perf(tools.func, alpine-tools.func): replace direct /etc/os-release reads with get_os_info(), echo|tr with bash builtins, consolidate pipelines

- get_os_info(): single while-read replaces 4 awk subprocesses on first call
- manage_tool_repository(): 7 awk|tr pipelines → get_os_info() cached lookups
- setup_hwaccel(): 3 grep|tr pipelines → get_os_info()
- setup_java/mysql/php/postgresql/clickhouse(): 2 awk|tr pipelines each → get_os_info()
- 6× echo|tr -d ' ' → bash parameter expansion (${var// /})
- 3× mod=$(echo|tr) → bash ${mod//[[:space:]]/}
- npm/apt-cache/cargo pipelines: grep|awk|tr → single awk with gsub
- COMBINED_MODULES: echo|tr|awk|paste (4 proc) → single awk with RS
- download_with_progress: awk|tr → awk gsub (both tools.func and alpine-tools.func)

Eliminates ~30 subprocess forks across typical tool setup paths.

.github/workflows/update-script-timestamp-on-sh-change.yml

@@ -155,13 +155,21 @@ jobs:
                 console.log('Slug not in DB, skipping: ' + slug);
                 continue;
               }
+              const today = new Date().toISOString().split('T')[0];
+              const patchBody = {
+                script_updated: today,
+                last_update_commit: process.env.PR_URL || process.env.COMMIT_URL || ''
+              };
+              // When a dev script is merged into main, promote it to production
+              if (record.is_dev === true) {
+                patchBody.is_dev = false;
+                patchBody.script_created = today;
+                console.log('Promoting dev script to production: ' + slug);
+              }
               const patchRes = await request(recordsUrl + '/' + record.id, {
                 method: 'PATCH',
                 headers: { 'Authorization': token, 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                  script_updated: new Date().toISOString().split('T')[0],
-                  last_update_commit: process.env.PR_URL || process.env.COMMIT_URL || ''
-                })
+                body: JSON.stringify(patchBody)
               });
               if (!patchRes.ok) {
                 console.warn('PATCH failed for slug ' + slug + ': ' + patchRes.body);

CHANGELOG.md

@@ -426,12 +426,46 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-03-23
+
+### 🆕 New Scripts
+
+  - Alpine-Borgbackup-Server ([#13219](https://github.com/community-scripts/ProxmoxVE/pull/13219))
+
+### 🚀 Updated Scripts
+
+  - NginxProxyManager: build OpenResty from source via GitHub releases [@MickLesk](https://github.com/MickLesk) ([#13134](https://github.com/community-scripts/ProxmoxVE/pull/13134))
+
+  - #### ✨ New Features
+
+    - Kometa: optimize config.yml sed patterns, add Quickstart integration [@MickLesk](https://github.com/MickLesk) ([#13198](https://github.com/community-scripts/ProxmoxVE/pull/13198))
+
 ## 2026-03-22
 
 ### 🆕 New Scripts
 
   - versitygw ([#13180](https://github.com/community-scripts/ProxmoxVE/pull/13180))
 
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Adventurelog: pin DRF <3.15 to fix coreapi module removal [@MickLesk](https://github.com/MickLesk) ([#13194](https://github.com/community-scripts/ProxmoxVE/pull/13194))
+
+  - #### ✨ New Features
+
+    - ConvertX: add libreoffice-writer for ODT/document conversions [@MickLesk](https://github.com/MickLesk) ([#13196](https://github.com/community-scripts/ProxmoxVE/pull/13196))
+
+  - #### 🔧 Refactor
+
+    - iSponsorblockTV: add AVX CPU check before installation [@MickLesk](https://github.com/MickLesk) ([#13197](https://github.com/community-scripts/ProxmoxVE/pull/13197))
+
+### 💾 Core
+
+  - #### 🐞 Bug Fixes
+
+    - core: guard against empty IPv6 address in static mode [@MickLesk](https://github.com/MickLesk) ([#13195](https://github.com/community-scripts/ProxmoxVE/pull/13195))
+
 ## 2026-03-21
 
 ### 🚀 Updated Scripts

ct/adventurelog.sh

@@ -56,6 +56,7 @@ function update_script() {
     fi
     $STD .venv/bin/python -m pip install --upgrade pip
     $STD .venv/bin/python -m pip install -r requirements.txt
+    $STD .venv/bin/python -m pip install 'djangorestframework<3.15'
     $STD .venv/bin/python -m manage collectstatic --noinput
     $STD .venv/bin/python -m manage migrate
 

ct/alpine-borgbackup-server.sh

@@ -0,0 +1,107 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Sander Koenders (sanderkoenders)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.borgbackup.org/
+
+APP="Alpine-BorgBackup-Server"
+var_tags="${var_tags:-alpine;backup}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-1024}"
+var_disk="${var_disk:-20}"
+var_os="${var_os:-alpine}"
+var_version="${var_version:-3.23}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+
+  if [[ ! -f /usr/bin/borg ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  CHOICE=$(msg_menu "BorgBackup Server Update Options" \
+    "1" "Update BorgBackup Server" \
+    "2" "Reset SSH Access" \
+    "3" "Enable password authentication for backup user (not recommended, use SSH key instead)" \
+    "4" "Disable password authentication for backup user (recommended for security, use SSH key)")
+
+  case $CHOICE in
+  1)
+    msg_info "Updating $APP LXC"
+    $STD apk -U upgrade
+    msg_ok "Updated $APP LXC successfully!"
+    ;;
+  2)
+    if [[ "${PHS_SILENT:-0}" == "1" ]]; then
+      msg_warn "Reset SSH Public key requires interactive mode, skipping."
+      exit
+    fi
+
+    msg_info "Setting up SSH Public Key for backup user"
+
+    msg_info "Please paste your SSH public key (e.g., ssh-rsa AAAAB3... user@host): \n"
+    read -p "Key: " SSH_PUBLIC_KEY
+    echo
+
+    if [[ -z "$SSH_PUBLIC_KEY" ]]; then
+      msg_error "No SSH public key provided!"
+      exit 1
+    fi
+
+    if [[ ! "$SSH_PUBLIC_KEY" =~ ^(ssh-rsa|ssh-dss|ssh-ed25519|ecdsa-sha2-) ]]; then
+      msg_error "Invalid SSH public key format!"
+      exit 1
+    fi
+
+    msg_info "Setting up SSH access"
+    mkdir -p /home/backup/.ssh
+    echo "$SSH_PUBLIC_KEY" >/home/backup/.ssh/authorized_keys
+
+    chown -R backup:backup /home/backup/.ssh
+    chmod 700 /home/backup/.ssh
+    chmod 600 /home/backup/.ssh/authorized_keys
+
+    msg_ok "SSH access configured for backup user"
+    ;;
+  3)
+    if [[ "${PHS_SILENT:-0}" == "1" ]]; then
+      msg_warn "Enabling password authentication requires interactive mode, skipping."
+      exit
+    fi
+
+    msg_info "Enabling password authentication for backup user"
+    msg_warn "Password authentication is less secure than using SSH keys. Consider using SSH keys instead."
+    passwd backup
+    sed -i 's/^#*\s*PasswordAuthentication\s\+\(yes\|no\)/PasswordAuthentication yes/' /etc/ssh/sshd_config
+    rc-service sshd restart
+    msg_ok "Password authentication enabled for backup user"
+    ;;
+  4)
+    msg_info "Disabling password authentication for backup user"
+    sed -i 's/^#*\s*PasswordAuthentication\s\+\(yes\|no\)/PasswordAuthentication no/' /etc/ssh/sshd_config
+    rc-service sshd restart
+    msg_ok "Password authentication disabled for backup user"
+    ;;
+  esac
+
+  exit 0
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Connection information:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}ssh backup@${IP}${CL}"
+echo -e "${TAB}${VERIFYPW}${YW}To set SSH key, run this script with the 'update' option and select option 2${CL}"

