Add docuseal (ct)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

CHANGELOG.md

@@ -461,6 +461,37 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-05-12
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Save Omada version [@lucacome](https://github.com/lucacome) ([#14433](https://github.com/community-scripts/ProxmoxVE/pull/14433))
+
+## 2026-05-11
+
+### 🆕 New Scripts
+
+  - Lychee ([#14424](https://github.com/community-scripts/ProxmoxVE/pull/14424))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Termix: fix nginx pid path and log paths on update (#) [@MickLesk](https://github.com/MickLesk) ([#14419](https://github.com/community-scripts/ProxmoxVE/pull/14419))
+    - Nginxproxymanager: restore NPM nginx.conf after OpenResty rebuid [@MickLesk](https://github.com/MickLesk) ([#14421](https://github.com/community-scripts/ProxmoxVE/pull/14421))
+
+  - #### 🔧 Refactor
+
+    - InvestBrain: add commented reverse proxy config hints to .env [@MickLesk](https://github.com/MickLesk) ([#14422](https://github.com/community-scripts/ProxmoxVE/pull/14422))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - Cronmaster: fix unexpected EOF in update_cronmaster script [@MickLesk](https://github.com/MickLesk) ([#14420](https://github.com/community-scripts/ProxmoxVE/pull/14420))
+
 ## 2026-05-10
 
 ### 🚀 Updated Scripts
@@ -471,6 +502,10 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
     - karakeep: Fix SERVER_VERSION update [@MickLesk](https://github.com/MickLesk) ([#14378](https://github.com/community-scripts/ProxmoxVE/pull/14378))
     - inspIRCd: Fix service not autostarting [@tremor021](https://github.com/tremor021) ([#14368](https://github.com/community-scripts/ProxmoxVE/pull/14368))
 
+  - #### 🔧 Refactor
+
+    - refactor: webcheck [@CrazyWolf13](https://github.com/CrazyWolf13) ([#14391](https://github.com/community-scripts/ProxmoxVE/pull/14391))
+
 ### 💾 Core
 
   - #### 🐞 Bug Fixes

ct/docuseal.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.docuseal.com/
+
+APP="DocuSeal"
+var_tags="${var_tags:-document;esignature;pdf}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/docuseal ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "docuseal" "docusealco/docuseal"; then
+    msg_info "Stopping Services"
+    systemctl stop docuseal docuseal-sidekiq
+    msg_ok "Stopped Services"
+
+    msg_info "Backing up Data"
+    cp /opt/docuseal/.env /opt/docuseal.env.bak
+    [[ -d /opt/docuseal/data ]] && mv /opt/docuseal/data /opt/docuseal_data.bak
+    msg_ok "Backed up Data"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "docuseal" "docusealco/docuseal" "tarball"
+
+    msg_info "Restoring Data"
+    mv /opt/docuseal.env.bak /opt/docuseal/.env
+    [[ -d /opt/docuseal_data.bak ]] && mv /opt/docuseal_data.bak /opt/docuseal/data
+    msg_ok "Restored Data"
+
+    msg_info "Building Application"
+    cd /opt/docuseal
+    export PATH="$HOME/.rbenv/bin:$HOME/.rbenv/shims:$PATH"
+    eval "$(rbenv init - bash)" 2>/dev/null || true
+    export RAILS_ENV=production
+    export NODE_ENV=production
+    export SECRET_KEY_BASE_DUMMY=1
+    set -a
+    source /opt/docuseal/.env
+    set +a
+    $STD bundle config set --local deployment 'true'
+    $STD bundle config set --local without 'development:test'
+    $STD bundle install -j"$(nproc)"
+    $STD yarn install --network-timeout 1000000
+    $STD ./bin/shakapacker
+    $STD bundle exec rails db:migrate
+    $STD bundle exec bootsnap precompile -j 1 --gemfile app/ lib/
+    chown -R docuseal:docuseal /opt/docuseal
+    msg_ok "Built Application"
+
+    msg_info "Starting Services"
+    systemctl start docuseal docuseal-sidekiq
+    msg_ok "Started Services"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:3000${CL}"

ct/headers/docuseal

@@ -0,0 +1,6 @@
+    ____                   _____            __
+   / __ \____  _______  __/ ___/___  ____ _/ /
+  / / / / __ \/ ___/ / / /\__ \/ _ \/ __ `/ / 
+ / /_/ / /_/ / /__/ /_/ /___/ /  __/ /_/ / /  
+/_____/\____/\___/\__,_//____/\___/\__,_/_/   
+                                              

ct/headers/lychee

@@ -0,0 +1,6 @@
+    __               __            
+   / /   __  _______/ /_  ___  ___ 
+  / /   / / / / ___/ __ \/ _ \/ _ \
+ / /___/ /_/ / /__/ / / /  __/  __/
+/_____/\__, /\___/_/ /_/\___/\___/ 
+      /____/                       

ct/headers/solidtime

@@ -0,0 +1,6 @@
+   _____       ___     _________              
+  / ___/____  / (_)___/ /_  __(_)___ ___  ___ 
+  \__ \/ __ \/ / / __  / / / / / __ `__ \/ _ \
+ ___/ / /_/ / / / /_/ / / / / / / / / / /  __/
+/____/\____/_/_/\__,_/ /_/ /_/_/ /_/ /_/\___/ 
+                                              

ct/lychee.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/LycheeOrg/Lychee
+
+APP="Lychee"
+var_tags="${var_tags:-media;photos;gallery}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/lychee ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "lychee" "LycheeOrg/Lychee"; then
+    msg_info "Stopping Services"
+    systemctl stop caddy
+    msg_ok "Stopped Services"
+
+    msg_info "Backing up Data"
+    cp /opt/lychee/.env /opt/lychee.env.bak
+    cp -r /opt/lychee/storage /opt/lychee_storage_backup
+    msg_ok "Backed up Data"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "lychee" "LycheeOrg/Lychee" "prebuild" "latest" "/opt/lychee" "Lychee.zip"
+
+    msg_info "Restoring Data"
+    cp /opt/lychee.env.bak /opt/lychee/.env
+    rm -f /opt/lychee.env.bak
+    cp -r /opt/lychee_storage_backup/. /opt/lychee/storage
+    rm -rf /opt/lychee_storage_backup
+    msg_ok "Restored Data"
+
+    msg_info "Updating Application"
+    cd /opt/lychee
+    $STD php artisan migrate --force
+    $STD php artisan optimize:clear
+    chmod -R 775 /opt/lychee/storage /opt/lychee/bootstrap/cache
+    msg_ok "Updated Application"
+
+    msg_info "Starting Services"
+    systemctl start caddy
+    msg_ok "Started Services"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}${CL}"

ct/nginxproxymanager.sh

@@ -92,6 +92,11 @@ ExecStart=/usr/local/openresty/nginx/sbin/nginx -g 'daemon off;'
 [Install]
 WantedBy=multi-user.target
 EOF
+    if [ -f /opt/nginxproxymanager/docker/rootfs/etc/nginx/nginx.conf ]; then
+      cp /opt/nginxproxymanager/docker/rootfs/etc/nginx/nginx.conf /usr/local/openresty/nginx/conf/nginx.conf
+      sed -i 's+^daemon+#daemon+g' /usr/local/openresty/nginx/conf/nginx.conf
+      sed -i 's+include conf.d+include /etc/nginx/conf.d+g' /usr/local/openresty/nginx/conf/nginx.conf
+    fi
     sed -i 's/user npm/user root/g; s/^pid/#pid/g' /usr/local/openresty/nginx/conf/nginx.conf
     systemctl daemon-reload
     systemctl unmask openresty 2>/dev/null || true

