Update nginx-ui.sh

The previous install script started nginx-ui for 3 seconds, stopped it,
and ran reset-password to create an admin user. This caused:
- Race condition: the internal setup wizard could trigger during the brief
  start window, conflicting with the reset-password approach
- Admin users unable to login after the setup wizard fired
- Settings lockup due to overloaded app.ini with hardcoded nginx paths
  that conflict with UI-managed settings

Changes:
- Remove start/stop/reset-password hack from install script
- Simplify app.ini to match upstream defaults (minimal config)
- Let users complete the natural setup wizard on first visit
- Update JSON: remove default credentials, add setup wizard note
- Add setup wizard hint to CT script output

The setup wizard properly handles admin account creation and ACME email
configuration, which are both needed for full functionality.

Ref: ProxmoxVED#1408

CHANGELOG.md

@@ -410,25 +410,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
     - tracearr: prepare for next stable release [@durzo](https://github.com/durzo) ([#11673](https://github.com/community-scripts/ProxmoxVE/pull/11673))
     - PeaNUT: symlink server.js after update [@vhsdream](https://github.com/vhsdream) ([#11696](https://github.com/community-scripts/ProxmoxVE/pull/11696))
 
-  - #### ✨ New Features
-
-    - remove whiptail from update scripts for unattended update support [@MickLesk](https://github.com/MickLesk) ([#11712](https://github.com/community-scripts/ProxmoxVE/pull/11712))
-
-  - #### 🔧 Refactor
-
-    - Nginx-UI: better User Handling | ACME [@MickLesk](https://github.com/MickLesk) ([#11715](https://github.com/community-scripts/ProxmoxVE/pull/11715))
-    - NginxProxymanager: use better-sqlite3 [@MickLesk](https://github.com/MickLesk) ([#11708](https://github.com/community-scripts/ProxmoxVE/pull/11708))
-
-### 💾 Core
-
-  - #### 🔧 Refactor
-
-    - hwaccel: add libmfx-gen1.2 to Intel Arc setup for QSV support [@MickLesk](https://github.com/MickLesk) ([#11707](https://github.com/community-scripts/ProxmoxVE/pull/11707))
-
-### ❔ Uncategorized
-
-  - Bichon: Update website [@tremor021](https://github.com/tremor021) ([#11711](https://github.com/community-scripts/ProxmoxVE/pull/11711))
-
 ## 2026-02-08
 
 ### 🚀 Updated Scripts

ct/alpine-docker.sh

@@ -20,9 +20,28 @@ color
 catch_errors
 
 function update_script() {
-  header_info
-  $STD apk -U upgrade
-  msg_ok "Updated successfully!"
+  if ! apk -e info newt >/dev/null 2>&1; then
+    apk add -q newt
+  fi
+  while true; do
+    CHOICE=$(
+      whiptail --backtitle "Proxmox VE Helper Scripts" --title "SUPPORT" --menu "Select option" 11 58 1 \
+        "1" "Check for Docker Updates" 3>&2 2>&1 1>&3
+    )
+    exit_status=$?
+    if [ $exit_status == 1 ]; then
+      clear
+      exit-script
+    fi
+    header_info
+    case $CHOICE in
+    1)
+      $STD apk -U upgrade
+      msg_ok "Updated successfully!"
+      exit
+      ;;
+    esac
+  done
   exit 0
 }
 

ct/alpine-grafana.sh

@@ -20,32 +20,43 @@ color
 catch_errors
 
 function update_script() {
+  if ! apk -e info newt >/dev/null 2>&1; then
+    apk add -q newt
+  fi
   LXCIP=$(ip a s dev eth0 | awk '/inet / {print $2}' | cut -d/ -f1)
-
-  CHOICE=$(msg_menu "Grafana Update Options" \
-    "1" "Check for Grafana Updates" \
-    "2" "Allow 0.0.0.0 for listening" \
-    "3" "Allow only ${LXCIP} for listening")
-
-  case $CHOICE in
-  1)
-    $STD apk -U upgrade
-    msg_ok "Updated successfully!"
-    exit
-    ;;
-  2)
-    sed -i -e "s/cfg:server.http_addr=.*/cfg:server.http_addr=0.0.0.0/g" /etc/conf.d/grafana
-    service grafana restart
-    msg_ok "Allowed listening on all interfaces!"
-    exit
-    ;;
-  3)
-    sed -i -e "s/cfg:server.http_addr=.*/cfg:server.http_addr=$LXCIP/g" /etc/conf.d/grafana
-    service grafana restart
-    msg_ok "Allowed listening only on ${LXCIP}!"
-    exit
-    ;;
-  esac
+  while true; do
+    CHOICE=$(
+      whiptail --backtitle "Proxmox VE Helper Scripts" --title "SUPPORT" --menu "Select option" 11 58 3 \
+        "1" "Check for Grafana Updates" \
+        "2" "Allow 0.0.0.0 for listening" \
+        "3" "Allow only ${LXCIP} for listening" 3>&2 2>&1 1>&3
+    )
+    exit_status=$?
+    if [ $exit_status == 1 ]; then
+      clear
+      exit-script
+    fi
+    header_info
+    case $CHOICE in
+    1)
+      $STD apk -U upgrade
+      msg_ok "Updated successfully!"
+      exit
+      ;;
+    2)
+      sed -i -e "s/cfg:server.http_addr=.*/cfg:server.http_addr=0.0.0.0/g" /etc/conf.d/grafana
+      service grafana restart
+      msg_ok "Allowed listening on all interfaces!"
+      exit
+      ;;
+    3)
+      sed -i -e "s/cfg:server.http_addr=.*/cfg:server.http_addr=$LXCIP/g" /etc/conf.d/grafana
+      service grafana restart
+      msg_ok "Allowed listening only on ${LXCIP}!"
+      exit
+      ;;
+    esac
+  done
   exit 0
 }
 

