fix(build.func): generalize OS version fallback for all distros

Refactor fallback_to_debian12() into fallback_to_previous_os_version()
which dynamically determines the previous major version for any OS type
(debian, ubuntu, alpine, fedora, rocky, centos) by scanning available
local and online templates. The 3-option menu in the LXC stack upgrade
prompt now shows for all OS types, not just Debian 13.

.github/workflows/pocketbase-bot.yml

@@ -337,8 +337,8 @@ jobs:
 
             if (infoMatch) {
               // ── INFO SUBCOMMAND ──────────────────────────────────────────────
-              const notesArr   = readJsonBlob(record.notes_json);
-              const methodsArr = readJsonBlob(record.install_methods_json);
+              const notesArr   = readJsonBlob(record.notes);
+              const methodsArr = readJsonBlob(record.install_methods);
 
               const out = [];
               out.push('ℹ️ **PocketBase Bot**: Info for **`' + slug + '`**\n');
@@ -382,13 +382,13 @@ jobs:
               // ── NOTE SUBCOMMAND ──────────────────────────────────────────────
               const noteAction  = noteMatch[1].toLowerCase();
               const noteArgsStr = rest.substring(noteMatch[0].length).trim();
-              let notesArr = readJsonBlob(record.notes_json);
+              let notesArr = readJsonBlob(record.notes);
 
               async function patchNotes(arr) {
                 const res = await request(recordsUrl + '/' + record.id, {
                   method: 'PATCH',
                   headers: { 'Authorization': token, 'Content-Type': 'application/json' },
-                  body: JSON.stringify({ notes_json: JSON.stringify(arr) })
+                  body: JSON.stringify({ notes: arr })
                 });
                 if (!res.ok) {
                   await addReaction('-1');
@@ -504,7 +504,7 @@ jobs:
               // ── METHOD SUBCOMMAND ────────────────────────────────────────────
               const methodArgs     = rest.replace(/^method\s*/i, '').trim();
               const methodListMode = !methodArgs || methodArgs.toLowerCase() === 'list';
-              let methodsArr = readJsonBlob(record.install_methods_json);
+              let methodsArr = readJsonBlob(record.install_methods);
 
               // Method field classification
               const RESOURCE_KEYS = { cpu: 'number', ram: 'number', hdd: 'number', os: 'string', version: 'string' };
@@ -526,7 +526,7 @@ jobs:
                 const res = await request(recordsUrl + '/' + record.id, {
                   method: 'PATCH',
                   headers: { 'Authorization': token, 'Content-Type': 'application/json' },
-                  body: JSON.stringify({ install_methods_json: arr })
+                  body: JSON.stringify({ install_methods: arr })
                 });
                 if (!res.ok) {
                   await addReaction('-1');

CHANGELOG.md

@@ -445,6 +445,33 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-04-20
+
+### 🚀 Updated Scripts
+
+  - pangolin: create migration tables before data transfer to prevent role loss [@MickLesk](https://github.com/MickLesk) ([#13874](https://github.com/community-scripts/ProxmoxVE/pull/13874))
+
+  - #### 🐞 Bug Fixes
+
+    - Pangolin: pre-apply schema migrations to prevent data loss [@MickLesk](https://github.com/MickLesk) ([#13861](https://github.com/community-scripts/ProxmoxVE/pull/13861))
+    - ActualBudget: change migration messages to warnings [@MickLesk](https://github.com/MickLesk) ([#13860](https://github.com/community-scripts/ProxmoxVE/pull/13860))
+    - slskd: migrate config keys for 0.25.0 breaking change [@MickLesk](https://github.com/MickLesk) ([#13862](https://github.com/community-scripts/ProxmoxVE/pull/13862))
+
+  - #### ✨ New Features
+
+    - Wanderer: add pocketbase CLI wrapper with env [@MickLesk](https://github.com/MickLesk) ([#13863](https://github.com/community-scripts/ProxmoxVE/pull/13863))
+
+  - #### 🔧 Refactor
+
+    - Several Scripts: Bump NodeJS to align Node.js versions with upstream for 5 scripts [@MickLesk](https://github.com/MickLesk) ([#13875](https://github.com/community-scripts/ProxmoxVE/pull/13875))
+    - Refactor: PMG Post Install [@MickLesk](https://github.com/MickLesk) ([#13693](https://github.com/community-scripts/ProxmoxVE/pull/13693))
+
+## 2026-04-19
+
+### 🆕 New Scripts
+
+  - nametag ([#13849](https://github.com/community-scripts/ProxmoxVE/pull/13849))
+
 ## 2026-04-18
 
