fix(powerdns): fix SQLite directory permissions for pdns user

The /opt/poweradmin/ directory was owned by www-data:www-data (755),
but pdns runs as the 'pdns' user which had no write access to the
directory. SQLite requires write access to the database directory to
create journal/WAL files (powerdns.db-journal, powerdns.db-wal).
Without this, pdns fails to start.

Changes:
- Set directory group to 'pdns' instead of 'www-data' so pdns user
  can create SQLite journal/WAL files (via group write 775)
- Apply same permissions fix in update_script (ct/powerdns.sh)
- Fix msg_info -> msg_ok for 'Created Service' completion message

Fixes #12572

CHANGELOG.md

@@ -410,19 +410,32 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-03-05
+
 ## 2026-03-04
 
 ### 🚀 Updated Scripts
 
   - #### 🐞 Bug Fixes
 
-    - addon migrations: /usr/bin/update replacement to prevent syntax error [@MickLesk](https://github.com/MickLesk) ([#12540](https://github.com/community-scripts/ProxmoxVE/pull/12540))
+    - fix: gitea-mirror [@CrazyWolf13](https://github.com/CrazyWolf13) ([#12549](https://github.com/community-scripts/ProxmoxVE/pull/12549))
     - fix(immich): correct LibRaw clone URL to official upstream [@DenislavDenev](https://github.com/DenislavDenev) ([#12526](https://github.com/community-scripts/ProxmoxVE/pull/12526))
+    - update: stirling-pdf: java 25 [@CrazyWolf13](https://github.com/CrazyWolf13) ([#12552](https://github.com/community-scripts/ProxmoxVE/pull/12552))
+    - Docmost: register NoopAuditService globally when EE submodule is missing [@MickLesk](https://github.com/MickLesk) ([#12551](https://github.com/community-scripts/ProxmoxVE/pull/12551))
+    - jellyseer/overseer migration corrupting /usr/bin/update [@MickLesk](https://github.com/MickLesk) ([#12539](https://github.com/community-scripts/ProxmoxVE/pull/12539))
+    - PowerDNS: use gsqlite3 backend instead of BIND [@MickLesk](https://github.com/MickLesk) ([#12538](https://github.com/community-scripts/ProxmoxVE/pull/12538))
+    - addon migrations: /usr/bin/update replacement to prevent syntax error [@MickLesk](https://github.com/MickLesk) ([#12540](https://github.com/community-scripts/ProxmoxVE/pull/12540))
+
+  - #### 🔧 Refactor
+
+    - Fluid-Calendar: NodeJS bump [@tremor021](https://github.com/tremor021) ([#12558](https://github.com/community-scripts/ProxmoxVE/pull/12558))
+    - Refactor: LiteLLM [@tremor021](https://github.com/tremor021) ([#12550](https://github.com/community-scripts/ProxmoxVE/pull/12550))
 
 ### 💾 Core
 
   - #### 🐞 Bug Fixes
 
+    - tools: fall back to distro packages for psql [@MickLesk](https://github.com/MickLesk) ([#12542](https://github.com/community-scripts/ProxmoxVE/pull/12542))
     - fix: whitelist var_searchdomain and fix the handling of var_ns and va… [@tommoyer](https://github.com/tommoyer) ([#12521](https://github.com/community-scripts/ProxmoxVE/pull/12521))
 
 ## 2026-03-03

ct/docmost.sh

@@ -48,6 +48,17 @@ function update_script() {
     cd /opt/docmost
     mv /opt/.env /opt/docmost/.env
     mv /opt/data /opt/docmost/data
+
+    # Fix: Docmost EE (audit logs etc.) lives in a git submodule that is NOT
+    # included in GitHub tarballs.  The community NoopAuditService exists but
+    # is only exported by CoreModule – child modules such as UserModule cannot
+    # resolve it.  Making CoreModule @Global() exposes the token app-wide.
+    if [[ ! -f /opt/docmost/apps/server/src/ee/ee.module.ts ]] \
+      && ! grep -q '@Global()' /opt/docmost/apps/server/src/core/core.module.ts 2>/dev/null; then
+      sed -i '/^  Module,$/a\  Global,' /opt/docmost/apps/server/src/core/core.module.ts
+      sed -i '/^@Module({$/i @Global()' /opt/docmost/apps/server/src/core/core.module.ts
+    fi
+
     $STD pnpm install --force
     $STD pnpm build
     msg_ok "Updated ${APP}"

