Pin Alpine apk repositories to targeted version instead of latest-stable

CHANGELOG.md

@@ -511,14 +511,8 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
-    - IronClaw: pin to v0.29.1, 1.0 Reborn CLI/config is incompatible [@MickLesk](https://github.com/MickLesk) ([#15982](https://github.com/community-scripts/ProxmoxVE/pull/15982))
     - update authentik to 2026.5.6 [@thieneret](https://github.com/thieneret) ([#15973](https://github.com/community-scripts/ProxmoxVE/pull/15973))
 
-  - #### ✨ New Features
-
-    - Cockpit: default to Debian 13, 45Drives now ships Trixie packages | little refactor [@MickLesk](https://github.com/MickLesk) ([#15984](https://github.com/community-scripts/ProxmoxVE/pull/15984))
-    - Paperless-ngx: Support v3 [@tomfrenzel](https://github.com/tomfrenzel) ([#15221](https://github.com/community-scripts/ProxmoxVE/pull/15221))
-
 ## 2026-07-22
 
 ### 🆕 New Scripts

ct/alpine-adguard.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/alpine-bitmagnet.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-3}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/alpine-borgbackup-server.sh

@@ -12,7 +12,7 @@ var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-1024}"
 var_disk="${var_disk:-20}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/alpine-caddy.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-3}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/alpine-cinny.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 var_nesting="${var_nesting:-0}"

ct/alpine-docker.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-1024}"
 var_disk="${var_disk:-2}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/alpine-forgejo.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/alpine-garage.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-512}"
 var_disk="${var_disk:-5}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/alpine-gatus.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-512}"
 var_disk="${var_disk:-3}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/alpine-gitea.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/alpine-grafana.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-512}"
 var_disk="${var_disk:-2}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/alpine-ironclaw.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-1024}"
 var_disk="${var_disk:-8}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 
@@ -28,8 +28,7 @@ function update_script() {
     exit
   fi
 
-  RELEASE="ironclaw-v0.29.1"
-  if check_for_gh_release "ironclaw-bin" "nearai/ironclaw" "${RELEASE}" "IronClaw 1.0 (Reborn) is a ground-up rearchitecture with an incompatible CLI/config format; pinned until this script supports it"; then
+  if check_for_gh_release "ironclaw-bin" "nearai/ironclaw"; then
     msg_info "Stopping Service"
     rc-service ironclaw stop 2>/dev/null || true
     msg_ok "Stopped Service"
@@ -38,7 +37,7 @@ function update_script() {
     cp /root/.ironclaw/.env /root/ironclaw.env.bak
     msg_ok "Backed up Configuration"
 
-    fetch_and_deploy_gh_release "ironclaw-bin" "nearai/ironclaw" "prebuild" "${RELEASE}" "/usr/local/bin" \
+    fetch_and_deploy_gh_release "ironclaw-bin" "nearai/ironclaw" "prebuild" "latest" "/usr/local/bin" \
       "ironclaw-$(uname -m)-unknown-linux-musl.tar.gz"
     chmod +x /usr/local/bin/ironclaw
 

ct/alpine-it-tools.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/alpine-komodo.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-1024}"
 var_disk="${var_disk:-10}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/alpine-loki.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/alpine-mariadb.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/alpine-nextcloud.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-1024}"
 var_disk="${var_disk:-2}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/alpine-node-red.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/alpine-ntfy.sh

@@ -12,7 +12,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-2}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/alpine-postgresql.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/alpine-prometheus.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/alpine-rclone.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 var_fuse="${var_fuse:-yes}"

ct/alpine-redis.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/alpine-redlib.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-512}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/alpine-rustdeskserver.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-512}"
 var_disk="${var_disk:-3}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/alpine-rustypaste.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-4}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/alpine-syncthing.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/alpine-teamspeak-server.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-2}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-no}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/alpine-tinyauth.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-2}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/alpine-traefik.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-512}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/alpine-transmission.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/alpine-valkey.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/alpine-vaultwarden.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/alpine-wakapi.sh

