test: unify valkey.sh/alpine-valkey.sh, msg_menu OS choice

CHANGELOG.md

@@ -524,22 +524,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
-## 2026-08-17
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - keycloak: remove invalid ExecStop, kc.sh has no stop subcommand [@MickLesk](https://github.com/MickLesk) ([#16563](https://github.com/community-scripts/ProxmoxVE/pull/16563))
-    - Pin ownfoil release to version 2.3.0 [@MickLesk](https://github.com/MickLesk) ([#16574](https://github.com/community-scripts/ProxmoxVE/pull/16574))
-    - kometa: add git, needed by requirements.txt's git dependency [@MickLesk](https://github.com/MickLesk) ([#16562](https://github.com/community-scripts/ProxmoxVE/pull/16562))
-    - fix romm: deploy EmulatorJS and Ruffle after the frontend build [@angusmaul](https://github.com/angusmaul) ([#16571](https://github.com/community-scripts/ProxmoxVE/pull/16571))
-
-  - #### 🔧 Refactor
-
-    - patchmon: fetch only SCAP datastream XMLs [@MickLesk](https://github.com/MickLesk) ([#16565](https://github.com/community-scripts/ProxmoxVE/pull/16565))
-    - teslamate: use precompiled Elixir [@MickLesk](https://github.com/MickLesk) ([#16561](https://github.com/community-scripts/ProxmoxVE/pull/16561))
-
 ## 2026-08-16
 
 ### 🚀 Updated Scripts

ct/keycloak.sh

@@ -28,14 +28,6 @@ function update_script() {
     msg_error "No ${APP} Installation Found!"
     exit
   fi
-
-  if grep -q '^ExecStop=/opt/keycloak/bin/kc.sh stop$' /etc/systemd/system/keycloak.service 2>/dev/null; then
-    msg_info "Correcting Service"
-    sed -i '/^ExecStop=\/opt\/keycloak\/bin\/kc.sh stop$/d' /etc/systemd/system/keycloak.service
-    systemctl daemon-reload
-    msg_ok "Corrected Service"
-  fi
-
   if check_for_gh_release "keycloak_app" "keycloak/keycloak"; then
     msg_info "Stopping Service"
     systemctl stop keycloak

ct/kometa.sh

@@ -39,7 +39,6 @@ function update_script() {
     cp /opt/kometa/config/config.yml /opt
     msg_ok "Backup completed"
 
-    ensure_dependencies git
     PYTHON_VERSION="3.13" setup_uv
     fetch_and_deploy_gh_release "kometa" "Kometa-Team/Kometa" "tarball"
 

ct/ownfoil.sh

@@ -29,15 +29,15 @@ function update_script() {
     msg_error "No ${APP} Installation Found!"
     exit
   fi
-  RELEASE="2.3.0"
-  if check_for_gh_release "ownfoil" "a1ex4/ownfoil"  "${RELEASE}" "pinned until 2.4.0 (coming soon) is tested, possible Breaking Changes."; then
+
+  if check_for_gh_release "ownfoil" "a1ex4/ownfoil"; then
     msg_info "Stopping Service"
     systemctl stop ownfoil
     msg_ok "Stopped Service"
 
     create_backup /opt/ownfoil/app/config
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "ownfoil" "a1ex4/ownfoil" "tarball" "${RELEASE}"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "ownfoil" "a1ex4/ownfoil" "tarball"
 
     restore_backup
 

ct/patchmon.sh

@@ -76,15 +76,7 @@ EOF
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "PatchMon" "PatchMon/PatchMon" "singlefile" "latest" "/opt/patchmon" "patchmon-server-linux-$(arch_resolve)"
     mv /opt/patchmon/PatchMon /opt/patchmon/patchmon-server
-
-    msg_info "Updating SCAP Content"
-    RELEASE=$(get_latest_github_release "ComplianceAsCode/content")
-    curl_with_retry "https://github.com/ComplianceAsCode/content/releases/download/v${RELEASE}/scap-security-guide-${RELEASE}.tar.gz" "/tmp/ssg.tar.gz"
-    mkdir -p /opt/patchmon/ssg-content
-    find /opt/patchmon/ssg-content -mindepth 1 -delete
-    tar -xzf /tmp/ssg.tar.gz -C /opt/patchmon/ssg-content --strip-components=1 --wildcards '*/ssg-*-ds.xml'
-    rm -f /tmp/ssg.tar.gz
-    msg_ok "Updated SCAP Content"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "ssg-content" "ComplianceAsCode/content" "prebuild" "latest" "/opt/patchmon/ssg-content" "scap-security-guide-*.tar.gz"
 
