Update CHANGELOG.md (#13259 )

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Turnkey: modernize turnkey.sh with shared libraries (#13242 )
2026-03-24 19:03:00 +01:00 · 2026-03-24 14:54:30 +00:00 · 2026-03-24 15:54:01 +01:00 · 2026-03-24 15:10:33 +01:00 · 2026-03-24 10:51:59 +00:00 · 2026-03-24 11:51:35 +01:00
50 changed files with 896 additions and 321 deletions
--- a/.github/workflows/close-tteck-issues.yaml
+++ b/.github/workflows/close-tteck-issues.yaml
@@ -21,7 +21,7 @@ jobs:
              const message = `Hello, it looks like you are referencing the **old tteck repo**.
            This repository is no longer used for active scripts.
-            **Please update your bookmarks** and use: [https://community-scripts.com](https://community-scripts.com)
+            **Please update your bookmarks** and use: [https://helper-scripts.com](https://helper-scripts.com)
            Also make sure your Bash command starts with:
            \`\`\`bash
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -426,8 +426,27 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 </details>
 ## 2026-03-24
 ### 🆕 New Scripts
  - Homebrew (Addon) ([#13249](https://github.com/community-scripts/ProxmoxVE/pull/13249))
 - NextExplorer ([#13252](https://github.com/community-scripts/ProxmoxVE/pull/13252))
 ### 🚀 Updated Scripts
  - #### ✨ New Features
    - Turnkey: modernize turnkey.sh with shared libraries  [@MickLesk](https://github.com/MickLesk) ([#13242](https://github.com/community-scripts/ProxmoxVE/pull/13242))
 ## 2026-03-23
 ### 🚀 Updated Scripts
  - #### 🔧 Refactor
    - core: harden shell scripts against injection and insecure permissions [@MickLesk](https://github.com/MickLesk) ([#13239](https://github.com/community-scripts/ProxmoxVE/pull/13239))
 ## 2026-03-22
 ### 🆕 New Scripts
--- a/README.md
+++ b/README.md
@@ -5,7 +5,7 @@
  <p><em>A Community Legacy in Memory of @tteck</em></p>
  <p>
-    <a href="https://community-scripts.com">
+    <a href="https://helper-scripts.com">
      <img src="https://img.shields.io/badge/🌐_Website-Visit-4c9b3f?style=for-the-badge&labelColor=2d3748" alt="Website" />
    </a>
    <a href="https://discord.gg/3AnUqsXnmK">
--- a/ct/headers/nextexplorer
+++ b/ct/headers/nextexplorer
@@ -0,0 +1,6 @@
                    __  ______           __                    
   ____  ___  _  __/ /_/ ____/  ______  / /___  ________  _____
  / __ \/ _ \| |/_/ __/ __/ | |/_/ __ \/ / __ \/ ___/ _ \/ ___/
 / / / /  __/>  </ /_/ /____>  </ /_/ / / /_/ / /  /  __/ /    
 /_/ /_/\___/_/|_|\__/_____/_/|_/ .___/_/\____/_/   \___/_/     
                              /_/                              
--- a/ct/homeassistant.sh
+++ b/ct/homeassistant.sh
@@ -73,7 +73,7 @@ function update_script() {
    $STD curl -fsSL https://github.com/filebrowser/filebrowser/releases/download/v2.23.0/linux-amd64-filebrowser.tar.gz | tar -xzv -C /usr/local/bin
    $STD filebrowser config init -a '0.0.0.0'
    $STD filebrowser config set -a '0.0.0.0'
-    $STD filebrowser users add admin community-scripts.com --perm.admin
+    $STD filebrowser users add admin helper-scripts.com --perm.admin
    msg_ok "Installed FileBrowser"
    msg_info "Creating Service"
@@ -93,7 +93,7 @@ WantedBy=default.target" >$service_path
    msg_ok "Completed successfully!\n"
    echo -e "FileBrowser should be reachable by going to the following URL.
-         ${BL}http://$LOCAL_IP:8080${CL}   admin|community-scripts.com\n"
+         ${BL}http://$LOCAL_IP:8080${CL}   admin|helper-scripts.com\n"
    exit
  fi
 }
--- a/ct/nextexplorer.sh
+++ b/ct/nextexplorer.sh
@@ -0,0 +1,76 @@
 #!/usr/bin/env bash
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: vhsdream
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://github.com/nxzai/nextExplorer
 APP="nextExplorer"
 var_tags="${var_tags:-files;documents}"
 var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-3072}"
 var_disk="${var_disk:-8}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
 var_unprivileged="${var_unprivileged:-1}"
 header_info "$APP"
 variables
 color
 catch_errors
 function update_script() {
  header_info
  check_container_storage
  check_container_resources
  if [[ ! -d /opt/nextExplorer ]]; then
    msg_error "No ${APP} Installation Found!"
    exit
  fi
  NODE_VERSION="24" setup_nodejs
  if check_for_gh_release "nextExplorer" "nxzai/nextExplorer"; then
    msg_info "Stopping nextExplorer"
    $STD systemctl stop nextexplorer
    msg_ok "Stopped nextExplorer"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "nextExplorer" "nxzai/nextExplorer" "tarball" "latest" "/opt/nextExplorer"
    msg_info "Updating nextExplorer"
    APP_DIR="/opt/nextExplorer/app"
    mkdir -p "$APP_DIR"
    cd /opt/nextExplorer
    export NODE_ENV=production
    $STD npm ci --omit=dev --workspace backend
    mv node_modules "$APP_DIR"
    mv backend/{src,package.json} "$APP_DIR"
    unset NODE_ENV
    export NODE_ENV=development
    $STD npm ci --workspace frontend
    $STD npm run -w frontend build -- --sourcemap false
    unset NODE_ENV
    mv frontend/dist/ "$APP_DIR"/src/public
    chown -R explorer:explorer "$APP_DIR" /etc/nextExplorer
    sed -i "\|version|s|$(jq -cr '.version' ${APP_DIR}/package.json)|$(cat ~/.nextexplorer)|" "$APP_DIR"/package.json
    sed -i 's/app.js/server.js/' /etc/systemd/system/nextexplorer.service && systemctl daemon-reload
    msg_ok "Updated nextExplorer"
    msg_info "Starting nextExplorer"
    $STD systemctl start nextexplorer
    msg_ok "Started nextExplorer"
    msg_ok "Updated successfully!"
  fi
  exit
 }
 start
 build_container
 description
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW} Access it using the following URL:${CL}"
 echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:3000${CL}"
--- a/ct/podman-homeassistant.sh
+++ b/ct/podman-homeassistant.sh
@@ -68,7 +68,7 @@ function update_script() {
    $STD curl -fsSL https://raw.githubusercontent.com/filebrowser/get/master/get.sh | bash
    $STD filebrowser config init -a '0.0.0.0'
    $STD filebrowser config set -a '0.0.0.0'
-    $STD filebrowser users add admin community-scripts.com --perm.admin
+    $STD filebrowser users add admin helper-scripts.com --perm.admin
    msg_ok "Installed FileBrowser"
    msg_info "Creating Service"
@@ -90,7 +90,7 @@ EOF
    msg_ok "Completed successfully!\n"
    echo -e "FileBrowser should be reachable by going to the following URL.
-         ${BL}http://$LOCAL_IP:8080${CL}   admin|community-scripts.com\n"
+         ${BL}http://$LOCAL_IP:8080${CL}   admin|helper-scripts.com\n"
    exit
  fi
  if [ "$UPD" == "4" ]; then
--- a/ct/semaphore.sh
+++ b/ct/semaphore.sh
@@ -50,7 +50,7 @@ function update_script() {
        /opt/semaphore/config.json
      SEM_PW=$(cat ~/semaphore.creds)
      systemctl start semaphore
-      $STD semaphore user add --admin --login admin --email admin@community-scripts.com --name Administrator --password "${SEM_PW}" --config /opt/semaphore/config.json
+      $STD semaphore user add --admin --login admin --email admin@helper-scripts.com --name Administrator --password "${SEM_PW}" --config /opt/semaphore/config.json
      msg_ok "Moved from BoltDB to SQLite"
    fi
--- a/install/archivebox-install.sh
+++ b/install/archivebox-install.sh
@@ -62,10 +62,10 @@ expect "Email address"
 send "\r"
 expect "Password"
-send "community-scripts.com\r"
+send "helper-scripts.com\r"
 expect "Password (again)"
-send "community-scripts.com\r"
+send "helper-scripts.com\r"
 expect eof
 EOF
--- a/install/argus-install.sh
+++ b/install/argus-install.sh
@@ -58,7 +58,7 @@ service:
      use_prerelease: false
    dashboard:
      icon: https://raw.githubusercontent.com/community-scripts/ProxmoxVE/refs/heads/main/misc/images/logo.png
-      icon_link_to: https://community-scripts.com/
+      icon_link_to: https://helper-scripts.com/
      web_url: https://github.com/community-scripts/ProxmoxVE/releases
 EOF
 msg_ok "Setup Config"
--- a/install/healthchecks-install.sh
+++ b/install/healthchecks-install.sh
@@ -35,7 +35,7 @@ PG_DB_NAME="healthchecks_db" PG_DB_USER="hc_user" PG_DB_PASS=$(openssl rand -bas
 msg_info "Setup Keys (Admin / Secret)"
 SECRET_KEY="$(openssl rand -base64 32 | tr -dc 'a-zA-Z0-9' | cut -c1-32)"
-ADMIN_EMAIL="admin@community-scripts.com"
+ADMIN_EMAIL="admin@helper-scripts.local"
 ADMIN_PASSWORD="$PG_DB_PASS"
 {
  echo "healthchecks Admin Email: $ADMIN_EMAIL"
--- a/install/inspircd-install.sh
+++ b/install/inspircd-install.sh
