Harden OPNsense build wait detection

Improves VM install completion detection by encapsulating screendump hashing in a helper, clearing stale dump files, and trying both `qm monitor` and `pvesh` monitor paths. The stability check now tolerates alternating A/B frames from a blinking login cursor instead of requiring one identical frame. It also adds elapsed-time progress output and a safe fallback to a fixed 12-minute wait when screendumps are unavailable, avoiding false completion or endless polling.

CHANGELOG.md

@@ -505,42 +505,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
-## 2026-07-22
-
-### 🆕 New Scripts
-
-  - pve-tool: storage share helper script for Proxmox [@MickLesk](https://github.com/MickLesk) ([#15869](https://github.com/community-scripts/ProxmoxVE/pull/15869))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - InvoiceNinja: preserve and Re-download snappdf Chromium [@MickLesk](https://github.com/MickLesk) ([#15956](https://github.com/community-scripts/ProxmoxVE/pull/15956))
-    - Anytype: preserve default mongod.conf when configuring Anytype replica set [@MickLesk](https://github.com/MickLesk) ([#15954](https://github.com/community-scripts/ProxmoxVE/pull/15954))
-    - Nametag: fix missing tailwindcss module [@MickLesk](https://github.com/MickLesk) ([#15955](https://github.com/community-scripts/ProxmoxVE/pull/15955))
-
-  - #### ✨ New Features
-
-    - OPNSense: Bump FreeBSD to 15 and OPNSense to 26.7 [@MickLesk](https://github.com/MickLesk) ([#15943](https://github.com/community-scripts/ProxmoxVE/pull/15943))
-
-### 💾 Core
-
-  - #### ✨ New Features
-
-    - core: add OS mismatch guard for container updates [@MickLesk](https://github.com/MickLesk) ([#15948](https://github.com/community-scripts/ProxmoxVE/pull/15948))
-
-## 2026-07-21
-
-### 🚀 Updated Scripts
-
-  - #### ✨ New Features
-
-    - Pangolin: Bump Version to 1.21.0 [@MickLesk](https://github.com/MickLesk) ([#15938](https://github.com/community-scripts/ProxmoxVE/pull/15938))
-
-  - #### 🔧 Refactor
-
-    - Standardize CT update backup handling [@MickLesk](https://github.com/MickLesk) ([#15937](https://github.com/community-scripts/ProxmoxVE/pull/15937))
-
 ## 2026-07-20
 
 ### 🚀 Updated Scripts

ct/affine.sh

@@ -42,6 +42,8 @@ function update_script() {
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "${RELEASE}" "/opt/affine"
 
+    # Restore BEFORE the build: CLEAN_INSTALL wiped /opt/affine including .env,
+    # and the build below sources it
     restore_backup
 
     if [[ ! -f /opt/affine/.env ]]; then

ct/alpine-cinny.sh

@@ -30,11 +30,16 @@ function update_script() {
   fi
 
   if check_for_gh_release "cinny" "cinnyapp/cinny"; then
-    create_backup /opt/cinny/config.json
+    msg_info "Backing up Configuration"
+    cp /opt/cinny/config.json /opt/cinny_config.json.bak
+    msg_ok "Backed up Configuration"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "cinny" "cinnyapp/cinny" "prebuild" "latest" "/opt/cinny" "cinny-*.tar.gz"
 
-    restore_backup
+    msg_info "Restoring Configuration"
+    cp /opt/cinny_config.json.bak /opt/cinny/config.json
+    rm -f /opt/cinny_config.json.bak
+    msg_ok "Restored Configuration"
 
     msg_info "Restarting nginx"
     $STD rc-service nginx restart

ct/dispatcharr.sh

@@ -116,10 +116,21 @@ EOF
 
     msg_info "Creating Backup"
     BACKUP_FILE="/opt/dispatcharr_backup_$(date +%F_%H-%M-%S).tar.gz"
+    if [[ -f /opt/dispatcharr/.env ]]; then
+      cp /opt/dispatcharr/.env /tmp/dispatcharr.env.backup
+    fi
     if [[ -f /opt/dispatcharr/start-gunicorn.sh ]]; then
       rm -f /opt/dispatcharr/start-gunicorn.sh
     fi
-    create_backup /opt/dispatcharr/.env /opt/dispatcharr/start-celery.sh /opt/dispatcharr/start-celerybeat.sh /opt/dispatcharr/start-daphne.sh
+    if [[ -f /opt/dispatcharr/start-celery.sh ]]; then
+      cp /opt/dispatcharr/start-celery.sh /tmp/start-celery.sh.backup
+    fi
+    if [[ -f /opt/dispatcharr/start-celerybeat.sh ]]; then
+      cp /opt/dispatcharr/start-celerybeat.sh /tmp/start-celerybeat.sh.backup
+    fi
+    if [[ -f /opt/dispatcharr/start-daphne.sh ]]; then
+      cp /opt/dispatcharr/start-daphne.sh /tmp/start-daphne.sh.backup
+    fi
     if [[ -f /opt/dispatcharr/.env ]]; then
       set -o allexport
       source /opt/dispatcharr/.env
@@ -134,9 +145,20 @@ EOF
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "dispatcharr" "Dispatcharr/Dispatcharr" "tarball"
 
-    restore_backup
-
     msg_info "Updating Dispatcharr Backend"
+    if [[ -f /tmp/dispatcharr.env.backup ]]; then
+      mv /tmp/dispatcharr.env.backup /opt/dispatcharr/.env
+    fi
+    if [[ -f /tmp/start-celery.sh.backup ]]; then
+      mv /tmp/start-celery.sh.backup /opt/dispatcharr/start-celery.sh
+    fi
+    if [[ -f /tmp/start-celerybeat.sh.backup ]]; then
+      mv /tmp/start-celerybeat.sh.backup /opt/dispatcharr/start-celerybeat.sh
+    fi
+    if [[ -f /tmp/start-daphne.sh.backup ]]; then
+      mv /tmp/start-daphne.sh.backup /opt/dispatcharr/start-daphne.sh
+    fi
+
     if ! grep -q "DJANGO_SECRET_KEY" /opt/dispatcharr/.env; then
       DJANGO_SECRET=$(openssl rand -base64 48 | tr -dc 'a-zA-Z0-9' | cut -c1-50)
       echo "DJANGO_SECRET_KEY=$DJANGO_SECRET" >>/opt/dispatcharr/.env

ct/fladder.sh

@@ -35,11 +35,21 @@ function update_script() {
     systemctl stop nginx
     msg_ok "Stopped Service"
 
-    create_backup /opt/fladder/assets/config/config.json
+    if [[ -f /opt/fladder/assets/config/config.json ]]; then
+      msg_info "Backing up configuration"
+      cp /opt/fladder/assets/config/config.json /tmp/fladder_config.json.bak
+      msg_ok "Configuration backed up"
+    fi
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Fladder" "DonutWare/Fladder" "prebuild" "latest" "/opt/fladder" "Fladder-Web-*.zip"
 
-    restore_backup
+    if [[ -f /tmp/fladder_config.json.bak ]]; then
+      msg_info "Restoring configuration"
+      mkdir -p /opt/fladder/assets/config
+      cp /tmp/fladder_config.json.bak /opt/fladder/assets/config/config.json
+      rm -f /tmp/fladder_config.json.bak
+      msg_ok "Configuration restored"
+    fi
 
     msg_info "Starting Service"
     systemctl start nginx

ct/flatnotes.sh

@@ -34,11 +34,12 @@ function update_script() {
     systemctl stop flatnotes
     msg_ok "Stopped Service"
 
-    create_backup /opt/flatnotes/.env /opt/flatnotes/data
+    msg_info "Backing up Configuration and Data"
+    cp /opt/flatnotes/.env /opt/flatnotes.env
+    cp -r /opt/flatnotes/data /opt/flatnotes_data_backup
+    msg_ok "Backed up Configuration and Data"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "flatnotes" "dullage/flatnotes" "tarball"
+    fetch_and_deploy_gh_release "flatnotes" "dullage/flatnotes" "tarball"
-
-    restore_backup
 
     msg_info "Updating Flatnotes"
     cd /opt/flatnotes/client
@@ -51,6 +52,13 @@ function update_script() {
     $STD /usr/local/bin/uv sync
     msg_ok "Updated Flatnotes"
 
+    msg_info "Restoring Configuration and Data"
+    cp /opt/flatnotes.env /opt/flatnotes/.env
+    cp -r /opt/flatnotes_data_backup/. /opt/flatnotes/data
+    rm -f /opt/flatnotes.env
+    rm -r /opt/flatnotes_data_backup
+    msg_ok "Restored Configuration and Data"
+
     msg_info "Starting Service"
     systemctl start flatnotes
     msg_ok "Started Service"

ct/fluid-calendar.sh

@@ -38,9 +38,9 @@ function update_script() {
     systemctl stop fluid-calendar
     msg_info "Stopped Service"
 
-    create_backup /opt/fluid-calendar/.env
+    cp /opt/fluid-calendar/.env /opt/fluid.env
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "fluid-calendar" "dotnetfactory/fluid-calendar" "tarball"
-    restore_backup
+    mv /opt/fluid.env /opt/fluid-calendar/.env
 
     msg_info "Updating Fluid Calendar"
     cd /opt/fluid-calendar

ct/ghostfolio.sh

@@ -41,15 +41,13 @@ function update_script() {
       --exclude="ghostfolio/node_modules" \
       --exclude="ghostfolio/dist" \
       ghostfolio
+    mv /opt/ghostfolio/.env /opt/env.backup
     msg_ok "Backup Created"
 
-    create_backup /opt/ghostfolio/.env
-
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "ghostfolio" "ghostfolio/ghostfolio" "tarball" "latest" "/opt/ghostfolio"
 
-    restore_backup
-
     msg_info "Updating Ghostfolio"
+    mv /opt/env.backup /opt/ghostfolio/.env
     sed -i -E '/^DATABASE_URL=/ s/[?&]sslmode=prefer//g' /opt/ghostfolio/.env
     cd /opt/ghostfolio
     $STD npm ci

ct/gogs.sh

@@ -35,11 +35,18 @@ function update_script() {
     systemctl stop gogs
     msg_ok "Stopped Service"
 
-    create_backup /opt/gogs/custom /opt/gogs/data
+    msg_info "Backing up Data"
+    cp -r /opt/gogs/custom /opt/gogs_custom_backup
+    cp -r /opt/gogs/data /opt/gogs_data_backup
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "gogs" "gogs/gogs" "prebuild" "latest" "/opt/gogs" "gogs_*_linux_$(arch_resolve).tar.gz"
 
-    restore_backup
+    msg_info "Restoring Data"
+    cp -r /opt/gogs_custom_backup/. /opt/gogs/custom
+    cp -r /opt/gogs_data_backup/. /opt/gogs/data
+    rm -rf /opt/gogs_custom_backup /opt/gogs_data_backup
+    msg_ok "Restored Data"
 
     msg_info "Starting Service"
     systemctl start gogs

ct/grist.sh

@@ -37,14 +37,21 @@ function update_script() {
     systemctl stop grist
     msg_ok "Stopped Service"
 
-    create_backup /opt/grist/.env /opt/grist/docs /opt/grist/grist-sessions.db /opt/grist/landing.db
+    msg_info "Creating backup"
+    rm -rf /opt/grist_bak
+    mv /opt/grist /opt/grist_bak
+    msg_ok "Backup created"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "grist" "gristlabs/grist-core" "tarball"
+    fetch_and_deploy_gh_release "grist" "gristlabs/grist-core" "tarball"
-
-    restore_backup
 
     msg_info "Updating Grist"
     mkdir -p /opt/grist/docs
+    cp -n /opt/grist_bak/.env /opt/grist/.env
+    if ls /opt/grist_bak/docs/* &>/dev/null; then
+      cp -r /opt/grist_bak/docs/* /opt/grist/docs/
+    fi
+    [[ -f /opt/grist_bak/grist-sessions.db ]] && cp /opt/grist_bak/grist-sessions.db /opt/grist/grist-sessions.db
+    [[ -f /opt/grist_bak/landing.db ]] && cp /opt/grist_bak/landing.db /opt/grist/landing.db
     cd /opt/grist
     $STD yarn install
     $STD yarn run build:prod

ct/homebox.sh

@@ -39,12 +39,8 @@ function update_script() {
     systemctl stop homebox
     msg_ok "Stopped Service"
 
-    create_backup /opt/homebox/.env /opt/homebox/.data
-
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "homebox" "sysadminsmedia/homebox" "prebuild" "latest" "/opt/homebox" "homebox_Linux_$(arch_resolve "x86_64" "arm64").tar.gz"
     chmod +x /opt/homebox/homebox
-
-    restore_backup
     [ -f /opt/.env ] && mv /opt/.env /opt/homebox/.env
     [ -d /opt/.data ] && mv /opt/.data /opt/homebox/.data
 

ct/homelable.sh

@@ -35,12 +35,16 @@ function update_script() {
     systemctl stop homelable
     msg_ok "Stopped Service"
 
-    create_backup /opt/homelable/backend/.env /opt/homelable/data /opt/homelable/mcp/.env
+    msg_info "Backing up Configuration and Data"
+    cp /opt/homelable/backend/.env /opt/homelable.env.bak
+    cp -r /opt/homelable/data /opt/homelable_data_bak
+    if [[ -f /opt/homelable/mcp/.env ]]; then
+      cp -a /opt/homelable/mcp/.env /opt/homelable-mcp.env.bak
+    fi
+    msg_ok "Backed up Configuration and Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "homelable" "Pouzor/homelable" "tarball" "latest" "/opt/homelable"
 
-    restore_backup
-
     msg_info "Updating Python Dependencies"
     cd /opt/homelable/backend
     $STD uv venv --clear /opt/homelable/backend/.venv
@@ -53,8 +57,17 @@ function update_script() {
     $STD npm run build
     msg_ok "Rebuilt Frontend"
 
-    if [[ -f /opt/homelable/mcp/.env ]]; then
+    msg_info "Restoring Configuration and Data"
+    cp /opt/homelable.env.bak /opt/homelable/backend/.env
+    cp -r /opt/homelable_data_bak/. /opt/homelable/data/
+    rm -f /opt/homelable.env.bak
+    rm -rf /opt/homelable_data_bak
+    msg_ok "Restored Configuration and Data"
+
+    if [[ -f /opt/homelable-mcp.env.bak ]]; then
       msg_info "Restoring MCP Server"
+      cp -a /opt/homelable-mcp.env.bak /opt/homelable/mcp/.env
+      rm -f /opt/homelable-mcp.env.bak
       MCP_OWNER=$(stat -c '%U' /opt/homelable/mcp/.env)
       cd /opt/homelable/mcp
       $STD uv venv --clear /opt/homelable/mcp/.venv

ct/homepage.sh

@@ -37,12 +37,20 @@ function update_script() {
     systemctl stop homepage
     msg_ok "Stopped service"
 
