add configurable host CA inheritance for LXC bootstrap

Introduce host CA certificate propagation in the shared LXC build flow so containers can trust enterprise/private PKI roots during early package bootstrap. Add an advanced-install toggle with default auto behavior so unattended installs remain seamless while interactive users can explicitly opt out.

.github/workflows/delete-merged-branches.yml

@@ -91,30 +91,6 @@ jobs:
             let skipped = 0;
 
             for (const branch of candidates) {
-              // A branch name can be reused after an earlier PR was merged. Never delete a
-              // branch while it is the head of a current open PR, even if it is also a
-              // candidate from an older merged PR.
-              try {
-                const { data: openPrs } = await github.rest.pulls.list({
-                  owner,
-                  repo,
-                  state: "open",
-                  head: `${owner}:${branch}`,
-                  per_page: 1,
-                });
-
-                if (openPrs.length > 0) {
-                  console.log(`Skipped "${branch}" (head of open PR #${openPrs[0].number})`);
-                  skipped++;
-                  continue;
-                }
-              } catch (error) {
-                // Do not risk deleting a branch if GitHub cannot confirm it has no open PR.
-                console.log(`Failed to check open PRs for "${branch}": ${error.message}`);
-                skipped++;
-                continue;
-              }
-
               // Confirm the branch still exists and isn't protected.
               let branchData;
               try {

CHANGELOG.md

@@ -504,42 +504,12 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ## 2026-07-17
 
-### 🆕 New Scripts
-
-  - Invidious ([#15824](https://github.com/community-scripts/ProxmoxVE/pull/15824))
-- OxiCloud ([#15823](https://github.com/community-scripts/ProxmoxVE/pull/15823))
-
 ### 🚀 Updated Scripts
 
-  - #### 🐞 Bug Fixes
-
-    - webtrees: initialize database schema before admin user creation [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15837](https://github.com/community-scripts/ProxmoxVE/pull/15837))
-    - Fix DocuSeal missing Leptonica deps on install and update [@Copilot](https://github.com/Copilot) ([#15858](https://github.com/community-scripts/ProxmoxVE/pull/15858))
-    - apache-guacamole: detect installed extensions during update [@TowyTowy](https://github.com/TowyTowy) ([#15841](https://github.com/community-scripts/ProxmoxVE/pull/15841))
-    - CLIProxyAPI: fix update deleting config.yaml [@austinpilz](https://github.com/austinpilz) ([#15834](https://github.com/community-scripts/ProxmoxVE/pull/15834))
-    - esphome: install libusb-1.0-0 for ESP-IDF native builds [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15838](https://github.com/community-scripts/ProxmoxVE/pull/15838))
-
   - #### ✨ New Features
 
-    - AFFiNE: Bump to 0.27.0 [@MickLesk](https://github.com/MickLesk) ([#15848](https://github.com/community-scripts/ProxmoxVE/pull/15848))
-    - n8n: unpin / use latest release [@MickLesk](https://github.com/MickLesk) ([#15817](https://github.com/community-scripts/ProxmoxVE/pull/15817))
     - Pin Opencloud to v7.3.0 [@vhsdream](https://github.com/vhsdream) ([#15826](https://github.com/community-scripts/ProxmoxVE/pull/15826))
 
-  - #### 🔧 Refactor
-
-    - SFTPGo: Update APT Repo & Re-Enable Script [@MickLesk](https://github.com/MickLesk) ([#15829](https://github.com/community-scripts/ProxmoxVE/pull/15829))
-
-### 💾 Core
-
-  - #### ✨ New Features
-
-    - tools.func: enhance rbenv with profile updates / bundle in bashrc [@MickLesk](https://github.com/MickLesk) ([#15822](https://github.com/community-scripts/ProxmoxVE/pull/15822))
-    - feat(build.func): notify users when already on a pinned script version [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15819](https://github.com/community-scripts/ProxmoxVE/pull/15819))
-
-  - #### 💥 Breaking Changes
-
-    - MongoDB: Implement kernel version check and patch [@MickLesk](https://github.com/MickLesk) ([#15821](https://github.com/community-scripts/ProxmoxVE/pull/15821))
-
 ### 🧰 Tools
 
   - #### ✨ New Features

ct/affine.sh

@@ -30,19 +30,17 @@ function update_script() {
     exit
   fi
 
-  RELEASE="v0.27.0"
+  RELEASE="v0.26.3"
   if check_for_gh_release "affine_app" "toeverything/AFFiNE" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
     msg_info "Stopping Services"
     systemctl stop affine-web affine-worker
     msg_ok "Stopped Services"
 
-    ensure_dependencies cmake
-
     create_backup /root/.affine/config /root/.affine/storage
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "${RELEASE}" "/opt/affine"
 
-    msg_info "Rebuilding Application (Patience ~25 mins, don't close the console!)"
+    msg_info "Rebuilding Application (Patience)"
     cd /opt/affine
     source /root/.profile
     export PATH="/root/.cargo/bin:/root/.rbenv/shims:$PATH"
@@ -53,12 +51,11 @@ function update_script() {
     export VITE_CORE_COMMIT_SHA=$(cat ~/.affine_app)
 
     # Initialize git repo (required for build process)
-    export HUSKY=0
     $STD git init -q
     $STD git config user.email "build@local"
     $STD git config user.name "Build"
     $STD git add -A
-    $STD git commit -q -m "update" --no-verify --allow-empty
+    $STD git commit -q -m "update"
 
     # Force Turbo to run sequentially
     mkdir -p /opt/affine/.turbo
@@ -69,7 +66,7 @@ function update_script() {
 TURBO
 
     $STD corepack enable
-    $STD corepack prepare yarn@4.13.0 --activate
+    $STD corepack prepare yarn@4.12.0 --activate
     $STD yarn config set enableTelemetry 0
 
     export NODE_OPTIONS="--max-old-space-size=2048"

ct/apache-guacamole.sh

@@ -146,7 +146,7 @@ function update_script() {
 
   # Check and upgrade optional extensions
   # TOTP Extension
-  if compgen -G "/etc/guacamole/extensions/guacamole-auth-totp-*.jar" >/dev/null; then
+  if [[ -f /etc/guacamole/extensions/guacamole-auth-totp-*.jar ]]; then
     msg_info "Updating TOTP Extension"
     rm -f /etc/guacamole/extensions/guacamole-auth-totp-*.jar
     curl_download "/tmp/guacamole-auth-totp.tar.gz" "https://downloads.apache.org/guacamole/${LATEST_SERVER}/binary/guacamole-auth-totp-${LATEST_SERVER}.tar.gz"
@@ -158,7 +158,7 @@ function update_script() {
   fi
 
   # DUO Extension
-  if compgen -G "/etc/guacamole/extensions/guacamole-auth-duo-*.jar" >/dev/null; then
+  if [[ -f /etc/guacamole/extensions/guacamole-auth-duo-*.jar ]]; then
     msg_info "Updating DUO Extension"
     rm -f /etc/guacamole/extensions/guacamole-auth-duo-*.jar
     curl_download "/tmp/guacamole-auth-duo.tar.gz" "https://downloads.apache.org/guacamole/${LATEST_SERVER}/binary/guacamole-auth-duo-${LATEST_SERVER}.tar.gz"
@@ -170,7 +170,7 @@ function update_script() {
   fi
 
   # LDAP Extension
-  if compgen -G "/etc/guacamole/extensions/guacamole-auth-ldap-*.jar" >/dev/null; then
+  if [[ -f /etc/guacamole/extensions/guacamole-auth-ldap-*.jar ]]; then
     msg_info "Updating LDAP Extension"
     rm -f /etc/guacamole/extensions/guacamole-auth-ldap-*.jar
     curl_download "/tmp/guacamole-auth-ldap.tar.gz" "https://downloads.apache.org/guacamole/${LATEST_SERVER}/binary/guacamole-auth-ldap-${LATEST_SERVER}.tar.gz"
@@ -182,7 +182,7 @@ function update_script() {
   fi
 
   # Quick Connect Extension
-  if compgen -G "/etc/guacamole/extensions/guacamole-auth-quickconnect-*.jar" >/dev/null; then
+  if [[ -f /etc/guacamole/extensions/guacamole-auth-quickconnect-*.jar ]]; then
     msg_info "Updating Quick Connect Extension"
     rm -f /etc/guacamole/extensions/guacamole-auth-quickconnect-*.jar
     curl_download "/tmp/guacamole-auth-quickconnect.tar.gz" "https://downloads.apache.org/guacamole/${LATEST_SERVER}/binary/guacamole-auth-quickconnect-${LATEST_SERVER}.tar.gz"
@@ -194,7 +194,7 @@ function update_script() {
   fi
 
   # History Recording Storage Extension
-  if compgen -G "/etc/guacamole/extensions/guacamole-history-recording-storage-*.jar" >/dev/null; then
+  if [[ -f /etc/guacamole/extensions/guacamole-history-recording-storage-*.jar ]]; then
     msg_info "Updating History Recording Storage Extension"
     rm -f /etc/guacamole/extensions/guacamole-history-recording-storage-*.jar
     curl_download "/tmp/guacamole-history-recording-storage.tar.gz" "https://downloads.apache.org/guacamole/${LATEST_SERVER}/binary/guacamole-history-recording-storage-${LATEST_SERVER}.tar.gz"

ct/cliproxyapi.sh

@@ -36,12 +36,8 @@ function update_script() {
     systemctl stop cliproxyapi
     msg_ok "Stopped CLIProxyAPI"
 
-    create_backup /opt/cliproxyapi/config.yaml
-
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "cliproxyapi" "router-for-me/CLIProxyAPI" "prebuild" "latest" "/opt/cliproxyapi" "CLIProxyAPI_*_linux_$(arch_resolve "amd64" "aarch64").tar.gz"
 
-    restore_backup
-
     msg_info "Starting CLIProxyAPI"
     systemctl start cliproxyapi
     msg_ok "Started CLIProxyAPI"

ct/docuseal.sh

@@ -35,8 +35,6 @@ function update_script() {
     systemctl stop docuseal docuseal-sidekiq
     msg_ok "Stopped Services"
 
