Update immich to v3.3.5 (CVE/CA compromise fix)

Co-authored-by: MickLesk <47820557+MickLesk@users.noreply.github.com>
2026-10-26 23:45:13 +01:00 · 2026-10-21 18:28:29 +00:00
155 changed files with 1195 additions and 2739 deletions
@@ -1,171 +1,3 @@
-## 2026-10-24
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - patchmon: avoids systemd environment secret leaks via D-Bus/subprocesses. [@rhclayto](https://github.com/rhclayto) ([#18074](https://github.com/community-scripts/ProxmoxVE/pull/18074))
-    - fix: Linkwarden - clear Yarn berry cache after install and update- #18115 [@bferd](https://github.com/bferd) ([#18116](https://github.com/community-scripts/ProxmoxVE/pull/18116))
-    - Borg-UI: recreate the borg venvs with --clear [@MickLesk](https://github.com/MickLesk) ([#18118](https://github.com/community-scripts/ProxmoxVE/pull/18118))
-    - SnapOtter: recreate the AI venv with --clear [@MickLesk](https://github.com/MickLesk) ([#18119](https://github.com/community-scripts/ProxmoxVE/pull/18119))
-    - Update authentik version to 2026.8.5 [@thieneret](https://github.com/thieneret) ([#18125](https://github.com/community-scripts/ProxmoxVE/pull/18125))
-
-  - #### ✨ New Features
-
-    - Frigate: bump to v0.18.2 [@MickLesk](https://github.com/MickLesk) ([#18120](https://github.com/community-scripts/ProxmoxVE/pull/18120))
-
-  - #### 🔧 Refactor
-
-    - install: answer every prompt from the environment, survive a closed stdin [@MickLesk](https://github.com/MickLesk) ([#18121](https://github.com/community-scripts/ProxmoxVE/pull/18121))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - fix(addons): use catch_errors so the update marker is cleared [@mazelado](https://github.com/mazelado) ([#18128](https://github.com/community-scripts/ProxmoxVE/pull/18128))
-
-## 2026-10-23
-
-### 🚀 Updated Scripts
-
-  - postgresql: default the version prompt and match Alpine's packages [@MickLesk](https://github.com/MickLesk) ([#18093](https://github.com/community-scripts/ProxmoxVE/pull/18093))
- Storyteller: build the runtime like upstream's Dockerfile [@MickLesk](https://github.com/MickLesk) ([#18083](https://github.com/community-scripts/ProxmoxVE/pull/18083))
-
-  - #### 🐞 Bug Fixes
-
-    - proxcenter: skip the type check and lower the build heap [@MickLesk](https://github.com/MickLesk) ([#18090](https://github.com/community-scripts/ProxmoxVE/pull/18090))
-    - hermesagent: retry the installer download, fall back to GitHub [@MickLesk](https://github.com/MickLesk) ([#18091](https://github.com/community-scripts/ProxmoxVE/pull/18091))
-    - zabbix: use the arm64 repository for 7.0 [@MickLesk](https://github.com/MickLesk) ([#18089](https://github.com/community-scripts/ProxmoxVE/pull/18089))
-    - kasm: survive a failed release lookup and answer the installer with flags [@MickLesk](https://github.com/MickLesk) ([#18092](https://github.com/community-scripts/ProxmoxVE/pull/18092))
-
-  - #### ✨ New Features
-
-    - InvoiceShelf: run the Laravel scheduler [@MickLesk](https://github.com/MickLesk) ([#18079](https://github.com/community-scripts/ProxmoxVE/pull/18079))
-
-  - #### 🔧 Refactor
-
-    - podman-homeassistant: require Debian 13 [@MickLesk](https://github.com/MickLesk) ([#18095](https://github.com/community-scripts/ProxmoxVE/pull/18095))
-    - apache-guacamole: require Debian 13 [@MickLesk](https://github.com/MickLesk) ([#18094](https://github.com/community-scripts/ProxmoxVE/pull/18094))
-    - unifi-os-server: require Debian 13 [@MickLesk](https://github.com/MickLesk) ([#18096](https://github.com/community-scripts/ProxmoxVE/pull/18096))
-    - openwebui: drop the Intel oneAPI Base Toolkit [@MickLesk](https://github.com/MickLesk) ([#18098](https://github.com/community-scripts/ProxmoxVE/pull/18098))
-    - ollama: drop the Intel oneAPI Base Toolkit [@MickLesk](https://github.com/MickLesk) ([#18097](https://github.com/community-scripts/ProxmoxVE/pull/18097))
-    - tdarr: do not let a failed or slow updater block the service start [@MickLesk](https://github.com/MickLesk) ([#18100](https://github.com/community-scripts/ProxmoxVE/pull/18100))
-    - immich: install mise from its GitHub release, retry jellyfin-ffmpeg, default the ML prompt [@MickLesk](https://github.com/MickLesk) ([#18099](https://github.com/community-scripts/ProxmoxVE/pull/18099))
-    - Refactor: pimox-haos-vm [@MickLesk](https://github.com/MickLesk) ([#18077](https://github.com/community-scripts/ProxmoxVE/pull/18077))
-
-### 💾 Core
-
-  - Telemetry: explain and categorize by the command that failed [@MickLesk](https://github.com/MickLesk) ([core#166](https://github.com/community-scripts/core/pull/166))
- error-handler: report a handled silent failure only on its own line [@MickLesk](https://github.com/MickLesk) ([core#165](https://github.com/community-scripts/core/pull/165))
- VM silent: return the failure instead of exiting [@MickLesk](https://github.com/MickLesk) ([core#164](https://github.com/community-scripts/core/pull/164))
- error-handler: keep the start explanation and the final IP lookup from failing the run [@MickLesk](https://github.com/MickLesk) ([core#163](https://github.com/community-scripts/core/pull/163))
- error output: report a failure inside a subshell once [@MickLesk](https://github.com/MickLesk) ([core#162](https://github.com/community-scripts/core/pull/162))
- general: allow Composer as root in every script [@MickLesk](https://github.com/MickLesk) ([core#161](https://github.com/community-scripts/core/pull/161))
- lxc-updater: skip the resource check when the container cannot read its RAM [@MickLesk](https://github.com/MickLesk) ([core#160](https://github.com/community-scripts/core/pull/160))
- vm-core: let vm_timezone_default survive a host without /etc/timezone [@MickLesk](https://github.com/MickLesk) ([core#159](https://github.com/community-scripts/core/pull/159))
-
-## 2026-10-22
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Zabbix: keep unattended updates on the installed series [@florianpunz](https://github.com/florianpunz) ([#18051](https://github.com/community-scripts/ProxmoxVE/pull/18051))
-
-  - #### 🔧 Refactor
-
-    - Refactor: Cryptpad [@MickLesk](https://github.com/MickLesk) ([#18065](https://github.com/community-scripts/ProxmoxVE/pull/18065))
-
-### 💾 Core
-
-  - Incus: drive a remote Incus server from the client's default remote [@MickLesk](https://github.com/MickLesk) ([core#154](https://github.com/community-scripts/core/pull/154))
- Deploy the release again when an update is redone [@MickLesk](https://github.com/MickLesk) ([core#158](https://github.com/community-scripts/core/pull/158))
-
-### ❔ Uncategorized
-
-  - chore(ct): sync sparkyfitness defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18061](https://github.com/community-scripts/ProxmoxVE/pull/18061))
-
-## 2026-10-21
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Immich: bump release version to v3.3.5 (CVE) [@CerberusStyle](https://github.com/CerberusStyle) ([#18057](https://github.com/community-scripts/ProxmoxVE/pull/18057))
-    - DroppedNeedle: pass release version to the app via COMMIT_TAG [@MickLesk](https://github.com/MickLesk) ([#18042](https://github.com/community-scripts/ProxmoxVE/pull/18042))
-
-### 💾 Core
-
-  - Keep the version an update started from across a redo [@MickLesk](https://github.com/MickLesk) ([core#156](https://github.com/community-scripts/core/pull/156))
- Redo an update whose run did not finish after the deploy [@MickLesk](https://github.com/MickLesk) ([core#155](https://github.com/community-scripts/core/pull/155))
-
-## 2026-10-20
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Plane: give Silo its own HOME [@MickLesk](https://github.com/MickLesk) ([#18028](https://github.com/community-scripts/ProxmoxVE/pull/18028))
-    - Immich: Pin version to 3.3.4 [@vhsdream](https://github.com/vhsdream) ([#18036](https://github.com/community-scripts/ProxmoxVE/pull/18036))
-    - InvenTree: run apt under systemd so postinst can finish [@MickLesk](https://github.com/MickLesk) ([#18029](https://github.com/community-scripts/ProxmoxVE/pull/18029))
-    - Profilarr: pass the deno pin as the version [@MickLesk](https://github.com/MickLesk) ([#18025](https://github.com/community-scripts/ProxmoxVE/pull/18025))
-    - Silo: keep the version file out of ~/.silo [@MickLesk](https://github.com/MickLesk) ([#18030](https://github.com/community-scripts/ProxmoxVE/pull/18030))
-    - InvenTree: move to go.packager.io [@MickLesk](https://github.com/MickLesk) ([#18015](https://github.com/community-scripts/ProxmoxVE/pull/18015))
-    - Zitadel: run init and setup in the foreground [@MickLesk](https://github.com/MickLesk) ([#18016](https://github.com/community-scripts/ProxmoxVE/pull/18016))
-
-  - #### ✨ New Features
-
-    - Zitadel: Support v1 and v2 Login [@MickLesk](https://github.com/MickLesk) ([#18031](https://github.com/community-scripts/ProxmoxVE/pull/18031))
-
-  - #### 🔧 Refactor
-
-    - Refactor: OpenWebUI (remove numba pin)  [@MickLesk](https://github.com/MickLesk) ([#18026](https://github.com/community-scripts/ProxmoxVE/pull/18026))
-
-### 💾 Core
-
-  - Only treat an NVIDIA GPU as present when its device nodes are [@MickLesk](https://github.com/MickLesk) ([core#153](https://github.com/community-scripts/core/pull/153))
-
-## 2026-10-19
-
-### 🆕 New Scripts
-
-  - Calagopus ([#18012](https://github.com/community-scripts/ProxmoxVE/pull/18012))
- Netronome ([#18011](https://github.com/community-scripts/ProxmoxVE/pull/18011))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - immich: record library revisions when the line is missing [@mazelado](https://github.com/mazelado) ([#17990](https://github.com/community-scripts/ProxmoxVE/pull/17990))
-    - Update authentik 2026.8.4 [@thieneret](https://github.com/thieneret) ([#18004](https://github.com/community-scripts/ProxmoxVE/pull/18004))
-
-  - #### ✨ New Features
-
-    - feat(mealie): add reverse proxy auth settings to mealie.env [@bferd](https://github.com/bferd) ([#18006](https://github.com/community-scripts/ProxmoxVE/pull/18006))
-
-## 2026-10-18
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Donetick: create selfhosted.yaml from the example [@MickLesk](https://github.com/MickLesk) ([#17992](https://github.com/community-scripts/ProxmoxVE/pull/17992))
-    - Wiki.js: only back up db.sqlite on SQLite installs [@MickLesk](https://github.com/MickLesk) ([#17993](https://github.com/community-scripts/ProxmoxVE/pull/17993))
-    - FlareSolverr: pass Chrome an en-US Accept-Language [@MickLesk](https://github.com/MickLesk) ([#17995](https://github.com/community-scripts/ProxmoxVE/pull/17995))
-    - 2FAuth: install the locked dependencies [@MickLesk](https://github.com/MickLesk) ([#17996](https://github.com/community-scripts/ProxmoxVE/pull/17996))
-    - Tracearr: drop the pnpm store after the update build [@gioxx](https://github.com/gioxx) ([#17869](https://github.com/community-scripts/ProxmoxVE/pull/17869))
-    - vaultwarden: build before stopping the service [@mazelado](https://github.com/mazelado) ([#17983](https://github.com/community-scripts/ProxmoxVE/pull/17983))
-
-  - #### 💥 Breaking Changes
-
-    - fix: geopulse 2.0.0 upgrade support (nginx .mjs, pg18, jwt cleanup) [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17978](https://github.com/community-scripts/ProxmoxVE/pull/17978))
-
-### 💾 Core
-
-  - Let get_current_ip reach its IPv6 fallback [@MickLesk](https://github.com/MickLesk) ([core#151](https://github.com/community-scripts/core/pull/151))
- Drop apt autoclean before apt clean [@MickLesk](https://github.com/MickLesk) ([core#152](https://github.com/community-scripts/core/pull/152))
- Silence apt's script warning in $STD [@MickLesk](https://github.com/MickLesk) ([core#150](https://github.com/community-scripts/core/pull/150))
-
 ## 2026-10-17

 ### 🆕 New Scripts
@@ -119,9 +119,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit



-
-
-



@@ -135,7 +132,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit


 <details>
-<summary><h4>October (24 entries)</h4></summary>
+<summary><h4>October (17 entries)</h4></summary>

 [View October 2026 Changelog](.github/changelogs/2026/10.md)

@@ -568,177 +565,12 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 </details>

-## 2026-10-26
-
-### 🆕 New Scripts
-
-  - HomeTube ([#18172](https://github.com/community-scripts/ProxmoxVE/pull/18172))
- Honcho ([#18169](https://github.com/community-scripts/ProxmoxVE/pull/18169))
- YTPTube ([#18174](https://github.com/community-scripts/ProxmoxVE/pull/18174))
- Stump ([#18173](https://github.com/community-scripts/ProxmoxVE/pull/18173))
- Casdoor ([#18170](https://github.com/community-scripts/ProxmoxVE/pull/18170))
- Streamystats ([#18171](https://github.com/community-scripts/ProxmoxVE/pull/18171))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - excalidash: bump Node.js from 20 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18213](https://github.com/community-scripts/ProxmoxVE/pull/18213))
-    - readmeabook: bump Node.js from 20 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18217](https://github.com/community-scripts/ProxmoxVE/pull/18217))
-    - homepage: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18214](https://github.com/community-scripts/ProxmoxVE/pull/18214))
-    - remove old -install.sh (verdaccio) [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18218](https://github.com/community-scripts/ProxmoxVE/pull/18218))
-    - meshcentral: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18215](https://github.com/community-scripts/ProxmoxVE/pull/18215))
-
-## 2026-10-25
-
-### 🆕 New Scripts
-
-  - Dreeve ([#18167](https://github.com/community-scripts/ProxmoxVE/pull/18167))
- TaskView ([#18166](https://github.com/community-scripts/ProxmoxVE/pull/18166))
- EmDash ([#18165](https://github.com/community-scripts/ProxmoxVE/pull/18165))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - fix(mealie): install ffmpeg for video recipe import [@clartek](https://github.com/clartek) ([#18210](https://github.com/community-scripts/ProxmoxVE/pull/18210))
-    - Termix: step through 2.9.2 when updating from 2.8 or older [@MickLesk](https://github.com/MickLesk) ([#18158](https://github.com/community-scripts/ProxmoxVE/pull/18158))
-    - Element Synapse: remove the registration line by its text, not line 34 [@MickLesk](https://github.com/MickLesk) ([#18201](https://github.com/community-scripts/ProxmoxVE/pull/18201))
-    - Element Synapse: drop the ::1 listener so a container without IPv6 starts [@MickLesk](https://github.com/MickLesk) ([#18180](https://github.com/community-scripts/ProxmoxVE/pull/18180))
-    - Heimdall: generate the app key without the production prompt [@MickLesk](https://github.com/MickLesk) ([#18156](https://github.com/community-scripts/ProxmoxVE/pull/18156))
-    - Frigate: fetch the Intel graphics key with retries before building the media driver [@MickLesk](https://github.com/MickLesk) ([#18192](https://github.com/community-scripts/ProxmoxVE/pull/18192))
-    - Pterodactyl Panel: default the admin's first and last name when left empty [@MickLesk](https://github.com/MickLesk) ([#18177](https://github.com/community-scripts/ProxmoxVE/pull/18177))
-    - Jellyseerr: point fresh installs to Seerr instead of a missing install script [@MickLesk](https://github.com/MickLesk) ([#18183](https://github.com/community-scripts/ProxmoxVE/pull/18183))
-    - Pi-hole: download the installer before running it [@MickLesk](https://github.com/MickLesk) ([#18182](https://github.com/community-scripts/ProxmoxVE/pull/18182))
-    - OmniTools: give the build a git commit to read [@MickLesk](https://github.com/MickLesk) ([#18181](https://github.com/community-scripts/ProxmoxVE/pull/18181))
-    - iVentoy: stop early in an unprivileged container [@MickLesk](https://github.com/MickLesk) ([#18179](https://github.com/community-scripts/ProxmoxVE/pull/18179))
-    - Immich: stop early on Debian 12 instead of failing at apt [@MickLesk](https://github.com/MickLesk) ([#18178](https://github.com/community-scripts/ProxmoxVE/pull/18178))
-    - paperless-ngx: fix missing index folder [@Segelzwerg](https://github.com/Segelzwerg) ([#18142](https://github.com/community-scripts/ProxmoxVE/pull/18142))
-    - Anytype Server: keep the .env across updates and recreate a lost one [@MickLesk](https://github.com/MickLesk) ([#18155](https://github.com/community-scripts/ProxmoxVE/pull/18155))
-    - changedetection: build Browserless from its lockfile on update [@MickLesk](https://github.com/MickLesk) ([#18157](https://github.com/community-scripts/ProxmoxVE/pull/18157))
-    - Zitadel: identify the machine by hostname when it has no private IPv4 [@MickLesk](https://github.com/MickLesk) ([#18139](https://github.com/community-scripts/ProxmoxVE/pull/18139))
-    - fix(bar-assistant): publish starter media catalog so new bars provision [@och29](https://github.com/och29) ([#18130](https://github.com/community-scripts/ProxmoxVE/pull/18130))
-
-  - #### ✨ New Features
-
-    - Gramps-Web: run the Celery task queue with Redis [@MickLesk](https://github.com/MickLesk) ([#18141](https://github.com/community-scripts/ProxmoxVE/pull/18141))
-
-  - #### 💥 Breaking Changes
-
-    - Hermes Agent: install, update and run everything as the hermes user [@MickLesk](https://github.com/MickLesk) ([#18203](https://github.com/community-scripts/ProxmoxVE/pull/18203))
-    - tubearchivist: fix: prepare tubearchivist for v0.6.0 [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17867](https://github.com/community-scripts/ProxmoxVE/pull/17867))
-
-  - #### 🔧 Refactor
-
-    - TREK: build 5.0 with 4 GB RAM and without dependency install scripts [@MickLesk](https://github.com/MickLesk) ([#18194](https://github.com/community-scripts/ProxmoxVE/pull/18194))
-
-### 💾 Core
-
-  - alpine: fix uv release url [@mfelipe](https://github.com/mfelipe) ([core#168](https://github.com/community-scripts/core/pull/168))
- Set npm's script and git policy for root too, so --prefix keeps it [@MickLesk](https://github.com/MickLesk) ([core#170](https://github.com/community-scripts/core/pull/170))
- Upgrade Node.js in place when an app package depends on it [@MickLesk](https://github.com/MickLesk) ([core#169](https://github.com/community-scripts/core/pull/169))
-
-### 🧰 Tools
-
-  - #### ✨ New Features
-
-    - post-pmg-install: hide the subscription nag in the PMG 9 mobile quarantine [@MickLesk](https://github.com/MickLesk) ([#18140](https://github.com/community-scripts/ProxmoxVE/pull/18140))
-    - post-pve-install: hide the mobile subscription nag in every UI language [@MickLesk](https://github.com/MickLesk) ([#18143](https://github.com/community-scripts/ProxmoxVE/pull/18143))
-
-## 2026-10-24
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - patchmon: avoids systemd environment secret leaks via D-Bus/subprocesses. [@rhclayto](https://github.com/rhclayto) ([#18074](https://github.com/community-scripts/ProxmoxVE/pull/18074))
-    - fix: Linkwarden - clear Yarn berry cache after install and update- #18115 [@bferd](https://github.com/bferd) ([#18116](https://github.com/community-scripts/ProxmoxVE/pull/18116))
-    - Borg-UI: recreate the borg venvs with --clear [@MickLesk](https://github.com/MickLesk) ([#18118](https://github.com/community-scripts/ProxmoxVE/pull/18118))
-    - SnapOtter: recreate the AI venv with --clear [@MickLesk](https://github.com/MickLesk) ([#18119](https://github.com/community-scripts/ProxmoxVE/pull/18119))
-    - Update authentik version to 2026.8.5 [@thieneret](https://github.com/thieneret) ([#18125](https://github.com/community-scripts/ProxmoxVE/pull/18125))
-
-  - #### ✨ New Features
-
-    - Frigate: bump to v0.18.2 [@MickLesk](https://github.com/MickLesk) ([#18120](https://github.com/community-scripts/ProxmoxVE/pull/18120))
-
-  - #### 🔧 Refactor
-
-    - install: answer every prompt from the environment, survive a closed stdin [@MickLesk](https://github.com/MickLesk) ([#18121](https://github.com/community-scripts/ProxmoxVE/pull/18121))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - fix(addons): use catch_errors so the update marker is cleared [@mazelado](https://github.com/mazelado) ([#18128](https://github.com/community-scripts/ProxmoxVE/pull/18128))
-
-## 2026-10-23
-
-### 🚀 Updated Scripts
-
-  - postgresql: default the version prompt and match Alpine's packages [@MickLesk](https://github.com/MickLesk) ([#18093](https://github.com/community-scripts/ProxmoxVE/pull/18093))
- Storyteller: build the runtime like upstream's Dockerfile [@MickLesk](https://github.com/MickLesk) ([#18083](https://github.com/community-scripts/ProxmoxVE/pull/18083))
-
-  - #### 🐞 Bug Fixes
-
-    - proxcenter: skip the type check and lower the build heap [@MickLesk](https://github.com/MickLesk) ([#18090](https://github.com/community-scripts/ProxmoxVE/pull/18090))
-    - hermesagent: retry the installer download, fall back to GitHub [@MickLesk](https://github.com/MickLesk) ([#18091](https://github.com/community-scripts/ProxmoxVE/pull/18091))
-    - zabbix: use the arm64 repository for 7.0 [@MickLesk](https://github.com/MickLesk) ([#18089](https://github.com/community-scripts/ProxmoxVE/pull/18089))
-    - kasm: survive a failed release lookup and answer the installer with flags [@MickLesk](https://github.com/MickLesk) ([#18092](https://github.com/community-scripts/ProxmoxVE/pull/18092))
-
-  - #### ✨ New Features
-
-    - InvoiceShelf: run the Laravel scheduler [@MickLesk](https://github.com/MickLesk) ([#18079](https://github.com/community-scripts/ProxmoxVE/pull/18079))
-
-  - #### 🔧 Refactor
-
-    - podman-homeassistant: require Debian 13 [@MickLesk](https://github.com/MickLesk) ([#18095](https://github.com/community-scripts/ProxmoxVE/pull/18095))
-    - apache-guacamole: require Debian 13 [@MickLesk](https://github.com/MickLesk) ([#18094](https://github.com/community-scripts/ProxmoxVE/pull/18094))
-    - unifi-os-server: require Debian 13 [@MickLesk](https://github.com/MickLesk) ([#18096](https://github.com/community-scripts/ProxmoxVE/pull/18096))
-    - openwebui: drop the Intel oneAPI Base Toolkit [@MickLesk](https://github.com/MickLesk) ([#18098](https://github.com/community-scripts/ProxmoxVE/pull/18098))
-    - ollama: drop the Intel oneAPI Base Toolkit [@MickLesk](https://github.com/MickLesk) ([#18097](https://github.com/community-scripts/ProxmoxVE/pull/18097))
-    - tdarr: do not let a failed or slow updater block the service start [@MickLesk](https://github.com/MickLesk) ([#18100](https://github.com/community-scripts/ProxmoxVE/pull/18100))
-    - immich: install mise from its GitHub release, retry jellyfin-ffmpeg, default the ML prompt [@MickLesk](https://github.com/MickLesk) ([#18099](https://github.com/community-scripts/ProxmoxVE/pull/18099))
-    - Refactor: pimox-haos-vm [@MickLesk](https://github.com/MickLesk) ([#18077](https://github.com/community-scripts/ProxmoxVE/pull/18077))
-
-### 💾 Core
-
-  - Telemetry: explain and categorize by the command that failed [@MickLesk](https://github.com/MickLesk) ([core#166](https://github.com/community-scripts/core/pull/166))
- error-handler: report a handled silent failure only on its own line [@MickLesk](https://github.com/MickLesk) ([core#165](https://github.com/community-scripts/core/pull/165))
- VM silent: return the failure instead of exiting [@MickLesk](https://github.com/MickLesk) ([core#164](https://github.com/community-scripts/core/pull/164))
- error-handler: keep the start explanation and the final IP lookup from failing the run [@MickLesk](https://github.com/MickLesk) ([core#163](https://github.com/community-scripts/core/pull/163))
- error output: report a failure inside a subshell once [@MickLesk](https://github.com/MickLesk) ([core#162](https://github.com/community-scripts/core/pull/162))
- general: allow Composer as root in every script [@MickLesk](https://github.com/MickLesk) ([core#161](https://github.com/community-scripts/core/pull/161))
- lxc-updater: skip the resource check when the container cannot read its RAM [@MickLesk](https://github.com/MickLesk) ([core#160](https://github.com/community-scripts/core/pull/160))
- vm-core: let vm_timezone_default survive a host without /etc/timezone [@MickLesk](https://github.com/MickLesk) ([core#159](https://github.com/community-scripts/core/pull/159))
-
-## 2026-10-22
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Zabbix: keep unattended updates on the installed series [@florianpunz](https://github.com/florianpunz) ([#18051](https://github.com/community-scripts/ProxmoxVE/pull/18051))
-
-  - #### 🔧 Refactor
-
-    - Refactor: Cryptpad [@MickLesk](https://github.com/MickLesk) ([#18065](https://github.com/community-scripts/ProxmoxVE/pull/18065))
-
-### 💾 Core
-
-  - Incus: drive a remote Incus server from the client's default remote [@MickLesk](https://github.com/MickLesk) ([core#154](https://github.com/community-scripts/core/pull/154))
- Deploy the release again when an update is redone [@MickLesk](https://github.com/MickLesk) ([core#158](https://github.com/community-scripts/core/pull/158))
-
-### ❔ Uncategorized
-
-  - chore(ct): sync sparkyfitness defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18061](https://github.com/community-scripts/ProxmoxVE/pull/18061))
-
 ## 2026-10-21

