VMs: pass the machine type, CPU, disk cache and discard settings to qm

MikroTik RouterOS asked for machine type, CPU model and disk cache and used none of them, nor its discard/ssd flags. HAOS and TrueNAS dropped the chosen disk cache, UniFi OS Server the discard/ssd flags. Fixes #18211
Update CHANGELOG.md (#18231 )
2026-10-26 23:45:13 +01:00 · 2026-10-26 10:29:29 +01:00 · 2026-10-26 09:08:50 +00:00 · 2026-10-26 10:08:20 +01:00 · 2026-10-26 08:18:52 +00:00 · 2026-10-26 09:18:22 +01:00
155 changed files with 2740 additions and 1196 deletions
@@ -1,3 +1,171 @@
+## 2026-10-24
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - patchmon: avoids systemd environment secret leaks via D-Bus/subprocesses. [@rhclayto](https://github.com/rhclayto) ([#18074](https://github.com/community-scripts/ProxmoxVE/pull/18074))
+    - fix: Linkwarden - clear Yarn berry cache after install and update- #18115 [@bferd](https://github.com/bferd) ([#18116](https://github.com/community-scripts/ProxmoxVE/pull/18116))
+    - Borg-UI: recreate the borg venvs with --clear [@MickLesk](https://github.com/MickLesk) ([#18118](https://github.com/community-scripts/ProxmoxVE/pull/18118))
+    - SnapOtter: recreate the AI venv with --clear [@MickLesk](https://github.com/MickLesk) ([#18119](https://github.com/community-scripts/ProxmoxVE/pull/18119))
+    - Update authentik version to 2026.8.5 [@thieneret](https://github.com/thieneret) ([#18125](https://github.com/community-scripts/ProxmoxVE/pull/18125))
+
+  - #### ✨ New Features
+
+    - Frigate: bump to v0.18.2 [@MickLesk](https://github.com/MickLesk) ([#18120](https://github.com/community-scripts/ProxmoxVE/pull/18120))
+
+  - #### 🔧 Refactor
+
+    - install: answer every prompt from the environment, survive a closed stdin [@MickLesk](https://github.com/MickLesk) ([#18121](https://github.com/community-scripts/ProxmoxVE/pull/18121))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - fix(addons): use catch_errors so the update marker is cleared [@mazelado](https://github.com/mazelado) ([#18128](https://github.com/community-scripts/ProxmoxVE/pull/18128))
+
+## 2026-10-23
+
+### 🚀 Updated Scripts
+
+  - postgresql: default the version prompt and match Alpine's packages [@MickLesk](https://github.com/MickLesk) ([#18093](https://github.com/community-scripts/ProxmoxVE/pull/18093))
+- Storyteller: build the runtime like upstream's Dockerfile [@MickLesk](https://github.com/MickLesk) ([#18083](https://github.com/community-scripts/ProxmoxVE/pull/18083))
+
+  - #### 🐞 Bug Fixes
+
+    - proxcenter: skip the type check and lower the build heap [@MickLesk](https://github.com/MickLesk) ([#18090](https://github.com/community-scripts/ProxmoxVE/pull/18090))
+    - hermesagent: retry the installer download, fall back to GitHub [@MickLesk](https://github.com/MickLesk) ([#18091](https://github.com/community-scripts/ProxmoxVE/pull/18091))
+    - zabbix: use the arm64 repository for 7.0 [@MickLesk](https://github.com/MickLesk) ([#18089](https://github.com/community-scripts/ProxmoxVE/pull/18089))
+    - kasm: survive a failed release lookup and answer the installer with flags [@MickLesk](https://github.com/MickLesk) ([#18092](https://github.com/community-scripts/ProxmoxVE/pull/18092))
+
+  - #### ✨ New Features
+
+    - InvoiceShelf: run the Laravel scheduler [@MickLesk](https://github.com/MickLesk) ([#18079](https://github.com/community-scripts/ProxmoxVE/pull/18079))
+
+  - #### 🔧 Refactor
+
+    - podman-homeassistant: require Debian 13 [@MickLesk](https://github.com/MickLesk) ([#18095](https://github.com/community-scripts/ProxmoxVE/pull/18095))
+    - apache-guacamole: require Debian 13 [@MickLesk](https://github.com/MickLesk) ([#18094](https://github.com/community-scripts/ProxmoxVE/pull/18094))
+    - unifi-os-server: require Debian 13 [@MickLesk](https://github.com/MickLesk) ([#18096](https://github.com/community-scripts/ProxmoxVE/pull/18096))
+    - openwebui: drop the Intel oneAPI Base Toolkit [@MickLesk](https://github.com/MickLesk) ([#18098](https://github.com/community-scripts/ProxmoxVE/pull/18098))
+    - ollama: drop the Intel oneAPI Base Toolkit [@MickLesk](https://github.com/MickLesk) ([#18097](https://github.com/community-scripts/ProxmoxVE/pull/18097))
+    - tdarr: do not let a failed or slow updater block the service start [@MickLesk](https://github.com/MickLesk) ([#18100](https://github.com/community-scripts/ProxmoxVE/pull/18100))
+    - immich: install mise from its GitHub release, retry jellyfin-ffmpeg, default the ML prompt [@MickLesk](https://github.com/MickLesk) ([#18099](https://github.com/community-scripts/ProxmoxVE/pull/18099))
+    - Refactor: pimox-haos-vm [@MickLesk](https://github.com/MickLesk) ([#18077](https://github.com/community-scripts/ProxmoxVE/pull/18077))
+
+### 💾 Core
+
+  - Telemetry: explain and categorize by the command that failed [@MickLesk](https://github.com/MickLesk) ([core#166](https://github.com/community-scripts/core/pull/166))
+- error-handler: report a handled silent failure only on its own line [@MickLesk](https://github.com/MickLesk) ([core#165](https://github.com/community-scripts/core/pull/165))
+- VM silent: return the failure instead of exiting [@MickLesk](https://github.com/MickLesk) ([core#164](https://github.com/community-scripts/core/pull/164))
+- error-handler: keep the start explanation and the final IP lookup from failing the run [@MickLesk](https://github.com/MickLesk) ([core#163](https://github.com/community-scripts/core/pull/163))
+- error output: report a failure inside a subshell once [@MickLesk](https://github.com/MickLesk) ([core#162](https://github.com/community-scripts/core/pull/162))
+- general: allow Composer as root in every script [@MickLesk](https://github.com/MickLesk) ([core#161](https://github.com/community-scripts/core/pull/161))
+- lxc-updater: skip the resource check when the container cannot read its RAM [@MickLesk](https://github.com/MickLesk) ([core#160](https://github.com/community-scripts/core/pull/160))
+- vm-core: let vm_timezone_default survive a host without /etc/timezone [@MickLesk](https://github.com/MickLesk) ([core#159](https://github.com/community-scripts/core/pull/159))
+
+## 2026-10-22
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Zabbix: keep unattended updates on the installed series [@florianpunz](https://github.com/florianpunz) ([#18051](https://github.com/community-scripts/ProxmoxVE/pull/18051))
+
+  - #### 🔧 Refactor
+
+    - Refactor: Cryptpad [@MickLesk](https://github.com/MickLesk) ([#18065](https://github.com/community-scripts/ProxmoxVE/pull/18065))
+
+### 💾 Core
+
+  - Incus: drive a remote Incus server from the client's default remote [@MickLesk](https://github.com/MickLesk) ([core#154](https://github.com/community-scripts/core/pull/154))
+- Deploy the release again when an update is redone [@MickLesk](https://github.com/MickLesk) ([core#158](https://github.com/community-scripts/core/pull/158))
+
+### ❔ Uncategorized
+
+  - chore(ct): sync sparkyfitness defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18061](https://github.com/community-scripts/ProxmoxVE/pull/18061))
+
+## 2026-10-21
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Immich: bump release version to v3.3.5 (CVE) [@CerberusStyle](https://github.com/CerberusStyle) ([#18057](https://github.com/community-scripts/ProxmoxVE/pull/18057))
+    - DroppedNeedle: pass release version to the app via COMMIT_TAG [@MickLesk](https://github.com/MickLesk) ([#18042](https://github.com/community-scripts/ProxmoxVE/pull/18042))
+
+### 💾 Core
+
+  - Keep the version an update started from across a redo [@MickLesk](https://github.com/MickLesk) ([core#156](https://github.com/community-scripts/core/pull/156))
+- Redo an update whose run did not finish after the deploy [@MickLesk](https://github.com/MickLesk) ([core#155](https://github.com/community-scripts/core/pull/155))
+
+## 2026-10-20
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Plane: give Silo its own HOME [@MickLesk](https://github.com/MickLesk) ([#18028](https://github.com/community-scripts/ProxmoxVE/pull/18028))
+    - Immich: Pin version to 3.3.4 [@vhsdream](https://github.com/vhsdream) ([#18036](https://github.com/community-scripts/ProxmoxVE/pull/18036))
+    - InvenTree: run apt under systemd so postinst can finish [@MickLesk](https://github.com/MickLesk) ([#18029](https://github.com/community-scripts/ProxmoxVE/pull/18029))
+    - Profilarr: pass the deno pin as the version [@MickLesk](https://github.com/MickLesk) ([#18025](https://github.com/community-scripts/ProxmoxVE/pull/18025))
+    - Silo: keep the version file out of ~/.silo [@MickLesk](https://github.com/MickLesk) ([#18030](https://github.com/community-scripts/ProxmoxVE/pull/18030))
+    - InvenTree: move to go.packager.io [@MickLesk](https://github.com/MickLesk) ([#18015](https://github.com/community-scripts/ProxmoxVE/pull/18015))
+    - Zitadel: run init and setup in the foreground [@MickLesk](https://github.com/MickLesk) ([#18016](https://github.com/community-scripts/ProxmoxVE/pull/18016))
+
+  - #### ✨ New Features
+
+    - Zitadel: Support v1 and v2 Login [@MickLesk](https://github.com/MickLesk) ([#18031](https://github.com/community-scripts/ProxmoxVE/pull/18031))
+
+  - #### 🔧 Refactor
+
+    - Refactor: OpenWebUI (remove numba pin)  [@MickLesk](https://github.com/MickLesk) ([#18026](https://github.com/community-scripts/ProxmoxVE/pull/18026))
+
+### 💾 Core
+
+  - Only treat an NVIDIA GPU as present when its device nodes are [@MickLesk](https://github.com/MickLesk) ([core#153](https://github.com/community-scripts/core/pull/153))
+
+## 2026-10-19
+
+### 🆕 New Scripts
+
+  - Calagopus ([#18012](https://github.com/community-scripts/ProxmoxVE/pull/18012))
+- Netronome ([#18011](https://github.com/community-scripts/ProxmoxVE/pull/18011))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - immich: record library revisions when the line is missing [@mazelado](https://github.com/mazelado) ([#17990](https://github.com/community-scripts/ProxmoxVE/pull/17990))
+    - Update authentik 2026.8.4 [@thieneret](https://github.com/thieneret) ([#18004](https://github.com/community-scripts/ProxmoxVE/pull/18004))
+
+  - #### ✨ New Features
+
+    - feat(mealie): add reverse proxy auth settings to mealie.env [@bferd](https://github.com/bferd) ([#18006](https://github.com/community-scripts/ProxmoxVE/pull/18006))
+
+## 2026-10-18
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Donetick: create selfhosted.yaml from the example [@MickLesk](https://github.com/MickLesk) ([#17992](https://github.com/community-scripts/ProxmoxVE/pull/17992))
+    - Wiki.js: only back up db.sqlite on SQLite installs [@MickLesk](https://github.com/MickLesk) ([#17993](https://github.com/community-scripts/ProxmoxVE/pull/17993))
+    - FlareSolverr: pass Chrome an en-US Accept-Language [@MickLesk](https://github.com/MickLesk) ([#17995](https://github.com/community-scripts/ProxmoxVE/pull/17995))
+    - 2FAuth: install the locked dependencies [@MickLesk](https://github.com/MickLesk) ([#17996](https://github.com/community-scripts/ProxmoxVE/pull/17996))
+    - Tracearr: drop the pnpm store after the update build [@gioxx](https://github.com/gioxx) ([#17869](https://github.com/community-scripts/ProxmoxVE/pull/17869))
+    - vaultwarden: build before stopping the service [@mazelado](https://github.com/mazelado) ([#17983](https://github.com/community-scripts/ProxmoxVE/pull/17983))
+
+  - #### 💥 Breaking Changes
+
+    - fix: geopulse 2.0.0 upgrade support (nginx .mjs, pg18, jwt cleanup) [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17978](https://github.com/community-scripts/ProxmoxVE/pull/17978))
+
+### 💾 Core
+
+  - Let get_current_ip reach its IPv6 fallback [@MickLesk](https://github.com/MickLesk) ([core#151](https://github.com/community-scripts/core/pull/151))
+- Drop apt autoclean before apt clean [@MickLesk](https://github.com/MickLesk) ([core#152](https://github.com/community-scripts/core/pull/152))
+- Silence apt's script warning in $STD [@MickLesk](https://github.com/MickLesk) ([core#150](https://github.com/community-scripts/core/pull/150))
+
 ## 2026-10-17

 ### 🆕 New Scripts
@@ -119,6 +119,9 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit



+
+
+



@@ -132,7 +135,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit


 <details>
-<summary><h4>October (17 entries)</h4></summary>
+<summary><h4>October (24 entries)</h4></summary>

 [View October 2026 Changelog](.github/changelogs/2026/10.md)

@@ -565,12 +568,177 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 </details>

+## 2026-10-26
+
+### 🆕 New Scripts
+
+  - HomeTube ([#18172](https://github.com/community-scripts/ProxmoxVE/pull/18172))
+- Honcho ([#18169](https://github.com/community-scripts/ProxmoxVE/pull/18169))
+- YTPTube ([#18174](https://github.com/community-scripts/ProxmoxVE/pull/18174))
+- Stump ([#18173](https://github.com/community-scripts/ProxmoxVE/pull/18173))
+- Casdoor ([#18170](https://github.com/community-scripts/ProxmoxVE/pull/18170))
+- Streamystats ([#18171](https://github.com/community-scripts/ProxmoxVE/pull/18171))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - excalidash: bump Node.js from 20 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18213](https://github.com/community-scripts/ProxmoxVE/pull/18213))
+    - readmeabook: bump Node.js from 20 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18217](https://github.com/community-scripts/ProxmoxVE/pull/18217))
+    - homepage: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18214](https://github.com/community-scripts/ProxmoxVE/pull/18214))
+    - remove old -install.sh (verdaccio) [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18218](https://github.com/community-scripts/ProxmoxVE/pull/18218))
+    - meshcentral: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18215](https://github.com/community-scripts/ProxmoxVE/pull/18215))
+
+## 2026-10-25
+
+### 🆕 New Scripts
+
+  - Dreeve ([#18167](https://github.com/community-scripts/ProxmoxVE/pull/18167))
+- TaskView ([#18166](https://github.com/community-scripts/ProxmoxVE/pull/18166))
+- EmDash ([#18165](https://github.com/community-scripts/ProxmoxVE/pull/18165))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(mealie): install ffmpeg for video recipe import [@clartek](https://github.com/clartek) ([#18210](https://github.com/community-scripts/ProxmoxVE/pull/18210))
+    - Termix: step through 2.9.2 when updating from 2.8 or older [@MickLesk](https://github.com/MickLesk) ([#18158](https://github.com/community-scripts/ProxmoxVE/pull/18158))
+    - Element Synapse: remove the registration line by its text, not line 34 [@MickLesk](https://github.com/MickLesk) ([#18201](https://github.com/community-scripts/ProxmoxVE/pull/18201))
+    - Element Synapse: drop the ::1 listener so a container without IPv6 starts [@MickLesk](https://github.com/MickLesk) ([#18180](https://github.com/community-scripts/ProxmoxVE/pull/18180))
+    - Heimdall: generate the app key without the production prompt [@MickLesk](https://github.com/MickLesk) ([#18156](https://github.com/community-scripts/ProxmoxVE/pull/18156))
+    - Frigate: fetch the Intel graphics key with retries before building the media driver [@MickLesk](https://github.com/MickLesk) ([#18192](https://github.com/community-scripts/ProxmoxVE/pull/18192))
+    - Pterodactyl Panel: default the admin's first and last name when left empty [@MickLesk](https://github.com/MickLesk) ([#18177](https://github.com/community-scripts/ProxmoxVE/pull/18177))
+    - Jellyseerr: point fresh installs to Seerr instead of a missing install script [@MickLesk](https://github.com/MickLesk) ([#18183](https://github.com/community-scripts/ProxmoxVE/pull/18183))
+    - Pi-hole: download the installer before running it [@MickLesk](https://github.com/MickLesk) ([#18182](https://github.com/community-scripts/ProxmoxVE/pull/18182))
+    - OmniTools: give the build a git commit to read [@MickLesk](https://github.com/MickLesk) ([#18181](https://github.com/community-scripts/ProxmoxVE/pull/18181))
+    - iVentoy: stop early in an unprivileged container [@MickLesk](https://github.com/MickLesk) ([#18179](https://github.com/community-scripts/ProxmoxVE/pull/18179))
+    - Immich: stop early on Debian 12 instead of failing at apt [@MickLesk](https://github.com/MickLesk) ([#18178](https://github.com/community-scripts/ProxmoxVE/pull/18178))
+    - paperless-ngx: fix missing index folder [@Segelzwerg](https://github.com/Segelzwerg) ([#18142](https://github.com/community-scripts/ProxmoxVE/pull/18142))
+    - Anytype Server: keep the .env across updates and recreate a lost one [@MickLesk](https://github.com/MickLesk) ([#18155](https://github.com/community-scripts/ProxmoxVE/pull/18155))
+    - changedetection: build Browserless from its lockfile on update [@MickLesk](https://github.com/MickLesk) ([#18157](https://github.com/community-scripts/ProxmoxVE/pull/18157))
+    - Zitadel: identify the machine by hostname when it has no private IPv4 [@MickLesk](https://github.com/MickLesk) ([#18139](https://github.com/community-scripts/ProxmoxVE/pull/18139))
+    - fix(bar-assistant): publish starter media catalog so new bars provision [@och29](https://github.com/och29) ([#18130](https://github.com/community-scripts/ProxmoxVE/pull/18130))
+
+  - #### ✨ New Features
+
+    - Gramps-Web: run the Celery task queue with Redis [@MickLesk](https://github.com/MickLesk) ([#18141](https://github.com/community-scripts/ProxmoxVE/pull/18141))
+
+  - #### 💥 Breaking Changes
+
+    - Hermes Agent: install, update and run everything as the hermes user [@MickLesk](https://github.com/MickLesk) ([#18203](https://github.com/community-scripts/ProxmoxVE/pull/18203))
+    - tubearchivist: fix: prepare tubearchivist for v0.6.0 [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17867](https://github.com/community-scripts/ProxmoxVE/pull/17867))
+
+  - #### 🔧 Refactor
+
+    - TREK: build 5.0 with 4 GB RAM and without dependency install scripts [@MickLesk](https://github.com/MickLesk) ([#18194](https://github.com/community-scripts/ProxmoxVE/pull/18194))
+
+### 💾 Core
+
+  - alpine: fix uv release url [@mfelipe](https://github.com/mfelipe) ([core#168](https://github.com/community-scripts/core/pull/168))
+- Set npm's script and git policy for root too, so --prefix keeps it [@MickLesk](https://github.com/MickLesk) ([core#170](https://github.com/community-scripts/core/pull/170))
+- Upgrade Node.js in place when an app package depends on it [@MickLesk](https://github.com/MickLesk) ([core#169](https://github.com/community-scripts/core/pull/169))
+
+### 🧰 Tools
+
+  - #### ✨ New Features
+
+    - post-pmg-install: hide the subscription nag in the PMG 9 mobile quarantine [@MickLesk](https://github.com/MickLesk) ([#18140](https://github.com/community-scripts/ProxmoxVE/pull/18140))
+    - post-pve-install: hide the mobile subscription nag in every UI language [@MickLesk](https://github.com/MickLesk) ([#18143](https://github.com/community-scripts/ProxmoxVE/pull/18143))
+
+## 2026-10-24
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - patchmon: avoids systemd environment secret leaks via D-Bus/subprocesses. [@rhclayto](https://github.com/rhclayto) ([#18074](https://github.com/community-scripts/ProxmoxVE/pull/18074))
+    - fix: Linkwarden - clear Yarn berry cache after install and update- #18115 [@bferd](https://github.com/bferd) ([#18116](https://github.com/community-scripts/ProxmoxVE/pull/18116))
+    - Borg-UI: recreate the borg venvs with --clear [@MickLesk](https://github.com/MickLesk) ([#18118](https://github.com/community-scripts/ProxmoxVE/pull/18118))
+    - SnapOtter: recreate the AI venv with --clear [@MickLesk](https://github.com/MickLesk) ([#18119](https://github.com/community-scripts/ProxmoxVE/pull/18119))
+    - Update authentik version to 2026.8.5 [@thieneret](https://github.com/thieneret) ([#18125](https://github.com/community-scripts/ProxmoxVE/pull/18125))
+
+  - #### ✨ New Features
+
+    - Frigate: bump to v0.18.2 [@MickLesk](https://github.com/MickLesk) ([#18120](https://github.com/community-scripts/ProxmoxVE/pull/18120))
+
+  - #### 🔧 Refactor
+
+    - install: answer every prompt from the environment, survive a closed stdin [@MickLesk](https://github.com/MickLesk) ([#18121](https://github.com/community-scripts/ProxmoxVE/pull/18121))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - fix(addons): use catch_errors so the update marker is cleared [@mazelado](https://github.com/mazelado) ([#18128](https://github.com/community-scripts/ProxmoxVE/pull/18128))
+
+## 2026-10-23
+
+### 🚀 Updated Scripts
+
+  - postgresql: default the version prompt and match Alpine's packages [@MickLesk](https://github.com/MickLesk) ([#18093](https://github.com/community-scripts/ProxmoxVE/pull/18093))
+- Storyteller: build the runtime like upstream's Dockerfile [@MickLesk](https://github.com/MickLesk) ([#18083](https://github.com/community-scripts/ProxmoxVE/pull/18083))
+
+  - #### 🐞 Bug Fixes
+
+    - proxcenter: skip the type check and lower the build heap [@MickLesk](https://github.com/MickLesk) ([#18090](https://github.com/community-scripts/ProxmoxVE/pull/18090))
+    - hermesagent: retry the installer download, fall back to GitHub [@MickLesk](https://github.com/MickLesk) ([#18091](https://github.com/community-scripts/ProxmoxVE/pull/18091))
+    - zabbix: use the arm64 repository for 7.0 [@MickLesk](https://github.com/MickLesk) ([#18089](https://github.com/community-scripts/ProxmoxVE/pull/18089))
+    - kasm: survive a failed release lookup and answer the installer with flags [@MickLesk](https://github.com/MickLesk) ([#18092](https://github.com/community-scripts/ProxmoxVE/pull/18092))
+
+  - #### ✨ New Features
+
+    - InvoiceShelf: run the Laravel scheduler [@MickLesk](https://github.com/MickLesk) ([#18079](https://github.com/community-scripts/ProxmoxVE/pull/18079))
+
+  - #### 🔧 Refactor
+
+    - podman-homeassistant: require Debian 13 [@MickLesk](https://github.com/MickLesk) ([#18095](https://github.com/community-scripts/ProxmoxVE/pull/18095))
+    - apache-guacamole: require Debian 13 [@MickLesk](https://github.com/MickLesk) ([#18094](https://github.com/community-scripts/ProxmoxVE/pull/18094))
+    - unifi-os-server: require Debian 13 [@MickLesk](https://github.com/MickLesk) ([#18096](https://github.com/community-scripts/ProxmoxVE/pull/18096))
+    - openwebui: drop the Intel oneAPI Base Toolkit [@MickLesk](https://github.com/MickLesk) ([#18098](https://github.com/community-scripts/ProxmoxVE/pull/18098))
+    - ollama: drop the Intel oneAPI Base Toolkit [@MickLesk](https://github.com/MickLesk) ([#18097](https://github.com/community-scripts/ProxmoxVE/pull/18097))
+    - tdarr: do not let a failed or slow updater block the service start [@MickLesk](https://github.com/MickLesk) ([#18100](https://github.com/community-scripts/ProxmoxVE/pull/18100))
+    - immich: install mise from its GitHub release, retry jellyfin-ffmpeg, default the ML prompt [@MickLesk](https://github.com/MickLesk) ([#18099](https://github.com/community-scripts/ProxmoxVE/pull/18099))
+    - Refactor: pimox-haos-vm [@MickLesk](https://github.com/MickLesk) ([#18077](https://github.com/community-scripts/ProxmoxVE/pull/18077))
+
+### 💾 Core
+
+  - Telemetry: explain and categorize by the command that failed [@MickLesk](https://github.com/MickLesk) ([core#166](https://github.com/community-scripts/core/pull/166))
+- error-handler: report a handled silent failure only on its own line [@MickLesk](https://github.com/MickLesk) ([core#165](https://github.com/community-scripts/core/pull/165))
+- VM silent: return the failure instead of exiting [@MickLesk](https://github.com/MickLesk) ([core#164](https://github.com/community-scripts/core/pull/164))
+- error-handler: keep the start explanation and the final IP lookup from failing the run [@MickLesk](https://github.com/MickLesk) ([core#163](https://github.com/community-scripts/core/pull/163))
+- error output: report a failure inside a subshell once [@MickLesk](https://github.com/MickLesk) ([core#162](https://github.com/community-scripts/core/pull/162))
+- general: allow Composer as root in every script [@MickLesk](https://github.com/MickLesk) ([core#161](https://github.com/community-scripts/core/pull/161))
+- lxc-updater: skip the resource check when the container cannot read its RAM [@MickLesk](https://github.com/MickLesk) ([core#160](https://github.com/community-scripts/core/pull/160))
+- vm-core: let vm_timezone_default survive a host without /etc/timezone [@MickLesk](https://github.com/MickLesk) ([core#159](https://github.com/community-scripts/core/pull/159))
+
+## 2026-10-22
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Zabbix: keep unattended updates on the installed series [@florianpunz](https://github.com/florianpunz) ([#18051](https://github.com/community-scripts/ProxmoxVE/pull/18051))
+
+  - #### 🔧 Refactor
+
+    - Refactor: Cryptpad [@MickLesk](https://github.com/MickLesk) ([#18065](https://github.com/community-scripts/ProxmoxVE/pull/18065))
+
+### 💾 Core
+
+  - Incus: drive a remote Incus server from the client's default remote [@MickLesk](https://github.com/MickLesk) ([core#154](https://github.com/community-scripts/core/pull/154))
+- Deploy the release again when an update is redone [@MickLesk](https://github.com/MickLesk) ([core#158](https://github.com/community-scripts/core/pull/158))
+
+### ❔ Uncategorized
+
+  - chore(ct): sync sparkyfitness defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18061](https://github.com/community-scripts/ProxmoxVE/pull/18061))
+
 ## 2026-10-21

