fix(fileflows): handle update API 401 and skip check on Node

Server installs check update-available without curl -f so 401 is handled with a clear message instead of aborting via catch_errors. Node installs skip the API and always run the zip update.

Fixes #14622

Co-authored-by: Cursor <cursoragent@cursor.com>

CHANGELOG.md

@@ -476,8 +476,15 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - kan: extend fetch_and_deploy_gh_tag to use 'latest' tag [@MickLesk](https://github.com/MickLesk) ([#14853](https://github.com/community-scripts/ProxmoxVE/pull/14853))
+    - Glance: preserve glance.yml across updates [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#14845](https://github.com/community-scripts/ProxmoxVE/pull/14845))
+    - NginxProxymanager: set Certbot version in npm.service environment variable (2.15.0) [@MickLesk](https://github.com/MickLesk) ([#14843](https://github.com/community-scripts/ProxmoxVE/pull/14843))
     - [FileFlows] Fix service handling by using systemctl --all with quoted glob [@adrianmusante](https://github.com/adrianmusante) ([#14838](https://github.com/community-scripts/ProxmoxVE/pull/14838))
 
+  - #### ✨ New Features
+
+    - Kometa: also update Quickstart in update_script [@MickLesk](https://github.com/MickLesk) ([#14529](https://github.com/community-scripts/ProxmoxVE/pull/14529))
+
 ## 2026-05-31
 
 ### 🚀 Updated Scripts

ct/fileflows.sh

@@ -31,28 +31,39 @@ function update_script() {
     exit
   fi
 
-  update_available=$(curl -fsSL -X 'GET' "http://localhost:19200/api/status/update-available" -H 'accept: application/json' | jq .UpdateAvailable)
-  if [[ "${update_available}" == "true" ]]; then
-    msg_info "Stopping Service"
-    systemctl --all stop 'fileflows*'
-    msg_info "Stopped Service"
-
-    msg_info "Creating Backup"
-    ls /opt/*.tar.gz &>/dev/null && rm -f /opt/*.tar.gz
-    backup_filename="/opt/${APP}_backup_$(date +%F).tar.gz"
-    tar -czf "$backup_filename" -C /opt/fileflows Data
-    msg_ok "Backup Created"
-
-    fetch_and_deploy_from_url "https://fileflows.com/downloads/zip" "/opt/fileflows"
-
-    msg_info "Starting Service"
-    systemctl --all start 'fileflows*'
-    msg_ok "Started Service"
-    msg_ok "Updated successfully!"
-  else
-    msg_ok "No update required. ${APP} is already at latest version"
+  if systemctl list-unit-files 'fileflows.service' --no-legend 2>/dev/null | grep -q '^fileflows\.service'; then
+    tmp=$(mktemp)
+    http_code=$(curl -sSL -X 'GET' "http://localhost:19200/api/status/update-available" -H 'accept: application/json' -o "$tmp" -w '%{http_code}' 2>/dev/null) || http_code="000"
+    if [[ "$http_code" == "401" ]]; then
+      rm -f "$tmp"
+      msg_error "Could not check for updates: API returned 401. Disable security in FileFlows."
+      exit
+    fi
+    update_available=$(jq -r '.UpdateAvailable // false' "$tmp" 2>/dev/null)
+    rm -f "$tmp"
+    if [[ "${update_available}" != "true" ]]; then
+      msg_ok "No update required. ${APP} is already at latest version"
+      exit
+    fi
   fi
 
+  msg_info "Stopping Service"
+  systemctl --all stop 'fileflows*'
+  msg_ok "Stopped Service"
+
+  msg_info "Creating Backup"
+  ls /opt/*.tar.gz &>/dev/null && rm -f /opt/*.tar.gz
+  backup_filename="/opt/${APP}_backup_$(date +%F).tar.gz"
+  tar -czf "$backup_filename" -C /opt/fileflows Data
+  msg_ok "Backup Created"
+
+  fetch_and_deploy_from_url "https://fileflows.com/downloads/zip" "/opt/fileflows"
+
+  msg_info "Starting Service"
+  systemctl --all start 'fileflows*'
+  msg_ok "Started Service"
+  msg_ok "Updated successfully!"
+
   exit
 }
 

