fix(update-apps): sanitize service detection and fail on invalid names

Reject multi-line or shebang-leaked service names from /usr/bin/update, verify ct/<service>.sh exists before updating, and report ERROR instead of silently marking failed containers as OK.
Update CHANGELOG.md (#15310 )
2026-06-22 23:41:18 +02:00 · 2026-06-22 21:39:13 +02:00 · 2026-06-22 19:14:03 +00:00 · 2026-06-22 19:13:50 +00:00 · 2026-06-22 21:13:32 +02:00 · 2026-06-22 19:13:17 +00:00
95 changed files with 722 additions and 162 deletions
@@ -488,13 +488,33 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 ## 2026-06-22

+### 🆕 New Scripts
+
+  - Postiz ([#15048](https://github.com/community-scripts/ProxmoxVE/pull/15048))
+
 ### 🚀 Updated Scripts

+  - #### 🐞 Bug Fixes
+
+    - add proxy headers to dispatcharr from #15143 [@asylumexp](https://github.com/asylumexp) ([#15293](https://github.com/community-scripts/ProxmoxVE/pull/15293))
+    - Fix-15015: check correct path for certbot [@galz55](https://github.com/galz55) ([#15034](https://github.com/community-scripts/ProxmoxVE/pull/15034))
+    - fix(romm): resolve 403 Forbidden error on nginx mod_zip installation [@hug-efrei](https://github.com/hug-efrei) ([#15134](https://github.com/community-scripts/ProxmoxVE/pull/15134))
+    - Degoog: Fix valkey url in update; set mandatory settings password [@vhsdream](https://github.com/vhsdream) ([#15300](https://github.com/community-scripts/ProxmoxVE/pull/15300))
+    - [arm64] fix update functions to support arm64 [@asylumexp](https://github.com/asylumexp) ([#15290](https://github.com/community-scripts/ProxmoxVE/pull/15290))
+    - Fix typo in victoriametrics [@asylumexp](https://github.com/asylumexp) ([#15289](https://github.com/community-scripts/ProxmoxVE/pull/15289))
+
  - #### ✨ New Features

+    - [arm64] Port scripts between warracker-zwavejsui to support arm64 [@asylumexp](https://github.com/asylumexp) ([#15291](https://github.com/community-scripts/ProxmoxVE/pull/15291))
    - [arm64] Port scripts between thingsboard & wanderer to support arm64 [@asylumexp](https://github.com/asylumexp) ([#15286](https://github.com/community-scripts/ProxmoxVE/pull/15286))
    - [arm64] Port scripts between snowshare & thelounge to support arm64 [@asylumexp](https://github.com/asylumexp) ([#15280](https://github.com/community-scripts/ProxmoxVE/pull/15280))

+### 💾 Core
+
+  - #### ✨ New Features
+
+    - core: add pre-install storage health checks [@MickLesk](https://github.com/MickLesk) ([#15226](https://github.com/community-scripts/ProxmoxVE/pull/15226))
+
 ## 2026-06-21

 ### 🚀 Updated Scripts
@@ -30,7 +30,7 @@ function update_script() {
    exit
  fi

-  RELEASE=$(curl -fsSL "https://www.ispyconnect.com/api/Agent/DownloadLocation4?platform=Linux64&fromVersion=0" | grep -o 'https://.*\.zip')
+  RELEASE=$(curl -fsSL "https://www.ispyconnect.com/api/Agent/DownloadLocation4?platform=$(arch_resolve "Linux64" "LinuxARM64")&fromVersion=0" | grep -o 'https://.*\.zip')
  if [[ "${RELEASE}" != "$(cat ~/.agentdvr 2>/dev/null)" ]] || [[ ! -f ~/.agentdvr ]]; then
    msg_info "Stopping service"
    systemctl stop AgentDVR
@@ -39,10 +39,10 @@ function update_script() {
    msg_info "Updating AgentDVR"
    cd /opt/agentdvr/agent
    curl -fsSL "$RELEASE" -o $(basename "$RELEASE")
-    $STD unzip -o Agent_Linux64*.zip
+    $STD unzip -o Agent_$(arch_resolve "Linux64" "LinuxARM64")*.zip
    chmod +x ./Agent
    echo $RELEASE >~/.agentdvr
-    rm -rf Agent_Linux64*.zip
+    rm -rf Agent_$(arch_resolve "Linux64" "LinuxARM64")*.zip
    msg_ok "Updated AgentDVR"

    msg_info "Starting service"
@@ -31,11 +31,14 @@ function update_script() {
  fi

  RELEASE_JSON=$(curl -fsSL "https://api.bitfocus.io/v1/product/companion/packages?limit=20")
-  PACKAGE_JSON=$(echo "$RELEASE_JSON" | jq -c '(if type == "array" then . else .packages end) | [.[] | select(.target=="linux-tgz" and (.uri | contains("linux-x64")))] | first')
+  PACKAGE_JSON=$(echo "$RELEASE_JSON" | jq -c \
+    --arg target "linux-$(arch_resolve "tgz" "arm64-tgz")" \
+    --arg arch "linux-$(arch_resolve "x64" "arm64")" \
+    '(if type == "array" then . else .packages end) | [.[] | select(.target==$target and (.uri | contains($arch)))] | first')
  RELEASE=$(echo "$PACKAGE_JSON" | jq -r '.version // empty')
  ASSET_URL=$(echo "$PACKAGE_JSON" | jq -r '.uri // empty')
  if [[ -z "$RELEASE" || -z "$ASSET_URL" ]]; then
-    msg_error "Could not resolve a matching Linux x64 Companion package from the Bitfocus API."
+    msg_error "Could not resolve a matching Linux $(arch_resolve "x64" "arm64") Companion package from the Bitfocus API."
    exit 1
  fi

@@ -37,7 +37,7 @@ function update_script() {
      /opt/configarr/secrets.yml \
      /opt/configarr/.env

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "configarr" "raydak-labs/configarr" "prebuild" "latest" "/opt/configarr" "configarr-linux-x64.tar.xz"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "configarr" "raydak-labs/configarr" "prebuild" "latest" "/opt/configarr" "configarr-linux-$(arch_resolve "x64" "arm64").tar.xz"

    restore_backup

@@ -57,9 +57,11 @@ function update_script() {
    restore_backup

    if [[ -f /opt/degoog/.env ]]; then
-      grep -q "^DEGOOG_VALKEY_URL=" /opt/degoog/.env && sed -i "s|^DEGOOG_VALKEY_URL=.*|DEGOOG_VALKEY_URL=redis://valkey:6379|" /opt/degoog/.env || echo "DEGOOG_VALKEY_URL=redis://valkey:6379" >>/opt/degoog/.env
+      grep -q "^DEGOOG_VALKEY_URL=" /opt/degoog/.env && sed -i "s|^DEGOOG_VALKEY_URL=.*|DEGOOG_VALKEY_URL=redis://127.0.0.1:6379|" /opt/degoog/.env || echo "DEGOOG_VALKEY_URL=redis://127.0.0.1:6379" >>/opt/degoog/.env
      grep -q "^DEGOOG_CACHE_MAX_ENTRIES=" /opt/degoog/.env && sed -i "s|^DEGOOG_CACHE_MAX_ENTRIES=.*|DEGOOG_CACHE_MAX_ENTRIES=1000|" /opt/degoog/.env || echo "DEGOOG_CACHE_MAX_ENTRIES=1000" >>/opt/degoog/.env
      grep -q "^DEGOOG_CACHE_TTL_MS=" /opt/degoog/.env && sed -i "s|^DEGOOG_CACHE_TTL_MS=.*|DEGOOG_CACHE_TTL_MS=43200000|" /opt/degoog/.env || echo "DEGOOG_CACHE_TTL_MS=43200000" >>/opt/degoog/.env
+      grep -q "^# DEGOOG_SETTINGS_PASSWORDS" /opt/degoog/.env && sed -i "s|^# DEGOOG_SETTINGS_PASSWORDS=.*|DEGOOG_SETTINGS_PASSWORDS=$(openssl rand -hex 32)|" /opt/degoog/.env &&
+        msg_warn "Mandatory Settings Password created - check /opt/degoog/.env"
    fi
    msg_ok "Restored Configuration & Data"

@@ -32,11 +32,76 @@ function update_script() {

  setup_uv
  NODE_VERSION="24" setup_nodejs
+  if [[ -f "/etc/nginx/sites-available/dispatcharr.conf" ]] && ! grep -q "real_forwarded_proto" "/etc/nginx/sites-available/dispatcharr.conf"; then
+    msg_info "Migrating Nginx Configuration"
+    cat <<EOF >"/etc/nginx/sites-available/dispatcharr.conf"
+map \$http_x_forwarded_proto \$real_forwarded_proto {
+    ""      \$scheme;
+    default \$http_x_forwarded_proto;
+}

-  # Fix for nginx not allowing large files
-  if ! grep -q "client_max_body_size 100M;" /etc/nginx/sites-available/dispatcharr.conf; then
-    sed -i '/server_name _;/a \    client_max_body_size 100M;' /etc/nginx/sites-available/dispatcharr.conf
+map \$http_x_forwarded_port \$real_forwarded_port {
+    ""      \$server_port;
+    default \$http_x_forwarded_port;
+}
+
+server {
+    listen 9191;
+    server_name _;
+    client_max_body_size 100M;
+
+    # Serve static assets with correct MIME types
+    location /assets/ {
+        alias /opt/dispatcharr/frontend/dist/assets/;
+        expires 30d;
+        add_header Cache-Control "public, immutable";
+
+        # Explicitly set MIME types for webpack-built assets
+        types {
+            text/javascript js;
+            text/css css;
+            image/png png;
+            image/svg+xml svg svgz;
+            font/woff2 woff2;
+            font/woff woff;
+            font/ttf ttf;
+        }
+    }
+
+    location /static/ {
+        alias /opt/dispatcharr/static/;
+        expires 30d;
+        add_header Cache-Control "public, immutable";
+    }
+
+    location /media/ {
+        alias /opt/dispatcharr/media/;
+    }
+
+    location /ws/ {
+        proxy_pass http://127.0.0.1:8001;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade \$http_upgrade;
+        proxy_set_header Connection "Upgrade";
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$real_forwarded_proto;
+    }
+
+    # All other requests proxy to uWSGI
+    location / {
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$real_forwarded_proto;
+        proxy_set_header X-Forwarded-Port \$real_forwarded_port;
+        proxy_pass http://127.0.0.1:5656;
+    }
+}
+EOF
    systemctl reload nginx
+    msg_ok "Migrated Nginx Configuration"
  fi

  ensure_dependencies vlc-bin vlc-plugin-base
@@ -34,7 +34,7 @@ function update_script() {
    systemctl stop duplicati
    msg_info "Stopped Service"

-    fetch_and_deploy_gh_release "duplicati" "duplicati/duplicati" "binary" "latest" "/opt/duplicati" "duplicati-*-linux-x64-gui.deb"
+    fetch_and_deploy_gh_release "duplicati" "duplicati/duplicati" "binary" "latest" "/opt/duplicati" "duplicati-*-linux-$(arch_resolve "x64" "arm64")-gui.deb"

    msg_info "Starting Service"
    systemctl start duplicati
@@ -40,7 +40,7 @@ function update_script() {
    msg_ok "Backed Up Data"

    msg_info "Updating Garage"
-    curl -fsSL "https://garagehq.deuxfleurs.fr/_releases/${GITEA_RELEASE}/x86_64-unknown-linux-musl/garage" -o /usr/local/bin/garage
+    curl -fsSL "https://garagehq.deuxfleurs.fr/_releases/${GITEA_RELEASE}/$(arch_resolve "x86_64" "aarch64")-unknown-linux-musl/garage" -o /usr/local/bin/garage
    chmod +x /usr/local/bin/garage
    echo "${GITEA_RELEASE}" >~/.garage
    msg_ok "Updated Garage"
@@ -35,7 +35,7 @@ function update_script() {
    msg_ok "Service stopped"

    rm -rf /usr/local/bin/gitea
-    fetch_and_deploy_gh_release "gitea" "go-gitea/gitea" "singlefile" "latest" "/usr/local/bin" "gitea-*-linux-amd64"
+    fetch_and_deploy_gh_release "gitea" "go-gitea/gitea" "singlefile" "latest" "/usr/local/bin" "gitea-*-linux-$(arch_resolve)"
    chmod +x /usr/local/bin/gitea

    msg_info "Starting service"
@@ -46,7 +46,7 @@ function update_script() {
    done
    msg_ok "Backed up configuration"