@@ -17,7 +17,7 @@ fetch_and_deploy_gh_release "inspircd" "inspircd/inspircd" "binary" "latest" "/o
 msg_info "Configuring InspIRCd"
 cat <<EOF >/etc/inspircd/inspircd.conf
-<define name="networkDomain" value="community-scripts.com">
+<define name="networkDomain" value="helper-scripts.com">
 <define name="networkName" value="Proxmox VE Helper-Scripts">
 <server
--- a/install/kimai-install.sh
+++ b/install/kimai-install.sh
@@ -55,10 +55,10 @@ $STD expect <<EOF
 set timeout -1
 log_user 0
-spawn bin/console kimai:user:create admin admin@community-scripts.com ROLE_SUPER_ADMIN
+spawn bin/console kimai:user:create admin admin@helper-scripts.com ROLE_SUPER_ADMIN
 expect "Please enter the password:"
-send "community-scripts.com\r"
+send "helper-scripts.com\r"
 expect eof
 EOF
--- a/install/kometa-install.sh
+++ b/install/kometa-install.sh
@@ -35,7 +35,7 @@ fetch_and_deploy_gh_release "kometa-quickstart" "Kometa-Team/Quickstart" "tarbal
 msg_info "Installing Kometa Quickstart"
 cd /opt/kometa-quickstart
 $STD uv venv /opt/kometa-quickstart/.venv
-$STD /opt/kometa-quickstart/.venv/bin/python -m pip install -r requirements.txt
+$STD uv pip install -r requirements.txt -p /opt/kometa-quickstart/.venv/bin/python
 msg_ok "Installed Kometa Quickstart"
 msg_info "Creating Service"
--- a/install/monica-install.sh
+++ b/install/monica-install.sh
@@ -33,7 +33,7 @@ $STD yarn config set ignore-engines true
 $STD yarn install
 $STD yarn run production
 $STD php artisan key:generate
-$STD php artisan setup:production --email=admin@community-scripts.com --password=community-scripts.com --force
+$STD php artisan setup:production --email=admin@helper-scripts.com --password=helper-scripts.com --force
 chown -R www-data:www-data /opt/monica
 chmod -R 775 /opt/monica/storage
 echo "* * * * * root php /opt/monica/artisan schedule:run >> /dev/null 2>&1" >>/etc/crontab
--- a/install/nextexplorer-install.sh
+++ b/install/nextexplorer-install.sh
@@ -0,0 +1,164 @@
 #!/usr/bin/env bash
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: vhsdream
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://github.com/nxzai/nextExplorer
 source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
 color
 verb_ip6
 catch_errors
 setting_up_container
 network_check
 update_os
 msg_info "Installing Dependencies"
 $STD apt install -y \
  ripgrep \
  imagemagick \
  ffmpeg \
  libva-drm2 \
  libva2 \
  mesa-va-drivers \
  vainfo
 msg_ok "Installed Dependencies"
 NODE_VERSION="24" setup_nodejs
 fetch_and_deploy_gh_release "nextExplorer" "nxzai/nextExplorer" "tarball" "latest" "/opt/nextExplorer"
 msg_info "Building nextExplorer"
 APP_DIR="/opt/nextExplorer/app"
 LOCAL_IP="$(hostname -I | awk '{print $1}')"
 mkdir -p "$APP_DIR"
 mkdir -p /etc/nextExplorer
 cd /opt/nextExplorer
 export NODE_ENV=production
 $STD npm ci --omit=dev --workspace backend
 mv node_modules "$APP_DIR"
 mv backend/{src,package.json} "$APP_DIR"
 unset NODE_ENV
 export NODE_ENV=development
 export NODE_OPTIONS="--max-old-space-size=2048"
 $STD npm ci --workspace frontend
 $STD npm run -w frontend build -- --sourcemap false
 unset NODE_ENV
 mv frontend/dist/ "$APP_DIR"/src/public
 msg_ok "Built nextExplorer"
 msg_info "Configuring nextExplorer"
 SECRET=$(openssl rand -hex 32)
 cat <<EOF >/etc/nextExplorer/.env
 NODE_ENV=production
 PORT=3000
 VOLUME_ROOT=/mnt
 CONFIG_DIR=/etc/nextExplorer
 CACHE_DIR=/etc/nextExplorer/cache
 # USER_ROOT=
 PUBLIC_URL=${LOCAL_IP}:3000
 # TRUST_PROXY=
 # CORS_ORIGINS=
 TERMINAL_ENABLED=false
 LOG_LEVEL=info
 DEBUG=false
 ENABLE_HTTP_LOGGING=false
 AUTH_ENABLED=true
 AUTH_MODE=both
 SESSION_SECRET="${SECRET}"
 # AUTH_MAX_FAILED=
 # AUTH_LOCK_MINUTES=
 # AUTH_USER_EMAIL=
 # AUTH_USER_PASSWORD=
 # OIDC_ENABLED=
 # OIDC_ISSUER=
 # OIDC_AUTHORIZATION_URL=
 # OIDC_TOKEN_URL=
 # OIDC_USERINFO_URL=
 # OIDC_CLIENT_ID=
 # OIDC_CLIENT_SECRET=
 # OIDC_CALLBACK_URL=
 # OIDC_LOGOUT_URL=
 # OIDC_SCOPES=
 # OIDC_AUTO_CREATE_USERS=true
 # SEARCH_DEEP=
 # SEARCH_RIPGREP=
 # SEARCH_MAX_FILESIZE=
 # ONLYOFFICE_URL=
 # ONLYOFFICE_SECRET=
 # ONLYOFFICE_LANG=
 # ONLYOFFICE_FORCE_SAVE=
 # ONLYOFFICE_FILE_EXTENSIONS=
 # COLLABORA_URL=
 # COLLABORA_DISCOVERY_URL=
 # COLLABORA_SECRET=
 # COLLABORA_LANG=
 # COLLABORA_FILE_EXTENSIONS=
 SHOW_VOLUME_USAGE=true
 # USER_DIR_ENABLED=
 # SKIP_HOME=
 # EDITOR_EXTENSIONS=
 # FFMPEG_PATH=
 # FFPROBE_PATH=
 ## Hardware acceleration
 # FFMPEG_HWACCEL=vaapi
 # FFMPEG_HWACCEL_DEVICE=/dev/dri/renderD128
 # FFMPEG_HWACCEL_OUTPUT_FORMAT=nv12
 FAVORITES_DEFAULT_ICON=outline.StarIcon
 SHARES_ENABLED=true
 # SHARES_TOKEN_LENGTH=10
 # SHARES_MAX_PER_USER=100
 # SHARES_DEFAULT_EXPIRY_DAYS=30
 # SHARES_GUEST_SESSION_HOURS=24
 # SHARES_ALLOW_PASSWORD=true
 # SHARES_ALLOW_ANONYMOUS=true
 EOF
 chmod 600 /etc/nextExplorer/.env
 $STD useradd -U -s /usr/sbin/nologin -m -d /home/explorer explorer
 chown -R explorer:explorer "$APP_DIR" /etc/nextExplorer
 sed -i "\|version|s|$(jq -cr '.version' ${APP_DIR}/package.json)|$(cat ~/.nextexplorer)|" "$APP_DIR"/package.json
 msg_ok "Configured nextExplorer"
 msg_info "Creating nextExplorer Service"
 cat <<EOF >/etc/systemd/system/nextexplorer.service
 [Unit]
 Description=nextExplorer Service
 After=network.target
 [Service]
 Type=simple
 User=explorer
 Group=explorer
 WorkingDirectory=/opt/nextExplorer/app
 EnvironmentFile=/etc/nextExplorer/.env
 ExecStart=/usr/bin/node ./src/server.js
 Restart=always
 RestartSec=5
 StandardOutput=journal
 StandardError=journal
 [Install]
 WantedBy=multi-user.target
 EOF
 $STD systemctl enable -q --now nextexplorer
 msg_ok "Created nextExplorer Service"
 motd_ssh
 customize
 cleanup_lxc
--- a/install/nodebb-install.sh
+++ b/install/nodebb-install.sh
@@ -91,16 +91,16 @@ expect "Format: mongodb://*" {
    send "$MONGO_CONNECTION_STRING\r"
 }
 expect "Administrator username" {
-    send "community-scripts\r"
+    send "helper-scripts\r"
 }
 expect "Administrator email address" {
-    send "admin@community-scripts.com\r"
+    send "helper-scripts@local.com\r"
 }
 expect "Password" {
-    send "community-scripts\r"
+    send "helper-scripts\r"
 }
 expect "Confirm Password" {
-    send "community-scripts\r"
+    send "helper-scripts\r"
 }
 expect eof
 EOF
--- a/install/npmplus-install.sh
+++ b/install/npmplus-install.sh
@@ -60,7 +60,7 @@ read -r -p "${TAB3}Enter your ACME Email: " ACME_EMAIL_INPUT
 yq -i "
  .services.npmplus.environment |=
    (map(select(. != \"TZ=*\" and . != \"ACME_EMAIL=*\" and . != \"INITIAL_ADMIN_EMAIL=*\" and . != \"INITIAL_ADMIN_PASSWORD=*\")) +
-    [\"TZ=$TZ_INPUT\", \"ACME_EMAIL=$ACME_EMAIL_INPUT\", \"INITIAL_ADMIN_EMAIL=admin@local.com\", \"INITIAL_ADMIN_PASSWORD=community-scripts.com\"])
+    [\"TZ=$TZ_INPUT\", \"ACME_EMAIL=$ACME_EMAIL_INPUT\", \"INITIAL_ADMIN_EMAIL=admin@local.com\", \"INITIAL_ADMIN_PASSWORD=helper-scripts.com\"])
 " /opt/compose.yaml
 msg_info "Building and Starting NPMplus (Patience)"
--- a/install/photoprism-install.sh
+++ b/install/photoprism-install.sh
@@ -99,7 +99,7 @@ PHOTOPRISM_DEBUG='false'
 PHOTOPRISM_LOG_LEVEL='info'
 # Site Info
-PHOTOPRISM_SITE_CAPTION='https://community-scripts.com'
+PHOTOPRISM_SITE_CAPTION='https://Helper-Scripts.com'
 PHOTOPRISM_SITE_DESCRIPTION=''
 PHOTOPRISM_SITE_AUTHOR=''
 EOF
--- a/install/semaphore-install.sh
+++ b/install/semaphore-install.sh
@@ -40,7 +40,7 @@ cat <<EOF >/opt/semaphore/config.json
  "access_key_encryption": "${SEM_KEY}"
 }
 EOF
-$STD semaphore user add --admin --login admin --email admin@community-scripts.com --name Administrator --password "${SEM_PW}" --config /opt/semaphore/config.json
+$STD semaphore user add --admin --login admin --email admin@helper-scripts.com --name Administrator --password "${SEM_PW}" --config /opt/semaphore/config.json
 echo "${SEM_PW}" >~/semaphore.creds
 msg_ok "Setup Semaphore"
--- a/install/shinobi-install.sh
+++ b/install/shinobi-install.sh
@@ -35,7 +35,7 @@ cd Shinobi
 gitVersionNumber=$(git rev-parse HEAD)
 theDateRightNow=$(date)
 touch version.json
-chmod 777 version.json
+chmod 644 version.json
 echo '{"Product" : "'"Shinobi"'" , "Branch" : "'"master"'" , "Version" : "'"$gitVersionNumber"'" , "Date" : "'"$theDateRightNow"'" , "Repository" : "'"https://gitlab.com/Shinobi-Systems/Shinobi.git"'"}' >version.json
 msg_ok "Cloned Shinobi"
--- a/install/tasmoadmin-install.sh
+++ b/install/tasmoadmin-install.sh
@@ -23,7 +23,7 @@ fetch_and_deploy_gh_release "tasmoadmin" "TasmoAdmin/TasmoAdmin" "prebuild" "lat
 msg_info "Configuring TasmoAdmin"