ct/fireshare.sh

@@ -53,12 +53,6 @@ function update_script() {
     export VIDEO_DIRECTORY=/opt/fireshare-videos
     export PROCESSED_DIRECTORY=/opt/fireshare-processed
     $STD uv run flask db upgrade
-
-    msg_info "Building Fireshare Client"
-    cd /opt/fireshare/app/client
-    $STD npm install
-    $STD npm run build
-    msg_ok "Built Fireshare Client"
     msg_ok "Updated Fireshare"
 
     msg_info "Starting Service"

ct/glance.sh

@@ -34,8 +34,20 @@ function update_script() {
     systemctl stop glance
     msg_ok "Stopped Service"
 
+    if [[ -f /opt/glance/glance.yml ]]; then
+      msg_info "Backing up glance.yml"
+      cp /opt/glance/glance.yml /tmp/glance.yml.bak
+      msg_ok "Backed up glance.yml"
+    fi
+
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "glance" "glanceapp/glance" "prebuild" "latest" "/opt/glance" "glance-linux-amd64.tar.gz"
 
+    if [[ -f /tmp/glance.yml.bak ]]; then
+      msg_info "Restoring glance.yml"
+      mv /tmp/glance.yml.bak /opt/glance/glance.yml
+      msg_ok "Restored glance.yml"
+    fi
+
     msg_info "Starting Service"
     systemctl start glance
     msg_ok "Started Service"

ct/kan.sh

@@ -39,7 +39,7 @@ function update_script() {
     cp /opt/kan/.env /opt/kan.env.bak
     msg_ok "Backed up Data"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_tag "kan" "kanbn/kan" "tarball"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_tag "kan" "kanbn/kan" "latest"
 
     msg_info "Restoring Configuration"
     cp /opt/kan.env.bak /opt/kan/.env
@@ -49,8 +49,10 @@ function update_script() {
     msg_info "Building Application"
     cd /opt/kan
     set -a && source /opt/kan/.env && set +a
-    export NEXT_PUBLIC_USE_STANDALONE_OUTPUT=true CI=true
-    $STD pnpm install
+    export NEXT_PUBLIC_USE_STANDALONE_OUTPUT=true
+    $STD pnpm install --ignore-scripts
+    export CI=true
+    find /opt/kan/packages /opt/kan/apps -name 'tsconfig.json' -exec sed -i 's|"@kan/tsconfig/|"../../tooling/typescript/|g' {} +
     $STD pnpm build --filter=@kan/web
     unset NEXT_PUBLIC_USE_STANDALONE_OUTPUT CI
     msg_ok "Built Application"

ct/kometa.sh

@@ -32,6 +32,7 @@ function update_script() {
   if check_for_gh_release "kometa" "Kometa-Team/Kometa"; then
     msg_info "Stopping Service"
     systemctl stop kometa
+    [[ -d "/opt/kometa-quickstart" ]] && systemctl stop kometa-quickstart
     msg_ok "Stopped Service"
 
     msg_info "Backing up data"
@@ -42,7 +43,7 @@ function update_script() {
     fetch_and_deploy_gh_release "kometa" "Kometa-Team/Kometa" "tarball"
 
     msg_info "Updating Kometa"
-    cd /opt/kometa 
+    cd /opt/kometa
     $STD uv pip install -r requirements.txt --system
     mkdir -p config/assets
     cp /opt/config.yml config/config.yml
@@ -50,9 +51,28 @@ function update_script() {
 
