Harden OPNsense build wait detection

Improves VM install completion detection by encapsulating screendump hashing in a helper, clearing stale dump files, and trying both `qm monitor` and `pvesh` monitor paths. The stability check now tolerates alternating A/B frames from a blinking login cursor instead of requiring one identical frame. It also adds elapsed-time progress output and a safe fallback to a fixed 12-minute wait when screendumps are unavailable, avoiding false completion or endless polling.
Replace fixed OPNsense wait with screen polling
2026-07-21 21:35:08 +02:00 · 2026-07-21 16:35:06 +02:00 · 2026-07-21 13:16:21 +02:00 · 2026-07-21 13:11:40 +02:00 · 2026-07-21 10:56:46 +02:00 · 2026-07-21 10:02:26 +02:00
85 changed files with 1531 additions and 1290 deletions
@@ -511,8 +511,8 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
  - #### 🐞 Bug Fixes
    - fix: vikunja: asset selection [@CrazyWolf13](https://github.com/CrazyWolf13) ([#15929](https://github.com/community-scripts/ProxmoxVE/pull/15929))
    - RomM: use backup helpers in update / clear folder [@MickLesk](https://github.com/MickLesk) ([#15915](https://github.com/community-scripts/ProxmoxVE/pull/15915))
    - fix: vikunja: asset selection [@CrazyWolf13](https://github.com/CrazyWolf13) ([#15929](https://github.com/community-scripts/ProxmoxVE/pull/15929))
    - Zammad : bind Elasticsearch to 127.0.0.1 [@MickLesk](https://github.com/MickLesk) ([#15909](https://github.com/community-scripts/ProxmoxVE/pull/15909))
    - Omada: fix package version extraction [@MickLesk](https://github.com/MickLesk) ([#15908](https://github.com/community-scripts/ProxmoxVE/pull/15908))
    - fix(wanderer): use PocketBase-relative plugin symlink in unprivileged LXC [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15911](https://github.com/community-scripts/ProxmoxVE/pull/15911))
@@ -529,6 +529,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
  - #### ✨ New Features
    - core: refactor to single-reporter telemetry and better error_handling [@MickLesk](https://github.com/MickLesk) ([#15933](https://github.com/community-scripts/ProxmoxVE/pull/15933))
    - tools.func: add support for extracting 7z archives [@MickLesk](https://github.com/MickLesk) ([#15919](https://github.com/community-scripts/ProxmoxVE/pull/15919))
    - Meilisearch : use dumpless Meilisearch upgrades [@MickLesk](https://github.com/MickLesk) ([#15921](https://github.com/community-scripts/ProxmoxVE/pull/15921))
@@ -42,6 +42,8 @@ function update_script() {
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "${RELEASE}" "/opt/affine"
    # Restore BEFORE the build: CLEAN_INSTALL wiped /opt/affine including .env,
    # and the build below sources it
    restore_backup
    if [[ ! -f /opt/affine/.env ]]; then
@@ -30,11 +30,16 @@ function update_script() {
  fi
  if check_for_gh_release "cinny" "cinnyapp/cinny"; then
-    create_backup /opt/cinny/config.json
+    msg_info "Backing up Configuration"
    cp /opt/cinny/config.json /opt/cinny_config.json.bak
    msg_ok "Backed up Configuration"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "cinny" "cinnyapp/cinny" "prebuild" "latest" "/opt/cinny" "cinny-*.tar.gz"
-    restore_backup
+    msg_info "Restoring Configuration"
    cp /opt/cinny_config.json.bak /opt/cinny/config.json
    rm -f /opt/cinny_config.json.bak
    msg_ok "Restored Configuration"
    msg_info "Restarting nginx"
    $STD rc-service nginx restart
@@ -116,10 +116,21 @@ EOF
    msg_info "Creating Backup"
    BACKUP_FILE="/opt/dispatcharr_backup_$(date +%F_%H-%M-%S).tar.gz"
    if [[ -f /opt/dispatcharr/.env ]]; then
      cp /opt/dispatcharr/.env /tmp/dispatcharr.env.backup
    fi
    if [[ -f /opt/dispatcharr/start-gunicorn.sh ]]; then
      rm -f /opt/dispatcharr/start-gunicorn.sh
    fi
-    create_backup /opt/dispatcharr/.env /opt/dispatcharr/start-celery.sh /opt/dispatcharr/start-celerybeat.sh /opt/dispatcharr/start-daphne.sh
+    if [[ -f /opt/dispatcharr/start-celery.sh ]]; then
      cp /opt/dispatcharr/start-celery.sh /tmp/start-celery.sh.backup
    fi
    if [[ -f /opt/dispatcharr/start-celerybeat.sh ]]; then
      cp /opt/dispatcharr/start-celerybeat.sh /tmp/start-celerybeat.sh.backup
    fi
    if [[ -f /opt/dispatcharr/start-daphne.sh ]]; then
      cp /opt/dispatcharr/start-daphne.sh /tmp/start-daphne.sh.backup
    fi
    if [[ -f /opt/dispatcharr/.env ]]; then
      set -o allexport
      source /opt/dispatcharr/.env
@@ -134,9 +145,20 @@ EOF
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "dispatcharr" "Dispatcharr/Dispatcharr" "tarball"
    restore_backup
    msg_info "Updating Dispatcharr Backend"
    if [[ -f /tmp/dispatcharr.env.backup ]]; then
      mv /tmp/dispatcharr.env.backup /opt/dispatcharr/.env
    fi
    if [[ -f /tmp/start-celery.sh.backup ]]; then
      mv /tmp/start-celery.sh.backup /opt/dispatcharr/start-celery.sh
    fi
    if [[ -f /tmp/start-celerybeat.sh.backup ]]; then
      mv /tmp/start-celerybeat.sh.backup /opt/dispatcharr/start-celerybeat.sh
    fi
    if [[ -f /tmp/start-daphne.sh.backup ]]; then
      mv /tmp/start-daphne.sh.backup /opt/dispatcharr/start-daphne.sh
    fi
    if ! grep -q "DJANGO_SECRET_KEY" /opt/dispatcharr/.env; then
      DJANGO_SECRET=$(openssl rand -base64 48 | tr -dc 'a-zA-Z0-9' | cut -c1-50)
      echo "DJANGO_SECRET_KEY=$DJANGO_SECRET" >>/opt/dispatcharr/.env
@@ -35,11 +35,21 @@ function update_script() {
    systemctl stop nginx
    msg_ok "Stopped Service"
-    create_backup /opt/fladder/assets/config/config.json
+    if [[ -f /opt/fladder/assets/config/config.json ]]; then
      msg_info "Backing up configuration"
      cp /opt/fladder/assets/config/config.json /tmp/fladder_config.json.bak
      msg_ok "Configuration backed up"
    fi
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Fladder" "DonutWare/Fladder" "prebuild" "latest" "/opt/fladder" "Fladder-Web-*.zip"
-    restore_backup
+    if [[ -f /tmp/fladder_config.json.bak ]]; then
      msg_info "Restoring configuration"
      mkdir -p /opt/fladder/assets/config
      cp /tmp/fladder_config.json.bak /opt/fladder/assets/config/config.json
      rm -f /tmp/fladder_config.json.bak
      msg_ok "Configuration restored"
    fi
    msg_info "Starting Service"
    systemctl start nginx
@@ -34,11 +34,12 @@ function update_script() {
    systemctl stop flatnotes
    msg_ok "Stopped Service"
-    create_backup /opt/flatnotes/.env /opt/flatnotes/data
+    msg_info "Backing up Configuration and Data"
    cp /opt/flatnotes/.env /opt/flatnotes.env
    cp -r /opt/flatnotes/data /opt/flatnotes_data_backup
    msg_ok "Backed up Configuration and Data"
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "flatnotes" "dullage/flatnotes" "tarball"
+    fetch_and_deploy_gh_release "flatnotes" "dullage/flatnotes" "tarball"
    restore_backup
    msg_info "Updating Flatnotes"
    cd /opt/flatnotes/client
@@ -51,6 +52,13 @@ function update_script() {
    $STD /usr/local/bin/uv sync
    msg_ok "Updated Flatnotes"
    msg_info "Restoring Configuration and Data"
    cp /opt/flatnotes.env /opt/flatnotes/.env
    cp -r /opt/flatnotes_data_backup/. /opt/flatnotes/data
    rm -f /opt/flatnotes.env
    rm -r /opt/flatnotes_data_backup
    msg_ok "Restored Configuration and Data"
    msg_info "Starting Service"
    systemctl start flatnotes
    msg_ok "Started Service"
@@ -38,9 +38,9 @@ function update_script() {
    systemctl stop fluid-calendar
    msg_info "Stopped Service"
-    create_backup /opt/fluid-calendar/.env
+    cp /opt/fluid-calendar/.env /opt/fluid.env
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "fluid-calendar" "dotnetfactory/fluid-calendar" "tarball"
-    restore_backup
+    mv /opt/fluid.env /opt/fluid-calendar/.env
    msg_info "Updating Fluid Calendar"
    cd /opt/fluid-calendar
@@ -41,15 +41,13 @@ function update_script() {
      --exclude="ghostfolio/node_modules" \
      --exclude="ghostfolio/dist" \
      ghostfolio
    mv /opt/ghostfolio/.env /opt/env.backup
    msg_ok "Backup Created"
    create_backup /opt/ghostfolio/.env
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "ghostfolio" "ghostfolio/ghostfolio" "tarball" "latest" "/opt/ghostfolio"
    restore_backup
    msg_info "Updating Ghostfolio"
    mv /opt/env.backup /opt/ghostfolio/.env
    sed -i -E '/^DATABASE_URL=/ s/[?&]sslmode=prefer//g' /opt/ghostfolio/.env
    cd /opt/ghostfolio
    $STD npm ci
@@ -35,11 +35,18 @@ function update_script() {
    systemctl stop gogs
    msg_ok "Stopped Service"
-    create_backup /opt/gogs/custom /opt/gogs/data
+    msg_info "Backing up Data"
    cp -r /opt/gogs/custom /opt/gogs_custom_backup
    cp -r /opt/gogs/data /opt/gogs_data_backup
    msg_ok "Backed up Data"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "gogs" "gogs/gogs" "prebuild" "latest" "/opt/gogs" "gogs_*_linux_$(arch_resolve).tar.gz"
-    restore_backup
+    msg_info "Restoring Data"
    cp -r /opt/gogs_custom_backup/. /opt/gogs/custom
    cp -r /opt/gogs_data_backup/. /opt/gogs/data
    rm -rf /opt/gogs_custom_backup /opt/gogs_data_backup
    msg_ok "Restored Data"
    msg_info "Starting Service"
    systemctl start gogs
@@ -37,14 +37,21 @@ function update_script() {
    systemctl stop grist
    msg_ok "Stopped Service"
-    create_backup /opt/grist/.env /opt/grist/docs /opt/grist/grist-sessions.db /opt/grist/landing.db
+    msg_info "Creating backup"
    rm -rf /opt/grist_bak
    mv /opt/grist /opt/grist_bak
    msg_ok "Backup created"
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "grist" "gristlabs/grist-core" "tarball"
+    fetch_and_deploy_gh_release "grist" "gristlabs/grist-core" "tarball"
    restore_backup
    msg_info "Updating Grist"
    mkdir -p /opt/grist/docs
    cp -n /opt/grist_bak/.env /opt/grist/.env
    if ls /opt/grist_bak/docs/* &>/dev/null; then
      cp -r /opt/grist_bak/docs/* /opt/grist/docs/
    fi
    [[ -f /opt/grist_bak/grist-sessions.db ]] && cp /opt/grist_bak/grist-sessions.db /opt/grist/grist-sessions.db
    [[ -f /opt/grist_bak/landing.db ]] && cp /opt/grist_bak/landing.db /opt/grist/landing.db
    cd /opt/grist
    $STD yarn install
    $STD yarn run build:prod
@@ -39,12 +39,8 @@ function update_script() {
    systemctl stop homebox
    msg_ok "Stopped Service"
    create_backup /opt/homebox/.env /opt/homebox/.data
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "homebox" "sysadminsmedia/homebox" "prebuild" "latest" "/opt/homebox" "homebox_Linux_$(arch_resolve "x86_64" "arm64").tar.gz"
    chmod +x /opt/homebox/homebox
    restore_backup
    [ -f /opt/.env ] && mv /opt/.env /opt/homebox/.env
    [ -d /opt/.data ] && mv /opt/.data /opt/homebox/.data
@@ -35,12 +35,16 @@ function update_script() {
    systemctl stop homelable
    msg_ok "Stopped Service"
-    create_backup /opt/homelable/backend/.env /opt/homelable/data /opt/homelable/mcp/.env
+    msg_info "Backing up Configuration and Data"
    cp /opt/homelable/backend/.env /opt/homelable.env.bak
    cp -r /opt/homelable/data /opt/homelable_data_bak
    if [[ -f /opt/homelable/mcp/.env ]]; then
      cp -a /opt/homelable/mcp/.env /opt/homelable-mcp.env.bak
    fi
    msg_ok "Backed up Configuration and Data"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "homelable" "Pouzor/homelable" "tarball" "latest" "/opt/homelable"
    restore_backup
    msg_info "Updating Python Dependencies"
    cd /opt/homelable/backend
    $STD uv venv --clear /opt/homelable/backend/.venv
@@ -53,8 +57,17 @@ function update_script() {
    $STD npm run build
    msg_ok "Rebuilt Frontend"
-    if [[ -f /opt/homelable/mcp/.env ]]; then
+    msg_info "Restoring Configuration and Data"
    cp /opt/homelable.env.bak /opt/homelable/backend/.env
    cp -r /opt/homelable_data_bak/. /opt/homelable/data/
    rm -f /opt/homelable.env.bak
    rm -rf /opt/homelable_data_bak
    msg_ok "Restored Configuration and Data"
    if [[ -f /opt/homelable-mcp.env.bak ]]; then
      msg_info "Restoring MCP Server"
      cp -a /opt/homelable-mcp.env.bak /opt/homelable/mcp/.env
      rm -f /opt/homelable-mcp.env.bak
      MCP_OWNER=$(stat -c '%U' /opt/homelable/mcp/.env)
      cd /opt/homelable/mcp
      $STD uv venv --clear /opt/homelable/mcp/.venv
@@ -37,12 +37,20 @@ function update_script() {
    systemctl stop homepage
    msg_ok "Stopped service"
-    create_backup /opt/homepage/.env /opt/homepage/config
+    msg_info "Creating Backup"
-    BACKUP_DIR=/opt/homepage-assets.backup create_backup /opt/homepage/public/images /opt/homepage/public/icons
+    cp /opt/homepage/.env /opt/homepage.env
    cp -r /opt/homepage/config /opt/homepage_config_backup
    [[ -d /opt/homepage/public/images ]] && cp -r /opt/homepage/public/images /opt/homepage_images_backup
    [[ -d /opt/homepage/public/icons ]] && cp -r /opt/homepage/public/icons /opt/homepage_icons_backup
    msg_ok "Created Backup"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "homepage" "gethomepage/homepage" "tarball"
-    restore_backup
+    msg_info "Restoring Backup"
    mv /opt/homepage.env /opt/homepage
    rm -rf /opt/homepage/config
    mv /opt/homepage_config_backup /opt/homepage/config
    msg_ok "Restored Backup"
    msg_info "Updating Homepage (Patience)"
    RELEASE=$(get_latest_github_release "gethomepage/homepage")
@@ -55,7 +63,8 @@ function update_script() {
    export NEXT_PUBLIC_BUILDTIME=$(curl -fsSL https://api.github.com/repos/gethomepage/homepage/releases/latest | jq -r '.published_at')
    export NEXT_TELEMETRY_DISABLED=1
    $STD pnpm build
-    BACKUP_DIR=/opt/homepage-assets.backup restore_backup
+    [[ -d /opt/homepage_images_backup ]] && mv /opt/homepage_images_backup /opt/homepage/public/images
    [[ -d /opt/homepage_icons_backup ]] && mv /opt/homepage_icons_backup /opt/homepage/public/icons
    msg_ok "Updated Homepage"
    msg_info "Starting service"
@@ -36,11 +36,16 @@ function update_script() {
    systemctl stop hoodik
    msg_ok "Stopped Service"
-    create_backup /opt/hoodik/.env
+    msg_info "Backing up Configuration"
    cp /opt/hoodik/.env /opt/hoodik.env.bak
    msg_ok "Backed up Configuration"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "hoodik" "hudikhq/hoodik" "prebuild" "latest" "/opt/hoodik" "*$(arch_resolve "x86_64" "arm64").tar.gz"
-    restore_backup
+    msg_info "Restoring Configuration"
    cp /opt/hoodik.env.bak /opt/hoodik/.env
    rm -f /opt/hoodik.env.bak
    msg_ok "Restored Configuration"
    msg_info "Starting Service"
    systemctl start hoodik
@@ -35,11 +35,16 @@ function update_script() {
    systemctl stop igotify
    msg_ok "Stopped Service"
-    create_backup /opt/igotify/.env
+    msg_info "Backing up Configuration"
    cp /opt/igotify/.env /opt/igotify.env.bak