 ### 🚀 Updated Scripts

  - #### 🐞 Bug Fixes

+    - Immich: bump release version to v3.3.5 (CVE) [@CerberusStyle](https://github.com/CerberusStyle) ([#18057](https://github.com/community-scripts/ProxmoxVE/pull/18057))
    - DroppedNeedle: pass release version to the app via COMMIT_TAG [@MickLesk](https://github.com/MickLesk) ([#18042](https://github.com/community-scripts/ProxmoxVE/pull/18042))

 ### 💾 Core
@@ -1187,154 +1355,4 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

  - Incus: make prompts visible for end-user [@MickLesk](https://github.com/MickLesk) ([core#73](https://github.com/community-scripts/core/pull/73))
 - incus: do not let an install script block on an invisible prompt [@MickLesk](https://github.com/MickLesk) ([core#71](https://github.com/community-scripts/core/pull/71))
- tel: report progress from installs only, not updates [@MickLesk](https://github.com/MickLesk) ([core#72](https://github.com/community-scripts/core/pull/72))
-
-## 2026-09-24
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Declare the RomM filesystem structure required since 5.3.0 [@MickLesk](https://github.com/MickLesk) ([#17480](https://github.com/community-scripts/ProxmoxVE/pull/17480))
-    - general: use apt_update_safe instead of aborting on a failed apt update [@MickLesk](https://github.com/MickLesk) ([#17462](https://github.com/community-scripts/ProxmoxVE/pull/17462))
-
-  - #### 🔧 Refactor
-
-    - Journiv: Serve Node Frontend and add HTTP Auth .env [@MickLesk](https://github.com/MickLesk) ([#17479](https://github.com/community-scripts/ProxmoxVE/pull/17479))
-
-### 💾 Core
-
-  - core: accept an off-subnet gateway for /31 and /32 [@MickLesk](https://github.com/MickLesk) ([core#70](https://github.com/community-scripts/core/pull/70))
-
-## 2026-09-23
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - fix(signoz): install the histogramQuantile ClickHouse function [@maksimtech](https://github.com/maksimtech) ([#17386](https://github.com/community-scripts/ProxmoxVE/pull/17386))
-    - omniroute: bump to 4 GB for the npm install [@MickLesk](https://github.com/MickLesk) ([#17461](https://github.com/community-scripts/ProxmoxVE/pull/17461))
-    - Run Borg-UI with a single gunicorn worker [@MickLesk](https://github.com/MickLesk) ([#17445](https://github.com/community-scripts/ProxmoxVE/pull/17445))
-    - immich: keep geodata linked and the build deps present on update [@MickLesk](https://github.com/MickLesk) ([#17438](https://github.com/community-scripts/ProxmoxVE/pull/17438))
-
-  - #### 🔧 Refactor
-
-    - Refactor: Scanopy [@MickLesk](https://github.com/MickLesk) ([#16797](https://github.com/community-scripts/ProxmoxVE/pull/16797))
-
-### 💾 Core
-
-  - stop a partial find from aborting the caller under pipefail [@MickLesk](https://github.com/MickLesk) ([core#68](https://github.com/community-scripts/core/pull/68))
- core: give RHEL-family containers an ostype PVE accepts [@MickLesk](https://github.com/MickLesk) ([core#67](https://github.com/community-scripts/core/pull/67))
- core: do not abort on a failed apt update [@MickLesk](https://github.com/MickLesk) ([core#66](https://github.com/community-scripts/core/pull/66))
- VM's: report a finished VM as done, not aborted [@MickLesk](https://github.com/MickLesk) ([core#65](https://github.com/community-scripts/core/pull/65))
- VM-Core: decide console autologin from the image, not USE_CLOUD_INIT [@MickLesk](https://github.com/MickLesk) ([core#63](https://github.com/community-scripts/core/pull/63))
- VM-Core: report failed image steps and restore tty1 autologin without cloud-init [@MickLesk](https://github.com/MickLesk) ([core#62](https://github.com/community-scripts/core/pull/62))
- tools: raise pnpm/yarn fetch timeout and lower network concurrency [@MickLesk](https://github.com/MickLesk) ([core#59](https://github.com/community-scripts/core/pull/59))
- VM-Core: stop discarding cloud-init error messages [@MickLesk](https://github.com/MickLesk) ([core#60](https://github.com/community-scripts/core/pull/60))
-
-## 2026-09-22
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - fix(invoiceshelf): re-link storage during update [@owenvoke](https://github.com/owenvoke) ([#17431](https://github.com/community-scripts/ProxmoxVE/pull/17431))
-    - fix(alpine-it-tools): write the version file after a successful update [@Houtek](https://github.com/Houtek) ([#17421](https://github.com/community-scripts/ProxmoxVE/pull/17421))
-    - Umami: Align pnpm with engines.pnpm on update [@ReneNulschDE](https://github.com/ReneNulschDE) ([#17404](https://github.com/community-scripts/ProxmoxVE/pull/17404))
-
-  - #### 🔧 Refactor
-
-    - several scripts: let uv see the project before syncing it | refactor some scripts that use uv [@MickLesk](https://github.com/MickLesk) ([#17436](https://github.com/community-scripts/ProxmoxVE/pull/17436))
-
-### 💾 Core
-
-  - setup_uv: honour a project's required-version pin [@MickLesk](https://github.com/MickLesk) ([core#58](https://github.com/community-scripts/core/pull/58))
- fix(motd): repair legacy 00_lxc-details.sh header and dead color placeholders [@BadFlo](https://github.com/BadFlo) ([core#53](https://github.com/community-scripts/core/pull/53))
- meilisearch: take the raw binary, not the .deb [@MickLesk](https://github.com/MickLesk) ([core#57](https://github.com/community-scripts/core/pull/57))
-
-### 📚 Documentation
-
-  - github: Stop generating header filenames with a newline in them [@MickLesk](https://github.com/MickLesk) ([#17435](https://github.com/community-scripts/ProxmoxVE/pull/17435))
-
-### ❔ Uncategorized
-
-  - chore(ct): sync cloudflare-ddns defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17446](https://github.com/community-scripts/ProxmoxVE/pull/17446))
-
-## 2026-09-21
-
-### 🆕 New Scripts
-
-  - AudioMuse-AI ([#17415](https://github.com/community-scripts/ProxmoxVE/pull/17415))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - fix(portabase): meet the default admin password rules [@maksimtech](https://github.com/maksimtech) ([#17384](https://github.com/community-scripts/ProxmoxVE/pull/17384))
-    - truenas-vm: strip the G before the storage allocation [@MickLesk](https://github.com/MickLesk) ([#17407](https://github.com/community-scripts/ProxmoxVE/pull/17407))
-    - Librenms - Fix local snmpd community string setup [@dopch](https://github.com/dopch) ([#17363](https://github.com/community-scripts/ProxmoxVE/pull/17363))
-    - fix(iventoy): preserve release data and migrate legacy service launchers [@Msprg](https://github.com/Msprg) ([#17161](https://github.com/community-scripts/ProxmoxVE/pull/17161))
-    - xyops: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17398](https://github.com/community-scripts/ProxmoxVE/pull/17398))
-
-### 💾 Core
-
-  - Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#56](https://github.com/community-scripts/core/pull/56))
- github-api: take the release the maintainer marked as latest [@MickLesk](https://github.com/MickLesk) ([core#55](https://github.com/community-scripts/core/pull/55))
- general: prune old Rust toolchains [@MickLesk](https://github.com/MickLesk) ([core#52](https://github.com/community-scripts/core/pull/52))
- Ask when the preselected storage cannot hold the content [@MickLesk](https://github.com/MickLesk) ([core#51](https://github.com/community-scripts/core/pull/51))
-
-## 2026-09-20
-
-### 🆕 New Scripts
-
-  - Your-Spotify ([#17376](https://github.com/community-scripts/ProxmoxVE/pull/17376))
-
-## 2026-09-19
-
-### 🆕 New Scripts
-
-  - qBit-Manage ([#17377](https://github.com/community-scripts/ProxmoxVE/pull/17377))
- Ubuntu-VM: AIO | new core | performance | remove old wrappers [@MickLesk](https://github.com/MickLesk) ([#17354](https://github.com/community-scripts/ProxmoxVE/pull/17354))
-
-### 💾 Core
-
-  - Fall back to the unversioned banner slug [@MickLesk](https://github.com/MickLesk) ([core#48](https://github.com/community-scripts/core/pull/48))
-
-### ❔ Uncategorized
-
-  - chore(ct): sync immichframe defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17373](https://github.com/community-scripts/ProxmoxVE/pull/17373))
-
-## 2026-09-18
-
-### 🆕 New Scripts
-
-  - Almalinux-VM ([#17349](https://github.com/community-scripts/ProxmoxVE/pull/17349))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - update authentik to 2026.8.3 [@thieneret](https://github.com/thieneret) ([#17366](https://github.com/community-scripts/ProxmoxVE/pull/17366))
-    - crafty-controller: chown after restore_backup so restored data keeps ownership [@MickLesk](https://github.com/MickLesk) ([#17348](https://github.com/community-scripts/ProxmoxVE/pull/17348))
-    - databasus, domain-monitor, poznote: chown after restore_backup so restored data keeps its owner [@MickLesk](https://github.com/MickLesk) ([#17350](https://github.com/community-scripts/ProxmoxVE/pull/17350))
-    - alpine-vm: ask for the Cloud-Init credentials [@MickLesk](https://github.com/MickLesk) ([#17355](https://github.com/community-scripts/ProxmoxVE/pull/17355))
-    - suggestarr: keep the data where the app actually reads it [@MickLesk](https://github.com/MickLesk) ([#17317](https://github.com/community-scripts/ProxmoxVE/pull/17317))
-    - immichframe: set the admin password the new admin UI requires [@MickLesk](https://github.com/MickLesk) ([#17315](https://github.com/community-scripts/ProxmoxVE/pull/17315))
-
-  - #### ✨ New Features
-
-    - pangolin: Bump to 1.23.0 [@MickLesk](https://github.com/MickLesk) ([#17343](https://github.com/community-scripts/ProxmoxVE/pull/17343))
-
-  - #### 🔧 Refactor
-
-    - Refactor: Oxicloud [@MickLesk](https://github.com/MickLesk) ([#17338](https://github.com/community-scripts/ProxmoxVE/pull/17338))
-
-### 💾 Core
-
-  - Stop a modified conffile from aborting the whole update [@MickLesk](https://github.com/MickLesk) ([core#47](https://github.com/community-scripts/core/pull/47))
- Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#46](https://github.com/community-scripts/core/pull/46))
- github api: retry a 200 that is not a usable release payload [@MickLesk](https://github.com/MickLesk) ([core#45](https://github.com/community-scripts/core/pull/45))
-
-### 📚 Documentation
-
-  - chore: fix PR template help [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17364](https://github.com/community-scripts/ProxmoxVE/pull/17364))
+- tel: report progress from installs only, not updates [@MickLesk](https://github.com/MickLesk) ([core#72](https://github.com/community-scripts/core/pull/72))
@@ -37,13 +37,25 @@ function update_script() {
    systemctl stop anytype
    msg_ok "Stopped Service"

-    create_backup /opt/anytype/data
+    create_backup /opt/anytype/data /opt/anytype/.env

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "anytype" "grishy/any-sync-bundle" "prebuild" "latest" "/opt/anytype" "any-sync-bundle_*_linux_$(arch_resolve).tar.gz"
    chmod +x /opt/anytype/any-sync-bundle

    restore_backup

+    if [[ ! -f /opt/anytype/.env ]]; then
+      cat <<EOF >/opt/anytype/.env
+ANY_SYNC_BUNDLE_CONFIG=/opt/anytype/data/bundle-config.yml
+ANY_SYNC_BUNDLE_CLIENT_CONFIG=/opt/anytype/data/client-config.yml
+ANY_SYNC_BUNDLE_INIT_STORAGE=/opt/anytype/data/storage/
+ANY_SYNC_BUNDLE_INIT_EXTERNAL_ADDRS=$(hostname -I | awk '{print $1}')
+ANY_SYNC_BUNDLE_INIT_MONGO_URI=mongodb://127.0.0.1:27017/
+ANY_SYNC_BUNDLE_INIT_REDIS_URI=redis://127.0.0.1:6379/
+ANY_SYNC_BUNDLE_LOG_LEVEL=info
+EOF
+    fi
+
    msg_info "Starting Service"
    systemctl start anytype
    msg_ok "Started Service"
@@ -47,7 +47,7 @@ function update_script() {
  RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
  setup_yq

-  AUTHENTIK_VERSION="version/2026.8.4"
+  AUTHENTIK_VERSION="version/2026.8.5"
  # Source: https://github.com/goauthentik/fips/blob/main/Makefile#L26
  XMLSEC_VERSION="1.3.12"

@@ -46,11 +46,19 @@ function update_script() {

    restore_backup

+    msg_info "Refreshing Bar-Assistant data pack"
+    rm -rf /opt/bar-assistant/resources/data
+    mkdir -p /opt/bar-assistant/resources/data
+    curl -fsSL https://github.com/bar-assistant/data/archive/refs/heads/v5.tar.gz | tar -xz --strip-components=1 -C /opt/bar-assistant/resources/data
+    chown -R www-data:www-data /opt/bar-assistant/resources/data
+    msg_ok "Refreshed Bar-Assistant data pack"
+
    msg_info "Configuring Bar-Assistant"
    cd /opt/bar-assistant
    $STD composer install --no-interaction
    $STD php artisan migrate --force
    $STD php artisan storage:link
+    $STD php artisan starter-media:publish
    $STD php artisan bar:setup-meilisearch
    $STD php artisan scout:sync-index-settings
    $STD php artisan config:cache
@@ -69,7 +69,7 @@ function update_script() {

    if [[ "$(cat /opt/borg1-venv/.pinned_version 2>/dev/null)" != "$BORG1_VERSION" ]]; then
      msg_info "Installing Borg ${BORG1_VERSION} (Patience)"
-      $STD uv venv --python "$BORG_PYTHON" /opt/borg1-venv
+      $STD uv venv --clear --python "$BORG_PYTHON" /opt/borg1-venv
      $STD uv pip install --python /opt/borg1-venv pyfuse3 "borgbackup==${BORG1_VERSION}"
      echo "$BORG1_VERSION" >/opt/borg1-venv/.pinned_version
      ln -sf /opt/borg1-venv/bin/borg /usr/local/bin/borg
@@ -78,7 +78,7 @@ function update_script() {

    if [[ "$(cat /opt/borg2-venv/.pinned_version 2>/dev/null)" != "${BORG2_VERSION}-${BORGSTORE_VERSION}" ]]; then
      msg_info "Installing Borg ${BORG2_VERSION} (Patience)"
-      $STD uv venv --python "$BORG_PYTHON" /opt/borg2-venv
+      $STD uv venv --clear --python "$BORG_PYTHON" /opt/borg2-venv
      $STD uv pip install --python /opt/borg2-venv pyfuse3 "borgbackup==${BORG2_VERSION}" "borgstore[rclone,sftp,rest,s3,blake3]==${BORGSTORE_VERSION}"
      echo "${BORG2_VERSION}-${BORGSTORE_VERSION}" >/opt/borg2-venv/.pinned_version
      ln -sf /opt/borg2-venv/bin/borg /usr/local/bin/borg2
@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/casdoor/casdoor
+
+APP="Casdoor"
+var_tags="${var_tags:-auth;sso;iam}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-1024}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/casdoor ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "casdoor" "casdoor/casdoor"; then
+    msg_info "Stopping Casdoor"
+    systemctl stop casdoor
+    msg_ok "Stopped Casdoor"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "casdoor" "casdoor/casdoor" "prebuild" "latest" "/opt/casdoor" "casdoor_Linux_$(arch_resolve "x86_64" "arm64").tar.gz"
+
+    msg_info "Starting Casdoor"
+    systemctl start casdoor
+    msg_ok "Started Casdoor"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8000${CL}"
@@ -77,7 +77,6 @@ function update_script() {
    msg_info "Updating Browserless (Patience)"
    $STD git -C /opt/browserless/ fetch --all
    $STD git -C /opt/browserless/ reset --hard origin/main
-    $STD npm update --prefix /opt/browserless
    $STD npm ci --include=optional --include=dev --prefix /opt/browserless
    $STD npm install --save-exact playwright-core@1.62.1 --prefix /opt/browserless
    $STD /opt/browserless/node_modules/playwright-core/cli.js install --with-deps
@@ -30,12 +30,14 @@ function update_script() {
    msg_error "No ${APP} Installation Found!"
    exit
  fi
+  # Updates to 2026.10.0 finished without infra.js; run them again so it gets written
+  [[ -f /opt/cryptpad/config/infra.example.js && ! -f /opt/cryptpad/config/infra.js ]] && rm -f ~/.cryptpad
  if check_for_gh_release "cryptpad" "cryptpad/cryptpad"; then
    msg_info "Stopping Service"
    systemctl stop cryptpad
    msg_ok "Stopped Service"