@@ -12,7 +12,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-512}"
 var_disk="${var_disk:-4}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/alpine-wireguard.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 var_tun="${var_tun:-1}"

ct/alpine-zigbee2mqtt.sh

@@ -11,7 +11,7 @@ var_disk="${var_disk:-1}"
 var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-0}"
 

ct/alpine.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-512}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/cockpit.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-1024}"
 var_disk="${var_disk:-4}"
 var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
+var_version="${var_version:-12}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 
@@ -33,22 +33,6 @@ function update_script() {
   $STD apt update
   $STD apt -y upgrade
   msg_ok "Updated ${APP} LXC"
-
-  if [[ ! -f /etc/apt/sources.list.d/45drives.sources ]]; then
-    [[ "$(arch_resolve)" == "arm64" ]] || read -r -p "Would you like to install 45Drives' cockpit-file-sharing, cockpit-identities, and cockpit-navigator now? <y/N> " prompt
-    if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
-      msg_info "Installing 45Drives' cockpit extensions"
-      setup_deb822_repo "45drives" \
-        "https://repo.45drives.com/key/gpg.asc" \
-        "https://repo.45drives.com/enterprise/debian" \
-        "$(get_os_info codename)" \
-        "main" \
-        "amd64"
-      $STD apt install -y cockpit-file-sharing cockpit-identities cockpit-navigator
-      msg_ok "Installed 45Drives' cockpit extensions"
-    fi
-  fi
-
   msg_ok "Updated successfully!"
   exit
 }

ct/ironclaw.sh

@@ -30,8 +30,7 @@ function update_script() {
     exit
   fi
 
-  RELEASE="ironclaw-v0.29.1"
-  if check_for_gh_release "ironclaw-bin" "nearai/ironclaw" "${RELEASE}" "IronClaw 1.0 (Reborn) is a ground-up rearchitecture with an incompatible CLI/config format; pinned until this script supports it"; then
+  if check_for_gh_release "ironclaw-bin" "nearai/ironclaw"; then
     msg_info "Stopping Service"
     systemctl stop ironclaw
     msg_ok "Stopped Service"
@@ -40,7 +39,7 @@ function update_script() {
     cp /root/.ironclaw/.env /root/ironclaw.env.bak
     msg_ok "Backed up Configuration"
 
-    fetch_and_deploy_gh_release "ironclaw-bin" "nearai/ironclaw" "prebuild" "${RELEASE}" "/usr/local/bin" \
+    fetch_and_deploy_gh_release "ironclaw-bin" "nearai/ironclaw" "prebuild" "latest" "/usr/local/bin" \
       "ironclaw-$(uname -m)-unknown-linux-gnu.tar.gz"
     chmod +x /usr/local/bin/ironclaw
 

ct/npmplus.sh

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-512}"
 var_disk="${var_disk:-3}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.24}"
+var_version="${var_version:-3.23}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 

ct/paperless-ngx.sh

@@ -49,44 +49,22 @@ function update_script() {
     fi
   fi
 
-  local PAPERLESS_INSTALLED_VERSION="" BRIDGE_UPDATE=0
-  [[ -f ~/.paperless ]] && PAPERLESS_INSTALLED_VERSION="$(<~/.paperless)"
-  PAPERLESS_INSTALLED_VERSION="${PAPERLESS_INSTALLED_VERSION#v}"
-  if [[ "$PAPERLESS_INSTALLED_VERSION" == 2.* && "$PAPERLESS_INSTALLED_VERSION" != "2.20.15" ]]; then
-    BRIDGE_UPDATE=1
-  fi
-
-  if check_for_gh_release "paperless" "paperless-ngx/paperless-ngx"; then
-    if [[ "$PAPERLESS_INSTALLED_VERSION" == "2.20.15" ]]; then
-      msg_warn "Paperless-ngx v3 does not support encrypted documents anymore."
-      echo -e "${GATEWAY}${BGN}https://docs.paperless-ngx.com/migration-v3/#encryption-support${CL}"
-      msg_warn "Before continuing make sure that you do not use encryption or have decrypted all documents."
-      echo ""
-      read -rp "Do you want to continue with the update? (y/N): " MIGRATE
-      echo
-      if [[ ! "$MIGRATE" =~ ^[Yy]$ ]]; then
-        msg_info "Update aborted. Decrypt all documents before upgrading to v3."
-        exit 0
-      fi
-    fi
-
+  RELEASE="v2.20.15"
+  if check_for_gh_release "paperless" "paperless-ngx/paperless-ngx" "${RELEASE}" "v3 needs further testing"; then
     msg_info "Stopping all Paperless-ngx Services"
     systemctl stop paperless-consumer paperless-webserver paperless-scheduler paperless-task-queue
     msg_ok "Stopped all Paperless-ngx Services"
 