 ### 🆕 New Scripts

ct/actualbudget.sh

@@ -48,9 +48,9 @@ function update_script() {
       msg_ok "Updated successfully!"
     fi
   else
-    msg_info "Old Installation Found, you need to migrate your data and recreate to a new container"
-    msg_info "Please follow the instructions on the Actual Budget website to migrate your data"
-    msg_info "https://actualbudget.org/docs/backup-restore/backup"
+    msg_warn "Old Installation Found, you need to migrate your data and recreate to a new container"
+    msg_warn "Please follow the instructions on the Actual Budget website to migrate your data"
+    msg_warn "https://actualbudget.org/docs/backup-restore/backup"
     exit
   fi
   exit

ct/headers/nametag

@@ -0,0 +1,6 @@
+    _   __                     __             
+   / | / /___ _____ ___  ___  / /_____ _____ _
+  /  |/ / __ `/ __ `__ \/ _ \/ __/ __ `/ __ `/
+ / /|  / /_/ / / / / / /  __/ /_/ /_/ / /_/ / 
+/_/ |_/\__,_/_/ /_/ /_/\___/\__/\__,_/\__, /  
+                                     /____/   

ct/iobroker.sh

@@ -27,6 +27,9 @@ function update_script() {
     msg_error "No ${APP} Installation Found!"
     exit
   fi
+
+  NODE_VERSION="24" setup_nodejs
+
   msg_info "Updating ${APP} LXC"
   $STD apt update
   $STD apt -y upgrade

ct/kima-hub.sh

@@ -29,6 +29,8 @@ function update_script() {
     exit
   fi
 
+  NODE_VERSION="22" setup_nodejs
+
   if check_for_gh_release "kima-hub" "Chevron7Locked/kima-hub"; then
     msg_info "Stopping Services"
     systemctl stop kima-frontend kima-backend kima-analyzer kima-analyzer-clap

ct/myip.sh

@@ -28,6 +28,8 @@ function update_script() {
     exit
   fi
 
+  NODE_VERSION="24" setup_nodejs
+
   if check_for_gh_release "myip" "jason5ng32/MyIP"; then
     msg_info "Stopping Services"
     systemctl stop myip

ct/nametag.sh

@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/mattogodoy/nametag
+
+APP="Nametag"
+var_tags="${var_tags:-contacts;crm}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/nametag ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "nametag" "mattogodoy/nametag"; then
+    msg_info "Stopping Service"
+    systemctl stop nametag
+    msg_ok "Stopped Service"
+
+    msg_info "Backing up Data"
+    cp /opt/nametag/.env /opt/nametag.env.bak
+    cp -r /opt/nametag/data /opt/nametag_data_bak
+    msg_ok "Backed up Data"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "nametag" "mattogodoy/nametag" "tarball" "latest" "/opt/nametag"
+
+    msg_info "Rebuilding Application"
+    cd /opt/nametag
+    $STD npm ci
+    set -a
+    source /opt/nametag/.env
+    set +a
+    $STD npx prisma generate
+    $STD npm run build
+    cp -r /opt/nametag/.next/static /opt/nametag/.next/standalone/.next/static
+    cp -r /opt/nametag/public /opt/nametag/.next/standalone/public
+    msg_ok "Rebuilt Application"
+
+    msg_info "Restoring Data"
+    cp /opt/nametag.env.bak /opt/nametag/.env
+    cp -r /opt/nametag_data_bak/. /opt/nametag/data/
+    rm -f /opt/nametag.env.bak
+    rm -rf /opt/nametag_data_bak
+    msg_ok "Restored Data"
+
+    msg_info "Running Migrations"
+    cd /opt/nametag
+    $STD npx prisma migrate deploy
+    msg_ok "Ran Migrations"
+
+    msg_info "Starting Service"
+    systemctl start nametag
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:3000${CL}"

ct/outline.sh

@@ -28,7 +28,7 @@ function update_script() {
     exit
   fi
 
-  NODE_VERSION="22" setup_nodejs
+  NODE_VERSION="24" setup_nodejs
 
   if check_for_gh_release "outline" "outline/outline"; then
     msg_info "Stopping Services"

ct/pangolin.sh

@@ -69,7 +69,33 @@ function update_script() {
 
     msg_info "Running database migrations"
     cd /opt/pangolin
-    ENVIRONMENT=prod $STD npx drizzle-kit push --config drizzle.sqlite.config.ts
+
+    # Pre-apply potentially destructive schema changes safely so drizzle-kit
+    # does not recreate tables (which would delete all rows).
+    local DB="/opt/pangolin/config/db/db.sqlite"
+    if [[ -f "$DB" ]]; then
+      sqlite3 "$DB" "ALTER TABLE 'orgs' ADD COLUMN 'settingsLogRetentionDaysConnection' integer DEFAULT 0 NOT NULL;" 2>/dev/null || true
+      sqlite3 "$DB" "ALTER TABLE 'clientSitesAssociationsCache' ADD COLUMN 'isJitMode' integer DEFAULT 0 NOT NULL;" 2>/dev/null || true
+
+      # Create new role-mapping tables and migrate data before drizzle-kit
+      # drops the roleId columns from userOrgs and userInvites.
+      sqlite3 "$DB" "CREATE TABLE IF NOT EXISTS 'userOrgRoles' (
+        'userId' text NOT NULL REFERENCES 'user'('id') ON DELETE CASCADE,
+        'orgId' text NOT NULL REFERENCES 'orgs'('orgId') ON DELETE CASCADE,
+        'roleId' integer NOT NULL REFERENCES 'roles'('roleId') ON DELETE CASCADE,
+        UNIQUE('userId', 'orgId', 'roleId')
+      );" 2>/dev/null || true
+      sqlite3 "$DB" "INSERT OR IGNORE INTO 'userOrgRoles' (userId, orgId, roleId) SELECT userId, orgId, roleId FROM 'userOrgs' WHERE roleId IS NOT NULL;" 2>/dev/null || true
+
+      sqlite3 "$DB" "CREATE TABLE IF NOT EXISTS 'userInviteRoles' (
+        'inviteId' text NOT NULL REFERENCES 'userInvites'('inviteId') ON DELETE CASCADE,
+        'roleId' integer NOT NULL REFERENCES 'roles'('roleId') ON DELETE CASCADE,
+        PRIMARY KEY('inviteId', 'roleId')
+      );" 2>/dev/null || true
+      sqlite3 "$DB" "INSERT OR IGNORE INTO 'userInviteRoles' (inviteId, roleId) SELECT inviteId, roleId FROM 'userInvites' WHERE roleId IS NOT NULL;" 2>/dev/null || true
+    fi
+
+    ENVIRONMENT=prod $STD npx drizzle-kit push --force --config drizzle.sqlite.config.ts
     msg_ok "Ran database migrations"
 
