fix(paperless-ngx): increase default RAM to 3GB

2GB can be insufficient for certain tasks causing swap to fill up and tasks to fail or hang. Increase default to 3GB as a safer baseline. Ref #13014
2026-03-18 16:02:59 +01:00 · 2026-03-17 20:45:14 +01:00
15 changed files with 104 additions and 321 deletions
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -423,45 +423,8 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 </details>

-## 2026-03-18
-
-### 🆕 New Scripts
-
-  - split-pro ([#12975](https://github.com/community-scripts/ProxmoxVE/pull/12975))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Paperless-NGX: increase default RAM to 3GB [@MickLesk](https://github.com/MickLesk) ([#13018](https://github.com/community-scripts/ProxmoxVE/pull/13018))
-    - Plex: restart service after update to apply new version [@MickLesk](https://github.com/MickLesk) ([#13017](https://github.com/community-scripts/ProxmoxVE/pull/13017))
-
-  - #### 🔧 Refactor
-
-    - pve-scripts-local: Increase default disk size from 4GB to 10GB [@MickLesk](https://github.com/MickLesk) ([#13009](https://github.com/community-scripts/ProxmoxVE/pull/13009))
-
-### 💾 Core
-
-  - #### ✨ New Features
-
-    - tools.func: Implement check_for_gh_tag function [@MickLesk](https://github.com/MickLesk) ([#12998](https://github.com/community-scripts/ProxmoxVE/pull/12998))
-    - tools.func: Implement fetch_and_deploy_gh_tag function [@MickLesk](https://github.com/MickLesk) ([#13000](https://github.com/community-scripts/ProxmoxVE/pull/13000))
-
 ## 2026-03-17

-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Gluetun: add OpenVPN process user and cleanup stale config [@MickLesk](https://github.com/MickLesk) ([#13016](https://github.com/community-scripts/ProxmoxVE/pull/13016))
-    - Frigate: check OpenVino model files exist before configuring detector and use curl_with_retry instead of default wget [@MickLesk](https://github.com/MickLesk) ([#13019](https://github.com/community-scripts/ProxmoxVE/pull/13019))
-
-### 💾 Core
-
-  - #### 🔧 Refactor
-
-    - tools.func: Update `create_self_signed_cert()` [@tremor021](https://github.com/tremor021) ([#13008](https://github.com/community-scripts/ProxmoxVE/pull/13008))
-
 ## 2026-03-16

 ### 🆕 New Scripts
--- a/ct/headers/split-pro
+++ b/ct/headers/split-pro
@@ -1,6 +0,0 @@
-   _____       ___ __        ____           
-  / ___/____  / (_) /_      / __ \_________ 
-  \__ \/ __ \/ / / __/_____/ /_/ / ___/ __ \
- ___/ / /_/ / / / /_/_____/ ____/ /  / /_/ /
-/____/ .___/_/_/\__/     /_/   /_/   \____/ 
-    /_/                                     
--- a/ct/plex.sh
+++ b/ct/plex.sh
@@ -79,11 +79,6 @@ function update_script() {
  $STD apt update
  $STD apt install -y plexmediaserver
  msg_ok "Updated Plex Media Server"
-
-  msg_info "Restarting Plex Media Server"
-  systemctl restart plexmediaserver
-  msg_ok "Restarted Plex Media Server"
-
  msg_ok "Updated successfully!"
  exit
 }
--- a/ct/pve-scripts-local.sh
+++ b/ct/pve-scripts-local.sh
@@ -9,7 +9,7 @@ APP="PVE-Scripts-Local"
 var_tags="${var_tags:-pve-scripts-local}"
 var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-4096}"
-var_disk="${var_disk:-10}"
+var_disk="${var_disk:-4}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
 var_unprivileged="${var_unprivileged:-1}"
--- a/ct/sparkyfitness.sh
+++ b/ct/sparkyfitness.sh
@@ -51,7 +51,7 @@ function update_script() {

    msg_info "Updating Sparky Fitness Backend"
    cd /opt/sparkyfitness/SparkyFitnessServer
-    $STD pnpm install
+    $STD npm install --legacy-peer-deps
    msg_ok "Updated Sparky Fitness Backend"