     if grep -q "uv run" /etc/systemd/system/paperless-webserver.service; then
+
       msg_info "Backing up configuration"
       local BACKUP_DIR="/opt/paperless_backup_$$"
       mkdir -p "$BACKUP_DIR"
       [[ -f /opt/paperless/paperless.conf ]] && cp /opt/paperless/paperless.conf "$BACKUP_DIR/"
       msg_ok "Backup completed to $BACKUP_DIR"
 
-      PYTHON_VERSION="3.13" setup_uv  
-      if ((BRIDGE_UPDATE)); then
-        CLEAN_INSTALL=1 fetch_and_deploy_gh_release "paperless" "paperless-ngx/paperless-ngx" "prebuild" "v2.20.15" "/opt/paperless" "paperless*tar.xz"
-      else
-        CLEAN_INSTALL=1 fetch_and_deploy_gh_release "paperless" "paperless-ngx/paperless-ngx" "prebuild" "latest" "/opt/paperless" "paperless*tar.xz"
-      fi
+      PYTHON_VERSION="3.13" setup_uv
+      CLEAN_INSTALL=1 fetch_and_deploy_gh_release "paperless" "paperless-ngx/paperless-ngx" "prebuild" "${RELEASE}" "/opt/paperless" "paperless*tar.xz"
       CLEAN_INSTALL=1 fetch_and_deploy_gh_release "jbig2enc" "ie13/jbig2enc" "tarball" "latest" "/opt/jbig2enc"
 