-    create_backup /opt/cryptpad/config/config.js /opt/cryptpad/www/common/onlyoffice/dist
+    create_backup /opt/cryptpad/config/config.js /opt/cryptpad/config/infra.js /opt/cryptpad/www/common/onlyoffice/dist

    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="blob block customize data datastore onlyoffice-conf" fetch_and_deploy_gh_release "cryptpad" "cryptpad/cryptpad" "tarball"

@@ -45,8 +47,30 @@ function update_script() {
    cd /opt/cryptpad
    $STD npm ci --allow-git=all
    $STD npm run install:components
-    if [ -f "/opt/cryptpad/install-onlyoffice.sh" ]; then
-      $STD bash /opt/cryptpad/install-onlyoffice.sh --accept-license
+    if [[ -d /opt/cryptpad/www/common/onlyoffice/dist ]]; then
+      $STD bash /opt/cryptpad/install-office.sh --accept-license
+    fi
+    if [[ ! -f /opt/cryptpad/config/infra.js ]]; then
+      # 2026.10.0 reads the network settings from infra.js and no longer derives the sandbox origin
+      LOCAL_IP="$LOCAL_IP" node - <<'EOF'
+const c = require("/opt/cryptpad/config/config.js");
+const i = require("/opt/cryptpad/config/infra.example.js");
+const port = c.httpPort || i.public.httpPort;
+const safePort = c.httpSafePort || port + 1;
+const origin = (c.httpUnsafeOrigin || `http://${process.env.LOCAL_IP}:${port}`).replace(/\/+$/, "");
+const sandbox = new URL(origin);
+sandbox.port = safePort;
+Object.assign(i.public, {
+  origin,
+  sandboxOrigin: (c.httpSafeOrigin || sandbox.origin).replace(/\/+$/, ""),
+  httpHost: c.httpAddress || (c.httpUnsafeOrigin ? i.public.httpHost : "0.0.0.0"),
+  httpPort: port,
+  httpSafePort: safePort,
+  externalWebsocketURL: c.externalWebsocketURL,
+  fileHost: c.fileHost,
+});
+require("fs").writeFileSync("/opt/cryptpad/config/infra.js", "module.exports = " + JSON.stringify(i, null, 4) + ";\n");
+EOF
    fi
    $STD npm run build
    msg_ok "Updated CryptaPad"
@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/dreeveapp/dreeve
+
+APP="Dreeve"
+var_tags="${var_tags:-fitness;dashboard}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/dreeve ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "dreeve" "dreeveapp/dreeve"; then
+    msg_info "Stopping Service"
+    systemctl stop dreeve
+    msg_ok "Stopped Service"
+
+    create_backup /opt/dreeve/.env.local /opt/dreeve/Caddyfile
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "dreeve" "dreeveapp/dreeve" "tarball"
+
+    restore_backup
+
+    msg_info "Installing PHP Dependencies (Patience)"
+    cd /opt/dreeve
+    export COMPOSER_ALLOW_SUPERUSER=1
+    export APP_ENV=prod
+    $STD /opt/frankenphp/frankenphp php-cli /usr/local/bin/composer install --no-dev --optimize-autoloader --no-interaction --no-scripts
+    msg_ok "Installed PHP Dependencies"
+
+    msg_info "Running Migrations"
+    mkdir -p /opt/dreeve/var/{cache,log}
+    set -a
+    source /opt/dreeve/.env.local
+    set +a
+    $STD /opt/frankenphp/frankenphp php-cli bin/console app:db:migrate --no-interaction
+    $STD /opt/frankenphp/frankenphp php-cli bin/console assets:install public --no-interaction
+    rm -rf /opt/dreeve/var/cache/prod
+    $STD /opt/frankenphp/frankenphp php-cli bin/console cache:warmup --env=prod
+    msg_ok "Ran Migrations"
+
+    msg_info "Starting Service"
+    systemctl start dreeve
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8080${CL}"
+echo -e "${INFO}${YW}Admin credentials: ~/dreeve.creds (inside the container)${CL}"
+echo -e "${INFO}${YW}Add your Strava API credentials to /opt/dreeve/.env.local first${CL}"
@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/emdash-cms/emdash
+
+APP="EmDash"
+var_tags="${var_tags:-cms;blog}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-3072}"
+var_disk="${var_disk:-6}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+export var_emdash_url="${var_emdash_url:-}"
+export var_emdash_template="${var_emdash_template:-}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/emdash ]]; then
+    msg_error "No EmDash Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "emdash" "emdash-cms/emdash" "" "" "emdash@"; then
+    msg_info "Stopping EmDash"
+    systemctl stop emdash
+    msg_ok "Stopped EmDash"
+
+    NODE_VERSION="24" NODE_MODULE="pnpm@11" setup_nodejs
+
+    msg_info "Updating EmDash"
+    cd /opt/emdash
+    set -a && source /opt/emdash_data/.env && set +a
+    $STD pnpm add "${CHECK_UPDATE_RELEASE}"
+    $STD pnpm build
+    $STD pnpm store prune
+    cat <<EOF >~/.emdash
+${CHECK_UPDATE_RELEASE}
+EOF
+    msg_ok "Updated EmDash"
+
+    msg_info "Starting EmDash"
+    systemctl start emdash
+    msg_ok "Started EmDash"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:4321${CL}"
+echo -e "${INFO}${YW}The admin at /_emdash/admin signs in with passkeys only, and browsers allow those on HTTPS with a domain or on localhost, never on an IP address.${CL}"
+echo -e "${INFO}${YW}Put EmDash behind a reverse proxy with a trusted certificate, set EMDASH_SITE_URL in /opt/emdash_data/.env to that address and rebuild (see the notes), then create the admin there.${CL}"
@@ -35,7 +35,8 @@ function update_script() {
    msg_info "Stopping Service"
    systemctl stop excalidash
    msg_ok "Stopped Service"
-
+    
+    NODE_VERSION="24" setup_nodejs
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "excalidash" "ZimengXiong/ExcaliDash" "tarball"
    ln -sf /opt/excalidash_data/.env /opt/excalidash/backend/.env
    set -a && source /opt/excalidash_data/.env && set +a
@@ -34,9 +34,43 @@ function update_script() {
  PYTHON_VERSION="3.12" setup_uv
  NODE_VERSION="22" NODE_MODULE="corepack" setup_nodejs

+  if ! grep -q '^CELERY_CONFIG=' /opt/gramps-web/config/config.cfg; then
+    msg_info "Setting up Celery Task Queue"
+    ensure_dependencies redis-server
+    cat <<EOF >>/opt/gramps-web/config/config.cfg
+CELERY_CONFIG={"broker_url":"redis://127.0.0.1:6379/0","result_backend":"redis://127.0.0.1:6379/0"}
+RATELIMIT_STORAGE_URI="redis://127.0.0.1:6379/1"
+EOF
+    cat <<EOF >/etc/systemd/system/gramps-web-celery.service
+[Unit]
+Description=Gramps Web Celery Worker
+After=network.target redis-server.service
+Wants=redis-server.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/gramps-web-api
+Environment=GRAMPS_API_CONFIG=/opt/gramps-web/config/config.cfg
+Environment=GRAMPSHOME=/opt/gramps-web/data
+Environment=GRAMPS_DATABASE_PATH=/opt/gramps-web/data/gramps/grampsdb
+Environment=PATH=/opt/gramps-web/venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+ExecStart=/opt/gramps-web/venv/bin/celery -A gramps_webapi.celery worker --loglevel=INFO --concurrency=2
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+    systemctl daemon-reload
+    systemctl enable -q --now redis-server gramps-web-celery
+    systemctl restart gramps-web
+    msg_ok "Set up Celery Task Queue"
+  fi
+
  if check_for_gh_release "gramps-web-api" "gramps-project/gramps-web-api"; then
    msg_info "Stopping Service"
-    systemctl stop gramps-web
+    systemctl stop gramps-web gramps-web-celery
    msg_ok "Stopped Service"

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "gramps-web-api" "gramps-project/gramps-web-api" "tarball" "latest" "/opt/gramps-web-api"
@@ -71,7 +105,7 @@ function update_script() {
    msg_ok "Updated Gramps Addons"

    msg_info "Starting Service"
-    systemctl start gramps-web
+    systemctl start gramps-web gramps-web-celery
    msg_ok "Started Service"
  fi

@@ -33,36 +33,60 @@ function update_script() {

  confirm_external_installer "https://hermes-agent.nousresearch.com/" "hermes update (https://hermes-agent.nousresearch.com/)"

-  msg_info "Stopping Services"
-  systemctl stop hermes-dashboard
-  msg_ok "Stopped Services"
-
-  msg_info "Updating Hermes Agent"
-  $STD setsid --wait bash -c '
-    set -a; source /etc/default/hermes; set +a
-    /home/hermes/.local/bin/hermes update --yes
-  '
-  mapfile -t root_gateway_pids < <(ps -eo user=,pid=,args= | awk '$1 == "root" && /\/home\/hermes\/\.hermes\// && /hermes_cli[.]main/ && / gateway run --replace$/ { print $2 }')
-  if ((${#root_gateway_pids[@]})); then
-    kill -TERM "${root_gateway_pids[@]}"
-    for pid in "${root_gateway_pids[@]}"; do
-      while kill -0 "$pid" 2>/dev/null; do
-        sleep 0.1
+  if [[ -f /etc/systemd/system/hermes-dashboard.service ]]; then
+    msg_info "Moving Hermes to its own user"
+    systemctl disable -q --now hermes-dashboard
+    rm -f /etc/systemd/system/hermes-dashboard.service
+    systemctl daemon-reload
+    mapfile -t root_hermes_pids < <(ps -eo user=,pid=,args= | awk '$1 == "root" && /\/home\/hermes\/\.hermes\// && /hermes_cli[.]main/ { print $2 }')
+    if ((${#root_hermes_pids[@]})); then
+      kill -TERM "${root_hermes_pids[@]}" 2>/dev/null || true
+      for pid in "${root_hermes_pids[@]}"; do
+        while kill -0 "$pid" 2>/dev/null; do
+          sleep 0.1
+        done
      done
-    done
-  fi
-  if ps -eo user=,args= | awk '$1 == "root" && /\/home\/hermes\/\.hermes\// { found = 1 } END { exit !found }'; then
-    msg_warn "A root-owned Hermes process is still running; it may keep writing root-owned files"
+    fi
+    ensure_dependencies libatomic1
+    sed -i '/^HOME=/d' /etc/default/hermes
+    grep -q '^GATEWAY_HEALTH_URL=' /etc/default/hermes || echo "GATEWAY_HEALTH_URL=http://127.0.0.1:8642/health" >>/etc/default/hermes
+    mkdir -p /home/hermes/.config/systemd/user
+    cat <<EOF >/home/hermes/.config/systemd/user/hermes-dashboard.service
+[Unit]
+Description=Hermes Agent Web Dashboard
+After=network-online.target
+
+[Service]
+Type=simple
+UMask=0077
+WorkingDirectory=%h
+EnvironmentFile=/etc/default/hermes
+ExecStart=%h/.local/bin/hermes dashboard --host 127.0.0.1 --port 9119 --no-open
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=default.target
+EOF
+    msg_ok "Moved Hermes to its own user"
  fi
+
  # A writer racing chown makes files vanish between readdir and chown; one retry covers it.
  if ! chown -R hermes:hermes /home/hermes 2>/dev/null; then
    sleep 1
    chown -R hermes:hermes /home/hermes || msg_warn "Could not take ownership of everything under /home/hermes"
  fi
+  $STD runuser -l hermes -c 'systemctl --user daemon-reload && systemctl --user enable hermes-dashboard'
+
+  msg_info "Updating Hermes Agent"
+  $STD setsid --wait runuser -l hermes -c '
+    set -a; source /etc/default/hermes; set +a
+    hermes update --yes
+  '
  msg_ok "Updated Hermes Agent"

  msg_info "Starting Services"
-  systemctl start hermes-dashboard
+  $STD runuser -l hermes -c 'systemctl --user start hermes-dashboard'
  msg_ok "Started Services"
  msg_ok "Updated successfully!"
  exit
@@ -30,7 +30,7 @@ function update_script() {
    exit
  fi

-  NODE_VERSION="22" NODE_MODULE="pnpm@latest" setup_nodejs
+  NODE_VERSION="24" NODE_MODULE="pnpm@latest" setup_nodejs
  ensure_dependencies jq

  if check_for_gh_release "homepage" "gethomepage/homepage"; then
@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/EgalitarianMonkey/hometube
+
+APP="HomeTube"
+var_tags="${var_tags:-media;youtube;downloader}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-1024}"
+var_disk="${var_disk:-20}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/hometube ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  msg_info "Updating yt-dlp"
+  $STD yt-dlp -U
+  msg_ok "Updated yt-dlp"
+
+  fetch_and_deploy_gh_release "deno" "denoland/deno" "prebuild" "latest" "/usr/local/bin" "deno-$(arch_resolve "x86_64" "aarch64")-unknown-linux-gnu.zip"
+
+  if check_for_gh_release "hometube" "EgalitarianMonkey/hometube"; then
+    msg_info "Stopping HomeTube"
+    systemctl stop hometube
+    msg_ok "Stopped HomeTube"
+
+    PYTHON_VERSION="3.13" setup_uv
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "hometube" "EgalitarianMonkey/hometube" "tarball"
+
+    msg_info "Updating HomeTube"
+    cd /opt/hometube
+    $STD uv sync --locked --no-dev --no-install-project --no-install-package pyarrow
+    msg_ok "Updated HomeTube"
+
+    msg_info "Starting HomeTube"
+    systemctl start hometube
+    msg_ok "Started HomeTube"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8501${CL}"
@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/plastic-labs/honcho
+
+APP="Honcho"
+var_tags="${var_tags:-ai;memory;agents}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-6}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+export var_honcho_provider="${var_honcho_provider:-}"
+export var_honcho_api_key="${var_honcho_api_key:-}"
+export var_honcho_base_url="${var_honcho_base_url:-}"
+export var_honcho_model="${var_honcho_model:-}"
+export var_honcho_embedding_key="${var_honcho_embedding_key:-}"
+export var_honcho_embedding_model="${var_honcho_embedding_model:-}"
+export var_honcho_embedding_dims="${var_honcho_embedding_dims:-}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+if [[ -n "${var_honcho_provider}" && ! "${var_honcho_provider}" =~ ^(openai|anthropic|gemini)$ ]]; then
+  msg_error "var_honcho_provider must be openai, anthropic or gemini"
+  exit 1
+fi
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/honcho ]]; then
+    msg_error "No Honcho Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "honcho" "plastic-labs/honcho" "" "" "v"; then
+    msg_info "Stopping Honcho"
+    systemctl stop honcho-deriver honcho
+    msg_ok "Stopped Honcho"
+
+    PYTHON_VERSION="3.13" setup_uv
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP=".env" fetch_and_deploy_gh_release "honcho" "plastic-labs/honcho" "tarball" "latest" "/opt/honcho" "" "v"
+
+    msg_info "Updating Honcho"
+    cd /opt/honcho
+    $STD uv sync --frozen --no-dev
+    $STD .venv/bin/python scripts/provision_db.py
+    msg_ok "Updated Honcho"
+
+    if systemctl is-enabled -q honcho; then
+      msg_info "Starting Honcho"
+      systemctl start honcho honcho-deriver
+      msg_ok "Started Honcho"
+    fi
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access the API (interactive docs at /docs) using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8000${CL}"
+echo -e "${INFO}${YW}Admin key, sent as Authorization: Bearer <key> (more with: cd /opt/honcho && .venv/bin/python scripts/generate_jwt.py --admin):${CL}"
+echo -e "${INFO}${YW}Without an LLM provider key Honcho stays stopped: set one in /opt/honcho_data/.env, then run: systemctl enable --now honcho honcho-deriver${CL}"
@@ -65,19 +65,17 @@ EOF
    msg_ok "Installed/upgraded Testing repo packages"
  fi

-  if [[ ! -f /etc/apt/sources.list.d/mise.list ]]; then
-    msg_info "Installing Mise"
-    curl -fSs https://mise.jdx.dev/gpg-key.pub | tee /etc/apt/keyrings/mise-archive-keyring.pub 1>/dev/null
-    echo "deb [signed-by=/etc/apt/keyrings/mise-archive-keyring.pub arch=$(arch_resolve)] https://mise.jdx.dev/deb stable main" >/etc/apt/sources.list.d/mise.list
-    ensure_dependencies mise
-    msg_ok "Installed Mise"
+  if ! command -v mise >/dev/null 2>&1; then
+    MISE_ARCH="x64"
+    [[ "$(arch_resolve)" == "arm64" ]] && MISE_ARCH="arm64"
+    fetch_and_deploy_gh_release "mise" "jdx/mise" "singlefile" "latest" "/usr/local/bin" "mise-v*-linux-${MISE_ARCH}"
  fi

  STAGING_DIR=/opt/staging
  BASE_DIR=${STAGING_DIR}/base-images
  SOURCE_DIR=${STAGING_DIR}/image-source
  cd /tmp
-  RELEASE="v3.3.4"
+  RELEASE="v3.3.5"
  if [[ -f ~/.intel_version ]]; then
    INTEL_SRC="https://raw.githubusercontent.com/immich-app/immich/${RELEASE}/machine-learning"
    curl -fsSL "${INTEL_SRC}/scripts/install-intel-runtime.sh" -o ./intel-runtime 2>/dev/null ||
@@ -31,6 +31,14 @@ function update_script() {
    exit
  fi

+  if [[ ! -f /etc/cron.d/invoiceshelf ]]; then
+    msg_info "Adding the Laravel scheduler"
+    cat <<'EOF' >/etc/cron.d/invoiceshelf
+* * * * * www-data cd /opt/invoiceshelf && php artisan schedule:run >> /dev/null 2>&1
+EOF
+    msg_ok "Added the Laravel scheduler"
+  fi
+
  if check_for_gh_release "invoiceshelf" "InvoiceShelf/InvoiceShelf"; then
    msg_info "Stopping Services"
    systemctl stop caddy
@@ -96,6 +96,12 @@ EOF
  exit
 }

+if [[ ! -d /opt/jellyseerr ]]; then
+  msg_error "Jellyseerr is now Seerr and can no longer be installed with this script."
+  msg_warn "Install Seerr instead: https://community-scripts.org/scripts/seerr"
+  exit 1
+fi
+
 start
 build_container
 description
@@ -64,6 +64,7 @@ function update_script() {
    $STD yarn prisma:deploy
    rm -rf ~/.cargo/registry ~/.cargo/git ~/.cargo/.package-cache
    rm -rf /root/.cache/yarn
+    rm -rf /root/.yarn/berry/cache
    rm -rf /opt/linkwarden/.next/cache
    msg_ok "Updated Linkwarden"

@@ -30,6 +30,9 @@ function update_script() {
    msg_error "No ${APP} Installation Found!"
    exit
  fi
+
+  ensure_dependencies ffmpeg
+
  if check_for_gh_release "mealie" "mealie-recipes/mealie"; then

    msg_info "Stopping Service"
@@ -34,12 +34,15 @@ function update_script() {
  NODE_VERSION="24" setup_nodejs

  if check_for_gh_release "omnitools" "iib0011/omni-tools"; then
+    ensure_dependencies git
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "omnitools" "iib0011/omni-tools" "tarball"

    msg_info "Building OmniTools"
    cd /opt/omnitools
    export HUSKY=0
    $STD npm ci --allow-remote=all
+    $STD git init -q
+    $STD git -c user.name=build -c user.email=build@localhost commit -q --allow-empty -m build
    $STD npm run build
    msg_ok "Built OmniTools"

@@ -44,7 +44,7 @@ function update_script() {
    $STD npm ci --legacy-peer-deps --ignore-scripts
    $STD npm run build:icons
    $STD npx prisma generate
-    NODE_OPTIONS="--max-old-space-size=4608" $STD npm run build
+    PROXCENTER_SKIP_TYPECHECK=1 NODE_OPTIONS="--max-old-space-size=3072" $STD npm run build
    msg_ok "Built ProxCenter"

    msg_info "Migrating Database"
@@ -86,7 +86,7 @@ EOF

    msg_info "Updating SnapOtter"
    $STD uv python install 3.11
-    $STD uv venv --seed --python 3.11 /opt/snapotter_data/ai/venv
+    $STD uv venv --clear --seed --python 3.11 /opt/snapotter_data/ai/venv
    if [[ "$(arch_resolve)" == "arm64" ]]; then
      $STD uv pip install --python /opt/snapotter_data/ai/venv/bin/python \
        numpy==1.26.4 Pillow==12.3.0 opencv-python-headless==4.10.0.84 fonttools \
@@ -9,7 +9,7 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 APP="SparkyFitness"
 var_tags="${var_tags:-health;fitness}"
 var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
+var_ram="${var_ram:-4096}"
 var_disk="${var_disk:-7}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
@@ -31,42 +31,75 @@ function update_script() {
    exit
  fi