ct/fluid-calendar.sh

@@ -28,6 +28,9 @@ function update_script() {
     msg_error "No ${APP} Installation Found!"
     exit
   fi
+
+  NODE_VERSION="24" setup_nodejs
+
   if check_for_gh_release "fluid-calendar" "dotnetfactory/fluid-calendar"; then
     msg_info "Stopping Service"
     systemctl stop fluid-calendar
@@ -45,7 +48,7 @@ function update_script() {
     $STD npx prisma migrate deploy
     $STD npm run build:os
     msg_ok "Updated Fluid Calendar"
-    
+
     msg_info "Starting Service"
     systemctl start fluid-calendar
     msg_ok "Started Service"

ct/gitea-mirror.sh

@@ -87,6 +87,8 @@ EOF
     msg_ok "Old Enviroment fixed"
   fi
 
+  ensure_dependencies git
+
   if check_for_gh_release "gitea-mirror" "RayLabsHQ/gitea-mirror"; then
     msg_info "Stopping Services"
     systemctl stop gitea-mirror
@@ -94,7 +96,7 @@ EOF
 
     msg_info "Backup Data"
     mkdir -p /opt/gitea-mirror-backup/data
-    cp /opt/gitea-mirror/data/* /opt/gitea-mirror-backup/data/
+    cp -r /opt/gitea-mirror/data/* /opt/gitea-mirror-backup/data/
     msg_ok "Backup Data"
 
     msg_info "Installing Bun"
@@ -111,12 +113,11 @@ EOF
     $STD bun run setup
     $STD bun run build
     APP_VERSION=$(grep -o '"version": *"[^"]*"' package.json | cut -d'"' -f4)
-
-    sudo sed -i.bak "s|^npm_package_version=.*|npm_package_version=${APP_VERSION}|" /opt/gitea-mirror.env
+    sed -i.bak "s|^npm_package_version=.*|npm_package_version=${APP_VERSION}|" /opt/gitea-mirror.env
     msg_ok "Updated and rebuilt ${APP}"
 
     msg_info "Restoring Data"
-    cp /opt/gitea-mirror-backup/data/* /opt/gitea-mirror/data
+    cp -r /opt/gitea-mirror-backup/data/* /opt/gitea-mirror/data
     msg_ok "Restored Data"
 
     msg_info "Starting Service"

ct/litellm.sh

@@ -34,7 +34,7 @@ function update_script() {
   msg_ok "Stopped Service"
 
   VENV_PATH="/opt/litellm/.venv"
-  PYTHON_VERSION="3.13" setup_uv
+  PYTHON_VERSION="3.13" USE_UVX="YES" setup_uv
 
   msg_info "Updating LiteLLM"
   $STD "$VENV_PATH/bin/python" -m pip install --upgrade litellm[proxy] prisma

ct/powerdns.sh

@@ -47,7 +47,10 @@ function update_script() {
     cp /opt/poweradmin_powerdns.db.bak /opt/poweradmin/powerdns.db
     rm -rf /opt/poweradmin/install
     rm -f /opt/poweradmin_settings.php.bak /opt/poweradmin_powerdns.db.bak
-    chown -R www-data:www-data /opt/poweradmin
+    chown -R www-data:pdns /opt/poweradmin
+    chmod 775 /opt/poweradmin
+    chown pdns:pdns /opt/poweradmin/powerdns.db
+    chmod 664 /opt/poweradmin/powerdns.db
     msg_ok "Updated Poweradmin"
 