       . /etc/os-release
@@ -95,94 +73,18 @@ function update_script() {
       else
         ensure_dependencies ghostscript
       fi
-      ensure_dependencies gnupg
-
-      cp -r "$BACKUP_DIR"/* /opt/paperless/
-      if ((BRIDGE_UPDATE == 0)) && [[ "$PAPERLESS_INSTALLED_VERSION" == 2.* ]]; then
-        msg_info "Migrating Paperless-ngx v2 configuration to v3"
-        PAPERLESS_CONF="/opt/paperless/paperless.conf"
-
-        SECRET_KEY_CURRENT="$(sed -n 's|^PAPERLESS_SECRET_KEY=||p' "$PAPERLESS_CONF" | tail -n1)"
-        DBENGINE="$(sed -n 's|^PAPERLESS_DBENGINE=||p' "$PAPERLESS_CONF" | tail -n1)"
-        DB_OPTIONS_DEPRECATED="$(sed -n '/^PAPERLESS_DBSSLMODE=/p;/^PAPERLESS_DBSSLROOTCERT=/p;/^PAPERLESS_DBSSLCERT=/p;/^PAPERLESS_DBSSLKEY=/p;/^PAPERLESS_DB_POOLSIZE=/p;/^PAPERLESS_DB_TIMEOUT=/p' "$PAPERLESS_CONF")"
-        CONSUMER_POLLING="$(sed -n 's|^PAPERLESS_CONSUMER_POLLING=||p' "$PAPERLESS_CONF" | tail -n1)"
-        CONSUMER_POLLING_INTERVAL="$(sed -n 's|^PAPERLESS_CONSUMER_POLLING_INTERVAL=||p' "$PAPERLESS_CONF" | tail -n1)"
-        CONSUMER_INOTIFY_DELAY="$(sed -n 's|^PAPERLESS_CONSUMER_INOTIFY_DELAY=||p' "$PAPERLESS_CONF" | tail -n1)"
-        CONSUMER_STABILITY_DELAY="$(sed -n 's|^PAPERLESS_CONSUMER_STABILITY_DELAY=||p' "$PAPERLESS_CONF" | tail -n1)"
-        OCR_MODE="$(sed -n 's|^PAPERLESS_OCR_MODE=||p' "$PAPERLESS_CONF" | tail -n1)"
-        OCR_SKIP_ARCHIVE="$(sed -n 's|^PAPERLESS_OCR_SKIP_ARCHIVE_FILE=||p' "$PAPERLESS_CONF" | tail -n1)"
-        ARCHIVE_FILE_GENERATION="$(sed -n 's|^PAPERLESS_ARCHIVE_FILE_GENERATION=||p' "$PAPERLESS_CONF" | tail -n1)"
-        CONSUMER_DELETE_DUPLICATES="$(sed -n 's|^PAPERLESS_CONSUMER_DELETE_DUPLICATES=||p' "$PAPERLESS_CONF" | tail -n1)"
-
-        sed -i \
-          -e '/^PAPERLESS_CONSUMER_POLLING=/d' \
-          -e '/^PAPERLESS_CONSUMER_INOTIFY_DELAY=/d' \
-          -e '/^PAPERLESS_CONSUMER_POLLING_DELAY=/d' \
-          -e '/^PAPERLESS_CONSUMER_POLLING_RETRY_COUNT=/d' \
-          -e '/^PAPERLESS_CONSUMER_BARCODE_SCANNER=/d' \
-          -e '/^PAPERLESS_PASSPHRASE=/d' \
-          -e '/^PAPERLESS_OCR_SKIP_ARCHIVE_FILE=/d' \
-          -e 's|^PAPERLESS_OCR_MODE="\?skip"\?$|PAPERLESS_OCR_MODE=auto|' \
-          -e 's|^PAPERLESS_OCR_MODE="\?skip_noarchive"\?$|PAPERLESS_OCR_MODE=auto|' \
-          "$PAPERLESS_CONF"
-
-        if [[ -n "$DB_OPTIONS_DEPRECATED" ]]; then
-          msg_warn "Deprecated Paperless DB options detected; migrate them manually to PAPERLESS_DB_OPTIONS."
-          echo -e "${GATEWAY}${BGN}https://docs.paperless-ngx.com/migration-v3/#database-advanced-options${CL}"
-        fi
-        if [[ -z "$SECRET_KEY_CURRENT" || "$SECRET_KEY_CURRENT" == "change-me" ]]; then
-          SECRET_KEY="$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | od -An -tx1 | tr -d ' \n')"
-          sed -i \
-            -e '/^#\?PAPERLESS_SECRET_KEY=/d' \
-            -e "\$a\\PAPERLESS_SECRET_KEY=$SECRET_KEY" \
-            "$PAPERLESS_CONF"
-          printf "Paperless-ngx Secret Key: %s\n" "$SECRET_KEY" >>~/paperless-ngx.creds
-        fi
-        [[ -z "$DBENGINE" ]] && sed -i '$a\PAPERLESS_DBENGINE=postgresql' "$PAPERLESS_CONF"
-        [[ -n "$CONSUMER_POLLING" && -z "$CONSUMER_POLLING_INTERVAL" ]] &&
-          sed -i "\$a\\PAPERLESS_CONSUMER_POLLING_INTERVAL=$CONSUMER_POLLING" "$PAPERLESS_CONF"
-        [[ -n "$CONSUMER_INOTIFY_DELAY" && -z "$CONSUMER_STABILITY_DELAY" ]] &&
-          sed -i "\$a\\PAPERLESS_CONSUMER_STABILITY_DELAY=$CONSUMER_INOTIFY_DELAY" "$PAPERLESS_CONF"
-        [[ -z "$CONSUMER_DELETE_DUPLICATES" ]] &&
-          sed -i '$a\PAPERLESS_CONSUMER_DELETE_DUPLICATES=true' "$PAPERLESS_CONF"
-        if [[ -z "$ARCHIVE_FILE_GENERATION" ]]; then
-          if [[ "$OCR_MODE" == "skip_noarchive" || "$OCR_MODE" == "\"skip_noarchive\"" ]]; then
-            sed -i '$a\PAPERLESS_ARCHIVE_FILE_GENERATION=never' "$PAPERLESS_CONF"
-          elif [[ "$OCR_SKIP_ARCHIVE" == "never" || "$OCR_SKIP_ARCHIVE" == "\"never\"" ]]; then
-            sed -i '$a\PAPERLESS_ARCHIVE_FILE_GENERATION=always' "$PAPERLESS_CONF"
-          elif [[ "$OCR_SKIP_ARCHIVE" == "with_text" || "$OCR_SKIP_ARCHIVE" == "\"with_text\"" ]]; then
-            sed -i '$a\PAPERLESS_ARCHIVE_FILE_GENERATION=auto' "$PAPERLESS_CONF"
-          elif [[ "$OCR_SKIP_ARCHIVE" == "always" || "$OCR_SKIP_ARCHIVE" == "\"always\"" ]]; then
-            sed -i '$a\PAPERLESS_ARCHIVE_FILE_GENERATION=never' "$PAPERLESS_CONF"
-          fi
-        fi
-        [[ -n "$(sed -n '/^PAPERLESS_CONSUMER_IGNORE_PATTERNS=/p' "$PAPERLESS_CONF")" ]] &&
-          msg_warn "PAPERLESS_CONSUMER_IGNORE_PATTERNS now uses regex patterns; please verify custom values."
-        [[ -n "$(sed -n '/^PAPERLESS_PRE_CONSUME_SCRIPT=/p;/^PAPERLESS_POST_CONSUME_SCRIPT=/p' "$PAPERLESS_CONF")" ]] &&
-          msg_warn "Pre/post consume scripts no longer receive positional arguments in v3; please verify custom scripts."
-        msg_ok "Migrated Paperless-ngx configuration"
-      fi
 