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "actions-runner" "actions/runner" "prebuild" "latest" "/opt/actions-runner" "actions-runner-linux-x64-*.tar.gz"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "actions-runner" "actions/runner" "prebuild" "latest" "/opt/actions-runner" "actions-runner-linux-$(arch_resolve "x64" "arm64")-*.tar.gz"

    msg_info "Restoring runner configuration"
    for f in .runner .credentials .credentials_rsaparams .env .path; do
@@ -43,7 +43,7 @@ function update_script() {
    systemctl stop glance
    msg_ok "Stopped Service"

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "glance" "glanceapp/glance" "prebuild" "latest" "/opt/glance" "glance-linux-amd64.tar.gz"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "glance" "glanceapp/glance" "prebuild" "latest" "/opt/glance" "glance-linux-$(arch_resolve).tar.gz"

    msg_info "Starting Service"
    systemctl start glance
@@ -35,7 +35,7 @@ function update_script() {
    systemctl stop go2rtc
    msg_ok "Stopped service"

-    fetch_and_deploy_gh_release "go2rtc" "AlexxIT/go2rtc" "singlefile" "latest" "/opt/go2rtc" "go2rtc_linux_amd64"
+    fetch_and_deploy_gh_release "go2rtc" "AlexxIT/go2rtc" "singlefile" "latest" "/opt/go2rtc" "go2rtc_linux_$(arch_resolve)"

    msg_info "Starting service"
    systemctl start go2rtc
@@ -40,7 +40,7 @@ function update_script() {
    cp -r /opt/gogs/data /opt/gogs_data_backup
    msg_ok "Backed up Data"

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "gogs" "gogs/gogs" "prebuild" "latest" "/opt/gogs" "gogs_*_linux_amd64.tar.gz"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "gogs" "gogs/gogs" "prebuild" "latest" "/opt/gogs" "gogs_*_linux_$(arch_resolve).tar.gz"

    msg_info "Restoring Data"
    cp -r /opt/gogs_custom_backup/. /opt/gogs/custom
@@ -33,7 +33,7 @@ function update_script() {
    systemctl stop gokapi
    msg_ok "Stopped Service"

-    fetch_and_deploy_gh_release "gokapi" "Forceu/Gokapi" "prebuild" "latest" "/opt/gokapi" "*linux*amd64.zip"
+    fetch_and_deploy_gh_release "gokapi" "Forceu/Gokapi" "prebuild" "latest" "/opt/gokapi" "*linux*$(arch_resolve).zip"

    # Migrate from pre-v2.2.4 binary name (gokapi-linux_amd64 -> gokapi)
    if [[ -f /opt/gokapi/gokapi-linux_amd64 ]]; then
@@ -33,8 +33,8 @@ function update_script() {
    systemctl stop gotify
    msg_ok "Stopped Service"

-    fetch_and_deploy_gh_release "gotify" "gotify/server" "prebuild" "latest" "/opt/gotify" "gotify-linux-amd64.zip"
-    chmod +x /opt/gotify/gotify-linux-amd64
+    fetch_and_deploy_gh_release "gotify" "gotify/server" "prebuild" "latest" "/opt/gotify" "gotify-linux-$(arch_resolve).zip"
+    chmod +x /opt/gotify/gotify-linux-$(arch_resolve)

    msg_info "Starting Service"
    systemctl start gotify
@@ -0,0 +1,6 @@
+    ____             __  _    
+   / __ \____  _____/ /_(_)___
+  / /_/ / __ \/ ___/ __/ /_  /
+ / ____/ /_/ (__  ) /_/ / / /_
+/_/    \____/____/\__/_/ /___/
+                              
@@ -36,7 +36,7 @@ function update_script() {
    systemctl stop hev-socks5-server
    msg_ok "Stopped Service"

-    fetch_and_deploy_gh_release "hev-socks5-server" "heiher/hev-socks5-server" "singlefile" "latest" "/opt" "hev-socks5-server-linux-x86_64"
+    fetch_and_deploy_gh_release "hev-socks5-server" "heiher/hev-socks5-server" "singlefile" "latest" "/opt" "hev-socks5-server-linux-$(arch_resolve "x86_64" "arm64")"

    msg_info "Starting Service"
    systemctl start hev-socks5-server
@@ -62,7 +62,7 @@ EOF

    NODE_VERSION=$(curl -s https://raw.githubusercontent.com/homarr-labs/homarr/dev/package.json | jq -r '.engines.node | split(">=")[1] | split(".")[0]')
    setup_nodejs
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "homarr" "homarr-labs/homarr" "prebuild" "latest" "/opt/homarr" "build-debian-amd64.tar.gz"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "homarr" "homarr-labs/homarr" "prebuild" "latest" "/opt/homarr" "build-debian-$(arch_resolve).tar.gz"

    msg_info "Updating Homarr"
    cp /opt/homarr/redis.conf /etc/redis/redis.conf
@@ -71,7 +71,7 @@ function update_script() {
  if [ "$UPD" == "4" ]; then
    msg_info "Installing FileBrowser"
    RELEASE=$(curl -fsSL https://api.github.com/repos/filebrowser/filebrowser/releases/latest | grep -o '"tag_name": ".*"' | sed 's/"//g' | sed 's/tag_name: //g')
-    $STD curl -fsSL https://github.com/filebrowser/filebrowser/releases/download/v2.23.0/linux-amd64-filebrowser.tar.gz | tar -xzv -C /usr/local/bin
+    $STD curl -fsSL https://github.com/filebrowser/filebrowser/releases/download/v2.23.0/linux-$(arch_resolve)-filebrowser.tar.gz | tar -xzv -C /usr/local/bin
    $STD filebrowser config init -a '0.0.0.0'
    $STD filebrowser config set -a '0.0.0.0'
    $STD filebrowser users add admin community-scripts.org --perm.admin
@@ -39,7 +39,7 @@ function update_script() {
    systemctl stop homebox
    msg_ok "Stopped Service"

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "homebox" "sysadminsmedia/homebox" "prebuild" "latest" "/opt/homebox" "homebox_Linux_x86_64.tar.gz"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "homebox" "sysadminsmedia/homebox" "prebuild" "latest" "/opt/homebox" "homebox_Linux_$(arch_resolve "x86_64" "arm64").tar.gz"
    chmod +x /opt/homebox/homebox
    [ -f /opt/.env ] && mv /opt/.env /opt/homebox/.env
    [ -d /opt/.data ] && mv /opt/.data /opt/homebox/.data
@@ -40,7 +40,7 @@ function update_script() {
    cp /opt/hoodik/.env /opt/hoodik.env.bak
    msg_ok "Backed up Configuration"

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "hoodik" "hudikhq/hoodik" "prebuild" "latest" "/opt/hoodik" "*x86_64.tar.gz"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "hoodik" "hudikhq/hoodik" "prebuild" "latest" "/opt/hoodik" "*$(arch_resolve "x86_64" "arm64").tar.gz"

    msg_info "Restoring Configuration"
    cp /opt/hoodik.env.bak /opt/hoodik/.env
@@ -39,7 +39,7 @@ function update_script() {
    cp /opt/igotify/.env /opt/igotify.env.bak
    msg_ok "Backed up Configuration"

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "igotify" "androidseb25/iGotify-Notification-Assistent" "prebuild" "latest" "/opt/igotify" "iGotify-Notification-Service-amd64-v*.zip"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "igotify" "androidseb25/iGotify-Notification-Assistent" "prebuild" "latest" "/opt/igotify" "iGotify-Notification-Service-$(arch_resolve)-v*.zip"

    msg_info "Restoring Configuration"
    cp /opt/igotify.env.bak /opt/igotify/.env
@@ -67,7 +67,7 @@ EOF
  if [[ ! -f /etc/apt/sources.list.d/mise.list ]]; then
    msg_info "Installing Mise"
    curl -fSs https://mise.jdx.dev/gpg-key.pub | tee /etc/apt/keyrings/mise-archive-keyring.pub 1>/dev/null
-    echo "deb [signed-by=/etc/apt/keyrings/mise-archive-keyring.pub arch=amd64] https://mise.jdx.dev/deb stable main" >/etc/apt/sources.list.d/mise.list
+    echo "deb [signed-by=/etc/apt/keyrings/mise-archive-keyring.pub arch=$(arch_resolve)] https://mise.jdx.dev/deb stable main" >/etc/apt/sources.list.d/mise.list
    ensure_dependencies mise
    msg_ok "Installed Mise"
  fi
@@ -127,7 +127,7 @@ EOF
    VCHORD_RELEASE="0.5.3"
    [[ -f ~/.vchord_version ]] && mv ~/.vchord_version ~/.vectorchord
    if check_for_gh_release "VectorChord" "tensorchord/VectorChord" "${VCHORD_RELEASE}" "updated together with Immich after testing"; then
-      fetch_and_deploy_gh_release "VectorChord" "tensorchord/VectorChord" "binary" "${VCHORD_RELEASE}" "/tmp" "postgresql-16-vchord_*_amd64.deb"
+      fetch_and_deploy_gh_release "VectorChord" "tensorchord/VectorChord" "binary" "${VCHORD_RELEASE}" "/tmp" "postgresql-16-vchord_*_$(arch_resolve).deb"
      systemctl restart postgresql
      $STD sudo -u postgres psql -d immich -c "ALTER EXTENSION vector UPDATE;"
      $STD sudo -u postgres psql -d immich -c "ALTER EXTENSION vchord UPDATE;"
@@ -240,7 +240,7 @@ EOF
        $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT -nu immich uv sync --extra openvino --no-dev --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
        [[ $attempt -lt 3 ]] && msg_warn "uv sync attempt $attempt failed, retrying..." && sleep 10
      done
-      patchelf --clear-execstack "${VIRTUAL_ENV}/lib/python3.13/site-packages/onnxruntime/capi/onnxruntime_pybind11_state.cpython-313-x86_64-linux-gnu.so"
+      patchelf --clear-execstack "${VIRTUAL_ENV}/lib/python3.13/site-packages/onnxruntime/capi/onnxruntime_pybind11_state.cpython-313-$(arch_resolve "x86_64" "aarch64")-linux-gnu.so"
      msg_ok "Updated Intel OpenVINO machine-learning"
    else
      ML_PYTHON="python3.11"
@@ -45,7 +45,7 @@ function update_script() {
    cd /tmp/immichframe
    $STD dotnet publish ImmichFrame.WebApi/ImmichFrame.WebApi.csproj \
      --configuration Release \
-      --runtime linux-x64 \
+      --runtime "$(arch_resolve "linux-x64" "linux-arm64")" \
      --self-contained false \
      --output /opt/immichframe

@@ -36,9 +36,9 @@ function update_script() {
    systemctl stop isponsorblocktv
    msg_ok "Stopped Service"

-    ISBTV_BINARY="iSponsorBlockTV-x86_64-linux-v1"
+    ISBTV_BINARY="iSponsorBlockTV-$(arch_resolve "x86_64-linux-v1" "aarch64-linux")"
    if grep -q ' avx ' /proc/cpuinfo 2>/dev/null && grep -q ' avx2 ' /proc/cpuinfo 2>/dev/null && grep -q ' movbe ' /proc/cpuinfo 2>/dev/null; then
-      ISBTV_BINARY="iSponsorBlockTV-x86_64-linux"
+      ISBTV_BINARY="iSponsorBlockTV-$(arch_resolve "x86_64" "aarch64")-linux"
    fi
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "isponsorblocktv" "dmunozv04/iSponsorBlockTV" "singlefile" "latest" "/opt/isponsorblocktv" "${ISBTV_BINARY}"

@@ -41,7 +41,7 @@ EOF
    systemctl stop jackett
    msg_ok "Stopped Service"

