fix(immich): use start.sh in service, ensure DB_HOSTNAME in .env

.github/workflows/update-script-timestamp-on-sh-change.yml

@@ -155,21 +155,13 @@ jobs:
                 console.log('Slug not in DB, skipping: ' + slug);
                 continue;
               }
-              const today = new Date().toISOString().split('T')[0];
-              const patchBody = {
-                script_updated: today,
-                last_update_commit: process.env.PR_URL || process.env.COMMIT_URL || ''
-              };
-              // When a dev script is merged into main, promote it to production
-              if (record.is_dev === true) {
-                patchBody.is_dev = false;
-                patchBody.script_created = today;
-                console.log('Promoting dev script to production: ' + slug);
-              }
               const patchRes = await request(recordsUrl + '/' + record.id, {
                 method: 'PATCH',
                 headers: { 'Authorization': token, 'Content-Type': 'application/json' },
-                body: JSON.stringify(patchBody)
+                body: JSON.stringify({
+                  script_updated: new Date().toISOString().split('T')[0],
+                  last_update_commit: process.env.PR_URL || process.env.COMMIT_URL || ''
+                })
               });
               if (!patchRes.ok) {
                 console.warn('PATCH failed for slug ' + slug + ': ' + patchRes.body);

CHANGELOG.md

@@ -426,40 +426,12 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
-## 2026-03-23
-
-### 🚀 Updated Scripts
-
-  - #### 🔧 Refactor
-
-    - core: harden shell scripts against injection and insecure permissions [@MickLesk](https://github.com/MickLesk) ([#13239](https://github.com/community-scripts/ProxmoxVE/pull/13239))
-
 ## 2026-03-22
 
 ### 🆕 New Scripts
 
   - versitygw ([#13180](https://github.com/community-scripts/ProxmoxVE/pull/13180))
 
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Adventurelog: pin DRF <3.15 to fix coreapi module removal [@MickLesk](https://github.com/MickLesk) ([#13194](https://github.com/community-scripts/ProxmoxVE/pull/13194))
-
-  - #### ✨ New Features
-
-    - ConvertX: add libreoffice-writer for ODT/document conversions [@MickLesk](https://github.com/MickLesk) ([#13196](https://github.com/community-scripts/ProxmoxVE/pull/13196))
-
-  - #### 🔧 Refactor
-
-    - iSponsorblockTV: add AVX CPU check before installation [@MickLesk](https://github.com/MickLesk) ([#13197](https://github.com/community-scripts/ProxmoxVE/pull/13197))
-
-### 💾 Core
-
-  - #### 🐞 Bug Fixes
-
-    - core: guard against empty IPv6 address in static mode [@MickLesk](https://github.com/MickLesk) ([#13195](https://github.com/community-scripts/ProxmoxVE/pull/13195))
-
 ## 2026-03-21
 
 ### 🚀 Updated Scripts

ct/adventurelog.sh

@@ -56,7 +56,6 @@ function update_script() {
     fi
     $STD .venv/bin/python -m pip install --upgrade pip
     $STD .venv/bin/python -m pip install -r requirements.txt
-    $STD .venv/bin/python -m pip install 'djangorestframework<3.15'
     $STD .venv/bin/python -m manage collectstatic --noinput
     $STD .venv/bin/python -m manage migrate
 

ct/alpine-borgbackup-server.sh

@@ -1,107 +0,0 @@
-#!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: Sander Koenders (sanderkoenders)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://www.borgbackup.org/
-
-APP="Alpine-BorgBackup-Server"
-var_tags="${var_tags:-alpine;backup}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-1024}"
-var_disk="${var_disk:-20}"
-var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-
-  if [[ ! -f /usr/bin/borg ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  CHOICE=$(msg_menu "BorgBackup Server Update Options" \
-    "1" "Update BorgBackup Server" \
-    "2" "Reset SSH Access" \
-    "3" "Enable password authentication for backup user (not recommended, use SSH key instead)" \
-    "4" "Disable password authentication for backup user (recommended for security, use SSH key)")
-
-  case $CHOICE in
-  1)
-    msg_info "Updating $APP LXC"
-    $STD apk -U upgrade
-    msg_ok "Updated $APP LXC successfully!"
-    ;;
-  2)
-    if [[ "${PHS_SILENT:-0}" == "1" ]]; then
-      msg_warn "Reset SSH Public key requires interactive mode, skipping."
-      exit
-    fi
-
-    msg_info "Setting up SSH Public Key for backup user"
-
-    msg_info "Please paste your SSH public key (e.g., ssh-rsa AAAAB3... user@host): \n"
-    read -p "Key: " SSH_PUBLIC_KEY
-    echo
-
-    if [[ -z "$SSH_PUBLIC_KEY" ]]; then
-      msg_error "No SSH public key provided!"
-      exit 1
-    fi
-
-    if [[ ! "$SSH_PUBLIC_KEY" =~ ^(ssh-rsa|ssh-dss|ssh-ed25519|ecdsa-sha2-) ]]; then
-      msg_error "Invalid SSH public key format!"
-      exit 1
-    fi
-
-    msg_info "Setting up SSH access"
-    mkdir -p /home/backup/.ssh
-    echo "$SSH_PUBLIC_KEY" >/home/backup/.ssh/authorized_keys
-
-    chown -R backup:backup /home/backup/.ssh
-    chmod 700 /home/backup/.ssh
-    chmod 600 /home/backup/.ssh/authorized_keys
-
-    msg_ok "SSH access configured for backup user"
-    ;;
-  3)
-    if [[ "${PHS_SILENT:-0}" == "1" ]]; then
-      msg_warn "Enabling password authentication requires interactive mode, skipping."
-      exit
-    fi
-
-    msg_info "Enabling password authentication for backup user"
-    msg_warn "Password authentication is less secure than using SSH keys. Consider using SSH keys instead."
-    passwd backup
-    sed -i 's/^#*\s*PasswordAuthentication\s\+\(yes\|no\)/PasswordAuthentication yes/' /etc/ssh/sshd_config
-    rc-service sshd restart
-    msg_ok "Password authentication enabled for backup user"
-    ;;
-  4)
-    msg_info "Disabling password authentication for backup user"
-    sed -i 's/^#*\s*PasswordAuthentication\s\+\(yes\|no\)/PasswordAuthentication no/' /etc/ssh/sshd_config
-    rc-service sshd restart
-    msg_ok "Password authentication disabled for backup user"
-    ;;
-  esac
-
-  exit 0
-}
-
-start
-build_container
-description
-
-msg_ok "Completed successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Connection information:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}ssh backup@${IP}${CL}"
-echo -e "${TAB}${VERIFYPW}${YW}To set SSH key, run this script with the 'update' option and select option 2${CL}"

ct/convertx.sh

@@ -24,7 +24,7 @@ function update_script() {
   header_info
   check_container_storage
   check_container_resources
-  if [[ ! -d /opt/convertx ]]; then
+  if [[ ! -d /var ]]; then
     msg_error "No ${APP} Installation Found!"
     exit
   fi
@@ -33,8 +33,6 @@ function update_script() {
     systemctl stop convertx
     msg_info "Stopped Service"
 