    msg_ok "Backed up Configuration"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "igotify" "androidseb25/iGotify-Notification-Assistent" "prebuild" "latest" "/opt/igotify" "iGotify-Notification-Service-$(arch_resolve)-v*.zip"
-    restore_backup
+    msg_info "Restoring Configuration"
    cp /opt/igotify.env.bak /opt/igotify/.env
    rm -f /opt/igotify.env.bak
    msg_ok "Restored Configuration"
    msg_info "Starting Service"
    systemctl start igotify
@@ -35,7 +35,9 @@ function update_script() {
    systemctl stop immichframe
    msg_ok "Stopped Service"
-    create_backup /opt/immichframe/Config
+    msg_info "Backing up Configuration"
    cp -r /opt/immichframe/Config /tmp/immichframe_config.bak
    msg_ok "Backed up Configuration"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "immichframe" "immichFrame/ImmichFrame" "tarball" "latest" "/tmp/immichframe"
@@ -55,8 +57,11 @@ function update_script() {
    rm -rf /tmp/immichframe
    msg_ok "Setup ImmichFrame"
-    restore_backup
+    msg_info "Restoring Configuration"
    cp -r /tmp/immichframe_config.bak/* /opt/immichframe/Config/
    rm -rf /tmp/immichframe_config.bak
    chown -R immichframe:immichframe /opt/immichframe
    msg_ok "Restored Configuration"
    msg_info "Starting Service"
@@ -41,14 +41,20 @@ function update_script() {
    NODE_VERSION="22" setup_nodejs
    PG_VERSION="17" setup_postgresql
-    create_backup /opt/investbrain/.env /opt/investbrain/storage
+    msg_info "Creating Backup"
    rm -f /opt/.env.backup
    rm -rf /opt/investbrain_backup
    cp /opt/investbrain/.env /opt/.env.backup
    cp -r /opt/investbrain/storage /opt/investbrain_backup
    msg_ok "Created Backup"
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Investbrain" "investbrainapp/investbrain" "tarball" "latest" "/opt/investbrain"
+    fetch_and_deploy_gh_release "Investbrain" "investbrainapp/investbrain" "tarball" "latest" "/opt/investbrain"
    restore_backup
    msg_info "Updating Investbrain"
    cd /opt/investbrain
    rm -rf /opt/investbrain/storage
    cp /opt/.env.backup /opt/investbrain/.env
    cp -r /opt/investbrain_backup/ /opt/investbrain/storage
    export COMPOSER_ALLOW_SUPERUSER=1
    $STD /usr/local/bin/composer install --no-interaction --no-dev --optimize-autoloader
    $STD npm install
@@ -63,6 +69,7 @@ function update_script() {
    $STD php artisan event:cache
    chown -R www-data:www-data /opt/investbrain
    chmod -R 775 /opt/investbrain/storage /opt/investbrain/bootstrap/cache
    rm -rf /opt/.env.backup /opt/investbrain_backup
    msg_ok "Updated Investbrain"
    msg_info "Starting Services"
@@ -35,11 +35,21 @@ function update_script() {
    systemctl stop supervisor nginx php8.4-fpm
    msg_ok "Stopped Services"
-    create_backup /opt/invoiceninja/.env /opt/invoiceninja/storage /opt/invoiceninja/public/storage
+    msg_info "Creating Backup"
    mkdir -p /tmp/invoiceninja_backup
    cp /opt/invoiceninja/.env /tmp/invoiceninja_backup/
    cp -r /opt/invoiceninja/storage /tmp/invoiceninja_backup/ 2>/dev/null || true
    cp -r /opt/invoiceninja/public/storage /tmp/invoiceninja_backup/public_storage 2>/dev/null || true
    msg_ok "Created Backup"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "invoiceninja" "invoiceninja/invoiceninja" "prebuild" "latest" "/opt/invoiceninja" "invoiceninja.tar.gz"
-    restore_backup
+    msg_info "Restoring Data"
    cp /tmp/invoiceninja_backup/.env /opt/invoiceninja/
    cp -r /tmp/invoiceninja_backup/storage/* /opt/invoiceninja/storage/ 2>/dev/null || true
    cp -r /tmp/invoiceninja_backup/public_storage/* /opt/invoiceninja/public/storage/ 2>/dev/null || true
    rm -rf /tmp/invoiceninja_backup
    msg_ok "Restored Data"
    msg_info "Running Migrations"
    cd /opt/invoiceninja 
@@ -35,11 +35,19 @@ function update_script() {
    systemctl stop caddy
    msg_ok "Stopped Services"
-    create_backup /opt/invoiceshelf/.env /opt/invoiceshelf/storage
+    msg_info "Backing up Data"
    cp /opt/invoiceshelf/.env /opt/invoiceshelf.env.bak
    cp -r /opt/invoiceshelf/storage /opt/invoiceshelf_storage_backup
    msg_ok "Backed up Data"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "invoiceshelf" "InvoiceShelf/InvoiceShelf" "tarball"
-    restore_backup
+    msg_info "Restoring Data"
    cp /opt/invoiceshelf.env.bak /opt/invoiceshelf/.env
    rm -f /opt/invoiceshelf.env.bak
    cp -r /opt/invoiceshelf_storage_backup/. /opt/invoiceshelf/storage
    rm -rf /opt/invoiceshelf_storage_backup
    msg_ok "Restored Data"
    msg_info "Updating Application"
    cd /opt/invoiceshelf
@@ -36,9 +36,9 @@ function update_script() {
    systemctl stop joplin-server
    msg_ok "Stopped Services"
-    create_backup /opt/joplin-server/.env
+    cp /opt/joplin-server/.env /opt
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "joplin-server" "laurent22/joplin" "tarball"
-    restore_backup
+    mv /opt/.env /opt/joplin-server
    msg_info "Updating Joplin-Server"
    cd /opt/joplin-server
@@ -35,12 +35,20 @@ function update_script() {
    systemctl stop jotty
    msg_ok "Stopped Service"
-    create_backup /opt/jotty/.env /opt/jotty/data /opt/jotty/config
+    msg_info "Backing up configuration & data"
    cp /opt/jotty/.env /opt/app.env
    [[ -d /opt/jotty/data ]] && mv /opt/jotty/data /opt/data
    [[ -d /opt/jotty/config ]] && mv /opt/jotty/config /opt/config
    msg_ok "Backed up configuration & data"
    NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "jotty" "fccview/jotty" "prebuild" "latest" "/opt/jotty" "jotty_*_prebuild.tar.gz"
-    restore_backup
+    msg_info "Restoring configuration & data"
    mv /opt/app.env /opt/jotty/.env
    [[ -d /opt/data ]] && mv /opt/data /opt/jotty/data
    [[ -d /opt/config ]] && cp -a /opt/config/* /opt/jotty/config && rm -rf /opt/config
    msg_ok "Restored configuration & data"
    msg_info "Starting Service"
    systemctl start jotty
@@ -35,11 +35,16 @@ function update_script() {
    systemctl stop kan
    msg_ok "Stopped Service"
-    create_backup /opt/kan/.env
+    msg_info "Backing up Data"
    cp /opt/kan/.env /opt/kan.env.bak
    msg_ok "Backed up Data"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_tag "kan" "kanbn/kan" "latest"
-    restore_backup
+    msg_info "Restoring Configuration"
    cp /opt/kan.env.bak /opt/kan/.env
    rm -f /opt/kan.env.bak
    msg_ok "Restored Configuration"
    msg_info "Building Application"
    cd /opt/kan
@@ -37,11 +37,18 @@ function update_script() {
    systemctl stop kima-frontend kima-backend kima-analyzer kima-analyzer-clap
    msg_ok "Stopped Services"
-    create_backup /opt/kima-hub/backend/.env /opt/kima-hub/frontend/.env
+    msg_info "Backing up Data"
    cp /opt/kima-hub/backend/.env /opt/kima-hub-backend-env.bak
    cp /opt/kima-hub/frontend/.env /opt/kima-hub-frontend-env.bak
    msg_ok "Backed up Data"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "kima-hub" "Chevron7Locked/kima-hub" "tarball"
-    restore_backup
+    msg_info "Restoring Data"
    cp /opt/kima-hub-backend-env.bak /opt/kima-hub/backend/.env
    cp /opt/kima-hub-frontend-env.bak /opt/kima-hub/frontend/.env
    rm -f /opt/kima-hub-backend-env.bak /opt/kima-hub-frontend-env.bak
    msg_ok "Restored Data"
    msg_info "Rebuilding Backend"
    cd /opt/kima-hub/backend
@@ -35,14 +35,22 @@ function update_script() {
    systemctl stop kitchenowl
    msg_ok "Stopped Service"
-    create_backup /opt/kitchenowl/data /opt/kitchenowl/kitchenowl.env
+    msg_info "Creating Backup"
    mkdir -p /opt/kitchenowl_backup
    cp -r /opt/kitchenowl/data /opt/kitchenowl_backup/
    cp -f /opt/kitchenowl/kitchenowl.env /opt/kitchenowl_backup/
    msg_ok "Created Backup"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "kitchenowl" "TomBursch/kitchenowl" "tarball" "latest" "/opt/kitchenowl"
    rm -rf /opt/kitchenowl/web
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "kitchenowl-web" "TomBursch/kitchenowl" "prebuild" "latest" "/opt/kitchenowl/web" "kitchenowl_Web.tar.gz"
-    restore_backup
+    msg_info "Restoring data"
    sed -i 's/default=True/default=False/' /opt/kitchenowl/backend/wsgi.py
    cp -r /opt/kitchenowl_backup/data /opt/kitchenowl/
    cp -f /opt/kitchenowl_backup/kitchenowl.env /opt/kitchenowl/
    rm -rf /opt/kitchenowl_backup
    msg_ok "Restored data"
    msg_info "Updating KitchenOwl"
    cd /opt/kitchenowl/backend
@@ -35,11 +35,21 @@ function update_script() {
    systemctl stop nginx php8.4-fpm
    msg_ok "Stopped Services"
-    create_backup /opt/koel/.env /opt/koel/storage /opt/koel/public/img
+    msg_info "Creating Backup"
    mkdir -p /tmp/koel_backup
    cp /opt/koel/.env /tmp/koel_backup/
    cp -r /opt/koel/storage /tmp/koel_backup/ 2>/dev/null || true
    cp -r /opt/koel/public/img /tmp/koel_backup/ 2>/dev/null || true
    msg_ok "Created Backup"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "koel" "koel/koel" "prebuild" "latest" "/opt/koel" "koel-*.tar.gz"
-    restore_backup
+    msg_info "Restoring Data"
    cp /tmp/koel_backup/.env /opt/koel/
    cp -r /tmp/koel_backup/storage/* /opt/koel/storage/ 2>/dev/null || true
    cp -r /tmp/koel_backup/img/* /opt/koel/public/img/ 2>/dev/null || true
    rm -rf /tmp/koel_backup
    msg_ok "Restored Data"
    msg_info "Running Migrations"
    cd /opt/koel 
@@ -34,18 +34,20 @@ function update_script() {
    msg_info "Creating Backup"
    mariadb-dump leantime >"/opt/leantime_db_backup_$(date +%F).sql"
    tar -czf "/opt/leantime_backup_$(date +%F).tar.gz" "/opt/leantime"
    mv /opt/leantime /opt/leantime_bak
    msg_ok "Backup Created"
-    create_backup /opt/leantime/config/.env
+    fetch_and_deploy_gh_release "leantime" "Leantime/leantime" "prebuild" "latest" "/opt/leantime" Leantime*.tar.gz
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "leantime" "Leantime/leantime" "prebuild" "latest" "/opt/leantime" Leantime*.tar.gz
+    msg_info "Restoring Config & Permissions"
-
+    mv /opt/leantime_bak/config/.env /opt/leantime/config/.env
    restore_backup
    msg_info "Setting Permissions"
    chown -R www-data:www-data "/opt/leantime"
    chmod -R 750 "/opt/leantime"
-    msg_ok "Set Permissions"
+    msg_ok "Restored Config & Permissions"
    msg_info "Removing Backup"
    rm -rf /opt/leantime_bak
    msg_ok "Removed Backup"
    msg_ok "Updated successfully!"
  fi
  exit
@@ -35,12 +35,12 @@ function update_script() {
    systemctl stop librechat rag-api
    msg_ok "Stopped Services"
-    create_backup /opt/librechat/.env
+    msg_info "Backing up Configuration"
    cp /opt/librechat/.env /opt/librechat.env.bak
    msg_ok "Backed up Configuration"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_tag "librechat" "danny-avila/LibreChat"
    restore_backup
    msg_info "Installing Dependencies"
    cd /opt/librechat
    $STD npm ci
@@ -52,6 +52,11 @@ function update_script() {
    $STD npm cache clean --force
    msg_ok "Built Frontend"
    msg_info "Restoring Configuration"
    cp /opt/librechat.env.bak /opt/librechat/.env
    rm -f /opt/librechat.env.bak
    msg_ok "Restored Configuration"
    msg_info "Starting Services"
    systemctl start rag-api librechat
    msg_ok "Started Services"
@@ -63,17 +68,22 @@ function update_script() {
    systemctl stop rag-api
    msg_ok "Stopped RAG API"
-    create_backup /opt/rag-api/.env
+    msg_info "Backing up RAG API Configuration"
    cp /opt/rag-api/.env /opt/rag-api.env.bak
    msg_ok "Backed up RAG API Configuration"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "rag-api" "danny-avila/rag_api" "tarball"
    restore_backup
    msg_info "Updating RAG API Dependencies"
    cd /opt/rag-api
    $STD .venv/bin/pip install -r requirements.lite.txt
    msg_ok "Updated RAG API Dependencies"
    msg_info "Restoring RAG API Configuration"
    cp /opt/rag-api.env.bak /opt/rag-api/.env
    rm -f /opt/rag-api.env.bak
    msg_ok "Restored RAG API Configuration"
    msg_info "Starting RAG API"
    systemctl start rag-api
    msg_ok "Started RAG API"
@@ -35,12 +35,19 @@ function update_script() {
    systemctl stop nginx linkding linkding-tasks
    msg_ok "Stopped Services"
-    create_backup /opt/linkding/data /opt/linkding/.env
+    msg_info "Backing up Data"
    cp -r /opt/linkding/data /opt/linkding_data_backup
    cp /opt/linkding/.env /opt/linkding_env_backup
    msg_ok "Backed up Data"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "linkding" "sissbruecker/linkding" "tarball"
-    restore_backup
+    msg_info "Restoring Data"
    cp -r /opt/linkding_data_backup/. /opt/linkding/data
    cp /opt/linkding_env_backup /opt/linkding/.env
    rm -rf /opt/linkding_data_backup /opt/linkding_env_backup
    ln -sf /usr/lib/$(arch_resolve "x86_64-linux-gnu" "aarch64-linux-gnu")/mod_icu.so /opt/linkding/libicu.so
    msg_ok "Restored Data"
    msg_info "Updating LinkDing"
    cd /opt/linkding
@@ -35,11 +35,13 @@ function update_script() {
    RUST_CRATES="monolith" setup_rust
-    create_backup /opt/linkwarden/.env /opt/linkwarden/data
+    msg_info "Backing up data"
    mv /opt/linkwarden/.env /opt/.env
    [ -d /opt/linkwarden/data ] && mv /opt/linkwarden/data /opt/data.bak
    rm -rf /opt/linkwarden
    msg_ok "Backed up data"
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "linkwarden" "linkwarden/linkwarden" "tarball"
+    fetch_and_deploy_gh_release "linkwarden" "linkwarden/linkwarden" "tarball"
    restore_backup
    msg_info "Updating Linkwarden"
    cd /opt/linkwarden
@@ -58,9 +60,11 @@ function update_script() {
    $STD yarn
    $STD npx playwright install-deps
    $STD npx playwright install
    mv /opt/.env /opt/linkwarden/.env
    $STD yarn prisma:generate
    $STD yarn web:build
    $STD yarn prisma:deploy
    [ -d /opt/data.bak ] && mv /opt/data.bak /opt/linkwarden/data
    rm -rf ~/.cargo/registry ~/.cargo/git ~/.cargo/.package-cache
    rm -rf /root/.cache/yarn
    rm -rf /opt/linkwarden/.next/cache
@@ -35,11 +35,16 @@ function update_script() {
    systemctl stop lobehub
    msg_ok "Stopped Services"
-    create_backup /opt/lobehub/.env
+    msg_info "Backing up Data"
    cp /opt/lobehub/.env /opt/lobehub.env.bak
    msg_ok "Backed up Data"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "lobehub" "lobehub/lobehub" "tarball"
-    restore_backup
+    msg_info "Restoring Configuration"
    cp /opt/lobehub.env.bak /opt/lobehub/.env
    rm -f /opt/lobehub.env.bak
    msg_ok "Restored Configuration"
    msg_info "Building Application"
    cd /opt/lobehub
@@ -36,7 +36,10 @@ function update_script() {
    systemctl stop mail-archiver
    msg_ok "Stopped Mail-Archiver"
-    create_backup /opt/mail-archiver/appsettings.json /opt/mail-archiver/.env /opt/mail-archiver/DataProtection-Keys
+    msg_info "Creating Backup"
    cp /opt/mail-archiver/appsettings.json /opt/mail-archiver/.env /opt/