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "jackett" "Jackett/Jackett" "prebuild" "latest" "/opt/Jackett" "Jackett.Binaries.LinuxAMDx64.tar.gz"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "jackett" "Jackett/Jackett" "prebuild" "latest" "/opt/Jackett" "Jackett.Binaries.Linux$(arch_resolve "AMDx64" "ARM64").tar.gz"

    msg_info "Starting Service"
    systemctl start jackett
@@ -30,7 +30,7 @@ function update_script() {
    exit
  fi

-  if ! grep -qEi 'ubuntu' /etc/os-release; then
+  if ! grep -qEi 'ubuntu' /etc/os-release && [[ "$(arch_resolve)" == "amd64" ]]; then
    msg_info "Updating Intel Dependencies"
    rm -f ~/.intel-* || true

@@ -57,7 +57,7 @@ function update_script() {
  msg_info "Updating Jellyfin"
  ensure_dependencies libjemalloc2
  if [[ ! -f /usr/lib/libjemalloc.so ]]; then
-    ln -sf /usr/lib/x86_64-linux-gnu/libjemalloc.so.2 /usr/lib/libjemalloc.so
+    ln -sf "/usr/lib/$(arch_resolve "x86_64-linux-gnu" "aarch64-linux-gnu")/libjemalloc.so.2" /usr/lib/libjemalloc.so
  fi
  $STD apt -y upgrade
  $STD apt -y --with-new-pkgs upgrade jellyfin jellyfin-server jellyfin-ffmpeg7
@@ -34,7 +34,7 @@ function update_script() {
    systemctl stop kavita
    msg_ok "Service Stopped"

-    fetch_and_deploy_gh_release "kavita" "Kareadita/Kavita" "prebuild" "latest" "/opt/Kavita" "kavita-linux-x64.tar.gz"
+    fetch_and_deploy_gh_release "kavita" "Kareadita/Kavita" "prebuild" "latest" "/opt/Kavita" "kavita-linux-$(arch_resolve "x64" "arm64").tar.gz"
    chmod +x /opt/Kavita/Kavita && chown root:root /opt/Kavita/Kavita

    msg_info "Starting Service"
@@ -221,7 +221,13 @@ EOF
    msg_ok "Initialized Backend"

    msg_info "Starting Services"
-    CERTBOT_VER=$(/opt/certbot/bin/certbot --version 2>&1 | awk '{print $NF}')
+    if [ -f /opt/certbot/bin/certbot ]; then
+    CERTBOT_VER=$(/opt/certbot/bin/certbot --version 2>&1 | awk '{print $NF}' || echo "0.0.0")
+    elif command -v certbot &>/dev/null; then
+    CERTBOT_VER=$(certbot --version 2>&1 | awk '{print $NF}' || echo "0.0.0")
+    else
+    CERTBOT_VER="2.0.0"
+    fi
    if grep -q "Environment=CERTBOT_VERSION" /lib/systemd/system/npm.service; then
      sed -i "s|Environment=CERTBOT_VERSION=.*|Environment=CERTBOT_VERSION=${CERTBOT_VER}|" /lib/systemd/system/npm.service
    else
@@ -73,7 +73,7 @@ function update_script() {
      msg_ok "Migration complete!"
    fi

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "PatchMon" "PatchMon/PatchMon" "singlefile" "latest" "/opt/patchmon" "patchmon-server-linux-amd64"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "PatchMon" "PatchMon/PatchMon" "singlefile" "latest" "/opt/patchmon" "patchmon-server-linux-$(arch_resolve)"
    mv /opt/patchmon/PatchMon /opt/patchmon/patchmon-server

    msg_info "Fetching PatchMon agent binaries"
@@ -34,7 +34,7 @@ function update_script() {
    systemctl stop wings
    msg_ok "Stopped Service"

-    fetch_and_deploy_gh_release "wings" "pelican-dev/wings" "singlefile" "latest" "/usr/local/bin" "wings_linux_amd64"
+    fetch_and_deploy_gh_release "wings" "pelican-dev/wings" "singlefile" "latest" "/usr/local/bin" "wings_linux_$(arch_resolve)"

    msg_info "Starting Service"
    systemctl start wings
@@ -43,9 +43,9 @@ function update_script() {
      msg_ok "Added environment export"
    fi

-    fetch_and_deploy_gh_release "photoprism" "photoprism/photoprism" "prebuild" "latest" "/opt/photoprism" "*linux-amd64.tar.gz"
+    fetch_and_deploy_gh_release "photoprism" "photoprism/photoprism" "prebuild" "latest" "/opt/photoprism" "*linux-$(arch_resolve).tar.gz"

-    LIBHEIF_URL=$(curl -fsSL "https://dl.photoprism.app/dist/libheif/" | grep -oP "libheif-bookworm-amd64-v[0-9\.]+\.tar\.gz" | sort -V | tail -n 1)
+    LIBHEIF_URL=$(curl -fsSL "https://dl.photoprism.app/dist/libheif/" | grep -oP "libheif-bookworm-$(arch_resolve)-v[0-9\.]+\.tar\.gz" | sort -V | tail -n 1)
    if [[ "${LIBHEIF_URL}" != "$(cat ~/.photoprism_libheif 2>/dev/null)" ]] || [[ ! -f ~/.photoprism_libheif ]]; then
      msg_info "Updating PhotoPrism LibHeif"
      ensure_dependencies libvips42
@@ -71,7 +71,7 @@ function update_script() {
      cp /opt/pocket-id/.env /opt/env
    fi

-    fetch_and_deploy_gh_release "pocket-id" "pocket-id/pocket-id" "singlefile" "latest" "/opt/pocket-id/" "pocket-id-linux-amd64"
+    fetch_and_deploy_gh_release "pocket-id" "pocket-id/pocket-id" "singlefile" "latest" "/opt/pocket-id/" "pocket-id-linux-$(arch_resolve)"
    mv /opt/env /opt/pocket-id/.env

    msg_info "Starting Service"
@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/gitroomhq/postiz-app
+
+APP="Postiz"
+var_tags="${var_tags:-social-media;scheduling;automation}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-8192}"
+var_disk="${var_disk:-20}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/postiz ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "postiz" "gitroomhq/postiz-app"; then
+    msg_info "Stopping Services"
+    systemctl stop postiz-orchestrator postiz-frontend postiz-backend
+    msg_ok "Stopped Services"
+
+    create_backup /opt/postiz/.env \
+                  /opt/postiz/uploads
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "postiz" "gitroomhq/postiz-app" "tarball"
+
+    msg_info "Building Application"
+    cd /opt/postiz
+    cp /opt/postiz_env.bak /opt/postiz/.env
+    set -a && source /opt/postiz/.env && set +a
+    export NODE_OPTIONS="--max-old-space-size=4096"
+    $STD pnpm install
+    $STD pnpm run build
+    unset NODE_OPTIONS
+    msg_ok "Built Application"
+
+    msg_info "Running Database Migrations"
+    cd /opt/postiz
+    $STD pnpm run prisma-db-push
+    msg_ok "Ran Database Migrations"
+
+
+    mkdir -p /opt/postiz/uploads
+    restore_backup
+
+    msg_info "Starting Services"
+    systemctl start postiz-backend postiz-frontend postiz-orchestrator
+    msg_ok "Started Services"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}${CL}"
@@ -33,7 +33,7 @@ function update_script() {
    systemctl stop prometheus-alertmanager
    msg_ok "Stopped Service"

-    fetch_and_deploy_gh_release "alertmanager" "prometheus/alertmanager" "prebuild" "latest" "/usr/local/bin/" "alertmanager*linux-amd64.tar.gz"
+    fetch_and_deploy_gh_release "alertmanager" "prometheus/alertmanager" "prebuild" "latest" "/usr/local/bin/" "alertmanager*linux-$(arch_resolve).tar.gz"

    msg_info "Starting Service"
    systemctl start prometheus-alertmanager
@@ -38,7 +38,7 @@ function update_script() {
    mv /opt/blackbox-exporter/blackbox.yml /opt
    msg_ok "Backup created"

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "blackbox-exporter" "prometheus/blackbox_exporter" "prebuild" "latest" "/opt/blackbox-exporter" "blackbox_exporter-*.linux-amd64.tar.gz"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "blackbox-exporter" "prometheus/blackbox_exporter" "prebuild" "latest" "/opt/blackbox-exporter" "blackbox_exporter-*.linux-$(arch_resolve).tar.gz"

    msg_info "Restoring backup"
    cp -r /opt/blackbox.yml /opt/blackbox-exporter
@@ -33,7 +33,7 @@ function update_script() {
    systemctl stop prometheus
    msg_ok "Stopped Service"

-    fetch_and_deploy_gh_release "prometheus" "prometheus/prometheus" "prebuild" "latest" "/usr/local/bin" "*linux-amd64.tar.gz"
+    fetch_and_deploy_gh_release "prometheus" "prometheus/prometheus" "prebuild" "latest" "/usr/local/bin" "*linux-$(arch_resolve).tar.gz"
    rm -f /usr/local/bin/prometheus.yml

    msg_info "Starting Service"
@@ -34,7 +34,7 @@ function update_script() {
    msg_ok "Stopped Service"

    rm -rf /opt/Prowlarr
-    fetch_and_deploy_gh_release "prowlarr" "Prowlarr/Prowlarr" "prebuild" "latest" "/opt/Prowlarr" "Prowlarr.master*linux-core-x64.tar.gz"
+    fetch_and_deploy_gh_release "prowlarr" "Prowlarr/Prowlarr" "prebuild" "latest" "/opt/Prowlarr" "Prowlarr.master*linux-core-$(arch_resolve "x64" "arm64").tar.gz"
    chmod 775 /opt/Prowlarr

    msg_info "Starting Service"
@@ -35,7 +35,7 @@ function update_script() {
    msg_ok "Stopped Service"

    rm /usr/local/bin/wings
-    fetch_and_deploy_gh_release "wings" "pterodactyl/wings" "singlefile" "latest" "/usr/local/bin" "wings_linux_amd64"
+    fetch_and_deploy_gh_release "wings" "pterodactyl/wings" "singlefile" "latest" "/usr/local/bin" "wings_linux_$(arch_resolve)"

    msg_info "Starting Service"
    systemctl start wings
@@ -39,7 +39,7 @@ function update_script() {
      rm -f /opt/pulse/pulse
    fi

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "pulse" "rcourtman/Pulse" "prebuild" "latest" "/opt/pulse" "pulse-v*-linux-amd64.tar.gz"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "pulse" "rcourtman/Pulse" "prebuild" "latest" "/opt/pulse" "pulse-v*-linux-$(arch_resolve).tar.gz"
    ln -sf /opt/pulse/bin/pulse /usr/local/bin/pulse
    mkdir -p /etc/pulse
    chown pulse:pulse /etc/pulse
@@ -38,7 +38,7 @@ function update_script() {
    msg_ok "Stopped Service"

    rm -f /opt/qbittorrent/qbittorrent-nox
-    fetch_and_deploy_gh_release "qbittorrent" "userdocs/qbittorrent-nox-static" "singlefile" "latest" "/opt/qbittorrent" "x86_64-qbittorrent-nox"
+    fetch_and_deploy_gh_release "qbittorrent" "userdocs/qbittorrent-nox-static" "singlefile" "latest" "/opt/qbittorrent" "$(arch_resolve "x86_64" "aarch64")-qbittorrent-nox"
    mv /opt/qbittorrent/qbittorrent /opt/qbittorrent/qbittorrent-nox

    msg_info "Starting Service"
@@ -59,8 +59,13 @@ function update_script() {
    ROMM_BASE=${ROMM_BASE:-/var/lib/romm}
    ln -sfn "$ROMM_BASE"/resources /opt/romm/frontend/dist/assets/romm/resources
    ln -sfn "$ROMM_BASE"/assets /opt/romm/frontend/dist/assets/romm/assets
-    sed -i "s|alias .*/library/;|alias ${ROMM_BASE}/library/;|" /etc/nginx/sites-available/romm
-    systemctl reload nginx
+    if [[ -f /etc/angie/http.d/romm.conf ]]; then
+      sed -i "s|alias .*/library/;|alias ${ROMM_BASE}/library/;|" /etc/angie/http.d/romm.conf
+      systemctl reload angie
+    elif [[ -f /etc/nginx/sites-available/romm ]]; then
+      sed -i "s|alias .*/library/;|alias ${ROMM_BASE}/library/;|" /etc/nginx/sites-available/romm
+      systemctl reload nginx
+    fi
    msg_ok "Updated ROMM"

    msg_info "Starting Services"
@@ -35,7 +35,7 @@ function update_script() {
    systemctl stop sonarr
    msg_ok "Stopped Service"