       msg_info "Updating Paperless-ngx"
-      if ((BRIDGE_UPDATE == 0)); then
-        sed -i 's|^ExecStart=.*|ExecStart=uv run -- granian --interface asginl --ws --loop uvloop "paperless.asgi:application"|' /etc/systemd/system/paperless-webserver.service
-        $STD systemctl daemon-reload
-      fi
+      cp -r "$BACKUP_DIR"/* /opt/paperless/
       cd /opt/paperless
       $STD uv sync --all-extras
       cd /opt/paperless/src
       $STD uv run -- python manage.py migrate
       msg_ok "Updated Paperless-ngx"
 
-      if ((BRIDGE_UPDATE == 0)) && [[ "$PAPERLESS_INSTALLED_VERSION" == "2.20.15" ]]; then
-        $STD apt -y purge libzbar0t64 libzbar0 2>/dev/null || true
-        $STD apt -y autoremove 2>/dev/null || true
-      fi
-
       rm -rf "$BACKUP_DIR"
 
     else
-      BRIDGE_UPDATE=1
       msg_warn "You are about to migrate your Paperless-ngx installation to uv!"
       msg_custom "🔒" "It is strongly recommended to take a Proxmox snapshot first:"
       echo -e "   1. Stop the container:  pct stop <CTID>"
@@ -237,7 +139,7 @@ function update_script() {
       msg_ok "Backup completed to $BACKUP_DIR"
 
       PYTHON_VERSION="3.13" setup_uv
-      CLEAN_INSTALL=1 fetch_and_deploy_gh_release "paperless" "paperless-ngx/paperless-ngx" "prebuild" "v2.20.15" "/opt/paperless" "paperless*tar.xz"
+      CLEAN_INSTALL=1 fetch_and_deploy_gh_release "paperless" "paperless-ngx/paperless-ngx" "prebuild" "${RELEASE}" "/opt/paperless" "paperless*tar.xz"
       CLEAN_INSTALL=1 fetch_and_deploy_gh_release "jbig2enc" "ie13/jbig2enc" "tarball" "latest" "/opt/jbig2enc"
 
       . /etc/os-release
@@ -248,15 +150,14 @@ function update_script() {
         ensure_dependencies ghostscript
         msg_ok "Installed Ghostscript"
       fi
-      ensure_dependencies gnupg
 