     restore_backup
 

ct/romm.sh

@@ -81,113 +81,7 @@ function update_script() {
     ln -sfn "$ROMM_BASE"/resources /opt/romm/frontend/dist/assets/romm/resources
     ln -sfn "$ROMM_BASE"/assets /opt/romm/frontend/dist/assets/romm/assets
     if [[ -f /etc/angie/http.d/romm.conf ]]; then
-      if ! grep -q "js_content decode.decodeBase64" /etc/angie/http.d/romm.conf; then
-        msg_info "Adding missing /decode and /cache locations to Angie config"
-        dpkg -l angie-module-njs &>/dev/null || $STD apt-get install -y angie-module-njs
-        grep -q "ngx_http_js_module.so" /etc/angie/angie.conf || sed -i '1i load_module modules/ngx_http_js_module.so;' /etc/angie/angie.conf
-        mkdir -p /etc/angie/js "${ROMM_BASE}/cache"
-        cat <<'JSEOF' >/etc/angie/js/decode.js
-// Decode a Base64 encoded string received as a query parameter named 'value',
-// and return the decoded value in the response body.
-function decodeBase64(r) {
-  var encodedValue = r.args.value;
-
-  if (!encodedValue) {
-    r.return(400, "Missing 'value' query parameter");
-    return;
-  }
-
-  try {
-    // Use Buffer to return raw bytes — atob() returns a JS string which r.return()
-    // would re-encode as UTF-8, corrupting any non-ASCII bytes (e.g. in filenames
-    // like "Pokémon") and causing CRC mismatches in the mod_zip manifest.
-    r.return(200, Buffer.from(encodedValue, 'base64'));
-  } catch (e) {
-    r.return(400, "Invalid Base64 encoding");
-  }
-}
-
-export default { decodeBase64 };
-JSEOF
-        cat <<EOF >/etc/angie/http.d/romm.conf
-js_import /etc/angie/js/decode.js;
-
-upstream romm_backend {
-    server 127.0.0.1:5000;
-}
-
-map \$http_upgrade \$connection_upgrade {
-    default upgrade;
-    '' close;
-}
-
-server {
-    listen 80;
-    server_name _;
-    root /opt/romm/frontend/dist;
-    client_max_body_size 0;
-
-    location / {
-        try_files \$uri \$uri/ /index.html;
-    }
-
-    location /assets {
-        alias /opt/romm/frontend/dist/assets;
-        try_files \$uri \$uri/ =404;
-        expires 1y;
-        add_header Cache-Control "public, immutable";
-    }
-
-    location ~ ^/rom/.*/ejs\$ {
-        add_header Cross-Origin-Embedder-Policy "require-corp";
-        add_header Cross-Origin-Opener-Policy "same-origin";
-        try_files \$uri /index.html;
-    }
-
-    location /api {
-        proxy_pass http://romm_backend;
-        proxy_buffering off;
-        proxy_request_buffering off;
-        proxy_set_header Host \$host;
-        proxy_set_header X-Real-IP \$remote_addr;
-        proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto \$scheme;
-    }
-
-    location ~ ^/(ws|netplay) {
-        proxy_pass http://romm_backend;
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade \$http_upgrade;
-        proxy_set_header Connection \$connection_upgrade;
-        proxy_set_header Host \$host;
-        proxy_read_timeout 86400;
-    }
-
-    location = /openapi.json {
-        proxy_pass http://romm_backend;
-    }
-
-    location /library/ {
-        internal;
-        alias ${ROMM_BASE}/library/;
-    }
-
-    location /cache/ {
-        internal;
-        alias ${ROMM_BASE}/cache/;
-    }
-
-    location /decode {
-        internal;
-        js_content decode.decodeBase64;
-    }
-}
-EOF
-        msg_ok "Added /decode and /cache locations"
-      else
-        sed -i -e "s|alias .*/library/;|alias ${ROMM_BASE}/library/;|" \
-          -e "s|alias .*/cache/;|alias ${ROMM_BASE}/cache/;|" /etc/angie/http.d/romm.conf
-      fi
+      sed -i "s|alias .*/library/;|alias ${ROMM_BASE}/library/;|" /etc/angie/http.d/romm.conf
       systemctl reload angie
     elif [[ -f /etc/nginx/sites-available/romm ]]; then
       sed -i "s|alias .*/library/;|alias ${ROMM_BASE}/library/;|" /etc/nginx/sites-available/romm

ct/teslamate.sh

@@ -35,16 +35,6 @@ function update_script() {
     systemctl stop teslamate
     msg_ok "Stopped Service"
 
