fix(cross-seed): downgrade Node.js to v22 LTS to fix better-sqlite3 build failure

.codegraph/.gitignore

@@ -0,0 +1,16 @@
+# CodeGraph data files
+# These are local to each machine and should not be committed
+
+# Database
+*.db
+*.db-wal
+*.db-shm
+
+# Cache
+cache/
+
+# Logs
+*.log
+
+# Hook markers
+.dirty

CHANGELOG.md

@@ -470,37 +470,14 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
-## 2026-06-05
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - OpenThread-BR: use systemd instead of init.d [@tomfrenzel](https://github.com/tomfrenzel) ([#14942](https://github.com/community-scripts/ProxmoxVE/pull/14942))
-
-  - #### 💥 Breaking Changes
-
-    - update authentik to 2026.5.2 [@thieneret](https://github.com/thieneret) ([#14846](https://github.com/community-scripts/ProxmoxVE/pull/14846))
-
 ## 2026-06-04
 
 ### 🚀 Updated Scripts
 
-  - #### 🐞 Bug Fixes
-
-    - Fix status messages for several alpine scripts [@tremor021](https://github.com/tremor021) ([#14911](https://github.com/community-scripts/ProxmoxVE/pull/14911))
-    - ReactiveResume: Fix Service Path [@MickLesk](https://github.com/MickLesk) ([#14926](https://github.com/community-scripts/ProxmoxVE/pull/14926))
-    - Jellyfin: install intel-igc deps before intel-opencl-icd to fix dependency order [@MickLesk](https://github.com/MickLesk) ([#14927](https://github.com/community-scripts/ProxmoxVE/pull/14927))
-
   - #### 🔧 Refactor
 
-    - OpenThread-BR: use official GitHub releases [@tomfrenzel](https://github.com/tomfrenzel) ([#14916](https://github.com/community-scripts/ProxmoxVE/pull/14916))
     - Grist: remove extra text at the end of installation [@tremor021](https://github.com/tremor021) ([#14905](https://github.com/community-scripts/ProxmoxVE/pull/14905))
 
-### ❔ Uncategorized
-
-  - chore(ct): sync sparkyfitness defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#14925](https://github.com/community-scripts/ProxmoxVE/pull/14925))
-
 ## 2026-06-03
 
 ### 🚀 Updated Scripts

ct/alpine-grafana.sh

@@ -55,6 +55,5 @@ build_container
 description
 
 msg_ok "Completed successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${APP} should be reachable by going to the following URL.
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+         ${BL}http://${IP}:3000${CL} \n"
-echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"

ct/alpine-loki.sh

@@ -54,9 +54,8 @@ start
 build_container
 description
 
-msg_ok "Completed successfully!\n"
+msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${APP} should be reachable by going to the following URL.
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+         ${BL}http://${IP}:3100${CL} \n"
-echo -e "${GATEWAY}${BGN}http://${IP}:3100${CL}"
+echo -e "Promtail should be reachable by going to the following URL.
-echo -e "${INFO}${YW}Access Promtail using the following URL:${CL}"
+         ${BL}http://${IP}:9080${CL} \n"
-echo -e "${GATEWAY}${BGN}http://${IP}:9080${CL}"

ct/alpine-nextcloud.sh

@@ -57,6 +57,5 @@ build_container
 description
 
 msg_ok "Completed successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${APP} should be reachable by going to the following URL.
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+         ${BL}https://${IP}${CL} \n"
-echo -e "${GATEWAY}${BGN}https://${IP}${CL}"

ct/alpine-redis.sh

@@ -58,6 +58,5 @@ build_container
 description
 
 msg_ok "Completed successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${APP} should be reachable on port 6379.
-echo -e "${INFO}${YW}Connect to Redis CLI using the following command:${CL}"
+         ${BL}redis-cli -h ${IP} -p 6379${CL} \n"
-echo -e "${GATEWAY}${BGN}redis-cli -h ${IP} -p 6379${CL}"

ct/alpine-valkey.sh

@@ -59,6 +59,5 @@ build_container
 description
 
 msg_ok "Completed successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${APP} should be reachable on port 6379.
-echo -e "${INFO}${YW}Connect to Valkey CLI using the following command:${CL}"
+         ${BL}valkey-cli -h ${IP} -p 6379${CL} \n"
-echo -e "${GATEWAY}${BGN}valkey-cli -h ${IP} -p 6379${CL}"