ct/alpine-loki.sh

@@ -20,32 +20,43 @@ color
 catch_errors
 
 function update_script() {
+  if ! apk -e info newt >/dev/null 2>&1; then
+    apk add -q newt
+  fi
   LXCIP=$(ip a s dev eth0 | awk '/inet / {print $2}' | cut -d/ -f1)
-
-  CHOICE=$(msg_menu "Loki Update Options" \
-    "1" "Check for Loki Updates" \
-    "2" "Allow 0.0.0.0 for listening" \
-    "3" "Allow only ${LXCIP} for listening")
-
-  case $CHOICE in
-  1)
-    $STD apk -U upgrade
-    msg_ok "Updated successfully!"
-    exit
-    ;;
-  2)
-    sed -i -e "s/cfg:server.http_addr=.*/cfg:server.http_addr=0.0.0.0/g" /etc/conf.d/loki
-    service loki restart
-    msg_ok "Allowed listening on all interfaces!"
-    exit
-    ;;
-  3)
-    sed -i -e "s/cfg:server.http_addr=.*/cfg:server.http_addr=$LXCIP/g" /etc/conf.d/loki
-    service loki restart
-    msg_ok "Allowed listening only on ${LXCIP}!"
-    exit
-    ;;
-  esac
+  while true; do
+    CHOICE=$(
+      whiptail --backtitle "Proxmox VE Helper Scripts" --title "SUPPORT" --menu "Select option" 11 58 3 \
+        "1" "Check for Loki Updates" \
+        "2" "Allow 0.0.0.0 for listening" \
+        "3" "Allow only ${LXCIP} for listening" 3>&2 2>&1 1>&3
+    )
+    exit_status=$?
+    if [ $exit_status == 1 ]; then
+      clear
+      exit-script
+    fi
+    header_info
+    case $CHOICE in
+    1)
+      $STD apk -U upgrade
+      msg_ok "Updated successfully!"
+      exit
+      ;;
+    2)
+      sed -i -e "s/cfg:server.http_addr=.*/cfg:server.http_addr=0.0.0.0/g" /etc/conf.d/loki
+      service loki restart
+      msg_ok "Allowed listening on all interfaces!"
+      exit
+      ;;
+    3)
+      sed -i -e "s/cfg:server.http_addr=.*/cfg:server.http_addr=$LXCIP/g" /etc/conf.d/loki
+      service loki restart
+      msg_ok "Allowed listening only on ${LXCIP}!"
+      exit
+      ;;
+    esac
+  done
   exit 0
 }
 

ct/alpine-nextcloud.sh

@@ -24,31 +24,33 @@ function update_script() {
     msg_error "No ${APP} Installation Found!"
     exit
   fi
-
-  CHOICE=$(msg_menu "Nextcloud Options" \
-    "1" "Update Alpine Packages" \
-    "2" "Nextcloud Login Credentials" \
-    "3" "Renew Self-signed Certificate")
-
-  case $CHOICE in
-  1)
-    msg_info "Updating Alpine Packages"
-    $STD apk -U upgrade
-    msg_ok "Updated Alpine Packages"
-    msg_ok "Updated successfully!"
-    exit
-    ;;
-  2)
-    cat nextcloud.creds
-    exit
-    ;;
-  3)
-    openssl req -x509 -nodes -days 365 -newkey rsa:4096 -keyout /etc/ssl/private/nextcloud-selfsigned.key -out /etc/ssl/certs/nextcloud-selfsigned.crt -subj "/C=US/O=Nextcloud/OU=Domain Control Validated/CN=nextcloud.local" >/dev/null 2>&1
-    rc-service nginx restart
-    msg_ok "Renewed self-signed certificate"
-    exit
-    ;;
-  esac
+  if ! apk -e info newt >/dev/null 2>&1; then
+    apk add -q newt
+  fi
+  while true; do
+    CHOICE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "SUPPORT" --radiolist --cancel-button Exit-Script "Spacebar = Select" 11 58 3 \
+      "1" "Nextcloud Login Credentials" ON \
+      "2" "Renew Self-signed Certificate" OFF \
+      3>&1 1>&2 2>&3)
+    exit_status=$?
+    if [ $exit_status == 1 ]; then
+      clear
+      exit-script
+    fi
+    header_info
+    case $CHOICE in
+    1)
+      cat nextcloud.creds
+      exit
+      ;;
+    2)
+      openssl req -x509 -nodes -days 365 -newkey rsa:4096 -keyout /etc/ssl/private/nextcloud-selfsigned.key -out /etc/ssl/certs/nextcloud-selfsigned.crt -subj "/C=US/O=Nextcloud/OU=Domain Control Validated/CN=nextcloud.local" >/dev/null 2>&1
+      rc-service nginx restart
+      exit
+      ;;
+    esac
+  done
+  exit 0
 }
 