-    ensure_dependencies libleptonica-dev libleptonica6
-
     create_backup /opt/docuseal/.env \
       /opt/docuseal/data
 

ct/esphome.sh

@@ -28,7 +28,6 @@ function update_script() {
     msg_error "No ${APP} Installation Found!"
     exit
   fi
-  ensure_dependencies libusb-1.0-0
 
   msg_info "Stopping Service"
   systemctl stop esphome-device-builder 2>/dev/null || true

ct/headers/invidious

@@ -1,6 +0,0 @@
-    ____           _     ___                 
-   /  _/___ _   __(_)___/ (_)___  __  _______
-   / // __ \ | / / / __  / / __ \/ / / / ___/
- _/ // / / / |/ / / /_/ / / /_/ / /_/ (__  ) 
-/___/_/ /_/|___/_/\__,_/_/\____/\__,_/____/  
-                                             

ct/headers/oxicloud

@@ -1,6 +0,0 @@
-   ____       _ ________                __
-  / __ \_  __(_) ____/ /___  __  ______/ /
- / / / / |/_/ / /   / / __ \/ / / / __  / 
-/ /_/ />  </ / /___/ / /_/ / /_/ / /_/ /  
-\____/_/|_/_/\____/_/\____/\__,_/\__,_/   
-                                          

ct/invidious.sh

@@ -1,77 +0,0 @@
-#!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: vhsdream
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/iv-org/invidious
-
-APP="Invidious"
-var_tags="${var_tags:-streaming}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-4096}"
-var_disk="${var_disk:-20}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/invidious ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "Invidious" "iv-org/invidious"; then
-    msg_info "Stopping services"
-    $STD systemctl stop invidious-companion invidious
-    msg_ok "Stopped services"
-
-    create_backup /opt/invidious/config/config.yml
-
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Invidious" "iv-org/invidious" "tarball" "latest" "/opt/invidious"
-    if check_for_gh_release "Invidious-Companion" "iv-org/invidious-companion"; then
-      CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Invidious-Companion" "iv-org/invidious-companion" "prebuild" "latest" "/opt/invidious-companion" "invidious_companion-$(arch_resolve x86_64 aarch64)-unknown-linux-gnu.tar.gz"
-    fi
-
-    msg_info "Rebuilding Invidious"
-    cd /opt/invidious
-    INVIDIOUS_VERSION="$(cat ~/.invidious 2>/dev/null || echo "unknown")"
-    INVIDIOUS_VERSION="${INVIDIOUS_VERSION#v}"
-    sed -i \
-      -e "s~^\(\s*CURRENT_BRANCH\s*=\).*~\1 \"master\"~" \
-      -e "s~^\(\s*CURRENT_COMMIT\s*=\).*~\1 \"\"~" \
-      -e "s~^\(\s*CURRENT_VERSION\s*=\).*~\1 \"${INVIDIOUS_VERSION}\"~" \
-      -e "s~^\(\s*CURRENT_TAG\s*=\).*~\1 \"${INVIDIOUS_VERSION}\"~" \
-      -e "s~^\(\s*ASSET_COMMIT\s*=\).*~\1 \"\"~" \
-      src/invidious.cr
-    $STD make
-    msg_ok "Rebuilt Invidious"
-
-    restore_backup
-
-    msg_info "Starting services"
-    $STD systemctl start invidious invidious-companion
-    msg_ok "Started services"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"

ct/n8n.sh

@@ -45,7 +45,7 @@ EOF
     systemctl daemon-reload
   fi
 
-  $STD npm install -g n8n@latest
+  $STD npm install -g n8n@2.27.5
   systemctl restart n8n
   msg_ok "Updated n8n"
   msg_ok "Updated successfully!"

ct/oxicloud.sh

@@ -1,85 +0,0 @@
-#!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: vhsdream
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/DioCrafts/OxiCloud
-
-APP="OxiCloud"
-var_tags="${var_tags:-files;documents}"
-var_cpu="${var_cpu:-4}"
-var_ram="${var_ram:-6144}"
-var_disk="${var_disk:-20}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/oxicloud ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "OxiCloud" "DioCrafts/OxiCloud"; then
-    msg_info "Stopping OxiCloud"
-    systemctl stop oxicloud
-    msg_ok "Stopped OxiCloud"
-
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "OxiCloud" "DioCrafts/OxiCloud" "tarball" "latest" "/opt/oxicloud"
-    TOOLCHAIN="$(grep -oP 'FROM\s+rust:\K[0-9]+\.[0-9]+(\.[0-9]+)?' /opt/oxicloud/Dockerfile | head -1)"
-    RUST_TOOLCHAIN="${TOOLCHAIN:-stable}" setup_rust
-
-    msg_info "Building Frontend SPA"
-    cd /opt/oxicloud/frontend
-    $STD npm ci
-    $STD npm run build
-    msg_ok "Built Frontend SPA"
-
-    msg_info "Updating OxiCloud (Patience)"
-    set -a
-    source /etc/oxicloud/.env
-    set +a
-    cd /opt/oxicloud
-    export DATABASE_URL
-    export RUSTFLAGS="-C target-cpu=native"
-    RAM_MB=$(awk '/MemTotal/ {print int($2/1024)}' /proc/meminfo)
-    CARGO_JOBS=$((RAM_MB / 2560))
-    [[ $CARGO_JOBS -lt 1 ]] && CARGO_JOBS=1
-    [[ $CARGO_JOBS -gt $(nproc) ]] && CARGO_JOBS=$(nproc)
-    $STD cargo build --release -j "$CARGO_JOBS" --bin oxicloud --bin migrate-nfc-filenames
-    mv target/release/oxicloud /usr/local/bin/oxicloud
-    mv target/release/migrate-nfc-filenames /usr/local/bin/migrate-nfc-filenames
-    chmod +x /usr/local/bin/oxicloud /usr/local/bin/migrate-nfc-filenames
-    rm -f /usr/bin/oxicloud
-    rm -rf /opt/oxicloud/static
-    mv /opt/oxicloud/static-dist /opt/oxicloud/static
-    rm -rf /opt/oxicloud/target /opt/oxicloud/frontend/node_modules
-    msg_ok "Updated OxiCloud"
-
-    msg_info "Starting OxiCloud"
-    systemctl start oxicloud
-    msg_ok "Started OxiCloud"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:8086${CL}"

ct/sftpgo.sh

@@ -28,12 +28,6 @@ function update_script() {
     msg_error "No ${APP} Installation Found!"
     exit
   fi
-
-  setup_deb822_repo \
-  "sftpgo" \
-  "https://oss.sftpgo.com/apt/gpg.key" \
-  "https://oss.sftpgo.com/apt" \
-  "trixie"
   
   msg_info "Updating SFTPGo"
   $STD apt update

install/affine-install.sh

@@ -22,8 +22,7 @@ $STD apt install -y \
   libssl-dev \
   libjemalloc2 \
   redis-server \
-  nginx \
-  cmake
+  nginx
 msg_ok "Installed Dependencies"
 
 PG_VERSION="16" PG_MODULES="pgvector" setup_postgresql
@@ -31,7 +30,7 @@ PG_DB_NAME="affine" PG_DB_USER="affine" setup_postgresql_db
 NODE_VERSION="22" setup_nodejs
 setup_rust
 
-fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "v0.27.0" "/opt/affine"
+fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "v0.26.3" "/opt/affine"
 
 msg_info "Setting up Directories"
 rm -rf /root/.affine
@@ -60,12 +59,11 @@ export PATH="/root/.cargo/bin:$PATH"
 export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
 export VITE_CORE_COMMIT_SHA=$(cat ~/.affine_app)
 # # Initialize git repo (required for build process)
-export HUSKY=0
 $STD git init -q
 $STD git config user.email "build@local"
 $STD git config user.name "Build"
 $STD git add -A
-$STD git commit -q -m "update" --no-verify --allow-empty
+$STD git commit -q -m "initial"
 mkdir -p /opt/affine/.turbo
 cat <<TURBO >/opt/affine/.turbo/config.json
 {
@@ -73,7 +71,7 @@ cat <<TURBO >/opt/affine/.turbo/config.json
 }
 TURBO
 $STD corepack enable
-$STD corepack prepare yarn@4.13.0 --activate
+$STD corepack prepare yarn@4.12.0 --activate
 $STD yarn config set enableTelemetry 0
 export NODE_OPTIONS="--max-old-space-size=4096"
 export TSC_COMPILE_ON_ERROR=true

install/docuseal-install.sh

@@ -23,8 +23,6 @@ $STD apt install -y \
   libreadline-dev \
   zlib1g-dev \
   libffi-dev \
-  libleptonica-dev \
-  libleptonica6 \
   libvips42 \
   libvips-dev \
   libheif1 \

install/esphome-install.sh

@@ -14,8 +14,7 @@ network_check
 update_os
 
 msg_info "Installing Dependencies"
-$STD apt install -y git \
-  libusb-1.0-0
+$STD apt install -y git
 msg_ok "Installed Dependencies"
 
 PYTHON_VERSION="3.12" setup_uv

install/invidious-install.sh

@@ -1,121 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: vhsdream
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/iv-org/invidious
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-msg_info "Installing Dependencies"
-$STD apt install -y \
-  build-essential \
-  git \
-  pkg-config \
-  libssl-dev \
-  libxml2-dev \
-  libyaml-dev \
-  libgmp-dev \
-  libreadline-dev \
-  librsvg2-bin \
-  libsqlite3-dev \
-  zlib1g-dev \
-  libpcre2-dev \
-  libevent-dev \
-  fonts-open-sans
-msg_ok "Installed Dependencies"
-
-if [[ "$(arch_resolve amd64 arm64)" == "amd64" ]]; then
-  setup_deb822_repo "crystal" "https://download.opensuse.org/repositories/devel:/languages:/crystal/Debian_13/Release.key" "https://download.opensuse.org/repositories/devel:/languages:/crystal/Debian_13/" "./"
-  $STD apt install -y crystal
-else
-  fetch_and_deploy_gh_release "Crystal" "crystal-lang/crystal" "prebuild" "latest" "/opt/crystal" "crystal-*-linux-aarch64-bundled.tar.gz"
-  ln -sf /opt/crystal/bin/crystal /usr/local/bin/crystal
-  ln -sf /opt/crystal/bin/shards /usr/local/bin/shards
-fi
-
-PG_VERSION="17" setup_postgresql
-PG_DB_NAME="invidious" PG_DB_USER="invidious" setup_postgresql_db
-fetch_and_deploy_gh_release "Invidious" "iv-org/invidious" "tarball" "latest" "/opt/invidious"
-fetch_and_deploy_gh_release "Invidious Companion" "iv-org/invidious-companion" "prebuild" "latest" "/opt/invidious-companion" "invidious_companion-$(arch_resolve x86_64 aarch64)-unknown-linux-gnu.tar.gz"
-
-msg_info "Building Invidious"
-cd /opt/invidious
-INVIDIOUS_VERSION="$(cat ~/.invidious 2>/dev/null || echo "unknown")"
-INVIDIOUS_VERSION="${INVIDIOUS_VERSION#v}"
-sed -i \
-  -e "s~^\(\s*CURRENT_BRANCH\s*=\).*~\1 \"master\"~" \
-  -e "s~^\(\s*CURRENT_COMMIT\s*=\).*~\1 \"\"~" \
-  -e "s~^\(\s*CURRENT_VERSION\s*=\).*~\1 \"${INVIDIOUS_VERSION}\"~" \
-  -e "s~^\(\s*CURRENT_TAG\s*=\).*~\1 \"${INVIDIOUS_VERSION}\"~" \
-  -e "s~^\(\s*ASSET_COMMIT\s*=\).*~\1 \"\"~" \
-  src/invidious.cr
-$STD make
-msg_ok "Built Invidious"
-
-msg_info "Configuring Invidious"
-SECRET_KEY="$(openssl rand -hex 8)"
-HMAC_KEY="$(openssl rand -hex 32)"
-sed -e '\~^db:~,\~dbname:~d' \
-  -e "s~^#database_.*~database_url: postgres://${PG_DB_USER}:${PG_DB_PASS}@localhost:5432/${PG_DB_NAME}~" \
-  -e 's~^#check_tables.*~check_tables: true~' \
-  -e 's~^#invidious_companion:~invidious_companion:~' \
-  -e 's~^#  - private_~  - private_~' \
-  -e "s~^#invidious_companion_key:.*~invidious_companion_key: \"${SECRET_KEY}\"~" \
-  -e "s~^hmac_key:.*~hmac_key: \"${HMAC_KEY}\"~" \
-  /opt/invidious/config/config.example.yml >/opt/invidious/config/config.yml
-chmod 600 /opt/invidious/config/config.yml
-
-cat <<EOF >/etc/logrotate.d/invidious.logrotate
-/opt/invidious/invidious.log {
-  rotate 4
-  weekly
-  notifempty
-  missingok
-  compress
-  minsize 1048576
-}
-EOF
-chmod 0644 /etc/logrotate.d/invidious.logrotate
-msg_ok "Configured Invidious"
-
-msg_info "Migrating database"
-$STD ./invidious --migrate
-msg_ok "Migrated database"
-
-msg_info "Configuring services"
-sed -e 's|^User=invidious|User=root|' \
-  -e 's|^Group=invidious|Group=root|' \
-  -e 's|/home/invidious/invidious|/opt/invidious|g' \
-  /opt/invidious/invidious.service >/etc/systemd/system/invidious.service
-mkdir -p /var/tmp/youtubei.js
-cat <<EOF >/etc/systemd/system/invidious-companion.service
-[Unit]
-Description=Invidious Companion
-After=network.target
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=/opt/invidious-companion
-Environment=SERVER_SECRET_KEY=${SECRET_KEY}
-Environment=CACHE_DIRECTORY=/var/tmp/youtubei.js
-ExecStart=/opt/invidious-companion/invidious_companion
-Restart=always
-RestartSec=2s
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl -q enable --now invidious invidious-companion
-msg_ok "Configured services"
-
-motd_ssh
-customize
-cleanup_lxc