ct/alpine-vaultwarden.sh

@@ -60,6 +60,5 @@ build_container
 description
 
 msg_ok "Completed successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${APP} should be reachable by going to the following URL.
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+         ${BL}https://${IP}:8000${CL} \n"
-echo -e "${GATEWAY}${BGN}https://${IP}:8000${CL}"

ct/authentik.sh

@@ -8,7 +8,7 @@ source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxV
 APP="authentik"
 var_tags="${var_tags:-auth}"
 var_cpu="${var_cpu:-4}"
-var_ram="${var_ram:-8192}"
+var_ram="${var_ram:-4096}"
 var_disk="${var_disk:-16}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
@@ -30,20 +30,12 @@ function update_script() {
     exit
   fi
 
-  read -r MAJOR MINOR PATCH <<< "$(sed 's/^version\///; s/\./ /g' "$HOME/.authentik")"
-
-  msg_info "Update dependencies"
-  ensure_dependencies crossbuild-essential-amd64 gcc-x86-64-linux-gnu cmake clang libunwind-18-dev
-  msg_ok "Update dependencies"
-
   NODE_VERSION="24" setup_nodejs
   setup_go
   UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.3" setup_uv
-  RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
+  setup_rust
-  setup_yq
 
-  AUTHENTIK_VERSION="version/2026.5.2"
+  AUTHENTIK_VERSION="version/2026.2.3"
-  # Source: https://github.com/goauthentik/fips/blob/main/Makefile#L26
   XMLSEC_VERSION="1.3.11"
 
   if check_for_gh_release "geoipupdate" "maxmind/geoipupdate"; then
@@ -79,13 +71,7 @@ function update_script() {
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
 
-	msg_info "Configuring rust"
+    msg_info "Updating web"
-	cd /opt/authentik
-	$STD rustup install
-	$STD rustup default "$(sed -n 's/channel = "\(.*\)"/\1/p' rust-toolchain.toml)"
-	msg_ok "Configured rust"
-
-	msg_info "Updating web"
     cd /opt/authentik/web
     export NODE_ENV="production"
     $STD npm install
@@ -103,14 +89,6 @@ function update_script() {
 	$STD go build -o /opt/authentik/radius ./cmd/radius
     msg_ok "Updated go proxy"
 
