node drift: label bump PRs so they reach the changelog

This workflow now opens one PR per drifting script instead of batching all Node.js version bumps together. Each PR includes the exact version change, a test command, and a clear decision path for manual review or closure. The summary issue also tracks each script's PR state so drift reporting stays in sync across runs.

CHANGELOG.md

@@ -540,30 +540,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
-## 2026-09-07
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - kaneo: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17086](https://github.com/community-scripts/ProxmoxVE/pull/17086))
-    - iobroker: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17085](https://github.com/community-scripts/ProxmoxVE/pull/17085))
-    - reactive-resume: repair any wrong WorkingDirectory on update [@MickLesk](https://github.com/MickLesk) ([#17068](https://github.com/community-scripts/ProxmoxVE/pull/17068))
-    - mediamtx: keep mediamtx.yml across updates [@MickLesk](https://github.com/MickLesk) ([#17069](https://github.com/community-scripts/ProxmoxVE/pull/17069))
-    - omnitools: allow remote action while npm ci [@MickLesk](https://github.com/MickLesk) ([#17070](https://github.com/community-scripts/ProxmoxVE/pull/17070))
-
-  - #### ✨ New Features
-
-    - netboot-xyz: add Secure Boot and Legacy assets [@MickLesk](https://github.com/MickLesk) ([#17066](https://github.com/community-scripts/ProxmoxVE/pull/17066))
-
-  - #### 🔧 Refactor
-
-    - heimdall: set up PHP 8.4 on update, keep only the database, run migrations [@MickLesk](https://github.com/MickLesk) ([#17067](https://github.com/community-scripts/ProxmoxVE/pull/17067))
-
-### 📂 Github
-
-  - github: Open per-script Node bump PRs [@MickLesk](https://github.com/MickLesk) ([#17065](https://github.com/community-scripts/ProxmoxVE/pull/17065))
-
 ## 2026-09-06
 
 ### 🚀 Updated Scripts

ct/headers/safebucket

@@ -1,6 +0,0 @@
-   _____       ____     __               __        __ 
-  / ___/____ _/ __/__  / /_  __  _______/ /_____  / /_
-  \__ \/ __ `/ /_/ _ \/ __ \/ / / / ___/ //_/ _ \/ __/
- ___/ / /_/ / __/  __/ /_/ / /_/ / /__/ ,< /  __/ /_  
-/____/\__,_/_/  \___/_.___/\__,_/\___/_/|_|\___/\__/  
-                                                      

ct/heimdall-dashboard.sh

@@ -37,9 +37,12 @@ function update_script() {
     sleep 1
     msg_ok "Stopped Service"
 
-    create_backup /opt/Heimdall/database/app.sqlite
+    msg_info "Backing up Data"
+    cp -R /opt/Heimdall/database database-backup
+    cp -R /opt/Heimdall/public public-backup
+    sleep 1
+    msg_ok "Backed up Data"
 
-    PHP_VERSION="8.4" PHP_FPM="YES" setup_php
     setup_composer
     fetch_and_deploy_gh_release "Heimdall" "linuxserver/Heimdall" "tarball"
 
@@ -49,15 +52,20 @@ function update_script() {
     rm -f bootstrap/cache/*.php
     export COMPOSER_ALLOW_SUPERUSER=1
     $STD composer install --no-dev --no-interaction --prefer-dist --optimize-autoloader
+    $STD php artisan optimize:clear
     msg_ok "Updated Heimdall-Dashboard"
 
-    restore_backup
+    msg_info "Restoring Data"
+    cd ~
+    cp -R database-backup/* /opt/Heimdall/database
+    cp -R public-backup/* /opt/Heimdall/public
+    sleep 1
+    msg_ok "Restored Data"
 
-    msg_info "Migrating Database"
-    cd /opt/Heimdall
-    $STD php artisan migrate --force
-    $STD php artisan optimize:clear
-    msg_ok "Migrated Database"
+    msg_info "Cleaning Up"
+    rm -rf {public-backup,database-backup}
+    sleep 1
+    msg_ok "Cleaned Up"
 
     msg_info "Starting Service"
     systemctl start heimdall.service

ct/iobroker.sh

@@ -31,7 +31,7 @@ function update_script() {
     exit
   fi
 
-  NODE_VERSION="26" NPM_VERSION="11" setup_nodejs
+  NODE_VERSION="24" setup_nodejs
 
   msg_info "Updating ${APP} LXC"
   $STD apt update

ct/kaneo.sh

@@ -42,7 +42,7 @@ function update_script() {
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "kaneo" "usekaneo/kaneo" "tarball"
 