-    ensure_dependencies libreoffice-writer
-
     msg_info "Move data-Folder"
     if [[ -d /opt/convertx/data ]]; then
       mv /opt/convertx/data /opt/data

ct/headers/alpine-borgbackup-server

@@ -1,6 +0,0 @@
-    ___    __      _                  ____                   ____             __                    _____                          
-   /   |  / /___  (_)___  ___        / __ )____  _________ _/ __ )____ ______/ /____  ______       / ___/___  ______   _____  _____
-  / /| | / / __ \/ / __ \/ _ \______/ __  / __ \/ ___/ __ `/ __  / __ `/ ___/ //_/ / / / __ \______\__ \/ _ \/ ___/ | / / _ \/ ___/
- / ___ |/ / /_/ / / / / /  __/_____/ /_/ / /_/ / /  / /_/ / /_/ / /_/ / /__/ ,< / /_/ / /_/ /_____/__/ /  __/ /   | |/ /  __/ /    
-/_/  |_/_/ .___/_/_/ /_/\___/     /_____/\____/_/   \__, /_____/\__,_/\___/_/|_|\__,_/ .___/     /____/\___/_/    |___/\___/_/     
-        /_/                                        /____/                           /_/                                            

ct/immich.sh

@@ -263,6 +263,16 @@ EOF
     [[ ! -f /usr/bin/immich ]] && ln -sf "$APP_DIR"/cli/bin/immich /usr/bin/immich
     [[ ! -f /usr/bin/immich-admin ]] && ln -sf "$APP_DIR"/bin/immich-admin /usr/bin/immich-admin
 
+    if ! grep -q '^DB_HOSTNAME=' "$INSTALL_DIR"/.env; then
+      sed -i '/^DB_DATABASE_NAME/a DB_HOSTNAME=127.0.0.1' "$INSTALL_DIR"/.env
+    fi
+
+    if grep -q 'ExecStart=/usr/bin/node' /etc/systemd/system/immich-web.service; then
+      sed -i '/^EnvironmentFile=/d' /etc/systemd/system/immich-web.service
+      sed -i "s|^ExecStart=.*|ExecStart=${APP_DIR}/bin/start.sh|" /etc/systemd/system/immich-web.service
+      systemctl daemon-reload
+    fi
+
     chown -R immich:immich "$INSTALL_DIR"
     if [[ "${MAINT_MODE:-0}" == 1 ]]; then
       msg_info "Disabling Maintenance Mode"

ct/kometa.sh

@@ -61,5 +61,5 @@ description
 
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access Kometa Quickstart:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:7171${CL}"
+echo -e "${INFO}${YW} Access the LXC at following IP address:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}${IP}${CL}"

ct/nginxproxymanager.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
 # Copyright (c) 2021-2026 community-scripts ORG
-# Author: tteck (tteckster) | Co-Author: CrazyWolf13, MickLesk (CanbiZ)
+# Author: tteck (tteckster) | Co-Author: CrazyWolf13
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://nginxproxymanager.com/ | Github: https://github.com/NginxProxyManager/nginx-proxy-manager
 
@@ -38,8 +38,8 @@ function update_script() {
     CURRENT_NODE_VERSION=$(node --version | cut -d'v' -f2 | cut -d'.' -f1)
     if [[ "$CURRENT_NODE_VERSION" != "22" ]]; then
       systemctl stop openresty
-      $STD apt purge -y nodejs npm
-      $STD apt autoremove -y
+      apt-get purge -y nodejs npm
+      apt-get autoremove -y
       rm -rf /usr/local/bin/node /usr/local/bin/npm
       rm -rf /usr/local/lib/node_modules
       rm -rf ~/.npm
@@ -49,150 +49,92 @@ function update_script() {
 
   NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
 
-  if dpkg -s openresty &>/dev/null 2>&1; then
-    msg_info "Migrating from packaged OpenResty to source"
-    rm -f /etc/apt/trusted.gpg.d/openresty-archive-keyring.gpg /etc/apt/trusted.gpg.d/openresty.gpg
-    rm -f /etc/apt/sources.list.d/openresty.list /etc/apt/sources.list.d/openresty.sources
-    $STD apt remove -y openresty
-    $STD apt autoremove -y
-    rm -f ~/.openresty
-    msg_ok "Migrated from packaged OpenResty to source"
+  RELEASE=$(curl -fsSL https://api.github.com/repos/NginxProxyManager/nginx-proxy-manager/releases/latest |
+    grep "tag_name" |
+    awk '{print substr($2, 3, length($2)-4) }')
+
+  CLEAN_INSTALL=1 fetch_and_deploy_gh_release "nginxproxymanager" "NginxProxyManager/nginx-proxy-manager" "tarball" "v${RELEASE}" "/opt/nginxproxymanager"
+  
+  msg_info "Stopping Services"
+  systemctl stop openresty
+  systemctl stop npm
+  msg_ok "Stopped Services"
+
+  msg_info "Cleaning old files"
+  $STD rm -rf /app \
+    /var/www/html \
+    /etc/nginx \
+    /var/log/nginx \
+    /var/lib/nginx \
+    /var/cache/nginx
+  msg_ok "Cleaned old files"
+
+  msg_info "Setting up Environment"
+  ln -sf /usr/bin/python3 /usr/bin/python
+  ln -sf /usr/local/openresty/nginx/sbin/nginx /usr/sbin/nginx
+  ln -sf /usr/local/openresty/nginx/ /etc/nginx
+  sed -i "s|\"version\": \"2.0.0\"|\"version\": \"$RELEASE\"|" /opt/nginxproxymanager/backend/package.json
+  sed -i "s|\"version\": \"2.0.0\"|\"version\": \"$RELEASE\"|" /opt/nginxproxymanager/frontend/package.json
+  sed -i 's+^daemon+#daemon+g' /opt/nginxproxymanager/docker/rootfs/etc/nginx/nginx.conf
+  NGINX_CONFS=$(find /opt/nginxproxymanager -type f -name "*.conf")
+  for NGINX_CONF in $NGINX_CONFS; do
+    sed -i 's+include conf.d+include /etc/nginx/conf.d+g' "$NGINX_CONF"
+  done
+
+  mkdir -p /var/www/html /etc/nginx/logs
+  cp -r /opt/nginxproxymanager/docker/rootfs/var/www/html/* /var/www/html/
+  cp -r /opt/nginxproxymanager/docker/rootfs/etc/nginx/* /etc/nginx/
+  cp /opt/nginxproxymanager/docker/rootfs/etc/letsencrypt.ini /etc/letsencrypt.ini
+  cp /opt/nginxproxymanager/docker/rootfs/etc/logrotate.d/nginx-proxy-manager /etc/logrotate.d/nginx-proxy-manager
+  ln -sf /etc/nginx/nginx.conf /etc/nginx/conf/nginx.conf
+  rm -f /etc/nginx/conf.d/dev.conf
+
+  mkdir -p /tmp/nginx/body \
+    /run/nginx \
+    /data/nginx \
+    /data/custom_ssl \
+    /data/logs \
+    /data/access \
+    /data/nginx/default_host \
+    /data/nginx/default_www \
+    /data/nginx/proxy_host \
+    /data/nginx/redirection_host \
+    /data/nginx/stream \
+    /data/nginx/dead_host \
+    /data/nginx/temp \
+    /var/lib/nginx/cache/public \
+    /var/lib/nginx/cache/private \
+    /var/cache/nginx/proxy_temp
+
+  chmod -R 777 /var/cache/nginx
+  chown root /tmp/nginx
+
+  echo resolver "$(awk 'BEGIN{ORS=" "} $1=="nameserver" {print ($2 ~ ":")? "["$2"]": $2}' /etc/resolv.conf);" >/etc/nginx/conf.d/include/resolvers.conf
+
+  if [ ! -f /data/nginx/dummycert.pem ] || [ ! -f /data/nginx/dummykey.pem ]; then
+    $STD openssl req -new -newkey rsa:2048 -days 3650 -nodes -x509 -subj "/O=Nginx Proxy Manager/OU=Dummy Certificate/CN=localhost" -keyout /data/nginx/dummykey.pem -out /data/nginx/dummycert.pem
   fi
 