 rm -rf /etc/php/8.4/apache2/conf.d/10-opcache.ini
 chown -R www-data:www-data /var/www/tasmoadmin
-chmod 777 /var/www/tasmoadmin/tmp /var/www/tasmoadmin/data
+chmod 775 /var/www/tasmoadmin/tmp /var/www/tasmoadmin/data
 cat <<EOF >/etc/apache2/sites-available/tasmoadmin.conf
 <VirtualHost *:9999>
 	ServerName tasmoadmin
--- a/misc/api.func
+++ b/misc/api.func
@@ -348,10 +348,10 @@ explain_exit_code() {
 json_escape() {
  # Escape a string for safe JSON embedding using awk (handles any input size).
  # Pipeline: strip ANSI → remove control chars → escape \ " TAB → join lines with \n
-  printf '%s' "$1" \
+  printf '%s' "$1" |
-    | sed 's/\x1b\[[0-9;]*[a-zA-Z]//g' \
+    sed 's/\x1b\[[0-9;]*[a-zA-Z]//g' |
-    | tr -d '\000-\010\013\014\016-\037\177\r' \
+    tr -d '\000-\010\013\014\016-\037\177\r' |
-    | awk '
+    awk '
        BEGIN { ORS = "" }
        {
          gsub(/\\/, "\\\\")   # backslash → \\
@@ -627,8 +627,8 @@ post_to_api() {
  [[ "${DEV_MODE:-}" == "true" ]] && echo "[DEBUG] post_to_api() DIAGNOSTICS=$DIAGNOSTICS RANDOM_UUID=$RANDOM_UUID NSAPP=$NSAPP" >&2
-  # Set type for later status updates
+  # Set type for later status updates (preserve if already set, e.g. turnkey)
-  TELEMETRY_TYPE="lxc"
+  TELEMETRY_TYPE="${TELEMETRY_TYPE:-lxc}"
  local pve_version=""
  if command -v pveversion &>/dev/null; then
@@ -664,7 +664,7 @@ post_to_api() {
 {
    "random_id": "${RANDOM_UUID}",
    "execution_id": "${EXECUTION_ID:-${RANDOM_UUID}}",
-    "type": "lxc",
+    "type": "${TELEMETRY_TYPE}",
    "nsapp": "${NSAPP:-unknown}",
    "status": "installing",
    "ct_type": ${CT_TYPE:-1},
@@ -692,6 +692,7 @@ EOF
  # Send initial "installing" record with retry.
  # This record MUST exist for all subsequent updates to succeed.
  local http_code="" attempt
  local _post_success=false
  for attempt in 1 2 3; do
    if [[ "${DEV_MODE:-}" == "true" ]]; then
      http_code=$(curl -sS -w "%{http_code}" -m "${TELEMETRY_TIMEOUT}" -X POST "${TELEMETRY_URL}" \
@@ -703,11 +704,19 @@ EOF
        -H "Content-Type: application/json" \
        -d "$JSON_PAYLOAD" -o /dev/null 2>/dev/null) || http_code="000"
    fi
-    [[ "$http_code" =~ ^2[0-9]{2}$ ]] && break
+    if [[ "$http_code" =~ ^2[0-9]{2}$ ]]; then
      _post_success=true
      break
    fi
    [[ "$attempt" -lt 3 ]] && sleep 1
  done
-  POST_TO_API_DONE=true
+  # Only mark done if at least one attempt succeeded.
  # If all 3 failed, POST_TO_API_DONE stays false so post_update_to_api
  # and on_exit() know the initial record was never created.
  # The server has fallback logic to create a new record on status updates,
  # so subsequent calls can still succeed even without the initial record.
  POST_TO_API_DONE=${_post_success}
 }
 # ------------------------------------------------------------------------------
@@ -798,15 +807,19 @@ EOF
  # Send initial "installing" record with retry (must succeed for updates to work)
  local http_code="" attempt
  local _post_success=false
  for attempt in 1 2 3; do
    http_code=$(curl -sS -w "%{http_code}" -m "${TELEMETRY_TIMEOUT}" -X POST "${TELEMETRY_URL}" \
      -H "Content-Type: application/json" \
      -d "$JSON_PAYLOAD" -o /dev/null 2>/dev/null) || http_code="000"
-    [[ "$http_code" =~ ^2[0-9]{2}$ ]] && break
+    if [[ "$http_code" =~ ^2[0-9]{2}$ ]]; then
      _post_success=true
      break
    fi
    [[ "$attempt" -lt 3 ]] && sleep 1
  done
-  POST_TO_API_DONE=true
+  POST_TO_API_DONE=${_post_success}
 }
 # ------------------------------------------------------------------------------
@@ -1083,6 +1096,12 @@ EOF
 # - Used to group errors in dashboard
 # ------------------------------------------------------------------------------
 categorize_error() {
  # Allow build.func to override category based on log analysis (exit code 1 subclassification)
  if [[ -n "${ERROR_CATEGORY_OVERRIDE:-}" ]]; then
    echo "$ERROR_CATEGORY_OVERRIDE"
    return
  fi
  local code="$1"
  case "$code" in
  # Network errors (curl/wget)
--- a/misc/build.func
+++ b/misc/build.func
@@ -221,6 +221,14 @@ update_motd_ip() {
    local current_hostname="$(hostname)"
    local current_ip="$(hostname -I | awk '{print $1}')"
    # Escape sed special chars in replacement strings (& \ |)
    current_os="${current_os//\\/\\\\}"
    current_os="${current_os//&/\\&}"
    current_hostname="${current_hostname//\\/\\\\}"
    current_hostname="${current_hostname//&/\\&}"
    current_ip="${current_ip//\\/\\\\}"
    current_ip="${current_ip//&/\\&}"
    # Update only if values actually changed
    if ! grep -q "OS:.*$current_os" "$PROFILE_FILE" 2>/dev/null; then
      sed -i "s|OS:.*|OS: \${GN}$current_os\${CL}\\\"|" "$PROFILE_FILE"
@@ -4076,8 +4084,8 @@ EOF
  if [ "$var_os" == "alpine" ]; then
    sleep 3
    pct exec "$CTID" -- /bin/sh -c 'cat <<EOF >/etc/apk/repositories
-http://dl-cdn.alpinelinux.org/alpine/latest-stable/main
+https://dl-cdn.alpinelinux.org/alpine/latest-stable/main
-http://dl-cdn.alpinelinux.org/alpine/latest-stable/community
+https://dl-cdn.alpinelinux.org/alpine/latest-stable/community
 EOF'
    pct exec "$CTID" -- ash -c "apk add bash newt curl openssh nano mc ncurses jq" >>"$BUILD_LOG" 2>&1 || {
      msg_error "Failed to install base packages in Alpine container"
@@ -4086,7 +4094,9 @@ EOF'
  else
    sleep 3
    LANG=${LANG:-en_US.UTF-8}
-    pct exec "$CTID" -- bash -c "sed -i \"/$LANG/ s/^# //\" /etc/locale.gen"
+    local LANG_ESC="${LANG//./\\.}"
    LANG_ESC="${LANG_ESC//|/\\|}"
    pct exec "$CTID" -- bash -c "sed -i \"/$LANG_ESC/ s/^# //\" /etc/locale.gen"
    pct exec "$CTID" -- bash -c "locale_line=\$(grep -v '^#' /etc/locale.gen | grep -E '^[a-zA-Z]' | awk '{print \$1}' | head -n 1) && \
    echo LANG=\$locale_line >/etc/default/locale && \
    locale-gen >/dev/null && \
@@ -4216,6 +4226,53 @@ EOF'
      fi
    fi
    # Defense-in-depth: Ensure error handling stays disabled during recovery.
    # Some functions (e.g. silent/$STD) unconditionally re-enable set -Eeuo pipefail
    # and trap 'error_handler' ERR. If any code path above called such a function,
    # the grep/sed pipelines below would trigger error_handler on non-match (exit 1).
    set +Eeuo pipefail
    trap - ERR
    # --- Exit code 1 subclassification: analyze logs BEFORE telemetry call ---
    # Exit code 1 is generic ("General error"). Analyze logs to determine the
    # real error category so telemetry gets a useful classification instead of "shell".
    local is_oom=false
    local is_network_issue=false
    local is_apt_issue=false
    local is_cmd_not_found=false
    local is_disk_full=false
    if [[ $install_exit_code -eq 1 && -f "$combined_log" ]]; then
      if grep -qiE 'E: Unable to|E: Package|E: Failed to fetch|dpkg.*error|broken packages|unmet dependencies|dpkg --configure -a' "$combined_log"; then
        is_apt_issue=true
      fi
      if grep -qiE 'Cannot allocate memory|Out of memory|oom-killer|Killed process|JavaScript heap' "$combined_log"; then
        is_oom=true
      fi
      if grep -qiE 'Could not resolve|DNS|Connection refused|Network is unreachable|No route to host|Temporary failure resolving|Failed to fetch' "$combined_log"; then
        is_network_issue=true
      fi
      if grep -qiE ': command not found|No such file or directory.*/s?bin/' "$combined_log"; then
        is_cmd_not_found=true
      fi
      if grep -qiE 'ENOSPC|no space left on device|Disk quota exceeded|errno -28' "$combined_log"; then
        is_disk_full=true
      fi
    fi
    # Set override for categorize_error() so telemetry gets the real category
    if [[ "$is_apt_issue" == true ]]; then
      export ERROR_CATEGORY_OVERRIDE="dependency"
    elif [[ "$is_oom" == true ]]; then
      export ERROR_CATEGORY_OVERRIDE="resource"
    elif [[ "$is_network_issue" == true ]]; then
      export ERROR_CATEGORY_OVERRIDE="network"
    elif [[ "$is_disk_full" == true ]]; then
      export ERROR_CATEGORY_OVERRIDE="storage"
    elif [[ "$is_cmd_not_found" == true ]]; then
      export ERROR_CATEGORY_OVERRIDE="dependency"
    fi
    # Report failure to telemetry API (now with log available on host)
    # NOTE: Do NOT use msg_info/spinner here — the background spinner process
    # causes SIGTSTP in non-interactive shells (bash -c "$(curl ...)"), which
@@ -4224,13 +4281,6 @@ EOF'
    post_update_to_api "failed" "$install_exit_code"
    $STD echo -e "${TAB}${CM:-✔} Failure reported"
    # Defense-in-depth: Ensure error handling stays disabled during recovery.
    # Some functions (e.g. silent/$STD) unconditionally re-enable set -Eeuo pipefail
    # and trap 'error_handler' ERR. If any code path above called such a function,
    # the grep/sed pipelines below would trigger error_handler on non-match (exit 1).
    set +Eeuo pipefail
    trap - ERR
    # Show combined log location
    if [[ -n "$CTID" && -n "${SESSION_ID:-}" ]]; then
      msg_custom "📋" "${YW}" "Installation log: ${combined_log}"
@@ -4259,12 +4309,9 @@ EOF'
    # Prompt user for cleanup with 60s timeout
    echo ""
-    # Detect error type for smart recovery options
+    # Extend error detection for non-exit-1 codes (exit 1 was already analyzed above)
-    local is_oom=false
+    # The is_* flags were set above for exit code 1 log analysis; here we add
-    local is_network_issue=false
+    # exit-code-specific detections for other codes.
    local is_apt_issue=false
    local is_cmd_not_found=false
    local is_disk_full=false
    local error_explanation=""
    if declare -f explain_exit_code >/dev/null 2>&1; then
      error_explanation="$(explain_exit_code "$install_exit_code")"
@@ -4314,26 +4361,6 @@ EOF'
      ;;
    esac
    # Exit 1 subclassification: analyze logs to identify actual root cause
    # Many exit 1 errors are actually APT, OOM, network, or command-not-found issues
    if [[ $install_exit_code -eq 1 && -f "$combined_log" ]]; then
      if grep -qiE 'E: Unable to|E: Package|E: Failed to fetch|dpkg.*error|broken packages|unmet dependencies|dpkg --configure -a' "$combined_log"; then
        is_apt_issue=true
      fi
      if grep -qiE 'Cannot allocate memory|Out of memory|oom-killer|Killed process|JavaScript heap' "$combined_log"; then
        is_oom=true
      fi
      if grep -qiE 'Could not resolve|DNS|Connection refused|Network is unreachable|No route to host|Temporary failure resolving|Failed to fetch' "$combined_log"; then
        is_network_issue=true
      fi
      if grep -qiE ': command not found|No such file or directory.*/s?bin/' "$combined_log"; then
        is_cmd_not_found=true
      fi
      if grep -qiE 'ENOSPC|no space left on device|Disk quota exceeded|errno -28' "$combined_log"; then
        is_disk_full=true
      fi
    fi
    # Show error explanation if available
    if [[ -n "$error_explanation" ]]; then
      echo -e "${TAB}${RD}Error: ${error_explanation}${CL}"
@@ -4535,6 +4562,7 @@ EOF'
          if [[ $apt_retry_code -eq 0 ]]; then
            msg_ok "Installation completed successfully after APT repair!"