     PNPM_VERSION=$(sed -n 's/.*"packageManager": "pnpm@\([^"+]*\).*/\1/p' /opt/kaneo/package.json)
-    NODE_VERSION="24" NODE_MODULE="pnpm@${PNPM_VERSION:-10.32.1}" setup_nodejs
+    NODE_VERSION="22" NODE_MODULE="pnpm@${PNPM_VERSION:-10.32.1}" setup_nodejs
 
     restore_backup
 

ct/mediamtx.sh

@@ -37,9 +37,7 @@ function update_script() {
     systemctl stop mediamtx
     msg_ok "Service stopped"
 
-    create_backup /opt/mediamtx/mediamtx.yml
     fetch_and_deploy_gh_release "mediamtx" "bluenviron/mediamtx" "prebuild" "latest" "/opt/mediamtx" "mediamtx*linux_$(arch_resolve).tar.gz"
-    restore_backup
 
     msg_info "Starting service"
     systemctl start mediamtx

ct/netboot-xyz.sh

@@ -58,14 +58,6 @@ function update_script() {
     USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-linux-bin" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-linux.bin"
     USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-dsk" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz.dsk"
     USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-pdsk" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz.pdsk"
-
-    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-efi" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.efi"
-    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-kpxe" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.kpxe"
-    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-lkrn" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.lkrn"
-    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-dsk" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.dsk"
-    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-pdsk" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.pdsk"
-    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-metal-legacy-efi" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-metal-legacy.efi"
-    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-metal-legacy-kpxe" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-metal-legacy.kpxe"
     USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-arm64" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-arm64.efi"
     USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-arm64-snp" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-arm64-snp.efi"
     USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-arm64-snponly" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-arm64-snponly.efi"
@@ -78,12 +70,6 @@ function update_script() {
     USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-arm64-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-arm64.img"
     USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-multiarch-iso" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-multiarch.iso"
     USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-multiarch-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-multiarch.img"
-    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-iso" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.iso"
-    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.img"
-    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-sb-iso" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sb.iso"
-    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-sb-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sb.img"
-    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-sb-arm64-iso" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sb-arm64.iso"
-    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-sb-arm64-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sb-arm64.img"
     USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-checksums" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sha256-checksums.txt"
 
     msg_info "Restoring Configuration"

ct/omnitools.sh

@@ -40,7 +40,7 @@ function update_script() {
     msg_info "Building OmniTools"
     cd /opt/omnitools
     export HUSKY=0
-    $STD npm ci --allow-remote=all
+    $STD npm ci
     $STD npm run build
     msg_ok "Built OmniTools"
 

ct/reactive-resume.sh

@@ -55,7 +55,7 @@ function update_script() {
     msg_ok "Updated Reactive Resume"
 
     msg_info "Updating Service"
-    sed -i -E 's|^WorkingDirectory=/opt/reactive-resume(/.*)?$|WorkingDirectory=/opt/reactive-resume/apps/server|; s|ExecStart=/usr/bin/node .output/server/index.mjs|ExecStart=/usr/bin/node dist/index.mjs|' /etc/systemd/system/reactive-resume.service
+    sed -i 's|WorkingDirectory=/opt/reactive-resume/apps/web|WorkingDirectory=/opt/reactive-resume/apps/server|; s|ExecStart=/usr/bin/node .output/server/index.mjs|ExecStart=/usr/bin/node dist/index.mjs|' /etc/systemd/system/reactive-resume.service
     systemctl daemon-reload
     msg_ok "Updated Service"
 