-  local pcre_pkg="libpcre3-dev"
-  if grep -qE 'VERSION_ID="1[3-9]"' /etc/os-release 2>/dev/null; then
-    pcre_pkg="libpcre2-dev"
-  fi
-  $STD apt install -y build-essential "$pcre_pkg" libssl-dev zlib1g-dev
+  mkdir -p /app/frontend/images
+  cp -r /opt/nginxproxymanager/backend/* /app
+  msg_ok "Set up Environment"
 
-  if check_for_gh_release "openresty" "openresty/openresty"; then
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "openresty" "openresty/openresty" "prebuild" "${CHECK_UPDATE_RELEASE}" "/opt/openresty" "openresty-*.tar.gz"
+  msg_info "Building Frontend"
+  export NODE_OPTIONS="--max_old_space_size=2048 --openssl-legacy-provider"
+  cd /opt/nginxproxymanager/frontend
+  # Replace node-sass with sass in package.json before installation
+  sed -E -i 's/"node-sass" *: *"([^"]*)"/"sass": "\1"/g' package.json
+  $STD yarn install --network-timeout 600000
+  $STD yarn locale-compile
+  $STD yarn build
+  cp -r /opt/nginxproxymanager/frontend/dist/* /app/frontend
+  cp -r /opt/nginxproxymanager/frontend/public/images/* /app/frontend/images
+  msg_ok "Built Frontend"
 
-    msg_info "Building OpenResty"
-    cd /opt/openresty
-    $STD ./configure \
-      --with-http_v2_module \
-      --with-http_realip_module \
-      --with-http_stub_status_module \
-      --with-http_ssl_module \
-      --with-http_sub_module \
-      --with-http_auth_request_module \
-      --with-pcre-jit \
-      --with-stream \
-      --with-stream_ssl_module
-    $STD make -j"$(nproc)"
-    $STD make install
-    rm -rf /opt/openresty
-    cat <<'EOF' >/lib/systemd/system/openresty.service
-[Unit]
-Description=The OpenResty Application Platform
-After=syslog.target network-online.target remote-fs.target nss-lookup.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-ExecStartPre=/usr/local/openresty/nginx/sbin/nginx -t
-ExecStart=/usr/local/openresty/nginx/sbin/nginx -g 'daemon off;'
-
-[Install]
-WantedBy=multi-user.target
-EOF
-    systemctl daemon-reload
-    systemctl restart openresty
-    msg_ok "Built OpenResty"
-  fi
-
-  cd /root
-  if [ -d /opt/certbot ]; then
-    msg_info "Updating Certbot"
-    $STD /opt/certbot/bin/pip install --upgrade pip setuptools wheel
-    $STD /opt/certbot/bin/pip install --upgrade certbot certbot-dns-cloudflare
-    msg_ok "Updated Certbot"
-  fi
-
-  if check_for_gh_release "nginxproxymanager" "NginxProxyManager/nginx-proxy-manager"; then
-    msg_info "Stopping Services"
-    systemctl stop openresty
-    systemctl stop npm
-    msg_ok "Stopped Services"
-
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "nginxproxymanager" "NginxProxyManager/nginx-proxy-manager" "tarball" "${CHECK_UPDATE_RELEASE}" "/opt/nginxproxymanager"
-
-    msg_info "Cleaning old files"
-    $STD rm -rf /app \
-      /var/www/html \
-      /etc/nginx \
-      /var/log/nginx \
-      /var/lib/nginx \
-      /var/cache/nginx
-    msg_ok "Cleaned old files"
-
-    local RELEASE="${CHECK_UPDATE_RELEASE#v}"
-    msg_info "Setting up Environment"
-    ln -sf /usr/bin/python3 /usr/bin/python
-    ln -sf /usr/local/openresty/nginx/sbin/nginx /usr/sbin/nginx
-    ln -sf /usr/local/openresty/nginx/ /etc/nginx
-    sed -i "0,/\"version\": \"[^\"]*\"/s|\"version\": \"[^\"]*\"|\"version\": \"$RELEASE\"|" /opt/nginxproxymanager/backend/package.json
-    sed -i "0,/\"version\": \"[^\"]*\"/s|\"version\": \"[^\"]*\"|\"version\": \"$RELEASE\"|" /opt/nginxproxymanager/frontend/package.json
-    sed -i 's+^daemon+#daemon+g' /opt/nginxproxymanager/docker/rootfs/etc/nginx/nginx.conf
-    NGINX_CONFS=$(find /opt/nginxproxymanager -type f -name "*.conf")
-    for NGINX_CONF in $NGINX_CONFS; do
-      sed -i 's+include conf.d+include /etc/nginx/conf.d+g' "$NGINX_CONF"
-    done
-
-    mkdir -p /var/www/html /etc/nginx/logs
-    cp -r /opt/nginxproxymanager/docker/rootfs/var/www/html/* /var/www/html/
-    cp -r /opt/nginxproxymanager/docker/rootfs/etc/nginx/* /etc/nginx/
-    cp /opt/nginxproxymanager/docker/rootfs/etc/letsencrypt.ini /etc/letsencrypt.ini
-    cp /opt/nginxproxymanager/docker/rootfs/etc/logrotate.d/nginx-proxy-manager /etc/logrotate.d/nginx-proxy-manager
-    ln -sf /etc/nginx/nginx.conf /etc/nginx/conf/nginx.conf
-    rm -f /etc/nginx/conf.d/dev.conf
-
-    mkdir -p /tmp/nginx/body \
-      /run/nginx \
-      /data/nginx \
-      /data/custom_ssl \
-      /data/logs \
-      /data/access \
-      /data/nginx/default_host \
-      /data/nginx/default_www \
-      /data/nginx/proxy_host \
-      /data/nginx/redirection_host \
-      /data/nginx/stream \
-      /data/nginx/dead_host \
-      /data/nginx/temp \
-      /var/lib/nginx/cache/public \
-      /var/lib/nginx/cache/private \
-      /var/cache/nginx/proxy_temp
-
-    chmod -R 777 /var/cache/nginx
-    chown root /tmp/nginx
-
-    echo resolver "$(awk 'BEGIN{ORS=" "} $1=="nameserver" {print ($2 ~ ":")? "["$2"]": $2}' /etc/resolv.conf);" >/etc/nginx/conf.d/include/resolvers.conf
-
-    if [ ! -f /data/nginx/dummycert.pem ] || [ ! -f /data/nginx/dummykey.pem ]; then
-      $STD openssl req -new -newkey rsa:2048 -days 3650 -nodes -x509 -subj "/O=Nginx Proxy Manager/OU=Dummy Certificate/CN=localhost" -keyout /data/nginx/dummykey.pem -out /data/nginx/dummycert.pem
-    fi
-
-    mkdir -p /app/frontend/images
-    cp -r /opt/nginxproxymanager/backend/* /app
-    msg_ok "Set up Environment"
-
-    msg_info "Building Frontend"
-    export NODE_OPTIONS="--max_old_space_size=2048 --openssl-legacy-provider"
-    cd /opt/nginxproxymanager/frontend
-    sed -E -i 's/"node-sass" *: *"([^"]*)"/"sass": "\1"/g' package.json
-    $STD yarn install --network-timeout 600000
-    $STD yarn locale-compile
-    $STD yarn build
-    cp -r /opt/nginxproxymanager/frontend/dist/* /app/frontend
-    cp -r /opt/nginxproxymanager/frontend/public/images/* /app/frontend/images
-    msg_ok "Built Frontend"
-
-    msg_info "Initializing Backend"
-    rm -rf /app/config/default.json
-    if [ ! -f /app/config/production.json ]; then
-      cat <<'EOF' >/app/config/production.json
+  msg_info "Initializing Backend"
+  rm -rf /app/config/default.json
+  if [ ! -f /app/config/production.json ]; then
+    cat <<'EOF' >/app/config/production.json
 {
   "database": {
     "engine": "knex-native",
@@ -206,21 +148,40 @@ EOF
   }
 }
 EOF
-    fi
-    sed -i 's/"client": "sqlite3"/"client": "better-sqlite3"/' /app/config/production.json
-    cd /app
-    $STD yarn install --network-timeout 600000
-    msg_ok "Initialized Backend"
-
-    msg_info "Starting Services"
-    sed -i 's/user npm/user root/g; s/^pid/#pid/g' /usr/local/openresty/nginx/conf/nginx.conf
-    sed -r -i 's/^([[:space:]]*)su npm npm/\1#su npm npm/g;' /etc/logrotate.d/nginx-proxy-manager
-    systemctl daemon-reload
-    systemctl enable -q --now openresty
-    systemctl enable -q --now npm
-    msg_ok "Started Services"
-    msg_ok "Updated successfully!"
   fi
+  sed -i 's/"client": "sqlite3"/"client": "better-sqlite3"/' /app/config/production.json
+  cd /app 
+  $STD yarn install --network-timeout 600000
+  msg_ok "Initialized Backend"
+
+  msg_info "Updating Certbot"
+  [ -f /etc/apt/trusted.gpg.d/openresty-archive-keyring.gpg ] && rm -f /etc/apt/trusted.gpg.d/openresty-archive-keyring.gpg
+  [ -f /etc/apt/sources.list.d/openresty.list ] && rm -f /etc/apt/sources.list.d/openresty.list
+  [ ! -f /etc/apt/trusted.gpg.d/openresty.gpg ] && curl -fsSL https://openresty.org/package/pubkey.gpg | gpg --dearmor --yes -o /etc/apt/trusted.gpg.d/openresty.gpg
+  [ ! -f /etc/apt/sources.list.d/openresty.sources ] && cat <<'EOF' >/etc/apt/sources.list.d/openresty.sources
+Types: deb
+URIs: http://openresty.org/package/debian/
+Suites: bookworm
+Components: openresty
+Signed-By: /etc/apt/trusted.gpg.d/openresty.gpg
+EOF
+  $STD apt update
+  $STD apt -y install openresty
+  if [ -d /opt/certbot ]; then
+    $STD /opt/certbot/bin/pip install --upgrade pip setuptools wheel
+    $STD /opt/certbot/bin/pip install --upgrade certbot certbot-dns-cloudflare
+  fi
+  msg_ok "Updated Certbot"
+
+  msg_info "Starting Services"
+  sed -i 's/user npm/user root/g; s/^pid/#pid/g' /usr/local/openresty/nginx/conf/nginx.conf
+  sed -r -i 's/^([[:space:]]*)su npm npm/\1#su npm npm/g;' /etc/logrotate.d/nginx-proxy-manager
+  systemctl enable -q --now openresty
+  systemctl enable -q --now npm
+  systemctl restart openresty
+  msg_ok "Started Services"
+
+  msg_ok "Updated successfully!"
   exit
 }
 