-  NODE_VERSION="24" NODE_MODULE="corepack,yarn" setup_nodejs
+  NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs

  if check_for_gl_release "storyteller" "storyteller-platform/storyteller" "" "" "web-v2"; then
    msg_info "Stopping Service"
    systemctl stop storyteller
    msg_ok "Stopped Service"

+    ensure_dependencies cmake argon2 libcurl4t64 libxml2
+    fetch_and_deploy_gh_release "readium" "readium/cli" "prebuild" "v0.9.1" "/opt/readium" "readium_linux_$(arch_resolve "x86_64" "arm64").tar.gz"
+
    create_backup /opt/storyteller/.env
-
-    CLEAN_INSTALL=1 fetch_and_deploy_gl_release "storyteller" "storyteller-platform/storyteller" "tarball" "latest" "/opt/storyteller" "" "web-v2"
-
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="data" fetch_and_deploy_gl_release "storyteller" "storyteller-platform/storyteller" "tarball" "latest" "/opt/storyteller" "" "web-v2"
    restore_backup

-    msg_info "Rebuilding Storyteller"
+    msg_info "Building Storyteller (Patience)"
    cd /opt/storyteller
-    export NODE_OPTIONS="--max-old-space-size=4096"
-
-    $STD corepack yarn install --network-timeout 600000
-    $STD gcc -g -fPIC -rdynamic -shared web/sqlite/uuid.c -o web/sqlite/uuid.c.so
-    export CI=1
+    $STD corepack yarn install
    export NODE_ENV=production
    export NEXT_TELEMETRY_DISABLED=1
    export SQLITE_NATIVE_BINDING=/opt/storyteller/node_modules/better-sqlite3/build/Release/better_sqlite3.node
    $STD corepack yarn workspaces foreach -Rpt --from @storyteller-platform/web --exclude @storyteller-platform/eslint run build
-    mkdir -p /opt/storyteller/web/.next/standalone/web/.next/static
-    cp -rT /opt/storyteller/web/.next/static /opt/storyteller/web/.next/standalone/web/.next/static
-    if [[ -d /opt/storyteller/web/public ]]; then
-      mkdir -p /opt/storyteller/web/.next/standalone/web/public
-      cp -rT /opt/storyteller/web/public /opt/storyteller/web/.next/standalone/web/public
+    STANDALONE=/opt/storyteller/applications/web/.next/standalone
+    WEB_DIR="$STANDALONE/applications/web"
+    mkdir -p "$WEB_DIR"/{public,.next/static,.next/cache,migrations,sqlite,scripts}
+    cp -rT applications/web/public "$WEB_DIR/public"
+    cp -rT applications/web/.next/static "$WEB_DIR/.next/static"
+    cp -rT applications/web/migrations "$WEB_DIR/migrations"
+    cp applications/web/sqlite/uuid.c.so "$WEB_DIR/sqlite/"
+    cp docker-scripts/reset-password.sh "$WEB_DIR/scripts/"
+    cp -r applications/web/work-dist applications/web/file-write-dist "$WEB_DIR/"
+    mkdir -p "$WEB_DIR/work-dist/@storyteller-platform/align/prebuilds"
+    cp -r "libraries/align/prebuilds/linux-$(arch_resolve "x64" "arm64")" "$WEB_DIR/work-dist/@storyteller-platform/align/prebuilds/"
+    cp node_modules/@echogarden/icu-segmentation-wasm/wasm/*.wasm "$WEB_DIR/work-dist/"
+    cp -rT node_modules/@parcel "$STANDALONE/node_modules/@parcel"
+    cp -rT node_modules/kuromoji "$STANDALONE/node_modules/kuromoji"
+    ln -sf /opt/storyteller/.env "$WEB_DIR/.env"
+    msg_ok "Built Storyteller"
+
+    msg_info "Updating Whisper"
+    WHISPER_VARIANT="linux-$(arch_resolve "x64" "arm64")-cpu"
+    $STD node /opt/storyteller/libraries/ghost-story/dist/cli/bin.js install binary "$WHISPER_VARIANT"
+    $STD node /opt/storyteller/libraries/ghost-story/dist/cli/bin.js install model tiny.en
+    if [[ "$WHISPER_VARIANT" == "linux-x64-cpu" ]]; then
+      $STD node /opt/storyteller/libraries/ghost-story/dist/cli/bin.js install binary linux-x64-cpu-legacy
    fi
-    mkdir -p /opt/storyteller/web/.next/standalone/web/migrations
-    cp -rT /opt/storyteller/web/migrations /opt/storyteller/web/.next/standalone/web/migrations
-    mkdir -p /opt/storyteller/web/.next/standalone/web/sqlite
-    cp -rT /opt/storyteller/web/sqlite /opt/storyteller/web/.next/standalone/web/sqlite
-    ln -sf /opt/storyteller/.env /opt/storyteller/web/.next/standalone/web/.env
-    msg_ok "Rebuilt Storyteller"
+    msg_ok "Updated Whisper"
+
+    cat <<EOF >/etc/systemd/system/storyteller.service
+[Unit]
+Description=Storyteller
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=${WEB_DIR}
+EnvironmentFile=/opt/storyteller/.env
+Environment=SQLITE_NATIVE_BINDING=${STANDALONE}/node_modules/better-sqlite3/build/Release/better_sqlite3.node
+Environment=ERROR_ALIGN_NATIVE_BINDING=${WEB_DIR}/work-dist/@storyteller-platform/align/
+Environment=STORYTELLER_WORKER=worker.mjs
+Environment=STORYTELLER_FILE_WRITE_WORKER=fileWriteWorker.mjs
+ExecStart=/usr/bin/node --enable-source-maps server.js
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+    systemctl daemon-reload

    msg_info "Starting Service"
    systemctl start storyteller
@@ -75,7 +108,6 @@ function update_script() {
  fi
  exit
 }
-
 start
 build_container
 description
@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/fredrikburmester/streamystats
+
+APP="Streamystats"
+var_tags="${var_tags:-analytics;jellyfin}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-3072}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/streamystats ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "streamystats" "fredrikburmester/streamystats"; then
+    msg_info "Stopping Streamystats"
+    systemctl stop streamystats-nextjs-app streamystats-job-server
+    msg_ok "Stopped Streamystats"
+
+    msg_info "Updating Bun"
+    $STD bun upgrade
+    msg_ok "Updated Bun"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "streamystats" "fredrikburmester/streamystats" "tarball"
+
+    msg_info "Building Streamystats"
+    cd /opt/streamystats
+    $STD bun install --frozen-lockfile
+    NEXT_TELEMETRY_DISABLED=1 NEXT_PUBLIC_VERSION="v$(cat ~/.streamystats)" $STD bun run build
+    msg_ok "Built Streamystats"
+
+    msg_info "Migrating Streamystats Database"
+    $STD bun --env-file=/opt/streamystats_data/.env run db:migrate
+    msg_ok "Migrated Streamystats Database"
+
+    msg_info "Starting Streamystats"
+    systemctl start streamystats-job-server streamystats-nextjs-app
+    msg_ok "Started Streamystats"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"
@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/stumpapp/stump
+
+APP="Stump"
+var_tags="${var_tags:-comics;manga;ebook}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-1024}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/stump ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "stump" "stumpapp/stump"; then
+    msg_info "Stopping Stump"
+    systemctl stop stump
+    msg_ok "Stopped Stump"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "stump" "stumpapp/stump" "prebuild" "latest" "/opt/stump" "linux-build-results.zip"
+    chmod +x /opt/stump/stump_server
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "pdfium" "bblanchon/pdfium-binaries" "prebuild" "latest" "/opt/pdfium" "pdfium-linux-x64.tgz"
+
+    msg_info "Starting Stump"
+    systemctl start stump
+    msg_ok "Started Stump"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:10801${CL}"
@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Gimanh/taskview-community
+
+APP="TaskView"
+var_tags="${var_tags:-project-management;tasks;kanban}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-6144}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/taskview ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "taskview" "Gimanh/taskview-community"; then
+    msg_info "Stopping TaskView"
+    systemctl stop taskview
+    msg_ok "Stopped TaskView"
+
+    NODE_VERSION="24" NODE_MODULE="pnpm" setup_nodejs
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "taskview" "Gimanh/taskview-community" "tarball"
+
+    msg_info "Building TaskView"
+    cd /opt/taskview
+    $STD pnpm install --frozen-lockfile
+    cd /opt/taskview/api
+    $STD pnpm run build:docker
+    $STD pnpm run build:migration
+    cp -r src/migrations/taskview dist-migration/
+    cd /opt/taskview/web
+    $STD pnpm run build:packages
+    $STD pnpm run build-only
+    msg_ok "Built TaskView"
+
+    msg_info "Migrating TaskView Database"
+    cd /opt/taskview_data
+    $STD node /opt/taskview/api/dist-migration/taskview-db-migration.js
+    msg_ok "Migrated TaskView Database"
+
+    msg_info "Starting TaskView"
+    systemctl start taskview
+    msg_ok "Started TaskView"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}${CL}"
@@ -108,6 +108,12 @@ EOF
  fi

  if check_for_gh_release "termix" "Termix-SSH/Termix"; then
+    TERMIX_RELEASE="latest"
+    if [[ "$CS_PREVIOUS_VERSION" =~ ^(release-)?([0-9]+)\.([0-9]+)\. ]] && ((BASH_REMATCH[2] * 100 + BASH_REMATCH[3] < 209)); then
+      TERMIX_RELEASE="release-2.9.2-tag"
+      msg_warn "Termix ${CS_PREVIOUS_VERSION} has to run 2.9.2 once before newer releases accept its database"
+    fi
+
    msg_info "Stopping Termix"
    systemctl stop termix
    msg_ok "Stopped Termix"
@@ -165,7 +171,7 @@ EOF

    create_backup /opt/termix/.env

-    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="db/data data uploads" fetch_and_deploy_gh_release "termix" "Termix-SSH/Termix" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="db/data data uploads" fetch_and_deploy_gh_release "termix" "Termix-SSH/Termix" "tarball" "$TERMIX_RELEASE"

    restore_backup

@@ -258,12 +264,24 @@ EOF

    msg_info "Starting Termix"
    systemctl daemon-reload
+    TERMIX_START=$(date +%s)
    if ! systemctl start termix; then
      msg_error "Termix failed to start"
      journalctl -u termix -n 30 --no-pager || true
      exit 1
    fi
    msg_ok "Started Termix"
+    if [[ "$TERMIX_RELEASE" != "latest" ]]; then
+      msg_info "Waiting for Termix 2.9.2 to migrate the database"
+      if ! timeout 300 bash -c "until journalctl -u termix --since @${TERMIX_START} --no-pager | grep -q 'Termix backend started successfully'; do sleep 2; done"; then
+        msg_error "Termix 2.9.2 did not finish starting, so the database was not migrated"
+        journalctl -u termix -n 30 --no-pager || true
+        exit 1
+      fi
+      msg_ok "Migrated the database with Termix 2.9.2"
+      msg_warn "Run update again to continue to the current Termix release"
+      exit
+    fi
    msg_ok "Updated successfully!"
  fi
  exit
@@ -9,7 +9,7 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 APP="TREK"
 var_tags="${var_tags:-travel;planning;collaboration}"
 var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
+var_ram="${var_ram:-4096}"
 var_disk="${var_disk:-8}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
@@ -43,6 +43,7 @@ function update_script() {
    msg_ok "Stopped Service"

    ensure_dependencies "libkitinerary-bin"
+    ln -sf "$(find /usr/lib -name kitinerary-extractor -type f | head -1)" /usr/local/bin/kitinerary-extractor

    create_backup /opt/trek/server/.env \
      /opt/trek/data \
@@ -52,7 +53,7 @@ function update_script() {

    msg_info "Building TREK"
    cd /opt/trek
-    $STD npm ci
+    $STD npm ci --ignore-scripts
    $STD npm run build --workspace=shared
    $STD npm run build --workspace=client
    $STD npm run build --workspace=server
@@ -72,7 +73,7 @@ function update_script() {

    rm -rf /opt/trek/node_modules
    cd /opt/trek
-    $STD npm ci --workspace=server --omit=dev
+    $STD npm ci --workspace=server --omit=dev --ignore-scripts
    msg_ok "Set up TREK Workspace"

    if [[ "$MIGRATION" == "1" ]]; then
@@ -71,6 +71,41 @@ EOF

    restore_backup

+    if grep -q '^TA_BACKEND_PORT=' /opt/tubearchivist/.env 2>/dev/null; then
+      msg_info "Migrating to v0.6.0 (dropping Nginx)"
+      systemctl disable -q --now nginx
+      $STD apt autoremove --purge -y nginx
+      sed -i 's/^TA_BACKEND_PORT=.*/TA_PORT=8000/' /opt/tubearchivist/.env
+      cat <<'RUNEOF' >/opt/tubearchivist/backend/run.sh
+#!/bin/bash
+set -e
+cd /opt/tubearchivist/backend
+set -a
+source /opt/tubearchivist/.env
+set +a
+PYTHON=/opt/tubearchivist/.venv/bin/python
+
+echo "Waiting for ElasticSearch..."
+for i in $(seq 1 30); do
+  if curl -sf http://localhost:9200/_cluster/health >/dev/null 2>&1; then
+    break
+  fi
+  sleep 2
+done
+
+$PYTHON manage.py ta_stop_on_error
+$PYTHON manage.py migrate
+$PYTHON manage.py collectstatic --noinput -c
+$PYTHON manage.py ta_envcheck
+$PYTHON manage.py ta_connection
+$PYTHON manage.py ta_startup
+
+exec $PYTHON backend_start.py
+RUNEOF
+      chmod +x /opt/tubearchivist/backend/run.sh
+      msg_ok "Migrated to v0.6.0 (dropping Nginx)"
+    fi
+
    msg_info "Rebuilding Tube Archivist"
    cd /opt/tubearchivist/frontend
    $STD npm install
@@ -113,7 +148,6 @@ EOF

    msg_info "Starting Services"
    systemctl start bgutil-provider tubearchivist tubearchivist-celery tubearchivist-beat
-    systemctl reload nginx
    msg_ok "Started Services"
    msg_ok "Updated successfully!"
  fi
@@ -128,3 +162,5 @@ msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
 echo -e "${GATEWAY}${BGN}http://${IP}:8000${CL}"
+echo -e "${INFO}${YW}Admin credentials saved to ~/tubearchivist.creds${CL}"
+echo -e "${INFO}${YW}The WebUI may take a couple of minutes to become available on first start, while Elasticsearch and the backend initialize.${CL}"
@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/arabcoders/ytptube
+
+APP="YTPTube"
+var_tags="${var_tags:-media;youtube;downloader}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-3072}"
+var_disk="${var_disk:-20}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_gpu="${var_gpu:-yes}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/ytptube ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  fetch_and_deploy_gh_release "deno" "denoland/deno" "prebuild" "latest" "/usr/local/bin" "deno-$(arch_resolve "x86_64" "aarch64")-unknown-linux-gnu.zip"
+
+  if check_for_gh_release "ytptube" "arabcoders/ytptube"; then
+    msg_info "Stopping YTPTube"
+    systemctl stop ytptube
+    msg_ok "Stopped YTPTube"
+
+    NODE_VERSION="24" NODE_MODULE="bun" setup_nodejs
+    PYTHON_VERSION="3.13" setup_uv
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "ytptube" "arabcoders/ytptube" "tarball"
+
+    msg_info "Building YTPTube"
+    cd /opt/ytptube/ui
+    $STD bun install --frozen-lockfile --production
+    NODE_ENV=production $STD bun run generate
+    rm -rf /opt/ytptube/ui/node_modules
+    cd /opt/ytptube
+    sed -i "s/^APP_VERSION = .*/APP_VERSION = \"v$(cat ~/.ytptube)\"/" app/library/version.py
+    $STD uv sync --locked --no-dev
+    $STD uv pip install --python .venv/bin/python pip
+    msg_ok "Built YTPTube"
+
+    msg_info "Starting YTPTube"
+    systemctl start ytptube
+    msg_ok "Started YTPTube"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8081${CL}"
+echo -e "${INFO}${YW}The first visitor creates the admin account - open the URL right away${CL}"
@@ -46,24 +46,36 @@ function update_script() {
    msg_warn "No Zabbix Agent service found, skipping agent actions"
  fi

+  ZABBIX_SERIES="$(dpkg-query -W -f='${Version}' zabbix-release 2>/dev/null || true)"
+  ZABBIX_SERIES="${ZABBIX_SERIES#*:}"
+  ZABBIX_SERIES="${ZABBIX_SERIES%%[!0-9.]*}"
+  if [[ "${PHS_SILENT:-0}" == "1" ]]; then
+    if [[ ! "$ZABBIX_SERIES" =~ ^[0-9]+\.[0-9]+$ ]]; then
+      msg_warn "Could not detect the installed Zabbix series - skipping update, requires an interactive run"
+      exit 75
+    fi
+    ZABBIX_VERSION="$ZABBIX_SERIES"
+    msg_warn "Unattended update: staying on Zabbix ${ZABBIX_VERSION}"
+  else
+    read -rp "Choose Zabbix version [1] 7.0 LTS  [2] 7.4 (Latest Stable)  [3] Latest available (default: 2): " ZABBIX_CHOICE
+    ZABBIX_CHOICE=${ZABBIX_CHOICE:-2}
+    case "$ZABBIX_CHOICE" in
+    1) ZABBIX_VERSION="7.0" ;;
+    2) ZABBIX_VERSION="7.4" ;;
+    3) ZABBIX_VERSION=$(curl -fsSL https://repo.zabbix.com/zabbix/ |
+      grep -oP '(?<=href=")[0-9]+\.[0-9]+(?=/")' | sort -V | tail -n1) ;;
+    *)
+      ZABBIX_VERSION="7.4"
+      echo "Invalid choice. Defaulting to 7.4."
+      ;;
+    esac
+  fi
+
  msg_info "Stopping Services"
  systemctl stop zabbix-server
  [[ -n "$AGENT_SERVICE" ]] && systemctl stop "$AGENT_SERVICE"
  msg_ok "Stopped Services"

-  read -rp "Choose Zabbix version [1] 7.0 LTS  [2] 7.4 (Latest Stable)  [3] Latest available (default: 2): " ZABBIX_CHOICE
-  ZABBIX_CHOICE=${ZABBIX_CHOICE:-2}
-  case "$ZABBIX_CHOICE" in
-  1) ZABBIX_VERSION="7.0" ;;
-  2) ZABBIX_VERSION="7.4" ;;
-  3) ZABBIX_VERSION=$(curl -fsSL https://repo.zabbix.com/zabbix/ |
-    grep -oP '(?<=href=")[0-9]+\.[0-9]+(?=/")' | sort -V | tail -n1) ;;
-  *)
-    ZABBIX_VERSION="7.4"
-    echo "Invalid choice. Defaulting to 7.4."
-    ;;
-  esac
-
  msg_info "Updating Zabbix to $ZABBIX_VERSION"
  mkdir -p /opt/zabbix-backup/
  cp /etc/zabbix/zabbix_server.conf /opt/zabbix-backup/
@@ -73,8 +85,10 @@ function update_script() {
  rm -Rf /etc/apt/sources.list.d/zabbix.list
  cd /tmp

+  ZABBIX_REPO_DIR="debian"
+  [[ "$ZABBIX_VERSION" == "7.0" && "$(arch_resolve)" == "arm64" ]] && ZABBIX_REPO_DIR="debian-arm64"
  if [[ "$ZABBIX_VERSION" == "7.0" ]]; then
-    ZABBIX_DEB_URL="https://repo.zabbix.com/zabbix/${ZABBIX_VERSION}/debian/pool/main/z/zabbix-release/zabbix-release_latest_${ZABBIX_VERSION}+debian13_all.deb"
+    ZABBIX_DEB_URL="https://repo.zabbix.com/zabbix/${ZABBIX_VERSION}/${ZABBIX_REPO_DIR}/pool/main/z/zabbix-release/zabbix-release_latest_${ZABBIX_VERSION}+debian13_all.deb"
    ZABBIX_DEB_FILE="zabbix-release_latest_${ZABBIX_VERSION}+debian13_all.deb"
  else
    ZABBIX_DEB_URL="https://repo.zabbix.com/zabbix/${ZABBIX_VERSION}/release/debian/pool/main/z/zabbix-release/zabbix-release_latest+debian13_all.deb"
@@ -12,6 +12,11 @@ setting_up_container
 network_check
 update_os

+if is_debian && [[ "$(get_os_version_major)" -lt 13 ]]; then
+  msg_error "Apache Guacamole needs Debian 13: freerdp3-dev is not available on Debian 12."
+  exit 238
+fi
+
 msg_info "Installing Dependencies"
 $STD apt install -y \
  build-essential \
@@ -13,12 +13,14 @@ setting_up_container
 network_check
 update_os