ct/convertx.sh

@@ -24,7 +24,7 @@ function update_script() {
   header_info
   check_container_storage
   check_container_resources
-  if [[ ! -d /var ]]; then
+  if [[ ! -d /opt/convertx ]]; then
     msg_error "No ${APP} Installation Found!"
     exit
   fi
@@ -33,6 +33,8 @@ function update_script() {
     systemctl stop convertx
     msg_info "Stopped Service"
 
+    ensure_dependencies libreoffice-writer
+
     msg_info "Move data-Folder"
     if [[ -d /opt/convertx/data ]]; then
       mv /opt/convertx/data /opt/data

ct/headers/alpine-borgbackup-server

@@ -0,0 +1,6 @@
+    ___    __      _                  ____                   ____             __                    _____                          
+   /   |  / /___  (_)___  ___        / __ )____  _________ _/ __ )____ ______/ /____  ______       / ___/___  ______   _____  _____
+  / /| | / / __ \/ / __ \/ _ \______/ __  / __ \/ ___/ __ `/ __  / __ `/ ___/ //_/ / / / __ \______\__ \/ _ \/ ___/ | / / _ \/ ___/
+ / ___ |/ / /_/ / / / / /  __/_____/ /_/ / /_/ / /  / /_/ / /_/ / /_/ / /__/ ,< / /_/ / /_/ /_____/__/ /  __/ /   | |/ /  __/ /    
+/_/  |_/_/ .___/_/_/ /_/\___/     /_____/\____/_/   \__, /_____/\__,_/\___/_/|_|\__,_/ .___/     /____/\___/_/    |___/\___/_/     
+        /_/                                        /____/                           /_/                                            

ct/kometa.sh

@@ -61,5 +61,5 @@ description
 
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access the LXC at following IP address:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}${IP}${CL}"
+echo -e "${INFO}${YW} Access Kometa Quickstart:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:7171${CL}"

ct/nginxproxymanager.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
 # Copyright (c) 2021-2026 community-scripts ORG
-# Author: tteck (tteckster) | Co-Author: CrazyWolf13
+# Author: tteck (tteckster) | Co-Author: CrazyWolf13, MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://nginxproxymanager.com/ | Github: https://github.com/NginxProxyManager/nginx-proxy-manager
 
@@ -38,8 +38,8 @@ function update_script() {
     CURRENT_NODE_VERSION=$(node --version | cut -d'v' -f2 | cut -d'.' -f1)
     if [[ "$CURRENT_NODE_VERSION" != "22" ]]; then
       systemctl stop openresty
-      apt-get purge -y nodejs npm
-      apt-get autoremove -y
+      $STD apt purge -y nodejs npm
+      $STD apt autoremove -y
       rm -rf /usr/local/bin/node /usr/local/bin/npm
       rm -rf /usr/local/lib/node_modules
       rm -rf ~/.npm
@@ -49,12 +49,10 @@ function update_script() {
 
   NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
 
-  RELEASE=$(curl -fsSL https://api.github.com/repos/NginxProxyManager/nginx-proxy-manager/releases/latest |
-    grep "tag_name" |
-    awk '{print substr($2, 3, length($2)-4) }')
+  RELEASE=$(get_latest_github_release "NginxProxyManager/nginx-proxy-manager")
 
   CLEAN_INSTALL=1 fetch_and_deploy_gh_release "nginxproxymanager" "NginxProxyManager/nginx-proxy-manager" "tarball" "v${RELEASE}" "/opt/nginxproxymanager"
-  
+
   msg_info "Stopping Services"
   systemctl stop openresty
   systemctl stop npm
@@ -69,12 +67,62 @@ function update_script() {
     /var/cache/nginx
   msg_ok "Cleaned old files"
 