    [[ -d /opt/mail-archiver/DataProtection-Keys ]] && cp -r /opt/mail-archiver/DataProtection-Keys /opt
    msg_ok "Created Backup"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "mail-archiver" "s1t5/mail-archiver" "tarball"
@@ -48,7 +51,10 @@ function update_script() {
    rm -rf /opt/mail-archiver-build
    msg_ok "Updated Mail-Archiver"
-    restore_backup
+    msg_info "Restoring Backup"
    cp /opt/appsettings.json /opt/.env /opt/mail-archiver
    [[ -d /opt/DataProtection-Keys ]] && cp -r /opt/DataProtection-Keys /opt/mail-archiver/
    msg_ok "Restored Backup"
    msg_info "Starting Mail-Archiver"
    systemctl start mail-archiver
@@ -39,15 +39,13 @@ function update_script() {
    msg_info "Backing up Data"
    CURRENT_VERSION=$(grep -oP 'APP_VERSION=\K[^ ]+' /opt/manyfold/.env || echo "unknown")
    cp -r /opt/manyfold/app/storage /opt/manyfold_storage_backup 2>/dev/null || true
    cp -r /opt/manyfold/app/tmp /opt/manyfold_tmp_backup 2>/dev/null || true
    $STD tar -czf "/opt/manyfold_${CURRENT_VERSION}_backup.tar.gz" -C /opt/manyfold app
    msg_ok "Backed up Data"
    create_backup /opt/manyfold/app/storage /opt/manyfold/app/tmp
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "manyfold" "manyfold3d/manyfold" "tarball" "latest" "/opt/manyfold/app"
    restore_backup
    msg_info "Configuring Manyfold"
    RUBY_INSTALL_VERSION=$(cat /opt/manyfold/app/.ruby-version)
    YARN_VERSION=$(grep '"packageManager":' /opt/manyfold/app/package.json | sed -E 's/.*"(yarn@[0-9\.]+)".*/\1/')
@@ -57,9 +55,14 @@ function update_script() {
    RUBY_VERSION=${RUBY_INSTALL_VERSION} RUBY_INSTALL_RAILS="true" HOME=/home/manyfold setup_ruby
-    msg_info "Setting Permissions"
+    msg_info "Restoring Data"
    rm -rf /opt/manyfold/app/{storage,tmp}
    cp -r /opt/manyfold_storage_backup /opt/manyfold/app/storage 2>/dev/null || true
    cp -r /opt/manyfold_tmp_backup /opt/manyfold/app/tmp 2>/dev/null || true
    chown -R manyfold:manyfold {/home/manyfold,/opt/manyfold}
-    msg_ok "Set Permissions"
+    chown -R manyfold:manyfold /opt/manyfold/app/storage /opt/manyfold/app/tmp /opt/manyfold/app/config
    rm -rf /opt/manyfold_storage_backup /opt/manyfold_tmp_backup
    msg_ok "Restored Data"
    msg_info "Installing Manyfold"
@@ -35,7 +35,11 @@ function update_script() {
    systemctl stop caddy
    msg_ok "Stopped Services"
-    create_backup /opt/matomo/config/config.ini.php /opt/matomo/misc/user /root/matomo.creds
+    msg_info "Backing up Data"
    [[ -f /opt/matomo/config/config.ini.php ]] && cp /opt/matomo/config/config.ini.php /opt/matomo_config.bak
    [[ -d /opt/matomo/misc/user ]] && cp -r /opt/matomo/misc/user /opt/matomo_user_backup
    [[ -f /root/matomo.creds ]] && cp /root/matomo.creds /opt/matomo_db_creds.bak
    msg_ok "Backed up Data"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "matomo" "matomo-org/matomo" "prebuild" "latest" "/opt/matomo" "matomo-*.zip"
@@ -49,8 +53,20 @@ function update_script() {
    chmod -R 755 /opt/matomo/tmp
    msg_ok "Set up Matomo"
-    restore_backup
+    msg_info "Restoring Data"
    if [[ -f /opt/matomo_config.bak ]]; then
      mkdir -p /opt/matomo/config
      cp /opt/matomo_config.bak /opt/matomo/config/config.ini.php
    fi
    if [[ -d /opt/matomo_user_backup ]]; then
      mkdir -p /opt/matomo/misc/user
      cp -r /opt/matomo_user_backup/. /opt/matomo/misc/user
    fi
    [[ -f /opt/matomo_db_creds.bak ]] && cp /opt/matomo_db_creds.bak /root/matomo.creds
    rm -f /opt/matomo_config.bak /opt/matomo_db_creds.bak
    rm -rf /opt/matomo_user_backup
    chown -R www-data:www-data /opt/matomo
    msg_ok "Restored Data"
    if [[ -f /opt/matomo/console ]]; then
      msg_info "Running Matomo database upgrade"
@@ -33,13 +33,14 @@ function update_script() {
      systemctl stop meilisearch-ui
      msg_ok "Stopped Meilisearch-UI"
-      create_backup /opt/meilisearch-ui/.env.local
+      cp /opt/meilisearch-ui/.env.local /tmp/.env.local.bak
-      CLEAN_INSTALL=1 fetch_and_deploy_gh_release "meilisearch-ui" "riccox/meilisearch-ui" "tarball"
+      rm -rf /opt/meilisearch-ui
-      restore_backup
+      fetch_and_deploy_gh_release "meilisearch-ui" "riccox/meilisearch-ui" "tarball"
      msg_info "Configuring Meilisearch-UI"
      cd /opt/meilisearch-ui
      sed -i 's|const hash = execSync("git rev-parse HEAD").toString().trim();|const hash = "unknown";|' /opt/meilisearch-ui/vite.config.ts
      mv /tmp/.env.local.bak /opt/meilisearch-ui/.env.local
      $STD pnpm install
      msg_ok "Configured Meilisearch-UI"
@@ -48,11 +48,14 @@ function update_script() {
    systemctl stop metube
    msg_ok "Stopped Service"
-    create_backup /opt/metube/.env
+    msg_info "Backing up Old Installation"
    if [[ -d /opt/metube_bak ]]; then
      rm -rf /opt/metube_bak
    fi
    mv /opt/metube /opt/metube_bak
    msg_ok "Backup created"
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "metube" "alexta69/metube" "tarball" "latest"
+    fetch_and_deploy_gh_release "metube" "alexta69/metube" "tarball" "latest"
    restore_backup
    msg_info "Building Frontend"
    cd /opt/metube/ui
@@ -72,6 +75,13 @@ function update_script() {
    $STD uv sync
    msg_ok "Installed Backend"
    msg_info "Restoring .env"
    if [[ -f /opt/metube_bak/.env ]]; then
      cp /opt/metube_bak/.env /opt/metube/.env
    fi
    rm -rf /opt/metube_bak
    msg_ok "Restored .env"
    if grep -q 'pipenv' /etc/systemd/system/metube.service; then
      msg_info "Patching systemd Service"
      cat <<EOF >/etc/systemd/system/metube.service
@@ -35,11 +35,15 @@ function update_script() {
    systemctl stop nametag
    msg_ok "Stopped Service"
-    create_backup /opt/nametag/.env /opt/nametag/data
+    msg_info "Backing up Data"
    cp /opt/nametag/.env /opt/nametag.env.bak
    cp -r /opt/nametag/data /opt/nametag_data_bak
    msg_ok "Backed up Data"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "nametag" "mattogodoy/nametag" "tarball" "latest" "/opt/nametag"
-    restore_backup
+    # Restore .env BEFORE the build: CLEAN_INSTALL wiped it and the build sources it
    cp /opt/nametag.env.bak /opt/nametag/.env
    msg_info "Rebuilding Application"
    cd /opt/nametag
@@ -53,6 +57,13 @@ function update_script() {
    cp -r /opt/nametag/public /opt/nametag/.next/standalone/public
    msg_ok "Rebuilt Application"
    msg_info "Restoring Data"
    cp /opt/nametag.env.bak /opt/nametag/.env
    cp -r /opt/nametag_data_bak/. /opt/nametag/data/
    rm -f /opt/nametag.env.bak
    rm -rf /opt/nametag_data_bak
    msg_ok "Restored Data"
    msg_info "Running Migrations"
    cd /opt/nametag
    $STD npx prisma migrate deploy
@@ -61,16 +61,18 @@ EOF
    systemctl stop overseerr
    msg_ok "Service stopped"
-    create_backup /opt/overseerr/config
+    msg_info "Creating backup"
    mv /opt/overseerr/config /opt/config_backup
    msg_ok "Backup created"
    fetch_and_deploy_gh_release "overseerr" "sct/overseerr" "tarball"
-
+    rm -rf /opt/overseerr/config
    restore_backup
    msg_info "Configuring ${APP} (Patience)"
    cd /opt/overseerr
    $STD yarn install
    $STD yarn build
    mv /opt/config_backup /opt/overseerr/config
    msg_ok "Configured ${APP}"
    msg_info "Starting Service"
@@ -35,18 +35,23 @@ function update_script() {
    systemctl stop ownfoil
    msg_ok "Stopped Service"
-    create_backup /opt/ownfoil/app/config
+    msg_info "Backing up Data"
    cp -r /opt/ownfoil/app/config /opt/ownfoil_data_backup
    msg_ok "Backed up Data"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "ownfoil" "a1ex4/ownfoil" "tarball"
    restore_backup
    msg_info "Installing Dependencies"
    cd /opt/ownfoil
    $STD source .venv/bin/activate
    $STD uv pip install -r requirements.txt
    msg_ok "Installed Dependencies"
    msg_info "Restoring Data"
    cp -r /opt/ownfoil_data_backup /opt/ownfoil/app/config
    rm -rf /opt/ownfoil_data_backup
    msg_ok "Restored Data"
    msg_info "Starting Service"
    systemctl start ownfoil
    msg_ok "Started Service"
@@ -35,11 +35,15 @@ function update_script() {
    systemctl stop paperclip
    msg_ok "Stopped Service"
-    create_backup /opt/paperclip-ai/.env
+    msg_info "Backing up Configuration"
    cp /opt/paperclip-ai/.env /opt/paperclip.env.bak
    msg_ok "Backed up Configuration"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "paperclip-ai" "paperclipai/paperclip" "tarball"
-    restore_backup
+    msg_info "Restoring Configuration"
    mv /opt/paperclip.env.bak /opt/paperclip-ai/.env
    msg_ok "Restored Configuration"
    msg_info "Rebuilding Paperclip"
    cd /opt/paperclip-ai
@@ -35,18 +35,22 @@ function update_script() {
    systemctl stop papra
    msg_ok "Stopped Service"
-    create_backup /opt/papra/apps/papra-server/.env
+    msg_info "Backing up Configuration"
    if [[ -f /opt/papra/apps/papra-server/.env ]]; then
      cp /opt/papra/apps/papra-server/.env /opt/papra_env.bak
    fi
    msg_ok "Backed up Configuration"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "papra" "papra-hq/papra" "tarball"
    restore_backup
    pnpm_version=$(grep -oP '"packageManager":\s*"pnpm@\K[^"]+' /opt/papra/package.json)
    NODE_VERSION="26" NODE_MODULE="pnpm@$pnpm_version" setup_nodejs
    msg_info "Building Application"
    cd /opt/papra
-    if [[ ! -f /opt/papra/apps/papra-server/.env ]]; then
+    if [[ -f /opt/papra_env.bak ]]; then
      cp /opt/papra_env.bak /opt/papra/apps/papra-server/.env
    else
      msg_warn ".env missing, regenerating from defaults"
      LOCAL_IP=$(hostname -I | awk '{print $1}')
      cat <<EOF >/opt/papra/apps/papra-server/.env
@@ -70,6 +74,7 @@ EOF
    $STD pnpm --filter "@papra/app-client..." run build
    $STD pnpm --filter "@papra/app-server..." run build
    ln -sf /opt/papra/apps/papra-client/dist /opt/papra/apps/papra-server/public
    rm -f /opt/papra_env.bak
    msg_ok "Built Application"
    msg_info "Starting Service"
@@ -72,13 +72,9 @@ EOF
      msg_ok "Migration complete!"
    fi
    create_backup /opt/patchmon/.env
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "PatchMon" "PatchMon/PatchMon" "singlefile" "latest" "/opt/patchmon" "patchmon-server-linux-$(arch_resolve)"
    mv /opt/patchmon/PatchMon /opt/patchmon/patchmon-server
    restore_backup
    msg_info "Fetching PatchMon agent binaries"
    RELEASE=$(get_latest_github_release "PatchMon/PatchMon")
    [[ ! -d /opt/patchmon/agents ]] && mkdir -p /opt/patchmon/agents
@@ -41,6 +41,8 @@ function update_script() {
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "postiz" "gitroomhq/postiz-app" "tarball"
    # Restore BEFORE the build: CLEAN_INSTALL wiped /opt/postiz including .env,
    # and the build below sources it
    restore_backup
    msg_info "Building Application"
@@ -36,14 +36,18 @@ function update_script() {
  msg_ok "Updated PowerDNS"
  if check_for_gh_release "poweradmin" "poweradmin/poweradmin"; then
-    create_backup /opt/poweradmin/config/settings.php /opt/poweradmin/powerdns.db
+    msg_info "Backing up Configuration"
    cp /opt/poweradmin/config/settings.php /opt/poweradmin_settings.php.bak
    cp /opt/poweradmin/powerdns.db /opt/poweradmin_powerdns.db.bak
    msg_ok "Backed up Configuration"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "poweradmin" "poweradmin/poweradmin" "tarball"
    restore_backup
    msg_info "Updating Poweradmin"
    cp /opt/poweradmin_settings.php.bak /opt/poweradmin/config/settings.php
    cp /opt/poweradmin_powerdns.db.bak /opt/poweradmin/powerdns.db
    rm -rf /opt/poweradmin/install
    rm -f /opt/poweradmin_settings.php.bak /opt/poweradmin_powerdns.db.bak
    chown -R www-data:pdns /opt/poweradmin
    chmod 775 /opt/poweradmin
    chown pdns:pdns /opt/poweradmin/powerdns.db
@@ -34,12 +34,17 @@ function update_script() {
    systemctl stop radicale
    msg_ok "Stopped service"
-    create_backup /opt/radicale/users
+    msg_info "Backing up users file"
    cp /opt/radicale/users /opt/radicale_users_backup
    msg_ok "Backed up users file"
    PYTHON_VERSION="3.13" setup_uv
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Radicale" "Kozea/Radicale" "tarball" "latest" "/opt/radicale"
-    restore_backup
+    msg_info "Restoring users file"
    rm -f /opt/radicale/users
    mv /opt/radicale_users_backup /opt/radicale/users
    msg_ok "Restored users file"
    if grep -q 'start.sh' /etc/systemd/system/radicale.service; then
      sed -i -e '/^Description/i[Unit]' \
@@ -36,12 +36,10 @@ function update_script() {
    ensure_dependencies git
-    create_backup /opt/reactive-resume/.env
+    cp /opt/reactive-resume/.env /opt/reactive-resume.env.bak
    NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "reactive-resume" "amruthpillai/reactive-resume" "tarball" "latest" "/opt/reactive-resume"
    restore_backup
    msg_info "Updating Reactive Resume (Patience)"
    cd /opt/reactive-resume
    export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
@@ -51,6 +49,7 @@ function update_script() {
    export NODE_ENV="production"
    $STD pnpm install --frozen-lockfile
    $STD pnpm run build
    mv /opt/reactive-resume.env.bak /opt/reactive-resume/.env
    msg_ok "Updated Reactive Resume"
    msg_info "Updating Service"
@@ -35,11 +35,18 @@ function update_script() {
    systemctl stop rustypaste
    msg_ok "Stopped Services"
-    create_backup /opt/rustypaste/upload /opt/rustypaste/config.toml
+    msg_info "Creating Backup"
    tar -czf "/opt/rustypaste_backup_$(date +%F).tar.gz" /opt/rustypaste/upload 2>/dev/null || true
    cp /opt/rustypaste/config.toml /tmp/rustypaste_config.toml.bak
    msg_ok "Backup Created"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "rustypaste" "orhun/rustypaste" "prebuild" "latest" "/opt/rustypaste" "*x86_64-unknown-linux-gnu.tar.gz"
-    restore_backup
+    msg_info "Restoring Data"
    mv /tmp/rustypaste_config.toml.bak /opt/rustypaste/config.toml
    tar -xzf "/opt/rustypaste_backup_$(date +%F).tar.gz" -C /opt/rustypaste/upload 2>/dev/null || true
    rm -rf /opt/rustypaste_backup_$(date +%F).tar.gz
    msg_ok "Restored Data"
    msg_info "Starting Services"
    systemctl start rustypaste
@@ -36,16 +36,19 @@ function update_script() {
    [[ -f /etc/systemd/system/scanopy-daemon.service ]] && systemctl stop scanopy-daemon
    msg_ok "Stopped services"
-    create_backup /opt/scanopy/.env /opt/scanopy/oidc.toml
+    msg_info "Backing up configurations"
    cp /opt/scanopy/.env /opt/scanopy.env
    [[ -f /opt/scanopy/oidc.toml ]] && cp /opt/scanopy/oidc.toml /opt/scanopy.oidc.toml
    msg_ok "Backed up configurations"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Scanopy" "scanopy/scanopy" "tarball" "latest" "/opt/scanopy"
    restore_backup