 start

ct/alpine-redis.sh

@@ -20,36 +20,47 @@ color
 catch_errors
 
 function update_script() {
+  if ! apk -e info newt >/dev/null 2>&1; then
+    apk add -q newt
+  fi
   LXCIP=$(ip a s dev eth0 | awk '/inet / {print $2}' | cut -d/ -f1)
-
-  CHOICE=$(msg_menu "Redis Management" \
-    "1" "Update Redis" \
-    "2" "Allow 0.0.0.0 for listening" \
-    "3" "Allow only ${LXCIP} for listening")
-
-  case $CHOICE in
-  1)
-    msg_info "Updating Redis"
-    apk update && apk upgrade redis
-    rc-service redis restart
-    msg_ok "Updated successfully!"
-    exit
-    ;;
-  2)
-    msg_info "Setting Redis to listen on all interfaces"
-    sed -i 's/^bind .*/bind 0.0.0.0/' /etc/redis.conf
-    rc-service redis restart
-    msg_ok "Redis now listens on all interfaces!"
-    exit
-    ;;
-  3)
-    msg_info "Setting Redis to listen only on ${LXCIP}"
-    sed -i "s/^bind .*/bind ${LXCIP}/" /etc/redis.conf
-    rc-service redis restart
-    msg_ok "Redis now listens only on ${LXCIP}!"
-    exit
-    ;;
-  esac
+  while true; do
+    CHOICE=$(
+      whiptail --backtitle "Proxmox VE Helper Scripts" --title "Redis Management" --menu "Select option" 11 58 3 \
+        "1" "Update Redis" \
+        "2" "Allow 0.0.0.0 for listening" \
+        "3" "Allow only ${LXCIP} for listening" 3>&2 2>&1 1>&3
+    )
+    exit_status=$?
+    if [ $exit_status == 1 ]; then
+      clear
+      exit-script
+    fi
+    header_info
+    case $CHOICE in
+    1)
+      msg_info "Updating Redis"
+      apk update && apk upgrade redis
+      rc-service redis restart
+      msg_ok "Updated successfully!"
+      exit
+      ;;
+    2)
+      msg_info "Setting Redis to listen on all interfaces"
+      sed -i 's/^bind .*/bind 0.0.0.0/' /etc/redis.conf
+      rc-service redis restart
+      msg_ok "Redis now listens on all interfaces!"
+      exit
+      ;;
+    3)
+      msg_info "Setting Redis to listen only on ${LXCIP}"
+      sed -i "s/^bind .*/bind ${LXCIP}/" /etc/redis.conf
+      rc-service redis restart
+      msg_ok "Redis now listens only on ${LXCIP}!"
+      exit
+      ;;
+    esac
+  done
 }
 
 start

ct/alpine-valkey.sh

@@ -20,37 +20,48 @@ color
 catch_errors
 
 function update_script() {
+  if ! apk -e info newt >/dev/null 2>&1; then
+    apk add -q newt
+  fi
   LXCIP=$(ip a s dev eth0 | awk '/inet / {print $2}' | cut -d/ -f1)
-
-  CHOICE=$(msg_menu "Valkey Management" \
-    "1" "Update Valkey" \
-    "2" "Allow 0.0.0.0 for listening" \
-    "3" "Allow only ${LXCIP} for listening")
-
-  case $CHOICE in
-  1)
-    msg_info "Updating Valkey"
-    apk update && apk upgrade valkey
-    rc-service valkey restart
-    msg_ok "Updated Valkey"
-    msg_ok "Updated successfully!"
-    exit
-    ;;
-  2)
-    msg_info "Setting Valkey to listen on all interfaces"
-    sed -i 's/^bind .*/bind 0.0.0.0/' /etc/valkey/valkey.conf
-    rc-service valkey restart
-    msg_ok "Valkey now listens on all interfaces!"
-    exit
-    ;;
-  3)
-    msg_info "Setting Valkey to listen only on ${LXCIP}"
-    sed -i "s/^bind .*/bind ${LXCIP}/" /etc/valkey/valkey.conf
-    rc-service valkey restart
-    msg_ok "Valkey now listens only on ${LXCIP}!"
-    exit
-    ;;
-  esac
+  while true; do
+    CHOICE=$(
+      whiptail --backtitle "Proxmox VE Helper Scripts" --title "Valkey Management" --menu "Select option" 11 58 3 \
+        "1" "Update Valkey" \
+        "2" "Allow 0.0.0.0 for listening" \
+        "3" "Allow only ${LXCIP} for listening" 3>&2 2>&1 1>&3
+    )
+    exit_status=$?
+    if [ $exit_status == 1 ]; then
+      clear
+      exit-script
+    fi
+    header_info
+    case $CHOICE in
+    1)
+      msg_info "Updating Valkey"
+      apk update && apk upgrade valkey
+      rc-service valkey restart
+      msg_ok "Updated Valkey"
+      msg_ok "Updated successfully!"
+      exit
+      ;;
+    2)
+      msg_info "Setting Valkey to listen on all interfaces"
+      sed -i 's/^bind .*/bind 0.0.0.0/' /etc/valkey/valkey.conf
+      rc-service valkey restart
+      msg_ok "Valkey now listens on all interfaces!"
+      exit
+      ;;
+    3)
+      msg_info "Setting Valkey to listen only on ${LXCIP}"
+      sed -i "s/^bind .*/bind ${LXCIP}/" /etc/valkey/valkey.conf
+      rc-service valkey restart
+      msg_ok "Valkey now listens only on ${LXCIP}!"
+      exit
+      ;;
+    esac
+  done
 }
 