+  msg_info "Migrating to OpenResty from source"
+  rm -f /etc/apt/trusted.gpg.d/openresty-archive-keyring.gpg /etc/apt/trusted.gpg.d/openresty.gpg
+  rm -f /etc/apt/sources.list.d/openresty.list /etc/apt/sources.list.d/openresty.sources
+  if dpkg -l openresty &>/dev/null; then
+    $STD apt remove -y openresty
+    $STD apt autoremove -y
+  fi
+  local pcre_pkg="libpcre3-dev"
+  if grep -qE 'VERSION_ID="1[3-9]"' /etc/os-release 2>/dev/null; then
+    pcre_pkg="libpcre2-dev"
+  fi
+  $STD apt install -y build-essential "$pcre_pkg" libssl-dev zlib1g-dev
+  msg_ok "Migrated to OpenResty from source"
+
+  CLEAN_INSTALL=1 fetch_and_deploy_gh_release "openresty" "openresty/openresty" "prebuild" "latest" "/opt/openresty" "openresty-*.tar.gz"
+
+  if [[ -d /opt/openresty ]]; then
+    msg_info "Building OpenResty"
+    cd /opt/openresty
+    $STD ./configure \
+      --with-http_v2_module \
+      --with-http_realip_module \
+      --with-http_stub_status_module \
+      --with-http_ssl_module \
+      --with-http_sub_module \
+      --with-http_auth_request_module \
+      --with-pcre-jit \
+      --with-stream \
+      --with-stream_ssl_module
+    $STD make -j"$(nproc)"
+    $STD make install
+    rm -rf /opt/openresty
+    cat <<'EOF' >/lib/systemd/system/openresty.service
+[Unit]
+Description=The OpenResty Application Platform
+After=syslog.target network-online.target remote-fs.target nss-lookup.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStartPre=/usr/local/openresty/nginx/sbin/nginx -t
+ExecStart=/usr/local/openresty/nginx/sbin/nginx -g 'daemon off;'
+
+[Install]
+WantedBy=multi-user.target
+EOF
+    systemctl daemon-reload
+    msg_ok "Built OpenResty"
+  fi
+
   msg_info "Setting up Environment"
   ln -sf /usr/bin/python3 /usr/bin/python
   ln -sf /usr/local/openresty/nginx/sbin/nginx /usr/sbin/nginx
   ln -sf /usr/local/openresty/nginx/ /etc/nginx
-  sed -i "s|\"version\": \"2.0.0\"|\"version\": \"$RELEASE\"|" /opt/nginxproxymanager/backend/package.json
-  sed -i "s|\"version\": \"2.0.0\"|\"version\": \"$RELEASE\"|" /opt/nginxproxymanager/frontend/package.json
+  sed -i "0,/\"version\": \"[^\"]*\"/s|\"version\": \"[^\"]*\"|\"version\": \"$RELEASE\"|" /opt/nginxproxymanager/backend/package.json
+  sed -i "0,/\"version\": \"[^\"]*\"/s|\"version\": \"[^\"]*\"|\"version\": \"$RELEASE\"|" /opt/nginxproxymanager/frontend/package.json
   sed -i 's+^daemon+#daemon+g' /opt/nginxproxymanager/docker/rootfs/etc/nginx/nginx.conf
   NGINX_CONFS=$(find /opt/nginxproxymanager -type f -name "*.conf")
   for NGINX_CONF in $NGINX_CONFS; do
@@ -150,23 +198,11 @@ function update_script() {
 EOF
   fi
   sed -i 's/"client": "sqlite3"/"client": "better-sqlite3"/' /app/config/production.json
-  cd /app 
+  cd /app
   $STD yarn install --network-timeout 600000
   msg_ok "Initialized Backend"
 
   msg_info "Updating Certbot"
-  [ -f /etc/apt/trusted.gpg.d/openresty-archive-keyring.gpg ] && rm -f /etc/apt/trusted.gpg.d/openresty-archive-keyring.gpg
-  [ -f /etc/apt/sources.list.d/openresty.list ] && rm -f /etc/apt/sources.list.d/openresty.list
-  [ ! -f /etc/apt/trusted.gpg.d/openresty.gpg ] && curl -fsSL https://openresty.org/package/pubkey.gpg | gpg --dearmor --yes -o /etc/apt/trusted.gpg.d/openresty.gpg
-  [ ! -f /etc/apt/sources.list.d/openresty.sources ] && cat <<'EOF' >/etc/apt/sources.list.d/openresty.sources
-Types: deb
-URIs: http://openresty.org/package/debian/
-Suites: bookworm
-Components: openresty
-Signed-By: /etc/apt/trusted.gpg.d/openresty.gpg
-EOF
-  $STD apt update
-  $STD apt -y install openresty
   if [ -d /opt/certbot ]; then
     $STD /opt/certbot/bin/pip install --upgrade pip setuptools wheel
     $STD /opt/certbot/bin/pip install --upgrade certbot certbot-dns-cloudflare
@@ -176,9 +212,9 @@ EOF
   msg_info "Starting Services"
   sed -i 's/user npm/user root/g; s/^pid/#pid/g' /usr/local/openresty/nginx/conf/nginx.conf
   sed -r -i 's/^([[:space:]]*)su npm npm/\1#su npm npm/g;' /etc/logrotate.d/nginx-proxy-manager
+  systemctl daemon-reload
   systemctl enable -q --now openresty
   systemctl enable -q --now npm
-  systemctl restart openresty
   msg_ok "Started Services"
 
   msg_ok "Updated successfully!"

install/adventurelog-install.sh

@@ -62,6 +62,7 @@ $STD uv venv --clear /opt/adventurelog/backend/server/.venv
 $STD /opt/adventurelog/backend/server/.venv/bin/python -m ensurepip --upgrade
 $STD /opt/adventurelog/backend/server/.venv/bin/python -m pip install --upgrade pip
 $STD /opt/adventurelog/backend/server/.venv/bin/python -m pip install -r requirements.txt
+$STD /opt/adventurelog/backend/server/.venv/bin/python -m pip install 'djangorestframework<3.15'
 $STD /opt/adventurelog/backend/server/.venv/bin/python -m manage collectstatic --noinput
 $STD /opt/adventurelog/backend/server/.venv/bin/python -m manage migrate
 $STD /opt/adventurelog/backend/server/.venv/bin/python -m manage download-countries

install/alpine-borgbackup-server-install.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Sander Koenders (sanderkoenders)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.borgbackup.org/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing BorgBackup"
+$STD apk add --no-cache borgbackup openssh
+$STD rc-update add sshd
+$STD rc-service sshd start
+msg_ok "Installed BorgBackup"
+
+msg_info "Creating backup user"
+$STD adduser -D -s /bin/bash -h /home/backup backup
+$STD passwd -d backup
+msg_ok "Created backup user"
+
+msg_info "Configure SSH, disabling password authentication and enabling public key authentication"
+$STD sed -i -e 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
+$STD rc-service sshd restart
+msg_ok "Configured SSH"
+
+motd_ssh
+customize
+cleanup_lxc

install/convertx-install.sh

@@ -24,6 +24,7 @@ $STD apt install -y \
   dvisvgm \
   ffmpeg \
   inkscape \
+  libreoffice-writer \
   libva2 \
   libvips-tools \
   lmodern \

install/isponsorblocktv-install.sh

@@ -13,6 +13,11 @@ setting_up_container
 network_check
 update_os
 
+if ! grep -q ' avx ' /proc/cpuinfo 2>/dev/null; then
+  msg_error "CPU does not support AVX instructions (required by iSponsorBlockTV/PyApp)"
+  exit 106
+fi
+
 fetch_and_deploy_gh_release "isponsorblocktv" "dmunozv04/iSponsorBlockTV" "singlefile" "latest" "/opt/isponsorblocktv" "iSponsorBlockTV-x86_64-linux"
 
 msg_info "Setting up iSponsorBlockTV"

install/kometa-install.sh

@@ -23,12 +23,20 @@ mkdir -p config/assets
 cp config/config.yml.template config/config.yml
 msg_ok "Setup Kometa"
 