    msg_info "Updating Sparky Fitness Frontend (Patience)"
--- a/ct/split-pro.sh
+++ b/ct/split-pro.sh
@@ -1,68 +0,0 @@
-#!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: johanngrobe
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/oss-apps/split-pro
-
-APP="Split-Pro"
-var_tags="${var_tags:-finance;expense-sharing}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-4096}"
-var_disk="${var_disk:-6}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_unprivileged="${var_unprivileged:-1}"
-
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/split-pro ]]; then
-    msg_error "No Split Pro Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "split-pro" "oss-apps/split-pro"; then
-    msg_info "Stopping Service"
-    systemctl stop split-pro
-    msg_ok "Stopped Service"
-
-    msg_info "Backing up Data"
-    cp /opt/split-pro/.env /opt/split-pro.env
-    msg_ok "Backed up Data"
-
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "split-pro" "oss-apps/split-pro" "tarball"
-
-    msg_info "Building Application"
-    cd /opt/split-pro
-    $STD pnpm install --frozen-lockfile
-    $STD pnpm build
-    cp /opt/split-pro.env /opt/split-pro/.env
-    rm -f /opt/split-pro.env
-    ln -sf /opt/split-pro_data/uploads /opt/split-pro/uploads
-    $STD pnpm exec prisma migrate deploy
-    msg_ok "Built Application"
-
-    msg_info "Starting Service"
-    systemctl start split-pro
-    msg_ok "Started Service"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:3000${CL}"
--- a/install/channels-install.sh
+++ b/install/channels-install.sh
@@ -35,6 +35,7 @@ setup_hwaccel
 msg_info "Installing Channels DVR Server (Patience)"
 cd /opt
 $STD bash <(curl -fsSL https://getchannels.com/dvr/setup.sh)
+sed -i -e 's/^sgx:x:104:$/render:x:104:root/' -e 's/^render:x:106:root$/sgx:x:106:/' /etc/group
 msg_ok "Installed Channels DVR Server"

 motd_ssh
--- a/install/emby-install.sh
+++ b/install/emby-install.sh
@@ -13,10 +13,18 @@ setting_up_container
 network_check
 update_os

-setup_hwaccel "emby"
+setup_hwaccel

 fetch_and_deploy_gh_release "emby" "MediaBrowser/Emby.Releases" "binary"

+msg_info "Configuring Emby"
+if [[ "$CTTYPE" == "0" ]]; then
+  sed -i -e 's/^ssl-cert:x:104:$/render:x:104:root,emby/' -e 's/^render:x:108:root,emby$/ssl-cert:x:108:/' /etc/group
+else
+  sed -i -e 's/^ssl-cert:x:104:$/render:x:104:emby/' -e 's/^render:x:108:emby$/ssl-cert:x:108:/' /etc/group
+fi
+msg_ok "Configured Emby"
+
 motd_ssh
 customize
 cleanup_lxc
--- a/install/frigate-install.sh
+++ b/install/frigate-install.sh
@@ -146,7 +146,7 @@ ldconfig
 msg_ok "Built libUSB"

 msg_info "Bootstrapping pip"
-curl_with_retry "https://bootstrap.pypa.io/get-pip.py" "/tmp/get-pip.py"
+wget -q https://bootstrap.pypa.io/get-pip.py -O /tmp/get-pip.py
 sed -i 's/args.append("setuptools")/args.append("setuptools==77.0.3")/' /tmp/get-pip.py
 $STD python3 /tmp/get-pip.py "pip"
 rm -f /tmp/get-pip.py
@@ -169,13 +169,13 @@ NODE_VERSION="20" setup_nodejs

 msg_info "Downloading Inference Models"
 mkdir -p /models /openvino-model
-curl_with_retry "https://github.com/google-coral/test_data/raw/release-frogfish/ssdlite_mobiledet_coco_qat_postprocess_edgetpu.tflite" "/edgetpu_model.tflite"
-curl_with_retry "https://github.com/google-coral/test_data/raw/release-frogfish/ssdlite_mobiledet_coco_qat_postprocess.tflite" "/models/cpu_model.tflite"
+wget -q -O /edgetpu_model.tflite https://github.com/google-coral/test_data/raw/release-frogfish/ssdlite_mobiledet_coco_qat_postprocess_edgetpu.tflite
+wget -q -O /models/cpu_model.tflite https://github.com/google-coral/test_data/raw/release-frogfish/ssdlite_mobiledet_coco_qat_postprocess.tflite
 cp /opt/frigate/labelmap.txt /labelmap.txt
 msg_ok "Downloaded Inference Models"