 ### 🚀 Updated Scripts

  - #### 🐞 Bug Fixes

-    - Immich: bump release version to v3.3.5 (CVE) [@CerberusStyle](https://github.com/CerberusStyle) ([#18057](https://github.com/community-scripts/ProxmoxVE/pull/18057))
    - DroppedNeedle: pass release version to the app via COMMIT_TAG [@MickLesk](https://github.com/MickLesk) ([#18042](https://github.com/community-scripts/ProxmoxVE/pull/18042))

 ### 💾 Core
@@ -1355,4 +1187,154 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

  - Incus: make prompts visible for end-user [@MickLesk](https://github.com/MickLesk) ([core#73](https://github.com/community-scripts/core/pull/73))
 - incus: do not let an install script block on an invisible prompt [@MickLesk](https://github.com/MickLesk) ([core#71](https://github.com/community-scripts/core/pull/71))
- tel: report progress from installs only, not updates [@MickLesk](https://github.com/MickLesk) ([core#72](https://github.com/community-scripts/core/pull/72))
+- tel: report progress from installs only, not updates [@MickLesk](https://github.com/MickLesk) ([core#72](https://github.com/community-scripts/core/pull/72))
+
+## 2026-09-24
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Declare the RomM filesystem structure required since 5.3.0 [@MickLesk](https://github.com/MickLesk) ([#17480](https://github.com/community-scripts/ProxmoxVE/pull/17480))
+    - general: use apt_update_safe instead of aborting on a failed apt update [@MickLesk](https://github.com/MickLesk) ([#17462](https://github.com/community-scripts/ProxmoxVE/pull/17462))
+
+  - #### 🔧 Refactor
+
+    - Journiv: Serve Node Frontend and add HTTP Auth .env [@MickLesk](https://github.com/MickLesk) ([#17479](https://github.com/community-scripts/ProxmoxVE/pull/17479))
+
+### 💾 Core
+
+  - core: accept an off-subnet gateway for /31 and /32 [@MickLesk](https://github.com/MickLesk) ([core#70](https://github.com/community-scripts/core/pull/70))
+
+## 2026-09-23
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(signoz): install the histogramQuantile ClickHouse function [@maksimtech](https://github.com/maksimtech) ([#17386](https://github.com/community-scripts/ProxmoxVE/pull/17386))
+    - omniroute: bump to 4 GB for the npm install [@MickLesk](https://github.com/MickLesk) ([#17461](https://github.com/community-scripts/ProxmoxVE/pull/17461))
+    - Run Borg-UI with a single gunicorn worker [@MickLesk](https://github.com/MickLesk) ([#17445](https://github.com/community-scripts/ProxmoxVE/pull/17445))
+    - immich: keep geodata linked and the build deps present on update [@MickLesk](https://github.com/MickLesk) ([#17438](https://github.com/community-scripts/ProxmoxVE/pull/17438))
+
+  - #### 🔧 Refactor
+
+    - Refactor: Scanopy [@MickLesk](https://github.com/MickLesk) ([#16797](https://github.com/community-scripts/ProxmoxVE/pull/16797))
+
+### 💾 Core
+
+  - stop a partial find from aborting the caller under pipefail [@MickLesk](https://github.com/MickLesk) ([core#68](https://github.com/community-scripts/core/pull/68))
+- core: give RHEL-family containers an ostype PVE accepts [@MickLesk](https://github.com/MickLesk) ([core#67](https://github.com/community-scripts/core/pull/67))
+- core: do not abort on a failed apt update [@MickLesk](https://github.com/MickLesk) ([core#66](https://github.com/community-scripts/core/pull/66))
+- VM's: report a finished VM as done, not aborted [@MickLesk](https://github.com/MickLesk) ([core#65](https://github.com/community-scripts/core/pull/65))
+- VM-Core: decide console autologin from the image, not USE_CLOUD_INIT [@MickLesk](https://github.com/MickLesk) ([core#63](https://github.com/community-scripts/core/pull/63))
+- VM-Core: report failed image steps and restore tty1 autologin without cloud-init [@MickLesk](https://github.com/MickLesk) ([core#62](https://github.com/community-scripts/core/pull/62))
+- tools: raise pnpm/yarn fetch timeout and lower network concurrency [@MickLesk](https://github.com/MickLesk) ([core#59](https://github.com/community-scripts/core/pull/59))
+- VM-Core: stop discarding cloud-init error messages [@MickLesk](https://github.com/MickLesk) ([core#60](https://github.com/community-scripts/core/pull/60))
+
+## 2026-09-22
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(invoiceshelf): re-link storage during update [@owenvoke](https://github.com/owenvoke) ([#17431](https://github.com/community-scripts/ProxmoxVE/pull/17431))
+    - fix(alpine-it-tools): write the version file after a successful update [@Houtek](https://github.com/Houtek) ([#17421](https://github.com/community-scripts/ProxmoxVE/pull/17421))
+    - Umami: Align pnpm with engines.pnpm on update [@ReneNulschDE](https://github.com/ReneNulschDE) ([#17404](https://github.com/community-scripts/ProxmoxVE/pull/17404))
+
+  - #### 🔧 Refactor
+
+    - several scripts: let uv see the project before syncing it | refactor some scripts that use uv [@MickLesk](https://github.com/MickLesk) ([#17436](https://github.com/community-scripts/ProxmoxVE/pull/17436))
+
+### 💾 Core
+
+  - setup_uv: honour a project's required-version pin [@MickLesk](https://github.com/MickLesk) ([core#58](https://github.com/community-scripts/core/pull/58))
+- fix(motd): repair legacy 00_lxc-details.sh header and dead color placeholders [@BadFlo](https://github.com/BadFlo) ([core#53](https://github.com/community-scripts/core/pull/53))
+- meilisearch: take the raw binary, not the .deb [@MickLesk](https://github.com/MickLesk) ([core#57](https://github.com/community-scripts/core/pull/57))
+
+### 📚 Documentation
+
+  - github: Stop generating header filenames with a newline in them [@MickLesk](https://github.com/MickLesk) ([#17435](https://github.com/community-scripts/ProxmoxVE/pull/17435))
+
+### ❔ Uncategorized
+
+  - chore(ct): sync cloudflare-ddns defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17446](https://github.com/community-scripts/ProxmoxVE/pull/17446))
+
+## 2026-09-21
+
+### 🆕 New Scripts
+
+  - AudioMuse-AI ([#17415](https://github.com/community-scripts/ProxmoxVE/pull/17415))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(portabase): meet the default admin password rules [@maksimtech](https://github.com/maksimtech) ([#17384](https://github.com/community-scripts/ProxmoxVE/pull/17384))
+    - truenas-vm: strip the G before the storage allocation [@MickLesk](https://github.com/MickLesk) ([#17407](https://github.com/community-scripts/ProxmoxVE/pull/17407))
+    - Librenms - Fix local snmpd community string setup [@dopch](https://github.com/dopch) ([#17363](https://github.com/community-scripts/ProxmoxVE/pull/17363))
+    - fix(iventoy): preserve release data and migrate legacy service launchers [@Msprg](https://github.com/Msprg) ([#17161](https://github.com/community-scripts/ProxmoxVE/pull/17161))
+    - xyops: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17398](https://github.com/community-scripts/ProxmoxVE/pull/17398))
+
+### 💾 Core
+
+  - Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#56](https://github.com/community-scripts/core/pull/56))
+- github-api: take the release the maintainer marked as latest [@MickLesk](https://github.com/MickLesk) ([core#55](https://github.com/community-scripts/core/pull/55))
+- general: prune old Rust toolchains [@MickLesk](https://github.com/MickLesk) ([core#52](https://github.com/community-scripts/core/pull/52))
+- Ask when the preselected storage cannot hold the content [@MickLesk](https://github.com/MickLesk) ([core#51](https://github.com/community-scripts/core/pull/51))
+
+## 2026-09-20
+
+### 🆕 New Scripts
+
+  - Your-Spotify ([#17376](https://github.com/community-scripts/ProxmoxVE/pull/17376))
+
+## 2026-09-19
+
+### 🆕 New Scripts
+
+  - qBit-Manage ([#17377](https://github.com/community-scripts/ProxmoxVE/pull/17377))
+- Ubuntu-VM: AIO | new core | performance | remove old wrappers [@MickLesk](https://github.com/MickLesk) ([#17354](https://github.com/community-scripts/ProxmoxVE/pull/17354))
+
+### 💾 Core
+
+  - Fall back to the unversioned banner slug [@MickLesk](https://github.com/MickLesk) ([core#48](https://github.com/community-scripts/core/pull/48))
+
+### ❔ Uncategorized
+
+  - chore(ct): sync immichframe defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17373](https://github.com/community-scripts/ProxmoxVE/pull/17373))
+
+## 2026-09-18
+
+### 🆕 New Scripts
+
+  - Almalinux-VM ([#17349](https://github.com/community-scripts/ProxmoxVE/pull/17349))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - update authentik to 2026.8.3 [@thieneret](https://github.com/thieneret) ([#17366](https://github.com/community-scripts/ProxmoxVE/pull/17366))
+    - crafty-controller: chown after restore_backup so restored data keeps ownership [@MickLesk](https://github.com/MickLesk) ([#17348](https://github.com/community-scripts/ProxmoxVE/pull/17348))
+    - databasus, domain-monitor, poznote: chown after restore_backup so restored data keeps its owner [@MickLesk](https://github.com/MickLesk) ([#17350](https://github.com/community-scripts/ProxmoxVE/pull/17350))
+    - alpine-vm: ask for the Cloud-Init credentials [@MickLesk](https://github.com/MickLesk) ([#17355](https://github.com/community-scripts/ProxmoxVE/pull/17355))
+    - suggestarr: keep the data where the app actually reads it [@MickLesk](https://github.com/MickLesk) ([#17317](https://github.com/community-scripts/ProxmoxVE/pull/17317))
+    - immichframe: set the admin password the new admin UI requires [@MickLesk](https://github.com/MickLesk) ([#17315](https://github.com/community-scripts/ProxmoxVE/pull/17315))
+
+  - #### ✨ New Features
+
+    - pangolin: Bump to 1.23.0 [@MickLesk](https://github.com/MickLesk) ([#17343](https://github.com/community-scripts/ProxmoxVE/pull/17343))
+
+  - #### 🔧 Refactor
+
+    - Refactor: Oxicloud [@MickLesk](https://github.com/MickLesk) ([#17338](https://github.com/community-scripts/ProxmoxVE/pull/17338))
+
+### 💾 Core
+
+  - Stop a modified conffile from aborting the whole update [@MickLesk](https://github.com/MickLesk) ([core#47](https://github.com/community-scripts/core/pull/47))
+- Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#46](https://github.com/community-scripts/core/pull/46))
+- github api: retry a 200 that is not a usable release payload [@MickLesk](https://github.com/MickLesk) ([core#45](https://github.com/community-scripts/core/pull/45))
+
+### 📚 Documentation
+
+  - chore: fix PR template help [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17364](https://github.com/community-scripts/ProxmoxVE/pull/17364))
@@ -37,25 +37,13 @@ function update_script() {
    systemctl stop anytype
    msg_ok "Stopped Service"

-    create_backup /opt/anytype/data /opt/anytype/.env
+    create_backup /opt/anytype/data

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "anytype" "grishy/any-sync-bundle" "prebuild" "latest" "/opt/anytype" "any-sync-bundle_*_linux_$(arch_resolve).tar.gz"
    chmod +x /opt/anytype/any-sync-bundle

    restore_backup

-    if [[ ! -f /opt/anytype/.env ]]; then
-      cat <<EOF >/opt/anytype/.env
-ANY_SYNC_BUNDLE_CONFIG=/opt/anytype/data/bundle-config.yml
-ANY_SYNC_BUNDLE_CLIENT_CONFIG=/opt/anytype/data/client-config.yml
-ANY_SYNC_BUNDLE_INIT_STORAGE=/opt/anytype/data/storage/
-ANY_SYNC_BUNDLE_INIT_EXTERNAL_ADDRS=$(hostname -I | awk '{print $1}')
-ANY_SYNC_BUNDLE_INIT_MONGO_URI=mongodb://127.0.0.1:27017/
-ANY_SYNC_BUNDLE_INIT_REDIS_URI=redis://127.0.0.1:6379/
-ANY_SYNC_BUNDLE_LOG_LEVEL=info
-EOF
-    fi
-
    msg_info "Starting Service"
    systemctl start anytype
    msg_ok "Started Service"
@@ -47,7 +47,7 @@ function update_script() {
  RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
  setup_yq

-  AUTHENTIK_VERSION="version/2026.8.5"
+  AUTHENTIK_VERSION="version/2026.8.4"
  # Source: https://github.com/goauthentik/fips/blob/main/Makefile#L26
  XMLSEC_VERSION="1.3.12"

@@ -46,19 +46,11 @@ function update_script() {

    restore_backup

-    msg_info "Refreshing Bar-Assistant data pack"
-    rm -rf /opt/bar-assistant/resources/data
-    mkdir -p /opt/bar-assistant/resources/data
-    curl -fsSL https://github.com/bar-assistant/data/archive/refs/heads/v5.tar.gz | tar -xz --strip-components=1 -C /opt/bar-assistant/resources/data
-    chown -R www-data:www-data /opt/bar-assistant/resources/data
-    msg_ok "Refreshed Bar-Assistant data pack"
-
    msg_info "Configuring Bar-Assistant"
    cd /opt/bar-assistant
    $STD composer install --no-interaction
    $STD php artisan migrate --force
    $STD php artisan storage:link
-    $STD php artisan starter-media:publish
    $STD php artisan bar:setup-meilisearch
    $STD php artisan scout:sync-index-settings
    $STD php artisan config:cache
@@ -69,7 +69,7 @@ function update_script() {

    if [[ "$(cat /opt/borg1-venv/.pinned_version 2>/dev/null)" != "$BORG1_VERSION" ]]; then
      msg_info "Installing Borg ${BORG1_VERSION} (Patience)"
-      $STD uv venv --clear --python "$BORG_PYTHON" /opt/borg1-venv
+      $STD uv venv --python "$BORG_PYTHON" /opt/borg1-venv
      $STD uv pip install --python /opt/borg1-venv pyfuse3 "borgbackup==${BORG1_VERSION}"
      echo "$BORG1_VERSION" >/opt/borg1-venv/.pinned_version
      ln -sf /opt/borg1-venv/bin/borg /usr/local/bin/borg
@@ -78,7 +78,7 @@ function update_script() {

    if [[ "$(cat /opt/borg2-venv/.pinned_version 2>/dev/null)" != "${BORG2_VERSION}-${BORGSTORE_VERSION}" ]]; then
      msg_info "Installing Borg ${BORG2_VERSION} (Patience)"
-      $STD uv venv --clear --python "$BORG_PYTHON" /opt/borg2-venv
+      $STD uv venv --python "$BORG_PYTHON" /opt/borg2-venv
      $STD uv pip install --python /opt/borg2-venv pyfuse3 "borgbackup==${BORG2_VERSION}" "borgstore[rclone,sftp,rest,s3,blake3]==${BORGSTORE_VERSION}"
      echo "${BORG2_VERSION}-${BORGSTORE_VERSION}" >/opt/borg2-venv/.pinned_version
      ln -sf /opt/borg2-venv/bin/borg /usr/local/bin/borg2
@@ -1,56 +0,0 @@
-#!/usr/bin/env bash
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/casdoor/casdoor
-
-APP="Casdoor"
-var_tags="${var_tags:-auth;sso;iam}"
-var_cpu="${var_cpu:-1}"
-var_ram="${var_ram:-1024}"
-var_disk="${var_disk:-4}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/casdoor ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "casdoor" "casdoor/casdoor"; then
-    msg_info "Stopping Casdoor"
-    systemctl stop casdoor
-    msg_ok "Stopped Casdoor"
-
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "casdoor" "casdoor/casdoor" "prebuild" "latest" "/opt/casdoor" "casdoor_Linux_$(arch_resolve "x86_64" "arm64").tar.gz"
-
-    msg_info "Starting Casdoor"
-    systemctl start casdoor
-    msg_ok "Started Casdoor"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:8000${CL}"
@@ -77,6 +77,7 @@ function update_script() {
    msg_info "Updating Browserless (Patience)"
    $STD git -C /opt/browserless/ fetch --all
    $STD git -C /opt/browserless/ reset --hard origin/main
+    $STD npm update --prefix /opt/browserless
    $STD npm ci --include=optional --include=dev --prefix /opt/browserless
    $STD npm install --save-exact playwright-core@1.62.1 --prefix /opt/browserless
    $STD /opt/browserless/node_modules/playwright-core/cli.js install --with-deps
@@ -30,14 +30,12 @@ function update_script() {
    msg_error "No ${APP} Installation Found!"
    exit
  fi
-  # Updates to 2026.10.0 finished without infra.js; run them again so it gets written
-  [[ -f /opt/cryptpad/config/infra.example.js && ! -f /opt/cryptpad/config/infra.js ]] && rm -f ~/.cryptpad
  if check_for_gh_release "cryptpad" "cryptpad/cryptpad"; then
    msg_info "Stopping Service"
    systemctl stop cryptpad
    msg_ok "Stopped Service"

