minor fix

Pin Vikunja install/update to v2.3.0
Set both install and update scripts to deploy Vikunja v2.3.0 instead of latest. The update flow now checks against this pinned release and includes context that v2.4.0 is temporarily avoided due to an upstream startup failure caused by the packaged systemd SystemCallFilter.
2026-07-27 16:22:53 +02:00 · 2026-07-27 09:19:38 +02:00 · 2026-07-27 09:19:15 +02:00 · 2026-07-27 06:41:38 +00:00 · 2026-07-27 08:41:11 +02:00 · 2026-07-26 20:37:14 +00:00
82 changed files with 1854 additions and 342 deletions
@@ -1,3 +1,134 @@
+## 2026-07-25
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - SparkyFitness: substitute SPARKY_FITNESS_FRONTEND_URL in nginx config [@MickLesk](https://github.com/MickLesk) ([#16007](https://github.com/community-scripts/ProxmoxVE/pull/16007))
+
+  - #### ✨ New Features
+
+    - AFFiNE: Bump version to v0.27.3 [@Oscar006](https://github.com/Oscar006) ([#16012](https://github.com/community-scripts/ProxmoxVE/pull/16012))
+
+## 2026-07-24
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Termix: migrate database to new db/data layout  [@MickLesk](https://github.com/MickLesk) ([#15996](https://github.com/community-scripts/ProxmoxVE/pull/15996))
+    - Sync-in: create admin user with admin role instead of default user [@MickLesk](https://github.com/MickLesk) ([#15983](https://github.com/community-scripts/ProxmoxVE/pull/15983))
+    - VM: fix machine type selection being ignored, VM always created as q35 [@MickLesk](https://github.com/MickLesk) ([#15995](https://github.com/community-scripts/ProxmoxVE/pull/15995))
+
+  - #### ✨ New Features
+
+    - Bump all Alpine scripts to 3.24 [@asylumexp](https://github.com/asylumexp) ([#15994](https://github.com/community-scripts/ProxmoxVE/pull/15994))
+
+## 2026-07-23
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - IronClaw: pin to v0.29.1, 1.0 Reborn CLI/config is incompatible [@MickLesk](https://github.com/MickLesk) ([#15982](https://github.com/community-scripts/ProxmoxVE/pull/15982))
+    - update authentik to 2026.5.6 [@thieneret](https://github.com/thieneret) ([#15973](https://github.com/community-scripts/ProxmoxVE/pull/15973))
+
+  - #### ✨ New Features
+
+    - Cockpit: default to Debian 13, 45Drives now ships Trixie packages | little refactor [@MickLesk](https://github.com/MickLesk) ([#15984](https://github.com/community-scripts/ProxmoxVE/pull/15984))
+    - Paperless-ngx: Support v3 [@tomfrenzel](https://github.com/tomfrenzel) ([#15221](https://github.com/community-scripts/ProxmoxVE/pull/15221))
+
+## 2026-07-22
+
+### 🆕 New Scripts
+
+  - pve-tool: storage share helper script for Proxmox [@MickLesk](https://github.com/MickLesk) ([#15869](https://github.com/community-scripts/ProxmoxVE/pull/15869))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - InvoiceNinja: preserve and Re-download snappdf Chromium [@MickLesk](https://github.com/MickLesk) ([#15956](https://github.com/community-scripts/ProxmoxVE/pull/15956))
+    - Anytype: preserve default mongod.conf when configuring Anytype replica set [@MickLesk](https://github.com/MickLesk) ([#15954](https://github.com/community-scripts/ProxmoxVE/pull/15954))
+    - Nametag: fix missing tailwindcss module [@MickLesk](https://github.com/MickLesk) ([#15955](https://github.com/community-scripts/ProxmoxVE/pull/15955))
+
+  - #### ✨ New Features
+
+    - OPNSense: Bump FreeBSD to 15 and OPNSense to 26.7 [@MickLesk](https://github.com/MickLesk) ([#15943](https://github.com/community-scripts/ProxmoxVE/pull/15943))
+
+### 💾 Core
+
+  - #### ✨ New Features
+
+    - core: add OS mismatch guard for container updates [@MickLesk](https://github.com/MickLesk) ([#15948](https://github.com/community-scripts/ProxmoxVE/pull/15948))
+
+## 2026-07-21
+
+### 🚀 Updated Scripts
+
+  - #### ✨ New Features
+
+    - Pangolin: Bump Version to 1.21.0 [@MickLesk](https://github.com/MickLesk) ([#15938](https://github.com/community-scripts/ProxmoxVE/pull/15938))
+
+  - #### 🔧 Refactor
+
+    - Standardize CT update backup handling [@MickLesk](https://github.com/MickLesk) ([#15937](https://github.com/community-scripts/ProxmoxVE/pull/15937))
+
+## 2026-07-20
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - RomM: use backup helpers in update / clear folder [@MickLesk](https://github.com/MickLesk) ([#15915](https://github.com/community-scripts/ProxmoxVE/pull/15915))
+    - fix: vikunja: asset selection [@CrazyWolf13](https://github.com/CrazyWolf13) ([#15929](https://github.com/community-scripts/ProxmoxVE/pull/15929))
+    - Zammad : bind Elasticsearch to 127.0.0.1 [@MickLesk](https://github.com/MickLesk) ([#15909](https://github.com/community-scripts/ProxmoxVE/pull/15909))
+    - Omada: fix package version extraction [@MickLesk](https://github.com/MickLesk) ([#15908](https://github.com/community-scripts/ProxmoxVE/pull/15908))
+    - fix(wanderer): use PocketBase-relative plugin symlink in unprivileged LXC [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15911](https://github.com/community-scripts/ProxmoxVE/pull/15911))
+
+  - #### ✨ New Features
+
+    - AFFiNE: Bump version to v0.27.2 [@MickLesk](https://github.com/MickLesk) ([#15930](https://github.com/community-scripts/ProxmoxVE/pull/15930))
+
+  - #### 💥 Breaking Changes
+
+    - Gotify: Migration to v3 [@MickLesk](https://github.com/MickLesk) ([#15912](https://github.com/community-scripts/ProxmoxVE/pull/15912))
+
+### 💾 Core
+
+  - #### ✨ New Features
+
+    - core: refactor to single-reporter telemetry and better error_handling [@MickLesk](https://github.com/MickLesk) ([#15933](https://github.com/community-scripts/ProxmoxVE/pull/15933))
+    - tools.func: add support for extracting 7z archives [@MickLesk](https://github.com/MickLesk) ([#15919](https://github.com/community-scripts/ProxmoxVE/pull/15919))
+    - Meilisearch : use dumpless Meilisearch upgrades [@MickLesk](https://github.com/MickLesk) ([#15921](https://github.com/community-scripts/ProxmoxVE/pull/15921))
+
+  - #### 🔧 Refactor
+
+    - core: Improve GPU detection and mapping logic [@MickLesk](https://github.com/MickLesk) ([#15918](https://github.com/community-scripts/ProxmoxVE/pull/15918))
+
+## 2026-07-19
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - change trek repo to liketrek/TREK [@asylumexp](https://github.com/asylumexp) ([#15893](https://github.com/community-scripts/ProxmoxVE/pull/15893))
+    - update authentik to 2026.5.5 [@thieneret](https://github.com/thieneret) ([#15855](https://github.com/community-scripts/ProxmoxVE/pull/15855))
+    - [FIX] BookOrbit: add missing `restore_backup` during update [@vhsdream](https://github.com/vhsdream) ([#15881](https://github.com/community-scripts/ProxmoxVE/pull/15881))
+
+  - #### ✨ New Features
+
+    - tools.func: centralize deploy tail + trap-based tmpdir cleanup [@MickLesk](https://github.com/MickLesk) ([#15872](https://github.com/community-scripts/ProxmoxVE/pull/15872))
+    - Update OPNsense from 26.1 to 26.7 [@tdn131](https://github.com/tdn131) ([#15895](https://github.com/community-scripts/ProxmoxVE/pull/15895))
+
+### 💾 Core
+
+  - Revert "core: add configurable host CA inheritance during bootstrap" [@MickLesk](https://github.com/MickLesk) ([#15886](https://github.com/community-scripts/ProxmoxVE/pull/15886))
+
+  - #### 🐞 Bug Fixes
+
+    - fix(build.func): expand glob in SSH key "Scan Folder/Glob" so it can find keys [@TowyTowy](https://github.com/TowyTowy) ([#15873](https://github.com/community-scripts/ProxmoxVE/pull/15873))
+
 ## 2026-07-18

 ### 💾 Core
@@ -80,6 +80,9 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit



+
+
+



@@ -93,7 +96,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit


 <details>
-<summary><h4>July (18 entries)</h4></summary>
+<summary><h4>July (25 entries)</h4></summary>

 [View July 2026 Changelog](.github/changelogs/2026/07.md)

@@ -505,6 +508,108 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 </details>

+## 2026-07-27
+
+### 🆕 New Scripts
+
+  - PasswordPusher ([#16031](https://github.com/community-scripts/ProxmoxVE/pull/16031))
+
+## 2026-07-26
+
+### 🆕 New Scripts
+
+  - Satisfactory ([#16023](https://github.com/community-scripts/ProxmoxVE/pull/16023))
+- OmniTools ([#16032](https://github.com/community-scripts/ProxmoxVE/pull/16032))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Apache Tika: Remove software-properties-common from Apache Tika install [@andygrunwald](https://github.com/andygrunwald) ([#16054](https://github.com/community-scripts/ProxmoxVE/pull/16054))
+    - Fix inventree missing db engine (upstream issue / postinstall)  [@MickLesk](https://github.com/MickLesk) ([#16022](https://github.com/community-scripts/ProxmoxVE/pull/16022))
+    - OPNsense VM: answer console password prompt explicitly, add inter-key delay [@MickLesk](https://github.com/MickLesk) ([#16021](https://github.com/community-scripts/ProxmoxVE/pull/16021))
+    - [endurain] add node update to update script [@johanngrobe](https://github.com/johanngrobe) ([#16014](https://github.com/community-scripts/ProxmoxVE/pull/16014))
+
+  - #### 🔧 Refactor
+
+    - Apache Tika: Switch from Debian Bookworm to Debian Trixie and replace manual install of OpenJDK with setup_java [@andygrunwald](https://github.com/andygrunwald) ([#16036](https://github.com/community-scripts/ProxmoxVE/pull/16036))
+
+### 💾 Core
+
+  - #### 🔧 Refactor
+
+    - core: improve OS mismatch message [@MickLesk](https://github.com/MickLesk) ([#16035](https://github.com/community-scripts/ProxmoxVE/pull/16035))
+
+### 🧰 Tools
+
+  - #### 🔧 Refactor
+
+    - Improve command description for disabling pve-enterprise repo [@Marcondiro](https://github.com/Marcondiro) ([#16020](https://github.com/community-scripts/ProxmoxVE/pull/16020))
+
+## 2026-07-25
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - SparkyFitness: substitute SPARKY_FITNESS_FRONTEND_URL in nginx config [@MickLesk](https://github.com/MickLesk) ([#16007](https://github.com/community-scripts/ProxmoxVE/pull/16007))
+
+  - #### ✨ New Features
+
+    - AFFiNE: Bump version to v0.27.3 [@Oscar006](https://github.com/Oscar006) ([#16012](https://github.com/community-scripts/ProxmoxVE/pull/16012))
+
+## 2026-07-24
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Termix: migrate database to new db/data layout  [@MickLesk](https://github.com/MickLesk) ([#15996](https://github.com/community-scripts/ProxmoxVE/pull/15996))
+    - Sync-in: create admin user with admin role instead of default user [@MickLesk](https://github.com/MickLesk) ([#15983](https://github.com/community-scripts/ProxmoxVE/pull/15983))
+    - VM: fix machine type selection being ignored, VM always created as q35 [@MickLesk](https://github.com/MickLesk) ([#15995](https://github.com/community-scripts/ProxmoxVE/pull/15995))
+
+  - #### ✨ New Features
+
+    - Bump all Alpine scripts to 3.24 [@asylumexp](https://github.com/asylumexp) ([#15994](https://github.com/community-scripts/ProxmoxVE/pull/15994))
+
+## 2026-07-23
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - IronClaw: pin to v0.29.1, 1.0 Reborn CLI/config is incompatible [@MickLesk](https://github.com/MickLesk) ([#15982](https://github.com/community-scripts/ProxmoxVE/pull/15982))
+    - update authentik to 2026.5.6 [@thieneret](https://github.com/thieneret) ([#15973](https://github.com/community-scripts/ProxmoxVE/pull/15973))
+
+  - #### ✨ New Features
+
+    - Cockpit: default to Debian 13, 45Drives now ships Trixie packages | little refactor [@MickLesk](https://github.com/MickLesk) ([#15984](https://github.com/community-scripts/ProxmoxVE/pull/15984))
+    - Paperless-ngx: Support v3 [@tomfrenzel](https://github.com/tomfrenzel) ([#15221](https://github.com/community-scripts/ProxmoxVE/pull/15221))
+
+## 2026-07-22
+
+### 🆕 New Scripts
+
+  - pve-tool: storage share helper script for Proxmox [@MickLesk](https://github.com/MickLesk) ([#15869](https://github.com/community-scripts/ProxmoxVE/pull/15869))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - InvoiceNinja: preserve and Re-download snappdf Chromium [@MickLesk](https://github.com/MickLesk) ([#15956](https://github.com/community-scripts/ProxmoxVE/pull/15956))
+    - Anytype: preserve default mongod.conf when configuring Anytype replica set [@MickLesk](https://github.com/MickLesk) ([#15954](https://github.com/community-scripts/ProxmoxVE/pull/15954))
+    - Nametag: fix missing tailwindcss module [@MickLesk](https://github.com/MickLesk) ([#15955](https://github.com/community-scripts/ProxmoxVE/pull/15955))
+
+  - #### ✨ New Features
+
+    - OPNSense: Bump FreeBSD to 15 and OPNSense to 26.7 [@MickLesk](https://github.com/MickLesk) ([#15943](https://github.com/community-scripts/ProxmoxVE/pull/15943))
+
+### 💾 Core
+
+  - #### ✨ New Features
+
+    - core: add OS mismatch guard for container updates [@MickLesk](https://github.com/MickLesk) ([#15948](https://github.com/community-scripts/ProxmoxVE/pull/15948))
+
 ## 2026-07-21