ct/part-db.sh

@@ -27,27 +27,36 @@ function update_script() {
     msg_error "No ${APP} Installation Found!"
     exit
   fi
-
+  
+  RELEASE=$(get_latest_github_release "Part-DB/Part-DB-server")
   if check_for_gh_release "partdb" "Part-DB/Part-DB-server"; then
     msg_info "Stopping Service"
     systemctl stop apache2
     msg_ok "Stopped Service"
 
+    msg_info "Updating $APP to v${RELEASE}"
+    cd /opt
     mv /opt/partdb/ /opt/partdb-backup
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "partdb" "Part-DB/Part-DB-server" "prebuild" "latest" "/opt/partdb" "partdb_with_assets.zip"
+    curl -fsSL "https://github.com/Part-DB/Part-DB-server/archive/refs/tags/v${RELEASE}.zip" -o "/opt/v${RELEASE}.zip"
+    $STD unzip "v${RELEASE}.zip"
+    mv /opt/Part-DB-server-${RELEASE}/ /opt/partdb
 
-    msg_info "Updating Part-DB"
     cd /opt/partdb/
-    cp -r /opt/partdb-backup/.env.local /opt/partdb/
-    cp -r /opt/partdb-backup/public/media /opt/partdb/public/
-    cp -r /opt/partdb-backup/config/banner.md /opt/partdb/config/
+    cp -r "/opt/partdb-backup/.env.local" /opt/partdb/
+    cp -r "/opt/partdb-backup/public/media" /opt/partdb/public/
+    cp -r "/opt/partdb-backup/config/banner.md" /opt/partdb/config/
+
     export COMPOSER_ALLOW_SUPERUSER=1
     $STD composer install --no-dev -o --no-interaction
+    $STD yarn install
+    $STD yarn build
     $STD php bin/console cache:clear
     $STD php bin/console doctrine:migrations:migrate -n
     chown -R www-data:www-data /opt/partdb
+    rm -r "/opt/v${RELEASE}.zip"
     rm -r /opt/partdb-backup
-    msg_ok "Updated Part-DB"
+    echo "${RELEASE}" >~/.partdb
+    msg_ok "Updated $APP to v${RELEASE}"
 
     msg_info "Starting Service"
     systemctl start apache2

ct/tracearr.sh

@@ -8,7 +8,7 @@ source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxV
 APP="Tracearr"
 var_tags="${var_tags:-media}"
 var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-8192}"
+var_ram="${var_ram:-4096}"
 var_disk="${var_disk:-10}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
@@ -102,7 +102,7 @@ EOF
 
   if check_for_gh_release "tracearr" "connorgallopo/Tracearr"; then
     msg_info "Stopping Services"
-    systemctl stop tracearr postgresql redis-server
+    systemctl stop tracearr postgresql redis
     msg_ok "Stopped Services"
 
     msg_info "Updating pnpm"
@@ -115,7 +115,6 @@ EOF
 
     msg_info "Building Tracearr"
     export TZ=$(cat /etc/timezone)
-    export NODE_OPTIONS="--max-old-space-size=4096"
     cd /opt/tracearr.build
     $STD pnpm install --frozen-lockfile --force
     $STD pnpm turbo telemetry disable
@@ -149,7 +148,7 @@ EOF
     msg_ok "Configured Tracearr"
 
     msg_info "Starting services"
-    systemctl start postgresql redis-server tracearr
+    systemctl start postgresql redis tracearr
     msg_ok "Started services"
     msg_ok "Updated successfully!"
   else

install/adventurelog-install.sh

@@ -62,7 +62,6 @@ $STD uv venv --clear /opt/adventurelog/backend/server/.venv
 $STD /opt/adventurelog/backend/server/.venv/bin/python -m ensurepip --upgrade
 $STD /opt/adventurelog/backend/server/.venv/bin/python -m pip install --upgrade pip
 $STD /opt/adventurelog/backend/server/.venv/bin/python -m pip install -r requirements.txt
-$STD /opt/adventurelog/backend/server/.venv/bin/python -m pip install 'djangorestframework<3.15'
 $STD /opt/adventurelog/backend/server/.venv/bin/python -m manage collectstatic --noinput
 $STD /opt/adventurelog/backend/server/.venv/bin/python -m manage migrate
 $STD /opt/adventurelog/backend/server/.venv/bin/python -m manage download-countries

install/alpine-borgbackup-server-install.sh

@@ -1,34 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: Sander Koenders (sanderkoenders)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://www.borgbackup.org/
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-msg_info "Installing BorgBackup"
-$STD apk add --no-cache borgbackup openssh
-$STD rc-update add sshd
-$STD rc-service sshd start
-msg_ok "Installed BorgBackup"
-
-msg_info "Creating backup user"
-$STD adduser -D -s /bin/bash -h /home/backup backup
-$STD passwd -d backup
-msg_ok "Created backup user"
-
-msg_info "Configure SSH, disabling password authentication and enabling public key authentication"
-$STD sed -i -e 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
-$STD rc-service sshd restart
-msg_ok "Configured SSH"
-
-motd_ssh
-customize
-cleanup_lxc

