER_EXTERNAL_URL=http://${LOCAL_IP}
-DATABASE_URL=postgresql://${PG_DB_USER}:${PG_DB_PASS}@localhost:5432/${PG_DB_NAME}
-REDIS_SERVER_HOST=localhost
-REDIS_SERVER_PORT=6379
-AFFINE_INDEXER_ENABLED=false
-SECRET_KEY=${SECRET_KEY}
-EOF
-msg_ok "Configured Environment"
-
-msg_info "Building AFFiNE (Patience)"
-cd /opt/affine
-source /root/.profile
-export PATH="/root/.cargo/bin:$PATH"
-export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
-export VITE_CORE_COMMIT_SHA=$(cat ~/.affine_app)
-# # Initialize git repo (required for build process)
-$STD git init -q
-$STD git config user.email "build@local"
-$STD git config user.name "Build"
-$STD git add -A
-$STD git commit -q -m "initial"
-mkdir -p /opt/affine/.turbo
-cat <<TURBO >/opt/affine/.turbo/config.json
-{
-  "concurrency": 1
-}
-TURBO
-$STD corepack enable
-$STD corepack prepare yarn@4.12.0 --activate
-$STD yarn config set enableTelemetry 0
-export NODE_OPTIONS="--max-old-space-size=4096"
-export TSC_COMPILE_ON_ERROR=true
-$STD yarn install
-$STD npm install -g typescript
-$STD yarn affine @affine/native build
-$STD yarn affine @affine/server-native build
-
-# Create architecture-specific symlinks for server-native
-ln -sf /opt/affine/packages/backend/native/server-native.node \
-  /opt/affine/packages/backend/native/server-native.x64.node
-ln -sf /opt/affine/packages/backend/native/server-native.node \
-  /opt/affine/packages/backend/native/server-native.arm64.node
-ln -sf /opt/affine/packages/backend/native/server-native.node \
-  /opt/affine/packages/backend/native/server-native.armv7.node
-
-$STD yarn affine init
-$STD yarn affine build -p @affine/reader
-$STD yarn affine build -p @affine/server
-export NODE_OPTIONS="--max-old-space-size=4096"
-$STD yarn affine build -p @affine/web
-$STD yarn affine build -p @affine/admin
-mkdir -p /opt/affine/packages/backend/server/static
-cp -r /opt/affine/packages/frontend/apps/web/dist/* /opt/affine/packages/backend/server/static/
-mkdir -p /opt/affine/packages/backend/server/static/admin
-cp -r /opt/affine/packages/frontend/admin/dist/* /opt/affine/packages/backend/server/static/admin/
-# Create empty mobile manifest (server expects it but we don't build mobile)
-mkdir -p /opt/affine/packages/backend/server/static/mobile
-cat <<'MANIFEST' >/opt/affine/packages/backend/server/static/mobile/assets-manifest.json
-{"publicPath":"/","js":[],"css":[],"gitHash":"","description":""}
-MANIFEST
-msg_ok "Built AFFiNE"
-
-msg_info "Running Initial Migration"
-cd /opt/affine/packages/backend/server
-set -a && source /opt/affine/.env && set +a
-$STD node ./scripts/self-host-predeploy.js
-msg_ok "Ran Initial Migration"
-
-msg_info "Creating Services"
-cat <<EOF >/etc/systemd/system/affine-web.service