-    create_backup /opt/homepage/.env /opt/homepage/config
+    msg_info "Creating Backup"
-    BACKUP_DIR=/opt/homepage-assets.backup create_backup /opt/homepage/public/images /opt/homepage/public/icons
+    cp /opt/homepage/.env /opt/homepage.env
+    cp -r /opt/homepage/config /opt/homepage_config_backup
+    [[ -d /opt/homepage/public/images ]] && cp -r /opt/homepage/public/images /opt/homepage_images_backup
+    [[ -d /opt/homepage/public/icons ]] && cp -r /opt/homepage/public/icons /opt/homepage_icons_backup
+    msg_ok "Created Backup"
     
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "homepage" "gethomepage/homepage" "tarball"
     
-    restore_backup
+    msg_info "Restoring Backup"
+    mv /opt/homepage.env /opt/homepage
+    rm -rf /opt/homepage/config
+    mv /opt/homepage_config_backup /opt/homepage/config
+    msg_ok "Restored Backup"
 
     msg_info "Updating Homepage (Patience)"
     RELEASE=$(get_latest_github_release "gethomepage/homepage")
@@ -55,7 +63,8 @@ function update_script() {
     export NEXT_PUBLIC_BUILDTIME=$(curl -fsSL https://api.github.com/repos/gethomepage/homepage/releases/latest | jq -r '.published_at')
     export NEXT_TELEMETRY_DISABLED=1
     $STD pnpm build
-    BACKUP_DIR=/opt/homepage-assets.backup restore_backup
+    [[ -d /opt/homepage_images_backup ]] && mv /opt/homepage_images_backup /opt/homepage/public/images
+    [[ -d /opt/homepage_icons_backup ]] && mv /opt/homepage_icons_backup /opt/homepage/public/icons
     msg_ok "Updated Homepage"
 
     msg_info "Starting service"

ct/hoodik.sh

@@ -36,11 +36,16 @@ function update_script() {
     systemctl stop hoodik
     msg_ok "Stopped Service"
 
-    create_backup /opt/hoodik/.env
+    msg_info "Backing up Configuration"
+    cp /opt/hoodik/.env /opt/hoodik.env.bak
+    msg_ok "Backed up Configuration"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "hoodik" "hudikhq/hoodik" "prebuild" "latest" "/opt/hoodik" "*$(arch_resolve "x86_64" "arm64").tar.gz"
 
-    restore_backup
+    msg_info "Restoring Configuration"
+    cp /opt/hoodik.env.bak /opt/hoodik/.env
+    rm -f /opt/hoodik.env.bak
+    msg_ok "Restored Configuration"
 
     msg_info "Starting Service"
     systemctl start hoodik

ct/igotify.sh

@@ -35,11 +35,16 @@ function update_script() {
     systemctl stop igotify
     msg_ok "Stopped Service"
 
-    create_backup /opt/igotify/.env
+    msg_info "Backing up Configuration"
+    cp /opt/igotify/.env /opt/igotify.env.bak
+    msg_ok "Backed up Configuration"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "igotify" "androidseb25/iGotify-Notification-Assistent" "prebuild" "latest" "/opt/igotify" "iGotify-Notification-Service-$(arch_resolve)-v*.zip"
 
-    restore_backup
+    msg_info "Restoring Configuration"
+    cp /opt/igotify.env.bak /opt/igotify/.env
+    rm -f /opt/igotify.env.bak
+    msg_ok "Restored Configuration"
 
     msg_info "Starting Service"
     systemctl start igotify

ct/immichframe.sh

@@ -35,7 +35,9 @@ function update_script() {
     systemctl stop immichframe
     msg_ok "Stopped Service"
 
-    create_backup /opt/immichframe/Config
+    msg_info "Backing up Configuration"
+    cp -r /opt/immichframe/Config /tmp/immichframe_config.bak
+    msg_ok "Backed up Configuration"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "immichframe" "immichFrame/ImmichFrame" "tarball" "latest" "/tmp/immichframe"
 
@@ -55,8 +57,11 @@ function update_script() {
     rm -rf /tmp/immichframe
     msg_ok "Setup ImmichFrame"
 
-    restore_backup
+    msg_info "Restoring Configuration"
+    cp -r /tmp/immichframe_config.bak/* /opt/immichframe/Config/
+    rm -rf /tmp/immichframe_config.bak
     chown -R immichframe:immichframe /opt/immichframe
+    msg_ok "Restored Configuration"
 
 
     msg_info "Starting Service"

ct/investbrain.sh

@@ -41,14 +41,20 @@ function update_script() {
     NODE_VERSION="22" setup_nodejs
     PG_VERSION="17" setup_postgresql
 
-    create_backup /opt/investbrain/.env /opt/investbrain/storage
+    msg_info "Creating Backup"
+    rm -f /opt/.env.backup
+    rm -rf /opt/investbrain_backup
+    cp /opt/investbrain/.env /opt/.env.backup
+    cp -r /opt/investbrain/storage /opt/investbrain_backup
+    msg_ok "Created Backup"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Investbrain" "investbrainapp/investbrain" "tarball" "latest" "/opt/investbrain"
+    fetch_and_deploy_gh_release "Investbrain" "investbrainapp/investbrain" "tarball" "latest" "/opt/investbrain"
-
-    restore_backup
 
     msg_info "Updating Investbrain"
     cd /opt/investbrain
+    rm -rf /opt/investbrain/storage
+    cp /opt/.env.backup /opt/investbrain/.env
+    cp -r /opt/investbrain_backup/ /opt/investbrain/storage
     export COMPOSER_ALLOW_SUPERUSER=1
     $STD /usr/local/bin/composer install --no-interaction --no-dev --optimize-autoloader
     $STD npm install
@@ -63,6 +69,7 @@ function update_script() {
     $STD php artisan event:cache
     chown -R www-data:www-data /opt/investbrain
     chmod -R 775 /opt/investbrain/storage /opt/investbrain/bootstrap/cache
+    rm -rf /opt/.env.backup /opt/investbrain_backup
     msg_ok "Updated Investbrain"
 
     msg_info "Starting Services"

ct/invoiceninja.sh

@@ -35,17 +35,21 @@ function update_script() {
     systemctl stop supervisor nginx php8.4-fpm
     msg_ok "Stopped Services"
 
-    create_backup /opt/invoiceninja/.env /opt/invoiceninja/storage /opt/invoiceninja/public/storage /opt/invoiceninja/vendor/beganovich/snappdf/versions
+    msg_info "Creating Backup"
+    mkdir -p /tmp/invoiceninja_backup
+    cp /opt/invoiceninja/.env /tmp/invoiceninja_backup/
+    cp -r /opt/invoiceninja/storage /tmp/invoiceninja_backup/ 2>/dev/null || true
+    cp -r /opt/invoiceninja/public/storage /tmp/invoiceninja_backup/public_storage 2>/dev/null || true
+    msg_ok "Created Backup"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "invoiceninja" "invoiceninja/invoiceninja" "prebuild" "latest" "/opt/invoiceninja" "invoiceninja.tar.gz"
 
-    restore_backup
+    msg_info "Restoring Data"
-
+    cp /tmp/invoiceninja_backup/.env /opt/invoiceninja/
-    msg_info "Verifying Chromium for PDF Generation"
+    cp -r /tmp/invoiceninja_backup/storage/* /opt/invoiceninja/storage/ 2>/dev/null || true
-    cd /opt/invoiceninja
+    cp -r /tmp/invoiceninja_backup/public_storage/* /opt/invoiceninja/public/storage/ 2>/dev/null || true
-    $STD ./vendor/bin/snappdf download
+    rm -rf /tmp/invoiceninja_backup
-    chown -R www-data:www-data /opt/invoiceninja/vendor/beganovich/snappdf/versions
+    msg_ok "Restored Data"
-    msg_ok "Verified Chromium for PDF Generation"
 
     msg_info "Running Migrations"
     cd /opt/invoiceninja 

ct/invoiceshelf.sh

@@ -35,11 +35,19 @@ function update_script() {
     systemctl stop caddy
     msg_ok "Stopped Services"
 
-    create_backup /opt/invoiceshelf/.env /opt/invoiceshelf/storage
+    msg_info "Backing up Data"
+    cp /opt/invoiceshelf/.env /opt/invoiceshelf.env.bak
+    cp -r /opt/invoiceshelf/storage /opt/invoiceshelf_storage_backup
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "invoiceshelf" "InvoiceShelf/InvoiceShelf" "tarball"
 
-    restore_backup
+    msg_info "Restoring Data"
+    cp /opt/invoiceshelf.env.bak /opt/invoiceshelf/.env
+    rm -f /opt/invoiceshelf.env.bak
+    cp -r /opt/invoiceshelf_storage_backup/. /opt/invoiceshelf/storage
+    rm -rf /opt/invoiceshelf_storage_backup
+    msg_ok "Restored Data"
 
     msg_info "Updating Application"
     cd /opt/invoiceshelf

ct/joplin-server.sh

@@ -36,9 +36,9 @@ function update_script() {
     systemctl stop joplin-server
     msg_ok "Stopped Services"
 
-    create_backup /opt/joplin-server/.env
+    cp /opt/joplin-server/.env /opt
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "joplin-server" "laurent22/joplin" "tarball"
-    restore_backup
+    mv /opt/.env /opt/joplin-server
 
     msg_info "Updating Joplin-Server"
     cd /opt/joplin-server

ct/jotty.sh

@@ -35,12 +35,20 @@ function update_script() {
     systemctl stop jotty
     msg_ok "Stopped Service"
 
-    create_backup /opt/jotty/.env /opt/jotty/data /opt/jotty/config
+    msg_info "Backing up configuration & data"
+    cp /opt/jotty/.env /opt/app.env
+    [[ -d /opt/jotty/data ]] && mv /opt/jotty/data /opt/data
+    [[ -d /opt/jotty/config ]] && mv /opt/jotty/config /opt/config
+    msg_ok "Backed up configuration & data"
 
     NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "jotty" "fccview/jotty" "prebuild" "latest" "/opt/jotty" "jotty_*_prebuild.tar.gz"
 
-    restore_backup
+    msg_info "Restoring configuration & data"
+    mv /opt/app.env /opt/jotty/.env
+    [[ -d /opt/data ]] && mv /opt/data /opt/jotty/data
+    [[ -d /opt/config ]] && cp -a /opt/config/* /opt/jotty/config && rm -rf /opt/config
+    msg_ok "Restored configuration & data"
 
     msg_info "Starting Service"
     systemctl start jotty

ct/kan.sh

@@ -35,11 +35,16 @@ function update_script() {
     systemctl stop kan
     msg_ok "Stopped Service"
 
-    create_backup /opt/kan/.env
+    msg_info "Backing up Data"
+    cp /opt/kan/.env /opt/kan.env.bak
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_tag "kan" "kanbn/kan" "latest"
 
-    restore_backup
+    msg_info "Restoring Configuration"
+    cp /opt/kan.env.bak /opt/kan/.env
+    rm -f /opt/kan.env.bak
+    msg_ok "Restored Configuration"
 
     msg_info "Building Application"
     cd /opt/kan

ct/kima-hub.sh

@@ -37,11 +37,18 @@ function update_script() {
     systemctl stop kima-frontend kima-backend kima-analyzer kima-analyzer-clap
     msg_ok "Stopped Services"
 
-    create_backup /opt/kima-hub/backend/.env /opt/kima-hub/frontend/.env
+    msg_info "Backing up Data"
+    cp /opt/kima-hub/backend/.env /opt/kima-hub-backend-env.bak
+    cp /opt/kima-hub/frontend/.env /opt/kima-hub-frontend-env.bak
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "kima-hub" "Chevron7Locked/kima-hub" "tarball"
 
-    restore_backup
+    msg_info "Restoring Data"
+    cp /opt/kima-hub-backend-env.bak /opt/kima-hub/backend/.env
+    cp /opt/kima-hub-frontend-env.bak /opt/kima-hub/frontend/.env
+    rm -f /opt/kima-hub-backend-env.bak /opt/kima-hub-frontend-env.bak
+    msg_ok "Restored Data"
 
     msg_info "Rebuilding Backend"
     cd /opt/kima-hub/backend

ct/kitchenowl.sh

@@ -35,14 +35,22 @@ function update_script() {
     systemctl stop kitchenowl
     msg_ok "Stopped Service"
 
-    create_backup /opt/kitchenowl/data /opt/kitchenowl/kitchenowl.env
+    msg_info "Creating Backup"
+    mkdir -p /opt/kitchenowl_backup
+    cp -r /opt/kitchenowl/data /opt/kitchenowl_backup/
+    cp -f /opt/kitchenowl/kitchenowl.env /opt/kitchenowl_backup/
+    msg_ok "Created Backup"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "kitchenowl" "TomBursch/kitchenowl" "tarball" "latest" "/opt/kitchenowl"
     rm -rf /opt/kitchenowl/web
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "kitchenowl-web" "TomBursch/kitchenowl" "prebuild" "latest" "/opt/kitchenowl/web" "kitchenowl_Web.tar.gz"
 
-    restore_backup
+    msg_info "Restoring data"
     sed -i 's/default=True/default=False/' /opt/kitchenowl/backend/wsgi.py
+    cp -r /opt/kitchenowl_backup/data /opt/kitchenowl/
+    cp -f /opt/kitchenowl_backup/kitchenowl.env /opt/kitchenowl/
+    rm -rf /opt/kitchenowl_backup
+    msg_ok "Restored data"
 
     msg_info "Updating KitchenOwl"
     cd /opt/kitchenowl/backend

ct/koel.sh

@@ -35,11 +35,21 @@ function update_script() {
     systemctl stop nginx php8.4-fpm
     msg_ok "Stopped Services"
 
-    create_backup /opt/koel/.env /opt/koel/storage /opt/koel/public/img
+    msg_info "Creating Backup"
+    mkdir -p /tmp/koel_backup
+    cp /opt/koel/.env /tmp/koel_backup/
+    cp -r /opt/koel/storage /tmp/koel_backup/ 2>/dev/null || true
+    cp -r /opt/koel/public/img /tmp/koel_backup/ 2>/dev/null || true
+    msg_ok "Created Backup"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "koel" "koel/koel" "prebuild" "latest" "/opt/koel" "koel-*.tar.gz"
 