     msg_info "Restarting Services"

ct/stirling-pdf.sh

@@ -35,7 +35,7 @@ function update_script() {
     fi
 
     PYTHON_VERSION="3.12" setup_uv
-    JAVA_VERSION="21" setup_java
+    JAVA_VERSION="25" setup_java
 
     msg_info "Stopping Services"
     systemctl stop stirlingpdf libreoffice-listener unoserver

frontend/public/json/github-versions.json

@@ -1,5 +1,5 @@
 {
-  "generated": "2026-03-04T06:16:35Z",
+  "generated": "2026-03-05T06:17:38Z",
   "versions": [
     {
       "slug": "2fauth",
@@ -39,9 +39,9 @@
     {
       "slug": "ampache",
       "repo": "ampache/ampache",
-      "version": "7.9.1",
+      "version": "7.9.2",
       "pinned": false,
-      "date": "2026-02-25T08:52:58Z"
+      "date": "2026-03-05T03:54:03Z"
     },
     {
       "slug": "argus",
@@ -193,9 +193,9 @@
     {
       "slug": "checkmate",
       "repo": "bluewave-labs/Checkmate",
-      "version": "v3.4.0",
+      "version": "v3.5.0",
       "pinned": false,
-      "date": "2026-02-20T21:08:55Z"
+      "date": "2026-03-04T19:51:22Z"
     },
     {
       "slug": "cleanuparr",
@@ -298,9 +298,9 @@
     {
       "slug": "docmost",
       "repo": "docmost/docmost",
-      "version": "v0.70.0",
+      "version": "v0.70.1",
       "pinned": false,
-      "date": "2026-03-03T20:33:08Z"
+      "date": "2026-03-04T12:54:49Z"
     },
     {
       "slug": "domain-locker",
@@ -382,9 +382,9 @@
     {
       "slug": "firefly",
       "repo": "firefly-iii/firefly-iii",
-      "version": "v6.5.2",
+      "version": "v6.5.3",
       "pinned": false,
-      "date": "2026-03-03T05:42:27Z"
+      "date": "2026-03-04T06:53:02Z"
     },
     {
       "slug": "fladder",
@@ -438,9 +438,9 @@
     {
       "slug": "ghostfolio",
       "repo": "ghostfolio/ghostfolio",
-      "version": "2.246.0",
+      "version": "2.247.0",
       "pinned": false,
-      "date": "2026-03-03T19:37:20Z"
+      "date": "2026-03-04T07:48:00Z"
     },
     {
       "slug": "gitea",
@@ -452,9 +452,9 @@
     {
       "slug": "gitea-mirror",
       "repo": "RayLabsHQ/gitea-mirror",
-      "version": "v3.12.0",
+      "version": "v3.12.2",
       "pinned": false,
-      "date": "2026-03-04T02:53:42Z"
+      "date": "2026-03-05T04:26:50Z"
     },
     {
       "slug": "glance",
@@ -473,9 +473,9 @@
     {
       "slug": "gokapi",
       "repo": "Forceu/Gokapi",
-      "version": "v2.2.2",
+      "version": "v2.2.3",
       "pinned": false,
-      "date": "2026-01-31T21:11:27Z"
+      "date": "2026-03-04T21:29:16Z"
     },
     {
       "slug": "gotify",
@@ -613,9 +613,9 @@
     {
       "slug": "jackett",
       "repo": "Jackett/Jackett",
-      "version": "v0.24.1275",
+      "version": "v0.24.1287",
       "pinned": false,
-      "date": "2026-03-04T05:53:40Z"
+      "date": "2026-03-05T05:49:33Z"
     },
     {
       "slug": "jellystat",
@@ -669,9 +669,9 @@
     {
       "slug": "kima-hub",
       "repo": "Chevron7Locked/kima-hub",
-      "version": "v1.6.1",
+      "version": "v1.6.2",
       "pinned": false,