-    if [[ ! -d /opt/elixir ]]; then
-      msg_info "Migrating to newer Elixir (required by TeslaMate)"
-      $STD apt remove -y elixir
-      fetch_and_deploy_gh_release "elixir" "elixir-lang/elixir" "prebuild" "latest" "/opt/elixir" "elixir-otp-27.zip"
-      for bin in elixir elixirc iex mix; do
-        ln -sf "/opt/elixir/bin/$bin" "/usr/local/bin/$bin"
-      done
-      msg_ok "Migrated to newer Elixir"
-    fi
-
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "teslamate" "teslamate-org/teslamate" "tarball"
 
     msg_info "Building TeslaMate (Patience)"

ct/valkey.sh

@@ -8,13 +8,23 @@ source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxV
 APP="Valkey"
 var_tags="${var_tags:-database}"
 var_cpu="${var_cpu:-1}"
-var_ram="${var_ram:-1024}"
-var_disk="${var_disk:-4}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 
+if [[ -z "${var_os:-}" ]]; then
+  var_os=$(msg_menu "Choose the container OS" "debian" "Debian 13 (TLS supported)" "alpine" "Alpine 3.24 (smaller, no TLS)")
+fi
+
+if [[ "$var_os" == "alpine" ]]; then
+  var_ram="${var_ram:-256}"
+  var_disk="${var_disk:-1}"
+  var_version="${var_version:-3.24}"
+else
+  var_ram="${var_ram:-1024}"
+  var_disk="${var_disk:-4}"
+  var_version="${var_version:-13}"
+fi
+
 header_info "$APP"
 variables
 color
@@ -24,16 +34,66 @@ function update_script() {
     header_info
     check_container_storage
     check_container_resources
-    if [[ ! -f /lib/systemd/system/valkey-server.service ]]; then
-        msg_error "No Valkey Installation Found!"
-        exit
+
+    IS_ALPINE=0
+    [[ -f /etc/alpine-release ]] && IS_ALPINE=1
+
+    if [[ "$IS_ALPINE" == "1" ]]; then
+        if [[ ! -f /etc/init.d/valkey ]]; then
+            msg_error "No Valkey Installation Found!"
+            exit
+        fi
+    else
+        if [[ ! -f /lib/systemd/system/valkey-server.service ]]; then
+            msg_error "No Valkey Installation Found!"
+            exit
+        fi
     fi
-    msg_info "Updating Valkey LXC"
-    $STD apt update
-    $STD apt -y upgrade
-    msg_ok "Updated Valkey LXC"
-    msg_ok "Updated successfully!"
-    exit
+
+    LXCIP=$(ip a s dev eth0 | awk '/inet / {print $2}' | cut -d/ -f1)
+
+    CHOICE=$(msg_menu "Valkey Management" \
+        "1" "Update Valkey" \
+        "2" "Allow 0.0.0.0 for listening" \
+        "3" "Allow only ${LXCIP} for listening")
+
+    case $CHOICE in
+    1)
+        msg_info "Updating Valkey"
+        if [[ "$IS_ALPINE" == "1" ]]; then
+            apk update && apk upgrade valkey
+            rc-service valkey restart
+        else
+            $STD apt update
+            $STD apt -y upgrade
+        fi
+        msg_ok "Updated Valkey"
+        msg_ok "Updated successfully!"
+        exit
+        ;;
+    2)
+        msg_info "Setting Valkey to listen on all interfaces"
+        sed -i 's/^bind .*/bind 0.0.0.0/' /etc/valkey/valkey.conf
+        if [[ "$IS_ALPINE" == "1" ]]; then
+            rc-service valkey restart
+        else
+            systemctl restart valkey-server
+        fi
+        msg_ok "Valkey now listens on all interfaces!"
+        exit
+        ;;
+    3)
+        msg_info "Setting Valkey to listen only on ${LXCIP}"
+        sed -i "s/^bind .*/bind ${LXCIP}/" /etc/valkey/valkey.conf
+        if [[ "$IS_ALPINE" == "1" ]]; then
+            rc-service valkey restart
+        else
+            systemctl restart valkey-server
+        fi
+        msg_ok "Valkey now listens only on ${LXCIP}!"
+        exit
+        ;;
+    esac
 }
 