install/convertx-install.sh

@@ -24,7 +24,6 @@ $STD apt install -y \
   dvisvgm \
   ffmpeg \
   inkscape \
-  libreoffice-writer \
   libva2 \
   libvips-tools \
   lmodern \

install/immich-install.sh

@@ -469,8 +469,7 @@ User=immich
 Group=immich
 UMask=0077
 WorkingDirectory=${APP_DIR}
-EnvironmentFile=${INSTALL_DIR}/.env
-ExecStart=/usr/bin/node ${APP_DIR}/dist/main
+ExecStart=${APP_DIR}/bin/start.sh
 Restart=on-failure
 SyslogIdentifier=immich-web
 StandardOutput=append:/var/log/immich/web.log

install/isponsorblocktv-install.sh

@@ -13,11 +13,6 @@ setting_up_container
 network_check
 update_os
 
-if ! grep -q ' avx ' /proc/cpuinfo 2>/dev/null; then
-  msg_error "CPU does not support AVX instructions (required by iSponsorBlockTV/PyApp)"
-  exit 106
-fi
-
 fetch_and_deploy_gh_release "isponsorblocktv" "dmunozv04/iSponsorBlockTV" "singlefile" "latest" "/opt/isponsorblocktv" "iSponsorBlockTV-x86_64-linux"
 
 msg_info "Setting up iSponsorBlockTV"

install/kometa-install.sh

@@ -23,20 +23,12 @@ mkdir -p config/assets
 cp config/config.yml.template config/config.yml
 msg_ok "Setup Kometa"
 
-read -r -p "${TAB3}Enter your TMDb API key: " TMDBKEY
-read -r -p "${TAB3}Enter your Plex URL: " PLEXURL
-read -r -p "${TAB3}Enter your Plex token: " PLEXTOKEN
-sed -i '/^plex:/,/^[^ ]/{s|  url:.*|  url: '"$PLEXURL"'|}' /opt/kometa/config/config.yml
-sed -i '/^plex:/,/^[^ ]/{s|  token:.*|  token: '"$PLEXTOKEN"'|}' /opt/kometa/config/config.yml
-sed -i '/^tmdb:/,/^[^ ]/{s|  apikey:.*|  apikey: '"$TMDBKEY"'|}' /opt/kometa/config/config.yml
-
-fetch_and_deploy_gh_release "kometa-quickstart" "Kometa-Team/Quickstart" "tarball"
-
-msg_info "Installing Kometa Quickstart"
-cd /opt/kometa-quickstart
-$STD uv venv /opt/kometa-quickstart/.venv
-$STD /opt/kometa-quickstart/.venv/bin/python -m pip install -r requirements.txt
-msg_ok "Installed Kometa Quickstart"
+read -p "${TAB3}Enter your TMDb API key: " TMDBKEY
+read -p "${TAB3}Enter your Plex URL: " PLEXURL
+read -p "${TAB3}Enter your Plex token: " PLEXTOKEN
+sed -i -e "s#url: http://192.168.1.12:32400#url: $PLEXURL #g" /opt/kometa/config/config.yml
+sed -i -e "s/token: ####################/token: $PLEXTOKEN/g" /opt/kometa/config/config.yml
+sed -i -e "s/apikey: ################################/apikey: $TMDBKEY/g" /opt/kometa/config/config.yml
 
 msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/kometa.service
@@ -54,22 +46,7 @@ RestartSec=30
 [Install]
 WantedBy=multi-user.target
 EOF
-cat <<EOF >/etc/systemd/system/kometa-quickstart.service
-[Unit]
-Description=Kometa Quickstart
-After=network-online.target
-
-[Service]
-Type=simple
-WorkingDirectory=/opt/kometa-quickstart
-ExecStart=/opt/kometa-quickstart/.venv/bin/python quickstart.py
-Restart=always
-RestartSec=10
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now kometa kometa-quickstart
+systemctl enable -q --now kometa
 msg_ok "Created Service"
 
 motd_ssh

install/nginxproxymanager-install.sh

@@ -14,20 +14,23 @@ network_check
 update_os
 
 msg_info "Installing Dependencies"
-$STD apt install -y \
+$STD apt update
+$STD apt -y install \
+  ca-certificates \
   apache2-utils \
   logrotate \
   build-essential \
-  libpcre3-dev \
-  libssl-dev \
-  zlib1g-dev \
-  git \
+  git
+msg_ok "Installed Dependencies"
+
+msg_info "Installing Python Dependencies"
+$STD apt install -y \
   python3 \
   python3-dev \
   python3-pip \
   python3-venv \
   python3-cffi
-msg_ok "Installed Dependencies"
+msg_ok "Installed Python Dependencies"
 
 msg_info "Setting up Certbot"
 $STD python3 -m venv /opt/certbot
@@ -36,50 +39,33 @@ $STD /opt/certbot/bin/pip install certbot certbot-dns-cloudflare
 ln -sf /opt/certbot/bin/certbot /usr/local/bin/certbot
 msg_ok "Set up Certbot"
 
-fetch_and_deploy_gh_release "openresty" "openresty/openresty" "prebuild" "latest" "/opt/openresty" "openresty-*.tar.gz"
-
-msg_info "Building OpenResty"
-cd /opt/openresty
-$STD ./configure \
-  --with-http_v2_module \
-  --with-http_realip_module \
-  --with-http_stub_status_module \
-  --with-http_ssl_module \
-  --with-http_sub_module \
-  --with-http_auth_request_module \
-  --with-pcre-jit \
-  --with-stream \
-  --with-stream_ssl_module
-$STD make -j"$(nproc)"
-$STD make install
-rm -rf /opt/openresty
-
-cat <<'EOF' >/lib/systemd/system/openresty.service
-[Unit]
-Description=The OpenResty Application Platform
-After=syslog.target network-online.target remote-fs.target nss-lookup.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-ExecStartPre=/usr/local/openresty/nginx/sbin/nginx -t
-ExecStart=/usr/local/openresty/nginx/sbin/nginx -g 'daemon off;'
-
-[Install]
-WantedBy=multi-user.target
+msg_info "Installing Openresty"
+curl -fsSL "https://openresty.org/package/pubkey.gpg" | gpg --dearmor -o /etc/apt/trusted.gpg.d/openresty.gpg
+cat <<'EOF' >/etc/apt/sources.list.d/openresty.sources
+Types: deb
+URIs: http://openresty.org/package/debian/
+Suites: bookworm
+Components: openresty
+Signed-By: /etc/apt/trusted.gpg.d/openresty.gpg
 EOF
-msg_ok "Built OpenResty"
+$STD apt update
+$STD apt -y install openresty
+msg_ok "Installed Openresty"
 
 NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
-RELEASE=$(get_latest_github_release "NginxProxyManager/nginx-proxy-manager")
+
+RELEASE=$(curl -fsSL https://api.github.com/repos/NginxProxyManager/nginx-proxy-manager/releases/latest |
+  grep "tag_name" |
+  awk '{print substr($2, 3, length($2)-4) }')
+
 fetch_and_deploy_gh_release "nginxproxymanager" "NginxProxyManager/nginx-proxy-manager" "tarball" "v${RELEASE}"
 
 msg_info "Setting up Environment"
 ln -sf /usr/bin/python3 /usr/bin/python
 ln -sf /usr/local/openresty/nginx/sbin/nginx /usr/sbin/nginx
 ln -sf /usr/local/openresty/nginx/ /etc/nginx
-sed -i "0,/\"version\": \"[^\"]*\"/s|\"version\": \"[^\"]*\"|\"version\": \"$RELEASE\"|" /opt/nginxproxymanager/backend/package.json
-sed -i "0,/\"version\": \"[^\"]*\"/s|\"version\": \"[^\"]*\"|\"version\": \"$RELEASE\"|" /opt/nginxproxymanager/frontend/package.json
+sed -i "s|\"version\": \"2.0.0\"|\"version\": \"$RELEASE\"|" /opt/nginxproxymanager/backend/package.json
+sed -i "s|\"version\": \"2.0.0\"|\"version\": \"$RELEASE\"|" /opt/nginxproxymanager/frontend/package.json
 sed -i 's+^daemon+#daemon+g' /opt/nginxproxymanager/docker/rootfs/etc/nginx/nginx.conf
 NGINX_CONFS=$(find /opt/nginxproxymanager -type f -name "*.conf")
 for NGINX_CONF in $NGINX_CONFS; do
@@ -183,6 +169,7 @@ sed -i 's/user npm/user root/g; s/^pid/#pid/g' /usr/local/openresty/nginx/conf/n
 sed -r -i 's/^([[:space:]]*)su npm npm/\1#su npm npm/g;' /etc/logrotate.d/nginx-proxy-manager
 systemctl enable -q --now openresty
 systemctl enable -q --now npm
+systemctl restart openresty
 msg_ok "Started Services"
 
 motd_ssh

install/part-db-install.sh

@@ -13,19 +13,27 @@ setting_up_container
 network_check
 update_os
 
+NODE_VERSION="22" NODE_MODULE="yarn@latest" setup_nodejs
 PG_VERSION="16" setup_postgresql
 PG_DB_NAME="partdb" PG_DB_USER="partdb" setup_postgresql_db
 PHP_VERSION="8.4" PHP_APACHE="YES" PHP_MODULE="xsl" PHP_POST_MAX_SIZE="100M" PHP_UPLOAD_MAX_FILESIZE="100M" setup_php
 setup_composer
 
-fetch_and_deploy_gh_release "partdb" "Part-DB/Part-DB-server" "prebuild" "latest" "/opt/partdb" "partdb_with_assets.zip"
+msg_info "Installing Part-DB (Patience)"
+cd /opt
+RELEASE=$(get_latest_github_release "Part-DB/Part-DB-server")
+curl -fsSL "https://github.com/Part-DB/Part-DB-server/archive/refs/tags/v${RELEASE}.zip" -o "/opt/v${RELEASE}.zip"
+$STD unzip "v${RELEASE}.zip"
+mv /opt/Part-DB-server-${RELEASE}/ /opt/partdb
 
-msg_info "Installing Part-DB"
 cd /opt/partdb/
 cp .env .env.local
 sed -i "s|DATABASE_URL=\"sqlite:///%kernel.project_dir%/var/app.db\"|DATABASE_URL=\"postgresql://${PG_DB_USER}:${PG_DB_PASS}@127.0.0.1:5432/${PG_DB_NAME}?serverVersion=12.19&charset=utf8\"|" .env.local
+
 export COMPOSER_ALLOW_SUPERUSER=1
 $STD composer install --no-dev -o --no-interaction
+$STD yarn install
+$STD yarn build
 $STD php bin/console cache:clear
 php bin/console doctrine:migrations:migrate -n >~/database-migration-output
 chown -R www-data:www-data /opt/partdb
@@ -36,6 +44,8 @@ ADMIN_PASS=$(grep -oP 'The initial password for the "admin" user is: \K\w+' ~/da
   echo "Part-DB Admin Password: $ADMIN_PASS"
 } >>~/partdb.creds
 rm -rf ~/database-migration-output
+rm -rf "/opt/v${RELEASE}.zip"
+echo "${RELEASE}" >~/.partdb
 msg_ok "Installed Part-DB"
 
 msg_info "Creating Service"

install/shinobi-install.sh

@@ -35,7 +35,7 @@ cd Shinobi
 gitVersionNumber=$(git rev-parse HEAD)
 theDateRightNow=$(date)
 touch version.json
-chmod 644 version.json
+chmod 777 version.json
 echo '{"Product" : "'"Shinobi"'" , "Branch" : "'"master"'" , "Version" : "'"$gitVersionNumber"'" , "Date" : "'"$theDateRightNow"'" , "Repository" : "'"https://gitlab.com/Shinobi-Systems/Shinobi.git"'"}' >version.json
 msg_ok "Cloned Shinobi"
 

install/tasmoadmin-install.sh

@@ -23,7 +23,7 @@ fetch_and_deploy_gh_release "tasmoadmin" "TasmoAdmin/TasmoAdmin" "prebuild" "lat
 msg_info "Configuring TasmoAdmin"
 rm -rf /etc/php/8.4/apache2/conf.d/10-opcache.ini
 chown -R www-data:www-data /var/www/tasmoadmin
-chmod 775 /var/www/tasmoadmin/tmp /var/www/tasmoadmin/data
+chmod 777 /var/www/tasmoadmin/tmp /var/www/tasmoadmin/data
 cat <<EOF >/etc/apache2/sites-available/tasmoadmin.conf
 <VirtualHost *:9999>
 	ServerName tasmoadmin

install/tracearr-install.sh

@@ -62,7 +62,6 @@ fetch_and_deploy_gh_release "tracearr" "connorgallopo/Tracearr" "tarball" "lates
 
 msg_info "Building Tracearr"
 export TZ=$(cat /etc/timezone)
-export NODE_OPTIONS="--max-old-space-size=4096"
 cd /opt/tracearr.build
 $STD pnpm install --frozen-lockfile --force
 $STD pnpm turbo telemetry disable

misc/alpine-install.func

@@ -90,18 +90,11 @@ setting_up_container() {
 network_check() {
   set +e
   trap - ERR
-  ipv4_connected=false
-
-  # Check IPv4 connectivity to Cloudflare, Google & Quad9 DNS servers
   if ping -c 1 -W 1 1.1.1.1 &>/dev/null || ping -c 1 -W 1 8.8.8.8 &>/dev/null || ping -c 1 -W 1 9.9.9.9 &>/dev/null; then
-    msg_ok "IPv4 Internet Connected"
-    ipv4_connected=true
+    ipv4_status="${GN}✔${CL} IPv4"
   else
-    msg_error "IPv4 Internet Not Connected"
-  fi
-
-  if [[ $ipv4_connected == false ]]; then
-    read -r -p "No Internet detected, would you like to continue anyway? <y/N> " prompt
+    ipv4_status="${RD}✖${CL} IPv4"
+    read -r -p "Internet NOT connected. Continue anyway? <y/N> " prompt
     if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
       echo -e "${INFO}${RD}Expect Issues Without Internet${CL}"
     else
@@ -109,28 +102,12 @@ network_check() {
       exit 122
     fi
   fi
-
-  # DNS resolution checks for GitHub-related domains
-  GIT_HOSTS=("github.com" "raw.githubusercontent.com" "api.github.com" "git.community-scripts.org")
-  GIT_STATUS="Git DNS:"
-  DNS_FAILED=false
-
-  for HOST in "${GIT_HOSTS[@]}"; do
-    RESOLVEDIP=$(getent hosts "$HOST" | awk '{ print $1 }' | grep -E '(^([0-9]{1,3}\.){3}[0-9]{1,3}$)|(^[a-fA-F0-9:]+$)' | head -n1)
-    if [[ -z "$RESOLVEDIP" ]]; then
-      GIT_STATUS+="$HOST:($DNSFAIL)"
-      DNS_FAILED=true
-    else
-      GIT_STATUS+=" $HOST:($DNSOK)"
-    fi
-  done
-
-  if [[ "$DNS_FAILED" == true ]]; then
-    fatal "$GIT_STATUS"
+  RESOLVEDIP=$(getent hosts github.com | awk '{ print $1 }')
+  if [[ -z "$RESOLVEDIP" ]]; then
+    msg_error "Internet: ${ipv4_status}  DNS Failed"
   else
-    msg_ok "$GIT_STATUS"
+    msg_ok "Internet: ${ipv4_status}  DNS: ${BL}${RESOLVEDIP}${CL}"
   fi
-
   set -e
   trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
 }

misc/build.func

@@ -221,11 +221,6 @@ update_motd_ip() {
     local current_hostname="$(hostname)"
     local current_ip="$(hostname -I | awk '{print $1}')"
 