 start

ct/alpine-vaultwarden.sh

@@ -20,38 +20,45 @@ color
 catch_errors
 
 function update_script() {
-  CHOICE=$(msg_menu "Vaultwarden Update Options" \
-    "1" "Update Vaultwarden" \
-    "2" "Reset ADMIN_TOKEN")
-
-  case $CHOICE in
-  1)
-    $STD apk -U upgrade
-    rc-service vaultwarden restart -q
-    msg_ok "Updated successfully!"
-    exit
-    ;;
-  2)
-    if [[ "${PHS_SILENT:-0}" == "1" ]]; then
-      msg_warn "Reset ADMIN_TOKEN requires interactive mode, skipping."
-      exit
+  if ! apk -e info newt >/dev/null 2>&1; then
+    apk add -q newt
+  fi
+  while true; do
+    CHOICE=$(
+      whiptail --backtitle "Proxmox VE Helper Scripts" --title "SUPPORT" --menu "Select option" 11 58 2 \
+        "1" "Update Vaultwarden" \
+        "2" "Reset ADMIN_TOKEN" 3>&2 2>&1 1>&3
+    )
+    exit_status=$?
+    if [ $exit_status == 1 ]; then
+      clear
+      exit-script
     fi
-    read -r -s -p "Setup your ADMIN_TOKEN (make it strong): " NEWTOKEN
-    echo ""
-    if [[ -n "$NEWTOKEN" ]]; then
-      if ! command -v argon2 >/dev/null 2>&1; then apk add argon2 &>/dev/null; fi
-      TOKEN=$(echo -n "${NEWTOKEN}" | argon2 "$(openssl rand -base64 32)" -e -id -k 19456 -t 2 -p 1)
-      if [[ ! -f /var/lib/vaultwarden/config.json ]]; then
-        sed -i "s|export ADMIN_TOKEN=.*|export ADMIN_TOKEN='${TOKEN}'|" /etc/conf.d/vaultwarden
-      else
-        sed -i "s|\"admin_token\": .*|\"admin_token\": \"${TOKEN}\",|" /var/lib/vaultwarden/config.json
-      fi
+    header_info
+    case $CHOICE in
+    1)
+      $STD apk -U upgrade
       rc-service vaultwarden restart -q
-      msg_ok "Admin token updated"
-    fi
-    exit
-    ;;
-  esac
+      msg_ok "Updated successfully!"
+      exit
+      ;;
+    2)
+      if NEWTOKEN=$(whiptail --backtitle "Proxmox VE Helper Scripts" --passwordbox "Setup your ADMIN_TOKEN (make it strong)" 10 58 3>&1 1>&2 2>&3); then
+        if [[ -z "$NEWTOKEN" ]]; then exit-script; fi
+        if ! command -v argon2 >/dev/null 2>&1; then apk add argon2 &>/dev/null; fi
+        TOKEN=$(echo -n "${NEWTOKEN}" | argon2 "$(openssl rand -base64 32)" -e -id -k 19456 -t 2 -p 1)
+        if [[ ! -f /var/lib/vaultwarden/config.json ]]; then
+          sed -i "s|export ADMIN_TOKEN=.*|export ADMIN_TOKEN='${TOKEN}'|" /etc/conf.d/vaultwarden
+        else
+          sed -i "s|\"admin_token\": .*|\"admin_token\": \"${TOKEN}\",|" /var/lib/vaultwarden/config.json
+        fi
+        rc-service vaultwarden restart -q
+      fi
+      clear
+      exit
+      ;;
+    esac
+  done
 }
 
 start

ct/alpine-zigbee2mqtt.sh

@@ -20,10 +20,28 @@ color
 catch_errors
 
 function update_script() {
-  header_info
-  $STD apk -U upgrade
-  msg_ok "Updated successfully!"
-  exit 0
+  if ! apk -e info newt >/dev/null 2>&1; then
+    apk add -q newt
+  fi
+  while true; do
+    CHOICE=$(
+      whiptail --backtitle "Proxmox VE Helper Scripts" --title "SUPPORT" --menu "Select option" 11 58 1 \
+        "1" "Check for Zigbee2MQTT Updates" 3>&2 2>&1 1>&3
+    )
+    exit_status=$?
+    if [ $exit_status == 1 ]; then
+      clear
+      exit-script
+    fi
+    header_info
+    case $CHOICE in
+    1)
+      $STD apk -U upgrade
+      msg_ok "Updated successfully!"
+      exit
+      ;;
+    esac
+  done
 }
 
 start

ct/alpine.sh

@@ -20,10 +20,18 @@ color
 catch_errors
 
 function update_script() {
+  UPD=$(
+    whiptail --backtitle "Proxmox VE Helper Scripts" --title "SUPPORT" --radiolist --cancel-button Exit-Script "Spacebar = Select" 11 58 1 \
+      "1" "Check for Alpine Updates" ON \
+      3>&1 1>&2 2>&3
+  )
+
   header_info
-  $STD apk -U upgrade
-  msg_ok "Updated successfully!"
-  exit 0
+  if [ "$UPD" == "1" ]; then
+    $STD apk -U upgrade
+    msg_ok "Updated successfully!"
+    exit 0
+  fi
 }
 
 start

ct/cronicle.sh

@@ -23,9 +23,10 @@ function update_script() {
   header_info
   check_container_storage
   check_container_resources
-  UPD=$(msg_menu "Cronicle Update Options" \
-    "1" "Update ${APP}" \
-    "2" "Install ${APP} Worker")
+  UPD=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "SUPPORT" --radiolist --cancel-button Exit-Script "Spacebar = Select" 11 58 2 \
+    "1" "Update ${APP}" ON \
+    "2" "Install ${APP} Worker" OFF \
+    3>&1 1>&2 2>&3)
 