     msg_info "Updating Badger plugin version"

ct/shelfmark.sh

@@ -29,7 +29,7 @@ function update_script() {
     exit
   fi
 
-  NODE_VERSION="22" setup_nodejs
+  NODE_VERSION="24" setup_nodejs
   PYTHON_VERSION="3.12" setup_uv
 
   if check_for_gh_release "shelfmark" "calibrain/shelfmark"; then

ct/slskd.sh

@@ -43,6 +43,10 @@ function update_script() {
 
     msg_info "Restoring config"
     mv /opt/slskd.yml.bak /opt/slskd/config/slskd.yml
+
+    # Migrate 0.25.0 breaking config key renames
+    sed -i 's/^global:/transfers:/' /opt/slskd/config/slskd.yml
+    sed -i 's/^integration:/integrations:/' /opt/slskd/config/slskd.yml
     msg_ok "Restored config"
 
     msg_info "Starting Service(s)"

install/iobroker-install.sh

@@ -28,7 +28,7 @@ if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
   exit 10
 fi
 
-NODE_VERSION="22" setup_nodejs
+NODE_VERSION="24" setup_nodejs
 
 msg_info "Installing ioBroker (Patience)"
 $STD bash <(curl -fsSL https://iobroker.net/install.sh)

install/kima-hub-install.sh

@@ -28,7 +28,7 @@ msg_ok "Installed Dependencies"
 
 PG_VERSION="16" PG_MODULES="pgvector" setup_postgresql
 PG_DB_NAME="kima" PG_DB_USER="kima" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db
-NODE_VERSION="20" setup_nodejs
+NODE_VERSION="22" setup_nodejs
 
 msg_info "Configuring Redis"
 systemctl enable -q --now redis-server

install/myip-install.sh

@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os
 
-NODE_VERSION="22" setup_nodejs
+NODE_VERSION="24" setup_nodejs
 fetch_and_deploy_gh_release "myip" "jason5ng32/MyIP" "tarball"
 
 msg_info "Configuring MyIP"

install/nametag-install.sh

@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/mattogodoy/nametag
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+PG_VERSION="16" setup_postgresql
+PG_DB_NAME="nametag_db" PG_DB_USER="nametag" setup_postgresql_db
+NODE_VERSION="20" setup_nodejs
+fetch_and_deploy_gh_release "nametag" "mattogodoy/nametag" "tarball" "latest" "/opt/nametag"
+
+msg_info "Setting up Application"
+cd /opt/nametag
+$STD npm ci
+DATABASE_URL="postgresql://${PG_DB_USER}:${PG_DB_PASS}@127.0.0.1:5432/${PG_DB_NAME}" $STD npx prisma generate
+DATABASE_URL="postgresql://${PG_DB_USER}:${PG_DB_PASS}@127.0.0.1:5432/${PG_DB_NAME}" $STD npx prisma migrate deploy
+msg_ok "Set up Application"
+
+msg_info "Configuring Nametag"
+NEXTAUTH_SECRET=$(openssl rand -base64 32)
+CRON_SECRET=$(openssl rand -base64 16)
+mkdir -p /opt/nametag/data/photos
+cat <<EOF >/opt/nametag/.env
+DATABASE_URL=postgresql://${PG_DB_USER}:${PG_DB_PASS}@127.0.0.1:5432/${PG_DB_NAME}
+NEXTAUTH_URL=http://${LOCAL_IP}:3000
+NEXTAUTH_SECRET=${NEXTAUTH_SECRET}
+CRON_SECRET=${CRON_SECRET}
+PHOTO_STORAGE_PATH=/opt/nametag/data/photos
+NODE_ENV=production
+EOF
+msg_ok "Configured Nametag"
+
+msg_info "Building Application"
+cd /opt/nametag
+set -a
+source /opt/nametag/.env
+set +a
+$STD npm run build
+cp -r /opt/nametag/.next/static /opt/nametag/.next/standalone/.next/static
+cp -r /opt/nametag/public /opt/nametag/.next/standalone/public
+msg_ok "Built Application"
+
+msg_info "Running Production Seed"
+cd /opt/nametag
+$STD npx esbuild prisma/seed.production.ts --platform=node --format=cjs --outfile=prisma/seed.production.js --bundle --external:@prisma/client --external:pg --minify
+$STD node prisma/seed.production.js
+msg_ok "Ran Production Seed"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/nametag.service
+[Unit]
+Description=Nametag - Personal Relationships Manager
+After=network.target postgresql.service
+
+[Service]
+Type=simple
+WorkingDirectory=/opt/nametag
+EnvironmentFile=/opt/nametag/.env
+ExecStart=/usr/bin/node /opt/nametag/.next/standalone/server.js
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now nametag
+msg_ok "Created Service"
+
+msg_info "Setting up Cron Jobs"
+cat <<EOF >/etc/cron.d/nametag
+0 8 * * * root curl -sf -H "Authorization: Bearer ${CRON_SECRET}" http://127.0.0.1:3000/api/cron/send-reminders >/dev/null 2>&1
+0 3 * * * root curl -sf -H "Authorization: Bearer ${CRON_SECRET}" http://127.0.0.1:3000/api/cron/purge-deleted >/dev/null 2>&1
+EOF
+chmod 644 /etc/cron.d/nametag
+msg_ok "Set up Cron Jobs"
+
+motd_ssh
+customize
+cleanup_lxc