install/n8n-install.sh

@@ -16,6 +16,7 @@ update_os
 msg_info "Installing Dependencies"
 $STD apt install -y \
   build-essential \
+  python3 \
   python3-setuptools \
   graphicsmagick
 msg_ok "Installed Dependencies"
@@ -23,7 +24,7 @@ msg_ok "Installed Dependencies"
 NODE_VERSION="24" setup_nodejs
 
 msg_info "Installing n8n (Patience)"
-$STD npm install -g n8n@latest
+$STD npm install -g n8n@2.27.5
 msg_ok "Installed n8n"
 
 msg_info "Creating Service"

install/oxicloud-install.sh

@@ -1,88 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: vhsdream
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/DioCrafts/OxiCloud
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-msg_info "Installing Dependencies"
-$STD apt install -y build-essential
-msg_ok "Installed Dependencies"
-
-NODE_VERSION="24" setup_nodejs
-PG_VERSION="17" setup_postgresql
-PG_DB_NAME="oxicloud" PG_DB_USER="oxicloud" setup_postgresql_db
-fetch_and_deploy_gh_release "OxiCloud" "DioCrafts/OxiCloud" "tarball" "latest" "/opt/oxicloud"
-TOOLCHAIN="$(grep -oP 'FROM\s+rust:\K[0-9]+\.[0-9]+(\.[0-9]+)?' /opt/oxicloud/Dockerfile | head -1)"
-RUST_TOOLCHAIN="${TOOLCHAIN:-stable}" setup_rust
-
-msg_info "Building Frontend SPA"
-cd /opt/oxicloud/frontend
-$STD npm ci
-$STD npm run build
-msg_ok "Built Frontend SPA"
-
-msg_info "Building OxiCloud (Patience)"
-cd /opt/oxicloud
-export DATABASE_URL="postgres://${PG_DB_USER}:${PG_DB_PASS}@localhost/${PG_DB_NAME}"
-export RUSTFLAGS="-C target-cpu=native"
-RAM_MB=$(awk '/MemTotal/ {print int($2/1024)}' /proc/meminfo)
-CARGO_JOBS=$((RAM_MB / 2560))
-[[ $CARGO_JOBS -lt 1 ]] && CARGO_JOBS=1
-[[ $CARGO_JOBS -gt $(nproc) ]] && CARGO_JOBS=$(nproc)
-$STD cargo build --release -j "$CARGO_JOBS" --bin oxicloud --bin migrate-nfc-filenames
-mv target/release/oxicloud /usr/local/bin/oxicloud
-mv target/release/migrate-nfc-filenames /usr/local/bin/migrate-nfc-filenames
-rm -rf /opt/oxicloud/static
-mv /opt/oxicloud/static-dist /opt/oxicloud/static
-rm -rf /opt/oxicloud/target /opt/oxicloud/frontend/node_modules
-msg_ok "Built OxiCloud"
-
-msg_info "Configuring OxiCloud"
-mkdir -p {/mnt/oxicloud,/etc/oxicloud}
-sed -e 's|OXICLOUD_STORAGE_PATH=.*|OXICLOUD_STORAGE_PATH=/mnt/oxicloud|' \
-  -e 's|OXICLOUD_SERVER_HOST=.*|OXICLOUD_SERVER_HOST=0.0.0.0|' \
-  -e 's|OXICLOUD_STATIC_PATH=.*|OXICLOUD_STATIC_PATH=/opt/oxicloud/static|' \
-  -e "s|^#OXICLOUD_BASE_URL=.*|OXICLOUD_BASE_URL=http://${LOCAL_IP}:8086|" \
-  -e "s|OXICLOUD_DB_CONNECTION_STRING=.*|OXICLOUD_DB_CONNECTION_STRING=${DATABASE_URL}|" \
-  -e "s|^DATABASE_URL=.*|DATABASE_URL=${DATABASE_URL}|" \
-  -e "s|^#OXICLOUD_JWT_SECRET=.*|OXICLOUD_JWT_SECRET=$(openssl rand -hex 32)|" \
-  /opt/oxicloud/example.env >/etc/oxicloud/.env
-chmod 600 /etc/oxicloud/.env
-msg_ok "Configured OxiCloud"
-
-msg_info "Creating OxiCloud Service"
-cat <<EOF >/etc/systemd/system/oxicloud.service
-[Unit]
-Description=OxiCloud Service
-After=network.target postgresql.service
-Requires=postgresql.service
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=/opt/oxicloud
-EnvironmentFile=/etc/oxicloud/.env
-ExecStart=/usr/local/bin/oxicloud
-Restart=always
-RestartSec=5
-StandardOutput=journal
-StandardError=journal
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now oxicloud
-msg_ok "Created OxiCloud Service"
-
-motd_ssh
-customize
-cleanup_lxc

install/sftpgo-install.sh

@@ -19,8 +19,8 @@ msg_ok "Installed Dependencies"
 
 setup_deb822_repo \
   "sftpgo" \
-  "https://oss.sftpgo.com/apt/gpg.key" \
-  "https://oss.sftpgo.com/apt" \
+  "https://ftp.osuosl.org/pub/sftpgo/apt/gpg.key" \
+  "https://ftp.osuosl.org/pub/sftpgo/apt" \
   "trixie"
 
 msg_info "Installing SFTPGo"

install/webtrees-install.sh

@@ -47,8 +47,6 @@ msg_ok "Configured Caddy"
 
 msg_info "Automating Webtrees Setup"
 cd /opt/webtrees
-mkdir -p /opt/webtrees/data
-chown -R www-data:www-data /opt/webtrees/data
 WT_ADMIN_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c15)
 $STD sudo -u www-data php /opt/webtrees/index.php config-ini \
   --dbhost=127.0.0.1 \
@@ -58,15 +56,6 @@ $STD sudo -u www-data php /opt/webtrees/index.php config-ini \
   --dbname=webtrees \
   --tblpfx=wt_ \
   --base-url="http://${LOCAL_IP}"
-msg_info "Initializing Webtrees database schema"
-for i in {1..15}; do
-  if curl -sf "http://127.0.0.1/" >/dev/null 2>&1; then
-    break
-  fi
-  sleep 2
-done
-$STD mariadb -u webtrees -p"${MARIADB_DB_PASS}" -h 127.0.0.1 webtrees -e "SHOW TABLES LIKE 'wt_user';" | grep -q wt_user
-msg_ok "Initialized Webtrees database schema"
 $STD sudo -u www-data php /opt/webtrees/index.php user Admin \
   --create \
   --real-name="Administrator" \

misc/build.func

@@ -1009,6 +1009,7 @@ base_settings() {
 
   APT_CACHER=${var_apt_cacher:-""}
   APT_CACHER_IP=${var_apt_cacher_ip:-""}
+  INHERIT_HOST_CA="${var_inherit_host_ca:-auto}"
 
   # Runtime check: Verify APT cacher is reachable if configured
   if [[ -n "$APT_CACHER_IP" && "$APT_CACHER" == "yes" ]]; then
@@ -1088,7 +1089,7 @@ load_vars_file() {
 
   # Allowed var_* keys
   local VAR_WHITELIST=(
-    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_keyctl
+    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_inherit_host_ca var_keyctl
     var_gateway var_hostname var_ipv6_method var_mac var_mknod var_mount_fs var_mtu
     var_net var_nesting var_ns var_os var_protection var_pw var_ram var_tags var_timezone var_tun var_unprivileged
     var_verbose var_version var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage var_searchdomain
@@ -1285,6 +1286,12 @@ load_vars_file() {
             continue
           fi
           ;;
+        var_inherit_host_ca)
+          if [[ "$var_val" != "yes" && "$var_val" != "no" && "$var_val" != "auto" ]]; then
+            msg_warn "Invalid host CA inheritance value '$var_val' in $file (must be yes/no/auto), ignoring"
+            continue
+          fi
+          ;;
         var_container_storage | var_template_storage)
           # Validate that the storage exists and is active on the current node
           local _storage_status
@@ -1324,7 +1331,7 @@ default_var_settings() {
   # Allowed var_* keys (alphabetically sorted)
   # Note: Removed var_ctid (can only exist once), var_ipv6_static (static IPs are unique)
   local VAR_WHITELIST=(
-    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_keyctl
+    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_inherit_host_ca var_keyctl
     var_gateway var_hostname var_ipv6_method var_mac var_mknod var_mount_fs var_mtu
     var_net var_nesting var_ns var_os var_protection var_pw var_ram var_tags var_timezone var_tun var_unprivileged
     var_verbose var_version var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage
@@ -1407,6 +1414,7 @@ var_ssh=no
 # HTTP/HTTPS proxy (optional - for networks requiring a proxy)
 # var_http_proxy=http://proxy.local:8080
 # var_http_no_proxy=localhost,127.0.0.1,.local
+# var_inherit_host_ca=auto
 