ct/safebucket.sh

@@ -1,67 +0,0 @@
-#!/usr/bin/env bash
-_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: renizmy
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/safebucket/safebucket
-
-APP="Safebucket"
-var_tags="${var_tags:-files;sharing}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-1024}"
-var_disk="${var_disk:-10}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -f /opt/safebucket/safebucket ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit 1
-  fi
-
-  if check_for_gh_release "safebucket" "safebucket/safebucket"; then
-    local ARCH
-    ARCH=$(arch_resolve)
-
-    msg_info "Stopping Service"
-    systemctl stop safebucket
-    msg_ok "Stopped Service"
-
-    create_backup /opt/safebucket/config.yaml /opt/safebucket/data/
-    fetch_and_deploy_gh_release "safebucket" "safebucket/safebucket" "singlefile" "latest" "/opt/safebucket" "safebucket-linux-${ARCH}"
-    restore_backup
-
-    msg_info "Configuring Safebucket"
-    chown -R safebucket:safebucket /opt/safebucket
-    msg_ok "Configured Safebucket"
-
-    msg_info "Starting Service"
-    systemctl start safebucket
-    msg_ok "Started Service"
-    msg_ok "Updated successfully!"
-  fi
-  cleanup_lxc
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:8080${CL}"

install/iobroker-install.sh

@@ -28,7 +28,7 @@ if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
   exit 10
 fi
 
-NODE_VERSION="26" NPM_VERSION="11" setup_nodejs
+NODE_VERSION="24" setup_nodejs
 
 msg_info "Installing ioBroker (Patience)"
 $STD bash <(curl -fsSL https://iobroker.net/install.sh)

install/kaneo-install.sh

@@ -22,7 +22,7 @@ PG_DB_NAME="kaneo" PG_DB_USER="kaneo" setup_postgresql_db
 fetch_and_deploy_gh_release "kaneo" "usekaneo/kaneo" "tarball"
 
 PNPM_VERSION=$(sed -n 's/.*"packageManager": "pnpm@\([^"+]*\).*/\1/p' /opt/kaneo/package.json)
-NODE_VERSION="24" NODE_MODULE="pnpm@${PNPM_VERSION:-10.32.1}" setup_nodejs
+NODE_VERSION="22" NODE_MODULE="pnpm@${PNPM_VERSION:-10.32.1}" setup_nodejs
 
 msg_info "Configuring Kaneo"
 cat <<EOF >/opt/kaneo/.env

install/netboot-xyz-install.sh

@@ -41,14 +41,6 @@ USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-lkrn" "netbo
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-linux-bin" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-linux.bin"
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-dsk" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz.dsk"
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-pdsk" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz.pdsk"
-
-USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-efi" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.efi"
-USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-kpxe" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.kpxe"
-USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-lkrn" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.lkrn"
-USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-dsk" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.dsk"
-USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-pdsk" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.pdsk"
-USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-metal-legacy-efi" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-metal-legacy.efi"
-USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-metal-legacy-kpxe" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-metal-legacy.kpxe"
 # ARM64 bootloaders
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-arm64" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-arm64.efi"
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-arm64-snp" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-arm64-snp.efi"
@@ -63,12 +55,6 @@ USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-arm64-iso" "
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-arm64-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-arm64.img"
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-multiarch-iso" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-multiarch.iso"
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-multiarch-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-multiarch.img"
-USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-iso" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.iso"
-USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-legacy-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-legacy.img"
-USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-sb-iso" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sb.iso"
-USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-sb-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sb.img"
-USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-sb-arm64-iso" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sb-arm64.iso"
-USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-sb-arm64-img" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sb-arm64.img"
 # SHA256 checksums
 USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "netboot-xyz-checksums" "netbootxyz/netboot.xyz" "singlefile" "latest" "/var/www/html" "netboot.xyz-sha256-checksums.txt"
 

install/omnitools-install.sh

@@ -23,7 +23,7 @@ fetch_and_deploy_gh_release "omnitools" "iib0011/omni-tools" "tarball"
 msg_info "Building OmniTools"
 cd /opt/omnitools
 export HUSKY=0
-$STD npm ci --allow-remote=all
+$STD npm ci
 $STD npm run build
 msg_ok "Built OmniTools"
 