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Sonarr" "Sonarr/Sonarr" "prebuild" "latest" "/opt/Sonarr" "Sonarr.main.*.linux-x64.tar.gz"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Sonarr" "Sonarr/Sonarr" "prebuild" "latest" "/opt/Sonarr" "Sonarr.main.*.linux-$(arch_resolve "x64" "arm64").tar.gz"

    msg_info "Starting Service"
    systemctl start sonarr
@@ -34,7 +34,7 @@ function update_script() {
    systemctl stop sportarr
    msg_ok "Stopped Services"

-    fetch_and_deploy_gh_release "sportarr" "Sportarr/Sportarr" "prebuild" "latest" "/opt/sportarr" "Sportarr-linux-x64-*.tar.gz"
+    fetch_and_deploy_gh_release "sportarr" "Sportarr/Sportarr" "prebuild" "latest" "/opt/sportarr" "Sportarr-linux-$(arch_resolve "x64" "arm64")-*.tar.gz"

    msg_info "Starting Services"
    systemctl start sportarr
@@ -57,7 +57,7 @@ function update_script() {
  msg_ok "Updated step-ca and step-cli"

  if check_for_gh_release "step-badger" "lukasz-lobocki/step-badger"; then
-    fetch_and_deploy_gh_release "step-badger" "lukasz-lobocki/step-badger" "prebuild" "latest" "/opt/step-badger" "step-badger_Linux_x86_64.tar.gz"
+    fetch_and_deploy_gh_release "step-badger" "lukasz-lobocki/step-badger" "prebuild" "latest" "/opt/step-badger" "step-badger_Linux_$(arch_resolve "x86_64" "arm64").tar.gz"
    msg_ok "Updated step-badger"
  fi
  exit
@@ -35,7 +35,7 @@ function update_script() {
    systemctl stop stylus
    msg_info "Stopped Service"

-    fetch_and_deploy_gh_release "stylus" "mmastrac/stylus" "singlefile" "latest" "/usr/bin/" "*_linux_amd64"
+    fetch_and_deploy_gh_release "stylus" "mmastrac/stylus" "singlefile" "latest" "/usr/bin/" "*_linux_$(arch_resolve)"

    msg_info "Starting Service"
    systemctl start stylus
@@ -34,7 +34,7 @@ function update_script() {
  $STD apt upgrade -y
  rm -rf /opt/tdarr/Tdarr_Updater
  cd /opt/tdarr
-  RELEASE=$(curl_with_retry "https://f000.backblazeb2.com/file/tdarrs/versions.json" "-" | grep -oP '(?<="Tdarr_Updater": ")[^"]+' | grep linux_x64 | head -n 1)
+  RELEASE=$(curl_with_retry "https://f000.backblazeb2.com/file/tdarrs/versions.json" "-" | grep -oP '(?<="Tdarr_Updater": ")[^"]+' | grep "linux_$(arch_resolve "x64" "arm64")" | head -n 1)
  curl_with_retry "$RELEASE" "Tdarr_Updater.zip"
  $STD unzip Tdarr_Updater.zip
  chmod +x Tdarr_Updater
@@ -35,7 +35,7 @@ function update_script() {
    systemctl stop threadfin
    msg_ok "Stopped Service"

-    fetch_and_deploy_gh_release "threadfin-app" "threadfin/threadfin" "singlefile" "latest" "/opt/threadfin" "Threadfin_linux_amd64"
+    fetch_and_deploy_gh_release "threadfin-app" "threadfin/threadfin" "singlefile" "latest" "/opt/threadfin" "Threadfin_linux_$(arch_resolve)"
    mv /opt/threadfin/threadfin-app /opt/threadfin/threadfin

    msg_info "Starting Service"
@@ -34,7 +34,7 @@ function update_script() {
    systemctl stop tinyauth
    msg_ok "Stopped Service"

-    fetch_and_deploy_gh_release "tinyauth" "tinyauthapp/tinyauth" "singlefile" "latest" "/opt/tinyauth" "tinyauth-amd64"
+    fetch_and_deploy_gh_release "tinyauth" "tinyauthapp/tinyauth" "singlefile" "latest" "/opt/tinyauth" "tinyauth-$(arch_resolve)"

    msg_info "Starting Service"
    systemctl start tinyauth
@@ -40,7 +40,7 @@ function update_script() {
    [[ -d /opt/traccar/media ]] && mv /opt/traccar/media /opt
    msg_ok "Backup created"

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "traccar" "traccar/traccar" "prebuild" "latest" "/opt/traccar" "traccar-linux-64*.zip"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "traccar" "traccar/traccar" "prebuild" "latest" "/opt/traccar" "traccar-linux-$(arch_resolve "64*" "arm-*").zip"

    msg_info "Perform Update"
    cd /opt/traccar
@@ -34,7 +34,7 @@ function update_script() {
    systemctl stop traefik
    msg_ok "Stopped Service"

-    fetch_and_deploy_gh_release "traefik" "traefik/traefik" "prebuild" "latest" "/usr/bin" "traefik_v*_linux_amd64.tar.gz"
+    fetch_and_deploy_gh_release "traefik" "traefik/traefik" "prebuild" "latest" "/usr/bin" "traefik_v*_linux_$(arch_resolve).tar.gz"

    msg_info "Starting Service"
    systemctl start traefik
@@ -30,10 +30,10 @@ function update_script() {
    exit
  fi

-  fetch_and_deploy_gh_release "calibre" "kovidgoyal/calibre" "prebuild" "latest" "/opt/calibre" "calibre-*-x86_64.txz"
+  fetch_and_deploy_gh_release "calibre" "kovidgoyal/calibre" "prebuild" "latest" "/opt/calibre" "calibre-*-$(arch_resolve "x86_64" "arm64").txz"
  ln -sf /opt/calibre/ebook-convert /usr/bin/ebook-convert
-  fetch_and_deploy_gh_release "drawio" "jgraph/drawio-desktop" "binary" "latest" "" "drawio-amd64-*.deb"
-  fetch_and_deploy_gh_release "pandoc" "jgm/pandoc" "binary" "latest" "" "pandoc-*-amd64.deb"
+  fetch_and_deploy_gh_release "drawio" "jgraph/drawio-desktop" "binary" "latest" "" "drawio-$(arch_resolve)-*.deb"
+  fetch_and_deploy_gh_release "pandoc" "jgm/pandoc" "binary" "latest" "" "pandoc-*-$(arch_resolve).deb"

  if check_for_gh_release "transmute" "transmute-app/transmute"; then
    msg_info "Stopping Service"
@@ -51,7 +51,7 @@ function update_script() {
    rm -rf /opt/trilium
    msg_ok "Backed up Database"

-    fetch_and_deploy_gh_release "Trilium" "TriliumNext/Trilium" "prebuild" "latest" "/opt/trilium" "TriliumNotes-Server-*linux-x64.tar.xz"
+    fetch_and_deploy_gh_release "Trilium" "TriliumNext/Trilium" "prebuild" "latest" "/opt/trilium" "TriliumNotes-Server-*linux-$(arch_resolve "x64" "arm64").tar.xz"

    msg_info "Restoring Database"
    mkdir -p "$(dirname "${DB_RESTORE_PATH}")"
@@ -41,7 +41,7 @@ function update_script() {
      msg_error "Backup failed: /root/.local/share/tunarr does not exist"
    fi

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "tunarr" "chrisbenincasa/tunarr" "prebuild" "latest" "/opt/tunarr" "*linux-x64.tar.gz"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "tunarr" "chrisbenincasa/tunarr" "prebuild" "latest" "/opt/tunarr" "*linux-$(arch_resolve "x64" "arm64").tar.gz"
    cd /opt/tunarr
    mv tunarr* tunarr

@@ -56,7 +56,7 @@ function update_script() {
    systemctl stop tunarr
    msg_ok "Stopped Service"

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "ersatztv-ffmpeg" "ErsatzTV/ErsatzTV-ffmpeg" "prebuild" "latest" "/opt/ErsatzTV-ffmpeg" "*-linux64-gpl-7.1.tar.xz"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "ersatztv-ffmpeg" "ErsatzTV/ErsatzTV-ffmpeg" "prebuild" "latest" "/opt/ErsatzTV-ffmpeg" "*-linux$(arch_resolve "64" "arm64")-gpl-7.1.tar.xz"

    msg_info "Set ErsatzTV-ffmpeg links"
    chmod +x /opt/ErsatzTV-ffmpeg/bin/*
@@ -44,8 +44,8 @@ function update_script() {
      apt remove ffmpeg -y && apt autoremove -y
    fi
    setup_ffmpeg
-    fetch_and_deploy_gh_release "comskip" "swapplications/comskip" "prebuild" "latest" "/opt/comskip" "comskip-x64-*.zip"
-    fetch_and_deploy_gh_release "uhf-server" "swapplications/uhf-server-dist" "prebuild" "latest" "/opt/uhf-server" "UHF.Server-linux-x64-*.zip"
+    fetch_and_deploy_gh_release "comskip" "swapplications/comskip" "prebuild" "latest" "/opt/comskip" "comskip-$(arch_resolve "x64" "arm64")-*.zip"
+    fetch_and_deploy_gh_release "uhf-server" "swapplications/uhf-server-dist" "prebuild" "latest" "/opt/uhf-server" "UHF.Server-linux-$(arch_resolve "x64" "arm64")-*.zip"
    msg_ok "Updated UHF Server"

    msg_info "Starting Service"
@@ -34,7 +34,7 @@ function update_script() {
        systemctl stop upgopher
        msg_ok "Stopped Service"

-        fetch_and_deploy_gh_release "upgopher" "wanetty/upgopher" "prebuild" "latest" "/opt/upgopher" "upgopher_*_linux_amd64.tar.gz"
+        fetch_and_deploy_gh_release "upgopher" "wanetty/upgopher" "prebuild" "latest" "/opt/upgopher" "upgopher_*_linux_$(arch_resolve).tar.gz"
        chmod +x /opt/upgopher/upgopher

        msg_info "Starting Service"
@@ -34,7 +34,7 @@ function update_script() {
        systemctl stop upsnap
        msg_ok "Stopped Services"

-        fetch_and_deploy_gh_release "upsnap" "seriousm4x/UpSnap" "prebuild" "latest" "/opt/upsnap" "UpSnap_*_linux_amd64.zip"
+        fetch_and_deploy_gh_release "upsnap" "seriousm4x/UpSnap" "prebuild" "latest" "/opt/upsnap" "UpSnap_*_linux_$(arch_resolve).zip"

        msg_info "Starting Services"
        systemctl start upsnap
@@ -38,13 +38,13 @@ function update_script() {
    msg_ok "Stopped Service"

    victoriametrics_release=$(curl -fsSL "https://api.github.com/repos/VictoriaMetrics/VictoriaMetrics/releases" |
-      jq -r '.[] | select(.assets[].name | match("^victoria-metrics-linux-amd64-v[0-9.]+.tar.gz$")) | .tag_name' |
+      jq -r --arg a "$(arch_resolve)" '.[] | select(.assets[].name | match("^victoria-metrics-linux-" + $a + "-v[0-9.]+.tar.gz$")) | .tag_name' |
      head -n 1)

    msg_debug "Using release $victoriametrics_release"

