build.func: add var_post_install (host-side post-install script). Configurable via default.vars/app.vars or new advanced-settings step (path on Proxmox host); runs in description() with APP/CTID/IP env vars.

Update CHANGELOG.md (#14156 )
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
2026-05-01 22:35:05 +02:00 · 2026-05-01 22:28:36 +02:00 · 2026-05-01 19:00:34 +00:00 · 2026-05-01 19:00:08 +00:00 · 2026-05-01 21:00:05 +02:00 · 2026-05-01 20:59:38 +02:00
13 changed files with 102 additions and 291 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -448,6 +448,19 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 </details>

+## 2026-05-01
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - paperless-ngx: refresh NLTK data on update [@kurtislanderson](https://github.com/kurtislanderson) ([#14144](https://github.com/community-scripts/ProxmoxVE/pull/14144))
+    - [Pelican Panel] stop deleting the public storage [@LetterN](https://github.com/LetterN) ([#14145](https://github.com/community-scripts/ProxmoxVE/pull/14145))
+
+  - #### 🔧 Refactor
+
+    - Mail-Archiver: update dependencies [@tremor021](https://github.com/tremor021) ([#14152](https://github.com/community-scripts/ProxmoxVE/pull/14152))
+
 ## 2026-04-30

 ### 🆕 New Scripts
@@ -455,6 +468,13 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
  - Nagios ([#14126](https://github.com/community-scripts/ProxmoxVE/pull/14126))
 - Neko ([#14121](https://github.com/community-scripts/ProxmoxVE/pull/14121))

+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - alpine-docker: install openssl as core dependency | alpine-komodo: check & install openssl if missing [@MickLesk](https://github.com/MickLesk) ([#14134](https://github.com/community-scripts/ProxmoxVE/pull/14134))
+    - endurain: update source references to Codeberg [@MickLesk](https://github.com/MickLesk) ([#14128](https://github.com/community-scripts/ProxmoxVE/pull/14128))
+
 ### 💾 Core

  - #### 🔧 Refactor
--- a/ct/endurain.sh
+++ b/ct/endurain.sh
@@ -3,7 +3,7 @@ source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxV
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: johanngrobe
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/joaovitoriasilva/endurain
+# Source: https://codeberg.org/endurain-project/endurain

 APP="Endurain"
 var_tags="${var_tags:-sport;social-media}"
@@ -28,7 +28,7 @@ function update_script() {
    msg_error "No ${APP} installation found!"
    exit 233
  fi
-  if check_for_gh_release "endurain" "endurain-project/endurain"; then
+  if check_for_codeberg_release "endurain" "endurain-project/endurain"; then
    msg_info "Stopping Service"
    systemctl stop endurain
    msg_ok "Stopped Service"
@@ -38,7 +38,7 @@ function update_script() {
    cp /opt/endurain/frontend/app/dist/env.js /opt/endurain.env.js
    msg_ok "Created Backup"

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "endurain" "endurain-project/endurain" "tarball" "latest" "/opt/endurain"
+    CLEAN_INSTALL=1 fetch_and_deploy_codeberg_release "endurain" "endurain-project/endurain" "tarball" "latest" "/opt/endurain"

    msg_info "Preparing Update"
    cd /opt/endurain
--- a/ct/headers/protonmail-bridge
+++ b/ct/headers/protonmail-bridge
@@ -1,6 +0,0 @@
-    ____             __              __  ___      _ __      ____       _     __         
-   / __ \_________  / /_____  ____  /  |/  /___ _(_) /     / __ )_____(_)___/ /___ ____ 
-  / /_/ / ___/ __ \/ __/ __ \/ __ \/ /|_/ / __ `/ / /_____/ __  / ___/ / __  / __ `/ _ \
- / ____/ /  / /_/ / /_/ /_/ / / / / /  / / /_/ / / /_____/ /_/ / /  / / /_/ / /_/ /  __/
-/_/   /_/   \____/\__/\____/_/ /_/_/  /_/\__,_/_/_/     /_____/_/  /_/\__,_/\__, /\___/ 
-                                                                           /____/       
--- a/ct/mail-archiver.sh
+++ b/ct/mail-archiver.sh
@@ -28,6 +28,8 @@ function update_script() {
    exit
  fi

+  ensure_dependencies libgssapi-krb5-2
+
  if check_for_gh_release "mail-archiver" "s1t5/mail-archiver"; then
    msg_info "Stopping Mail-Archiver"
    systemctl stop mail-archiver
--- a/ct/paperless-ngx.sh
+++ b/ct/paperless-ngx.sh
@@ -164,6 +164,14 @@ function update_script() {
      fi
    fi