-    restore_backup
+    msg_info "Restoring Data"
+    cp /tmp/koel_backup/.env /opt/koel/
+    cp -r /tmp/koel_backup/storage/* /opt/koel/storage/ 2>/dev/null || true
+    cp -r /tmp/koel_backup/img/* /opt/koel/public/img/ 2>/dev/null || true
+    rm -rf /tmp/koel_backup
+    msg_ok "Restored Data"
 
     msg_info "Running Migrations"
     cd /opt/koel 

ct/leantime.sh

@@ -34,18 +34,20 @@ function update_script() {
     msg_info "Creating Backup"
     mariadb-dump leantime >"/opt/leantime_db_backup_$(date +%F).sql"
     tar -czf "/opt/leantime_backup_$(date +%F).tar.gz" "/opt/leantime"
+    mv /opt/leantime /opt/leantime_bak
     msg_ok "Backup Created"
 
-    create_backup /opt/leantime/config/.env
+    fetch_and_deploy_gh_release "leantime" "Leantime/leantime" "prebuild" "latest" "/opt/leantime" Leantime*.tar.gz
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "leantime" "Leantime/leantime" "prebuild" "latest" "/opt/leantime" Leantime*.tar.gz
+    msg_info "Restoring Config & Permissions"
-
+    mv /opt/leantime_bak/config/.env /opt/leantime/config/.env
-    restore_backup
-
-    msg_info "Setting Permissions"
     chown -R www-data:www-data "/opt/leantime"
     chmod -R 750 "/opt/leantime"
-    msg_ok "Set Permissions"
+    msg_ok "Restored Config & Permissions"
+
+    msg_info "Removing Backup"
+    rm -rf /opt/leantime_bak
+    msg_ok "Removed Backup"
     msg_ok "Updated successfully!"
   fi
   exit

ct/librechat.sh

@@ -35,12 +35,12 @@ function update_script() {
     systemctl stop librechat rag-api
     msg_ok "Stopped Services"
 
-    create_backup /opt/librechat/.env
+    msg_info "Backing up Configuration"
+    cp /opt/librechat/.env /opt/librechat.env.bak
+    msg_ok "Backed up Configuration"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_tag "librechat" "danny-avila/LibreChat"
 
-    restore_backup
-
     msg_info "Installing Dependencies"
     cd /opt/librechat
     $STD npm ci
@@ -52,6 +52,11 @@ function update_script() {
     $STD npm cache clean --force
     msg_ok "Built Frontend"
 
+    msg_info "Restoring Configuration"
+    cp /opt/librechat.env.bak /opt/librechat/.env
+    rm -f /opt/librechat.env.bak
+    msg_ok "Restored Configuration"
+
     msg_info "Starting Services"
     systemctl start rag-api librechat
     msg_ok "Started Services"
@@ -63,17 +68,22 @@ function update_script() {
     systemctl stop rag-api
     msg_ok "Stopped RAG API"
 
-    create_backup /opt/rag-api/.env
+    msg_info "Backing up RAG API Configuration"
+    cp /opt/rag-api/.env /opt/rag-api.env.bak
+    msg_ok "Backed up RAG API Configuration"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "rag-api" "danny-avila/rag_api" "tarball"
 
-    restore_backup
-
     msg_info "Updating RAG API Dependencies"
     cd /opt/rag-api
     $STD .venv/bin/pip install -r requirements.lite.txt
     msg_ok "Updated RAG API Dependencies"
 
+    msg_info "Restoring RAG API Configuration"
+    cp /opt/rag-api.env.bak /opt/rag-api/.env
+    rm -f /opt/rag-api.env.bak
+    msg_ok "Restored RAG API Configuration"
+
     msg_info "Starting RAG API"
     systemctl start rag-api
     msg_ok "Started RAG API"

ct/linkding.sh

@@ -35,12 +35,19 @@ function update_script() {
     systemctl stop nginx linkding linkding-tasks
     msg_ok "Stopped Services"
 
-    create_backup /opt/linkding/data /opt/linkding/.env
+    msg_info "Backing up Data"
+    cp -r /opt/linkding/data /opt/linkding_data_backup
+    cp /opt/linkding/.env /opt/linkding_env_backup
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "linkding" "sissbruecker/linkding" "tarball"
 
-    restore_backup
+    msg_info "Restoring Data"
+    cp -r /opt/linkding_data_backup/. /opt/linkding/data
+    cp /opt/linkding_env_backup /opt/linkding/.env
+    rm -rf /opt/linkding_data_backup /opt/linkding_env_backup
     ln -sf /usr/lib/$(arch_resolve "x86_64-linux-gnu" "aarch64-linux-gnu")/mod_icu.so /opt/linkding/libicu.so
+    msg_ok "Restored Data"
 
     msg_info "Updating LinkDing"
     cd /opt/linkding

ct/linkwarden.sh

@@ -35,11 +35,13 @@ function update_script() {
 
     RUST_CRATES="monolith" setup_rust
 
-    create_backup /opt/linkwarden/.env /opt/linkwarden/data
+    msg_info "Backing up data"
+    mv /opt/linkwarden/.env /opt/.env
+    [ -d /opt/linkwarden/data ] && mv /opt/linkwarden/data /opt/data.bak
+    rm -rf /opt/linkwarden
+    msg_ok "Backed up data"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "linkwarden" "linkwarden/linkwarden" "tarball"
+    fetch_and_deploy_gh_release "linkwarden" "linkwarden/linkwarden" "tarball"
-
-    restore_backup
 
     msg_info "Updating Linkwarden"
     cd /opt/linkwarden
@@ -58,9 +60,11 @@ function update_script() {
     $STD yarn
     $STD npx playwright install-deps
     $STD npx playwright install
+    mv /opt/.env /opt/linkwarden/.env
     $STD yarn prisma:generate
     $STD yarn web:build
     $STD yarn prisma:deploy
+    [ -d /opt/data.bak ] && mv /opt/data.bak /opt/linkwarden/data
     rm -rf ~/.cargo/registry ~/.cargo/git ~/.cargo/.package-cache
     rm -rf /root/.cache/yarn
     rm -rf /opt/linkwarden/.next/cache

ct/lobehub.sh

@@ -35,11 +35,16 @@ function update_script() {
     systemctl stop lobehub
     msg_ok "Stopped Services"
 
-    create_backup /opt/lobehub/.env
+    msg_info "Backing up Data"
+    cp /opt/lobehub/.env /opt/lobehub.env.bak
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "lobehub" "lobehub/lobehub" "tarball"
 
-    restore_backup
+    msg_info "Restoring Configuration"
+    cp /opt/lobehub.env.bak /opt/lobehub/.env
+    rm -f /opt/lobehub.env.bak
+    msg_ok "Restored Configuration"
 
     msg_info "Building Application"
     cd /opt/lobehub

ct/mail-archiver.sh

@@ -36,7 +36,10 @@ function update_script() {
     systemctl stop mail-archiver
     msg_ok "Stopped Mail-Archiver"
 
-    create_backup /opt/mail-archiver/appsettings.json /opt/mail-archiver/.env /opt/mail-archiver/DataProtection-Keys
+    msg_info "Creating Backup"
+    cp /opt/mail-archiver/appsettings.json /opt/mail-archiver/.env /opt/
+    [[ -d /opt/mail-archiver/DataProtection-Keys ]] && cp -r /opt/mail-archiver/DataProtection-Keys /opt
+    msg_ok "Created Backup"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "mail-archiver" "s1t5/mail-archiver" "tarball"
 
@@ -48,7 +51,10 @@ function update_script() {
     rm -rf /opt/mail-archiver-build
     msg_ok "Updated Mail-Archiver"
 
-    restore_backup
+    msg_info "Restoring Backup"
+    cp /opt/appsettings.json /opt/.env /opt/mail-archiver
+    [[ -d /opt/DataProtection-Keys ]] && cp -r /opt/DataProtection-Keys /opt/mail-archiver/
+    msg_ok "Restored Backup"
 
     msg_info "Starting Mail-Archiver"
     systemctl start mail-archiver

ct/manyfold.sh

@@ -39,15 +39,13 @@ function update_script() {
 
     msg_info "Backing up Data"
     CURRENT_VERSION=$(grep -oP 'APP_VERSION=\K[^ ]+' /opt/manyfold/.env || echo "unknown")
+    cp -r /opt/manyfold/app/storage /opt/manyfold_storage_backup 2>/dev/null || true
+    cp -r /opt/manyfold/app/tmp /opt/manyfold_tmp_backup 2>/dev/null || true
     $STD tar -czf "/opt/manyfold_${CURRENT_VERSION}_backup.tar.gz" -C /opt/manyfold app
     msg_ok "Backed up Data"
 
-    create_backup /opt/manyfold/app/storage /opt/manyfold/app/tmp
-
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "manyfold" "manyfold3d/manyfold" "tarball" "latest" "/opt/manyfold/app"
 
-    restore_backup
-
     msg_info "Configuring Manyfold"
     RUBY_INSTALL_VERSION=$(cat /opt/manyfold/app/.ruby-version)
     YARN_VERSION=$(grep '"packageManager":' /opt/manyfold/app/package.json | sed -E 's/.*"(yarn@[0-9\.]+)".*/\1/')
@@ -57,9 +55,14 @@ function update_script() {
 
     RUBY_VERSION=${RUBY_INSTALL_VERSION} RUBY_INSTALL_RAILS="true" HOME=/home/manyfold setup_ruby
 
-    msg_info "Setting Permissions"
+    msg_info "Restoring Data"
+    rm -rf /opt/manyfold/app/{storage,tmp}
+    cp -r /opt/manyfold_storage_backup /opt/manyfold/app/storage 2>/dev/null || true
+    cp -r /opt/manyfold_tmp_backup /opt/manyfold/app/tmp 2>/dev/null || true
     chown -R manyfold:manyfold {/home/manyfold,/opt/manyfold}
-    msg_ok "Set Permissions"
+    chown -R manyfold:manyfold /opt/manyfold/app/storage /opt/manyfold/app/tmp /opt/manyfold/app/config
+    rm -rf /opt/manyfold_storage_backup /opt/manyfold_tmp_backup
+    msg_ok "Restored Data"
 
     msg_info "Installing Manyfold"
 

ct/matomo.sh

@@ -35,7 +35,11 @@ function update_script() {
     systemctl stop caddy
     msg_ok "Stopped Services"
 
-    create_backup /opt/matomo/config/config.ini.php /opt/matomo/misc/user /root/matomo.creds
+    msg_info "Backing up Data"
+    [[ -f /opt/matomo/config/config.ini.php ]] && cp /opt/matomo/config/config.ini.php /opt/matomo_config.bak
+    [[ -d /opt/matomo/misc/user ]] && cp -r /opt/matomo/misc/user /opt/matomo_user_backup
+    [[ -f /root/matomo.creds ]] && cp /root/matomo.creds /opt/matomo_db_creds.bak
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "matomo" "matomo-org/matomo" "prebuild" "latest" "/opt/matomo" "matomo-*.zip"
 
@@ -49,8 +53,20 @@ function update_script() {
     chmod -R 755 /opt/matomo/tmp
     msg_ok "Set up Matomo"
 
-    restore_backup
+    msg_info "Restoring Data"
+    if [[ -f /opt/matomo_config.bak ]]; then
+      mkdir -p /opt/matomo/config
+      cp /opt/matomo_config.bak /opt/matomo/config/config.ini.php
+    fi
+    if [[ -d /opt/matomo_user_backup ]]; then
+      mkdir -p /opt/matomo/misc/user
+      cp -r /opt/matomo_user_backup/. /opt/matomo/misc/user
+    fi
+    [[ -f /opt/matomo_db_creds.bak ]] && cp /opt/matomo_db_creds.bak /root/matomo.creds
+    rm -f /opt/matomo_config.bak /opt/matomo_db_creds.bak
+    rm -rf /opt/matomo_user_backup
     chown -R www-data:www-data /opt/matomo
+    msg_ok "Restored Data"
 
     if [[ -f /opt/matomo/console ]]; then
       msg_info "Running Matomo database upgrade"

ct/meilisearch.sh

@@ -33,13 +33,14 @@ function update_script() {
       systemctl stop meilisearch-ui
       msg_ok "Stopped Meilisearch-UI"
 
-      create_backup /opt/meilisearch-ui/.env.local
+      cp /opt/meilisearch-ui/.env.local /tmp/.env.local.bak
-      CLEAN_INSTALL=1 fetch_and_deploy_gh_release "meilisearch-ui" "riccox/meilisearch-ui" "tarball"
+      rm -rf /opt/meilisearch-ui
-      restore_backup
+      fetch_and_deploy_gh_release "meilisearch-ui" "riccox/meilisearch-ui" "tarball"
 
       msg_info "Configuring Meilisearch-UI"
       cd /opt/meilisearch-ui
       sed -i 's|const hash = execSync("git rev-parse HEAD").toString().trim();|const hash = "unknown";|' /opt/meilisearch-ui/vite.config.ts
+      mv /tmp/.env.local.bak /opt/meilisearch-ui/.env.local
       $STD pnpm install
       msg_ok "Configured Meilisearch-UI"
 

ct/metube.sh

@@ -48,11 +48,14 @@ function update_script() {
     systemctl stop metube
     msg_ok "Stopped Service"
 
-    create_backup /opt/metube/.env
+    msg_info "Backing up Old Installation"
+    if [[ -d /opt/metube_bak ]]; then
+      rm -rf /opt/metube_bak
+    fi
+    mv /opt/metube /opt/metube_bak
+    msg_ok "Backup created"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "metube" "alexta69/metube" "tarball" "latest"
+    fetch_and_deploy_gh_release "metube" "alexta69/metube" "tarball" "latest"
-
-    restore_backup
 
     msg_info "Building Frontend"
     cd /opt/metube/ui
@@ -72,6 +75,13 @@ function update_script() {
     $STD uv sync
     msg_ok "Installed Backend"
 
+    msg_info "Restoring .env"
+    if [[ -f /opt/metube_bak/.env ]]; then
+      cp /opt/metube_bak/.env /opt/metube/.env
+    fi
+    rm -rf /opt/metube_bak
+    msg_ok "Restored .env"
+
     if grep -q 'pipenv' /etc/systemd/system/metube.service; then
       msg_info "Patching systemd Service"
       cat <<EOF >/etc/systemd/system/metube.service

ct/nametag.sh

@@ -35,15 +35,19 @@ function update_script() {
     systemctl stop nametag
     msg_ok "Stopped Service"
 
-    create_backup /opt/nametag/.env /opt/nametag/data
+    msg_info "Backing up Data"
+    cp /opt/nametag/.env /opt/nametag.env.bak
+    cp -r /opt/nametag/data /opt/nametag_data_bak
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "nametag" "mattogodoy/nametag" "tarball" "latest" "/opt/nametag"
 