-    # Escape sed special chars in replacement strings (& \ |)
-    current_os="${current_os//\\/\\\\}"; current_os="${current_os//&/\\&}"
-    current_hostname="${current_hostname//\\/\\\\}"; current_hostname="${current_hostname//&/\\&}"
-    current_ip="${current_ip//\\/\\\\}"; current_ip="${current_ip//&/\\&}"
-
     # Update only if values actually changed
     if ! grep -q "OS:.*$current_os" "$PROFILE_FILE" 2>/dev/null; then
       sed -i "s|OS:.*|OS: \${GN}$current_os\${CL}\\\"|" "$PROFILE_FILE"
@@ -534,10 +529,6 @@ validate_gateway_in_subnet() {
   local ip="${static_ip%%/*}"
   local cidr="${static_ip##*/}"
 
-  # /31 and /32 are valid point-to-point / zero-trust DMZ configurations
-  # where the gateway is technically outside the subnet — skip validation
-  ((cidr >= 31)) && return 0
-
   # Convert CIDR to netmask bits
   local mask=$((0xFFFFFFFF << (32 - cidr) & 0xFFFFFFFF))
 
@@ -3553,10 +3544,8 @@ build_container() {
   auto) NET_STRING="$NET_STRING,ip6=auto" ;;
   dhcp) NET_STRING="$NET_STRING,ip6=dhcp" ;;
   static)
-    if [[ -n "$IPV6_ADDR" ]]; then
-      NET_STRING="$NET_STRING,ip6=$IPV6_ADDR"
-      [ -n "$IPV6_GATE" ] && NET_STRING="$NET_STRING,gw6=$IPV6_GATE"
-    fi
+    NET_STRING="$NET_STRING,ip6=$IPV6_ADDR"
+    [ -n "$IPV6_GATE" ] && NET_STRING="$NET_STRING,gw6=$IPV6_GATE"
     ;;
   none) ;;
   esac
@@ -4081,8 +4070,8 @@ EOF
   if [ "$var_os" == "alpine" ]; then
     sleep 3
     pct exec "$CTID" -- /bin/sh -c 'cat <<EOF >/etc/apk/repositories
-https://dl-cdn.alpinelinux.org/alpine/latest-stable/main
-https://dl-cdn.alpinelinux.org/alpine/latest-stable/community
+http://dl-cdn.alpinelinux.org/alpine/latest-stable/main
+http://dl-cdn.alpinelinux.org/alpine/latest-stable/community
 EOF'
     pct exec "$CTID" -- ash -c "apk add bash newt curl openssh nano mc ncurses jq" >>"$BUILD_LOG" 2>&1 || {
       msg_error "Failed to install base packages in Alpine container"
@@ -4091,9 +4080,7 @@ EOF'
   else
     sleep 3
     LANG=${LANG:-en_US.UTF-8}
-    local LANG_ESC="${LANG//./\\.}"
-    LANG_ESC="${LANG_ESC//|/\\|}"
-    pct exec "$CTID" -- bash -c "sed -i \"/$LANG_ESC/ s/^# //\" /etc/locale.gen"
+    pct exec "$CTID" -- bash -c "sed -i \"/$LANG/ s/^# //\" /etc/locale.gen"
     pct exec "$CTID" -- bash -c "locale_line=\$(grep -v '^#' /etc/locale.gen | grep -E '^[a-zA-Z]' | awk '{print \$1}' | head -n 1) && \
     echo LANG=\$locale_line >/etc/default/locale && \
     locale-gen >/dev/null && \
@@ -4766,10 +4753,6 @@ fix_gpu_gids() {
   pct stop "$CTID" >/dev/null 2>&1
   sleep 1
 
-  # Validate GIDs are numeric before sed
-  [[ "$render_gid" =~ ^[0-9]+$ ]] || render_gid="104"
-  [[ "$video_gid" =~ ^[0-9]+$ ]] || video_gid="44"
-
   # Update dev entries with correct GIDs
   sed -i.bak -E "s|(dev[0-9]+: /dev/dri/renderD[0-9]+),gid=[0-9]+|\1,gid=${render_gid}|g" "$LXC_CONFIG"
   sed -i -E "s|(dev[0-9]+: /dev/dri/card[0-9]+),gid=[0-9]+|\1,gid=${video_gid}|g" "$LXC_CONFIG"
@@ -5013,7 +4996,7 @@ create_lxc_container() {
       return 0
     fi
 
-    msg_warn "An update for the Proxmox LXC stack is available"
+    msg_info "An update for the Proxmox LXC stack is available"
     echo "  pve-container: installed=${_pvec_i:-n/a}  candidate=${_pvec_c:-n/a}"
     echo "  lxc-pve     : installed=${_lxcp_i:-n/a}  candidate=${_lxcp_c:-n/a}"
     echo

misc/install.func

@@ -309,14 +309,14 @@ customize() {
   if [[ "$PASSWORD" == "" ]]; then
     msg_info "Customizing Container"
     GETTY_OVERRIDE="/etc/systemd/system/container-getty@1.service.d/override.conf"
-    mkdir -p "$(dirname "$GETTY_OVERRIDE")"
-    cat <<EOF >"$GETTY_OVERRIDE"
+    mkdir -p $(dirname $GETTY_OVERRIDE)
+    cat <<EOF >$GETTY_OVERRIDE
   [Service]
   ExecStart=
   ExecStart=-/sbin/agetty --autologin root --noclear --keep-baud tty%I 115200,38400,9600 \$TERM
 EOF
     systemctl daemon-reload
-    systemctl restart "$(basename "$(dirname "$GETTY_OVERRIDE")" | sed 's/\.d//')"
+    systemctl restart $(basename $(dirname $GETTY_OVERRIDE) | sed 's/\.d//')
     msg_ok "Customized Container"
   fi
   echo "bash -c \"\$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/${app}.sh)\"" >/usr/bin/update

misc/tools.func

@@ -242,7 +242,7 @@ download_gpg_key() {
 
     # Process based on mode
     if [[ "$mode" == "dearmor" ]]; then
-      if gpg --dearmor --yes -o "$output" <"$temp_key" 2>/dev/null && [[ -s "$output" ]]; then
+      if gpg --dearmor --yes -o "$output" <"$temp_key" 2>/dev/null; then
         rm -f "$temp_key"
         debug_log "GPG key installed (dearmored): $output"
         return 0
@@ -5192,7 +5192,7 @@ _setup_gpu_permissions() {
     for nvidia_dev in /dev/nvidia*; do
       [[ -e "$nvidia_dev" ]] && {
         chgrp video "$nvidia_dev" 2>/dev/null || true
-        chmod 660 "$nvidia_dev" 2>/dev/null || true
+        chmod 666 "$nvidia_dev" 2>/dev/null || true
       }
     done
     if [[ -d /dev/nvidia-caps ]]; then
@@ -5200,7 +5200,7 @@ _setup_gpu_permissions() {
       for caps_dev in /dev/nvidia-caps/*; do
         [[ -e "$caps_dev" ]] && {
           chgrp video "$caps_dev" 2>/dev/null || true
-          chmod 660 "$caps_dev" 2>/dev/null || true
+          chmod 666 "$caps_dev" 2>/dev/null || true
         }
       done
     fi
@@ -5217,8 +5217,7 @@ _setup_gpu_permissions() {
 