-	msg_info "Building worker"
-	export AWS_LC_FIPS_SYS_CC="clang"
-	cd /opt/authentik
-	$STD cargo build --package authentik --no-default-features --features core --locked --release --jobs 1
-	cp ./target/release/authentik /opt/authentik/authentik-worker
-	rm -r ./target
-	msg_ok "Built worker"
-
     msg_info "Updating python server"
     export UV_NO_BINARY_PACKAGE="cryptography lxml python-kadmin-rs xmlsec"
     export UV_COMPILE_BYTECODE="1"
@@ -122,103 +100,6 @@ function update_script() {
     $STD uv sync --frozen --no-install-project --no-dev
     chown -R authentik:authentik /opt/authentik
     msg_ok "Updated python server"
-
-    if [[ $MAJOR == 2026 && $MINOR -lt 5 ]]; then
-	  msg_info "Updating Worker and Server config"
-	  cp /etc/authentik/config.yml /etc/authentik/config.bak
-	  yq -i ".postgresql.conn_max_age = 0" /etc/authentik/config.yml
-	  yq -i ".postgresql.conn_health_checks = false" /etc/authentik/config.yml
-	  yq -i ".listen.debug_tokio = \"[::]:6669\"" /etc/authentik/config.yml
-      yq -i ".log.rust_log.console_subscriber = \"info\"" /etc/authentik/config.yml
-      yq -i ".log.rust_log.h2 = \"info\""  /etc/authentik/config.yml
-      yq -i ".log.rust_log.hyper_util = \"warn\"" /etc/authentik/config.yml
-      yq -i ".log.rust_log.mio = \"info\"" /etc/authentik/config.yml
-      yq -i ".log.rust_log.notify = \"info\"" /etc/authentik/config.yml
-	  yq -i ".log.rust_log.reqwest = \"info\"" /etc/authentik/config.yml
-      yq -i ".log.rust_log.runtime = \"info\"" /etc/authentik/config.yml
-      yq -i ".log.rust_log.rustls = \"info\"" /etc/authentik/config.yml
-      yq -i ".log.rust_log.sqlx = \"info\"" /etc/authentik/config.yml
-      yq -i ".log.rust_log.sqlx_postgres = \"info\"" /etc/authentik/config.yml
-      yq -i ".log.rust_log.tokio = \"info\"" /etc/authentik/config.yml
-      yq -i ".log.rust_log.tungstenite = \"info\"" /etc/authentik/config.yml
-	  yq -i ".web.workers = 2" /etc/authentik/config.yml
-	  mv /etc/default/authentik /etc/default/authentik.bak
-	  cat <<EOF >/etc/default/authentik-server
-TMPDIR=/dev/shm/
-UV_LINK_MODE=copy
-UV_PYTHON_DOWNLOADS=0
-UV_NATIVE_TLS=1
-VENV_PATH=/opt/authentik/.venv
-PYTHONDONTWRITEBYTECODE=1
-PYTHONUNBUFFERED=1
-PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
-DJANGO_SETTINGS_MODULE=authentik.root.settings
-PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
-AUTHENTIK_LISTEN__HTTP="[::]:9000"
-AUTHENTIK_LISTEN__HTTPS="[::]:9443"
-AUTHENTIK_LISTEN__METRICS="[::]:9300"
-EOF
-	  cat <<EOF >/etc/default/authentik-worker
-TMPDIR=/dev/shm/
-UV_LINK_MODE=copy
-UV_PYTHON_DOWNLOADS=0
-UV_NATIVE_TLS=1
-VENV_PATH=/opt/authentik/.venv
-PYTHONDONTWRITEBYTECODE=1
-PYTHONUNBUFFERED=1
-PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
-DJANGO_SETTINGS_MODULE=authentik.root.settings
-PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
-AUTHENTIK_LISTEN__HTTP="[::]:8000"
-AUTHENTIK_LISTEN__HTTPS="[::]:8443"
-AUTHENTIK_LISTEN__METRICS="[::]:8300"
-EOF
-	  msg_ok "Updated Worker and Server config!"
-	  msg_warn "Please check /etc/default/authentik-worker and /etc/default/authentik-server config files for port configurations!"
-
-	  msg_info "Updating services"
-	  cat <<EOF >/etc/systemd/system/authentik-server.service
-[Unit]
-Description=authentik Go Server (API Gateway)
-After=network.target
-Wants=postgresql.service
-
-[Service]
-User=authentik
-Group=authentik
-ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
-ExecStart=/opt/authentik/authentik-server
-WorkingDirectory=/opt/authentik/
-Restart=always
-RestartSec=5
-EnvironmentFile=/etc/default/authentik-server
-
-[Install]
-WantedBy=multi-user.target
-EOF
-
-	  cat <<EOF >/etc/systemd/system/authentik-worker.service
-[Unit]
-Description=authentik Worker
-After=network.target postgresql.service
-
-[Service]
-User=authentik
-Group=authentik
-Type=simple
-EnvironmentFile=/etc/default/authentik-worker
-ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
-ExecStart=/opt/authentik/authentik-worker worker
-WorkingDirectory=/opt/authentik
-Restart=always
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-	  systemctl daemon-reload
-	  msg_ok "Updated services"
-	fi
   fi
 
   msg_info "Starting Services"
@@ -269,5 +150,7 @@ description
 
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${INFO}${YW} Initial setup URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}https://${IP}:9443${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:9000/if/flow/initial-setup/${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:9000${CL}"

ct/headers/matterjs-server

@@ -1,6 +0,0 @@
-    __  ___      __  __                _______      _____                          
-   /  |/  /___ _/ /_/ /____  _____    / / ___/     / ___/___  ______   _____  _____
-  / /|_/ / __ `/ __/ __/ _ \/ ___/_  / /\__ \______\__ \/ _ \/ ___/ | / / _ \/ ___/
- / /  / / /_/ / /_/ /_/  __/ /  / /_/ /___/ /_____/__/ /  __/ /   | |/ /  __/ /    
-/_/  /_/\__,_/\__/\__/\___/_/   \____//____/     /____/\___/_/    |___/\___/_/     
-                                                                                   