 msg_info "Downloading Audio Model"
-curl_with_retry "https://www.kaggle.com/api/v1/models/google/yamnet/tfLite/classification-tflite/1/download" "/tmp/yamnet.tar.gz"
+wget -q -O /tmp/yamnet.tar.gz https://www.kaggle.com/api/v1/models/google/yamnet/tfLite/classification-tflite/1/download
 $STD tar xzf /tmp/yamnet.tar.gz -C /
 mv /1.tflite /cpu_audio_model.tflite
 cp /opt/frigate/audio-labelmap.txt /audio-labelmap.txt
@@ -205,7 +205,7 @@ msg_ok "Installed OpenVino"

 msg_info "Building OpenVino Model"
 cd /models
-curl_with_retry "http://download.tensorflow.org/models/object_detection/ssdlite_mobilenet_v2_coco_2018_05_09.tar.gz" "ssdlite_mobilenet_v2_coco_2018_05_09.tar.gz"
+wget -q http://download.tensorflow.org/models/object_detection/ssdlite_mobilenet_v2_coco_2018_05_09.tar.gz
 $STD tar -zxf ssdlite_mobilenet_v2_coco_2018_05_09.tar.gz --no-same-owner
 if python3 /opt/frigate/docker/main/build_ov_model.py &>/dev/null; then
  mkdir -p /openvino-model
@@ -219,7 +219,7 @@ if python3 /opt/frigate/docker/main/build_ov_model.py &>/dev/null; then
    if [[ -n "$OV_LABELS" ]]; then
      ln -sf "$OV_LABELS" /openvino-model/coco_91cl_bkgr.txt
    else
-      curl_with_retry "https://raw.githubusercontent.com/openvinotoolkit/open_model_zoo/master/data/dataset_classes/coco_91cl_bkgr.txt" "/openvino-model/coco_91cl_bkgr.txt"
+      wget -q "https://raw.githubusercontent.com/openvinotoolkit/open_model_zoo/master/data/dataset_classes/coco_91cl_bkgr.txt" -O /openvino-model/coco_91cl_bkgr.txt
    fi
  fi
  sed -i 's/truck/car/g' /openvino-model/coco_91cl_bkgr.txt
@@ -246,7 +246,7 @@ msg_info "Configuring Frigate"
 mkdir -p /config /media/frigate
 cp -r /opt/frigate/config/. /config

-curl_with_retry "https://github.com/intel-iot-devkit/sample-videos/raw/master/person-bicycle-car-detection.mp4" "/media/frigate/person-bicycle-car-detection.mp4"
+curl -fsSL "https://github.com/intel-iot-devkit/sample-videos/raw/master/person-bicycle-car-detection.mp4" -o "/media/frigate/person-bicycle-car-detection.mp4"

 echo "tmpfs   /tmp/cache      tmpfs   defaults        0       0" >>/etc/fstab

@@ -289,7 +289,7 @@ detect:
  enabled: false
 EOF

-if grep -q -o -m1 -E 'avx[^ ]*|sse4_2' /proc/cpuinfo && [[ -f /openvino-model/ssdlite_mobilenet_v2.xml ]] && [[ -f /openvino-model/coco_91cl_bkgr.txt ]]; then
+if grep -q -o -m1 -E 'avx[^ ]*|sse4_2' /proc/cpuinfo; then
  cat <<EOF >>/config/config.yml
 ffmpeg:
  hwaccel_args: auto
--- a/install/gluetun-install.sh
+++ b/install/gluetun-install.sh
@@ -46,9 +46,6 @@ VPN_TYPE=openvpn
 OPENVPN_CUSTOM_CONFIG=/opt/gluetun-data/custom.ovpn
 OPENVPN_USER=
 OPENVPN_PASSWORD=
-OPENVPN_PROCESS_USER=root
-PUID=0
-PGID=0
 HTTP_CONTROL_SERVER_ADDRESS=:8000
 HTTPPROXY=off
 SHADOWSOCKS=off
@@ -79,7 +76,6 @@ User=root
 WorkingDirectory=/opt/gluetun-data
 EnvironmentFile=/opt/gluetun-data/.env
 UnsetEnvironment=USER
-ExecStartPre=/bin/sh -c 'rm -f /etc/openvpn/target.ovpn'
 ExecStart=/usr/local/bin/gluetun
 Restart=on-failure
 RestartSec=5
--- a/install/ollama-install.sh
+++ b/install/ollama-install.sh
@@ -42,7 +42,7 @@ EOF
 $STD apt update
 msg_ok "Set up Intel® Repositories"