install/safebucket-install.sh

@@ -1,233 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: renizmy
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/safebucket/safebucket
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-ARCH=$(arch_resolve)
-GARAGE_ARCH=$(arch_resolve "x86_64-unknown-linux-musl" "aarch64-unknown-linux-musl")
-
-msg_info "Installing Dependencies"
-$STD apt install -y \
-  awscli
-msg_ok "Installed Dependencies"
-
-msg_info "Installing Garage"
-useradd --system --no-create-home --shell /usr/sbin/nologin garage 2>/dev/null || true
-GARAGE_VERSION=$(curl -fsSL https://api.github.com/repos/deuxfleurs-org/garage/tags |
-  jq -r '.[].name | select(test("^v[0-9]+\\.[0-9]+\\.[0-9]+$"))' | sort -V | tail -n1)
-if [[ -z "$GARAGE_VERSION" ]]; then
-  msg_error "Could not determine latest stable Garage version"
-  exit 1
-fi
-curl -fsSL "https://garagehq.deuxfleurs.fr/_releases/${GARAGE_VERSION}/${GARAGE_ARCH}/garage" -o /usr/local/bin/garage
-chmod +x /usr/local/bin/garage
-mkdir -p /opt/garage/{data,meta}
-RPC_SECRET=$(openssl rand -hex 32)
-ADMIN_TOKEN=$(openssl rand -base64 32)
-cat <<EOF >/opt/garage/garage.toml
-metadata_dir = "/opt/garage/meta"
-data_dir = "/opt/garage/data"
-db_engine = "lmdb"
-replication_factor = 1
-
-rpc_bind_addr = "[::]:3901"
-rpc_public_addr = "127.0.0.1:3901"
-rpc_secret = "${RPC_SECRET}"
-
-[s3_api]
-s3_region = "garage"
-api_bind_addr = "[::]:3900"
-root_domain = ".s3.garage.localhost"
-
-[admin]
-api_bind_addr = "[::]:3903"
-admin_token = "${ADMIN_TOKEN}"
-EOF
-chmod 600 /opt/garage/garage.toml
-chown -R garage:garage /opt/garage
-cat <<EOF >/etc/systemd/system/garage.service
-[Unit]
-Description=Garage Object Storage
-After=network.target
-
-[Service]
-Type=simple
-User=garage
-Group=garage
-WorkingDirectory=/opt/garage
-ExecStart=/usr/local/bin/garage -c /opt/garage/garage.toml server
-Restart=on-failure
-RestartSec=5
-LimitNOFILE=65536
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now garage
-msg_ok "Installed Garage"
-
-msg_info "Configuring Garage Bucket"
-RETRIES=0
-until garage -c /opt/garage/garage.toml status &>/dev/null; do
-  RETRIES=$((RETRIES + 1))
-  if [[ $RETRIES -ge 60 ]]; then
-    msg_error "Garage did not become ready within 60 seconds"
-    exit 1
-  fi
-  sleep 1
-done
-NODE_ID=$(garage -c /opt/garage/garage.toml status 2>/dev/null | awk '/^[0-9a-f]/{print $1; exit}')
-if [[ -z "$NODE_ID" ]]; then
-  msg_error "Could not determine Garage node ID from cluster status"
-  exit 1
-fi
-GARAGE_CAPACITY="${GARAGE_CAPACITY:-$(df -BG --output=avail /opt/garage | awk 'NR==2{gsub(/G/,"",$1); v=$1-1; print (v<1?1:v)"G"}')}"
-$STD garage -c /opt/garage/garage.toml layout assign -z dc1 -c "${GARAGE_CAPACITY}" "${NODE_ID}"
-$STD garage -c /opt/garage/garage.toml layout apply --version 1
-GARAGE_KEY_INFO=$(garage -c /opt/garage/garage.toml key create safebucket-key)
-GARAGE_ACCESS_KEY=$(echo "$GARAGE_KEY_INFO" | awk '/Key ID:/{print $3}')
-GARAGE_SECRET_KEY=$(echo "$GARAGE_KEY_INFO" | awk '/Secret key:/{print $3}')
-$STD garage -c /opt/garage/garage.toml bucket create safebucket
-$STD garage -c /opt/garage/garage.toml bucket allow --read --write --owner safebucket --key safebucket-key
-msg_ok "Configured Garage Bucket"
-
-msg_info "Applying CORS Policy to Bucket"
-export AWS_ACCESS_KEY_ID="${GARAGE_ACCESS_KEY}"
-export AWS_SECRET_ACCESS_KEY="${GARAGE_SECRET_KEY}"