 ### 🚀 Updated Scripts
@@ -1018,209 +1123,4 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
    - QoL: kernel-clean: Validate kernel selection input [@MickLesk](https://github.com/MickLesk) ([#15414](https://github.com/community-scripts/ProxmoxVE/pull/15414))
    - QoL: clean-lxcs exclude matching and set -e cancel handling [@MickLesk](https://github.com/MickLesk) ([#15413](https://github.com/community-scripts/ProxmoxVE/pull/15413))
    - QoL: Harden microcode download/install in microcode and pbs-microcode [@MickLesk](https://github.com/MickLesk) ([#15415](https://github.com/community-scripts/ProxmoxVE/pull/15415))
-    - QoL: scaling-governor extend selection and guard missing cpufreq [@MickLesk](https://github.com/MickLesk) ([#15416](https://github.com/community-scripts/ProxmoxVE/pull/15416))
-
-## 2026-06-25
-
-### 🆕 New Scripts
-
-  - Pinchflat ([#15367](https://github.com/community-scripts/ProxmoxVE/pull/15367))
-
-### 🚀 Updated Scripts
-
-  - #### ✨ New Features
-
-    - persist gramps-web configuration file after update [@operfesium](https://github.com/operfesium) ([#15394](https://github.com/community-scripts/ProxmoxVE/pull/15394))
-
-### 💾 Core
-
-  - #### ✨ New Features
-
-    - VM-Core: Update some Functions [@MickLesk](https://github.com/MickLesk) ([#15113](https://github.com/community-scripts/ProxmoxVE/pull/15113))
-
-## 2026-06-24
-
-### 🆕 New Scripts
-
-  - SnapOtter ([#15368](https://github.com/community-scripts/ProxmoxVE/pull/15368))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - enabling rewirte module in apache [@d3v3lop3rDE](https://github.com/d3v3lop3rDE) ([#15360](https://github.com/community-scripts/ProxmoxVE/pull/15360))
-    - watcharr: Increase default RAM allocation from 1024 to 2048 [@MickLesk](https://github.com/MickLesk) ([#15370](https://github.com/community-scripts/ProxmoxVE/pull/15370))
-
-  - #### 🔧 Refactor
-
-    - Refactor LibreNMS: replace old install and update variant with tarball approach [@MickLesk](https://github.com/MickLesk) ([#15369](https://github.com/community-scripts/ProxmoxVE/pull/15369))
-
-### 🗑️ Deleted Scripts
-
-  - delete wger [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15380](https://github.com/community-scripts/ProxmoxVE/pull/15380))
- Delete ghost [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15377](https://github.com/community-scripts/ProxmoxVE/pull/15377))
-
-### 💾 Core
-
-  - #### ✨ New Features
-
-    - core: add SDN vnet selection in advanced install [@MickLesk](https://github.com/MickLesk) ([#15366](https://github.com/community-scripts/ProxmoxVE/pull/15366))
-    - core: add var_http_proxy and var_http_no_proxy support [@MickLesk](https://github.com/MickLesk) ([#15225](https://github.com/community-scripts/ProxmoxVE/pull/15225))
-
-## 2026-06-23
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - update jdk when updating crafty-controller [@asylumexp](https://github.com/asylumexp) ([#15349](https://github.com/community-scripts/ProxmoxVE/pull/15349))
-    - fix docker update function [@asylumexp](https://github.com/asylumexp) ([#15353](https://github.com/community-scripts/ProxmoxVE/pull/15353))
-    - LibreNMS: run daily.sh as librenms user with git available [@MickLesk](https://github.com/MickLesk) ([#15314](https://github.com/community-scripts/ProxmoxVE/pull/15314))
-
-  - #### ✨ New Features
-
-    - termix - patch tmp nginx behaviour to match the install script [@xyzulu](https://github.com/xyzulu) ([#15283](https://github.com/community-scripts/ProxmoxVE/pull/15283))
-
-### 💾 Core
-
-  - Fix syntax error in build function [@l0caldadmin](https://github.com/l0caldadmin) ([#15337](https://github.com/community-scripts/ProxmoxVE/pull/15337))
-
-  - #### 🐞 Bug Fixes
-
-    - fix: close lxc build function [@ServerBP](https://github.com/ServerBP) ([#15343](https://github.com/community-scripts/ProxmoxVE/pull/15343))
-
-### 🧰 Tools
-
-  - #### ✨ New Features
-
-    - [arm64] port pve scripts to support arm64 [@asylumexp](https://github.com/asylumexp) ([#15288](https://github.com/community-scripts/ProxmoxVE/pull/15288))
-
-### ❔ Uncategorized
-
-  - fix(build.func): remove duplicate if statement causing syntax error on container creation [@Copilot](https://github.com/Copilot) ([#15338](https://github.com/community-scripts/ProxmoxVE/pull/15338))
-
-## 2026-06-22
-
-### 🆕 New Scripts
-
-  - Postiz ([#15048](https://github.com/community-scripts/ProxmoxVE/pull/15048))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - invoiceshelf: use pnpm instead of yarn for frontend build [@MickLesk](https://github.com/MickLesk) ([#15312](https://github.com/community-scripts/ProxmoxVE/pull/15312))
-    - VictoriaMetrics: resolve architecture before jq asset filter [@MickLesk](https://github.com/MickLesk) ([#15316](https://github.com/community-scripts/ProxmoxVE/pull/15316))
-    - Endurain: pin uv to the version required by the project [@MickLesk](https://github.com/MickLesk) ([#15313](https://github.com/community-scripts/ProxmoxVE/pull/15313))
-    - add proxy headers to dispatcharr from #15143 [@asylumexp](https://github.com/asylumexp) ([#15293](https://github.com/community-scripts/ProxmoxVE/pull/15293))
-    - Fix-15015: check correct path for certbot [@galz55](https://github.com/galz55) ([#15034](https://github.com/community-scripts/ProxmoxVE/pull/15034))
-    - fix(romm): resolve 403 Forbidden error on nginx mod_zip installation [@hug-efrei](https://github.com/hug-efrei) ([#15134](https://github.com/community-scripts/ProxmoxVE/pull/15134))
-    - Degoog: Fix valkey url in update; set mandatory settings password [@vhsdream](https://github.com/vhsdream) ([#15300](https://github.com/community-scripts/ProxmoxVE/pull/15300))
-    - [arm64] fix update functions to support arm64 [@asylumexp](https://github.com/asylumexp) ([#15290](https://github.com/community-scripts/ProxmoxVE/pull/15290))
-    - Fix typo in victoriametrics [@asylumexp](https://github.com/asylumexp) ([#15289](https://github.com/community-scripts/ProxmoxVE/pull/15289))
-
-  - #### ✨ New Features
-
-    - update: esphome to install and run ESPHome Device Builder [@jesserockz](https://github.com/jesserockz) ([#15195](https://github.com/community-scripts/ProxmoxVE/pull/15195))
-    - [arm64] Port scripts between warracker-zwavejsui to support arm64 [@asylumexp](https://github.com/asylumexp) ([#15291](https://github.com/community-scripts/ProxmoxVE/pull/15291))
-    - [arm64] Port scripts between thingsboard & wanderer to support arm64 [@asylumexp](https://github.com/asylumexp) ([#15286](https://github.com/community-scripts/ProxmoxVE/pull/15286))
-    - [arm64] Port scripts between snowshare & thelounge to support arm64 [@asylumexp](https://github.com/asylumexp) ([#15280](https://github.com/community-scripts/ProxmoxVE/pull/15280))
-
-### 💾 Core
-
-  - #### 🐞 Bug Fixes
-
-    - tools.func: refresh ruby-build when requested version is missing [@MickLesk](https://github.com/MickLesk) ([#15315](https://github.com/community-scripts/ProxmoxVE/pull/15315))
-
-  - #### ✨ New Features
-
-    - core: add pre-install storage health checks [@MickLesk](https://github.com/MickLesk) ([#15226](https://github.com/community-scripts/ProxmoxVE/pull/15226))
-
-  - #### 🔧 Refactor
-
-    - core:: skip LXC stack upgrade prompt in unattended mode [@MickLesk](https://github.com/MickLesk) ([#15319](https://github.com/community-scripts/ProxmoxVE/pull/15319))
-
-### 🧰 Tools
-
-  - #### 🔧 Refactor
-
-    - update-apps: sanitize service detection and fail on invalid names [@MickLesk](https://github.com/MickLesk) ([#15318](https://github.com/community-scripts/ProxmoxVE/pull/15318))
-
-## 2026-06-21
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Matomo: flatten nested deploy layout after update [@MickLesk](https://github.com/MickLesk) ([#15267](https://github.com/community-scripts/ProxmoxVE/pull/15267))
-
-  - #### ✨ New Features
-
-    - [arm64] Port scripts between qdrant & snipeit to support arm64 [@asylumexp](https://github.com/asylumexp) ([#15274](https://github.com/community-scripts/ProxmoxVE/pull/15274))
-    - [arm64] Port scripts between nodered & paperlessngx to support arm64 [@asylumexp](https://github.com/asylumexp) ([#15255](https://github.com/community-scripts/ProxmoxVE/pull/15255))
-    - [arm64] port scripts titled between papra and qbittorrent to support arm64 [@asylumexp](https://github.com/asylumexp) ([#15258](https://github.com/community-scripts/ProxmoxVE/pull/15258))
-    - [arm64] Port scripts between mediamtx-nocodb to support arm64 [@asylumexp](https://github.com/asylumexp) ([#15254](https://github.com/community-scripts/ProxmoxVE/pull/15254))
-
-  - #### 🔧 Refactor
-
-    - tools.func: centralize Node.js corepack and npm handling in `setup_nodejs()` [@MickLesk](https://github.com/MickLesk) ([#15268](https://github.com/community-scripts/ProxmoxVE/pull/15268))
-
-### 💾 Core
-
-  - #### 🐞 Bug Fixes
-
-    - tools.func: APT install and deb822 repo reliability [@MickLesk](https://github.com/MickLesk) ([#15272](https://github.com/community-scripts/ProxmoxVE/pull/15272))
-    - tools.func: prevent MySQL data loss and fix repo version matching [@MickLesk](https://github.com/MickLesk) ([#15271](https://github.com/community-scripts/ProxmoxVE/pull/15271))
-    - tools.func: runtime hardening for API helpers and Docker/MeiliSearch [@MickLesk](https://github.com/MickLesk) ([#15273](https://github.com/community-scripts/ProxmoxVE/pull/15273))
-
-## 2026-06-20
-
-### 🆕 New Scripts
-
-  - Apache-Airflow ([#15228](https://github.com/community-scripts/ProxmoxVE/pull/15228))
- Plane ([#15227](https://github.com/community-scripts/ProxmoxVE/pull/15227))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Fix docker service crash [@asylumexp](https://github.com/asylumexp) ([#15243](https://github.com/community-scripts/ProxmoxVE/pull/15243))
-    - Nginxproxymanager: repair broken certbot pip before update [@MickLesk](https://github.com/MickLesk) ([#15224](https://github.com/community-scripts/ProxmoxVE/pull/15224))
-
-  - #### ✨ New Features
-
-    - [arm64] Port scripts between komga & mediamanager to support arm64 [@asylumexp](https://github.com/asylumexp) ([#15245](https://github.com/community-scripts/ProxmoxVE/pull/15245))
-    - [arm64] port scripts between hyperhdr & kometa to arm64 [@asylumexp](https://github.com/asylumexp) ([#15234](https://github.com/community-scripts/ProxmoxVE/pull/15234))
-
-### 📂 Github
-
-  - add arm64 title check to autolabeler [@asylumexp](https://github.com/asylumexp) ([#15235](https://github.com/community-scripts/ProxmoxVE/pull/15235))
-
-### ❔ Uncategorized
-
-  - chore(ct): sync limesurvey defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#15247](https://github.com/community-scripts/ProxmoxVE/pull/15247))
-
-## 2026-06-19
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - add avx2 check to influxdb3 [@asylumexp](https://github.com/asylumexp) ([#15208](https://github.com/community-scripts/ProxmoxVE/pull/15208))
-    - Step ca leaf data patch [@heinemannj](https://github.com/heinemannj) ([#15210](https://github.com/community-scripts/ProxmoxVE/pull/15210))
-    - Kimai: Add APP_SECRET env var [@tremor021](https://github.com/tremor021) ([#15199](https://github.com/community-scripts/ProxmoxVE/pull/15199))
-
-  - #### ✨ New Features
-
-    - [arm64] Port scripts between garage-hortusfox to support arm64 [@asylumexp](https://github.com/asylumexp) ([#15207](https://github.com/community-scripts/ProxmoxVE/pull/15207))
-    - [arm64] Port scripts titled between A-F to support arm64 [@asylumexp](https://github.com/asylumexp) ([#15181](https://github.com/community-scripts/ProxmoxVE/pull/15181))
-
-### 📂 Github
-
-  - fix (workflow): YAML syntax error in pocketbase stub generation [@Trollfjorden](https://github.com/Trollfjorden) ([#15174](https://github.com/community-scripts/ProxmoxVE/pull/15174))
-
-### ❔ Uncategorized
-
-  - chore(ct): sync coredns defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#15182](https://github.com/community-scripts/ProxmoxVE/pull/15182))
- chore(ct): sync gatus defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#15184](https://github.com/community-scripts/ProxmoxVE/pull/15184))
- chore(ct): sync bitmagnet defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#15183](https://github.com/community-scripts/ProxmoxVE/pull/15183))
+    - QoL: scaling-governor extend selection and guard missing cpufreq [@MickLesk](https://github.com/MickLesk) ([#15416](https://github.com/community-scripts/ProxmoxVE/pull/15416))
@@ -30,7 +30,7 @@ function update_script() {
    exit
  fi

-  RELEASE="v0.27.2"
+  RELEASE="v0.27.3"
  if check_for_gh_release "affine_app" "toeverything/AFFiNE" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
    msg_info "Stopping Services"
    systemctl stop affine-web affine-worker
@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-3}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -12,7 +12,7 @@ var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-1024}"
 var_disk="${var_disk:-20}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-3}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 var_nesting="${var_nesting:-0}"
@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-1024}"
 var_disk="${var_disk:-2}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-512}"
 var_disk="${var_disk:-5}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-512}"
 var_disk="${var_disk:-3}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-512}"
 var_disk="${var_disk:-2}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-1024}"
 var_disk="${var_disk:-8}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -28,7 +28,8 @@ function update_script() {
    exit
  fi

-  if check_for_gh_release "ironclaw-bin" "nearai/ironclaw"; then
+  RELEASE="ironclaw-v0.29.1"
+  if check_for_gh_release "ironclaw-bin" "nearai/ironclaw" "${RELEASE}" "IronClaw 1.0 (Reborn) is a ground-up rearchitecture with an incompatible CLI/config format; pinned until this script supports it"; then
    msg_info "Stopping Service"
    rc-service ironclaw stop 2>/dev/null || true
    msg_ok "Stopped Service"
@@ -37,7 +38,7 @@ function update_script() {
    cp /root/.ironclaw/.env /root/ironclaw.env.bak
    msg_ok "Backed up Configuration"

-    fetch_and_deploy_gh_release "ironclaw-bin" "nearai/ironclaw" "prebuild" "latest" "/usr/local/bin" \
+    fetch_and_deploy_gh_release "ironclaw-bin" "nearai/ironclaw" "prebuild" "${RELEASE}" "/usr/local/bin" \
      "ironclaw-$(uname -m)-unknown-linux-musl.tar.gz"
    chmod +x /usr/local/bin/ironclaw

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-1024}"
 var_disk="${var_disk:-10}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-1024}"
 var_disk="${var_disk:-2}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -12,7 +12,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-2}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 var_fuse="${var_fuse:-yes}"
@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-512}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-512}"
 var_disk="${var_disk:-3}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-4}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-2}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-no}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-2}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-512}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -12,7 +12,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-512}"
 var_disk="${var_disk:-4}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 var_tun="${var_tun:-1}"
@@ -11,7 +11,7 @@ var_disk="${var_disk:-1}"
 var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-256}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-0}"

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-512}"
 var_disk="${var_disk:-1}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-10}"
 var_os="${var_os:-debian}"
-var_version="${var_version:-12}"
+var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -43,7 +43,7 @@ function update_script() {
  RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
  setup_yq

-  AUTHENTIK_VERSION="version/2026.5.5"
+  AUTHENTIK_VERSION="version/2026.5.6"
  # Source: https://github.com/goauthentik/fips/blob/main/Makefile#L26
  XMLSEC_VERSION="1.3.12"

@@ -105,7 +105,7 @@ function update_script() {
    $STD go build -o /opt/authentik/radius ./cmd/radius
    msg_ok "Updated go proxy"

-    msg_info "Building worker"
+    msg_info "Building worker. It may take more than 10 minutes, please be patient."
    export AWS_LC_FIPS_SYS_CC="clang"
    cd /opt/authentik
    $STD cargo build --package authentik --no-default-features --features core --locked --release --jobs 1
@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-1024}"
 var_disk="${var_disk:-4}"
 var_os="${var_os:-debian}"
-var_version="${var_version:-12}"
+var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -33,6 +33,22 @@ function update_script() {
  $STD apt update
  $STD apt -y upgrade
  msg_ok "Updated ${APP} LXC"
+
+  if [[ ! -f /etc/apt/sources.list.d/45drives.sources ]]; then
+    [[ "$(arch_resolve)" == "arm64" ]] || read -r -p "Would you like to install 45Drives' cockpit-file-sharing, cockpit-identities, and cockpit-navigator now? <y/N> " prompt
+    if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
+      msg_info "Installing 45Drives' cockpit extensions"
+      setup_deb822_repo "45drives" \
+        "https://repo.45drives.com/key/gpg.asc" \
+        "https://repo.45drives.com/enterprise/debian" \
+        "$(get_os_info codename)" \
+        "main" \
+        "amd64"
+      $STD apt install -y cockpit-file-sharing cockpit-identities cockpit-navigator
+      msg_ok "Installed 45Drives' cockpit extensions"
+    fi
+  fi
+
  msg_ok "Updated successfully!"
  exit
 }
@@ -34,6 +34,8 @@ function update_script() {
    systemctl stop endurain
    msg_ok "Stopped Service"

+    NODE_VERSION="24" setup_nodejs
+
    create_backup /opt/endurain/.env /opt/endurain/frontend/dist/env.js
    CLEAN_INSTALL=1 fetch_and_deploy_codeberg_release "endurain" "endurain-project/endurain" "tarball" "latest" "/opt/endurain"

@@ -0,0 +1,6 @@
+   ____                  _ ______            __    
+  / __ \____ ___  ____  (_)_  __/___  ____  / /____
+ / / / / __ `__ \/ __ \/ / / / / __ \/ __ \/ / ___/
+/ /_/ / / / / / / / / / / / / / /_/ / /_/ / (__  ) 
+\____/_/ /_/ /_/_/ /_/_/ /_/  \____/\____/_/____/  
+                                                   
@@ -0,0 +1,6 @@
+    ____                                          ______             __             
+   / __ \____ ____________      ______  _________/ / __ \__  _______/ /_  ___  _____
+  / /_/ / __ `/ ___/ ___/ | /| / / __ \/ ___/ __  / /_/ / / / / ___/ __ \/ _ \/ ___/
+ / ____/ /_/ (__  |__  )| |/ |/ / /_/ / /  / /_/ / ____/ /_/ (__  ) / / /  __/ /    
+/_/    \__,_/____/____/ |__/|__/\____/_/   \__,_/_/    \__,_/____/_/ /_/\___/_/     
+                                                                                    
@@ -0,0 +1,6 @@
+   _____       __  _      ____           __                  
+  / ___/____ _/ /_(_)____/ __/___ ______/ /_____  _______  __
+  \__ \/ __ `/ __/ / ___/ /_/ __ `/ ___/ __/ __ \/ ___/ / / /
+ ___/ / /_/ / /_/ (__  ) __/ /_/ / /__/ /_/ /_/ / /  / /_/ / 
+/____/\__,_/\__/_/____/_/  \__,_/\___/\__/\____/_/   \__, /  
+                                                    /____/   
@@ -35,12 +35,18 @@ function update_script() {
    systemctl stop supervisor nginx php8.4-fpm
    msg_ok "Stopped Services"

-    create_backup /opt/invoiceninja/.env /opt/invoiceninja/storage /opt/invoiceninja/public/storage
+    create_backup /opt/invoiceninja/.env /opt/invoiceninja/storage /opt/invoiceninja/public/storage /opt/invoiceninja/vendor/beganovich/snappdf/versions

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "invoiceninja" "invoiceninja/invoiceninja" "prebuild" "latest" "/opt/invoiceninja" "invoiceninja.tar.gz"

    restore_backup

+    msg_info "Verifying Chromium for PDF Generation"
+    cd /opt/invoiceninja
+    $STD ./vendor/bin/snappdf download
+    chown -R www-data:www-data /opt/invoiceninja/vendor/beganovich/snappdf/versions
+    msg_ok "Verified Chromium for PDF Generation"
+
    msg_info "Running Migrations"
    cd /opt/invoiceninja 
    $STD php artisan migrate --force
@@ -30,7 +30,8 @@ function update_script() {
    exit
  fi

-  if check_for_gh_release "ironclaw-bin" "nearai/ironclaw"; then
+  RELEASE="ironclaw-v0.29.1"
+  if check_for_gh_release "ironclaw-bin" "nearai/ironclaw" "${RELEASE}" "IronClaw 1.0 (Reborn) is a ground-up rearchitecture with an incompatible CLI/config format; pinned until this script supports it"; then
    msg_info "Stopping Service"
    systemctl stop ironclaw
    msg_ok "Stopped Service"
@@ -39,7 +40,7 @@ function update_script() {
    cp /root/.ironclaw/.env /root/ironclaw.env.bak
    msg_ok "Backed up Configuration"

-    fetch_and_deploy_gh_release "ironclaw-bin" "nearai/ironclaw" "prebuild" "latest" "/usr/local/bin" \
+    fetch_and_deploy_gh_release "ironclaw-bin" "nearai/ironclaw" "prebuild" "${RELEASE}" "/usr/local/bin" \
      "ironclaw-$(uname -m)-unknown-linux-gnu.tar.gz"
    chmod +x /usr/local/bin/ironclaw