    ensure_dependencies pkg-config libssl-dev
    TOOLCHAIN="$(grep "channel" /opt/scanopy/backend/rust-toolchain.toml | awk -F\" '{print $2}')"
    RUST_TOOLCHAIN=$TOOLCHAIN setup_rust
    [[ -f /opt/scanopy.env ]] && mv /opt/scanopy.env /opt/scanopy/.env
    [[ -f /opt/scanopy.oidc.toml ]] && mv /opt/scanopy.oidc.toml /opt/scanopy/oidc.toml
    if ! grep -q "PUBLIC_URL" /opt/scanopy/.env; then
      sed -i "\|_PATH=|a\\scanopy_PUBLIC_URL=http://${LOCAL_IP}:60072" /opt/scanopy/.env
    fi
@@ -52,12 +52,11 @@ function update_script() {
      msg_ok "Updated FlareSolverr"
    fi
-    create_backup /opt/shelfmark/start.sh
+    cp /opt/shelfmark/start.sh /opt/start.sh.bak
    if command -v chromedriver &>/dev/null; then
      $STD apt remove -y chromium-driver
    fi
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "shelfmark" "calibrain/shelfmark" "tarball" "latest" "/opt/shelfmark"
    restore_backup
    RELEASE_VERSION=$(cat "$HOME/.shelfmark")
    msg_info "Updating Shelfmark"
@@ -75,6 +74,7 @@ function update_script() {
    else
      $STD uv sync --active --locked --no-default-groups
    fi
    mv /opt/start.sh.bak /opt/shelfmark/start.sh
    msg_ok "Updated Shelfmark"
    msg_info "Starting Service(s)"
@@ -35,11 +35,19 @@ function update_script() {
    systemctl stop shlink
    msg_ok "Stopped Service"
-    create_backup /opt/shlink/.env /opt/shlink/data
+    msg_info "Backing up Data"
    cp /opt/shlink/.env /opt/shlink.env.bak
    cp -r /opt/shlink/data /opt/shlink_data_backup
    msg_ok "Backed up Data"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "shlink" "shlinkio/shlink" "prebuild" "latest" "/opt/shlink" "shlink*_php8.5_dist.zip"
-    restore_backup
+    msg_info "Restoring Data"
    cp /opt/shlink.env.bak /opt/shlink/.env
    rm -f /opt/shlink.env.bak
    cp -r /opt/shlink_data_backup/. /opt/shlink/data
    rm -rf /opt/shlink_data_backup
    msg_ok "Restored Data"
    msg_info "Updating Application"
    cd /opt/shlink
@@ -36,17 +36,19 @@ function update_script() {
    [[ -f /etc/systemd/system/soularr.service ]] && systemctl stop soularr.timer soularr.service
    msg_ok "Stopped Service(s)"
-    create_backup /opt/slskd/config/slskd.yml
+    msg_info "Backing up config"
    cp /opt/slskd/config/slskd.yml /opt/slskd.yml.bak
    msg_ok "Backed up config"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Slskd" "slskd/slskd" "prebuild" "latest" "/opt/slskd" "slskd-*-linux-$(arch_resolve "x64" "arm64").zip"
-    restore_backup
+    msg_info "Restoring config"
    mv /opt/slskd.yml.bak /opt/slskd/config/slskd.yml
    msg_info "Migrating config"
    # Migrate 0.25.0 breaking config key renames
    sed -i 's/^global:/transfers:/' /opt/slskd/config/slskd.yml
    sed -i 's/^integration:/integrations:/' /opt/slskd/config/slskd.yml
-    msg_ok "Migrated config"
+    msg_ok "Restored config"
    msg_info "Starting Service(s)"
    systemctl start slskd
@@ -61,11 +63,13 @@ function update_script() {
      msg_ok "Stopped Timer and Service"
    fi
-    create_backup /opt/soularr/config.ini /opt/soularr/run.sh
+    msg_info "Backing up Soularr config"
    cp /opt/soularr/config.ini /opt/soularr_config.ini.bak
    cp /opt/soularr/run.sh /opt/soularr_run.sh.bak
    msg_ok "Backed up Soularr config"
    PYTHON_VERSION="3.11" setup_uv
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Soularr" "mrusse/soularr" "tarball" "latest" "/opt/soularr"
    restore_backup
    msg_info "Updating Soularr"
    cd /opt/soularr
    $STD uv venv -c venv
@@ -74,6 +78,11 @@ function update_script() {
    deactivate
    msg_ok "Updated Soularr"
    msg_info "Restoring Soularr config"
    mv /opt/soularr_config.ini.bak /opt/soularr/config.ini
    mv /opt/soularr_run.sh.bak /opt/soularr/run.sh
    msg_ok "Restored Soularr config"
    msg_info "Starting Soularr Timer"
    systemctl restart soularr.timer
    msg_ok "Started Soularr Timer"
@@ -35,11 +35,19 @@ function update_script() {
    systemctl stop caddy
    msg_ok "Stopped Services"
-    create_backup /opt/solidtime/.env /opt/solidtime/storage
+    msg_info "Backing up Data"
    cp /opt/solidtime/.env /opt/solidtime.env.bak
    cp -r /opt/solidtime/storage /opt/solidtime_storage_backup
    msg_ok "Backed up Data"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "solidtime" "solidtime-io/solidtime" "tarball"
-    restore_backup
+    msg_info "Restoring Data"
    cp /opt/solidtime.env.bak /opt/solidtime/.env
    rm -f /opt/solidtime.env.bak
    cp -r /opt/solidtime_storage_backup/. /opt/solidtime/storage
    rm -rf /opt/solidtime_storage_backup
    msg_ok "Restored Data"
    msg_info "Updating Application"
    cd /opt/solidtime
@@ -37,12 +37,13 @@ function update_script() {
    systemctl stop soulsync
    msg_ok "Stopped Service"
-    create_backup /opt/soulsync/config /opt/soulsync/data
+    msg_info "Backing up Data"
    mv /opt/soulsync/config /opt/soulsync-config.bak
    mv /opt/soulsync/data /opt/soulsync-data.bak
    msg_ok "Backed up Data"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "soulsync" "Nezreka/SoulSync" "tarball"
    restore_backup
    msg_info "Updating Python Dependencies"
    cd /opt/soulsync
    $STD uv venv --clear /opt/soulsync/.venv --python 3.11
@@ -55,6 +56,9 @@ function update_script() {
    $STD npm run build
    msg_ok "Built WebUI"
    mv /opt/soulsync-config.bak /opt/soulsync/config
    mv /opt/soulsync-data.bak /opt/soulsync/data
    msg_info "Starting Service"
    systemctl start soulsync
    msg_ok "Started Service"
@@ -35,12 +35,18 @@ function update_script() {
    systemctl stop sparkyfitness-server nginx
    msg_ok "Stopped Services"
-    create_backup /opt/sparkyfitness/SparkyFitnessServer/uploads /opt/sparkyfitness/SparkyFitnessServer/backup
+    msg_info "Backing up data"
    mkdir -p /opt/sparkyfitness_backup
    if [[ -d /opt/sparkyfitness/SparkyFitnessServer/uploads ]]; then
      cp -r /opt/sparkyfitness/SparkyFitnessServer/uploads /opt/sparkyfitness_backup/
    fi
    if [[ -d /opt/sparkyfitness/SparkyFitnessServer/backup ]]; then
      cp -r /opt/sparkyfitness/SparkyFitnessServer/backup /opt/sparkyfitness_backup/
    fi
    msg_ok "Backed up data"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "sparkyfitness" "CodeWithCJ/SparkyFitness" "tarball"
    restore_backup
    PNPM_VERSION="$(jq -r '.packageManager | split("@")[1]' /opt/sparkyfitness/package.json)"
    NODE_VERSION="25" NODE_MODULE="pnpm@${PNPM_VERSION}" setup_nodejs
@@ -90,6 +96,11 @@ EOF
    systemctl daemon-reload
    msg_ok "Refreshed SparkyFitness Service"
    msg_info "Restoring data"
    cp -r /opt/sparkyfitness_backup/. /opt/sparkyfitness/SparkyFitnessServer/
    rm -rf /opt/sparkyfitness_backup
    msg_ok "Restored data"
    msg_info "Starting Services"
    $STD systemctl start sparkyfitness-server nginx
    msg_ok "Started Services"
@@ -35,11 +35,16 @@ function update_script() {
    systemctl stop spliit
    msg_ok "Stopped Service"
-    create_backup /opt/spliit/.env
+    msg_info "Backing up Configuration"
    rm -f /opt/spliit.env.bak
    cp /opt/spliit/.env /opt/spliit.env.bak
    msg_ok "Backed up Configuration"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "spliit" "spliit-app/spliit" "tarball"
-    restore_backup
+    msg_info "Restoring Configuration"
    cp /opt/spliit.env.bak /opt/spliit/.env
    msg_ok "Restored Configuration"
    msg_info "Building Application"
    cd /opt/spliit
@@ -36,16 +36,18 @@ function update_script() {
    systemctl stop spoolman
    msg_ok "Stopped Service"
-    create_backup /opt/spoolman/.env
+    msg_info "Creating Backup"
    [ -d /opt/spoolman_bak ] && rm -rf /opt/spoolman_bak
    mv /opt/spoolman /opt/spoolman_bak
    msg_ok "Created Backup"
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "spoolman" "Donkie/Spoolman" "prebuild" "latest" "/opt/spoolman" "spoolman.zip"
+    fetch_and_deploy_gh_release "spoolman" "Donkie/Spoolman" "prebuild" "latest" "/opt/spoolman" "spoolman.zip"
    restore_backup
    msg_info "Updating Spoolman"
    cd /opt/spoolman
    $STD uv sync --locked --no-install-project
    $STD uv sync --locked
    cp /opt/spoolman_bak/.env /opt/spoolman
    sed -i 's|^ExecStart=.*|ExecStart=/usr/bin/bash /opt/spoolman/scripts/start.sh|' /etc/systemd/system/spoolman.service
    msg_ok "Updated Spoolman"
@@ -37,11 +37,15 @@ function update_script() {
    systemctl stop storyteller
    msg_ok "Stopped Service"
-    create_backup /opt/storyteller/.env
+    msg_info "Backing up Data"
    cp /opt/storyteller/.env /opt/storyteller_env.bak
    msg_ok "Backed up Data"
    CLEAN_INSTALL=1 fetch_and_deploy_gl_release "storyteller" "storyteller-platform/storyteller" "tarball" "latest" "/opt/storyteller" "" "web-v2"
-    restore_backup
+    msg_info "Restoring Configuration"
    mv /opt/storyteller_env.bak /opt/storyteller/.env
    msg_ok "Restored Configuration"
    msg_info "Rebuilding Storyteller"
    cd /opt/storyteller
@@ -43,15 +43,17 @@ function update_script() {
    systemctl stop tandoor
    msg_ok "Stopped Service"
-    create_backup /opt/tandoor/config /opt/tandoor/api /opt/tandoor/mediafiles /opt/tandoor/staticfiles /opt/tandoor/.env
+    msg_info "Creating Backup"
    mv /opt/tandoor /opt/tandoor.bak
    msg_ok "Backup Created"
    NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
    PYTHON_VERSION="3.13" setup_uv
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "tandoor" "TandoorRecipes/recipes" "tarball" "latest" "/opt/tandoor"
+    fetch_and_deploy_gh_release "tandoor" "TandoorRecipes/recipes" "tarball" "latest" "/opt/tandoor"
    restore_backup
    msg_info "Updating Tandoor"
    cp -r /opt/tandoor.bak/{config,api,mediafiles,staticfiles} /opt/tandoor/
    mv /opt/tandoor.bak/.env /opt/tandoor/.env
    cd /opt/tandoor
    $STD uv venv --clear .venv --python=python3
    $STD uv pip install -r requirements.txt --python .venv/bin/python
@@ -67,6 +69,7 @@ EOF
    cd /opt/tandoor
    $STD /opt/tandoor/.venv/bin/python manage.py migrate
    $STD /opt/tandoor/.venv/bin/python manage.py collectstatic --no-input
    rm -rf /opt/tandoor.bak
    msg_ok "Updated Tandoor"
    msg_info "Starting Service"
@@ -36,12 +36,13 @@ function update_script() {
    systemctl stop tautulli
    msg_ok "Stopped Service"
-    create_backup /opt/Tautulli/config.ini /opt/Tautulli/tautulli.db
+    msg_info "Backing up config and database"
    cp /opt/Tautulli/config.ini /opt/tautulli_config.ini.backup
    cp /opt/Tautulli/tautulli.db /opt/tautulli.db.backup
    msg_ok "Backed up config and database"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Tautulli" "Tautulli/Tautulli" "tarball"
    restore_backup
    msg_info "Updating Tautulli"
    cd /opt/Tautulli
    TAUTULLI_VERSION=$(get_latest_github_release "Tautulli/Tautulli" "false")
@@ -54,6 +55,12 @@ function update_script() {
    $STD uv pip install "setuptools<81"
    msg_ok "Updated Tautulli"
    msg_info "Restoring config and database"
    cp /opt/tautulli_config.ini.backup /opt/Tautulli/config.ini
    cp /opt/tautulli.db.backup /opt/Tautulli/tautulli.db
    rm -f /opt/{tautulli_config.ini.backup,tautulli.db.backup}
    msg_ok "Restored config and database"
    msg_info "Starting Service"
    systemctl start tautulli
    msg_ok "Started Service"
@@ -36,11 +36,15 @@ function update_script() {
    systemctl stop teable
    msg_ok "Stopped Service"
-    create_backup /opt/teable/.env
+    msg_info "Backing up Configuration"
    cp /opt/teable/.env /opt/teable.env.bak
    msg_ok "Backed up Configuration"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "teable" "teableio/teable" "tarball"
-    restore_backup
+    msg_info "Restoring Configuration"
    mv /opt/teable.env.bak /opt/teable/.env
    msg_ok "Restored Configuration"
    msg_info "Rebuilding Teable"
    cd /opt/teable
@@ -34,11 +34,16 @@ function update_script() {
    systemctl stop teddycloud
    msg_ok "Stopped Service"
-    create_backup /opt/teddycloud/certs /opt/teddycloud/config /opt/teddycloud/data
+    msg_info "Creating backup"
    mv /opt/teddycloud /opt/teddycloud_bak
    msg_ok "Backup created"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "teddycloud" "toniebox-reverse-engineering/teddycloud" "prebuild" "latest" "/opt/teddycloud" "teddycloud.amd64.release*.zip"
-    restore_backup
+    msg_info "Restoring data"
    cp -R /opt/teddycloud_bak/certs /opt/teddycloud_bak/config /opt/teddycloud_bak/data /opt/teddycloud
    rm -rf /opt/teddycloud_bak
    msg_ok "Data restored"
    msg_info "Starting Service"
    systemctl start teddycloud
@@ -143,12 +143,13 @@ EOF
    fi
    msg_ok "Migrated Configuration"
-    create_backup /opt/termix/data /opt/termix/uploads
+    msg_info "Backing up Data"
    cp -r /opt/termix/data /opt/termix_data_backup
    cp -r /opt/termix/uploads /opt/termix_uploads_backup
    msg_ok "Backed up Data"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "termix" "Termix-SSH/Termix" "tarball"
    restore_backup
    msg_info "Recreating Directories"
    mkdir -p /opt/termix/html \
      /opt/termix/nginx \
@@ -176,6 +177,12 @@ EOF
    $STD npm cache clean --force
    msg_ok "Set up Production Dependencies"
    msg_info "Restoring Data"
    cp -r /opt/termix_data_backup /opt/termix/data
    cp -r /opt/termix_uploads_backup /opt/termix/uploads
    rm -rf /opt/termix_data_backup /opt/termix_uploads_backup
    msg_ok "Restored Data"
    msg_info "Updating Frontend Files"
    rm -rf /opt/termix/html/*
    cp -r /opt/termix/dist/* /opt/termix/html/ 2>/dev/null || true
@@ -36,11 +36,12 @@ function update_script() {
    systemctl stop tianji
    msg_ok "Stopped Service"
-    create_backup /opt/tianji/src/server/.env
+    msg_info "Backing up data"
    cp /opt/tianji/src/server/.env /opt/.env
    mv /opt/tianji /opt/tianji_bak
    msg_ok "Backed up data"
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "tianji" "msgbyte/tianji" "tarball"
+    fetch_and_deploy_gh_release "tianji" "msgbyte/tianji" "tarball"
    restore_backup
    msg_info "Updating Tianji"
    cd /opt/tianji
@@ -51,8 +52,10 @@ function update_script() {
    mkdir -p ./src/server/public
    cp -r ./geo ./src/server/public
    $STD pnpm build:server
    mv /opt/.env /opt/tianji/src/server/.env
    cd src/server
    $STD pnpm db:migrate:apply
    rm -rf /opt/tianji_bak
    rm -rf /opt/tianji/src/client
    rm -rf /opt/tianji/website
    rm -rf /opt/tianji/reporter
@@ -40,12 +40,13 @@ function update_script() {
    systemctl stop transmute
    msg_ok "Stopped Service"
-    create_backup /opt/transmute/backend/.env /opt/transmute/data
+    msg_info "Backing up Data"
    cp /opt/transmute/backend/.env /opt/transmute.env.bak
    cp -r /opt/transmute/data /opt/transmute_data_bak