-read -p "${TAB3}Enter your TMDb API key: " TMDBKEY
-read -p "${TAB3}Enter your Plex URL: " PLEXURL
-read -p "${TAB3}Enter your Plex token: " PLEXTOKEN
-sed -i -e "s#url: http://192.168.1.12:32400#url: $PLEXURL #g" /opt/kometa/config/config.yml
-sed -i -e "s/token: ####################/token: $PLEXTOKEN/g" /opt/kometa/config/config.yml
-sed -i -e "s/apikey: ################################/apikey: $TMDBKEY/g" /opt/kometa/config/config.yml
+read -r -p "${TAB3}Enter your TMDb API key: " TMDBKEY
+read -r -p "${TAB3}Enter your Plex URL: " PLEXURL
+read -r -p "${TAB3}Enter your Plex token: " PLEXTOKEN
+sed -i '/^plex:/,/^[^ ]/{s|  url:.*|  url: '"$PLEXURL"'|}' /opt/kometa/config/config.yml
+sed -i '/^plex:/,/^[^ ]/{s|  token:.*|  token: '"$PLEXTOKEN"'|}' /opt/kometa/config/config.yml
+sed -i '/^tmdb:/,/^[^ ]/{s|  apikey:.*|  apikey: '"$TMDBKEY"'|}' /opt/kometa/config/config.yml
+
+fetch_and_deploy_gh_release "kometa-quickstart" "Kometa-Team/Quickstart" "tarball"
+
+msg_info "Installing Kometa Quickstart"
+cd /opt/kometa-quickstart
+$STD uv venv /opt/kometa-quickstart/.venv
+$STD /opt/kometa-quickstart/.venv/bin/python -m pip install -r requirements.txt
+msg_ok "Installed Kometa Quickstart"
 
 msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/kometa.service
@@ -46,7 +54,22 @@ RestartSec=30
 [Install]
 WantedBy=multi-user.target
 EOF
-systemctl enable -q --now kometa
+cat <<EOF >/etc/systemd/system/kometa-quickstart.service
+[Unit]
+Description=Kometa Quickstart
+After=network-online.target
+
+[Service]
+Type=simple
+WorkingDirectory=/opt/kometa-quickstart
+ExecStart=/opt/kometa-quickstart/.venv/bin/python quickstart.py
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now kometa kometa-quickstart
 msg_ok "Created Service"
 
 motd_ssh

install/nginxproxymanager-install.sh

@@ -14,23 +14,20 @@ network_check
 update_os
 
 msg_info "Installing Dependencies"
-$STD apt update
-$STD apt -y install \
-  ca-certificates \
+$STD apt install -y \
   apache2-utils \
   logrotate \
   build-essential \
-  git
-msg_ok "Installed Dependencies"
-
-msg_info "Installing Python Dependencies"
-$STD apt install -y \
+  libpcre3-dev \
+  libssl-dev \
+  zlib1g-dev \
+  git \
   python3 \
   python3-dev \
   python3-pip \
   python3-venv \
   python3-cffi
-msg_ok "Installed Python Dependencies"
+msg_ok "Installed Dependencies"
 
 msg_info "Setting up Certbot"
 $STD python3 -m venv /opt/certbot
@@ -39,33 +36,50 @@ $STD /opt/certbot/bin/pip install certbot certbot-dns-cloudflare
 ln -sf /opt/certbot/bin/certbot /usr/local/bin/certbot
 msg_ok "Set up Certbot"
 
-msg_info "Installing Openresty"
-curl -fsSL "https://openresty.org/package/pubkey.gpg" | gpg --dearmor -o /etc/apt/trusted.gpg.d/openresty.gpg
-cat <<'EOF' >/etc/apt/sources.list.d/openresty.sources
-Types: deb
-URIs: http://openresty.org/package/debian/
-Suites: bookworm
-Components: openresty
-Signed-By: /etc/apt/trusted.gpg.d/openresty.gpg
+fetch_and_deploy_gh_release "openresty" "openresty/openresty" "prebuild" "latest" "/opt/openresty" "openresty-*.tar.gz"
+
+msg_info "Building OpenResty"
+cd /opt/openresty
+$STD ./configure \
+  --with-http_v2_module \
+  --with-http_realip_module \
+  --with-http_stub_status_module \
+  --with-http_ssl_module \
+  --with-http_sub_module \
+  --with-http_auth_request_module \
+  --with-pcre-jit \
+  --with-stream \
+  --with-stream_ssl_module
+$STD make -j"$(nproc)"
+$STD make install
+rm -rf /opt/openresty
+
+cat <<'EOF' >/lib/systemd/system/openresty.service
+[Unit]
+Description=The OpenResty Application Platform
+After=syslog.target network-online.target remote-fs.target nss-lookup.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStartPre=/usr/local/openresty/nginx/sbin/nginx -t
+ExecStart=/usr/local/openresty/nginx/sbin/nginx -g 'daemon off;'
+
+[Install]
+WantedBy=multi-user.target
 EOF
-$STD apt update
-$STD apt -y install openresty
-msg_ok "Installed Openresty"
+msg_ok "Built OpenResty"
 
 NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
-
-RELEASE=$(curl -fsSL https://api.github.com/repos/NginxProxyManager/nginx-proxy-manager/releases/latest |
-  grep "tag_name" |
-  awk '{print substr($2, 3, length($2)-4) }')
-
+RELEASE=$(get_latest_github_release "NginxProxyManager/nginx-proxy-manager")
 fetch_and_deploy_gh_release "nginxproxymanager" "NginxProxyManager/nginx-proxy-manager" "tarball" "v${RELEASE}"
 
 msg_info "Setting up Environment"
 ln -sf /usr/bin/python3 /usr/bin/python
 ln -sf /usr/local/openresty/nginx/sbin/nginx /usr/sbin/nginx
 ln -sf /usr/local/openresty/nginx/ /etc/nginx
-sed -i "s|\"version\": \"2.0.0\"|\"version\": \"$RELEASE\"|" /opt/nginxproxymanager/backend/package.json
-sed -i "s|\"version\": \"2.0.0\"|\"version\": \"$RELEASE\"|" /opt/nginxproxymanager/frontend/package.json
+sed -i "0,/\"version\": \"[^\"]*\"/s|\"version\": \"[^\"]*\"|\"version\": \"$RELEASE\"|" /opt/nginxproxymanager/backend/package.json
+sed -i "0,/\"version\": \"[^\"]*\"/s|\"version\": \"[^\"]*\"|\"version\": \"$RELEASE\"|" /opt/nginxproxymanager/frontend/package.json
 sed -i 's+^daemon+#daemon+g' /opt/nginxproxymanager/docker/rootfs/etc/nginx/nginx.conf
 NGINX_CONFS=$(find /opt/nginxproxymanager -type f -name "*.conf")
 for NGINX_CONF in $NGINX_CONFS; do
@@ -169,7 +183,6 @@ sed -i 's/user npm/user root/g; s/^pid/#pid/g' /usr/local/openresty/nginx/conf/n
 sed -r -i 's/^([[:space:]]*)su npm npm/\1#su npm npm/g;' /etc/logrotate.d/nginx-proxy-manager
 systemctl enable -q --now openresty
 systemctl enable -q --now npm
-systemctl restart openresty
 msg_ok "Started Services"
 