install/outline-install.sh

@@ -20,7 +20,7 @@ $STD apt install -y \
   redis
 msg_ok "Installed Dependencies"
 
-NODE_VERSION="22" setup_nodejs
+NODE_VERSION="24" setup_nodejs
 PG_VERSION="16" setup_postgresql
 PG_DB_NAME="outline" PG_DB_USER="outline" setup_postgresql_db
 

install/shelfmark-install.sh

@@ -115,7 +115,7 @@ else
   msg_ok "Installed internal bypasser dependencies"
 fi
 
-NODE_VERSION="22" setup_nodejs
+NODE_VERSION="24" setup_nodejs
 PYTHON_VERSION="3.12" setup_uv
 
 fetch_and_deploy_gh_release "shelfmark" "calibrain/shelfmark" "tarball" "latest" "/opt/shelfmark"

install/wanderer-install.sh

@@ -60,6 +60,16 @@ wait -n
 EOF
 chmod +x /opt/wanderer/start.sh
 
+cat <<'EOF' >/usr/local/bin/wanderer-pb
+#!/usr/bin/env bash
+set -a
+source /opt/wanderer/.env
+set +a
+cd /opt/wanderer/source/db
+exec ./pocketbase "$@" --dir="$PB_DB_LOCATION"
+EOF
+chmod +x /usr/local/bin/wanderer-pb
+
 cat <<EOF >/etc/systemd/system/wanderer-web.service
 [Unit]
 Description=wanderer

misc/build.func

@@ -3658,7 +3658,7 @@ build_container() {
     local _mount_clean="${ALLOW_MOUNT_FS// /}"
     _mount_clean="${_mount_clean%%,}"
     _mount_clean="${_mount_clean##,}"
-    _mount_clean="${_mount_clean%%;}"  
+    _mount_clean="${_mount_clean%%;}"
     _mount_clean="${_mount_clean//,/;}"
     if [ -n "$_mount_clean" ]; then
       [ -n "$FEATURES" ] && FEATURES="$FEATURES,"
@@ -5250,9 +5250,133 @@ create_lxc_container() {
   # Extract Debian OS minor from template name: debian-13-standard_13.1-1_amd64.tar.zst => "13.1"
   parse_template_osver() { sed -n 's/.*_\([0-9][0-9]*\(\.[0-9]\+\)\?\)-.*/\1/p' <<<"$1"; }
 