    msg_ok "Backed up Data"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "transmute" "transmute-app/transmute" "tarball"
    restore_backup
    msg_info "Updating Python Dependencies"
    cd /opt/transmute
    $STD uv venv --clear /opt/transmute/.venv
@@ -58,6 +59,12 @@ function update_script() {
    $STD npm run build
    msg_ok "Rebuilt Frontend"
    msg_info "Restoring Data"
    cp /opt/transmute.env.bak /opt/transmute/backend/.env
    cp -r /opt/transmute_data_bak/. /opt/transmute/data/
    rm -f /opt/transmute.env.bak
    rm -rf /opt/transmute_data_bak
    msg_ok "Restored Data"
    msg_info "Starting Service"
    systemctl start transmute
@@ -35,12 +35,12 @@ function update_script() {
    systemctl stop tubearchivist tubearchivist-celery tubearchivist-beat
    msg_ok "Stopped Services"
-    create_backup /opt/tubearchivist/.env
+    msg_info "Backing up Data"
    cp /opt/tubearchivist/.env /opt/tubearchivist_env.bak
    msg_ok "Backed up Data"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "tubearchivist" "tubearchivist/tubearchivist" "tarball"
    restore_backup
    msg_info "Rebuilding Tube Archivist"
    cd /opt/tubearchivist/frontend
    $STD npm install
@@ -56,6 +56,7 @@ function update_script() {
    msg_ok "Rebuilt Tube Archivist"
    msg_info "Restoring Configuration"
    mv /opt/tubearchivist_env.bak /opt/tubearchivist/.env
    sed -i 's|^TA_APP_DIR=/opt/tubearchivist$|TA_APP_DIR=/opt/tubearchivist/backend|' /opt/tubearchivist/.env
    sed -i 's|^TA_CACHE_DIR=/opt/tubearchivist/cache$|TA_CACHE_DIR=/cache|' /opt/tubearchivist/.env
    sed -i 's|^TA_MEDIA_DIR=/opt/tubearchivist/media$|TA_MEDIA_DIR=/youtube|' /opt/tubearchivist/.env
@@ -34,9 +34,9 @@ function update_script() {
    systemctl stop umami
    msg_ok "Stopped Service"
-    create_backup /opt/umami/.env
+    mv /opt/umami/.env /opt/.env.bak
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "umami" "umami-software/umami" "tarball"
-    restore_backup
+    mv /opt/.env.bak /opt/umami/.env
    msg_info "Updating Umami"
    cd /opt/umami
@@ -34,9 +34,9 @@ function update_script() {
    systemctl stop umlautadaptarr
    msg_ok "Stopped Service"
-    create_backup /opt/UmlautAdaptarr/appsettings.json
+    cp /opt/UmlautAdaptarr/appsettings.json /opt/UmlautAdaptarr/appsettings.json.bak
    fetch_and_deploy_gh_release "UmlautAdaptarr" "PCJones/Umlautadaptarr" "prebuild" "latest" "/opt/UmlautAdaptarr" "linux-x64.zip"
-    restore_backup
+    cp /opt/UmlautAdaptarr/appsettings.json.bak /opt/UmlautAdaptarr/appsettings.json
    msg_info "Starting Service"
    systemctl start umlautadaptarr
@@ -38,11 +38,16 @@ function update_script() {
    systemctl stop nginx php8.3-fpm
    msg_ok "Stopped Services"
-    create_backup /opt/wallabag/app/config/parameters.yml
+    msg_info "Creating Backup"
    cp /opt/wallabag/app/config/parameters.yml /tmp/wallabag_parameters.yml.bak
    msg_ok "Created Backup"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "wallabag" "wallabag/wallabag" "prebuild" "latest" "/opt/wallabag" "wallabag-*.tar.gz"
-    restore_backup
+    msg_info "Restoring Configuration"
    cp /tmp/wallabag_parameters.yml.bak /opt/wallabag/app/config/parameters.yml
    rm -f /tmp/wallabag_parameters.yml.bak
    msg_ok "Restored Configuration"
    msg_info "Running Migrations"
    cd /opt/wallabag
@@ -39,13 +39,20 @@ function update_script() {
    systemctl stop wealthfolio
    msg_ok "Stopped Service"
-    create_backup /opt/wealthfolio_data /opt/wealthfolio/.env
+    msg_info "Backing up Data"
    cp -r /opt/wealthfolio_data /opt/wealthfolio_data_backup
    cp /opt/wealthfolio/.env /opt/wealthfolio_env_backup
    msg_ok "Backed up Data"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "wealthfolio" "wealthfolio/wealthfolio" "prebuild" "latest" "/opt/wealthfolio" "wealthfolio-server-*-linux-amd64.tar.gz"
    restore_backup
    install -m 755 /opt/wealthfolio/wealthfolio-server /usr/local/bin/wealthfolio-server
    msg_info "Restoring Data"
    cp -r /opt/wealthfolio_data_backup/. /opt/wealthfolio_data
    cp /opt/wealthfolio_env_backup /opt/wealthfolio/.env
    rm -rf /opt/wealthfolio_data_backup /opt/wealthfolio_env_backup
    msg_ok "Restored Data"
    msg_info "Starting Service"
    systemctl start wealthfolio
    msg_ok "Started Service"
@@ -34,12 +34,16 @@ function update_script() {
    systemctl stop web-check
    msg_ok "Stopped Service"
-    create_backup /opt/web-check/.env
+    msg_info "Creating backup"
    mv /opt/web-check/.env /opt
    msg_ok "Created backup"
    NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "web-check" "Lissy93/web-check" "tarball"
-    restore_backup
+    msg_info "Restoring backup"
    mv /opt/.env /opt/web-check
    msg_ok "Restored backup"
    msg_info "Building Web-Check"
    cd /opt/web-check 
@@ -36,12 +36,17 @@ function update_script() {
    systemctl stop caddy php${PHP_VER}-fpm
    msg_ok "Stopped Service"
-    create_backup /opt/webtrees/data
+    msg_info "Backing up Data"
    cp -r /opt/webtrees/data /opt/webtrees_data_backup
    msg_ok "Backed up Data"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "webtrees" "fisharebest/webtrees" "prebuild" "latest" "/opt/webtrees" "webtrees-*.zip"
-    restore_backup
+    msg_info "Restoring Data"
    cp -r /opt/webtrees_data_backup/. /opt/webtrees/data
    rm -rf /opt/webtrees_data_backup
    chown -R www-data:www-data /opt/webtrees
    msg_ok "Restored Data"
    msg_info "Starting Service"
    systemctl start caddy php${PHP_VER}-fpm
@@ -35,13 +35,16 @@ function update_script() {
    systemctl stop wishlist
    msg_ok "Stopped Service"
-    create_backup /opt/wishlist/.env /opt/wishlist/uploads /opt/wishlist/data
+    msg_info "Creating Backup"
    mkdir -p /opt/wishlist-backup
    cp /opt/wishlist/.env /opt/wishlist-backup/.env
    cp -a /opt/wishlist/uploads /opt/wishlist-backup
    cp -a /opt/wishlist/data /opt/wishlist-backup
    msg_ok "Created Backup"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "wishlist" "cmintey/wishlist" "tarball"
    LATEST_APP_VERSION=$(get_latest_github_release "cmintey/wishlist")
    restore_backup
    msg_info "Updating Wishlist"
    cd /opt/wishlist
    $STD pnpm install --frozen-lockfile
@@ -54,6 +57,13 @@ function update_script() {
    $STD pnpm prune --prod
    chmod +x /opt/wishlist/entrypoint.sh
    msg_info "Restoring Backup"
    cp /opt/wishlist-backup/.env /opt/wishlist/.env
    cp -a /opt/wishlist-backup/uploads /opt/wishlist
    cp -a /opt/wishlist-backup/data /opt/wishlist
    rm -rf /opt/wishlist-backup
    msg_ok "Restored Backup"
    msg_ok "Updated Wishlist"
    msg_info "Starting Service"
    systemctl start wishlist
@@ -35,11 +35,19 @@ function update_script() {
    systemctl stop writefreely
    msg_ok "Stopped Services"
-    create_backup /opt/writefreely/keys /opt/writefreely/config.ini
+    msg_info "Creating Backup"
    mkdir -p /tmp/writefreely_backup
    cp /opt/writefreely/keys /tmp/writefreely_backup/ 2>/dev/null
    cp /opt/writefreely/config.ini /tmp/writefreely_backup/ 2>/dev/null
    msg_ok "Created Backup"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "writefreely" "writefreely/writefreely" "prebuild" "latest" "/opt/writefreely" "writefreely_*_linux_$(arch_resolve).tar.gz"
-    restore_backup
+    msg_info "Restoring Data"
    cp /tmp/writefreely_backup/config.ini /opt/writefreely/ 2>/dev/null
    cp /tmp/writefreely_backup/keys/* /opt/writefreely/keys/ 2>/dev/null
    rm -rf /tmp/writefreely_backup
    msg_ok "Restored Data"
    msg_info "Running Post-Update Tasks"
    cd /opt/writefreely
@@ -35,12 +35,13 @@ function update_script() {
    systemctl stop xyops
    msg_ok "Stopped Service"
-    create_backup /opt/xyops/data /opt/xyops/conf
+    msg_info "Backing up Data"
    cp -r /opt/xyops/data /opt/xyops_data_backup
    cp -r /opt/xyops/conf /opt/xyops_conf_backup
    msg_ok "Backed up Data"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "xyops" "pixlcore/xyops" "tarball"
    restore_backup
    msg_info "Rebuilding Application"
    cd /opt/xyops
    $STD npm install
@@ -48,6 +49,12 @@ function update_script() {
    chmod 644 /opt/xyops/node_modules/useragent-ng/lib/regexps.js
    msg_ok "Rebuilt Application"
    msg_info "Restoring Data"
    cp -r /opt/xyops_data_backup/. /opt/xyops/data
    cp -r /opt/xyops_conf_backup/. /opt/xyops/conf
    rm -rf /opt/xyops_data_backup /opt/xyops_conf_backup
    msg_ok "Restored Data"
    msg_info "Starting Service"
    systemctl start xyops
    msg_ok "Started Service"
@@ -36,17 +36,22 @@ function update_script() {
    systemctl stop yamtrack yamtrack-celery
    msg_ok "Stopped Services"
-    create_backup /opt/yamtrack/src/.env
+    msg_info "Backing up Data"
    cp /opt/yamtrack/src/.env /opt/yamtrack_env.bak
    msg_ok "Backed up Data"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "yamtrack" "FuzzyGrim/Yamtrack" "tarball"
    restore_backup
    msg_info "Installing Python Dependencies"
    cd /opt/yamtrack
    $STD uv sync --locked
    msg_ok "Installed Python Dependencies"
    msg_info "Restoring Data"
    cp /opt/yamtrack_env.bak /opt/yamtrack/src/.env
    rm -f /opt/yamtrack_env.bak
    msg_ok "Restored Data"
    msg_info "Updating Yamtrack"
    cd /opt/yamtrack/src
    $STD /opt/yamtrack/.venv/bin/python manage.py migrate
@@ -35,13 +35,18 @@ function update_script() {
    systemctl stop nginx
    msg_ok "Stopped Service"
-    create_backup /opt/yourls/user
+    msg_info "Backing up Configuration"
    cp -r /opt/yourls/user /opt/yourls_user.bak
    msg_ok "Backed up Configuration"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "yourls" "YOURLS/YOURLS" "tarball"
    restore_backup
    chown -R www-data:www-data /opt/yourls
    msg_info "Restoring Configuration"
    cp -r /opt/yourls_user.bak/. /opt/yourls/user/
    rm -rf /opt/yourls_user.bak
    msg_ok "Restored Configuration"
    msg_info "Starting Service"
    systemctl start nginx
    msg_ok "Started Service"
@@ -35,14 +35,14 @@ function update_script() {
    systemctl stop zerobyte
    msg_ok "Stopped Service"
-    create_backup /opt/zerobyte/.env
+    msg_info "Backing up Configuration"
    cp /opt/zerobyte/.env /opt/zerobyte.env.bak
    msg_ok "Backed up Configuration"
    ensure_dependencies git
    NODE_VERSION="24" setup_nodejs
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "zerobyte" "nicotsx/zerobyte" "tarball"
    restore_backup
    msg_info "Building Zerobyte"
    export NODE_OPTIONS="--max-old-space-size=3072"
    cd /opt/zerobyte
@@ -50,6 +50,11 @@ function update_script() {
    $STD node ./node_modules/vite/bin/vite.js build
    msg_ok "Built Zerobyte"
    msg_info "Restoring Configuration"
    cp /opt/zerobyte.env.bak /opt/zerobyte/.env
    rm -f /opt/zerobyte.env.bak
    msg_ok "Restored Configuration"
    msg_info "Starting Service"
    systemctl start zerobyte
    msg_ok "Started Service"
@@ -37,24 +37,24 @@ function update_script() {
    msg_info "Creating Backup"
    ensure_dependencies zstd
-    mkdir -p /opt/backups
+    mkdir -p /opt/{backups,z2m_backup}
    BACKUP_VERSION="$(<"$HOME/.zigbee2mqtt")"
    BACKUP_FILE="/opt/backups/${APP}_backup_${BACKUP_VERSION}.tar.zst"
    $STD tar -cf - -C /opt zigbee2mqtt | zstd -q -o "$BACKUP_FILE"
    ls -t /opt/backups/${APP}_backup_*.tar.zst 2>/dev/null | tail -n +6 | xargs -r rm -f
    mv /opt/zigbee2mqtt/data /opt/z2m_backup/data
    msg_ok "Backup Created (${BACKUP_VERSION})"
    create_backup /opt/zigbee2mqtt/data
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Zigbee2MQTT" "Koenkk/zigbee2mqtt" "tarball" "latest" "/opt/zigbee2mqtt"
    restore_backup
    msg_info "Updating Zigbee2MQTT"
    rm -rf /opt/zigbee2mqtt/data
    mv /opt/z2m_backup/data /opt/zigbee2mqtt
    cd /opt/zigbee2mqtt
    grep -q "^packageImportMethod" ./pnpm-workspace.yaml 2>/dev/null || echo "packageImportMethod: hardlink" >>./pnpm-workspace.yaml
    $STD pnpm install --frozen-lockfile
    $STD pnpm build
    rm -rf /opt/z2m_backup
    msg_ok "Updated Zigbee2MQTT"
    msg_info "Starting Service"
@@ -6,6 +6,10 @@
 if ! command -v curl >/dev/null 2>&1; then
  apk update && apk add curl >/dev/null 2>&1
 fi
 # Mark container context BEFORE error handling starts: error_handler/on_exit
 # must write local failure artifacts instead of talking to the telemetry API
 # (the host is the single telemetry reporter).
 export TELEMETRY_CONTEXT="container"
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/core.func)
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/error_handler.func)
 load_functions
@@ -41,7 +45,7 @@ post_progress_to_api() {
  curl -fsS -m 5 -X POST "https://telemetry.community-scripts.org/telemetry" \
    -H "Content-Type: application/json" \
-    -d "{\"random_id\":\"${RANDOM_UUID}\",\"execution_id\":\"${EXECUTION_ID:-${RANDOM_UUID}}\",\"type\":\"lxc\",\"nsapp\":\"${app:-unknown}\",\"status\":\"${progress_status}\"}" &>/dev/null || true
+    -d "{\"random_id\":\"${RANDOM_UUID}\",\"execution_id\":\"${EXECUTION_ID:-${RANDOM_UUID}}\",\"type\":\"lxc\",\"nsapp\":\"${app:-unknown}\",\"status\":\"${progress_status}\",\"platform\":\"${TELEMETRY_PLATFORM:-}\",\"repo_source\":\"${REPO_SOURCE:-}\",\"repo_slug\":\"${REPO_SLUG:-}\"}" &>/dev/null || true
 }
 # This function enables IPv6 if it's not disabled and sets verbose mode
@@ -4072,6 +4072,11 @@ build_container() {
  export RANDOM_UUID="$RANDOM_UUID"
  export EXECUTION_ID="$EXECUTION_ID"
  export SESSION_ID="$SESSION_ID"
  # Repo attribution + platform for container-side progress pings (the
  # container inherits the host's detection instead of re-detecting)
  export REPO_SOURCE="${REPO_SOURCE:-}"
  export REPO_SLUG="${REPO_SLUG:-}"
  export TELEMETRY_PLATFORM="pve"
  export CACHER="$APT_CACHER"
  export CACHER_IP="$APT_CACHER_IP"
  if [[ -n "${HTTP_PROXY:-}" ]]; then
@@ -4895,6 +4900,16 @@ EOF
        # Point INSTALL_LOG to combined log so get_full_log() finds it
        INSTALL_LOG="$combined_log"
      fi
      # Pull the structured error capture (.errinfo) from the container.
      # It contains EXACTLY the output of the command that failed (written by
      # silent()/error_handler inside the container) and is the primary source
      # for the telemetry error trace - instead of a generic log tail.
      local host_errinfo="/tmp/.errinfo-${SESSION_ID}"
      if timeout 8 pct pull "$CTID" "/root/.install-${SESSION_ID}.log.errinfo" "$host_errinfo" 2>/dev/null && [[ -s "$host_errinfo" ]]; then
        TELEMETRY_ERRINFO="$host_errinfo"
        export TELEMETRY_ERRINFO
      fi
    fi
    # Defense-in-depth: Ensure error handling stays disabled during recovery.
@@ -5170,6 +5185,8 @@ EOF
        echo -e "  Verbose: ${GN}enabled${CL}"
        echo ""
        msg_info "Restarting installation..."