-[Unit]
-Description=AFFiNE Web Server
-After=network.target postgresql.service redis-server.service
-Requires=postgresql.service redis-server.service
-
-[Service]
-Type=simple
-WorkingDirectory=/opt/affine/packages/backend/server
-EnvironmentFile=/opt/affine/.env
-Environment=LD_PRELOAD=libjemalloc.so.2
-Environment=NODE_OPTIONS=--max-old-space-size=1024
-ExecStart=/usr/bin/node ./dist/main.js
-Restart=always
-RestartSec=10
-
-[Install]
-WantedBy=multi-user.target
-EOF
-
-cat <<EOF >/etc/systemd/system/affine-worker.service
-[Unit]
-Description=AFFiNE Background Worker
-After=network.target postgresql.service redis-server.service
-Requires=postgresql.service redis-server.service
-
-[Service]
-Type=simple
-WorkingDirectory=/opt/affine/packages/backend/server
-EnvironmentFile=/opt/affine/.env
-Environment=LD_PRELOAD=libjemalloc.so.2
-Environment=NODE_OPTIONS=--max-old-space-size=1024
-ExecStart=/usr/bin/node ./dist/main.js --worker
-Restart=always
-RestartSec=10
-
-[Install]
-WantedBy=multi-user.target
-EOF
-
-systemctl enable -q --now redis-server affine-web affine-worker
-msg_ok "Created Services"
-
-msg_info "Creating Admin User"
-ADMIN_PASS=$(openssl rand -base64 12)
-for i in {1..30}; do
-  if curl -s http://localhost:3010/info >/dev/null 2>&1; then
-    break
-  fi
-  sleep 2
-done
-# Create admin via API
-ADMIN_RESPONSE=$(curl -s -X POST http://localhost:3010/api/setup/create-admin-user \
-  -H "Content-Type: application/json" \
-  -d "{\"email\":\"admin@affine.local\",\"password\":\"${ADMIN_PASS}\"}")
-if echo "$ADMIN_RESPONSE" | grep -q '"id"'; then
-  {
-    echo "AFFiNE Credentials"
-    echo "=================="
-    echo "Email: admin@affine.local"
-    echo "Password: ${ADMIN_PASS}"
-  } >~/affine.creds
-  msg_ok "Created Admin User"
-else
-  msg_warn "Admin creation skipped (may already exist)"
-fi
-
-msg_info "Configuring Nginx"
-cat <<EOF >/etc/nginx/sites-available/affine.conf
-upstream affine_backend {
-    server 127.0.0.1:3010;
-}
-
-server {
-    listen 80;
-    server_name _;
-
-    client_max_body_size 100M;
-
-    location / {
-        proxy_pass http://affine_backend;
-        proxy_http_version 1.1;
-        proxy_set_header Host \$host;
-        proxy_set_header X-Real-IP \$remote_addr;
-        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto \$scheme;
-        proxy_set_header Upgrade \$http_upgrade;
-        proxy_set_header Connection "upgrade";
-        proxy_redirect off;
-        proxy_buffering off;
-    }
-}
-EOF
-ln -sf /etc/nginx/sites-available/affine.conf /etc/nginx/sites-enabled/
-rm -f /etc/nginx/sites-enabled/default
-systemctl enable -q --now nginx
-msg_ok "Configured Nginx"
-
-motd_ssh
-customize
-cleanup_lxc