-export AWS_DEFAULT_REGION="garage"
-if aws s3api put-bucket-cors \
-  --bucket safebucket \
-  --endpoint-url "http://127.0.0.1:3900" \
-  --cors-configuration '{"CORSRules":[{"AllowedHeaders":["*"],"AllowedMethods":["GET","PUT","POST","DELETE","HEAD"],"AllowedOrigins":["http://'"${LOCAL_IP}"':8080"],"ExposeHeaders":["ETag"]}]}' &>/dev/null; then
-  msg_ok "Applied CORS Policy to Bucket"
-else
-  msg_warn "Could not apply CORS policy automatically; direct browser uploads may fail until CORS is configured manually"
-fi
-unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_DEFAULT_REGION
-
-msg_info "Installing Safebucket"
-fetch_and_deploy_gh_release "safebucket" "safebucket/safebucket" "singlefile" "latest" "/opt/safebucket" "safebucket-linux-${ARCH}"
-msg_ok "Installed Safebucket"
-
-msg_info "Configuring Safebucket"
-useradd --system --no-create-home --shell /usr/sbin/nologin safebucket 2>/dev/null || true
-mkdir -p /opt/safebucket/data/{notifications,activity}
-TOKEN_SECRET=$(openssl rand -base64 32)
-MFA_KEY=$(openssl rand -base64 48 | tr -dc 'a-zA-Z0-9' | cut -c1-32)
-ADMIN_PASSWORD=$(openssl rand -hex 12)
-cat <<EOF >/opt/safebucket/config.yaml
-app:
-  profile: default
-  log_level: info
-  api_url: http://${LOCAL_IP}:8080
-  web_url: http://${LOCAL_IP}:8080
-  allowed_origins:
-    - http://${LOCAL_IP}:8080
-  port: 8080
-  token_secret: "${TOKEN_SECRET}"
-  mfa_encryption_key: "${MFA_KEY}"
-  mfa_required: false
-  admin_email: admin@safebucket.io
-  admin_password: "${ADMIN_PASSWORD}"
-  trash_retention_days: 7
-  max_upload_size: 5368709120
-  trusted_proxies:
-    - 10.0.0.0/8
-    - 172.16.0.0/12
-    - 192.168.0.0/16
-    - 127.0.0.0/8
-    - ::1/128
-    - fc00::/7
-  static_files:
-    enabled: true
-
-database:
-  type: sqlite
-  sqlite:
-    path: /opt/safebucket/data/safebucket.db
-
-cache:
-  type: memory
-
-storage:
-  type: s3
-  s3:
-    bucket_name: safebucket
-    endpoint: 127.0.0.1:3900
-    external_endpoint: http://${LOCAL_IP}:3900
-    access_key: ${GARAGE_ACCESS_KEY}
-    secret_key: ${GARAGE_SECRET_KEY}
-    region: garage
-    force_path_style: true
-    use_tls: false
-
-events:
-  type: memory
-  queues:
-    notifications:
-      name: safebucket-notifications
-    object_deletion:
-      name: safebucket-object-deletion
-    bucket_events:
-      name: safebucket-bucket-events
-
-notifier:
-  type: filesystem
-  filesystem:
-    directory: /opt/safebucket/data/notifications
-
-activity:
-  type: filesystem
-  filesystem:
-    directory: /opt/safebucket/data/activity
-
-auth:
-  providers:
-    local:
-      name: local
-      type: local
-      sharing:
-        allowed: true
-        domains: []
-EOF
-chmod 600 /opt/safebucket/config.yaml
-chown -R safebucket:safebucket /opt/safebucket
-msg_ok "Configured Safebucket"
-
-msg_info "Creating Service"
-cat <<EOF >/etc/systemd/system/safebucket.service
-[Unit]
-Description=Safebucket File Sharing Platform
-After=network-online.target garage.service
-Wants=network-online.target
-Requires=garage.service
-
-[Service]
-Type=simple
-User=safebucket
-Group=safebucket
-WorkingDirectory=/opt/safebucket
-Environment=CONFIG_FILE_PATH=/opt/safebucket/config.yaml
-ExecStart=/opt/safebucket/safebucket
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now safebucket
-msg_ok "Created Service"
-
-motd_ssh
-customize
-cleanup_lxc