ct/omada.sh

@@ -38,20 +38,32 @@ function update_script() {
 
   JAVA_VERSION="21" setup_java
 
-  msg_info "Updating Omada Controller"
   OMADA_URL=$(curl -fsSL "https://support.omadanetworks.com/en/download/software/omada-controller/" |
     grep -o 'https://static\.tp-link\.com/upload/software/[^"]*linux_x64[^"]*\.deb' |
     head -n1)
-  OMADA_PKG=$(basename "$OMADA_URL")
-  if [ -z "$OMADA_PKG" ]; then
-    msg_error "Could not retrieve Omada package – server may be down."
-    exit
+  OMADA_PKG=$(basename "${OMADA_URL}")
+  VERSION=$(sed -n 's/.*_v\([0-9.]*\)_.*_\([0-9]\{14\}\)\.deb$/\1-\2/p' <<<"${OMADA_PKG}")
+
+  CURRENT_VERSION=$(cat $HOME/.omada 2>/dev/null || echo "0")
+
+  if dpkg --compare-versions "${VERSION}" gt "${CURRENT_VERSION}"; then
+
+    msg_info "Updating Omada Controller"
+
+    if [ -z "${OMADA_PKG}" ]; then
+      msg_error "Could not retrieve Omada package – server may be down."
+      exit
+    fi
+    curl -fsSL "${OMADA_URL}" -o "${OMADA_PKG}"
+    export DEBIAN_FRONTEND=noninteractive
+    $STD dpkg -i "${OMADA_PKG}"
+    rm -f "${OMADA_PKG}"
+    echo "${VERSION}" >$HOME/.omada
+    msg_ok "Updated Omada Controller to ${VERSION}"
+    msg_ok "Updated successfully!"
+  else
+    msg_ok "No update available: ${APP} (${CURRENT_VERSION})"
   fi
-  curl -fsSL "$OMADA_URL" -o "$OMADA_PKG"
-  export DEBIAN_FRONTEND=noninteractive
-  $STD dpkg -i "$OMADA_PKG"
-  rm -f "$OMADA_PKG"
-  msg_ok "Updated successfully!"
   exit
 }
 

ct/solidtime.sh

@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.solidtime.io/
+
+APP="SolidTime"
+var_tags="${var_tags:-time-tracking;productivity;business}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/solidtime ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "solidtime" "solidtime-io/solidtime"; then
+    msg_info "Stopping Services"
+    systemctl stop caddy
+    msg_ok "Stopped Services"
+
+    msg_info "Backing up Data"
+    cp /opt/solidtime/.env /opt/solidtime.env.bak
+    cp -r /opt/solidtime/storage /opt/solidtime_storage_backup
+    msg_ok "Backed up Data"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "solidtime" "solidtime-io/solidtime" "tarball"
+
+    msg_info "Restoring Data"
+    cp /opt/solidtime.env.bak /opt/solidtime/.env
+    rm -f /opt/solidtime.env.bak
+    cp -r /opt/solidtime_storage_backup/. /opt/solidtime/storage
+    rm -rf /opt/solidtime_storage_backup
+    msg_ok "Restored Data"
+
+    msg_info "Updating Application"
+    cd /opt/solidtime
+    $STD composer install --no-dev --optimize-autoloader
+    $STD npm install
+    $STD npm run build
+    $STD php artisan migrate --force
+    $STD php artisan optimize:clear
+    chown -R www-data:www-data /opt/solidtime
+    msg_ok "Updated Application"
+
+    msg_info "Starting Services"
+    systemctl start caddy
+    msg_ok "Started Services"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}${CL}"
+echo -e "${INFO}${YW}HTTPS is not enabled by default (use domain + reverse proxy/TLS if needed).${CL}"

ct/termix.sh

@@ -199,7 +199,9 @@ EOF
       cp /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bak
       curl -fsSL "https://raw.githubusercontent.com/Termix-SSH/Termix/main/docker/nginx.conf" -o /etc/nginx/nginx.conf
       sed -i '/^master_process/d' /etc/nginx/nginx.conf
-      sed -i '/^pid \/app\/nginx/d' /etc/nginx/nginx.conf
+      sed -i 's|pid /tmp/nginx/nginx.pid;|pid /run/nginx.pid;|' /etc/nginx/nginx.conf
+      sed -i 's|error_log /tmp/nginx/error.log|error_log /var/log/nginx/error.log|' /etc/nginx/nginx.conf
+      sed -i 's|access_log /tmp/nginx/access.log|access_log /var/log/nginx/access.log|' /etc/nginx/nginx.conf
       sed -i 's|/app/html|/opt/termix/html|g' /etc/nginx/nginx.conf
       sed -i 's|/app/nginx|/opt/termix/nginx|g' /etc/nginx/nginx.conf
       sed -i 's|listen ${PORT};|listen 80;|g' /etc/nginx/nginx.conf

ct/web-check.sh

@@ -28,7 +28,7 @@ function update_script() {
     exit
   fi
 
-  if check_for_gh_release "web-check" "CrazyWolf13/web-check"; then
+  if check_for_gh_release "web-check" "Lissy93/web-check"; then
     msg_info "Stopping Service"
     systemctl stop web-check
     msg_ok "Stopped Service"
@@ -38,7 +38,7 @@ function update_script() {
     msg_ok "Created backup"
 
     NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "web-check" "CrazyWolf13/web-check" "tarball"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "web-check" "Lissy93/web-check" "tarball"
 