install/fireshare-install.sh

@@ -141,9 +141,6 @@ cp /opt/fireshare/app/nginx/prod.conf /etc/nginx/nginx.conf
 sed -i 's|root /processed/|root /opt/fireshare-processed/|g' /etc/nginx/nginx.conf
 sed -i 's/^user[[:space:]]\+nginx;/user  root;/' /etc/nginx/nginx.conf
 sed -i 's|root[[:space:]]\+/app/build;|root /opt/fireshare/app/client/build;|' /etc/nginx/nginx.conf
-sed -i 's/__FIRESHARE_PORT__/80/g' /etc/nginx/nginx.conf
-cp /opt/fireshare/app/nginx/error.html /etc/nginx/
-cp /opt/fireshare/app/nginx/api_unavailable.html /etc/nginx/
 systemctl start nginx
 
 cat <<EOF >~/fireshare.creds

install/squid-install.sh

@@ -1,88 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: 007hacky007
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://www.squid-cache.org/
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-msg_info "Configuring Squid"
-mkdir -p /etc/squid
-cat <<EOF >/etc/squid/squid.conf
-acl localnet src 0.0.0.1-0.255.255.255
-acl localnet src 10.0.0.0/8
-acl localnet src 100.64.0.0/10
-acl localnet src 169.254.0.0/16
-acl localnet src 172.16.0.0/12
-acl localnet src 192.168.0.0/16
-acl localnet src fc00::/7
-acl localnet src fe80::/10
-
-acl SSL_ports port 443
-acl Safe_ports port 80
-acl Safe_ports port 21
-acl Safe_ports port 443
-acl Safe_ports port 70
-acl Safe_ports port 210
-acl Safe_ports port 1025-65535
-acl Safe_ports port 280
-acl Safe_ports port 488
-acl Safe_ports port 591
-acl Safe_ports port 777
-acl CONNECT method CONNECT
-
-http_access deny !Safe_ports
-http_access deny CONNECT !SSL_ports
-http_access allow localhost manager
-http_access deny manager
-
-auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/passwords
-auth_param basic realm proxy
-acl authenticated proxy_auth REQUIRED
-http_access allow authenticated
-http_access deny all
-
-http_port 3128
-
-coredump_dir /var/spool/squid
-
-refresh_pattern ^ftp:        1440    20%    10080
-refresh_pattern ^gopher:     1440    0%     1440
-refresh_pattern -i (/cgi-bin/|\\?) 0  0%     0
-refresh_pattern .            0       20%    4320
-
-# Privacy / hardening
-httpd_suppress_version_string on
-visible_hostname $(hostname)
-forwarded_for delete
-request_header_access X-Forwarded-For deny all
-EOF
-msg_ok "Configured Squid"
-
-msg_info "Installing Dependencies"
-$STD apt install -y \
-  squid \
-  apache2-utils
-msg_ok "Installed Dependencies"
-
-msg_info "Configuring Squid Authentication"
-touch /etc/squid/passwords
-chown proxy:proxy /etc/squid/passwords
-chmod 640 /etc/squid/passwords
-$STD squid -k parse
-msg_ok "Configured Squid Authentication"
-
-msg_info "Starting Service"
-systemctl enable -q --now squid
-msg_ok "Started Service"
-
-motd_ssh
-customize
-cleanup_lxc

misc/tools.func

@@ -125,67 +125,6 @@ curl_with_retry() {
   fi
 }
 
-# ------------------------------------------------------------------------------
-# Robust curl wrapper for API calls (returns HTTP code + body)
-#
-# Usage:
-#   response=$(curl_api_with_retry "https://api.github.com/repos/owner/repo/releases/latest")
-#   http_code=$(curl_api_with_retry "https://api.github.com/..." "/tmp/body.json")
-#
-# Parameters:
-#   $1 - URL to call
-#   $2 - (optional) Output file for body (default: stdout)
-#   $3 - (optional) Additional curl options as string
-#
-# Returns: HTTP status code, body in file or stdout
-# ------------------------------------------------------------------------------
-curl_api_with_retry() {
-  local url="$1"
-  local body_file="${2:-}"
-  local extra_opts="${3:-}"
-  local retries="${CURL_RETRIES:-3}"
-  local timeout="${CURL_TIMEOUT:-60}"
-  local connect_timeout="${CURL_CONNECT_TO:-10}"
-
-  local attempt=1
-  local http_code=""
-
-  while [[ $attempt -le $retries ]]; do
-    debug_log "curl API attempt $attempt/$retries: $url"
-
-    local curl_cmd="curl -fsSL --connect-timeout $connect_timeout --max-time $timeout -w '%{http_code}'"
-    [[ -n "$extra_opts" ]] && curl_cmd="$curl_cmd $extra_opts"
-
-    if [[ -n "$body_file" ]]; then
-      http_code=$($curl_cmd -o "$body_file" "$url" 2>/dev/null) || true
-    else
-      # Capture body and http_code separately
-      local tmp_body="/tmp/curl_api_body_$$"
-      http_code=$($curl_cmd -o "$tmp_body" "$url" 2>/dev/null) || true
-      if [[ -f "$tmp_body" ]]; then
-        cat "$tmp_body"
-        rm -f "$tmp_body"
-      fi
-    fi
-
-    # Success on 2xx codes
-    if [[ "$http_code" =~ ^2[0-9]{2}$ ]]; then
-      debug_log "curl API successful: $url (HTTP $http_code)"
-      echo "$http_code"
-      return 0
-    fi
-
-    debug_log "curl API attempt $attempt failed (HTTP $http_code, timeout=${timeout}s), waiting ${attempt}s..."
-    sleep "$attempt"
-    # Double --max-time on each retry so slow connections can finish
-    timeout=$((timeout * 2))
-    ((attempt++))
-  done
-
-  debug_log "curl API FAILED after $retries attempts: $url"
-  echo "$http_code"
-  return 7
-}
 