-      "date": "2026-03-03T16:13:53Z"
+      "date": "2026-03-05T05:38:02Z"
     },
     {
       "slug": "kimai",
@@ -690,9 +690,9 @@
     {
       "slug": "koel",
       "repo": "koel/koel",
-      "version": "v8.3.0",
+      "version": "v8.3.1",
       "pinned": false,
-      "date": "2026-01-08T21:32:58Z"
+      "date": "2026-03-04T08:22:06Z"
     },
     {
       "slug": "koillection",
@@ -1061,9 +1061,9 @@
     {
       "slug": "paperless-ngx",
       "repo": "paperless-ngx/paperless-ngx",
-      "version": "v2.20.9",
+      "version": "v2.20.10",
       "pinned": false,
-      "date": "2026-02-28T10:17:35Z"
+      "date": "2026-03-04T19:20:57Z"
     },
     {
       "slug": "patchmon",
@@ -1369,9 +1369,9 @@
     {
       "slug": "seaweedfs",
       "repo": "seaweedfs/seaweedfs",
-      "version": "4.13",
+      "version": "4.14",
       "pinned": false,
-      "date": "2026-02-17T01:09:45Z"
+      "date": "2026-03-05T04:49:27Z"
     },
     {
       "slug": "seelf",
@@ -1474,9 +1474,9 @@
     {
       "slug": "stirling-pdf",
       "repo": "Stirling-Tools/Stirling-PDF",
-      "version": "v2.5.3",
+      "version": "v2.6.0",
       "pinned": false,
-      "date": "2026-02-23T23:23:39Z"
+      "date": "2026-03-03T20:46:42Z"
     },
     {
       "slug": "streamlink-webui",
@@ -1565,9 +1565,9 @@
     {
       "slug": "tinyauth",
       "repo": "steveiliop56/tinyauth",
-      "version": "v5.0.0",
+      "version": "v5.0.1",
       "pinned": false,
-      "date": "2026-03-02T18:43:57Z"
+      "date": "2026-03-04T21:05:05Z"
     },
     {
       "slug": "traccar",
@@ -1607,9 +1607,9 @@
     {
       "slug": "trip",
       "repo": "itskovacs/TRIP",
-      "version": "1.41.0",
+      "version": "1.41.1",
       "pinned": false,
-      "date": "2026-02-23T17:57:31Z"
+      "date": "2026-03-04T07:25:35Z"
     },
     {
       "slug": "tududi",
@@ -1663,9 +1663,9 @@
     {
       "slug": "uptimekuma",
       "repo": "louislam/uptime-kuma",
-      "version": "2.1.3",
+      "version": "2.2.0",
       "pinned": false,
-      "date": "2026-02-19T05:37:30Z"
+      "date": "2026-03-05T02:08:14Z"
     },
     {
       "slug": "vaultwarden",
@@ -1719,9 +1719,9 @@
     {
       "slug": "watcharr",
       "repo": "sbondCo/Watcharr",
-      "version": "v2.1.1",
+      "version": "v3.0.0",
       "pinned": false,
-      "date": "2025-07-15T22:38:01Z"
+      "date": "2026-03-04T09:29:14Z"
     },
     {
       "slug": "watchyourlan",
@@ -1824,9 +1824,9 @@
     {
       "slug": "zitadel",
       "repo": "zitadel/zitadel",
-      "version": "v4.12.0",
+      "version": "v4.12.1",
       "pinned": false,
-      "date": "2026-03-02T08:16:10Z"
+      "date": "2026-03-04T12:40:17Z"
     },
     {
       "slug": "zoraxy",
@@ -1838,9 +1838,9 @@
     {
       "slug": "zwave-js-ui",
       "repo": "zwave-js/zwave-js-ui",
-      "version": "v11.12.0",
+      "version": "v11.13.0",
       "pinned": false,
-      "date": "2026-02-19T10:14:19Z"
+      "date": "2026-03-04T15:09:54Z"
     }
   ]
 }