@@ -43,7 +43,7 @@ function update_script() {

    msg_info "Rebuilding Application"
    cd /opt/nametag
-    $STD npm ci
+    $STD npm ci --include=dev
    set -a
    source /opt/nametag/.env
    set +a
@@ -11,7 +11,7 @@ var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-512}"
 var_disk="${var_disk:-3}"
 var_os="${var_os:-alpine}"
-var_version="${var_version:-3.23}"
+var_version="${var_version:-3.24}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Majiiin
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/iib0011/omni-tools
+
+APP="OmniTools"
+var_tags="${var_tags:-utilities;tools;converter}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/omnitools ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  NODE_VERSION="24" setup_nodejs
+
+  if check_for_gh_release "omnitools" "iib0011/omni-tools"; then
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "omnitools" "iib0011/omni-tools" "tarball"
+
+    msg_info "Building OmniTools"
+    cd /opt/omnitools
+    export HUSKY=0
+    $STD npm ci
+    $STD npm run build
+    msg_ok "Built OmniTools"
+
+    msg_info "Publishing Web Assets"
+    rm -rf /usr/share/nginx/html
+    mkdir -p /usr/share/nginx/html
+    cp -a /opt/omnitools/dist/. /usr/share/nginx/html/
+    rm -rf /opt/omnitools/node_modules
+    systemctl reload nginx
+    msg_ok "Published Web Assets"
+    msg_ok "Updated successfully!"
+  fi
+
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}${CL}"
@@ -49,22 +49,44 @@ function update_script() {
    fi
  fi

-  RELEASE="v2.20.15"
-  if check_for_gh_release "paperless" "paperless-ngx/paperless-ngx" "${RELEASE}" "v3 needs further testing"; then
+  local PAPERLESS_INSTALLED_VERSION="" BRIDGE_UPDATE=0
+  [[ -f ~/.paperless ]] && PAPERLESS_INSTALLED_VERSION="$(<~/.paperless)"
+  PAPERLESS_INSTALLED_VERSION="${PAPERLESS_INSTALLED_VERSION#v}"
+  if [[ "$PAPERLESS_INSTALLED_VERSION" == 2.* && "$PAPERLESS_INSTALLED_VERSION" != "2.20.15" ]]; then
+    BRIDGE_UPDATE=1
+  fi
+
+  if check_for_gh_release "paperless" "paperless-ngx/paperless-ngx"; then
+    if [[ "$PAPERLESS_INSTALLED_VERSION" == "2.20.15" ]]; then
+      msg_warn "Paperless-ngx v3 does not support encrypted documents anymore."
+      echo -e "${GATEWAY}${BGN}https://docs.paperless-ngx.com/migration-v3/#encryption-support${CL}"
+      msg_warn "Before continuing make sure that you do not use encryption or have decrypted all documents."
+      echo ""
+      read -rp "Do you want to continue with the update? (y/N): " MIGRATE
+      echo
+      if [[ ! "$MIGRATE" =~ ^[Yy]$ ]]; then
+        msg_info "Update aborted. Decrypt all documents before upgrading to v3."
+        exit 0
+      fi
+    fi
+
    msg_info "Stopping all Paperless-ngx Services"
    systemctl stop paperless-consumer paperless-webserver paperless-scheduler paperless-task-queue
    msg_ok "Stopped all Paperless-ngx Services"

    if grep -q "uv run" /etc/systemd/system/paperless-webserver.service; then
-
      msg_info "Backing up configuration"
      local BACKUP_DIR="/opt/paperless_backup_$$"
      mkdir -p "$BACKUP_DIR"
      [[ -f /opt/paperless/paperless.conf ]] && cp /opt/paperless/paperless.conf "$BACKUP_DIR/"
      msg_ok "Backup completed to $BACKUP_DIR"

-      PYTHON_VERSION="3.13" setup_uv
-      CLEAN_INSTALL=1 fetch_and_deploy_gh_release "paperless" "paperless-ngx/paperless-ngx" "prebuild" "${RELEASE}" "/opt/paperless" "paperless*tar.xz"
+      PYTHON_VERSION="3.13" setup_uv  
+      if ((BRIDGE_UPDATE)); then
+        CLEAN_INSTALL=1 fetch_and_deploy_gh_release "paperless" "paperless-ngx/paperless-ngx" "prebuild" "v2.20.15" "/opt/paperless" "paperless*tar.xz"
+      else
+        CLEAN_INSTALL=1 fetch_and_deploy_gh_release "paperless" "paperless-ngx/paperless-ngx" "prebuild" "latest" "/opt/paperless" "paperless*tar.xz"
+      fi
      CLEAN_INSTALL=1 fetch_and_deploy_gh_release "jbig2enc" "ie13/jbig2enc" "tarball" "latest" "/opt/jbig2enc"

      . /etc/os-release
@@ -73,18 +95,94 @@ function update_script() {
      else
        ensure_dependencies ghostscript
      fi
+      ensure_dependencies gnupg
+
+      cp -r "$BACKUP_DIR"/* /opt/paperless/
+      if ((BRIDGE_UPDATE == 0)) && [[ "$PAPERLESS_INSTALLED_VERSION" == 2.* ]]; then
+        msg_info "Migrating Paperless-ngx v2 configuration to v3"
+        PAPERLESS_CONF="/opt/paperless/paperless.conf"
+
+        SECRET_KEY_CURRENT="$(sed -n 's|^PAPERLESS_SECRET_KEY=||p' "$PAPERLESS_CONF" | tail -n1)"
+        DBENGINE="$(sed -n 's|^PAPERLESS_DBENGINE=||p' "$PAPERLESS_CONF" | tail -n1)"
+        DB_OPTIONS_DEPRECATED="$(sed -n '/^PAPERLESS_DBSSLMODE=/p;/^PAPERLESS_DBSSLROOTCERT=/p;/^PAPERLESS_DBSSLCERT=/p;/^PAPERLESS_DBSSLKEY=/p;/^PAPERLESS_DB_POOLSIZE=/p;/^PAPERLESS_DB_TIMEOUT=/p' "$PAPERLESS_CONF")"
+        CONSUMER_POLLING="$(sed -n 's|^PAPERLESS_CONSUMER_POLLING=||p' "$PAPERLESS_CONF" | tail -n1)"
+        CONSUMER_POLLING_INTERVAL="$(sed -n 's|^PAPERLESS_CONSUMER_POLLING_INTERVAL=||p' "$PAPERLESS_CONF" | tail -n1)"
+        CONSUMER_INOTIFY_DELAY="$(sed -n 's|^PAPERLESS_CONSUMER_INOTIFY_DELAY=||p' "$PAPERLESS_CONF" | tail -n1)"
+        CONSUMER_STABILITY_DELAY="$(sed -n 's|^PAPERLESS_CONSUMER_STABILITY_DELAY=||p' "$PAPERLESS_CONF" | tail -n1)"
+        OCR_MODE="$(sed -n 's|^PAPERLESS_OCR_MODE=||p' "$PAPERLESS_CONF" | tail -n1)"
+        OCR_SKIP_ARCHIVE="$(sed -n 's|^PAPERLESS_OCR_SKIP_ARCHIVE_FILE=||p' "$PAPERLESS_CONF" | tail -n1)"
+        ARCHIVE_FILE_GENERATION="$(sed -n 's|^PAPERLESS_ARCHIVE_FILE_GENERATION=||p' "$PAPERLESS_CONF" | tail -n1)"
+        CONSUMER_DELETE_DUPLICATES="$(sed -n 's|^PAPERLESS_CONSUMER_DELETE_DUPLICATES=||p' "$PAPERLESS_CONF" | tail -n1)"
+
+        sed -i \
+          -e '/^PAPERLESS_CONSUMER_POLLING=/d' \
+          -e '/^PAPERLESS_CONSUMER_INOTIFY_DELAY=/d' \
+          -e '/^PAPERLESS_CONSUMER_POLLING_DELAY=/d' \
+          -e '/^PAPERLESS_CONSUMER_POLLING_RETRY_COUNT=/d' \
+          -e '/^PAPERLESS_CONSUMER_BARCODE_SCANNER=/d' \
+          -e '/^PAPERLESS_PASSPHRASE=/d' \
+          -e '/^PAPERLESS_OCR_SKIP_ARCHIVE_FILE=/d' \
+          -e 's|^PAPERLESS_OCR_MODE="\?skip"\?$|PAPERLESS_OCR_MODE=auto|' \
+          -e 's|^PAPERLESS_OCR_MODE="\?skip_noarchive"\?$|PAPERLESS_OCR_MODE=auto|' \
+          "$PAPERLESS_CONF"
+
+        if [[ -n "$DB_OPTIONS_DEPRECATED" ]]; then
+          msg_warn "Deprecated Paperless DB options detected; migrate them manually to PAPERLESS_DB_OPTIONS."
+          echo -e "${GATEWAY}${BGN}https://docs.paperless-ngx.com/migration-v3/#database-advanced-options${CL}"
+        fi
+        if [[ -z "$SECRET_KEY_CURRENT" || "$SECRET_KEY_CURRENT" == "change-me" ]]; then
+          SECRET_KEY="$(dd if=/dev/urandom bs=32 count=1 2>/dev/null | od -An -tx1 | tr -d ' \n')"
+          sed -i \
+            -e '/^#\?PAPERLESS_SECRET_KEY=/d' \
+            -e "\$a\\PAPERLESS_SECRET_KEY=$SECRET_KEY" \
+            "$PAPERLESS_CONF"
+          printf "Paperless-ngx Secret Key: %s\n" "$SECRET_KEY" >>~/paperless-ngx.creds
+        fi
+        [[ -z "$DBENGINE" ]] && sed -i '$a\PAPERLESS_DBENGINE=postgresql' "$PAPERLESS_CONF"
+        [[ -n "$CONSUMER_POLLING" && -z "$CONSUMER_POLLING_INTERVAL" ]] &&
+          sed -i "\$a\\PAPERLESS_CONSUMER_POLLING_INTERVAL=$CONSUMER_POLLING" "$PAPERLESS_CONF"
+        [[ -n "$CONSUMER_INOTIFY_DELAY" && -z "$CONSUMER_STABILITY_DELAY" ]] &&
+          sed -i "\$a\\PAPERLESS_CONSUMER_STABILITY_DELAY=$CONSUMER_INOTIFY_DELAY" "$PAPERLESS_CONF"
+        [[ -z "$CONSUMER_DELETE_DUPLICATES" ]] &&
+          sed -i '$a\PAPERLESS_CONSUMER_DELETE_DUPLICATES=true' "$PAPERLESS_CONF"
+        if [[ -z "$ARCHIVE_FILE_GENERATION" ]]; then
+          if [[ "$OCR_MODE" == "skip_noarchive" || "$OCR_MODE" == "\"skip_noarchive\"" ]]; then
+            sed -i '$a\PAPERLESS_ARCHIVE_FILE_GENERATION=never' "$PAPERLESS_CONF"
+          elif [[ "$OCR_SKIP_ARCHIVE" == "never" || "$OCR_SKIP_ARCHIVE" == "\"never\"" ]]; then
+            sed -i '$a\PAPERLESS_ARCHIVE_FILE_GENERATION=always' "$PAPERLESS_CONF"
+          elif [[ "$OCR_SKIP_ARCHIVE" == "with_text" || "$OCR_SKIP_ARCHIVE" == "\"with_text\"" ]]; then
+            sed -i '$a\PAPERLESS_ARCHIVE_FILE_GENERATION=auto' "$PAPERLESS_CONF"
+          elif [[ "$OCR_SKIP_ARCHIVE" == "always" || "$OCR_SKIP_ARCHIVE" == "\"always\"" ]]; then
+            sed -i '$a\PAPERLESS_ARCHIVE_FILE_GENERATION=never' "$PAPERLESS_CONF"
+          fi
+        fi
+        [[ -n "$(sed -n '/^PAPERLESS_CONSUMER_IGNORE_PATTERNS=/p' "$PAPERLESS_CONF")" ]] &&
+          msg_warn "PAPERLESS_CONSUMER_IGNORE_PATTERNS now uses regex patterns; please verify custom values."
+        [[ -n "$(sed -n '/^PAPERLESS_PRE_CONSUME_SCRIPT=/p;/^PAPERLESS_POST_CONSUME_SCRIPT=/p' "$PAPERLESS_CONF")" ]] &&
+          msg_warn "Pre/post consume scripts no longer receive positional arguments in v3; please verify custom scripts."
+        msg_ok "Migrated Paperless-ngx configuration"
+      fi

      msg_info "Updating Paperless-ngx"
-      cp -r "$BACKUP_DIR"/* /opt/paperless/
+      if ((BRIDGE_UPDATE == 0)); then
+        sed -i 's|^ExecStart=.*|ExecStart=uv run -- granian --interface asginl --ws --loop uvloop "paperless.asgi:application"|' /etc/systemd/system/paperless-webserver.service
+        $STD systemctl daemon-reload
+      fi
      cd /opt/paperless
      $STD uv sync --all-extras
      cd /opt/paperless/src
      $STD uv run -- python manage.py migrate
      msg_ok "Updated Paperless-ngx"

+      if ((BRIDGE_UPDATE == 0)) && [[ "$PAPERLESS_INSTALLED_VERSION" == "2.20.15" ]]; then
+        $STD apt -y purge libzbar0t64 libzbar0 2>/dev/null || true
+        $STD apt -y autoremove 2>/dev/null || true
+      fi
+
      rm -rf "$BACKUP_DIR"

    else
+      BRIDGE_UPDATE=1
      msg_warn "You are about to migrate your Paperless-ngx installation to uv!"
      msg_custom "🔒" "It is strongly recommended to take a Proxmox snapshot first:"
      echo -e "   1. Stop the container:  pct stop <CTID>"
@@ -139,7 +237,7 @@ function update_script() {
      msg_ok "Backup completed to $BACKUP_DIR"

      PYTHON_VERSION="3.13" setup_uv
-      CLEAN_INSTALL=1 fetch_and_deploy_gh_release "paperless" "paperless-ngx/paperless-ngx" "prebuild" "${RELEASE}" "/opt/paperless" "paperless*tar.xz"
+      CLEAN_INSTALL=1 fetch_and_deploy_gh_release "paperless" "paperless-ngx/paperless-ngx" "prebuild" "v2.20.15" "/opt/paperless" "paperless*tar.xz"
      CLEAN_INSTALL=1 fetch_and_deploy_gh_release "jbig2enc" "ie13/jbig2enc" "tarball" "latest" "/opt/jbig2enc"

      . /etc/os-release
@@ -150,14 +248,15 @@ function update_script() {
        ensure_dependencies ghostscript
        msg_ok "Installed Ghostscript"
      fi
+      ensure_dependencies gnupg

-      msg_info "Updating Paperless-ngx"
+      msg_info "Updating Paperless-ngx to v2.20.15"
      cp -r "$BACKUP_DIR"/* /opt/paperless/
      cd /opt/paperless
      $STD uv sync --all-extras
      cd /opt/paperless/src
      $STD uv run -- python manage.py migrate
-      msg_ok "Paperless-ngx migration and update completed"
+      msg_ok "Migrated to uv and updated to v2.20.15 (required before v3)"

      rm -rf "$BACKUP_DIR"
      if [[ -d /opt/paperless/backup ]]; then
@@ -172,6 +271,10 @@ function update_script() {
    systemctl start paperless-consumer paperless-webserver paperless-scheduler paperless-task-queue
    sleep 1
    msg_ok "Started all Paperless-ngx Services"
+    if ((BRIDGE_UPDATE)); then
+      msg_custom "ℹ️" "${YW}" "Paperless-ngx is now on v2.20.15. Run the update again to upgrade to v3."
+      exit
+    fi
    msg_ok "Updated successfully!"
  fi
  exit
@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/pglombardo/PasswordPusher
+
+APP="PasswordPusher"
+var_tags="${var_tags:-security;sharing;password}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/passwordpusher ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "passwordpusher" "pglombardo/PasswordPusher"; then
+    msg_info "Stopping Service"
+    systemctl stop passwordpusher
+    msg_ok "Stopped Service"
+
+    create_backup /opt/passwordpusher/storage /opt/passwordpusher/.env.production
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "passwordpusher" "pglombardo/PasswordPusher" "tarball"
+
+    msg_info "Installing Gem Dependencies"
+    cd /opt/passwordpusher
+    export PATH="$HOME/.rbenv/shims:$HOME/.rbenv/bin:$PATH"
+    $STD bundle config set --local without 'development test'
+    $STD bundle config set --local deployment 'true'
+    $STD bundle install
+    msg_ok "Installed Gem Dependencies"
+
+    msg_info "Installing JS Dependencies"
+    $STD yarn install --frozen-lockfile
+    msg_ok "Installed JS Dependencies"
+
+    msg_info "Running Database Migrations"
+    RAILS_ENV=production $STD bundle exec rails db:migrate
+    msg_ok "Ran Database Migrations"
+
+    msg_info "Precompiling Assets"
+    RAILS_ENV=production SECRET_KEY_BASE_DUMMY=1 $STD bundle exec rails assets:precompile
+    msg_ok "Precompiled Assets"
+
+    restore_backup
+
+    msg_info "Starting Service"
+    systemctl start passwordpusher
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:5100${CL}"
@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: n8flx
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.satisfactorygame.com/
+
+APP="Satisfactory"
+var_tags="${var_tags:-gaming;server}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-8192}"
+var_disk="${var_disk:-20}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -x /opt/steamcmd/steamcmd.sh || ! -d /opt/satisfactory/server ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  msg_info "Stopping Satisfactory"
+  systemctl stop satisfactory
+  msg_ok "Stopped Satisfactory"
+
+  create_backup /home/steam/.config/Epic/FactoryGame/Saved
+
+  msg_info "Updating Satisfactory"
+  if $STD runuser -u steam -- /opt/steamcmd/steamcmd.sh \
+    +force_install_dir /opt/satisfactory/server \
+    +login anonymous \
+    +app_update 1690800 -beta public validate \
+    +quit; then
+    msg_ok "Updated Satisfactory"
+  else
+    restore_backup
+    systemctl start satisfactory
+    msg_error "Failed to update Satisfactory"
+    exit 1
+  fi
+
+  restore_backup
+
+  msg_info "Starting Satisfactory"
+  systemctl start satisfactory
+  msg_ok "Started Satisfactory"
+  msg_ok "Updated Successfully!"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Add the server in Satisfactory Server Manager:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}${IP}:7777${CL}"
+echo -e "${INFO}${YW} Required ports:${CL} ${BGN}7777 TCP/UDP and 8888 TCP${CL}"
@@ -58,9 +58,11 @@ function update_script() {
    msg_ok "Updated Sparky Fitness Frontend"

    msg_info "Refreshing Nginx Config"
+    FRONTEND_URL=$(grep -oP '^SPARKY_FITNESS_FRONTEND_URL=\K.*' /etc/sparkyfitness/.env)
    sed \
      -e 's|${SPARKY_FITNESS_SERVER_HOST}|127.0.0.1|g' \
      -e 's|${SPARKY_FITNESS_SERVER_PORT}|3010|g' \
+      -e "s|\${SPARKY_FITNESS_FRONTEND_URL}|${FRONTEND_URL}|g" \
      -e 's|${NGINX_LISTEN_PORT}|80|g' \
      -e 's|${NGINX_ACCESS_LOG}|/var/log/nginx/sparkyfitness.access.log|g' \
      -e 's|${NGINX_ERROR_LOG}|/var/log/nginx/sparkyfitness.error.log|g' \
@@ -154,9 +154,16 @@ EOF
      /opt/termix/nginx \
      /opt/termix/nginx/logs \
      /opt/termix/nginx/cache \
-      /opt/termix/nginx/client_body
+      /opt/termix/nginx/client_body \
+      /opt/termix/db/data
    msg_ok "Recreated Directories"