   if [ "$UPD" == "1" ]; then
     if [[ ! -d /opt/cronicle ]]; then

ct/gitea-mirror.sh

@@ -31,27 +31,18 @@ function update_script() {
 
   APP_VERSION=$(grep -o '"version": *"[^"]*"' /opt/gitea-mirror/package.json | cut -d'"' -f4)
   if [[ $APP_VERSION =~ ^2\. ]]; then
-    if [[ "${PHS_SILENT:-0}" == "1" ]]; then
-      msg_warn "Version $APP_VERSION detected. Major version upgrade requires interactive confirmation, skipping."
-      exit 75
-    fi
-    msg_warn "WARNING: Version $APP_VERSION detected!"
-    msg_warn "Updating from version 2.x will CLEAR ALL CONFIGURATION."
-    msg_warn "This includes: API tokens, User settings, Repository configurations, All custom settings"
-    echo ""
-    read -r -p "Do you want to continue? (y/N): " CONFIRM
-    if [[ ! "$CONFIRM" =~ ^[Yy]$ ]]; then
+    if ! whiptail --backtitle "Gitea Mirror Update" --title "⚠️  VERSION 2.x DETECTED" --yesno \
+      "WARNING: Version $APP_VERSION detected!\n\nUpdating from version 2.x will CLEAR ALL CONFIGURATION.\n\nThis includes:\n• API tokens\n• User settings\n• Repository configurations\n• All custom settings\n\nDo you want to continue with the update process?" 15 70 --defaultno; then
       exit 0
     fi
-    msg_warn "FINAL WARNING: This update WILL clear all configuration!"
-    msg_warn "Please ensure you have backed up API tokens, custom configurations, and repository settings."
-    echo ""
-    read -r -p "Final confirmation - proceed? (y/N): " CONFIRM2
-    if [[ ! "$CONFIRM2" =~ ^[Yy]$ ]]; then
-      msg_info "Update cancelled. Please backup your configuration before proceeding."
+
+    if ! whiptail --backtitle "Gitea Mirror Update" --title "⚠️  FINAL CONFIRMATION" --yesno \
+      "FINAL WARNING: This update WILL clear all configuration!\n\nBEFORE PROCEEDING, please:\n\n• Copy API tokens to a safe location\n• Backup any custom configurations\n• Note down repository settings\n\nThis action CANNOT be undone!" 18 70 --defaultno; then
+      whiptail --backtitle "Gitea Mirror Update" --title "Update Cancelled" --msgbox "Update process cancelled. Please backup your configuration before proceeding." 8 60
       exit 0
     fi
-    msg_info "Proceeding with version $APP_VERSION update. All configuration will be cleared as warned."
+    whiptail --backtitle "Gitea Mirror Update" --title "Proceeding with Update" --msgbox \
+      "Proceeding with version $APP_VERSION update.\n\nAll configuration will be cleared as warned." 8 50
     rm -rf /opt/gitea-mirror
   fi
 

ct/homeassistant.sh

@@ -27,11 +27,12 @@ function update_script() {
     msg_error "No ${APP} Installation Found!"
     exit
   fi
-  UPD=$(msg_menu "Home Assistant Update Options" \
-    "1" "Update ALL Containers" \
-    "2" "Remove ALL Unused Images" \
-    "3" "Install HACS" \
-    "4" "Install FileBrowser")
+  UPD=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "UPDATE" --radiolist --cancel-button Exit-Script "Spacebar = Select" 11 58 4 \
+    "1" "Update ALL Containers" ON \
+    "2" "Remove ALL Unused Images" OFF \
+    "3" "Install HACS" OFF \
+    "4" "Install FileBrowser" OFF \
+    3>&1 1>&2 2>&3)
 
   if [ "$UPD" == "1" ]; then
     msg_info "Updating All Containers"

ct/loki.sh

@@ -29,13 +29,21 @@ function update_script() {
     exit 1
   fi
 
-  CHOICE=$(msg_menu "Loki Update Options" \
-    "1" "Update Loki & Promtail" \
-    "2" "Allow 0.0.0.0 for listening" \
-    "3" "Allow only ${LOCAL_IP} for listening")
-
-  case $CHOICE in
-  1)
+  while true; do
+    CHOICE=$(
+      whiptail --backtitle "Proxmox VE Helper Scripts" --title "SUPPORT" --menu "Select option" 11 58 3 \
+        "1" "Update Loki & Promtail" \
+        "2" "Allow 0.0.0.0 for listening" \
+        "3" "Allow only ${LOCAL_IP} for listening" 3>&2 2>&1 1>&3
+    )
+    exit_status=$?
+    if [ $exit_status == 1 ]; then
+      clear
+      exit-script
+    fi
+    header_info
+    case $CHOICE in
+    1)
       msg_info "Stopping Loki"
       systemctl stop loki
       if systemctl is-active --quiet promtail 2>/dev/null || dpkg -s promtail >/dev/null 2>&1; then
@@ -77,6 +85,7 @@ function update_script() {
       exit
       ;;
     esac
+  done
   exit 0
 }
 

ct/meilisearch.sh

@@ -24,9 +24,21 @@ function update_script() {
   check_container_storage
   check_container_resources
 
-  setup_meilisearch
+  UPD=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "Meilisearch Update" --radiolist --cancel-button Exit-Script "Spacebar = Select" 10 58 2 \
+    "1" "Update Meilisearch" ON \
+    "2" "Update Meilisearch-UI" OFF \
+    3>&1 1>&2 2>&3)
 
-  if [[ -d /opt/meilisearch-ui ]]; then
+  if [ "$UPD" == "1" ]; then
+    setup_meilisearch
+    exit
+  fi
+
+  if [ "$UPD" == "2" ]; then
+    if [[ ! -d /opt/meilisearch-ui ]]; then
+      msg_error "No Meilisearch-UI Installation Found!"
+      exit
+    fi
     if check_for_gh_release "meilisearch-ui" "riccox/meilisearch-ui"; then
       msg_info "Stopping Meilisearch-UI"
       systemctl stop meilisearch-ui
@@ -46,11 +58,10 @@ function update_script() {
       msg_info "Starting Meilisearch-UI"
       systemctl start meilisearch-ui
       msg_ok "Started Meilisearch-UI"
+      msg_ok "Updated successfully!"
     fi
+    exit
   fi
-
-  msg_ok "Updated successfully!"
-  exit
 }
 