            INSTALL_COMPLETE=true
            post_update_to_api "done" "0" "force"
            return 0
          else
@@ -4759,6 +4787,10 @@ fix_gpu_gids() {
  pct stop "$CTID" >/dev/null 2>&1
  sleep 1
  # Validate GIDs are numeric before sed
  [[ "$render_gid" =~ ^[0-9]+$ ]] || render_gid="104"
  [[ "$video_gid" =~ ^[0-9]+$ ]] || video_gid="44"
  # Update dev entries with correct GIDs
  sed -i.bak -E "s|(dev[0-9]+: /dev/dri/renderD[0-9]+),gid=[0-9]+|\1,gid=${render_gid}|g" "$LXC_CONFIG"
  sed -i -E "s|(dev[0-9]+: /dev/dri/card[0-9]+),gid=[0-9]+|\1,gid=${video_gid}|g" "$LXC_CONFIG"
@@ -5672,7 +5704,7 @@ description() {
  DESCRIPTION=$(
    cat <<EOF
 <div align='center'>
-  <a href='https://community-scripts.com' target='_blank' rel='noopener noreferrer'>
+  <a href='https://Helper-Scripts.com' target='_blank' rel='noopener noreferrer'>
    <img src='https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/images/logo-81x112.png' alt='Logo' style='width:81px;height:112px;'/>
  </a>
@@ -5705,6 +5737,7 @@ EOF
    systemctl start ping-instances.service
  fi
  INSTALL_COMPLETE=true
  post_update_to_api "done" "none"
 }
--- a/misc/error_handler.func
+++ b/misc/error_handler.func
@@ -507,14 +507,23 @@ _stop_container_if_installing() {
 on_exit() {
  local exit_code=$?
-  # Report orphaned "installing" records to telemetry API
+  # Report orphaned telemetry records
-  # Catches ALL exit paths: errors, signals, AND clean exits where
+  # Two scenarios handled:
-  # post_to_api was called but post_update_to_api was never called
+  # 1. POST_TO_API_DONE=true but POST_UPDATE_DONE=false: Record was created but
-  if [[ "${POST_TO_API_DONE:-}" == "true" && "${POST_UPDATE_DONE:-}" != "true" ]]; then
+  #    never got a final status update → send abort/done now.
-    if [[ $exit_code -ne 0 ]]; then
+  # 2. POST_TO_API_DONE=false but DIAGNOSTICS=yes: Initial post failed (server
-      _send_abort_telemetry "$exit_code"
+  #    unreachable/timeout), but the server has fallback create-on-update logic,
-    elif declare -f post_update_to_api >/dev/null 2>&1; then
+  #    so a status update can still create the record. Worth one last try.
-      post_update_to_api "done" "0" 2>/dev/null || true
+  if [[ "${POST_UPDATE_DONE:-}" != "true" ]]; then
    if [[ "${POST_TO_API_DONE:-}" == "true" || "${DIAGNOSTICS:-no}" == "yes" ]]; then
      if [[ $exit_code -ne 0 ]]; then
        _send_abort_telemetry "$exit_code"
      elif [[ "${INSTALL_COMPLETE:-}" == "true" ]] && declare -f post_update_to_api >/dev/null 2>&1; then
        # Only report success if the install was explicitly marked complete.
        # Without this guard, early bailouts (e.g. user cancelled) with exit 0
        # would be falsely reported as successful installations.
        post_update_to_api "done" "0" 2>/dev/null || true
      fi
    fi
  fi
--- a/misc/install.func
+++ b/misc/install.func
@@ -309,14 +309,14 @@ customize() {
  if [[ "$PASSWORD" == "" ]]; then
    msg_info "Customizing Container"
    GETTY_OVERRIDE="/etc/systemd/system/container-getty@1.service.d/override.conf"
-    mkdir -p $(dirname $GETTY_OVERRIDE)
+    mkdir -p "$(dirname "$GETTY_OVERRIDE")"
-    cat <<EOF >$GETTY_OVERRIDE
+    cat <<EOF >"$GETTY_OVERRIDE"
  [Service]
  ExecStart=
  ExecStart=-/sbin/agetty --autologin root --noclear --keep-baud tty%I 115200,38400,9600 \$TERM
 EOF
    systemctl daemon-reload
-    systemctl restart $(basename $(dirname $GETTY_OVERRIDE) | sed 's/\.d//')
+    systemctl restart "$(basename "$(dirname "$GETTY_OVERRIDE")" | sed 's/\.d//')"
    msg_ok "Customized Container"
  fi
  echo "bash -c \"\$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/${app}.sh)\"" >/usr/bin/update
--- a/misc/tools.func
+++ b/misc/tools.func
@@ -242,7 +242,7 @@ download_gpg_key() {
    # Process based on mode
    if [[ "$mode" == "dearmor" ]]; then
-      if gpg --dearmor --yes -o "$output" <"$temp_key" 2>/dev/null; then
+      if gpg --dearmor --yes -o "$output" <"$temp_key" 2>/dev/null && [[ -s "$output" ]]; then
        rm -f "$temp_key"
        debug_log "GPG key installed (dearmored): $output"
        return 0
@@ -5192,7 +5192,7 @@ _setup_gpu_permissions() {
    for nvidia_dev in /dev/nvidia*; do
      [[ -e "$nvidia_dev" ]] && {
        chgrp video "$nvidia_dev" 2>/dev/null || true
-        chmod 666 "$nvidia_dev" 2>/dev/null || true
+        chmod 660 "$nvidia_dev" 2>/dev/null || true
      }
    done
    if [[ -d /dev/nvidia-caps ]]; then
@@ -5200,7 +5200,7 @@ _setup_gpu_permissions() {
      for caps_dev in /dev/nvidia-caps/*; do
        [[ -e "$caps_dev" ]] && {
          chgrp video "$caps_dev" 2>/dev/null || true
-          chmod 666 "$caps_dev" 2>/dev/null || true
+          chmod 660 "$caps_dev" 2>/dev/null || true
        }
      done
    fi
@@ -5217,7 +5217,8 @@ _setup_gpu_permissions() {
  # /dev/kfd permissions (AMD ROCm)
  if [[ -e /dev/kfd ]]; then
-    chmod 666 /dev/kfd 2>/dev/null || true
+    chgrp render /dev/kfd 2>/dev/null || true
    chmod 660 /dev/kfd 2>/dev/null || true
    msg_info "AMD ROCm compute device configured"
  fi
--- a/misc/vm-core.func
+++ b/misc/vm-core.func
@@ -594,7 +594,7 @@ set_description() {
  DESCRIPTION=$(
    cat <<EOF
 <div align='center'>
-  <a href='https://community-scripts.com' target='_blank' rel='noopener noreferrer'>
+  <a href='https://Helper-Scripts.com' target='_blank' rel='noopener noreferrer'>
    <img src='https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/images/logo-81x112.png' alt='Logo' style='width:81px;height:112px;'/>
  </a>
--- a/tools/addon/all-templates.sh
+++ b/tools/addon/all-templates.sh
@@ -116,7 +116,7 @@ fi
 PCT_OPTIONS="
    -features keyctl=1,nesting=1
    -hostname $NAME
-    -tags community-script
+    -tags proxmox-helper-scripts
    -onboot 0
    -cores 2
    -memory 2048
--- a/tools/addon/copyparty.sh
+++ b/tools/addon/copyparty.sh
@@ -165,9 +165,9 @@ function install() {
  else
    read -rp "${TAB}Set admin username [admin]: " admin_user
    admin_user=${admin_user:-admin}
-    read -rsp "${TAB}Set admin password [community-scripts.com]: " admin_pass
+    read -rsp "${TAB}Set admin password [helper-scripts.com]: " admin_pass
    echo ""
-    admin_pass=${admin_pass:-community-scripts.com}
+    admin_pass=${admin_pass:-helper-scripts.com}
    msg_ok "Configured with admin user: ${admin_user}"
  fi
--- a/tools/addon/filebrowser-quantum.sh
+++ b/tools/addon/filebrowser-quantum.sh
@@ -201,9 +201,9 @@ server:
            - neverWatchPath: "/lost+found"
 auth:
  adminUsername: admin
-  adminPassword: community-scripts.com
+  adminPassword: helper-scripts.com
 EOF
-  msg_ok "Configured with default admin (admin / community-scripts.com)"
+  msg_ok "Configured with default admin (admin / helper-scripts.com)"
 fi
 msg_info "Creating service"
--- a/tools/addon/filebrowser.sh
+++ b/tools/addon/filebrowser.sh
@@ -140,8 +140,8 @@ if [[ "${install_prompt,,}" =~ ^(y|yes)$ ]]; then
    cd /usr/local/community-scripts
    filebrowser config init -a '0.0.0.0' -p "$PORT" -d "$DB_PATH" &>/dev/null
    filebrowser config set -a '0.0.0.0' -p "$PORT" -d "$DB_PATH" &>/dev/null
-    filebrowser users add admin community-scripts.com --perm.admin --database "$DB_PATH" &>/dev/null
+    filebrowser users add admin helper-scripts.com --perm.admin --database "$DB_PATH" &>/dev/null
-    msg_ok "Default authentication configured (admin:community-scripts.com)"
+    msg_ok "Default authentication configured (admin:helper-scripts.com)"
  fi
  msg_info "Creating service"
--- a/tools/addon/homebrew.sh
+++ b/tools/addon/homebrew.sh
@@ -0,0 +1,173 @@
 #!/usr/bin/env bash
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: MorganCSIT | MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://brew.sh | Github: https://github.com/Homebrew/brew
 if ! command -v curl &>/dev/null; then
  printf "\r\e[2K%b" '\033[93m Setup Source \033[m' >&2
  apt-get update >/dev/null 2>&1
  apt-get install -y curl >/dev/null 2>&1
 fi
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/core.func)
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/tools.func)
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/error_handler.func)
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/api.func) 2>/dev/null || true
 # Enable error handling
 set -Eeuo pipefail
 trap 'error_handler' ERR
 load_functions
 init_tool_telemetry "" "addon"
 # ==============================================================================
 # CONFIGURATION
 # ==============================================================================
 VERBOSE=${var_verbose:-no}
 APP="homebrew"
 APP_TYPE="tools"
 INSTALL_PATH="/home/linuxbrew/.linuxbrew"
 # ==============================================================================
 # OS DETECTION
 # ==============================================================================
 if [[ -f "/etc/alpine-release" ]]; then
  echo -e "${CROSS} Alpine is not supported by Homebrew. Exiting."