        # New telemetry execution for the retry (previous one keeps its "failed")
        declare -f telemetry_new_attempt &>/dev/null && telemetry_new_attempt
        # Re-run build_container
        build_container
        return $?
@@ -5209,6 +5226,10 @@ EOF
          echo ""
          msg_info "Re-running installation script..."
          # New telemetry execution for the in-place retry
          declare -f telemetry_new_attempt &>/dev/null && telemetry_new_attempt
          declare -f post_to_api &>/dev/null && post_to_api 2>/dev/null || true
          # Re-run install script in existing container (don't destroy/recreate)
          set +Eeuo pipefail
          trap - ERR
@@ -5272,6 +5293,7 @@ EOF
          echo -e "  Verbose: ${GN}enabled${CL}"
          echo ""
          msg_info "Restarting installation..."
          declare -f telemetry_new_attempt &>/dev/null && telemetry_new_attempt
          build_container
          return $?
        fi
@@ -5301,6 +5323,7 @@ EOF
          echo -e "  Verbose: ${GN}enabled${CL}"
          echo ""
          msg_info "Restarting installation..."
          declare -f telemetry_new_attempt &>/dev/null && telemetry_new_attempt
          build_container
          return $?
        fi
@@ -5325,6 +5348,7 @@ EOF
          echo -e "  Verbose: ${GN}enabled${CL}"
          echo ""
          msg_info "Restarting installation..."
          declare -f telemetry_new_attempt &>/dev/null && telemetry_new_attempt
          build_container
          return $?
        fi
@@ -6999,6 +7023,16 @@ ensure_log_on_host() {
        rm -f "$temp_log"
      fi
    fi
    # Also pull the structured error capture (.errinfo) so the telemetry error
    # trace shows the failing command's exact output (signal-exit paths reach
    # this via on_exit before/instead of the recovery flow)
    if [[ -z "${TELEMETRY_ERRINFO:-}" || ! -s "${TELEMETRY_ERRINFO:-}" ]]; then
      local host_errinfo="/tmp/.errinfo-${SESSION_ID}"
      if timeout 8 pct pull "$CTID" "/root/.install-${SESSION_ID}.log.errinfo" "$host_errinfo" 2>/dev/null && [[ -s "$host_errinfo" ]]; then
        TELEMETRY_ERRINFO="$host_errinfo"
        export TELEMETRY_ERRINFO
      fi
    fi
    if [[ -s "$combined_log" ]]; then
      INSTALL_LOG="$combined_log"
    fi
@@ -546,6 +546,12 @@ silent() {
  set +Eeuo pipefail
  trap - ERR
  # Byte offset BEFORE the command runs - everything the log grows by is
  # exactly this command's output (used for the .errinfo telemetry capture)
  local start_bytes=0
  [[ -f "$logfile" ]] && start_bytes=$(stat -c%s "$logfile" 2>/dev/null || echo 0)
  [[ ! "$start_bytes" =~ ^[0-9]+$ ]] && start_bytes=0
  "$@" >>"$logfile" 2>&1
  local rc=$?
@@ -567,12 +573,43 @@ silent() {
    export _SILENT_FAILED_LINE="$caller_line"
    export _SILENT_FAILED_LOG="$logfile"
    # ── Structured error capture (.errinfo) for telemetry ──
    # Extract exactly THIS command's output (from the recorded byte offset),
    # strip ANSI/progress noise, keep the last 60 lines. The host builds the
    # telemetry error trace from this file (pulled from the container on
    # failure). Self-contained - containers don't source api.func.
    {
      local flat_cmd
      flat_cmd=$(printf '%s' "$cmd" | tr '\n' ' ' | head -c 300)
      echo "EXIT_CODE=${rc}"
      echo "LINE=${caller_line}"
      echo "COMMAND=${flat_cmd}"
      echo "--- OUTPUT ---"
      if [[ -s "$logfile" ]]; then
        local segment
        segment=$(tail -c +"$((start_bytes + 1))" "$logfile" 2>/dev/null |
          sed 's/\r$//' |
          sed 's/\x1b\[[0-9;]*[a-zA-Z]//g' |
          grep -avE '^(Get:|Hit:|Ign:|Fetched |Reading package lists|Reading state information|Building dependency tree|Selecting previously|Preparing to unpack|Unpacking |Processing triggers for|\(Reading database|[0-9]+%[[:space:]]*\[)' |
          grep -avE '^[[:space:]]*$' |
          tail -n 60)
        # If the noise filter swallowed everything, fall back to the raw tail
        if [[ -z "$segment" ]]; then
          segment=$(tail -c +"$((start_bytes + 1))" "$logfile" 2>/dev/null |
            sed 's/\r$//' | sed 's/\x1b\[[0-9;]*[a-zA-Z]//g' | tail -n 60)
        fi
        printf '%s' "$segment" | head -c 10240
      fi
    } >"${logfile}.errinfo" 2>/dev/null || true
    return "$rc"
  fi
  # Clear stale flags on success (prevents false positives if a previous
  # $STD cmd || true failed and a later non-silent command triggers error_handler)
  unset _SILENT_FAILED_RC _SILENT_FAILED_CMD _SILENT_FAILED_LINE _SILENT_FAILED_LOG 2>/dev/null || true
  # Also drop a stale .errinfo from a previously tolerated failure ($STD cmd || true)
  rm -f "${logfile}.errinfo" 2>/dev/null || true
 }
 # ------------------------------------------------------------------------------
@@ -7,12 +7,17 @@
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # ------------------------------------------------------------------------------
 #
-# Provides comprehensive error handling and signal management for all scripts.
+# Provides error handling and signal management for all scripts.
-# Includes:
+#
-#   - Exit code explanations (shell, package managers, databases, custom codes)
+# TELEMETRY CONTRACT:
-#   - Error handler with detailed logging
+#   - HOST context: this file reports terminal statuses via post_update_to_api
-#   - Signal handlers (EXIT, INT, TERM)
+#     (full metadata + focused error trace).
-#   - Initialization function for trap setup
+#   - CONTAINER context: this file NEVER talks to the telemetry API. It writes
 #     two local artifacts that the host picks up after lxc-attach returns:
 #       /root/.install-<SESSION_ID>.failed        → exit code (flag file)
 #       /root/.install-<SESSION_ID>.log.errinfo   → structured error capture
 #     This guarantees the server only ever sees ONE terminal event per
 #     execution - the host's complete one.
 #
 # Usage:
 #   source <(curl -fsSL .../error_handler.func)
@@ -21,15 +26,14 @@
 # ------------------------------------------------------------------------------
 # ==============================================================================
-# SECTION 1: EXIT CODE EXPLANATIONS
+# SECTION 1: EXIT CODE EXPLANATIONS (fallback)
 # ==============================================================================
 # ------------------------------------------------------------------------------
 # explain_exit_code()
 #
-# - Canonical version is defined in api.func (sourced before this file)
+# - Canonical version lives in api.func (sourced before this file on the host)
-# - This section only provides a fallback if api.func was not loaded
+# - This fallback covers the container context where api.func is not sourced
 # - See api.func SECTION 1 for the authoritative exit code mappings
 # ------------------------------------------------------------------------------
 if ! declare -f explain_exit_code &>/dev/null; then
  explain_exit_code() {
@@ -94,8 +98,6 @@ if ! declare -f explain_exit_code &>/dev/null; then
    100) echo "APT: Package manager error (broken packages / dependency problems)" ;;
    101) echo "APT: Configuration error (bad sources.list, malformed config)" ;;
    102) echo "APT: Lock held by another process (dpkg/apt still running)" ;;
    # --- Script Validation & Setup (103-123) ---
    103) echo "Validation: Shell is not Bash" ;;
    104) echo "Validation: Not running as root (or invoked via sudo)" ;;
    105) echo "Validation: Proxmox VE version not supported" ;;
@@ -177,9 +179,8 @@ if ! declare -f explain_exit_code &>/dev/null; then
    223) echo "Proxmox: Template not available after download" ;;
    224) echo "Proxmox: PBS storage is for backups only" ;;
    225) echo "Proxmox: No template available for OS/Version" ;;
    226) echo "Proxmox: VM disk import or post-creation setup failed" ;;
    231) echo "Proxmox: LXC stack upgrade failed" ;;
    # --- Tools & Addon Scripts (232-238) ---
    232) echo "Tools: Wrong execution environment (run on PVE host, not inside LXC)" ;;
    233) echo "Tools: Application not installed (update prerequisite missing)" ;;
    234) echo "Tools: No LXC containers found or available" ;;
@@ -187,7 +188,6 @@ if ! declare -f explain_exit_code &>/dev/null; then
    236) echo "Tools: Required hardware not detected" ;;
    237) echo "Tools: Dependency package installation failed" ;;
    238) echo "Tools: OS or distribution not supported for this addon" ;;
    239) echo "npm/Node.js: Unexpected runtime error or dependency failure" ;;
    243) echo "Node.js: Out of memory (JavaScript heap out of memory)" ;;
    245) echo "Node.js: Invalid command-line option" ;;
@@ -195,14 +195,11 @@ if ! declare -f explain_exit_code &>/dev/null; then
    247) echo "Node.js: Fatal internal error" ;;
    248) echo "Node.js: Invalid C++ addon / N-API failure" ;;
    249) echo "npm/pnpm/yarn: Unknown fatal error" ;;
    # --- Application Install/Update Errors (250-254) ---
    250) echo "App: Download failed or version not determined" ;;
    251) echo "App: File extraction failed (corrupt or incomplete archive)" ;;
    252) echo "App: Required file or resource not found" ;;
    253) echo "App: Data migration required — update aborted" ;;
    254) echo "App: User declined prompt or input timed out" ;;
    255) echo "DPKG: Fatal internal error" ;;
    *) echo "Unknown error" ;;
    esac
@@ -210,24 +207,98 @@ if ! declare -f explain_exit_code &>/dev/null; then
 fi
 # ==============================================================================
-# SECTION 2: ERROR HANDLERS
+# SECTION 2: CONTEXT DETECTION & CONTAINER ARTIFACTS
 # ==============================================================================
 # ------------------------------------------------------------------------------
 # _is_container_context()
 #
 # - Returns 0 (true) when running INSIDE the LXC container being installed
 # - TELEMETRY_CONTEXT can override the heuristic ("host" / "container");
 #   install.func sets TELEMETRY_CONTEXT=container during bootstrap
 # ------------------------------------------------------------------------------
 _is_container_context() {
  case "${TELEMETRY_CONTEXT:-}" in
  container) return 0 ;;
  host) return 1 ;;
  esac
  # Proxmox/Incus tooling exists only on the host
  command -v pveversion &>/dev/null && return 1
  command -v pct &>/dev/null && return 1
  command -v incus &>/dev/null && return 1
  # systemd-detect-virt reports lxc inside containers
  if command -v systemd-detect-virt &>/dev/null; then
    case "$(systemd-detect-virt -c 2>/dev/null)" in
    lxc | lxc-libvirt | openvz) return 0 ;;
    esac
  fi
  # PCT_OSTYPE is exported into the install environment by the host
  [[ -n "${PCT_OSTYPE:-}" ]] && return 0
  return 1
 }
 # ------------------------------------------------------------------------------
 # _container_write_failure()
 #
 # - Writes the failure artifacts inside the container for the host to pick up:
 #   * flag file with the exit code
 #   * .errinfo capture (if silent() has not already written a better one)
 #   * copy of the install log
 # - This REPLACES any direct telemetry send from the container
 # - Arguments: $1 = exit_code, $2 = command (optional), $3 = line (optional)
 # ------------------------------------------------------------------------------
 _container_write_failure() {
  local exit_code="${1:-1}"
  local command="${2:-}"
  local line="${3:-}"
  local sid="${SESSION_ID:-error}"
  # Flag file with exit code (host reads this after lxc-attach returns)
  echo "$exit_code" >"/root/.install-${sid}.failed" 2>/dev/null || true
  # Keep the install log where the host expects it
  if [[ -n "${INSTALL_LOG:-}" && -f "${INSTALL_LOG}" && "${INSTALL_LOG}" != "/root/.install-${sid}.log" ]]; then
    cp "${INSTALL_LOG}" "/root/.install-${sid}.log" 2>/dev/null || true
  fi
  # Structured error capture (skip if silent() already wrote the exact
  # output segment of the failing command - that one is always better).
  # Self-contained: api.func is NOT sourced inside containers.
  local errinfo="${INSTALL_LOG:-/root/.install-${sid}.log}.errinfo"
  if [[ ! -s "$errinfo" ]]; then
    local flat_cmd
    flat_cmd=$(printf '%s' "${command:-unknown}" | tr '\n' ' ' | head -c 300)
    {
      echo "EXIT_CODE=${exit_code}"
      echo "LINE=${line:-0}"
      echo "COMMAND=${flat_cmd}"
      echo "--- OUTPUT ---"
      if [[ -n "${INSTALL_LOG:-}" && -s "${INSTALL_LOG}" ]]; then
        tail -n 80 "${INSTALL_LOG}" 2>/dev/null |
          sed 's/\r$//' |
          sed 's/\x1b\[[0-9;]*[a-zA-Z]//g' |
          grep -avE '^(Get:|Hit:|Ign:|Fetched |Reading package lists|Reading state information|Building dependency tree|Selecting previously|Preparing to unpack|Unpacking |Processing triggers for|\(Reading database|[0-9]+%[[:space:]]*\[)' |
          grep -avE '^[[:space:]]*$' |
          tail -n 60 | head -c 10240
      fi
    } >"$errinfo" 2>/dev/null || true
  fi
 }
 # ==============================================================================
 # SECTION 3: ERROR HANDLER
 # ==============================================================================
 # ------------------------------------------------------------------------------
 # error_handler()
 #
 # - Main error handler triggered by ERR trap
-# - Arguments: exit_code, command, line_number
+# - Displays error message with line number, exit code, explanation, command
-# - Behavior:
+# - Shows last 20 lines of the active log
-#   * Returns silently if exit_code is 0 (success)
+# - Emits actionable hints for common failure patterns (OOM, APT, network...)
-#   * Sources explain_exit_code() for detailed error description
+# - HOST: reports "failed" to telemetry (full payload via api.func)
-#   * Displays error message with:
+# - CONTAINER: writes failure artifacts, sends nothing
-#     - Line number where error occurred
+# - Exits with original exit code
 #     - Exit code with explanation
 #     - Command that failed
 #   * Shows last 20 lines of SILENT_LOGFILE if available
 #   * Copies log to container /root for later inspection
 #   * Exits with original exit code
 # ------------------------------------------------------------------------------
 error_handler() {
  local exit_code=${1:-$?}
@@ -237,12 +308,10 @@ error_handler() {
  command="${command//\$STD/}"
  # If error originated from silent(), use its captured metadata
  # This provides the actual command and line number instead of "silent ..."
  if [[ -n "${_SILENT_FAILED_RC:-}" ]]; then
    exit_code="$_SILENT_FAILED_RC"
    command="$_SILENT_FAILED_CMD"
    line_number="$_SILENT_FAILED_LINE"
    # Clear flags to prevent stale data on subsequent errors
    unset _SILENT_FAILED_RC _SILENT_FAILED_CMD _SILENT_FAILED_LINE
  fi
@@ -250,8 +319,12 @@ error_handler() {
    return 0
  fi
-  # Stop spinner and restore cursor FIRST — before any output
+  # Export the failure location so telemetry can include the "where"
-  # This prevents spinner text overlapping with error messages
+  FAILED_COMMAND="$command"
  FAILED_LINE="$line_number"
  export FAILED_COMMAND FAILED_LINE
  # Stop spinner and restore cursor FIRST - before any output
  if declare -f stop_spinner >/dev/null 2>&1; then
    stop_spinner 2>/dev/null || true
  fi
@@ -259,18 +332,18 @@ error_handler() {
  local explanation
  explanation="$(explain_exit_code "$exit_code")"
-
+  if [[ "$explanation" == curl:* && ! "$command" =~ (^|[[:space:]])([^[:space:]]*/)?curl([[:space:]]|$) ]]; then
-  # ALWAYS report failure to API immediately - don't wait for container checks
+    explanation="Command failed with exit status ${exit_code}"
  # This ensures we capture failures that occur before/after container exists
  if declare -f post_update_to_api &>/dev/null; then
    post_update_to_api "failed" "$exit_code" 2>/dev/null || true
  else
    # Container context: post_update_to_api not available (api.func not sourced)
    # Send status directly via curl so container failures are never lost
    _send_abort_telemetry "$exit_code" 2>/dev/null || true
  fi
-  # Use msg_error if available, fallback to echo
+  # ── Telemetry / failure artifacts ──
  if _is_container_context; then
    _container_write_failure "$exit_code" "$command" "$line_number"
  elif declare -f post_update_to_api &>/dev/null; then
    post_update_to_api "failed" "$exit_code" 2>/dev/null || true
  fi
  # ── Display ──
  if declare -f msg_error >/dev/null 2>&1; then
    msg_error "in line ${line_number}: exit code ${exit_code} (${explanation}): while executing command ${command}"
  else
@@ -288,8 +361,7 @@ error_handler() {
    } >>"$DEBUG_LOGFILE"
  fi
-  # Get active log file (BUILD_LOG or INSTALL_LOG)
+  # Get active log file (prefer silent()'s logfile when available)
  # Prefer silent()'s logfile when available (contains the actual command output)
  local active_log=""
  if [[ -n "${_SILENT_FAILED_LOG:-}" && -s "${_SILENT_FAILED_LOG}" ]]; then
    active_log="$_SILENT_FAILED_LOG"
@@ -300,21 +372,17 @@ error_handler() {
    active_log="$SILENT_LOGFILE"
  fi
  # If active_log points to a container-internal path that doesn't exist on host,
  # fall back to BUILD_LOG (host-side log)
  if [[ -n "$active_log" && ! -s "$active_log" && -n "${BUILD_LOG:-}" && -s "${BUILD_LOG}" ]]; then
    active_log="$BUILD_LOG"
  fi
  # Show last log lines if available
  if [[ -n "$active_log" && -s "$active_log" ]]; then
    echo -e "\n${TAB}--- Last 20 lines of log ---"
    tail -n 20 "$active_log"
    echo -e "${TAB}-----------------------------------\n"
  fi
-  # Detect probable Node.js heap OOM and print actionable guidance.