 start

ct/nginxproxymanager.sh

@@ -28,6 +28,12 @@ function update_script() {
     exit
   fi
 
+  msg_error "This script is currently disabled due to an external issue with the OpenResty APT repository."
+  msg_error "The repository's GPG key uses SHA-1 signatures, which are no longer accepted by Debian as of February 1, 2026."
+  msg_error "The issue is tracked in openresty/openresty#1097"
+  msg_error "For more details, see: https://github.com/community-scripts/ProxmoxVE/issues/11406"
+  exit 1
+
   if [[ $(grep -E '^VERSION_ID=' /etc/os-release) == *"12"* ]]; then
     msg_error "Wrong Debian version detected!"
     msg_error "Please create a snapshot first. You must upgrade your LXC to Debian Trixie before updating. Visit: https://github.com/community-scripts/ProxmoxVE/discussions/7489"
@@ -139,17 +145,15 @@ function update_script() {
   "database": {
     "engine": "knex-native",
     "knex": {
-      "client": "better-sqlite3",
+      "client": "sqlite3",
       "connection": {
         "filename": "/data/database.sqlite"
-      },
-      "useNullAsDefault": true
+      }
     }
   }
 }
 EOF
   fi
-  sed -i 's/"client": "sqlite3"/"client": "better-sqlite3"/' /app/config/production.json
   cd /app 
   $STD yarn install --network-timeout 600000
   msg_ok "Initialized Backend"

ct/node-red.sh

@@ -27,9 +27,10 @@ function update_script() {
     msg_error "No ${APP} Installation Found!"
     exit
   fi
-  UPD=$(msg_menu "Node-Red Update Options" \
-    "1" "Update ${APP}" \
-    "2" "Install Themes")
+  UPD=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "SUPPORT" --radiolist --cancel-button Exit-Script "Spacebar = Select" 11 58 2 \
+    "1" "Update ${APP}" ON \
+    "2" "Install Themes" OFF \
+    3>&1 1>&2 2>&3)
   if [ "$UPD" == "1" ]; then
     NODE_VERSION="22" setup_nodejs
 
@@ -48,31 +49,32 @@ function update_script() {
     exit
   fi
   if [ "$UPD" == "2" ]; then
-    THEME=$(msg_menu "Node-Red Themes" \
-      "midnight-red" "Midnight Red (default)" \
-      "aurora" "Aurora" \
-      "cobalt2" "Cobalt2" \
-      "dark" "Dark" \
-      "dracula" "Dracula" \
-      "espresso-libre" "Espresso Libre" \
-      "github-dark" "GitHub Dark" \
-      "github-dark-default" "GitHub Dark Default" \
-      "github-dark-dimmed" "GitHub Dark Dimmed" \
-      "monoindustrial" "Monoindustrial" \
-      "monokai" "Monokai" \
-      "monokai-dimmed" "Monokai Dimmed" \
-      "noctis" "Noctis" \
-      "oceanic-next" "Oceanic Next" \
-      "oled" "OLED" \
-      "one-dark-pro" "One Dark Pro" \
-      "one-dark-pro-darker" "One Dark Pro Darker" \
-      "solarized-dark" "Solarized Dark" \
-      "solarized-light" "Solarized Light" \
-      "tokyo-night" "Tokyo Night" \
-      "tokyo-night-light" "Tokyo Night Light" \
-      "tokyo-night-storm" "Tokyo Night Storm" \
-      "totallyinformation" "TotallyInformation" \
-      "zenburn" "Zenburn")
+    THEME=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "NODE-RED THEMES" --radiolist --cancel-button Exit-Script "Choose Theme" 15 58 6 \
+      "aurora" "" OFF \
+      "cobalt2" "" OFF \
+      "dark" "" OFF \
+      "dracula" "" OFF \
+      "espresso-libre" "" OFF \
+      "github-dark" "" OFF \
+      "github-dark-default" "" OFF \
+      "github-dark-dimmed" "" OFF \
+      "midnight-red" "" ON \
+      "monoindustrial" "" OFF \
+      "monokai" "" OFF \
+      "monokai-dimmed" "" OFF \
+      "noctis" "" OFF \
+      "oceanic-next" "" OFF \
+      "oled" "" OFF \
+      "one-dark-pro" "" OFF \
+      "one-dark-pro-darker" "" OFF \
+      "solarized-dark" "" OFF \
+      "solarized-light" "" OFF \
+      "tokyo-night" "" OFF \
+      "tokyo-night-light" "" OFF \
+      "tokyo-night-storm" "" OFF \
+      "totallyinformation" "" OFF \
+      "zenburn" "" OFF \
+      3>&1 1>&2 2>&3)
     header_info
     msg_info "Installing ${THEME} Theme"
     cd /root/.node-red

ct/npmplus.sh

@@ -20,21 +20,32 @@ color
 catch_errors
 
 function update_script() {
+  UPD=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "UPDATE MODE" --radiolist --cancel-button Exit-Script "Spacebar = Select" 14 60 2 \
+    "1" "Check for Alpine Updates" OFF \
+    "2" "Update NPMplus Docker Container" ON \
+    3>&1 1>&2 2>&3)
+
   header_info "$APP"
 
-  msg_info "Updating Alpine OS"
-  $STD apk -U upgrade
-  msg_ok "System updated"
-
-  msg_info "Pulling latest NPMplus container image"
-  cd /opt
-  $STD docker compose pull
-  msg_info "Recreating container"
-  $STD docker compose up -d
-  msg_ok "Updated NPMplus container"
-
-  msg_ok "Updated successfully!"
-  exit
+  case "$UPD" in
+  "1")
+    msg_info "Updating Alpine OS"
+    $STD apk -U upgrade
+    msg_ok "System updated"
+    exit
+    ;;
+  "2")
+    msg_info "Updating NPMplus Container"
+    cd /opt
+    msg_info "Pulling latest container image"
+    $STD docker compose pull
+    msg_info "Recreating container"
+    $STD docker compose up -d
+    msg_ok "Updated successfully!"
+    exit
+    ;;
+  esac
+  exit 0
 }
 