 start
@@ -42,5 +102,5 @@ description
 
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:6379${CL}"
+echo -e "${INFO}${YW}Connect to Valkey CLI using the following command:${CL}"
+echo -e "${GATEWAY}${BGN}valkey-cli -h ${IP} -p 6379${CL}"

install/keycloak-install.sh

@@ -39,6 +39,7 @@ Type=idle
 User=root
 WorkingDirectory=/opt/keycloak
 ExecStart=/opt/keycloak/bin/kc.sh start
+ExecStop=/opt/keycloak/bin/kc.sh stop
 Restart=always
 RestartSec=3
 Environment="JAVA_HOME=/usr/lib/jvm/temurin-21-jdk-$(arch_resolve)"

install/kometa-install.sh

@@ -13,10 +13,6 @@ setting_up_container
 network_check
 update_os
 
-msg_info "Installing Dependencies"
-$STD apt install -y git
-msg_ok "Installed Dependencies"
-
 PYTHON_VERSION="3.13" setup_uv
 fetch_and_deploy_gh_release "kometa" "Kometa-Team/Kometa" "tarball"
 

install/ownfoil-install.sh

@@ -18,7 +18,7 @@ $STD apt install -y git
 msg_ok "Installed Dependencies"
 
 setup_uv
-fetch_and_deploy_gh_release "ownfoil" "a1ex4/ownfoil" "tarball" "2.3.0"
+fetch_and_deploy_gh_release "ownfoil" "a1ex4/ownfoil" "tarball"
 
 msg_info "Setting up Ownfoil"
 cd /opt/ownfoil

install/patchmon-install.sh

@@ -86,13 +86,7 @@ for arch in "${AGENT_NAME[@]}"; do
 done
 msg_ok "Fetched PatchMon agent binaries"
 
-msg_info "Fetching SCAP Content"
-RELEASE=$(get_latest_github_release "ComplianceAsCode/content")
-curl_with_retry "https://github.com/ComplianceAsCode/content/releases/download/v${RELEASE}/scap-security-guide-${RELEASE}.tar.gz" "/tmp/ssg.tar.gz"
-mkdir -p /opt/patchmon/ssg-content
-tar -xzf /tmp/ssg.tar.gz -C /opt/patchmon/ssg-content --strip-components=1 --wildcards '*/ssg-*-ds.xml'
-rm -f /tmp/ssg.tar.gz
-msg_ok "Fetched SCAP Content"
+fetch_and_deploy_gh_release "ssg-content" "ComplianceAsCode/content" "prebuild" "latest" "/opt/patchmon/ssg-content" "scap-security-guide-*.tar.gz"
 
 msg_info "Creating service"
 cat <<EOF >/etc/systemd/system/patchmon-server.service

install/romm-install.sh

@@ -42,40 +42,16 @@ $STD apt install -y \
   tzdata
 msg_ok "Installed Dependencies"
 