-read -r -p "${TAB3}Which Tomcat version would you like to install? (9, 10.1, 11): " version
+version="${var_apache_tomcat_version:-}"
+[[ -n "$version" ]] || read -r -p "${TAB3}Which Tomcat version would you like to install? (9, 10.1, 11): " version || true
+jdk_version="${var_apache_tomcat_jdk_version:-}"
 case $version in
 9)
  TOMCAT_VERSION="9"
  echo "Which LTS Java version would you like to use? (8, 11, 17, 21): "
-  read -r jdk_version
+  [[ -n "$jdk_version" ]] || read -r jdk_version || true
  case $jdk_version in
  8 | 11 | 17 | 21)
    JAVA_VERSION="$jdk_version" setup_java
@@ -32,7 +34,7 @@ case $version in
 10 | 10.1)
  TOMCAT_VERSION="10"
  echo "Which LTS Java version would you like to use? (11, 17, 21): "
-  read -r jdk_version
+  [[ -n "$jdk_version" ]] || read -r jdk_version || true
  case $jdk_version in
  11 | 17 | 21)
    JAVA_VERSION="$jdk_version" setup_java
@@ -46,7 +48,7 @@ case $version in
 11)
  TOMCAT_VERSION="11"
  echo "Which LTS Java version would you like to use? (17, 21): "
-  read -r jdk_version
+  [[ -n "$jdk_version" ]] || read -r jdk_version || true
  case $jdk_version in
  17 | 21)
    JAVA_VERSION="$jdk_version" setup_java
@@ -18,7 +18,7 @@ $STD apt install -y aria2
 msg_ok "Installed Aria2"

 prompt="${var_aria2_ariang:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add AriaNG? <y/N> " prompt
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add AriaNG? <y/N> " prompt || true
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  msg_info "Installing Dependencies"
  $STD apt install -y nginx
@@ -47,7 +47,8 @@ Choose Asterisk version to install:
 2) Latest LTS ($LTS_VERSION)
 3) Latest Certified ($CERT_VERSION)
 EOF
-read -rp "Enter choice [1-3]: " ASTERISK_CHOICE
+ASTERISK_CHOICE="${var_asterisk_version:-}"
+[[ -n "$ASTERISK_CHOICE" ]] || read -rp "Enter choice [1-3]: " ASTERISK_CHOICE || true

 CERTIFIED=0
 case "$ASTERISK_CHOICE" in
@@ -17,9 +17,10 @@ fetch_and_deploy_gh_release "authelia" "authelia/authelia" "binary"

 MAX_ATTEMPTS=3
 attempt=0
+DOMAIN="${var_authelia_domain:-}"
 while true; do
  attempt=$((attempt + 1))
-  read -rp "${TAB3}Enter your domain or IP (ex. example.com or 192.168.1.100): " DOMAIN
+  [[ -n "$DOMAIN" ]] || read -rp "${TAB3}Enter your domain or IP (ex. example.com or 192.168.1.100): " DOMAIN || true
  if [[ -z "$DOMAIN" ]]; then
    if ((attempt >= MAX_ATTEMPTS)); then
      DOMAIN="${LOCAL_IP:-localhost}"
@@ -40,11 +41,13 @@ while true; do
      break
    else
      msg_warn "Invalid IP address!"
+      DOMAIN=""
    fi
  elif [[ "$DOMAIN" =~ ^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*\.[a-zA-Z]{2,}$ ]]; then
    break
  else
    msg_warn "Invalid domain format!"
+    DOMAIN=""
  fi
 done
 msg_info "Setting Authelia up"
@@ -57,7 +57,7 @@ PG_VERSION="17" setup_postgresql
 PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db

 XMLSEC_VERSION="1.3.12"
-AUTHENTIK_VERSION="version/2026.8.4"
+AUTHENTIK_VERSION="version/2026.8.5"
 fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec"
 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
 GO_VERSION="$(grep -m1 '^go ' /opt/authentik/go.mod | awk '{print $2}')" setup_go
@@ -52,6 +52,7 @@ $STD php artisan key:generate
 touch storage/bar-assistant/database.ba3.sqlite
 $STD php artisan migrate --force
 $STD php artisan storage:link
+$STD php artisan starter-media:publish
 $STD php artisan bar:setup-meilisearch
 $STD php artisan scout:sync-index-settings
 $STD php artisan config:cache
@@ -15,7 +15,8 @@ update_os

 fetch_and_deploy_gh_release "bichon" "rustmailer/bichon" "prebuild" "latest" "/opt/bichon" "bichon-*-$(arch_resolve "x86_64" "aarch64")-unknown-linux-gnu.tar.gz"

-read -r -p "${TAB3}Enter the public URL for Bichon (e.g., https://bichon.yourdomain.com) or leave empty to use container IP: " bichon_url
+bichon_url="${var_bichon_url:-}"
+[[ -n "$bichon_url" ]] || read -r -p "${TAB3}Enter the public URL for Bichon (e.g., https://bichon.yourdomain.com) or leave empty to use container IP: " bichon_url || true
 if [[ -z "$bichon_url" ]]; then
  msg_info "No URL provided"
  BICHON_PUBLIC_URL="http://$LOCAL_IP:15630"
@@ -34,7 +34,8 @@ setup_deb_based() {
  chmod +x bitmagnet
  msg_ok "Configured bitmagnet"

-  read -r -p "${TAB3}Enter your TMDB API key if you have one: " tmdbapikey
+  tmdbapikey="${var_bitmagnet_tmdb_api_key:-}"
+  [[ -n "$tmdbapikey" ]] || read -r -p "${TAB3}Enter your TMDB API key if you have one: " tmdbapikey || true

  cat <<EOF >/etc/bitmagnet.env
 POSTGRES_HOST=localhost
@@ -99,7 +100,8 @@ setup_alpine() {
  $STD su - postgres -c "psql -c 'CREATE DATABASE bitmagnet;'"
  msg_ok "Built bitmagnet"

-  read -rp "${TAB3}Enter your TMDB API key if you have one: " tmdbapikey
+  tmdbapikey="${var_bitmagnet_tmdb_api_key:-}"
+  [[ -n "$tmdbapikey" ]] || read -rp "${TAB3}Enter your TMDB API key if you have one: " tmdbapikey || true

  msg_info "Enabling bitmagnet Service"
  cat <<EOF >/etc/init.d/bitmagnet
@@ -25,7 +25,7 @@ $STD npm install
 msg_ok "Installed ByteStash"

 allowreg="${var_bytestash_registration:-}"
-[[ -n "$allowreg" ]] || read -rp "${TAB3}Do you want to allow registration of multiple accounts? [y/n]: " allowreg
+[[ -n "$allowreg" ]] || read -rp "${TAB3}Do you want to allow registration of multiple accounts? [y/n]: " allowreg || true

 msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/bytestash-backend.service
@@ -18,7 +18,7 @@ setup_deb_based() {
  systemctl enable -q --now caddy

  prompt="${var_caddy_xcaddy:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install xCaddy Addon? <y/N> " prompt
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install xCaddy Addon? <y/N> " prompt || true
  if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
    setup_go
    fetch_and_deploy_gh_release "xcaddy" "caddyserver/xcaddy" "binary"
@@ -64,7 +64,7 @@ EOF
  msg_ok "Installed Caddy"

  prompt="${var_caddy_xcaddy:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install xCaddy Addon? <y/N> " prompt
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install xCaddy Addon? <y/N> " prompt || true
  if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
    GO_VERSION="$(curl -fsSL https://go.dev/VERSION?m=text | head -1 | cut -c3-)" setup_go
    fetch_and_deploy_gh_release "xcaddy" "caddyserver/xcaddy" "prebuild" "latest" "/opt/xcaddy" "xcaddy_*_linux_$(arch_resolve).tar.gz"
@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/casdoor/casdoor
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+PG_VERSION="17" setup_postgresql
+PG_DB_NAME="casdoor" PG_DB_USER="casdoor" setup_postgresql_db
+
+fetch_and_deploy_gh_release "casdoor" "casdoor/casdoor" "prebuild" "latest" "/opt/casdoor" "casdoor_Linux_$(arch_resolve "x86_64" "arm64").tar.gz"
+
+msg_info "Configuring Casdoor"
+mkdir -p /opt/casdoor_data/conf
+cat <<EOF >/opt/casdoor_data/conf/app.conf
+appname = casdoor
+httpport = 8000
+runmode = prod
+copyrequestbody = true
+driverName = postgres
+dataSourceName = user=casdoor password=${PG_DB_PASS} host=localhost port=5432 sslmode=disable dbname=casdoor
+dbName = casdoor
+tableNamePrefix =
+showSql = false
+redisEndpoint =
+defaultStorageProvider =
+isCloudIntranet = false
+authState = "casdoor"
+socks5Proxy =
+verificationCodeTimeout = 10
+initScore = 0
+logPostOnly = true
+isUsernameLowered = false
+origin = http://${LOCAL_IP}:8000
+originFrontend =
+staticBaseUrl = "https://cdn.casbin.org"
+isDemoMode = false
+batchSize = 100
+showGithubCorner = false
+forceLanguage = ""
+defaultLanguage = "en"
+defaultApplication = "app-built-in"
+maxItemsForFlatMenu = 7
+enableErrorMask = false
+enableGzip = true
+inactiveTimeoutMinutes =
+ldapServerPort = 389
+ldapsCertId = ""
+ldapsServerPort = 636
+radiusServerPort = 1812
+radiusDefaultOrganization = "built-in"
+radiusSecret = "$(random_password)"
+quota = {"organization": -1, "user": -1, "application": -1, "provider": -1}
+logConfig = {"adapter":"console", "color":false}
+initDataNewOnly = false
+initDataFile = "./init_data.json"
+frontendBaseDir = "/opt/casdoor/web/build"
+EOF
+chmod 600 /opt/casdoor_data/conf/app.conf
+msg_ok "Configured Casdoor"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/casdoor.service
+[Unit]
+Description=Casdoor
+After=network.target postgresql.service
+Requires=postgresql.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/casdoor_data
+ExecStart=/opt/casdoor/casdoor
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now casdoor
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc
@@ -13,15 +13,18 @@ setting_up_container
 network_check
 update_os

-var_cf_api_token="default"
-read -rp "${TAB3}Enter the Cloudflare API token: " var_cf_api_token
+var_cf_api_token="${var_cf_api_token:-}"
+[[ -n "$var_cf_api_token" ]] || read -rp "${TAB3}Enter the Cloudflare API token: " var_cf_api_token || true
+[[ -n "$var_cf_api_token" ]] || { msg_error "No Cloudflare API token given; set var_cf_api_token or answer the prompt"; exit 64; }

-var_cf_domains="default"
-read -rp "${TAB3}Enter the domains separated with a comma (*.example.org,www.example.org) " var_cf_domains
+var_cf_domains="${var_cf_domains:-}"
+[[ -n "$var_cf_domains" ]] || read -rp "${TAB3}Enter the domains separated with a comma (*.example.org,www.example.org) " var_cf_domains || true
+[[ -n "$var_cf_domains" ]] || { msg_error "No domains given; set var_cf_domains or answer the prompt"; exit 64; }

 var_cf_proxied="false"
+answer="${var_cloudflare_ddns_proxied:-}"
 while true; do
-  read -rp "${TAB3}Proxied? (y/n): " answer
+  [[ -n "$answer" ]] || read -rp "${TAB3}Proxied? (y/n): " answer || answer="n"
  case "$answer" in
  [Yy]*)
    var_cf_proxied="true"
@@ -31,12 +34,13 @@ while true; do
    var_cf_proxied="false"
    break
    ;;
-  *) echo "Please answer y or n." ;;
+  *) echo "Please answer y or n."; answer="" ;;
  esac
 done
 var_cf_ip6_provider="none"
+answer="${var_cloudflare_ddns_ipv6:-}"
 while true; do
-  read -rp "${TAB3}Enable IPv6 support? (y/n): " answer
+  [[ -n "$answer" ]] || read -rp "${TAB3}Enable IPv6 support? (y/n): " answer || answer="n"
  case "$answer" in
  [Yy]*)
    var_cf_ip6_provider="cloudflare.trace"
@@ -46,7 +50,7 @@ while true; do
    var_cf_ip6_provider="none"
    break
    ;;
-  *) echo "Please answer y or n." ;;
+  *) echo "Please answer y or n."; answer="" ;;
  esac
 done
 msg_ok "Configured Application"
@@ -33,7 +33,7 @@ msg_ok "Installed Cockpit"
 # 45Drives only publishes amd64 packages
 if [[ "$(arch_resolve)" != "arm64" ]]; then
  prompt="${var_cockpit_45drives:-}"
-  [[ -n "$prompt" ]] || read -r -p "Would you like to install 45Drives' cockpit-file-sharing, cockpit-identities, and cockpit-navigator  <y/N> " prompt
+  [[ -n "$prompt" ]] || read -r -p "Would you like to install 45Drives' cockpit-file-sharing, cockpit-identities, and cockpit-navigator  <y/N> " prompt || true
 fi
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
  msg_info "Installing 45Drives' cockpit extensions"
@@ -17,7 +17,8 @@ setup_hwaccel
 echo
 echo "${TAB3}Choose the GPU type for ComfyUI:"
 echo "${TAB3}[1]-None  [2]-NVIDIA  [3]-AMD  [4]-Intel"
-read -rp "${TAB3}Enter your choice [1-4] (default: 1): " gpu_choice
+gpu_choice="${var_comfyui_gpu_type:-}"
+[[ -n "$gpu_choice" ]] || read -rp "${TAB3}Enter your choice [1-4] (default: 1): " gpu_choice || true
 gpu_choice=${gpu_choice:-1}
 case "$gpu_choice" in
 1) comfyui_gpu_type="none" ;;
@@ -20,7 +20,7 @@ msg_ok "Installed Dependencies"
 NODE_VERSION="22" setup_nodejs

 onlyoffice="${var_cryptpad_onlyoffice:-}"
-[[ -n "$onlyoffice" ]] || read -rp "${TAB3}Install OnlyOffice components instead of CKEditor? (Y/N): " onlyoffice
+[[ -n "$onlyoffice" ]] || read -rp "${TAB3}Install OnlyOffice components instead of CKEditor? (Y/N): " onlyoffice || true
 fetch_and_deploy_gh_release "cryptpad" "cryptpad/cryptpad" "tarball"

 msg_info "Setup CryptPad"
@@ -28,11 +28,15 @@ cd /opt/cryptpad
 $STD npm ci --allow-git=all
 $STD npm run install:components
 if [[ "${onlyoffice,,}" =~ ^(y|yes)$ ]]; then
-  $STD bash -c "./install-onlyoffice.sh --accept-license"
+  $STD bash -c "./install-office.sh --accept-license"
 fi
 cp config/config.example.js config/config.js
-sed -i "51s/localhost/${LOCAL_IP}/g" /opt/cryptpad/config/config.js
-sed -i "80s#//httpAddress: 'localhost'#httpAddress: '0.0.0.0'#g" /opt/cryptpad/config/config.js
+cp config/infra.example.js config/infra.js
+sed -i \
+  -e "s|origin: \"http://localhost:3000\"|origin: \"http://${LOCAL_IP}:3000\"|" \
+  -e "s|sandboxOrigin: \"http://localhost:3001\"|sandboxOrigin: \"http://${LOCAL_IP}:3001\"|" \
+  -e "s|httpHost: \"localhost\"|httpHost: \"0.0.0.0\"|" \
+  config/infra.js
 $STD npm run build
 msg_ok "Setup CryptPad"

@@ -15,11 +15,8 @@ update_os

 setup_deb_based() {
  setup_docker
-  if [[ -n "${var_docker_socket:-}" ]]; then
-    socket_choice="$var_docker_socket"
-  else
-    read -r -p "${TAB3}Expose Docker TCP socket (insecure) ? [n = No, l = Local only (127.0.0.1), a = All interfaces (0.0.0.0)] <n/l/a>: " socket_choice
-  fi
+  socket_choice="${var_docker_socket:-}"
+  [[ -n "$socket_choice" ]] || read -r -p "${TAB3}Expose Docker TCP socket (insecure) ? [n = No, l = Local only (127.0.0.1), a = All interfaces (0.0.0.0)] <n/l/a>: " socket_choice || true
  case "${socket_choice,,}" in
  l | local)
    socket="tcp://127.0.0.1:2375"
@@ -70,11 +67,8 @@ setup_alpine() {
  msg_ok "Installed Docker"

  DOCKER_COMPOSE_LATEST_VERSION=$(get_latest_github_release "docker/compose" false)
-  if [[ -n "${var_docker_compose:-}" ]]; then
-    prompt="$var_docker_compose"
-  else
-    read -r -p "${TAB3}Would you like to add Docker Compose? <y/N> " prompt
-  fi
+  prompt="${var_docker_compose:-}"
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Docker Compose? <y/N> " prompt || true
  if [[ "${prompt,,}" =~ ^(y|yes|true)$ ]]; then
    msg_info "Installing Docker Compose $DOCKER_COMPOSE_LATEST_VERSION"
    DOCKER_CONFIG=${DOCKER_CONFIG:-$HOME/.docker}
@@ -83,11 +77,8 @@ setup_alpine() {
    chmod +x "$DOCKER_CONFIG"/cli-plugins/docker-compose
    msg_ok "Installed Docker Compose $DOCKER_COMPOSE_LATEST_VERSION"
  fi
-  if [[ -n "${var_docker_socket:-}" ]]; then
-    prompt="$var_docker_socket"
-  else
-    read -r -p "${TAB3}Would you like to expose the Docker TCP socket? <y/N> " prompt
-  fi
+  prompt="${var_docker_socket:-}"
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to expose the Docker TCP socket? <y/N> " prompt || true
  case "${prompt,,}" in
  y | yes | a | all) socket="tcp://0.0.0.0:2375" ;;
  l | local) socket="tcp://127.0.0.1:2375" ;;
@@ -26,8 +26,9 @@ $STD apt install -y \
  nginx
 msg_ok "Installed Dependencies"

-var_project_name="default"
-read -r -p "${TAB3}Type the assembly name of the project: " var_project_name
+var_project_name="${var_project_name:-}"
+[[ -n "$var_project_name" ]] || read -r -p "${TAB3}Type the assembly name of the project: " var_project_name || true
+[[ -n "$var_project_name" ]] || { msg_error "No assembly name given; set var_project_name or answer the prompt"; exit 64; }

 msg_info "Setting up FTP Server"
 useradd ftpuser
@@ -0,0 +1,136 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/dreeveapp/dreeve
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  libsqlite3-0 \
+  libcap2-bin \
+  ca-certificates
+msg_ok "Installed Dependencies"
+
+# 1.13.0's php-cli shifts the script into argv[1], which breaks composer and bin/console (php/frankenphp#2690); unpin once 1.13.1 is out
+fetch_and_deploy_gh_release "frankenphp" "php/frankenphp" "singlefile" "v1.12.7" "/opt/frankenphp" "frankenphp-linux-$(arch_resolve x86_64 aarch64)-gnu"
+fetch_and_deploy_gh_release "dreeve" "dreeveapp/dreeve" "tarball"
+
+msg_info "Providing php CLI"
+cat <<'EOF' >/usr/local/bin/php
+#!/usr/bin/env bash
+exec /opt/frankenphp/frankenphp php-cli "$@"
+EOF
+chmod +x /usr/local/bin/php
+msg_ok "Provided php CLI"
+
+msg_info "Installing Composer"
+curl -fsSL https://getcomposer.org/installer -o /tmp/composer-setup.php
+$STD /opt/frankenphp/frankenphp php-cli /tmp/composer-setup.php --install-dir=/usr/local/bin --filename=composer
+rm -f /tmp/composer-setup.php
+msg_ok "Installed Composer"
+
+msg_info "Installing PHP Dependencies (Patience)"
+cd /opt/dreeve
+export COMPOSER_ALLOW_SUPERUSER=1
+export APP_ENV=prod
+$STD /opt/frankenphp/frankenphp php-cli /usr/local/bin/composer install --no-dev --optimize-autoloader --no-interaction --no-scripts
+msg_ok "Installed PHP Dependencies"
+
+msg_info "Configuring Dreeve"
+mkdir -p /opt/dreeve_data /opt/dreeve/var/{cache,log}
+DREEVE_PASSWORD=$(openssl rand -base64 18)
+DREEVE_HASH=$(DREEVE_PASSWORD="$DREEVE_PASSWORD" /opt/frankenphp/frankenphp php-cli -r 'echo password_hash(getenv("DREEVE_PASSWORD"), PASSWORD_BCRYPT, ["cost" => 13]);')
+[[ "$DREEVE_HASH" =~ ^\$2y\$ ]] || {
+  msg_error "Could not generate the admin password hash"
+  exit 1
+}
+cat <<EOF >/opt/dreeve/.env.local
+APP_ENV=prod
+APP_DEBUG=0
+APP_SECRET=$(openssl rand -hex 32)
+APP_URL=http://${LOCAL_IP}:8080
+DATABASE_DIRECTORY=/opt/dreeve_data
+ADMIN_USERNAME=admin
+ADMIN_PASSWORD_HASH='${DREEVE_HASH}'
+TZ=UTC
+
+# Create an API application at https://www.strava.com/settings/api
+STRAVA_CLIENT_ID=replace-me
+STRAVA_CLIENT_SECRET=replace-me
+STRAVA_REFRESH_TOKEN=replace-me
+EOF
+chmod 600 /opt/dreeve/.env.local
+
+cat <<EOF >~/dreeve.creds
+Dreeve Admin
+Username: admin
+Password: ${DREEVE_PASSWORD}
+EOF
+chmod 600 ~/dreeve.creds
+
+cat <<EOF >/opt/dreeve/Caddyfile
+{
+	http_port 8080
+	auto_https off
+
+	frankenphp {
+		num_threads 3
+		worker {
+			num 2
+			file /opt/dreeve/public/index.php
+		}
+	}
+}
+
+:8080 {
+	root /opt/dreeve/public
+	encode zstd br gzip
+	php_server
+}
+EOF
+msg_ok "Configured Dreeve"
+
+msg_info "Initializing Database"
+cd /opt/dreeve
+set -a
+source /opt/dreeve/.env.local
+set +a
+$STD /opt/frankenphp/frankenphp php-cli bin/console app:db:migrate --no-interaction
+$STD /opt/frankenphp/frankenphp php-cli bin/console assets:install public --no-interaction
+$STD /opt/frankenphp/frankenphp php-cli bin/console cache:warmup --env=prod
+msg_ok "Initialized Database"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/dreeve.service
+[Unit]
+Description=Dreeve
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/dreeve
+EnvironmentFile=/opt/dreeve/.env.local
+ExecStart=/opt/frankenphp/frankenphp run --config /opt/dreeve/Caddyfile
+Restart=on-failure
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now dreeve
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc
@@ -23,7 +23,9 @@ NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs

 echo "${TAB3}It is important to choose the name for your server before you install Synapse, because it cannot be changed later."
 echo "${TAB3}The server name determines the “domain” part of user-ids for users on your server: these will all be of the format @user:my.domain.name. It also determines how other matrix servers will reach yours for federation."
-read -p "${TAB3}Please enter the name for your server: " servername
+servername="${var_elementsynapse_server_name:-}"
+[[ -n "$servername" ]] || read -r -p "${TAB3}Please enter the name for your server: " servername || true
+[[ -n "$servername" ]] || { msg_error "No server name given; set var_elementsynapse_server_name or answer the prompt"; exit 64; }

 msg_info "Installing Element Synapse"
 setup_deb822_repo "matrix-org" \
@@ -38,7 +40,7 @@ chmod +x /usr/sbin/policy-rc.d
 $STD apt install matrix-synapse-py3 -y
 rm -f /usr/sbin/policy-rc.d
 sed -i 's/127.0.0.1/0.0.0.0/g' /etc/matrix-synapse/homeserver.yaml
-sed -i 's/'\''::1'\'', //g' /etc/matrix-synapse/homeserver.yaml
+sed -i '/^ *- ::1$/d' /etc/matrix-synapse/homeserver.yaml
 SECRET=$(openssl rand -hex 32)
 ADMIN_PASS="$(random_password 13)"
 echo "enable_registration_without_verification: true" >>/etc/matrix-synapse/homeserver.yaml
@@ -69,7 +71,7 @@ Admin username: admin
 Admin password: $ADMIN_PASS
 EOF
 systemctl stop matrix-synapse
-sed -i '34d' /etc/matrix-synapse/homeserver.yaml
+sed -i '/^enable_registration_without_verification: true$/d' /etc/matrix-synapse/homeserver.yaml
 systemctl start matrix-synapse
 msg_ok "Installed Element Synapse"