     msg_info "Restoring backup"
     mv /opt/.env /opt/web-check

install/docuseal-install.sh

@@ -0,0 +1,164 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.docuseal.com/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  build-essential \
+  git \
+  libpq-dev \
+  libssl-dev \
+  libyaml-dev \
+  libreadline-dev \
+  zlib1g-dev \
+  libffi-dev \
+  libvips42 \
+  libvips-dev \
+  libheif1 \
+  redis-server \
+  fontconfig
+msg_ok "Installed Dependencies"
+
+NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
+RUBY_VERSION="4.0.1" RUBY_INSTALL_RAILS="false" setup_ruby
+PG_VERSION="17" setup_postgresql
+PG_DB_NAME="docuseal" PG_DB_USER="docuseal" setup_postgresql_db
+
+msg_info "Downloading Fonts and PDFium"
+mkdir -p /opt/fonts /usr/share/fonts/noto
+ARCH=$(uname -m | sed 's/x86_64/x64/;s/aarch64/arm64/')
+curl -fsSL -o /opt/fonts/GoNotoKurrent-Regular.ttf \
+  https://github.com/satbyy/go-noto-universal/releases/download/v7.0/GoNotoKurrent-Regular.ttf
+curl -fsSL -o /opt/fonts/GoNotoKurrent-Bold.ttf \
+  https://github.com/satbyy/go-noto-universal/releases/download/v7.0/GoNotoKurrent-Bold.ttf
+curl -fsSL -o /opt/fonts/DancingScript-Regular.otf \
+  https://github.com/impallari/DancingScript/raw/master/fonts/DancingScript-Regular.otf
+ln -sf /opt/fonts/GoNotoKurrent-Regular.ttf /usr/share/fonts/noto/
+ln -sf /opt/fonts/GoNotoKurrent-Bold.ttf /usr/share/fonts/noto/
+$STD fc-cache -f
+curl -fsSL -o /tmp/pdfium.tgz \
+  "https://github.com/bblanchon/pdfium-binaries/releases/latest/download/pdfium-linux-${ARCH}.tgz"
+mkdir -p /tmp/pdfium && tar -xzf /tmp/pdfium.tgz -C /tmp/pdfium
+cp /tmp/pdfium/lib/libpdfium.so /usr/lib/libpdfium.so
+rm -rf /tmp/pdfium /tmp/pdfium.tgz
+msg_ok "Downloaded Fonts and PDFium"
+
+fetch_and_deploy_gh_release "docuseal" "docusealco/docuseal" "tarball"
+
+msg_info "Downloading Field Detection Model"
+mkdir -p /opt/docuseal/tmp
+curl -fsSL -o /opt/docuseal/tmp/model.onnx \
+  "https://github.com/docusealco/fields-detection/releases/download/2.0.0/model_704_int8.onnx"
+mkdir -p /opt/docuseal/public/fonts
+ln -sf /opt/fonts/DancingScript-Regular.otf /opt/docuseal/public/fonts/DancingScript-Regular.otf
+msg_ok "Downloaded Field Detection Model"
+
+msg_info "Configuring DocuSeal"
+SECRET_KEY=$(openssl rand -hex 64)
+mkdir -p /opt/docuseal/data
+cat <<EOF >/opt/docuseal/.env
+RAILS_ENV=production
+NODE_ENV=production
+RAILS_LOG_TO_STDOUT=true
+RAILS_SERVE_STATIC_FILES=true
+SECRET_KEY_BASE=${SECRET_KEY}
+DATABASE_URL=postgresql://docuseal:${PG_DB_PASS}@127.0.0.1:5432/docuseal
+REDIS_URL=redis://localhost:6379/0
+WORKDIR=/opt/docuseal/data
+VIPS_MAX_COORD=17000
+EOF
+msg_ok "Configured DocuSeal"
+
+msg_info "Building Application"
+cd /opt/docuseal
+export PATH="$HOME/.rbenv/bin:$HOME/.rbenv/shims:$PATH"
+eval "$(rbenv init - bash)" 2>/dev/null || true
+export RAILS_ENV=production
+export NODE_ENV=production
+export SECRET_KEY_BASE_DUMMY=1
+set -a
+source /opt/docuseal/.env
+set +a
+$STD bundle config set --local deployment 'true'
+$STD bundle config set --local without 'development:test'
+$STD bundle install -j"$(nproc)"
+$STD yarn install --network-timeout 1000000
+$STD ./bin/shakapacker
+$STD bundle exec rails db:migrate
+$STD bundle exec bootsnap precompile -j 1 --gemfile app/ lib/
+msg_ok "Built Application"
+
+msg_info "Enabling Redis"
+systemctl enable -q --now redis-server
+msg_ok "Enabled Redis"
+
+msg_info "Creating docuseal User"
+id docuseal &>/dev/null || useradd -u 2000 -M -s /usr/sbin/nologin -d /opt/docuseal docuseal
+chmod o+x /root
+chmod -R o+rX /root/.rbenv
+chown -R docuseal:docuseal /opt/docuseal /opt/fonts
+msg_ok "Created docuseal User"
+
+msg_info "Creating Services"
+cat <<EOF >/etc/systemd/system/docuseal.service
+[Unit]
+Description=DocuSeal Web
+After=network.target postgresql.service redis-server.service
+
+[Service]
+Type=simple
+User=docuseal
+Group=docuseal
+WorkingDirectory=/opt/docuseal
+EnvironmentFile=/opt/docuseal/.env
+Environment=HOME=/opt/docuseal
+Environment=PATH=/root/.rbenv/shims:/root/.rbenv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+Environment=BUNDLE_GEMFILE=/opt/docuseal/Gemfile
+Environment=BUNDLE_WITHOUT=development:test
+ExecStart=/opt/docuseal/bin/bundle exec puma -C /opt/docuseal/config/puma.rb --dir /opt/docuseal -p 3000
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+cat <<EOF >/etc/systemd/system/docuseal-sidekiq.service
+[Unit]
+Description=DocuSeal Sidekiq
+After=network.target postgresql.service redis-server.service
+
+[Service]
+Type=simple
+User=docuseal
+Group=docuseal
+WorkingDirectory=/opt/docuseal
+EnvironmentFile=/opt/docuseal/.env
+Environment=HOME=/opt/docuseal
+Environment=PATH=/root/.rbenv/shims:/root/.rbenv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+Environment=BUNDLE_GEMFILE=/opt/docuseal/Gemfile
+Environment=BUNDLE_WITHOUT=development:test
+ExecStart=/opt/docuseal/bin/bundle exec sidekiq
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now docuseal docuseal-sidekiq
+msg_ok "Created Services"
+
+motd_ssh
+customize
+cleanup_lxc

install/investbrain-install.sh

@@ -90,6 +90,11 @@ MAIL_PORT=2525
 MAIL_FROM_ADDRESS="investbrain@${LOCAL_IP}"
 
 VITE_APP_NAME=Investbrain
+
+# Reverse Proxy Support (uncomment and set APP_URL/ASSET_URL to your domain when using a reverse proxy)
+# APP_URL=https://your-domain.com
+# ASSET_URL=https://your-domain.com
+# TRUSTED_PROXIES=*
 EOF
 export COMPOSER_ALLOW_SUPERUSER=1
 $STD /usr/local/bin/composer install --no-interaction --no-dev --optimize-autoloader

install/lychee-install.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/LycheeOrg/Lychee
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  caddy \
+  libimage-exiftool-perl \
+  jpegoptim
+msg_ok "Installed Dependencies"
+
+PHP_VERSION="8.4" PHP_FPM="YES" PHP_MODULE="bcmath,ldap,exif,gd,intl,imagick,redis,zip,pdo_pgsql,pcntl" setup_php
+PG_VERSION="16" setup_postgresql
+PG_DB_NAME="lychee" PG_DB_USER="lychee" setup_postgresql_db
+setup_ffmpeg
+setup_imagemagick
+
+fetch_and_deploy_gh_release "lychee" "LycheeOrg/Lychee" "prebuild" "latest" "/opt/lychee" "Lychee.zip"
+
+msg_info "Configuring Application"
+cd /opt/lychee
+cp .env.example .env
+APP_KEY=$($STD php artisan key:generate --show)
+sed -i "s|^APP_KEY=.*|APP_KEY=${APP_KEY}|" .env
+sed -i "s|^APP_ENV=.*|APP_ENV=production|" .env
+sed -i "s|^APP_DEBUG=.*|APP_DEBUG=false|" .env
+sed -i "s|^APP_URL=.*|APP_URL=http://${LOCAL_IP}|" .env
+sed -i "s|^DB_CONNECTION=.*|DB_CONNECTION=pgsql|" .env
+sed -i "s|^DB_HOST=.*|DB_HOST=127.0.0.1|" .env
+sed -i "s|^DB_PORT=.*|DB_PORT=5432|" .env
+sed -i "s|^#\?DB_DATABASE=.*|DB_DATABASE=${PG_DB_NAME}|" .env
+sed -i "s|^DB_USERNAME=.*|DB_USERNAME=${PG_DB_USER}|" .env
+sed -i "s|^DB_PASSWORD=.*|DB_PASSWORD=${PG_DB_PASS}|" .env
+mkdir -p storage/framework/{cache,sessions,views} storage/logs bootstrap/cache public/dist public/uploads public/sym
+touch public/dist/user.css public/dist/custom.js
+chmod -R 775 storage bootstrap/cache public/dist public/uploads public/sym
+msg_ok "Configured Application"
+
+msg_info "Running Database Migrations"
+cd /opt/lychee
+$STD php artisan migrate --force
+msg_ok "Ran Database Migrations"
+
+chown -R www-data:www-data /opt/lychee
+
+msg_info "Configuring Caddy"
+PHP_VER=$(php -r 'echo PHP_MAJOR_VERSION . "." . PHP_MINOR_VERSION;')
+cat <<EOF >/etc/caddy/Caddyfile
+:80 {
+    root * /opt/lychee/public
+    php_fastcgi unix//run/php/php${PHP_VER}-fpm.sock
+    file_server
+    encode gzip
+}
+EOF
+usermod -aG www-data caddy
+msg_ok "Configured Caddy"
+
+systemctl enable -q --now php${PHP_VER}-fpm
+systemctl restart caddy
+
+motd_ssh
+customize
+cleanup_lxc

install/omada-install.sh

@@ -38,10 +38,12 @@ msg_info "Installing Omada Controller"
 OMADA_URL=$(curl -fsSL "https://support.omadanetworks.com/en/download/software/omada-controller/" |
   grep -o 'https://static\.tp-link\.com/upload/software/[^"]*linux_x64[^"]*\.deb' |
   head -n1)
-OMADA_PKG=$(basename "$OMADA_URL")
-curl -fsSL "$OMADA_URL" -o "$OMADA_PKG"
-$STD dpkg -i "$OMADA_PKG"
-rm -rf "$OMADA_PKG"
+OMADA_PKG=$(basename "${OMADA_URL}")
+curl -fsSL "${OMADA_URL}" -o "${OMADA_PKG}"
+$STD dpkg -i "${OMADA_PKG}"
+rm -rf "${OMADA_PKG}"
+VERSION=$(sed -n 's/.*_v\([0-9.]*\)_.*_\([0-9]\{14\}\)\.deb$/\1-\2/p' <<<"${OMADA_PKG}")
+echo "${VERSION}" >$HOME/.omada
 msg_ok "Installed Omada Controller"
 