+    if [[ -f /opt/termix/data/db.sqlite.encrypted && ! -f /opt/termix/db/data/db.sqlite.encrypted ]]; then
+      msg_info "Migrating Database to new layout"
+      cp -a /opt/termix/data/db.sqlite.encrypted /opt/termix/db/data/db.sqlite.encrypted
+      msg_ok "Migrated Database to new layout"
+    fi
+
    msg_info "Building Frontend"
    cd /opt/termix
    export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
@@ -168,6 +175,10 @@ EOF
    msg_info "Building Backend"
    $STD npm rebuild better-sqlite3 --force
    $STD npm run build:backend
+    if [[ ! -f /opt/termix/dist/backend/backend/starter.js ]]; then
+      msg_error "Backend build failed: /opt/termix/dist/backend/backend/starter.js was not created"
+      exit 1
+    fi
    msg_ok "Built Backend"

    msg_info "Setting up Production Dependencies"
@@ -29,9 +29,9 @@ function update_script() {
    exit
  fi

-  RELEASE="$( [[ -f "$HOME/.vikunja" ]] && cat "$HOME/.vikunja" 2>/dev/null || [[ -f /opt/Vikunja_version ]] && cat /opt/Vikunja_version 2>/dev/null || true)"
-  if [[ -z "$RELEASE" ]] || [[ "$RELEASE" == "unstable" ]] || dpkg --compare-versions "${RELEASE:-0.0.0}" lt "1.0.0"; then
-    msg_warn "You are upgrading from Vikunja '$RELEASE'."
+  INSTALLED_VERSION="$( [[ -f "$HOME/.vikunja" ]] && cat "$HOME/.vikunja" 2>/dev/null || [[ -f /opt/Vikunja_version ]] && cat /opt/Vikunja_version 2>/dev/null || true)"
+  if [[ -z "$INSTALLED_VERSION" ]] || [[ "$INSTALLED_VERSION" == "unstable" ]] || dpkg --compare-versions "${INSTALLED_VERSION:-0.0.0}" lt "1.0.0"; then
+    msg_warn "You are upgrading from Vikunja '$INSTALLED_VERSION'."
    msg_warn "This requires MANUAL config changes in /etc/vikunja/config.yml."
    msg_warn "See: https://vikunja.io/changelog/whats-new-in-vikunja-1.0.0/#config-changes"

@@ -46,7 +46,8 @@ function update_script() {
    [[ "$CONFIRM2" =~ ^[yY]$ ]] || exit 0
  fi

-  if check_for_gh_release "vikunja" "go-vikunja/vikunja"; then
+  RELEASE="v2.3.0"
+  if check_for_gh_release "vikunja" "go-vikunja/vikunja" "${RELEASE}" "v2.4.0 is killed at startup by the systemd SystemCallFilter shipped in the .deb (upstream go-vikunja/vikunja#3252); pinned until a fixed release is out"; then
    echo
    msg_warn "The package update may include config file changes."
    echo -e "${TAB}${YW}How do you want to handle /etc/vikunja/config.yml?${CL}"
@@ -65,7 +66,7 @@ function update_script() {
    systemctl stop vikunja
    msg_ok "Stopped Service"

-    fetch_and_deploy_gh_release "vikunja" "go-vikunja/vikunja" "binary" "latest" "" "vikunja-*-$(arch_resolve "x86_64" "aarch64").deb"
+    fetch_and_deploy_gh_release "vikunja" "go-vikunja/vikunja" "binary" "${RELEASE}" "" "vikunja-*-$(arch_resolve "x86_64" "aarch64").deb"
    $STD systemctl daemon-reload

    msg_info "Starting Service"
@@ -31,7 +31,7 @@ PG_DB_NAME="affine" PG_DB_USER="affine" setup_postgresql_db
 NODE_VERSION="22" setup_nodejs
 setup_rust

-fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "v0.27.2" "/opt/affine"
+fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "v0.27.3" "/opt/affine"

 msg_info "Setting up Directories"
 rm -rf /root/.affine
@@ -31,7 +31,7 @@ $STD su -s /bin/sh postgres -c "psql -c \"CREATE DATABASE ironclaw WITH OWNER ir
 $STD su -s /bin/sh postgres -c "psql -d ironclaw -c \"CREATE EXTENSION IF NOT EXISTS vector;\""
 msg_ok "Set up Database"

-fetch_and_deploy_gh_release "ironclaw-bin" "nearai/ironclaw" "prebuild" "latest" "/usr/local/bin" \
+fetch_and_deploy_gh_release "ironclaw-bin" "nearai/ironclaw" "prebuild" "ironclaw-v0.29.1" "/usr/local/bin" \
  "ironclaw-$(uname -m)-unknown-linux-musl.tar.gz"
 chmod +x /usr/local/bin/ironclaw

@@ -16,7 +16,7 @@ update_os
 setup_mongodb

 msg_info "Configuring MongoDB Replica Set"
-cat <<EOF >/etc/mongod.conf
+cat <<EOF >>/etc/mongod.conf

 replication:
  replSetName: "rs0"
@@ -15,7 +15,6 @@ update_os

 msg_info "Installing Dependencies"
 $STD apt-get install -y \
-  software-properties-common \
  gdal-bin \
  tesseract-ocr \
  tesseract-ocr-eng \
@@ -33,10 +32,7 @@ $STD apt-get install -y \
  cabextract
 msg_ok "Installed Dependencies"

-msg_info "Setup OpenJDK"
-$STD apt-get install -y \
-  openjdk-17-jre-headless
-msg_ok "Setup OpenJDK"
+JAVA_VERSION="21" setup_java

 msg_info "Installing Apache Tika"
 mkdir -p /opt/apache-tika
@@ -59,7 +59,7 @@ PG_VERSION="17" setup_postgresql
 PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db

 XMLSEC_VERSION="1.3.12"
-AUTHENTIK_VERSION="version/2026.5.5"
+AUTHENTIK_VERSION="version/2026.5.6"
 fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec"
 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
 fetch_and_deploy_gh_release "geoipupdate" "maxmind/geoipupdate" "binary"
@@ -109,7 +109,7 @@ EOF

 echo "#39 19 * * 6,4 /usr/bin/geoipupdate -f /usr/local/etc/GeoIP.conf" | crontab -

-msg_info "Building worker"
+msg_info "Building worker. It may take more than 10 minutes, please be patient."
 export AWS_LC_FIPS_SYS_CC="clang"
 cd /opt/authentik
 $STD cargo build --package authentik --no-default-features --features core --locked --release --jobs 1
@@ -15,42 +15,33 @@ network_check
 update_os

 msg_info "Installing Cockpit"
-source /etc/os-release
+CODENAME=$(get_os_info codename)
 cat <<EOF >/etc/apt/sources.list.d/debian-backports.sources
 Types: deb deb-src
 URIs: http://deb.debian.org/debian
-Suites: ${VERSION_CODENAME}-backports
+Suites: ${CODENAME}-backports
 Components: main
 Enabled: yes
 Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
 EOF

 $STD apt update
-$STD apt install -t ${VERSION_CODENAME}-backports cockpit cracklib-runtime --no-install-recommends -y
+$STD apt install -t ${CODENAME}-backports cockpit cracklib-runtime --no-install-recommends -y
 sed -i "s/root//g" /etc/cockpit/disallowed-users
 msg_ok "Installed Cockpit"

 # 45Drives only publishes amd64 packages
 [[ "$(arch_resolve)" == "arm64" ]] || read -r -p "Would you like to install 45Drives' cockpit-file-sharing, cockpit-identities, and cockpit-navigator  <y/N> " prompt
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
-  install_45drives=true
-  if [[ "${VERSION_ID}" -ge 13 ]]; then
-    read -r -p "Debian ${VERSION_ID} is not officially supported by 45Drives yet, would you like to continue anyway? <y/N> " prompt
-    if [[ ! "${prompt,,}" =~ ^(y|yes)$ ]]; then
-      install_45drives=false
-    fi
-  fi
-  if [[ "$install_45drives" == "true" ]]; then
-    msg_info "Installing 45Drives' cockpit extensions"
-    setup_deb822_repo "45drives" \
-      "https://repo.45drives.com/key/gpg.asc" \
-      "https://repo.45drives.com/enterprise/debian" \
-      "bookworm" \
-      "main" \
-      "amd64"
-    $STD apt install -y cockpit-file-sharing cockpit-identities cockpit-navigator
-    msg_ok "Installed 45Drives' cockpit extensions"
-  fi
+  msg_info "Installing 45Drives' cockpit extensions"
+  setup_deb822_repo "45drives" \
+    "https://repo.45drives.com/key/gpg.asc" \
+    "https://repo.45drives.com/enterprise/debian" \
+    "${CODENAME}" \
+    "main" \
+    "amd64"
+  $STD apt install -y cockpit-file-sharing cockpit-identities cockpit-navigator
+  msg_ok "Installed 45Drives' cockpit extensions"
 fi

 motd_ssh
@@ -30,6 +30,11 @@ msg_ok "Installed InvenTree"
 msg_info "Configuring InvenTree"
 if [[ -f /etc/inventree/config.yaml ]]; then
  sed -i "s|site_url:.*|site_url: http://${LOCAL_IP}|" /etc/inventree/config.yaml
+  if ! grep -q "^  engine:" /etc/inventree/config.yaml; then
+    mkdir -p /home/inventree/data
+    chown inventree:inventree /home/inventree/data
+    sed -i "/^database:$/a\\  engine: sqlite3\\n  name: '/home/inventree/data/database.sqlite3'" /etc/inventree/config.yaml
+  fi
 fi
 $STD inventree run invoke update
 msg_ok "Configured InvenTree"
@@ -23,7 +23,7 @@ msg_ok "Installed Dependencies"
 PG_VERSION="17" PG_MODULES="pgvector" setup_postgresql
 PG_DB_NAME="ironclaw" PG_DB_USER="ironclaw" PG_DB_EXTENSIONS="vector" setup_postgresql_db

-fetch_and_deploy_gh_release "ironclaw-bin" "nearai/ironclaw" "prebuild" "latest" "/usr/local/bin" \
+fetch_and_deploy_gh_release "ironclaw-bin" "nearai/ironclaw" "prebuild" "ironclaw-v0.29.1" "/usr/local/bin" \
  "ironclaw-$(uname -m)-unknown-linux-gnu.tar.gz"
 chmod +x /usr/local/bin/ironclaw

@@ -20,7 +20,7 @@ fetch_and_deploy_gh_release "nametag" "mattogodoy/nametag" "tarball" "latest" "/

 msg_info "Setting up Application"
 cd /opt/nametag
-$STD npm ci
+$STD npm ci --include=dev
 DATABASE_URL="postgresql://${PG_DB_USER}:${PG_DB_PASS}@127.0.0.1:5432/${PG_DB_NAME}" $STD npx prisma generate
 DATABASE_URL="postgresql://${PG_DB_USER}:${PG_DB_PASS}@127.0.0.1:5432/${PG_DB_NAME}" $STD npx prisma migrate deploy
 msg_ok "Set up Application"
@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Majiiin
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/iib0011/omni-tools
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y nginx
+msg_ok "Installed Dependencies"
+
+NODE_VERSION="24" setup_nodejs
+fetch_and_deploy_gh_release "omnitools" "iib0011/omni-tools" "tarball"
+
+msg_info "Building OmniTools"
+cd /opt/omnitools
+export HUSKY=0
+$STD npm ci
+$STD npm run build
+msg_ok "Built OmniTools"
+
+msg_info "Publishing Web Assets"
+rm -rf /usr/share/nginx/html
+mkdir -p /usr/share/nginx/html
+cp -a /opt/omnitools/dist/. /usr/share/nginx/html/
+rm -rf /opt/omnitools/node_modules
+msg_ok "Published Web Assets"
+
+msg_info "Configuring Nginx"
+sed -i \
+  's/application\/javascript.*js;/application\/javascript                js mjs;/' \
+  /etc/nginx/mime.types
+
+cat <<'EOF' >/etc/nginx/sites-available/omnitools
+server {
+    listen 80 default_server;
+    listen [::]:80 default_server;
+
+    server_name _;
+
+    root /usr/share/nginx/html;
+    index index.html;
+
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+}
+EOF
+
+ln -sf /etc/nginx/sites-available/omnitools /etc/nginx/sites-enabled/omnitools
+rm -f /etc/nginx/sites-enabled/default
+$STD nginx -t
+systemctl enable -q --now nginx
+systemctl reload nginx
+msg_ok "Configured Nginx"
+
+motd_ssh
+customize
+cleanup_lxc
@@ -19,10 +19,10 @@ $STD apt install -y \
  build-essential \
  imagemagick \
  fonts-liberation \
+  gnupg \
  optipng \
  libpq-dev \
  libmagic-dev \
-  libzbar0t64 \
  poppler-utils \
  default-libmysqlclient-dev \
  automake \
@@ -43,16 +43,15 @@ $STD apt install -y \
  ghostscript
 msg_ok "Installed Dependencies"

-PG_VERSION="16" setup_postgresql
+PG_VERSION="18" setup_postgresql
 PG_DB_NAME="paperlessdb" PG_DB_USER="paperless" setup_postgresql_db
 PYTHON_VERSION="3.13" setup_uv
-fetch_and_deploy_gh_release "paperless" "paperless-ngx/paperless-ngx" "prebuild" "v2.20.15" "/opt/paperless" "paperless*tar.xz"
+fetch_and_deploy_gh_release "paperless" "paperless-ngx/paperless-ngx" "prebuild" "latest" "/opt/paperless" "paperless*tar.xz"

 msg_info "Setup Paperless-ngx"
 cd /opt/paperless
 rm -rf /opt/paperless/docker
 $STD uv sync --all-extras
-curl -fsSL "https://raw.githubusercontent.com/paperless-ngx/paperless-ngx/main/paperless.conf.example" -o /opt/paperless/paperless.conf
 mkdir -p /opt/paperless_data/{consume,data,media,trash}
 mkdir -p /opt/paperless/static
 SECRET_KEY="$(head /dev/urandom | tr -dc A-Za-z0-9 | head -c 32)"
@@ -69,12 +68,12 @@ sed -i \
  -e "s|#PAPERLESS_MEDIA_ROOT=../media|PAPERLESS_MEDIA_ROOT=/opt/paperless_data/media|" \
  -e "s|#PAPERLESS_EMPTY_TRASH_DIR=|PAPERLESS_EMPTY_TRASH_DIR=/opt/paperless_data/trash|" \
  -e "s|#PAPERLESS_STATICDIR=../static|PAPERLESS_STATICDIR=/opt/paperless/static|" \
-  -e 's|#PAPERLESS_DBHOST=localhost|PAPERLESS_DBHOST=localhost|' \
+  -e 's|#PAPERLESS_DBHOST=localhost|PAPERLESS_DBENGINE=postgresql\nPAPERLESS_DBHOST=localhost|' \
  -e 's|#PAPERLESS_DBPORT=5432|PAPERLESS_DBPORT=5432|' \
  -e "s|#PAPERLESS_DBNAME=paperless|PAPERLESS_DBNAME=$PG_DB_NAME|" \
  -e "s|#PAPERLESS_DBUSER=paperless|PAPERLESS_DBUSER=$PG_DB_USER|" \
  -e "s|#PAPERLESS_DBPASS=paperless|PAPERLESS_DBPASS=$PG_DB_PASS|" \
-  -e "s|#PAPERLESS_SECRET_KEY=change-me|PAPERLESS_SECRET_KEY=$SECRET_KEY|" \
+  -e "s|PAPERLESS_SECRET_KEY=change-me|PAPERLESS_SECRET_KEY=$SECRET_KEY|" \
  /opt/paperless/paperless.conf
 cd /opt/paperless/src
 set -a
@@ -152,7 +151,7 @@ Requires=redis.service