-    victoriametrics_filename="victoria-metrics-linux-amd64-${victoriametrics_release}.tar.gz"
-    vmutils_filename="vmutils-linux-amd64-${victoriametrics_release}.tar.gz"
+    victoriametrics_filename="victoria-metrics-linux-$(arch_resolve)-${victoriametrics_release}.tar.gz"
+    vmutils_filename="vmutils-linux-$(arch_resolve)-${victoriametrics_release}.tar.gz"

    fetch_and_deploy_gh_release "victoriametrics" "VictoriaMetrics/VictoriaMetrics" "prebuild" "$victoriametrics_release" "/opt/victoriametrics" "$victoriametrics_filename"
    fetch_and_deploy_gh_release "vmutils" "VictoriaMetrics/VictoriaMetrics" "prebuild" "$victoriametrics_release" "/opt/victoriametrics" "$vmutils_filename"
@@ -52,10 +52,10 @@ function update_script() {
    if [[ -f /etc/systemd/system/victoriametrics-logs.service ]]; then
      vmlogs_filename=$(curl -fsSL "https://api.github.com/repos/VictoriaMetrics/VictoriaLogs/releases/latest" |
        jq -r '.assets[].name' |
-        grep -E '^victoria-logs-linux-amd64-v[0-9.]+\.tar\.gz$')
+        grep -E "^victoria-logs-linux-$(arch_resolve)-v[0-9.]+\.tar\.gz$")
      vlutils_filename=$(curl -fsSL "https://api.github.com/repos/VictoriaMetrics/VictoriaLogs/releases/latest" |
        jq -r '.assets[].name' |
-        grep -E '^vlutils-linux-amd64-v[0-9.]+\.tar\.gz$')
+        grep -E "^vlutils-linux-$(arch_resolve)-v[0-9.]+\.tar\.gz$")

      fetch_and_deploy_gh_release "victorialogs" "VictoriaMetrics/VictoriaLogs" "prebuild" "latest" "/opt/victoriametrics" "$vmlogs_filename"
      fetch_and_deploy_gh_release "vlutils" "VictoriaMetrics/VictoriaLogs" "prebuild" "latest" "/opt/victoriametrics" "$vlutils_filename"
@@ -12,7 +12,7 @@ var_ram="${var_ram:-1024}"
 var_disk="${var_disk:-4}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-no}"
+var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

 header_info "$APP"
@@ -66,7 +66,7 @@ EOF

    msg_info "Updating Wastebin"
    temp_file=$(mktemp)
-    curl -fsSL "https://github.com/matze/wastebin/releases/download/${RELEASE}/wastebin_${RELEASE}_x86_64-unknown-linux-musl.tar.zst" -o "$temp_file"
+    curl -fsSL "https://github.com/matze/wastebin/releases/download/${RELEASE}/wastebin_${RELEASE}_$(arch_resolve "x86_64" "aarch64")-unknown-linux-musl.tar.zst" -o "$temp_file"
    tar -xf "$temp_file"
    cp -f wastebin* /opt/wastebin/
    chmod +x /opt/wastebin/wastebin
@@ -12,7 +12,7 @@ var_ram="${var_ram:-4096}"
 var_disk="${var_disk:-25}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-no}"
+var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

 header_info "$APP"
@@ -12,7 +12,7 @@ var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-12}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-no}"
+var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

 header_info "$APP"
@@ -12,7 +12,7 @@ var_ram="${var_ram:-1024}"
 var_disk="${var_disk:-4}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-no}"
+var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

 header_info "$APP"
@@ -12,7 +12,7 @@ var_ram="${var_ram:-512}"
 var_disk="${var_disk:-2}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-no}"
+var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

 header_info "$APP"
@@ -35,7 +35,7 @@ function update_script() {
    systemctl stop whodb
    msg_ok "Stopped Service"

-    fetch_and_deploy_gh_release "whodb" "clidey/whodb" "singlefile" "latest" "/opt/whodb" "whodb-*-linux-amd64"
+    fetch_and_deploy_gh_release "whodb" "clidey/whodb" "singlefile" "latest" "/opt/whodb" "whodb-*-linux-$(arch_resolve)"

    msg_info "Starting Service"
    systemctl start whodb
@@ -12,7 +12,7 @@ var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-5}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-no}"
+var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

 header_info "$APP"
@@ -12,7 +12,7 @@ var_ram="${var_ram:-1024}"
 var_disk="${var_disk:-4}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-no}"
+var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

 header_info "$APP"
@@ -41,7 +41,7 @@ function update_script() {
    cp /opt/writefreely/config.ini /tmp/writefreely_backup/ 2>/dev/null
    msg_ok "Created Backup"

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "writefreely" "writefreely/writefreely" "prebuild" "latest" "/opt/writefreely" "writefreely_*_linux_amd64.tar.gz"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "writefreely" "writefreely/writefreely" "prebuild" "latest" "/opt/writefreely" "writefreely_*_linux_$(arch_resolve).tar.gz"

    msg_info "Restoring Data"
    cp /tmp/writefreely_backup/config.ini /opt/writefreely/ 2>/dev/null
@@ -12,7 +12,7 @@ var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-8}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-no}"
+var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

 header_info "$APP"
@@ -13,7 +13,7 @@ var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-8}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-no}"
+var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

 header_info "$APP"
@@ -12,7 +12,7 @@ var_ram="${var_ram:-512}"
 var_disk="${var_disk:-4}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-no}"
+var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

 header_info "$APP"
@@ -12,7 +12,7 @@ var_ram="${var_ram:-1024}"
 var_disk="${var_disk:-4}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-no}"
+var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

 header_info "$APP"
@@ -39,7 +39,7 @@ function update_script() {
    msg_ok "Updated yt-dlp"

    rm -rf /usr/local/bin/yt-dlp-webui
-    fetch_and_deploy_gh_release "yt-dlp-webui" "marcopiovanello/yt-dlp-web-ui" "singlefile" "latest" "/usr/local/bin" "yt-dlp-webui_linux-amd64"
+    fetch_and_deploy_gh_release "yt-dlp-webui" "marcopiovanello/yt-dlp-web-ui" "singlefile" "latest" "/usr/local/bin" "yt-dlp-webui_linux-$(arch_resolve)"

    msg_info "Starting Service"
    systemctl start yt-dlp-webui
@@ -12,7 +12,7 @@ var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-15}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-no}"
+var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

 header_info "$APP"
@@ -12,7 +12,7 @@ var_ram="${var_ram:-6144}"
 var_disk="${var_disk:-10}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-no}"
+var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

 header_info "$APP"
@@ -8,11 +8,11 @@ source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxV
 APP="Zerotier-One"
 var_tags="${var_tags:-networking}"
 var_cpu="${var_cpu:-1}"
-var_ram="${var_ram:-512}"
+var_ram="${var_ram:-1024}"
 var_disk="${var_disk:-4}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-no}"
+var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

 header_info "$APP"
@@ -12,7 +12,7 @@ var_ram="${var_ram:-1024}"
 var_disk="${var_disk:-8}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-no}"
+var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

 header_info "$APP"
@@ -35,7 +35,7 @@ function update_script() {
    msg_ok "Stopped Service"

    rm -f /usr/local/bin/zitadel
-    fetch_and_deploy_gh_release "zitadel" "zitadel/zitadel" "prebuild" "latest" "/usr/local/bin" "zitadel-linux-amd64.tar.gz"
+    fetch_and_deploy_gh_release "zitadel" "zitadel/zitadel" "prebuild" "latest" "/usr/local/bin" "zitadel-linux-$(arch_resolve).tar.gz"

    msg_info "Updating Zitadel"
    $STD zitadel setup --masterkeyFile /opt/zitadel/.masterkey --config /opt/zitadel/config.yaml --init-projections=true
@@ -12,7 +12,7 @@ var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-6}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-no}"
+var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

 header_info "$APP"
@@ -34,7 +34,7 @@ function update_script() {
    msg_ok "Service stopped"

    rm -rf /opt/zoraxy/zoraxy
-    fetch_and_deploy_gh_release "zoraxy" "tobychui/zoraxy" "singlefile" "latest" "/opt/zoraxy" "zoraxy_linux_amd64"
+    fetch_and_deploy_gh_release "zoraxy" "tobychui/zoraxy" "singlefile" "latest" "/opt/zoraxy" "zoraxy_linux_$(arch_resolve)"

    msg_info "Starting service"
    systemctl start zoraxy
@@ -12,7 +12,7 @@ var_ram="${var_ram:-4096}"
 var_disk="${var_disk:-5}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-no}"
+var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

 header_info "$APP"
@@ -35,7 +35,7 @@ function update_script() {
    msg_ok "Stopped Zot service"

    rm -f /usr/bin/zot
-    fetch_and_deploy_gh_release "zot" "project-zot/zot" "singlefile" "latest" "/usr/bin" "zot-linux-amd64"
+    fetch_and_deploy_gh_release "zot" "project-zot/zot" "singlefile" "latest" "/usr/bin" "zot-linux-$(arch_resolve)"

    msg_info "Configuring Zot Registry"
    chown root:root /usr/bin/zot
@@ -12,7 +12,7 @@ var_ram="${var_ram:-1024}"
 var_disk="${var_disk:-4}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
-var_arm64="${var_arm64:-no}"
+var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-0}"

 header_info "$APP"
@@ -35,7 +35,7 @@ function update_script() {
    msg_ok "Stopped Service"

    rm -rf /opt/zwave-js-ui/*
-    fetch_and_deploy_gh_release "zwave-js-ui" "zwave-js/zwave-js-ui" "prebuild" "latest" "/opt/zwave-js-ui" "zwave-js-ui*-linux.zip"
+    fetch_and_deploy_gh_release "zwave-js-ui" "zwave-js/zwave-js-ui" "prebuild" "latest" "/opt/zwave-js-ui" "zwave-js-ui*-$(arch_resolve "linux" "linux-arm64").zip"

    msg_info "Starting Service"
    systemctl start zwave-js-ui
@@ -33,6 +33,7 @@ fetch_and_deploy_gh_release "degoog" "fccview/degoog" "prebuild" "latest" "/opt/
 msg_info "Setting up degoog"
 mkdir -p /opt/degoog/data/{engines,plugins,themes,store}

+SETTINGS_PASS="$(openssl rand -hex 32)"
 cat <<EOF >/opt/degoog/.env
 DEGOOG_PORT=4444
 DEGOOG_ENGINES_DIR=/opt/degoog/data/engines
@@ -43,7 +44,7 @@ DEGOOG_PLUGIN_SETTINGS_FILE=/opt/degoog/data/plugin-settings.json
 DEGOOG_VALKEY_URL=redis://127.0.0.1:6379
 DEGOOG_CACHE_MAX_ENTRIES=1000
 DEGOOG_CACHE_TTL_MS=43200000
-# DEGOOG_SETTINGS_PASSWORDS=changeme
+DEGOOG_SETTINGS_PASSWORDS=${SETTINGS_PASS}
 # DEGOOG_PUBLIC_INSTANCE=false
 # LOGGER=debug
 EOF
@@ -74,6 +74,16 @@ msg_ok "Configured Dispatcharr"

 msg_info "Configuring Nginx"
 cat <<EOF >/etc/nginx/sites-available/dispatcharr.conf
+map \$http_x_forwarded_proto \$real_forwarded_proto {
+    ""      \$scheme;
+    default \$http_x_forwarded_proto;
+}
+
+map \$http_x_forwarded_port \$real_forwarded_port {
+    ""      \$server_port;
+    default \$http_x_forwarded_port;
+}
+
 server {
    listen 9191;
    server_name _;
@@ -115,13 +125,16 @@ server {
        proxy_set_header Host \$host;
        proxy_set_header X-Real-IP \$remote_addr;
        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto \$scheme;
+        proxy_set_header X-Forwarded-Proto \$real_forwarded_proto;
    }