-    create_backup /opt/cryptpad/config/config.js /opt/cryptpad/config/infra.js /opt/cryptpad/www/common/onlyoffice/dist
+    create_backup /opt/cryptpad/config/config.js /opt/cryptpad/www/common/onlyoffice/dist

    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="blob block customize data datastore onlyoffice-conf" fetch_and_deploy_gh_release "cryptpad" "cryptpad/cryptpad" "tarball"

@@ -47,30 +45,8 @@ function update_script() {
    cd /opt/cryptpad
    $STD npm ci --allow-git=all
    $STD npm run install:components
-    if [[ -d /opt/cryptpad/www/common/onlyoffice/dist ]]; then
-      $STD bash /opt/cryptpad/install-office.sh --accept-license
-    fi
-    if [[ ! -f /opt/cryptpad/config/infra.js ]]; then
-      # 2026.10.0 reads the network settings from infra.js and no longer derives the sandbox origin
-      LOCAL_IP="$LOCAL_IP" node - <<'EOF'
-const c = require("/opt/cryptpad/config/config.js");
-const i = require("/opt/cryptpad/config/infra.example.js");
-const port = c.httpPort || i.public.httpPort;
-const safePort = c.httpSafePort || port + 1;
-const origin = (c.httpUnsafeOrigin || `http://${process.env.LOCAL_IP}:${port}`).replace(/\/+$/, "");
-const sandbox = new URL(origin);
-sandbox.port = safePort;
-Object.assign(i.public, {
-  origin,
-  sandboxOrigin: (c.httpSafeOrigin || sandbox.origin).replace(/\/+$/, ""),
-  httpHost: c.httpAddress || (c.httpUnsafeOrigin ? i.public.httpHost : "0.0.0.0"),
-  httpPort: port,
-  httpSafePort: safePort,
-  externalWebsocketURL: c.externalWebsocketURL,
-  fileHost: c.fileHost,
-});
-require("fs").writeFileSync("/opt/cryptpad/config/infra.js", "module.exports = " + JSON.stringify(i, null, 4) + ";\n");
-EOF
+    if [ -f "/opt/cryptpad/install-onlyoffice.sh" ]; then
+      $STD bash /opt/cryptpad/install-onlyoffice.sh --accept-license
    fi
    $STD npm run build
    msg_ok "Updated CryptaPad"
@@ -1,80 +0,0 @@
-#!/usr/bin/env bash
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/dreeveapp/dreeve
-
-APP="Dreeve"
-var_tags="${var_tags:-fitness;dashboard}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
-var_disk="${var_disk:-10}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/dreeve ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "dreeve" "dreeveapp/dreeve"; then
-    msg_info "Stopping Service"
-    systemctl stop dreeve
-    msg_ok "Stopped Service"
-
-    create_backup /opt/dreeve/.env.local /opt/dreeve/Caddyfile
-
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "dreeve" "dreeveapp/dreeve" "tarball"
-
-    restore_backup
-
-    msg_info "Installing PHP Dependencies (Patience)"
-    cd /opt/dreeve
-    export COMPOSER_ALLOW_SUPERUSER=1
-    export APP_ENV=prod
-    $STD /opt/frankenphp/frankenphp php-cli /usr/local/bin/composer install --no-dev --optimize-autoloader --no-interaction --no-scripts
-    msg_ok "Installed PHP Dependencies"
-
-    msg_info "Running Migrations"
-    mkdir -p /opt/dreeve/var/{cache,log}
-    set -a
-    source /opt/dreeve/.env.local
-    set +a
-    $STD /opt/frankenphp/frankenphp php-cli bin/console app:db:migrate --no-interaction
-    $STD /opt/frankenphp/frankenphp php-cli bin/console assets:install public --no-interaction
-    rm -rf /opt/dreeve/var/cache/prod
-    $STD /opt/frankenphp/frankenphp php-cli bin/console cache:warmup --env=prod
-    msg_ok "Ran Migrations"
-
-    msg_info "Starting Service"
-    systemctl start dreeve
-    msg_ok "Started Service"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:8080${CL}"
-echo -e "${INFO}${YW}Admin credentials: ~/dreeve.creds (inside the container)${CL}"
-echo -e "${INFO}${YW}Add your Strava API credentials to /opt/dreeve/.env.local first${CL}"
@@ -1,72 +0,0 @@
-#!/usr/bin/env bash
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/emdash-cms/emdash
-
-APP="EmDash"
-var_tags="${var_tags:-cms;blog}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-3072}"
-var_disk="${var_disk:-6}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
-var_unprivileged="${var_unprivileged:-1}"
-
-export var_emdash_url="${var_emdash_url:-}"
-export var_emdash_template="${var_emdash_template:-}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/emdash ]]; then
-    msg_error "No EmDash Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "emdash" "emdash-cms/emdash" "" "" "emdash@"; then
-    msg_info "Stopping EmDash"
-    systemctl stop emdash
-    msg_ok "Stopped EmDash"
-
-    NODE_VERSION="24" NODE_MODULE="pnpm@11" setup_nodejs
-
-    msg_info "Updating EmDash"
-    cd /opt/emdash
-    set -a && source /opt/emdash_data/.env && set +a
-    $STD pnpm add "${CHECK_UPDATE_RELEASE}"
-    $STD pnpm build
-    $STD pnpm store prune
-    cat <<EOF >~/.emdash
-${CHECK_UPDATE_RELEASE}
-EOF
-    msg_ok "Updated EmDash"
-
-    msg_info "Starting EmDash"
-    systemctl start emdash
-    msg_ok "Started EmDash"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:4321${CL}"
-echo -e "${INFO}${YW}The admin at /_emdash/admin signs in with passkeys only, and browsers allow those on HTTPS with a domain or on localhost, never on an IP address.${CL}"
-echo -e "${INFO}${YW}Put EmDash behind a reverse proxy with a trusted certificate, set EMDASH_SITE_URL in /opt/emdash_data/.env to that address and rebuild (see the notes), then create the admin there.${CL}"
@@ -35,8 +35,7 @@ function update_script() {
    msg_info "Stopping Service"
    systemctl stop excalidash
    msg_ok "Stopped Service"
-    
-    NODE_VERSION="24" setup_nodejs
+
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "excalidash" "ZimengXiong/ExcaliDash" "tarball"
    ln -sf /opt/excalidash_data/.env /opt/excalidash/backend/.env
    set -a && source /opt/excalidash_data/.env && set +a
@@ -34,43 +34,9 @@ function update_script() {
  PYTHON_VERSION="3.12" setup_uv
  NODE_VERSION="22" NODE_MODULE="corepack" setup_nodejs

-  if ! grep -q '^CELERY_CONFIG=' /opt/gramps-web/config/config.cfg; then
-    msg_info "Setting up Celery Task Queue"
-    ensure_dependencies redis-server
-    cat <<EOF >>/opt/gramps-web/config/config.cfg
-CELERY_CONFIG={"broker_url":"redis://127.0.0.1:6379/0","result_backend":"redis://127.0.0.1:6379/0"}
-RATELIMIT_STORAGE_URI="redis://127.0.0.1:6379/1"
-EOF
-    cat <<EOF >/etc/systemd/system/gramps-web-celery.service
-[Unit]
-Description=Gramps Web Celery Worker
-After=network.target redis-server.service
-Wants=redis-server.service
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=/opt/gramps-web-api
-Environment=GRAMPS_API_CONFIG=/opt/gramps-web/config/config.cfg
-Environment=GRAMPSHOME=/opt/gramps-web/data
-Environment=GRAMPS_DATABASE_PATH=/opt/gramps-web/data/gramps/grampsdb
-Environment=PATH=/opt/gramps-web/venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
-ExecStart=/opt/gramps-web/venv/bin/celery -A gramps_webapi.celery worker --loglevel=INFO --concurrency=2
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-    systemctl daemon-reload
-    systemctl enable -q --now redis-server gramps-web-celery
-    systemctl restart gramps-web
-    msg_ok "Set up Celery Task Queue"
-  fi
-
  if check_for_gh_release "gramps-web-api" "gramps-project/gramps-web-api"; then
    msg_info "Stopping Service"
-    systemctl stop gramps-web gramps-web-celery
+    systemctl stop gramps-web
    msg_ok "Stopped Service"

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "gramps-web-api" "gramps-project/gramps-web-api" "tarball" "latest" "/opt/gramps-web-api"
@@ -105,7 +71,7 @@ EOF
    msg_ok "Updated Gramps Addons"

    msg_info "Starting Service"
-    systemctl start gramps-web gramps-web-celery
+    systemctl start gramps-web
    msg_ok "Started Service"
  fi

@@ -33,60 +33,36 @@ function update_script() {

  confirm_external_installer "https://hermes-agent.nousresearch.com/" "hermes update (https://hermes-agent.nousresearch.com/)"

-  if [[ -f /etc/systemd/system/hermes-dashboard.service ]]; then
-    msg_info "Moving Hermes to its own user"
-    systemctl disable -q --now hermes-dashboard
-    rm -f /etc/systemd/system/hermes-dashboard.service
-    systemctl daemon-reload
-    mapfile -t root_hermes_pids < <(ps -eo user=,pid=,args= | awk '$1 == "root" && /\/home\/hermes\/\.hermes\// && /hermes_cli[.]main/ { print $2 }')
-    if ((${#root_hermes_pids[@]})); then
-      kill -TERM "${root_hermes_pids[@]}" 2>/dev/null || true
-      for pid in "${root_hermes_pids[@]}"; do
-        while kill -0 "$pid" 2>/dev/null; do
-          sleep 0.1
-        done
+  msg_info "Stopping Services"
+  systemctl stop hermes-dashboard
+  msg_ok "Stopped Services"
+
+  msg_info "Updating Hermes Agent"
+  $STD setsid --wait bash -c '
+    set -a; source /etc/default/hermes; set +a
+    /home/hermes/.local/bin/hermes update --yes
+  '
+  mapfile -t root_gateway_pids < <(ps -eo user=,pid=,args= | awk '$1 == "root" && /\/home\/hermes\/\.hermes\// && /hermes_cli[.]main/ && / gateway run --replace$/ { print $2 }')
+  if ((${#root_gateway_pids[@]})); then
+    kill -TERM "${root_gateway_pids[@]}"
+    for pid in "${root_gateway_pids[@]}"; do
+      while kill -0 "$pid" 2>/dev/null; do
+        sleep 0.1
      done
-    fi
-    ensure_dependencies libatomic1
-    sed -i '/^HOME=/d' /etc/default/hermes
-    grep -q '^GATEWAY_HEALTH_URL=' /etc/default/hermes || echo "GATEWAY_HEALTH_URL=http://127.0.0.1:8642/health" >>/etc/default/hermes
-    mkdir -p /home/hermes/.config/systemd/user
-    cat <<EOF >/home/hermes/.config/systemd/user/hermes-dashboard.service
-[Unit]
-Description=Hermes Agent Web Dashboard
-After=network-online.target
-
-[Service]
-Type=simple
-UMask=0077
-WorkingDirectory=%h
-EnvironmentFile=/etc/default/hermes
-ExecStart=%h/.local/bin/hermes dashboard --host 127.0.0.1 --port 9119 --no-open
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=default.target
-EOF
-    msg_ok "Moved Hermes to its own user"
+    done
+  fi
+  if ps -eo user=,args= | awk '$1 == "root" && /\/home\/hermes\/\.hermes\// { found = 1 } END { exit !found }'; then
+    msg_warn "A root-owned Hermes process is still running; it may keep writing root-owned files"
  fi
-
  # A writer racing chown makes files vanish between readdir and chown; one retry covers it.
  if ! chown -R hermes:hermes /home/hermes 2>/dev/null; then
    sleep 1
    chown -R hermes:hermes /home/hermes || msg_warn "Could not take ownership of everything under /home/hermes"
  fi
-  $STD runuser -l hermes -c 'systemctl --user daemon-reload && systemctl --user enable hermes-dashboard'
-
-  msg_info "Updating Hermes Agent"
-  $STD setsid --wait runuser -l hermes -c '
-    set -a; source /etc/default/hermes; set +a
-    hermes update --yes
-  '
  msg_ok "Updated Hermes Agent"

  msg_info "Starting Services"
-  $STD runuser -l hermes -c 'systemctl --user start hermes-dashboard'
+  systemctl start hermes-dashboard
  msg_ok "Started Services"
  msg_ok "Updated successfully!"
  exit
@@ -30,7 +30,7 @@ function update_script() {
    exit
  fi

-  NODE_VERSION="24" NODE_MODULE="pnpm@latest" setup_nodejs
+  NODE_VERSION="22" NODE_MODULE="pnpm@latest" setup_nodejs
  ensure_dependencies jq

  if check_for_gh_release "homepage" "gethomepage/homepage"; then
@@ -1,68 +0,0 @@
-#!/usr/bin/env bash
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/EgalitarianMonkey/hometube
-
-APP="HomeTube"
-var_tags="${var_tags:-media;youtube;downloader}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-1024}"
-var_disk="${var_disk:-20}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/hometube ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  msg_info "Updating yt-dlp"
-  $STD yt-dlp -U
-  msg_ok "Updated yt-dlp"
-
-  fetch_and_deploy_gh_release "deno" "denoland/deno" "prebuild" "latest" "/usr/local/bin" "deno-$(arch_resolve "x86_64" "aarch64")-unknown-linux-gnu.zip"
-
-  if check_for_gh_release "hometube" "EgalitarianMonkey/hometube"; then
-    msg_info "Stopping HomeTube"
-    systemctl stop hometube
-    msg_ok "Stopped HomeTube"
-
-    PYTHON_VERSION="3.13" setup_uv
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "hometube" "EgalitarianMonkey/hometube" "tarball"
-
-    msg_info "Updating HomeTube"
-    cd /opt/hometube
-    $STD uv sync --locked --no-dev --no-install-project --no-install-package pyarrow
-    msg_ok "Updated HomeTube"
-
-    msg_info "Starting HomeTube"
-    systemctl start hometube
-    msg_ok "Started HomeTube"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:8501${CL}"
@@ -1,80 +0,0 @@
-#!/usr/bin/env bash
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/plastic-labs/honcho
-
-APP="Honcho"
-var_tags="${var_tags:-ai;memory;agents}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
-var_disk="${var_disk:-6}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
-var_unprivileged="${var_unprivileged:-1}"
-
-export var_honcho_provider="${var_honcho_provider:-}"
-export var_honcho_api_key="${var_honcho_api_key:-}"
-export var_honcho_base_url="${var_honcho_base_url:-}"
-export var_honcho_model="${var_honcho_model:-}"
-export var_honcho_embedding_key="${var_honcho_embedding_key:-}"
-export var_honcho_embedding_model="${var_honcho_embedding_model:-}"
-export var_honcho_embedding_dims="${var_honcho_embedding_dims:-}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-if [[ -n "${var_honcho_provider}" && ! "${var_honcho_provider}" =~ ^(openai|anthropic|gemini)$ ]]; then
-  msg_error "var_honcho_provider must be openai, anthropic or gemini"
-  exit 1
-fi
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/honcho ]]; then
-    msg_error "No Honcho Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "honcho" "plastic-labs/honcho" "" "" "v"; then
-    msg_info "Stopping Honcho"
-    systemctl stop honcho-deriver honcho
-    msg_ok "Stopped Honcho"
-
-    PYTHON_VERSION="3.13" setup_uv
-    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP=".env" fetch_and_deploy_gh_release "honcho" "plastic-labs/honcho" "tarball" "latest" "/opt/honcho" "" "v"
-
-    msg_info "Updating Honcho"
-    cd /opt/honcho
-    $STD uv sync --frozen --no-dev
-    $STD .venv/bin/python scripts/provision_db.py
-    msg_ok "Updated Honcho"
-
-    if systemctl is-enabled -q honcho; then
-      msg_info "Starting Honcho"
-      systemctl start honcho honcho-deriver
-      msg_ok "Started Honcho"
-    fi
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access the API (interactive docs at /docs) using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:8000${CL}"
-echo -e "${INFO}${YW}Admin key, sent as Authorization: Bearer <key> (more with: cd /opt/honcho && .venv/bin/python scripts/generate_jwt.py --admin):${CL}"
-echo -e "${INFO}${YW}Without an LLM provider key Honcho stays stopped: set one in /opt/honcho_data/.env, then run: systemctl enable --now honcho honcho-deriver${CL}"
@@ -65,10 +65,12 @@ EOF
    msg_ok "Installed/upgraded Testing repo packages"
  fi

-  if ! command -v mise >/dev/null 2>&1; then
-    MISE_ARCH="x64"
-    [[ "$(arch_resolve)" == "arm64" ]] && MISE_ARCH="arm64"
-    fetch_and_deploy_gh_release "mise" "jdx/mise" "singlefile" "latest" "/usr/local/bin" "mise-v*-linux-${MISE_ARCH}"
+  if [[ ! -f /etc/apt/sources.list.d/mise.list ]]; then
+    msg_info "Installing Mise"
+    curl -fSs https://mise.jdx.dev/gpg-key.pub | tee /etc/apt/keyrings/mise-archive-keyring.pub 1>/dev/null
+    echo "deb [signed-by=/etc/apt/keyrings/mise-archive-keyring.pub arch=$(arch_resolve)] https://mise.jdx.dev/deb stable main" >/etc/apt/sources.list.d/mise.list
+    ensure_dependencies mise
+    msg_ok "Installed Mise"
  fi

  STAGING_DIR=/opt/staging
@@ -31,14 +31,6 @@ function update_script() {
    exit
  fi

-  if [[ ! -f /etc/cron.d/invoiceshelf ]]; then
-    msg_info "Adding the Laravel scheduler"
-    cat <<'EOF' >/etc/cron.d/invoiceshelf
-* * * * * www-data cd /opt/invoiceshelf && php artisan schedule:run >> /dev/null 2>&1
-EOF
-    msg_ok "Added the Laravel scheduler"
-  fi
-
  if check_for_gh_release "invoiceshelf" "InvoiceShelf/InvoiceShelf"; then
    msg_info "Stopping Services"
    systemctl stop caddy
@@ -96,12 +96,6 @@ EOF
  exit
 }

-if [[ ! -d /opt/jellyseerr ]]; then
-  msg_error "Jellyseerr is now Seerr and can no longer be installed with this script."
-  msg_warn "Install Seerr instead: https://community-scripts.org/scripts/seerr"
-  exit 1
-fi
-
 start
 build_container
 description
@@ -64,7 +64,6 @@ function update_script() {
    $STD yarn prisma:deploy
    rm -rf ~/.cargo/registry ~/.cargo/git ~/.cargo/.package-cache
    rm -rf /root/.cache/yarn
-    rm -rf /root/.yarn/berry/cache
    rm -rf /opt/linkwarden/.next/cache
    msg_ok "Updated Linkwarden"

@@ -30,9 +30,6 @@ function update_script() {
    msg_error "No ${APP} Installation Found!"
    exit
  fi
-
-  ensure_dependencies ffmpeg
-
  if check_for_gh_release "mealie" "mealie-recipes/mealie"; then

    msg_info "Stopping Service"
@@ -34,15 +34,12 @@ function update_script() {
  NODE_VERSION="24" setup_nodejs

  if check_for_gh_release "omnitools" "iib0011/omni-tools"; then
-    ensure_dependencies git
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "omnitools" "iib0011/omni-tools" "tarball"

    msg_info "Building OmniTools"
    cd /opt/omnitools
    export HUSKY=0
    $STD npm ci --allow-remote=all
-    $STD git init -q
-    $STD git -c user.name=build -c user.email=build@localhost commit -q --allow-empty -m build
    $STD npm run build
    msg_ok "Built OmniTools"

@@ -44,7 +44,7 @@ function update_script() {
    $STD npm ci --legacy-peer-deps --ignore-scripts
    $STD npm run build:icons
    $STD npx prisma generate
-    PROXCENTER_SKIP_TYPECHECK=1 NODE_OPTIONS="--max-old-space-size=3072" $STD npm run build
+    NODE_OPTIONS="--max-old-space-size=4608" $STD npm run build
    msg_ok "Built ProxCenter"

    msg_info "Migrating Database"
@@ -86,7 +86,7 @@ EOF

    msg_info "Updating SnapOtter"
    $STD uv python install 3.11
-    $STD uv venv --clear --seed --python 3.11 /opt/snapotter_data/ai/venv
+    $STD uv venv --seed --python 3.11 /opt/snapotter_data/ai/venv
    if [[ "$(arch_resolve)" == "arm64" ]]; then
      $STD uv pip install --python /opt/snapotter_data/ai/venv/bin/python \
        numpy==1.26.4 Pillow==12.3.0 opencv-python-headless==4.10.0.84 fonttools \
@@ -9,7 +9,7 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 APP="SparkyFitness"
 var_tags="${var_tags:-health;fitness}"
 var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-4096}"
+var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-7}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
@@ -31,75 +31,42 @@ function update_script() {
    exit
  fi

-  NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs
+  NODE_VERSION="24" NODE_MODULE="corepack,yarn" setup_nodejs

  if check_for_gl_release "storyteller" "storyteller-platform/storyteller" "" "" "web-v2"; then
    msg_info "Stopping Service"
    systemctl stop storyteller
    msg_ok "Stopped Service"