+    msg_info "Updating NLTK Data"
+    cd /opt/paperless
+    $STD uv run python -m nltk.downloader -d /usr/share/nltk_data snowball_data
+    $STD uv run python -m nltk.downloader -d /usr/share/nltk_data stopwords
+    $STD uv run python -m nltk.downloader -d /usr/share/nltk_data punkt_tab ||
+      $STD uv run python -m nltk.downloader -d /usr/share/nltk_data punkt
+    msg_ok "Updated NLTK Data"
+
    msg_info "Starting all Paperless-ngx Services"
    systemctl start paperless-consumer paperless-webserver paperless-scheduler paperless-task-queue
    sleep 1
--- a/ct/pelican-panel.sh
+++ b/ct/pelican-panel.sh
@@ -45,15 +45,21 @@ function update_script() {
    $STD php artisan down
    msg_ok "Stopped Service"

-    cp -r /opt/pelican-panel/.env /opt/
+    cp -a /opt/pelican-panel/.env /opt/backup
+    cp -a /opt/pelican-panel/storage/app/public /opt/backup/storage/app/
+    
    SQLITE_INSTALL=$(ls /opt/pelican-panel/database/*.sqlite 1>/dev/null 2>&1 && echo "true" || echo "false")
-    $SQLITE_INSTALL && cp -r /opt/pelican-panel/database/*.sqlite /opt/
-    rm -rf * .*
+    $SQLITE_INSTALL && cp -r /opt/pelican-panel/database/*.sqlite /opt/backup
+    
+    find /opt/pelican-panel -mindepth 1 -maxdepth 1 ! -name 'backup' ! -name 'plugins' -exec rm -rf {} +
+    
    fetch_and_deploy_gh_release "pelican-panel" "pelican-dev/panel" "prebuild" "latest" "/opt/pelican-panel" "panel.tar.gz"

    msg_info "Updating Pelican Panel"
-    mv /opt/.env /opt/pelican-panel/
-    $SQLITE_INSTALL && mv /opt/*.sqlite /opt/pelican-panel/database/
+    cp -a /opt/backup/.env /opt/pelican-panel/
+    $SQLITE_INSTALL && mv /opt/backup/*.sqlite /opt/pelican-panel/database/
+    cp -a /opt/backup/storage/app/public /opt/pelican-panel/storage/app/
+
    $STD composer install --no-dev --optimize-autoloader --no-interaction
    $STD php artisan p:environment:setup
    $STD php artisan view:clear
--- a/ct/protonmail-bridge.sh
+++ b/ct/protonmail-bridge.sh
@@ -1,79 +0,0 @@
-#!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: Stephen Chin (steveonjava)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/ProtonMail/proton-bridge
-
-APP="ProtonMail-Bridge"
-var_tags="${var_tags:-mail;proton}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-1024}"
-var_disk="${var_disk:-8}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -x /usr/bin/protonmail-bridge ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit 1
-  fi
-
-  if check_for_gh_release "protonmail-bridge" "ProtonMail/proton-bridge"; then
-    local -a bridge_units=(
-      protonmail-bridge
-      protonmail-bridge-imap.socket
-      protonmail-bridge-smtp.socket
-      protonmail-bridge-imap-proxy
-      protonmail-bridge-smtp-proxy
-    )
-    local unit
-    declare -A was_active
-    for unit in "${bridge_units[@]}"; do
-      if systemctl is-active --quiet "$unit" 2>/dev/null; then
-        was_active["$unit"]=1
-      else
-        was_active["$unit"]=0
-      fi
-    done
-
-    msg_info "Stopping Services"
-    systemctl stop protonmail-bridge-imap.socket protonmail-bridge-smtp.socket protonmail-bridge-imap-proxy protonmail-bridge-smtp-proxy protonmail-bridge
-    msg_ok "Stopped Services"
-
-    fetch_and_deploy_gh_release "protonmail-bridge" "ProtonMail/proton-bridge" "binary"
-
-    if [[ -f /home/protonbridge/.protonmailbridge-initialized ]]; then
-      msg_info "Starting Services"
-      for unit in "${bridge_units[@]}"; do
-        if [[ "${was_active[$unit]:-0}" == "1" ]]; then
-          systemctl start "$unit"
-        fi
-      done
-      msg_ok "Started Services"
-    else
-      msg_ok "Initialization not completed. Services remain disabled."
-    fi
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}One-time configuration is required before Bridge services are enabled.${CL}"
-echo -e "${INFO}${YW}Run this command in the container: protonmailbridge-configure${CL}"
--- a/install/alpine-docker-install.sh
+++ b/install/alpine-docker-install.sh
@@ -14,7 +14,7 @@ network_check
 update_os