  exit 1
 elif grep -qE 'ID=debian|ID=ubuntu' /etc/os-release; then
  OS="Debian"
 else
  echo -e "${CROSS} Unsupported OS detected. Exiting."
  exit 1
 fi
 # ==============================================================================
 # UNINSTALL
 # ==============================================================================
 function uninstall() {
  msg_info "Uninstalling Homebrew"
  BREW_USER=$(awk -F: '$3 >= 1000 && $3 < 65534 { print $1; exit }' /etc/passwd)
  if [[ -n "$BREW_USER" ]]; then
    BREW_USER_HOME=$(getent passwd "$BREW_USER" | cut -d: -f6)
    for rc_file in "$BREW_USER_HOME/.bashrc" "$BREW_USER_HOME/.profile"; do
      if [[ -f "$rc_file" ]]; then
        sed -i '/# Homebrew (Linuxbrew)/,/^fi$/d' "$rc_file"
      fi
    done
  fi
  rm -rf /home/linuxbrew
  rm -f /etc/profile.d/homebrew.sh
  groupdel linuxbrew &>/dev/null || true
  msg_ok "Homebrew has been uninstalled"
 }
 # ==============================================================================
 # INSTALL
 # ==============================================================================
 function install() {
  msg_info "Detecting Non-Root User"
  BREW_USER=$(awk -F: '$3 >= 1000 && $3 < 65534 { print $1; exit }' /etc/passwd)
  if [[ -z "$BREW_USER" ]]; then
    msg_warn "No non-root user found (uid >= 1000). Homebrew cannot run as root."
    read -r -p "${TAB}Create a 'brew' user automatically? (y/N): " create_user_prompt
    if [[ "${create_user_prompt,,}" =~ ^(y|yes)$ ]]; then
      msg_info "Creating user 'brew'"
      useradd -m -s /bin/bash brew
      BREW_USER="brew"
      msg_ok "Created user 'brew'"
    else
      msg_error "Cannot install Homebrew without a non-root user. Exiting."
      exit 1
    fi
  fi
  msg_ok "Detected User: $BREW_USER"
  msg_info "Installing Dependencies"
  $STD apt update
  $STD apt install -y build-essential git file procps
  msg_ok "Installed Dependencies"
  msg_info "Setting Up Homebrew Prefix"
  export PATH="/usr/sbin:$PATH"
  groupadd -f linuxbrew
  mkdir -p /home/linuxbrew/.linuxbrew
  chown -R "$BREW_USER":linuxbrew /home/linuxbrew
  chmod 2775 /home/linuxbrew
  chmod 2775 /home/linuxbrew/.linuxbrew
  usermod -aG linuxbrew "$BREW_USER"
  msg_ok "Set Up Homebrew Prefix"
  msg_info "Installing Homebrew"
  $STD su - "$BREW_USER" -c 'NONINTERACTIVE=1 /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"'
  msg_ok "Installed Homebrew"
  msg_info "Configuring Shell Integration"
  cat <<'EOF' >/etc/profile.d/homebrew.sh
 #!/bin/bash
 if [ -d "/home/linuxbrew/.linuxbrew" ]; then
    eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
 fi
 EOF
  chmod +x /etc/profile.d/homebrew.sh
  BREW_USER_HOME=$(getent passwd "$BREW_USER" | cut -d: -f6)
  BREW_SHELL_BLOCK='\n# Homebrew (Linuxbrew)\nif [ -d "/home/linuxbrew/.linuxbrew" ]; then\n    eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"\nfi'
  for rc_file in "$BREW_USER_HOME/.bashrc" "$BREW_USER_HOME/.profile"; do
    if ! grep -q 'linuxbrew' "$rc_file" 2>/dev/null; then
      echo -e "$BREW_SHELL_BLOCK" >>"$rc_file"
    fi
  done
  msg_ok "Configured Shell Integration"
  msg_info "Verifying Installation"
  $STD su - "$BREW_USER" -c 'eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)" && brew --version'
  msg_ok "Homebrew Verified"
  echo ""
  msg_ok "Homebrew installed successfully"
  msg_ok "Ready for user: ${BL}${BREW_USER}${CL}"
  echo ""
  echo -e "${TAB}${INFO} Usage: Switch to the brew user with a login shell:"
  echo -e "${TAB}  ${BL}su - ${BREW_USER}${CL}"
  echo -e "${TAB}  Then run: ${BL}brew install <package>${CL}"
  echo -e "${TAB}  Update with: ${BL}brew update${CL}"
 }
 # ==============================================================================
 # MAIN
 # ==============================================================================
 header_info
 if [[ -d "$INSTALL_PATH" ]]; then
  msg_warn "Homebrew is already installed."
  echo ""
  read -r -p "${TAB}Uninstall Homebrew? (y/N): " uninstall_prompt
  if [[ "${uninstall_prompt,,}" =~ ^(y|yes)$ ]]; then
    uninstall
    exit 0
  fi
  msg_warn "No action selected. Exiting."
  exit 0
 fi
 # Fresh installation
 msg_warn "Homebrew is not installed."
 echo ""
 echo -e "${TAB}${INFO} This will install:"
 echo -e "${TAB}  - Homebrew (Linuxbrew) package manager"
 echo -e "${TAB}  - Shell integration for the detected non-root user"
 echo ""
 read -r -p "${TAB}Install Homebrew? (y/N): " install_prompt
 if [[ "${install_prompt,,}" =~ ^(y|yes)$ ]]; then
  install
 else
  msg_warn "Installation cancelled. Exiting."
  exit 0
 fi
--- a/tools/addon/runtipi.sh
+++ b/tools/addon/runtipi.sh
@@ -150,7 +150,7 @@ function install() {
  curl -fsSL "https://raw.githubusercontent.com/runtipi/runtipi/master/scripts/install.sh" -o "install.sh"
  chmod +x install.sh
  $STD ./install.sh
-  chmod 666 /opt/runtipi/state/settings.json 2>/dev/null || true
+  chmod 660 /opt/runtipi/state/settings.json 2>/dev/null || true
  rm -f /opt/install.sh
  msg_ok "Installed ${APP}"
--- a/turnkey/turnkey.sh
+++ b/turnkey/turnkey.sh
@@ -1,10 +1,23 @@
 #!/usr/bin/env bash
-# Copyright (c) 2021-2026 tteck
+# Copyright (c) 2021-2026 community-scripts ORG
 # Author: tteck (tteckster)
-# License: MIT
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-function header_info {
+# Source shared libraries
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/api.func)
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/core.func)
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/error_handler.func)
 load_functions
 catch_errors
 APP="TurnKey LXC"
 NSAPP="turnkey"
 DIAGNOSTICS="no"
 METHOD="default"
 RANDOM_UUID="$(cat /proc/sys/kernel/random/uuid)"
 EXECUTION_ID="${RANDOM_UUID}"
 header_info() {
  clear
  cat <<"EOF"
 ______              __ __           __   _  _______
@@ -15,281 +28,343 @@ function header_info {
 EOF
 }
-set -euo pipefail
+# Validate if a container ID is available (cluster-aware)
-shopt -s expand_aliases
+validate_container_id() {
 alias die='EXIT=$? LINE=$LINENO error_exit'
 trap die ERR
 function error_exit() {
  trap - ERR
  local DEFAULT='Unknown failure occured.'
  local REASON="\e[97m${1:-$DEFAULT}\e[39m"
  local FLAG="\e[91m[ERROR] \e[93m$EXIT@$LINE"
  msg "$FLAG $REASON" 1>&2
  [ ! -z ${CTID-} ] && cleanup_ctid
  exit $EXIT
 }
 function warn() {
  local REASON="\e[97m$1\e[39m"
  local FLAG="\e[93m[WARNING]\e[39m"
  msg "$FLAG $REASON"
 }
 function info() {
  local REASON="$1"
  local FLAG="\e[36m[INFO]\e[39m"
  msg "$FLAG $REASON"
 }
 function msg() {
  local TEXT="$1"
  echo -e "$TEXT"
 }
 function validate_container_id() {
  local ctid="$1"
-  # Check if ID is numeric
+  [[ "$ctid" =~ ^[0-9]+$ ]] || return 1
-  if ! [[ "$ctid" =~ ^[0-9]+$ ]]; then
+
-    return 1
+  # Cluster-wide check via pvesh
  if command -v pvesh &>/dev/null; then
    local cluster_ids
    cluster_ids=$(pvesh get /cluster/resources --type vm --output-format json 2>/dev/null |
      grep -oP '"vmid":\s*\K[0-9]+' 2>/dev/null || true)
    if [[ -n "$cluster_ids" ]] && echo "$cluster_ids" | grep -qw "$ctid"; then
      return 1
    fi
  fi
-  # Check if config file exists for VM or LXC
+
  # Local fallback
  if [[ -f "/etc/pve/qemu-server/${ctid}.conf" ]] || [[ -f "/etc/pve/lxc/${ctid}.conf" ]]; then
    return 1
  fi
-  # Check if ID is used in LVM logical volumes
+
  # Check all cluster nodes
  if [[ -d "/etc/pve/nodes" ]]; then
    for node_dir in /etc/pve/nodes/*/; do
      if [[ -f "${node_dir}qemu-server/${ctid}.conf" ]] || [[ -f "${node_dir}lxc/${ctid}.conf" ]]; then
        return 1
      fi
    done
  fi
  # Check LVM volumes
  if lvs --noheadings -o lv_name 2>/dev/null | grep -qE "(^|[-_])${ctid}($|[-_])"; then
    return 1
  fi
  return 0
 }
-function get_valid_container_id() {
+
-  local suggested_id="${1:-$(pvesh get /cluster/nextid)}"
+get_valid_container_id() {
  local suggested_id="${1:-$(pvesh get /cluster/nextid 2>/dev/null || echo 100)}"
  while ! validate_container_id "$suggested_id"; do
    suggested_id=$((suggested_id + 1))
  done
  echo "$suggested_id"
 }
-function cleanup_ctid() {
+
-  if pct status $CTID &>/dev/null; then
+cleanup_ctid() {
-    if [ "$(pct status $CTID | awk '{print $2}')" == "running" ]; then
+  if pct status "$CTID" &>/dev/null; then
-      pct stop $CTID
+    if [[ "$(pct status "$CTID" | awk '{print $2}')" == "running" ]]; then
      pct stop "$CTID"
    fi
-    pct destroy $CTID
+    pct destroy "$CTID"
  fi
 }
 select_storage() {
  local class="$1" content content_label
  case "$class" in
  container)
    content='rootdir'
    content_label='Container'
    ;;
  template)
    content='vztmpl'
    content_label='Container template'
    ;;
  *)
    msg_error "Invalid storage class '$class'"
    return 1
    ;;
  esac
  local -a MENU=()
  local MSG_MAX_LENGTH=0
  while read -r line; do
    local TAG TYPE FREE ITEM OFFSET=2
    TAG=$(echo "$line" | awk '{print $1}')
    TYPE=$(echo "$line" | awk '{printf "%-10s", $2}')
    FREE=$(echo "$line" | numfmt --field 4-6 --from-unit=K --to=iec --format %.2f | awk '{printf( "%9sB", $6)}')
    ITEM="  Type: $TYPE Free: $FREE "
    ((${#ITEM} + OFFSET > MSG_MAX_LENGTH)) && MSG_MAX_LENGTH=$((${#ITEM} + OFFSET))
    MENU+=("$TAG" "$ITEM" "OFF")
  done < <(pvesm status -content "$content" | awk 'NR>1')
  if [[ $((${#MENU[@]} / 3)) -eq 0 ]]; then
    msg_error "'$content_label' needs to be selected for at least one storage location."