 [Service]
 WorkingDirectory=/opt/paperless/src
-ExecStart=uv run -- granian --interface asgi --ws "paperless.asgi:application"
+ExecStart=uv run -- granian --interface asginl --ws --loop uvloop "paperless.asgi:application"
 Environment=GRANIAN_HOST=::
 Environment=GRANIAN_PORT=8000
 Environment=GRANIAN_WORKERS=1
@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/pglombardo/PasswordPusher
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  default-libmysqlclient-dev \
+  git \
+  libpq-dev \
+  libsqlite3-dev \
+  pkg-config
+msg_ok "Installed Dependencies"
+
+RUBY_VERSION="4.0.5" RUBY_INSTALL_RAILS="false" setup_ruby
+NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
+export PATH="$HOME/.rbenv/shims:$HOME/.rbenv/bin:$PATH"
+
+fetch_and_deploy_gh_release "passwordpusher" "pglombardo/PasswordPusher" "tarball"
+
+msg_info "Installing Gem Dependencies"
+cd /opt/passwordpusher
+$STD bundle config set --local without 'development test'
+$STD bundle config set --local deployment 'true'
+$STD bundle install
+msg_ok "Installed Gem Dependencies"
+
+msg_info "Installing JS Dependencies"
+$STD yarn install --frozen-lockfile
+msg_ok "Installed JS Dependencies"
+
+msg_info "Configuring PasswordPusher"
+mkdir -p /opt/passwordpusher/storage/db
+SECRET_KEY_BASE=$(bundle exec rails secret)
+MASTER_KEY=$(openssl rand -hex 32)
+cat <<EOF >/opt/passwordpusher/.env.production
+SECRET_KEY_BASE=${SECRET_KEY_BASE}
+PWPUSH_MASTER_KEY=${MASTER_KEY}
+PWP__FILES__STORAGE=local
+RAILS_LOG_TO_STDOUT=true
+PORT=5100
+EOF
+msg_ok "Configured PasswordPusher"
+
+msg_info "Setting up Database"
+RAILS_ENV=production $STD bundle exec rails db:setup
+msg_ok "Set up Database"
+
+msg_info "Precompiling Assets"
+RAILS_ENV=production SECRET_KEY_BASE_DUMMY=1 $STD bundle exec rails assets:precompile
+msg_ok "Precompiled Assets"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/passwordpusher.service
+[Unit]
+Description=Password Pusher
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/passwordpusher
+Environment=RAILS_ENV=production
+Environment=PATH=/root/.rbenv/shims:/root/.rbenv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+EnvironmentFile=/opt/passwordpusher/.env.production
+ExecStart=/root/.rbenv/shims/bundle exec puma -C config/puma.rb -e production
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now passwordpusher
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc
@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: n8flx
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://www.satisfactorygame.com/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  lib32gcc-s1 \
+  lib32stdc++6
+msg_ok "Installed Dependencies"
+
+msg_info "Creating Steam User and Application Directories"
+useradd --system \
+  --create-home \
+  --home-dir /home/steam \
+  --shell /usr/sbin/nologin \
+  steam
+mkdir -p /opt/satisfactory/server /opt/steamcmd
+chown -R steam:steam /opt/satisfactory /opt/steamcmd /home/steam
+msg_ok "Created Steam User and Application Directories"
+
+fetch_and_deploy_from_url \
+  "https://steamcdn-a.akamaihd.net/client/installer/steamcmd_linux.tar.gz" \
+  "/opt/steamcmd"
+chown -R steam:steam /opt/steamcmd
+
+msg_info "Installing Satisfactory Dedicated Server"
+$STD runuser -u steam -- /opt/steamcmd/steamcmd.sh \
+  +force_install_dir /opt/satisfactory/server \
+  +login anonymous \
+  +app_update 1690800 -beta public validate \
+  +quit
+msg_ok "Installed Satisfactory Dedicated Server"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/satisfactory.service
+[Unit]
+Description=Satisfactory Dedicated Server
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=simple
+User=steam
+Group=steam
+WorkingDirectory=/opt/satisfactory/server
+Environment=LANG=C.UTF-8
+Environment=HOME=/home/steam
+ExecStart=/opt/satisfactory/server/FactoryServer.sh -log
+Restart=on-failure
+RestartSec=10
+KillSignal=SIGINT
+TimeoutStopSec=120
+StandardOutput=journal+console
+StandardError=journal+console
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now satisfactory
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc
@@ -84,6 +84,7 @@ msg_info "Configuring Nginx"
 sed \
  -e 's|${SPARKY_FITNESS_SERVER_HOST}|127.0.0.1|g' \
  -e 's|${SPARKY_FITNESS_SERVER_PORT}|3010|g' \
+  -e "s|\${SPARKY_FITNESS_FRONTEND_URL}|http://${LOCAL_IP}:80|g" \
  -e 's|${NGINX_LISTEN_PORT}|80|g' \
  -e 's|${NGINX_ACCESS_LOG}|/var/log/nginx/sparkyfitness.access.log|g' \
  -e 's|${NGINX_ERROR_LOG}|/var/log/nginx/sparkyfitness.error.log|g' \
@@ -51,7 +51,14 @@ msg_ok "Ran Database Migrations"

 msg_info "Creating Admin User"
 cd /opt/sync-in
-$STD npx sync-in-server create-user
+ADMIN_PASS=$(openssl rand -base64 18)
+$STD npx sync-in-server create-user --role admin --login admin --password "${ADMIN_PASS}"
+cat <<EOF >~/sync-in.creds
+Sync-in Credentials
+====================
+Login: admin
+Password: ${ADMIN_PASS}
+EOF
 msg_ok "Created Admin User"

 VERSION=$(node -pe "require('/opt/sync-in/node_modules/@sync-in/server/package.json').version" 2>/dev/null || echo "")
@@ -85,7 +85,8 @@ mkdir -p /opt/termix/data \
  /opt/termix/nginx \
  /opt/termix/nginx/logs \
  /opt/termix/nginx/cache \
-  /opt/termix/nginx/client_body
+  /opt/termix/nginx/client_body \
+  /opt/termix/db/data

 cp -r /opt/termix/dist/* /opt/termix/html/ 2>/dev/null || true
 cp -r /opt/termix/src/locales /opt/termix/html/locales 2>/dev/null || true
@@ -13,7 +13,8 @@ setting_up_container
 network_check
 update_os

-fetch_and_deploy_gh_release "vikunja" "go-vikunja/vikunja" "binary" "latest" "" "vikunja-*-$(arch_resolve "x86_64" "aarch64").deb"
+RELEASE="v2.3.0"
+fetch_and_deploy_gh_release "vikunja" "go-vikunja/vikunja" "binary" "${RELEASE}" "" "vikunja-*-$(arch_resolve "x86_64" "aarch64").deb"

 msg_info "Setting up Vikunja"
 sed -i 's|^# \(service:\)|\1|' /etc/vikunja/config.yml
@@ -3831,6 +3831,94 @@ runtime_script_status_guard() {
  return 0
 }

+# ------------------------------------------------------------------------------
+# check_container_os_guard()
+#
+# - Compares the container OS (/etc/os-release) with the script's recommended
+#   var_os/var_version before running update_script
+# - On mismatch: interactive runs ask whether to continue (default: no);
+#   headless runs (PHS_SILENT=1 / no tty) abort instead of updating on an
+#   unsupported base and leaving the app broken mid-update
+# - Bypass via var_ignore_os_mismatch=1|yes|true|on (still warns, but continues)
+# ------------------------------------------------------------------------------
+check_container_os_guard() {
+  local rec_os="${var_os:-}" rec_ver="${var_version:-}"
+  rec_os="${rec_os,,}"
+  [[ -z "$rec_os" || -z "$rec_ver" ]] && return 0
+  [[ -r /etc/os-release ]] || return 0
+
+  local cur_os cur_ver
+  cur_os="$(. /etc/os-release 2>/dev/null; echo "${ID:-}")"
+  cur_ver="$(. /etc/os-release 2>/dev/null; echo "${VERSION_ID:-}")"
+  cur_os="${cur_os,,}"
+  [[ -z "$cur_os" || -z "$cur_ver" ]] && return 0
+
+  # Exact version or prefix on a dot boundary (e.g. alpine 3.22 matches 3.22.1)
+  if [[ "$cur_os" == "$rec_os" ]] && [[ "$cur_ver" == "$rec_ver" || "$cur_ver" == "$rec_ver".* ]]; then
+    return 0
+  fi
+
+  local downgraded_target=0
+  if [[ "$cur_os" == "$rec_os" ]] && [[ "$cur_ver" != "$rec_ver" ]]; then
+    if [[ "$(printf '%s\n%s\n' "$cur_ver" "$rec_ver" | sort -V | tail -n1)" == "$cur_ver" ]]; then
+      downgraded_target=1
+    fi
+  fi
+
+  case "${var_ignore_os_mismatch:-}" in
+  1 | yes | true | on)
+    msg_warn "Container OS is ${cur_os} ${cur_ver} but the script recommends ${rec_os} ${rec_ver} — continuing via var_ignore_os_mismatch (may break, no support)."
+    return 0
+    ;;
+  esac
+
+  # Persistent opt-out: stores the ignored target version, so the question
+  # comes back once the script targets a newer OS again
+  local ignore_file="/usr/local/community-scripts/ignore-os-mismatch"
+  if [[ -f "$ignore_file" && "$(cat "$ignore_file" 2>/dev/null)" == "${rec_os} ${rec_ver}" ]]; then
+    msg_warn "Container OS is ${cur_os} ${cur_ver} but the script recommends ${rec_os} ${rec_ver} — continuing (previously ignored via ${ignore_file}, may break, no support)."
+    return 0
+  fi
+
+  local mismatch_detail remediation
+  if [[ "$downgraded_target" -eq 1 ]]; then
+    mismatch_detail="Your container runs ${cur_os} ${cur_ver}, which is newer than what this script now targets (${rec_os} ${rec_ver}).\n\nThe target was likely lowered on purpose, e.g. because ${APP:-the app} had problems on newer OS versions - check the GitHub issues for ${APP:-this app} for details.\n\nContinuing on ${cur_ver} often still works, but isn't guaranteed. If you are unsure, ask in our Discord (https://discord.gg/3AnUqsXnmK) before continuing."
+    remediation="This script now targets the older ${rec_os} ${rec_ver}. Check the GitHub issues for ${APP:-this app}, or ask in Discord (https://discord.gg/3AnUqsXnmK) if you are unsure"
+  else
+    mismatch_detail="This container runs ${cur_os} ${cur_ver}, but this script now targets ${rec_os} ${rec_ver}.\n\nUpdating on the older base OS may fail or leave ${APP:-the application} broken (e.g. required runtime versions are not available).\n\nRecommended: upgrade the container OS to ${rec_os} ${rec_ver} first, then run this update again."
+    remediation="Upgrade the container OS to ${rec_os} ${rec_ver} first, then run this update again"
+  fi
+
+  if [[ "${PHS_SILENT:-0}" != "1" ]] && command -v whiptail &>/dev/null && [ -t 0 ] && [[ "$TERM" != "dumb" ]]; then
+    local choice
+    choice=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "OS VERSION MISMATCH" --menu \
+      "${mismatch_detail}\n\nIf you continue anyway, it may break — no support is provided in that case.\n\nContinue anyway?" \
+      20 70 3 \
+      "1" "No  (cancel update)" \
+      "2" "Yes (continue this time)" \
+      "3" "Yes (continue and don't ask again)" \
+      --nocancel --default-item "1" 3>&1 1>&2 2>&3)
+    case "$choice" in
+    2)
+      msg_warn "Continuing update on ${cur_os} ${cur_ver} despite recommended ${rec_os} ${rec_ver} — may break, no support."
+      return 0
+      ;;
+    3)
+      mkdir -p "${ignore_file%/*}"
+      echo "${rec_os} ${rec_ver}" >"$ignore_file"
+      msg_warn "Continuing update on ${cur_os} ${cur_ver}; OS check for ${rec_os} ${rec_ver} disabled via ${ignore_file} — may break, no support."
+      return 0
+      ;;
+    esac
+    msg_error "Update cancelled: container OS ${cur_os} ${cur_ver} does not match the recommended ${rec_os} ${rec_ver}."
+    return 1
+  fi
+
+  msg_error "Container OS ${cur_os} ${cur_ver} does not match the recommended ${rec_os} ${rec_ver} — skipping update."
+  msg_error "${remediation} — or bypass this check (may break, no support) with: echo \"${rec_os} ${rec_ver}\" > ${ignore_file}"
+  return 1
+}
+
 # ------------------------------------------------------------------------------
 # start()
 #
@@ -3852,6 +3940,7 @@ start() {
    ensure_profile_loaded
    get_lxc_ip
    runtime_script_status_guard update || return 0
+    check_container_os_guard || return 0
    update_script
    run_addon_updates
    update_motd_ip
@@ -3863,6 +3952,7 @@ start() {
    ensure_profile_loaded
    get_lxc_ip
    runtime_script_status_guard update || return 0
+    check_container_os_guard || return 0
    update_script
    run_addon_updates
    update_motd_ip
@@ -3893,6 +3983,7 @@ start() {
    ensure_profile_loaded
    get_lxc_ip
    runtime_script_status_guard update || return 0
+    check_container_os_guard || return 0
    update_script
    run_addon_updates
    update_motd_ip
@@ -5140,7 +5231,10 @@ EOF
    echo -en "${YW}Select option [1-${max_option}] (default: 1, auto-remove in 60s): ${CL}"

    local response=""
-    if read -t 60 -r response; then
+    local read_rc
+    read -t 60 -r response
+    read_rc=$?
+    if [[ $read_rc -eq 0 ]]; then
      case "${response:-1}" in
      1)
        # Remove container
@@ -5359,13 +5453,20 @@ EOF
        fi
        ;;
      esac
-    else
+    elif [[ $read_rc -gt 128 ]]; then
      # Timeout - auto-remove
      echo ""
      msg_info "No response - removing container ${CTID}"
      pct stop "$CTID" &>/dev/null || true
      pct destroy "$CTID" &>/dev/null || true
      msg_ok "Container ${CTID} removed"
+    else
+      # read itself failed (e.g. broken/closed stdin, I/O error) rather than
+      # timing out - don't guess and destroy the container on a read we
+      # couldn't actually capture; keep it since that's the reversible choice.
+      echo ""
+      msg_error "Could not read your response (stdin error) - keeping container ${CTID} for safety."
+      msg_error "Remove it manually if not needed: pct destroy ${CTID}"
    fi