install/docmost-install.sh

@@ -26,6 +26,17 @@ fetch_and_deploy_gh_release "docmost" "docmost/docmost" "tarball"
 
 msg_info "Configuring Docmost (Patience)"
 cd /opt/docmost
+
+# Fix: Docmost EE (audit logs etc.) lives in a git submodule that is NOT
+# included in GitHub tarballs.  The community NoopAuditService exists but
+# is only exported by CoreModule – child modules such as UserModule cannot
+# resolve it.  Making CoreModule @Global() exposes the token app-wide.
+if [[ ! -f /opt/docmost/apps/server/src/ee/ee.module.ts ]] \
+  && ! grep -q '@Global()' /opt/docmost/apps/server/src/core/core.module.ts 2>/dev/null; then
+  sed -i '/^  Module,$/a\  Global,' /opt/docmost/apps/server/src/core/core.module.ts
+  sed -i '/^@Module({$/i @Global()' /opt/docmost/apps/server/src/core/core.module.ts
+fi
+
 mv .env.example .env
 mkdir data
 sed -i -e "s|APP_SECRET=.*|APP_SECRET=$(openssl rand -base64 32 | tr -dc 'a-zA-Z0-9' | cut -c1-32)|" \

install/fluid-calendar-install.sh

@@ -19,7 +19,7 @@ msg_ok "Installed Dependencies"
 
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="fluiddb" PG_DB_USER="fluiduser" setup_postgresql_db
-NODE_VERSION="20" setup_nodejs
+NODE_VERSION="24" setup_nodejs
 fetch_and_deploy_gh_release "fluid-calendar" "dotnetfactory/fluid-calendar" "tarball"
 
 msg_info "Configuring fluid-calendar"

install/gitea-mirror-install.sh

@@ -18,7 +18,8 @@ $STD apt install -y \
   build-essential \
   openssl \
   sqlite3 \
-  unzip
+  unzip \
+  git
 msg_ok "Installed Dependencies"
 
 msg_info "Installing Bun"

install/litellm-install.sh

@@ -20,24 +20,8 @@ $STD apt install -y \
 msg_ok "Installed Dependencies"
 
 PG_VERSION="17" setup_postgresql
-PYTHON_VERSION="3.13" setup_uv
-
-msg_info "Setting up PostgreSQL"
-DB_NAME="litellm_db"
-DB_USER="litellm"
-DB_PASS="$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-13)"
-$STD sudo -u postgres psql -c "CREATE ROLE $DB_USER WITH LOGIN PASSWORD '$DB_PASS';"
-$STD sudo -u postgres psql -c "CREATE DATABASE $DB_NAME WITH OWNER $DB_USER ENCODING 'UTF8' TEMPLATE template0;"
-$STD sudo -u postgres psql -c "ALTER ROLE $DB_USER SET client_encoding TO 'utf8';"
-$STD sudo -u postgres psql -c "ALTER ROLE $DB_USER SET default_transaction_isolation TO 'read committed';"
-$STD sudo -u postgres psql -c "ALTER ROLE $DB_USER SET timezone TO 'UTC';"
-{
-  echo "${APPLICATION} Credentials"
-  echo "Database Name: $DB_NAME"
-  echo "Database User: $DB_USER"
-  echo "Database Password: $DB_PASS"
-} >>~/litellm.creds
-msg_ok "Set up PostgreSQL"
+PG_DB_NAME="litellm_db" PG_DB_USER="litellm" setup_postgresql_db
+PYTHON_VERSION="3.13" USE_UVX="YES" setup_uv
 
 msg_info "Setting up Virtual Environment"
 mkdir -p /opt/litellm
@@ -53,10 +37,9 @@ mkdir -p /opt
 cat <<EOF >/opt/litellm/litellm.yaml
 general_settings:
   master_key: sk-1234
-  database_url: postgresql://$DB_USER:$DB_PASS@127.0.0.1:5432/$DB_NAME
+  database_url: postgresql://$PG_DB_USER:$PG_DB_PASS@127.0.0.1:5432/$PG_DB_NAME
   store_model_in_db: true
 EOF
-
 uv --directory=/opt/litellm run litellm --config /opt/litellm/litellm.yaml --use_prisma_db_push --skip_server_startup
 msg_ok "Configured LiteLLM"
 