-setup_hwaccel "ollama"
+setup_hwaccel

 msg_info "Installing Intel® Level Zero"
 # Debian 13+ has newer Level Zero packages in system repos that conflict with Intel repo packages
@@ -89,6 +89,8 @@ msg_info "Creating ollama User and Group"
 if ! id ollama >/dev/null 2>&1; then
  useradd -r -s /usr/sbin/nologin -U -m -d /usr/share/ollama ollama
 fi
+$STD usermod -aG render ollama || true
+$STD usermod -aG video ollama || true
 $STD usermod -aG ollama $(id -u -n)
 msg_ok "Created ollama User and adjusted Groups"

--- a/install/plex-install.sh
+++ b/install/plex-install.sh
@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os

-setup_hwaccel "plex"
+setup_hwaccel

 msg_info "Setting Up Plex Media Server Repository"
 setup_deb822_repo \
@@ -26,6 +26,11 @@ msg_ok "Set Up Plex Media Server Repository"

 msg_info "Installing Plex Media Server"
 $STD apt install -y plexmediaserver
+if [[ "$CTTYPE" == "0" ]]; then
+  sed -i -e 's/^ssl-cert:x:104:plex$/render:x:104:root,plex/' -e 's/^render:x:108:root$/ssl-cert:x:108:plex/' /etc/group
+else
+  sed -i -e 's/^ssl-cert:x:104:plex$/render:x:104:plex/' -e 's/^render:x:108:$/ssl-cert:x:108:/' /etc/group
+fi
 msg_ok "Installed Plex Media Server"

 motd_ssh
--- a/install/sparkyfitness-install.sh
+++ b/install/sparkyfitness-install.sh
@@ -47,7 +47,7 @@ msg_ok "Configured Sparky Fitness"

 msg_info "Building Backend"
 cd /opt/sparkyfitness/SparkyFitnessServer
-$STD pnpm install
+$STD npm install --legacy-peer-deps
 msg_ok "Built Backend"

 msg_info "Building Frontend (Patience)"
--- a/install/split-pro-install.sh
+++ b/install/split-pro-install.sh
@@ -1,74 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: johanngrobe
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/oss-apps/split-pro
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-NODE_VERSION="22" NODE_MODULE="pnpm" setup_nodejs
-PG_VERSION="17" PG_MODULES="cron" setup_postgresql
-
-msg_info "Installing Dependencies"
-$STD apt install -y openssl
-msg_ok "Installed Dependencies"
-
-PG_DB_NAME="splitpro" PG_DB_USER="splitpro" PG_DB_EXTENSIONS="pg_cron" setup_postgresql_db
-fetch_and_deploy_gh_release "split-pro" "oss-apps/split-pro" "tarball"
-
-msg_info "Installing Dependencies"
-cd /opt/split-pro
-$STD pnpm install --frozen-lockfile
-msg_ok "Installed Dependencies"
-
-msg_info "Building Split Pro"
-cd /opt/split-pro
-mkdir -p /opt/split-pro_data/uploads
-ln -sf /opt/split-pro_data/uploads /opt/split-pro/uploads
-NEXTAUTH_SECRET=$(openssl rand -base64 32)
-cp .env.example .env
-sed -i "s|^DATABASE_URL=.*|DATABASE_URL=\"postgresql://${PG_DB_USER}:${PG_DB_PASS}@localhost:5432/${PG_DB_NAME}\"|" .env
-sed -i "s|^NEXTAUTH_SECRET=.*|NEXTAUTH_SECRET=\"${NEXTAUTH_SECRET}\"|" .env
-sed -i "s|^NEXTAUTH_URL=.*|NEXTAUTH_URL=\"http://${LOCAL_IP}:3000\"|" .env
-sed -i "s|^NEXTAUTH_URL_INTERNAL=.*|NEXTAUTH_URL_INTERNAL=\"http://localhost:3000\"|" .env
-sed -i "/^POSTGRES_CONTAINER_NAME=/d" .env
-sed -i "/^POSTGRES_USER=/d" .env
-sed -i "/^POSTGRES_PASSWORD=/d" .env
-sed -i "/^POSTGRES_DB=/d" .env
-sed -i "/^POSTGRES_PORT=/d" .env
-$STD pnpm build
-$STD pnpm exec prisma migrate deploy
-msg_ok "Built Split Pro"
-
-msg_info "Creating Service"
-cat <<EOF >/etc/systemd/system/split-pro.service
-[Unit]
-Description=Split Pro
-After=network.target postgresql.service
-Requires=postgresql.service
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=/opt/split-pro
-EnvironmentFile=/opt/split-pro/.env
-ExecStart=/usr/bin/pnpm start
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now split-pro
-msg_ok "Created Service"
-
-motd_ssh
-customize
-cleanup_lxc
--- a/misc/tools.func
+++ b/misc/tools.func
@@ -2077,129 +2077,101 @@ verify_gpg_fingerprint() {
 }