-msg_info "Installing Angie with mod_zip and njs modules"
+msg_info "Installing Angie with mod_zip module"
 setup_deb822_repo \
   "angie" \
   "https://angie.software/keys/angie-signing.gpg" \
   "https://download.angie.software/angie/debian/$(get_os_info version_id)" \
   "$(get_os_info codename)" \
   "main"
-$STD apt-get install -y angie angie-module-zip angie-module-njs
-sed -i '1i load_module modules/ngx_http_zip_module.so;\nload_module modules/ngx_http_js_module.so;' /etc/angie/angie.conf
-mkdir -p /etc/angie/js
-cat <<'EOF' >/etc/angie/js/decode.js
-// Decode a Base64 encoded string received as a query parameter named 'value',
-// and return the decoded value in the response body.
-function decodeBase64(r) {
-  var encodedValue = r.args.value;
-
-  if (!encodedValue) {
-    r.return(400, "Missing 'value' query parameter");
-    return;
-  }
-
-  try {
-    // Use Buffer to return raw bytes — atob() returns a JS string which r.return()
-    // would re-encode as UTF-8, corrupting any non-ASCII bytes (e.g. in filenames
-    // like "Pokémon") and causing CRC mismatches in the mod_zip manifest.
-    r.return(200, Buffer.from(encodedValue, 'base64'));
-  } catch (e) {
-    r.return(400, "Invalid Base64 encoding");
-  }
-}
-
-export default { decodeBase64 };
-EOF
-msg_ok "Installed Angie with mod_zip and njs modules"
+$STD apt-get install -y angie angie-module-zip
+sed -i '1i load_module modules/ngx_http_zip_module.so;' /etc/angie/angie.conf
+msg_ok "Installed Angie with mod_zip module"
 PYTHON_VERSION="3.13" setup_uv
 NODE_VERSION="24" setup_nodejs
 setup_mariadb
@@ -87,8 +63,7 @@ mkdir -p /opt/romm \
   /var/lib/romm/resources \
   /var/lib/romm/assets/{saves,states,screenshots} \
   /var/lib/romm/library/roms \
-  /var/lib/romm/library/bios \
-  /var/lib/romm/cache
+  /var/lib/romm/library/bios
 msg_ok "Created directories"
 
 msg_info "Creating configuration file"
@@ -161,6 +136,8 @@ else
 fi
 
 fetch_and_deploy_gh_release "romm" "rommapp/romm" "tarball"
+fetch_and_deploy_gh_release "ruffle" "ruffle-rs/ruffle" "prebuild" "latest" "/opt/romm/frontend/dist/assets/ruffle" "ruffle-*-web-selfhosted.zip"
+fetch_and_deploy_gh_release "EmulatorJS" "EmulatorJS/EmulatorJS" "prebuild" "v4.2.3" "/opt/romm/frontend/dist/assets/emulatorjs" "4.2.3.7z"
 
 msg_info "Creating environment file"
 sed -i 's/^supervised no/supervised systemd/' /etc/redis/redis.conf
@@ -237,13 +214,8 @@ ln -sfn "$ROMM_BASE"/resources /opt/romm/frontend/dist/assets/romm/resources
 ln -sfn "$ROMM_BASE"/assets /opt/romm/frontend/dist/assets/romm/assets
 msg_ok "Set up RomM Frontend"
 
-fetch_and_deploy_gh_release "ruffle" "ruffle-rs/ruffle" "prebuild" "latest" "/opt/romm/frontend/dist/assets/ruffle" "ruffle-*-web-selfhosted.zip"
-fetch_and_deploy_gh_release "EmulatorJS" "EmulatorJS/EmulatorJS" "prebuild" "v4.2.3" "/opt/romm/frontend/dist/assets/emulatorjs" "4.2.3.7z"
-
 msg_info "Configuring Angie"
 cat <<'EOF' >/etc/angie/http.d/romm.conf
-js_import /etc/angie/js/decode.js;
-
 upstream romm_backend {
     server 127.0.0.1:5000;
 }
@@ -310,24 +282,10 @@ server {
         internal;
         alias /var/lib/romm/library/;
     }
-
-    # Internally redirect cached zip file requests (Range-resumable downloads)
-    location /cache/ {
-        internal;
-        alias /var/lib/romm/cache/;
-    }
-
-    # Internal decoding endpoint, used by mod_zip to decode base64-encoded
-    # multi-file manifest entries (e.g. the generated .m3u for multi-disc games)
-    location /decode {
-        internal;
-        js_content decode.decodeBase64;
-    }
 }
 EOF
 
-sed -i -e "s|alias /var/lib/romm/library/;|alias ${ROMM_BASE}/library/;|" \
-  -e "s|alias /var/lib/romm/cache/;|alias ${ROMM_BASE}/cache/;|" /etc/angie/http.d/romm.conf
+sed -i "s|alias /var/lib/romm/library/;|alias ${ROMM_BASE}/library/;|" /etc/angie/http.d/romm.conf
 rm -f /etc/angie/http.d/default.conf
 systemctl restart angie
 systemctl enable -q --now angie

install/teslamate-install.sh

@@ -19,6 +19,7 @@ $STD apt install -y \
   erlang \
   erlang-dev \
   erlang-syntax-tools \
+  elixir \
   mosquitto \
   locales
 sed -i 's/^# *\(en_US.UTF-8\)/\1/' /etc/locale.gen
@@ -26,11 +27,6 @@ $STD locale-gen
 systemctl enable -q --now mosquitto
 msg_ok "Installed Dependencies"
 