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/emdash-cms/emdash
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+NODE_VERSION="24" NODE_MODULE="pnpm@11" setup_nodejs
+
+msg_info "Creating EmDash Site"
+cd /opt
+$STD pnpm dlx create-emdash@latest emdash --platform node --template "${var_emdash_template:-blog}" --pm pnpm --no-install --yes
+mkdir -p /opt/emdash_data/uploads
+mv /opt/emdash/.env /opt/emdash_data/.env
+sed -i -e 's|file:./data.db|file:/opt/emdash_data/data.db|' -e 's|"./uploads"|"/opt/emdash_data/uploads"|' /opt/emdash/astro.config.mjs
+cat <<EOF >>/opt/emdash_data/.env
+HOST=0.0.0.0
+PORT=4321
+# The address in the browser bar. Passkeys are bound to its hostname, and the build bakes it in for image optimization:
+# after a change run cd /opt/emdash && set -a && . /opt/emdash_data/.env && set +a && pnpm build && systemctl restart emdash
+EMDASH_SITE_URL=${var_emdash_url:-http://${LOCAL_IP}:4321}
+EOF
+chmod 600 /opt/emdash_data/.env
+msg_ok "Created EmDash Site"
+
+msg_info "Building EmDash"
+cd /opt/emdash
+# pnpm keeps Astro's sharp out of the site's reach, and every /_image request then fails with MissingSharp
+$STD pnpm add sharp
+set -a && source /opt/emdash_data/.env && set +a
+$STD pnpm build
+cat <<EOF >~/.emdash
+emdash@$(node -p 'require("/opt/emdash/node_modules/emdash/package.json").version')
+EOF
+msg_ok "Built EmDash"
+
+msg_info "Creating EmDash Service"
+cat <<EOF >/etc/systemd/system/emdash.service
+[Unit]
+Description=EmDash
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/emdash
+EnvironmentFile=/opt/emdash_data/.env
+Environment=NODE_ENV=production
+ExecStart=/usr/bin/node /opt/emdash/dist/server/entry.mjs
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now emdash
+msg_ok "Created EmDash Service"
+
+motd_ssh
+customize
+cleanup_lxc
@@ -39,7 +39,7 @@ echo "$LATEST_VERSION" >~/.emqx
 msg_ok "Installed EMQX"

 prompt="${var_emqx_disable_mq:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to disable the EMQX MQ feature? (reduces disk/CPU usage) <y/N> " prompt
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to disable the EMQX MQ feature? (reduces disk/CPU usage) <y/N> " prompt || true
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  msg_info "Disabling EMQX MQ feature"
  mkdir -p /etc/emqx
@@ -19,7 +19,7 @@ $STD apt install -y \
  nginx
 msg_ok "Installed Dependencies"

-NODE_VERSION="20" setup_nodejs
+NODE_VERSION="24" setup_nodejs
 PG_VERSION="18" setup_postgresql
 PG_DB_NAME="excalidash" PG_DB_USER="excalidash" setup_postgresql_db

@@ -45,7 +45,8 @@ $STD ln -svf /usr/bin/ffmpeg /usr/local/bin/ffmpeg
 $STD ln -svf /usr/bin/ffprobe /usr/local/bin/ffprobe
 $STD rm -rf /opt/fileflows/Server/runtimes/win-*

-read -r -p "${TAB3}Do you want to install FileFlows Server or Agent? (S/A): " install_server
+install_server="${var_fileflows_mode:-}"
+[[ -n "$install_server" ]] || read -r -p "${TAB3}Do you want to install FileFlows Server or Agent? (S/A): " install_server || true

 if [[ "$install_server" =~ ^[Ss]$ ]]; then
  msg_info "Installing FileFlows Server"
@@ -54,9 +55,10 @@ if [[ "$install_server" =~ ^[Ss]$ ]]; then
  systemctl enable -q --now fileflows
  msg_ok "Installed FileFlows Server"
 else
-  read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url
+  server_url="${var_fileflows_server_url:-}"
+  [[ -n "$server_url" ]] || read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url || true
  while [[ -z "${server_url// /}" ]]; do
-    read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url
+    read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url || { msg_error "No FileFlows Server URL given; set var_fileflows_server_url or answer the prompt"; exit 64; }
  done
  msg_info "Installing FileFlows Agent"
  cd /opt/fileflows/Agent
@@ -15,12 +15,12 @@ update_os
 setup_yq

 if [[ -z "${var_forgejo_instance:-}" ]]; then
-  read -r -p "${TAB3}Forgejo Instance URL (e.g. https://codeberg.org): " var_forgejo_instance
+  read -r -p "${TAB3}Forgejo Instance URL (e.g. https://codeberg.org): " var_forgejo_instance || true
  var_forgejo_instance="${var_forgejo_instance:-https://codeberg.org}"
 fi

 if [[ -z "${var_forgejo_runner_uuid:-}" ]]; then
-  read -r -p "${TAB3}Forgejo Runner UUID: " var_forgejo_runner_uuid
+  read -r -p "${TAB3}Forgejo Runner UUID: " var_forgejo_runner_uuid || true
 fi

 if [[ -z "${var_forgejo_runner_uuid:-}" ]]; then
@@ -29,7 +29,7 @@ if [[ -z "${var_forgejo_runner_uuid:-}" ]]; then
 fi

 if [[ -z "${var_forgejo_runner_token:-}" ]]; then
-  read -r -p "${TAB3}Forgejo Runner Token: " var_forgejo_runner_token
+  read -r -p "${TAB3}Forgejo Runner Token: " var_forgejo_runner_token || true
 fi

 if [[ -z "${var_forgejo_runner_token:-}" ]]; then
@@ -39,7 +39,7 @@ fi

 DEFAULT_RUNNER_LABELS="linux-amd64:docker://node:22-bookworm"
 if [[ -z "${var_runner_labels:-}" ]]; then
-  read -r -p "${TAB3}Additional runner labels (comma-separated, or leave blank for default only): " var_runner_labels
+  read -r -p "${TAB3}Additional runner labels (comma-separated, or leave blank for default only): " var_runner_labels || true
 fi
 if [[ -n "${var_runner_labels:-}" ]]; then
  RUNNER_LABELS="${DEFAULT_RUNNER_LABELS},${var_runner_labels}"
@@ -110,7 +110,7 @@ export AUTOGRAPH_VERBOSITY=0
 export GLOG_minloglevel=3
 export GLOG_logtostderr=0

-fetch_and_deploy_gh_release "frigate" "blakeblackshear/frigate" "tarball" "v0.18.0" "/opt/frigate"
+fetch_and_deploy_gh_release "frigate" "blakeblackshear/frigate" "tarball" "v0.18.2" "/opt/frigate"

 msg_info "Building Nginx"
 $STD bash /opt/frigate/docker/main/build_nginx.sh
@@ -124,6 +124,8 @@ msg_ok "Built SQLite Extensions"

 if [[ "$(arch_resolve)" == "amd64" ]]; then
  msg_info "Building Intel Media Driver (Patience)"
+  download_gpg_key "https://repositories.intel.com/gpu/intel-graphics.key" "/usr/share/keyrings/intel-graphics.gpg" "dearmor"
+  sed -i '/intel-graphics.key/d' /opt/frigate/docker/main/build_intel_media_driver.sh
  $STD bash /opt/frigate/docker/main/build_intel_media_driver.sh
  cp -a /rootfs/. /
  rm -rf /rootfs
@@ -51,8 +51,10 @@ echo -e ""
 msg_custom "🪙" "$YW" "CoinGecko API keys are optional but provide better cryptocurrency data."
 msg_custom "🪙" "$YW" "You can skip this and add them later by editing /opt/ghostfolio/.env"
 echo -e ""
-read -rp "${TAB3}CoinGecko Demo API key (press Enter to skip): " COINGECKO_DEMO_KEY
-read -rp "${TAB3}CoinGecko Pro API key (press Enter to skip): " COINGECKO_PRO_KEY
+COINGECKO_DEMO_KEY="${var_ghostfolio_coingecko_demo_key:-}"
+[[ -n "$COINGECKO_DEMO_KEY" ]] || read -rp "${TAB3}CoinGecko Demo API key (press Enter to skip): " COINGECKO_DEMO_KEY || true
+COINGECKO_PRO_KEY="${var_ghostfolio_coingecko_pro_key:-}"
+[[ -n "$COINGECKO_PRO_KEY" ]] || read -rp "${TAB3}CoinGecko Pro API key (press Enter to skip): " COINGECKO_PRO_KEY || true

 msg_info "Setting up Environment"
 cat <<EOF >/opt/ghostfolio/.env
@@ -34,6 +34,7 @@ $STD apt install -y \
  pkg-config \
  poppler-utils \
  python3-dev \
+  redis-server \
  tesseract-ocr
 msg_ok "Installed Dependencies"

@@ -70,6 +71,8 @@ REQUEST_CACHE_CONFIG={"CACHE_TYPE":"FileSystemCache","CACHE_DIR":"/opt/gramps-we
 PERSISTENT_CACHE_CONFIG={"CACHE_TYPE":"FileSystemCache","CACHE_DIR":"/opt/gramps-web/data/cache/persistent","CACHE_THRESHOLD":0,"CACHE_DEFAULT_TIMEOUT":0}
 REPORT_DIR="/opt/gramps-web/data/cache/report"
 EXPORT_DIR="/opt/gramps-web/data/cache/export"
+CELERY_CONFIG={"broker_url":"redis://127.0.0.1:6379/0","result_backend":"redis://127.0.0.1:6379/0"}
+RATELIMIT_STORAGE_URI="redis://127.0.0.1:6379/1"
 EOF
 $STD uv venv -c -p python3.12 /opt/gramps-web/venv
 source /opt/gramps-web/venv/bin/activate
@@ -107,7 +110,8 @@ msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/gramps-web.service
 [Unit]
 Description=Gramps Web Service
-After=network.target
+After=network.target redis-server.service
+Wants=redis-server.service

 [Service]
 Type=simple
@@ -124,7 +128,28 @@ RestartSec=5
 [Install]
 WantedBy=multi-user.target
 EOF
-systemctl enable -q --now gramps-web
+cat <<EOF >/etc/systemd/system/gramps-web-celery.service
+[Unit]
+Description=Gramps Web Celery Worker
+After=network.target redis-server.service
+Wants=redis-server.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/gramps-web-api
+Environment=GRAMPS_API_CONFIG=/opt/gramps-web/config/config.cfg
+Environment=GRAMPSHOME=/opt/gramps-web/data
+Environment=GRAMPS_DATABASE_PATH=/opt/gramps-web/data/gramps/grampsdb
+Environment=PATH=/opt/gramps-web/venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+ExecStart=/opt/gramps-web/venv/bin/celery -A gramps_webapi.celery worker --loglevel=INFO --concurrency=2
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now gramps-web gramps-web-celery
 msg_ok "Created Service"

 motd_ssh
@@ -16,7 +16,7 @@ update_os
 fetch_and_deploy_gh_release "headscale" "juanfont/headscale" "binary"

 prompt="${var_headscale_admin:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add headscale-admin UI? <y/N> " prompt
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add headscale-admin UI? <y/N> " prompt || true
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  fetch_and_deploy_gh_release "headscale-admin" "GoodiesHQ/headscale-admin" "prebuild" "latest" "/opt/headscale-admin" "admin.zip"

@@ -25,7 +25,7 @@ msg_info "Setting up Heimdall-Dashboard"
 cd /opt/Heimdall
 cp .env.example .env
 sed -i 's/^APP_ENV=.*/APP_ENV=production/' .env
-$STD php artisan key:generate
+$STD php artisan key:generate --force
 msg_ok "Setup Heimdall-Dashboard"

 msg_info "Creating Service"
@@ -14,7 +14,9 @@ network_check
 update_os

 msg_info "Installing Dependencies"
-$STD apt install -y git
+$STD apt install -y \
+  git \
+  libatomic1
 msg_ok "Installed Dependencies"

 NODE_VERSION="22" setup_nodejs
@@ -27,78 +29,71 @@ msg_ok "Created Hermes User"

 msg_info "Configuring Service Environment"
 cat <<EOF >/etc/default/hermes
-HOME=/home/hermes
 PATH=/home/hermes/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 NODE_OPTIONS=${NODE_OPTIONS}
+GATEWAY_HEALTH_URL=http://127.0.0.1:8642/health
 EOF
 msg_ok "Configured Service Environment"

 confirm_external_installer "https://hermes-agent.nousresearch.com/" "https://hermes-agent.nousresearch.com/install.sh"

 msg_info "Installing Hermes Agent"
-curl -fsSL https://hermes-agent.nousresearch.com/install.sh -o /tmp/hermes-install.sh
-$STD setsid --wait bash -c '
+curl_with_retry "https://hermes-agent.nousresearch.com/install.sh" /tmp/hermes-install.sh ||
+  curl_with_retry "https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scripts/install.sh" /tmp/hermes-install.sh
+chmod 644 /tmp/hermes-install.sh
+$STD setsid --wait runuser -l hermes -c '
  set -a; source /etc/default/hermes; set +a
  export npm_config_yes=true
-  bash /tmp/hermes-install.sh --skip-setup --hermes-home /home/hermes/.hermes --dir /home/hermes/.hermes/hermes-agent
+  bash /tmp/hermes-install.sh --skip-setup --hermes-home ~/.hermes --dir ~/.hermes/hermes-agent
 '
 rm -f /tmp/hermes-install.sh
-chown -R hermes:hermes /home/hermes
 chmod 750 /home/hermes
 chmod 700 /home/hermes/.hermes
-git config --system --add safe.directory /home/hermes/.hermes/hermes-agent 2>/dev/null || true
 msg_ok "Installed Hermes Agent"

 msg_info "Configuring API Server"
 API_SERVER_KEY=$(random_password 32)
-mkdir -p /home/hermes/.hermes
 cat <<EOF >/home/hermes/.hermes/.env
 API_SERVER_ENABLED=true
 API_SERVER_HOST=0.0.0.0
 API_SERVER_PORT=8642
 API_SERVER_KEY=${API_SERVER_KEY}
 EOF
+chown hermes:hermes /home/hermes/.hermes/.env
 chmod 600 /home/hermes/.hermes/.env
 msg_ok "Configured API Server"

 msg_info "Creating Dashboard Service"
-cat <<EOF >/etc/systemd/system/hermes-dashboard.service
+mkdir -p /home/hermes/.config/systemd/user
+cat <<EOF >/home/hermes/.config/systemd/user/hermes-dashboard.service
 [Unit]
 Description=Hermes Agent Web Dashboard
 After=network-online.target
-Wants=network-online.target

 [Service]
 Type=simple
-User=hermes
-Group=hermes
 UMask=0077
-WorkingDirectory=/home/hermes
-ExecStart=/home/hermes/.local/bin/hermes dashboard --host 127.0.0.1 --port 9119 --no-open
+WorkingDirectory=%h
 EnvironmentFile=/etc/default/hermes
+ExecStart=%h/.local/bin/hermes dashboard --host 127.0.0.1 --port 9119 --no-open
 Restart=on-failure
 RestartSec=5
-ProtectProc=invisible
-ProcSubset=pid

 [Install]
-WantedBy=multi-user.target
+WantedBy=default.target
 EOF
-systemctl enable -q --now hermes-dashboard
+chown -R hermes:hermes /home/hermes/.config
+$STD runuser -l hermes -c 'systemctl --user daemon-reload && systemctl --user enable --now hermes-dashboard'
 msg_ok "Created Dashboard Service"

 msg_info "Creating Setup Helper"
 cat <<'SETUP' >/usr/bin/hermes-setup
 #!/usr/bin/env bash
-set -a; source /etc/default/hermes; set +a
-/home/hermes/.local/bin/hermes setup
-chown -R hermes:hermes /home/hermes
-chmod 750 /home/hermes
-chmod 700 /home/hermes/.hermes
+su - hermes -c 'set -a; source /etc/default/hermes; set +a; hermes setup'
 if [[ -f /home/hermes/.config/systemd/user/hermes-gateway.service ]]; then
  su - hermes -c 'systemctl --user enable --now hermes-gateway'
 fi
-echo "Hermes setup complete. File permissions restored."
+echo "Hermes setup complete."
 SETUP
 chmod +x /usr/bin/hermes-setup
 msg_ok "Created Setup Helper"
@@ -17,7 +17,7 @@ msg_info "Installing Dependencies"
 $STD apt install -y jq
 msg_ok "Installed Dependencies"

-NODE_VERSION="22" NODE_MODULE="pnpm@latest" setup_nodejs
+NODE_VERSION="24" NODE_MODULE="pnpm@latest" setup_nodejs
 fetch_and_deploy_gh_release "homepage" "gethomepage/homepage" "tarball"
 RELEASE=$(get_latest_github_release "gethomepage/homepage")