 # ------------------------------------------------------------------------------
-# Fetches and deploys a GitHub tag-based source tarball.
+# Get latest GitHub tag for a repository.
 #
 # Description:
-#   - Downloads the source tarball for a given tag from GitHub
-#   - Extracts to the target directory
-#   - Writes the version to ~/.<app>
+#   - Queries the GitHub API for tags (not releases)
+#   - Useful for repos that only create tags, not full releases
+#   - Supports optional prefix filter and version-only extraction
+#   - Returns the latest tag name (printed to stdout)
 #
 # Usage:
-#     fetch_and_deploy_gh_tag "guacd" "apache/guacamole-server"
-#     fetch_and_deploy_gh_tag "guacd" "apache/guacamole-server" "latest" "/opt/guacamole-server"
+#   MONGO_VERSION=$(get_latest_gh_tag "mongodb/mongo-tools")
+#   LATEST=$(get_latest_gh_tag "owner/repo" "v")          # only tags starting with "v"
+#   LATEST=$(get_latest_gh_tag "owner/repo" "" "true")     # strip leading "v"
 #
 # Arguments:
-#   $1 - App name (used for version file ~/.<app>)
-#   $2 - GitHub repo (owner/repo)
-#   $3 - Tag version (default: "latest" → auto-detect via get_latest_gh_tag)
-#   $4 - Target directory (default: /opt/$app)
+#   $1 - GitHub repo (owner/repo)
+#   $2 - Tag prefix filter (optional, e.g. "v" or "100.")
+#   $3 - Strip prefix from result (optional, "true" to strip $2 prefix)
+#
+# Returns:
+#   0 on success (tag printed to stdout), 1 on failure
 #
 # Notes:
-#   - Supports CLEAN_INSTALL=1 to wipe target before extracting
-#   - For repos that only publish tags, not GitHub Releases
+#   - Skips tags containing "rc", "alpha", "beta", "dev", "test"
+#   - Sorts by version number (sort -V) to find the latest
+#   - Respects GITHUB_TOKEN for rate limiting
 # ------------------------------------------------------------------------------
-fetch_and_deploy_gh_tag() {
-  local app="$1"
-  local repo="$2"
-  local version="${3:-latest}"
-  local target="${4:-/opt/$app}"
-  local app_lc=""
-  app_lc="$(echo "${app,,}" | tr -d ' ')"
-  local version_file="$HOME/.${app_lc}"
+get_latest_gh_tag() {
+  local repo="$1"
+  local prefix="${2:-}"
+  local strip_prefix="${3:-false}"

-  if [[ "$version" == "latest" ]]; then
-    version=$(get_latest_gh_tag "$repo") || {
-      msg_error "Failed to determine latest tag for ${repo}"
-      return 1
-    }
-  fi
+  local header_args=()
+  [[ -n "${GITHUB_TOKEN:-}" ]] && header_args=(-H "Authorization: Bearer $GITHUB_TOKEN")

