Disable NPM install and update due to OpenResty SHA-1 signature issue (#11406)

Co-authored-by: GitHub Actions <github-actions[bot]@users.noreply.github.com>

CHANGELOG.md

@@ -774,6 +774,10 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ## 2026-02-02
 
+### 🆕 New Scripts
+
+  - KitchenOwl ([#11453](https://github.com/community-scripts/ProxmoxVE/pull/11453))
+
 ## 2026-02-01
 
 ### 🚀 Updated Scripts

ct/headers/kitchenowl

@@ -0,0 +1,6 @@
+    __ __ _ __       __               ____           __
+   / //_/(_) /______/ /_  ___  ____  / __ \_      __/ /
+  / ,<  / / __/ ___/ __ \/ _ \/ __ \/ / / / | /| / / / 
+ / /| |/ / /_/ /__/ / / /  __/ / / / /_/ /| |/ |/ / /  
+/_/ |_/_/\__/\___/_/ /_/\___/_/ /_/\____/ |__/|__/_/   
+                                                       

ct/kitchenowl.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: snazzybean
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/TomBursch/kitchenowl
+
+APP="KitchenOwl"
+var_tags="${var_tags:-food;recipes}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-6}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/kitchenowl ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "kitchenowl" "TomBursch/kitchenowl"; then
+    msg_info "Stopping Service"
+    systemctl stop kitchenowl
+    msg_ok "Stopped Service"
+
+    msg_info "Creating Backup"
+    mkdir -p /opt/kitchenowl_backup
+    cp -r /opt/kitchenowl/data /opt/kitchenowl_backup/
+    cp -f /opt/kitchenowl/kitchenowl.env /opt/kitchenowl_backup/
+    msg_ok "Created Backup"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "kitchenowl" "TomBursch/kitchenowl" "tarball" "latest" "/opt/kitchenowl"
+    rm -rf /opt/kitchenowl/web
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "kitchenowl-web" "TomBursch/kitchenowl" "prebuild" "latest" "/opt/kitchenowl/web" "kitchenowl_Web.tar.gz"
+
+    msg_info "Restoring data"
+    sed -i 's/default=True/default=False/' /opt/kitchenowl/backend/wsgi.py
+    cp -r /opt/kitchenowl_backup/data /opt/kitchenowl/
+    cp -f /opt/kitchenowl_backup/kitchenowl.env /opt/kitchenowl/
+    rm -rf /opt/kitchenowl_backup
+    msg_ok "Restored data"
+
+    msg_info "Updating KitchenOwl"
+    cd /opt/kitchenowl/backend
+    $STD uv sync --frozen
+    cd /opt/kitchenowl/backend
+    set -a
+    source /opt/kitchenowl/kitchenowl.env
+    set +a
+    $STD uv run flask db upgrade
+    msg_ok "Updated KitchenOwl"
+
+    msg_info "Starting Service"
+    systemctl start kitchenowl
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:80${CL}"

ct/nginxproxymanager.sh

@@ -28,6 +28,12 @@ function update_script() {
     exit
   fi
 
+  msg_error "This script is currently disabled due to an external issue with the OpenResty APT repository."
+  msg_error "The repository's GPG key uses SHA-1 signatures, which are no longer accepted by Debian as of February 1, 2026."
+  msg_error "The issue is tracked in openresty/openresty#1097"
+  msg_error "For more details, see: https://github.com/community-scripts/ProxmoxVE/issues/11406"
+  exit 1
+
   if [[ $(grep -E '^VERSION_ID=' /etc/os-release) == *"12"* ]]; then
     msg_error "Wrong Debian version detected!"
     msg_error "Please create a snapshot first. You must upgrade your LXC to Debian Trixie before updating. Visit: https://github.com/community-scripts/ProxmoxVE/discussions/7489"

frontend/public/json/kitchenowl.json

@@ -0,0 +1,35 @@
+{
+  "name": "KitchenOwl",
+  "slug": "kitchenowl",
+  "categories": [
+    13
+  ],
+  "date_created": "2026-02-02",
+  "type": "ct",
+  "updateable": true,
+  "privileged": false,
+  "interface_port": 80,
+  "documentation": "https://docs.kitchenowl.org/",
+  "website": "https://kitchenowl.org/",
+  "logo": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/kitchenowl.webp",
+  "config_path": "/opt/kitchenowl/kitchenowl.env",
+  "description": "KitchenOwl is a smart self-hosted grocery list and recipe manager with real-time synchronization, recipe management, meal planning, and expense tracking.",
+  "install_methods": [
+    {
+      "type": "default",
+      "script": "ct/kitchenowl.sh",
+      "resources": {
+        "cpu": 1,
+        "ram": 2048,
+        "hdd": 6,
+        "os": "Debian",
+        "version": "13"
+      }
+    }
+  ],
+  "default_credentials": {
+    "username": null,
+    "password": null
+  },
+  "notes": []
+}