     msg_info "Starting Service"
     systemctl start kometa
+    [[ -d "/opt/kometa-quickstart" ]] && systemctl start kometa-quickstart
     msg_ok "Started Service"
     msg_ok "Updated successfully!"
   fi
+
+  if [[ -d "/opt/kometa-quickstart" ]] && check_for_gh_release "kometa-quickstart" "Kometa-Team/Quickstart"; then
+    msg_info "Stopping Quickstart Service"
+    systemctl stop kometa-quickstart
+    msg_ok "Stopped Quickstart Service"
+
+    fetch_and_deploy_gh_release "kometa-quickstart" "Kometa-Team/Quickstart" "tarball"
+
+    msg_info "Updating Kometa Quickstart"
+    cd /opt/kometa-quickstart
+    $STD uv pip install -r requirements.txt -p /opt/kometa-quickstart/.venv/bin/python
+    msg_ok "Updated Kometa Quickstart"
+
+    msg_info "Starting Quickstart Service"
+    systemctl start kometa-quickstart
+    msg_ok "Started Quickstart Service"
+    msg_ok "Updated Quickstart successfully!"
+  fi
   exit
 }
 

ct/nginxproxymanager.sh

@@ -216,6 +216,12 @@ EOF
     msg_ok "Initialized Backend"
 
     msg_info "Starting Services"
+    CERTBOT_VER=$(/opt/certbot/bin/certbot --version 2>&1 | awk '{print $NF}')
+    if grep -q "Environment=CERTBOT_VERSION" /lib/systemd/system/npm.service; then
+      sed -i "s|Environment=CERTBOT_VERSION=.*|Environment=CERTBOT_VERSION=${CERTBOT_VER}|" /lib/systemd/system/npm.service
+    else
+      sed -i "/Environment=NODE_ENV=production/a Environment=CERTBOT_VERSION=${CERTBOT_VER}" /lib/systemd/system/npm.service
+    fi
     sed -i 's/user npm/user root/g; s/^pid/#pid/g' /usr/local/openresty/nginx/conf/nginx.conf
     sed -r -i 's/^([[:space:]]*)su npm npm/\1#su npm npm/g;' /etc/logrotate.d/nginx-proxy-manager
     systemctl daemon-reload

install/kan-install.sh

@@ -23,7 +23,7 @@ PG_VERSION="16" setup_postgresql
 PG_DB_NAME="kan" PG_DB_USER="kan" setup_postgresql_db
 NODE_VERSION="20" NODE_MODULE="pnpm" setup_nodejs
 
-fetch_and_deploy_gh_tag "kan" "kanbn/kan" "tarball"
+fetch_and_deploy_gh_tag "kan" "kanbn/kan" "latest"
 
 msg_info "Configuring Application"
 AUTH_SECRET=$(openssl rand -base64 32)
@@ -45,8 +45,9 @@ msg_info "Building Application"
 cd /opt/kan
 set -a && source /opt/kan/.env && set +a
 export NEXT_PUBLIC_USE_STANDALONE_OUTPUT=true NEXT_PUBLIC_BASE_URL BETTER_AUTH_TRUSTED_ORIGINS NEXT_PUBLIC_ALLOW_CREDENTIALS BETTER_AUTH_SECRET
+$STD pnpm install --ignore-scripts
 export CI=true
-$STD pnpm install
+find /opt/kan/packages /opt/kan/apps -name 'tsconfig.json' -exec sed -i 's|"@kan/tsconfig/|"../../tooling/typescript/|g' {} +
 $STD pnpm build --filter=@kan/web
 unset NEXT_PUBLIC_USE_STANDALONE_OUTPUT CI
 msg_ok "Built Application"

install/nginxproxymanager-install.sh

@@ -160,7 +160,8 @@ $STD yarn install --network-timeout 600000
 msg_ok "Initialized Backend"
 
 msg_info "Creating Service"
-cat <<'EOF' >/lib/systemd/system/npm.service
+CERTBOT_VER=$(/opt/certbot/bin/certbot --version 2>&1 | awk '{print $NF}')
+cat <<EOF >/lib/systemd/system/npm.service
 [Unit]
 Description=Nginx Proxy Manager
 After=network.target
@@ -169,6 +170,7 @@ Wants=openresty.service
 [Service]
 Type=simple
 Environment=NODE_ENV=production
+Environment=CERTBOT_VERSION=${CERTBOT_VER}
 ExecStartPre=-mkdir -p /tmp/nginx/body /data/letsencrypt-acme-challenge
 ExecStart=/usr/bin/node index.js --abort_on_uncaught_exception --max_old_space_size=250
 WorkingDirectory=/app