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/EgalitarianMonkey/hometube
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+setup_ffmpeg
+PYTHON_VERSION="3.13" setup_uv
+fetch_and_deploy_gh_release "deno" "denoland/deno" "prebuild" "latest" "/usr/local/bin" "deno-$(arch_resolve "x86_64" "aarch64")-unknown-linux-gnu.zip"
+fetch_and_deploy_gh_release "yt-dlp" "yt-dlp/yt-dlp" "singlefile" "latest" "/usr/local/bin" "yt-dlp_$(arch_resolve "linux" "linux_aarch64")"
+fetch_and_deploy_gh_release "hometube" "EgalitarianMonkey/hometube" "tarball"
+
+msg_info "Installing HomeTube"
+cd /opt/hometube
+$STD uv sync --locked --no-dev --no-install-project --no-install-package pyarrow
+mkdir -p /opt/hometube_data/{videos,tmp,cookies}
+cat <<EOF >/opt/hometube_data/.env
+VIDEOS_FOLDER=/opt/hometube_data/videos
+TMP_DOWNLOAD_FOLDER=/opt/hometube_data/tmp
+YOUTUBE_COOKIES_FILE_PATH=/opt/hometube_data/cookies/youtube_cookies.txt
+REMOVE_TMP_FILES_AFTER_DOWNLOAD=true
+EOF
+msg_ok "Installed HomeTube"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/hometube.service
+[Unit]
+Description=HomeTube
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/hometube
+EnvironmentFile=/opt/hometube_data/.env
+Environment=PYTHONUNBUFFERED=1
+ExecStartPre=-/usr/local/bin/yt-dlp -U
+ExecStart=/opt/hometube/.venv/bin/python -m streamlit run app/main.py --server.port=8501 --server.address=0.0.0.0 --server.headless=true --server.enableCORS=false --server.enableXsrfProtection=false
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now hometube
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc
@@ -0,0 +1,168 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/plastic-labs/honcho
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y redis-server
+msg_ok "Installed Dependencies"
+
+PG_VERSION="17" PG_MODULES="pgvector" setup_postgresql
+PG_DB_NAME="honcho" PG_DB_USER="honcho" PG_DB_EXTENSIONS="vector,pg_trgm" setup_postgresql_db
+PYTHON_VERSION="3.13" setup_uv
+fetch_and_deploy_gh_release "honcho" "plastic-labs/honcho" "tarball" "latest" "/opt/honcho" "" "v"
+
+msg_info "Installing Honcho"
+cd /opt/honcho
+$STD uv sync --frozen --no-dev
+msg_ok "Installed Honcho"
+
+if [[ -t 0 && -z "${var_honcho_provider:-}${var_honcho_api_key:-}${var_honcho_base_url:-}" ]]; then
+  echo -e "${INFO}${YW} Honcho needs an LLM provider for memory, embeddings and chat; without a key it is installed but not started.${CL}"
+  read -t 300 -rsp "${TAB3}OpenAI API key (Enter to set up a provider later): " var_honcho_api_key || true
+  echo
+fi
+
+declare -A HONCHO_KEY=([openai]="" [anthropic]="" [gemini]="")
+case "${var_honcho_provider:-openai}" in
+anthropic)
+  HONCHO_TRANSPORT="anthropic" HONCHO_MODEL="${var_honcho_model:-claude-haiku-4-5}"
+  HONCHO_EMBEDDING="openai" HONCHO_EMBEDDING_MODEL="${var_honcho_embedding_model:-text-embedding-3-small}"
+  HONCHO_KEY[anthropic]="${var_honcho_api_key:-}"
+  HONCHO_KEY[openai]="${var_honcho_embedding_key:-}"
+  ;;
+gemini)
+  HONCHO_TRANSPORT="gemini" HONCHO_MODEL="${var_honcho_model:-gemini-2.5-flash}"
+  HONCHO_EMBEDDING="gemini" HONCHO_EMBEDDING_MODEL="${var_honcho_embedding_model:-gemini-embedding-001}"
+  HONCHO_KEY[gemini]="${var_honcho_api_key:-}"
+  ;;
+*)
+  HONCHO_TRANSPORT="openai" HONCHO_MODEL="${var_honcho_model:-gpt-5.4-mini}"
+  HONCHO_EMBEDDING="openai" HONCHO_EMBEDDING_MODEL="${var_honcho_embedding_model:-text-embedding-3-small}"
+  HONCHO_KEY[openai]="${var_honcho_api_key:-${var_honcho_base_url:+not-needed}}"
+  ;;
+esac
+
+msg_info "Configuring Honcho"
+mkdir -p /opt/honcho_data
+cat <<EOF >/opt/honcho_data/.env
+DB_CONNECTION_URI=postgresql+psycopg://honcho:${PG_DB_PASS}@localhost:5432/honcho
+CACHE_ENABLED=true
+CACHE_URL=redis://localhost:6379/0?suppress=true
+
+# Every /v3 API request needs a JWT signed with this secret. Mint one with:
+# cd /opt/honcho && .venv/bin/python scripts/generate_jwt.py --admin
+AUTH_USE_AUTH=true
+AUTH_JWT_SECRET=$(openssl rand -hex 32)
+WEBHOOK_SECRET=$(openssl rand -hex 32)
+
+# Transports: openai (OpenAI or any OpenAI-compatible endpoint), anthropic, gemini.
+# Embeddings run on openai or gemini only. Apply changes with: systemctl restart honcho honcho-deriver
+LLM_OPENAI_API_KEY=${HONCHO_KEY[openai]}
+LLM_ANTHROPIC_API_KEY=${HONCHO_KEY[anthropic]}
+LLM_GEMINI_API_KEY=${HONCHO_KEY[gemini]}
+
+# An OpenAI-compatible endpoint (OpenRouter, Ollama, vLLM, LiteLLM) replaces api.openai.com through both lines:
+#LLM_OPENAI_BASE_URL=http://192.168.1.50:11434/v1
+#EMBEDDING_MODEL_CONFIG__OVERRIDES__BASE_URL=http://192.168.1.50:11434/v1
+# Endpoints without OpenAI Structured Outputs need:
+#DERIVER_MODEL_CONFIG__STRUCTURED_OUTPUT_MODE=json_object
+
+EMBEDDING_MODEL_CONFIG__TRANSPORT=${HONCHO_EMBEDDING}
+EMBEDDING_MODEL_CONFIG__MODEL=${HONCHO_EMBEDDING_MODEL}
+# A model with another vector size works only while nothing is embedded yet: set it here, then run
+# cd /opt/honcho && .venv/bin/python scripts/configure_embeddings.py --yes
+#EMBEDDING_VECTOR_DIMENSIONS=1536
+
+# The deriver waits for about 512 new tokens per peer, or 30 minutes, before it calls the LLM
+#DERIVER_FLUSH_ENABLED=true
+
+# Models for the deriver, summaries, dreams and dialectic chat; they must support tool calling
+EOF
+for prefix in DERIVER SUMMARY DREAM_DEDUCTION DREAM_INDUCTION DIALECTIC_LEVELS__{minimal,low,medium,high,max}_; do
+  cat <<EOF >>/opt/honcho_data/.env
+${prefix}_MODEL_CONFIG__TRANSPORT=${HONCHO_TRANSPORT}
+${prefix}_MODEL_CONFIG__MODEL=${HONCHO_MODEL}
+EOF
+done
+if [[ -n "${var_honcho_base_url:-}" ]]; then
+  cat <<EOF >>/opt/honcho_data/.env
+
+LLM_OPENAI_BASE_URL=${var_honcho_base_url}
+EMBEDDING_MODEL_CONFIG__OVERRIDES__BASE_URL=${var_honcho_base_url}
+EOF
+fi
+if [[ -n "${var_honcho_embedding_dims:-}" ]]; then
+  cat <<EOF >>/opt/honcho_data/.env
+EMBEDDING_VECTOR_DIMENSIONS=${var_honcho_embedding_dims}
+EOF
+fi
+chmod 600 /opt/honcho_data/.env
+ln -sf /opt/honcho_data/.env /opt/honcho/.env
+msg_ok "Configured Honcho"
+
+msg_info "Migrating Honcho Database"
+$STD .venv/bin/python scripts/provision_db.py
+$STD .venv/bin/python scripts/configure_embeddings.py --yes
+msg_ok "Migrated Honcho Database"
+
+msg_info "Creating Honcho Services"
+cat <<EOF >/etc/systemd/system/honcho.service
+[Unit]
+Description=Honcho API
+After=network.target postgresql.service redis-server.service
+Requires=postgresql.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/honcho
+Environment=PYTHONUNBUFFERED=1
+ExecStart=/opt/honcho/.venv/bin/fastapi run --host 0.0.0.0 --port 8000 src/main.py
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+cat <<EOF >/etc/systemd/system/honcho-deriver.service
+[Unit]
+Description=Honcho Deriver
+After=network.target postgresql.service redis-server.service honcho.service
+Requires=postgresql.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/honcho
+Environment=PYTHONUNBUFFERED=1
+ExecStart=/opt/honcho/.venv/bin/python -m src.deriver
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+msg_ok "Created Honcho Services"
+
+if [[ -n "${HONCHO_KEY[$HONCHO_TRANSPORT]}" && -n "${HONCHO_KEY[$HONCHO_EMBEDDING]}" ]]; then
+  msg_info "Starting Honcho"
+  systemctl enable -q --now honcho honcho-deriver
+  msg_ok "Started Honcho"
+else
+  msg_warn "No LLM provider key (with Anthropic also an OpenAI key for embeddings): Honcho stays stopped until it is set in /opt/honcho_data/.env"
+fi
+
+motd_ssh
+customize
+cleanup_lxc
@@ -13,7 +13,12 @@ setting_up_container
 network_check
 update_os

-RELEASE="v3.3.4"
+if is_debian && [[ "$(get_os_version_major)" -lt 13 ]]; then
+  msg_error "Immich needs Debian 13: its build dependencies and Intel runtime packages are not available on Debian 12."
+  exit 238
+fi
+
+RELEASE="v3.3.5"
 if lscpu | grep -q 'GenuineIntel'; then
  echo ""
  echo ""
@@ -25,7 +30,7 @@ if lscpu | grep -q 'GenuineIntel'; then
  echo " 2) **NEW** Intel OpenVINO CPU or iGPU"
  echo ""

-  read -r -p "${TAB3}Select machine-learning type [1]: " ML_TYPE
+  read -r -p "${TAB3}Select machine-learning type [1]: " ML_TYPE || true
  ML_TYPE="${ML_TYPE:-1}"
  if [[ "$ML_TYPE" == "2" ]]; then
    touch ~/.openvino
@@ -110,7 +115,7 @@ setup_deb822_repo \
  "https://repo.jellyfin.org/jellyfin_team.gpg.key" \
  "https://repo.jellyfin.org/debian" \
  "$(get_os_info codename)"
-$STD apt install -y jellyfin-ffmpeg7
+install_packages_with_retry jellyfin-ffmpeg7
 ln -sf /usr/lib/jellyfin-ffmpeg/ffmpeg /usr/bin/ffmpeg
 ln -sf /usr/lib/jellyfin-ffmpeg/ffprobe /usr/bin/ffprobe

@@ -124,12 +129,9 @@ if [[ "$CTTYPE" == "0" && -d /dev/dri ]]; then
 fi
 msg_ok "Dependencies Installed"

-msg_info "Installing Mise"
-curl -fSs https://mise.jdx.dev/gpg-key.pub | tee /etc/apt/keyrings/mise-archive-keyring.pub 1>/dev/null
-echo "deb [signed-by=/etc/apt/keyrings/mise-archive-keyring.pub arch=$(arch_resolve)] https://mise.jdx.dev/deb stable main" >/etc/apt/sources.list.d/mise.list
-apt_update_safe
-$STD apt install -y mise
-msg_ok "Installed Mise"
+MISE_ARCH="x64"
+[[ "$(arch_resolve)" == "arm64" ]] && MISE_ARCH="arm64"
+fetch_and_deploy_gh_release "mise" "jdx/mise" "singlefile" "latest" "/usr/local/bin" "mise-v*-linux-${MISE_ARCH}"

 msg_info "Configuring Debian Testing Repo"
 if [[ -f /etc/apt/sources.list.d/debian.sources ]]; then
@@ -21,7 +21,8 @@ setup_deb822_repo \
  "stable"
 msg_ok "Set up InfluxDB Repository"

-read -r -p "${TAB3}Which version of InfluxDB to install? (1, 2 or 3) " prompt
+prompt="${var_influxdb_version:-}"
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Which version of InfluxDB to install? (1, 2 or 3) " prompt || true
 if [[ $prompt == "3" ]]; then
  INFLUX="3"
 elif [[ $prompt == "2" ]]; then
@@ -51,7 +52,7 @@ fi
 msg_ok "Installed InfluxDB"

 prompt="${var_influxdb_telegraf:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Telegraf? <y/N> " prompt
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Telegraf? <y/N> " prompt || true
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
  msg_info "Installing Telegraf"
  $STD apt install -y telegraf
@@ -52,6 +52,9 @@ chown -R www-data:www-data /opt/invoiceshelf
 chmod -R 775 storage bootstrap/cache
 $STD php artisan migrate --force
 $STD php artisan storage:link
+cat <<'EOF' >/etc/cron.d/invoiceshelf
+* * * * * www-data cd /opt/invoiceshelf && php artisan schedule:run >> /dev/null 2>&1
+EOF
 msg_ok "Set up InvoiceShelf"

 msg_info "Configuring Caddy"
@@ -13,6 +13,12 @@ setting_up_container
 network_check
 update_os

+if [[ "${CTTYPE:-1}" != "0" ]]; then
+  msg_error "iVentoy requires a privileged LXC container."
+  msg_error "Recreate the container with unprivileged=0."
+  exit 10
+fi
+
 fetch_and_deploy_gh_release "iventoy" "ventoy/PXE" "prebuild" "latest" "/opt/iventoy" "iventoy-*-linux-$(arch_resolve x86_64-free arm64-trial).tar.gz"
 mkdir -p /opt/iventoy/{data,iso}

@@ -37,10 +37,10 @@ fi
 msg_ok "Installed Docker"

 msg_info "Detecting latest Kasm Workspaces release"
-KASM_URL=$(curl -s https://kasm.com/downloads \
+KASM_URL=$(curl -s --max-time 30 https://kasm.com/downloads \
  | grep -oP 'https://kasm-static-content\.s3\.amazonaws\.com/kasm_release_\d+\.\d+\.\d+-latest\.tar\.gz' \
-  | head -1)
-KASM_VERSION=$(echo "$KASM_URL" | grep -oP '\d+\.\d+\.\d+(?=-latest)')
+  | head -1 || true)
+KASM_VERSION=$(echo "$KASM_URL" | grep -oP '\d+\.\d+\.\d+(?=-latest)' || true)

 # Fallback to predefined version if online lookup failed.
 if [[ -z "$KASM_VERSION" ]] || [[ -z "$KASM_URL" ]]; then
@@ -63,7 +63,7 @@ curl_download "/opt/kasm_release_${KASM_VERSION}.tar.gz" "$KASM_URL"
 cd /opt
 tar -xf "kasm_release_${KASM_VERSION}.tar.gz"
 chmod +x /opt/kasm_release/install.sh
-printf 'y\ny\ny\n4\n' | bash /opt/kasm_release/install.sh --ignore-dep-failures >~/kasm-install.output 2>&1
+bash /opt/kasm_release/install.sh --accept-eula --no-swap-check --no-check-disk --ignore-dep-failures >~/kasm-install.output 2>&1
 awk '
  /^Kasm UI Login Credentials$/ {capture=1}
  capture {print}
@@ -28,9 +28,15 @@ mkdir -p config/assets
 cp config/config.yml.template config/config.yml
 msg_ok "Setup Kometa"

-read -r -p "${TAB3}Enter your TMDb API key: " TMDBKEY
-read -r -p "${TAB3}Enter your Plex URL: " PLEXURL
-read -r -p "${TAB3}Enter your Plex token: " PLEXTOKEN
+TMDBKEY="${var_kometa_tmdb_key:-}"
+[[ -n "$TMDBKEY" ]] || read -r -p "${TAB3}Enter your TMDb API key: " TMDBKEY || true
+[[ -n "$TMDBKEY" ]] || { msg_error "No TMDb API key given; set var_kometa_tmdb_key or answer the prompt"; exit 64; }
+PLEXURL="${var_kometa_plex_url:-}"
+[[ -n "$PLEXURL" ]] || read -r -p "${TAB3}Enter your Plex URL: " PLEXURL || true
+[[ -n "$PLEXURL" ]] || { msg_error "No Plex URL given; set var_kometa_plex_url or answer the prompt"; exit 64; }
+PLEXTOKEN="${var_kometa_plex_token:-}"
+[[ -n "$PLEXTOKEN" ]] || read -r -p "${TAB3}Enter your Plex token: " PLEXTOKEN || true
+[[ -n "$PLEXTOKEN" ]] || { msg_error "No Plex token given; set var_kometa_plex_token or answer the prompt"; exit 64; }
 sed -i '/^plex:/,/^[^ ]/{s|  url:.*|  url: '"$PLEXURL"'|}' /opt/kometa/config/config.yml
 sed -i '/^plex:/,/^[^ ]/{s|  token:.*|  token: '"$PLEXTOKEN"'|}' /opt/kometa/config/config.yml
 sed -i '/^tmdb:/,/^[^ ]/{s|  apikey:.*|  apikey: '"$TMDBKEY"'|}' /opt/kometa/config/config.yml
@@ -15,7 +15,8 @@ update_os

 echo "${TAB3}How would you like to handle SSL termination?"
 echo "${TAB3}[i]-Internal (self-signed SSL Certificate)   [e]-External (use your own reverse proxy)"
-read -rp "${TAB3}Enter your choice <i/e> (default: i): " ssl_choice
+ssl_choice="${var_kutt_ssl:-}"
+[[ -n "$ssl_choice" ]] || read -rp "${TAB3}Enter your choice <i/e> (default: i): " ssl_choice || true
 ssl_choice=${ssl_choice:-i}
 case "${ssl_choice,,}" in
 i)
@@ -32,7 +33,9 @@ EOF
  msg_ok "Configured Caddy"
  ;;
 e)
-  read -r -p "${TAB3}Enter the hostname you want to use for Kutt (eg. kutt.example.com): " custom_host
+  custom_host="${var_kutt_hostname:-}"
+  [[ -n "$custom_host" ]] || read -r -p "${TAB3}Enter the hostname you want to use for Kutt (eg. kutt.example.com): " custom_host || true
+  [[ -n "$custom_host" ]] || { msg_error "No hostname given; set var_kutt_hostname or answer the prompt"; exit 64; }
  if [[ "$custom_host" ]]; then
    DEFAULT_HOST="$custom_host"
  fi
@@ -29,12 +29,12 @@ rm -f /tmp/LanguageTool-stable.zip
 msg_ok "Setup LanguageTool"

 ngram_dir=""
-lang_code=""
+lang_code="${var_languagetool_ngram_lang:-}"
 max_attempts=3
 attempt=0

 while [[ $attempt -lt $max_attempts ]]; do
-  read -r -p "${TAB3}Enter language code (en, de, es, fr, nl) to download ngrams or press ENTER to skip: " lang_code
+  [[ -n "$lang_code" ]] || read -r -p "${TAB3}Enter language code (en, de, es, fr, nl) to download ngrams or press ENTER to skip: " lang_code || lang_code=""

  if [[ -z "$lang_code" ]]; then
    break
@@ -43,11 +43,11 @@ while [[ $attempt -lt $max_attempts ]]; do
  if [[ "$lang_code" =~ [[:space:]] ]]; then
    ((attempt++))
    remaining=$((max_attempts - attempt))
+    lang_code=""
    if [[ $remaining -gt 0 ]]; then
      msg_error "Please enter only ONE language code. You have $remaining attempt(s) remaining."
    else
      msg_error "Maximum attempts reached. Continuing without ngrams."
-      lang_code=""
    fi
    continue
  fi
@@ -25,7 +25,7 @@ RUST_CRATES="monolith" setup_rust
 PG_DB_NAME="linkwardendb" PG_DB_USER="linkwarden" setup_postgresql_db

 prompt="${var_linkwarden_adminer:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Adminer? <y/N> " prompt
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Adminer? <y/N> " prompt || true
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
  setup_adminer
 fi
@@ -61,6 +61,7 @@ $STD yarn web:build
 $STD yarn prisma:deploy
 rm -rf ~/.cargo/registry ~/.cargo/git ~/.cargo/.package-cache
 rm -rf /root/.cache/yarn
+rm -rf /root/.yarn/berry/cache
 rm -rf /opt/linkwarden/.next/cache
 msg_ok "Installed Linkwarden"

@@ -22,7 +22,7 @@ setup_deb_based() {
  msg_ok "Setup MariaDB"

  prompt="${var_mariadb_phpmyadmin:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add PhpMyAdmin? <y/N> " prompt
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add PhpMyAdmin? <y/N> " prompt || true
  if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
    msg_info "Installing phpMyAdmin"
    $STD apt install -y \
@@ -60,7 +60,7 @@ setup_alpine() {
  msg_ok "MariaDB Configured"

  prompt="${var_mariadb_adminer:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install Adminer with lighttpd? <y/N>: " prompt
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install Adminer with lighttpd? <y/N>: " prompt || true
  if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
    msg_info "Installing Adminer and dependencies"
    $STD apk add --no-cache \
@@ -23,6 +23,7 @@ $STD apt install -y \
  libldap-common \
  libssl-dev \
  libldap2 \
+  ffmpeg \
  gosu \
  iproute2
 msg_ok "Installed Dependencies"
@@ -13,7 +13,9 @@ setting_up_container
 network_check
 update_os

-read -r -p "${TAB3}Enter the email address of your first admin user: " admin_email
+admin_email="${var_mediamanager_admin_email:-}"
+[[ -n "$admin_email" ]] || read -r -p "${TAB3}Enter the email address of your first admin user: " admin_email || true
+[[ -n "$admin_email" ]] || { msg_error "No admin e-mail given; set var_mediamanager_admin_email or answer the prompt"; exit 64; }
 if [[ "$admin_email" ]]; then
  EMAIL="$admin_email"
 fi
@@ -16,7 +16,7 @@ update_os
 MEILISEARCH_BIND="0.0.0.0:7700" setup_meilisearch

 prompt="${var_meilisearch_ui:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Do you want add meilisearch-ui? [y/n]: " prompt
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Do you want add meilisearch-ui? [y/n]: " prompt || true
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  NODE_VERSION="22" NODE_MODULE="pnpm@latest" setup_nodejs
  fetch_and_deploy_gh_release "meilisearch-ui" "riccox/meilisearch-ui" "tarball"
@@ -17,7 +17,7 @@ msg_info "Installing Dependencies"
 $STD apt install -y ca-certificates
 msg_ok "Installed Dependencies"

-NODE_VERSION="22" setup_nodejs
+NODE_VERSION="24" setup_nodejs

 msg_info "Installing MeshCentral"
 mkdir /opt/meshcentral
@@ -16,8 +16,9 @@ update_os
 if [[ "$(arch_resolve)" == "arm64" ]]; then
  MONGO_VERSION="8.0" setup_mongodb
 else
-  read -p "${TAB3}Do you want to install MongoDB 8.0 instead of 7.0? [y/N]: " install_mongodb_8
-  if [[ "$install_mongodb_8" =~ ^[Yy]$ ]]; then
+  install_mongodb_8="${var_mongodb_8:-}"
+  [[ -n "$install_mongodb_8" ]] || read -r -p "${TAB3}Do you want to install MongoDB 8.0 instead of 7.0? [y/N]: " install_mongodb_8 || true
+  if [[ "$install_mongodb_8" =~ ^[Yy]([Ee][Ss])?$ ]]; then
    MONGO_VERSION="8.0" setup_mongodb
  else
    MONGO_VERSION="7.0" setup_mongodb
@@ -21,7 +21,8 @@ msg_ok "Installed Dependencies"