 # ------------------------------------------------------------------------------
 # Download and install GPG key with retry logic and validation
@@ -317,15 +256,6 @@ cache_installed_version() {
   echo "$version" >"/var/cache/app-versions/${app}_version.txt"
 }
 
-get_cached_version() {
-  local app="$1"
-  mkdir -p /var/cache/app-versions
-  if [[ -f "/var/cache/app-versions/${app}_version.txt" ]]; then
-    cat "/var/cache/app-versions/${app}_version.txt"
-    return 0
-  fi
-  return 1
-}
 
 # ------------------------------------------------------------------------------
 # Clean up ALL keyring locations for a tool (unified helper)
@@ -1642,14 +1572,6 @@ codeberg_api_call() {
   return 22
 }
 
-should_upgrade() {
-  local current="$1"
-  local target="$2"
-
-  [[ -z "$current" ]] && return 0
-  version_gt "$target" "$current" && return 0
-  return 1
-}
 
 # ------------------------------------------------------------------------------
 # Get OS information (cached for performance)
@@ -1802,200 +1724,6 @@ get_fallback_suite() {
   return 0
 }
 
-# ------------------------------------------------------------------------------
-# Verify package source and version
-# ------------------------------------------------------------------------------
-verify_package_source() {
-  local package="$1"
-  local expected_version="$2"
-
-  if apt-cache policy "$package" 2>/dev/null | grep -q "$expected_version"; then
-    return 0
-  fi
-  return 1
-}
-
-# ------------------------------------------------------------------------------
-# Check if running on LTS version
-# ------------------------------------------------------------------------------
-is_lts_version() {
-  local os_id=$(get_os_info id)
-  local codename=$(get_os_info codename)
-
-  if [[ "$os_id" == "ubuntu" ]]; then
-    case "$codename" in
-    focal | jammy | noble) return 0 ;; # 20.04, 22.04, 24.04
-    *) return 1 ;;
-    esac
-  elif [[ "$os_id" == "debian" ]]; then
-    # Debian releases are all "stable"
-    case "$codename" in
-    bullseye | bookworm | trixie) return 0 ;;
-    *) return 1 ;;
-    esac
-  fi
-
-  return 1
-}
-
-# ------------------------------------------------------------------------------
-# Get optimal number of parallel jobs (cached)
-# Features:
-#   - CPU count detection
-#   - Memory-based limiting (1.5GB per job for safety)
-#   - Current load awareness
-#   - Container/VM detection for conservative limits
-# ------------------------------------------------------------------------------
-get_parallel_jobs() {
-  if [[ -z "${_PARALLEL_JOBS:-}" ]]; then
-    local cpu_count
-    cpu_count=$(nproc 2>/dev/null || grep -c ^processor /proc/cpuinfo 2>/dev/null || echo 1)
-
-    local mem_mb
-    mem_mb=$(free -m 2>/dev/null | awk '/^Mem:/{print $2}' || echo 1024)
-
-    # Assume 1.5GB per compilation job for safety margin
-    local max_by_mem=$((mem_mb / 1536))
-    ((max_by_mem < 1)) && max_by_mem=1
-
-    # Check current system load - reduce jobs if already loaded
-    local load_1m
-    load_1m=$(awk '{print int($1)}' /proc/loadavg 2>/dev/null || echo 0)
-    local available_cpus=$((cpu_count - load_1m))
-    ((available_cpus < 1)) && available_cpus=1
-
-    # Take minimum of: available CPUs, memory-limited, and total CPUs
-    local max_jobs=$cpu_count
-    ((max_by_mem < max_jobs)) && max_jobs=$max_by_mem
-    ((available_cpus < max_jobs)) && max_jobs=$available_cpus
-
-    # Container detection - be more conservative in containers
-    if [[ -f /.dockerenv ]] || grep -q 'lxc\|docker\|container' /proc/1/cgroup 2>/dev/null; then
-      # Reduce by 25% in containers to leave headroom
-      max_jobs=$((max_jobs * 3 / 4))
-      ((max_jobs < 1)) && max_jobs=1