 start

ct/plex.sh

@@ -29,9 +29,10 @@ function update_script() {
     msg_error "No ${APP} Installation Found!"
     exit
   fi
-  UPD=$(msg_menu "Plex Update Options" \
-    "1" "Update LXC" \
-    "2" "Install plexupdate")
+  UPD=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "SUPPORT" --radiolist --cancel-button Exit-Script "Spacebar = Select \nplexupdate info >> https://github.com/mrworf/plexupdate" 10 59 2 \
+    "1" "Update LXC" ON \
+    "2" "Install plexupdate" OFF \
+    3>&1 1>&2 2>&3)
   if [ "$UPD" == "1" ]; then
     msg_info "Updating ${APP} LXC"
     $STD apt update

ct/podman-homeassistant.sh

@@ -27,11 +27,12 @@ function update_script() {
     msg_error "No ${APP} Installation Found!"
     exit
   fi
-  UPD=$(msg_menu "Home Assistant Update Options" \
-    "1" "Update system and containers" \
-    "2" "Install HACS" \
-    "3" "Install FileBrowser" \
-    "4" "Remove ALL Unused Images")
+  UPD=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "UPDATE" --radiolist --cancel-button Exit-Script "Spacebar = Select" 11 58 4 \
+    "1" "Update system and containers" ON \
+    "2" "Install HACS" OFF \
+    "3" "Install FileBrowser" OFF \
+    "4" "Remove ALL Unused Images" OFF \
+    3>&1 1>&2 2>&3)
 
   if [ "$UPD" == "1" ]; then
     msg_info "Updating ${APP} LXC"

ct/vaultwarden.sh

@@ -31,9 +31,11 @@ function update_script() {
   VAULT=$(get_latest_github_release "dani-garcia/vaultwarden")
   WVRELEASE=$(get_latest_github_release "dani-garcia/bw_web_builds")
 
-  UPD=$(msg_menu "Vaultwarden Update Options" \
-    "1" "Update VaultWarden + Web-Vault" \
-    "2" "Set Admin Token")
+  UPD=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "SUPPORT" --radiolist --cancel-button Exit-Script "Spacebar = Select" 11 58 3 \
+    "1" "VaultWarden $VAULT" ON \
+    "2" "Web-Vault $WVRELEASE" OFF \
+    "3" "Set Admin Token" OFF \
+    3>&1 1>&2 2>&3)
 
   if [ "$UPD" == "1" ]; then
     if check_for_gh_release "vaultwarden" "dani-garcia/vaultwarden"; then
@@ -57,10 +59,14 @@ function update_script() {
       msg_info "Starting Service"
       systemctl start vaultwarden
       msg_ok "Started Service"
+      msg_ok "Updated successfully!"
     else
       msg_ok "VaultWarden is already up-to-date"
     fi
+    exit
+  fi
 
+  if [ "$UPD" == "2" ]; then
     if check_for_gh_release "vaultwarden_webvault" "dani-garcia/bw_web_builds"; then
       msg_info "Stopping Service"
       systemctl stop vaultwarden
@@ -78,22 +84,16 @@ function update_script() {
       msg_info "Starting Service"
       systemctl start vaultwarden
       msg_ok "Started Service"
+      msg_ok "Updated successfully!"
     else
       msg_ok "Web-Vault is already up-to-date"
     fi
-
-    msg_ok "Updated successfully!"
     exit
   fi
 
-  if [ "$UPD" == "2" ]; then
-    if [[ "${PHS_SILENT:-0}" == "1" ]]; then
-      msg_warn "Set Admin Token requires interactive mode, skipping."
-      exit
-    fi
-    read -r -s -p "Set the ADMIN_TOKEN: " NEWTOKEN
-    echo ""
-    if [[ -n "$NEWTOKEN" ]]; then
+  if [ "$UPD" == "3" ]; then
+    if NEWTOKEN=$(whiptail --backtitle "Proxmox VE Helper Scripts" --passwordbox "Set the ADMIN_TOKEN" 10 58 3>&1 1>&2 2>&3); then
+      if [[ -z "$NEWTOKEN" ]]; then exit; fi
       ensure_dependencies argon2
       TOKEN=$(echo -n "${NEWTOKEN}" | argon2 "$(openssl rand -base64 32)" -t 2 -m 16 -p 4 -l 64 -e)
       sed -i "s|ADMIN_TOKEN=.*|ADMIN_TOKEN='${TOKEN}'|" /opt/vaultwarden/.env

frontend/public/json/bichon.json

@@ -35,10 +35,6 @@
     {
       "text": "The Disk space initially allocated by the script is only a placeholder, as we can't know how much space you will ever need. You should increase it to match your workload.",
       "type": "info"
-    },
-    {
-      "text": "Please copy your `BICHON_ENCRYPT_PASSWORD` from `/opt/bichon/bichon.env` to a safe place.",
-      "type": "warning"
     }
   ]
 }

frontend/public/json/github-versions.json

@@ -1,5 +1,5 @@
 {
-  "generated": "2026-02-09T12:16:55Z",
+  "generated": "2026-02-09T06:27:10Z",
   "versions": [
     {
       "slug": "2fauth",
@@ -109,9 +109,9 @@
     {
       "slug": "bentopdf",
       "repo": "alam00000/bentopdf",
-      "version": "v2.2.0",
+      "version": "v2.1.0",
       "pinned": false,
-      "date": "2026-02-09T07:07:40Z"
+      "date": "2026-02-02T14:30:55Z"
     },
     {
       "slug": "beszel",
@@ -284,9 +284,9 @@
     {
       "slug": "domain-monitor",
       "repo": "Hosteroid/domain-monitor",
-      "version": "v1.1.2",
+      "version": "v1.1.1",
       "pinned": false,
-      "date": "2026-02-09T06:29:34Z"
+      "date": "2025-11-18T11:32:30Z"
     },
     {
       "slug": "donetick",
@@ -1292,9 +1292,9 @@
     {
       "slug": "snowshare",
       "repo": "TuroYT/snowshare",
-      "version": "v1.3.3",
+      "version": "v1.2.12",
       "pinned": false,
-      "date": "2026-02-09T10:52:12Z"
+      "date": "2026-01-30T13:35:56Z"
     },
     {
       "slug": "sonarr",
@@ -1523,9 +1523,9 @@
     {
       "slug": "vikunja",
       "repo": "go-vikunja/vikunja",
-      "version": "v1.1.0",
+      "version": "v1.0.0",
       "pinned": false,
-      "date": "2026-02-09T10:34:29Z"
+      "date": "2026-01-28T11:12:59Z"
     },
     {
       "slug": "wallabag",