+  # Switch to the previous OS major version template and retry pct create
+  # Determines the fallback version automatically based on available templates.
+  # Returns: 0 = success, 1 = failed
+  fallback_to_previous_os_version() {
+    local old_template="$TEMPLATE"
+    local os_type="${PCT_OSTYPE:-}"
+    local current_ver="${PCT_OSVERSION:-}"
+
+    # Determine template search pattern based on OS type
+    local tpl_pattern=""
+    case "$os_type" in
+    debian | ubuntu) tpl_pattern="-standard_" ;;
+    alpine | fedora | rocky | centos) tpl_pattern="-default_" ;;
+    *) tpl_pattern="" ;;
+    esac
+
+    msg_info "Searching for an older $os_type template (current: $os_type $current_ver)"
+
+    # Collect all available versions for this OS type (local + online)
+    local -a all_versions=()
+
+    # Local templates
+    mapfile -t _local_vers < <(
+      pveam list "$TEMPLATE_STORAGE" 2>/dev/null |
+        awk -v os="$os_type" -v pat="$tpl_pattern" '$1 ~ ("^"os"|/"os) && $1 ~ pat {print $1}' |
+        sed 's|.*/||' |
+        sed -E "s/^${os_type}-([0-9]+(\.[0-9]+)?).*/\1/" |
+        sort -u -V
+    )
+    all_versions+=("${_local_vers[@]}")
+
+    # Online templates (only if needed)
+    if command -v timeout &>/dev/null; then
+      timeout 30 pveam update >/dev/null 2>&1 || true
+    else
+      pveam update >/dev/null 2>&1 || true
+    fi
+    mapfile -t _online_vers < <(
+      pveam available -section system 2>/dev/null |
+        awk '{print $2}' |
+        grep -E "^${os_type}-[0-9]" |
+        { [[ -n "$tpl_pattern" ]] && grep "$tpl_pattern" || cat; } |
+        sed -E "s/^${os_type}-([0-9]+(\.[0-9]+)?).*/\1/" |
+        sort -u -V 2>/dev/null || true
+    )
+    all_versions+=("${_online_vers[@]}")
+
+    # Deduplicate and sort, find the highest version below current
+    local fallback_ver=""
+    fallback_ver=$(printf '%s\n' "${all_versions[@]}" | sort -u -V | awk -v cur="$current_ver" '{
+      # Compare major versions: extract major part
+      split($0, a, ".")
+      split(cur, b, ".")
+      if (a[1]+0 < b[1]+0) ver=$0
+    } END { if (ver) print ver }')
+
+    if [[ -z "$fallback_ver" ]]; then
+      msg_error "No older $os_type template version found."
+      return 1
+    fi
+
+    msg_ok "Fallback version: $os_type $fallback_ver"
+
+    # Find the actual template file for this version
+    local fallback_search="${os_type}-${fallback_ver}"
+    local fallback_template=""
+
+    # Check local first
+    mapfile -t _fb_local < <(
+      pveam list "$TEMPLATE_STORAGE" 2>/dev/null |
+        awk -v search="$fallback_search" -v pat="$tpl_pattern" '$1 ~ search && $1 ~ pat {print $1}' |
+        sed 's|.*/||' | sort -t - -k 2 -V
+    )
+    if [[ ${#_fb_local[@]} -gt 0 ]]; then
+      fallback_template="${_fb_local[-1]}"
+    else
+      # Check online
+      mapfile -t _fb_online < <(
+        pveam available -section system 2>/dev/null |
+          awk '{print $2}' |
+          grep -E "^${fallback_search}.*${tpl_pattern}" |
+          sort -t - -k 2 -V 2>/dev/null || true
+      )
+      [[ ${#_fb_online[@]} -gt 0 ]] && fallback_template="${_fb_online[-1]}"
+    fi
+
+    if [[ -z "$fallback_template" ]]; then
+      msg_error "No template found for $os_type $fallback_ver."
+      return 1
+    fi
+
+    msg_ok "Found template: $fallback_template"
+
+    # Download if needed
+    local fallback_path
+    fallback_path="$(pvesm path "$TEMPLATE_STORAGE:vztmpl/$fallback_template" 2>/dev/null || true)"
+    [[ -z "$fallback_path" ]] && fallback_path="/var/lib/vz/template/cache/$fallback_template"
+
+    if [[ ! -f "$fallback_path" ]]; then
+      msg_info "Downloading $os_type $fallback_ver template"
+      if ! pveam download "$TEMPLATE_STORAGE" "$fallback_template" >>"${BUILD_LOG:-/dev/null}" 2>&1; then
+        msg_error "Failed to download $os_type $fallback_ver template."
+        return 1
+      fi
+      msg_ok "Template downloaded"
+    fi
+
+    # Update variables
+    TEMPLATE="$fallback_template"
+    TEMPLATE_PATH="$fallback_path"
+    PCT_OSVERSION="$fallback_ver"
+    export PCT_OSVERSION
+
+    # Retry pct create
+    msg_info "Retrying container creation with $os_type $fallback_ver"
+    if pct create "$CTID" "${TEMPLATE_STORAGE}:vztmpl/${TEMPLATE}" $PCT_OPTIONS >>"$LOGFILE" 2>&1; then
+      msg_ok "Container created successfully with $os_type $fallback_ver (fallback from $old_template)."
+      return 0
+    else
+      msg_error "Container creation with $os_type $fallback_ver also failed. See $LOGFILE"
+      return 1
+    fi
+  }
+
   # Offer upgrade for pve-container/lxc-pve if candidate > installed; optional auto-retry pct create
   # Returns:
-  #   0 = no upgrade needed
+  #   0 = no upgrade needed / container created after upgrade or fallback
   #   1 = upgraded (and if do_retry=yes and retry succeeded, creation done)
   #   2 = user declined
   #   3 = upgrade attempted but failed OR retry failed
@@ -5280,13 +5404,58 @@ create_lxc_container() {
     echo "  pve-container: installed=${_pvec_i:-n/a}  candidate=${_pvec_c:-n/a}"
     echo "  lxc-pve     : installed=${_lxcp_i:-n/a}  candidate=${_lxcp_c:-n/a}"
     echo
-    read -rp "Do you want to upgrade now? [y/N] " _ans </dev/tty
+
+    # Offer older OS version fallback when template version might be too new for LXC stack
+    local _has_fallback_option=false
+    if [[ -n "${PCT_OSTYPE:-}" && -n "${PCT_OSVERSION:-}" ]]; then
+      _has_fallback_option=true
+      echo "  [1] Upgrade LXC stack now (recommended)"
+      echo "  [2] Use an older ${PCT_OSTYPE} template instead (may not work with all scripts)"
+      echo "  [3] Cancel"
+      echo
+      read -rp "Select option [1/2/3]: " _ans </dev/tty
+    else
+      read -rp "Do you want to upgrade now? [y/N] " _ans </dev/tty
+    fi
+
+    if [[ "$_has_fallback_option" == true ]]; then
+      case "$_ans" in
+      1)
+        _ans="y"
+        ;;
+      2)
+        if [[ "$do_retry" == "yes" ]]; then
+          if fallback_to_previous_os_version; then
+            return 0
+          else
+            return 3
+          fi
+        else
+          msg_custom "ℹ️" "${YW}" "OS version fallback is only available during container creation."
+          return 2
+        fi
+        ;;
+      *)
+        return 2
+        ;;
+      esac
+    fi
+
     case "${_ans,,}" in
     y | yes)
       msg_info "Upgrading Proxmox LXC stack (pve-container, lxc-pve)"
       apt_update_safe
       if $STD apt-get install -y --only-upgrade pve-container lxc-pve; then
         msg_ok "LXC stack upgraded."
+        # Verify pct binary still works after upgrade (partial upgrades can break Perl modules)
+        if ! pct list &>/dev/null; then
+          msg_error "LXC stack upgrade caused PVE tool breakage (likely Perl module incompatibility)."
+          msg_custom "⚠️" "${YW}" "A partial package upgrade has left the PVE stack in an inconsistent state."
+          msg_custom "🔧" "${YW}" "Please run the following on the Proxmox host, then retry:"
+          echo -e "${TAB}  apt update && apt dist-upgrade -y"
+          echo -e "${TAB}  reboot"
+          return 3
+        fi
         if [[ "$do_retry" == "yes" ]]; then
           msg_info "Retrying container creation after upgrade"
           if pct create "$CTID" "${TEMPLATE_STORAGE}:vztmpl/${TEMPLATE}" $PCT_OPTIONS >>"$LOGFILE" 2>&1; then
@@ -5385,10 +5554,35 @@ create_lxc_container() {
   fi
 