+  # ── Node.js heap OOM detection with actionable guidance ──
  # This avoids generic SIGABRT/SIGKILL confusion for frontend build failures.
  local node_oom_detected="false"
  local node_build_context="false"
  if [[ "$command" =~ (npm|pnpm|yarn|node|vite|turbo) ]]; then
@@ -331,7 +399,6 @@ error_handler() {
  if [[ "$node_oom_detected" == "true" ]] || { [[ "$node_build_context" == "true" ]] && [[ "$exit_code" =~ ^(134|137)$ ]]; }; then
    local heap_hint_mb=""
    # If explicitly configured, prefer the current value for troubleshooting output.
    if [[ -n "${NODE_OPTIONS:-}" ]] && [[ "${NODE_OPTIONS}" =~ max-old-space-size=([0-9]+) ]]; then
      heap_hint_mb="${BASH_REMATCH[1]}"
    elif [[ -n "${var_ram:-}" ]] && [[ "${var_ram}" =~ ^[0-9]+$ ]]; then
@@ -358,14 +425,13 @@ error_handler() {
    fi
  fi
-  # ── Log-pattern analysis: detect common failure causes and emit actionable hints ──
+  # ── Log-pattern analysis: actionable hints for common failure causes ──
  if [[ -n "$active_log" && -s "$active_log" ]]; then
    local _log_tail
    _log_tail=$(tail -n 60 "$active_log" 2>/dev/null || true)
    # 1. APT/dpkg dependency conflict
    if echo "$_log_tail" | grep -qE "Depends:|depends on.*but.*not installed|broken packages|unmet dep|dependency problems"; then
      # Check for PostgreSQL-specific version mismatch (most actionable)
      local _pg_conflict
      _pg_conflict=$(echo "$_log_tail" | grep -oE 'postgresql-[0-9]+ but.*installed' | head -1 || true)
      if [[ -n "$_pg_conflict" ]]; then
@@ -386,7 +452,7 @@ error_handler() {
        msg_warn "Hint: A repository GPG key may be missing, expired, or the keyring file is not yet present (/usr/share/postgresql-common/pgdg/apt.postgresql.org.asc etc.)."
        msg_warn "Hint: Install the 'postgresql-common' package first, or re-add the repository with its correct signing key."
      fi
-    # 3. Network / DNS failure during apt-get or curl
+    # 3. Network / DNS failure
    elif echo "$_log_tail" | grep -qE "Could not resolve|Failed to fetch|Unable to connect|Name or service not known|Network is unreachable|curl.*resolve"; then
      if declare -f msg_warn >/dev/null 2>&1; then
        msg_warn "Network or DNS failure detected."
@@ -407,17 +473,12 @@ error_handler() {
    fi
  fi
-  # Detect context: Container (INSTALL_LOG set + inside container /root) vs Host
+  # ── Context-specific cleanup ──
-  if [[ -n "${INSTALL_LOG:-}" && -f "${INSTALL_LOG:-}" && -d /root ]]; then
+  if _is_container_context; then
-    # CONTAINER CONTEXT: Copy log and create flag file for host
+    # Container: artifacts already written above; nothing more to do
-    local container_log="/root/.install-${SESSION_ID:-error}.log"
+    :
    cp "${INSTALL_LOG}" "$container_log" 2>/dev/null || true
    # Create error flag file with exit code for host detection
    echo "$exit_code" >"/root/.install-${SESSION_ID:-error}.failed" 2>/dev/null || true
    # Log path is shown by host as combined log - no need to show container path
  else
-    # HOST CONTEXT: Show local log path and offer container cleanup
+    # HOST: show log path and offer container cleanup
    if [[ -n "$active_log" && -s "$active_log" ]]; then
      if declare -f msg_custom >/dev/null 2>&1; then
        msg_custom "📋" "${YW}" "Full log: ${active_log}"
@@ -435,7 +496,6 @@ error_handler() {
        echo -en "${YW}Remove broken container ${CTID}? (Y/n) [auto-remove in 60s]: ${CL}"
      fi
      # Read user response
      local response=""
      if read -t 60 -r response; then
        if [[ -z "$response" || "$response" =~ ^[Yy]$ ]]; then
@@ -476,12 +536,6 @@ error_handler() {
          echo -e "${GN}✔${CL} Container ${CTID} removed"
        fi
      fi
      # Force one final status update attempt after cleanup
      # This ensures status is updated even if the first attempt failed (e.g., HTTP 400)
      if declare -f post_update_to_api &>/dev/null; then
        post_update_to_api "failed" "$exit_code" "force"
      fi
    fi
  fi
@@ -489,106 +543,33 @@ error_handler() {
 }
 # ==============================================================================
-# SECTION 3: TELEMETRY & CLEANUP HELPERS FOR SIGNAL HANDLERS
+# SECTION 4: TELEMETRY & CLEANUP HELPERS FOR SIGNAL HANDLERS
 # ==============================================================================
 # ------------------------------------------------------------------------------
-# _send_abort_telemetry()
+# _send_abort_telemetry()  (compatibility name)
 #
-# - Sends failure/abort status to telemetry API
+# - HOST: reports via post_update_to_api (signals map to "aborted" there)
-# - Works in BOTH host context (post_update_to_api available) and
+# - CONTAINER: writes failure artifacts instead of sending anything
 #   container context (only curl available, api.func not sourced)
 # - Container context is critical: without this, container-side failures
 #   and signal exits are never reported, leaving records stuck in
 #   "installing" or "configuring" forever
 # - Arguments: $1 = exit_code
 # ------------------------------------------------------------------------------
 _send_abort_telemetry() {
  local exit_code="${1:-1}"
-  # Try full API function first (host context - api.func sourced)
+  if _is_container_context; then
    _container_write_failure "$exit_code"
    return 0
  fi
  if declare -f post_update_to_api &>/dev/null; then
    post_update_to_api "failed" "$exit_code" 2>/dev/null || true
    return
  fi
  # Fallback: direct curl (container context - api.func NOT sourced)
  # This is the ONLY way containers can report failures to telemetry
  command -v curl &>/dev/null || return 0
  [[ "${DIAGNOSTICS:-no}" == "no" ]] && return 0
  [[ -z "${RANDOM_UUID:-}" ]] && return 0
  # Collect last 200 log lines for error diagnosis (best-effort)
  # Container context has no get_full_log(), so we gather as much as possible
  local error_text=""
  local logfile=""
  if [[ -n "${INSTALL_LOG:-}" && -s "${INSTALL_LOG}" ]]; then
    logfile="${INSTALL_LOG}"
  elif [[ -n "${SILENT_LOGFILE:-}" && -s "${SILENT_LOGFILE}" ]]; then
    logfile="${SILENT_LOGFILE}"
  fi
  if [[ -n "$logfile" ]]; then
    error_text=$(tail -n 200 "$logfile" 2>/dev/null | sed 's/\x1b\[[0-9;]*[a-zA-Z]//g; s/\\/\\\\/g; s/"/\\"/g; s/\r//g' | tr '\n' '|' | sed 's/|$//' | head -c 16384 | tr -d '\000-\010\013\014\016-\037\177') || true
  fi
  # Prepend exit code explanation header (like build_error_string does on host)
  local explanation=""
  if declare -f explain_exit_code &>/dev/null; then
    explanation=$(explain_exit_code "$exit_code" 2>/dev/null) || true
  fi
  if [[ -n "$explanation" && -n "$error_text" ]]; then
    error_text="exit_code=${exit_code} | ${explanation}|---|${error_text}"
  elif [[ -n "$explanation" && -z "$error_text" ]]; then
    error_text="exit_code=${exit_code} | ${explanation}"
  fi
  # Calculate duration if start time is available
  local duration=""
  if [[ -n "${DIAGNOSTICS_START_TIME:-}" ]]; then
    duration=$(($(date +%s) - DIAGNOSTICS_START_TIME))
  fi
  # Categorize error if function is available (may not be in minimal container context)
  local error_category=""
  if declare -f categorize_error &>/dev/null; then
    error_category=$(categorize_error "$exit_code" 2>/dev/null) || true
  fi
  # Build JSON payload with error context
  local payload
  payload="{\"random_id\":\"${RANDOM_UUID}\",\"execution_id\":\"${EXECUTION_ID:-${RANDOM_UUID}}\",\"type\":\"${TELEMETRY_TYPE:-lxc}\",\"nsapp\":\"${NSAPP:-${app:-unknown}}\",\"status\":\"failed\",\"exit_code\":${exit_code}"
  [[ -n "$error_text" ]] && payload="${payload},\"error\":\"${error_text}\""
  [[ -n "$error_category" ]] && payload="${payload},\"error_category\":\"${error_category}\""
  [[ -n "$duration" ]] && payload="${payload},\"duration\":${duration}"
  payload="${payload}}"
  local api_url="${TELEMETRY_URL:-https://telemetry.community-scripts.org/telemetry}"
  # 2 attempts (retry once on failure) — original had no retry
  local attempt
  for attempt in 1 2; do
    if curl -fsS -m 5 -X POST "$api_url" \
      -H "Content-Type: application/json" \
      -d "$payload" &>/dev/null; then
      return 0
    fi
    [[ $attempt -eq 1 ]] && sleep 1
  done
  return 0
 }
 # ------------------------------------------------------------------------------
 # _stop_container_if_installing()
 #
-# - Stops the LXC container if we're in the install phase
+# - Stops the LXC container if we're in the install phase (host only)
 # - Prevents orphaned container processes when the host exits due to a signal
 #   (SSH disconnect, Ctrl+C, SIGTERM) — without this, the container keeps
 #   running and may send "configuring" status AFTER the host already sent
 #   "failed", leaving records permanently stuck in "configuring"
 # - Only acts when:
 #   * CONTAINER_INSTALLING flag is set (during lxc-attach in build_container)
 #   * CTID is set (container was created)
 #   * pct command is available (we're on the Proxmox host, not inside a container)
 # - Does NOT destroy the container — just stops it for potential debugging
 # ------------------------------------------------------------------------------
 _stop_container_if_installing() {
  [[ "${CONTAINER_INSTALLING:-}" == "true" ]] || return 0
@@ -598,51 +579,47 @@ _stop_container_if_installing() {
 }
 # ==============================================================================
-# SECTION 4: SIGNAL HANDLERS
+# SECTION 5: SIGNAL HANDLERS
 # ==============================================================================
 # ------------------------------------------------------------------------------
 # on_exit()
 #
 # - EXIT trap handler — runs on EVERY script termination
-# - Catches orphaned "installing"/"configuring" records:
+# - CONTAINER: ensures failure artifacts exist on non-zero exit (this also
-#   * If post_to_api sent "installing" but post_update_to_api never ran
+#   covers silent()'s direct `exit $rc`, which bypasses the ERR trap)
-#   * Reports final status to prevent records stuck forever
+# - HOST: catches executions that never sent a final status:
-# - Best-effort log collection for failed installs
+#   * non-zero exit → "failed" (signal codes map to "aborted")
-# - Stops orphaned container processes on failure
+#   * zero exit with an "installing" record but no final → "aborted"
-# - Cleans up lock files
+#     (e.g. user cancelled a whiptail dialog, script exited cleanly)
 # ------------------------------------------------------------------------------
 on_exit() {
  local exit_code=$?
-  # Report orphaned telemetry records
+  if _is_container_context; then
-  # Two scenarios handled:
+    if [[ $exit_code -ne 0 ]]; then
-  # 1. POST_TO_API_DONE=true but POST_UPDATE_DONE=false: Record was created but
+      _container_write_failure "$exit_code" "${FAILED_COMMAND:-}" "${FAILED_LINE:-}"
-  #    never got a final status update → send abort/done now.
+    fi
-  # 2. POST_TO_API_DONE=false but DIAGNOSTICS=yes: Initial post failed (server
+  else
-  #    unreachable/timeout), but the server has fallback create-on-update logic,
+    if [[ "${POST_UPDATE_DONE:-}" != "true" ]] && declare -f post_update_to_api >/dev/null 2>&1; then
  #    so a status update can still create the record. Worth one last try.
  if [[ "${POST_UPDATE_DONE:-}" != "true" ]]; then
    if [[ "${POST_TO_API_DONE:-}" == "true" || "${DIAGNOSTICS:-no}" == "yes" ]]; then
      if [[ $exit_code -ne 0 ]]; then
-        _send_abort_telemetry "$exit_code"
+        post_update_to_api "failed" "$exit_code" 2>/dev/null || true
-      elif [[ "${INSTALL_COMPLETE:-}" == "true" ]] && declare -f post_update_to_api >/dev/null 2>&1; then
+      elif [[ "${POST_TO_API_DONE:-}" == "true" ]]; then
-        # Only report success if the install was explicitly marked complete.
+        # Clean exit but no success was ever reported: the user backed out
-        # Without this guard, early bailouts (e.g. user cancelled) with exit 0
+        # somewhere. Report as aborted so the record doesn't stay "installing".
-        # would be falsely reported as successful installations.
+        post_update_to_api "aborted" "0" 2>/dev/null || true
        post_update_to_api "done" "0" 2>/dev/null || true
      fi
    fi
  fi
-  # Best-effort log collection on failure (non-critical, telemetry already sent)
+    # Best-effort log collection on failure
-  if [[ $exit_code -ne 0 ]] && declare -f ensure_log_on_host >/dev/null 2>&1; then
+    if [[ $exit_code -ne 0 ]] && declare -f ensure_log_on_host >/dev/null 2>&1; then
-    ensure_log_on_host 2>/dev/null || true
+      ensure_log_on_host 2>/dev/null || true
-  fi
+    fi
-  # Stop orphaned container if we're in the install phase and exiting with error
+    # Stop orphaned container if we're in the install phase
-  if [[ $exit_code -ne 0 ]]; then
+    if [[ $exit_code -ne 0 ]]; then
-    _stop_container_if_installing
+      _stop_container_if_installing
    fi
  fi
  [[ -n "${lockfile:-}" && -e "$lockfile" ]] && rm -f "$lockfile"
@@ -650,21 +627,19 @@ on_exit() {
 }
 # ------------------------------------------------------------------------------
-# on_interrupt()
+# on_interrupt() - SIGINT (Ctrl+C)
 #
 # - SIGINT (Ctrl+C) trap handler
 # - Reports status FIRST (time-critical: container may be dying)
 # - Stops orphaned container to prevent "configuring" ghost records
 # - Exits with code 130 (128 + SIGINT=2)
 # ------------------------------------------------------------------------------
 on_interrupt() {
  # Stop spinner and restore cursor before any output
  if declare -f stop_spinner >/dev/null 2>&1; then
    stop_spinner 2>/dev/null || true
  fi
  printf "\e[?25h" 2>/dev/null || true
-  _send_abort_telemetry "130"
+  if _is_container_context; then
    _container_write_failure "130"
  elif declare -f post_update_to_api &>/dev/null; then
    post_update_to_api "aborted" "130" 2>/dev/null || true
  fi
  _stop_container_if_installing
  if declare -f msg_error >/dev/null 2>&1; then
    msg_error "Interrupted by user (SIGINT)" 2>/dev/null || true
@@ -675,21 +650,19 @@ on_interrupt() {
 }
 # ------------------------------------------------------------------------------
-# on_terminate()
+# on_terminate() - SIGTERM
 #
 # - SIGTERM trap handler
 # - Reports status FIRST (time-critical: process being killed)
 # - Stops orphaned container to prevent "configuring" ghost records
 # - Exits with code 143 (128 + SIGTERM=15)
 # ------------------------------------------------------------------------------
 on_terminate() {
  # Stop spinner and restore cursor before any output
  if declare -f stop_spinner >/dev/null 2>&1; then
    stop_spinner 2>/dev/null || true
  fi
  printf "\e[?25h" 2>/dev/null || true
-  _send_abort_telemetry "143"
+  if _is_container_context; then
    _container_write_failure "143"
  elif declare -f post_update_to_api &>/dev/null; then
    post_update_to_api "aborted" "143" 2>/dev/null || true
  fi
  _stop_container_if_installing
  if declare -f msg_error >/dev/null 2>&1; then
    msg_error "Terminated by signal (SIGTERM)" 2>/dev/null || true
@@ -700,45 +673,32 @@ on_terminate() {
 }
 # ------------------------------------------------------------------------------
-# on_hangup()
+# on_hangup() - SIGHUP (SSH disconnect, terminal closed)
 #
 # - SIGHUP trap handler (SSH disconnect, terminal closed)
 # - CRITICAL: This was previously MISSING from catch_errors(), causing
 #   container processes to become orphans on SSH disconnect — the #1 cause
 #   of records stuck in "installing" and "configuring" states
 # - Reports status via direct curl (terminal is already closed, no output)
 # - Stops orphaned container to prevent ghost records
 # - Exits with code 129 (128 + SIGHUP=1)
 # ------------------------------------------------------------------------------
 on_hangup() {
  # Stop spinner (no cursor restore needed — terminal is already gone)
  if declare -f stop_spinner >/dev/null 2>&1; then
    stop_spinner 2>/dev/null || true
  fi
-  _send_abort_telemetry "129"
+  if _is_container_context; then
    _container_write_failure "129"
  elif declare -f post_update_to_api &>/dev/null; then
    post_update_to_api "aborted" "129" 2>/dev/null || true
  fi
  _stop_container_if_installing
  exit 129
 }
 # ==============================================================================
-# SECTION 5: INITIALIZATION
+# SECTION 6: INITIALIZATION
 # ==============================================================================
 # ------------------------------------------------------------------------------
 # catch_errors()
 #
 # - Initializes error handling and signal traps
-# - Enables strict error handling:
+# - set -Ee -o pipefail (+ set -u when STRICT_UNSET=1)