 motd_ssh

install/solidtime-install.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.solidtime.io/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y caddy
+msg_ok "Installed Dependencies"
+
+PHP_VERSION="8.3" PHP_FPM="YES" PHP_MODULES="bcmath,gd,intl,xml,zip,pdo_pgsql,redis,mbstring,curl" setup_php
+setup_composer
+NODE_VERSION="22" setup_nodejs
+PG_VERSION="16" setup_postgresql
+PG_DB_NAME="solidtime" PG_DB_USER="solidtime" setup_postgresql_db
+
+fetch_and_deploy_gh_release "solidtime" "solidtime-io/solidtime" "tarball"
+
+msg_info "Setting up SolidTime"
+cd /opt/solidtime
+cp .env.example .env
+sed -i "s|^APP_ENV=.*|APP_ENV=production|" .env
+sed -i "s|^APP_DEBUG=.*|APP_DEBUG=false|" .env
+sed -i "s|^APP_URL=.*|APP_URL=http://${LOCAL_IP}|" .env
+sed -i "s|^APP_ENABLE_REGISTRATION=.*|APP_ENABLE_REGISTRATION=true|" .env
+sed -i "s|^DB_CONNECTION=.*|DB_CONNECTION=pgsql|" .env
+sed -i "s|^DB_HOST=.*|DB_HOST=127.0.0.1|" .env
+sed -i "s|^DB_PORT=.*|DB_PORT=5432|" .env
+sed -i "s|^DB_DATABASE=.*|DB_DATABASE=${PG_DB_NAME}|" .env
+sed -i "s|^DB_USERNAME=.*|DB_USERNAME=${PG_DB_USER}|" .env
+sed -i "s|^DB_PASSWORD=.*|DB_PASSWORD=${PG_DB_PASS}|" .env
+sed -i "s|^FILESYSTEM_DISK=.*|FILESYSTEM_DISK=local|" .env
+sed -i "s|^PUBLIC_FILESYSTEM_DISK=.*|PUBLIC_FILESYSTEM_DISK=public|" .env
+sed -i "s|^MAIL_MAILER=.*|MAIL_MAILER=log|" .env
+sed -i "s|^SESSION_SECURE_COOKIE=.*|SESSION_SECURE_COOKIE=false|" .env
+grep -q "^SESSION_SECURE_COOKIE=" .env || echo "SESSION_SECURE_COOKIE=false" >>.env
+sed -i "s|^APP_FORCE_HTTPS=.*|APP_FORCE_HTTPS=false|" .env
+grep -q "^APP_FORCE_HTTPS=" .env || echo "APP_FORCE_HTTPS=false" >>.env
+$STD composer install --no-dev --optimize-autoloader
+php artisan self-host:generate-keys >/tmp/solidtime.keys 2>/dev/null
+while IFS= read -r line; do
+  KEY="${line%%=*}"
+  [[ -z "$KEY" || "${KEY:0:1}" == "#" ]] && continue
+  sed -i "/^${KEY}=/d" .env
+  echo "$line" >>.env
+done </tmp/solidtime.keys
+rm -f /tmp/solidtime.keys
+$STD npm install
+$STD npm run build
+rm -rf node_modules
+mkdir -p storage/framework/{cache,sessions,views} storage/logs bootstrap/cache
+chown -R www-data:www-data /opt/solidtime
+chmod -R 775 storage bootstrap/cache
+$STD php artisan storage:link
+$STD php artisan migrate --force
+$STD php artisan passport:client --personal --name="API" -n
+$STD php artisan optimize:clear
+msg_ok "Set up SolidTime"
+
+msg_info "Configuring Caddy"
+PHP_VER=$(php -r 'echo PHP_MAJOR_VERSION . "." . PHP_MINOR_VERSION;')
+cat <<EOF >/etc/caddy/Caddyfile
+:80 {
+    root * /opt/solidtime/public
+    php_fastcgi unix//run/php/php${PHP_VER}-fpm.sock
+    file_server
+    encode gzip
+}
+EOF
+usermod -aG www-data caddy
+systemctl enable -q --now php${PHP_VER}-fpm
+systemctl restart caddy
+msg_ok "Configured Caddy"
+
+motd_ssh
+customize
+cleanup_lxc

install/web-check-install.sh

@@ -18,13 +18,10 @@ export DEBIAN_FRONTEND=noninteractive
 $STD apt -y install --no-install-recommends \
   git \
   traceroute \
-  make \
-  g++ \
-  traceroute \
+  build-essential \
   xvfb \
   dbus \
   xorg \
-  xvfb \
   gtk2-engines-pixbuf \
   dbus-x11 \
   xfonts-base \
@@ -43,16 +40,13 @@ rm -rf /usr/lib/python3.*/EXTERNALLY-MANAGED
 msg_ok "Setup Python3"
 
 msg_info "Installing Chromium"
-curl -fsSL https://dl-ssl.google.com/linux/linux_signing_key.pub | gpg --dearmor -o /usr/share/keyrings/google-chrome-keyring.gpg
-cat <<EOF | sudo tee /etc/apt/sources.list.d/google-chrome.sources >/dev/null
-Types: deb
-URIs: http://dl.google.com/linux/chrome/deb/
-Suites: stable
-Components: main
-Architectures: amd64
-Signed-By: /usr/share/keyrings/google-chrome-keyring.gpg
-EOF
-$STD apt update
+setup_deb822_repo \
+  "google-chrome" \
+  "https://dl-ssl.google.com/linux/linux_signing_key.pub" \
+  "http://dl.google.com/linux/chrome/deb/" \
+  "stable" \
+  "main" \
+  "amd64"
 $STD apt -y install \
   chromium \
   libxss1 \
@@ -64,13 +58,14 @@ msg_info "Setting up Chromium"
 chmod 755 /usr/bin/chromium
 msg_ok "Setup Chromium"
 
-fetch_and_deploy_gh_release "web-check" "CrazyWolf13/web-check" "tarball"
+fetch_and_deploy_gh_release "web-check" "Lissy93/web-check" "tarball"
 
 msg_info "Installing Web-Check (Patience)"
 cd /opt/web-check
 cat <<'EOF' >/opt/web-check/.env
 CHROME_PATH=/usr/bin/chromium
 PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium
+PUPPETEER_SKIP_DOWNLOAD='true'
 HEADLESS=true
 GOOGLE_CLOUD_API_KEY=''
 REACT_APP_SHODAN_API_KEY=''

misc/build.func

@@ -1062,6 +1062,7 @@ load_vars_file() {
     var_gateway var_hostname var_ipv6_method var_mac var_mknod var_mount_fs var_mtu
     var_net var_nesting var_ns var_os var_protection var_pw var_ram var_tags var_timezone var_tun var_unprivileged
     var_verbose var_version var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage var_searchdomain
+    var_post_install
   )
 
   # Whitelist check helper
@@ -1279,6 +1280,7 @@ default_var_settings() {
     var_gateway var_hostname var_ipv6_method var_mac var_mknod var_mount_fs var_mtu
     var_net var_nesting var_ns var_os var_protection var_pw var_ram var_tags var_timezone var_tun var_unprivileged
     var_verbose var_version var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage
+    var_post_install
   )
 
   # Snapshot: environment variables (highest precedence)
@@ -1374,6 +1376,11 @@ var_verbose=no
 # GitHub Personal Access Token (optional – avoids API rate limits during installs)
 # Create at https://github.com/settings/tokens – read-only public access is sufficient
 # var_github_token=ghp_your_token_here
+
+# Optional post-install script (host-side path to a *.sh on the Proxmox host)
+# Runs ON THE HOST after the container is fully provisioned.
+# Available env vars: APP, NSAPP, CTID, IP, HN, STORAGE, BRG
+# var_post_install=/opt/post-install/myhook.sh
 EOF
 
     # Now choose storages (always prompt unless just one exists)
@@ -1452,6 +1459,7 @@ if ! declare -p VAR_WHITELIST >/dev/null 2>&1; then
     var_gateway var_hostname var_ipv6_method var_mac var_mknod var_mount_fs var_mtu
     var_net var_nesting var_ns var_os var_protection var_pw var_ram var_tags var_timezone var_tun var_unprivileged
     var_verbose var_version var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage var_searchdomain
+    var_post_install
   )
 fi
 