 motd_ssh

misc/alpine-install.func

@@ -67,22 +67,22 @@ EOF
 # This function sets up the Container OS by generating the locale, setting the timezone, and checking the network connection
 setting_up_container() {
   msg_info "Setting up Container OS"
+  local _ip=""
   while [ $i -gt 0 ]; do
-    if [ "$(ip addr show | grep 'inet ' | grep -v '127.0.0.1' | awk '{print $2}' | cut -d'/' -f1)" != "" ]; then
-      break
-    fi
+    _ip=$(ip -4 addr show 2>/dev/null | awk '/inet [0-9]/ && !/127\.0\.0\.1/ {sub(/\/.*/, "", $2); print $2; exit}')
+    [[ -n "$_ip" ]] && break
     echo 1>&2 -en "${CROSS}${RD} No Network! "
     sleep $RETRY_EVERY
     i=$((i - 1))
   done
 
-  if [ "$(ip addr show | grep 'inet ' | grep -v '127.0.0.1' | awk '{print $2}' | cut -d'/' -f1)" = "" ]; then
+  if [[ -z "$_ip" ]]; then
     echo 1>&2 -e "\n${CROSS}${RD} No Network After $RETRY_NUM Tries${CL}"
     echo -e "${NETWORK}Check Network Settings"
     exit 121
   fi
   msg_ok "Set up Container OS"
-  msg_ok "Network Connected: ${BL}$(ip addr show | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1 | tail -n1)${CL}"
+  msg_ok "Network Connected: ${BL}${_ip}${CL}"
   post_progress_to_api
 }
 

misc/alpine-tools.func

@@ -53,7 +53,7 @@ download_with_progress() {
   # $1 url, $2 dest
   local url="$1" out="$2" cl
   need_tool curl pv || return 1
-  cl=$(curl -fsSLI "$url" 2>/dev/null | awk 'tolower($0) ~ /^content-length:/ {print $2}' | tr -d '\r')
+  cl=$(curl -fsSLI "$url" 2>/dev/null | awk 'tolower($0) ~ /^content-length:/ {gsub(/\r/,""); print $2}')
   if [ -n "$cl" ]; then
     curl -fsSL "$url" | pv -s "$cl" >"$out" || {
       msg_error "Download failed: $url"

misc/api.func

@@ -348,10 +348,10 @@ explain_exit_code() {
 json_escape() {
   # Escape a string for safe JSON embedding using awk (handles any input size).
   # Pipeline: strip ANSI → remove control chars → escape \ " TAB → join lines with \n
-  printf '%s' "$1" \
-    | sed 's/\x1b\[[0-9;]*[a-zA-Z]//g' \
-    | tr -d '\000-\010\013\014\016-\037\177\r' \
-    | awk '
+  printf '%s' "$1" |
+    sed 's/\x1b\[[0-9;]*[a-zA-Z]//g' |
+    tr -d '\000-\010\013\014\016-\037\177\r' |
+    awk '
         BEGIN { ORS = "" }
         {
           gsub(/\\/, "\\\\")   # backslash → \\
@@ -401,7 +401,7 @@ get_error_text() {
   fi
 
   if [[ -n "$logfile" && -s "$logfile" ]]; then
-    tail -n 20 "$logfile" 2>/dev/null | sed 's/\r$//' | sed 's/\x1b\[[0-9;]*[a-zA-Z]//g'
+    tail -n 20 "$logfile" 2>/dev/null | sed -E 's/\r$//; s/\x1b\[[0-9;]*[a-zA-Z]//g'
   fi
 }
 
@@ -508,7 +508,8 @@ detect_gpu() {
 
   if [[ -n "$gpu_line" ]]; then
     # Extract model: everything after the colon, clean up
-    GPU_MODEL=$(echo "$gpu_line" | sed 's/.*: //' | sed 's/ (rev .*)$//' | cut -c1-64)
+    GPU_MODEL=$(echo "$gpu_line" | sed -E 's/.*: //; s/ \(rev .*\)$//')
+    GPU_MODEL="${GPU_MODEL:0:64}"
 
     # Detect vendor and passthrough type
     if echo "$gpu_line" | grep -qi "Intel"; then
@@ -557,7 +558,8 @@ detect_cpu() {
     esac
 
     # Extract model name and clean it up
-    CPU_MODEL=$(grep -m1 "model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2 | sed 's/^ *//' | sed 's/(R)//g' | sed 's/(TM)//g' | sed 's/  */ /g' | cut -c1-64)
+    CPU_MODEL=$(grep -m1 "model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2 | sed -E 's/^ *//; s/\(R\)//g; s/\(TM\)//g; s/  +/ /g')
+    CPU_MODEL="${CPU_MODEL:0:64}"
   fi
 
   export CPU_VENDOR CPU_MODEL
@@ -1325,11 +1327,16 @@ post_addon_to_api() {
     error_category=$(categorize_error "$exit_code")
   fi
 
-  # Detect OS info
+  # Detect OS info (single read)
   local os_type="" os_version=""
   if [[ -f /etc/os-release ]]; then
-    os_type=$(grep "^ID=" /etc/os-release | cut -d= -f2 | tr -d '"')
-    os_version=$(grep "^VERSION_ID=" /etc/os-release | cut -d= -f2 | tr -d '"')
+    while IFS='=' read -r _k _v; do
+      _v="${_v//\"/}"
+      case "$_k" in
+      ID) os_type="$_v" ;;
+      VERSION_ID) os_version="$_v" ;;
+      esac
+    done </etc/os-release
   fi
 
   local JSON_PAYLOAD

misc/core.func

@@ -1644,7 +1644,7 @@ function get_lxc_ip() {
       local ip
 
       # Try direct interface lookup for eth0 FIRST (most reliable for LXC) - IPv4
-      ip=$(ip -4 addr show eth0 2>/dev/null | awk '/inet / {print $2}' | cut -d/ -f1 | head -n1)
+      ip=$(ip -4 addr show eth0 2>/dev/null | awk '/inet / {sub(/\/.*/, "", $2); print $2; exit}')
       if [[ -n "$ip" && "$ip" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
         echo "$ip"
         return 0
@@ -1652,11 +1652,14 @@ function get_lxc_ip() {
 
