Update maintainerr.sh script header comments

On a merged PR labelled "breaking change", POST the PR number to the site's
/api/breaking-changes/ingest endpoint so it can show a temporary advisory on
the affected scripts. Uses pull_request_target (secrets available for fork
PRs) and never checks out PR code — it only forwards the number after merge.
The `labeled` trigger also covers labelling a PR after it has merged.

Requires repo secret BREAKING_CHANGE_INGEST_SECRET (matching the site) and an
optional SITE_URL variable (defaults to https://community-scripts.org).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TFBuZEp142Ei2PAfWqbMXT

.github/workflows/notify-breaking-change.yml

@@ -0,0 +1,58 @@
+name: Notify breaking change
+
+# When a PR labelled "breaking change" is merged, tell the Helper-Scripts site
+# so it can show a temporary advisory on the affected scripts. The site pulls
+# the PR itself and re-verifies it is merged + labelled, so this workflow only
+# has to hand over the PR number.
+#
+# Requires one repo secret:
+#   BREAKING_CHANGE_INGEST_SECRET  — must match the value the site runs with.
+# Site URL is taken from the existing FRONTEND_URL secret, then an optional
+# SITE_URL variable, then a hard default.
+#
+# pull_request_target (not pull_request) so the run has access to the secret
+# even for fork PRs. It is safe here: the job never checks out or runs PR code —
+# it only forwards the number after the PR has merged.
+
+on:
+  pull_request_target:
+    # closed  -> fires on the merge itself
+    # labeled -> fires if the label is added to an already-merged PR
+    types: [closed, labeled]
+
+concurrency:
+  group: notify-breaking-change-${{ github.event.pull_request.number }}
+  cancel-in-progress: false
+
+jobs:
+  notify:
+    if: >-
+      github.event.pull_request.merged == true &&
+      contains(github.event.pull_request.labels.*.name, 'breaking change')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Notify site of breaking change
+        env:
+          INGEST_SECRET: ${{ secrets.BREAKING_CHANGE_INGEST_SECRET }}
+          SITE_URL: ${{ secrets.FRONTEND_URL || vars.SITE_URL || 'https://community-scripts.org' }}
+          PR: ${{ github.event.pull_request.number }}
+        run: |
+          set -euo pipefail
+          if [ -z "${INGEST_SECRET:-}" ]; then
+            echo "::error::BREAKING_CHANGE_INGEST_SECRET secret is not set."
+            exit 1
+          fi
+          url="${SITE_URL%/}/api/breaking-changes/ingest"
+          echo "Notifying $url for PR #${PR}"
+          status="$(curl -sS -o response.json -w '%{http_code}' \
+            -X POST "$url" \
+            -H "Authorization: Bearer ${INGEST_SECRET}" \
+            -H "Content-Type: application/json" \
+            -d "{\"pr\": ${PR}}")"
+          echo "HTTP $status"
+          cat response.json || true
+          echo
+          if [ "$status" != "200" ]; then
+            echo "::error::ingest endpoint returned HTTP $status"
+            exit 1
+          fi

CHANGELOG.md

@@ -527,6 +527,8 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-08-24
+
 ## 2026-08-23
 
 ### 🚀 Updated Scripts

ct/fireshare.sh

@@ -57,9 +57,11 @@ function update_script() {
     $STD .venv/bin/python -m pip install --upgrade --break-system-packages pip
     $STD .venv/bin/python -m pip install --no-cache-dir --break-system-packages --ignore-installed app/server
     cp .venv/bin/fireshare /usr/local/bin/fireshare
-    set -a
-    source /opt/fireshare/fireshare.env
-    set +a
+    export FLASK_APP="/opt/fireshare/app/server/fireshare:create_app()"
+    export DATA_DIRECTORY=/opt/fireshare-data
+    export IMAGE_DIRECTORY=/opt/fireshare-images
+    export VIDEO_DIRECTORY=/opt/fireshare-videos
+    export PROCESSED_DIRECTORY=/opt/fireshare-processed
     $STD uv run flask db upgrade
     cd /opt/fireshare/app/client
     $STD npm install