    return 1
  elif [[ $((${#MENU[@]} / 3)) -eq 1 ]]; then
    printf '%s' "${MENU[0]}"
  else
    local STORAGE
    while [[ -z "${STORAGE:+x}" ]]; do
      STORAGE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "Storage Pools" --radiolist \
        "Which storage pool for the ${content_label,,}?\n\n" \
        16 $((MSG_MAX_LENGTH + 23)) 6 \
        "${MENU[@]}" 3>&1 1>&2 2>&3) || exit_script
    done
    printf '%s' "$STORAGE"
  fi
 }
 # ==============================================================================
 # MAIN
 # ==============================================================================
 # Cleanup on error: destroy container, report telemetry, and restart monitor
 turnkey_cleanup() {
  local exit_code=$?
  if [[ $exit_code -ne 0 ]]; then
    # Report failure to telemetry
    if [[ "${POST_TO_API_DONE:-}" == "true" && "${POST_UPDATE_DONE:-}" != "true" ]]; then
      post_update_to_api "failed" "$exit_code" 2>/dev/null || true
    fi
    # Destroy failed container
    if [[ -n "${CTID:-}" ]]; then
      cleanup_ctid 2>/dev/null || true
    fi
  fi
  if [[ -f /etc/systemd/system/ping-instances.service ]]; then
    systemctl start ping-instances.service 2>/dev/null || true
  fi
 }
 trap turnkey_cleanup EXIT
 # Stop Proxmox VE Monitor-All if running
 if systemctl is-active -q ping-instances.service; then
  systemctl stop ping-instances.service
 fi
 pve_check
 shell_check
 root_check
 # Read diagnostics preference (same logic as build.func diagnostics_check)
 DIAG_CONFIG="/usr/local/community-scripts/diagnostics"
 if [[ -f "$DIAG_CONFIG" ]]; then
  DIAGNOSTICS=$(awk -F '=' '/^DIAGNOSTICS/ {print $2}' "$DIAG_CONFIG") || true
  DIAGNOSTICS="${DIAGNOSTICS:-no}"
 fi
 header_info
-whiptail --backtitle "Proxmox VE Helper Scripts" --title "TurnKey LXCs" --yesno "This will allow for the creation of one of the many TurnKey LXC Containers. Proceed?" 10 68
+whiptail --backtitle "Proxmox VE Helper Scripts" --title "TurnKey LXCs" --yesno \
  "This will allow for the creation of one of the many TurnKey LXC Containers. Proceed?" 10 68 || exit_script
 # Update template catalog early so the menu reflects the latest available templates
 msg_info "Updating LXC template list"
 pveam update >/dev/null
 msg_ok "Updated LXC template list"
 # Build TurnKey selection menu dynamically from available templates
 declare -A TURNKEY_TEMPLATES
 TURNKEY_MENU=()
 MSG_MAX_LENGTH=0
-while read -r TAG ITEM; do
+while IFS=$'\t' read -r TEMPLATE_FILE TAG ITEM; do
  TURNKEY_TEMPLATES["$TAG"]="$TEMPLATE_FILE"
  OFFSET=2
-  ((${#ITEM} + OFFSET > MSG_MAX_LENGTH)) && MSG_MAX_LENGTH=${#ITEM}+OFFSET
+  ((${#ITEM} + OFFSET > MSG_MAX_LENGTH)) && MSG_MAX_LENGTH=$((${#ITEM} + OFFSET))
  TURNKEY_MENU+=("$TAG" "$ITEM " "OFF")
-done < <(
+done < <(pveam available -section turnkeylinux | awk '{
-  cat <<EOF
+  tpl = $2
-ansible Ansible
+  if (match(tpl, /debian-([0-9]+)-turnkey-([^_]+)_([^_]+)_/, m)) {
-bookstack BookStack
+    app = m[2]; deb = m[1]; ver = m[3]
-core Core
+    display = app
-faveo-helpdesk Faveo Helpdesk
+    gsub(/-/, " ", display)
-fileserver File Server
+    n = split(display, words, " ")
-gallery Gallery
+    display = ""
-gameserver Game Server
+    for (i = 1; i <= n; i++) {
-gitea Gitea
+      words[i] = toupper(substr(words[i], 1, 1)) substr(words[i], 2)
-gitlab GitLab
+      display = display (i > 1 ? " " : "") words[i]
-invoice-ninja Invoice Ninja
+    }
-mediaserver Media Server
+    tag = app "-" deb
-nextcloud Nextcloud
+    printf "%s\t%s\t%s | Debian %s | %s\n", tpl, tag, display, deb, ver
-observium Observium
+  }
-odoo Odoo
+}' | sort -t$'\t' -k2,2)
 openldap OpenLDAP
 openvpn OpenVPN
 owncloud ownCloud
 phpbb phpBB
 torrentserver Torrent Server
 wireguard WireGuard
 wordpress Wordpress
 zoneminder ZoneMinder
 EOF
 )
 turnkey=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "TurnKey LXCs" --radiolist "\nSelect a TurnKey LXC to create:\n" 16 $((MSG_MAX_LENGTH + 58)) 6 "${TURNKEY_MENU[@]}" 3>&1 1>&2 2>&3 | tr -d '"')
 [ -z "$turnkey" ] && {
  whiptail --backtitle "Proxmox VE Helper Scripts" --title "No TurnKey LXC Selected" --msgbox "It appears that no TurnKey LXC container was selected" 10 68
  msg "Done"
  exit
 }
-# Setup script environment
+if [[ ${#TURNKEY_MENU[@]} -eq 0 ]]; then
  msg_error "No TurnKey templates found. Check your internet connection or template repository."
  exit 1
 fi
 selected=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "TurnKey LXCs" --radiolist \
  "\nSelect a TurnKey LXC to create:\n" 20 $((MSG_MAX_LENGTH + 58)) 12 \
  "${TURNKEY_MENU[@]}" 3>&1 1>&2 2>&3 | tr -d '"') || exit_script
 if [[ -z "$selected" ]]; then
  whiptail --backtitle "Proxmox VE Helper Scripts" --title "No TurnKey LXC Selected" \
    --msgbox "It appears that no TurnKey LXC container was selected" 10 68
  exit_script
 fi
 # Extract template filename and app name from selection
 TEMPLATE="${TURNKEY_TEMPLATES[$selected]}"
 turnkey="${selected%-*}"
 # Generate random password
 PASS="$(openssl rand -base64 8)"
-# Prompt user to confirm container ID
+
 # Prompt for Container ID
 NEXT_ID=$(pvesh get /cluster/nextid 2>/dev/null || echo 100)
 while true; do
-  CTID=$(whiptail --backtitle "Container ID" --title "Choose the Container ID" --inputbox "Enter the container ID..." 8 40 $(pvesh get /cluster/nextid) 3>&1 1>&2 2>&3)
+  CTID=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "Container ID" \
    --inputbox "Enter the container ID..." 8 40 "$NEXT_ID" 3>&1 1>&2 2>&3) || exit_script
-  # Check if user cancelled
+  if [[ -z "$CTID" ]]; then
-  [ -z "$CTID" ] && die "No Container ID selected"
+    msg_error "No Container ID selected"
    exit_script
  fi
  # Validate Container ID
  if ! validate_container_id "$CTID"; then
    SUGGESTED_ID=$(get_valid_container_id "$CTID")
-    if whiptail --backtitle "Container ID" --title "ID Already In Use" --yesno "Container/VM ID $CTID is already in use.\n\nWould you like to use the next available ID ($SUGGESTED_ID)?" 10 58; then
+    if whiptail --backtitle "Proxmox VE Helper Scripts" --title "ID Already In Use" --yesno \
      "Container/VM ID $CTID is already in use.\n\nWould you like to use the next available ID ($SUGGESTED_ID)?" 10 58; then
      CTID="$SUGGESTED_ID"
      break
    fi
    # User declined, loop back to input
  else
    break
  fi
 done
-# Prompt user to confirm Hostname
+
-HOST_NAME=$(whiptail --backtitle "Hostname" --title "Choose the Hostname" --inputbox "Enter the containers Hostname..." 8 40 "turnkey-${turnkey}" 3>&1 1>&2 2>&3)
+# Prompt for Hostname
-PCT_OPTIONS="
+HOST_NAME=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "Hostname" \
-    -features keyctl=1,nesting=1
+  --inputbox "Enter the container hostname..." 8 40 "turnkey-${turnkey}" 3>&1 1>&2 2>&3) || exit_script
-    -hostname $HOST_NAME
+
-    -tags community-script
+# Container options
-    -onboot 1
+PCT_OPTIONS=(
-    -cores 2
+  -features keyctl=1,nesting=1
-    -memory 2048
+  -hostname "$HOST_NAME"
-    -password $PASS
+  -tags community-script
-    -net0 name=eth0,bridge=vmbr0,ip=dhcp
+  -onboot 1
-    -unprivileged 1
+  -cores 2
-  "
+  -memory 2048
-DEFAULT_PCT_OPTIONS=(
+  -password "$PASS"
-  -arch $(dpkg --print-architecture)
+  -net0 name=eth0,bridge=vmbr0,ip=dhcp
  -unprivileged 1
  -arch "$(dpkg --print-architecture)"
 )
-# Set the CONTENT and CONTENT_LABEL variables
+# Storage selection
-function select_storage() {
+TEMPLATE_STORAGE=$(select_storage template) || {
-  local CLASS=$1
+  msg_error "Failed to select template storage"
-  local CONTENT
+  exit 1
  local CONTENT_LABEL
  case $CLASS in
  container)
    CONTENT='rootdir'
    CONTENT_LABEL='Container'
    ;;
  template)
    CONTENT='vztmpl'
    CONTENT_LABEL='Container template'
    ;;
  *) false || die "Invalid storage class." ;;
  esac
  # Query all storage locations
  local -a MENU
  while read -r line; do
    local TAG=$(echo $line | awk '{print $1}')
    local TYPE=$(echo $line | awk '{printf "%-10s", $2}')
    local FREE=$(echo $line | numfmt --field 4-6 --from-unit=K --to=iec --format %.2f | awk '{printf( "%9sB", $6)}')
    local ITEM="  Type: $TYPE Free: $FREE "
    local OFFSET=2
    if [[ $((${#ITEM} + $OFFSET)) -gt ${MSG_MAX_LENGTH:-} ]]; then
      local MSG_MAX_LENGTH=$((${#ITEM} + $OFFSET))
    fi
    MENU+=("$TAG" "$ITEM" "OFF")
  done < <(pvesm status -content $CONTENT | awk 'NR>1')
  # Select storage location
  if [ $((${#MENU[@]} / 3)) -eq 0 ]; then
    warn "'$CONTENT_LABEL' needs to be selected for at least one storage location."