-      msg_info "Updating Paperless-ngx to v2.20.15"
+      msg_info "Updating Paperless-ngx"
       cp -r "$BACKUP_DIR"/* /opt/paperless/
       cd /opt/paperless
       $STD uv sync --all-extras
       cd /opt/paperless/src
       $STD uv run -- python manage.py migrate
-      msg_ok "Migrated to uv and updated to v2.20.15 (required before v3)"
+      msg_ok "Paperless-ngx migration and update completed"
 
       rm -rf "$BACKUP_DIR"
       if [[ -d /opt/paperless/backup ]]; then
@@ -271,10 +172,6 @@ function update_script() {
     systemctl start paperless-consumer paperless-webserver paperless-scheduler paperless-task-queue
     sleep 1
     msg_ok "Started all Paperless-ngx Services"
-    if ((BRIDGE_UPDATE)); then
-      msg_custom "ℹ️" "${YW}" "Paperless-ngx is now on v2.20.15. Run the update again to upgrade to v3."
-      exit
-    fi
     msg_ok "Updated successfully!"
   fi
   exit

install/alpine-ironclaw-install.sh

@@ -31,7 +31,7 @@ $STD su -s /bin/sh postgres -c "psql -c \"CREATE DATABASE ironclaw WITH OWNER ir
 $STD su -s /bin/sh postgres -c "psql -d ironclaw -c \"CREATE EXTENSION IF NOT EXISTS vector;\""
 msg_ok "Set up Database"
 
-fetch_and_deploy_gh_release "ironclaw-bin" "nearai/ironclaw" "prebuild" "ironclaw-v0.29.1" "/usr/local/bin" \
+fetch_and_deploy_gh_release "ironclaw-bin" "nearai/ironclaw" "prebuild" "latest" "/usr/local/bin" \
   "ironclaw-$(uname -m)-unknown-linux-musl.tar.gz"
 chmod +x /usr/local/bin/ironclaw
 

install/cockpit-install.sh

@@ -15,33 +15,42 @@ network_check
 update_os
 
 msg_info "Installing Cockpit"
-CODENAME=$(get_os_info codename)
+source /etc/os-release
 cat <<EOF >/etc/apt/sources.list.d/debian-backports.sources
 Types: deb deb-src
 URIs: http://deb.debian.org/debian
-Suites: ${CODENAME}-backports
+Suites: ${VERSION_CODENAME}-backports
 Components: main
 Enabled: yes
 Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
 EOF
 
 $STD apt update
-$STD apt install -t ${CODENAME}-backports cockpit cracklib-runtime --no-install-recommends -y
+$STD apt install -t ${VERSION_CODENAME}-backports cockpit cracklib-runtime --no-install-recommends -y
 sed -i "s/root//g" /etc/cockpit/disallowed-users
 msg_ok "Installed Cockpit"
 
 # 45Drives only publishes amd64 packages
 [[ "$(arch_resolve)" == "arm64" ]] || read -r -p "Would you like to install 45Drives' cockpit-file-sharing, cockpit-identities, and cockpit-navigator  <y/N> " prompt
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
-  msg_info "Installing 45Drives' cockpit extensions"
-  setup_deb822_repo "45drives" \
-    "https://repo.45drives.com/key/gpg.asc" \
-    "https://repo.45drives.com/enterprise/debian" \
-    "${CODENAME}" \
-    "main" \
-    "amd64"
-  $STD apt install -y cockpit-file-sharing cockpit-identities cockpit-navigator
-  msg_ok "Installed 45Drives' cockpit extensions"
+  install_45drives=true
+  if [[ "${VERSION_ID}" -ge 13 ]]; then
+    read -r -p "Debian ${VERSION_ID} is not officially supported by 45Drives yet, would you like to continue anyway? <y/N> " prompt
+    if [[ ! "${prompt,,}" =~ ^(y|yes)$ ]]; then
+      install_45drives=false
+    fi
+  fi
+  if [[ "$install_45drives" == "true" ]]; then
+    msg_info "Installing 45Drives' cockpit extensions"
+    setup_deb822_repo "45drives" \
+      "https://repo.45drives.com/key/gpg.asc" \
+      "https://repo.45drives.com/enterprise/debian" \
+      "bookworm" \
+      "main" \
+      "amd64"
+    $STD apt install -y cockpit-file-sharing cockpit-identities cockpit-navigator
+    msg_ok "Installed 45Drives' cockpit extensions"
+  fi
 fi
 
 motd_ssh

install/ironclaw-install.sh

@@ -23,7 +23,7 @@ msg_ok "Installed Dependencies"
 PG_VERSION="17" PG_MODULES="pgvector" setup_postgresql
 PG_DB_NAME="ironclaw" PG_DB_USER="ironclaw" PG_DB_EXTENSIONS="vector" setup_postgresql_db
 