@@ -1664,6 +1672,7 @@ _build_current_app_vars_tmp() {
 
     [ -n "$_tpl_storage" ] && echo "var_template_storage=$(_sanitize_value "$_tpl_storage")"
     [ -n "$_ct_storage" ] && echo "var_container_storage=$(_sanitize_value "$_ct_storage")"
+    [ -n "${var_post_install:-}" ] && echo "var_post_install=$(_sanitize_value "${var_post_install}")"
   } >"$tmpf"
 
   echo "$tmpf"
@@ -1808,7 +1817,7 @@ advanced_settings() {
     TAGS="community-script${var_tags:+;${var_tags}}"
   fi
   local STEP=1
-  local MAX_STEP=28
+  local MAX_STEP=29
 
   # Store values for back navigation - inherit from var_* app defaults
   local _ct_type="${var_unprivileged:-1}"
@@ -1842,6 +1851,7 @@ advanced_settings() {
   local _enable_mknod="${var_mknod:-0}"
   local _mount_fs="${var_mount_fs:-}"
   local _protect_ct="${var_protection:-no}"
+  local _post_install="${var_post_install:-}"
 
   # Detect host timezone for default (if not set via var_timezone)
   local _host_timezone=""
@@ -2699,9 +2709,61 @@ advanced_settings() {
       ;;
 
     # ═══════════════════════════════════════════════════════════════════════════
-    # STEP 28: Verbose Mode & Confirmation
+    # STEP 28: Optional host-side post-install hook (path on the Proxmox HOST)
     # ═══════════════════════════════════════════════════════════════════════════
     28)
+      local _hook_prompt="Optional: absolute path to a *.sh file ON THE PROXMOX HOST.
+
+It runs as root on the HOST (NOT in the LXC) after the container
+is fully provisioned and started.
+
+Available env vars: APP, NSAPP, CTID, IP, HN, STORAGE, BRG.
+
+Leave empty to skip."
+      while true; do
+        if result=$(whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
+          --title "POST-INSTALL HOOK (HOST)" \
+          --ok-button "Next" --cancel-button "Back" \
+          --inputbox "$_hook_prompt" 16 70 "${_post_install}" \
+          3>&1 1>&2 2>&3); then
+          # Normalize: strip surrounding whitespace
+          result="$(printf '%s' "$result" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//')"
+          if [[ -z "$result" ]]; then
+            _post_install=""
+            ((STEP++))
+            break
+          fi
+          # Reject obvious shell-meta sneaking through
+          if [[ "$result" == *';'* || "$result" == *'$('* || "$result" == *'`'* || "$result" == *'&&'* || "$result" == *'||'* ]]; then
+            whiptail --backtitle "Proxmox VE Helper Scripts" --title "INVALID PATH" \
+              --msgbox "Path contains shell metacharacters. Please provide a plain absolute file path." 10 70
+            continue
+          fi
+          if [[ "$result" != /* ]]; then
+            whiptail --backtitle "Proxmox VE Helper Scripts" --title "INVALID PATH" \
+              --msgbox "Path must be absolute (start with /).\n\nGot: $result" 10 70
+            continue
+          fi
+          if [[ ! -f "$result" ]]; then
+            if ! whiptail --backtitle "Proxmox VE Helper Scripts" --title "FILE NOT FOUND" \
+              --yesno "File does not exist on host:\n\n$result\n\nKeep this path anyway?" 12 70; then
+              continue
+            fi
+          fi
+          _post_install="$result"
+          ((STEP++))
+          break
+        else
+          ((STEP--))
+          break
+        fi
+      done
+      ;;
+
+    # ═══════════════════════════════════════════════════════════════════════════
+    # STEP 29: Verbose Mode & Confirmation
+    # ═══════════════════════════════════════════════════════════════════════════
+    29)
       local verbose_default_flag="--defaultno"
       [[ "$_verbose" == "yes" ]] && verbose_default_flag=""
 
@@ -2730,6 +2792,11 @@ advanced_settings() {
       local apt_display="${_apt_cacher:-no}"
       [[ "$_apt_cacher" == "yes" && -n "$_apt_cacher_ip" ]] && apt_display="$_apt_cacher_ip"
 
+      local post_install_display="${_post_install:-(none)}"
+      local post_install_warn=""
+      [[ -n "$_post_install" ]] && post_install_warn="
+  ⚠ Hook runs as root on Proxmox HOST (not in LXC)"
+
       local summary="Container Type: $ct_type_desc
 Container ID: $_ct_id
 Hostname: $_hostname
@@ -2753,7 +2820,8 @@ Features:
 Advanced:
   Timezone: $tz_display
   APT Cacher: $apt_display
-  Verbose: $_verbose"
+  Verbose: $_verbose
+  Post-Install Script: ${post_install_display}${post_install_warn}"
 
       if whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
         --title "CONFIRM SETTINGS" \
@@ -2796,6 +2864,7 @@ Advanced:
   APT_CACHER="$_apt_cacher"
   APT_CACHER_IP="$_apt_cacher_ip"
   VERBOSE="$_verbose"
+  var_post_install="$_post_install"
 
   # Update var_* based on user choice (for functions that check these)
   var_gpu="$_enable_gpu"
@@ -6361,6 +6430,40 @@ EOF
     systemctl start ping-instances.service
   fi
 
+  # Optional host-side post-install hook
+  # Path comes from var_post_install (default.vars / app.vars / advanced settings).
+  # Runs ON THE PROXMOX HOST after the container is up and configured.
+  # Exposed env vars: APP, NSAPP, CTID, IP, HN, STORAGE, BRG.
+  # Output (stdout/stderr) is captured to /var/log/community-scripts/post-install-<CTID>.log
+  if [[ -n "${var_post_install:-}" ]]; then
+    local _hook_log_dir="/var/log/community-scripts"
+    local _hook_log="${_hook_log_dir}/post-install-${CTID}.log"
+    mkdir -p "$_hook_log_dir" 2>/dev/null || true
+
+    if [[ ! -f "${var_post_install}" ]]; then
+      msg_error "Post-install hook not found on host: ${var_post_install}"
+      whiptail --backtitle "Proxmox VE Helper Scripts" \
+        --title "POST-INSTALL HOOK FAILED" \
+        --msgbox "The configured post-install hook was not found on the Proxmox host:\n\n${var_post_install}\n\nThe LXC was created successfully, but the hook did NOT run." 14 72 || true
+    else
+      msg_info "Running post-install hook: ${var_post_install}"
+      local _hook_rc=0
+      APP="$APP" NSAPP="${NSAPP:-}" CTID="$CTID" IP="$IP" HN="${HN:-}" \
+        STORAGE="${STORAGE:-}" BRG="${BRG:-}" \
+        bash "${var_post_install}" >"${_hook_log}" 2>&1 || _hook_rc=$?
+      if [[ $_hook_rc -eq 0 ]]; then
+        msg_ok "Post-install hook completed (log: ${_hook_log})"
+      else
+        msg_error "Post-install hook failed (rc=${_hook_rc}) – see ${_hook_log}"
+        local _hook_tail=""
+        _hook_tail="$(tail -n 15 "${_hook_log}" 2>/dev/null || true)"
+        whiptail --backtitle "Proxmox VE Helper Scripts" \
+          --title "POST-INSTALL HOOK FAILED" \
+          --msgbox "Hook exited with code ${_hook_rc}.\n\nScript: ${var_post_install}\nLog:    ${_hook_log}\n\n--- Last log lines ---\n${_hook_tail}\n\nThe LXC itself was created successfully." 22 78 || true
+      fi
+    fi
+  fi
+
   INSTALL_COMPLETE=true
   post_update_to_api "done" "none"
 }

tools/addon/cronmaster.sh

@@ -147,7 +147,7 @@ EOF
   # Create update script
   msg_info "Creating update script"
   ensure_usr_local_bin_persist
-  cat <<EOF >/usr/local/bin/update_cronmaster
+  cat <<'EOF' >/usr/local/bin/update_cronmaster
 #!/usr/bin/env bash
 # CronMaster Update Script
 type=update bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/cronmaster.sh)"