 msg_info "Installing Dependencies"
-$STD apk add tzdata
+$STD apk add tzdata openssl
 msg_ok "Installed Dependencies"

 msg_info "Installing Docker"
--- a/install/endurain-install.sh
+++ b/install/endurain-install.sh
@@ -3,7 +3,7 @@
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: johanngrobe
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/joaovitoriasilva/endurain
+# Source: https://codeberg.org/endurain-project/endurain

 source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
 color
@@ -21,7 +21,7 @@ PYTHON_VERSION="3.13" setup_uv
 NODE_VERSION="24" setup_nodejs
 PG_VERSION="17" PG_MODULES="postgis" setup_postgresql
 PG_DB_NAME="enduraindb" PG_DB_USER="endurain" setup_postgresql_db
-fetch_and_deploy_gh_release "endurain" "endurain-project/endurain" "tarball" "latest" "/opt/endurain"
+fetch_and_deploy_codeberg_release "endurain" "endurain-project/endurain" "tarball" "latest" "/opt/endurain"

 msg_info "Setting up Endurain"
 cd /opt/endurain
--- a/install/mail-archiver-install.sh
+++ b/install/mail-archiver-install.sh
@@ -22,7 +22,8 @@ setup_deb822_repo \
  "main"
 $STD apt install -y \
  dotnet-sdk-10.0 \
-  aspnetcore-runtime-8.0
+  aspnetcore-runtime-8.0 \
+  libgssapi-krb5-2
 msg_ok "Installed Dependencies"