-fetch_and_deploy_gh_release "elixir" "elixir-lang/elixir" "prebuild" "latest" "/opt/elixir" "elixir-otp-27.zip"
-for bin in elixir elixirc iex mix; do
-  ln -sf "/opt/elixir/bin/$bin" "/usr/local/bin/$bin"
-done
-
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="teslamate" PG_DB_USER="teslamate" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db
 NODE_VERSION="22" setup_nodejs

install/valkey-install.sh

@@ -13,12 +13,23 @@ setting_up_container
 network_check
 update_os
 
+IS_ALPINE=0
+[[ -f /etc/alpine-release ]] && IS_ALPINE=1
+
 msg_info "Installing Valkey"
-$STD apt update
-$STD apt install -y valkey openssl
+if [[ "$IS_ALPINE" == "1" ]]; then
+  $STD apk add valkey valkey-openrc valkey-cli
+else
+  $STD apt update
+  $STD apt install -y valkey openssl
+fi
 sed -i 's/^bind .*/bind 0.0.0.0/' /etc/valkey/valkey.conf
 
-PASS="$(openssl rand -base64 48 | tr -dc 'a-zA-Z0-9' | head -c32)"
+if [[ "$IS_ALPINE" == "1" ]]; then
+  PASS="$(head -c 100 /dev/urandom | tr -dc 'a-zA-Z0-9' | head -c32)"
+else
+  PASS="$(openssl rand -base64 48 | tr -dc 'a-zA-Z0-9' | head -c32)"
+fi
 echo "requirepass $PASS" >>/etc/valkey/valkey.conf
 echo "$PASS" >~/valkey.creds
 chmod 600 ~/valkey.creds
@@ -34,9 +45,12 @@ echo "maxmemory-policy allkeys-lru" >>/etc/valkey/valkey.conf
 echo "maxmemory-samples 10" >>/etc/valkey/valkey.conf
 msg_ok "Installed Valkey"
 
-echo
-read -r -p "${TAB3}Enable TLS for Valkey (Sentinel mode does not supported)? [y/N]: " prompt
-if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
+if [[ "$IS_ALPINE" == "1" ]]; then
+  msg_info "Skipping TLS (Alpine's valkey package is compiled without TLS support)"
+else
+  echo
+  read -r -p "${TAB3}Enable TLS for Valkey (Sentinel mode does not supported)? [y/N]: " prompt
+  if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
     read -r -p "${TAB3}Use TLS-only mode (disable TCP port 6379)? [y/N]: " tls_only
     msg_info "Configuring TLS for Valkey..."
 
@@ -47,7 +61,7 @@ if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
     chown valkey:valkey "$TLS_CERT" "$TLS_KEY"
 
     if [[ ${tls_only,,} =~ ^(y|yes)$ ]]; then
-        cat <<EOF >/etc/valkey/valkey.conf
+      cat <<EOF >>/etc/valkey/valkey.conf
 
 # TLS configuration generated by Proxmox VE Valkey helper-script
 port 0
@@ -56,9 +70,9 @@ tls-cert-file $TLS_DIR/valkey.crt
 tls-key-file $TLS_DIR/valkey.key
 tls-auth-clients no
 EOF
-        msg_ok "Enabled TLS-only mode on port 6379"
+      msg_ok "Enabled TLS-only mode on port 6379"
     else
-        cat <<EOF >/etc/valkey/valkey.conf
+      cat <<EOF >>/etc/valkey/valkey.conf
 
 # TLS configuration generated by Proxmox VE Valkey helper-script
 tls-port 6380
@@ -66,12 +80,18 @@ tls-cert-file $TLS_DIR/valkey.crt
 tls-key-file $TLS_DIR/valkey.key
 tls-auth-clients no
 EOF
-        msg_ok "Enabled TLS on port 6380 and TCP on 6379"
+      msg_ok "Enabled TLS on port 6380 and TCP on 6379"
     fi
+  fi
 fi
 
-systemctl enable -q --now valkey-server
-systemctl restart valkey-server
+if [[ "$IS_ALPINE" == "1" ]]; then
+  $STD rc-update add valkey default
+  $STD rc-service valkey start
+else
+  systemctl enable -q --now valkey-server
+  systemctl restart valkey-server
+fi
 
 motd_ssh
 customize