 # Features/Tags/verbosity
 var_fuse=no
@@ -1507,7 +1515,7 @@ get_app_defaults_path() {
 if ! declare -p VAR_WHITELIST >/dev/null 2>&1; then
   # Note: Removed var_ctid (can only exist once), var_ipv6_static (static IPs are unique)
   declare -ag VAR_WHITELIST=(
-    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_keyctl
+    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_inherit_host_ca var_keyctl
     var_gateway var_hostname var_ipv6_method var_mac var_mknod var_mount_fs var_mtu
     var_net var_nesting var_ns var_os var_protection var_pw var_ram var_tags var_timezone var_tun var_unprivileged
     var_verbose var_version var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage var_searchdomain
@@ -1657,6 +1665,7 @@ _build_current_app_vars_tmp() {
   _apt_cacher_ip="${APT_CACHER_IP:-}"
   _http_proxy="${HTTP_PROXY:-${var_http_proxy:-}}"
   _http_no_proxy="${HTTP_NO_PROXY:-${var_http_no_proxy:-}}"
+  _inherit_host_ca="${INHERIT_HOST_CA:-${var_inherit_host_ca:-auto}}"
   _fuse="${ENABLE_FUSE:-no}"
   _tun="${ENABLE_TUN:-no}"
   _gpu="${ENABLE_GPU:-no}"
@@ -1710,6 +1719,7 @@ _build_current_app_vars_tmp() {
     [ -n "$_apt_cacher_ip" ] && echo "var_apt_cacher_ip=$(_sanitize_value "$_apt_cacher_ip")"
     [ -n "$_http_proxy" ] && echo "var_http_proxy=$(_sanitize_value "$_http_proxy")"
     [ -n "$_http_no_proxy" ] && echo "var_http_no_proxy=$(_sanitize_value "$_http_no_proxy")"
+    [ -n "$_inherit_host_ca" ] && echo "var_inherit_host_ca=$(_sanitize_value "$_inherit_host_ca")"
 
     [ -n "$_fuse" ] && echo "var_fuse=$(_sanitize_value "$_fuse")"
     [ -n "$_tun" ] && echo "var_tun=$(_sanitize_value "$_tun")"
@@ -1874,7 +1884,7 @@ advanced_settings() {
     TAGS="community-script${var_tags:+;${var_tags}}"
   fi
   local STEP=1
-  local MAX_STEP=30
+  local MAX_STEP=31
 
   # Store values for back navigation - inherit from var_* app defaults
   local _ct_type="${var_unprivileged:-1}"
@@ -1896,6 +1906,7 @@ advanced_settings() {
   local _apt_cacher_ip="${var_apt_cacher_ip:-}"
   local _http_proxy="${var_http_proxy:-}"
   local _http_no_proxy="${var_http_no_proxy:-}"
+  local _inherit_host_ca="${var_inherit_host_ca:-auto}"
   local _mtu="${var_mtu:-}"
   local _sd="${var_searchdomain:-}"
   local _ns="${var_ns:-}"
@@ -2725,9 +2736,47 @@ advanced_settings() {
       ;;
 
     # ═══════════════════════════════════════════════════════════════════════════
-    # STEP 25: Container Timezone
+    # STEP 25: Host CA Inheritance
     # ═══════════════════════════════════════════════════════════════════════════
     25)
+      local host_ca_count=0
+      local host_ca_dir="/usr/local/share/ca-certificates"
+      local cert
+      shopt -s nullglob
+      for cert in "$host_ca_dir"/*.crt; do
+        host_ca_count=$((host_ca_count + 1))
+      done
+      shopt -u nullglob
+
+      if [[ $host_ca_count -eq 0 ]]; then
+        _inherit_host_ca="auto"
+        ((STEP++))
+        continue
+      fi
+
+      local host_ca_default_flag=""
+      [[ "$_inherit_host_ca" == "no" ]] && host_ca_default_flag="--defaultno"
+      if whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
+        --title "HOST CA INHERITANCE" \
+        --ok-button "Next" --cancel-button "Back" \
+        $host_ca_default_flag \
+        --yesno "\nInherit host CA certificates into this container?\n\nDetected on host: ${host_ca_count} certificate(s) in:\n${host_ca_dir}\n\nRecommended for private PKI / TLS-inspection environments.\n\n(App default: ${var_inherit_host_ca:-auto})" 16 72; then
+        _inherit_host_ca="yes"
+      else
+        if [ $? -eq 1 ]; then
+          _inherit_host_ca="no"
+        else
+          ((STEP--))
+          continue
+        fi
+      fi
+      ((STEP++))
+      ;;
+
+    # ═══════════════════════════════════════════════════════════════════════════
+    # STEP 26: Container Timezone
+    # ═══════════════════════════════════════════════════════════════════════════
+    26)
       local tz_hint="$_ct_timezone"
       [[ -z "$tz_hint" ]] && tz_hint="(empty - will use host timezone)"
 
@@ -2750,9 +2799,9 @@ advanced_settings() {
       ;;
 
     # ═══════════════════════════════════════════════════════════════════════════
-    # STEP 26: Container Protection
+    # STEP 27: Container Protection
     # ═══════════════════════════════════════════════════════════════════════════
-    26)
+    27)
       local protect_default_flag="--defaultno"
       [[ "$_protect_ct" == "yes" || "$_protect_ct" == "1" ]] && protect_default_flag=""
 
@@ -2904,6 +2953,7 @@ Leave empty to skip."
       local apt_display="${_apt_cacher:-no}"
       [[ "$_apt_cacher" == "yes" && -n "$_apt_cacher_ip" ]] && apt_display="$_apt_cacher_ip"
       local http_proxy_display="${_http_proxy:-(none)}"
+      local inherit_ca_display="${_inherit_host_ca:-auto}"
 
       local post_install_display="${_post_install:-(none)}"
       local post_install_warn=""
@@ -2934,6 +2984,7 @@ Advanced:
   Timezone: $tz_display
   APT Cacher: $apt_display
   HTTP Proxy: $http_proxy_display
+  Inherit Host CAs: $inherit_ca_display
   Verbose: $_verbose
   Post-Install Script: ${post_install_display}${post_install_warn}"
 
@@ -2979,6 +3030,7 @@ Advanced:
   APT_CACHER_IP="$_apt_cacher_ip"
   HTTP_PROXY="$_http_proxy"
   HTTP_NO_PROXY="$_http_no_proxy"
+  INHERIT_HOST_CA="$_inherit_host_ca"
   VERBOSE="$_verbose"
   var_post_install="$_post_install"
 
@@ -2997,6 +3049,7 @@ Advanced:
   var_sdn_vnet="$_sdn_vnet"
   var_http_proxy="$_http_proxy"
   var_http_no_proxy="$_http_no_proxy"
+  var_inherit_host_ca="$_inherit_host_ca"
 
   # Format optional values
   [[ -n "$_mtu" ]] && MTU=",mtu=$_mtu" || MTU=""
@@ -3753,19 +3806,18 @@ run_addon_updates() {
 }
 
 runtime_script_status_guard() {
-  local mode="${1:-}"
   local script_slug="${SCRIPT_SLUG:-${NSAPP:-}}"
   script_slug="$(echo "$script_slug" | tr '[:upper:]' '[:lower:]' | tr ' ' '-')"
   [[ -z "$script_slug" ]] && return 0
 
-  local api_url="https://db.community-scripts.org/api/collections/script_scripts/records?filter=(slug='${script_slug}')&perPage=1&fields=slug,is_disabled,is_deleted,disable_message,deleted_message,pinned_version,pin_reason"
+  local api_url="https://db.community-scripts.org/api/collections/script_scripts/records?filter=(slug='${script_slug}')&perPage=1&fields=slug,is_disabled,is_deleted,disable_message,deleted_message"
   local response
   if ! response=$(curl -fsSL --connect-timeout 2 --max-time 3 "$api_url" 2>/dev/null); then
     msg_warn "Script status check is unavailable. Continuing without status verification."
     return 0
   fi
 
-  local is_deleted is_disabled deleted_message disable_message pinned_version pin_reason info_url
+  local is_deleted is_disabled deleted_message disable_message info_url
   if printf '%s' "$response" | grep -qE '"items":[[:space:]]*\[[[:space:]]*\]'; then
     return 0
   fi
@@ -3775,8 +3827,6 @@ runtime_script_status_guard() {
   is_disabled=$(printf '%s' "$response" | sed -n 's/.*"is_disabled"[[:space:]]*:[[:space:]]*\(true\|false\).*/\1/p' | head -1)
   deleted_message=$(printf '%s' "$response" | sed -n 's/.*"deleted_message"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -1)
   disable_message=$(printf '%s' "$response" | sed -n 's/.*"disable_message"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -1)
-  pinned_version=$(printf '%s' "$response" | sed -n 's/.*"pinned_version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -1)
-  pin_reason=$(printf '%s' "$response" | sed -n 's/.*"pin_reason"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -1)
   is_deleted=${is_deleted:-false}
   is_disabled=${is_disabled:-false}
   info_url="https://community-scripts.org/scripts/${script_slug}"
@@ -3808,26 +3858,6 @@ runtime_script_status_guard() {
     return 1
   fi
 
-  if [[ "$mode" == "update" && -n "$pinned_version" && -n "${NSAPP:-}" ]]; then
-    local current_file="$HOME/.${NSAPP}"
-    if [[ -f "$current_file" ]]; then
-      local installed pinned_clean installed_clean
-      installed="$(<"$current_file")"
-      pinned_clean="$pinned_version"
-      installed_clean="$installed"
-      [[ "$pinned_clean" =~ ^v[0-9] ]] && pinned_clean="${pinned_clean:1}"
-      [[ "$installed_clean" =~ ^v[0-9] ]] && installed_clean="${installed_clean:1}"
-      if [[ "$installed_clean" == "$pinned_clean" ]]; then
-        if [[ -n "$pin_reason" ]]; then
-          msg_info "You are already on the pinned version (${pinned_version}). ${pin_reason}"
-        else
-          msg_info "You are already on the pinned version (${pinned_version}). No newer update is offered intentionally — please do not open an issue unless you see an actual error."
-        fi
-        msg_info "More info: ${info_url}"
-      fi
-    fi
-  fi
-
   return 0
 }
 
@@ -3843,7 +3873,7 @@ runtime_script_status_guard() {
 start() {
   source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/tools.func)
   if command -v pveversion >/dev/null 2>&1; then
-    runtime_script_status_guard install || return 0
+    runtime_script_status_guard || return 0
     install_script || return 0
     return 0
   elif [ ! -z ${PHS_SILENT+x} ] && [[ "${PHS_SILENT}" == "1" ]]; then
@@ -3851,7 +3881,7 @@ start() {
     set_std_mode
     ensure_profile_loaded
     get_lxc_ip
-    runtime_script_status_guard update || return 0
+    runtime_script_status_guard || return 0
     update_script
     run_addon_updates
     update_motd_ip
@@ -3862,7 +3892,7 @@ start() {
     set_std_mode
     ensure_profile_loaded
     get_lxc_ip
-    runtime_script_status_guard update || return 0
+    runtime_script_status_guard || return 0
     update_script
     run_addon_updates
     update_motd_ip
@@ -3892,7 +3922,7 @@ start() {
     esac
     ensure_profile_loaded
     get_lxc_ip
-    runtime_script_status_guard update || return 0
+    runtime_script_status_guard || return 0
     update_script
     run_addon_updates
     update_motd_ip
@@ -3945,6 +3975,81 @@ EOF
   msg_ok "Applied HTTP proxy in container"
 }
 