 PG_VERSION="17" setup_postgresql
--- a/install/protonmail-bridge-install.sh
+++ b/install/protonmail-bridge-install.sh
@@ -1,192 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: Stephen Chin (steveonjava)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/ProtonMail/proton-bridge
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-msg_info "Installing Dependencies"
-$STD apt install -y pass
-msg_ok "Installed Dependencies"
-
-msg_info "Creating Service User"
-useradd -r -m -d /home/protonbridge -s /usr/sbin/nologin protonbridge
-install -d -m 0750 -o protonbridge -g protonbridge /home/protonbridge
-msg_ok "Created Service User"
-
-fetch_and_deploy_gh_release "protonmail-bridge" "ProtonMail/proton-bridge" "binary"
-
-msg_info "Creating Services"
-cat <<EOF >/etc/systemd/system/protonmail-bridge.service
-[Unit]
-Description=Proton Mail Bridge (noninteractive)
-After=network-online.target
-Wants=network-online.target
-ConditionPathExists=/home/protonbridge/.protonmailbridge-initialized
-
-[Service]
-Type=simple
-User=protonbridge
-Group=protonbridge
-WorkingDirectory=/home/protonbridge
-Environment=HOME=/home/protonbridge
-ExecStart=/usr/bin/protonmail-bridge --noninteractive
-Restart=always
-RestartSec=3
-NoNewPrivileges=yes
-PrivateTmp=yes
-ProtectSystem=full
-ProtectKernelTunables=yes
-ProtectKernelModules=yes
-ProtectControlGroups=yes
-
-[Install]
-WantedBy=multi-user.target
-EOF
-cat <<'EOF' >/etc/systemd/system/protonmail-bridge-imap.socket
-[Unit]
-Description=Proton Mail Bridge IMAP Socket (143)
-ConditionPathExists=/home/protonbridge/.protonmailbridge-initialized
-
-[Socket]
-ListenStream=143
-Accept=no
-Service=protonmail-bridge-imap-proxy.service
-
-[Install]
-WantedBy=sockets.target
-EOF
-cat <<'EOF' >/etc/systemd/system/protonmail-bridge-imap-proxy.service
-[Unit]
-Description=Proton Mail Bridge IMAP Proxy (143 -> 127.0.0.1:1143)
-After=protonmail-bridge.service
-Requires=protonmail-bridge.service
-ConditionPathExists=/home/protonbridge/.protonmailbridge-initialized
-
-[Service]
-Type=simple
-Sockets=protonmail-bridge-imap.socket
-ExecStart=/usr/lib/systemd/systemd-socket-proxyd 127.0.0.1:1143
-NoNewPrivileges=yes
-PrivateTmp=yes
-EOF
-cat <<'EOF' >/etc/systemd/system/protonmail-bridge-smtp.socket
-[Unit]
-Description=Proton Mail Bridge SMTP Socket (587)
-ConditionPathExists=/home/protonbridge/.protonmailbridge-initialized
-
-[Socket]
-ListenStream=587
-Accept=no
-Service=protonmail-bridge-smtp-proxy.service
-
-[Install]
-WantedBy=sockets.target
-EOF
-cat <<'EOF' >/etc/systemd/system/protonmail-bridge-smtp-proxy.service
-[Unit]
-Description=Proton Mail Bridge SMTP Proxy (587 -> 127.0.0.1:1025)
-After=protonmail-bridge.service
-Requires=protonmail-bridge.service
-ConditionPathExists=/home/protonbridge/.protonmailbridge-initialized
-
-[Service]
-Type=simple
-Sockets=protonmail-bridge-smtp.socket
-ExecStart=/usr/lib/systemd/systemd-socket-proxyd 127.0.0.1:1025
-NoNewPrivileges=yes
-PrivateTmp=yes
-EOF
-msg_ok "Created Services"
-
-msg_info "Creating Helper Commands"
-
-cat <<'EOF' >/usr/local/bin/protonmailbridge-configure
-#!/usr/bin/env bash
-set -euo pipefail
-
-BRIDGE_USER="protonbridge"
-BRIDGE_HOME="/home/${BRIDGE_USER}"
-GNUPG_HOME="${BRIDGE_HOME}/.gnupg"
-MARKER="${BRIDGE_HOME}/.protonmailbridge-initialized"
-
-FIRST_TIME=0
-if [[ ! -f "${MARKER}" ]]; then
-  FIRST_TIME=1
-fi
-
-# Stop sockets/proxies/bridge daemon before configuration
-systemctl stop protonmail-bridge-imap.socket protonmail-bridge-smtp.socket
-systemctl stop protonmail-bridge-imap-proxy protonmail-bridge-smtp-proxy protonmail-bridge
-
-if [[ "${FIRST_TIME}" == "1" ]]; then
-  echo "First-time setup: initializing pass keychain for ${BRIDGE_USER} (required by Proton Mail Bridge on Linux)."
-
-  install -d -m 0700 -o "${BRIDGE_USER}" -g "${BRIDGE_USER}" "${GNUPG_HOME}"
-
-  FPR="$(runuser -u "${BRIDGE_USER}" -- env HOME="${BRIDGE_HOME}" GNUPGHOME="${GNUPG_HOME}" \
-    gpg --list-secret-keys --with-colons 2>/dev/null | awk -F: '$1=="fpr"{print $10; exit}')"
-
-  if [[ -z "${FPR}" ]]; then
-    runuser -u "${BRIDGE_USER}" -- env HOME="${BRIDGE_HOME}" GNUPGHOME="${GNUPG_HOME}" \
-      gpg --batch --pinentry-mode loopback --passphrase '' \
-      --quick-gen-key 'ProtonMail Bridge' default default never
-
-    FPR="$(runuser -u "${BRIDGE_USER}" -- env HOME="${BRIDGE_HOME}" GNUPGHOME="${GNUPG_HOME}" \
-      gpg --list-secret-keys --with-colons 2>/dev/null | awk -F: '$1=="fpr"{print $10; exit}')"
-  fi
-
-  if [[ -z "${FPR}" ]]; then
-    echo "Failed to detect a GPG key fingerprint for ${BRIDGE_USER}." >&2
-    exit 1
-  fi
-
-  runuser -u "${BRIDGE_USER}" -- env HOME="${BRIDGE_HOME}" GNUPGHOME="${GNUPG_HOME}" \
-    pass init "${FPR}"
-
-  echo
-  echo "To do initial configuration of the Proton Mail Bridge:"
-  echo "Run: login"
-  echo "Run: info"
-  echo "Run: exit"
-  echo
-else
-  echo
-  echo "Launching Proton Mail Bridge CLI for configuration."
-  echo "External access is disabled until you exit."
-  echo "Run: exit"
-  echo
-fi
-
-runuser -u "${BRIDGE_USER}" -- env HOME="${BRIDGE_HOME}" \
-  protonmail-bridge -c
-
-if [[ "${FIRST_TIME}" == "1" ]]; then
-  touch "${MARKER}"
-  chown "${BRIDGE_USER}:${BRIDGE_USER}" "${MARKER}"
-  chmod 0644 "${MARKER}"
-fi
-
-systemctl enable -q --now protonmail-bridge.service protonmail-bridge-imap.socket protonmail-bridge-smtp.socket
-
-if [[ "${FIRST_TIME}" == "1" ]]; then
-  echo "Initialization complete. Services enabled and started."
-else
-  echo "Configuration complete. Services enabled and started."
-fi
-EOF
-chmod +x /usr/local/bin/protonmailbridge-configure
-ln -sf /usr/local/bin/protonmailbridge-configure /usr/bin/protonmailbridge-configure
-msg_ok "Created Helper Commands"
-
-motd_ssh
-customize
-cleanup_lxc
--- a/misc/build.func
+++ b/misc/build.func
@@ -1062,6 +1062,7 @@ load_vars_file() {
    var_gateway var_hostname var_ipv6_method var_mac var_mknod var_mount_fs var_mtu
    var_net var_nesting var_ns var_os var_protection var_pw var_ram var_tags var_timezone var_tun var_unprivileged
    var_verbose var_version var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage var_searchdomain
+    var_post_install
  )