   msg_info "Validating storage '$CONTAINER_STORAGE'"
-  STORAGE_TYPE=$(grep -E "^[^:]+: $CONTAINER_STORAGE$" /etc/pve/storage.cfg | cut -d: -f1 | head -1 || true)
+  # Check if storage.cfg is accessible (pmxcfs must be mounted)
+  if [[ ! -f /etc/pve/storage.cfg ]]; then
+    if ! mountpoint -q /etc/pve 2>/dev/null; then
+      msg_error "Proxmox cluster filesystem (pmxcfs) is not mounted at /etc/pve."
+      msg_custom "🔧" "${YW}" "Try: systemctl restart pve-cluster"
+    else
+      msg_error "/etc/pve/storage.cfg does not exist."
+      msg_custom "🔧" "${YW}" "Check Proxmox cluster filesystem integrity: pvecm status"
+    fi
+    exit 213
+  fi
+
+  STORAGE_TYPE=$(grep -E "^[^:]+:[[:space:]]*$CONTAINER_STORAGE[[:space:]]*$" /etc/pve/storage.cfg | cut -d: -f1 | head -1 || true)
+
+  # Fallback: use pvesm status to determine storage type
+  if [[ -z "$STORAGE_TYPE" ]]; then
+    STORAGE_TYPE=$(pvesm status -storage "$CONTAINER_STORAGE" 2>/dev/null | awk 'NR>1{print $2}')
+  fi
 
   if [[ -z "$STORAGE_TYPE" ]]; then
     msg_error "Storage '$CONTAINER_STORAGE' not found in /etc/pve/storage.cfg"
+    msg_custom "📋" "${YW}" "Available storages: $(pvesm status 2>/dev/null | awk 'NR>1{printf "%s (%s) ", $1, $2}' || echo 'n/a')"
+    if [[ -r /etc/pve/storage.cfg ]]; then
+      msg_custom "📋" "${YW}" "Storage definitions found in config:"
+      grep -E '^[a-z]+:' /etc/pve/storage.cfg 2>/dev/null | while IFS= read -r _line; do
+        echo "${TAB}  $_line"
+      done
+    fi
+    msg_custom "📖" "${YW}" "See https://pve.proxmox.com/wiki/Storage for storage configuration details."
     exit 213
   fi
 
@@ -5811,6 +6005,17 @@ create_lxc_container() {
   if ! pct create "$CTID" "${TEMPLATE_STORAGE}:vztmpl/${TEMPLATE}" $PCT_OPTIONS >"$LOGFILE" 2>&1; then
     msg_debug "Container creation failed on ${TEMPLATE_STORAGE}. Checking error..."
 