       # Fallback: Try hostname -I (returns IPv4 first if available)
       if command -v hostname >/dev/null 2>&1; then
-        ip=$(hostname -I 2>/dev/null | awk '{print $1}')
-        if [[ -n "$ip" && "$ip" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-          echo "$ip"
-          return 0
-        fi
+        local -a _ips
+        read -ra _ips <<<"$(hostname -I 2>/dev/null)"
+        for ip in "${_ips[@]}"; do
+          if [[ "$ip" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "$ip"
+            return 0
+          fi
+        done
       fi
 
       # Try routing table with IPv4 targets
@@ -1674,7 +1677,7 @@ function get_lxc_ip() {
       done
 
       # IPv6 fallback: Try direct interface lookup for eth0
-      ip=$(ip -6 addr show eth0 scope global 2>/dev/null | awk '/inet6 / {print $2}' | cut -d/ -f1 | head -n1)
+      ip=$(ip -6 addr show eth0 scope global 2>/dev/null | awk '/inet6 / {sub(/\/.*/, "", $2); print $2; exit}')
       if [[ -n "$ip" && "$ip" =~ : ]]; then
         echo "$ip"
         return 0
@@ -1682,11 +1685,14 @@ function get_lxc_ip() {
 
       # IPv6 fallback: Try hostname -I for IPv6
       if command -v hostname >/dev/null 2>&1; then
-        ip=$(hostname -I 2>/dev/null | tr ' ' '\n' | grep -E ':' | head -n1)
-        if [[ -n "$ip" && "$ip" =~ : ]]; then
-          echo "$ip"
-          return 0
-        fi
+        local -a _ips6
+        read -ra _ips6 <<<"$(hostname -I 2>/dev/null)"
+        for ip in "${_ips6[@]}"; do
+          [[ "$ip" == *:* ]] && {
+            echo "$ip"
+            return 0
+          }
+        done
       fi
 
       # IPv6 fallback: Use routing table with IPv6 targets

misc/install.func

@@ -116,14 +116,14 @@ setting_up_container() {
     (chown root:root / 2>/dev/null) || true
   fi
 
+  local _host_ip=""
   for ((i = RETRY_NUM; i > 0; i--)); do
-    if [ "$(hostname -I)" != "" ]; then
-      break
-    fi
+    _host_ip=$(hostname -I 2>/dev/null | awk '{print $1}')
+    [[ -n "$_host_ip" ]] && break
     echo 1>&2 -en "${CROSS}${RD} No Network! "
     sleep $RETRY_EVERY
   done
-  if [ "$(hostname -I)" = "" ]; then
+  if [[ -z "$_host_ip" ]]; then
     echo 1>&2 -e "\n${CROSS}${RD} No Network After $RETRY_NUM Tries${CL}"
     echo -e "${NETWORK}Check Network Settings"
     exit 121
@@ -131,8 +131,7 @@ setting_up_container() {
   rm -rf /usr/lib/python3.*/EXTERNALLY-MANAGED
   systemctl disable -q --now systemd-networkd-wait-online.service
   msg_ok "Set up Container OS"
-  #msg_custom "${CM}" "${GN}" "Network Connected: ${BL}$(hostname -I)"
-  msg_ok "Network Connected: ${BL}$(hostname -I)"
+  msg_ok "Network Connected: ${BL}${_host_ip}"
   post_progress_to_api
 }
 

misc/tools.func

@@ -700,7 +700,7 @@ manage_tool_repository() {
   local gpg_key_url="${4:-}"
   local distro_id repo_component suite
 
-  distro_id=$(awk -F= '/^ID=/{print $2}' /etc/os-release | tr -d '"')
+  distro_id=$(get_os_info id)
 
   case "$tool_name" in
   mariadb)
@@ -714,7 +714,7 @@ manage_tool_repository() {
 
     # Get suite for fallback handling
     local distro_codename
-    distro_codename=$(awk -F= '/^VERSION_CODENAME=/{print $2}' /etc/os-release)
+    distro_codename=$(get_os_info codename)
     suite=$(get_fallback_suite "$distro_id" "$distro_codename" "$repo_url/$distro_id")
 
     # Setup new repository using deb822 format
@@ -745,7 +745,7 @@ manage_tool_repository() {
 
     # Setup repository
     local distro_codename
-    distro_codename=$(awk -F= '/^VERSION_CODENAME=/{print $2}' /etc/os-release)
+    distro_codename=$(get_os_info codename)
 
     # Suite mapping with fallback for newer releases not yet supported by upstream
     if [[ "$distro_id" == "debian" ]]; then
@@ -816,7 +816,7 @@ EOF
 
     # NodeSource uses deb822 format with GPG from repo
     local distro_codename
-    distro_codename=$(awk -F= '/^VERSION_CODENAME=/{print $2}' /etc/os-release)
+    distro_codename=$(get_os_info codename)
 
     # Download GPG key from NodeSource with retry logic
     if ! download_gpg_key "$gpg_key_url" "/etc/apt/keyrings/nodesource.gpg" "dearmor"; then
@@ -858,7 +858,7 @@ EOF
 
     # Setup repository
     local distro_codename
-    distro_codename=$(awk -F= '/^VERSION_CODENAME=/{print $2}' /etc/os-release)
+    distro_codename=$(get_os_info codename)
     cat <<EOF >/etc/apt/sources.list.d/php.sources
 Types: deb
 URIs: https://packages.sury.org/php
@@ -886,7 +886,7 @@ EOF
 
     # Setup repository
     local distro_codename
-    distro_codename=$(awk -F= '/^VERSION_CODENAME=/{print $2}' /etc/os-release)
+    distro_codename=$(get_os_info codename)
     cat <<EOF >/etc/apt/sources.list.d/postgresql.sources
 Types: deb
 URIs: http://apt.postgresql.org/pub/repos/apt
@@ -1323,10 +1323,16 @@ get_os_info() {
 