+# ------------------------------------------------------------------------------
+# _apply_host_ca_certs_in_container()
+#
+# - Copies administrator-provided CA certificates from the Proxmox host into the
+#   container before base package bootstrap
+# - Source: /usr/local/share/ca-certificates/*.crt (Debian convention)
+# - Refreshes the container trust store when update-ca-certificates is available
+# - No-op when no host certificates are present; failures are non-fatal
+# ------------------------------------------------------------------------------
+_apply_host_ca_certs_in_container() {
+  local host_ca_dir="/usr/local/share/ca-certificates"
+  [[ -z "${CTID:-}" ]] && return 0
+  local inherit_host_ca="${INHERIT_HOST_CA:-${var_inherit_host_ca:-auto}}"
+
+  local -a host_certs=()
+  local cert
+  shopt -s nullglob
+  for cert in "$host_ca_dir"/*.crt; do
+    host_certs+=("$cert")
+  done
+  shopt -u nullglob
+
+  [[ ${#host_certs[@]} -eq 0 ]] && return 0
+
+  case "${inherit_host_ca,,}" in
+  no | false | 0 | off)
+    msg_info "Skipping host CA inheritance by configuration"
+    return 0
+    ;;
+  esac
+
+  msg_info "Inheriting host CA certificates into container"
+
+  local found=${#host_certs[@]}
+  local copied=0
+  local skipped=0
+  local cert_name
+
+  pct exec "$CTID" -- mkdir -p /usr/local/share/ca-certificates >/dev/null 2>&1 || {
+    msg_warn "Failed to create CA certificate directory in container"
+    return 0
+  }
+
+  for cert in "${host_certs[@]}"; do
+    cert_name="$(basename "$cert")"
+    if [[ ! -r "$cert" || "$cert_name" != *.crt ]]; then
+      msg_warn "Skipping invalid or unreadable host CA certificate: ${cert_name}"
+      skipped=$((skipped + 1))
+      continue
+    fi
+
+    if pct push "$CTID" "$cert" "/usr/local/share/ca-certificates/${cert_name}" >/dev/null 2>&1; then
+      pct exec "$CTID" -- chmod 644 "/usr/local/share/ca-certificates/${cert_name}" >/dev/null 2>&1 || true
+      copied=$((copied + 1))
+    else
+      msg_warn "Failed to push host CA certificate: ${cert_name}"
+      skipped=$((skipped + 1))
+    fi
+  done
+
+  if [[ $copied -eq 0 ]]; then
+    msg_warn "No host CA certificates were copied (${found} found, ${skipped} skipped)"
+    return 0
+  fi
+
+  local refresh_shell="bash"
+  [[ "$var_os" == "alpine" ]] && refresh_shell="ash"
+
+  if pct exec "$CTID" -- "$refresh_shell" -c 'command -v update-ca-certificates >/dev/null 2>&1 && update-ca-certificates' >/dev/null 2>&1; then
+    msg_ok "Inherited ${copied} host CA certificate(s) and updated trust store (${skipped} skipped)"
+  else
+    msg_warn "Copied ${copied} host CA certificate(s), but trust store update failed or update-ca-certificates is unavailable (${skipped} skipped)"
+  fi
+}
+
 # ------------------------------------------------------------------------------
 # build_container()
 #
@@ -4565,6 +4670,7 @@ EOF
   local install_exit_code=0
 
   _apply_http_proxy_in_container
+  _apply_host_ca_certs_in_container
 
   # Continue with standard container setup
   if [ "$var_os" == "alpine" ]; then

misc/tools.func

@@ -2483,150 +2483,6 @@ verify_gpg_fingerprint() {
   return 65
 }
 
-# ------------------------------------------------------------------------------
-# _download_source_tarball <url> <dest> [curl args...]
-#
-# Downloads a source .tar.gz to <dest> and verifies the gzip stream is complete
-# before returning. Source forges (GitHub/GitLab/Codeberg) build these archives
-# on the fly; for large repos the response is occasionally a truncated-but-
-# cleanly-closed gzip that curl accepts as success (HTTP 200) and which then
-# fails at extraction time. We validate with `gzip -t` and re-download on
-# failure, and abort stalled transfers (--speed-time) so a hung generation
-# retries instead of blocking for minutes. Extra args pass through to curl
-# (e.g. auth headers like -H "PRIVATE-TOKEN: ...").
-#
-# Returns: 0 on success, 250 on persistent failure.
-# ------------------------------------------------------------------------------
-_download_source_tarball() {
-  local url="$1" dest="$2"
-  shift 2
-  local attempt max=3
-  for ((attempt = 1; attempt <= max; attempt++)); do
-    if curl --connect-timeout 15 --max-time 900 --speed-limit 1024 --speed-time 60 \
-      -fsSL "$@" -o "$dest" "$url" && gzip -t "$dest" 2>/dev/null; then
-      return 0
-    fi
-    rm -f "$dest"
-    ((attempt < max)) && {
-      msg_warn "Source archive download failed or incomplete (attempt ${attempt}/${max}), retrying..."
-      sleep $((attempt * 3))
-    }
-  done
-  return 250
-}
-
-# ------------------------------------------------------------------------------
-# _deploy_source_tarball <tarball_path> <target> <workdir>
-#
-# Shared tail for the *source tarball* modes of the fetch_and_deploy_* helpers
-# (GitHub/GitLab/Codeberg archive tarballs that contain a single top-level
-# directory). Extracts <tarball_path> into <workdir>, then copies the contents
-# of that top-level directory into <target>.
-#
-#   - Honors CLEAN_INSTALL=1 (wipes <target> first, dotfiles included).
-#   - Does NOT own <workdir>: the caller creates it and is responsible for its
-#     cleanup (typically via a RETURN trap on its tmpdir).
-#   - cp failures are non-fatal here, matching the previous inline behavior.
-#
-# Returns: 0 on success (or non-fatal cp failure), 251 on extraction failure.
-# ------------------------------------------------------------------------------
-_deploy_source_tarball() {
-  local tarball="$1" target="$2" workdir="$3"
-
-  mkdir -p "$target"
-  if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-    find "${target:?}" -mindepth 1 -delete
-  fi
-
-  tar --no-same-owner -xzf "$tarball" -C "$workdir" || {
-    msg_error "Failed to extract tarball"
-    return 251
-  }
-
-  local unpack_dir
-  unpack_dir=$(find "$workdir" -mindepth 1 -maxdepth 1 -type d | head -n1)
-
-  shopt -s dotglob nullglob
-  cp -r "$unpack_dir"/* "$target/"
-  shopt -u dotglob nullglob
-  return 0
-}
-
-# ------------------------------------------------------------------------------
-# _deploy_unpacked_archive <archive_path> <target> <workdir>
-#
-# Shared tail for the *prebuild* modes of the fetch_and_deploy_*_release helpers
-# (release assets shipped as .zip / .tar.* / .tgz / .txz). Extracts the archive
-# into <workdir>, then copies its payload into <target>. If the archive contains
-# a single top-level directory, that directory is stripped (its contents land
-# directly in <target>); otherwise the archive contents are copied as-is.
-#
-#   - Honors CLEAN_INSTALL=1 (wipes <target> first, dotfiles included).
-#   - Does NOT own <workdir>: the caller creates it and cleans it up.
-#
-# Returns: 0 on success, 65 on unsupported format, 251 on extraction failure,
-#          252 on copy failure / empty archive.
-# ------------------------------------------------------------------------------
-_deploy_unpacked_archive() {
-  local archive="$1" target="$2" workdir="$3"
-  local filename="${archive##*/}"
-
-  mkdir -p "$target"
-  if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-    find "${target:?}" -mindepth 1 -delete
-  fi
-
-  if [[ "$filename" == *.zip ]]; then
-    ensure_dependencies unzip
-    unzip -q "$archive" -d "$workdir" || {
-      msg_error "Failed to extract ZIP archive"
-      return 251
-    }
-  elif [[ "$filename" == *.tar.* || "$filename" == *.tgz || "$filename" == *.txz ]]; then
-    tar --no-same-owner -xf "$archive" -C "$workdir" || {
-      msg_error "Failed to extract TAR archive"
-      return 251
-    }
-  else
-    msg_error "Unsupported archive format: $filename"
-    return 65
-  fi
-
-  local top_entries inner_dir
-  top_entries=$(find "$workdir" -mindepth 1 -maxdepth 1)
-  if [[ "$(echo "$top_entries" | wc -l)" -eq 1 && -d "$top_entries" ]]; then
-    inner_dir="$top_entries"
-    shopt -s dotglob nullglob
-    if compgen -G "$inner_dir/*" >/dev/null; then
-      cp -r "$inner_dir"/* "$target/" || {
-        msg_error "Failed to copy contents from $inner_dir to $target"
-        shopt -u dotglob nullglob
-        return 252
-      }
-    else
-      msg_error "Inner directory is empty: $inner_dir"
-      shopt -u dotglob nullglob
-      return 252
-    fi
-    shopt -u dotglob nullglob
-  else
-    shopt -s dotglob nullglob
-    if compgen -G "$workdir/*" >/dev/null; then
-      cp -r "$workdir"/* "$target/" || {
-        msg_error "Failed to copy contents to $target"
-        shopt -u dotglob nullglob
-        return 252
-      }
-    else
-      msg_error "Unpacked archive is empty"
-      shopt -u dotglob nullglob
-      return 252
-    fi
-    shopt -u dotglob nullglob
-  fi
-  return 0
-}
-
 # ------------------------------------------------------------------------------
 # Fetches and deploys a GitHub tag-based source tarball.
 #
@@ -2675,19 +2531,36 @@ fetch_and_deploy_gh_tag() {
 
   local tmpdir
   tmpdir=$(mktemp -d) || return 1
-  trap 'rm -rf "$tmpdir"' RETURN
   local tarball_url="https://github.com/${repo}/archive/refs/tags/${version}.tar.gz"
   local filename="${app_lc}-${version}.tar.gz"
 
   msg_info "Fetching GitHub tag: ${app} (${version})"
 
-  _download_source_tarball "$tarball_url" "$tmpdir/$filename" || {
+  download_file "$tarball_url" "$tmpdir/$filename" || {
     msg_error "Download failed: $tarball_url"
+    rm -rf "$tmpdir"
     return 7
   }
 
-  _deploy_source_tarball "$tmpdir/$filename" "$target" "$tmpdir" || return 251
+  mkdir -p "$target"
+  if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
+    rm -rf "${target:?}/"*
+  fi
 