-    fi
-
-    # Final bounds check
-    ((max_jobs < 1)) && max_jobs=1
-    ((max_jobs > cpu_count)) && max_jobs=$cpu_count
-
-    export _PARALLEL_JOBS=$max_jobs
-    debug_log "Parallel jobs: $_PARALLEL_JOBS (CPUs: $cpu_count, mem-limit: $max_by_mem, load: $load_1m)"
-  fi
-  echo "$_PARALLEL_JOBS"
-}
-
-# ------------------------------------------------------------------------------
-# Get default PHP version for OS
-# Updated for latest distro releases
-# ------------------------------------------------------------------------------
-get_default_php_version() {
-  local os_id
-  os_id=$(get_os_info id)
-  local os_version
-  os_version=$(get_os_version_major)
-
-  case "$os_id" in
-  debian)
-    case "$os_version" in
-    14) echo "8.4" ;; # Debian 14 (Forky) - future
-    13) echo "8.3" ;; # Debian 13 (Trixie)
-    12) echo "8.2" ;; # Debian 12 (Bookworm)
-    11) echo "7.4" ;; # Debian 11 (Bullseye)
-    *) echo "8.3" ;;  # Default to latest stable
-    esac
-    ;;
-  ubuntu)
-    case "$os_version" in
-    26) echo "8.4" ;; # Ubuntu 26.04 - future
-    24) echo "8.3" ;; # Ubuntu 24.04 LTS (Noble)
-    22) echo "8.1" ;; # Ubuntu 22.04 LTS (Jammy)
-    20) echo "7.4" ;; # Ubuntu 20.04 LTS (Focal)
-    *) echo "8.3" ;;  # Default to latest stable
-    esac
-    ;;
-  *)
-    echo "8.3"
-    ;;
-  esac
-}
-
-# ------------------------------------------------------------------------------
-# Get default Python version for OS
-# Updated for latest distro releases
-# ------------------------------------------------------------------------------
-get_default_python_version() {
-  local os_id
-  os_id=$(get_os_info id)
-  local os_version
-  os_version=$(get_os_version_major)
-
-  case "$os_id" in
-  debian)
-    case "$os_version" in
-    14) echo "3.13" ;; # Debian 14 (Forky) - future
-    13) echo "3.12" ;; # Debian 13 (Trixie)
-    12) echo "3.11" ;; # Debian 12 (Bookworm)
-    11) echo "3.9" ;;  # Debian 11 (Bullseye)
-    *) echo "3.12" ;;  # Default to latest stable
-    esac
-    ;;
-  ubuntu)
-    case "$os_version" in
-    26) echo "3.13" ;; # Ubuntu 26.04 - future
-    24) echo "3.12" ;; # Ubuntu 24.04 LTS
-    22) echo "3.10" ;; # Ubuntu 22.04 LTS
-    20) echo "3.8" ;;  # Ubuntu 20.04 LTS
-    *) echo "3.12" ;;  # Default to latest stable
-    esac
-    ;;
-  *)
-    echo "3.12"
-    ;;
-  esac
-}
-
-# ------------------------------------------------------------------------------
-# Get default Node.js LTS version
-# ------------------------------------------------------------------------------
-get_default_nodejs_version() {
-  # Current LTS as of January 2026 (Node.js 24 LTS)
-  echo "24"
-}
-
-# ------------------------------------------------------------------------------
-# Check if package manager is locked
-# ------------------------------------------------------------------------------
-is_apt_locked() {
-  if fuser /var/lib/dpkg/lock-frontend &>/dev/null ||
-    fuser /var/lib/apt/lists/lock &>/dev/null ||
-    fuser /var/cache/apt/archives/lock &>/dev/null; then
-    return 0
-  fi
-  return 1
-}
-
-# ------------------------------------------------------------------------------
-# Wait for apt to be available
-# ------------------------------------------------------------------------------
-wait_for_apt() {
-  local max_wait="${1:-300}" # 5 minutes default
-  local waited=0
-
-  while is_apt_locked; do
-    if [[ $waited -ge $max_wait ]]; then
-      msg_error "Timeout waiting for apt to be available"
-      msg_error "Hint: Another process (apt, dpkg, unattended-upgrades) may hold a lock. Check: ps aux | grep -E 'apt|dpkg'"
-      return 100
-    fi
-
-    sleep 5
-    waited=$((waited + 5))
-  done
-
-  return 0
-}
 