    # All other requests proxy to uWSGI
    location / {
-        include proxy_params;
-        proxy_set_header X-Forwarded-Port \$server_port;
+        proxy_set_header Host \$host;
+        proxy_set_header X-Real-IP \$remote_addr;
+        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto \$real_forwarded_proto;
+        proxy_set_header X-Forwarded-Port \$real_forwarded_port;
        proxy_pass http://127.0.0.1:5656;
    }
 }
@@ -0,0 +1,248 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/gitroomhq/postiz-app
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  build-essential \
+  redis-server \
+  nginx
+msg_ok "Installed Dependencies"
+
+PG_VERSION="17" setup_postgresql
+PG_DB_NAME="postiz" PG_DB_USER="postiz" setup_postgresql_db
+NODE_VERSION="24" setup_nodejs
+
+fetch_and_deploy_gh_release "temporal" "temporalio/cli" "prebuild" "latest" "/opt/temporal" "temporal_cli_*_linux_amd64.tar.gz"
+chmod +x /opt/temporal/temporal
+fetch_and_deploy_gh_release "postiz" "gitroomhq/postiz-app" "tarball"
+
+msg_info "Installing pnpm"
+PNPM_VERSION=$(sed -n 's/.*"packageManager":\s*"pnpm@\([^"]*\)".*/\1/p' /opt/postiz/package.json)
+$STD npm install -g "pnpm@${PNPM_VERSION}"
+msg_ok "Installed pnpm"
+
+msg_info "Configuring Application"
+JWT_SECRET=$(openssl rand -base64 32)
+mkdir -p /opt/postiz/uploads
+cat <<EOF >/opt/postiz/.env
+DATABASE_URL=postgresql://${PG_DB_USER}:${PG_DB_PASS}@localhost:5432/${PG_DB_NAME}
+REDIS_URL=redis://localhost:6379
+JWT_SECRET=${JWT_SECRET}
+MAIN_URL=http://${LOCAL_IP}
+FRONTEND_URL=http://${LOCAL_IP}
+NEXT_PUBLIC_BACKEND_URL=http://${LOCAL_IP}/api
+BACKEND_INTERNAL_URL=http://localhost:3000
+NOT_SECURED=true
+TEMPORAL_ADDRESS=localhost:7233
+IS_GENERAL=true
+STORAGE_PROVIDER=local
+UPLOAD_DIRECTORY=/opt/postiz/uploads
+NEXT_PUBLIC_UPLOAD_DIRECTORY=/uploads
+NX_ADD_PLUGINS=false
+EOF
+msg_ok "Configured Application"
+
+msg_info "Building Application"
+cd /opt/postiz
+set -a && source /opt/postiz/.env && set +a
+export NODE_OPTIONS="--max-old-space-size=4096"
+$STD pnpm install
+$STD pnpm run build
+unset NODE_OPTIONS
+msg_ok "Built Application"
+
+msg_info "Running Database Migrations"
+cd /opt/postiz
+set -a && source /opt/postiz/.env && set +a
+$STD pnpm run prisma-db-push
+msg_ok "Ran Database Migrations"
+
+msg_info "Creating Services"
+PNPM_BIN="$(command -v pnpm)"
+cat <<EOF >/etc/systemd/system/postiz-temporal.service
+[Unit]
+Description=Temporal Dev Server (Postiz)
+After=network.target
+
+[Service]
+Type=simple
+User=root
+ExecStart=/opt/temporal/temporal server start-dev --db-filename /opt/temporal/temporal.db --log-format json --log-level warn
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+cat <<EOF >/etc/systemd/system/postiz-backend.service
+[Unit]
+Description=Postiz Backend
+After=network.target postgresql.service redis-server.service postiz-temporal.service
+Requires=postgresql.service redis-server.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/postiz
+EnvironmentFile=/opt/postiz/.env
+ExecStart=${PNPM_BIN} run start:prod:backend
+Environment=NODE_OPTIONS=--max-old-space-size=512
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+cat <<EOF >/etc/systemd/system/postiz-frontend.service
+[Unit]
+Description=Postiz Frontend
+After=network.target postiz-backend.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/postiz
+EnvironmentFile=/opt/postiz/.env
+Environment=PORT=4200
+ExecStart=${PNPM_BIN} run start:prod:frontend
+Environment=NODE_OPTIONS=--max-old-space-size=512
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+cat <<EOF >/etc/systemd/system/postiz-orchestrator.service
+[Unit]
+Description=Postiz Orchestrator
+After=network.target postiz-temporal.service postiz-backend.service
+Requires=postiz-temporal.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/postiz
+EnvironmentFile=/opt/postiz/.env
+ExecStart=${PNPM_BIN} run start:prod:orchestrator
+Environment=NODE_OPTIONS=--max-old-space-size=384
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+systemctl enable -q --now redis-server postiz-temporal postiz-backend postiz-frontend postiz-orchestrator
+msg_ok "Created Services"
+
+msg_info "Creating Helper Scripts"
+cat <<'EOF' >/usr/local/bin/postiz-rebuild
+#!/usr/bin/env bash
+echo "=== Postiz Rebuild ==="
+echo "Stopping services..."
+systemctl stop postiz-orchestrator postiz-frontend postiz-backend
+
+cd /opt/postiz
+set -a && source /opt/postiz/.env && set +a
+export NODE_OPTIONS="--max-old-space-size=4096"
+
+echo "Building application (this may take a while)..."
+pnpm run build
+BUILD_RC=$?
+unset NODE_OPTIONS
+
+if [[ $BUILD_RC -ne 0 ]]; then
+  echo "ERROR: Build failed! Check the output above."
+  echo "Starting services with previous build..."
+  systemctl start postiz-backend postiz-frontend postiz-orchestrator
+  exit 1
+fi
+
+echo "Running database migrations..."
+pnpm run prisma-db-push
+
+echo "Starting services..."
+systemctl start postiz-backend postiz-frontend postiz-orchestrator
+echo "=== Rebuild complete ==="
+EOF
+chmod +x /usr/local/bin/postiz-rebuild
+msg_ok "Created Helper Scripts"
+
+msg_info "Configuring Nginx"
+cat <<EOF >/etc/nginx/sites-available/postiz
+server {
+  listen 80 default_server;
+  server_name _;
+
+  client_max_body_size 100M;
+
+  gzip on;
+  gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
+
+  location /api/ {
+    proxy_pass http://127.0.0.1:3000/;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade \$http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_set_header Host \$host;
+    proxy_set_header X-Real-IP \$remote_addr;
+    proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto \$scheme;
+    proxy_set_header Reload \$http_reload;
+    proxy_set_header Onboarding \$http_onboarding;
+    proxy_set_header Activate \$http_activate;
+    proxy_set_header Auth \$http_auth;
+    proxy_set_header Showorg \$http_showorg;
+    proxy_set_header Impersonate \$http_impersonate;
+    proxy_set_header Accept-Language \$http_accept_language;
+  }
+
+  location /uploads/ {
+    alias /opt/postiz/uploads/;
+  }
+
+  location / {
+    proxy_pass http://127.0.0.1:4200/;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade \$http_upgrade;
+    proxy_set_header Connection "upgrade";
+    proxy_set_header Host \$host;
+    proxy_set_header X-Real-IP \$remote_addr;
+    proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto \$scheme;
+    proxy_set_header Reload \$http_reload;
+    proxy_set_header Onboarding \$http_onboarding;
+    proxy_set_header Activate \$http_activate;
+    proxy_set_header Auth \$http_auth;
+    proxy_set_header Showorg \$http_showorg;
+    proxy_set_header Impersonate \$http_impersonate;
+    proxy_set_header Accept-Language \$http_accept_language;
+    proxy_set_header i18next \$http_i18next;
+  }
+}
+EOF
+ln -sf /etc/nginx/sites-available/postiz /etc/nginx/sites-enabled/postiz
+rm -f /etc/nginx/sites-enabled/default
+$STD nginx -t
+systemctl enable -q nginx
+systemctl reload -q nginx
+msg_ok "Configured Nginx"
+
+motd_ssh
+customize
+cleanup_lxc
@@ -37,20 +37,19 @@ $STD apt install -y \
  redis-server \
  redis-tools \
  p7zip-full \
-  tzdata \
-  nginx
+  tzdata
 msg_ok "Installed Dependencies"

-msg_info "Installing Nginx mod_zip module"
+msg_info "Installing Angie with mod_zip module"
 setup_deb822_repo \
-  "getpagespeed-extras" \
-  "https://extras.getpagespeed.com/deb-archive-keyring.gpg" \
-  "https://extras.getpagespeed.com/debian" \
+  "angie" \
+  "https://angie.software/keys/angie-signing.gpg" \
+  "https://download.angie.software/angie/debian/$(get_os_info version_id)" \
  "$(get_os_info codename)" \
  "main"
-$STD apt-get install -y nginx nginx-module-zip
-msg_ok "Installed Nginx mod_zip module"
-
+$STD apt-get install -y angie angie-module-zip
+sed -i '1i load_module modules/ngx_http_zip_module.so;' /etc/angie/angie.conf
+msg_ok "Installed Angie with mod_zip module"
 PYTHON_VERSION="3.13" setup_uv
 NODE_VERSION="24" setup_nodejs
 setup_mariadb
@@ -196,8 +195,8 @@ ln -sfn "$ROMM_BASE"/resources /opt/romm/frontend/dist/assets/romm/resources
 ln -sfn "$ROMM_BASE"/assets /opt/romm/frontend/dist/assets/romm/assets
 msg_ok "Set up RomM Frontend"

-msg_info "Configuring Nginx"
-cat <<'EOF' >/etc/nginx/sites-available/romm
+msg_info "Configuring Angie"
+cat <<'EOF' >/etc/angie/http.d/romm.conf
 upstream romm_backend {
    server 127.0.0.1:5000;
 }
@@ -267,13 +266,11 @@ server {
 }
 EOF

-sed -i "s|alias /var/lib/romm/library/;|alias ${ROMM_BASE}/library/;|" /etc/nginx/sites-available/romm
-rm -f /etc/nginx/sites-enabled/default
-rm -f /etc/nginx/conf.d/default.conf
-ln -sf /etc/nginx/sites-available/romm /etc/nginx/sites-enabled/romm
-systemctl restart nginx
-systemctl enable -q --now nginx
-msg_ok "Configured Nginx"
+sed -i "s|alias /var/lib/romm/library/;|alias ${ROMM_BASE}/library/;|" /etc/angie/http.d/romm.conf
+rm -f /etc/angie/http.d/default.conf
+systemctl restart angie
+systemctl enable -q --now angie
+msg_ok "Configured Angie"

 msg_info "Creating Services"
 cat <<EOF >/etc/systemd/system/romm-backend.service
@@ -18,8 +18,8 @@ msg_info "Getting latest version of VictoriaMetrics"
 victoriametrics_release=$(curl -fsSL "https://api.github.com/repos/VictoriaMetrics/VictoriaMetrics/releases" |
  jq -r --arg a "$arch_resolve" '.[] | select(.assets[].name | match("^victoria-metrics-linux-" + $a + "-v[0-9.]+.tar.gz$")) | .tag_name' |
  head -n 1)
-victoriametrics_filename="victoria-metrics-linux-${arch_resolve}-${victoriametrics_release}.tar.gz"
-vmutils_filename="vmutils-linux-${arch_resolve}-${victoriametrics_release}.tar.gz"
+victoriametrics_filename="victoria-metrics-linux-$(arch_resolve)-${victoriametrics_release}.tar.gz"
+vmutils_filename="vmutils-linux-$(arch_resolve)-${victoriametrics_release}.tar.gz"
 msg_ok "Got version $victoriametrics_release of VictoriaMetrics"

 fetch_and_deploy_gh_release "victoriametrics" "VictoriaMetrics/VictoriaMetrics" "prebuild" "$victoriametrics_release" "/opt/victoriametrics" "$victoriametrics_filename"
@@ -30,10 +30,10 @@ read -r -p "${TAB3}Would you like to add VictoriaLogs? <y/N> " prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  vmlogs_filename=$(curl -fsSL "https://api.github.com/repos/VictoriaMetrics/VictoriaLogs/releases/latest" |
    jq -r '.assets[].name' |
-    grep -E "^victoria-logs-linux-${arch_resolve}-v[0-9.]+\.tar\.gz$")
+    grep -E "^victoria-logs-linux-$(arch_resolve)-v[0-9.]+\.tar\.gz$")
  vlutils_filename=$(curl -fsSL "https://api.github.com/repos/VictoriaMetrics/VictoriaLogs/releases/latest" |
    jq -r '.assets[].name' |
-    grep -E "^vlutils-linux-${arch_resolve}-v[0-9.]+\.tar\.gz$")
+    grep -E "^vlutils-linux-$(arch_resolve)-v[0-9.]+\.tar\.gz$")
  fetch_and_deploy_gh_release "victorialogs" "VictoriaMetrics/VictoriaLogs" "prebuild" "latest" "/opt/victoriametrics" "$vmlogs_filename"
  fetch_and_deploy_gh_release "vlutils" "VictoriaMetrics/VictoriaLogs" "prebuild" "latest" "/opt/victoriametrics" "$vlutils_filename"
 fi
@@ -20,7 +20,7 @@ msg_ok "Installed dependencies"
 msg_info "Installing Wastebin"
 temp_file=$(mktemp)
 RELEASE=$(curl -fsSL https://api.github.com/repos/matze/wastebin/releases/latest | grep "tag_name" | awk '{print substr($2, 2, length($2)-3) }')
-curl -fsSL "https://github.com/matze/wastebin/releases/download/${RELEASE}/wastebin_${RELEASE}_x86_64-unknown-linux-musl.tar.zst" -o "$temp_file"
+curl -fsSL "https://github.com/matze/wastebin/releases/download/${RELEASE}/wastebin_${RELEASE}_$(arch_resolve "x86_64" "aarch64")-unknown-linux-musl.tar.zst" -o "$temp_file"
 tar -xf "$temp_file"
 mkdir -p /opt/wastebin
 mv wastebin* /opt/wastebin/
@@ -14,10 +14,10 @@ network_check
 update_os

 msg_info "Installing Dependencies"
-$STD apt install -y sqlite3
+$STD apt install -y sqlite3 libicu-dev
 msg_ok "Installed Dependencies"