ct/headers/maintainerr

@@ -0,0 +1,6 @@
+    __  ___      _       __        _                     
+   /  |/  /___ _(_)___  / /_____ _(_)___  ___  __________
+  / /|_/ / __ `/ / __ \/ __/ __ `/ / __ \/ _ \/ ___/ ___/
+ / /  / / /_/ / / / / / /_/ /_/ / / / / /  __/ /  / /    
+/_/  /_/\__,_/_/_/ /_/\__/\__,_/_/_/ /_/\___/_/  /_/     
+                                                         

ct/maintainerr.sh

@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Karolis Stanelis
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Maintainerr/Maintainerr
+
+APP="Maintainerr"
+var_tags="${var_tags:-media;arr;cleanup}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-8192}"
+var_disk="${var_disk:-24}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/maintainerr ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "maintainerr" "Maintainerr/Maintainerr"; then
+    msg_info "Stopping Service"
+    systemctl stop maintainerr
+    msg_ok "Stopped Service"
+
+    create_backup /opt/data /opt/maintainerr/.env
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "maintainerr" "Maintainerr/Maintainerr" "tarball" "latest" "/opt/maintainerr"
+
+    msg_info "Rebuilding Maintainerr (Patience)"
+    cd /opt/maintainerr
+    export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+    export NODE_OPTIONS="--max-old-space-size=4096"
+    $STD corepack enable
+    $STD corepack prepare yarn@4.11.0 --activate
+    $STD yarn config set enableTelemetry 0
+    $STD yarn install --network-timeout 300000
+    $STD yarn turbo build --concurrency=1
+    cp -r apps/ui/dist apps/server/dist/ui
+    cp -r apps/server/assets apps/server/dist/assets
+    find apps/server/dist/ui -type f -not -path '*/node_modules/*' -print0 | xargs -0 sed -i "s,/__PATH_PREFIX__,,g"
+    $STD yarn workspaces focus --all --production
+    rm -rf /opt/maintainerr/.yarn/cache /opt/maintainerr/.turbo /opt/maintainerr/apps/ui
+    $STD apt autoremove -y
+    msg_ok "Rebuilt Maintainerr"
+
+    restore_backup
+    sed -i '/^npm_package_version=/d;/^VERSION_TAG=/d' /opt/maintainerr/.env
+    {
+      echo "VERSION_TAG=stable"
+      echo "npm_package_version=$(cat ~/.maintainerr)"
+    } >>/opt/maintainerr/.env
+
+    msg_info "Starting Service"
+    systemctl start maintainerr
+    msg_ok "Started Service"
+    msg_ok "Updated Successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:6246${CL}"