-fetch_and_deploy_gh_release "ironclaw-bin" "nearai/ironclaw" "prebuild" "ironclaw-v0.29.1" "/usr/local/bin" \
+fetch_and_deploy_gh_release "ironclaw-bin" "nearai/ironclaw" "prebuild" "latest" "/usr/local/bin" \
   "ironclaw-$(uname -m)-unknown-linux-gnu.tar.gz"
 chmod +x /usr/local/bin/ironclaw
 

install/paperless-ngx-install.sh

@@ -19,10 +19,10 @@ $STD apt install -y \
   build-essential \
   imagemagick \
   fonts-liberation \
-  gnupg \
   optipng \
   libpq-dev \
   libmagic-dev \
+  libzbar0t64 \
   poppler-utils \
   default-libmysqlclient-dev \
   automake \
@@ -43,15 +43,16 @@ $STD apt install -y \
   ghostscript
 msg_ok "Installed Dependencies"
 
-PG_VERSION="18" setup_postgresql
+PG_VERSION="16" setup_postgresql
 PG_DB_NAME="paperlessdb" PG_DB_USER="paperless" setup_postgresql_db
 PYTHON_VERSION="3.13" setup_uv
-fetch_and_deploy_gh_release "paperless" "paperless-ngx/paperless-ngx" "prebuild" "latest" "/opt/paperless" "paperless*tar.xz"
+fetch_and_deploy_gh_release "paperless" "paperless-ngx/paperless-ngx" "prebuild" "v2.20.15" "/opt/paperless" "paperless*tar.xz"
 
 msg_info "Setup Paperless-ngx"
 cd /opt/paperless
 rm -rf /opt/paperless/docker
 $STD uv sync --all-extras
+curl -fsSL "https://raw.githubusercontent.com/paperless-ngx/paperless-ngx/main/paperless.conf.example" -o /opt/paperless/paperless.conf
 mkdir -p /opt/paperless_data/{consume,data,media,trash}
 mkdir -p /opt/paperless/static
 SECRET_KEY="$(head /dev/urandom | tr -dc A-Za-z0-9 | head -c 32)"
@@ -68,12 +69,12 @@ sed -i \
   -e "s|#PAPERLESS_MEDIA_ROOT=../media|PAPERLESS_MEDIA_ROOT=/opt/paperless_data/media|" \
   -e "s|#PAPERLESS_EMPTY_TRASH_DIR=|PAPERLESS_EMPTY_TRASH_DIR=/opt/paperless_data/trash|" \
   -e "s|#PAPERLESS_STATICDIR=../static|PAPERLESS_STATICDIR=/opt/paperless/static|" \
-  -e 's|#PAPERLESS_DBHOST=localhost|PAPERLESS_DBENGINE=postgresql\nPAPERLESS_DBHOST=localhost|' \
+  -e 's|#PAPERLESS_DBHOST=localhost|PAPERLESS_DBHOST=localhost|' \
   -e 's|#PAPERLESS_DBPORT=5432|PAPERLESS_DBPORT=5432|' \
   -e "s|#PAPERLESS_DBNAME=paperless|PAPERLESS_DBNAME=$PG_DB_NAME|" \
   -e "s|#PAPERLESS_DBUSER=paperless|PAPERLESS_DBUSER=$PG_DB_USER|" \
   -e "s|#PAPERLESS_DBPASS=paperless|PAPERLESS_DBPASS=$PG_DB_PASS|" \
-  -e "s|PAPERLESS_SECRET_KEY=change-me|PAPERLESS_SECRET_KEY=$SECRET_KEY|" \
+  -e "s|#PAPERLESS_SECRET_KEY=change-me|PAPERLESS_SECRET_KEY=$SECRET_KEY|" \
   /opt/paperless/paperless.conf
 cd /opt/paperless/src
 set -a
@@ -151,7 +152,7 @@ Requires=redis.service
 