    # Force one final status update attempt after cleanup
@@ -497,7 +497,10 @@ error_handler() {
      fi

      local response=""
-      if read -t 60 -r response; then
+      local read_rc
+      read -t 60 -r response
+      read_rc=$?
+      if [[ $read_rc -eq 0 ]]; then
        if [[ -z "$response" || "$response" =~ ^[Yy]$ ]]; then
          echo ""
          if declare -f msg_info >/dev/null 2>&1; then
@@ -520,7 +523,7 @@ error_handler() {
            echo -e "${YW}Container ${CTID} kept for debugging${CL}"
          fi
        fi
-      else
+      elif [[ $read_rc -gt 128 ]]; then
        # Timeout - auto-remove
        echo ""
        if declare -f msg_info >/dev/null 2>&1; then
@@ -535,6 +538,18 @@ error_handler() {
        else
          echo -e "${GN}✔${CL} Container ${CTID} removed"
        fi
+      else
+        # read itself failed (e.g. broken/closed stdin, I/O error) rather than
+        # timing out - don't guess and destroy the container on a read we
+        # couldn't actually capture; keep it since that's the reversible choice.
+        echo ""
+        if declare -f msg_error >/dev/null 2>&1; then
+          msg_error "Could not read your response (stdin error) - keeping container ${CTID} for safety."
+          msg_error "Remove it manually if not needed: pct destroy ${CTID}"
+        else
+          echo -e "${YW}Could not read your response (stdin error) - keeping container ${CTID} for safety.${CL}"
+          echo -e "${YW}Remove it manually if not needed: pct destroy ${CTID}${CL}"
+        fi
      fi
    fi
  fi
@@ -300,7 +300,7 @@ EOF
      --title "PVE-ENTERPRISE" \
      --menu "'pve-enterprise' repository already exists.\n\nWhat do you want to do?" 14 58 2 \
      "keep" "Keep as is" \
-      "disable" "Comment out (disable) this repo" \
+      "disable" "Disable this repo (set Enabled: false)" \
      "delete" "Delete this repo file" \
      3>&2 2>&1 1>&3)
    case $CHOICE in
@@ -0,0 +1,693 @@
+#!/usr/bin/env bash
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/refs/heads/main/misc/core.func)
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/api.func) 2>/dev/null || true
+load_functions
+declare -f init_tool_telemetry &>/dev/null && init_tool_telemetry "storage-share-helper" "pve"
+
+set -eEuo pipefail
+
+function header_info() {
+  clear
+  cat <<"EOF"
+    _____ __                                 ___    _________ 
+   / ___// /_____  _________ _____ ____     /   |  /  _/ __ \
+   \__ \/ __/ __ \/ ___/ __ `/ __ `/ _ \   / /| |  / // / / /
+  ___/ / /_/ /_/ / /  / /_/ / /_/ /  __/  / ___ |_/ // /_/ / 
+ /____/\__/\____/_/   \__,_/\__, /\___/  /_/  |_/___/_____/  
+                            /____/                            
+
+ Proxmox Storage Allrounder
+ SMB | NFS | iSCSI | LVM-on-iSCSI | LXC Mountpoints | Host Shares
+EOF
+}
+
+pause() {
+  read -r -p "Press Enter to continue..." _
+}
+
+require_pve() {
+  if ! command -v pct >/dev/null 2>&1 || ! command -v pvesm >/dev/null 2>&1; then
+    msg_error "This script must run on a Proxmox VE host (pct/pvesm missing)."
+    exit 1
+  fi
+}
+
+ensure_packages() {
+  local packages=()
+
+  command -v whiptail >/dev/null 2>&1 || packages+=("whiptail")
+  command -v mount.cifs >/dev/null 2>&1 || packages+=("cifs-utils")
+  command -v showmount >/dev/null 2>&1 || packages+=("nfs-common")
+  command -v iscsiadm >/dev/null 2>&1 || packages+=("open-iscsi")
+
+  if [[ ${#packages[@]} -gt 0 ]]; then
+    msg_info "Installing required packages: ${packages[*]}"
+    apt update >/dev/null 2>&1
+    apt install -y "${packages[@]}" >/dev/null 2>&1
+    msg_ok "Dependencies installed"
+  fi
+}
+
+confirm_start() {
+  whiptail --backtitle "Proxmox VE Helper Scripts" --title "Storage Share Allrounder" \
+    --yesno "This AIO wizard can test and configure SMB/NFS/iSCSI, create/remove Proxmox storages, manage LXC mountpoints and optionally create host shares. Proceed?" 13 100
+}
+
+read_input() {
+  local title="$1"
+  local prompt="$2"
+  local default_value="${3:-}"
+
+  whiptail --backtitle "Proxmox VE Helper Scripts" --title "$title" \
+    --inputbox "$prompt" 11 100 "$default_value" 3>&1 1>&2 2>&3
+}
+
+read_password() {
+  local title="$1"
+  local prompt="$2"
+
+  whiptail --backtitle "Proxmox VE Helper Scripts" --title "$title" \
+    --passwordbox "$prompt" 11 100 3>&1 1>&2 2>&3
+}
+
+confirm_yes_no() {
+  local title="$1"
+  local prompt="$2"
+  local height="${3:-11}"
+  local width="${4:-100}"
+
+  whiptail --backtitle "Proxmox VE Helper Scripts" --title "$title" \
+    --yesno "$prompt" "$height" "$width"
+}
+
+# Destructive confirmation: defaults to "No" so a stray Enter never removes anything.
+confirm_danger() {
+  local title="$1"
+  local prompt="$2"
+  local height="${3:-15}"
+  local width="${4:-100}"
+
+  whiptail --backtitle "Proxmox VE Helper Scripts" --title "$title" \
+    --defaultno --yesno "$prompt" "$height" "$width"
+}
+
+# Shown before slow data gathering. Goes to stderr: inside $(...) captures, stdout is
+# swallowed — stderr is the real terminal.
+show_loading() {
+  echo -e "${YW}Loading... gathering data, this can take a moment (CTRL+C to abort)${CL}" >&2
+}
+
+# Info popup that stays visible inside $(...) captures: whiptail draws its UI on
+# stdout, so without 1>&2 the dialog would be captured and the script appears hung.
+notice_box() {
+  local title="$1"
+  local text="$2"
+  whiptail --backtitle "Proxmox VE Helper Scripts" --title "$title" \
+    --msgbox "$text" 10 80 1>&2
+}
+
+# Interactive container picker (read-only): returns the chosen CTID on stdout.
+pick_container() {
+  local title="$1"
+  local -a rows=()
+  local ctid status name label
+
+  show_loading
+  while IFS=$'\t' read -r ctid status name; do
+    [[ -z "$ctid" ]] && continue
+    label=$(printf '%-58s' "${name:-<no-name>} [${status}]")
+    rows+=("$ctid" "$label")
+  done < <(pct list 2>/dev/null | awk 'NR>1 {print $1"\t"$2"\t"$NF}')
+
+  if [[ ${#rows[@]} -eq 0 ]]; then
+    notice_box "$title" "No LXC containers found on this host."
+    return 1
+  fi
+
+  whiptail --backtitle "Proxmox VE Helper Scripts" --title "$title" \
+    --menu "Select a container:" 24 80 16 "${rows[@]}" 3>&1 1>&2 2>&3
+}
+
+# Interactive multi-select picker over ALL mountpoints across ALL containers (read-only).
+# Returns chosen entries as "<ctid>:<mpX>" tokens on stdout.
+# Reads /etc/pve/lxc/*.conf directly (one 'pct config' per CT is far too slow);
+# awk stops at the first '[section]' so snapshot mp entries are not listed.
+pick_all_mountpoints_multi() {
+  local title="$1"
+  local -a rows=()
+  local conf ctid name line key def label
+
+  show_loading
+  for conf in /etc/pve/lxc/*.conf; do
+    [[ -e "$conf" ]] || continue
+    ctid="$(basename "$conf" .conf)"
+    name=$(awk '/^\[/{exit} $1=="hostname:"{print $2; exit}' "$conf")
+    while IFS= read -r line; do
+      [[ -z "$line" ]] && continue
+      key="${line%%:*}"
+      def="${line#*: }"
+      label=$(printf '%-86s' "CT ${ctid} ${name:-<no-name>} | ${key}: ${def}")
+      rows+=("${ctid}:${key}" "$label" "OFF")
+    done < <(awk '/^\[/{exit} /^mp[0-9]+:/{print}' "$conf")
+  done
+
+  if [[ ${#rows[@]} -eq 0 ]]; then
+    notice_box "$title" "No LXC mountpoints found on any container."
+    return 1
+  fi
+
+  whiptail --backtitle "Proxmox VE Helper Scripts" --title "$title" \
+    --checklist "Select mountpoint(s) to remove across all containers (Space to toggle, Enter to confirm):" \
+    24 112 16 "${rows[@]}" 3>&1 1>&2 2>&3
+}
+
+# Interactive multi-select storage picker (read-only): returns chosen storage IDs on stdout.
+pick_storages_multi() {
+  local title="$1"
+  local -a rows=()
+  local stype sid label
+
+  show_loading
+  while read -r stype sid; do
+    [[ -z "$sid" ]] && continue
+    label=$(printf '%-58s' "[${stype}]")
+    rows+=("$sid" "$label" "OFF")
+  done < <(awk -F': ' '/^[a-z]+: /{print $1, $2}' /etc/pve/storage.cfg 2>/dev/null)
+
+  if [[ ${#rows[@]} -eq 0 ]]; then
+    notice_box "$title" "No storages found in /etc/pve/storage.cfg."
+    return 1
+  fi
+
+  whiptail --backtitle "Proxmox VE Helper Scripts" --title "$title" \
+    --checklist "Select storage(s) to remove (Space to toggle, Enter to confirm):" \
+    24 80 16 "${rows[@]}" 3>&1 1>&2 2>&3
+}
+
+# Interactive multi-select container picker (read-only): returns chosen CTIDs on stdout.
+pick_containers_multi() {
+  local title="$1"
+  local -a rows=()
+  local ctid status name label
+
+  show_loading
+  while IFS=$'\t' read -r ctid status name; do
+    [[ -z "$ctid" ]] && continue
+    label=$(printf '%-58s' "${name:-<no-name>} [${status}]")
+    rows+=("$ctid" "$label" "OFF")
+  done < <(pct list 2>/dev/null | awk 'NR>1 {print $1"\t"$2"\t"$NF}')
+
+  if [[ ${#rows[@]} -eq 0 ]]; then
+    notice_box "$title" "No LXC containers found on this host."
+    return 1
+  fi
+
+  whiptail --backtitle "Proxmox VE Helper Scripts" --title "$title" \
+    --checklist "Select one or more containers (Space to toggle, Enter to confirm):" \
+    24 80 16 "${rows[@]}" 3>&1 1>&2 2>&3
+}
+
+manual_smb_test() {
+  header_info
+  local server share username password domain vers mount_dir mount_opts
+
+  server=$(read_input "SMB Test" "SMB server/IP (e.g. 10.0.1.9)") || return
+  share=$(read_input "SMB Test" "Share name (without leading //)" "Proxmox") || return
+  username=$(read_input "SMB Test" "Username" "proxmox") || return
+  password=$(read_password "SMB Test" "Password for ${username}") || return
+  domain=$(read_input "SMB Test" "Domain/Workgroup (optional, leave empty if not needed)") || return
+  vers=$(read_input "SMB Test" "SMB version (e.g. 3.0, 3.1.1)" "3.1.1") || return
+  mount_dir="/mnt/test-smb"
+
+  mkdir -p "$mount_dir"
+
+  mount_opts="username=${username},password=${password},vers=${vers},sec=ntlmssp"
+  if [[ -n "$domain" ]]; then
+    mount_opts+=";domain=${domain}"
+  fi
+
+  msg_info "Testing SMB mount on ${mount_dir}"
+  if mount -t cifs "//${server}/${share}" "$mount_dir" -o "${mount_opts//;/,}" >/dev/null 2>&1; then
+    touch "${mount_dir}/smb-test-$(date +%s)" >/dev/null 2>&1 || true
+    umount "$mount_dir" >/dev/null 2>&1 || true
+    msg_ok "SMB test successful"
+  else
+    msg_error "SMB test failed. Check network/firewall/credentials/share permissions."
+  fi
+
+  pause
+}
+
+manual_nfs_test() {
+  header_info
+  local server export_path mount_dir
+
+  server=$(read_input "NFS Test" "NFS server/IP (e.g. 10.0.6.159)") || return
+  export_path=$(read_input "NFS Test" "NFS export path (e.g. /srv/proxmox-nfs)") || return
+  mount_dir="/mnt/test-nfs"
+
+  mkdir -p "$mount_dir"
+
+  msg_info "Testing NFS mount on ${mount_dir}"
+  if mount -t nfs "${server}:${export_path}" "$mount_dir" >/dev/null 2>&1; then
+    touch "${mount_dir}/nfs-test-$(date +%s)" >/dev/null 2>&1 || true
+    umount "$mount_dir" >/dev/null 2>&1 || true
+    msg_ok "NFS test successful"
+  else
+    msg_error "NFS test failed. Check export/firewall/network permissions."
+  fi
+
+  pause
+}
+
+manual_iscsi_discovery() {
+  header_info
+  local portal
+
+  portal=$(read_input "iSCSI Discovery" "iSCSI portal IP/FQDN (e.g. 10.0.1.20)") || return
+  msg_info "Running iSCSI target discovery on ${portal}"
+  if iscsiadm -m discovery -t sendtargets -p "$portal"; then
+    msg_ok "iSCSI discovery completed"
+  else
+    msg_error "iSCSI discovery failed"
+  fi
+
+  pause
+}
+
+add_smb_storage() {
+  header_info
+  local storage_id server share username password content nodes options
+
+  storage_id=$(read_input "Add SMB/CIFS Storage" "Storage ID (unique, e.g. smb-media)") || return
+  server=$(read_input "Add SMB/CIFS Storage" "SMB server/IP") || return
+  share=$(read_input "Add SMB/CIFS Storage" "Share name (without //)") || return
+  username=$(read_input "Add SMB/CIFS Storage" "Username") || return
+  password=$(read_password "Add SMB/CIFS Storage" "Password for ${username}") || return
+  content=$(read_input "Add SMB/CIFS Storage" "Content types (comma separated)" "backup,iso,vztmpl,snippets") || return
+  nodes=$(read_input "Add SMB/CIFS Storage" "Nodes (optional, comma separated)") || return
+  options=$(read_input "Add SMB/CIFS Storage" "Mount options (optional, e.g. vers=3.1.1,domain=WORKGROUP)") || return
+
+  local cmd=(pvesm add cifs "$storage_id" --server "$server" --share "$share" --username "$username" --password "$password" --content "$content")
+  [[ -n "$nodes" ]] && cmd+=(--nodes "$nodes")
+  [[ -n "$options" ]] && cmd+=(--options "$options")
+
+  if "${cmd[@]}" >/dev/null 2>&1; then
+    msg_ok "SMB storage '${storage_id}' added"
+  else
+    msg_error "Failed to add SMB storage '${storage_id}'"
+  fi
+
+  pause
+}
+
+add_nfs_storage() {
+  header_info
+  local storage_id server export_path content nodes options
+
+  storage_id=$(read_input "Add NFS Storage" "Storage ID (unique, e.g. nfs-vmdata)") || return
+  server=$(read_input "Add NFS Storage" "NFS server/IP") || return
+  export_path=$(read_input "Add NFS Storage" "Export path") || return
+  content=$(read_input "Add NFS Storage" "Content types (comma separated)" "images,rootdir") || return
+  nodes=$(read_input "Add NFS Storage" "Nodes (optional, comma separated)") || return
+  options=$(read_input "Add NFS Storage" "Mount options (optional)") || return
+
+  local cmd=(pvesm add nfs "$storage_id" --server "$server" --export "$export_path" --content "$content")
+  [[ -n "$nodes" ]] && cmd+=(--nodes "$nodes")
+  [[ -n "$options" ]] && cmd+=(--options "$options")
+
+  if "${cmd[@]}" >/dev/null 2>&1; then
+    msg_ok "NFS storage '${storage_id}' added"
+  else
+    msg_error "Failed to add NFS storage '${storage_id}'"
+  fi
+
+  pause
+}
+
+add_iscsi_storage() {
+  header_info
+  local storage_id portal target nodes
+
+  storage_id=$(read_input "Add iSCSI Storage" "Storage ID (unique, e.g. iscsi-synology)") || return
+  portal=$(read_input "Add iSCSI Storage" "Portal IP/FQDN") || return
+  target=$(read_input "Add iSCSI Storage" "Target IQN (e.g. iqn.2000-01.com.synology:...)") || return
+  nodes=$(read_input "Add iSCSI Storage" "Nodes (optional, comma separated)") || return
+
+  local cmd=(pvesm add iscsi "$storage_id" --portal "$portal" --target "$target")
+  [[ -n "$nodes" ]] && cmd+=(--nodes "$nodes")
+
+  if "${cmd[@]}" >/dev/null 2>&1; then
+    msg_ok "iSCSI storage '${storage_id}' added"
+  else
+    msg_error "Failed to add iSCSI storage '${storage_id}'"
+  fi
+
+  pause
+}
+
+add_lvm_on_base_storage() {
+  header_info
+  local storage_id base_storage vgname content shared
+
+  storage_id=$(read_input "Add LVM Storage" "LVM Storage ID (unique, e.g. lvm-iscsi01)") || return
+  base_storage=$(read_input "Add LVM Storage" "Base storage ID (usually iSCSI storage ID)") || return
+  vgname=$(read_input "Add LVM Storage" "Volume Group name on target") || return
+  content=$(read_input "Add LVM Storage" "Content types (comma separated)" "images,rootdir") || return
+  shared=$(read_input "Add LVM Storage" "Shared across nodes? 1=yes, 0=no" "1") || return
+
+  local cmd=(pvesm add lvm "$storage_id" --base "$base_storage" --vgname "$vgname" --content "$content" --shared "$shared")
+  if "${cmd[@]}" >/dev/null 2>&1; then
+    msg_ok "LVM storage '${storage_id}' added"
+  else
+    msg_error "Failed to add LVM storage '${storage_id}'"
+  fi
+
+  pause
+}
+
+remove_storage() {
+  header_info
+  local selection storage_id
+  local -a results=()
+
+  selection=$(pick_storages_multi "Remove Storage") || return
+  if [[ -z "$selection" ]]; then
+    msg_warn "No storage selected."
+    pause
+    return
+  fi
+
+  # Confirm each selected storage separately (defaults to No).
+  for storage_id in $selection; do
+    storage_id="${storage_id//\"/}"
+    [[ -z "$storage_id" ]] && continue
+
+    if confirm_danger "Remove Storage" \
+      "Really remove storage '${storage_id}' from the Proxmox config?
+
+This removes the storage definition only.
+Data on the underlying share/target is NOT deleted."; then
+      if pvesm remove "$storage_id" >/dev/null 2>&1; then
+        results+=("removed  ${storage_id}")
+      else
+        results+=("FAILED   ${storage_id}")
+      fi
+    else
+      results+=("skipped  ${storage_id}")
+    fi
+  done
+
+  header_info
+  echo -e "${BL}Remove storage — result${CL}\n"
+  printf '  %s\n' "${results[@]}"
+  echo
+  pause
+}
+
+find_next_mp_slot() {
+  local ctid="$1"
+  local used
+
+  used=$(pct config "$ctid" | awk -F: '/^mp[0-9]+:/ {gsub("mp", "", $1); print $1}')
+  for i in $(seq 0 255); do
+    if ! grep -qx "$i" <<<"$used"; then
+      echo "$i"
+      return
+    fi
+  done
+
+  echo ""
+}
+
+add_lxc_mountpoint() {
+  header_info
+  local ctid host_path ct_path mp_slot
+
+  ctid=$(pick_container "LXC: add mountpoint") || return
+  host_path=$(read_input "LXC Mountpoint" "Host path (must exist, e.g. /mnt/pve/smb-media)") || return
+  ct_path=$(read_input "LXC Mountpoint" "Container path (e.g. /mnt/media)") || return
+
+  if [[ ! -d "$host_path" ]]; then
+    msg_error "Host path does not exist: ${host_path}"
+    pause
+    return
+  fi
+
+  mp_slot=$(find_next_mp_slot "$ctid")
+  if [[ -z "$mp_slot" ]]; then
+    msg_error "No free mp slot available for container ${ctid}"
+    pause
+    return
+  fi
+
+  confirm_yes_no "LXC: add mountpoint" \
+    "Add mp${mp_slot} to CT ${ctid}?
+
+  ${host_path}  ->  ${ct_path}" 13 100 || return
+
+  if pct set "$ctid" -mp"$mp_slot" "$host_path",mp="$ct_path" >/dev/null 2>&1; then
+    msg_ok "Added mp${mp_slot}: ${host_path} -> ${ct_path} on CT ${ctid}"
+    msg_warn "If CT is unprivileged, ensure UID/GID mapping and filesystem permissions fit your workload."
+  else
+    msg_error "Failed to add mountpoint to CT ${ctid}"
+  fi
+
+  pause
+}
+
+remove_lxc_mountpoint() {
+  header_info
+  local selection entry ctid mp_key mp_def
+  local -a results=()
+
+  selection=$(pick_all_mountpoints_multi "LXC: remove mountpoint") || return
+  if [[ -z "$selection" ]]; then
+    msg_warn "No mountpoint selected."
+    pause
+    return
+  fi
+
+  # Confirm each selected mountpoint separately (defaults to No).
+  for entry in $selection; do
+    entry="${entry//\"/}"
+    [[ -z "$entry" ]] && continue
+    ctid="${entry%%:*}"
+    mp_key="${entry#*:}"
+    mp_def=$(pct config "$ctid" | awk -F': ' -v k="$mp_key" '$1==k{print $2}')
+
+    if confirm_danger "LXC: remove mountpoint" \
+      "Remove ${mp_key} from CT ${ctid}?
+
+  ${mp_key}: ${mp_def}
+
+This only detaches the mountpoint from the container.
+Data on the host is NOT deleted."; then
+      if pct set "$ctid" -delete "$mp_key" >/dev/null 2>&1; then
+        results+=("removed  CT ${ctid}  ${mp_key}")
+      else
+        results+=("FAILED   CT ${ctid}  ${mp_key}")
+      fi
+    else
+      results+=("skipped  CT ${ctid}  ${mp_key}")
+    fi
+  done
+
+  header_info
+  echo -e "${BL}Remove mountpoint — result${CL}\n"
+  printf '  %s\n' "${results[@]}"
+  echo
+  pause
+}
+
+list_lxc_mountpoints() {
+  header_info
+  local selection ctid mps
+
+  selection=$(pick_containers_multi "LXC: list mountpoints") || return
+  if [[ -z "$selection" ]]; then
+    msg_warn "No container selected."
+    pause
+    return
+  fi
+
+  for ctid in $selection; do
+    ctid="${ctid//\"/}"
+    [[ -z "$ctid" ]] && continue
+    echo -e "${BL}Mountpoints for CT ${ctid}${CL}"
+    mps=$(pct config "$ctid" | awk '/^mp[0-9]+:/{print}')
+    if [[ -n "$mps" ]]; then
+      echo "$mps"
+    else
+      echo "  (no mountpoints configured)"
+    fi
+    echo
+  done
+
+  pause
+}
+
+host_create_samba_share() {
+  header_info
+  local share_name share_path user_name user_pass
+
+  share_name=$(read_input "Host Samba Share" "Share name (e.g. data)") || return
+  share_path=$(read_input "Host Samba Share" "Share path on host (e.g. /srv/samba/data)" "/srv/samba/${share_name}") || return
+  user_name=$(read_input "Host Samba Share" "Linux/Samba username") || return
+  user_pass=$(read_password "Host Samba Share" "Password for ${user_name}") || return
+
+  msg_info "Installing Samba on host if needed"
+  apt update >/dev/null 2>&1
+  apt install -y samba >/dev/null 2>&1
+
+  mkdir -p "$share_path"
+  getent group sambashare >/dev/null 2>&1 || groupadd sambashare
+  id "$user_name" >/dev/null 2>&1 || useradd -M -s /usr/sbin/nologin -G sambashare "$user_name"
+  usermod -aG sambashare "$user_name"
+  chown -R root:sambashare "$share_path"
+  chmod 2775 "$share_path"
+
+  if ! (
+    echo "$user_pass"
+    echo "$user_pass"
+  ) | smbpasswd -s -a "$user_name" >/dev/null 2>&1; then
+    msg_error "Failed to set Samba password for ${user_name}"
+    pause
+    return
+  fi
+
+  if ! grep -q "^\[${share_name}\]" /etc/samba/smb.conf; then
+    cat <<EOF >>/etc/samba/smb.conf
+
+[${share_name}]
+   comment = Proxmox Host Share (${share_name})
+   path = ${share_path}
+   browseable = yes
+   read only = no
+   guest ok = no
+   create mask = 0664
+   directory mask = 2775
+   valid users = @sambashare
+EOF
+  fi
+
+  testparm -s >/dev/null 2>&1 || {
+    msg_error "Samba config validation failed (testparm). Check /etc/samba/smb.conf"
+    pause
+    return
+  }
+
+  systemctl enable --now smbd nmbd >/dev/null 2>&1
+  systemctl restart smbd nmbd >/dev/null 2>&1
+
+  msg_ok "Host SMB share created: //$(hostname -I | awk '{print $1}')/${share_name}"
+  msg_warn "Best practice: prefer running Samba in a dedicated LXC/VM for cleaner host separation."
+
+  pause
+}
+
+host_create_nfs_export() {
+  header_info
+  local export_path subnet options
+
+  export_path=$(read_input "Host NFS Export" "Export path on host (e.g. /srv/proxmox-nfs)" "/srv/proxmox-nfs") || return
+  subnet=$(read_input "Host NFS Export" "Allowed subnet/CIDR (e.g. 10.0.0.0/16)") || return
+  options=$(read_input "Host NFS Export" "Export options" "rw,sync,no_subtree_check,no_root_squash") || return
+
+  msg_info "Installing NFS server on host if needed"
+  apt update >/dev/null 2>&1
+  apt install -y nfs-kernel-server >/dev/null 2>&1
+
+  mkdir -p "$export_path"
+  chmod 0770 "$export_path"
+
+  if ! grep -qE "^${export_path//\//\/}[[:space:]]+${subnet//\//\/}\(" /etc/exports; then
+    echo "${export_path} ${subnet}(${options})" >>/etc/exports
+  fi
+
+  exportfs -ra >/dev/null 2>&1
+  systemctl enable --now nfs-kernel-server >/dev/null 2>&1
+
+  msg_ok "Host NFS export created: ${export_path} ${subnet}(${options})"
+  msg_warn "Best practice: use host exports carefully; dedicated storage VM/LXC is often cleaner."
+  pause
+}
+
+show_status() {
+  header_info
+  echo -e "${BL}pvesm status${CL}"
+  pvesm status || true
+  echo
+  echo -e "${BL}Mounted /mnt/pve paths${CL}"
+  mount | grep /mnt/pve || true
+  echo
+  echo -e "${BL}Mounted CIFS/NFS/iSCSI related paths${CL}"
+  mount | grep -E ' type (cifs|nfs|nfs4)' || true
+  echo
+  echo -e "${BL}iSCSI sessions${CL}"
+  iscsiadm -m session 2>/dev/null || true
+  echo
+  pause
+}
+
+main_menu() {
+  while true; do
+    local choice
+    choice=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "Storage Share Allrounder" \
+      --menu "Select action  (read-only actions are safe; write/remove actions ask for confirmation):" 30 116 22 \
+      " " "──────────  READ-ONLY (safe, no changes)  ──────────" \
+      "1" "Test   | SMB: manual mount test" \
+      "2" "Test   | NFS: manual mount test" \
+      "3" "Test   | iSCSI: discovery test" \
+      "4" "Read   | LXC: list mountpoints" \
+      "5" "Read   | Show storage/mount/iSCSI status" \
+      "  " "──────────  WRITE (modifies config / host)  ──────────" \
+      "6" "Write  | Proxmox: add SMB/CIFS storage" \
+      "7" "Write  | Proxmox: add NFS storage" \
+      "8" "Write  | Proxmox: add iSCSI storage" \
+      "9" "Write  | Proxmox: add LVM on base storage (e.g. iSCSI)" \
+      "10" "Write  | LXC: add bind mountpoint (pct set -mpX)" \
+      "11" "Write  | Host: install Samba + create SMB share" \
+      "12" "Write  | Host: install NFS server + create export" \
+      "   " "──────────  REMOVE (destructive, defaults to No)  ──────────" \
+      "13" "Remove | Proxmox: remove storage definition" \
+      "14" "Remove | LXC: remove mountpoint (pct set -delete mpX)" \
+      "0" "Exit" 3>&1 1>&2 2>&3) || break
+
+    # '|| true' so a cancelled sub-dialog (whiptail returns non-zero) returns to the
+    # menu instead of tripping 'set -e' and exiting the whole script.
+    case "$choice" in
+    1) manual_smb_test || true ;;
+    2) manual_nfs_test || true ;;
+    3) manual_iscsi_discovery || true ;;
+    4) list_lxc_mountpoints || true ;;
+    5) show_status || true ;;
+    6) add_smb_storage || true ;;
+    7) add_nfs_storage || true ;;
+    8) add_iscsi_storage || true ;;
+    9) add_lvm_on_base_storage || true ;;
+    10) add_lxc_mountpoint || true ;;
+    11) host_create_samba_share || true ;;
+    12) host_create_nfs_export || true ;;
+    13) remove_storage || true ;;
+    14) remove_lxc_mountpoint || true ;;
+    0) break ;;
+    *) ;;
+    esac
+  done
+}
+
+header_info
+root_check
+pve_check
+require_pve
+ensure_packages
+confirm_start || exit 0
+main_menu
+
+header_info
+msg_ok "Finished."
@@ -280,7 +280,7 @@ function extract_xz_with_pv() {
 function default_settings() {
  BRANCH="$stable"
  VMID=$(get_valid_nextid)
-  MACHINE="q35"
+  MACHINE=" -machine q35"
  FORMAT=""
  DISK_SIZE="32G"
  HN="haos-${BRANCH}"
@@ -598,7 +598,7 @@ msg_ok "${CL}${BL}${URL}${CL}"
 download_and_validate_xz "$URL" "$CACHE_FILE"