+  tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
+    msg_error "Failed to extract tarball"
+    rm -rf "$tmpdir"
+    return 251
+  }
+
+  local unpack_dir
+  unpack_dir=$(find "$tmpdir" -mindepth 1 -maxdepth 1 -type d | head -n1)
+
+  shopt -s dotglob nullglob
+  cp -r "$unpack_dir"/* "$target/"
+  shopt -u dotglob nullglob
+
+  rm -rf "$tmpdir"
   echo "$version" >"$version_file"
   msg_ok "Deployed ${app} ${version} to ${target}"
   return 0
@@ -2852,18 +2725,35 @@ fetch_and_deploy_gl_tag() {
 
   local tmpdir
   tmpdir=$(mktemp -d) || return 1
-  trap 'rm -rf "$tmpdir"' RETURN
   local filename="${app_lc}-${version_safe}.tar.gz"
 
   msg_info "Fetching GitLab tag: ${app} (${resolved_tag})"
 
-  _download_source_tarball "$tarball_url" "$tmpdir/$filename" "${header[@]}" || {
+  curl $download_timeout -fsSL "${header[@]}" -o "$tmpdir/$filename" "$tarball_url" || {
     msg_error "Download failed: $tarball_url"
+    rm -rf "$tmpdir"
     return 7
   }
 
-  _deploy_source_tarball "$tmpdir/$filename" "$target" "$tmpdir" || return 251
+  mkdir -p "$target"
+  if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
+    rm -rf "${target:?}/"*
+  fi
 
+  tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
+    msg_error "Failed to extract tarball"
+    rm -rf "$tmpdir"
+    return 251
+  }
+
+  local unpack_dir
+  unpack_dir=$(find "$tmpdir" -mindepth 1 -maxdepth 1 -type d | head -n1)
+
+  shopt -s dotglob nullglob
+  cp -r "$unpack_dir"/* "$target/"
+  shopt -u dotglob nullglob
+
+  rm -rf "$tmpdir"
   echo "$resolved_tag" >"$version_file"
   msg_ok "Deployed ${app} ${resolved_tag} to ${target}"
   return 0
@@ -3560,7 +3450,6 @@ fetch_and_deploy_codeberg_release() {
 
     local tmpdir
     tmpdir=$(mktemp -d) || return 252
-    trap 'rm -rf "$tmpdir"' RETURN
 
     msg_info "Fetching Codeberg tag: $app ($tag_name)"
 
@@ -3571,19 +3460,37 @@ fetch_and_deploy_codeberg_release() {
 
     # Codeberg archive URL format: https://codeberg.org/{owner}/{repo}/archive/{tag}.tar.gz
     local archive_url="https://codeberg.org/$repo/archive/${tag_name}.tar.gz"
-    if _download_source_tarball "$archive_url" "$tmpdir/$filename"; then
+    if curl_download "$tmpdir/$filename" "$archive_url"; then
       download_success=true
     fi
 
     if [[ "$download_success" != "true" ]]; then
       msg_error "Download failed for $app ($tag_name)"
+      rm -rf "$tmpdir"
       return 250
     fi
 
-    _deploy_source_tarball "$tmpdir/$filename" "$target" "$tmpdir" || return 251
+    mkdir -p "$target"
+    if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
+      rm -rf "${target:?}/"*
+    fi
+
+    tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
+      msg_error "Failed to extract tarball"
+      rm -rf "$tmpdir"
+      return 251
+    }
+
+    local unpack_dir
+    unpack_dir=$(find "$tmpdir" -mindepth 1 -maxdepth 1 -type d | head -n1)
+
+    shopt -s dotglob nullglob
+    cp -r "$unpack_dir"/* "$target/"
+    shopt -u dotglob nullglob
 
     echo "$version" >"$version_file"
     msg_ok "Deployed: $app ($version)"
+    rm -rf "$tmpdir"
     return 0
   fi
 
@@ -3602,7 +3509,7 @@ fetch_and_deploy_codeberg_release() {
 
   local codeberg_rel_json
   codeberg_rel_json=$(mktemp /tmp/tools-codeberg-rel-XXXXXX) || return 73
-  trap 'rm -f "$codeberg_rel_json"; rm -rf "${tmpdir:-}" "${unpack_tmp:-}"' RETURN
+  trap 'rm -f "$codeberg_rel_json"' RETURN
 
   local attempt=0 success=false resp http_code
 
@@ -3656,16 +3563,32 @@ fetch_and_deploy_codeberg_release() {
 
     # Codeberg archive URL format
     local archive_url="https://codeberg.org/$repo/archive/${tag_name}.tar.gz"
-    if _download_source_tarball "$archive_url" "$tmpdir/$filename"; then
+    if curl_download "$tmpdir/$filename" "$archive_url"; then
       download_success=true
     fi
 
     if [[ "$download_success" != "true" ]]; then
       msg_error "Download failed for $app ($tag_name)"
+      rm -rf "$tmpdir"
       return 250
     fi
 
-    _deploy_source_tarball "$tmpdir/$filename" "$target" "$tmpdir" || return 251
+    mkdir -p "$target"
+    if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
+      rm -rf "${target:?}/"*
+    fi
+
+    tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
+      msg_error "Failed to extract tarball"
+      rm -rf "$tmpdir"
+      return 251
+    }
+    local unpack_dir
+    unpack_dir=$(find "$tmpdir" -mindepth 1 -maxdepth 1 -type d | head -n1)
+
+    shopt -s dotglob nullglob
+    cp -r "$unpack_dir"/* "$target/"
+    shopt -u dotglob nullglob
 
   ### Binary Mode ###
   elif [[ "$mode" == "binary" ]]; then
@@ -3713,12 +3636,14 @@ fetch_and_deploy_codeberg_release() {
 
     if [[ -z "$url_match" ]]; then
       msg_error "No suitable .deb asset found for $app"
+      rm -rf "$tmpdir"
       return 252
     fi
 
     filename="${url_match##*/}"
     curl_download "$tmpdir/$filename" "$url_match" || {
       msg_error "Download failed: $url_match"
+      rm -rf "$tmpdir"
       return 250
     }
 
@@ -3726,6 +3651,7 @@ fetch_and_deploy_codeberg_release() {
     $STD apt install -y "$tmpdir/$filename" || {
       $STD dpkg -i "$tmpdir/$filename" || {
         _diagnose_deb_failure "$tmpdir/$filename"
+        rm -rf "$tmpdir"
         return 100
       }
     }
@@ -3736,6 +3662,7 @@ fetch_and_deploy_codeberg_release() {
     pattern="${pattern#\"}"
     [[ -z "$pattern" ]] && {
       msg_error "Mode 'prebuild' requires 6th parameter (asset filename pattern)"
+      rm -rf "$tmpdir"
       return 65
     }
 
@@ -3752,18 +3679,77 @@ fetch_and_deploy_codeberg_release() {
 
     [[ -z "$asset_url" ]] && {
       msg_error "No asset matching '$pattern' found"
+      rm -rf "$tmpdir"
       return 252
     }
 
     filename="${asset_url##*/}"
     curl_download "$tmpdir/$filename" "$asset_url" || {
       msg_error "Download failed: $asset_url"
+      rm -rf "$tmpdir"
       return 250
     }
 
     local unpack_tmp
     unpack_tmp=$(mktemp -d)
-    _deploy_unpacked_archive "$tmpdir/$filename" "$target" "$unpack_tmp" || return
+    mkdir -p "$target"
+    if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
+      rm -rf "${target:?}/"*
+    fi
+
+    if [[ "$filename" == *.zip ]]; then
+      ensure_dependencies unzip
+      unzip -q "$tmpdir/$filename" -d "$unpack_tmp" || {
+        msg_error "Failed to extract ZIP archive"
+        rm -rf "$tmpdir" "$unpack_tmp"
+        return 251
+      }
+    elif [[ "$filename" == *.tar.* || "$filename" == *.tgz ]]; then
+      tar --no-same-owner -xf "$tmpdir/$filename" -C "$unpack_tmp" || {
+        msg_error "Failed to extract TAR archive"
+        rm -rf "$tmpdir" "$unpack_tmp"
+        return 251
+      }
+    else
+      msg_error "Unsupported archive format: $filename"
+      rm -rf "$tmpdir" "$unpack_tmp"
+      return 251
+    fi
+
+    local top_dirs
+    top_dirs=$(find "$unpack_tmp" -mindepth 1 -maxdepth 1 -type d | wc -l)
+    local top_entries inner_dir
+    top_entries=$(find "$unpack_tmp" -mindepth 1 -maxdepth 1)
+    if [[ "$(echo "$top_entries" | wc -l)" -eq 1 && -d "$top_entries" ]]; then
+      inner_dir="$top_entries"
+      shopt -s dotglob nullglob
+      if compgen -G "$inner_dir/*" >/dev/null; then
+        cp -r "$inner_dir"/* "$target/" || {
+          msg_error "Failed to copy contents from $inner_dir to $target"
+          rm -rf "$tmpdir" "$unpack_tmp"
+          return 252
+        }
+      else
+        msg_error "Inner directory is empty: $inner_dir"
+        rm -rf "$tmpdir" "$unpack_tmp"
+        return 252
+      fi
+      shopt -u dotglob nullglob
+    else
+      shopt -s dotglob nullglob
+      if compgen -G "$unpack_tmp/*" >/dev/null; then
+        cp -r "$unpack_tmp"/* "$target/" || {
+          msg_error "Failed to copy contents to $target"
+          rm -rf "$tmpdir" "$unpack_tmp"
+          return 252
+        }
+      else
+        msg_error "Unpacked archive is empty"
+        rm -rf "$tmpdir" "$unpack_tmp"
+        return 252
+      fi
+      shopt -u dotglob nullglob
+    fi
 
   ### Singlefile Mode ###
   elif [[ "$mode" == "singlefile" ]]; then
@@ -3771,6 +3757,7 @@ fetch_and_deploy_codeberg_release() {
     pattern="${pattern#\"}"
     [[ -z "$pattern" ]] && {
       msg_error "Mode 'singlefile' requires 6th parameter (asset filename pattern)"
+      rm -rf "$tmpdir"
       return 65
     }
 
@@ -3787,6 +3774,7 @@ fetch_and_deploy_codeberg_release() {
 
     [[ -z "$asset_url" ]] && {
       msg_error "No asset matching '$pattern' found"
+      rm -rf "$tmpdir"
       return 252
     }
 
@@ -3799,6 +3787,7 @@ fetch_and_deploy_codeberg_release() {
 
     curl_download "$target/$target_file" "$asset_url" || {
       msg_error "Download failed: $asset_url"
+      rm -rf "$tmpdir"
       return 250
     }
 
@@ -3808,11 +3797,13 @@ fetch_and_deploy_codeberg_release() {
 
   else
     msg_error "Unknown mode: $mode"
+    rm -rf "$tmpdir"
     return 65
   fi
 
   echo "$version" >"$version_file"
   msg_ok "Deployed: $app ($version)"
+  rm -rf "$tmpdir"
 }
 
 # ------------------------------------------------------------------------------
@@ -4099,7 +4090,6 @@ fetch_and_deploy_gh_release() {
 
   local tmpdir
   tmpdir=$(mktemp -d) || return 1
-  trap 'rm -rf "$tmpdir" "${unpack_tmp:-}"' RETURN
   local filename="" url=""
 
   msg_info "Fetching GitHub release: $app ($version)"
@@ -4114,12 +4104,28 @@ fetch_and_deploy_gh_release() {
     local direct_tarball_url="https://github.com/$repo/archive/refs/tags/$tag_name.tar.gz"
     filename="${app_lc}-${version_safe}.tar.gz"
 