-    ensure_dependencies cmake argon2 libcurl4t64 libxml2
-    fetch_and_deploy_gh_release "readium" "readium/cli" "prebuild" "v0.9.1" "/opt/readium" "readium_linux_$(arch_resolve "x86_64" "arm64").tar.gz"
-
    create_backup /opt/storyteller/.env
-    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="data" fetch_and_deploy_gl_release "storyteller" "storyteller-platform/storyteller" "tarball" "latest" "/opt/storyteller" "" "web-v2"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gl_release "storyteller" "storyteller-platform/storyteller" "tarball" "latest" "/opt/storyteller" "" "web-v2"
+
    restore_backup

-    msg_info "Building Storyteller (Patience)"
+    msg_info "Rebuilding Storyteller"
    cd /opt/storyteller
-    $STD corepack yarn install
+    export NODE_OPTIONS="--max-old-space-size=4096"
+
+    $STD corepack yarn install --network-timeout 600000
+    $STD gcc -g -fPIC -rdynamic -shared web/sqlite/uuid.c -o web/sqlite/uuid.c.so
+    export CI=1
    export NODE_ENV=production
    export NEXT_TELEMETRY_DISABLED=1
    export SQLITE_NATIVE_BINDING=/opt/storyteller/node_modules/better-sqlite3/build/Release/better_sqlite3.node
    $STD corepack yarn workspaces foreach -Rpt --from @storyteller-platform/web --exclude @storyteller-platform/eslint run build
-    STANDALONE=/opt/storyteller/applications/web/.next/standalone
-    WEB_DIR="$STANDALONE/applications/web"
-    mkdir -p "$WEB_DIR"/{public,.next/static,.next/cache,migrations,sqlite,scripts}
-    cp -rT applications/web/public "$WEB_DIR/public"
-    cp -rT applications/web/.next/static "$WEB_DIR/.next/static"
-    cp -rT applications/web/migrations "$WEB_DIR/migrations"
-    cp applications/web/sqlite/uuid.c.so "$WEB_DIR/sqlite/"
-    cp docker-scripts/reset-password.sh "$WEB_DIR/scripts/"
-    cp -r applications/web/work-dist applications/web/file-write-dist "$WEB_DIR/"
-    mkdir -p "$WEB_DIR/work-dist/@storyteller-platform/align/prebuilds"
-    cp -r "libraries/align/prebuilds/linux-$(arch_resolve "x64" "arm64")" "$WEB_DIR/work-dist/@storyteller-platform/align/prebuilds/"
-    cp node_modules/@echogarden/icu-segmentation-wasm/wasm/*.wasm "$WEB_DIR/work-dist/"
-    cp -rT node_modules/@parcel "$STANDALONE/node_modules/@parcel"
-    cp -rT node_modules/kuromoji "$STANDALONE/node_modules/kuromoji"
-    ln -sf /opt/storyteller/.env "$WEB_DIR/.env"
-    msg_ok "Built Storyteller"
-
-    msg_info "Updating Whisper"
-    WHISPER_VARIANT="linux-$(arch_resolve "x64" "arm64")-cpu"
-    $STD node /opt/storyteller/libraries/ghost-story/dist/cli/bin.js install binary "$WHISPER_VARIANT"
-    $STD node /opt/storyteller/libraries/ghost-story/dist/cli/bin.js install model tiny.en
-    if [[ "$WHISPER_VARIANT" == "linux-x64-cpu" ]]; then
-      $STD node /opt/storyteller/libraries/ghost-story/dist/cli/bin.js install binary linux-x64-cpu-legacy
+    mkdir -p /opt/storyteller/web/.next/standalone/web/.next/static
+    cp -rT /opt/storyteller/web/.next/static /opt/storyteller/web/.next/standalone/web/.next/static
+    if [[ -d /opt/storyteller/web/public ]]; then
+      mkdir -p /opt/storyteller/web/.next/standalone/web/public
+      cp -rT /opt/storyteller/web/public /opt/storyteller/web/.next/standalone/web/public
    fi
-    msg_ok "Updated Whisper"
-
-    cat <<EOF >/etc/systemd/system/storyteller.service
-[Unit]
-Description=Storyteller
-After=network.target
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=${WEB_DIR}
-EnvironmentFile=/opt/storyteller/.env
-Environment=SQLITE_NATIVE_BINDING=${STANDALONE}/node_modules/better-sqlite3/build/Release/better_sqlite3.node
-Environment=ERROR_ALIGN_NATIVE_BINDING=${WEB_DIR}/work-dist/@storyteller-platform/align/
-Environment=STORYTELLER_WORKER=worker.mjs
-Environment=STORYTELLER_FILE_WRITE_WORKER=fileWriteWorker.mjs
-ExecStart=/usr/bin/node --enable-source-maps server.js
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-    systemctl daemon-reload
+    mkdir -p /opt/storyteller/web/.next/standalone/web/migrations
+    cp -rT /opt/storyteller/web/migrations /opt/storyteller/web/.next/standalone/web/migrations
+    mkdir -p /opt/storyteller/web/.next/standalone/web/sqlite
+    cp -rT /opt/storyteller/web/sqlite /opt/storyteller/web/.next/standalone/web/sqlite
+    ln -sf /opt/storyteller/.env /opt/storyteller/web/.next/standalone/web/.env
+    msg_ok "Rebuilt Storyteller"

    msg_info "Starting Service"
    systemctl start storyteller
@@ -108,6 +75,7 @@ EOF
  fi
  exit
 }
+
 start
 build_container
 description
@@ -1,70 +0,0 @@
-#!/usr/bin/env bash
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/fredrikburmester/streamystats
-
-APP="Streamystats"
-var_tags="${var_tags:-analytics;jellyfin}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-3072}"
-var_disk="${var_disk:-10}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/streamystats ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "streamystats" "fredrikburmester/streamystats"; then
-    msg_info "Stopping Streamystats"
-    systemctl stop streamystats-nextjs-app streamystats-job-server
-    msg_ok "Stopped Streamystats"
-
-    msg_info "Updating Bun"
-    $STD bun upgrade
-    msg_ok "Updated Bun"
-
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "streamystats" "fredrikburmester/streamystats" "tarball"
-
-    msg_info "Building Streamystats"
-    cd /opt/streamystats
-    $STD bun install --frozen-lockfile
-    NEXT_TELEMETRY_DISABLED=1 NEXT_PUBLIC_VERSION="v$(cat ~/.streamystats)" $STD bun run build
-    msg_ok "Built Streamystats"
-
-    msg_info "Migrating Streamystats Database"
-    $STD bun --env-file=/opt/streamystats_data/.env run db:migrate
-    msg_ok "Migrated Streamystats Database"
-
-    msg_info "Starting Streamystats"
-    systemctl start streamystats-job-server streamystats-nextjs-app
-    msg_ok "Started Streamystats"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"
@@ -1,58 +0,0 @@
-#!/usr/bin/env bash
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/stumpapp/stump
-
-APP="Stump"
-var_tags="${var_tags:-comics;manga;ebook}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-1024}"
-var_disk="${var_disk:-8}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-no}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/stump ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "stump" "stumpapp/stump"; then
-    msg_info "Stopping Stump"
-    systemctl stop stump
-    msg_ok "Stopped Stump"
-
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "stump" "stumpapp/stump" "prebuild" "latest" "/opt/stump" "linux-build-results.zip"
-    chmod +x /opt/stump/stump_server
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "pdfium" "bblanchon/pdfium-binaries" "prebuild" "latest" "/opt/pdfium" "pdfium-linux-x64.tgz"
-
-    msg_info "Starting Stump"
-    systemctl start stump
-    msg_ok "Started Stump"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:10801${CL}"
@@ -1,74 +0,0 @@
-#!/usr/bin/env bash
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/Gimanh/taskview-community
-
-APP="TaskView"
-var_tags="${var_tags:-project-management;tasks;kanban}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-6144}"
-var_disk="${var_disk:-10}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/taskview ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "taskview" "Gimanh/taskview-community"; then
-    msg_info "Stopping TaskView"
-    systemctl stop taskview
-    msg_ok "Stopped TaskView"
-
-    NODE_VERSION="24" NODE_MODULE="pnpm" setup_nodejs
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "taskview" "Gimanh/taskview-community" "tarball"
-
-    msg_info "Building TaskView"
-    cd /opt/taskview
-    $STD pnpm install --frozen-lockfile
-    cd /opt/taskview/api
-    $STD pnpm run build:docker
-    $STD pnpm run build:migration
-    cp -r src/migrations/taskview dist-migration/
-    cd /opt/taskview/web
-    $STD pnpm run build:packages
-    $STD pnpm run build-only
-    msg_ok "Built TaskView"
-
-    msg_info "Migrating TaskView Database"
-    cd /opt/taskview_data
-    $STD node /opt/taskview/api/dist-migration/taskview-db-migration.js
-    msg_ok "Migrated TaskView Database"
-
-    msg_info "Starting TaskView"
-    systemctl start taskview
-    msg_ok "Started TaskView"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}${CL}"
@@ -108,12 +108,6 @@ EOF
  fi

  if check_for_gh_release "termix" "Termix-SSH/Termix"; then
-    TERMIX_RELEASE="latest"
-    if [[ "$CS_PREVIOUS_VERSION" =~ ^(release-)?([0-9]+)\.([0-9]+)\. ]] && ((BASH_REMATCH[2] * 100 + BASH_REMATCH[3] < 209)); then
-      TERMIX_RELEASE="release-2.9.2-tag"
-      msg_warn "Termix ${CS_PREVIOUS_VERSION} has to run 2.9.2 once before newer releases accept its database"
-    fi
-
    msg_info "Stopping Termix"
    systemctl stop termix
    msg_ok "Stopped Termix"
@@ -171,7 +165,7 @@ EOF

    create_backup /opt/termix/.env

-    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="db/data data uploads" fetch_and_deploy_gh_release "termix" "Termix-SSH/Termix" "tarball" "$TERMIX_RELEASE"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="db/data data uploads" fetch_and_deploy_gh_release "termix" "Termix-SSH/Termix" "tarball"

    restore_backup

@@ -264,24 +258,12 @@ EOF

    msg_info "Starting Termix"
    systemctl daemon-reload
-    TERMIX_START=$(date +%s)
    if ! systemctl start termix; then
      msg_error "Termix failed to start"
      journalctl -u termix -n 30 --no-pager || true
      exit 1
    fi
    msg_ok "Started Termix"
-    if [[ "$TERMIX_RELEASE" != "latest" ]]; then
-      msg_info "Waiting for Termix 2.9.2 to migrate the database"
-      if ! timeout 300 bash -c "until journalctl -u termix --since @${TERMIX_START} --no-pager | grep -q 'Termix backend started successfully'; do sleep 2; done"; then
-        msg_error "Termix 2.9.2 did not finish starting, so the database was not migrated"
-        journalctl -u termix -n 30 --no-pager || true
-        exit 1
-      fi
-      msg_ok "Migrated the database with Termix 2.9.2"
-      msg_warn "Run update again to continue to the current Termix release"
-      exit
-    fi
    msg_ok "Updated successfully!"
  fi
  exit
@@ -9,7 +9,7 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 APP="TREK"
 var_tags="${var_tags:-travel;planning;collaboration}"
 var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-4096}"
+var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-8}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
@@ -43,7 +43,6 @@ function update_script() {
    msg_ok "Stopped Service"

    ensure_dependencies "libkitinerary-bin"
-    ln -sf "$(find /usr/lib -name kitinerary-extractor -type f | head -1)" /usr/local/bin/kitinerary-extractor

    create_backup /opt/trek/server/.env \
      /opt/trek/data \
@@ -53,7 +52,7 @@ function update_script() {

    msg_info "Building TREK"
    cd /opt/trek
-    $STD npm ci --ignore-scripts
+    $STD npm ci
    $STD npm run build --workspace=shared
    $STD npm run build --workspace=client
    $STD npm run build --workspace=server
@@ -73,7 +72,7 @@ function update_script() {

    rm -rf /opt/trek/node_modules
    cd /opt/trek
-    $STD npm ci --workspace=server --omit=dev --ignore-scripts
+    $STD npm ci --workspace=server --omit=dev
    msg_ok "Set up TREK Workspace"

    if [[ "$MIGRATION" == "1" ]]; then
@@ -71,41 +71,6 @@ EOF

    restore_backup

-    if grep -q '^TA_BACKEND_PORT=' /opt/tubearchivist/.env 2>/dev/null; then
-      msg_info "Migrating to v0.6.0 (dropping Nginx)"
-      systemctl disable -q --now nginx
-      $STD apt autoremove --purge -y nginx
-      sed -i 's/^TA_BACKEND_PORT=.*/TA_PORT=8000/' /opt/tubearchivist/.env
-      cat <<'RUNEOF' >/opt/tubearchivist/backend/run.sh
-#!/bin/bash
-set -e
-cd /opt/tubearchivist/backend
-set -a
-source /opt/tubearchivist/.env
-set +a
-PYTHON=/opt/tubearchivist/.venv/bin/python
-
-echo "Waiting for ElasticSearch..."
-for i in $(seq 1 30); do
-  if curl -sf http://localhost:9200/_cluster/health >/dev/null 2>&1; then
-    break
-  fi
-  sleep 2
-done
-
-$PYTHON manage.py ta_stop_on_error
-$PYTHON manage.py migrate
-$PYTHON manage.py collectstatic --noinput -c
-$PYTHON manage.py ta_envcheck
-$PYTHON manage.py ta_connection
-$PYTHON manage.py ta_startup
-
-exec $PYTHON backend_start.py
-RUNEOF
-      chmod +x /opt/tubearchivist/backend/run.sh
-      msg_ok "Migrated to v0.6.0 (dropping Nginx)"
-    fi
-
    msg_info "Rebuilding Tube Archivist"
    cd /opt/tubearchivist/frontend
    $STD npm install
@@ -148,6 +113,7 @@ RUNEOF

    msg_info "Starting Services"
    systemctl start bgutil-provider tubearchivist tubearchivist-celery tubearchivist-beat
+    systemctl reload nginx
    msg_ok "Started Services"
    msg_ok "Updated successfully!"
  fi
@@ -162,5 +128,3 @@ msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
 echo -e "${GATEWAY}${BGN}http://${IP}:8000${CL}"
-echo -e "${INFO}${YW}Admin credentials saved to ~/tubearchivist.creds${CL}"
-echo -e "${INFO}${YW}The WebUI may take a couple of minutes to become available on first start, while Elasticsearch and the backend initialize.${CL}"
@@ -1,73 +0,0 @@
-#!/usr/bin/env bash
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/arabcoders/ytptube
-
-APP="YTPTube"
-var_tags="${var_tags:-media;youtube;downloader}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-3072}"
-var_disk="${var_disk:-20}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_gpu="${var_gpu:-yes}"
-var_arm64="${var_arm64:-yes}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/ytptube ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  fetch_and_deploy_gh_release "deno" "denoland/deno" "prebuild" "latest" "/usr/local/bin" "deno-$(arch_resolve "x86_64" "aarch64")-unknown-linux-gnu.zip"
-
-  if check_for_gh_release "ytptube" "arabcoders/ytptube"; then
-    msg_info "Stopping YTPTube"
-    systemctl stop ytptube
-    msg_ok "Stopped YTPTube"
-
-    NODE_VERSION="24" NODE_MODULE="bun" setup_nodejs
-    PYTHON_VERSION="3.13" setup_uv
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "ytptube" "arabcoders/ytptube" "tarball"
-
-    msg_info "Building YTPTube"
-    cd /opt/ytptube/ui
-    $STD bun install --frozen-lockfile --production
-    NODE_ENV=production $STD bun run generate
-    rm -rf /opt/ytptube/ui/node_modules
-    cd /opt/ytptube
-    sed -i "s/^APP_VERSION = .*/APP_VERSION = \"v$(cat ~/.ytptube)\"/" app/library/version.py
-    $STD uv sync --locked --no-dev
-    $STD uv pip install --python .venv/bin/python pip
-    msg_ok "Built YTPTube"
-
-    msg_info "Starting YTPTube"
-    systemctl start ytptube
-    msg_ok "Started YTPTube"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:8081${CL}"
-echo -e "${INFO}${YW}The first visitor creates the admin account - open the URL right away${CL}"
@@ -46,36 +46,24 @@ function update_script() {
    msg_warn "No Zabbix Agent service found, skipping agent actions"
  fi

-  ZABBIX_SERIES="$(dpkg-query -W -f='${Version}' zabbix-release 2>/dev/null || true)"
-  ZABBIX_SERIES="${ZABBIX_SERIES#*:}"
-  ZABBIX_SERIES="${ZABBIX_SERIES%%[!0-9.]*}"
-  if [[ "${PHS_SILENT:-0}" == "1" ]]; then
-    if [[ ! "$ZABBIX_SERIES" =~ ^[0-9]+\.[0-9]+$ ]]; then
-      msg_warn "Could not detect the installed Zabbix series - skipping update, requires an interactive run"
-      exit 75
-    fi
-    ZABBIX_VERSION="$ZABBIX_SERIES"
-    msg_warn "Unattended update: staying on Zabbix ${ZABBIX_VERSION}"
-  else
-    read -rp "Choose Zabbix version [1] 7.0 LTS  [2] 7.4 (Latest Stable)  [3] Latest available (default: 2): " ZABBIX_CHOICE
-    ZABBIX_CHOICE=${ZABBIX_CHOICE:-2}
-    case "$ZABBIX_CHOICE" in
-    1) ZABBIX_VERSION="7.0" ;;
-    2) ZABBIX_VERSION="7.4" ;;
-    3) ZABBIX_VERSION=$(curl -fsSL https://repo.zabbix.com/zabbix/ |
-      grep -oP '(?<=href=")[0-9]+\.[0-9]+(?=/")' | sort -V | tail -n1) ;;
-    *)
-      ZABBIX_VERSION="7.4"
-      echo "Invalid choice. Defaulting to 7.4."
-      ;;
-    esac
-  fi
-
  msg_info "Stopping Services"
  systemctl stop zabbix-server
  [[ -n "$AGENT_SERVICE" ]] && systemctl stop "$AGENT_SERVICE"
  msg_ok "Stopped Services"

+  read -rp "Choose Zabbix version [1] 7.0 LTS  [2] 7.4 (Latest Stable)  [3] Latest available (default: 2): " ZABBIX_CHOICE
+  ZABBIX_CHOICE=${ZABBIX_CHOICE:-2}
+  case "$ZABBIX_CHOICE" in
+  1) ZABBIX_VERSION="7.0" ;;
+  2) ZABBIX_VERSION="7.4" ;;
+  3) ZABBIX_VERSION=$(curl -fsSL https://repo.zabbix.com/zabbix/ |
+    grep -oP '(?<=href=")[0-9]+\.[0-9]+(?=/")' | sort -V | tail -n1) ;;
+  *)
+    ZABBIX_VERSION="7.4"
+    echo "Invalid choice. Defaulting to 7.4."
+    ;;
+  esac
+
  msg_info "Updating Zabbix to $ZABBIX_VERSION"
  mkdir -p /opt/zabbix-backup/
  cp /etc/zabbix/zabbix_server.conf /opt/zabbix-backup/
@@ -85,10 +73,8 @@ function update_script() {
  rm -Rf /etc/apt/sources.list.d/zabbix.list
  cd /tmp

-  ZABBIX_REPO_DIR="debian"
-  [[ "$ZABBIX_VERSION" == "7.0" && "$(arch_resolve)" == "arm64" ]] && ZABBIX_REPO_DIR="debian-arm64"
  if [[ "$ZABBIX_VERSION" == "7.0" ]]; then
-    ZABBIX_DEB_URL="https://repo.zabbix.com/zabbix/${ZABBIX_VERSION}/${ZABBIX_REPO_DIR}/pool/main/z/zabbix-release/zabbix-release_latest_${ZABBIX_VERSION}+debian13_all.deb"
+    ZABBIX_DEB_URL="https://repo.zabbix.com/zabbix/${ZABBIX_VERSION}/debian/pool/main/z/zabbix-release/zabbix-release_latest_${ZABBIX_VERSION}+debian13_all.deb"
    ZABBIX_DEB_FILE="zabbix-release_latest_${ZABBIX_VERSION}+debian13_all.deb"
  else
    ZABBIX_DEB_URL="https://repo.zabbix.com/zabbix/${ZABBIX_VERSION}/release/debian/pool/main/z/zabbix-release/zabbix-release_latest+debian13_all.deb"
@@ -12,11 +12,6 @@ setting_up_container
 network_check
 update_os

-if is_debian && [[ "$(get_os_version_major)" -lt 13 ]]; then
-  msg_error "Apache Guacamole needs Debian 13: freerdp3-dev is not available on Debian 12."
-  exit 238
-fi
-
 msg_info "Installing Dependencies"
 $STD apt install -y \
  build-essential \
@@ -13,14 +13,12 @@ setting_up_container
 network_check
 update_os