-fetch_and_deploy_gh_release "Whisparr" "Whisparr/Whisparr" "prebuild" "latest" "/opt/Whisparr" "Whisparr.*.linux-x64.tar.gz"
+fetch_and_deploy_gh_release "Whisparr" "Whisparr/Whisparr" "prebuild" "latest" "/opt/Whisparr" "Whisparr.*.linux-$(arch_resolve "x64" "arm64").tar.gz"

 msg_info "Configuring Whisparr"
 mkdir -p /var/lib/whisparr/
@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os

-fetch_and_deploy_gh_release "whodb" "clidey/whodb" "singlefile" "latest" "/opt/whodb" "whodb-*-linux-amd64"
+fetch_and_deploy_gh_release "whodb" "clidey/whodb" "singlefile" "latest" "/opt/whodb" "whodb-*-linux-$(arch_resolve)"

 msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/whodb.service
@@ -20,7 +20,7 @@ $STD apt install -y \
  caddy
 msg_ok "Installed dependencies"

-NODE_VERSION="24" NODE_MODULE="pnpm@10" setup_nodejs
+NODE_VERSION="24" NODE_MODULE="pnpm@11" setup_nodejs
 fetch_and_deploy_gh_release "wishlist" "cmintey/wishlist" "tarball"
 LATEST_APP_VERSION=$(get_latest_github_release "cmintey/wishlist")

@@ -19,7 +19,7 @@ msg_ok "Installed Dependencies"

 setup_mariadb
 MARIADB_DB_NAME="writefreely" MARIADB_DB_USER="writefreely" setup_mariadb_db
-fetch_and_deploy_gh_release "writefreely" "writefreely/writefreely" "prebuild" "latest" "/opt/writefreely" "writefreely_*_linux_amd64.tar.gz"
+fetch_and_deploy_gh_release "writefreely" "writefreely/writefreely" "prebuild" "latest" "/opt/writefreely" "writefreely_*_linux_$(arch_resolve).tar.gz"

 msg_info "Setting up WriteFreely"
 cd /opt/writefreely
@@ -17,7 +17,7 @@ msg_info "Installing Dependencies"
 $STD apt install -y ffmpeg
 msg_ok "Installed Dependencies"

-fetch_and_deploy_gh_release "yt-dlp-webui" "marcopiovanello/yt-dlp-web-ui" "singlefile" "latest" "/usr/local/bin" "yt-dlp-webui_linux-amd64"
+fetch_and_deploy_gh_release "yt-dlp-webui" "marcopiovanello/yt-dlp-web-ui" "singlefile" "latest" "/usr/local/bin" "yt-dlp-webui_linux-$(arch_resolve)"
 fetch_and_deploy_gh_release "yt-dlp" "yt-dlp/yt-dlp" "singlefile" "latest" "/usr/local/bin" "yt-dlp"

 msg_info "Setting up YT-DLP-WEBUI"
@@ -24,15 +24,15 @@ $STD apt-get install -y \
  openssh-client
 msg_ok "Installed Dependencies"

-fetch_and_deploy_gh_release "restic" "restic/restic" "singlefile" "latest" "/usr/local/bin" "restic_*_linux_amd64.bz2"
+fetch_and_deploy_gh_release "restic" "restic/restic" "singlefile" "latest" "/usr/local/bin" "restic_*_linux_$(arch_resolve).bz2"
 mv /usr/local/bin/restic /usr/local/bin/restic.bz2
 bzip2 -d /usr/local/bin/restic.bz2
 chmod +x /usr/local/bin/restic

-fetch_and_deploy_gh_release "rclone" "rclone/rclone" "prebuild" "latest" "/opt/rclone" "rclone-*-linux-amd64.zip"
+fetch_and_deploy_gh_release "rclone" "rclone/rclone" "prebuild" "latest" "/opt/rclone" "rclone-*-linux-$(arch_resolve).zip"
 ln -sf /opt/rclone/rclone /usr/local/bin/rclone

-fetch_and_deploy_gh_release "shoutrrr" "nicholas-fedor/shoutrrr" "prebuild" "latest" "/opt/shoutrrr" "shoutrrr_linux_amd64_*.tar.gz"
+fetch_and_deploy_gh_release "shoutrrr" "nicholas-fedor/shoutrrr" "prebuild" "latest" "/opt/shoutrrr" "shoutrrr_linux_$(arch_resolve "amd64" "arm64v8")_*.tar.gz"
 ln -sf /opt/shoutrrr/shoutrrr /usr/local/bin/shoutrrr

 msg_info "Installing Bun"
@@ -36,8 +36,44 @@ fi
 msg_ok "Setup Zerotier-One"

 msg_info "Setting up UI"
-curl -O https://s3-us-west-1.amazonaws.com/key-networks/deb/ztncui/1/x86_64/ztncui_0.8.14_amd64.deb
-dpkg -i ztncui_0.8.14_amd64.deb
+if [[ "$(arch_resolve)" == "arm64" ]]; then
+  $STD apt-get install -y build-essential python3 openssl
+  NODE_VERSION="20" setup_nodejs
+  curl -fsSL "https://github.com/key-networks/ztncui/archive/refs/heads/master.tar.gz" -o /tmp/ztncui.tar.gz
+  $STD tar -xzf /tmp/ztncui.tar.gz -C /tmp
+  mkdir -p /opt/key-networks
+  cp -r /tmp/ztncui-master/src /opt/key-networks/ztncui
+  cd /opt/key-networks/ztncui
+  $STD npm install --omit=dev
+  cp etc/default.passwd etc/passwd
+  create_self_signed_cert "ztncui"
+  mkdir -p etc/tls
+  cp /etc/ssl/ztncui/ztncui.key etc/tls/privkey.pem
+  cp /etc/ssl/ztncui/ztncui.crt etc/tls/fullchain.pem
+  id -u ztncui &>/dev/null || useradd --system --home-dir /opt/key-networks/ztncui --shell /usr/sbin/nologin ztncui
+  chown -R ztncui:ztncui /opt/key-networks/ztncui
+  cat <<'EOF' >/lib/systemd/system/ztncui.service
+[Unit]
+Description=ztncui - ZeroTier network controller user interface
+Documentation=https://key-networks.com
+After=network.target
+
+[Service]
+Type=simple
+User=ztncui
+WorkingDirectory=/opt/key-networks/ztncui
+ExecStart=/usr/bin/node /opt/key-networks/ztncui/bin/www
+Restart=on-failure
+
+[Install]
+WantedBy=multi-user.target
+EOF
+  systemctl daemon-reload
+  systemctl enable -q ztncui
+else
+  curl -O https://s3-us-west-1.amazonaws.com/key-networks/deb/ztncui/1/x86_64/ztncui_0.8.14_amd64.deb
+  dpkg -i ztncui_0.8.14_amd64.deb
+fi
 sh -c "echo ZT_TOKEN=$(cat /var/lib/zerotier-one/authtoken.secret) > /opt/key-networks/ztncui/.env"
 echo HTTPS_PORT=3443 >>/opt/key-networks/ztncui/.env
 echo NODE_ENV=production >>/opt/key-networks/ztncui/.env
@@ -14,7 +14,7 @@ network_check
 update_os

 msg_info "Installing Dependencies (Patience)"
-$STD apt install -y ca-certificates
+$STD apt install -y ca-certificates lsof
 msg_ok "Installed Dependecies"

 PG_VERSION="17" setup_postgresql
@@ -39,7 +39,7 @@ $STD sudo -u postgres psql -c "CREATE DATABASE $DB_NAME OWNER $DB_ADMIN_USER;"
 } >>~/zitadel.creds
 msg_ok "Installed PostgreSQL"

-fetch_and_deploy_gh_release "zitadel" "zitadel/zitadel" "prebuild" "latest" "/usr/local/bin" "zitadel-linux-amd64.tar.gz"
+fetch_and_deploy_gh_release "zitadel" "zitadel/zitadel" "prebuild" "latest" "/usr/local/bin" "zitadel-linux-$(arch_resolve).tar.gz"

 msg_info "Setting up Zitadel Environments"
 mkdir -p /opt/zitadel
@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os

-fetch_and_deploy_gh_release "zoraxy" "tobychui/zoraxy" "singlefile" "latest" "/opt/zoraxy" "zoraxy_linux_amd64"
+fetch_and_deploy_gh_release "zoraxy" "tobychui/zoraxy" "singlefile" "latest" "/opt/zoraxy" "zoraxy_linux_$(arch_resolve)"
 ln -s /opt/zoraxy/zoraxy /usr/local/bin/zoraxy

 msg_info "Creating Service"
@@ -17,7 +17,7 @@ msg_info "Installing Dependencies"
 $STD apt install -y apache2-utils
 msg_ok "Installed Dependencies"

-fetch_and_deploy_gh_release "zot" "project-zot/zot" "singlefile" "latest" "/usr/bin" "zot-linux-amd64"
+fetch_and_deploy_gh_release "zot" "project-zot/zot" "singlefile" "latest" "/usr/bin" "zot-linux-$(arch_resolve)"

 msg_info "Configuring Zot Registry"
 mkdir -p /etc/zot
@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os

-fetch_and_deploy_gh_release "zwave-js-ui" "zwave-js/zwave-js-ui" "prebuild" "latest" "/opt/zwave-js-ui" "zwave-js-ui*-linux.zip"
+fetch_and_deploy_gh_release "zwave-js-ui" "zwave-js/zwave-js-ui" "prebuild" "latest" "/opt/zwave-js-ui" "zwave-js-ui*-$(arch_resolve "linux" "linux-arm64").zip"

 msg_info "Configuring Z-Wave JS UI"
 mkdir -p /opt/zwave_store
@@ -33,7 +33,7 @@ After=network-online.target
 [Service]
 User=root
 WorkingDirectory=/opt/zwave-js-ui
-ExecStart=/opt/zwave-js-ui/zwave-js-ui-linux
+ExecStart=/opt/zwave-js-ui/$(arch_resolve "zwave-js-ui-linux" "zwave-js-ui")
 EnvironmentFile=/opt/.env

 [Install]
@@ -4001,6 +4001,7 @@ $PCT_OPTIONS_STRING"
      exit 214
    fi
    msg_ok "Storage space validated"
+    check_storage_health "$CONTAINER_STORAGE" "$DISK_SIZE"
  fi

  create_lxc_container || exit $?
@@ -5383,6 +5384,7 @@ select_storage() {
    # Validate storage space for container storage
    if [[ "$CLASS" == "container" && -n "${DISK_SIZE:-}" ]]; then
      validate_storage_space "$STORAGE_RESULT" "$DISK_SIZE" "yes"
+      check_storage_health "$STORAGE_RESULT" "$DISK_SIZE"
      # Continue even if validation fails - user was warned
    fi