-  local current_version=""
-  [[ -f "$version_file" ]] && current_version=$(<"$version_file")
+  local http_code=""
+  http_code=$(curl -sSL --max-time 20 -w "%{http_code}" -o /tmp/gh_tags.json \
+    -H 'Accept: application/vnd.github+json' \
+    -H 'X-GitHub-Api-Version: 2022-11-28' \
+    "${header_args[@]}" \
+    "https://api.github.com/repos/${repo}/tags?per_page=100" 2>/dev/null) || true

-  if [[ "$current_version" == "$version" ]]; then
-    msg_ok "$app is already up-to-date ($version)"
-    return 0
-  fi
-
-  local tmpdir
-  tmpdir=$(mktemp -d) || return 1
-  local tarball_url="https://github.com/${repo}/archive/refs/tags/${version}.tar.gz"
-  local filename="${app_lc}-${version}.tar.gz"
-
-  msg_info "Fetching GitHub tag: ${app} (${version})"
-
-  download_file "$tarball_url" "$tmpdir/$filename" || {
-    msg_error "Download failed: $tarball_url"
-    rm -rf "$tmpdir"
+  if [[ "$http_code" == "401" ]]; then
+    msg_error "GitHub API authentication failed (HTTP 401)."
+    if [[ -n "${GITHUB_TOKEN:-}" ]]; then
+      msg_error "Your GITHUB_TOKEN appears to be invalid or expired."
+    else
+      msg_error "The repository may require authentication. Try: export GITHUB_TOKEN=\"ghp_your_token\""
+    fi
+    rm -f /tmp/gh_tags.json
    return 1
-  }
-
-  mkdir -p "$target"
-  if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-    rm -rf "${target:?}/"*
  fi

-  tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
-    msg_error "Failed to extract tarball"
-    rm -rf "$tmpdir"
+  if [[ "$http_code" == "403" ]]; then
+    msg_error "GitHub API rate limit exceeded (HTTP 403)."
+    msg_error "To increase the limit, export a GitHub token before running the script:"
+    msg_error "  export GITHUB_TOKEN=\"ghp_your_token_here\""
+    rm -f /tmp/gh_tags.json
    return 1
-  }
+  fi

-  local unpack_dir
-  unpack_dir=$(find "$tmpdir" -mindepth 1 -maxdepth 1 -type d | head -n1)
+  if [[ "$http_code" == "000" || -z "$http_code" ]]; then
+    msg_error "GitHub API connection failed (no response)."
+    msg_error "Check your network/DNS: curl -sSL https://api.github.com/rate_limit"
+    rm -f /tmp/gh_tags.json
+    return 1
+  fi

-  shopt -s dotglob nullglob
-  cp -r "$unpack_dir"/* "$target/"
-  shopt -u dotglob nullglob
+  if [[ "$http_code" != "200" ]] || [[ ! -s /tmp/gh_tags.json ]]; then
+    msg_error "Unable to fetch tags for ${repo} (HTTP ${http_code})"
+    rm -f /tmp/gh_tags.json
+    return 1
+  fi

-  rm -rf "$tmpdir"
-  echo "$version" >"$version_file"
-  msg_ok "Deployed ${app} ${version} to ${target}"
-  return 0
-}
-
-# ------------------------------------------------------------------------------
-# Checks for new GitHub tag (for repos without releases).
-#
-# Description:
-#   - Uses get_latest_gh_tag to fetch the latest tag
-#   - Compares it to a local cached version (~/.<app>)
-#   - If newer, sets global CHECK_UPDATE_RELEASE and returns 0
-#
-# Usage:
-#     if check_for_gh_tag "guacd" "apache/guacamole-server"; then
-#       fetch_and_deploy_gh_tag "guacd" "apache/guacamole-server" "/opt/guacamole-server"
-#     fi
-#
-# Notes:
-#   - For repos that only publish tags, not GitHub Releases
-#   - Same interface as check_for_gh_release
-# ------------------------------------------------------------------------------
-check_for_gh_tag() {
-  local app="$1"
-  local repo="$2"
-  local prefix="${3:-}"
-  local app_lc=""
-  app_lc="$(echo "${app,,}" | tr -d ' ')"
-  local current_file="$HOME/.${app_lc}"
-
-  msg_info "Checking for update: ${app}"
+  local tags_json
+  tags_json=$(</tmp/gh_tags.json)
+  rm -f /tmp/gh_tags.json