-version="${var_apache_tomcat_version:-}"
-[[ -n "$version" ]] || read -r -p "${TAB3}Which Tomcat version would you like to install? (9, 10.1, 11): " version || true
-jdk_version="${var_apache_tomcat_jdk_version:-}"
+read -r -p "${TAB3}Which Tomcat version would you like to install? (9, 10.1, 11): " version
 case $version in
 9)
  TOMCAT_VERSION="9"
  echo "Which LTS Java version would you like to use? (8, 11, 17, 21): "
-  [[ -n "$jdk_version" ]] || read -r jdk_version || true
+  read -r jdk_version
  case $jdk_version in
  8 | 11 | 17 | 21)
    JAVA_VERSION="$jdk_version" setup_java
@@ -34,7 +32,7 @@ case $version in
 10 | 10.1)
  TOMCAT_VERSION="10"
  echo "Which LTS Java version would you like to use? (11, 17, 21): "
-  [[ -n "$jdk_version" ]] || read -r jdk_version || true
+  read -r jdk_version
  case $jdk_version in
  11 | 17 | 21)
    JAVA_VERSION="$jdk_version" setup_java
@@ -48,7 +46,7 @@ case $version in
 11)
  TOMCAT_VERSION="11"
  echo "Which LTS Java version would you like to use? (17, 21): "
-  [[ -n "$jdk_version" ]] || read -r jdk_version || true
+  read -r jdk_version
  case $jdk_version in
  17 | 21)
    JAVA_VERSION="$jdk_version" setup_java
@@ -18,7 +18,7 @@ $STD apt install -y aria2
 msg_ok "Installed Aria2"

 prompt="${var_aria2_ariang:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add AriaNG? <y/N> " prompt || true
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add AriaNG? <y/N> " prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  msg_info "Installing Dependencies"
  $STD apt install -y nginx
@@ -47,8 +47,7 @@ Choose Asterisk version to install:
 2) Latest LTS ($LTS_VERSION)
 3) Latest Certified ($CERT_VERSION)
 EOF
-ASTERISK_CHOICE="${var_asterisk_version:-}"
-[[ -n "$ASTERISK_CHOICE" ]] || read -rp "Enter choice [1-3]: " ASTERISK_CHOICE || true
+read -rp "Enter choice [1-3]: " ASTERISK_CHOICE

 CERTIFIED=0
 case "$ASTERISK_CHOICE" in
@@ -17,10 +17,9 @@ fetch_and_deploy_gh_release "authelia" "authelia/authelia" "binary"

 MAX_ATTEMPTS=3
 attempt=0
-DOMAIN="${var_authelia_domain:-}"
 while true; do
  attempt=$((attempt + 1))
-  [[ -n "$DOMAIN" ]] || read -rp "${TAB3}Enter your domain or IP (ex. example.com or 192.168.1.100): " DOMAIN || true
+  read -rp "${TAB3}Enter your domain or IP (ex. example.com or 192.168.1.100): " DOMAIN
  if [[ -z "$DOMAIN" ]]; then
    if ((attempt >= MAX_ATTEMPTS)); then
      DOMAIN="${LOCAL_IP:-localhost}"
@@ -41,13 +40,11 @@ while true; do
      break
    else
      msg_warn "Invalid IP address!"
-      DOMAIN=""
    fi
  elif [[ "$DOMAIN" =~ ^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*\.[a-zA-Z]{2,}$ ]]; then
    break
  else
    msg_warn "Invalid domain format!"
-    DOMAIN=""
  fi
 done
 msg_info "Setting Authelia up"
@@ -57,7 +57,7 @@ PG_VERSION="17" setup_postgresql
 PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db

 XMLSEC_VERSION="1.3.12"
-AUTHENTIK_VERSION="version/2026.8.5"
+AUTHENTIK_VERSION="version/2026.8.4"
 fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec"
 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
 GO_VERSION="$(grep -m1 '^go ' /opt/authentik/go.mod | awk '{print $2}')" setup_go
@@ -52,7 +52,6 @@ $STD php artisan key:generate
 touch storage/bar-assistant/database.ba3.sqlite
 $STD php artisan migrate --force
 $STD php artisan storage:link
-$STD php artisan starter-media:publish
 $STD php artisan bar:setup-meilisearch
 $STD php artisan scout:sync-index-settings
 $STD php artisan config:cache
@@ -15,8 +15,7 @@ update_os

 fetch_and_deploy_gh_release "bichon" "rustmailer/bichon" "prebuild" "latest" "/opt/bichon" "bichon-*-$(arch_resolve "x86_64" "aarch64")-unknown-linux-gnu.tar.gz"

-bichon_url="${var_bichon_url:-}"
-[[ -n "$bichon_url" ]] || read -r -p "${TAB3}Enter the public URL for Bichon (e.g., https://bichon.yourdomain.com) or leave empty to use container IP: " bichon_url || true
+read -r -p "${TAB3}Enter the public URL for Bichon (e.g., https://bichon.yourdomain.com) or leave empty to use container IP: " bichon_url
 if [[ -z "$bichon_url" ]]; then
  msg_info "No URL provided"
  BICHON_PUBLIC_URL="http://$LOCAL_IP:15630"
@@ -34,8 +34,7 @@ setup_deb_based() {
  chmod +x bitmagnet
  msg_ok "Configured bitmagnet"

-  tmdbapikey="${var_bitmagnet_tmdb_api_key:-}"
-  [[ -n "$tmdbapikey" ]] || read -r -p "${TAB3}Enter your TMDB API key if you have one: " tmdbapikey || true
+  read -r -p "${TAB3}Enter your TMDB API key if you have one: " tmdbapikey

  cat <<EOF >/etc/bitmagnet.env
 POSTGRES_HOST=localhost
@@ -100,8 +99,7 @@ setup_alpine() {
  $STD su - postgres -c "psql -c 'CREATE DATABASE bitmagnet;'"
  msg_ok "Built bitmagnet"

-  tmdbapikey="${var_bitmagnet_tmdb_api_key:-}"
-  [[ -n "$tmdbapikey" ]] || read -rp "${TAB3}Enter your TMDB API key if you have one: " tmdbapikey || true
+  read -rp "${TAB3}Enter your TMDB API key if you have one: " tmdbapikey

  msg_info "Enabling bitmagnet Service"
  cat <<EOF >/etc/init.d/bitmagnet
@@ -25,7 +25,7 @@ $STD npm install
 msg_ok "Installed ByteStash"

 allowreg="${var_bytestash_registration:-}"
-[[ -n "$allowreg" ]] || read -rp "${TAB3}Do you want to allow registration of multiple accounts? [y/n]: " allowreg || true
+[[ -n "$allowreg" ]] || read -rp "${TAB3}Do you want to allow registration of multiple accounts? [y/n]: " allowreg

 msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/bytestash-backend.service
@@ -18,7 +18,7 @@ setup_deb_based() {
  systemctl enable -q --now caddy

  prompt="${var_caddy_xcaddy:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install xCaddy Addon? <y/N> " prompt || true
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install xCaddy Addon? <y/N> " prompt
  if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
    setup_go
    fetch_and_deploy_gh_release "xcaddy" "caddyserver/xcaddy" "binary"
@@ -64,7 +64,7 @@ EOF
  msg_ok "Installed Caddy"

  prompt="${var_caddy_xcaddy:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install xCaddy Addon? <y/N> " prompt || true
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install xCaddy Addon? <y/N> " prompt
  if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
    GO_VERSION="$(curl -fsSL https://go.dev/VERSION?m=text | head -1 | cut -c3-)" setup_go
    fetch_and_deploy_gh_release "xcaddy" "caddyserver/xcaddy" "prebuild" "latest" "/opt/xcaddy" "xcaddy_*_linux_$(arch_resolve).tar.gz"
@@ -1,93 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/casdoor/casdoor
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-PG_VERSION="17" setup_postgresql
-PG_DB_NAME="casdoor" PG_DB_USER="casdoor" setup_postgresql_db
-
-fetch_and_deploy_gh_release "casdoor" "casdoor/casdoor" "prebuild" "latest" "/opt/casdoor" "casdoor_Linux_$(arch_resolve "x86_64" "arm64").tar.gz"
-
-msg_info "Configuring Casdoor"
-mkdir -p /opt/casdoor_data/conf
-cat <<EOF >/opt/casdoor_data/conf/app.conf
-appname = casdoor
-httpport = 8000
-runmode = prod
-copyrequestbody = true
-driverName = postgres
-dataSourceName = user=casdoor password=${PG_DB_PASS} host=localhost port=5432 sslmode=disable dbname=casdoor
-dbName = casdoor
-tableNamePrefix =
-showSql = false
-redisEndpoint =
-defaultStorageProvider =
-isCloudIntranet = false
-authState = "casdoor"
-socks5Proxy =
-verificationCodeTimeout = 10
-initScore = 0
-logPostOnly = true
-isUsernameLowered = false
-origin = http://${LOCAL_IP}:8000
-originFrontend =
-staticBaseUrl = "https://cdn.casbin.org"
-isDemoMode = false
-batchSize = 100
-showGithubCorner = false
-forceLanguage = ""
-defaultLanguage = "en"
-defaultApplication = "app-built-in"
-maxItemsForFlatMenu = 7
-enableErrorMask = false
-enableGzip = true
-inactiveTimeoutMinutes =
-ldapServerPort = 389
-ldapsCertId = ""
-ldapsServerPort = 636
-radiusServerPort = 1812
-radiusDefaultOrganization = "built-in"
-radiusSecret = "$(random_password)"
-quota = {"organization": -1, "user": -1, "application": -1, "provider": -1}
-logConfig = {"adapter":"console", "color":false}
-initDataNewOnly = false
-initDataFile = "./init_data.json"
-frontendBaseDir = "/opt/casdoor/web/build"
-EOF
-chmod 600 /opt/casdoor_data/conf/app.conf
-msg_ok "Configured Casdoor"
-
-msg_info "Creating Service"
-cat <<EOF >/etc/systemd/system/casdoor.service
-[Unit]
-Description=Casdoor
-After=network.target postgresql.service
-Requires=postgresql.service
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=/opt/casdoor_data
-ExecStart=/opt/casdoor/casdoor
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now casdoor
-msg_ok "Created Service"
-
-motd_ssh
-customize
-cleanup_lxc
@@ -13,18 +13,15 @@ setting_up_container
 network_check
 update_os

-var_cf_api_token="${var_cf_api_token:-}"
-[[ -n "$var_cf_api_token" ]] || read -rp "${TAB3}Enter the Cloudflare API token: " var_cf_api_token || true
-[[ -n "$var_cf_api_token" ]] || { msg_error "No Cloudflare API token given; set var_cf_api_token or answer the prompt"; exit 64; }
+var_cf_api_token="default"
+read -rp "${TAB3}Enter the Cloudflare API token: " var_cf_api_token

-var_cf_domains="${var_cf_domains:-}"
-[[ -n "$var_cf_domains" ]] || read -rp "${TAB3}Enter the domains separated with a comma (*.example.org,www.example.org) " var_cf_domains || true
-[[ -n "$var_cf_domains" ]] || { msg_error "No domains given; set var_cf_domains or answer the prompt"; exit 64; }
+var_cf_domains="default"
+read -rp "${TAB3}Enter the domains separated with a comma (*.example.org,www.example.org) " var_cf_domains

 var_cf_proxied="false"
-answer="${var_cloudflare_ddns_proxied:-}"
 while true; do
-  [[ -n "$answer" ]] || read -rp "${TAB3}Proxied? (y/n): " answer || answer="n"
+  read -rp "${TAB3}Proxied? (y/n): " answer
  case "$answer" in
  [Yy]*)
    var_cf_proxied="true"
@@ -34,13 +31,12 @@ while true; do
    var_cf_proxied="false"
    break
    ;;
-  *) echo "Please answer y or n."; answer="" ;;
+  *) echo "Please answer y or n." ;;
  esac
 done
 var_cf_ip6_provider="none"
-answer="${var_cloudflare_ddns_ipv6:-}"
 while true; do
-  [[ -n "$answer" ]] || read -rp "${TAB3}Enable IPv6 support? (y/n): " answer || answer="n"
+  read -rp "${TAB3}Enable IPv6 support? (y/n): " answer
  case "$answer" in
  [Yy]*)
    var_cf_ip6_provider="cloudflare.trace"
@@ -50,7 +46,7 @@ while true; do
    var_cf_ip6_provider="none"
    break
    ;;
-  *) echo "Please answer y or n."; answer="" ;;
+  *) echo "Please answer y or n." ;;
  esac
 done
 msg_ok "Configured Application"
@@ -33,7 +33,7 @@ msg_ok "Installed Cockpit"
 # 45Drives only publishes amd64 packages
 if [[ "$(arch_resolve)" != "arm64" ]]; then
  prompt="${var_cockpit_45drives:-}"
-  [[ -n "$prompt" ]] || read -r -p "Would you like to install 45Drives' cockpit-file-sharing, cockpit-identities, and cockpit-navigator  <y/N> " prompt || true
+  [[ -n "$prompt" ]] || read -r -p "Would you like to install 45Drives' cockpit-file-sharing, cockpit-identities, and cockpit-navigator  <y/N> " prompt
 fi
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
  msg_info "Installing 45Drives' cockpit extensions"
@@ -17,8 +17,7 @@ setup_hwaccel
 echo
 echo "${TAB3}Choose the GPU type for ComfyUI:"
 echo "${TAB3}[1]-None  [2]-NVIDIA  [3]-AMD  [4]-Intel"
-gpu_choice="${var_comfyui_gpu_type:-}"
-[[ -n "$gpu_choice" ]] || read -rp "${TAB3}Enter your choice [1-4] (default: 1): " gpu_choice || true
+read -rp "${TAB3}Enter your choice [1-4] (default: 1): " gpu_choice
 gpu_choice=${gpu_choice:-1}
 case "$gpu_choice" in
 1) comfyui_gpu_type="none" ;;
@@ -20,7 +20,7 @@ msg_ok "Installed Dependencies"
 NODE_VERSION="22" setup_nodejs

 onlyoffice="${var_cryptpad_onlyoffice:-}"
-[[ -n "$onlyoffice" ]] || read -rp "${TAB3}Install OnlyOffice components instead of CKEditor? (Y/N): " onlyoffice || true
+[[ -n "$onlyoffice" ]] || read -rp "${TAB3}Install OnlyOffice components instead of CKEditor? (Y/N): " onlyoffice
 fetch_and_deploy_gh_release "cryptpad" "cryptpad/cryptpad" "tarball"

 msg_info "Setup CryptPad"
@@ -28,15 +28,11 @@ cd /opt/cryptpad
 $STD npm ci --allow-git=all
 $STD npm run install:components
 if [[ "${onlyoffice,,}" =~ ^(y|yes)$ ]]; then
-  $STD bash -c "./install-office.sh --accept-license"
+  $STD bash -c "./install-onlyoffice.sh --accept-license"
 fi
 cp config/config.example.js config/config.js
-cp config/infra.example.js config/infra.js
-sed -i \
-  -e "s|origin: \"http://localhost:3000\"|origin: \"http://${LOCAL_IP}:3000\"|" \
-  -e "s|sandboxOrigin: \"http://localhost:3001\"|sandboxOrigin: \"http://${LOCAL_IP}:3001\"|" \
-  -e "s|httpHost: \"localhost\"|httpHost: \"0.0.0.0\"|" \
-  config/infra.js
+sed -i "51s/localhost/${LOCAL_IP}/g" /opt/cryptpad/config/config.js
+sed -i "80s#//httpAddress: 'localhost'#httpAddress: '0.0.0.0'#g" /opt/cryptpad/config/config.js
 $STD npm run build
 msg_ok "Setup CryptPad"

@@ -15,8 +15,11 @@ update_os

 setup_deb_based() {
  setup_docker
-  socket_choice="${var_docker_socket:-}"
-  [[ -n "$socket_choice" ]] || read -r -p "${TAB3}Expose Docker TCP socket (insecure) ? [n = No, l = Local only (127.0.0.1), a = All interfaces (0.0.0.0)] <n/l/a>: " socket_choice || true
+  if [[ -n "${var_docker_socket:-}" ]]; then
+    socket_choice="$var_docker_socket"
+  else
+    read -r -p "${TAB3}Expose Docker TCP socket (insecure) ? [n = No, l = Local only (127.0.0.1), a = All interfaces (0.0.0.0)] <n/l/a>: " socket_choice
+  fi
  case "${socket_choice,,}" in
  l | local)
    socket="tcp://127.0.0.1:2375"
@@ -67,8 +70,11 @@ setup_alpine() {
  msg_ok "Installed Docker"

  DOCKER_COMPOSE_LATEST_VERSION=$(get_latest_github_release "docker/compose" false)
-  prompt="${var_docker_compose:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Docker Compose? <y/N> " prompt || true
+  if [[ -n "${var_docker_compose:-}" ]]; then
+    prompt="$var_docker_compose"
+  else
+    read -r -p "${TAB3}Would you like to add Docker Compose? <y/N> " prompt
+  fi
  if [[ "${prompt,,}" =~ ^(y|yes|true)$ ]]; then
    msg_info "Installing Docker Compose $DOCKER_COMPOSE_LATEST_VERSION"
    DOCKER_CONFIG=${DOCKER_CONFIG:-$HOME/.docker}
@@ -77,8 +83,11 @@ setup_alpine() {
    chmod +x "$DOCKER_CONFIG"/cli-plugins/docker-compose
    msg_ok "Installed Docker Compose $DOCKER_COMPOSE_LATEST_VERSION"
  fi
-  prompt="${var_docker_socket:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to expose the Docker TCP socket? <y/N> " prompt || true
+  if [[ -n "${var_docker_socket:-}" ]]; then
+    prompt="$var_docker_socket"
+  else
+    read -r -p "${TAB3}Would you like to expose the Docker TCP socket? <y/N> " prompt
+  fi
  case "${prompt,,}" in
  y | yes | a | all) socket="tcp://0.0.0.0:2375" ;;
  l | local) socket="tcp://127.0.0.1:2375" ;;
@@ -26,9 +26,8 @@ $STD apt install -y \
  nginx
 msg_ok "Installed Dependencies"

-var_project_name="${var_project_name:-}"
-[[ -n "$var_project_name" ]] || read -r -p "${TAB3}Type the assembly name of the project: " var_project_name || true
-[[ -n "$var_project_name" ]] || { msg_error "No assembly name given; set var_project_name or answer the prompt"; exit 64; }
+var_project_name="default"
+read -r -p "${TAB3}Type the assembly name of the project: " var_project_name

 msg_info "Setting up FTP Server"
 useradd ftpuser
@@ -1,136 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/dreeveapp/dreeve
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-msg_info "Installing Dependencies"
-$STD apt install -y \
-  libsqlite3-0 \
-  libcap2-bin \
-  ca-certificates
-msg_ok "Installed Dependencies"
-
-# 1.13.0's php-cli shifts the script into argv[1], which breaks composer and bin/console (php/frankenphp#2690); unpin once 1.13.1 is out
-fetch_and_deploy_gh_release "frankenphp" "php/frankenphp" "singlefile" "v1.12.7" "/opt/frankenphp" "frankenphp-linux-$(arch_resolve x86_64 aarch64)-gnu"
-fetch_and_deploy_gh_release "dreeve" "dreeveapp/dreeve" "tarball"
-
-msg_info "Providing php CLI"
-cat <<'EOF' >/usr/local/bin/php
-#!/usr/bin/env bash
-exec /opt/frankenphp/frankenphp php-cli "$@"
-EOF
-chmod +x /usr/local/bin/php
-msg_ok "Provided php CLI"
-
-msg_info "Installing Composer"
-curl -fsSL https://getcomposer.org/installer -o /tmp/composer-setup.php
-$STD /opt/frankenphp/frankenphp php-cli /tmp/composer-setup.php --install-dir=/usr/local/bin --filename=composer
-rm -f /tmp/composer-setup.php
-msg_ok "Installed Composer"
-
-msg_info "Installing PHP Dependencies (Patience)"
-cd /opt/dreeve
-export COMPOSER_ALLOW_SUPERUSER=1
-export APP_ENV=prod
-$STD /opt/frankenphp/frankenphp php-cli /usr/local/bin/composer install --no-dev --optimize-autoloader --no-interaction --no-scripts
-msg_ok "Installed PHP Dependencies"
-
-msg_info "Configuring Dreeve"
-mkdir -p /opt/dreeve_data /opt/dreeve/var/{cache,log}
-DREEVE_PASSWORD=$(openssl rand -base64 18)
-DREEVE_HASH=$(DREEVE_PASSWORD="$DREEVE_PASSWORD" /opt/frankenphp/frankenphp php-cli -r 'echo password_hash(getenv("DREEVE_PASSWORD"), PASSWORD_BCRYPT, ["cost" => 13]);')
-[[ "$DREEVE_HASH" =~ ^\$2y\$ ]] || {
-  msg_error "Could not generate the admin password hash"
-  exit 1
-}
-cat <<EOF >/opt/dreeve/.env.local
-APP_ENV=prod
-APP_DEBUG=0
-APP_SECRET=$(openssl rand -hex 32)
-APP_URL=http://${LOCAL_IP}:8080
-DATABASE_DIRECTORY=/opt/dreeve_data
-ADMIN_USERNAME=admin
-ADMIN_PASSWORD_HASH='${DREEVE_HASH}'
-TZ=UTC
-
-# Create an API application at https://www.strava.com/settings/api
-STRAVA_CLIENT_ID=replace-me
-STRAVA_CLIENT_SECRET=replace-me
-STRAVA_REFRESH_TOKEN=replace-me
-EOF
-chmod 600 /opt/dreeve/.env.local
-
-cat <<EOF >~/dreeve.creds
-Dreeve Admin
-Username: admin
-Password: ${DREEVE_PASSWORD}
-EOF
-chmod 600 ~/dreeve.creds
-
-cat <<EOF >/opt/dreeve/Caddyfile
-{
-	http_port 8080
-	auto_https off
-
-	frankenphp {
-		num_threads 3
-		worker {
-			num 2
-			file /opt/dreeve/public/index.php
-		}
-	}
-}
-
-:8080 {
-	root /opt/dreeve/public
-	encode zstd br gzip
-	php_server
-}
-EOF
-msg_ok "Configured Dreeve"
-
-msg_info "Initializing Database"
-cd /opt/dreeve
-set -a
-source /opt/dreeve/.env.local
-set +a
-$STD /opt/frankenphp/frankenphp php-cli bin/console app:db:migrate --no-interaction
-$STD /opt/frankenphp/frankenphp php-cli bin/console assets:install public --no-interaction
-$STD /opt/frankenphp/frankenphp php-cli bin/console cache:warmup --env=prod
-msg_ok "Initialized Database"
-
-msg_info "Creating Service"
-cat <<EOF >/etc/systemd/system/dreeve.service
-[Unit]
-Description=Dreeve
-Wants=network-online.target
-After=network-online.target
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=/opt/dreeve
-EnvironmentFile=/opt/dreeve/.env.local
-ExecStart=/opt/frankenphp/frankenphp run --config /opt/dreeve/Caddyfile
-Restart=on-failure
-RestartSec=10
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now dreeve
-msg_ok "Created Service"
-
-motd_ssh
-customize
-cleanup_lxc
@@ -23,9 +23,7 @@ NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs

 echo "${TAB3}It is important to choose the name for your server before you install Synapse, because it cannot be changed later."
 echo "${TAB3}The server name determines the “domain” part of user-ids for users on your server: these will all be of the format @user:my.domain.name. It also determines how other matrix servers will reach yours for federation."
-servername="${var_elementsynapse_server_name:-}"
-[[ -n "$servername" ]] || read -r -p "${TAB3}Please enter the name for your server: " servername || true
-[[ -n "$servername" ]] || { msg_error "No server name given; set var_elementsynapse_server_name or answer the prompt"; exit 64; }
+read -p "${TAB3}Please enter the name for your server: " servername

 msg_info "Installing Element Synapse"
 setup_deb822_repo "matrix-org" \
@@ -40,7 +38,7 @@ chmod +x /usr/sbin/policy-rc.d
 $STD apt install matrix-synapse-py3 -y
 rm -f /usr/sbin/policy-rc.d
 sed -i 's/127.0.0.1/0.0.0.0/g' /etc/matrix-synapse/homeserver.yaml
-sed -i '/^ *- ::1$/d' /etc/matrix-synapse/homeserver.yaml
+sed -i 's/'\''::1'\'', //g' /etc/matrix-synapse/homeserver.yaml
 SECRET=$(openssl rand -hex 32)
 ADMIN_PASS="$(random_password 13)"
 echo "enable_registration_without_verification: true" >>/etc/matrix-synapse/homeserver.yaml
@@ -71,7 +69,7 @@ Admin username: admin
 Admin password: $ADMIN_PASS
 EOF
 systemctl stop matrix-synapse
-sed -i '/^enable_registration_without_verification: true$/d' /etc/matrix-synapse/homeserver.yaml
+sed -i '34d' /etc/matrix-synapse/homeserver.yaml
 systemctl start matrix-synapse
 msg_ok "Installed Element Synapse"