+    # Check for Perl module breakage (partial PVE upgrade)
+    if grep -qiE 'Compilation failed|Bareword.*not allowed' "$LOGFILE"; then
+      msg_error "Container creation failed due to broken Perl modules on the PVE host."
+      msg_custom "⚠️" "${YW}" "This usually happens after a partial PVE package upgrade."
+      msg_custom "🔧" "${YW}" "Please run the following on the Proxmox host, then retry:"
+      echo -e "${TAB}  apt update && apt dist-upgrade -y"
+      echo -e "${TAB}  reboot"
+      _flush_pct_log
+      exit 232
+    fi
+
     # Check if CTID collision (race condition: ID claimed between validation and creation)
     if grep -qiE 'already exists|already in use' "$LOGFILE"; then
       local old_ctid="$CTID"
@@ -5856,15 +6061,16 @@ create_lxc_container() {
               rc=$?
               case $rc in
               0) : ;; # success - container created, continue
-              2)
-                msg_error "Upgrade declined. Please update and re-run: apt update && apt install --only-upgrade pve-container lxc-pve"
-                _flush_pct_log
-                exit 231
-                ;;
-              3)
-                msg_error "Upgrade and/or retry failed. Please inspect: $LOGFILE"
-                _flush_pct_log
-                exit 231
+              2 | 3)
+                # Upgrade declined or failed — try older OS version as last resort
+                msg_warn "Attempting older ${PCT_OSTYPE:-} version as last resort"
+                if fallback_to_previous_os_version; then
+                  : # success
+                else
+                  msg_error "All recovery options exhausted. Please inspect: $LOGFILE"
+                  _flush_pct_log
+                  exit 231
+                fi
                 ;;
               esac
             else
@@ -5888,15 +6094,16 @@ create_lxc_container() {
             rc=$?
             case $rc in
             0) : ;; # success - container created, continue
-            2)
-              msg_error "Upgrade declined. Please update and re-run: apt update && apt install --only-upgrade pve-container lxc-pve"
-              _flush_pct_log
-              exit 231
-              ;;
-            3)
-              msg_error "Upgrade and/or retry failed. Please inspect: $LOGFILE"
-              _flush_pct_log
-              exit 231
+            2 | 3)
+              # Upgrade declined or failed — try older OS version as last resort
+              msg_warn "Attempting older ${PCT_OSTYPE:-} version as last resort"
+              if fallback_to_previous_os_version; then
+                : # success
+              else
+                msg_error "All recovery options exhausted. Please inspect: $LOGFILE"
+                _flush_pct_log
+                exit 231
+              fi
               ;;
             esac
           else
@@ -5915,7 +6122,7 @@ create_lxc_container() {
       fi
     fi # close CTID collision else-branch
   fi
-  set +f  # re-enable globbing after pct create block
+  set +f # re-enable globbing after pct create block
 
   # Verify container exists (allow up to 10s for pmxcfs sync in clusters)
   local _pct_visible=false

tools/pve/post-pmg-install.sh

@@ -47,7 +47,8 @@ msg_error() {
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/api.func) 2>/dev/null || true
 declare -f init_tool_telemetry &>/dev/null && init_tool_telemetry "post-pmg-install" "pve"
 
-if ! grep -q "Proxmox Mail Gateway" /etc/issue 2>/dev/null; then
+if ! dpkg -s proxmox-mailgateway-container >/dev/null 2>&1 &&
+  ! dpkg -s proxmox-mailgateway >/dev/null 2>&1; then
   msg_error "This script is only intended for Proxmox Mail Gateway"
   exit 232
 fi
@@ -57,14 +58,24 @@ repo_state() {
   local repo="$1"
   local file=""
   local state="missing"
-  for f in /etc/apt/sources.list /etc/apt/sources.list.d/*.list; do
+  for f in /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources; do
     [[ -f "$f" ]] || continue
     if grep -q "$repo" "$f"; then
       file="$f"
-      if grep -qE "^[^#].*${repo}" "$f"; then
-        state="active"
-      elif grep -qE "^#.*${repo}" "$f"; then
-        state="disabled"
+      if [[ "$f" == *.sources ]]; then
+        # deb822 format: check Enabled field
+        if grep -qiE '^Enabled:\s*no' "$f"; then
+          state="disabled"
+        else
+          state="active"
+        fi
+      else
+        # legacy format
+        if grep -qE "^[^#].*${repo}" "$f"; then
+          state="active"
+        elif grep -qE "^#.*${repo}" "$f"; then
+          state="disabled"
+        fi
       fi
       break
     fi
@@ -72,6 +83,28 @@ repo_state() {
   echo "$state $file"
 }
 