+  # Extract tag names, filter by prefix, exclude pre-release patterns, sort by version
  local latest=""
-  latest=$(get_latest_gh_tag "$repo" "$prefix") || return 1
+  latest=$(echo "$tags_json" | grep -oP '"name":\s*"\K[^"]+' |
+    { [[ -n "$prefix" ]] && grep "^${prefix}" || cat; } |
+    grep -viE '(rc|alpha|beta|dev|test|preview|snapshot)' |
+    sort -V | tail -n1)

-  local current=""
-  [[ -f "$current_file" ]] && current="$(<"$current_file")"
-
-  if [[ -z "$current" || "$current" != "$latest" ]]; then
-    CHECK_UPDATE_RELEASE="$latest"
-    msg_ok "Update available: ${app} ${current:-not installed} → ${latest}"
-    return 0
+  if [[ -z "$latest" ]]; then
+    msg_warn "No matching tags found for ${repo}${prefix:+ (prefix: $prefix)}"
+    return 1
  fi

-  msg_ok "No update available: ${app} (${latest})"
-  return 1
+  if [[ "$strip_prefix" == "true" && -n "$prefix" ]]; then
+    latest="${latest#"$prefix"}"
+  fi
+
+  echo "$latest"
+  return 0
 }

 # ==============================================================================
@@ -2547,8 +2519,6 @@ check_for_codeberg_release() {
 # ------------------------------------------------------------------------------
 create_self_signed_cert() {
  local APP_NAME="${1:-${APPLICATION}}"
-  local HOSTNAME="$(hostname -f)"
-  local IP="$(hostname -I | awk '{print $1}')"
  local APP_NAME_LC=$(echo "${APP_NAME,,}" | tr -d ' ')
  local CERT_DIR="/etc/ssl/${APP_NAME_LC}"
  local CERT_KEY="${CERT_DIR}/${APP_NAME_LC}.key"
@@ -2566,8 +2536,8 @@ create_self_signed_cert() {

  mkdir -p "$CERT_DIR"
  $STD openssl req -new -newkey rsa:2048 -days 365 -nodes -x509 \
-    -subj "/CN=${HOSTNAME}" \
-    -addext "subjectAltName=DNS:${HOSTNAME},DNS:localhost,IP:${IP},IP:127.0.0.1" \
+    -subj "/CN=${APP_NAME}" \
+    -addext "subjectAltName=DNS:${APP_NAME}" \
    -keyout "$CERT_KEY" \
    -out "$CERT_CRT" || {
    msg_error "Failed to create self-signed certificate"
@@ -4215,8 +4185,6 @@ function setup_gs() {
 #   - NVIDIA requires matching host driver version
 # ------------------------------------------------------------------------------
 function setup_hwaccel() {
-  local service_user="${1:-}"
-
  # Check if user explicitly disabled GPU in advanced settings
  # ENABLE_GPU is exported from build.func
  if [[ "${ENABLE_GPU:-no}" == "no" ]]; then
@@ -4468,7 +4436,7 @@ function setup_hwaccel() {
  # ═══════════════════════════════════════════════════════════════════════════
  # Device Permissions
  # ═══════════════════════════════════════════════════════════════════════════
-  _setup_gpu_permissions "$in_ct" "$service_user"
+  _setup_gpu_permissions "$in_ct"

  cache_installed_version "hwaccel" "1.0"
  msg_ok "Setup Hardware Acceleration"
@@ -5102,7 +5070,6 @@ EOF
 # ══════════════════════════════════════════════════════════════════════════════
 _setup_gpu_permissions() {
  local in_ct="$1"
-  local service_user="${2:-}"

  # /dev/dri permissions (Intel/AMD)
  if [[ "$in_ct" == "0" && -d /dev/dri ]]; then
@@ -5169,12 +5136,6 @@ _setup_gpu_permissions() {
    chmod 666 /dev/kfd 2>/dev/null || true
    msg_info "AMD ROCm compute device configured"
  fi
-
-  # Add service user to render and video groups for GPU hardware acceleration
-  if [[ -n "$service_user" ]]; then
-    $STD usermod -aG render "$service_user" 2>/dev/null || true
-    $STD usermod -aG video "$service_user" 2>/dev/null || true
-  fi
 }

 # ------------------------------------------------------------------------------