@@ -1,70 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/emdash-cms/emdash
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-NODE_VERSION="24" NODE_MODULE="pnpm@11" setup_nodejs
-
-msg_info "Creating EmDash Site"
-cd /opt
-$STD pnpm dlx create-emdash@latest emdash --platform node --template "${var_emdash_template:-blog}" --pm pnpm --no-install --yes
-mkdir -p /opt/emdash_data/uploads
-mv /opt/emdash/.env /opt/emdash_data/.env
-sed -i -e 's|file:./data.db|file:/opt/emdash_data/data.db|' -e 's|"./uploads"|"/opt/emdash_data/uploads"|' /opt/emdash/astro.config.mjs
-cat <<EOF >>/opt/emdash_data/.env
-HOST=0.0.0.0
-PORT=4321
-# The address in the browser bar. Passkeys are bound to its hostname, and the build bakes it in for image optimization:
-# after a change run cd /opt/emdash && set -a && . /opt/emdash_data/.env && set +a && pnpm build && systemctl restart emdash
-EMDASH_SITE_URL=${var_emdash_url:-http://${LOCAL_IP}:4321}
-EOF
-chmod 600 /opt/emdash_data/.env
-msg_ok "Created EmDash Site"
-
-msg_info "Building EmDash"
-cd /opt/emdash
-# pnpm keeps Astro's sharp out of the site's reach, and every /_image request then fails with MissingSharp
-$STD pnpm add sharp
-set -a && source /opt/emdash_data/.env && set +a
-$STD pnpm build
-cat <<EOF >~/.emdash
-emdash@$(node -p 'require("/opt/emdash/node_modules/emdash/package.json").version')
-EOF
-msg_ok "Built EmDash"
-
-msg_info "Creating EmDash Service"
-cat <<EOF >/etc/systemd/system/emdash.service
-[Unit]
-Description=EmDash
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=/opt/emdash
-EnvironmentFile=/opt/emdash_data/.env
-Environment=NODE_ENV=production
-ExecStart=/usr/bin/node /opt/emdash/dist/server/entry.mjs
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now emdash
-msg_ok "Created EmDash Service"
-
-motd_ssh
-customize
-cleanup_lxc
@@ -39,7 +39,7 @@ echo "$LATEST_VERSION" >~/.emqx
 msg_ok "Installed EMQX"

 prompt="${var_emqx_disable_mq:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to disable the EMQX MQ feature? (reduces disk/CPU usage) <y/N> " prompt || true
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to disable the EMQX MQ feature? (reduces disk/CPU usage) <y/N> " prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  msg_info "Disabling EMQX MQ feature"
  mkdir -p /etc/emqx
@@ -19,7 +19,7 @@ $STD apt install -y \
  nginx
 msg_ok "Installed Dependencies"

-NODE_VERSION="24" setup_nodejs
+NODE_VERSION="20" setup_nodejs
 PG_VERSION="18" setup_postgresql
 PG_DB_NAME="excalidash" PG_DB_USER="excalidash" setup_postgresql_db

@@ -45,8 +45,7 @@ $STD ln -svf /usr/bin/ffmpeg /usr/local/bin/ffmpeg
 $STD ln -svf /usr/bin/ffprobe /usr/local/bin/ffprobe
 $STD rm -rf /opt/fileflows/Server/runtimes/win-*

-install_server="${var_fileflows_mode:-}"
-[[ -n "$install_server" ]] || read -r -p "${TAB3}Do you want to install FileFlows Server or Agent? (S/A): " install_server || true
+read -r -p "${TAB3}Do you want to install FileFlows Server or Agent? (S/A): " install_server

 if [[ "$install_server" =~ ^[Ss]$ ]]; then
  msg_info "Installing FileFlows Server"
@@ -55,10 +54,9 @@ if [[ "$install_server" =~ ^[Ss]$ ]]; then
  systemctl enable -q --now fileflows
  msg_ok "Installed FileFlows Server"
 else
-  server_url="${var_fileflows_server_url:-}"
-  [[ -n "$server_url" ]] || read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url || true
+  read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url
  while [[ -z "${server_url// /}" ]]; do
-    read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url || { msg_error "No FileFlows Server URL given; set var_fileflows_server_url or answer the prompt"; exit 64; }
+    read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url
  done
  msg_info "Installing FileFlows Agent"
  cd /opt/fileflows/Agent
@@ -15,12 +15,12 @@ update_os
 setup_yq

 if [[ -z "${var_forgejo_instance:-}" ]]; then
-  read -r -p "${TAB3}Forgejo Instance URL (e.g. https://codeberg.org): " var_forgejo_instance || true
+  read -r -p "${TAB3}Forgejo Instance URL (e.g. https://codeberg.org): " var_forgejo_instance
  var_forgejo_instance="${var_forgejo_instance:-https://codeberg.org}"
 fi

 if [[ -z "${var_forgejo_runner_uuid:-}" ]]; then
-  read -r -p "${TAB3}Forgejo Runner UUID: " var_forgejo_runner_uuid || true
+  read -r -p "${TAB3}Forgejo Runner UUID: " var_forgejo_runner_uuid
 fi

 if [[ -z "${var_forgejo_runner_uuid:-}" ]]; then
@@ -29,7 +29,7 @@ if [[ -z "${var_forgejo_runner_uuid:-}" ]]; then
 fi

 if [[ -z "${var_forgejo_runner_token:-}" ]]; then
-  read -r -p "${TAB3}Forgejo Runner Token: " var_forgejo_runner_token || true
+  read -r -p "${TAB3}Forgejo Runner Token: " var_forgejo_runner_token
 fi

 if [[ -z "${var_forgejo_runner_token:-}" ]]; then
@@ -39,7 +39,7 @@ fi

 DEFAULT_RUNNER_LABELS="linux-amd64:docker://node:22-bookworm"
 if [[ -z "${var_runner_labels:-}" ]]; then
-  read -r -p "${TAB3}Additional runner labels (comma-separated, or leave blank for default only): " var_runner_labels || true
+  read -r -p "${TAB3}Additional runner labels (comma-separated, or leave blank for default only): " var_runner_labels
 fi
 if [[ -n "${var_runner_labels:-}" ]]; then
  RUNNER_LABELS="${DEFAULT_RUNNER_LABELS},${var_runner_labels}"
@@ -110,7 +110,7 @@ export AUTOGRAPH_VERBOSITY=0
 export GLOG_minloglevel=3
 export GLOG_logtostderr=0

-fetch_and_deploy_gh_release "frigate" "blakeblackshear/frigate" "tarball" "v0.18.2" "/opt/frigate"
+fetch_and_deploy_gh_release "frigate" "blakeblackshear/frigate" "tarball" "v0.18.0" "/opt/frigate"

 msg_info "Building Nginx"
 $STD bash /opt/frigate/docker/main/build_nginx.sh
@@ -124,8 +124,6 @@ msg_ok "Built SQLite Extensions"

 if [[ "$(arch_resolve)" == "amd64" ]]; then
  msg_info "Building Intel Media Driver (Patience)"
-  download_gpg_key "https://repositories.intel.com/gpu/intel-graphics.key" "/usr/share/keyrings/intel-graphics.gpg" "dearmor"
-  sed -i '/intel-graphics.key/d' /opt/frigate/docker/main/build_intel_media_driver.sh
  $STD bash /opt/frigate/docker/main/build_intel_media_driver.sh
  cp -a /rootfs/. /
  rm -rf /rootfs
@@ -51,10 +51,8 @@ echo -e ""
 msg_custom "🪙" "$YW" "CoinGecko API keys are optional but provide better cryptocurrency data."
 msg_custom "🪙" "$YW" "You can skip this and add them later by editing /opt/ghostfolio/.env"
 echo -e ""
-COINGECKO_DEMO_KEY="${var_ghostfolio_coingecko_demo_key:-}"
-[[ -n "$COINGECKO_DEMO_KEY" ]] || read -rp "${TAB3}CoinGecko Demo API key (press Enter to skip): " COINGECKO_DEMO_KEY || true
-COINGECKO_PRO_KEY="${var_ghostfolio_coingecko_pro_key:-}"
-[[ -n "$COINGECKO_PRO_KEY" ]] || read -rp "${TAB3}CoinGecko Pro API key (press Enter to skip): " COINGECKO_PRO_KEY || true
+read -rp "${TAB3}CoinGecko Demo API key (press Enter to skip): " COINGECKO_DEMO_KEY
+read -rp "${TAB3}CoinGecko Pro API key (press Enter to skip): " COINGECKO_PRO_KEY

 msg_info "Setting up Environment"
 cat <<EOF >/opt/ghostfolio/.env
@@ -34,7 +34,6 @@ $STD apt install -y \
  pkg-config \
  poppler-utils \
  python3-dev \
-  redis-server \
  tesseract-ocr
 msg_ok "Installed Dependencies"

@@ -71,8 +70,6 @@ REQUEST_CACHE_CONFIG={"CACHE_TYPE":"FileSystemCache","CACHE_DIR":"/opt/gramps-we
 PERSISTENT_CACHE_CONFIG={"CACHE_TYPE":"FileSystemCache","CACHE_DIR":"/opt/gramps-web/data/cache/persistent","CACHE_THRESHOLD":0,"CACHE_DEFAULT_TIMEOUT":0}
 REPORT_DIR="/opt/gramps-web/data/cache/report"
 EXPORT_DIR="/opt/gramps-web/data/cache/export"
-CELERY_CONFIG={"broker_url":"redis://127.0.0.1:6379/0","result_backend":"redis://127.0.0.1:6379/0"}
-RATELIMIT_STORAGE_URI="redis://127.0.0.1:6379/1"
 EOF
 $STD uv venv -c -p python3.12 /opt/gramps-web/venv
 source /opt/gramps-web/venv/bin/activate
@@ -110,8 +107,7 @@ msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/gramps-web.service
 [Unit]
 Description=Gramps Web Service
-After=network.target redis-server.service
-Wants=redis-server.service
+After=network.target

 [Service]
 Type=simple
@@ -128,28 +124,7 @@ RestartSec=5
 [Install]
 WantedBy=multi-user.target
 EOF
-cat <<EOF >/etc/systemd/system/gramps-web-celery.service
-[Unit]
-Description=Gramps Web Celery Worker
-After=network.target redis-server.service
-Wants=redis-server.service
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=/opt/gramps-web-api
-Environment=GRAMPS_API_CONFIG=/opt/gramps-web/config/config.cfg
-Environment=GRAMPSHOME=/opt/gramps-web/data
-Environment=GRAMPS_DATABASE_PATH=/opt/gramps-web/data/gramps/grampsdb
-Environment=PATH=/opt/gramps-web/venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
-ExecStart=/opt/gramps-web/venv/bin/celery -A gramps_webapi.celery worker --loglevel=INFO --concurrency=2
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now gramps-web gramps-web-celery
+systemctl enable -q --now gramps-web
 msg_ok "Created Service"

 motd_ssh
@@ -16,7 +16,7 @@ update_os
 fetch_and_deploy_gh_release "headscale" "juanfont/headscale" "binary"

 prompt="${var_headscale_admin:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add headscale-admin UI? <y/N> " prompt || true
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add headscale-admin UI? <y/N> " prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  fetch_and_deploy_gh_release "headscale-admin" "GoodiesHQ/headscale-admin" "prebuild" "latest" "/opt/headscale-admin" "admin.zip"

@@ -25,7 +25,7 @@ msg_info "Setting up Heimdall-Dashboard"
 cd /opt/Heimdall
 cp .env.example .env
 sed -i 's/^APP_ENV=.*/APP_ENV=production/' .env
-$STD php artisan key:generate --force
+$STD php artisan key:generate
 msg_ok "Setup Heimdall-Dashboard"

 msg_info "Creating Service"
@@ -14,9 +14,7 @@ network_check
 update_os

 msg_info "Installing Dependencies"
-$STD apt install -y \
-  git \
-  libatomic1
+$STD apt install -y git
 msg_ok "Installed Dependencies"

 NODE_VERSION="22" setup_nodejs
@@ -29,71 +27,78 @@ msg_ok "Created Hermes User"

 msg_info "Configuring Service Environment"
 cat <<EOF >/etc/default/hermes
+HOME=/home/hermes
 PATH=/home/hermes/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 NODE_OPTIONS=${NODE_OPTIONS}
-GATEWAY_HEALTH_URL=http://127.0.0.1:8642/health
 EOF
 msg_ok "Configured Service Environment"

 confirm_external_installer "https://hermes-agent.nousresearch.com/" "https://hermes-agent.nousresearch.com/install.sh"

 msg_info "Installing Hermes Agent"
-curl_with_retry "https://hermes-agent.nousresearch.com/install.sh" /tmp/hermes-install.sh ||
-  curl_with_retry "https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scripts/install.sh" /tmp/hermes-install.sh
-chmod 644 /tmp/hermes-install.sh
-$STD setsid --wait runuser -l hermes -c '
+curl -fsSL https://hermes-agent.nousresearch.com/install.sh -o /tmp/hermes-install.sh
+$STD setsid --wait bash -c '
  set -a; source /etc/default/hermes; set +a
  export npm_config_yes=true
-  bash /tmp/hermes-install.sh --skip-setup --hermes-home ~/.hermes --dir ~/.hermes/hermes-agent
+  bash /tmp/hermes-install.sh --skip-setup --hermes-home /home/hermes/.hermes --dir /home/hermes/.hermes/hermes-agent
 '
 rm -f /tmp/hermes-install.sh
+chown -R hermes:hermes /home/hermes
 chmod 750 /home/hermes
 chmod 700 /home/hermes/.hermes
+git config --system --add safe.directory /home/hermes/.hermes/hermes-agent 2>/dev/null || true
 msg_ok "Installed Hermes Agent"

 msg_info "Configuring API Server"
 API_SERVER_KEY=$(random_password 32)
+mkdir -p /home/hermes/.hermes
 cat <<EOF >/home/hermes/.hermes/.env
 API_SERVER_ENABLED=true
 API_SERVER_HOST=0.0.0.0
 API_SERVER_PORT=8642
 API_SERVER_KEY=${API_SERVER_KEY}
 EOF
-chown hermes:hermes /home/hermes/.hermes/.env
 chmod 600 /home/hermes/.hermes/.env
 msg_ok "Configured API Server"

 msg_info "Creating Dashboard Service"
-mkdir -p /home/hermes/.config/systemd/user
-cat <<EOF >/home/hermes/.config/systemd/user/hermes-dashboard.service
+cat <<EOF >/etc/systemd/system/hermes-dashboard.service
 [Unit]
 Description=Hermes Agent Web Dashboard
 After=network-online.target
+Wants=network-online.target

 [Service]
 Type=simple
+User=hermes
+Group=hermes
 UMask=0077
-WorkingDirectory=%h
+WorkingDirectory=/home/hermes
+ExecStart=/home/hermes/.local/bin/hermes dashboard --host 127.0.0.1 --port 9119 --no-open
 EnvironmentFile=/etc/default/hermes
-ExecStart=%h/.local/bin/hermes dashboard --host 127.0.0.1 --port 9119 --no-open
 Restart=on-failure
 RestartSec=5
+ProtectProc=invisible
+ProcSubset=pid

 [Install]
-WantedBy=default.target
+WantedBy=multi-user.target
 EOF
-chown -R hermes:hermes /home/hermes/.config
-$STD runuser -l hermes -c 'systemctl --user daemon-reload && systemctl --user enable --now hermes-dashboard'
+systemctl enable -q --now hermes-dashboard
 msg_ok "Created Dashboard Service"

 msg_info "Creating Setup Helper"
 cat <<'SETUP' >/usr/bin/hermes-setup
 #!/usr/bin/env bash
-su - hermes -c 'set -a; source /etc/default/hermes; set +a; hermes setup'
+set -a; source /etc/default/hermes; set +a
+/home/hermes/.local/bin/hermes setup
+chown -R hermes:hermes /home/hermes
+chmod 750 /home/hermes
+chmod 700 /home/hermes/.hermes
 if [[ -f /home/hermes/.config/systemd/user/hermes-gateway.service ]]; then
  su - hermes -c 'systemctl --user enable --now hermes-gateway'
 fi
-echo "Hermes setup complete."
+echo "Hermes setup complete. File permissions restored."
 SETUP
 chmod +x /usr/bin/hermes-setup
 msg_ok "Created Setup Helper"
@@ -17,7 +17,7 @@ msg_info "Installing Dependencies"
 $STD apt install -y jq
 msg_ok "Installed Dependencies"

-NODE_VERSION="24" NODE_MODULE="pnpm@latest" setup_nodejs
+NODE_VERSION="22" NODE_MODULE="pnpm@latest" setup_nodejs
 fetch_and_deploy_gh_release "homepage" "gethomepage/homepage" "tarball"
 RELEASE=$(get_latest_github_release "gethomepage/homepage")