tools/addon/qbittorrent-exporter.sh

@@ -68,6 +68,24 @@ function uninstall() {
 # ==============================================================================
 function update() {
   if check_for_gh_release "qbittorrent-exporter" "martabal/qbittorrent-exporter"; then
+    if [[ "$(printf '%s\n' "2.0.0" "$CHECK_UPDATE_RELEASE" | sort -V | tail -n1)" == "$CHECK_UPDATE_RELEASE" ]] && \
+       ! grep -q "QBITTORRENT_API_KEY" "$CONFIG_PATH" 2>/dev/null; then
+      echo ""
+      msg_warn "Version 2.0.0 introduces a breaking change: username/password login has been replaced by an API key."
+      echo -e "${TAB3}${INFO} You must create an API key in qBittorrent under Tools > Options > Web UI > API key"
+      echo ""
+      echo -n "${TAB3}Enter your qBittorrent API key (or press Enter to abort): "
+      read -r QBITTORRENT_API_KEY
+      if [[ -z "$QBITTORRENT_API_KEY" ]]; then
+        msg_warn "No API key provided. Update aborted."
+        exit 0
+      fi
+      sed -i '/^QBITTORRENT_USERNAME=/d' "$CONFIG_PATH"
+      sed -i '/^QBITTORRENT_PASSWORD=/d' "$CONFIG_PATH"
+      echo "QBITTORRENT_API_KEY=\"${QBITTORRENT_API_KEY}\"" >>"$CONFIG_PATH"
+      msg_ok "API key saved to configuration"
+    fi
+
     msg_info "Stopping service"
     if [[ "$OS" == "Alpine" ]]; then
       rc-service qbittorrent-exporter stop &>/dev/null
@@ -100,10 +118,9 @@ function update() {
 # INSTALL
 # ==============================================================================
 function install() {
-  read -erp "Enter URL of qBittorrent, example: (http://127.0.0.1:8080): " QBITTORRENT_BASE_URL
-  read -erp "Enter qBittorrent username: " QBITTORRENT_USERNAME
-  read -rsp "Enter qBittorrent password: " QBITTORRENT_PASSWORD
-  printf "\n"
+  read -erp "${TAB3}Enter URL of qBittorrent, example: (http://127.0.0.1:8080): " QBITTORRENT_BASE_URL
+  echo -e "${TAB3}${INFO} Create an API key in qBittorrent under Tools > Options > Web UI > API key"
+  read -erp "${TAB3}Enter qBittorrent API key: " QBITTORRENT_API_KEY
 
   fetch_and_deploy_gh_release "qbittorrent-exporter" "martabal/qbittorrent-exporter" "tarball" "latest"
   setup_go
@@ -116,8 +133,7 @@ function install() {
   cat <<EOF >"$CONFIG_PATH"
 # https://github.com/martabal/qbittorrent-exporter?tab=readme-ov-file#parameters
 QBITTORRENT_BASE_URL="${QBITTORRENT_BASE_URL}"
-QBITTORRENT_USERNAME="${QBITTORRENT_USERNAME}"
-QBITTORRENT_PASSWORD="${QBITTORRENT_PASSWORD}"
+QBITTORRENT_API_KEY="${QBITTORRENT_API_KEY}"
 EOF
   msg_ok "Created configuration"
 