ct/jellyfin.sh

@@ -36,13 +36,13 @@ function update_script() {
 
     # Fetch compute-runtime first so /tmp/gh_rel.json is populated for IGC tag resolution
     fetch_and_deploy_gh_release "intel-libgdgmm12" "intel/compute-runtime" "binary" "latest" "" "libigdgmm12_*_amd64.deb"
+    fetch_and_deploy_gh_release "intel-opencl-icd" "intel/compute-runtime" "binary" "latest" "" "intel-opencl-icd_*_amd64.deb"
 
     local igc_tag
     _resolve_igc_tag igc_tag
 
     fetch_and_deploy_gh_release "intel-igc-core-2" "intel/intel-graphics-compiler" "binary" "$igc_tag" "" "intel-igc-core-2_*_amd64.deb"
     fetch_and_deploy_gh_release "intel-igc-opencl-2" "intel/intel-graphics-compiler" "binary" "$igc_tag" "" "intel-igc-opencl-2_*_amd64.deb"
-    fetch_and_deploy_gh_release "intel-opencl-icd" "intel/compute-runtime" "binary" "latest" "" "intel-opencl-icd_*_amd64.deb"
     msg_ok "Updated Intel Dependencies"
   fi
 

ct/matterjs-server.sh

@@ -1,64 +0,0 @@
-#!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/matter-js/matterjs-server
-
-APP="MatterJS-Server"
-var_tags="${var_tags:-matter;iot;smarthome;homeassistant}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-1024}"
-var_disk="${var_disk:-4}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-no}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/matter-server ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  NODE_VERSION="24" setup_nodejs
-  
-  CURRENT=$(cat /opt/matter-server/node_modules/matter-server/package.json | grep '"version"' | head -1 | sed 's/.*"\([^"]*\)".*/\1/')
-  LATEST=$(npm view matter-server version 2>/dev/null)
-  if [[ "$CURRENT" != "$LATEST" ]]; then
-    msg_info "Stopping Service"
-    systemctl stop matterjs-server
-    msg_ok "Stopped Service"
-
-    msg_info "Updating ${APP} from v${CURRENT} to v${LATEST}"
-    cd /opt/matter-server
-    $STD npm install matter-server@latest
-    msg_ok "Updated ${APP}"
-
-    msg_info "Starting Service"
-    systemctl start matterjs-server
-    msg_ok "Started Service"
-    msg_ok "Updated successfully!"
-  else
-    msg_ok "No update required. ${APP} is already at v${LATEST}"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:5580${CL}"

ct/openthread-br.sh

@@ -2,7 +2,7 @@
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
 
 # Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ) | Co-Author: Tom Frenzel (tomfrenzel)
+# Author: MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://openthread.io/guides/border-router
 
@@ -32,30 +32,29 @@ function update_script() {
     exit
   fi
 
-  if check_for_gh_release "openthread-br" "openthread/ot-br-posix"; then
+  cd /opt/ot-br-posix
-    msg_info "Stopping Services"
+  LOCAL_COMMIT=$(git rev-parse HEAD)
-    systemctl stop otbr-web
+  $STD git fetch --depth 1 origin main
-    systemctl stop otbr-agent
+  REMOTE_COMMIT=$(git rev-parse origin/main)
-    msg_ok "Stopped Services"
 
-    if [[ -f /etc/init.d/otbr-agent ]] || [[ -f /etc/init.d/otbr-web ]]; then
+  if [[ "${LOCAL_COMMIT}" == "${REMOTE_COMMIT}" ]]; then
-      msg_info "Removing legacy services"
+    msg_ok "Already up to date (${LOCAL_COMMIT:0:7})"
-      rm -f /etc/init.d/otbr-agent /etc/init.d/otbr-web
+    exit
-      systemctl daemon-reload
+  fi
-      msg_ok "Removed legacy services"
-    fi
 
-    msg_info "Backing up Configuration"
+  msg_info "Stopping Services"
-    cp /etc/default/otbr-agent /etc/default/otbr-agent.bak
+  systemctl stop otbr-web
-    msg_ok "Backed up Configuration"
+  systemctl stop otbr-agent
+  msg_ok "Stopped Services"
 