@@ -1,60 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/EgalitarianMonkey/hometube
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-setup_ffmpeg
-PYTHON_VERSION="3.13" setup_uv
-fetch_and_deploy_gh_release "deno" "denoland/deno" "prebuild" "latest" "/usr/local/bin" "deno-$(arch_resolve "x86_64" "aarch64")-unknown-linux-gnu.zip"
-fetch_and_deploy_gh_release "yt-dlp" "yt-dlp/yt-dlp" "singlefile" "latest" "/usr/local/bin" "yt-dlp_$(arch_resolve "linux" "linux_aarch64")"
-fetch_and_deploy_gh_release "hometube" "EgalitarianMonkey/hometube" "tarball"
-
-msg_info "Installing HomeTube"
-cd /opt/hometube
-$STD uv sync --locked --no-dev --no-install-project --no-install-package pyarrow
-mkdir -p /opt/hometube_data/{videos,tmp,cookies}
-cat <<EOF >/opt/hometube_data/.env
-VIDEOS_FOLDER=/opt/hometube_data/videos
-TMP_DOWNLOAD_FOLDER=/opt/hometube_data/tmp
-YOUTUBE_COOKIES_FILE_PATH=/opt/hometube_data/cookies/youtube_cookies.txt
-REMOVE_TMP_FILES_AFTER_DOWNLOAD=true
-EOF
-msg_ok "Installed HomeTube"
-
-msg_info "Creating Service"
-cat <<EOF >/etc/systemd/system/hometube.service
-[Unit]
-Description=HomeTube
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=/opt/hometube
-EnvironmentFile=/opt/hometube_data/.env
-Environment=PYTHONUNBUFFERED=1
-ExecStartPre=-/usr/local/bin/yt-dlp -U
-ExecStart=/opt/hometube/.venv/bin/python -m streamlit run app/main.py --server.port=8501 --server.address=0.0.0.0 --server.headless=true --server.enableCORS=false --server.enableXsrfProtection=false
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now hometube
-msg_ok "Created Service"
-
-motd_ssh
-customize
-cleanup_lxc
@@ -1,168 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/plastic-labs/honcho
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-msg_info "Installing Dependencies"
-$STD apt install -y redis-server
-msg_ok "Installed Dependencies"
-
-PG_VERSION="17" PG_MODULES="pgvector" setup_postgresql
-PG_DB_NAME="honcho" PG_DB_USER="honcho" PG_DB_EXTENSIONS="vector,pg_trgm" setup_postgresql_db
-PYTHON_VERSION="3.13" setup_uv
-fetch_and_deploy_gh_release "honcho" "plastic-labs/honcho" "tarball" "latest" "/opt/honcho" "" "v"
-
-msg_info "Installing Honcho"
-cd /opt/honcho
-$STD uv sync --frozen --no-dev
-msg_ok "Installed Honcho"
-
-if [[ -t 0 && -z "${var_honcho_provider:-}${var_honcho_api_key:-}${var_honcho_base_url:-}" ]]; then
-  echo -e "${INFO}${YW} Honcho needs an LLM provider for memory, embeddings and chat; without a key it is installed but not started.${CL}"
-  read -t 300 -rsp "${TAB3}OpenAI API key (Enter to set up a provider later): " var_honcho_api_key || true
-  echo
-fi
-
-declare -A HONCHO_KEY=([openai]="" [anthropic]="" [gemini]="")
-case "${var_honcho_provider:-openai}" in
-anthropic)
-  HONCHO_TRANSPORT="anthropic" HONCHO_MODEL="${var_honcho_model:-claude-haiku-4-5}"
-  HONCHO_EMBEDDING="openai" HONCHO_EMBEDDING_MODEL="${var_honcho_embedding_model:-text-embedding-3-small}"
-  HONCHO_KEY[anthropic]="${var_honcho_api_key:-}"
-  HONCHO_KEY[openai]="${var_honcho_embedding_key:-}"
-  ;;
-gemini)
-  HONCHO_TRANSPORT="gemini" HONCHO_MODEL="${var_honcho_model:-gemini-2.5-flash}"
-  HONCHO_EMBEDDING="gemini" HONCHO_EMBEDDING_MODEL="${var_honcho_embedding_model:-gemini-embedding-001}"
-  HONCHO_KEY[gemini]="${var_honcho_api_key:-}"
-  ;;
-*)
-  HONCHO_TRANSPORT="openai" HONCHO_MODEL="${var_honcho_model:-gpt-5.4-mini}"
-  HONCHO_EMBEDDING="openai" HONCHO_EMBEDDING_MODEL="${var_honcho_embedding_model:-text-embedding-3-small}"
-  HONCHO_KEY[openai]="${var_honcho_api_key:-${var_honcho_base_url:+not-needed}}"
-  ;;
-esac
-
-msg_info "Configuring Honcho"
-mkdir -p /opt/honcho_data
-cat <<EOF >/opt/honcho_data/.env
-DB_CONNECTION_URI=postgresql+psycopg://honcho:${PG_DB_PASS}@localhost:5432/honcho
-CACHE_ENABLED=true
-CACHE_URL=redis://localhost:6379/0?suppress=true
-
-# Every /v3 API request needs a JWT signed with this secret. Mint one with:
-# cd /opt/honcho && .venv/bin/python scripts/generate_jwt.py --admin
-AUTH_USE_AUTH=true
-AUTH_JWT_SECRET=$(openssl rand -hex 32)
-WEBHOOK_SECRET=$(openssl rand -hex 32)
-
-# Transports: openai (OpenAI or any OpenAI-compatible endpoint), anthropic, gemini.
-# Embeddings run on openai or gemini only. Apply changes with: systemctl restart honcho honcho-deriver
-LLM_OPENAI_API_KEY=${HONCHO_KEY[openai]}
-LLM_ANTHROPIC_API_KEY=${HONCHO_KEY[anthropic]}
-LLM_GEMINI_API_KEY=${HONCHO_KEY[gemini]}
-
-# An OpenAI-compatible endpoint (OpenRouter, Ollama, vLLM, LiteLLM) replaces api.openai.com through both lines:
-#LLM_OPENAI_BASE_URL=http://192.168.1.50:11434/v1
-#EMBEDDING_MODEL_CONFIG__OVERRIDES__BASE_URL=http://192.168.1.50:11434/v1
-# Endpoints without OpenAI Structured Outputs need:
-#DERIVER_MODEL_CONFIG__STRUCTURED_OUTPUT_MODE=json_object
-
-EMBEDDING_MODEL_CONFIG__TRANSPORT=${HONCHO_EMBEDDING}
-EMBEDDING_MODEL_CONFIG__MODEL=${HONCHO_EMBEDDING_MODEL}
-# A model with another vector size works only while nothing is embedded yet: set it here, then run
-# cd /opt/honcho && .venv/bin/python scripts/configure_embeddings.py --yes
-#EMBEDDING_VECTOR_DIMENSIONS=1536
-
-# The deriver waits for about 512 new tokens per peer, or 30 minutes, before it calls the LLM
-#DERIVER_FLUSH_ENABLED=true
-
-# Models for the deriver, summaries, dreams and dialectic chat; they must support tool calling
-EOF
-for prefix in DERIVER SUMMARY DREAM_DEDUCTION DREAM_INDUCTION DIALECTIC_LEVELS__{minimal,low,medium,high,max}_; do
-  cat <<EOF >>/opt/honcho_data/.env
-${prefix}_MODEL_CONFIG__TRANSPORT=${HONCHO_TRANSPORT}
-${prefix}_MODEL_CONFIG__MODEL=${HONCHO_MODEL}
-EOF
-done
-if [[ -n "${var_honcho_base_url:-}" ]]; then
-  cat <<EOF >>/opt/honcho_data/.env
-
-LLM_OPENAI_BASE_URL=${var_honcho_base_url}
-EMBEDDING_MODEL_CONFIG__OVERRIDES__BASE_URL=${var_honcho_base_url}
-EOF
-fi
-if [[ -n "${var_honcho_embedding_dims:-}" ]]; then
-  cat <<EOF >>/opt/honcho_data/.env
-EMBEDDING_VECTOR_DIMENSIONS=${var_honcho_embedding_dims}
-EOF
-fi
-chmod 600 /opt/honcho_data/.env
-ln -sf /opt/honcho_data/.env /opt/honcho/.env
-msg_ok "Configured Honcho"
-
-msg_info "Migrating Honcho Database"
-$STD .venv/bin/python scripts/provision_db.py
-$STD .venv/bin/python scripts/configure_embeddings.py --yes
-msg_ok "Migrated Honcho Database"
-
-msg_info "Creating Honcho Services"
-cat <<EOF >/etc/systemd/system/honcho.service
-[Unit]
-Description=Honcho API
-After=network.target postgresql.service redis-server.service
-Requires=postgresql.service
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=/opt/honcho
-Environment=PYTHONUNBUFFERED=1
-ExecStart=/opt/honcho/.venv/bin/fastapi run --host 0.0.0.0 --port 8000 src/main.py
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-cat <<EOF >/etc/systemd/system/honcho-deriver.service
-[Unit]
-Description=Honcho Deriver
-After=network.target postgresql.service redis-server.service honcho.service
-Requires=postgresql.service
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=/opt/honcho
-Environment=PYTHONUNBUFFERED=1
-ExecStart=/opt/honcho/.venv/bin/python -m src.deriver
-Restart=always
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-msg_ok "Created Honcho Services"
-
-if [[ -n "${HONCHO_KEY[$HONCHO_TRANSPORT]}" && -n "${HONCHO_KEY[$HONCHO_EMBEDDING]}" ]]; then
-  msg_info "Starting Honcho"
-  systemctl enable -q --now honcho honcho-deriver
-  msg_ok "Started Honcho"
-else
-  msg_warn "No LLM provider key (with Anthropic also an OpenAI key for embeddings): Honcho stays stopped until it is set in /opt/honcho_data/.env"
-fi
-
-motd_ssh
-customize
-cleanup_lxc
@@ -13,11 +13,6 @@ setting_up_container
 network_check
 update_os

-if is_debian && [[ "$(get_os_version_major)" -lt 13 ]]; then
-  msg_error "Immich needs Debian 13: its build dependencies and Intel runtime packages are not available on Debian 12."
-  exit 238
-fi
-
 RELEASE="v3.3.5"
 if lscpu | grep -q 'GenuineIntel'; then
  echo ""
@@ -30,7 +25,7 @@ if lscpu | grep -q 'GenuineIntel'; then
  echo " 2) **NEW** Intel OpenVINO CPU or iGPU"
  echo ""

-  read -r -p "${TAB3}Select machine-learning type [1]: " ML_TYPE || true
+  read -r -p "${TAB3}Select machine-learning type [1]: " ML_TYPE
  ML_TYPE="${ML_TYPE:-1}"
  if [[ "$ML_TYPE" == "2" ]]; then
    touch ~/.openvino
@@ -115,7 +110,7 @@ setup_deb822_repo \
  "https://repo.jellyfin.org/jellyfin_team.gpg.key" \
  "https://repo.jellyfin.org/debian" \
  "$(get_os_info codename)"
-install_packages_with_retry jellyfin-ffmpeg7
+$STD apt install -y jellyfin-ffmpeg7
 ln -sf /usr/lib/jellyfin-ffmpeg/ffmpeg /usr/bin/ffmpeg
 ln -sf /usr/lib/jellyfin-ffmpeg/ffprobe /usr/bin/ffprobe

@@ -129,9 +124,12 @@ if [[ "$CTTYPE" == "0" && -d /dev/dri ]]; then
 fi
 msg_ok "Dependencies Installed"

-MISE_ARCH="x64"
-[[ "$(arch_resolve)" == "arm64" ]] && MISE_ARCH="arm64"
-fetch_and_deploy_gh_release "mise" "jdx/mise" "singlefile" "latest" "/usr/local/bin" "mise-v*-linux-${MISE_ARCH}"
+msg_info "Installing Mise"
+curl -fSs https://mise.jdx.dev/gpg-key.pub | tee /etc/apt/keyrings/mise-archive-keyring.pub 1>/dev/null
+echo "deb [signed-by=/etc/apt/keyrings/mise-archive-keyring.pub arch=$(arch_resolve)] https://mise.jdx.dev/deb stable main" >/etc/apt/sources.list.d/mise.list
+apt_update_safe
+$STD apt install -y mise
+msg_ok "Installed Mise"

 msg_info "Configuring Debian Testing Repo"
 if [[ -f /etc/apt/sources.list.d/debian.sources ]]; then
@@ -21,8 +21,7 @@ setup_deb822_repo \
  "stable"
 msg_ok "Set up InfluxDB Repository"

-prompt="${var_influxdb_version:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Which version of InfluxDB to install? (1, 2 or 3) " prompt || true
+read -r -p "${TAB3}Which version of InfluxDB to install? (1, 2 or 3) " prompt
 if [[ $prompt == "3" ]]; then
  INFLUX="3"
 elif [[ $prompt == "2" ]]; then
@@ -52,7 +51,7 @@ fi
 msg_ok "Installed InfluxDB"

 prompt="${var_influxdb_telegraf:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Telegraf? <y/N> " prompt || true
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Telegraf? <y/N> " prompt
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
  msg_info "Installing Telegraf"
  $STD apt install -y telegraf
@@ -52,9 +52,6 @@ chown -R www-data:www-data /opt/invoiceshelf
 chmod -R 775 storage bootstrap/cache
 $STD php artisan migrate --force
 $STD php artisan storage:link
-cat <<'EOF' >/etc/cron.d/invoiceshelf
-* * * * * www-data cd /opt/invoiceshelf && php artisan schedule:run >> /dev/null 2>&1
-EOF
 msg_ok "Set up InvoiceShelf"

 msg_info "Configuring Caddy"
@@ -13,12 +13,6 @@ setting_up_container
 network_check
 update_os

-if [[ "${CTTYPE:-1}" != "0" ]]; then
-  msg_error "iVentoy requires a privileged LXC container."
-  msg_error "Recreate the container with unprivileged=0."
-  exit 10
-fi
-
 fetch_and_deploy_gh_release "iventoy" "ventoy/PXE" "prebuild" "latest" "/opt/iventoy" "iventoy-*-linux-$(arch_resolve x86_64-free arm64-trial).tar.gz"
 mkdir -p /opt/iventoy/{data,iso}

@@ -37,10 +37,10 @@ fi
 msg_ok "Installed Docker"

 msg_info "Detecting latest Kasm Workspaces release"
-KASM_URL=$(curl -s --max-time 30 https://kasm.com/downloads \
+KASM_URL=$(curl -s https://kasm.com/downloads \
  | grep -oP 'https://kasm-static-content\.s3\.amazonaws\.com/kasm_release_\d+\.\d+\.\d+-latest\.tar\.gz' \
-  | head -1 || true)
-KASM_VERSION=$(echo "$KASM_URL" | grep -oP '\d+\.\d+\.\d+(?=-latest)' || true)
+  | head -1)
+KASM_VERSION=$(echo "$KASM_URL" | grep -oP '\d+\.\d+\.\d+(?=-latest)')

 # Fallback to predefined version if online lookup failed.
 if [[ -z "$KASM_VERSION" ]] || [[ -z "$KASM_URL" ]]; then
@@ -63,7 +63,7 @@ curl_download "/opt/kasm_release_${KASM_VERSION}.tar.gz" "$KASM_URL"
 cd /opt
 tar -xf "kasm_release_${KASM_VERSION}.tar.gz"
 chmod +x /opt/kasm_release/install.sh
-bash /opt/kasm_release/install.sh --accept-eula --no-swap-check --no-check-disk --ignore-dep-failures >~/kasm-install.output 2>&1
+printf 'y\ny\ny\n4\n' | bash /opt/kasm_release/install.sh --ignore-dep-failures >~/kasm-install.output 2>&1
 awk '
  /^Kasm UI Login Credentials$/ {capture=1}
  capture {print}
@@ -28,15 +28,9 @@ mkdir -p config/assets
 cp config/config.yml.template config/config.yml
 msg_ok "Setup Kometa"

-TMDBKEY="${var_kometa_tmdb_key:-}"
-[[ -n "$TMDBKEY" ]] || read -r -p "${TAB3}Enter your TMDb API key: " TMDBKEY || true
-[[ -n "$TMDBKEY" ]] || { msg_error "No TMDb API key given; set var_kometa_tmdb_key or answer the prompt"; exit 64; }
-PLEXURL="${var_kometa_plex_url:-}"
-[[ -n "$PLEXURL" ]] || read -r -p "${TAB3}Enter your Plex URL: " PLEXURL || true
-[[ -n "$PLEXURL" ]] || { msg_error "No Plex URL given; set var_kometa_plex_url or answer the prompt"; exit 64; }
-PLEXTOKEN="${var_kometa_plex_token:-}"
-[[ -n "$PLEXTOKEN" ]] || read -r -p "${TAB3}Enter your Plex token: " PLEXTOKEN || true
-[[ -n "$PLEXTOKEN" ]] || { msg_error "No Plex token given; set var_kometa_plex_token or answer the prompt"; exit 64; }
+read -r -p "${TAB3}Enter your TMDb API key: " TMDBKEY
+read -r -p "${TAB3}Enter your Plex URL: " PLEXURL
+read -r -p "${TAB3}Enter your Plex token: " PLEXTOKEN
 sed -i '/^plex:/,/^[^ ]/{s|  url:.*|  url: '"$PLEXURL"'|}' /opt/kometa/config/config.yml
 sed -i '/^plex:/,/^[^ ]/{s|  token:.*|  token: '"$PLEXTOKEN"'|}' /opt/kometa/config/config.yml
 sed -i '/^tmdb:/,/^[^ ]/{s|  apikey:.*|  apikey: '"$TMDBKEY"'|}' /opt/kometa/config/config.yml
@@ -15,8 +15,7 @@ update_os

 echo "${TAB3}How would you like to handle SSL termination?"
 echo "${TAB3}[i]-Internal (self-signed SSL Certificate)   [e]-External (use your own reverse proxy)"
-ssl_choice="${var_kutt_ssl:-}"
-[[ -n "$ssl_choice" ]] || read -rp "${TAB3}Enter your choice <i/e> (default: i): " ssl_choice || true
+read -rp "${TAB3}Enter your choice <i/e> (default: i): " ssl_choice
 ssl_choice=${ssl_choice:-i}
 case "${ssl_choice,,}" in
 i)
@@ -33,9 +32,7 @@ EOF
  msg_ok "Configured Caddy"
  ;;
 e)
-  custom_host="${var_kutt_hostname:-}"
-  [[ -n "$custom_host" ]] || read -r -p "${TAB3}Enter the hostname you want to use for Kutt (eg. kutt.example.com): " custom_host || true
-  [[ -n "$custom_host" ]] || { msg_error "No hostname given; set var_kutt_hostname or answer the prompt"; exit 64; }
+  read -r -p "${TAB3}Enter the hostname you want to use for Kutt (eg. kutt.example.com): " custom_host
  if [[ "$custom_host" ]]; then
    DEFAULT_HOST="$custom_host"
  fi
@@ -29,12 +29,12 @@ rm -f /tmp/LanguageTool-stable.zip
 msg_ok "Setup LanguageTool"

 ngram_dir=""
-lang_code="${var_languagetool_ngram_lang:-}"
+lang_code=""
 max_attempts=3
 attempt=0

 while [[ $attempt -lt $max_attempts ]]; do
-  [[ -n "$lang_code" ]] || read -r -p "${TAB3}Enter language code (en, de, es, fr, nl) to download ngrams or press ENTER to skip: " lang_code || lang_code=""
+  read -r -p "${TAB3}Enter language code (en, de, es, fr, nl) to download ngrams or press ENTER to skip: " lang_code

  if [[ -z "$lang_code" ]]; then
    break
@@ -43,11 +43,11 @@ while [[ $attempt -lt $max_attempts ]]; do
  if [[ "$lang_code" =~ [[:space:]] ]]; then
    ((attempt++))
    remaining=$((max_attempts - attempt))
-    lang_code=""
    if [[ $remaining -gt 0 ]]; then
      msg_error "Please enter only ONE language code. You have $remaining attempt(s) remaining."
    else
      msg_error "Maximum attempts reached. Continuing without ngrams."
+      lang_code=""
    fi
    continue
  fi
@@ -25,7 +25,7 @@ RUST_CRATES="monolith" setup_rust
 PG_DB_NAME="linkwardendb" PG_DB_USER="linkwarden" setup_postgresql_db

 prompt="${var_linkwarden_adminer:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Adminer? <y/N> " prompt || true
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Adminer? <y/N> " prompt
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
  setup_adminer
 fi
@@ -61,7 +61,6 @@ $STD yarn web:build
 $STD yarn prisma:deploy
 rm -rf ~/.cargo/registry ~/.cargo/git ~/.cargo/.package-cache
 rm -rf /root/.cache/yarn
-rm -rf /root/.yarn/berry/cache
 rm -rf /opt/linkwarden/.next/cache
 msg_ok "Installed Linkwarden"

@@ -22,7 +22,7 @@ setup_deb_based() {
  msg_ok "Setup MariaDB"

  prompt="${var_mariadb_phpmyadmin:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add PhpMyAdmin? <y/N> " prompt || true
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add PhpMyAdmin? <y/N> " prompt
  if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
    msg_info "Installing phpMyAdmin"
    $STD apt install -y \
@@ -60,7 +60,7 @@ setup_alpine() {
  msg_ok "MariaDB Configured"

  prompt="${var_mariadb_adminer:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install Adminer with lighttpd? <y/N>: " prompt || true
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install Adminer with lighttpd? <y/N>: " prompt
  if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
    msg_info "Installing Adminer and dependencies"
    $STD apk add --no-cache \
@@ -23,7 +23,6 @@ $STD apt install -y \
  libldap-common \
  libssl-dev \
  libldap2 \
-  ffmpeg \
  gosu \
  iproute2
 msg_ok "Installed Dependencies"
@@ -13,9 +13,7 @@ setting_up_container
 network_check
 update_os

-admin_email="${var_mediamanager_admin_email:-}"
-[[ -n "$admin_email" ]] || read -r -p "${TAB3}Enter the email address of your first admin user: " admin_email || true
-[[ -n "$admin_email" ]] || { msg_error "No admin e-mail given; set var_mediamanager_admin_email or answer the prompt"; exit 64; }
+read -r -p "${TAB3}Enter the email address of your first admin user: " admin_email
 if [[ "$admin_email" ]]; then
  EMAIL="$admin_email"
 fi
@@ -16,7 +16,7 @@ update_os
 MEILISEARCH_BIND="0.0.0.0:7700" setup_meilisearch

 prompt="${var_meilisearch_ui:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Do you want add meilisearch-ui? [y/n]: " prompt || true
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Do you want add meilisearch-ui? [y/n]: " prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  NODE_VERSION="22" NODE_MODULE="pnpm@latest" setup_nodejs
  fetch_and_deploy_gh_release "meilisearch-ui" "riccox/meilisearch-ui" "tarball"
@@ -17,7 +17,7 @@ msg_info "Installing Dependencies"
 $STD apt install -y ca-certificates
 msg_ok "Installed Dependencies"

-NODE_VERSION="24" setup_nodejs
+NODE_VERSION="22" setup_nodejs

 msg_info "Installing MeshCentral"
 mkdir /opt/meshcentral
@@ -16,9 +16,8 @@ update_os
 if [[ "$(arch_resolve)" == "arm64" ]]; then
  MONGO_VERSION="8.0" setup_mongodb
 else
-  install_mongodb_8="${var_mongodb_8:-}"
-  [[ -n "$install_mongodb_8" ]] || read -r -p "${TAB3}Do you want to install MongoDB 8.0 instead of 7.0? [y/N]: " install_mongodb_8 || true
-  if [[ "$install_mongodb_8" =~ ^[Yy]([Ee][Ss])?$ ]]; then
+  read -p "${TAB3}Do you want to install MongoDB 8.0 instead of 7.0? [y/N]: " install_mongodb_8
+  if [[ "$install_mongodb_8" =~ ^[Yy]$ ]]; then
    MONGO_VERSION="8.0" setup_mongodb
  else
    MONGO_VERSION="7.0" setup_mongodb
@@ -21,8 +21,7 @@ msg_ok "Installed Dependencies"