  # Whitelist check helper
@@ -1279,6 +1280,7 @@ default_var_settings() {
    var_gateway var_hostname var_ipv6_method var_mac var_mknod var_mount_fs var_mtu
    var_net var_nesting var_ns var_os var_protection var_pw var_ram var_tags var_timezone var_tun var_unprivileged
    var_verbose var_version var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage
+    var_post_install
  )

  # Snapshot: environment variables (highest precedence)
@@ -1374,6 +1376,11 @@ var_verbose=no
 # GitHub Personal Access Token (optional – avoids API rate limits during installs)
 # Create at https://github.com/settings/tokens – read-only public access is sufficient
 # var_github_token=ghp_your_token_here
+
+# Optional post-install script (host-side path to a *.sh on the Proxmox host)
+# Runs ON THE HOST after the container is fully provisioned.
+# Available env vars: APP, NSAPP, CTID, IP, HN, STORAGE, BRG
+# var_post_install=/opt/post-install/myhook.sh
 EOF

    # Now choose storages (always prompt unless just one exists)
@@ -1452,6 +1459,7 @@ if ! declare -p VAR_WHITELIST >/dev/null 2>&1; then
    var_gateway var_hostname var_ipv6_method var_mac var_mknod var_mount_fs var_mtu
    var_net var_nesting var_ns var_os var_protection var_pw var_ram var_tags var_timezone var_tun var_unprivileged
    var_verbose var_version var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage var_searchdomain
+    var_post_install
  )
 fi

@@ -1664,6 +1672,7 @@ _build_current_app_vars_tmp() {

    [ -n "$_tpl_storage" ] && echo "var_template_storage=$(_sanitize_value "$_tpl_storage")"
    [ -n "$_ct_storage" ] && echo "var_container_storage=$(_sanitize_value "$_ct_storage")"
+    [ -n "${var_post_install:-}" ] && echo "var_post_install=$(_sanitize_value "${var_post_install}")"
  } >"$tmpf"

  echo "$tmpf"
@@ -1808,7 +1817,7 @@ advanced_settings() {
    TAGS="community-script${var_tags:+;${var_tags}}"
  fi
  local STEP=1
-  local MAX_STEP=28
+  local MAX_STEP=29

  # Store values for back navigation - inherit from var_* app defaults
  local _ct_type="${var_unprivileged:-1}"
@@ -1842,6 +1851,7 @@ advanced_settings() {
  local _enable_mknod="${var_mknod:-0}"
  local _mount_fs="${var_mount_fs:-}"
  local _protect_ct="${var_protection:-no}"
+  local _post_install="${var_post_install:-}"

  # Detect host timezone for default (if not set via var_timezone)
  local _host_timezone=""
@@ -2753,7 +2763,8 @@ Features:
 Advanced:
  Timezone: $tz_display
  APT Cacher: $apt_display
-  Verbose: $_verbose"
+  Verbose: $_verbose
+  Post-Install Script: ${_post_install:-(none)}"

      if whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
        --title "CONFIRM SETTINGS" \
@@ -2796,6 +2807,7 @@ Advanced:
  APT_CACHER="$_apt_cacher"
  APT_CACHER_IP="$_apt_cacher_ip"
  VERBOSE="$_verbose"
+  var_post_install="$_post_install"