   # Cache OS info to avoid repeated file reads
   if [[ -z "${_OS_ID:-}" ]]; then
-    export _OS_ID=$(awk -F= '/^ID=/{gsub(/"/,"",$2); print $2}' /etc/os-release)
-    export _OS_CODENAME=$(awk -F= '/^VERSION_CODENAME=/{gsub(/"/,"",$2); print $2}' /etc/os-release)
-    export _OS_VERSION=$(awk -F= '/^VERSION_ID=/{gsub(/"/,"",$2); print $2}' /etc/os-release)
-    export _OS_VERSION_FULL=$(awk -F= '/^VERSION=/{gsub(/"/,"",$2); print $2}' /etc/os-release)
+    local _line
+    while IFS='=' read -r _key _val; do
+      _val="${_val//\"/}"
+      case "$_key" in
+      ID) export _OS_ID="$_val" ;;
+      VERSION_CODENAME) export _OS_CODENAME="$_val" ;;
+      VERSION_ID) export _OS_VERSION="$_val" ;;
+      VERSION) export _OS_VERSION_FULL="$_val" ;;
+      esac
+    done </etc/os-release
   fi
 
   case "$field" in
@@ -2144,8 +2150,8 @@ fetch_and_deploy_gh_tag() {
   local repo="$2"
   local version="${3:-latest}"
   local target="${4:-/opt/$app}"
-  local app_lc=""
-  app_lc="$(echo "${app,,}" | tr -d ' ')"
+  local app_lc="${app,,}"
+  app_lc="${app_lc// /}"
   local version_file="$HOME/.${app_lc}"
 
   if [[ "$version" == "latest" ]]; then
@@ -2221,8 +2227,8 @@ check_for_gh_tag() {
   local app="$1"
   local repo="$2"
   local prefix="${3:-}"
-  local app_lc=""
-  app_lc="$(echo "${app,,}" | tr -d ' ')"
+  local app_lc="${app,,}"
+  app_lc="${app_lc// /}"
   local current_file="$HOME/.${app_lc}"
 
   msg_info "Checking for update: ${app}"
@@ -2272,8 +2278,8 @@ check_for_gh_release() {
   local source="$2"
   local pinned_version_in="${3:-}" # optional
   local pin_reason="${4:-}"        # optional reason shown to user
-  local app_lc=""
-  app_lc="$(echo "${app,,}" | tr -d ' ')"
+  local app_lc="${app,,}"
+  app_lc="${app_lc// /}"
   local current_file="$HOME/.${app_lc}"
 
   msg_info "Checking for update: ${app}"
@@ -2600,7 +2606,8 @@ create_self_signed_cert() {
   local APP_NAME="${1:-${APPLICATION}}"
   local HOSTNAME="$(hostname -f)"
   local IP="$(hostname -I | awk '{print $1}')"
-  local APP_NAME_LC=$(echo "${APP_NAME,,}" | tr -d ' ')
+  local APP_NAME_LC="${APP_NAME,,}"
+  APP_NAME_LC="${APP_NAME_LC// /}"
   local CERT_DIR="/etc/ssl/${APP_NAME_LC}"
   local CERT_KEY="${CERT_DIR}/${APP_NAME_LC}.key"
   local CERT_CRT="${CERT_DIR}/${APP_NAME_LC}.crt"
@@ -2647,7 +2654,7 @@ function download_with_progress() {
 
   # Content-Length aus HTTP-Header holen
   local content_length
-  content_length=$(curl -fsSLI "$url" | awk '/Content-Length/ {print $2}' | tr -d '\r' || true)
+  content_length=$(curl -fsSLI "$url" | awk '/Content-Length/ {gsub(/\r/,""); print $2}' || true)
 
   if [[ -z "$content_length" ]]; then
     if ! curl -fL# -o "$output" "$url"; then
@@ -2766,7 +2773,8 @@ function fetch_and_deploy_codeberg_release() {
   local target="${5:-/opt/$app}"
   local asset_pattern="${6:-}"
 
-  local app_lc=$(echo "${app,,}" | tr -d ' ')
+  local app_lc="${app,,}"
+  app_lc="${app_lc// /}"
   local version_file="$HOME/.${app_lc}"
 
   local api_timeouts=(60 120 240)
@@ -3318,7 +3326,8 @@ function fetch_and_deploy_gh_release() {
     fi
   fi
 
-  local app_lc=$(echo "${app,,}" | tr -d ' ')
+  local app_lc="${app,,}"
+  app_lc="${app_lc// /}"
   local version_file="$HOME/.${app_lc}"
 
   local api_timeouts=(60 120 240)
@@ -4409,7 +4418,7 @@ function setup_hwaccel() {
       # Parse comma-separated numbers
       IFS=',' read -ra nums <<<"$selection"
       for num in "${nums[@]}"; do
-        num=$(echo "$num" | tr -d ' ')
+        num="${num// /}"
         if [[ "$num" =~ ^[0-9]+$ ]] && ((num >= 1 && num <= gpu_count)); then
           SELECTED_INDICES+=("$((num - 1))")
         fi
@@ -4451,9 +4460,9 @@ function setup_hwaccel() {
   # OS Detection
   # ═══════════════════════════════════════════════════════════════════════════
   local os_id os_codename os_version
-  os_id=$(grep -oP '(?<=^ID=).+' /etc/os-release 2>/dev/null | tr -d '"' || echo "debian")
-  os_codename=$(grep -oP '(?<=^VERSION_CODENAME=).+' /etc/os-release 2>/dev/null | tr -d '"' || echo "unknown")
-  os_version=$(grep -oP '(?<=^VERSION_ID=).+' /etc/os-release 2>/dev/null | tr -d '"' || echo "")
+  os_id=$(get_os_info id)
+  os_codename=$(get_os_info codename)
+  os_version=$(get_os_info version)
   [[ -z "$os_id" ]] && os_id="debian"
 
   local in_ct="${CTTYPE:-0}"
@@ -5339,8 +5348,8 @@ function setup_imagemagick() {
 function setup_java() {
   local JAVA_VERSION="${JAVA_VERSION:-21}"
   local DISTRO_ID DISTRO_CODENAME
-  DISTRO_ID=$(awk -F= '/^ID=/{print $2}' /etc/os-release | tr -d '"')
-  DISTRO_CODENAME=$(awk -F= '/VERSION_CODENAME/ { print $2 }' /etc/os-release)
+  DISTRO_ID=$(get_os_info id)
+  DISTRO_CODENAME=$(get_os_info codename)
   local DESIRED_PACKAGE="temurin-${JAVA_VERSION}-jdk"
 