 msg_info "Creating Home Assistant OS VM shell"
-qm create $VMID -machine q35 -bios ovmf -agent 1 -tablet 0 -localtime 1 ${CPU_TYPE} \
+qm create $VMID${MACHINE} -bios ovmf -agent 1 -tablet 0 -localtime 1 ${CPU_TYPE} \
  -cores "$CORE_COUNT" -memory "$RAM_SIZE" -name "$HN" -tags community-script \
  -net0 "virtio,bridge=$BRG,macaddr=$MAC$VLAN$MTU" -onboot 1 -ostype l26 -scsihw virtio-scsi-pci >/dev/null
 msg_ok "Created VM shell"
@@ -25,6 +25,7 @@ METHOD=""
 NSAPP="opnsense-vm"
 var_os="opnsense"
 var_version="26.7"
+FREEBSD_MAJOR="15"
 #
 GEN_MAC=02:$(openssl rand -hex 5 | awk '{print toupper($0)}' | sed 's/\(..\)/\1:/g; s/.$//')
 GEN_MAC_LAN=02:$(openssl rand -hex 5 | awk '{print toupper($0)}' | sed 's/\(..\)/\1:/g; s/.$//')
@@ -490,7 +491,7 @@ function advanced_settings() {
        fi
        echo -e "${DGN}Using LAN GATEWAY ADDRESS: ${BGN}$LAN_GW${CL}"
      fi
-      if NETMASK=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a LAN netmmask (24 for example)" 8 58 $NETMASK --title "LAN NETMASK" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
+      if NETMASK=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a LAN netmask (24 for example)" 8 58 $NETMASK --title "LAN NETMASK" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
        if [ -z $NETMASK ]; then
          echo -e "${DGN}Netmask needs to be set if ip is not dhcp${CL}"
        fi
@@ -558,7 +559,7 @@ function advanced_settings() {
      else
        exit-script
      fi
-      if WAN_NETMASK=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a WAN netmmask (24 for example)" 8 58 $WAN_NETMASK --title "WAN NETMASK" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
+      if WAN_NETMASK=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a WAN netmask (24 for example)" 8 58 $WAN_NETMASK --title "WAN NETMASK" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
        if [ -z $WAN_NETMASK ]; then
          echo -e "${DGN}WAN Netmask needs to be set if ip is not dhcp${CL}"
        fi
@@ -574,7 +575,7 @@ function advanced_settings() {
  else
    exit-script
  fi
-  if MAC1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a WAN MAC Address" 8 58 $GEN_MAC --title "WAN MAC ADDRESS" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
+  if MAC1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a LAN MAC Address" 8 58 $GEN_MAC --title "LAN MAC ADDRESS" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
    if [ -z $MAC1 ]; then
      MAC="$GEN_MAC"
    else
@@ -585,7 +586,7 @@ function advanced_settings() {
    exit-script
  fi

-  if MAC2=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a LAN MAC Address" 8 58 $GEN_MAC_LAN --title "LAN MAC ADDRESS" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
+  if MAC2=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a WAN MAC Address" 8 58 $GEN_MAC_LAN --title "WAN MAC ADDRESS" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
    if [ -z $MAC2 ]; then
      WAN_MAC="$GEN_MAC_LAN"
    else
@@ -652,23 +653,26 @@ fi
 msg_ok "Using ${CL}${BL}$STORAGE${CL} ${GN}for Storage Location."
 msg_ok "Virtual Machine ID is ${CL}${BL}$VMID${CL}."
 msg_info "Retrieving the URL for the OPNsense Qcow2 Disk Image"
-# Use latest stable FreeBSD amd64 qcow2 VM image (generic, not UFS/ZFS)
+# Use latest stable FreeBSD amd64 qcow2 VM image matching FREEBSD_MAJOR
 RELEASE_LIST="$(curl -s https://download.freebsd.org/releases/VM-IMAGES/ |
-  grep -Eo '[0-9]+\.[0-9]+-RELEASE' |
+  grep -Eo "${FREEBSD_MAJOR}\.[0-9]+-RELEASE" |
  sort -Vr |
  uniq)"
 URL=""
 FREEBSD_VER=""
 for ver in $RELEASE_LIST; do
-  candidate="https://download.freebsd.org/releases/VM-IMAGES/${ver}/amd64/Latest/FreeBSD-${ver}-amd64.qcow2.xz"
-  if curl -fsI "$candidate" >/dev/null 2>&1; then
-    FREEBSD_VER="$ver"
-    URL="$candidate"
-    break
-  fi
+  # FreeBSD 15+ publishes separate -ufs/-zfs images instead of a generic one
+  for variant in "" "-ufs" "-zfs"; do
+    candidate="https://download.freebsd.org/releases/VM-IMAGES/${ver}/amd64/Latest/FreeBSD-${ver}-amd64${variant}.qcow2.xz"
+    if curl -fsI "$candidate" >/dev/null 2>&1; then
+      FREEBSD_VER="$ver"
+      URL="$candidate"
+      break 2
+    fi
+  done
 done
 if [ -z "$URL" ]; then
-  msg_error "Could not find generic FreeBSD amd64 qcow2 image (non-UFS/ZFS)."
+  msg_error "Could not find a FreeBSD ${FREEBSD_MAJOR}.x amd64 qcow2 image."
  exit 115
 fi
 msg_ok "Download URL: ${CL}${BL}${URL}${CL}"
@@ -768,7 +772,7 @@ DESCRIPTION=$(
  cat <<EOF
 <div align='center'>
  <a href='https://community-scripts.org' target='_blank' rel='noopener noreferrer'>
-    <img src='https://raw.githubusercontent.com/michelroegl-brunner/ProxmoxVE/refs/heads/develop/misc/images/logo-81x112.png' alt='Logo' style='width:81px;height:112px;'/>
+    <img src='https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/images/logo-81x112.png' alt='Logo' style='width:81px;height:112px;'/>
  </a>

  <h2 style='font-size: 24px; margin: 20px 0;'>OPNsense VM</h2>
@@ -806,6 +810,8 @@ msg_ok "Starting OPNsense VM (Patience this takes 20-30 minutes)"
 qm start $VMID
 sleep 90
 send_line_to_vm "root"
+sleep 2
+send_line_to_vm ""
 send_line_to_vm "fetch https://raw.githubusercontent.com/opnsense/update/master/src/bootstrap/opnsense-bootstrap.sh.in"
 if [ -n "$WAN_BRG" ]; then
  msg_info "Adding WAN interface"
@@ -814,10 +820,70 @@ if [ -n "$WAN_BRG" ]; then
  msg_ok "WAN interface added"
  sleep 5 # Brief pause after adding network interface
 fi
-send_line_to_vm "sh ./opnsense-bootstrap.sh.in -y -f -r 26.7"
+# FreeBSD 15+ VM images ship the base system as pkgbase packages; the bootstrap's
+# "delete all packages" step would remove the running base system (/bin/rm etc.)
+# and brick the VM. Deregister them from the pkg db first - the files stay in
+# place and OPNsense replaces base and kernel with its own sets afterwards.
+send_line_to_vm "echo \"PRAGMA foreign_keys=ON; DELETE FROM packages WHERE name LIKE 'FreeBSD-%';\" | pkg shell"
+sleep 5
+send_line_to_vm "sh ./opnsense-bootstrap.sh.in -y -f -r ${var_version}"
 msg_ok "OPNsense VM is being installed, do not close the terminal, or the installation will fail."
-#We need to wait for the OPNsense build proccess to finish, this takes a few minutes
-sleep 1000
+# The bootstrap ends with an automatic reboot into OPNsense. While it runs the
+# console keeps changing (download progress, package installs); once the VM has
+# settled at the login prompt the screen stays static. Poll a screendump hash
+# and continue after 3 minutes without change, bounded by a floor (the build
+# never finishes faster) and a ceiling for slow machines. If no screendump can
+# be captured at all, fall back to a fixed wait.
+SCREEN_PPM="${TEMP_DIR}/screen-${VMID}.ppm"
+
+function screen_hash() {
+  # Remove the previous dump first: a stale file from an earlier successful
+  # dump must not simulate a static screen when later dumps start failing.
+  # Note: "qm monitor" is unusable here - its readline attaches to /dev/tty
+  # even with piped stdin and captures the terminal, so use the API instead.
+  rm -f "$SCREEN_PPM"
+  timeout 10 pvesh create /nodes/$(hostname -s)/qemu/$VMID/monitor --command "screendump ${SCREEN_PPM}" >/dev/null 2>&1 || true
+  md5sum "$SCREEN_PPM" 2>/dev/null | cut -d' ' -f1 || true
+}
+
+build_elapsed=300
+build_stable=0
+screen_ok=0
+hash_a=""
+hash_b=""
+sleep 300
+while [ $build_stable -lt 6 ] && [ $build_elapsed -lt 2400 ]; do
+  sleep 30
+  build_elapsed=$((build_elapsed + 30))
+  new_hash=$(screen_hash)
+  if [ -n "$new_hash" ]; then
+    screen_ok=1
+    # The login prompt cursor may blink: a screen alternating between the same
+    # two frames (A/B/A/B) counts as stable, anything new resets the counter
+    if [ "$new_hash" = "$hash_a" ] || [ "$new_hash" = "$hash_b" ]; then
+      build_stable=$((build_stable + 1))
+    else
+      build_stable=0
+    fi
+  else
+    build_stable=0
+  fi
+  hash_b="$hash_a"
+  hash_a="$new_hash"
+  if [ -n "$new_hash" ]; then
+    echo -e "${DGN}Waiting for OPNsense build: ${YW}$((build_elapsed / 60))min elapsed, screen ${new_hash:0:8}, stable ${build_stable}/6${CL}"
+  else
+    echo -e "${DGN}Waiting for OPNsense build: ${YW}$((build_elapsed / 60))min elapsed, screendump failed${CL}"
+  fi
+  # No working screendump after several attempts: fixed wait instead
+  if [ $screen_ok -eq 0 ] && [ $build_elapsed -ge 480 ]; then
+    msg_error "Console screendump not available on this system - falling back to a fixed wait (12 minutes)."
+    sleep 720
+    build_elapsed=$((build_elapsed + 720))
+    break
+  fi
+done
+msg_ok "OPNsense build finished after $((build_elapsed / 60)) minutes"
 send_line_to_vm "root"
 send_line_to_vm "opnsense"
 send_line_to_vm "2"
@@ -855,8 +921,8 @@ if [ -n "$WAN_BRG" ] && [ "$WAN_IP_ADDR" != "" ]; then
  send_line_to_vm "2"
  send_line_to_vm "n"
  send_line_to_vm "${WAN_IP_ADDR}"
-  send_line_to_vm "${NETMASK}"
-  send_line_to_vm "${LAN_GW}"
+  send_line_to_vm "${WAN_NETMASK}"
+  send_line_to_vm "${WAN_GW}"
  send_line_to_vm "n"
  send_line_to_vm " "
  send_line_to_vm "n"
@@ -273,7 +273,7 @@ function extract_xz_with_pv() {

 function default_settings() {
  VMID=$(get_valid_nextid)
-  MACHINE="q35"
+  MACHINE=" -machine q35"
  FORMAT=""
  DISK_SIZE="32G"
  HN="umbrelos"
@@ -564,7 +564,7 @@ mkdir -p "$CACHE_DIR" "$(dirname "$FILE_IMG")"

 download_and_validate_xz "$URL" "$CACHE_FILE"