 RELEASE_REPO="mysql-8.0"
 RELEASE_AUTH="mysql_native_password"
-read -r -p "${TAB3}Would you like to install the MySQL 8.4 LTS release instead of MySQL 8.0 (bug fix track; EOL April-2026)? <y/N> " prompt
+prompt="${var_mysql_lts:-}"
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install the MySQL 8.4 LTS release instead of MySQL 8.0 (bug fix track; EOL April-2026)? <y/N> " prompt || true
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
  RELEASE_REPO="mysql-8.4-lts"
  RELEASE_AUTH="caching_sha2_password"
@@ -61,7 +62,8 @@ echo -e "MySQL user: root" >>~/mysql.creds
 echo -e "MySQL password: $ADMIN_PASS" >>~/mysql.creds
 msg_ok "MySQL Server configured"

-read -r -p "${TAB3}Would you like to add PhpMyAdmin? <y/N> " prompt
+prompt="${var_mysql_phpmyadmin:-}"
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add PhpMyAdmin? <y/N> " prompt || true
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/phpmyadmin.sh)"
 fi
@@ -36,7 +36,8 @@ echo " 1) NetBird Managed (default) - Use NetBird's managed service"
 echo " 2) Self-Hosted - Use your own NetBird management server"
 echo ""

-read -r -p "${TAB3}Select deployment type [1]: " DEPLOYMENT_TYPE
+DEPLOYMENT_TYPE="${var_netbird_deployment:-}"
+[[ -n "$DEPLOYMENT_TYPE" ]] || read -r -p "${TAB3}Select deployment type [1]: " DEPLOYMENT_TYPE || true
 DEPLOYMENT_TYPE="${DEPLOYMENT_TYPE:-1}"

 NETBIRD_MGMT_URL=""
@@ -51,7 +52,8 @@ case "$DEPLOYMENT_TYPE" in
    echo "Enter your NetBird management server URL."
    echo "Example: https://management.example.com"
    echo ""
-    read -r -p "Management URL: " NETBIRD_MGMT_URL
+    NETBIRD_MGMT_URL="${var_netbird_mgmt_url:-}"
+    [[ -n "$NETBIRD_MGMT_URL" ]] || read -r -p "Management URL: " NETBIRD_MGMT_URL || true

    if [[ -z "$NETBIRD_MGMT_URL" ]]; then
      msg_warn "No management URL provided. Run 'netbird up --management-url <url>' to connect."
@@ -81,7 +83,8 @@ else
 fi
 echo ""

-read -r -p "Select authentication method [1]: " AUTH_METHOD
+AUTH_METHOD="${var_netbird_auth:-}"
+[[ -n "$AUTH_METHOD" ]] || read -r -p "Select authentication method [1]: " AUTH_METHOD || true
 AUTH_METHOD="${AUTH_METHOD:-1}"

 if [[ "$DEPLOYMENT_TYPE" == "1" ]]; then
@@ -90,7 +93,8 @@ if [[ "$DEPLOYMENT_TYPE" == "1" ]]; then
      echo ""
      echo "Enter your NetBird setup key from the NetBird dashboard."
      echo ""
-      read -r -p "Setup key: " NETBIRD_SETUP_KEY
+      NETBIRD_SETUP_KEY="${var_netbird_setup_key:-}"
+      [[ -n "$NETBIRD_SETUP_KEY" ]] || read -r -p "Setup key: " NETBIRD_SETUP_KEY || true
      echo ""

      if [[ -z "$NETBIRD_SETUP_KEY" ]]; then
@@ -136,7 +140,8 @@ else
      echo ""
      echo "Enter your NetBird setup key from the NetBird dashboard."
      echo ""
-      read -r -p "Setup key: " NETBIRD_SETUP_KEY
+      NETBIRD_SETUP_KEY="${var_netbird_setup_key:-}"
+      [[ -n "$NETBIRD_SETUP_KEY" ]] || read -r -p "Setup key: " NETBIRD_SETUP_KEY || true
      echo ""

      if [[ -z "$NETBIRD_SETUP_KEY" ]]; then
@@ -16,16 +16,15 @@ update_os
 fetch_and_deploy_gh_release "newt" "fosrl/newt" "singlefile" "latest" "/opt/newt" "newt_linux_$(arch_resolve)"
 ln -sf /opt/newt/newt /usr/local/bin/newt

-if [[ -z "${NEWT_ID:-}" ]]; then
-  read -rp "Newt ID (from your Pangolin dashboard): " NEWT_ID
-fi
-if [[ -z "${NEWT_SECRET:-}" ]]; then
-  read -rsp "Newt Secret: " NEWT_SECRET
+NEWT_ID="${NEWT_ID:-${var_newt_id:-}}"
+[[ -n "$NEWT_ID" ]] || read -rp "Newt ID (from your Pangolin dashboard): " NEWT_ID || true
+NEWT_SECRET="${NEWT_SECRET:-${var_newt_secret:-}}"
+if [[ -z "$NEWT_SECRET" ]]; then
+  read -rsp "Newt Secret: " NEWT_SECRET || true
  echo
 fi
-if [[ -z "${PANGOLIN_ENDPOINT:-}" ]]; then
-  read -rp "Pangolin endpoint (e.g. https://pangolin.example.com): " PANGOLIN_ENDPOINT
-fi
+PANGOLIN_ENDPOINT="${PANGOLIN_ENDPOINT:-${var_newt_endpoint:-}}"
+[[ -n "$PANGOLIN_ENDPOINT" ]] || read -rp "Pangolin endpoint (e.g. https://pangolin.example.com): " PANGOLIN_ENDPOINT || true

 if [[ -z "$NEWT_ID" || -z "$NEWT_SECRET" || -z "$PANGOLIN_ENDPOINT" ]]; then
  msg_error "Newt ID, Secret and Endpoint are all required. Aborting."
@@ -38,12 +38,14 @@ curl -fsSL "https://raw.githubusercontent.com/ZoeyVid/NPMplus/refs/heads/develop
 msg_ok "Fetched NPMplus"

 attempts=0
+TZ_INPUT="${var_npmplus_tz:-}"
 while true; do
-  read -r -p "${TAB3}Enter your TZ Identifier (e.g., Europe/Berlin): " TZ_INPUT
+  [[ -n "$TZ_INPUT" ]] || read -r -p "${TAB3}Enter your TZ Identifier (e.g., Europe/Berlin): " TZ_INPUT || { msg_error "No TZ identifier given; set var_npmplus_tz or answer the prompt"; exit 64; }
  if validate_tz "$TZ_INPUT"; then
    break
  fi
  msg_error "Invalid timezone! Please enter a valid TZ identifier."
+  TZ_INPUT=""

  attempts=$((attempts + 1))
  if [[ "$attempts" -ge 3 ]]; then
@@ -52,7 +54,9 @@ while true; do
  fi
 done

-read -r -p "${TAB3}Enter your ACME Email: " ACME_EMAIL_INPUT
+ACME_EMAIL_INPUT="${var_npmplus_acme_email:-}"
+[[ -n "$ACME_EMAIL_INPUT" ]] || read -r -p "${TAB3}Enter your ACME Email: " ACME_EMAIL_INPUT || true
+[[ -n "$ACME_EMAIL_INPUT" ]] || { msg_error "No ACME e-mail given; set var_npmplus_acme_email or answer the prompt"; exit 64; }

 yq -i "
  .services.npmplus.environment |=
@@ -57,10 +57,6 @@ else
  }
 fi
 msg_ok "Installed Intel® Level Zero"
-
-msg_info "Installing Intel® oneAPI Base Toolkit (Patience)"
-$STD apt install -y --no-install-recommends intel-basekit-2024.1
-msg_ok "Installed Intel® oneAPI Base Toolkit"
 fi

 msg_info "Installing Ollama (Patience)"
@@ -14,7 +14,9 @@ network_check
 update_os

 msg_info "Installing Dependencies"
-$STD apt install -y nginx
+$STD apt install -y \
+  git \
+  nginx
 msg_ok "Installed Dependencies"

 NODE_VERSION="24" setup_nodejs
@@ -24,6 +26,8 @@ msg_info "Building OmniTools"
 cd /opt/omnitools
 export HUSKY=0
 $STD npm ci --allow-remote=all
+$STD git init -q
+$STD git -c user.name=build -c user.email=build@localhost commit -q --allow-empty -m build
 $STD npm run build
 msg_ok "Built OmniTools"

@@ -17,19 +17,23 @@ MAX_ATTEMPTS=3
 servers=("opencloud" "collabora" "wopi")
 attempt=0
 for server in "${servers[@]}"; do
+  fqdn_var="var_opencloud_${server}_fqdn"
+  fqdn="${!fqdn_var:-}"
  until ((attempt >= MAX_ATTEMPTS)); do
    attempt=$((attempt + 1))
-    read -rp "${TAB3}Enter the FQDN of your ${server^} server (ATTEMPT $attempt/$MAX_ATTEMPTS) (eg $server.domain.tld): " fqdn
+    [[ -n "$fqdn" ]] || read -rp "${TAB3}Enter the FQDN of your ${server^} server (ATTEMPT $attempt/$MAX_ATTEMPTS) (eg $server.domain.tld): " fqdn || { msg_error "No ${server^} FQDN given; set ${fqdn_var} or answer the prompt"; exit 64; }
    if [[ -z "$fqdn" ]]; then
      msg_warn "Domain cannot be empty!"
    elif [[ "$fqdn" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]]; then
      msg_warn "IP address not allowed! Please use a FQDN"
+      fqdn=""
    elif [[ "$fqdn" =~ ^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*\.[a-zA-Z]{2,}$ ]]; then
      export ${server^^}_FQDN="$fqdn"
      attempt=0
      break
    else
      msg_warn "Invalid domain format!"
+      fqdn=""
    fi
  done
  if ((attempt >= MAX_ATTEMPTS)); then
@@ -27,7 +27,7 @@ PYTHON_VERSION="3.12" setup_uv

 OTEL_ARGS=()
 prompt="${var_openwebui_otel:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install OpenTelemetry instrumentation packages (requires manual .env configuration)? <y/N> " prompt
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install OpenTelemetry instrumentation packages (requires manual .env configuration)? <y/N> " prompt || true
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  for pkg in \
    opentelemetry-api \
@@ -57,7 +57,7 @@ done
 msg_ok "Installed Open WebUI"

 prompt="${var_openwebui_ollama:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Ollama? <y/N> " prompt
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Ollama? <y/N> " prompt || true
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  if [[ "$(arch_resolve)" == "amd64" ]]; then
  msg_info "Setting up Intel® Repositories"
@@ -96,10 +96,6 @@ EOF
    }
  fi
  msg_ok "Installed Intel® Level Zero"
-
-  msg_info "Installing Intel® oneAPI Base Toolkit (Patience)"
-  $STD apt install -y --no-install-recommends intel-basekit-2024.1 2>/dev/null || true
-  msg_ok "Installed Intel® oneAPI Base Toolkit"
  fi

  msg_info "Installing Ollama"
@@ -27,17 +27,22 @@ apt_update_safe
 $STD apt install -y openziti-controller openziti-console </dev/null
 msg_ok "Installed openziti"

-read -r -p "${TAB3}Would you like to go through the auto configuration now? <y/N>" prompt
+prompt="${var_openziti_controller_autoconfig:-}"
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to go through the auto configuration now? <y/N>" prompt || true
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  GEN_FQDN="controller.${LOCAL_IP}.sslip.io"
-  read -r -p "${TAB3}Please enter the controller FQDN [${GEN_FQDN}]: " ZITI_CTRL_ADVERTISED_ADDRESS
+  ZITI_CTRL_ADVERTISED_ADDRESS="${var_openziti_controller_fqdn:-}"
+  [[ -n "$ZITI_CTRL_ADVERTISED_ADDRESS" ]] || read -r -p "${TAB3}Please enter the controller FQDN [${GEN_FQDN}]: " ZITI_CTRL_ADVERTISED_ADDRESS || true
  ZITI_CTRL_ADVERTISED_ADDRESS=${ZITI_CTRL_ADVERTISED_ADDRESS:-$GEN_FQDN}
-  read -r -p "${TAB3}Please enter the controller port [1280]: " ZITI_CTRL_ADVERTISED_PORT
+  ZITI_CTRL_ADVERTISED_PORT="${var_openziti_controller_port:-}"
+  [[ -n "$ZITI_CTRL_ADVERTISED_PORT" ]] || read -r -p "${TAB3}Please enter the controller port [1280]: " ZITI_CTRL_ADVERTISED_PORT || true
  ZITI_CTRL_ADVERTISED_PORT=${ZITI_CTRL_ADVERTISED_PORT:-1280}
-  read -r -p "${TAB3}Please enter the controller admin user [admin]: " ZITI_USER
+  ZITI_USER="${var_openziti_controller_user:-}"
+  [[ -n "$ZITI_USER" ]] || read -r -p "${TAB3}Please enter the controller admin user [admin]: " ZITI_USER || true
  ZITI_USER=${ZITI_USER:-admin}
  GEN_PWD=$(head -c128 /dev/urandom | LC_ALL=C tr -dc 'A-Za-z0-9!@#$%^*_+~' | cut -c 1-12)
-  read -r -p "${TAB3}Please enter the controller admin password [${GEN_PWD}]:" ZITI_PWD
+  ZITI_PWD="${var_openziti_controller_password:-}"
+  [[ -n "$ZITI_PWD" ]] || read -r -p "${TAB3}Please enter the controller admin password [${GEN_PWD}]:" ZITI_PWD || true
  ZITI_PWD=${ZITI_PWD:-$GEN_PWD}
  CONFIG_FILE="/opt/openziti/etc/controller/bootstrap.env"
  sed -i "s|^ZITI_CTRL_ADVERTISED_ADDRESS=.*|ZITI_CTRL_ADVERTISED_ADDRESS='${ZITI_CTRL_ADVERTISED_ADDRESS}'|" "$CONFIG_FILE"
@@ -29,7 +29,8 @@ sed -i '0,/^ExecStart/ { /^ExecStart/ { n; s|^ExecStart.*|ExecStart=/opt/openzit
 systemctl daemon-reload
 msg_ok "Installed openziti"

-read -r -p "${TAB3}Please paste an identity enrollment token(JTW)" prompt
+prompt="${var_openziti_tunnel_enrollment_token:-}"
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Please paste an identity enrollment token(JTW)" prompt || true
 if [[ ${prompt} ]]; then
  msg_info "Adding identity"
  echo "${prompt}" >/opt/openziti/etc/identities/identity.jwt
@@ -27,15 +27,13 @@ fetch_and_deploy_gh_release "gerbil" "fosrl/gerbil" "singlefile" "latest" "/usr/
 fetch_and_deploy_gh_release "traefik" "traefik/traefik" "prebuild" "latest" "/usr/bin" "traefik_v*_linux_$(arch_resolve).tar.gz"

 pango_url="${var_pangolin_url:-}"
-if [[ -z "$pango_url" ]]; then
-  read -rp "${TAB3}Enter your Pangolin URL (ex: https://pangolin.example.com): " pango_url
-fi
+[[ -n "$pango_url" ]] || read -rp "${TAB3}Enter your Pangolin URL (ex: https://pangolin.example.com): " pango_url || true
+[[ -n "$pango_url" ]] || { msg_error "No Pangolin URL given; set var_pangolin_url or answer the prompt"; exit 64; }
 [[ "$pango_url" != https://* && "$pango_url" != http://* ]] && pango_url="https://${pango_url}"

 pango_email="${var_pangolin_email:-}"
-if [[ -z "$pango_email" ]]; then
-  read -rp "${TAB3}Enter your email address: " pango_email
-fi
+[[ -n "$pango_email" ]] || read -rp "${TAB3}Enter your email address: " pango_email || true
+[[ -n "$pango_email" ]] || { msg_error "No email address given; set var_pangolin_email or answer the prompt"; exit 64; }

 msg_info "Setup Pangolin"
 SECRET_KEY=$(random_password 32)
@@ -38,16 +38,22 @@ CGO_ENABLED=1 go build -tags musl -o paperless-gpt .
 msg_ok "Setup Paperless-GPT"

 mkdir -p /opt/paperless-gpt-data
-read -rp "${TAB3}Do you want to enter the Paperless local URL now? (y/n) " input_url
-if [[ $input_url =~ ^[Yy]$ ]]; then
-  read -rp "${TAB3}Enter your Paperless-NGX instance URL (e.g., http://192.168.1.100:8000): " PAPERLESS_BASE_URL
+input_url="${var_paperless_gpt_enter_url:-}"
+[[ -n "$input_url" ]] || read -rp "${TAB3}Do you want to enter the Paperless local URL now? (y/n) " input_url || true
+if [[ $input_url =~ ^[Yy]([Ee][Ss])?$ ]]; then
+  PAPERLESS_BASE_URL="${var_paperless_gpt_url:-}"
+  [[ -n "$PAPERLESS_BASE_URL" ]] || read -rp "${TAB3}Enter your Paperless-NGX instance URL (e.g., http://192.168.1.100:8000): " PAPERLESS_BASE_URL || true
+  [[ -n "$PAPERLESS_BASE_URL" ]] || { msg_error "No Paperless-NGX URL given; set var_paperless_gpt_url or answer the prompt"; exit 64; }
 else
  PAPERLESS_BASE_URL="http://your_paperless_ngx_url"
 fi

-read -rp "${TAB3}Do you want to enter the Paperless API token now? (y/n) " input_token
-if [[ $input_token =~ ^[Yy]$ ]]; then
-  read -rp "${TAB3}Enter your Paperless API token: " PAPERLESS_API_TOKEN
+input_token="${var_paperless_gpt_enter_token:-}"
+[[ -n "$input_token" ]] || read -rp "${TAB3}Do you want to enter the Paperless API token now? (y/n) " input_token || true
+if [[ $input_token =~ ^[Yy]([Ee][Ss])?$ ]]; then
+  PAPERLESS_API_TOKEN="${var_paperless_gpt_api_token:-}"
+  [[ -n "$PAPERLESS_API_TOKEN" ]] || read -rp "${TAB3}Enter your Paperless API token: " PAPERLESS_API_TOKEN || true
+  [[ -n "$PAPERLESS_API_TOKEN" ]] || { msg_error "No Paperless API token given; set var_paperless_gpt_api_token or answer the prompt"; exit 64; }
 else
  PAPERLESS_API_TOKEN="your_paperless_api_token"
 fi
@@ -52,7 +52,7 @@ msg_info "Setup Paperless-ngx"
 cd /opt/paperless
 rm -rf /opt/paperless/docker
 $STD uv sync --all-extras
-mkdir -p /opt/paperless_data/{consume,data,media,trash}
+mkdir -p /opt/paperless_data/{consume,data,index,media,trash}
 mkdir -p /opt/paperless/static
 SECRET_KEY="$(random_password 32)"
 cat <<EOF >~/paperless-ngx.creds
@@ -172,7 +172,7 @@ systemctl enable -q --now paperless-webserver paperless-scheduler paperless-task
 msg_ok "Created Services"

 prompt="${var_paperless_ngx_adminer:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Adminer? <y/N> " prompt
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Adminer? <y/N> " prompt || true
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
  setup_adminer
 fi
@@ -107,7 +107,7 @@ ExecStart=/opt/patchmon/patchmon-server
 Restart=always
 RestartSec=10
 Environment=PATH=/usr/bin:/usr/local/bin
-EnvironmentFile=/opt/patchmon/.env
+Environment=ENV_FILE=/opt/patchmon/.env
 NoNewPrivileges=true
 PrivateTmp=true
 ProtectSystem=strict
@@ -22,7 +22,9 @@ msg_ok "Installed Dependencies"
 msg_info "Installing Pi-hole"
 mkdir -p /etc/pihole
 touch /etc/pihole/pihole.toml
-$STD bash <(curl -fsSL https://install.pi-hole.net) --unattended
+curl_with_retry "https://install.pi-hole.net" /tmp/pihole-install.sh
+$STD bash /tmp/pihole-install.sh --unattended
+rm -f /tmp/pihole-install.sh
 sed -i -E '
 /^\s*upstreams =/ s|=.*|= ["8.8.8.8", "8.8.4.4"]|
 /^\s*interface =/ s|=.*|= "eth0"|
@@ -57,10 +59,10 @@ systemctl restart pihole-FTL.service
 msg_ok "Installed Pi-hole"

 prompt="${var_pihole_unbound:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Unbound? <y/N> " prompt
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Unbound? <y/N> " prompt || true
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  prompt="${var_pihole_unbound_dot:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Unbound is configured as a recursive DNS server by default, would you like it to be configured as a forwarding DNS server (using DNS-over-TLS (DoT)) instead? <y/N> " prompt
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Unbound is configured as a recursive DNS server by default, would you like it to be configured as a forwarding DNS server (using DNS-over-TLS (DoT)) instead? <y/N> " prompt || true
  msg_info "Installing Unbound"
  mkdir -p /etc/unbound/unbound.conf.d
  cat <<EOF >/etc/unbound/unbound.conf.d/pi-hole.conf
@@ -13,7 +13,9 @@ setting_up_container
 network_check
 update_os

-read -r -p "${TAB3}What public URL do you want to use (e.g. pocketid.mydomain.com)? " public_url
+public_url="${var_pocketid_url:-}"
+[[ -n "$public_url" ]] || read -r -p "${TAB3}What public URL do you want to use (e.g. pocketid.mydomain.com)? " public_url || true
+[[ -n "$public_url" ]] || { msg_error "No public URL given; set var_pocketid_url or answer the prompt"; exit 64; }
 fetch_and_deploy_gh_release "pocket-id" "pocket-id/pocket-id" "singlefile" "latest" "/opt/pocket-id/" "pocket-id_linux_$(arch_resolve)"

 msg_info "Configuring Pocket ID"
--- a/Show More
+++ b/Show More