-    restore_backup
+    # Restore .env BEFORE the build: CLEAN_INSTALL wiped it and the build sources it
+    cp /opt/nametag.env.bak /opt/nametag/.env
 
     msg_info "Rebuilding Application"
     cd /opt/nametag
-    $STD npm ci --include=dev
+    $STD npm ci
     set -a
     source /opt/nametag/.env
     set +a
@@ -53,6 +57,13 @@ function update_script() {
     cp -r /opt/nametag/public /opt/nametag/.next/standalone/public
     msg_ok "Rebuilt Application"
 
+    msg_info "Restoring Data"
+    cp /opt/nametag.env.bak /opt/nametag/.env
+    cp -r /opt/nametag_data_bak/. /opt/nametag/data/
+    rm -f /opt/nametag.env.bak
+    rm -rf /opt/nametag_data_bak
+    msg_ok "Restored Data"
+
     msg_info "Running Migrations"
     cd /opt/nametag
     $STD npx prisma migrate deploy

ct/overseerr.sh

@@ -61,16 +61,18 @@ EOF
     systemctl stop overseerr
     msg_ok "Service stopped"
 
-    create_backup /opt/overseerr/config
+    msg_info "Creating backup"
+    mv /opt/overseerr/config /opt/config_backup
+    msg_ok "Backup created"
 
     fetch_and_deploy_gh_release "overseerr" "sct/overseerr" "tarball"
-
+    rm -rf /opt/overseerr/config
-    restore_backup
 
     msg_info "Configuring ${APP} (Patience)"
     cd /opt/overseerr
     $STD yarn install
     $STD yarn build
+    mv /opt/config_backup /opt/overseerr/config
     msg_ok "Configured ${APP}"
 
     msg_info "Starting Service"

ct/ownfoil.sh

@@ -35,18 +35,23 @@ function update_script() {
     systemctl stop ownfoil
     msg_ok "Stopped Service"
 
-    create_backup /opt/ownfoil/app/config
+    msg_info "Backing up Data"
+    cp -r /opt/ownfoil/app/config /opt/ownfoil_data_backup
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "ownfoil" "a1ex4/ownfoil" "tarball"
 
-    restore_backup
-
     msg_info "Installing Dependencies"
     cd /opt/ownfoil
     $STD source .venv/bin/activate
     $STD uv pip install -r requirements.txt
     msg_ok "Installed Dependencies"
 
+    msg_info "Restoring Data"
+    cp -r /opt/ownfoil_data_backup /opt/ownfoil/app/config
+    rm -rf /opt/ownfoil_data_backup
+    msg_ok "Restored Data"
+
     msg_info "Starting Service"
     systemctl start ownfoil
     msg_ok "Started Service"

ct/pangolin.sh

@@ -6,7 +6,7 @@ source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxV
 # Source: https://pangolin.net/ | Github: https://github.com/fosrl/pangolin
 
 APP="Pangolin"
-PANGOLIN_VERSION="${PANGOLIN_VERSION:-1.21.0}"
+PANGOLIN_VERSION="${PANGOLIN_VERSION:-1.20.0}"
 var_tags="${var_tags:-proxy}"
 var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-4096}"

ct/paperclip.sh

@@ -35,11 +35,15 @@ function update_script() {
     systemctl stop paperclip
     msg_ok "Stopped Service"
 
-    create_backup /opt/paperclip-ai/.env
+    msg_info "Backing up Configuration"
+    cp /opt/paperclip-ai/.env /opt/paperclip.env.bak
+    msg_ok "Backed up Configuration"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "paperclip-ai" "paperclipai/paperclip" "tarball"
 
-    restore_backup
+    msg_info "Restoring Configuration"
+    mv /opt/paperclip.env.bak /opt/paperclip-ai/.env
+    msg_ok "Restored Configuration"
 
     msg_info "Rebuilding Paperclip"
     cd /opt/paperclip-ai

ct/papra.sh

@@ -35,18 +35,22 @@ function update_script() {
     systemctl stop papra
     msg_ok "Stopped Service"
 
-    create_backup /opt/papra/apps/papra-server/.env
+    msg_info "Backing up Configuration"
+    if [[ -f /opt/papra/apps/papra-server/.env ]]; then
+      cp /opt/papra/apps/papra-server/.env /opt/papra_env.bak
+    fi
+    msg_ok "Backed up Configuration"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "papra" "papra-hq/papra" "tarball"
 
-    restore_backup
-
     pnpm_version=$(grep -oP '"packageManager":\s*"pnpm@\K[^"]+' /opt/papra/package.json)
     NODE_VERSION="26" NODE_MODULE="pnpm@$pnpm_version" setup_nodejs
 
     msg_info "Building Application"
     cd /opt/papra
-    if [[ ! -f /opt/papra/apps/papra-server/.env ]]; then
+    if [[ -f /opt/papra_env.bak ]]; then
+      cp /opt/papra_env.bak /opt/papra/apps/papra-server/.env
+    else
       msg_warn ".env missing, regenerating from defaults"
       LOCAL_IP=$(hostname -I | awk '{print $1}')
       cat <<EOF >/opt/papra/apps/papra-server/.env
@@ -70,6 +74,7 @@ EOF
     $STD pnpm --filter "@papra/app-client..." run build
     $STD pnpm --filter "@papra/app-server..." run build
     ln -sf /opt/papra/apps/papra-client/dist /opt/papra/apps/papra-server/public
+    rm -f /opt/papra_env.bak
     msg_ok "Built Application"
 
     msg_info "Starting Service"

ct/patchmon.sh

@@ -72,13 +72,9 @@ EOF
       msg_ok "Migration complete!"
     fi
 
-    create_backup /opt/patchmon/.env
-
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "PatchMon" "PatchMon/PatchMon" "singlefile" "latest" "/opt/patchmon" "patchmon-server-linux-$(arch_resolve)"
     mv /opt/patchmon/PatchMon /opt/patchmon/patchmon-server
 
-    restore_backup
-
     msg_info "Fetching PatchMon agent binaries"
     RELEASE=$(get_latest_github_release "PatchMon/PatchMon")
     [[ ! -d /opt/patchmon/agents ]] && mkdir -p /opt/patchmon/agents

ct/postiz.sh

@@ -41,6 +41,8 @@ function update_script() {
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "postiz" "gitroomhq/postiz-app" "tarball"
 
+    # Restore BEFORE the build: CLEAN_INSTALL wiped /opt/postiz including .env,
+    # and the build below sources it
     restore_backup
 
     msg_info "Building Application"

ct/powerdns.sh

@@ -36,14 +36,18 @@ function update_script() {
   msg_ok "Updated PowerDNS"
 
   if check_for_gh_release "poweradmin" "poweradmin/poweradmin"; then
-    create_backup /opt/poweradmin/config/settings.php /opt/poweradmin/powerdns.db
+    msg_info "Backing up Configuration"
+    cp /opt/poweradmin/config/settings.php /opt/poweradmin_settings.php.bak
+    cp /opt/poweradmin/powerdns.db /opt/poweradmin_powerdns.db.bak
+    msg_ok "Backed up Configuration"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "poweradmin" "poweradmin/poweradmin" "tarball"
 
-    restore_backup
-
     msg_info "Updating Poweradmin"
+    cp /opt/poweradmin_settings.php.bak /opt/poweradmin/config/settings.php
+    cp /opt/poweradmin_powerdns.db.bak /opt/poweradmin/powerdns.db
     rm -rf /opt/poweradmin/install
+    rm -f /opt/poweradmin_settings.php.bak /opt/poweradmin_powerdns.db.bak
     chown -R www-data:pdns /opt/poweradmin
     chmod 775 /opt/poweradmin
     chown pdns:pdns /opt/poweradmin/powerdns.db

ct/radicale.sh

@@ -34,12 +34,17 @@ function update_script() {
     systemctl stop radicale
     msg_ok "Stopped service"
 
-    create_backup /opt/radicale/users
+    msg_info "Backing up users file"
+    cp /opt/radicale/users /opt/radicale_users_backup
+    msg_ok "Backed up users file"
 
     PYTHON_VERSION="3.13" setup_uv
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Radicale" "Kozea/Radicale" "tarball" "latest" "/opt/radicale"
 
-    restore_backup
+    msg_info "Restoring users file"
+    rm -f /opt/radicale/users
+    mv /opt/radicale_users_backup /opt/radicale/users
+    msg_ok "Restored users file"
 
     if grep -q 'start.sh' /etc/systemd/system/radicale.service; then
       sed -i -e '/^Description/i[Unit]' \

ct/reactive-resume.sh

@@ -36,12 +36,10 @@ function update_script() {
 
     ensure_dependencies git
 
-    create_backup /opt/reactive-resume/.env
+    cp /opt/reactive-resume/.env /opt/reactive-resume.env.bak
     NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "reactive-resume" "amruthpillai/reactive-resume" "tarball" "latest" "/opt/reactive-resume"
 
-    restore_backup
-
     msg_info "Updating Reactive Resume (Patience)"
     cd /opt/reactive-resume
     export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
@@ -51,6 +49,7 @@ function update_script() {
     export NODE_ENV="production"
     $STD pnpm install --frozen-lockfile
     $STD pnpm run build
+    mv /opt/reactive-resume.env.bak /opt/reactive-resume/.env
     msg_ok "Updated Reactive Resume"
 
     msg_info "Updating Service"

ct/rustypaste.sh

@@ -35,11 +35,18 @@ function update_script() {
     systemctl stop rustypaste
     msg_ok "Stopped Services"
 
-    create_backup /opt/rustypaste/upload /opt/rustypaste/config.toml
+    msg_info "Creating Backup"
+    tar -czf "/opt/rustypaste_backup_$(date +%F).tar.gz" /opt/rustypaste/upload 2>/dev/null || true
+    cp /opt/rustypaste/config.toml /tmp/rustypaste_config.toml.bak
+    msg_ok "Backup Created"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "rustypaste" "orhun/rustypaste" "prebuild" "latest" "/opt/rustypaste" "*x86_64-unknown-linux-gnu.tar.gz"
 
-    restore_backup
+    msg_info "Restoring Data"
+    mv /tmp/rustypaste_config.toml.bak /opt/rustypaste/config.toml
+    tar -xzf "/opt/rustypaste_backup_$(date +%F).tar.gz" -C /opt/rustypaste/upload 2>/dev/null || true
+    rm -rf /opt/rustypaste_backup_$(date +%F).tar.gz
+    msg_ok "Restored Data"
 
     msg_info "Starting Services"
     systemctl start rustypaste

ct/scanopy.sh

@@ -36,16 +36,19 @@ function update_script() {
     [[ -f /etc/systemd/system/scanopy-daemon.service ]] && systemctl stop scanopy-daemon
     msg_ok "Stopped services"
 
-    create_backup /opt/scanopy/.env /opt/scanopy/oidc.toml
+    msg_info "Backing up configurations"
+    cp /opt/scanopy/.env /opt/scanopy.env
+    [[ -f /opt/scanopy/oidc.toml ]] && cp /opt/scanopy/oidc.toml /opt/scanopy.oidc.toml
+    msg_ok "Backed up configurations"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Scanopy" "scanopy/scanopy" "tarball" "latest" "/opt/scanopy"
 
-    restore_backup
-
     ensure_dependencies pkg-config libssl-dev
     TOOLCHAIN="$(grep "channel" /opt/scanopy/backend/rust-toolchain.toml | awk -F\" '{print $2}')"
     RUST_TOOLCHAIN=$TOOLCHAIN setup_rust
 
+    [[ -f /opt/scanopy.env ]] && mv /opt/scanopy.env /opt/scanopy/.env
+    [[ -f /opt/scanopy.oidc.toml ]] && mv /opt/scanopy.oidc.toml /opt/scanopy/oidc.toml
     if ! grep -q "PUBLIC_URL" /opt/scanopy/.env; then
       sed -i "\|_PATH=|a\\scanopy_PUBLIC_URL=http://${LOCAL_IP}:60072" /opt/scanopy/.env
     fi

ct/shelfmark.sh

@@ -52,12 +52,11 @@ function update_script() {
       msg_ok "Updated FlareSolverr"
     fi
 
-    create_backup /opt/shelfmark/start.sh
+    cp /opt/shelfmark/start.sh /opt/start.sh.bak
     if command -v chromedriver &>/dev/null; then
       $STD apt remove -y chromium-driver
     fi
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "shelfmark" "calibrain/shelfmark" "tarball" "latest" "/opt/shelfmark"
-    restore_backup
     RELEASE_VERSION=$(cat "$HOME/.shelfmark")
 
     msg_info "Updating Shelfmark"
@@ -75,6 +74,7 @@ function update_script() {
     else
       $STD uv sync --active --locked --no-default-groups
     fi
+    mv /opt/start.sh.bak /opt/shelfmark/start.sh
     msg_ok "Updated Shelfmark"
 
     msg_info "Starting Service(s)"

ct/shlink.sh

@@ -35,11 +35,19 @@ function update_script() {
     systemctl stop shlink
     msg_ok "Stopped Service"
 
-    create_backup /opt/shlink/.env /opt/shlink/data
+    msg_info "Backing up Data"
+    cp /opt/shlink/.env /opt/shlink.env.bak
+    cp -r /opt/shlink/data /opt/shlink_data_backup
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "shlink" "shlinkio/shlink" "prebuild" "latest" "/opt/shlink" "shlink*_php8.5_dist.zip"
 
-    restore_backup
+    msg_info "Restoring Data"
+    cp /opt/shlink.env.bak /opt/shlink/.env
+    rm -f /opt/shlink.env.bak
+    cp -r /opt/shlink_data_backup/. /opt/shlink/data
+    rm -rf /opt/shlink_data_backup
+    msg_ok "Restored Data"
 
     msg_info "Updating Application"
     cd /opt/shlink

ct/slskd.sh

@@ -36,17 +36,19 @@ function update_script() {
     [[ -f /etc/systemd/system/soularr.service ]] && systemctl stop soularr.timer soularr.service
     msg_ok "Stopped Service(s)"
 
-    create_backup /opt/slskd/config/slskd.yml
+    msg_info "Backing up config"
+    cp /opt/slskd/config/slskd.yml /opt/slskd.yml.bak
+    msg_ok "Backed up config"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Slskd" "slskd/slskd" "prebuild" "latest" "/opt/slskd" "slskd-*-linux-$(arch_resolve "x64" "arm64").zip"
 
-    restore_backup
+    msg_info "Restoring config"
+    mv /opt/slskd.yml.bak /opt/slskd/config/slskd.yml
 
-    msg_info "Migrating config"
     # Migrate 0.25.0 breaking config key renames
     sed -i 's/^global:/transfers:/' /opt/slskd/config/slskd.yml
     sed -i 's/^integration:/integrations:/' /opt/slskd/config/slskd.yml
-    msg_ok "Migrated config"
+    msg_ok "Restored config"
 
     msg_info "Starting Service(s)"
     systemctl start slskd
@@ -61,11 +63,13 @@ function update_script() {
       msg_ok "Stopped Timer and Service"
     fi
 