@@ -73,7 +56,6 @@ Restart=always
 [Install]
 WantedBy=multi-user.target
 EOF
-
 systemctl enable -q --now litellm
 msg_ok "Created Service"
 

install/powerdns-install.sh

@@ -38,6 +38,12 @@ msg_info "Setting up PowerDNS"
 $STD apt install -y \
   pdns-server \
   pdns-backend-sqlite3
+sed -i 's/^launch=$/# launch=/' /etc/powerdns/pdns.conf
+rm -f /etc/powerdns/pdns.d/bind.conf
+cat <<EOF >/etc/powerdns/pdns.d/gsqlite3.conf
+launch+=gsqlite3
+gsqlite3-database=/opt/poweradmin/powerdns.db
+EOF
 msg_ok "Setup PowerDNS"
 
 fetch_and_deploy_gh_release "poweradmin" "poweradmin/poweradmin" "tarball"
@@ -125,9 +131,13 @@ cat <<EOF >/etc/apache2/sites-enabled/poweradmin.conf
 </VirtualHost>
 EOF
 $STD a2enmod rewrite headers
-chown -R www-data:www-data /opt/poweradmin
-$STD systemctl restart apache2
-msg_info "Created Service"
+chown -R www-data:pdns /opt/poweradmin
+chmod 775 /opt/poweradmin
+chown pdns:pdns /opt/poweradmin/powerdns.db
+chmod 664 /opt/poweradmin/powerdns.db
+usermod -aG pdns www-data
+$STD systemctl restart pdns apache2
+msg_ok "Created Service"
 
 motd_ssh
 customize

install/stirling-pdf-install.sh

@@ -31,7 +31,7 @@ $STD apt install -y \
 msg_ok "Installed Dependencies"
 
 PYTHON_VERSION="3.12" setup_uv
-JAVA_VERSION="21" setup_java
+JAVA_VERSION="25" setup_java
 
 read -r -p "${TAB3}Do you want to use Stirling-PDF with Login? (no/n = without Login) [Y/n] " response
 response=${response,,} # Convert to lowercase

misc/build.func

@@ -3617,16 +3617,16 @@ build_container() {
 $PCT_OPTIONS_STRING"
   fi
 
-  # Add storage if specified
+  # Add searchdomain if specified
   if [ -n "$SD" ]; then
     PCT_OPTIONS_STRING="$PCT_OPTIONS_STRING
-  -searchdomain $SD"
+  $SD"
   fi
 
   # Add nameserver if specified
   if [ -n "$NS" ]; then
     PCT_OPTIONS_STRING="$PCT_OPTIONS_STRING
-  -nameserver $NS"
+  $NS"
   fi
 
   # Network configuration

misc/tools.func

@@ -6500,14 +6500,13 @@ function setup_postgresql() {
   local SUITE
   case "$DISTRO_CODENAME" in
   trixie | forky | sid)
-
     if verify_repo_available "https://apt.postgresql.org/pub/repos/apt" "trixie-pgdg"; then
       SUITE="trixie-pgdg"
-
     else
-      SUITE="bookworm-pgdg"
+      msg_warn "PGDG repo not available for ${DISTRO_CODENAME}, falling back to distro packages"
+      USE_PGDG_REPO=false setup_postgresql
+      return $?
     fi
-
     ;;
   *)
     SUITE=$(get_fallback_suite "$DISTRO_ID" "$DISTRO_CODENAME" "https://apt.postgresql.org/pub/repos/apt")