-qm create $VMID -machine q35 -bios ovmf -agent 1 -tablet 0 -localtime 1 ${CPU_TYPE} \
+qm create $VMID${MACHINE} -bios ovmf -agent 1 -tablet 0 -localtime 1 ${CPU_TYPE} \
  -cores "$CORE_COUNT" -memory "$RAM_SIZE" -name "$HN" -tags community-script \
  -net0 "virtio,bridge=$BRG,macaddr=$MAC$VLAN$MTU" -onboot 1 -ostype l26 -scsihw virtio-scsi-pci >/dev/null
Author	SHA1	Message	Date
MickLesk	099c94955f	minor fix	2026-07-27 09:19:38 +02:00
MickLesk	665f0dbee5	Pin Vikunja install/update to v2.3.0 Set both install and update scripts to deploy Vikunja v2.3.0 instead of latest. The update flow now checks against this pinned release and includes context that v2.4.0 is temporarily avoided due to an upstream startup failure caused by the packaged systemd SystemCallFilter.	2026-07-27 09:19:15 +02:00
community-scripts-pr-app[bot]	7715c37553	Update CHANGELOG.md (#16057 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-27 06:41:38 +00:00
push-app-to-main[bot]	5be03046e4	PasswordPusher (#16031 ) * Add passwordpusher (ct) * Update install/passwordpusher-install.sh * Update ct/passwordpusher.sh * Refactor passwordpusher.sh to streamline sourcing --------- Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com> Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com>	2026-07-27 08:41:11 +02:00
community-scripts-pr-app[bot]	1ea195e7a6	Update CHANGELOG.md (#16055 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-26 20:37:14 +00:00
Andy Grunwald	cad309b6a5	Remove software-properties-common from Apache Tika install (#16054 ) The container was switched from bookworm to trixie in #16036, but software-properties-common does not exist in Debian 13. apt aborts the whole dependency line on the single missing package (exit code 100), so a fresh install never gets past "Installing Dependencies". The package only provides add-apt-repository, which this script never calls — no PPAs or custom repos are configured anywhere. It is a dead dependency, so dropping it needs no replacement; every other package on that line exists in trixie. Fixes #16053 Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-26 22:36:46 +02:00
community-scripts-pr-app[bot]	24c5abbcc1	Update CHANGELOG.md (#16049 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-26 17:05:19 +00:00
push-app-to-main[bot]	49e04e6202	Satisfactory (#16023 ) * Add satisfactory (ct) * Refactor messages for Satisfactory application --------- Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com> Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com>	2026-07-26 19:04:53 +02:00
community-scripts-pr-app[bot]	aeccbf72d5	Update CHANGELOG.md (#16048 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-26 16:53:30 +00:00
push-app-to-main[bot]	3e1feef953	OmniTools (#16032 ) * Add omnitools (ct) * Fix sourcing of build.func in omnitools.sh * Remove redundant line in omnitools.sh * Fix Nginx configuration script formatting --------- Co-authored-by: push-app-to-main[bot] <203845782+push-app-to-main[bot]@users.noreply.github.com> Co-authored-by: Tobias <96661824+CrazyWolf13@users.noreply.github.com>	2026-07-26 18:53:08 +02:00
community-scripts-pr-app[bot]	10287dd48a	Update CHANGELOG.md (#16047 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-26 16:51:58 +00:00
Marco C.	d325c03944	Improve command description for disabling pve-enterprise repo (#16020 ) The "disable" option description stated "Comment out (disable) this repo" but the implementation uses `Enabled: false` (deb822 format) instead of commenting. Update description to better reflect the action.	2026-07-26 18:51:33 +02:00
community-scripts-pr-app[bot]	f6e1f86310	Update CHANGELOG.md (#16045 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-26 16:42:37 +00:00
CanbiZ (MickLesk)	300744cc7c	build.func: fix OS mismatch message when script target moved to an older OS (#16035 )	2026-07-26 18:42:11 +02:00
community-scripts-pr-app[bot]	640dc68bdc	Update CHANGELOG.md (#16044 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-26 16:35:55 +00:00
Andy Grunwald	f5390ebdbf	Apache Tika: Switch from Debian Bookworm to Debian Trixie and replace manual install of OpenJDK with setup_java (#16036 ) * Install Java via setup_java instead of distro openjdk Apache Tika's Java runtime was installed by calling apt directly for openjdk-17-jre-headless. This tied the JDK to whatever Debian ships, and that coupling has now broken: openjdk-17 is no longer available on Debian 13 (Trixie), where openjdk-21 is current. It also made this the only script in install/ that installs Java by hand, while every other Java application in the repository uses the shared setup_java helper. Switch to setup_java, which installs Eclipse Temurin from the Adoptium repository. Temurin is versioned independently of the Debian release, so a future distribution upgrade cannot remove the JDK out from under the application the way this one did. Java 21 satisfies both current and upcoming Tika: 3.x requires Java 11 or newer, and 4.x raises the floor to Java 17. The surrounding msg_info/msg_ok pair is dropped because setup_java emits its own progress messages; keeping them would nest the output. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Bump Apache-Tika container to Debian 13 The container declared Debian 12 (Bookworm) as its base, which had become an outlier: 475 of the repository's ct scripts target Debian 13 and only 22 still target 12. build.func also sets trixie as the default ARM64 template codename, so this script's declared base had drifted away from the repository default. The declared version is not cosmetic. check_container_os_guard() reads var_os/var_version as the script's recommended OS and compares them against a container's /etc/os-release, prompting on interactive runs and aborting headless ones when they disagree. Debian 12 was also the reason the previous openjdk-17 dependency looked valid; on Debian 13 that package no longer exists, which is addressed in the preceding commit. Existing Debian 12 containers keep working, because update_script only replaces the Tika jar and never touches the operating system or Java. They will, however, now hit the OS mismatch guard on update and be asked to move to Debian 13 first. That is intended rather than a regression, but it is a visible change for existing users. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-07-26 18:35:32 +02:00
community-scripts-pr-app[bot]	9fafffbe04	Update CHANGELOG.md (#16043 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-26 16:34:32 +00:00
CanbiZ (MickLesk)	62690cfafb	InvenTree: populate database engine/name in config.yaml before invoke update (#16022 )	2026-07-26 18:34:05 +02:00
community-scripts-pr-app[bot]	b0db823934	Update CHANGELOG.md (#16040 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-26 14:57:50 +00:00
CanbiZ (MickLesk)	2dd9d98e8a	OPNsense VM: answer console password prompt explicitly (#16021 )	2026-07-26 16:57:29 +02:00
community-scripts-pr-app[bot]	5919f0773e	Update CHANGELOG.md (#16039 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-26 13:39:16 +00:00
Johann Grobe	895ecdc71e	add node update to update script (#16014 )	2026-07-26 23:38:55 +10:00
community-scripts-pr-app[bot]	681b57317e	Update CHANGELOG.md (#16018 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-26 00:20:34 +00:00
community-scripts-pr-app[bot]	41eb00bda4	Archive old changelog entries (#16017 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-26 00:20:07 +00:00
community-scripts-pr-app[bot]	1f5d66dfc7	Update CHANGELOG.md (#16013 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-25 19:52:15 +00:00
Oscar006	e5c61a25b2	AFFiNE: Bump version to v0.27.3 (#16012 )	2026-07-25 21:51:51 +02:00
community-scripts-pr-app[bot]	c444b6b726	Update CHANGELOG.md (#16010 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-25 02:55:25 +00:00
CanbiZ (MickLesk)	01984190c1	SparkyFitness: substitute SPARKY_FITNESS_FRONTEND_URL in nginx config (#16007 )	2026-07-25 12:55:01 +10:00
community-scripts-pr-app[bot]	1d3e02954a	Update CHANGELOG.md (#16001 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-24 09:56:12 +00:00
CanbiZ (MickLesk)	2fcbee5057	Termix: migrate database to new db/data layout introduced in 2.5.1 (#15996 ) Migrate Termix database to the new db/data layout introduced in 2.5.1, fail fast on backend build errors, and precreate the db/data directory on fresh installs. Co-authored-by: P3RF3CTION <13474113+P3RF3CTION@users.noreply.github.com>	2026-07-24 19:55:46 +10:00
community-scripts-pr-app[bot]	e35199cd29	Update CHANGELOG.md (#15999 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-24 08:20:02 +00:00
CanbiZ (MickLesk)	3e0c0d7955	Sync-in: create admin user with admin role instead of default user (#15983 ) * Sync-in: create admin user with admin role instead of default user * Sync-in: use heredoc for credentials file, matching repo convention	2026-07-24 10:19:35 +02:00
community-scripts-pr-app[bot]	7c874d33d1	Update CHANGELOG.md (#15998 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-24 08:04:17 +00:00
CanbiZ (MickLesk)	f40adfa1da	VM: fix machine type selection being ignored, VM always created as q35 (#15995 ) * HAOS: fix machine type selection being ignored, VM always created as q35 * Fix machine parameter formatting in VM script	2026-07-24 10:03:48 +02:00
community-scripts-pr-app[bot]	71369e0596	Update CHANGELOG.md (#15997 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-24 07:27:58 +00:00
Sam Heinz	235ac3ef7e	Bump all Alpine scripts to 3.24 (#15994 ) Co-authored-by: sanderkoenders <1557855+sanderkoenders@users.noreply.github.com>	2026-07-24 09:27:30 +02:00
community-scripts-pr-app[bot]	673cab07df	Update CHANGELOG.md (#15988 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-23 21:19:23 +00:00
CanbiZ (MickLesk)	d2b75f4c5d	IronClaw: pin to v0.29.1, 1.0 Reborn CLI/config is incompatible (#15982 )	2026-07-23 23:19:05 +02:00
community-scripts-pr-app[bot]	d599a3cad4	Update CHANGELOG.md (#15987 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-23 21:18:53 +00:00
community-scripts-pr-app[bot]	956d30329d	Update CHANGELOG.md (#15986 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-23 21:18:41 +00:00
CanbiZ (MickLesk)	b2f3e192af	Cockpit: default to Debian 13, 45Drives now ships Trixie packages \| little refactor (#15984 )	2026-07-23 23:18:28 +02:00
community-scripts-pr-app[bot]	89f9a40296	Update CHANGELOG.md (#15985 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-23 21:18:18 +00:00
Tom Frenzel	d3b3c402e4	Paperless-ngx: Support v3 (#15221 )	2026-07-23 23:17:55 +02:00
community-scripts-pr-app[bot]	bcbc819252	Update CHANGELOG.md (#15980 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-23 08:59:25 +00:00
thieneret	8ec7d93c30	update authentik to 2026.5.6 (#15973 )	2026-07-23 10:59:01 +02:00
community-scripts-pr-app[bot]	24c0455085	Update CHANGELOG.md (#15969 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-22 12:03:35 +00:00
CanbiZ (MickLesk)	3a7305a8cf	pve-tool: storage share helper script for Proxmox (#15869 ) * pve-tool: storage share helper script for Proxmox This script provides a menu-driven interface for managing various storage types in Proxmox, including SMB, NFS, and iSCSI. It includes functions for testing mounts, adding storage, and managing LXC mountpoints. * bump function call * add dynamic whiptail (feedback from #15882) * broken whiptail in menu 4 * fix ui bug, more space for container names * fix whiptail pick mountpoint * Allow removing multiple LXC mountpoints Update `remove_lxc_mountpoint` in `storage-share-helper.sh` to support multi-select mountpoint removal for a container. Each selected mountpoint is now confirmed individually (default No), processed independently, and reported in a final result summary with `removed`, `FAILED`, or `skipped` status. * stupid whiptail.. now done * Update storage-share-helper.sh	2026-07-22 14:03:09 +02:00
community-scripts-pr-app[bot]	737d99ec9d	Update CHANGELOG.md (#15965 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-22 06:59:28 +00:00
CanbiZ (MickLesk)	0576b7c61f	OPNSense: Bump FreeBSD to 15 and OPNSense to 26.7 (#15943 ) * OPNSense: Bump FreeBSD to 15 and OPNSense to 26.7 * fix user feedback * fix typo * fix url for image * Replace fixed OPNsense wait with screen polling Swap the hardcoded 1000-second sleep for an adaptive loop that watches VM console screendump hashes and proceeds after sustained stability. The new logic enforces a minimum 5-minute wait, checks every 30 seconds, and caps total wait at 40 minutes to handle slower hosts or screendump failures more reliably. * Harden OPNsense build wait detection Improves VM install completion detection by encapsulating screendump hashing in a helper, clearing stale dump files, and trying both `qm monitor` and `pvesh` monitor paths. The stability check now tolerates alternating A/B frames from a blinking login cursor instead of requiring one identical frame. It also adds elapsed-time progress output and a safe fallback to a fixed 12-minute wait when screendumps are unavailable, avoiding false completion or endless polling.	2026-07-22 08:59:05 +02:00
community-scripts-pr-app[bot]	56e2170f6c	Update CHANGELOG.md (#15964 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-22 06:55:57 +00:00
CanbiZ (MickLesk)	d5f9db35f3	core: add OS mismatch guard for container updates (#15948 ) * core: add OS mismatch guard for container updates Introduces `check_container_os_guard()` to compare the container's `/etc/os-release` against the script's recommended `var_os`/`var_version` before running updates. On mismatch, interactive runs now prompt to continue (default no), while silent/headless runs abort to avoid partial breakage on unsupported bases. A bypass flag (`var_ignore_os_mismatch=1\|yes\|true\|on`) was added, and the guard is wired into all update entry paths in `start()`. * Refine OS mismatch update guidance Updates the OS version mismatch prompts in `check_container_os_guard()` to recommend upgrading the existing container OS to the target release before rerunning the update, instead of recreating the container. The skip/error path now uses the same guidance while still documenting `var_ignore_os_mismatch=1` as an override. * Add persistent OS mismatch bypass option Enhances `check_container_os_guard` to support a persistent opt-out for OS version mismatch checks. The prompt now uses a 3-option whiptail menu (cancel, continue once, continue and remember), and stores ignored targets in `/root/.helper-scripts-ignoreOSupdate` so users are re-prompted when a newer recommended OS appears. Messaging was also tightened to explicitly warn that bypassing may break updates and is unsupported. * switch to /usr/local	2026-07-22 08:55:32 +02:00
community-scripts-pr-app[bot]	6b068bc9bf	Update CHANGELOG.md (#15963 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-22 06:18:42 +00:00
community-scripts-pr-app[bot]	04dbf97672	Update CHANGELOG.md (#15962 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-07-22 06:18:22 +00:00
CanbiZ (MickLesk)	a339c08bca	InvoiceNinja: preserve and Re-download snappdf Chromium (#15956 ) * Re-download snappdf Chromium after Invoice Ninja updates update_script() redeploys /opt/invoiceninja via CLEAN_INSTALL, which wipes vendor/beganovich/snappdf/versions. That path isn't covered by create_backup/restore_backup, so the Chromium binary snappdf needs for PDF generation was missing after every update, breaking PDFs (#15942). Re-run the same "vendor/bin/snappdf download" step the install script already does, right after the backup is restored. * Back up snappdf's Chromium download to avoid re-fetching on every update vendor/bin/snappdf download is idempotent: it exits immediately without downloading if versions/revision.txt already exists, and PDF generation doesn't check that version against the installed snappdf package - it just uses whatever's in versions/. So the cached Chromium build survives just fine across an update via the existing backup/restore mechanism. Add vendor/beganovich/snappdf/versions to create_backup/restore_backup; keep the snappdf download call only as a safety net for when the backup doesn't have it yet (e.g. the first update after this fix ships). * Remove explanatory comment	2026-07-22 08:18:21 +02:00
CanbiZ (MickLesk)	e4d0e743e4	Preserve default mongod.conf when configuring Anytype replica set (#15954 ) Overwriting /etc/mongod.conf with only the replication block wiped out storage.dbPath from the mongodb-org package default, so mongod fell back to its compiled-in /data/db path, which was never created. Append the replication section instead of replacing the file.	2026-07-22 08:18:12 +02:00
CanbiZ (MickLesk)	b2d54f2a72	Nametag: fix missing tailwindcss module (#15955 ) * Fix Nametag update failing with missing tailwindcss module npm ci during update ran with devDependencies omitted, likely because NODE_ENV=production was already present in the environment by then (npm's documented default: omit=dev when NODE_ENV=production). Since @tailwindcss/postcss is a devDependency, the subsequent `npm run build` failed with "Cannot find module '@tailwindcss/postcss'". Force devDeps to be installed regardless of NODE_ENV via --include=dev. * Apply --include=dev to fresh installs too, for parity with update fix Couldn't confirm within this repo why devDependencies would only be omitted on update and not on a fresh install - create_backup/ restore_backup are plain file copies and nothing in tools.func sets NODE_ENV or writes an .npmrc. Since npm ci runs before .env is sourced in both scripts, apply the same explicit --include=dev to the installer as defense-in-depth against the same class of failure.	2026-07-22 08:18:01 +02:00
MickLesk	fe01d670f6	Don't destroy container on error_handler recovery-prompt read failure Same bug as build.func's install-recovery menu: this "Remove broken container?" prompt treated a hard read failure (broken/closed stdin, I/O error) identically to a real 60s timeout, defaulting to pct destroy either way. Only auto-remove on an actual timeout (read_rc > 128); on a genuine read failure, keep the container instead of guessing and destroying it.	2026-07-21 23:32:19 +02:00
MickLesk	e0df8a80bf	Don't destroy container on install-recovery menu read failure read -t returns >128 on a real timeout, but a lower/plain error code on a genuine read failure (e.g. broken/closed stdin, I/O error) - these were treated identically as "no response", so a user whose keystroke failed to be captured (e.g. a transient stdin I/O error) got their container silently destroyed instead of kept. Only auto-remove on an actual timeout; on a hard read failure, keep the container (reversible) and tell the user how to remove it manually.	2026-07-21 23:27:22 +02:00