-    _download_source_tarball "$direct_tarball_url" "$tmpdir/$filename" || {
+    curl_download "$tmpdir/$filename" "$direct_tarball_url" || {
       msg_error "Download failed: $direct_tarball_url"
+      rm -rf "$tmpdir"
       return 250
     }
 
-    _deploy_source_tarball "$tmpdir/$filename" "$target" "$tmpdir" || return 251
+    mkdir -p "$target"
+    if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
+      rm -rf "${target:?}/"*
+    fi
+
+    tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
+      msg_error "Failed to extract tarball"
+      rm -rf "$tmpdir"
+      return 251
+    }
+    local unpack_dir
+    unpack_dir=$(find "$tmpdir" -mindepth 1 -maxdepth 1 -type d | head -n1)
+
+    shopt -s dotglob nullglob
+    cp -r "$unpack_dir"/* "$target/"
+    shopt -u dotglob nullglob
 
     ### Binary Mode ###
   elif [[ "$mode" == "binary" ]]; then
@@ -4204,12 +4210,14 @@ fetch_and_deploy_gh_release() {
 
     if [[ -z "$url_match" ]]; then
       msg_error "No suitable .deb asset found for $app"
+      rm -rf "$tmpdir"
       return 252
     fi
 
     filename="${url_match##*/}"
     curl_download "$tmpdir/$filename" "$url_match" || {
       msg_error "Download failed: $url_match"
+      rm -rf "$tmpdir"
       return 250
     }
 
@@ -4222,6 +4230,7 @@ fetch_and_deploy_gh_release() {
     DEBIAN_FRONTEND=noninteractive SYSTEMD_OFFLINE=1 $STD apt install -y $dpkg_opts "$tmpdir/$filename" || {
       SYSTEMD_OFFLINE=1 $STD dpkg -i "$tmpdir/$filename" || {
         _diagnose_deb_failure "$tmpdir/$filename"
+        rm -rf "$tmpdir"
         return 100
       }
     }
@@ -4232,6 +4241,7 @@ fetch_and_deploy_gh_release() {
     pattern="${pattern#\"}"
     [[ -z "$pattern" ]] && {
       msg_error "Mode 'prebuild' requires 6th parameter (asset filename pattern)"
+      rm -rf "$tmpdir"
       return 65
     }
 
@@ -4267,18 +4277,79 @@ fetch_and_deploy_gh_release() {
 
     [[ -z "$asset_url" ]] && {
       msg_error "No asset matching '$pattern' found"
+      rm -rf "$tmpdir"
       return 252
     }
 
     filename="${asset_url##*/}"
     curl_download "$tmpdir/$filename" "$asset_url" || {
       msg_error "Download failed: $asset_url"
+      rm -rf "$tmpdir"
       return 250
     }
 
     local unpack_tmp
     unpack_tmp=$(mktemp -d)
-    _deploy_unpacked_archive "$tmpdir/$filename" "$target" "$unpack_tmp" || return
+    mkdir -p "$target"
+    if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
+      rm -rf "${target:?}/"*
+    fi
+
+    if [[ "$filename" == *.zip ]]; then
+      ensure_dependencies unzip
+      unzip -q "$tmpdir/$filename" -d "$unpack_tmp" || {
+        msg_error "Failed to extract ZIP archive"
+        rm -rf "$tmpdir" "$unpack_tmp"
+        return 251
+      }
+    elif [[ "$filename" == *.tar.* || "$filename" == *.tgz || "$filename" == *.txz ]]; then
+      tar --no-same-owner -xf "$tmpdir/$filename" -C "$unpack_tmp" || {
+        msg_error "Failed to extract TAR archive"
+        rm -rf "$tmpdir" "$unpack_tmp"
+        return 251
+      }
+    else
+      msg_error "Unsupported archive format: $filename"
+      rm -rf "$tmpdir" "$unpack_tmp"
+      return 65
+    fi
+
+    local top_dirs
+    top_dirs=$(find "$unpack_tmp" -mindepth 1 -maxdepth 1 -type d | wc -l)
+    local top_entries inner_dir
+    top_entries=$(find "$unpack_tmp" -mindepth 1 -maxdepth 1)
+    if [[ "$(echo "$top_entries" | wc -l)" -eq 1 && -d "$top_entries" ]]; then
+      # Strip leading folder
+      inner_dir="$top_entries"
+      shopt -s dotglob nullglob
+      if compgen -G "$inner_dir/*" >/dev/null; then
+        cp -r "$inner_dir"/* "$target/" || {
+          msg_error "Failed to copy contents from $inner_dir to $target"
+          rm -rf "$tmpdir" "$unpack_tmp"
+          return 252
+        }
+      else
+        msg_error "Inner directory is empty: $inner_dir"
+        rm -rf "$tmpdir" "$unpack_tmp"
+        return 252
+      fi
+      shopt -u dotglob nullglob
+    else
+      # Copy all contents
+      shopt -s dotglob nullglob
+      if compgen -G "$unpack_tmp/*" >/dev/null; then
+        cp -r "$unpack_tmp"/* "$target/" || {
+          msg_error "Failed to copy contents to $target"
+          rm -rf "$tmpdir" "$unpack_tmp"
+          return 252
+        }
+      else
+        msg_error "Unpacked archive is empty"
+        rm -rf "$tmpdir" "$unpack_tmp"
+        return 252
+      fi
+      shopt -u dotglob nullglob
+    fi
 
     ### Singlefile Mode ###
   elif [[ "$mode" == "singlefile" ]]; then
@@ -4286,6 +4357,7 @@ fetch_and_deploy_gh_release() {
     pattern="${pattern#\"}"
     [[ -z "$pattern" ]] && {
       msg_error "Mode 'singlefile' requires 6th parameter (asset filename pattern)"
+      rm -rf "$tmpdir"
       return 65
     }
 
@@ -4320,6 +4392,7 @@ fetch_and_deploy_gh_release() {
     fi
     [[ -z "$asset_url" ]] && {
       msg_error "No asset matching '$pattern' found"
+      rm -rf "$tmpdir"
       return 252
     }
 
@@ -4332,6 +4405,7 @@ fetch_and_deploy_gh_release() {
 
     curl_download "$target/$target_file" "$asset_url" || {
       msg_error "Download failed: $asset_url"
+      rm -rf "$tmpdir"
       return 250
     }
 
@@ -4341,11 +4415,13 @@ fetch_and_deploy_gh_release() {
 
   else
     msg_error "Unknown mode: $mode"
+    rm -rf "$tmpdir"
     return 65
   fi
 
   echo "$version" >"$version_file"
   msg_ok "Deployed: $app ($version)"
+  rm -rf "$tmpdir"
 }
 
 # ------------------------------------------------------------------------------
@@ -7081,7 +7157,7 @@ setup_meilisearch() {
         MEILI_DB_PATH="${MEILI_DB_PATH:-/var/lib/meilisearch/data}"
 
         msg_info "Removing old MeiliSearch database for migration"
-        find "${MEILI_DB_PATH:?}" -mindepth 1 -delete
+        rm -rf "${MEILI_DB_PATH:?}"/*
 
         # Import dump using CLI flag (this is the supported method)
         local DUMP_FILE="${MEILI_DUMP_DIR}/${DUMP_UID}.dump"
@@ -7355,18 +7431,6 @@ setup_mongodb() {
   mkdir -p /var/lib/mongodb
   chown -R mongodb:mongodb /var/lib/mongodb
 
-  local KERNEL_VERSION MONGO_MAJOR
-  KERNEL_VERSION=$(uname -r | cut -d- -f1)
-  MONGO_MAJOR="${MONGO_VERSION%%.*}"
-  if ((MONGO_MAJOR >= 8)) && [[ "$(printf '%s\n' "6.19" "$KERNEL_VERSION" | sort -V | head -n1)" == "6.19" ]]; then
-    mkdir -p /etc/systemd/system/mongod.service.d
-    cat <<EOF >/etc/systemd/system/mongod.service.d/rseq.conf
-[Service]
-Environment=GLIBC_TUNABLES=glibc.pthread.rseq=1
-EOF
-    systemctl daemon-reload
-  fi
-
   $STD systemctl enable mongod || {
     msg_warn "Failed to enable mongod service"
   }
@@ -8613,7 +8677,6 @@ setup_postgresql_db() {
   export PG_DB_USER
   export PG_DB_PASS
 }
-
 # ------------------------------------------------------------------------------
 # Installs rbenv and ruby-build, installs Ruby and optionally Rails.
 #
@@ -8633,26 +8696,8 @@ setup_ruby() {
   local RBENV_DIR="$HOME/.rbenv"
   local RBENV_BIN="$RBENV_DIR/bin/rbenv"
   local PROFILE_FILE="$HOME/.profile"
-  local BASH_PROFILE_FILE="$HOME/.bash_profile"
-  local BASHRC_FILE="$HOME/.bashrc"
   local TMP_DIR=$(mktemp -d)
 
-  if ! grep -q 'rbenv init' "$PROFILE_FILE" 2>/dev/null; then
-    cat <<'EOF' >>"$PROFILE_FILE"
-export PATH="$HOME/.rbenv/bin:$PATH"
-eval "$(rbenv init -)"
-EOF
-  fi
-  if ! grep -q '.rbenv/shims' "$PROFILE_FILE" 2>/dev/null; then
-    echo 'export PATH="$HOME/.rbenv/shims:$HOME/.rbenv/bin:$PATH"' >>"$PROFILE_FILE"
-  fi
-  if [[ -f "$BASH_PROFILE_FILE" ]] && ! grep -q '.rbenv/shims' "$BASH_PROFILE_FILE"; then
-    echo 'export PATH="$HOME/.rbenv/shims:$HOME/.rbenv/bin:$PATH"' >>"$BASH_PROFILE_FILE"
-  fi
-  if [[ -f "$BASHRC_FILE" ]] && ! grep -q '.rbenv/shims' "$BASHRC_FILE"; then
-    echo 'export PATH="$HOME/.rbenv/shims:$HOME/.rbenv/bin:$PATH"' >>"$BASHRC_FILE"
-  fi
-
   # Get currently installed Ruby version
   local CURRENT_RUBY_VERSION=""
   if [[ -x "$RBENV_BIN" ]]; then
@@ -9055,16 +9100,6 @@ setup_uv() {
       msg_ok "uvx wrapper installed"
     fi
 
-    # Install specific Python version if requested (even when uv is already up to date)
-    if [[ -n "${PYTHON_VERSION:-}" ]]; then
-      msg_info "Installing Python $PYTHON_VERSION via uv"
-      $STD uv python install "$PYTHON_VERSION" || {
-        msg_error "Failed to install Python $PYTHON_VERSION"
-        return 150
-      }
-      msg_ok "Python $PYTHON_VERSION installed"
-    fi
-
     return 0
   fi
 
