fix(graylog): set vm.max_map_count on host for OpenSearch

OpenSearch requires vm.max_map_count >= 262144 but the Linux default is 65530. Since this is not a namespaced sysctl, it must be set on the Proxmox host rather than inside the unprivileged LXC. Closes #13420
2026-04-03 00:32:58 +02:00 · 2026-03-31 20:50:50 +02:00
8 changed files with 11 additions and 186 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -429,33 +429,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 </details>

-## 2026-04-01
-
-### 🆕 New Scripts
-
-  - DrawDB ([#13454](https://github.com/community-scripts/ProxmoxVE/pull/13454))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - Filebrowser: make noauth setup use correct database [@MickLesk](https://github.com/MickLesk) ([#13457](https://github.com/community-scripts/ProxmoxVE/pull/13457))
-
-## 2026-03-31
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Graylog: set vm.max_map_count on host for OpenSearch [@MickLesk](https://github.com/MickLesk) ([#13441](https://github.com/community-scripts/ProxmoxVE/pull/13441))
-    - Koillection: ensure newline before appending to .env.local [@MickLesk](https://github.com/MickLesk) ([#13440](https://github.com/community-scripts/ProxmoxVE/pull/13440))
-
-### 💾 Core
-
-  - #### 🔧 Refactor
-
-    - core: skip empty gateway value in network config [@MickLesk](https://github.com/MickLesk) ([#13442](https://github.com/community-scripts/ProxmoxVE/pull/13442))
-
 ## 2026-03-30

 ### 🆕 New Scripts
--- a/ct/drawdb.sh
+++ b/ct/drawdb.sh
@@ -1,53 +0,0 @@
-#!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/drawdb-io/drawdb
-
-APP="DrawDB"
-var_tags="${var_tags:-database;dev-tools}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-6144}"
-var_disk="${var_disk:-5}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/drawdb ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_tag "drawdb" "drawdb-io/drawdb"; then
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_tag "drawdb" "drawdb-io/drawdb" "latest" "/opt/drawdb"
-
-    msg_info "Rebuilding Frontend"
-    cd /opt/drawdb
-    $STD npm ci
-    NODE_OPTIONS="--max-old-space-size=4096" $STD npm run build
-    sed -i '/<head>/a <script>if(!crypto.randomUUID){crypto.randomUUID=function(){return([1e7]+-1e3+-4e3+-8e3+-1e11).replace(/[018]/g,function(c){return(c^(crypto.getRandomValues(new Uint8Array(1))[0]&(15>>c/4))).toString(16)})}};</script>' /opt/drawdb/dist/index.html
-    msg_ok "Rebuilt Frontend"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:3000${CL}"
--- a/ct/headers/drawdb
+++ b/ct/headers/drawdb
@@ -1,6 +0,0 @@
-    ____                      ____  ____ 
-   / __ \_________ __      __/ __ \/ __ )
-  / / / / ___/ __ `/ | /| / / / / / __  |
- / /_/ / /  / /_/ /| |/ |/ / /_/ / /_/ / 
-/_____/_/   \__,_/ |__/|__/_____/_____/  
-                                         
--- a/ct/koillection.sh
+++ b/ct/koillection.sh
@@ -48,9 +48,7 @@ function update_script() {
    
    # Ensure APP_RUNTIME is in .env.local for CLI commands (upgrades from older versions)
    if ! grep -q "APP_RUNTIME" /opt/koillection/.env.local 2>/dev/null; then
-      # Ensure file ends with newline before appending to avoid concatenation
-      [[ -s /opt/koillection/.env.local && -n "$(tail -c 1 /opt/koillection/.env.local)" ]] && echo "" >>/opt/koillection/.env.local
-      echo 'APP_RUNTIME="Symfony\Component\Runtime\SymfonyRuntime"' >>/opt/koillection/.env.local
+      echo 'APP_RUNTIME="Symfony\Component\Runtime\SymfonyRuntime"' >> /opt/koillection/.env.local
    fi
    