-    create_backup /opt/soularr/config.ini /opt/soularr/run.sh
+    msg_info "Backing up Soularr config"
+    cp /opt/soularr/config.ini /opt/soularr_config.ini.bak
+    cp /opt/soularr/run.sh /opt/soularr_run.sh.bak
+    msg_ok "Backed up Soularr config"
 
     PYTHON_VERSION="3.11" setup_uv
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Soularr" "mrusse/soularr" "tarball" "latest" "/opt/soularr"
-    restore_backup
     msg_info "Updating Soularr"
     cd /opt/soularr
     $STD uv venv -c venv
@@ -74,6 +78,11 @@ function update_script() {
     deactivate
     msg_ok "Updated Soularr"
 
+    msg_info "Restoring Soularr config"
+    mv /opt/soularr_config.ini.bak /opt/soularr/config.ini
+    mv /opt/soularr_run.sh.bak /opt/soularr/run.sh
+    msg_ok "Restored Soularr config"
+
     msg_info "Starting Soularr Timer"
     systemctl restart soularr.timer
     msg_ok "Started Soularr Timer"

ct/solidtime.sh

@@ -35,11 +35,19 @@ function update_script() {
     systemctl stop caddy
     msg_ok "Stopped Services"
 
-    create_backup /opt/solidtime/.env /opt/solidtime/storage
+    msg_info "Backing up Data"
+    cp /opt/solidtime/.env /opt/solidtime.env.bak
+    cp -r /opt/solidtime/storage /opt/solidtime_storage_backup
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "solidtime" "solidtime-io/solidtime" "tarball"
 
-    restore_backup
+    msg_info "Restoring Data"
+    cp /opt/solidtime.env.bak /opt/solidtime/.env
+    rm -f /opt/solidtime.env.bak
+    cp -r /opt/solidtime_storage_backup/. /opt/solidtime/storage
+    rm -rf /opt/solidtime_storage_backup
+    msg_ok "Restored Data"
 
     msg_info "Updating Application"
     cd /opt/solidtime

ct/soulsync.sh

@@ -37,12 +37,13 @@ function update_script() {
     systemctl stop soulsync
     msg_ok "Stopped Service"
 
-    create_backup /opt/soulsync/config /opt/soulsync/data
+    msg_info "Backing up Data"
+    mv /opt/soulsync/config /opt/soulsync-config.bak
+    mv /opt/soulsync/data /opt/soulsync-data.bak
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "soulsync" "Nezreka/SoulSync" "tarball"
 
-    restore_backup
-
     msg_info "Updating Python Dependencies"
     cd /opt/soulsync
     $STD uv venv --clear /opt/soulsync/.venv --python 3.11
@@ -55,6 +56,9 @@ function update_script() {
     $STD npm run build
     msg_ok "Built WebUI"
 
+    mv /opt/soulsync-config.bak /opt/soulsync/config
+    mv /opt/soulsync-data.bak /opt/soulsync/data
+
     msg_info "Starting Service"
     systemctl start soulsync
     msg_ok "Started Service"

ct/sparkyfitness.sh

@@ -35,12 +35,18 @@ function update_script() {
     systemctl stop sparkyfitness-server nginx
     msg_ok "Stopped Services"
 
-    create_backup /opt/sparkyfitness/SparkyFitnessServer/uploads /opt/sparkyfitness/SparkyFitnessServer/backup
+    msg_info "Backing up data"
+    mkdir -p /opt/sparkyfitness_backup
+    if [[ -d /opt/sparkyfitness/SparkyFitnessServer/uploads ]]; then
+      cp -r /opt/sparkyfitness/SparkyFitnessServer/uploads /opt/sparkyfitness_backup/
+    fi
+    if [[ -d /opt/sparkyfitness/SparkyFitnessServer/backup ]]; then
+      cp -r /opt/sparkyfitness/SparkyFitnessServer/backup /opt/sparkyfitness_backup/
+    fi
+    msg_ok "Backed up data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "sparkyfitness" "CodeWithCJ/SparkyFitness" "tarball"
 
-    restore_backup
-
     PNPM_VERSION="$(jq -r '.packageManager | split("@")[1]' /opt/sparkyfitness/package.json)"
     NODE_VERSION="25" NODE_MODULE="pnpm@${PNPM_VERSION}" setup_nodejs
 
@@ -90,6 +96,11 @@ EOF
     systemctl daemon-reload
     msg_ok "Refreshed SparkyFitness Service"
 
+    msg_info "Restoring data"
+    cp -r /opt/sparkyfitness_backup/. /opt/sparkyfitness/SparkyFitnessServer/
+    rm -rf /opt/sparkyfitness_backup
+    msg_ok "Restored data"
+
     msg_info "Starting Services"
     $STD systemctl start sparkyfitness-server nginx
     msg_ok "Started Services"

ct/spliit.sh

@@ -35,11 +35,16 @@ function update_script() {
     systemctl stop spliit
     msg_ok "Stopped Service"
 
-    create_backup /opt/spliit/.env
+    msg_info "Backing up Configuration"
+    rm -f /opt/spliit.env.bak
+    cp /opt/spliit/.env /opt/spliit.env.bak
+    msg_ok "Backed up Configuration"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "spliit" "spliit-app/spliit" "tarball"
 
-    restore_backup
+    msg_info "Restoring Configuration"
+    cp /opt/spliit.env.bak /opt/spliit/.env
+    msg_ok "Restored Configuration"
 
     msg_info "Building Application"
     cd /opt/spliit

ct/spoolman.sh

@@ -36,16 +36,18 @@ function update_script() {
     systemctl stop spoolman
     msg_ok "Stopped Service"
 
-    create_backup /opt/spoolman/.env
+    msg_info "Creating Backup"
+    [ -d /opt/spoolman_bak ] && rm -rf /opt/spoolman_bak
+    mv /opt/spoolman /opt/spoolman_bak
+    msg_ok "Created Backup"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "spoolman" "Donkie/Spoolman" "prebuild" "latest" "/opt/spoolman" "spoolman.zip"
+    fetch_and_deploy_gh_release "spoolman" "Donkie/Spoolman" "prebuild" "latest" "/opt/spoolman" "spoolman.zip"
-
-    restore_backup
 
     msg_info "Updating Spoolman"
     cd /opt/spoolman
     $STD uv sync --locked --no-install-project
     $STD uv sync --locked
+    cp /opt/spoolman_bak/.env /opt/spoolman
     sed -i 's|^ExecStart=.*|ExecStart=/usr/bin/bash /opt/spoolman/scripts/start.sh|' /etc/systemd/system/spoolman.service
     msg_ok "Updated Spoolman"
 

ct/storyteller.sh

@@ -37,11 +37,15 @@ function update_script() {
     systemctl stop storyteller
     msg_ok "Stopped Service"
 
-    create_backup /opt/storyteller/.env
+    msg_info "Backing up Data"
+    cp /opt/storyteller/.env /opt/storyteller_env.bak
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gl_release "storyteller" "storyteller-platform/storyteller" "tarball" "latest" "/opt/storyteller" "" "web-v2"
 
-    restore_backup
+    msg_info "Restoring Configuration"
+    mv /opt/storyteller_env.bak /opt/storyteller/.env
+    msg_ok "Restored Configuration"
 
     msg_info "Rebuilding Storyteller"
     cd /opt/storyteller

ct/tandoor.sh

@@ -43,15 +43,17 @@ function update_script() {
     systemctl stop tandoor
     msg_ok "Stopped Service"
 
-    create_backup /opt/tandoor/config /opt/tandoor/api /opt/tandoor/mediafiles /opt/tandoor/staticfiles /opt/tandoor/.env
+    msg_info "Creating Backup"
+    mv /opt/tandoor /opt/tandoor.bak
+    msg_ok "Backup Created"
 
     NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
     PYTHON_VERSION="3.13" setup_uv
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "tandoor" "TandoorRecipes/recipes" "tarball" "latest" "/opt/tandoor"
+    fetch_and_deploy_gh_release "tandoor" "TandoorRecipes/recipes" "tarball" "latest" "/opt/tandoor"
-
-    restore_backup
 
     msg_info "Updating Tandoor"
+    cp -r /opt/tandoor.bak/{config,api,mediafiles,staticfiles} /opt/tandoor/
+    mv /opt/tandoor.bak/.env /opt/tandoor/.env
     cd /opt/tandoor
     $STD uv venv --clear .venv --python=python3
     $STD uv pip install -r requirements.txt --python .venv/bin/python
@@ -67,6 +69,7 @@ EOF
     cd /opt/tandoor
     $STD /opt/tandoor/.venv/bin/python manage.py migrate
     $STD /opt/tandoor/.venv/bin/python manage.py collectstatic --no-input
+    rm -rf /opt/tandoor.bak
     msg_ok "Updated Tandoor"
 
     msg_info "Starting Service"

ct/tautulli.sh

@@ -36,12 +36,13 @@ function update_script() {
     systemctl stop tautulli
     msg_ok "Stopped Service"
 
-    create_backup /opt/Tautulli/config.ini /opt/Tautulli/tautulli.db
+    msg_info "Backing up config and database"
+    cp /opt/Tautulli/config.ini /opt/tautulli_config.ini.backup
+    cp /opt/Tautulli/tautulli.db /opt/tautulli.db.backup
+    msg_ok "Backed up config and database"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Tautulli" "Tautulli/Tautulli" "tarball"
 
-    restore_backup
-
     msg_info "Updating Tautulli"
     cd /opt/Tautulli
     TAUTULLI_VERSION=$(get_latest_github_release "Tautulli/Tautulli" "false")
@@ -54,6 +55,12 @@ function update_script() {
     $STD uv pip install "setuptools<81"
     msg_ok "Updated Tautulli"
 
+    msg_info "Restoring config and database"
+    cp /opt/tautulli_config.ini.backup /opt/Tautulli/config.ini
+    cp /opt/tautulli.db.backup /opt/Tautulli/tautulli.db
+    rm -f /opt/{tautulli_config.ini.backup,tautulli.db.backup}
+    msg_ok "Restored config and database"
+
     msg_info "Starting Service"
     systemctl start tautulli
     msg_ok "Started Service"

ct/teable.sh

@@ -36,11 +36,15 @@ function update_script() {
     systemctl stop teable
     msg_ok "Stopped Service"
 
-    create_backup /opt/teable/.env
+    msg_info "Backing up Configuration"
+    cp /opt/teable/.env /opt/teable.env.bak
+    msg_ok "Backed up Configuration"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "teable" "teableio/teable" "tarball"
 
-    restore_backup
+    msg_info "Restoring Configuration"
+    mv /opt/teable.env.bak /opt/teable/.env
+    msg_ok "Restored Configuration"
 
     msg_info "Rebuilding Teable"
     cd /opt/teable

ct/teddycloud.sh

@@ -34,11 +34,16 @@ function update_script() {
     systemctl stop teddycloud
     msg_ok "Stopped Service"
 
-    create_backup /opt/teddycloud/certs /opt/teddycloud/config /opt/teddycloud/data
+    msg_info "Creating backup"
+    mv /opt/teddycloud /opt/teddycloud_bak
+    msg_ok "Backup created"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "teddycloud" "toniebox-reverse-engineering/teddycloud" "prebuild" "latest" "/opt/teddycloud" "teddycloud.amd64.release*.zip"
 
-    restore_backup
+    msg_info "Restoring data"
+    cp -R /opt/teddycloud_bak/certs /opt/teddycloud_bak/config /opt/teddycloud_bak/data /opt/teddycloud
+    rm -rf /opt/teddycloud_bak
+    msg_ok "Data restored"
 
     msg_info "Starting Service"
     systemctl start teddycloud

ct/termix.sh

@@ -143,12 +143,13 @@ EOF
     fi
     msg_ok "Migrated Configuration"
 
-    create_backup /opt/termix/data /opt/termix/uploads
+    msg_info "Backing up Data"
+    cp -r /opt/termix/data /opt/termix_data_backup
+    cp -r /opt/termix/uploads /opt/termix_uploads_backup
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "termix" "Termix-SSH/Termix" "tarball"
 
-    restore_backup
-
     msg_info "Recreating Directories"
     mkdir -p /opt/termix/html \
       /opt/termix/nginx \
@@ -176,6 +177,12 @@ EOF
     $STD npm cache clean --force
     msg_ok "Set up Production Dependencies"
 
+    msg_info "Restoring Data"
+    cp -r /opt/termix_data_backup /opt/termix/data
+    cp -r /opt/termix_uploads_backup /opt/termix/uploads
+    rm -rf /opt/termix_data_backup /opt/termix_uploads_backup
+    msg_ok "Restored Data"
+
     msg_info "Updating Frontend Files"
     rm -rf /opt/termix/html/*
     cp -r /opt/termix/dist/* /opt/termix/html/ 2>/dev/null || true

ct/tianji.sh

@@ -36,11 +36,12 @@ function update_script() {
     systemctl stop tianji
     msg_ok "Stopped Service"
 
-    create_backup /opt/tianji/src/server/.env
+    msg_info "Backing up data"
+    cp /opt/tianji/src/server/.env /opt/.env
+    mv /opt/tianji /opt/tianji_bak
+    msg_ok "Backed up data"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "tianji" "msgbyte/tianji" "tarball"
+    fetch_and_deploy_gh_release "tianji" "msgbyte/tianji" "tarball"
-
-    restore_backup
 
     msg_info "Updating Tianji"
     cd /opt/tianji
@@ -51,8 +52,10 @@ function update_script() {
     mkdir -p ./src/server/public
     cp -r ./geo ./src/server/public
     $STD pnpm build:server
+    mv /opt/.env /opt/tianji/src/server/.env
     cd src/server
     $STD pnpm db:migrate:apply
+    rm -rf /opt/tianji_bak
     rm -rf /opt/tianji/src/client
     rm -rf /opt/tianji/website
     rm -rf /opt/tianji/reporter

ct/transmute.sh

@@ -40,12 +40,13 @@ function update_script() {
     systemctl stop transmute
     msg_ok "Stopped Service"
 
-    create_backup /opt/transmute/backend/.env /opt/transmute/data
+    msg_info "Backing up Data"
+    cp /opt/transmute/backend/.env /opt/transmute.env.bak
+    cp -r /opt/transmute/data /opt/transmute_data_bak
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "transmute" "transmute-app/transmute" "tarball"
 
-    restore_backup
-
     msg_info "Updating Python Dependencies"
     cd /opt/transmute
     $STD uv venv --clear /opt/transmute/.venv
@@ -58,6 +59,12 @@ function update_script() {
     $STD npm run build
     msg_ok "Rebuilt Frontend"
 