-#   * set -Ee: Exit on error, inherit ERR trap in functions
+# - Traps: ERR → error_handler, EXIT → on_exit, INT/TERM/HUP → signal handlers
 #   * set -o pipefail: Pipeline fails if any command fails
 #   * set -u: (optional) Exit on undefined variable (if STRICT_UNSET=1)
 # - Sets up traps:
 #   * ERR  → error_handler (script errors)
 #   * EXIT → on_exit      (any termination — cleanup + orphan detection)
 #   * INT  → on_interrupt  (Ctrl+C)
 #   * TERM → on_terminate  (kill / systemd stop)
 #   * HUP  → on_hangup     (SSH disconnect / terminal closed)
 # - Call this function early in every script
 # ------------------------------------------------------------------------------
 catch_errors() {
@@ -32,6 +32,11 @@ if ! command -v curl >/dev/null 2>&1; then
  apt update >/dev/null 2>&1
  apt install -y curl >/dev/null 2>&1
 fi
 # Mark container context BEFORE error handling starts: error_handler/on_exit
 # must write local failure artifacts instead of talking to the telemetry API
 # (the host is the single telemetry reporter).
 export TELEMETRY_CONTEXT="container"
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/core.func)
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/error_handler.func)
 load_functions
@@ -65,9 +70,12 @@ post_progress_to_api() {
  local progress_status="${1:-configuring}"
  # Progress pings are the ONLY telemetry a container sends (terminal statuses
  # are reported by the host). Include execution_id + platform + repo
  # attribution (exported by the host) so the server can correlate and filter.
  curl -fsS -m 5 -X POST "https://telemetry.community-scripts.org/telemetry" \
    -H "Content-Type: application/json" \
-    -d "{\"random_id\":\"${RANDOM_UUID}\",\"execution_id\":\"${EXECUTION_ID:-${RANDOM_UUID}}\",\"type\":\"lxc\",\"nsapp\":\"${app:-unknown}\",\"status\":\"${progress_status}\"}" &>/dev/null || true
+    -d "{\"random_id\":\"${RANDOM_UUID}\",\"execution_id\":\"${EXECUTION_ID:-${RANDOM_UUID}}\",\"type\":\"lxc\",\"nsapp\":\"${app:-unknown}\",\"status\":\"${progress_status}\",\"platform\":\"${TELEMETRY_PLATFORM:-}\",\"repo_source\":\"${REPO_SOURCE:-}\",\"repo_slug\":\"${REPO_SLUG:-}\"}" &>/dev/null || true
 }
 # ==============================================================================
@@ -573,8 +573,10 @@ cleanup() {
      if [[ $exit_code -ne 0 ]]; then
        post_update_to_api "failed" "$exit_code"
      else
-        # Exited cleanly but description()/success was never called — shouldn't happen
+        # Exited cleanly but description()/success was never called: the user
-        post_update_to_api "failed" "1"
+        # backed out of a dialog. Report as aborted - NOT "failed 1" (which
        # produced meaningless 'General error' records with no error text).
        post_update_to_api "aborted" "0"
      fi
    fi
  fi
@@ -25,6 +25,7 @@ METHOD=""
 NSAPP="opnsense-vm"
 var_os="opnsense"
 var_version="26.7"
 FREEBSD_MAJOR="15"
 #
 GEN_MAC=02:$(openssl rand -hex 5 | awk '{print toupper($0)}' | sed 's/\(..\)/\1:/g; s/.$//')
 GEN_MAC_LAN=02:$(openssl rand -hex 5 | awk '{print toupper($0)}' | sed 's/\(..\)/\1:/g; s/.$//')
@@ -490,7 +491,7 @@ function advanced_settings() {
        fi
        echo -e "${DGN}Using LAN GATEWAY ADDRESS: ${BGN}$LAN_GW${CL}"
      fi
-      if NETMASK=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a LAN netmmask (24 for example)" 8 58 $NETMASK --title "LAN NETMASK" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
+      if NETMASK=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a LAN netmask (24 for example)" 8 58 $NETMASK --title "LAN NETMASK" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
        if [ -z $NETMASK ]; then
          echo -e "${DGN}Netmask needs to be set if ip is not dhcp${CL}"
        fi
@@ -558,7 +559,7 @@ function advanced_settings() {
      else
        exit-script
      fi
-      if WAN_NETMASK=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a WAN netmmask (24 for example)" 8 58 $WAN_NETMASK --title "WAN NETMASK" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
+      if WAN_NETMASK=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a WAN netmask (24 for example)" 8 58 $WAN_NETMASK --title "WAN NETMASK" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
        if [ -z $WAN_NETMASK ]; then
          echo -e "${DGN}WAN Netmask needs to be set if ip is not dhcp${CL}"
        fi
@@ -574,7 +575,7 @@ function advanced_settings() {
  else
    exit-script
  fi
-  if MAC1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a WAN MAC Address" 8 58 $GEN_MAC --title "WAN MAC ADDRESS" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
+  if MAC1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a LAN MAC Address" 8 58 $GEN_MAC --title "LAN MAC ADDRESS" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
    if [ -z $MAC1 ]; then
      MAC="$GEN_MAC"
    else
@@ -585,7 +586,7 @@ function advanced_settings() {
    exit-script
  fi
-  if MAC2=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a LAN MAC Address" 8 58 $GEN_MAC_LAN --title "LAN MAC ADDRESS" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
+  if MAC2=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a WAN MAC Address" 8 58 $GEN_MAC_LAN --title "WAN MAC ADDRESS" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
    if [ -z $MAC2 ]; then
      WAN_MAC="$GEN_MAC_LAN"
    else
@@ -652,23 +653,26 @@ fi
 msg_ok "Using ${CL}${BL}$STORAGE${CL} ${GN}for Storage Location."
 msg_ok "Virtual Machine ID is ${CL}${BL}$VMID${CL}."
 msg_info "Retrieving the URL for the OPNsense Qcow2 Disk Image"
-# Use latest stable FreeBSD amd64 qcow2 VM image (generic, not UFS/ZFS)
+# Use latest stable FreeBSD amd64 qcow2 VM image matching FREEBSD_MAJOR
 RELEASE_LIST="$(curl -s https://download.freebsd.org/releases/VM-IMAGES/ |
-  grep -Eo '[0-9]+\.[0-9]+-RELEASE' |
+  grep -Eo "${FREEBSD_MAJOR}\.[0-9]+-RELEASE" |
  sort -Vr |
  uniq)"
 URL=""
 FREEBSD_VER=""
 for ver in $RELEASE_LIST; do
-  candidate="https://download.freebsd.org/releases/VM-IMAGES/${ver}/amd64/Latest/FreeBSD-${ver}-amd64.qcow2.xz"
+  # FreeBSD 15+ publishes separate -ufs/-zfs images instead of a generic one
-  if curl -fsI "$candidate" >/dev/null 2>&1; then
+  for variant in "" "-ufs" "-zfs"; do
-    FREEBSD_VER="$ver"
+    candidate="https://download.freebsd.org/releases/VM-IMAGES/${ver}/amd64/Latest/FreeBSD-${ver}-amd64${variant}.qcow2.xz"
-    URL="$candidate"
+    if curl -fsI "$candidate" >/dev/null 2>&1; then
-    break
+      FREEBSD_VER="$ver"
-  fi
+      URL="$candidate"
      break 2
    fi
  done
 done
 if [ -z "$URL" ]; then
-  msg_error "Could not find generic FreeBSD amd64 qcow2 image (non-UFS/ZFS)."
+  msg_error "Could not find a FreeBSD ${FREEBSD_MAJOR}.x amd64 qcow2 image."
  exit 115
 fi
 msg_ok "Download URL: ${CL}${BL}${URL}${CL}"
@@ -768,7 +772,7 @@ DESCRIPTION=$(
  cat <<EOF
 <div align='center'>
  <a href='https://community-scripts.org' target='_blank' rel='noopener noreferrer'>
-    <img src='https://raw.githubusercontent.com/michelroegl-brunner/ProxmoxVE/refs/heads/develop/misc/images/logo-81x112.png' alt='Logo' style='width:81px;height:112px;'/>
+    <img src='https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/images/logo-81x112.png' alt='Logo' style='width:81px;height:112px;'/>
  </a>
  <h2 style='font-size: 24px; margin: 20px 0;'>OPNsense VM</h2>
@@ -814,10 +818,70 @@ if [ -n "$WAN_BRG" ]; then
  msg_ok "WAN interface added"
  sleep 5 # Brief pause after adding network interface
 fi
-send_line_to_vm "sh ./opnsense-bootstrap.sh.in -y -f -r 26.7"
+# FreeBSD 15+ VM images ship the base system as pkgbase packages; the bootstrap's
 # "delete all packages" step would remove the running base system (/bin/rm etc.)
 # and brick the VM. Deregister them from the pkg db first - the files stay in
 # place and OPNsense replaces base and kernel with its own sets afterwards.
 send_line_to_vm "echo \"PRAGMA foreign_keys=ON; DELETE FROM packages WHERE name LIKE 'FreeBSD-%';\" | pkg shell"
 sleep 5
 send_line_to_vm "sh ./opnsense-bootstrap.sh.in -y -f -r ${var_version}"
 msg_ok "OPNsense VM is being installed, do not close the terminal, or the installation will fail."
-#We need to wait for the OPNsense build proccess to finish, this takes a few minutes
+# The bootstrap ends with an automatic reboot into OPNsense. While it runs the
-sleep 1000
+# console keeps changing (download progress, package installs); once the VM has
 # settled at the login prompt the screen stays static. Poll a screendump hash
 # and continue after 3 minutes without change, bounded by a floor (the build
 # never finishes faster) and a ceiling for slow machines. If no screendump can
 # be captured at all, fall back to a fixed wait.
 SCREEN_PPM="${TEMP_DIR}/screen-${VMID}.ppm"
 function screen_hash() {
  # Remove the previous dump first: a stale file from an earlier successful
  # dump must not simulate a static screen when later dumps start failing.
  # Note: "qm monitor" is unusable here - its readline attaches to /dev/tty
  # even with piped stdin and captures the terminal, so use the API instead.
  rm -f "$SCREEN_PPM"
  timeout 10 pvesh create /nodes/$(hostname -s)/qemu/$VMID/monitor --command "screendump ${SCREEN_PPM}" >/dev/null 2>&1 || true
  md5sum "$SCREEN_PPM" 2>/dev/null | cut -d' ' -f1 || true
 }
 build_elapsed=300
 build_stable=0
 screen_ok=0
 hash_a=""
 hash_b=""
 sleep 300
 while [ $build_stable -lt 6 ] && [ $build_elapsed -lt 2400 ]; do
  sleep 30
  build_elapsed=$((build_elapsed + 30))
  new_hash=$(screen_hash)
  if [ -n "$new_hash" ]; then
    screen_ok=1
    # The login prompt cursor may blink: a screen alternating between the same
    # two frames (A/B/A/B) counts as stable, anything new resets the counter
    if [ "$new_hash" = "$hash_a" ] || [ "$new_hash" = "$hash_b" ]; then
      build_stable=$((build_stable + 1))
    else
      build_stable=0
    fi
  else
    build_stable=0
  fi
  hash_b="$hash_a"
  hash_a="$new_hash"
  if [ -n "$new_hash" ]; then
    echo -e "${DGN}Waiting for OPNsense build: ${YW}$((build_elapsed / 60))min elapsed, screen ${new_hash:0:8}, stable ${build_stable}/6${CL}"
  else
    echo -e "${DGN}Waiting for OPNsense build: ${YW}$((build_elapsed / 60))min elapsed, screendump failed${CL}"
  fi
  # No working screendump after several attempts: fixed wait instead
  if [ $screen_ok -eq 0 ] && [ $build_elapsed -ge 480 ]; then
    msg_error "Console screendump not available on this system - falling back to a fixed wait (12 minutes)."
    sleep 720
    build_elapsed=$((build_elapsed + 720))
    break
  fi
 done
 msg_ok "OPNsense build finished after $((build_elapsed / 60)) minutes"
 send_line_to_vm "root"
 send_line_to_vm "opnsense"
 send_line_to_vm "2"
@@ -855,8 +919,8 @@ if [ -n "$WAN_BRG" ] && [ "$WAN_IP_ADDR" != "" ]; then
  send_line_to_vm "2"
  send_line_to_vm "n"
  send_line_to_vm "${WAN_IP_ADDR}"
-  send_line_to_vm "${NETMASK}"
+  send_line_to_vm "${WAN_NETMASK}"
-  send_line_to_vm "${LAN_GW}"
+  send_line_to_vm "${WAN_GW}"
  send_line_to_vm "n"
  send_line_to_vm " "
  send_line_to_vm "n"
Author	SHA1	Message	Date
MickLesk	b13b590604	Harden OPNsense build wait detection Improves VM install completion detection by encapsulating screendump hashing in a helper, clearing stale dump files, and trying both `qm monitor` and `pvesh` monitor paths. The stability check now tolerates alternating A/B frames from a blinking login cursor instead of requiring one identical frame. It also adds elapsed-time progress output and a safe fallback to a fixed 12-minute wait when screendumps are unavailable, avoiding false completion or endless polling.	2026-07-21 16:35:06 +02:00
MickLesk	b295ec5be7	Replace fixed OPNsense wait with screen polling Swap the hardcoded 1000-second sleep for an adaptive loop that watches VM console screendump hashes and proceeds after sustained stability. The new logic enforces a minimum 5-minute wait, checks every 30 seconds, and caps total wait at 40 minutes to handle slower hosts or screendump failures more reliably.	2026-07-21 13:16:21 +02:00
MickLesk	3200758cfb	fix url for image	2026-07-21 13:11:40 +02:00
MickLesk	d604230a3f	fix typo	2026-07-21 10:56:46 +02:00
MickLesk	de174cada6	fix user feedback	2026-07-21 10:02:26 +02:00
MickLesk	a6d3f27e36	OPNSense: Bump FreeBSD to 15 and OPNSense to 26.7	2026-07-21 09:51:41 +02:00
community-scripts-pr-app[bot]	1cfddc4c9c	Update CHANGELOG.md (#15936 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-20 18:33:05 +00:00
CanbiZ (MickLesk)	6f04a9787f	core-refactor: single-reporter telemetry rewrite (#15933 ) Overhaul the telemetry system to enforce a single-reporter model where only the HOST sends terminal statuses (success/failed/aborted) to the API. Containers now write local artifact files (.failed flag + .errinfo) that the host picks up after lxc-attach returns, preventing the race condition where a metadata-less container payload would win over the full host payload. Key changes: - Add TELEMETRY_CONTEXT=container export in install.func/alpine-install.func to mark container context before error handling starts - Introduce _is_container_context() heuristic and _container_write_failure() artifact writer in error_handler.func - Refactor api.func: unified _tm_payload() builder (full metadata on every send), _tm_send() curl wrapper, _tm_enabled() gate, telemetry_collect_sysinfo() cached collector - Add structured .errinfo capture in silent() (core.func) using byte-offset to extract exactly the failing command's output - Pull .errinfo from container in build.func after lxc-attach for precise error traces - Add categorize_error(), telemetry_new_attempt(), detect_arm(), REPO_SLUG tracking - Signal exits (129/130/143) now report as 'aborted' instead of 'failed' - Remove post_update_to_api_extended() (superseded by unified _tm_payload) - Export REPO_SOURCE, REPO_SLUG, TELEMETRY_PLATFORM into container environment	2026-07-20 20:32:36 +02:00
community-scripts-pr-app[bot]	b889e8d05e	Update CHANGELOG.md (#15935 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-20 18:23:30 +00:00