-    msg_info "Fetching GitHub release OpenThread-BR (${CHECK_UPDATE_RELEASE#v})" 
+  msg_info "Backing up Configuration"
-    cd /opt/ot-br-posix
+  cp /etc/default/otbr-agent /etc/default/otbr-agent.bak
-    $STD git fetch --depth 1 origin tag "$CHECK_UPDATE_RELEASE"
+  msg_ok "Backed up Configuration"
-    $STD git checkout -f "$CHECK_UPDATE_RELEASE"
+
-    $STD git submodule update --depth 1 --init --recursive
+  msg_info "Updating Source"
-    echo "${CHECK_UPDATE_RELEASE#v}" > ~/.openthread-br
+  $STD git reset --hard origin/main
-    msg_ok "Deployed GitHub release OpenThread-BR (${CHECK_UPDATE_RELEASE#v})"
+  $STD git submodule update --depth 1 --init --recursive
+  msg_ok "Updated Source"
 
   msg_info "Rebuilding OpenThread Border Router (Patience)"
   cd /opt/ot-br-posix/build
@@ -68,7 +67,6 @@ function update_script() {
     -DOTBR_WEB=ON \
     -DOTBR_BORDER_ROUTING=ON \
     -DOTBR_BACKBONE_ROUTER=ON \
-    -DOTBR_SYSTEMD_UNIT_DIR=/etc/systemd/system \
     -DOT_FIREWALL=ON \
     -DOT_POSIX_NAT64_CIDR="192.168.255.0/24" \
     ..
@@ -106,7 +104,6 @@ EOF
   systemctl start otbr-web
   msg_ok "Started Services"
   msg_ok "Updated successfully!"
-  fi
   exit
 }
 

ct/reactive-resume.sh

@@ -53,7 +53,7 @@ function update_script() {
     msg_ok "Updated Reactive Resume"
 
     msg_info "Updating Service"
-    sed -i 's|WorkingDirectory=/opt/reactive-resume/apps/web|WorkingDirectory=/opt/reactive-resume/apps/server|; s|ExecStart=/usr/bin/node .output/server/index.mjs|ExecStart=/usr/bin/node dist/index.mjs|' /etc/systemd/system/reactive-resume.service
+    sed -i 's|WorkingDirectory=/opt/reactive-resume$|WorkingDirectory=/opt/reactive-resume/apps/web|' /etc/systemd/system/reactive-resume.service
     systemctl daemon-reload
     msg_ok "Updated Service"
 

ct/sparkyfitness.sh

@@ -9,7 +9,7 @@ APP="SparkyFitness"
 var_tags="${var_tags:-health;fitness}"
 var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-2048}"
-var_disk="${var_disk:-7}"
+var_disk="${var_disk:-4}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
 var_arm64="${var_arm64:-no}"

install/authentik-install.sh

@@ -29,6 +29,8 @@ $STD apt install -y \
   libltdl-dev \
   libpq5 \
   libmaxminddb0 \
+  libkrb5-3 \
+  libkdb5-10 \
   libkadm5clnt-mit12 \
   libkadm5clnt7t64-heimdal \
   libltdl7 \
@@ -42,61 +44,49 @@ $STD apt install -y \
   libtool \
   libtool-bin \
   gcc \
-  crossbuild-essential-amd64 \
-  gcc-x86-64-linux-gnu \
-  cmake \
-  clang \
-  libunwind-18-dev \
   git
 msg_ok "Installed Dependencies"
 
 NODE_VERSION="24" setup_nodejs
 setup_yq
 setup_go
-RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
 UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.3" setup_uv
+setup_rust
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db
 
 XMLSEC_VERSION="1.3.11"
-AUTHENTIK_VERSION="version/2026.5.2"
+AUTHENTIK_VERSION="version/2026.2.3"
 fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec"
 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
 fetch_and_deploy_gh_release "geoipupdate" "maxmind/geoipupdate" "binary"
 
-msg_info "Setting up xmlsec"
+msg_info "Setup xmlsec"
 cd /opt/xmlsec
 $STD ./autogen.sh
 $STD make -j $(nproc)
 $STD make check
 $STD make install
 $STD ldconfig
-msg_ok "Setup xmlsec"
+msg_ok "xmlsec installed"
 
-msg_info "Configuring rust"
+msg_info "Setup web"
-cd /opt/authentik
-$STD rustup install
-$STD rustup default "$(sed -n 's/channel = "\(.*\)"/\1/p' rust-toolchain.toml)"
-msg_ok "Configured rust"
-
-msg_info "Setting up web"
 cd /opt/authentik/web
 export NODE_ENV="production"
 $STD npm install
 $STD npm run build
 $STD npm run build:sfe
-msg_ok "Setup web"
+msg_ok "Web installed"
 