    export COMPOSER_ALLOW_SUPERUSER=1
--- a/install/drawdb-install.sh
+++ b/install/drawdb-install.sh
@@ -1,52 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/drawdb-io/drawdb
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-msg_info "Installing Dependencies"
-$STD apt install -y nginx
-msg_ok "Installed Dependencies"
-
-NODE_VERSION="20" setup_nodejs
-fetch_and_deploy_gh_tag "drawdb" "drawdb-io/drawdb" "latest" "/opt/drawdb"
-
-msg_info "Building Frontend"
-cd /opt/drawdb
-$STD npm ci
-NODE_OPTIONS="--max-old-space-size=4096" $STD npm run build
-msg_ok "Built Frontend"
-
-msg_info "Applying crypto.randomUUID Polyfill"
-sed -i '/<head>/a <script>if(!crypto.randomUUID){crypto.randomUUID=function(){return([1e7]+-1e3+-4e3+-8e3+-1e11).replace(/[018]/g,function(c){return(c^(crypto.getRandomValues(new Uint8Array(1))[0]&(15>>c/4))).toString(16)})}};</script>' /opt/drawdb/dist/index.html
-msg_ok "Applied Polyfill"
-
-msg_info "Configuring Nginx"
-cat <<EOF >/etc/nginx/conf.d/drawdb.conf
-server {
-    listen 3000;
-    server_name _;
-    root /opt/drawdb/dist;
-
-    location / {
-        try_files \$uri /index.html;
-    }
-}
-EOF
-rm -f /etc/nginx/sites-enabled/default
-systemctl enable -q --now nginx
-systemctl reload nginx
-msg_ok "Configured Nginx"
-
-motd_ssh
-customize
-cleanup_lxc
--- a/misc/build.func
+++ b/misc/build.func
@@ -986,23 +986,13 @@ base_settings() {

  # Runtime check: Verify APT cacher is reachable if configured
  if [[ -n "$APT_CACHER_IP" && "$APT_CACHER" == "yes" ]]; then
-    local _check_host _check_port _check_url
-    _check_host=$(echo "$APT_CACHER_IP" | sed -e 's|https\?://||' -e 's|/.*||' | cut -d: -f1)
-    _check_port=$(echo "$APT_CACHER_IP" | sed -e 's|https\?://||' -e 's|/.*||' | cut -s -d: -f2)
-    if [[ "$APT_CACHER_IP" =~ ^https?:// ]]; then
-      _check_url="$APT_CACHER_IP"
-      _check_port="${_check_port:-80}"
-    else
-      _check_port="${_check_port:-3142}"
-      _check_url="http://${APT_CACHER_IP}:${_check_port}"
-    fi
-    if ! curl -s --connect-timeout 2 "${_check_url}" >/dev/null 2>&1; then
-      msg_warn "APT Cacher configured but not reachable at ${_check_url}"
+    if ! curl -s --connect-timeout 2 "http://${APT_CACHER_IP}:3142" >/dev/null 2>&1; then
+      msg_warn "APT Cacher configured but not reachable at ${APT_CACHER_IP}:3142"
      msg_custom "⚠️" "${YW}" "Disabling APT Cacher for this installation"
      APT_CACHER=""
      APT_CACHER_IP=""
    else
-      msg_ok "APT Cacher verified at ${_check_url}"
+      msg_ok "APT Cacher verified at ${APT_CACHER_IP}:3142"
    fi
  fi

@@ -1209,13 +1199,6 @@ load_vars_file() {
            continue
          fi
          ;;
-        var_apt_cacher_ip)
-          # Allow: plain IP/hostname, http://host, https://host:port
-          if [[ -n "$var_val" ]] && ! [[ "$var_val" =~ ^(https?://)?[a-zA-Z0-9._-]+(:[0-9]+)?(/.*)?$ ]]; then
-            msg_warn "Invalid APT Cacher address '$var_val' in $file, ignoring"
-            continue
-          fi
-          ;;
        var_container_storage | var_template_storage)
          # Validate that the storage exists and is active on the current node
          local _storage_status
@@ -1328,11 +1311,9 @@ var_ipv6_method=none
 var_ssh=no
 # var_ssh_authorized_key=