@@ -9267,10 +9302,10 @@ fetch_and_deploy_from_url() {
     msg_error "Failed to create temporary directory"
     return 252
   }
-  trap 'rm -rf "$tmpdir" "${unpack_tmp:-}"' RETURN
 
   curl -fsSL -o "$tmpdir/$filename" "$url" || {
     msg_error "Download failed: $url"
+    rm -rf "$tmpdir"
     return 250
   }
 
@@ -9290,6 +9325,7 @@ fetch_and_deploy_from_url() {
     archive_type="tar"
   else
     msg_error "Unsupported or unknown archive type: $file_desc"
+    rm -rf "$tmpdir"
     return 65
   fi
 
@@ -9302,16 +9338,19 @@ fetch_and_deploy_from_url() {
     $STD apt install -y "$tmpdir/$filename" || {
       $STD dpkg -i "$tmpdir/$filename" || {
         _diagnose_deb_failure "$tmpdir/$filename"
+        rm -rf "$tmpdir"
         return 100
       }
     }
 
+    rm -rf "$tmpdir"
     msg_ok "Successfully installed .deb package"
     return 0
   fi
 
   if [[ -z "$directory" ]]; then
     msg_error "Directory parameter is required for archive extraction"
+    rm -rf "$tmpdir"
     return 65
   fi
 
@@ -9320,7 +9359,7 @@ fetch_and_deploy_from_url() {
   mkdir -p "$directory"
 
   if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-    find "${directory:?}" -mindepth 1 -delete
+    rm -rf "${directory:?}/"*
   fi
 
   local unpack_tmp
@@ -9330,11 +9369,13 @@ fetch_and_deploy_from_url() {
     ensure_dependencies unzip
     unzip -q "$tmpdir/$filename" -d "$unpack_tmp" || {
       msg_error "Failed to extract ZIP archive"
+      rm -rf "$tmpdir" "$unpack_tmp"
       return 251
     }
   elif [[ "$archive_type" == "tar" ]]; then
     tar --no-same-owner -xf "$tmpdir/$filename" -C "$unpack_tmp" || {
       msg_error "Failed to extract TAR archive"
+      rm -rf "$tmpdir" "$unpack_tmp"
       return 251
     }
   fi
@@ -9348,12 +9389,12 @@ fetch_and_deploy_from_url() {
     if compgen -G "$inner_dir/*" >/dev/null; then
       cp -r "$inner_dir"/* "$directory/" || {
         msg_error "Failed to copy contents from $inner_dir to $directory"
-        shopt -u dotglob nullglob
+        rm -rf "$tmpdir" "$unpack_tmp"
         return 252
       }
     else
       msg_error "Inner directory is empty: $inner_dir"
-      shopt -u dotglob nullglob
+      rm -rf "$tmpdir" "$unpack_tmp"
       return 252
     fi
     shopt -u dotglob nullglob
@@ -9362,17 +9403,18 @@ fetch_and_deploy_from_url() {
     if compgen -G "$unpack_tmp/*" >/dev/null; then
       cp -r "$unpack_tmp"/* "$directory/" || {
         msg_error "Failed to copy contents to $directory"
-        shopt -u dotglob nullglob
+        rm -rf "$tmpdir" "$unpack_tmp"
         return 252
       }
     else
       msg_error "Unpacked archive is empty"
-      shopt -u dotglob nullglob
+      rm -rf "$tmpdir" "$unpack_tmp"
       return 252
     fi
     shopt -u dotglob nullglob
   fi
 
+  rm -rf "$tmpdir" "$unpack_tmp"
   msg_ok "Successfully deployed archive to $directory"
   return 0
 }
@@ -9773,7 +9815,7 @@ fetch_and_deploy_gl_release() {
 
   local gl_rel_json
   gl_rel_json=$(mktemp /tmp/tools-gl-rel-XXXXXX) || return 73
-  trap 'rm -f "$gl_rel_json"; rm -rf "${tmpdir:-}" "${unpack_tmp:-}"' RETURN
+  trap 'rm -f "$gl_rel_json"' RETURN
 
   local repo_encoded
   repo_encoded=$(printf '%s' "$repo" | sed 's|/|%2F|g')
@@ -9885,12 +9927,28 @@ fetch_and_deploy_gl_release() {
     local direct_tarball_url="https://gitlab.com/$repo/-/archive/$tag_name/${app_lc}-${version_safe}.tar.gz"
     filename="${app_lc}-${version_safe}.tar.gz"
 
-    _download_source_tarball "$direct_tarball_url" "$tmpdir/$filename" "${header[@]}" || {
+    curl $download_timeout -fsSL "${header[@]}" -o "$tmpdir/$filename" "$direct_tarball_url" || {
       msg_error "Download failed: $direct_tarball_url"
+      rm -rf "$tmpdir"
       return 1
     }
 
-    _deploy_source_tarball "$tmpdir/$filename" "$target" "$tmpdir" || return 1
+    mkdir -p "$target"
+    if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
+      rm -rf "${target:?}/"*
+    fi
+
+    tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
+      msg_error "Failed to extract tarball"
+      rm -rf "$tmpdir"
+      return 1
+    }
+    local unpack_dir
+    unpack_dir=$(find "$tmpdir" -mindepth 1 -maxdepth 1 -type d | head -n1)
+
+    shopt -s dotglob nullglob
+    cp -r "$unpack_dir"/* "$target/"
+    shopt -u dotglob nullglob
 
   ### Binary Mode ###
   elif [[ "$mode" == "binary" ]]; then
@@ -9960,12 +10018,14 @@ fetch_and_deploy_gl_release() {
 
     if [[ -z "$url_match" ]]; then
       msg_error "No suitable .deb asset found for $app"
+      rm -rf "$tmpdir"
       return 1
     fi
 
     filename="${url_match##*/}"
     curl $download_timeout -fsSL "${header[@]}" -o "$tmpdir/$filename" "$url_match" || {
       msg_error "Download failed: $url_match"
+      rm -rf "$tmpdir"
       return 1
     }
 
@@ -9976,6 +10036,7 @@ fetch_and_deploy_gl_release() {
     DEBIAN_FRONTEND=noninteractive SYSTEMD_OFFLINE=1 $STD apt install -y $dpkg_opts "$tmpdir/$filename" || {
       SYSTEMD_OFFLINE=1 $STD dpkg -i "$tmpdir/$filename" || {
         _diagnose_deb_failure "$tmpdir/$filename"
+        rm -rf "$tmpdir"
         return 1
       }
     }
@@ -9986,6 +10047,7 @@ fetch_and_deploy_gl_release() {
     pattern="${pattern#\"}"
     [[ -z "$pattern" ]] && {
       msg_error "Mode 'prebuild' requires 6th parameter (asset filename pattern)"
+      rm -rf "$tmpdir"
       return 1
     }
 
@@ -10020,18 +10082,75 @@ fetch_and_deploy_gl_release() {
 
     [[ -z "$asset_url" ]] && {
       msg_error "No asset matching '$pattern' found"
+      rm -rf "$tmpdir"
       return 1
     }
 
     filename="${asset_url##*/}"
     curl $download_timeout -fsSL "${header[@]}" -o "$tmpdir/$filename" "$asset_url" || {
       msg_error "Download failed: $asset_url"
+      rm -rf "$tmpdir"
       return 1
     }
 
     local unpack_tmp
     unpack_tmp=$(mktemp -d)
-    _deploy_unpacked_archive "$tmpdir/$filename" "$target" "$unpack_tmp" || return
+    mkdir -p "$target"
+    if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
+      rm -rf "${target:?}/"*
+    fi
+
+    if [[ "$filename" == *.zip ]]; then
+      ensure_dependencies unzip
+      unzip -q "$tmpdir/$filename" -d "$unpack_tmp" || {
+        msg_error "Failed to extract ZIP archive"
+        rm -rf "$tmpdir" "$unpack_tmp"
+        return 1
+      }
+    elif [[ "$filename" == *.tar.* || "$filename" == *.tgz || "$filename" == *.txz ]]; then
+      tar --no-same-owner -xf "$tmpdir/$filename" -C "$unpack_tmp" || {
+        msg_error "Failed to extract TAR archive"
+        rm -rf "$tmpdir" "$unpack_tmp"
+        return 1
+      }
+    else
+      msg_error "Unsupported archive format: $filename"
+      rm -rf "$tmpdir" "$unpack_tmp"
+      return 1
+    fi
+
+    local top_entries inner_dir
+    top_entries=$(find "$unpack_tmp" -mindepth 1 -maxdepth 1)
+    if [[ "$(echo "$top_entries" | wc -l)" -eq 1 && -d "$top_entries" ]]; then
+      inner_dir="$top_entries"
+      shopt -s dotglob nullglob
+      if compgen -G "$inner_dir/*" >/dev/null; then
+        cp -r "$inner_dir"/* "$target/" || {
+          msg_error "Failed to copy contents from $inner_dir to $target"
+          rm -rf "$tmpdir" "$unpack_tmp"
+          return 1
+        }
+      else
+        msg_error "Inner directory is empty: $inner_dir"
+        rm -rf "$tmpdir" "$unpack_tmp"
+        return 1
+      fi
+      shopt -u dotglob nullglob
+    else
+      shopt -s dotglob nullglob
+      if compgen -G "$unpack_tmp/*" >/dev/null; then
+        cp -r "$unpack_tmp"/* "$target/" || {
+          msg_error "Failed to copy contents to $target"
+          rm -rf "$tmpdir" "$unpack_tmp"
+          return 1
+        }
+      else
+        msg_error "Unpacked archive is empty"
+        rm -rf "$tmpdir" "$unpack_tmp"
+        return 1
+      fi
+      shopt -u dotglob nullglob
+    fi
 
   ### Singlefile Mode ###
   elif [[ "$mode" == "singlefile" ]]; then
@@ -10039,6 +10158,7 @@ fetch_and_deploy_gl_release() {
     pattern="${pattern#\"}"
     [[ -z "$pattern" ]] && {
       msg_error "Mode 'singlefile' requires 6th parameter (asset filename pattern)"
+      rm -rf "$tmpdir"
       return 1
     }
 
@@ -10073,6 +10193,7 @@ fetch_and_deploy_gl_release() {
 
     [[ -z "$asset_url" ]] && {
       msg_error "No asset matching '$pattern' found"
+      rm -rf "$tmpdir"
       return 1
     }
 
@@ -10085,6 +10206,7 @@ fetch_and_deploy_gl_release() {
 
     curl $download_timeout -fsSL "${header[@]}" -o "$target/$target_file" "$asset_url" || {
       msg_error "Download failed: $asset_url"
+      rm -rf "$tmpdir"
       return 1
     }
 
@@ -10094,11 +10216,13 @@ fetch_and_deploy_gl_release() {
 
   else
     msg_error "Unknown mode: $mode"
+    rm -rf "$tmpdir"
     return 1
   fi
 
   echo "$version" >"$version_file"
   msg_ok "Deployed: $app ($version)"
+  rm -rf "$tmpdir"
 }
 
 # ------------------------------------------------------------------------------