   # Prepare repository (cleanup + validation)
@@ -5595,7 +5604,7 @@ EOF
     if [[ -n "$CURRENT_VERSION" ]]; then
       # Get available distro version
       local DISTRO_VERSION=""
-      DISTRO_VERSION=$(apt-cache policy mariadb-server 2>/dev/null | grep -E "Candidate:" | awk '{print $2}' | grep -oP '^\d+:\K\d+\.\d+\.\d+' || echo "")
+      DISTRO_VERSION=$(apt-cache policy mariadb-server 2>/dev/null | awk '/Candidate:/ {sub(/^[0-9]+:/, "", $2); print $2}' || echo "")
 
       if [[ -n "$DISTRO_VERSION" ]]; then
         # Compare versions - if current is higher, keep it
@@ -5996,8 +6005,8 @@ function setup_mysql() {
   local MYSQL_VERSION="${MYSQL_VERSION:-8.0}"
   local USE_MYSQL_REPO="${USE_MYSQL_REPO:-true}"
   local DISTRO_ID DISTRO_CODENAME
-  DISTRO_ID=$(awk -F= '/^ID=/{print $2}' /etc/os-release | tr -d '"')
-  DISTRO_CODENAME=$(awk -F= '/^VERSION_CODENAME=/{print $2}' /etc/os-release)
+  DISTRO_ID=$(get_os_info id)
+  DISTRO_CODENAME=$(get_os_info codename)
 
   # Ensure non-interactive mode for all apt operations
   export DEBIAN_FRONTEND=noninteractive
@@ -6343,7 +6352,7 @@ function setup_nodejs() {
 
       # Check if the module is already installed
       if $STD npm list -g --depth=0 "$MODULE_NAME" 2>&1 | grep -q "$MODULE_NAME@"; then
-        MODULE_INSTALLED_VERSION="$(npm list -g --depth=0 "$MODULE_NAME" 2>&1 | grep "$MODULE_NAME@" | awk -F@ '{print $2}' 2>/dev/null | tr -d '[:space:]' || echo '')"
+        MODULE_INSTALLED_VERSION="$(npm list -g --depth=0 "$MODULE_NAME" 2>&1 | awk -F@ -v mod="$MODULE_NAME" '$0 ~ mod"@" {gsub(/[[:space:]]/, "", $2); print $2}' || echo '')"
         if [[ "$MODULE_REQ_VERSION" != "latest" && "$MODULE_REQ_VERSION" != "$MODULE_INSTALLED_VERSION" ]]; then
           msg_info "Updating $MODULE_NAME from v$MODULE_INSTALLED_VERSION to v$MODULE_REQ_VERSION"
           if ! $STD npm install -g "${MODULE_NAME}@${MODULE_REQ_VERSION}" 2>/dev/null; then
@@ -6414,8 +6423,8 @@ function setup_php() {
   local PHP_APACHE="${PHP_APACHE:-NO}"
   local PHP_FPM="${PHP_FPM:-NO}"
   local DISTRO_ID DISTRO_CODENAME
-  DISTRO_ID=$(awk -F= '/^ID=/{print $2}' /etc/os-release | tr -d '"')
-  DISTRO_CODENAME=$(awk -F= '/^VERSION_CODENAME=/{print $2}' /etc/os-release)
+  DISTRO_ID=$(get_os_info id)
+  DISTRO_CODENAME=$(get_os_info codename)
 
   # Parse version for compatibility checks
   local PHP_MAJOR="${PHP_VERSION%%.*}"
@@ -6462,7 +6471,7 @@ function setup_php() {
   local FILTERED_MODULES=""
   IFS=',' read -ra ALL_MODULES <<<"$COMBINED_MODULES"
   for mod in "${ALL_MODULES[@]}"; do
-    mod=$(echo "$mod" | tr -d '[:space:]')
+    mod="${mod//[[:space:]]/}"
     [[ -z "$mod" ]] && continue
 
     # Skip if it's a known built-in module
@@ -6479,7 +6488,7 @@ function setup_php() {
   done
 
   # Deduplicate
-  COMBINED_MODULES=$(echo "$FILTERED_MODULES" | tr ',' '\n' | awk '!seen[$0]++' | paste -sd, -)
+  COMBINED_MODULES=$(awk -v RS=',' '!seen[$0]++{printf "%s%s", sep, $0; sep=","}' <<<"$FILTERED_MODULES")
 
   # Get current PHP-CLI version
   local CURRENT_PHP=""
@@ -6548,7 +6557,7 @@ EOF
 
   IFS=',' read -ra MODULES <<<"$COMBINED_MODULES"
   for mod in "${MODULES[@]}"; do
-    mod=$(echo "$mod" | tr -d '[:space:]')
+    mod="${mod//[[:space:]]/}"
     [[ -z "$mod" ]] && continue
 
     local pkg_name="php${PHP_VERSION}-${mod}"
@@ -6727,8 +6736,8 @@ setup_postgresql() {
   local PG_MODULES="${PG_MODULES:-}"
   local USE_PGDG_REPO="${USE_PGDG_REPO:-true}"
   local DISTRO_ID DISTRO_CODENAME
-  DISTRO_ID=$(awk -F= '/^ID=/{print $2}' /etc/os-release | tr -d '"')
-  DISTRO_CODENAME=$(awk -F= '/^VERSION_CODENAME=/{print $2}' /etc/os-release)
+  DISTRO_ID=$(get_os_info id)
+  DISTRO_CODENAME=$(get_os_info codename)
 
   # Ensure non-interactive mode for all apt operations
   export DEBIAN_FRONTEND=noninteractive
@@ -7571,8 +7580,8 @@ EOF
 function setup_clickhouse() {
   local CLICKHOUSE_VERSION="${CLICKHOUSE_VERSION:-latest}"
   local DISTRO_ID DISTRO_CODENAME
-  DISTRO_ID=$(awk -F= '/^ID=/{print $2}' /etc/os-release | tr -d '"')
-  DISTRO_CODENAME=$(awk -F= '/^VERSION_CODENAME=/{print $2}' /etc/os-release)
+  DISTRO_ID=$(get_os_info id)
+  DISTRO_CODENAME=$(get_os_info codename)
 
   # Ensure non-interactive mode for all apt operations
   export DEBIAN_FRONTEND=noninteractive
@@ -7786,7 +7795,7 @@ function setup_rust() {
 
       # Check if already installed
       if echo "$CRATE_LIST" | grep -q "^${NAME} "; then
-        INSTALLED_VER=$(echo "$CRATE_LIST" | grep "^${NAME} " | head -1 | awk '{print $2}' 2>/dev/null | tr -d 'v:' || echo '')
+        INSTALLED_VER=$(echo "$CRATE_LIST" | grep "^${NAME} " | head -1 | awk '{gsub(/[v:]/, "", $2); print $2}' || echo '')
 
         if [[ -n "$VER" && "$VER" != "$INSTALLED_VER" ]]; then
           msg_info "Upgrading $NAME from v$INSTALLED_VER to v$VER"