tools/pve/post-install-hook-examples.sh

@@ -0,0 +1,436 @@
+#!/usr/bin/env bash
+# ============================================================================
+#  Community-Scripts ProxmoxVE — Post-Install Hook: Example Library
+# ----------------------------------------------------------------------------
+#  This file is NOT meant to be executed as-is.
+#  It is a collection of complete, copy-pasteable example hooks for the
+#  optional `var_post_install` feature in build.func.
+#
+#  HOW IT WORKS
+#  ------------
+#  In the ct/*.sh CT scripts (or via Advanced Settings → Step 28) you can
+#  point `var_post_install` to an absolute path on the Proxmox HOST, e.g.:
+#
+#      # in /root/.community-scripts/default.vars
+#      var_post_install=/opt/community-scripts/hooks/notify.sh
+#
+#      # OR per-app, in app.vars
+#      var_post_install=/opt/community-scripts/hooks/vaultwarden-postprovision.sh
+#
+#      # OR interactively in the Advanced Settings whiptail (Step 28).
+#
+#  The hook runs ON THE PROXMOX HOST (NOT inside the LXC) as root,
+#  AFTER the container is fully provisioned, started and the description
+#  is set. stdout/stderr is captured to:
+#
+#      /var/log/community-scripts/post-install-<CTID>.log
+#
+#  AVAILABLE ENV VARIABLES
+#  -----------------------
+#    APP        - Pretty name (e.g. "Vaultwarden")
+#    NSAPP      - Slug / lowercase  (e.g. "vaultwarden")
+#    CTID       - Numeric container ID (e.g. "103")
+#    IP         - IPv4 address of the LXC (e.g. "192.168.1.50")
+#    HN         - Hostname (e.g. "vaultwarden")
+#    STORAGE    - Storage where the rootfs lives (e.g. "local-lvm")
+#    BRG        - Bridge (e.g. "vmbr0")
+#
+#  GENERAL TIPS
+#  ------------
+#  - Use `set -euo pipefail` so failures actually surface.
+#  - Use `|| true` on best-effort steps you do not want to abort the hook.
+#  - The file just needs to be a valid script. `+x` is optional — it is
+#    invoked via `bash <path>`. Shebang is honored only if you call it
+#    yourself; otherwise the shebang line is purely cosmetic.
+#  - If the hook exits non-zero, the user gets a whiptail popup with the
+#    last 15 log lines. The LXC creation itself is NOT rolled back.
+#  - Keep hooks idempotent — they may be re-run if you recreate a CT.
+#
+#  HOW TO USE THIS FILE
+#  --------------------
+#    1. Copy ONE example block (between the BEGIN/END markers) into a new
+#       file on the Proxmox host, e.g. /opt/community-scripts/hooks/notify.sh
+#    2. chmod +x /opt/community-scripts/hooks/notify.sh   (optional)
+#    3. Set var_post_install in default.vars / app.vars or pick the path
+#       in Advanced Settings.
+# ============================================================================
+
+# ============================================================================
+# ▼▼▼ EXAMPLE 1 — BEGIN ▼▼▼
+# ----------------------------------------------------------------------------
+#  Name        : minimal-logger.sh
+#  Purpose     : Append every newly created LXC to a single CSV-ish log.
+#  Difficulty  : ⭐ Beginner
+#  Side effects: Writes to /var/log/community-scripts/created-lxcs.log
+#  Use case    : You just want a paper trail of "what got created when".
+# ============================================================================
+#!/usr/bin/env bash
+set -euo pipefail
+
+LOG_DIR="/var/log/community-scripts"
+LOG_FILE="${LOG_DIR}/created-lxcs.log"
+
+mkdir -p "$LOG_DIR"
+
+# Header on first use
+if [[ ! -s "$LOG_FILE" ]]; then
+  echo "timestamp;ctid;app;hostname;ip;bridge;storage" >"$LOG_FILE"
+fi
+
+printf '%s;%s;%s;%s;%s;%s;%s\n' \
+  "$(date -Iseconds)" \
+  "${CTID}" \
+  "${APP}" \
+  "${HN}" \
+  "${IP}" \
+  "${BRG}" \
+  "${STORAGE}" \
+  >>"$LOG_FILE"
+
+echo "Logged ${APP} (CTID=${CTID}) to ${LOG_FILE}"
+# ▲▲▲ EXAMPLE 1 — END ▲▲▲
+
+# ============================================================================
+# ▼▼▼ EXAMPLE 2 — BEGIN ▼▼▼
+# ----------------------------------------------------------------------------
+#  Name        : discord-gotify-notify.sh
+#  Purpose     : Send a rich Discord embed AND a Gotify push notification
+#                whenever a new LXC is provisioned.
+#  Difficulty  : ⭐⭐ Intermediate
+#  Requires    : curl on the host (default), reachable webhook URLs.
+#  Side effects: Outbound HTTPS to Discord + your Gotify server.
+# ============================================================================
+#!/usr/bin/env bash
+set -euo pipefail
+
+# --- CONFIG (edit me) -------------------------------------------------------
+DISCORD_WEBHOOK="https://discord.com/api/webhooks/XXXXXXXX/YYYYYYYY"
+GOTIFY_URL="https://gotify.example.com"
+GOTIFY_TOKEN="AbCdEfGhIjKlMnO"
+GOTIFY_PRIORITY=5
+# ----------------------------------------------------------------------------
+
+# Resolve the Proxmox node's hostname for context
+NODE="$(hostname -s)"
+TS="$(date -Iseconds)"
+
+# --- Discord embed ----------------------------------------------------------
+read -r -d '' DISCORD_PAYLOAD <<JSON || true
+{
+  "username": "Proxmox - ${NODE}",
+  "avatar_url": "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/images/logo-81x112.png",
+  "embeds": [{
+    "title": "✅ ${APP} LXC created",
+    "description": "A new community-script LXC has been provisioned on **${NODE}**.",
+    "color": 3066993,
+    "timestamp": "${TS}",
+    "fields": [
+      {"name": "CTID",     "value": "${CTID}",    "inline": true},
+      {"name": "Hostname", "value": "${HN}",      "inline": true},
+      {"name": "App",      "value": "${APP}",     "inline": true},
+      {"name": "IP",       "value": "${IP}",      "inline": true},
+      {"name": "Bridge",   "value": "${BRG}",     "inline": true},
+      {"name": "Storage",  "value": "${STORAGE}", "inline": true}
+    ],
+    "footer": {"text": "community-scripts.org"}
+  }]
+}
+JSON
+
+curl -fsS --max-time 10 \
+  -H "Content-Type: application/json" \
+  -X POST "$DISCORD_WEBHOOK" \
+  --data "$DISCORD_PAYLOAD" \
+  >/dev/null ||
+  echo "WARN: Discord webhook failed (non-fatal)"
+
+# --- Gotify push ------------------------------------------------------------
+curl -fsS --max-time 10 \
+  -H "X-Gotify-Key: ${GOTIFY_TOKEN}" \
+  -F "title=Proxmox: ${APP} LXC created" \
+  -F "message=CTID=${CTID}  IP=${IP}  HN=${HN}  on ${NODE}" \
+  -F "priority=${GOTIFY_PRIORITY}" \
+  "${GOTIFY_URL}/message" \
+  >/dev/null ||
+  echo "WARN: Gotify push failed (non-fatal)"
+
+echo "Notifications dispatched for CTID=${CTID}"
+# ▲▲▲ EXAMPLE 2 — END ▲▲▲
+
+# ============================================================================
+# ▼▼▼ EXAMPLE 3 — BEGIN ▼▼▼
+# ----------------------------------------------------------------------------
+#  Name        : auto-pool-tags-backup.sh
+#  Purpose     : Add the new LXC to a Proxmox pool, append cluster-wide tags,
+#                register a DNS record in pi-hole, and trigger an immediate
+#                snapshot backup to a configured storage.
+#  Difficulty  : ⭐⭐⭐ Advanced
+#  Requires    : pvesh, pct, vzdump (host-side; available by default on PVE),
+#                a reachable pi-hole admin API.
+# ============================================================================
+#!/usr/bin/env bash
+set -euo pipefail
+
+# --- CONFIG (edit me) -------------------------------------------------------
+TARGET_POOL="auto-lxc"
+EXTRA_TAGS=("auto-provisioned" "${NSAPP}") # community-script tag is set by build.func
+BACKUP_STORAGE="pbs-main"                  # set to "" to skip initial backup
+PIHOLE_HOST="192.168.1.5"
+PIHOLE_PASSWORD="changeme" # web-UI password
+DNS_DOMAIN="lan"           # FQDN will be ${HN}.${DNS_DOMAIN}
+# ----------------------------------------------------------------------------
+
+# 1) Ensure the pool exists, then attach the CT
+if ! pvesh get "/pools/${TARGET_POOL}" >/dev/null 2>&1; then
+  echo "Creating pool: ${TARGET_POOL}"
+  pvesh create /pools --poolid "${TARGET_POOL}" --comment "Auto-created by post-install hook" || true
+fi
+echo "Adding CTID=${CTID} to pool=${TARGET_POOL}"
+pvesh set "/pools/${TARGET_POOL}" --vms "${CTID}" || echo "WARN: pool attach failed (non-fatal)"
+
+# 2) Merge new tags with existing ones (preserve community-script etc.)
+CURRENT_TAGS="$(pct config "${CTID}" | awk -F': ' '/^tags:/{print $2}')"
+declare -A TAG_SET
+IFS=';' read -r -a CUR_ARR <<<"${CURRENT_TAGS:-}"
+for t in "${CUR_ARR[@]}"; do [[ -n "$t" ]] && TAG_SET["$t"]=1; done
+for t in "${EXTRA_TAGS[@]}"; do [[ -n "$t" ]] && TAG_SET["$t"]=1; done
+NEW_TAGS="$(
+  IFS=';'
+  echo "${!TAG_SET[*]}"
+)"
+echo "Setting tags: ${NEW_TAGS}"
+pct set "${CTID}" --tags "${NEW_TAGS}" || echo "WARN: tag update failed (non-fatal)"
+
+# 3) Register DNS in pi-hole (custom DNS record)
+FQDN="${HN}.${DNS_DOMAIN}"
+echo "Registering DNS: ${FQDN} → ${IP} on pi-hole ${PIHOLE_HOST}"
+SID="$(curl -fsS --max-time 5 \
+  -d "pw=${PIHOLE_PASSWORD}" \