-msg_info "Setting up go proxy"
+msg_info "Setup go proxy"
 cd /opt/authentik
 export CGO_ENABLED="1"
-export CC="x86_64-linux-gnu-gcc"
 $STD go mod download
 $STD go build -o /opt/authentik/authentik-server ./cmd/server
 $STD go build -o /opt/authentik/ldap ./cmd/ldap
 $STD go build -o /opt/authentik/rac ./cmd/rac
 $STD go build -o /opt/authentik/radius ./cmd/radius
-msg_ok "Setup go proxy"
+msg_ok "Go proxy installed"
 
 cat <<EOF >/usr/local/etc/GeoIP.conf
 AccountID ChangeME
@@ -109,24 +99,17 @@ EOF
 
 echo "#39 19 * * 6,4 /usr/bin/geoipupdate -f /usr/local/etc/GeoIP.conf" | crontab -
 
-msg_info "Building worker"
+msg_info "Setup python server"
-export AWS_LC_FIPS_SYS_CC="clang"
-cd /opt/authentik
-$STD cargo build --package authentik --no-default-features --features core --locked --release --jobs 1
-cp ./target/release/authentik /opt/authentik/authentik-worker
-rm -r ./target
-msg_ok "Built worker"
-
-msg_info "Setting up python server"
 export UV_NO_BINARY_PACKAGE="cryptography lxml python-kadmin-rs xmlsec"
 export UV_COMPILE_BYTECODE="1"
 export UV_LINK_MODE="copy"
 export UV_NATIVE_TLS="1"
+export RUSTUP_PERMIT_COPY_RENAME="true"
 export UV_PYTHON_INSTALL_DIR="/usr/local/bin"
 cd /opt/authentik
 $STD uv sync --frozen --no-install-project --no-dev
 cp /opt/authentik/authentik/sources/kerberos/krb5.conf /etc/krb5.conf
-msg_ok "Setup python server"
+msg_ok "Installed python server"
 
 msg_info "Creating authentik config"
 mkdir -p /etc/authentik
@@ -142,7 +125,7 @@ yq -i ".storage.file.path = \"/opt/authentik-data\"" /etc/authentik/config.yml
 yq -i ".disable_startup_analytics = \"true\"" /etc/authentik/config.yml
 $STD useradd -U -s /usr/sbin/nologin -r -M -d /opt/authentik authentik
 chown -R authentik:authentik /opt/authentik
-cat <<EOF >/etc/default/authentik-server
+cat <<EOF >/etc/default/authentik
 TMPDIR=/dev/shm/
 UV_LINK_MODE=copy
 UV_PYTHON_DOWNLOADS=0
@@ -153,24 +136,6 @@ PYTHONUNBUFFERED=1
 PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
 DJANGO_SETTINGS_MODULE=authentik.root.settings
 PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
-AUTHENTIK_LISTEN__HTTP="[::]:9000"
-AUTHENTIK_LISTEN__HTTPS="[::]:9443"
-AUTHENTIK_LISTEN__METRICS="[::]:9300"
-EOF
-cat <<EOF >/etc/default/authentik-worker
-TMPDIR=/dev/shm/
-UV_LINK_MODE=copy
-UV_PYTHON_DOWNLOADS=0
-UV_NATIVE_TLS=1
-VENV_PATH=/opt/authentik/.venv
-PYTHONDONTWRITEBYTECODE=1
-PYTHONUNBUFFERED=1
-PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
-DJANGO_SETTINGS_MODULE=authentik.root.settings
-PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
-AUTHENTIK_LISTEN__HTTP="[::]:8000"
-AUTHENTIK_LISTEN__HTTPS="[::]:8443"
-AUTHENTIK_LISTEN__METRICS="[::]:8300"
 EOF
 cat <<EOF >/etc/default/authentik_ldap
 AUTHENTIK_HOST="https://127.0.0.1:9443"
@@ -187,7 +152,7 @@ AUTHENTIK_HOST="https://127.0.0.1:9443"
 AUTHENTIK_INSECURE="true"
 AUTHENTIK_TOKEN="token-generated-by-authentik"
 EOF
-msg_ok "Created authentik config"
+msg_ok "authentik config created"
 
 msg_info "Creating services"
 cat <<EOF >/etc/systemd/system/authentik-server.service
@@ -199,12 +164,12 @@ Wants=postgresql.service
 [Service]
 User=authentik
 Group=authentik
-EnvironmentFile=/etc/default/authentik-server
 ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
 ExecStart=/opt/authentik/authentik-server
 WorkingDirectory=/opt/authentik/
 Restart=always
 RestartSec=5
+EnvironmentFile=/etc/default/authentik
 