    die "Unable to detect valid storage location."
  elif [ $((${#MENU[@]} / 3)) -eq 1 ]; then
    printf ${MENU[0]}
  else
    local STORAGE
    while [ -z "${STORAGE:+x}" ]; do
      STORAGE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "Storage Pools" --radiolist \
        "Which storage pool would you like to use for the ${CONTENT_LABEL,,}?\n\n" \
        16 $(($MSG_MAX_LENGTH + 23)) 6 \
        "${MENU[@]}" 3>&1 1>&2 2>&3) || die "Menu aborted."
    done
    printf $STORAGE
  fi
 }
 msg_ok "Using '${BL}${TEMPLATE_STORAGE}${CL}' for template storage"
-# Get template storage
+CONTAINER_STORAGE=$(select_storage container) || {
-TEMPLATE_STORAGE=$(select_storage template)
+  msg_error "Failed to select container storage"
-info "Using '$TEMPLATE_STORAGE' for template storage."
+  exit 1
 }
 msg_ok "Using '${BL}${CONTAINER_STORAGE}${CL}' for container storage"
-# Get container storage
+# Download template if not already cached
-CONTAINER_STORAGE=$(select_storage container)
+if ! pveam list "$TEMPLATE_STORAGE" | grep -q "$TEMPLATE"; then
-info "Using '$CONTAINER_STORAGE' for container storage."
+  msg_info "Downloading LXC template"
-
+  pveam download "$TEMPLATE_STORAGE" "$TEMPLATE" >/dev/null || {
-# Update LXC template list
+    msg_error "Failed to download LXC template '${TEMPLATE}'"
-msg "Updating LXC template list..."
+    exit 1
-pveam update >/dev/null
+  }
-
+  msg_ok "Downloaded LXC template"
 # Get LXC template string
 mapfile -t TEMPLATES < <(pveam available -section turnkeylinux | awk -v turnkey="${turnkey}" '$0 ~ turnkey {print $2}' | sort -t - -k 2 -V)
 [ ${#TEMPLATES[@]} -gt 0 ] || die "Unable to find a template when searching for '${turnkey}'."
 TEMPLATE="${TEMPLATES[-1]}"
 # Download LXC template
 if ! pveam list $TEMPLATE_STORAGE | grep -q $TEMPLATE; then
  msg "Downloading LXC template (Patience)..."
  pveam download $TEMPLATE_STORAGE $TEMPLATE >/dev/null ||
    die "A problem occured while downloading the LXC template."
 fi
-# Create variable for 'pct' options
+# Add rootfs if not specified
-PCT_OPTIONS=(${PCT_OPTIONS[@]:-${DEFAULT_PCT_OPTIONS[@]}})
+[[ " ${PCT_OPTIONS[*]} " =~ " -rootfs " ]] || PCT_OPTIONS+=(-rootfs "${CONTAINER_STORAGE}:${PCT_DISK_SIZE:-8}")
 [[ " ${PCT_OPTIONS[@]} " =~ " -rootfs " ]] || PCT_OPTIONS+=(-rootfs $CONTAINER_STORAGE:${PCT_DISK_SIZE:-8})
-# Create LXC
+# Set telemetry variables for the selected turnkey
-msg "Creating LXC container..."
+TELEMETRY_TYPE="turnkey"
-pct create $CTID ${TEMPLATE_STORAGE}:vztmpl/${TEMPLATE} ${PCT_OPTIONS[@]} >/dev/null ||
+NSAPP="turnkey-${turnkey}"
-  die "A problem occured while trying to create container."
+CT_TYPE=1
 DISK_SIZE="${PCT_DISK_SIZE:-8}"
 CORE_COUNT=2
 RAM_SIZE=2048
 var_os="turnkey"
 var_version="${turnkey}"
-# Save password
+# Report installation start to telemetry
-echo "TurnKey ${turnkey} password: ${PASS}" >>~/turnkey-${turnkey}.creds # file is located in the Proxmox root directory
+post_to_api
-# If turnkey is "OpenVPN", add access to the tun device
+# Create LXC container
-TUN_DEVICE_REQUIRED=("openvpn") # Setup this way in case future turnkeys also need tun access
+msg_info "Creating LXC container"
 pct create "$CTID" "${TEMPLATE_STORAGE}:vztmpl/${TEMPLATE}" "${PCT_OPTIONS[@]}" >/dev/null || {
  msg_error "Failed to create container"
  exit 1
 }
 msg_ok "Created LXC container (ID: ${BL}${CTID}${CL})"
 # Save credentials securely
 CREDS_FILE=~/turnkey-${turnkey}.creds
 echo "TurnKey ${turnkey} password: ${PASS}" >>"$CREDS_FILE"
 chmod 600 "$CREDS_FILE"
 # Configure TUN device access for VPN-based turnkeys
 TUN_DEVICE_REQUIRED=("openvpn")
 if printf '%s\n' "${TUN_DEVICE_REQUIRED[@]}" | grep -qw "${turnkey}"; then
-  info "${turnkey} requires access to /dev/net/tun on the host. Modifying the container configuration to allow this."
+  msg_info "Configuring TUN device access for ${turnkey}"
-  echo "lxc.cgroup2.devices.allow: c 10:200 rwm" >>/etc/pve/lxc/${CTID}.conf
+  {
-  echo "lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file 0 0" >>/etc/pve/lxc/${CTID}.conf
+    echo "lxc.cgroup2.devices.allow: c 10:200 rwm"
    echo "lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file 0 0"
  } >>"/etc/pve/lxc/${CTID}.conf"
  msg_ok "TUN device access configured"
  sleep 5
 fi
 # Start container
-msg "Starting LXC Container..."
+msg_info "Starting LXC container"
 pct start "$CTID"
 msg_ok "Started LXC container"
 sleep 10
-# Get container IP
+# Detect container IP
-set +euo pipefail # Turn off error checking
+msg_info "Detecting IP address"
 max_attempts=5
 attempt=1
 IP=""
-while [[ $attempt -le $max_attempts ]]; do
+for attempt in $(seq 1 5); do
-  IP=$(pct exec $CTID ip a show dev eth0 | grep -oP 'inet \K[^/]+')
+  IP=$(pct exec "$CTID" -- ip -4 a show dev eth0 2>/dev/null | grep -oP 'inet \K[^/]+' || true)
-  if [[ -n $IP ]]; then
+  if [[ -n "$IP" ]]; then
    break
  else
    warn "Attempt $attempt: IP address not found. Pausing for 5 seconds..."
    sleep 5
    ((attempt++))
  fi
  [[ $attempt -lt 5 ]] && sleep 5
 done
-if [[ -z $IP ]]; then
+if [[ -z "$IP" ]]; then
-  warn "Maximum number of attempts reached. IP address not found."
+  msg_warn "IP address not found after 5 attempts"
  IP="NOT FOUND"
 else
  msg_ok "IP address: ${BL}${IP}${CL}"
 fi
-# Start Proxmox VE Monitor-All if available
+# Report success to telemetry
-if [[ -f /etc/systemd/system/ping-instances.service ]]; then
+post_update_to_api "done" "none"
  systemctl start ping-instances.service
 fi
-# Success message
+# Success summary
 header_info
 echo
-info "LXC container '$CTID' was successfully created, and its IP address is ${IP}."
+msg_ok "TurnKey ${BL}${turnkey}${CL} LXC container '${BL}${CTID}${CL}' was successfully created."
 echo
-info "Proceed to the LXC console to complete the setup."
+echo -e "  ${TAB}${YW}IP Address:${CL}  ${BL}${IP}${CL}"
 echo -e "  ${TAB}${YW}Login:${CL}       ${GN}root${CL}"
 echo -e "  ${TAB}${YW}Password:${CL}    ${GN}${PASS}${CL}"
 echo
-info "login: root"
+echo -e "  ${TAB}Proceed to the LXC console to complete the TurnKey setup."
-info "password: $PASS"
+echo -e "  ${TAB}Credentials stored in: ${BL}~/turnkey-${turnkey}.creds${CL}"
 info "(credentials also stored in the root user's root directory in the 'turnkey-${turnkey}.creds' file.)"