install/maintainerr-install.sh

@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Karolis Stanelis
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Maintainerr/Maintainerr
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  build-essential \
+  pkg-config \
+  libcairo2-dev \
+  libpango1.0-dev \
+  libjpeg-dev \
+  libgif-dev \
+  libpixman-1-dev \
+  librsvg2-dev
+msg_ok "Installed Dependencies"
+
+NODE_VERSION="24" setup_nodejs
+
+fetch_and_deploy_gh_release "maintainerr" "Maintainerr/Maintainerr" "tarball" "latest" "/opt/maintainerr"
+
+msg_info "Building Maintainerr (Patience)"
+cd /opt/maintainerr
+export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+export NODE_OPTIONS="--max-old-space-size=4096"
+$STD corepack enable
+$STD corepack prepare yarn@4.11.0 --activate
+$STD yarn config set enableTelemetry 0
+$STD yarn install --network-timeout 300000
+$STD yarn turbo build --concurrency=1
+cp -r apps/ui/dist apps/server/dist/ui
+cp -r apps/server/assets apps/server/dist/assets
+find apps/server/dist/ui -type f -not -path '*/node_modules/*' -print0 | xargs -0 sed -i "s,/__PATH_PREFIX__,,g"
+msg_ok "Built Maintainerr"
+
+msg_info "Reclaiming Disk Space"
+$STD yarn workspaces focus --all --production
+rm -rf /opt/maintainerr/.yarn/cache /opt/maintainerr/.turbo /opt/maintainerr/apps/ui
+$STD apt autoremove -y
+msg_ok "Reclaimed Disk Space"
+
+msg_info "Configuring Environment"
+mkdir -p /opt/data/logs
+ln -sfn /opt/maintainerr /opt/app
+cat <<EOF >/opt/maintainerr/.env
+NODE_ENV=production
+DATA_DIR=/opt/data
+UI_PORT=6246
+UI_HOSTNAME=0.0.0.0
+BASE_PATH=
+VERSION_TAG=stable
+npm_package_version=$(cat ~/.maintainerr)
+EOF
+msg_ok "Configured Environment"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/maintainerr.service
+[Unit]
+Description=Maintainerr
+After=network.target
+
+[Service]
+Type=simple
+WorkingDirectory=/opt/maintainerr/apps/server
+EnvironmentFile=/opt/maintainerr/.env
+ExecStart=/usr/bin/node dist/main
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now maintainerr
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

misc/build.func

@@ -1208,10 +1208,12 @@ base_settings() {
 # - Used by default_var_settings and app defaults loading
 # - Only loads whitelisted var_* keys
 # - Optional force parameter to override existing values (for app defaults)
+# - Optional protected list preserves genuinely user-exported var_* values
 # ------------------------------------------------------------------------------
 load_vars_file() {
   local file="$1"
-  local force="${2:-no}" # If "yes", override existing variables
+  local force="${2:-no}"      # If "yes", override existing variables
+  local protected="${3:-}"    # space-separated var_* keys the user genuinely exported before this file loaded; never overwritten
   [ -f "$file" ] || return 0
   msg_info "Loading defaults from ${file}"
 
@@ -1231,6 +1233,13 @@ load_vars_file() {
     return 1
   }
 
+  # Protected check helper (genuinely user-exported vars, see $protected above)
+  _is_protected() {
+    local k="$1" p
+    for p in $protected; do [ "$k" = "$p" ] && return 0; done
+    return 1
+  }
+
   local line key val
   while IFS= read -r line || [ -n "$line" ]; do
     line="${line#"${line%%[![:space:]]*}"}"
@@ -1435,9 +1444,19 @@ load_vars_file() {
         esac
       fi
 
-      # Set variable: force mode overrides existing, otherwise only set if empty
+      # Set variable: force mode overrides existing, otherwise only set if empty.
+      # Exception: var_cpu/var_ram/var_disk are always applied here (unless the
+      # user genuinely exported them beforehand, per $protected) even though the
+      # app script already declared its own baseline for them - base_settings()
+      # reconciles the final floor against APP_DEFAULT_* afterward, so this file
+      # must be allowed to raise them instead of being silently blocked by the
+      # app's own pre-set value.
       if [[ "$force" == "yes" ]]; then
         export "${var_key}=${var_val}"
+      elif _is_protected "$var_key"; then
+        :
+      elif [[ "$var_key" == "var_cpu" || "$var_key" == "var_ram" || "$var_key" == "var_disk" ]]; then
+        export "${var_key}=${var_val}"
       else
         [[ -z "${!var_key+x}" ]] && export "${var_key}=${var_val}"
       fi
@@ -1597,7 +1616,7 @@ EOF
     msg_error "default.vars not found after ensure step"
     return 252
   }
-  load_vars_file "$dv"
+  load_vars_file "$dv" "no" "${!_HARD_ENV[*]}"
 
   # 3) Map var_verbose → VERBOSE
   if [[ -n "${var_verbose:-}" ]]; then