 # ------------------------------------------------------------------------------
 # Cleanup old repository files (migration helper)
@@ -2198,22 +1926,6 @@ setup_deb822_repo() {
   fi
 }
 
-# ------------------------------------------------------------------------------
-# Package version hold/unhold helpers
-# ------------------------------------------------------------------------------
-hold_package_version() {
-  local package="$1"
-  $STD apt-mark hold "$package" || {
-    msg_warn "Failed to hold package version: ${package}"
-  }
-}
-
-unhold_package_version() {
-  local package="$1"
-  $STD apt-mark unhold "$package" || {
-    msg_warn "Failed to unhold package version: ${package}"
-  }
-}
 
 # ------------------------------------------------------------------------------
 # Safe service restart with verification
@@ -2259,41 +1971,6 @@ safe_service_restart() {
   return 150
 }
 
-# ------------------------------------------------------------------------------
-# Enable and start service (with error handling)
-# ------------------------------------------------------------------------------
-enable_and_start_service() {
-  local service="$1"
-
-  if ! systemctl enable "$service" &>/dev/null; then
-    msg_error "Failed to enable service: $service"
-    return 150
-  fi
-
-  if ! systemctl start "$service" &>/dev/null; then
-    msg_error "Failed to start $service"
-    systemctl status "$service" --no-pager
-    return 150
-  fi
-
-  return 0
-}
-
-# ------------------------------------------------------------------------------
-# Check if service is enabled
-# ------------------------------------------------------------------------------
-is_service_enabled() {
-  local service="$1"
-  systemctl is-enabled --quiet "$service" 2>/dev/null
-}
-
-# ------------------------------------------------------------------------------
-# Check if service is running
-# ------------------------------------------------------------------------------
-is_service_running() {
-  local service="$1"
-  systemctl is-active --quiet "$service" 2>/dev/null
-}
 
 # ------------------------------------------------------------------------------
 # Extract version from JSON (GitHub releases)
@@ -2439,42 +2116,6 @@ get_latest_codeberg_release() {
   echo "$version"
 }
 
-# ------------------------------------------------------------------------------
-# Debug logging - using main debug_log function (line 40)
-# Supports both TOOLS_DEBUG and DEBUG environment variables
-# ------------------------------------------------------------------------------
-
-# ------------------------------------------------------------------------------
-# Performance timing helper
-# ------------------------------------------------------------------------------
-start_timer() {
-  echo $(date +%s)
-}
-
-end_timer() {
-  local start_time="$1"
-  local label="${2:-Operation}"
-  local end_time=$(date +%s)
-  local duration=$((end_time - start_time))
-}
-
-# ------------------------------------------------------------------------------
-# GPG key fingerprint verification
-# ------------------------------------------------------------------------------
-verify_gpg_fingerprint() {
-  local key_file="$1"
-  local expected_fingerprint="$2"
-
-  local actual_fingerprint
-  actual_fingerprint=$(gpg --show-keys --with-fingerprint --with-colons "$key_file" 2>&1 | grep -m1 '^fpr:' | cut -d: -f10)
-
-  if [[ "$actual_fingerprint" == "$expected_fingerprint" ]]; then
-    return 0
-  fi
-
-  msg_error "GPG fingerprint mismatch! Expected: $expected_fingerprint, Got: $actual_fingerprint"
-  return 65
-}
 