 RELEASE_REPO="mysql-8.0"
 RELEASE_AUTH="mysql_native_password"
-prompt="${var_mysql_lts:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install the MySQL 8.4 LTS release instead of MySQL 8.0 (bug fix track; EOL April-2026)? <y/N> " prompt || true
+read -r -p "${TAB3}Would you like to install the MySQL 8.4 LTS release instead of MySQL 8.0 (bug fix track; EOL April-2026)? <y/N> " prompt
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
  RELEASE_REPO="mysql-8.4-lts"
  RELEASE_AUTH="caching_sha2_password"
@@ -62,8 +61,7 @@ echo -e "MySQL user: root" >>~/mysql.creds
 echo -e "MySQL password: $ADMIN_PASS" >>~/mysql.creds
 msg_ok "MySQL Server configured"

-prompt="${var_mysql_phpmyadmin:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add PhpMyAdmin? <y/N> " prompt || true
+read -r -p "${TAB3}Would you like to add PhpMyAdmin? <y/N> " prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/phpmyadmin.sh)"
 fi
@@ -36,8 +36,7 @@ echo " 1) NetBird Managed (default) - Use NetBird's managed service"
 echo " 2) Self-Hosted - Use your own NetBird management server"
 echo ""

-DEPLOYMENT_TYPE="${var_netbird_deployment:-}"
-[[ -n "$DEPLOYMENT_TYPE" ]] || read -r -p "${TAB3}Select deployment type [1]: " DEPLOYMENT_TYPE || true
+read -r -p "${TAB3}Select deployment type [1]: " DEPLOYMENT_TYPE
 DEPLOYMENT_TYPE="${DEPLOYMENT_TYPE:-1}"

 NETBIRD_MGMT_URL=""
@@ -52,8 +51,7 @@ case "$DEPLOYMENT_TYPE" in
    echo "Enter your NetBird management server URL."
    echo "Example: https://management.example.com"
    echo ""
-    NETBIRD_MGMT_URL="${var_netbird_mgmt_url:-}"
-    [[ -n "$NETBIRD_MGMT_URL" ]] || read -r -p "Management URL: " NETBIRD_MGMT_URL || true
+    read -r -p "Management URL: " NETBIRD_MGMT_URL

    if [[ -z "$NETBIRD_MGMT_URL" ]]; then
      msg_warn "No management URL provided. Run 'netbird up --management-url <url>' to connect."
@@ -83,8 +81,7 @@ else
 fi
 echo ""

-AUTH_METHOD="${var_netbird_auth:-}"
-[[ -n "$AUTH_METHOD" ]] || read -r -p "Select authentication method [1]: " AUTH_METHOD || true
+read -r -p "Select authentication method [1]: " AUTH_METHOD
 AUTH_METHOD="${AUTH_METHOD:-1}"

 if [[ "$DEPLOYMENT_TYPE" == "1" ]]; then
@@ -93,8 +90,7 @@ if [[ "$DEPLOYMENT_TYPE" == "1" ]]; then
      echo ""
      echo "Enter your NetBird setup key from the NetBird dashboard."
      echo ""
-      NETBIRD_SETUP_KEY="${var_netbird_setup_key:-}"
-      [[ -n "$NETBIRD_SETUP_KEY" ]] || read -r -p "Setup key: " NETBIRD_SETUP_KEY || true
+      read -r -p "Setup key: " NETBIRD_SETUP_KEY
      echo ""

      if [[ -z "$NETBIRD_SETUP_KEY" ]]; then
@@ -140,8 +136,7 @@ else
      echo ""
      echo "Enter your NetBird setup key from the NetBird dashboard."
      echo ""
-      NETBIRD_SETUP_KEY="${var_netbird_setup_key:-}"
-      [[ -n "$NETBIRD_SETUP_KEY" ]] || read -r -p "Setup key: " NETBIRD_SETUP_KEY || true
+      read -r -p "Setup key: " NETBIRD_SETUP_KEY
      echo ""

      if [[ -z "$NETBIRD_SETUP_KEY" ]]; then
@@ -16,15 +16,16 @@ update_os
 fetch_and_deploy_gh_release "newt" "fosrl/newt" "singlefile" "latest" "/opt/newt" "newt_linux_$(arch_resolve)"
 ln -sf /opt/newt/newt /usr/local/bin/newt

-NEWT_ID="${NEWT_ID:-${var_newt_id:-}}"
-[[ -n "$NEWT_ID" ]] || read -rp "Newt ID (from your Pangolin dashboard): " NEWT_ID || true
-NEWT_SECRET="${NEWT_SECRET:-${var_newt_secret:-}}"
-if [[ -z "$NEWT_SECRET" ]]; then
-  read -rsp "Newt Secret: " NEWT_SECRET || true
+if [[ -z "${NEWT_ID:-}" ]]; then
+  read -rp "Newt ID (from your Pangolin dashboard): " NEWT_ID
+fi
+if [[ -z "${NEWT_SECRET:-}" ]]; then
+  read -rsp "Newt Secret: " NEWT_SECRET
  echo
 fi
-PANGOLIN_ENDPOINT="${PANGOLIN_ENDPOINT:-${var_newt_endpoint:-}}"
-[[ -n "$PANGOLIN_ENDPOINT" ]] || read -rp "Pangolin endpoint (e.g. https://pangolin.example.com): " PANGOLIN_ENDPOINT || true
+if [[ -z "${PANGOLIN_ENDPOINT:-}" ]]; then
+  read -rp "Pangolin endpoint (e.g. https://pangolin.example.com): " PANGOLIN_ENDPOINT
+fi

 if [[ -z "$NEWT_ID" || -z "$NEWT_SECRET" || -z "$PANGOLIN_ENDPOINT" ]]; then
  msg_error "Newt ID, Secret and Endpoint are all required. Aborting."
@@ -38,14 +38,12 @@ curl -fsSL "https://raw.githubusercontent.com/ZoeyVid/NPMplus/refs/heads/develop
 msg_ok "Fetched NPMplus"

 attempts=0
-TZ_INPUT="${var_npmplus_tz:-}"
 while true; do
-  [[ -n "$TZ_INPUT" ]] || read -r -p "${TAB3}Enter your TZ Identifier (e.g., Europe/Berlin): " TZ_INPUT || { msg_error "No TZ identifier given; set var_npmplus_tz or answer the prompt"; exit 64; }
+  read -r -p "${TAB3}Enter your TZ Identifier (e.g., Europe/Berlin): " TZ_INPUT
  if validate_tz "$TZ_INPUT"; then
    break
  fi
  msg_error "Invalid timezone! Please enter a valid TZ identifier."
-  TZ_INPUT=""

  attempts=$((attempts + 1))
  if [[ "$attempts" -ge 3 ]]; then
@@ -54,9 +52,7 @@ while true; do
  fi
 done

-ACME_EMAIL_INPUT="${var_npmplus_acme_email:-}"
-[[ -n "$ACME_EMAIL_INPUT" ]] || read -r -p "${TAB3}Enter your ACME Email: " ACME_EMAIL_INPUT || true
-[[ -n "$ACME_EMAIL_INPUT" ]] || { msg_error "No ACME e-mail given; set var_npmplus_acme_email or answer the prompt"; exit 64; }
+read -r -p "${TAB3}Enter your ACME Email: " ACME_EMAIL_INPUT

 yq -i "
  .services.npmplus.environment |=
@@ -57,6 +57,10 @@ else
  }
 fi
 msg_ok "Installed Intel® Level Zero"
+
+msg_info "Installing Intel® oneAPI Base Toolkit (Patience)"
+$STD apt install -y --no-install-recommends intel-basekit-2024.1
+msg_ok "Installed Intel® oneAPI Base Toolkit"
 fi

 msg_info "Installing Ollama (Patience)"
@@ -14,9 +14,7 @@ network_check
 update_os

 msg_info "Installing Dependencies"
-$STD apt install -y \
-  git \
-  nginx
+$STD apt install -y nginx
 msg_ok "Installed Dependencies"

 NODE_VERSION="24" setup_nodejs
@@ -26,8 +24,6 @@ msg_info "Building OmniTools"
 cd /opt/omnitools
 export HUSKY=0
 $STD npm ci --allow-remote=all
-$STD git init -q
-$STD git -c user.name=build -c user.email=build@localhost commit -q --allow-empty -m build
 $STD npm run build
 msg_ok "Built OmniTools"

@@ -17,23 +17,19 @@ MAX_ATTEMPTS=3
 servers=("opencloud" "collabora" "wopi")
 attempt=0
 for server in "${servers[@]}"; do
-  fqdn_var="var_opencloud_${server}_fqdn"
-  fqdn="${!fqdn_var:-}"
  until ((attempt >= MAX_ATTEMPTS)); do
    attempt=$((attempt + 1))
-    [[ -n "$fqdn" ]] || read -rp "${TAB3}Enter the FQDN of your ${server^} server (ATTEMPT $attempt/$MAX_ATTEMPTS) (eg $server.domain.tld): " fqdn || { msg_error "No ${server^} FQDN given; set ${fqdn_var} or answer the prompt"; exit 64; }
+    read -rp "${TAB3}Enter the FQDN of your ${server^} server (ATTEMPT $attempt/$MAX_ATTEMPTS) (eg $server.domain.tld): " fqdn
    if [[ -z "$fqdn" ]]; then
      msg_warn "Domain cannot be empty!"
    elif [[ "$fqdn" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]]; then
      msg_warn "IP address not allowed! Please use a FQDN"
-      fqdn=""
    elif [[ "$fqdn" =~ ^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*\.[a-zA-Z]{2,}$ ]]; then
      export ${server^^}_FQDN="$fqdn"
      attempt=0
      break
    else
      msg_warn "Invalid domain format!"
-      fqdn=""
    fi
  done
  if ((attempt >= MAX_ATTEMPTS)); then
@@ -27,7 +27,7 @@ PYTHON_VERSION="3.12" setup_uv

 OTEL_ARGS=()
 prompt="${var_openwebui_otel:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install OpenTelemetry instrumentation packages (requires manual .env configuration)? <y/N> " prompt || true
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install OpenTelemetry instrumentation packages (requires manual .env configuration)? <y/N> " prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  for pkg in \
    opentelemetry-api \
@@ -57,7 +57,7 @@ done
 msg_ok "Installed Open WebUI"

 prompt="${var_openwebui_ollama:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Ollama? <y/N> " prompt || true
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Ollama? <y/N> " prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  if [[ "$(arch_resolve)" == "amd64" ]]; then
  msg_info "Setting up Intel® Repositories"
@@ -96,6 +96,10 @@ EOF
    }
  fi
  msg_ok "Installed Intel® Level Zero"
+
+  msg_info "Installing Intel® oneAPI Base Toolkit (Patience)"
+  $STD apt install -y --no-install-recommends intel-basekit-2024.1 2>/dev/null || true
+  msg_ok "Installed Intel® oneAPI Base Toolkit"
  fi

  msg_info "Installing Ollama"
@@ -27,22 +27,17 @@ apt_update_safe
 $STD apt install -y openziti-controller openziti-console </dev/null
 msg_ok "Installed openziti"

-prompt="${var_openziti_controller_autoconfig:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to go through the auto configuration now? <y/N>" prompt || true
+read -r -p "${TAB3}Would you like to go through the auto configuration now? <y/N>" prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  GEN_FQDN="controller.${LOCAL_IP}.sslip.io"
-  ZITI_CTRL_ADVERTISED_ADDRESS="${var_openziti_controller_fqdn:-}"
-  [[ -n "$ZITI_CTRL_ADVERTISED_ADDRESS" ]] || read -r -p "${TAB3}Please enter the controller FQDN [${GEN_FQDN}]: " ZITI_CTRL_ADVERTISED_ADDRESS || true
+  read -r -p "${TAB3}Please enter the controller FQDN [${GEN_FQDN}]: " ZITI_CTRL_ADVERTISED_ADDRESS
  ZITI_CTRL_ADVERTISED_ADDRESS=${ZITI_CTRL_ADVERTISED_ADDRESS:-$GEN_FQDN}
-  ZITI_CTRL_ADVERTISED_PORT="${var_openziti_controller_port:-}"
-  [[ -n "$ZITI_CTRL_ADVERTISED_PORT" ]] || read -r -p "${TAB3}Please enter the controller port [1280]: " ZITI_CTRL_ADVERTISED_PORT || true
+  read -r -p "${TAB3}Please enter the controller port [1280]: " ZITI_CTRL_ADVERTISED_PORT
  ZITI_CTRL_ADVERTISED_PORT=${ZITI_CTRL_ADVERTISED_PORT:-1280}
-  ZITI_USER="${var_openziti_controller_user:-}"
-  [[ -n "$ZITI_USER" ]] || read -r -p "${TAB3}Please enter the controller admin user [admin]: " ZITI_USER || true
+  read -r -p "${TAB3}Please enter the controller admin user [admin]: " ZITI_USER
  ZITI_USER=${ZITI_USER:-admin}
  GEN_PWD=$(head -c128 /dev/urandom | LC_ALL=C tr -dc 'A-Za-z0-9!@#$%^*_+~' | cut -c 1-12)
-  ZITI_PWD="${var_openziti_controller_password:-}"
-  [[ -n "$ZITI_PWD" ]] || read -r -p "${TAB3}Please enter the controller admin password [${GEN_PWD}]:" ZITI_PWD || true
+  read -r -p "${TAB3}Please enter the controller admin password [${GEN_PWD}]:" ZITI_PWD
  ZITI_PWD=${ZITI_PWD:-$GEN_PWD}
  CONFIG_FILE="/opt/openziti/etc/controller/bootstrap.env"
  sed -i "s|^ZITI_CTRL_ADVERTISED_ADDRESS=.*|ZITI_CTRL_ADVERTISED_ADDRESS='${ZITI_CTRL_ADVERTISED_ADDRESS}'|" "$CONFIG_FILE"
@@ -29,8 +29,7 @@ sed -i '0,/^ExecStart/ { /^ExecStart/ { n; s|^ExecStart.*|ExecStart=/opt/openzit
 systemctl daemon-reload
 msg_ok "Installed openziti"

-prompt="${var_openziti_tunnel_enrollment_token:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Please paste an identity enrollment token(JTW)" prompt || true
+read -r -p "${TAB3}Please paste an identity enrollment token(JTW)" prompt
 if [[ ${prompt} ]]; then
  msg_info "Adding identity"
  echo "${prompt}" >/opt/openziti/etc/identities/identity.jwt
@@ -27,13 +27,15 @@ fetch_and_deploy_gh_release "gerbil" "fosrl/gerbil" "singlefile" "latest" "/usr/
 fetch_and_deploy_gh_release "traefik" "traefik/traefik" "prebuild" "latest" "/usr/bin" "traefik_v*_linux_$(arch_resolve).tar.gz"

 pango_url="${var_pangolin_url:-}"
-[[ -n "$pango_url" ]] || read -rp "${TAB3}Enter your Pangolin URL (ex: https://pangolin.example.com): " pango_url || true
-[[ -n "$pango_url" ]] || { msg_error "No Pangolin URL given; set var_pangolin_url or answer the prompt"; exit 64; }
+if [[ -z "$pango_url" ]]; then
+  read -rp "${TAB3}Enter your Pangolin URL (ex: https://pangolin.example.com): " pango_url
+fi
 [[ "$pango_url" != https://* && "$pango_url" != http://* ]] && pango_url="https://${pango_url}"

 pango_email="${var_pangolin_email:-}"
-[[ -n "$pango_email" ]] || read -rp "${TAB3}Enter your email address: " pango_email || true
-[[ -n "$pango_email" ]] || { msg_error "No email address given; set var_pangolin_email or answer the prompt"; exit 64; }
+if [[ -z "$pango_email" ]]; then
+  read -rp "${TAB3}Enter your email address: " pango_email
+fi

 msg_info "Setup Pangolin"
 SECRET_KEY=$(random_password 32)
@@ -38,22 +38,16 @@ CGO_ENABLED=1 go build -tags musl -o paperless-gpt .
 msg_ok "Setup Paperless-GPT"

 mkdir -p /opt/paperless-gpt-data
-input_url="${var_paperless_gpt_enter_url:-}"
-[[ -n "$input_url" ]] || read -rp "${TAB3}Do you want to enter the Paperless local URL now? (y/n) " input_url || true
-if [[ $input_url =~ ^[Yy]([Ee][Ss])?$ ]]; then
-  PAPERLESS_BASE_URL="${var_paperless_gpt_url:-}"
-  [[ -n "$PAPERLESS_BASE_URL" ]] || read -rp "${TAB3}Enter your Paperless-NGX instance URL (e.g., http://192.168.1.100:8000): " PAPERLESS_BASE_URL || true
-  [[ -n "$PAPERLESS_BASE_URL" ]] || { msg_error "No Paperless-NGX URL given; set var_paperless_gpt_url or answer the prompt"; exit 64; }
+read -rp "${TAB3}Do you want to enter the Paperless local URL now? (y/n) " input_url
+if [[ $input_url =~ ^[Yy]$ ]]; then
+  read -rp "${TAB3}Enter your Paperless-NGX instance URL (e.g., http://192.168.1.100:8000): " PAPERLESS_BASE_URL
 else
  PAPERLESS_BASE_URL="http://your_paperless_ngx_url"
 fi

-input_token="${var_paperless_gpt_enter_token:-}"
-[[ -n "$input_token" ]] || read -rp "${TAB3}Do you want to enter the Paperless API token now? (y/n) " input_token || true
-if [[ $input_token =~ ^[Yy]([Ee][Ss])?$ ]]; then
-  PAPERLESS_API_TOKEN="${var_paperless_gpt_api_token:-}"
-  [[ -n "$PAPERLESS_API_TOKEN" ]] || read -rp "${TAB3}Enter your Paperless API token: " PAPERLESS_API_TOKEN || true
-  [[ -n "$PAPERLESS_API_TOKEN" ]] || { msg_error "No Paperless API token given; set var_paperless_gpt_api_token or answer the prompt"; exit 64; }
+read -rp "${TAB3}Do you want to enter the Paperless API token now? (y/n) " input_token
+if [[ $input_token =~ ^[Yy]$ ]]; then
+  read -rp "${TAB3}Enter your Paperless API token: " PAPERLESS_API_TOKEN
 else
  PAPERLESS_API_TOKEN="your_paperless_api_token"
 fi
@@ -52,7 +52,7 @@ msg_info "Setup Paperless-ngx"
 cd /opt/paperless
 rm -rf /opt/paperless/docker
 $STD uv sync --all-extras
-mkdir -p /opt/paperless_data/{consume,data,index,media,trash}
+mkdir -p /opt/paperless_data/{consume,data,media,trash}
 mkdir -p /opt/paperless/static
 SECRET_KEY="$(random_password 32)"
 cat <<EOF >~/paperless-ngx.creds
@@ -172,7 +172,7 @@ systemctl enable -q --now paperless-webserver paperless-scheduler paperless-task
 msg_ok "Created Services"

 prompt="${var_paperless_ngx_adminer:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Adminer? <y/N> " prompt || true
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Adminer? <y/N> " prompt
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
  setup_adminer
 fi
@@ -107,7 +107,7 @@ ExecStart=/opt/patchmon/patchmon-server
 Restart=always
 RestartSec=10
 Environment=PATH=/usr/bin:/usr/local/bin
-Environment=ENV_FILE=/opt/patchmon/.env
+EnvironmentFile=/opt/patchmon/.env
 NoNewPrivileges=true
 PrivateTmp=true
 ProtectSystem=strict
@@ -22,9 +22,7 @@ msg_ok "Installed Dependencies"
 msg_info "Installing Pi-hole"
 mkdir -p /etc/pihole
 touch /etc/pihole/pihole.toml
-curl_with_retry "https://install.pi-hole.net" /tmp/pihole-install.sh
-$STD bash /tmp/pihole-install.sh --unattended
-rm -f /tmp/pihole-install.sh
+$STD bash <(curl -fsSL https://install.pi-hole.net) --unattended
 sed -i -E '
 /^\s*upstreams =/ s|=.*|= ["8.8.8.8", "8.8.4.4"]|
 /^\s*interface =/ s|=.*|= "eth0"|
@@ -59,10 +57,10 @@ systemctl restart pihole-FTL.service
 msg_ok "Installed Pi-hole"

 prompt="${var_pihole_unbound:-}"
-[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Unbound? <y/N> " prompt || true
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Unbound? <y/N> " prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
  prompt="${var_pihole_unbound_dot:-}"
-  [[ -n "$prompt" ]] || read -r -p "${TAB3}Unbound is configured as a recursive DNS server by default, would you like it to be configured as a forwarding DNS server (using DNS-over-TLS (DoT)) instead? <y/N> " prompt || true
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Unbound is configured as a recursive DNS server by default, would you like it to be configured as a forwarding DNS server (using DNS-over-TLS (DoT)) instead? <y/N> " prompt
  msg_info "Installing Unbound"
  mkdir -p /etc/unbound/unbound.conf.d
  cat <<EOF >/etc/unbound/unbound.conf.d/pi-hole.conf
@@ -13,9 +13,7 @@ setting_up_container
 network_check
 update_os

-public_url="${var_pocketid_url:-}"
-[[ -n "$public_url" ]] || read -r -p "${TAB3}What public URL do you want to use (e.g. pocketid.mydomain.com)? " public_url || true
-[[ -n "$public_url" ]] || { msg_error "No public URL given; set var_pocketid_url or answer the prompt"; exit 64; }
+read -r -p "${TAB3}What public URL do you want to use (e.g. pocketid.mydomain.com)? " public_url
 fetch_and_deploy_gh_release "pocket-id" "pocket-id/pocket-id" "singlefile" "latest" "/opt/pocket-id/" "pocket-id_linux_$(arch_resolve)"

 msg_info "Configuring Pocket ID"
--- a/Show More
+++ b/Show More