 [Install]
 WantedBy=multi-user.target
@@ -219,9 +184,8 @@ After=network.target postgresql.service
 User=authentik
 Group=authentik
 Type=simple
-EnvironmentFile=/etc/default/authentik-worker
+EnvironmentFile=/etc/default/authentik
-ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
+ExecStart=/usr/local/bin/uv run python -m manage worker --pid-file /dev/shm/authentik-worker.pid
-ExecStart=/opt/authentik/authentik-worker worker
 WorkingDirectory=/opt/authentik
 Restart=always
 RestartSec=5
@@ -286,7 +250,7 @@ EnvironmentFile=/etc/default/authentik_radius
 [Install]
 WantedBy=multi-user.target
 EOF
-msg_ok "Created services"
+msg_ok "Services created"
 
 motd_ssh
 customize

install/cross-seed-install.sh

@@ -17,7 +17,7 @@ msg_info "Installing Dependencies"
 $STD apt install -y build-essential
 msg_ok "Installed Dependencies"
 
-NODE_VERSION="26" setup_nodejs
+NODE_VERSION="22" setup_nodejs
 
 msg_info "Setup Cross-Seed"
 $STD npm install cross-seed@latest -g

install/matterjs-server-install.sh

@@ -1,58 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/matter-js/matterjs-server
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-NODE_VERSION="24" setup_nodejs
-
-msg_info "Installing MatterJS-Server"
-mkdir -p /opt/matter-server
-cd /opt/matter-server
-$STD npm install matter-server
-mkdir -p /var/lib/matterjs-server
-msg_ok "Installed MatterJS-Server"
-
-msg_info "Configuring Network"
-cat <<EOF >/etc/sysctl.d/60-ipv6-ra-rio.conf
-net.ipv6.conf.default.accept_ra=1
-net.ipv6.conf.default.accept_ra_rtr_pref=1
-net.ipv6.conf.default.accept_ra_rt_info_max_plen=64
-net.ipv6.conf.eth0.accept_ra=1
-net.ipv6.conf.eth0.accept_ra_rtr_pref=1
-net.ipv6.conf.eth0.accept_ra_rt_info_max_plen=64
-EOF
-$STD sysctl -p /etc/sysctl.d/60-ipv6-ra-rio.conf
-msg_ok "Configured Network"
-
-msg_info "Creating Service"
-cat <<EOF >/etc/systemd/system/matterjs-server.service
-[Unit]
-Description=MatterJS Server
-After=network.target
-
-[Service]
-Type=simple
-User=root
-ExecStart=/usr/bin/node /opt/matter-server/node_modules/matter-server/dist/esm/MatterServer.js --storage-path /var/lib/matterjs-server
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now matterjs-server
-msg_ok "Created Service"
-
-motd_ssh
-customize
-cleanup_lxc

install/onlyoffice-install.sh

@@ -20,29 +20,13 @@ $STD apt install -y \
 msg_ok "Installed Dependencies"
 
 PG_VERSION="16" setup_postgresql
-
+PG_DB_NAME="onlyoffice" PG_DB_USER="onlyoffice_user" setup_postgresql_db
-msg_info "Setup Database"
-DB_NAME=onlyoffice
-DB_USER=onlyoffice_user
-DB_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-13)
-$STD sudo -u postgres psql -c "CREATE ROLE $DB_USER WITH LOGIN PASSWORD '$DB_PASS';"
-$STD sudo -u postgres psql -c "CREATE DATABASE $DB_NAME WITH OWNER $DB_USER ENCODING 'UTF8' TEMPLATE template0;"
-$STD sudo -u postgres psql -c "ALTER ROLE $DB_USER SET client_encoding TO 'utf8';"
-$STD sudo -u postgres psql -c "ALTER ROLE $DB_USER SET default_transaction_isolation TO 'read committed';"
-$STD sudo -u postgres psql -c "ALTER ROLE $DB_USER SET timezone TO 'UTC'"
-{
-  echo "ONLYOFFICE-Credentials"
-  echo "ONLYOFFICE Database User: $DB_USER"
-  echo "ONLYOFFICE Database Password: $DB_PASS"
-  echo "ONLYOFFICE Database Name: $DB_NAME"
-} >>~/onlyoffice.creds
-msg_ok "Set up Database"
 