   # /dev/kfd permissions (AMD ROCm)
   if [[ -e /dev/kfd ]]; then
-    chgrp render /dev/kfd 2>/dev/null || true
-    chmod 660 /dev/kfd 2>/dev/null || true
+    chmod 666 /dev/kfd 2>/dev/null || true
     msg_info "AMD ROCm compute device configured"
   fi
 

tools/addon/homebrew.sh

@@ -1,173 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MorganCSIT | MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://brew.sh | Github: https://github.com/Homebrew/brew
-
-if ! command -v curl &>/dev/null; then
-  printf "\r\e[2K%b" '\033[93m Setup Source \033[m' >&2
-  apt-get update >/dev/null 2>&1
-  apt-get install -y curl >/dev/null 2>&1
-fi
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/core.func)
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/tools.func)
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/error_handler.func)
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/api.func) 2>/dev/null || true
-
-# Enable error handling
-set -Eeuo pipefail
-trap 'error_handler' ERR
-load_functions
-init_tool_telemetry "" "addon"
-
-# ==============================================================================
-# CONFIGURATION
-# ==============================================================================
-VERBOSE=${var_verbose:-no}
-APP="homebrew"
-APP_TYPE="tools"
-INSTALL_PATH="/home/linuxbrew/.linuxbrew"
-
-# ==============================================================================
-# OS DETECTION
-# ==============================================================================
-if [[ -f "/etc/alpine-release" ]]; then
-  echo -e "${CROSS} Alpine is not supported by Homebrew. Exiting."
-  exit 1
-elif grep -qE 'ID=debian|ID=ubuntu' /etc/os-release; then
-  OS="Debian"
-else
-  echo -e "${CROSS} Unsupported OS detected. Exiting."
-  exit 1
-fi
-
-# ==============================================================================
-# UNINSTALL
-# ==============================================================================
-function uninstall() {
-  msg_info "Uninstalling Homebrew"
-
-  BREW_USER=$(awk -F: '$3 >= 1000 && $3 < 65534 { print $1; exit }' /etc/passwd)
-  if [[ -n "$BREW_USER" ]]; then
-    BREW_USER_HOME=$(getent passwd "$BREW_USER" | cut -d: -f6)
-    for rc_file in "$BREW_USER_HOME/.bashrc" "$BREW_USER_HOME/.profile"; do
-      if [[ -f "$rc_file" ]]; then
-        sed -i '/# Homebrew (Linuxbrew)/,/^fi$/d' "$rc_file"
-      fi
-    done
-  fi
-
-  rm -rf /home/linuxbrew
-  rm -f /etc/profile.d/homebrew.sh
-  groupdel linuxbrew &>/dev/null || true
-
-  msg_ok "Homebrew has been uninstalled"
-}
-
-# ==============================================================================
-# INSTALL
-# ==============================================================================
-function install() {
-  msg_info "Detecting Non-Root User"
-  BREW_USER=$(awk -F: '$3 >= 1000 && $3 < 65534 { print $1; exit }' /etc/passwd)
-  if [[ -z "$BREW_USER" ]]; then
-    msg_warn "No non-root user found (uid >= 1000). Homebrew cannot run as root."
-    read -r -p "${TAB}Create a 'brew' user automatically? (y/N): " create_user_prompt
-    if [[ "${create_user_prompt,,}" =~ ^(y|yes)$ ]]; then
-      msg_info "Creating user 'brew'"
-      useradd -m -s /bin/bash brew
-      BREW_USER="brew"
-      msg_ok "Created user 'brew'"
-    else
-      msg_error "Cannot install Homebrew without a non-root user. Exiting."
-      exit 1
-    fi
-  fi
-  msg_ok "Detected User: $BREW_USER"
-
-  msg_info "Installing Dependencies"
-  $STD apt update
-  $STD apt install -y build-essential git file procps
-  msg_ok "Installed Dependencies"
-
-  msg_info "Setting Up Homebrew Prefix"
-  export PATH="/usr/sbin:$PATH"
-  groupadd -f linuxbrew
-  mkdir -p /home/linuxbrew/.linuxbrew
-  chown -R "$BREW_USER":linuxbrew /home/linuxbrew
-  chmod 2775 /home/linuxbrew
-  chmod 2775 /home/linuxbrew/.linuxbrew
-  usermod -aG linuxbrew "$BREW_USER"
-  msg_ok "Set Up Homebrew Prefix"
-
-  msg_info "Installing Homebrew"
-  $STD su - "$BREW_USER" -c 'NONINTERACTIVE=1 /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"'
-  msg_ok "Installed Homebrew"
-
-  msg_info "Configuring Shell Integration"
-  cat <<'EOF' >/etc/profile.d/homebrew.sh
-#!/bin/bash
-if [ -d "/home/linuxbrew/.linuxbrew" ]; then
-    eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
-fi
-EOF
-  chmod +x /etc/profile.d/homebrew.sh
-
-  BREW_USER_HOME=$(getent passwd "$BREW_USER" | cut -d: -f6)
-  BREW_SHELL_BLOCK='\n# Homebrew (Linuxbrew)\nif [ -d "/home/linuxbrew/.linuxbrew" ]; then\n    eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"\nfi'
-  for rc_file in "$BREW_USER_HOME/.bashrc" "$BREW_USER_HOME/.profile"; do
-    if ! grep -q 'linuxbrew' "$rc_file" 2>/dev/null; then
-      echo -e "$BREW_SHELL_BLOCK" >>"$rc_file"
-    fi
-  done
-  msg_ok "Configured Shell Integration"
-
-  msg_info "Verifying Installation"
-  $STD su - "$BREW_USER" -c 'eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)" && brew --version'
-  msg_ok "Homebrew Verified"
-
-  echo ""
-  msg_ok "Homebrew installed successfully"
-  msg_ok "Ready for user: ${BL}${BREW_USER}${CL}"
-  echo ""
-  echo -e "${TAB}${INFO} Usage: Switch to the brew user with a login shell:"
-  echo -e "${TAB}  ${BL}su - ${BREW_USER}${CL}"
-  echo -e "${TAB}  Then run: ${BL}brew install <package>${CL}"
-  echo -e "${TAB}  Update with: ${BL}brew update${CL}"
-}
-
-# ==============================================================================
-# MAIN
-# ==============================================================================
-header_info
-
-if [[ -d "$INSTALL_PATH" ]]; then
-  msg_warn "Homebrew is already installed."
-  echo ""
-
-  read -r -p "${TAB}Uninstall Homebrew? (y/N): " uninstall_prompt
-  if [[ "${uninstall_prompt,,}" =~ ^(y|yes)$ ]]; then
-    uninstall
-    exit 0
-  fi
-
-  msg_warn "No action selected. Exiting."
-  exit 0
-fi
-
-# Fresh installation
-msg_warn "Homebrew is not installed."
-echo ""
-echo -e "${TAB}${INFO} This will install:"
-echo -e "${TAB}  - Homebrew (Linuxbrew) package manager"
-echo -e "${TAB}  - Shell integration for the detected non-root user"
-echo ""
-
-read -r -p "${TAB}Install Homebrew? (y/N): " install_prompt
-if [[ "${install_prompt,,}" =~ ^(y|yes)$ ]]; then
-  install
-else
-  msg_warn "Installation cancelled. Exiting."
-  exit 0
-fi

tools/addon/runtipi.sh

@@ -150,7 +150,7 @@ function install() {
   curl -fsSL "https://raw.githubusercontent.com/runtipi/runtipi/master/scripts/install.sh" -o "install.sh"
   chmod +x install.sh
   $STD ./install.sh
-  chmod 660 /opt/runtipi/state/settings.json 2>/dev/null || true
+  chmod 666 /opt/runtipi/state/settings.json 2>/dev/null || true
   rm -f /opt/install.sh
   msg_ok "Installed ${APP}"