+    msg_info "Restoring Data"
+    cp /opt/transmute.env.bak /opt/transmute/backend/.env
+    cp -r /opt/transmute_data_bak/. /opt/transmute/data/
+    rm -f /opt/transmute.env.bak
+    rm -rf /opt/transmute_data_bak
+    msg_ok "Restored Data"
 
     msg_info "Starting Service"
     systemctl start transmute

ct/tubearchivist.sh

@@ -35,12 +35,12 @@ function update_script() {
     systemctl stop tubearchivist tubearchivist-celery tubearchivist-beat
     msg_ok "Stopped Services"
 
-    create_backup /opt/tubearchivist/.env
+    msg_info "Backing up Data"
+    cp /opt/tubearchivist/.env /opt/tubearchivist_env.bak
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "tubearchivist" "tubearchivist/tubearchivist" "tarball"
 
-    restore_backup
-
     msg_info "Rebuilding Tube Archivist"
     cd /opt/tubearchivist/frontend
     $STD npm install
@@ -56,6 +56,7 @@ function update_script() {
     msg_ok "Rebuilt Tube Archivist"
 
     msg_info "Restoring Configuration"
+    mv /opt/tubearchivist_env.bak /opt/tubearchivist/.env
     sed -i 's|^TA_APP_DIR=/opt/tubearchivist$|TA_APP_DIR=/opt/tubearchivist/backend|' /opt/tubearchivist/.env
     sed -i 's|^TA_CACHE_DIR=/opt/tubearchivist/cache$|TA_CACHE_DIR=/cache|' /opt/tubearchivist/.env
     sed -i 's|^TA_MEDIA_DIR=/opt/tubearchivist/media$|TA_MEDIA_DIR=/youtube|' /opt/tubearchivist/.env

ct/umami.sh

@@ -34,9 +34,9 @@ function update_script() {
     systemctl stop umami
     msg_ok "Stopped Service"
 
-    create_backup /opt/umami/.env
+    mv /opt/umami/.env /opt/.env.bak
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "umami" "umami-software/umami" "tarball"
-    restore_backup
+    mv /opt/.env.bak /opt/umami/.env
 
     msg_info "Updating Umami"
     cd /opt/umami

ct/umlautadaptarr.sh

@@ -34,9 +34,9 @@ function update_script() {
     systemctl stop umlautadaptarr
     msg_ok "Stopped Service"
 
-    create_backup /opt/UmlautAdaptarr/appsettings.json
+    cp /opt/UmlautAdaptarr/appsettings.json /opt/UmlautAdaptarr/appsettings.json.bak
     fetch_and_deploy_gh_release "UmlautAdaptarr" "PCJones/Umlautadaptarr" "prebuild" "latest" "/opt/UmlautAdaptarr" "linux-x64.zip"
-    restore_backup
+    cp /opt/UmlautAdaptarr/appsettings.json.bak /opt/UmlautAdaptarr/appsettings.json
 
     msg_info "Starting Service"
     systemctl start umlautadaptarr

ct/wallabag.sh

@@ -38,11 +38,16 @@ function update_script() {
     systemctl stop nginx php8.3-fpm
     msg_ok "Stopped Services"
 
-    create_backup /opt/wallabag/app/config/parameters.yml
+    msg_info "Creating Backup"
+    cp /opt/wallabag/app/config/parameters.yml /tmp/wallabag_parameters.yml.bak
+    msg_ok "Created Backup"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "wallabag" "wallabag/wallabag" "prebuild" "latest" "/opt/wallabag" "wallabag-*.tar.gz"
 
-    restore_backup
+    msg_info "Restoring Configuration"
+    cp /tmp/wallabag_parameters.yml.bak /opt/wallabag/app/config/parameters.yml
+    rm -f /tmp/wallabag_parameters.yml.bak
+    msg_ok "Restored Configuration"
 
     msg_info "Running Migrations"
     cd /opt/wallabag

ct/wealthfolio.sh

@@ -39,13 +39,20 @@ function update_script() {
     systemctl stop wealthfolio
     msg_ok "Stopped Service"
 
-    create_backup /opt/wealthfolio_data /opt/wealthfolio/.env
+    msg_info "Backing up Data"
+    cp -r /opt/wealthfolio_data /opt/wealthfolio_data_backup
+    cp /opt/wealthfolio/.env /opt/wealthfolio_env_backup
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "wealthfolio" "wealthfolio/wealthfolio" "prebuild" "latest" "/opt/wealthfolio" "wealthfolio-server-*-linux-amd64.tar.gz"
-
-    restore_backup
     install -m 755 /opt/wealthfolio/wealthfolio-server /usr/local/bin/wealthfolio-server
 
+    msg_info "Restoring Data"
+    cp -r /opt/wealthfolio_data_backup/. /opt/wealthfolio_data
+    cp /opt/wealthfolio_env_backup /opt/wealthfolio/.env
+    rm -rf /opt/wealthfolio_data_backup /opt/wealthfolio_env_backup
+    msg_ok "Restored Data"
+
     msg_info "Starting Service"
     systemctl start wealthfolio
     msg_ok "Started Service"

ct/web-check.sh

@@ -34,12 +34,16 @@ function update_script() {
     systemctl stop web-check
     msg_ok "Stopped Service"
 
-    create_backup /opt/web-check/.env
+    msg_info "Creating backup"
+    mv /opt/web-check/.env /opt
+    msg_ok "Created backup"
 
     NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "web-check" "Lissy93/web-check" "tarball"
 
-    restore_backup
+    msg_info "Restoring backup"
+    mv /opt/.env /opt/web-check
+    msg_ok "Restored backup"
 
     msg_info "Building Web-Check"
     cd /opt/web-check 

ct/webtrees.sh

@@ -36,12 +36,17 @@ function update_script() {
     systemctl stop caddy php${PHP_VER}-fpm
     msg_ok "Stopped Service"
 
-    create_backup /opt/webtrees/data
+    msg_info "Backing up Data"
+    cp -r /opt/webtrees/data /opt/webtrees_data_backup
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "webtrees" "fisharebest/webtrees" "prebuild" "latest" "/opt/webtrees" "webtrees-*.zip"
 
-    restore_backup
+    msg_info "Restoring Data"
+    cp -r /opt/webtrees_data_backup/. /opt/webtrees/data
+    rm -rf /opt/webtrees_data_backup
     chown -R www-data:www-data /opt/webtrees
+    msg_ok "Restored Data"
 
     msg_info "Starting Service"
     systemctl start caddy php${PHP_VER}-fpm

ct/wishlist.sh

@@ -35,13 +35,16 @@ function update_script() {
     systemctl stop wishlist
     msg_ok "Stopped Service"
 
-    create_backup /opt/wishlist/.env /opt/wishlist/uploads /opt/wishlist/data
+    msg_info "Creating Backup"
+    mkdir -p /opt/wishlist-backup
+    cp /opt/wishlist/.env /opt/wishlist-backup/.env
+    cp -a /opt/wishlist/uploads /opt/wishlist-backup
+    cp -a /opt/wishlist/data /opt/wishlist-backup
+    msg_ok "Created Backup"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "wishlist" "cmintey/wishlist" "tarball"
     LATEST_APP_VERSION=$(get_latest_github_release "cmintey/wishlist")
 
-    restore_backup
-
     msg_info "Updating Wishlist"
     cd /opt/wishlist
     $STD pnpm install --frozen-lockfile
@@ -54,6 +57,13 @@ function update_script() {
     $STD pnpm prune --prod
     chmod +x /opt/wishlist/entrypoint.sh
 
+    msg_info "Restoring Backup"
+    cp /opt/wishlist-backup/.env /opt/wishlist/.env
+    cp -a /opt/wishlist-backup/uploads /opt/wishlist
+    cp -a /opt/wishlist-backup/data /opt/wishlist
+    rm -rf /opt/wishlist-backup
+    msg_ok "Restored Backup"
+    
     msg_ok "Updated Wishlist"
     msg_info "Starting Service"
     systemctl start wishlist

ct/writefreely.sh

@@ -35,11 +35,19 @@ function update_script() {
     systemctl stop writefreely
     msg_ok "Stopped Services"
 
-    create_backup /opt/writefreely/keys /opt/writefreely/config.ini
+    msg_info "Creating Backup"
+    mkdir -p /tmp/writefreely_backup
+    cp /opt/writefreely/keys /tmp/writefreely_backup/ 2>/dev/null
+    cp /opt/writefreely/config.ini /tmp/writefreely_backup/ 2>/dev/null
+    msg_ok "Created Backup"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "writefreely" "writefreely/writefreely" "prebuild" "latest" "/opt/writefreely" "writefreely_*_linux_$(arch_resolve).tar.gz"
 
-    restore_backup
+    msg_info "Restoring Data"
+    cp /tmp/writefreely_backup/config.ini /opt/writefreely/ 2>/dev/null
+    cp /tmp/writefreely_backup/keys/* /opt/writefreely/keys/ 2>/dev/null
+    rm -rf /tmp/writefreely_backup
+    msg_ok "Restored Data"
 
     msg_info "Running Post-Update Tasks"
     cd /opt/writefreely

ct/xyops.sh

@@ -35,12 +35,13 @@ function update_script() {
     systemctl stop xyops
     msg_ok "Stopped Service"
 
-    create_backup /opt/xyops/data /opt/xyops/conf
+    msg_info "Backing up Data"
+    cp -r /opt/xyops/data /opt/xyops_data_backup
+    cp -r /opt/xyops/conf /opt/xyops_conf_backup
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "xyops" "pixlcore/xyops" "tarball"
 
-    restore_backup
-
     msg_info "Rebuilding Application"
     cd /opt/xyops
     $STD npm install
@@ -48,6 +49,12 @@ function update_script() {
     chmod 644 /opt/xyops/node_modules/useragent-ng/lib/regexps.js
     msg_ok "Rebuilt Application"
 
+    msg_info "Restoring Data"
+    cp -r /opt/xyops_data_backup/. /opt/xyops/data
+    cp -r /opt/xyops_conf_backup/. /opt/xyops/conf
+    rm -rf /opt/xyops_data_backup /opt/xyops_conf_backup
+    msg_ok "Restored Data"
+
     msg_info "Starting Service"
     systemctl start xyops
     msg_ok "Started Service"

ct/yamtrack.sh

@@ -36,17 +36,22 @@ function update_script() {
     systemctl stop yamtrack yamtrack-celery
     msg_ok "Stopped Services"
 
-    create_backup /opt/yamtrack/src/.env
+    msg_info "Backing up Data"
+    cp /opt/yamtrack/src/.env /opt/yamtrack_env.bak
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "yamtrack" "FuzzyGrim/Yamtrack" "tarball"
 
-    restore_backup
-
     msg_info "Installing Python Dependencies"
     cd /opt/yamtrack
     $STD uv sync --locked
     msg_ok "Installed Python Dependencies"
 
+    msg_info "Restoring Data"
+    cp /opt/yamtrack_env.bak /opt/yamtrack/src/.env
+    rm -f /opt/yamtrack_env.bak
+    msg_ok "Restored Data"
+
     msg_info "Updating Yamtrack"
     cd /opt/yamtrack/src
     $STD /opt/yamtrack/.venv/bin/python manage.py migrate

ct/yourls.sh

@@ -35,13 +35,18 @@ function update_script() {
     systemctl stop nginx
     msg_ok "Stopped Service"
 
-    create_backup /opt/yourls/user
+    msg_info "Backing up Configuration"
+    cp -r /opt/yourls/user /opt/yourls_user.bak
+    msg_ok "Backed up Configuration"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "yourls" "YOURLS/YOURLS" "tarball"
-
-    restore_backup
     chown -R www-data:www-data /opt/yourls
 
+    msg_info "Restoring Configuration"
+    cp -r /opt/yourls_user.bak/. /opt/yourls/user/
+    rm -rf /opt/yourls_user.bak
+    msg_ok "Restored Configuration"
+
     msg_info "Starting Service"
     systemctl start nginx
     msg_ok "Started Service"

ct/zerobyte.sh

@@ -35,14 +35,14 @@ function update_script() {
     systemctl stop zerobyte
     msg_ok "Stopped Service"
 
-    create_backup /opt/zerobyte/.env
+    msg_info "Backing up Configuration"
+    cp /opt/zerobyte/.env /opt/zerobyte.env.bak
+    msg_ok "Backed up Configuration"
     
     ensure_dependencies git
     NODE_VERSION="24" setup_nodejs
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "zerobyte" "nicotsx/zerobyte" "tarball"
 
-    restore_backup
-
     msg_info "Building Zerobyte"
     export NODE_OPTIONS="--max-old-space-size=3072"
     cd /opt/zerobyte
@@ -50,6 +50,11 @@ function update_script() {
     $STD node ./node_modules/vite/bin/vite.js build
     msg_ok "Built Zerobyte"
 
+    msg_info "Restoring Configuration"
+    cp /opt/zerobyte.env.bak /opt/zerobyte/.env
+    rm -f /opt/zerobyte.env.bak
+    msg_ok "Restored Configuration"
+
     msg_info "Starting Service"
     systemctl start zerobyte
     msg_ok "Started Service"

ct/zigbee2mqtt.sh

@@ -37,24 +37,24 @@ function update_script() {
 
     msg_info "Creating Backup"
     ensure_dependencies zstd
-    mkdir -p /opt/backups
+    mkdir -p /opt/{backups,z2m_backup}
     BACKUP_VERSION="$(<"$HOME/.zigbee2mqtt")"
     BACKUP_FILE="/opt/backups/${APP}_backup_${BACKUP_VERSION}.tar.zst"
     $STD tar -cf - -C /opt zigbee2mqtt | zstd -q -o "$BACKUP_FILE"
     ls -t /opt/backups/${APP}_backup_*.tar.zst 2>/dev/null | tail -n +6 | xargs -r rm -f
+    mv /opt/zigbee2mqtt/data /opt/z2m_backup/data
     msg_ok "Backup Created (${BACKUP_VERSION})"
 
-    create_backup /opt/zigbee2mqtt/data
-
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Zigbee2MQTT" "Koenkk/zigbee2mqtt" "tarball" "latest" "/opt/zigbee2mqtt"
 