  # Update var_* based on user choice (for functions that check these)
  var_gpu="$_enable_gpu"
@@ -6305,6 +6317,25 @@ EOF
    systemctl start ping-instances.service
  fi

+  # Optional host-side post-install hook
+  # Path comes from var_post_install (default.vars / app.vars / advanced settings).
+  # Runs ON THE PROXMOX HOST after the container is up and configured.
+  # Exposed env vars: APP, NSAPP, CTID, IP, HN, STORAGE, BRG.
+  if [[ -n "${var_post_install:-}" ]]; then
+    if [[ -f "${var_post_install}" ]]; then
+      msg_info "Running post-install script: ${var_post_install}"
+      if APP="$APP" NSAPP="${NSAPP:-}" CTID="$CTID" IP="$IP" HN="${HN:-}" \
+        STORAGE="${STORAGE:-}" BRG="${BRG:-}" \
+        bash "${var_post_install}"; then
+        msg_ok "Ran post-install script"
+      else
+        msg_error "Post-install script exited with non-zero status (rc=$?)"
+      fi
+    else
+      msg_error "Post-install script not found on host: ${var_post_install}"
+    fi
+  fi
+
  INSTALL_COMPLETE=true
  post_update_to_api "done" "none"
 }
--- a/tools/addon/komodo.sh
+++ b/tools/addon/komodo.sh
@@ -151,6 +151,23 @@ function check_proxmox_host() {
 # ==============================================================================
 # CHECK / INSTALL DOCKER
 # ==============================================================================
+function ensure_openssl() {
+  if command -v openssl &>/dev/null; then
+    return
+  fi
+  msg_info "Installing openssl"
+  if [[ -f /etc/alpine-release ]]; then
+    $STD apk add openssl
+  elif command -v apt-get &>/dev/null; then
+    $STD apt-get update
+    $STD apt-get install -y openssl
+  else
+    msg_error "openssl is required but could not be installed automatically."
+    exit 10
+  fi
+  msg_ok "Installed openssl"
+}
+
 function check_or_install_docker() {
  if command -v docker &>/dev/null; then
    msg_ok "Docker $(docker --version | cut -d' ' -f3 | tr -d ',') is available"
@@ -160,6 +177,7 @@ function check_or_install_docker() {
      msg_error "Docker Compose plugin is not available. Please install it."
      exit 10
    fi
+    ensure_openssl
    return
  fi

@@ -183,6 +201,8 @@ function check_or_install_docker() {
    $STD sh <(curl -fsSL https://get.docker.com)
  fi
  msg_ok "Installed Docker"
+
+  ensure_openssl
 }

 # ==============================================================================
Author	SHA1	Message	Date
MickLesk	53fcf1793a	build.func: add var_post_install (host-side post-install script). Configurable via default.vars/app.vars or new advanced-settings step (path on Proxmox host); runs in description() with APP/CTID/IP env vars.	2026-05-01 22:28:36 +02:00
community-scripts-pr-app[bot]	0dbee93410	Update CHANGELOG.md (#14156 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-05-01 19:00:34 +00:00
community-scripts-pr-app[bot]	1a7d1da029	Update CHANGELOG.md (#14155 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-05-01 19:00:08 +00:00
Kurt Anderson	f6ccf8be5e	paperless-ngx: refresh NLTK data on update (#14144 )	2026-05-01 21:00:05 +02:00
Letter N	ec81640d67	do not delete the public storage!!! (#14145 )	2026-05-01 20:59:38 +02:00
Slaviša Arežina	03a301d736	update dependencies (#14152 )	2026-05-01 20:59:10 +02:00
community-scripts-pr-app[bot]	be81d6255e	Update CHANGELOG.md (#14139 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-04-30 17:17:23 +00:00
CanbiZ (MickLesk)	c9da2daec2	alpine-docker: install openssl as core dependency \| alpine-komodo: check & install openssl if missing (#14134 ) * fix(alpine-docker): install openssl as core dependency * fix(komodo): ensure openssl is available on Alpine before generating secrets	2026-04-30 19:16:52 +02:00
community-scripts-pr-app[bot]	9015023e8c	Update CHANGELOG.md (#14138 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-04-30 16:10:48 +00:00
CanbiZ (MickLesk)	e2a51d4941	Update source references to Codeberg in Endurain scripts (#14128 )	2026-04-30 18:10:18 +02:00