frontend/public/json/nginxproxymanager.json

@@ -30,14 +30,10 @@
     }
   ],
   "default_credentials": {
-    "username": null,
-    "password": null
+    "username": "admin@example.com",
+    "password": "changeme"
   },
   "notes": [
-    {
-      "text": "On first launch, a setup wizard will guide you through creating an admin account. There are no default credentials.",
-      "type": "info"
-    },
     {
       "text": "You can install the specific one certbot you prefer, or you can Running /app/scripts/install-certbot-plugins within the Nginx Proxy Manager (NPM) LXC shell will install many common plugins. Important: This script does not install all Certbot plugins, as some require additional, external system dependencies (like specific packages for certain DNS providers). These external dependencies must be manually installed within the LXC container before you can successfully install and use the corresponding Certbot plugin. Consult the plugin's documentation for required packages.",
       "type": "info"

install/nginx-ui-install.sh

@@ -37,6 +37,7 @@ PageSize = 10
 Host = 0.0.0.0
 Port = 9000
 RunMode = release
+JwtSecret = $(openssl rand -hex 32)
 
 [cert]
 HTTPChallengePort = 9180

install/nginxproxymanager-install.sh

@@ -130,11 +130,10 @@ if [ ! -f /app/config/production.json ]; then
   "database": {
     "engine": "knex-native",
     "knex": {
-      "client": "better-sqlite3",
+      "client": "sqlite3",
       "connection": {
         "filename": "/data/database.sqlite"
-      },
-      "useNullAsDefault": true
+      }
     }
   }
 }

misc/build.func

@@ -3318,68 +3318,6 @@ configure_ssh_settings() {
   fi
 }
 
-# ------------------------------------------------------------------------------
-# msg_menu()
-#
-# - Displays a numbered menu for update_script() functions
-# - In silent mode (PHS_SILENT=1): auto-selects the default option
-# - In interactive mode: shows menu via read with 10s timeout + default fallback
-# - Usage: CHOICE=$(msg_menu "Title" "tag1" "Description 1" "tag2" "Desc 2" ...)
-# - The first item is always the default
-# - Returns the selected tag to stdout
-# - If no valid selection or timeout, returns the default (first) tag
-# ------------------------------------------------------------------------------
-msg_menu() {
-  local title="$1"
-  shift
-
-  # Parse items into parallel arrays: tags[] and descriptions[]
-  local -a tags=()
-  local -a descs=()
-  while [[ $# -ge 2 ]]; do
-    tags+=("$1")
-    descs+=("$2")
-    shift 2
-  done
-
-  local default_tag="${tags[0]}"
-  local count=${#tags[@]}
-
-  # Silent mode: return default immediately
-  if [[ -n "${PHS_SILENT+x}" ]] && [[ "${PHS_SILENT}" == "1" ]]; then
-    echo "$default_tag"
-    return 0
-  fi
-
-  # Display menu
-  echo ""
-  msg_custom "📋" "${BL}" "${title}"
-  echo ""
-  for i in "${!tags[@]}"; do
-    local marker="  "
-    [[ $i -eq 0 ]] && marker="* "
-    printf "${TAB3}${marker}%s) %s\n" "${tags[$i]}" "${descs[$i]}"
-  done
-  echo ""
-
-  local selection=""
-  read -r -t 10 -p "${TAB3}Select [default=${default_tag}, timeout 10s]: " selection || true
-
-  # Validate selection
-  if [[ -n "$selection" ]]; then
-    for tag in "${tags[@]}"; do
-      if [[ "$selection" == "$tag" ]]; then
-        echo "$selection"
-        return 0
-      fi
-    done
-    msg_warn "Invalid selection '${selection}' - using default: ${default_tag}"
-  fi
-
-  echo "$default_tag"
-  return 0
-}
-
 # ------------------------------------------------------------------------------
 # start()
 #

misc/tools.func

@@ -3595,7 +3595,6 @@ _setup_intel_arc() {
     $STD apt -y install \
       intel-media-va-driver-non-free \
       intel-opencl-icd \
-      libmfx-gen1.2 \
       vainfo \
       intel-gpu-tools 2>/dev/null || msg_warn "Some Intel Arc packages failed"
 
@@ -3622,7 +3621,6 @@ _setup_intel_arc() {
       intel-media-va-driver-non-free \
       ocl-icd-libopencl1 \
       libvpl2 \
-      libmfx-gen1.2 \
       vainfo \
       intel-gpu-tools 2>/dev/null || msg_warn "Some Intel Arc packages failed"
   fi

tools/pve/update-apps.sh

@@ -421,8 +421,6 @@ for container in $CHOICE; do
 
   if [ $exit_code -eq 0 ]; then
     msg_ok "Updated container $container"
-  elif [ $exit_code -eq 75 ]; then
-    echo -e "${YW}[WARN]${CL} Container $container skipped (requires interactive mode)"
   elif [ "$BACKUP_CHOICE" == "yes" ]; then
     msg_info "Restoring LXC from backup"
     pct stop $container