-    restore_backup
-
     msg_info "Updating Zigbee2MQTT"
+    rm -rf /opt/zigbee2mqtt/data
+    mv /opt/z2m_backup/data /opt/zigbee2mqtt
     cd /opt/zigbee2mqtt
     grep -q "^packageImportMethod" ./pnpm-workspace.yaml 2>/dev/null || echo "packageImportMethod: hardlink" >>./pnpm-workspace.yaml
     $STD pnpm install --frozen-lockfile
     $STD pnpm build
+    rm -rf /opt/z2m_backup
     msg_ok "Updated Zigbee2MQTT"
 
     msg_info "Starting Service"

install/anytype-server-install.sh

@@ -16,7 +16,7 @@ update_os
 setup_mongodb
 
 msg_info "Configuring MongoDB Replica Set"
-cat <<EOF >>/etc/mongod.conf
+cat <<EOF >/etc/mongod.conf
 
 replication:
   replSetName: "rs0"

install/nametag-install.sh

@@ -20,7 +20,7 @@ fetch_and_deploy_gh_release "nametag" "mattogodoy/nametag" "tarball" "latest" "/
 
 msg_info "Setting up Application"
 cd /opt/nametag
-$STD npm ci --include=dev
+$STD npm ci
 DATABASE_URL="postgresql://${PG_DB_USER}:${PG_DB_PASS}@127.0.0.1:5432/${PG_DB_NAME}" $STD npx prisma generate
 DATABASE_URL="postgresql://${PG_DB_USER}:${PG_DB_PASS}@127.0.0.1:5432/${PG_DB_NAME}" $STD npx prisma migrate deploy
 msg_ok "Set up Application"

install/pangolin-install.sh

@@ -22,7 +22,7 @@ msg_ok "Installed Dependencies"
 NODE_VERSION="24" setup_nodejs
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="pangolin" PG_DB_USER="pangolin" setup_postgresql_db
-PANGOLIN_VERSION="${PANGOLIN_VERSION:-1.21.0}"
+PANGOLIN_VERSION="${PANGOLIN_VERSION:-1.20.0}"
 fetch_and_deploy_gh_release "pangolin" "fosrl/pangolin" "tarball" "$PANGOLIN_VERSION"
 fetch_and_deploy_gh_release "gerbil" "fosrl/gerbil" "singlefile" "latest" "/usr/bin" "gerbil_linux_$(arch_resolve)"
 fetch_and_deploy_gh_release "traefik" "traefik/traefik" "prebuild" "latest" "/usr/bin" "traefik_v*_linux_$(arch_resolve).tar.gz"

misc/build.func

@@ -3831,78 +3831,6 @@ runtime_script_status_guard() {
   return 0
 }
 
-# ------------------------------------------------------------------------------
-# check_container_os_guard()
-#
-# - Compares the container OS (/etc/os-release) with the script's recommended
-#   var_os/var_version before running update_script
-# - On mismatch: interactive runs ask whether to continue (default: no);
-#   headless runs (PHS_SILENT=1 / no tty) abort instead of updating on an
-#   unsupported base and leaving the app broken mid-update
-# - Bypass via var_ignore_os_mismatch=1|yes|true|on (still warns, but continues)
-# ------------------------------------------------------------------------------
-check_container_os_guard() {
-  local rec_os="${var_os:-}" rec_ver="${var_version:-}"
-  rec_os="${rec_os,,}"
-  [[ -z "$rec_os" || -z "$rec_ver" ]] && return 0
-  [[ -r /etc/os-release ]] || return 0
-
-  local cur_os cur_ver
-  cur_os="$(. /etc/os-release 2>/dev/null; echo "${ID:-}")"
-  cur_ver="$(. /etc/os-release 2>/dev/null; echo "${VERSION_ID:-}")"
-  cur_os="${cur_os,,}"
-  [[ -z "$cur_os" || -z "$cur_ver" ]] && return 0
-
-  # Exact version or prefix on a dot boundary (e.g. alpine 3.22 matches 3.22.1)
-  if [[ "$cur_os" == "$rec_os" ]] && [[ "$cur_ver" == "$rec_ver" || "$cur_ver" == "$rec_ver".* ]]; then
-    return 0
-  fi
-
-  case "${var_ignore_os_mismatch:-}" in
-  1 | yes | true | on)
-    msg_warn "Container OS is ${cur_os} ${cur_ver} but the script recommends ${rec_os} ${rec_ver} — continuing via var_ignore_os_mismatch (may break, no support)."
-    return 0
-    ;;
-  esac
-
-  # Persistent opt-out: stores the ignored target version, so the question
-  # comes back once the script targets a newer OS again
-  local ignore_file="/usr/local/community-scripts/ignore-os-mismatch"
-  if [[ -f "$ignore_file" && "$(cat "$ignore_file" 2>/dev/null)" == "${rec_os} ${rec_ver}" ]]; then
-    msg_warn "Container OS is ${cur_os} ${cur_ver} but the script recommends ${rec_os} ${rec_ver} — continuing (previously ignored via ${ignore_file}, may break, no support)."
-    return 0
-  fi
-
-  if [[ "${PHS_SILENT:-0}" != "1" ]] && command -v whiptail &>/dev/null && [ -t 0 ] && [[ "$TERM" != "dumb" ]]; then
-    local choice
-    choice=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "OS VERSION MISMATCH" --menu \
-      "This container runs ${cur_os} ${cur_ver}, but this script now targets ${rec_os} ${rec_ver}.\n\nUpdating on the older base OS may fail or leave ${APP:-the application} broken (e.g. required runtime versions are not available).\n\nRecommended: upgrade the container OS to ${rec_os} ${rec_ver} first, then run this update again.\n\nIf you continue anyway, it may break — no support is provided in that case.\n\nContinue anyway?" \
-      20 70 3 \
-      "1" "No  (cancel update)" \
-      "2" "Yes (continue this time)" \
-      "3" "Yes (continue and don't ask again)" \
-      --nocancel --default-item "1" 3>&1 1>&2 2>&3)
-    case "$choice" in
-    2)
-      msg_warn "Continuing update on ${cur_os} ${cur_ver} despite recommended ${rec_os} ${rec_ver} — may break, no support."
-      return 0
-      ;;
-    3)
-      mkdir -p "${ignore_file%/*}"
-      echo "${rec_os} ${rec_ver}" >"$ignore_file"
-      msg_warn "Continuing update on ${cur_os} ${cur_ver}; OS check for ${rec_os} ${rec_ver} disabled via ${ignore_file} — may break, no support."
-      return 0
-      ;;
-    esac
-    msg_error "Update cancelled: container OS ${cur_os} ${cur_ver} does not match the recommended ${rec_os} ${rec_ver}."
-    return 1
-  fi
-
-  msg_error "Container OS ${cur_os} ${cur_ver} does not match the recommended ${rec_os} ${rec_ver} — skipping update."
-  msg_error "Upgrade the container OS to ${rec_os} ${rec_ver} first, then run this update again — or bypass this check (may break, no support) with: echo \"${rec_os} ${rec_ver}\" > ${ignore_file}"
-  return 1
-}
-
 # ------------------------------------------------------------------------------
 # start()
 #
@@ -3924,7 +3852,6 @@ start() {
     ensure_profile_loaded
     get_lxc_ip
     runtime_script_status_guard update || return 0
-    check_container_os_guard || return 0
     update_script
     run_addon_updates
     update_motd_ip
@@ -3936,7 +3863,6 @@ start() {
     ensure_profile_loaded
     get_lxc_ip
     runtime_script_status_guard update || return 0
-    check_container_os_guard || return 0
     update_script
     run_addon_updates
     update_motd_ip
@@ -3967,7 +3893,6 @@ start() {
     ensure_profile_loaded
     get_lxc_ip
     runtime_script_status_guard update || return 0
-    check_container_os_guard || return 0
     update_script
     run_addon_updates
     update_motd_ip
@@ -5215,10 +5140,7 @@ EOF
     echo -en "${YW}Select option [1-${max_option}] (default: 1, auto-remove in 60s): ${CL}"
 
     local response=""
-    local read_rc
+    if read -t 60 -r response; then
-    read -t 60 -r response
-    read_rc=$?
-    if [[ $read_rc -eq 0 ]]; then
       case "${response:-1}" in
       1)
         # Remove container
@@ -5437,20 +5359,13 @@ EOF
         fi
         ;;
       esac
-    elif [[ $read_rc -gt 128 ]]; then
+    else
       # Timeout - auto-remove
       echo ""
       msg_info "No response - removing container ${CTID}"
       pct stop "$CTID" &>/dev/null || true
       pct destroy "$CTID" &>/dev/null || true
       msg_ok "Container ${CTID} removed"
-    else
-      # read itself failed (e.g. broken/closed stdin, I/O error) rather than
-      # timing out - don't guess and destroy the container on a read we
-      # couldn't actually capture; keep it since that's the reversible choice.
-      echo ""
-      msg_error "Could not read your response (stdin error) - keeping container ${CTID} for safety."
-      msg_error "Remove it manually if not needed: pct destroy ${CTID}"
     fi
 
     # Force one final status update attempt after cleanup

misc/error_handler.func

@@ -497,10 +497,7 @@ error_handler() {
       fi
 
       local response=""
-      local read_rc
+      if read -t 60 -r response; then
-      read -t 60 -r response
-      read_rc=$?
-      if [[ $read_rc -eq 0 ]]; then
         if [[ -z "$response" || "$response" =~ ^[Yy]$ ]]; then
           echo ""
           if declare -f msg_info >/dev/null 2>&1; then
@@ -523,7 +520,7 @@ error_handler() {
             echo -e "${YW}Container ${CTID} kept for debugging${CL}"
           fi
         fi
-      elif [[ $read_rc -gt 128 ]]; then
+      else
         # Timeout - auto-remove
         echo ""
         if declare -f msg_info >/dev/null 2>&1; then
@@ -538,18 +535,6 @@ error_handler() {
         else
           echo -e "${GN}✔${CL} Container ${CTID} removed"
         fi
-      else
-        # read itself failed (e.g. broken/closed stdin, I/O error) rather than
-        # timing out - don't guess and destroy the container on a read we
-        # couldn't actually capture; keep it since that's the reversible choice.
-        echo ""
-        if declare -f msg_error >/dev/null 2>&1; then
-          msg_error "Could not read your response (stdin error) - keeping container ${CTID} for safety."
-          msg_error "Remove it manually if not needed: pct destroy ${CTID}"
-        else
-          echo -e "${YW}Could not read your response (stdin error) - keeping container ${CTID} for safety.${CL}"
-          echo -e "${YW}Remove it manually if not needed: pct destroy ${CTID}${CL}"
-        fi
       fi
     fi
   fi

misc/tools.func

@@ -2689,7 +2689,7 @@ fetch_and_deploy_gh_tag() {
 
   local tmpdir
   tmpdir=$(mktemp -d) || return 1
-  trap 'rm -rf "$tmpdir"; trap - RETURN' RETURN
+  trap 'rm -rf "$tmpdir"' RETURN
   local tarball_url="https://github.com/${repo}/archive/refs/tags/${version}.tar.gz"
   local filename="${app_lc}-${version}.tar.gz"
 
@@ -2866,7 +2866,7 @@ fetch_and_deploy_gl_tag() {
 
   local tmpdir
   tmpdir=$(mktemp -d) || return 1
-  trap 'rm -rf "$tmpdir"; trap - RETURN' RETURN
+  trap 'rm -rf "$tmpdir"' RETURN
   local filename="${app_lc}-${version_safe}.tar.gz"
 
   msg_info "Fetching GitLab tag: ${app} (${resolved_tag})"
@@ -2974,7 +2974,7 @@ check_for_gh_release() {
 
   local gh_check_json=""
   gh_check_json=$(mktemp /tmp/tools-gh-check-XXXXXX) || return 73
-  trap 'rm -f "${gh_check_json:-}"; trap - RETURN' RETURN
+  trap 'rm -f "${gh_check_json:-}"' RETURN
 
   # Build auth header if token is available
   local header_args=()
@@ -3574,7 +3574,7 @@ fetch_and_deploy_codeberg_release() {
 
     local tmpdir
     tmpdir=$(mktemp -d) || return 252
-    trap 'rm -rf "$tmpdir"; trap - RETURN' RETURN
+    trap 'rm -rf "$tmpdir"' RETURN
 
     msg_info "Fetching Codeberg tag: $app ($tag_name)"
 
@@ -3616,7 +3616,7 @@ fetch_and_deploy_codeberg_release() {
 
   local codeberg_rel_json
   codeberg_rel_json=$(mktemp /tmp/tools-codeberg-rel-XXXXXX) || return 73
-  trap 'rm -f "$codeberg_rel_json"; rm -rf "${tmpdir:-}" "${unpack_tmp:-}"; trap - RETURN' RETURN
+  trap 'rm -f "$codeberg_rel_json"; rm -rf "${tmpdir:-}" "${unpack_tmp:-}"' RETURN
 
   local attempt=0 success=false resp http_code
 
@@ -4113,7 +4113,7 @@ fetch_and_deploy_gh_release() {
 
   local tmpdir
   tmpdir=$(mktemp -d) || return 1
-  trap 'rm -rf "$tmpdir" "${unpack_tmp:-}"; trap - RETURN' RETURN
+  trap 'rm -rf "$tmpdir" "${unpack_tmp:-}"' RETURN
   local filename="" url=""
 
   msg_info "Fetching GitHub release: $app ($version)"
@@ -9218,7 +9218,7 @@ fetch_and_deploy_from_url() {
     msg_error "Failed to create temporary directory"
     return 252
   }
-  trap 'rm -rf "$tmpdir" "${unpack_tmp:-}"; trap - RETURN' RETURN
+  trap 'rm -rf "$tmpdir" "${unpack_tmp:-}"' RETURN
 
   curl -fsSL -o "$tmpdir/$filename" "$url" || {
     msg_error "Download failed: $url"
@@ -9434,7 +9434,7 @@ check_for_gl_release() {
 
   local gl_check_json
   gl_check_json=$(mktemp /tmp/tools-gl-check-XXXXXX) || return 73
-  trap 'rm -f "$gl_check_json"; trap - RETURN' RETURN
+  trap 'rm -f "$gl_check_json"' RETURN
 
   local repo_encoded
   repo_encoded=$(printf '%s' "$source" | sed 's|/|%2F|g')
@@ -9724,7 +9724,7 @@ fetch_and_deploy_gl_release() {
 
   local gl_rel_json
   gl_rel_json=$(mktemp /tmp/tools-gl-rel-XXXXXX) || return 73
-  trap 'rm -f "$gl_rel_json"; rm -rf "${tmpdir:-}" "${unpack_tmp:-}"; trap - RETURN' RETURN
+  trap 'rm -f "$gl_rel_json"; rm -rf "${tmpdir:-}" "${unpack_tmp:-}"' RETURN
 
   local repo_encoded
   repo_encoded=$(printf '%s' "$repo" | sed 's|/|%2F|g')