@@ -5448,6 +5450,51 @@ validate_storage_space() {
  return 0
 }

+# ------------------------------------------------------------------------------
+# check_storage_health()
+#
+# - Warns or blocks when target storage is nearly full
+# - Complements validate_storage_space (free space vs. requested disk)
+# - Uses pvesm status usage when available
+# ------------------------------------------------------------------------------
+check_storage_health() {
+  local storage="$1"
+  local required_gb="${2:-8}"
+  [[ -z "$storage" ]] && return 0
+
+  local storage_line storage_type total_kb avail_kb used_pct free_gb_fmt
+  storage_line=$(pvesm status 2>/dev/null | awk -v s="$storage" '$1 == s {print $0}')
+  [[ -z "$storage_line" ]] && return 0
+
+  storage_type=$(awk '{print $2}' <<<"$storage_line")
+  total_kb=$(awk '{print $4}' <<<"$storage_line")
+  avail_kb=$(awk '{print $6}' <<<"$storage_line")
+
+  [[ -z "$total_kb" || "$total_kb" == "0" || -z "$avail_kb" ]] && return 0
+
+  used_pct=$(( (total_kb - avail_kb) * 100 / total_kb ))
+  free_gb_fmt=$(numfmt --to=iec --from-unit=1024 --suffix=B --format %.1f "$avail_kb" 2>/dev/null || echo "${avail_kb}KB")
+
+  if (( used_pct >= 95 )); then
+    msg_warn "Storage '${storage}' (${storage_type}) is ${used_pct}% full (${free_gb_fmt} free)"
+    if ! is_unattended && command -v whiptail >/dev/null 2>&1 && [[ -t 0 ]]; then
+      if ! whiptail --backtitle "Proxmox VE Helper Scripts" \
+        --title "STORAGE ALMOST FULL" \
+        --yesno "Storage '${storage}' is ${used_pct}% full.\n\nType: ${storage_type}\nAvailable: ${free_gb_fmt}\nRequired for CT: ${required_gb} GB\n\nContinue anyway?" 14 70; then
+        msg_error "Installation cancelled – storage nearly full"
+        exit 214
+      fi
+    elif (( used_pct >= 98 )); then
+      msg_error "Storage '${storage}' is ${used_pct}% full – refusing install in unattended mode"
+      exit 214
+    fi
+  elif (( used_pct >= 85 )); then
+    msg_warn "Storage '${storage}' (${storage_type}) is ${used_pct}% full (${free_gb_fmt} free)"
+  fi
+
+  return 0
+}
+
 # ==============================================================================
 # SECTION 8: CONTAINER CREATION
 # ==============================================================================
@@ -145,11 +145,35 @@ function header_info {
 EOF
 }

+function sanitize_service_name() {
+  local name="${1//$'\r'/}"
+  name="${name//$'\n'/}"
+  [[ -z "$name" ]] && return 1
+  [[ "$name" == *'#!'* ]] && return 1
+  [[ ! "$name" =~ ^[a-zA-Z0-9._-]+$ ]] && return 1
+  return 0
+}
+
+function validate_service_script() {
+  local name="$1"
+  sanitize_service_name "$name" || return 1
+  curl -fsSL --max-time 10 -o /dev/null \
+    "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/${name}.sh" 2>/dev/null
+}
+
 function detect_service() {
-  pushd $(mktemp -d) >/dev/null
-  pct pull "$1" /usr/bin/update update 2>/dev/null
-  service=$(cat update | sed 's|.*/ct/||g' | sed 's|\.sh).*||g')
-  popd >/dev/null
+  local container="$1"
+  local tmpdir update_file
+  service=""
+  tmpdir=$(mktemp -d)
+  update_file="$tmpdir/update"
+  pct pull "$container" /usr/bin/update "$update_file" 2>/dev/null || true
+  if [[ ! -s "$update_file" ]]; then
+    rm -rf "$tmpdir"
+    return 1
+  fi
+  service=$(grep -oE '/ct/[a-zA-Z0-9._-]+\.sh' "$update_file" 2>/dev/null | head -n1 | sed 's|.*/ct/||; s|\.sh$||')
+  rm -rf "$tmpdir"
 }

 function dry_run_container() {
@@ -447,24 +471,33 @@ for container in $CHOICE; do
  #1) Detect service using the service name in the update command
  detect_service $container

-  #1.1) If update script not detected, return
-  if [ -z "${service}" ]; then
-    echo -e "${YW}[WARN]${CL} Update script not found. Skipping to next container"
-    log_result "$container" "(unknown)" "SKIPPED" "No update script found in container"
-    log_write "Container $container: SKIPPED — no update script found"
+  #1.1) If update script not detected or service name is invalid, skip
+  if [ -z "${service}" ] || ! sanitize_service_name "${service}"; then
+    echo -e "${RD}[ERROR]${CL} Could not detect a valid service name for container $container"
+    log_result "$container" "(unknown)" "ERROR" "Invalid or missing service name in /usr/bin/update"
+    log_write "Container $container: ERROR — invalid or missing service name"
    continue
-  else
-    echo -e "${BL}[INFO]${CL} Detected service: ${GN}${service}${CL}"
-    log_write "Container $container: detected service '$service'"
  fi

+  if ! validate_service_script "${service}"; then
+    echo -e "${RD}[ERROR]${CL} Service '${service}' does not resolve to ct/${service}.sh"
+    log_result "$container" "${service}" "ERROR" "No matching ct/${service}.sh script found"
+    log_write "Container $container: ERROR — ct/${service}.sh not found"
+    continue
+  fi
+
+  echo -e "${BL}[INFO]${CL} Detected service: ${GN}${service}${CL}"
+  log_write "Container $container: detected service '${service}'"
+
  #2) Extract service build/update resource requirements from config/installation file
-  script=$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/${service}.sh)
+  script=$(curl -fsSL "https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/${service}.sh")

  #2.1) Check if the script downloaded successfully
-  if [ $? -ne 0 ]; then
-    echo -e "${RD}[ERROR]${CL} Issue while downloading install script."
-    echo -e "${YW}[WARN]${CL} Unable to assess build resource requirements. Proceeding with current resources."
+  if [ $? -ne 0 ] || [ -z "${script}" ]; then
+    echo -e "${RD}[ERROR]${CL} Failed to download ct/${service}.sh"
+    log_result "$container" "${service}" "ERROR" "Failed to download ct/${service}.sh"
+    log_write "Container $container (${service}): ERROR — failed to download install script"
+    continue
  fi

  config=$(pct config "$container")
Author	SHA1	Message	Date
MickLesk	57de9560e6	fix(update-apps): sanitize service detection and fail on invalid names Reject multi-line or shebang-leaked service names from /usr/bin/update, verify ct/<service>.sh exists before updating, and report ERROR instead of silently marking failed containers as OK.	2026-06-22 21:39:13 +02:00
community-scripts-pr-app[bot]	6b931ef4d4	Update CHANGELOG.md (#15310 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-06-22 19:14:03 +00:00
community-scripts-pr-app[bot]	10d19362a2	Update CHANGELOG.md (#15309 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-06-22 19:13:50 +00:00
Sam Heinz	3fc187efb8	[arm64] Port scripts between warracker-zwavejsui to support arm64 (#15291 ) * [arm64] Port scripts between warracker-zwavejsui to support arm64 * Update zerotier-one-install.sh	2026-06-22 21:13:32 +02:00
community-scripts-pr-app[bot]	51db1a9d7d	Update CHANGELOG.md (#15308 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-06-22 19:13:17 +00:00
Sam Heinz	bc9ceb187d	add proxy headers to dispatcharr from #15143 (#15293 )	2026-06-22 21:12:42 +02:00
community-scripts-pr-app[bot]	490aa20dab	Update CHANGELOG.md (#15307 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-06-22 19:12:16 +00:00
push-app-to-main[bot]	834f2dbd29	Postiz (#15048 ) * Add postiz (ct) * Update postiz.sh * rm: python --------- Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com> Co-authored-by: Michel Roegl-Brunner <73236783+michelroegl-brunner@users.noreply.github.com> Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com>	2026-06-22 21:11:47 +02:00
community-scripts-pr-app[bot]	0524e7feb5	Update CHANGELOG.md (#15306 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-06-22 19:11:45 +00:00
galz55	c1a6dc29ee	Fix-15015: check correct path for certbot (#15034 ) Co-authored-by: galz55 <damianbc-github@gmail.com>	2026-06-22 21:11:14 +02:00
community-scripts-pr-app[bot]	7f363170f3	Update CHANGELOG.md (#15305 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-06-22 19:10:44 +00:00
hugo	bf815a847b	fix(romm): resolve 403 Forbidden error on nginx mod_zip installation (#15134 ) * Update Nginx installation and mod_zip configuration Replaced nginx with nginx-extras and modified Nginx mod_zip installation to use the native Debian module. * Update source URL for build functions in romm.sh * Update install script URL in build.func * Update romm-install.sh for Nginx and mod_zip installation Updated the installation script to include Nginx and libpcre2-dev, and modified the process for installing the Nginx mod_zip module. * Install Nginx mod_zip module and create symlinks Add installation steps for Nginx mod_zip module. * Modify Nginx installation to use custom modules path Updated installation script to use a custom modules directory for Nginx. * Install Nginx mod_zip without HTTP rewrite module Removed unnecessary HTTP rewrite module from Nginx configuration. * Simplify Nginx mod_zip installation script Removed redundant installation of libpcre3-dev for Nginx mod_zip. * Update romm-install.sh * Remove temporary files after Nginx module installation Clean up temporary files after installing the Nginx mod_zip module. * Update source URL in romm.sh script * Update install script URL to community repository * fix(romm): replace getpagespeed repo with source compilation for mod_zip The `getpagespeed` repository now requires a paid subscription, causing the RomM installation to fail with a 403 Forbidden error. Additionally, Debian 13 (Trixie) introduced an APT conflict between `libpcre3-dev` and `libpcre2-dev`. This commit fixes the installation by: - Removing the proprietary `getpagespeed` repository dependency. - Replacing `libpcre3-dev` with `libpcre2-dev` to resolve APT conflicts on Debian 13. - Downloading the `mod_zip` tarball directly from GitHub (avoiding `git clone`). - Downloading the exact Nginx source code matching the installed APT version. - Compiling the dynamic module (`ngx_http_zip_module.so`) using `--with-compat`. - Placing the compiled module in a custom directory (`/etc/nginx/custom-modules/`) to bypass Debian's default symlink quirks. - Cleaning up compilation files in `/tmp` to keep the container footprint small. * migrate from nginx to angie so dont need to then install nginx from tarball just to compile the zip module --------- Co-authored-by: Sam Heinz <54530346+asylumexp@users.noreply.github.com>	2026-06-22 21:10:14 +02:00
community-scripts-pr-app[bot]	a5f21f63e8	Update CHANGELOG.md (#15304 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-06-22 19:08:36 +00:00
CanbiZ (MickLesk)	0940119aea	feat(build): add pre-install storage health checks (#15226 ) Warn or block container creation when target storage is above 85% or 95% full. Co-authored-by: Cursor <cursoragent@cursor.com>	2026-06-22 21:08:09 +02:00
community-scripts-pr-app[bot]	7b3afbc609	Update CHANGELOG.md (#15303 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-06-22 18:13:56 +00:00
Chris	b581ce74e7	Degoog: Fix valkey url in update; set mandatory settings password (#15300 )	2026-06-22 20:13:27 +02:00
community-scripts-pr-app[bot]	afd20452b5	Update CHANGELOG.md (#15296 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-06-22 13:35:47 +00:00
Sam Heinz	6545c0b731	[arm64] fix update functions to support arm64 (#15290 ) oops forgot about a few update functions	2026-06-22 23:35:14 +10:00
community-scripts-pr-app[bot]	826311c0d6	Update CHANGELOG.md (#15295 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-06-22 13:32:07 +00:00
Sam Heinz	6e82dc8bce	Fix type in victoriametrics (#15289 )	2026-06-22 15:31:34 +02:00