+  "http://${PIHOLE_HOST}/api/auth" 2>/dev/null |
+  sed -nE 's/.*"sid":"([^"]+)".*/\1/p' || true)"
+
+if [[ -n "${SID}" ]]; then
+  curl -fsS --max-time 5 -X PUT \
+    -H "Content-Type: application/json" \
+    -H "sid: ${SID}" \
+    -d "{\"hosts\":[\"${IP} ${FQDN}\"]}" \
+    "http://${PIHOLE_HOST}/api/config/dns/hosts" >/dev/null ||
+    echo "WARN: pi-hole DNS update failed (non-fatal)"
+  curl -fsS --max-time 5 -X DELETE -H "sid: ${SID}" "http://${PIHOLE_HOST}/api/auth" >/dev/null || true
+else
+  echo "WARN: could not obtain pi-hole session (skipping DNS)"
+fi
+
+# 4) Initial backup (best-effort, can take a few minutes)
+if [[ -n "${BACKUP_STORAGE}" ]]; then
+  if pvesh get "/storage/${BACKUP_STORAGE}" >/dev/null 2>&1; then
+    echo "Triggering initial backup of CTID=${CTID} to ${BACKUP_STORAGE}"
+    vzdump "${CTID}" \
+      --storage "${BACKUP_STORAGE}" \
+      --mode snapshot \
+      --compress zstd \
+      --notes-template "Initial backup of ${APP} (CTID=${CTID})" \
+      --notification-mode auto ||
+      echo "WARN: initial backup failed (non-fatal)"
+  else
+    echo "Backup storage '${BACKUP_STORAGE}' not found — skipping."
+  fi
+fi
+
+echo "Post-provision routine complete for ${APP} (CTID=${CTID})"
+# ▲▲▲ EXAMPLE 3 — END ▲▲▲
+
+# ============================================================================
+# ▼▼▼ EXAMPLE 4 — BEGIN ▼▼▼
+# ----------------------------------------------------------------------------
+#  Name        : inject-ssh-and-monitoring.sh
+#  Purpose     : Push the host's admin SSH key into the new LXC, install the
+#                Beszel monitoring agent inside the container, and register
+#                an Uptime-Kuma HTTP push monitor for the LXC's IP.
+#  Difficulty  : ⭐⭐⭐ Advanced
+#  Requires    : pct (host), curl (inside LXC), reachable Beszel hub +
+#                Uptime-Kuma push URL.
+# ============================================================================
+#!/usr/bin/env bash
+set -euo pipefail
+
+# --- CONFIG (edit me) -------------------------------------------------------
+ADMIN_KEY="/root/.ssh/admin_ed25519.pub"
+BESZEL_HUB_URL="http://192.168.1.10:8090"
+BESZEL_AGENT_KEY="ssh-ed25519 AAAA... beszel@hub" # public key of the hub
+UPTIME_KUMA_PUSH_BASE="http://uptime.lan/api/push/abc123"
+# ----------------------------------------------------------------------------
+
+# 1) Inject the admin SSH key
+if [[ -f "${ADMIN_KEY}" ]]; then
+  echo "Pushing admin SSH key into CTID=${CTID}"
+  pct exec "${CTID}" -- mkdir -p /root/.ssh
+  pct exec "${CTID}" -- chmod 700 /root/.ssh
+  pct push "${CTID}" "${ADMIN_KEY}" /root/.ssh/authorized_keys
+  pct exec "${CTID}" -- chmod 600 /root/.ssh/authorized_keys
+else
+  echo "WARN: ${ADMIN_KEY} not found on host — skipping SSH key injection"
+fi
+
+# 2) Wait for outbound networking inside the CT (max 30 s)
+echo "Waiting for network inside CTID=${CTID}…"
+for _ in $(seq 1 30); do
+  if pct exec "${CTID}" -- bash -c 'getent hosts deb.debian.org >/dev/null 2>&1'; then
+    break
+  fi
+  sleep 1
+done
+
+# 3) Install Beszel agent inside the LXC
+echo "Installing Beszel agent inside CTID=${CTID}"
+pct exec "${CTID}" -- bash -s <<'AGENT_INSTALL' || echo "WARN: Beszel install failed"
+set -euo pipefail
+ARCH="$(uname -m)"
+case "$ARCH" in
+  x86_64)   ARCH_TAG=amd64 ;;
+  aarch64)  ARCH_TAG=arm64 ;;
+  *) echo "Unsupported arch: $ARCH"; exit 1 ;;
+esac
+TMP=$(mktemp -d)
+cd "$TMP"
+curl -fsSL "https://github.com/henrygd/beszel/releases/latest/download/beszel-agent_linux_${ARCH_TAG}.tar.gz" \
+  | tar -xz
+install -m 0755 beszel-agent /usr/local/bin/beszel-agent
+
+cat >/etc/systemd/system/beszel-agent.service <<UNIT
+[Unit]
+Description=Beszel Agent
+After=network-online.target
+Wants=network-online.target
+[Service]
+Environment="PORT=45876"
+Environment="KEY=__KEY_PLACEHOLDER__"
+ExecStart=/usr/local/bin/beszel-agent
+Restart=always
+[Install]
+WantedBy=multi-user.target
+UNIT
+AGENT_INSTALL
+
+# Inject the configured public key into the unit file (avoids quoting hell)
+pct exec "${CTID}" -- sed -i "s|__KEY_PLACEHOLDER__|${BESZEL_AGENT_KEY}|" \
+  /etc/systemd/system/beszel-agent.service
+
+pct exec "${CTID}" -- systemctl daemon-reload
+pct exec "${CTID}" -- systemctl enable --now beszel-agent.service ||
+  echo "WARN: could not start beszel-agent"
+
+# 4) Register an Uptime-Kuma push monitor (host-side, just sends one ping)
+echo "Pinging Uptime-Kuma push monitor for ${HN}"
+curl -fsS --max-time 5 \
+  --get \
+  --data-urlencode "status=up" \
+  --data-urlencode "msg=created by community-scripts" \
+  --data-urlencode "ping=1" \
+  --data-urlencode "label=${HN}" \
+  "${UPTIME_KUMA_PUSH_BASE}" >/dev/null ||
+  echo "WARN: Uptime-Kuma push failed (non-fatal)"
+
+echo "Provisioned monitoring for ${APP} (CTID=${CTID}, IP=${IP})"
+# ▲▲▲ EXAMPLE 4 — END ▲▲▲
+
+# ============================================================================
+# ▼▼▼ EXAMPLE 5 — BEGIN ▼▼▼
+# ----------------------------------------------------------------------------
+#  Name        : per-app-router.sh
+#  Purpose     : Single dispatcher hook that runs different actions
+#                depending on the app being installed (NSAPP). Useful when
+#                you want ONE hook for the whole cluster but distinct
+#                behavior for, e.g., databases vs media services.
+#  Difficulty  : ⭐⭐⭐ Advanced
+# ============================================================================
+#!/usr/bin/env bash
+set -euo pipefail
+
+# --- CONFIG (edit me) -------------------------------------------------------
+DEFAULT_DNS_SUFFIX="lan"
+PROM_FILE_SD_DIR="/etc/prometheus/file_sd" # on the host that runs Prometheus
+# ----------------------------------------------------------------------------
+
+log() { printf '[%s] %s\n' "$(date +%H:%M:%S)" "$*"; }
+
+# ---------- shared helpers --------------------------------------------------
+register_prometheus_target() {
+  local job="$1" port="$2"
+  local file="${PROM_FILE_SD_DIR}/${job}.json"
+  mkdir -p "${PROM_FILE_SD_DIR}"
+  if [[ ! -f "$file" ]]; then echo "[]" >"$file"; fi
+  python3 - "$file" "${IP}:${port}" "${HN}" "${NSAPP}" <<'PY'
+import json, sys
+path, target, hn, app = sys.argv[1:5]
+data = json.load(open(path))
+# Avoid duplicates
+data = [b for b in data if target not in b.get("targets", [])]
+data.append({"targets": [target], "labels": {"hostname": hn, "app": app}})
+json.dump(data, open(path, "w"), indent=2)
+PY
+  log "Registered Prometheus target ${IP}:${port} in ${file}"
+}
+
+set_ct_options() {
+  local cores="$1" mem="$2" desc="$3"
+  pct set "${CTID}" --cores "${cores}" --memory "${mem}" || true
+  pct set "${CTID}" --description "${desc}" || true
+}
+
+# ---------- per-app dispatch ------------------------------------------------
+log "Dispatching post-install for NSAPP=${NSAPP} CTID=${CTID}"
+
+case "${NSAPP}" in
+
+# ------ Databases ---------------------------------------------------------
+postgresql | mariadb | mongodb | redis | valkey)
+  log "Database role: bumping resources & adding to backup-critical pool"
+  set_ct_options 4 4096 "DB: ${APP}"
+  pvesh set /pools/db-critical --vms "${CTID}" 2>/dev/null || true
+  register_prometheus_target "${NSAPP}-exporter" 9187
+  ;;
+
+# ------ *arr media stack --------------------------------------------------
+sonarr | radarr | prowlarr | lidarr | readarr | bazarr)
+  log "Media-arr role: tagging + Sonarr/Radarr API webhook"
+  pct set "${CTID}" --tags "community-script;media;arr-stack" || true
+  curl -fsS --max-time 5 -X POST \
+    "http://media-hub.${DEFAULT_DNS_SUFFIX}/hooks/arr-added" \
+    -H "Content-Type: application/json" \
+    -d "{\"app\":\"${NSAPP}\",\"ctid\":${CTID},\"ip\":\"${IP}\"}" \
+    >/dev/null || log "WARN: media-hub webhook failed"
+  ;;
+
+# ------ Web apps that should sit behind NPM/Traefik ----------------------
+vaultwarden | paperless-ngx | nextcloud | immich | bookstack)
+  log "Web app role: registering reverse-proxy entry"
+  curl -fsS --max-time 5 -X POST \
+    "http://traefik.${DEFAULT_DNS_SUFFIX}/api/dynamic-add" \
+    -H "Content-Type: application/json" \
+    -d "$(
+      cat <<JSON
+{
+  "name": "${HN}",
+  "host": "${HN}.${DEFAULT_DNS_SUFFIX}",
+  "backend": "http://${IP}",
+  "app": "${NSAPP}"
+}
+JSON
+    )" >/dev/null || log "WARN: traefik registration failed"
+  register_prometheus_target "blackbox-http" 80
+  ;;
+
+# ------ Default fallback --------------------------------------------------
+*)
+  log "No special handling for ${NSAPP} — applying generic defaults"
+  register_prometheus_target "node-exporter" 9100
+  ;;
+esac
+
+log "Finished dispatcher for ${APP} (CTID=${CTID})"
+# ▲▲▲ EXAMPLE 5 — END ▲▲▲
+
+# ============================================================================
+#  END OF EXAMPLES
+# ============================================================================