frontend/public/json/nginxproxymanager.json

@@ -13,6 +13,8 @@
   "website": "https://nginxproxymanager.com/",
   "logo": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/nginx-proxy-manager.webp",
   "config_path": "",
+  "disable": true,
+  "disable_description": "This script is temporarily disabled due to an external issue with the OpenResty APT repository. The repository's GPG key uses SHA-1 signatures, which are no longer accepted by Debian as of February 1, 2026. This causes installation to fail with APT errors. The issue is tracked in openresty/openresty#1097. A workaround exists but requires manual configuration. The script will be re-enabled once OpenResty updates their repository signing key. For more details, see: https://github.com/community-scripts/ProxmoxVE/issues/11406",
   "description": "Nginx Proxy Manager is a tool that provides a web-based interface to manage Nginx reverse proxies. It enables users to easily and securely expose their services to the internet by providing features such as HTTPS encryption, domain mapping, and access control. It eliminates the need for manual configuration of Nginx reverse proxies, making it easy for users to quickly and securely expose their services to the public.",
   "install_methods": [
     {

install/kitchenowl-install.sh

@@ -0,0 +1,145 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2025 community-scripts ORG
+# Author: snazzybean
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/TomBursch/kitchenowl
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  nginx \
+  build-essential \
+  gfortran \
+  pkg-config \
+  ninja-build \
+  autoconf \
+  automake \
+  libpq-dev \
+  libffi-dev \
+  libssl-dev \
+  libpcre2-dev \
+  libre2-dev \
+  libxml2-dev \
+  libxslt-dev \
+  libopenblas-dev \
+  liblapack-dev \
+  zlib1g-dev \
+  libjpeg62-turbo-dev \
+  libsqlite3-dev \
+  libexpat1-dev \
+  libicu-dev
+msg_ok "Installed Dependencies"
+
+PYTHON_VERSION="3.14" setup_uv
+fetch_and_deploy_gh_release "kitchenowl" "TomBursch/kitchenowl" "tarball" "latest" "/opt/kitchenowl"
+rm -rf /opt/kitchenowl/web
+fetch_and_deploy_gh_release "kitchenowl-web" "TomBursch/kitchenowl" "prebuild" "latest" "/opt/kitchenowl/web" "kitchenowl_Web.tar.gz"
+
+msg_info "Setting up KitchenOwl"
+cd /opt/kitchenowl/backend
+$STD uv sync --no-dev
+sed -i 's/default=True/default=False/' /opt/kitchenowl/backend/wsgi.py
+mkdir -p /nltk_data
+$STD uv run python -m nltk.downloader -d /nltk_data averaged_perceptron_tagger_eng
+JWT_SECRET=$(openssl rand -hex 32)
+mkdir -p /opt/kitchenowl/data
+cat <<EOF >/opt/kitchenowl/kitchenowl.env
+STORAGE_PATH=/opt/kitchenowl/data
+JWT_SECRET_KEY=${JWT_SECRET}
+NLTK_DATA=/nltk_data
+FRONT_URL=http://${LOCAL_IP}
+FLASK_APP=wsgi.py
+FLASK_ENV=production
+EOF
+set -a
+source /opt/kitchenowl/kitchenowl.env
+set +a
+$STD uv run flask db upgrade
+msg_ok "Set up KitchenOwl"
+
+msg_info "Creating Systemd Service"
+cat <<EOF >/etc/systemd/system/kitchenowl.service
+[Unit]
+Description=KitchenOwl Backend
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/kitchenowl/backend
+EnvironmentFile=/opt/kitchenowl/kitchenowl.env
+ExecStart=/usr/local/bin/uv run wsgi.py
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now kitchenowl
+msg_ok "Created and Started Service"
+
+msg_info "Configuring Nginx"
+rm -f /etc/nginx/sites-enabled/default
+cat <<'EOF' >/etc/nginx/sites-available/kitchenowl.conf
+server {
+    listen 80;
+    server_name _;
+
+    root /opt/kitchenowl/web;
+    index index.html;
+
+    client_max_body_size 100M;
+
+    # Security Headers
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+
+    location /api {
+        proxy_pass http://127.0.0.1:5000;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_connect_timeout 60s;
+        proxy_send_timeout 60s;
+        proxy_read_timeout 60s;
+    }
+
+    location /socket.io {
+        proxy_pass http://127.0.0.1:5000;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        # WebSocket Timeouts - allow long-lived connections
+        proxy_read_timeout 86400s;
+        proxy_send_timeout 86400s;
+    }
+}
+EOF
+ln -sf /etc/nginx/sites-available/kitchenowl.conf /etc/nginx/sites-enabled/
+rm -f /etc/nginx/sites-enabled/default
+$STD systemctl reload nginx
+msg_ok "Configured Nginx"
+
+motd_ssh
+customize
+cleanup_lxc