-# APT cacher (optional - IP or URL)
+# APT cacher (optional - with example)
 # var_apt_cacher=yes
 # var_apt_cacher_ip=192.168.1.10
-# var_apt_cacher_ip=http://proxy.local
-# var_apt_cacher_ip=https://proxy.local:443

 # Features/Tags/verbosity
 var_fuse=no
@@ -2545,7 +2526,7 @@ advanced_settings() {
        # Ask for IP if enabled
        if result=$(whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
          --title "APT CACHER IP" \
-          --inputbox "\nEnter APT Cacher-NG IP or URL:\n(e.g. 192.168.1.10, http://host, https://host:443)" 12 62 "$_apt_cacher_ip" \
+          --inputbox "\nEnter APT Cacher-NG server IP address:" 10 58 "$_apt_cacher_ip" \
          3>&1 1>&2 2>&3); then
          _apt_cacher_ip="$result"
        fi
@@ -3549,7 +3530,6 @@ build_container() {
  # Gateway
  if [[ -n "$GATE" ]]; then
    case "$GATE" in
-    ,gw=) ;;
    ,gw=*) NET_STRING+="$GATE" ;;
    *) NET_STRING+=",gw=$GATE" ;;
    esac
--- a/misc/install.func
+++ b/misc/install.func
@@ -390,24 +390,10 @@ update_os() {
  msg_info "Updating Container OS"
  if [[ "$CACHER" == "yes" ]]; then
    echo 'Acquire::http::Proxy-Auto-Detect "/usr/local/bin/apt-proxy-detect.sh";' >/etc/apt/apt.conf.d/00aptproxy
-    local _proxy_raw="${CACHER_IP}"
-    local _proxy_host _proxy_port _proxy_url
-    # Parse host and port from URL or plain IP/hostname
-    _proxy_host=$(echo "$_proxy_raw" | sed -e 's|https\?://||' -e 's|/.*||' | cut -d: -f1)
-    _proxy_port=$(echo "$_proxy_raw" | sed -e 's|https\?://||' -e 's|/.*||' | cut -s -d: -f2)
-    if [[ "$_proxy_raw" =~ ^https?:// ]]; then
-      # Full URL provided — use as-is for proxy output, extract port for nc check
-      _proxy_url="$_proxy_raw"
-      _proxy_port="${_proxy_port:-80}"
-    else
-      # Legacy: plain IP or hostname — default to http + port 3142
-      _proxy_port="${_proxy_port:-3142}"
-      _proxy_url="http://${_proxy_raw}:${_proxy_port}"
-    fi
    cat <<EOF >/usr/local/bin/apt-proxy-detect.sh
 #!/bin/bash
-if nc -w1 -z "${_proxy_host}" ${_proxy_port}; then
-  echo -n "${_proxy_url}"
+if nc -w1 -z "${CACHER_IP}" 3142; then
+  echo -n "http://${CACHER_IP}:3142"
 else
  echo -n "DIRECT"
 fi
--- a/tools/addon/filebrowser.sh
+++ b/tools/addon/filebrowser.sh
@@ -131,10 +131,9 @@ if [[ "${install_prompt,,}" =~ ^(y|yes)$ ]]; then
    cd /usr/local/community-scripts
    filebrowser config init -a '0.0.0.0' -p "$PORT" -d "$DB_PATH" &>/dev/null
    filebrowser config set -a '0.0.0.0' -p "$PORT" -d "$DB_PATH" &>/dev/null
-    filebrowser config set --auth.method=noauth --database "$DB_PATH" &>/dev/null
-    if ! filebrowser users update 1 --perm.admin --database "$DB_PATH" &>/dev/null; then
-      filebrowser users add admin community-scripts.org --perm.admin --database "$DB_PATH" &>/dev/null
-    fi
+    filebrowser config init --auth.method=noauth &>/dev/null
+    filebrowser config set --auth.method=noauth &>/dev/null
+    filebrowser users add ID 1 --perm.admin &>/dev/null
    msg_ok "No Authentication configured"
  else
    msg_info "Setting up default authentication"