+toggle_repo() {
+  # $1 = file, $2 = action (enable|disable)
+  local file="$1" action="$2"
+  if [[ "$file" == *.sources ]]; then
+    if [[ "$action" == "disable" ]]; then
+      if grep -qiE '^Enabled:' "$file"; then
+        sed -i 's/^Enabled:.*/Enabled: no/' "$file"
+      else
+        echo "Enabled: no" >>"$file"
+      fi
+    else
+      sed -i 's/^Enabled:.*/Enabled: yes/' "$file"
+    fi
+  else
+    if [[ "$action" == "disable" ]]; then
+      sed -i '/^[^#]/s/^/# /' "$file"
+    else
+      sed -i 's/^# *//' "$file"
+    fi
+  fi
+}
+
 start_routines() {
   header_info
   VERSION="$(awk -F'=' '/^VERSION_CODENAME=/{ print $NF }' /etc/os-release)"
@@ -84,11 +117,20 @@ start_routines() {
   case $CHOICE in
   yes)
     msg_info "Correcting Debian Sources"
-    cat <<EOF >/etc/apt/sources.list
-deb http://deb.debian.org/debian ${VERSION} main contrib
-deb http://deb.debian.org/debian ${VERSION}-updates main contrib
-deb http://security.debian.org/debian-security ${VERSION}-security main contrib
+    cat <<EOF >/etc/apt/sources.list.d/debian.sources
+Types: deb
+URIs: http://deb.debian.org/debian
+Suites: ${VERSION} ${VERSION}-updates
+Components: main contrib non-free non-free-firmware
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
+
+Types: deb
+URIs: http://security.debian.org/debian-security
+Suites: ${VERSION}-security
+Components: main contrib non-free non-free-firmware
+Signed-By: /usr/share/keyrings/debian-archive-keyring.gpg
 EOF
+    rm -f /etc/apt/sources.list
     msg_ok "Corrected Debian Sources"
     ;;
   no) msg_error "Selected no to Correcting Debian Sources" ;;
@@ -108,7 +150,7 @@ EOF
     keep) msg_ok "Kept 'pmg-enterprise' repository" ;;
     disable)
       msg_info "Disabling 'pmg-enterprise' repository"
-      sed -i "s/^[^#].*pmg-enterprise/# &/" "$file"
+      toggle_repo "$file" disable
       msg_ok "Disabled 'pmg-enterprise' repository"
       ;;
     delete)
@@ -128,7 +170,7 @@ EOF
     case $CHOICE in
     enable)
       msg_info "Enabling 'pmg-enterprise' repository"
-      sed -i "s/^#.*pmg-enterprise/deb/" "$file"
+      toggle_repo "$file" enable
       msg_ok "Enabled 'pmg-enterprise' repository"
       ;;
     keep) msg_ok "Kept 'pmg-enterprise' repository disabled" ;;
@@ -149,8 +191,12 @@ EOF
     case $CHOICE in
     yes)
       msg_info "Adding 'pmg-enterprise' repository"
-      cat >/etc/apt/sources.list.d/pmg-enterprise.list <<EOF
-deb https://enterprise.proxmox.com/debian/pmg ${VERSION} pmg-enterprise
+      cat >/etc/apt/sources.list.d/pmg-enterprise.sources <<EOF
+Types: deb
+URIs: https://enterprise.proxmox.com/debian/pmg
+Suites: ${VERSION}
+Components: pmg-enterprise
+Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
 EOF
       msg_ok "Added 'pmg-enterprise' repository"
       ;;
@@ -173,7 +219,7 @@ EOF
     keep) msg_ok "Kept 'pmg-no-subscription' repository" ;;
     disable)
       msg_info "Disabling 'pmg-no-subscription' repository"
-      sed -i "s/^[^#].*pmg-no-subscription/# &/" "$file"
+      toggle_repo "$file" disable
       msg_ok "Disabled 'pmg-no-subscription' repository"
       ;;
     delete)
@@ -193,7 +239,7 @@ EOF
     case $CHOICE in
     enable)
       msg_info "Enabling 'pmg-no-subscription' repository"
-      sed -i "s/^#.*pmg-no-subscription/deb/" "$file"
+      toggle_repo "$file" enable
       msg_ok "Enabled 'pmg-no-subscription' repository"
       ;;
     keep) msg_ok "Kept 'pmg-no-subscription' repository disabled" ;;
@@ -213,8 +259,12 @@ EOF
     case $CHOICE in
     yes)
       msg_info "Adding 'pmg-no-subscription' repository"
-      cat >/etc/apt/sources.list.d/pmg-install-repo.list <<EOF
-deb http://download.proxmox.com/debian/pmg ${VERSION} pmg-no-subscription
+      cat >/etc/apt/sources.list.d/pmg-no-subscription.sources <<EOF
+Types: deb
+URIs: http://download.proxmox.com/debian/pmg
+Suites: ${VERSION}
+Components: pmg-no-subscription
+Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
 EOF
       msg_ok "Added 'pmg-no-subscription' repository"
       ;;
@@ -236,8 +286,13 @@ EOF
     case $CHOICE in
     yes)
       msg_info "Adding 'pmgtest' repository (disabled)"
-      cat >/etc/apt/sources.list.d/pmgtest-for-beta.list <<EOF
-# deb http://download.proxmox.com/debian/pmg ${VERSION} pmgtest
+      cat >/etc/apt/sources.list.d/pmgtest.sources <<EOF
+Types: deb
+URIs: http://download.proxmox.com/debian/pmg
+Suites: ${VERSION}
+Components: pmgtest
+Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
+Enabled: no
 EOF
       msg_ok "Added 'pmgtest' repository"
       ;;