 # ------------------------------------------------------------------------------
 # Fetches and deploys a GitHub tag-based source tarball.
@@ -3001,38 +2642,6 @@ create_self_signed_cert() {
   chmod 644 "$CERT_CRT"
 }
 
-# ------------------------------------------------------------------------------
-# Downloads file with optional progress indicator using pv.
-#
-# Arguments:
-#   $1 - URL
-#   $2 - Destination path
-# ------------------------------------------------------------------------------
-
-download_with_progress() {
-  local url="$1"
-  local output="$2"
-  if [ -n "$SPINNER_PID" ] && ps -p "$SPINNER_PID" >/dev/null; then kill "$SPINNER_PID" >/dev/null; fi
-
-  ensure_dependencies pv
-  set -o pipefail
-
-  # Content-Length aus HTTP-Header holen
-  local content_length
-  content_length=$(curl -fsSLI "$url" | awk '/Content-Length/ {print $2}' | tr -d '\r' || true)
-
-  if [[ -z "$content_length" ]]; then
-    if ! curl -fL# -o "$output" "$url"; then
-      msg_error "Download failed: $url"
-      return 7
-    fi
-  else
-    if ! curl -fsSL "$url" | pv -s "$content_length" >"$output"; then
-      msg_error "Download failed: $url"
-      return 7
-    fi
-  fi
-}
 
 # ------------------------------------------------------------------------------
 # Ensures /usr/local/bin is permanently in system PATH.
@@ -6332,117 +5941,6 @@ setup_java() {
   msg_ok "Setup Temurin JDK $JAVA_VERSION"
 }
 
-# ------------------------------------------------------------------------------
-# Installs a local IP updater script using networkd-dispatcher.
-#
-# Description:
-#   - Stores current IP in /run/local-ip.env
-#   - Automatically runs on network changes
-# ------------------------------------------------------------------------------
-
-setup_local_ip_helper() {
-  local BASE_DIR="/usr/local/community-scripts/ip-management"
-  local SCRIPT_PATH="$BASE_DIR/update_local_ip.sh"
-  local IP_FILE="/run/local-ip.env"
-  local DISPATCHER_SCRIPT="/etc/networkd-dispatcher/routable.d/10-update-local-ip.sh"
-
-  # Check if already set up
-  if [[ -f "$SCRIPT_PATH" && -f "$DISPATCHER_SCRIPT" ]]; then
-    msg_info "Update Local IP Helper"
-    cache_installed_version "local-ip-helper" "1.0"
-    msg_ok "Update Local IP Helper"
-  else
-    msg_info "Setup Local IP Helper"
-  fi
-
-  mkdir -p "$BASE_DIR"
-
-  # Install networkd-dispatcher if not present
-  if ! dpkg -s networkd-dispatcher >/dev/null 2>&1; then
-    ensure_dependencies networkd-dispatcher || {
-      msg_error "Failed to install networkd-dispatcher"
-      return 100
-    }
-  fi
-
-  # Write update_local_ip.sh
-  cat <<'EOF' >"$SCRIPT_PATH"
-#!/bin/bash
-set -euo pipefail
-
-IP_FILE="/run/local-ip.env"
-mkdir -p "$(dirname "$IP_FILE")"
-
-get_current_ip() {
-    local ip
-
-    # Try IPv4 targets first
-    local ipv4_targets=("8.8.8.8" "1.1.1.1" "192.168.1.1" "10.0.0.1" "172.16.0.1" "default")
-    for target in "${ipv4_targets[@]}"; do
-        if [[ "$target" == "default" ]]; then
-            ip=$(ip route get 1 2>/dev/null | awk '{for(i=1;i<=NF;i++) if ($i=="src") print $(i+1)}')
-        else
-            ip=$(ip route get "$target" 2>/dev/null | awk '{for(i=1;i<=NF;i++) if ($i=="src") print $(i+1)}')
-        fi
-        if [[ -n "$ip" ]]; then
-            echo "$ip"
-            return 0
-        fi
-    done
-
-    # IPv6 fallback: Try direct interface lookup for eth0
-    ip=$(ip -6 addr show eth0 scope global 2>/dev/null | awk '/inet6 / {print $2}' | cut -d/ -f1 | head -n1)
-    if [[ -n "$ip" && "$ip" =~ : ]]; then
-        echo "$ip"
-        return 0
-    fi
-
-    # IPv6 fallback: Use routing table with IPv6 targets (Google DNS, Cloudflare DNS)
-    local ipv6_targets=("2001:4860:4860::8888" "2606:4700:4700::1111")
-    for target in "${ipv6_targets[@]}"; do
-        ip=$(ip -6 route get "$target" 2>/dev/null | awk '{for(i=1;i<=NF;i++) if ($i=="src") print $(i+1)}')
-        if [[ -n "$ip" && "$ip" =~ : ]]; then
-            echo "$ip"
-            return 0
-        fi
-    done
-
-    return 1
-}
-
-current_ip="$(get_current_ip)"
-
-if [[ -z "$current_ip" ]]; then
-    echo "[ERROR] Could not detect local IP" >&2
-    exit 123
-fi
-
-if [[ -f "$IP_FILE" ]]; then
-    source "$IP_FILE"
-    [[ "$LOCAL_IP" == "$current_ip" ]] && exit 0
-fi
-
-echo "LOCAL_IP=$current_ip" > "$IP_FILE"
-echo "[INFO] LOCAL_IP updated to $current_ip"
-EOF
-
-  chmod +x "$SCRIPT_PATH"
-
-  # Install dispatcher hook
-  mkdir -p "$(dirname "$DISPATCHER_SCRIPT")"
-  cat <<EOF >"$DISPATCHER_SCRIPT"
-#!/bin/bash
-$SCRIPT_PATH
-EOF
-
-  chmod +x "$DISPATCHER_SCRIPT"
-  systemctl enable -q --now networkd-dispatcher.service || {
-    msg_warn "Failed to enable networkd-dispatcher service"
-  }
-
-  cache_installed_version "local-ip-helper" "1.0"
-  msg_ok "Setup Local IP Helper"
-}
 