 echo
--- a/vm/archlinux-vm.sh
+++ b/vm/archlinux-vm.sh
@@ -551,7 +551,7 @@ qm set $VMID \
 DESCRIPTION=$(
  cat <<EOF
 <div align='center'>
-  <a href='https://community-scripts.com' target='_blank' rel='noopener noreferrer'>
+  <a href='https://Helper-Scripts.com' target='_blank' rel='noopener noreferrer'>
    <img src='https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/images/logo-81x112.png' alt='Logo' style='width:81px;height:112px;'/>
  </a>
--- a/vm/debian-13-vm.sh
+++ b/vm/debian-13-vm.sh
@@ -631,7 +631,7 @@ rm -f "$WORK_FILE"
 DESCRIPTION=$(
  cat <<EOF
 <div align='center'>
-  <a href='https://community-scripts.com' target='_blank' rel='noopener noreferrer'>
+  <a href='https://Helper-Scripts.com' target='_blank' rel='noopener noreferrer'>
    <img src='https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/images/logo-81x112.png' alt='Logo' style='width:81px;height:112px;'/>
  </a>
--- a/vm/debian-vm.sh
+++ b/vm/debian-vm.sh
@@ -568,7 +568,7 @@ fi
 DESCRIPTION=$(
  cat <<EOF
 <div align='center'>
-  <a href='https://community-scripts.com' target='_blank' rel='noopener noreferrer'>
+  <a href='https://Helper-Scripts.com' target='_blank' rel='noopener noreferrer'>
    <img src='https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/images/logo-81x112.png' alt='Logo' style='width:81px;height:112px;'/>
  </a>
--- a/vm/haos-vm.sh
+++ b/vm/haos-vm.sh
@@ -639,7 +639,7 @@ msg_ok "Resized disk"
 DESCRIPTION=$(
  cat <<EOF
 <div align='center'>
-  <a href='https://community-scripts.com' target='_blank' rel='noopener noreferrer'>
+  <a href='https://Helper-Scripts.com' target='_blank' rel='noopener noreferrer'>
    <img src='https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/images/logo-81x112.png' alt='Logo' style='width:81px;height:112px;'/>
  </a>
--- a/vm/mikrotik-routeros.sh
+++ b/vm/mikrotik-routeros.sh
@@ -622,7 +622,7 @@ qm set $VMID \
 DESCRIPTION=$(
  cat <<EOF
 <div align='center'>
-  <a href='https://community-scripts.com' target='_blank' rel='noopener noreferrer'>
+  <a href='https://Helper-Scripts.com' target='_blank' rel='noopener noreferrer'>
    <img src='https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/images/logo-81x112.png' alt='Logo' style='width:81px;height:112px;'/>
  </a>
--- a/vm/nextcloud-vm.sh
+++ b/vm/nextcloud-vm.sh
@@ -546,7 +546,7 @@ qm set $VMID \
 DESCRIPTION=$(
  cat <<EOF
 <div align='center'>
-  <a href='https://community-scripts.com' target='_blank' rel='noopener noreferrer'>
+  <a href='https://Helper-Scripts.com' target='_blank' rel='noopener noreferrer'>
    <img src='https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/images/logo-81x112.png' alt='Logo' style='width:81px;height:112px;'/>
  </a>
--- a/vm/openwrt-vm.sh
+++ b/vm/openwrt-vm.sh
@@ -605,7 +605,7 @@ msg_ok "Resized disk to ${DISK_SIZE}"
 DESCRIPTION=$(
  cat <<EOF
 <div align='center'>
-  <a href='https://community-scripts.com' target='_blank' rel='noopener noreferrer'>
+  <a href='https://Helper-Scripts.com' target='_blank' rel='noopener noreferrer'>
    <img src='https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/images/logo-81x112.png' alt='Logo' style='width:81px;height:112px;'/>
  </a>
--- a/vm/opnsense-vm.sh
+++ b/vm/opnsense-vm.sh
@@ -737,7 +737,7 @@ done
 msg_info "Creating a OPNsense VM"
 qm create $VMID -agent 1${MACHINE} -tablet 0 -localtime 1 -bios ovmf${CPU_TYPE} -cores $CORE_COUNT -memory $RAM_SIZE \
-  -name $HN -tags community-script -net0 virtio,bridge=$BRG,macaddr=$MAC$VLAN$MTU -onboot 1 -ostype l26 -scsihw virtio-scsi-pci
+  -name $HN -tags proxmox-helper-scripts -net0 virtio,bridge=$BRG,macaddr=$MAC$VLAN$MTU -onboot 1 -ostype l26 -scsihw virtio-scsi-pci
 pvesm alloc $STORAGE $VMID $DISK0 4M 1>&/dev/null
 qm importdisk $VMID ${FILE} $STORAGE ${DISK_IMPORT:-} 1>&/dev/null
 qm set $VMID \
@@ -750,7 +750,7 @@ qm resize $VMID scsi0 20G >/dev/null
 DESCRIPTION=$(
  cat <<EOF
 <div align='center'>
-  <a href='https://community-scripts.com' target='_blank' rel='noopener noreferrer'>
+  <a href='https://Helper-Scripts.com' target='_blank' rel='noopener noreferrer'>
    <img src='https://raw.githubusercontent.com/michelroegl-brunner/ProxmoxVE/refs/heads/develop/misc/images/logo-81x112.png' alt='Logo' style='width:81px;height:112px;'/>
  </a>
--- a/vm/owncloud-vm.sh
+++ b/vm/owncloud-vm.sh
@@ -560,7 +560,7 @@ qm set $VMID \
 DESCRIPTION=$(
  cat <<EOF
 <div align='center'>
-  <a href='https://community-scripts.com' target='_blank' rel='noopener noreferrer'>
+  <a href='https://Helper-Scripts.com' target='_blank' rel='noopener noreferrer'>
    <img src='https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/images/logo-81x112.png' alt='Logo' style='width:81px;height:112px;'/>
  </a>
--- a/vm/pimox-haos-vm.sh
+++ b/vm/pimox-haos-vm.sh
@@ -462,7 +462,7 @@ qm set $VMID \
 DESCRIPTION=$(
  cat <<EOF
 <div align='center'>
-  <a href='https://community-scripts.com' target='_blank' rel='noopener noreferrer'>
+  <a href='https://Helper-Scripts.com' target='_blank' rel='noopener noreferrer'>
    <img src='https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/images/logo-81x112.png' alt='Logo' style='width:81px;height:112px;'/>
  </a>
--- a/vm/truenas-vm.sh
+++ b/vm/truenas-vm.sh
@@ -610,7 +610,7 @@ fi
 DESCRIPTION=$(
  cat <<EOF
 <div align='center'>
-  <a href='https://community-scripts.com' target='_blank' rel='noopener noreferrer'>
+  <a href='https://Helper-Scripts.com' target='_blank' rel='noopener noreferrer'>
    <img src='https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/images/logo-81x112.png' alt='Logo' style='width:81px;height:112px;'/>
  </a>
--- a/vm/ubuntu2204-vm.sh
+++ b/vm/ubuntu2204-vm.sh
@@ -542,7 +542,7 @@ qm set $VMID \
 DESCRIPTION=$(
  cat <<EOF
 <div align='center'>
-  <a href='https://community-scripts.com' target='_blank' rel='noopener noreferrer'>
+  <a href='https://Helper-Scripts.com' target='_blank' rel='noopener noreferrer'>
    <img src='https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/images/logo-81x112.png' alt='Logo' style='width:81px;height:112px;'/>
  </a>
--- a/vm/ubuntu2404-vm.sh
+++ b/vm/ubuntu2404-vm.sh
@@ -544,7 +544,7 @@ qm set $VMID \
 DESCRIPTION=$(
  cat <<EOF
 <div align='center'>
-  <a href='https://community-scripts.com' target='_blank' rel='noopener noreferrer'>
+  <a href='https://Helper-Scripts.com' target='_blank' rel='noopener noreferrer'>
    <img src='https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/images/logo-81x112.png' alt='Logo' style='width:81px;height:112px;'/>
  </a>
--- a/vm/ubuntu2504-vm.sh
+++ b/vm/ubuntu2504-vm.sh
@@ -543,7 +543,7 @@ qm set $VMID \
 DESCRIPTION=$(
  cat <<EOF
 <div align='center'>
-  <a href='https://community-scripts.com' target='_blank' rel='noopener noreferrer'>
+  <a href='https://Helper-Scripts.com' target='_blank' rel='noopener noreferrer'>
    <img src='https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/images/logo-81x112.png' alt='Logo' style='width:81px;height:112px;'/>
  </a>
--- a/vm/umbrel-os-vm.sh
+++ b/vm/umbrel-os-vm.sh
@@ -590,7 +590,7 @@ qm resize $VMID scsi0 ${DISK_SIZE} >/dev/null
 DESCRIPTION=$(
  cat <<EOF
 <div align='center'>
-  <a href='https://community-scripts.com' target='_blank' rel='noopener noreferrer'>
+  <a href='https://Helper-Scripts.com' target='_blank' rel='noopener noreferrer'>
    <img src='https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/images/logo-81x112.png' alt='Logo' style='width:81px;height:112px;'/>
  </a>
Author	SHA1	Message	Date
community-scripts-pr-app[bot]	d1d786cbc7	Update CHANGELOG.md (#13259 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-03-24 14:54:30 +00:00
CanbiZ (MickLesk)	1c3c223e51	Turnkey: modernize turnkey.sh with shared libraries (#13242 ) * refactor(turnkey): modernize turnkey.sh with shared libraries and telemetry - Source core.func, error_handler.func, api.func instead of custom error/msg functions - Replace custom error_exit/warn/info/msg with msg_info/msg_ok/msg_error/msg_warn - Upgrade validate_container_id to cluster-aware (pvesh + all-node config check) - Add diagnostics_check() and telemetry (post_to_api / post_update_to_api) - Add pve_check, shell_check, root_check for environment validation - Use proper EXIT trap for cleanup (destroy container on error, restart monitor) - Improve quoting throughout (PCT_OPTIONS as array, quoted variables) - Secure credentials file with chmod 600 - Use exit_script for user cancellations (consistent with other scripts) * fix(turnkey): replace diagnostics_check with inline config read diagnostics_check() is defined in build.func which is not sourced. Read the diagnostics config file directly instead — respects existing user preference without prompting (turnkey has no settings menu). * bump hardcoded names to dynamic list * Preserve telemetry type and report failures Respect a pre-set TELEMETRY_TYPE in misc/api.func and use it in the API payload instead of the hardcoded "lxc". In turnkey/turnkey.sh, set TELEMETRY_TYPE="turnkey" for turnkey installs and enhance turnkey_cleanup() to report failed installs to telemetry (calls post_update_to_api "failed" with the exit code when POST_TO_API_DONE is true and POST_UPDATE_DONE is not), then destroy the failed container. These changes ensure correct telemetry type propagation and that failed turnkey deployments are reported. --------- Co-authored-by: Slaviša Arežina <58952836+tremor021@users.noreply.github.com>	2026-03-24 15:54:01 +01:00
CanbiZ (MickLesk)	0980a85021	qf typo	2026-03-24 15:10:33 +01:00
community-scripts-pr-app[bot]	81547bb7a1	Update CHANGELOG.md (#13255 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-03-24 10:51:59 +00:00
push-app-to-main[bot]	c62e1ba882	Homebrew (Addon) (#13249 ) Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com> Co-authored-by: CanbiZ (MickLesk) <47820557+MickLesk@users.noreply.github.com>	2026-03-24 11:51:35 +01:00
community-scripts-pr-app[bot]	201a26a19e	Update .app files (#13254 ) Co-authored-by: GitHub Actions <github-actions[bot]@users.noreply.github.com>	2026-03-24 11:51:32 +01:00
community-scripts-pr-app[bot]	1dda554e40	Update CHANGELOG.md (#13253 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-03-24 10:49:32 +00:00
push-app-to-main[bot]	6b1b255ff6	NextExplorer (#13252 ) Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com>	2026-03-24 11:49:03 +01:00
community-scripts-pr-app[bot]	5d2fea107d	Update CHANGELOG.md (#13250 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-03-24 08:58:07 +00:00
CanbiZ (MickLesk)	86c658909a	Classify exit-1 errors & guard telemetry Analyze logs for generic exit code 1 and export an ERROR_CATEGORY_OVERRIDE so telemetry receives a more accurate error category (apt, oom, network, storage, dependency). Preserve any existing TELEMETRY_TYPE when posting updates. Add defense-in-depth by disabling strict error traps before running grep/sed log analysis to avoid spurious error_handler invocations. Mark successful installs with INSTALL_COMPLETE and update the error handler to only report a successful "done" telemetry state when INSTALL_COMPLETE is explicitly set, preventing false-positive success reports from early zero-exit exits.	2026-03-24 09:57:43 +01:00
community-scripts-pr-app[bot]	9aa0390553	Update CHANGELOG.md (#13245 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-03-23 21:22:47 +00:00
CanbiZ (MickLesk)	c8606e9fcc	core: harden shell scripts against injection and insecure permissions (#13239 )	2026-03-23 22:22:23 +01:00