 msg_info "Adding ONLYOFFICE GPG Key"
 GPG_TMP="/tmp/onlyoffice.gpg"
 KEY_URL="https://download.onlyoffice.com/GPG-KEY-ONLYOFFICE"
 TMP_KEY_CONTENT=$(mktemp)
-if curl -fsSL "$KEY_URL" -o "$TMP_KEY_CONTENT" && grep -q "BEGIN PGP PUBLIC KEY BLOCK" "$TMP_KEY_CONTENT"; then
+if curl_with_retry "$KEY_URL" "$TMP_KEY_CONTENT" && grep -q "BEGIN PGP PUBLIC KEY BLOCK" "$TMP_KEY_CONTENT"; then
   gpg --quiet --batch --yes --no-default-keyring --keyring "gnupg-ring:$GPG_TMP" --import "$TMP_KEY_CONTENT" >/dev/null 2>&1
   chmod 644 "$GPG_TMP"
   chown root:root "$GPG_TMP"
@@ -81,9 +65,6 @@ echo onlyoffice-documentserver onlyoffice/rabbitmq-pwd password $RMQ_PASS | debc
 echo onlyoffice-documentserver onlyoffice/jwt-enabled boolean true | debconf-set-selections
 echo onlyoffice-documentserver onlyoffice/jwt-secret password $JWT_SECRET | debconf-set-selections
 
-echo "RabbitMQ User: $RMQ_USER" >>~/onlyoffice.creds
-echo "RabbitMQ Password: $RMQ_PASS" >>~/onlyoffice.creds
-echo "JWT Secret: $JWT_SECRET" >>~/onlyoffice.creds
 {
   echo ""
   echo "ONLYOFFICE RabbitMQ Credentials"

install/openthread-br-install.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 
 # Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ) | Co-Author: Tom Frenzel (tomfrenzel)
+# Author: MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://openthread.io/guides/border-router
 
@@ -39,19 +39,12 @@ msg_ok "Installed Dependencies"
 
 setup_nodejs
 
-RELEASE=$(get_latest_gh_tag "openthread/ot-br-posix")
+msg_info "Cloning OpenThread Border Router"
-if [[ -z "$RELEASE" ]]; then
-  msg_error "Failed to fetch latest release tag"
-  exit 1
-fi
-
-msg_info "Fetching GitHub release OpenThread-BR (${RELEASE#v})"
 # git clone is needed to fetch submodules, fetch_and_deploy_gh_release doesn't support this. We use --depth 1 to minimize the amount of data cloned, but it still may take a while.
-$STD git clone --depth 1 --branch "$RELEASE" https://github.com/openthread/ot-br-posix /opt/ot-br-posix
+$STD git clone --depth 1 https://github.com/openthread/ot-br-posix /opt/ot-br-posix
 cd /opt/ot-br-posix
 $STD git submodule update --depth 1 --init --recursive
-echo "${RELEASE#v}" > ~/.openthread-br
+msg_ok "Cloned OpenThread Border Router"
-msg_ok "Deployed GitHub release OpenThread-BR (${RELEASE#v})"
 
 msg_info "Building OpenThread Border Router (Patience)"
 mkdir -p build && cd build
@@ -64,7 +57,6 @@ $STD cmake -GNinja \
   -DOTBR_WEB=ON \
   -DOTBR_BORDER_ROUTING=ON \
   -DOTBR_BACKBONE_ROUTER=ON \
-  -DOTBR_SYSTEMD_UNIT_DIR=/etc/systemd/system \
   -DOT_FIREWALL=ON \
   -DOT_POSIX_NAT64_CIDR="192.168.255.0/24" \
   ..

install/reactive-resume-install.sh

@@ -107,9 +107,9 @@ After=network.target postgresql.service chromium-printer.service
 Wants=postgresql.service chromium-printer.service
 
 [Service]
-WorkingDirectory=/opt/reactive-resume/apps/server
+WorkingDirectory=/opt/reactive-resume/apps/web
 EnvironmentFile=/opt/reactive-resume/.env
-ExecStart=/usr/bin/node dist/index.mjs
+ExecStart=/usr/bin/node .output/server/index.mjs
 Restart=always
 RestartSec=5