 [Service]
 WorkingDirectory=/opt/paperless/src
-ExecStart=uv run -- granian --interface asginl --ws --loop uvloop "paperless.asgi:application"
+ExecStart=uv run -- granian --interface asgi --ws "paperless.asgi:application"
 Environment=GRANIAN_HOST=::
 Environment=GRANIAN_PORT=8000
 Environment=GRANIAN_WORKERS=1

misc/alpine-install.func

@@ -147,12 +147,15 @@ update_os() {
     msg_warn "apk update failed (dl-cdn.alpinelinux.org), trying alternate mirrors..."
     local alpine_mirrors="mirror.init7.net ftp.halifax.rwth-aachen.de mirrors.edge.kernel.org alpine.mirror.wearetriple.com mirror.leaseweb.com uk.alpinelinux.org dl-2.alpinelinux.org dl-4.alpinelinux.org"
     local apk_ok=false
+    local alpine_branch
+    alpine_branch="v$(. /etc/os-release 2>/dev/null; printf '%s' "${VERSION_ID:-}" | cut -d. -f1,2)"
+    [ "$alpine_branch" = "v" ] && alpine_branch="latest-stable"
     for m in $(printf '%s\n' $alpine_mirrors | shuf); do
       if timeout 2 bash -c "echo >/dev/tcp/$m/80" 2>/dev/null; then
         msg_custom "${INFO}" "${YW}" "Attempting mirror: ${m}"
         cat <<EOF >/etc/apk/repositories
-http://$m/alpine/latest-stable/main
-http://$m/alpine/latest-stable/community
+http://$m/alpine/${alpine_branch}/main
+http://$m/alpine/${alpine_branch}/community
 EOF
         if $STD apk -U upgrade; then
           msg_ok "CDN set to ${m}: tests passed"

misc/build.func

@@ -4653,9 +4653,10 @@ EOF
   # Continue with standard container setup
   if [ "$var_os" == "alpine" ]; then
     sleep 3
+    local alpine_repo_branch="v${var_version}"
     pct exec "$CTID" -- /bin/sh -c 'cat <<EOF >/etc/apk/repositories
-https://dl-cdn.alpinelinux.org/alpine/latest-stable/main
-https://dl-cdn.alpinelinux.org/alpine/latest-stable/community
+https://dl-cdn.alpinelinux.org/alpine/'"${alpine_repo_branch}"'/main
+https://dl-cdn.alpinelinux.org/alpine/'"${alpine_repo_branch}"'/community
 EOF'
     pct exec "$CTID" -- ash -c 'set -a; [ -f /etc/profile.d/90-http-proxy.sh ] && . /etc/profile.d/90-http-proxy.sh; set +a; apk add bash newt curl openssh nano mc ncurses jq' >>"$BUILD_LOG" 2>&1 || {
       msg_warn "apk install failed (dl-cdn.alpinelinux.org), trying alternate mirrors..."
@@ -4666,11 +4667,11 @@ EOF'
         set +a
         ALPINE_MIRRORS="mirror.init7.net ftp.halifax.rwth-aachen.de mirrors.edge.kernel.org alpine.mirror.wearetriple.com mirror.leaseweb.com uk.alpinelinux.org dl-2.alpinelinux.org dl-4.alpinelinux.org"
         for m in $(printf "%s\n" $ALPINE_MIRRORS | shuf); do
-          if wget -q --spider --timeout=2 "http://$m/alpine/latest-stable/main/" 2>/dev/null; then
+          if wget -q --spider --timeout=2 "http://$m/alpine/'"${alpine_repo_branch}"'/main/" 2>/dev/null; then
             echo "  Attempting mirror: $m"
             cat <<EOF >/etc/apk/repositories
-http://$m/alpine/latest-stable/main
-http://$m/alpine/latest-stable/community
+http://$m/alpine/'"${alpine_repo_branch}"'/main
+http://$m/alpine/'"${alpine_repo_branch}"'/community
 EOF
             if apk update >/dev/null 2>&1 && apk add bash newt curl openssh nano mc ncurses jq >/dev/null 2>&1; then
               echo "  CDN set to $m: tests passed"