 # ------------------------------------------------------------------------------
 # Installs or updates MariaDB.
@@ -9206,50 +8704,6 @@ EOF
   return 0
 }
 
-# ------------------------------------------------------------------------------
-# Get latest GitLab release version.
-# Usage: get_latest_gitlab_release "owner/repo" [strip_v]
-# ------------------------------------------------------------------------------
-get_latest_gitlab_release() {
-  local repo="$1"
-  local strip_v="${2:-true}"
-
-  local repo_encoded
-  repo_encoded=$(printf '%s' "$repo" | sed 's|/|%2F|g')
-
-  local header=()
-  [[ -n "${GITLAB_TOKEN:-}" ]] && header=(-H "PRIVATE-TOKEN: $GITLAB_TOKEN")
-
-  local temp_file
-  temp_file=$(mktemp)
-
-  local http_code
-  http_code=$(curl --connect-timeout 10 --max-time 30 -sSL \
-    -w "%{http_code}" -o "$temp_file" \
-    "${header[@]}" \
-    "https://gitlab.com/api/v4/projects/$repo_encoded/releases?per_page=1&order_by=released_at&sort=desc" 2>/dev/null) || true
-
-  if [[ "$http_code" != "200" ]]; then
-    rm -f "$temp_file"
-    msg_warn "GitLab API call failed for ${repo} (HTTP ${http_code})"
-    return 22
-  fi
-
-  local version
-  version=$(jq -r '.[0].tag_name // empty' "$temp_file")
-  rm -f "$temp_file"
-
-  if [[ -z "$version" ]]; then
-    msg_error "Could not determine latest version for ${repo}"
-    return 250
-  fi
-
-  if [[ "$strip_v" == "true" ]]; then
-    [[ "$version" =~ ^v[0-9] ]] && version="${version:1}"
-  fi
-
-  echo "$version"
-}
 
 # ------------------------------------------------------------------------------
 # Checks for new GitLab release (latest tag).