tools/pve/storage-share-helper.sh

@@ -1,693 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/refs/heads/main/misc/core.func)
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/api.func) 2>/dev/null || true
-load_functions
-declare -f init_tool_telemetry &>/dev/null && init_tool_telemetry "storage-share-helper" "pve"
-
-set -eEuo pipefail
-
-function header_info() {
-  clear
-  cat <<"EOF"
-    _____ __                                 ___    _________ 
-   / ___// /_____  _________ _____ ____     /   |  /  _/ __ \
-   \__ \/ __/ __ \/ ___/ __ `/ __ `/ _ \   / /| |  / // / / /
-  ___/ / /_/ /_/ / /  / /_/ / /_/ /  __/  / ___ |_/ // /_/ / 
- /____/\__/\____/_/   \__,_/\__, /\___/  /_/  |_/___/_____/  
-                            /____/                            
-
- Proxmox Storage Allrounder
- SMB | NFS | iSCSI | LVM-on-iSCSI | LXC Mountpoints | Host Shares
-EOF
-}
-
-pause() {
-  read -r -p "Press Enter to continue..." _
-}
-
-require_pve() {
-  if ! command -v pct >/dev/null 2>&1 || ! command -v pvesm >/dev/null 2>&1; then
-    msg_error "This script must run on a Proxmox VE host (pct/pvesm missing)."
-    exit 1
-  fi
-}
-
-ensure_packages() {
-  local packages=()
-
-  command -v whiptail >/dev/null 2>&1 || packages+=("whiptail")
-  command -v mount.cifs >/dev/null 2>&1 || packages+=("cifs-utils")
-  command -v showmount >/dev/null 2>&1 || packages+=("nfs-common")
-  command -v iscsiadm >/dev/null 2>&1 || packages+=("open-iscsi")
-
-  if [[ ${#packages[@]} -gt 0 ]]; then
-    msg_info "Installing required packages: ${packages[*]}"
-    apt update >/dev/null 2>&1
-    apt install -y "${packages[@]}" >/dev/null 2>&1
-    msg_ok "Dependencies installed"
-  fi
-}
-
-confirm_start() {
-  whiptail --backtitle "Proxmox VE Helper Scripts" --title "Storage Share Allrounder" \
-    --yesno "This AIO wizard can test and configure SMB/NFS/iSCSI, create/remove Proxmox storages, manage LXC mountpoints and optionally create host shares. Proceed?" 13 100
-}
-
-read_input() {
-  local title="$1"
-  local prompt="$2"
-  local default_value="${3:-}"
-
-  whiptail --backtitle "Proxmox VE Helper Scripts" --title "$title" \
-    --inputbox "$prompt" 11 100 "$default_value" 3>&1 1>&2 2>&3
-}
-
-read_password() {
-  local title="$1"
-  local prompt="$2"
-
-  whiptail --backtitle "Proxmox VE Helper Scripts" --title "$title" \
-    --passwordbox "$prompt" 11 100 3>&1 1>&2 2>&3
-}
-
-confirm_yes_no() {
-  local title="$1"
-  local prompt="$2"
-  local height="${3:-11}"
-  local width="${4:-100}"
-
-  whiptail --backtitle "Proxmox VE Helper Scripts" --title "$title" \
-    --yesno "$prompt" "$height" "$width"
-}
-
-# Destructive confirmation: defaults to "No" so a stray Enter never removes anything.
-confirm_danger() {
-  local title="$1"
-  local prompt="$2"
-  local height="${3:-15}"
-  local width="${4:-100}"
-
-  whiptail --backtitle "Proxmox VE Helper Scripts" --title "$title" \
-    --defaultno --yesno "$prompt" "$height" "$width"
-}
-
-# Shown before slow data gathering. Goes to stderr: inside $(...) captures, stdout is
-# swallowed — stderr is the real terminal.
-show_loading() {
-  echo -e "${YW}Loading... gathering data, this can take a moment (CTRL+C to abort)${CL}" >&2
-}
-
-# Info popup that stays visible inside $(...) captures: whiptail draws its UI on
-# stdout, so without 1>&2 the dialog would be captured and the script appears hung.
-notice_box() {
-  local title="$1"
-  local text="$2"
-  whiptail --backtitle "Proxmox VE Helper Scripts" --title "$title" \
-    --msgbox "$text" 10 80 1>&2
-}
-
-# Interactive container picker (read-only): returns the chosen CTID on stdout.
-pick_container() {
-  local title="$1"
-  local -a rows=()
-  local ctid status name label
-
-  show_loading
-  while IFS=$'\t' read -r ctid status name; do
-    [[ -z "$ctid" ]] && continue
-    label=$(printf '%-58s' "${name:-<no-name>} [${status}]")
-    rows+=("$ctid" "$label")
-  done < <(pct list 2>/dev/null | awk 'NR>1 {print $1"\t"$2"\t"$NF}')
-
-  if [[ ${#rows[@]} -eq 0 ]]; then
-    notice_box "$title" "No LXC containers found on this host."
-    return 1
-  fi
-
-  whiptail --backtitle "Proxmox VE Helper Scripts" --title "$title" \
-    --menu "Select a container:" 24 80 16 "${rows[@]}" 3>&1 1>&2 2>&3
-}
-
-# Interactive multi-select picker over ALL mountpoints across ALL containers (read-only).
-# Returns chosen entries as "<ctid>:<mpX>" tokens on stdout.
-# Reads /etc/pve/lxc/*.conf directly (one 'pct config' per CT is far too slow);
-# awk stops at the first '[section]' so snapshot mp entries are not listed.
-pick_all_mountpoints_multi() {
-  local title="$1"
-  local -a rows=()
-  local conf ctid name line key def label
-
-  show_loading
-  for conf in /etc/pve/lxc/*.conf; do
-    [[ -e "$conf" ]] || continue
-    ctid="$(basename "$conf" .conf)"
-    name=$(awk '/^\[/{exit} $1=="hostname:"{print $2; exit}' "$conf")
-    while IFS= read -r line; do
-      [[ -z "$line" ]] && continue
-      key="${line%%:*}"
-      def="${line#*: }"
-      label=$(printf '%-86s' "CT ${ctid} ${name:-<no-name>} | ${key}: ${def}")
-      rows+=("${ctid}:${key}" "$label" "OFF")
-    done < <(awk '/^\[/{exit} /^mp[0-9]+:/{print}' "$conf")
-  done
-
-  if [[ ${#rows[@]} -eq 0 ]]; then
-    notice_box "$title" "No LXC mountpoints found on any container."
-    return 1
-  fi
-
-  whiptail --backtitle "Proxmox VE Helper Scripts" --title "$title" \
-    --checklist "Select mountpoint(s) to remove across all containers (Space to toggle, Enter to confirm):" \
-    24 112 16 "${rows[@]}" 3>&1 1>&2 2>&3
-}
-
-# Interactive multi-select storage picker (read-only): returns chosen storage IDs on stdout.
-pick_storages_multi() {
-  local title="$1"
-  local -a rows=()
-  local stype sid label
-
-  show_loading
-  while read -r stype sid; do
-    [[ -z "$sid" ]] && continue
-    label=$(printf '%-58s' "[${stype}]")
-    rows+=("$sid" "$label" "OFF")
-  done < <(awk -F': ' '/^[a-z]+: /{print $1, $2}' /etc/pve/storage.cfg 2>/dev/null)
-
-  if [[ ${#rows[@]} -eq 0 ]]; then
-    notice_box "$title" "No storages found in /etc/pve/storage.cfg."
-    return 1
-  fi
-
-  whiptail --backtitle "Proxmox VE Helper Scripts" --title "$title" \
-    --checklist "Select storage(s) to remove (Space to toggle, Enter to confirm):" \
-    24 80 16 "${rows[@]}" 3>&1 1>&2 2>&3
-}
-
-# Interactive multi-select container picker (read-only): returns chosen CTIDs on stdout.
-pick_containers_multi() {
-  local title="$1"
-  local -a rows=()
-  local ctid status name label
-
-  show_loading
-  while IFS=$'\t' read -r ctid status name; do
-    [[ -z "$ctid" ]] && continue
-    label=$(printf '%-58s' "${name:-<no-name>} [${status}]")
-    rows+=("$ctid" "$label" "OFF")
-  done < <(pct list 2>/dev/null | awk 'NR>1 {print $1"\t"$2"\t"$NF}')
-
-  if [[ ${#rows[@]} -eq 0 ]]; then
-    notice_box "$title" "No LXC containers found on this host."
-    return 1
-  fi
-
-  whiptail --backtitle "Proxmox VE Helper Scripts" --title "$title" \
-    --checklist "Select one or more containers (Space to toggle, Enter to confirm):" \
-    24 80 16 "${rows[@]}" 3>&1 1>&2 2>&3
-}
-
-manual_smb_test() {
-  header_info
-  local server share username password domain vers mount_dir mount_opts
-
-  server=$(read_input "SMB Test" "SMB server/IP (e.g. 10.0.1.9)") || return
-  share=$(read_input "SMB Test" "Share name (without leading //)" "Proxmox") || return
-  username=$(read_input "SMB Test" "Username" "proxmox") || return
-  password=$(read_password "SMB Test" "Password for ${username}") || return
-  domain=$(read_input "SMB Test" "Domain/Workgroup (optional, leave empty if not needed)") || return
-  vers=$(read_input "SMB Test" "SMB version (e.g. 3.0, 3.1.1)" "3.1.1") || return
-  mount_dir="/mnt/test-smb"
-
-  mkdir -p "$mount_dir"
-
-  mount_opts="username=${username},password=${password},vers=${vers},sec=ntlmssp"
-  if [[ -n "$domain" ]]; then
-    mount_opts+=";domain=${domain}"
-  fi
-
-  msg_info "Testing SMB mount on ${mount_dir}"
-  if mount -t cifs "//${server}/${share}" "$mount_dir" -o "${mount_opts//;/,}" >/dev/null 2>&1; then
-    touch "${mount_dir}/smb-test-$(date +%s)" >/dev/null 2>&1 || true
-    umount "$mount_dir" >/dev/null 2>&1 || true
-    msg_ok "SMB test successful"
-  else
-    msg_error "SMB test failed. Check network/firewall/credentials/share permissions."
-  fi
-
-  pause
-}
-
-manual_nfs_test() {
-  header_info
-  local server export_path mount_dir
-
-  server=$(read_input "NFS Test" "NFS server/IP (e.g. 10.0.6.159)") || return
-  export_path=$(read_input "NFS Test" "NFS export path (e.g. /srv/proxmox-nfs)") || return
-  mount_dir="/mnt/test-nfs"
-
-  mkdir -p "$mount_dir"
-
-  msg_info "Testing NFS mount on ${mount_dir}"
-  if mount -t nfs "${server}:${export_path}" "$mount_dir" >/dev/null 2>&1; then
-    touch "${mount_dir}/nfs-test-$(date +%s)" >/dev/null 2>&1 || true
-    umount "$mount_dir" >/dev/null 2>&1 || true
-    msg_ok "NFS test successful"
-  else
-    msg_error "NFS test failed. Check export/firewall/network permissions."
-  fi
-
-  pause
-}
-
-manual_iscsi_discovery() {
-  header_info
-  local portal
-
-  portal=$(read_input "iSCSI Discovery" "iSCSI portal IP/FQDN (e.g. 10.0.1.20)") || return
-  msg_info "Running iSCSI target discovery on ${portal}"
-  if iscsiadm -m discovery -t sendtargets -p "$portal"; then
-    msg_ok "iSCSI discovery completed"
-  else
-    msg_error "iSCSI discovery failed"
-  fi
-
-  pause
-}
-
-add_smb_storage() {
-  header_info
-  local storage_id server share username password content nodes options
-
-  storage_id=$(read_input "Add SMB/CIFS Storage" "Storage ID (unique, e.g. smb-media)") || return
-  server=$(read_input "Add SMB/CIFS Storage" "SMB server/IP") || return
-  share=$(read_input "Add SMB/CIFS Storage" "Share name (without //)") || return
-  username=$(read_input "Add SMB/CIFS Storage" "Username") || return
-  password=$(read_password "Add SMB/CIFS Storage" "Password for ${username}") || return
-  content=$(read_input "Add SMB/CIFS Storage" "Content types (comma separated)" "backup,iso,vztmpl,snippets") || return
-  nodes=$(read_input "Add SMB/CIFS Storage" "Nodes (optional, comma separated)") || return
-  options=$(read_input "Add SMB/CIFS Storage" "Mount options (optional, e.g. vers=3.1.1,domain=WORKGROUP)") || return
-
-  local cmd=(pvesm add cifs "$storage_id" --server "$server" --share "$share" --username "$username" --password "$password" --content "$content")
-  [[ -n "$nodes" ]] && cmd+=(--nodes "$nodes")
-  [[ -n "$options" ]] && cmd+=(--options "$options")
-
-  if "${cmd[@]}" >/dev/null 2>&1; then
-    msg_ok "SMB storage '${storage_id}' added"
-  else
-    msg_error "Failed to add SMB storage '${storage_id}'"
-  fi
-
-  pause
-}
-
-add_nfs_storage() {
-  header_info
-  local storage_id server export_path content nodes options
-
-  storage_id=$(read_input "Add NFS Storage" "Storage ID (unique, e.g. nfs-vmdata)") || return
-  server=$(read_input "Add NFS Storage" "NFS server/IP") || return
-  export_path=$(read_input "Add NFS Storage" "Export path") || return
-  content=$(read_input "Add NFS Storage" "Content types (comma separated)" "images,rootdir") || return
-  nodes=$(read_input "Add NFS Storage" "Nodes (optional, comma separated)") || return
-  options=$(read_input "Add NFS Storage" "Mount options (optional)") || return
-
-  local cmd=(pvesm add nfs "$storage_id" --server "$server" --export "$export_path" --content "$content")
-  [[ -n "$nodes" ]] && cmd+=(--nodes "$nodes")
-  [[ -n "$options" ]] && cmd+=(--options "$options")
-
-  if "${cmd[@]}" >/dev/null 2>&1; then
-    msg_ok "NFS storage '${storage_id}' added"
-  else
-    msg_error "Failed to add NFS storage '${storage_id}'"
-  fi
-
-  pause
-}
-
-add_iscsi_storage() {
-  header_info
-  local storage_id portal target nodes
-
-  storage_id=$(read_input "Add iSCSI Storage" "Storage ID (unique, e.g. iscsi-synology)") || return
-  portal=$(read_input "Add iSCSI Storage" "Portal IP/FQDN") || return
-  target=$(read_input "Add iSCSI Storage" "Target IQN (e.g. iqn.2000-01.com.synology:...)") || return
-  nodes=$(read_input "Add iSCSI Storage" "Nodes (optional, comma separated)") || return
-
-  local cmd=(pvesm add iscsi "$storage_id" --portal "$portal" --target "$target")
-  [[ -n "$nodes" ]] && cmd+=(--nodes "$nodes")
-
-  if "${cmd[@]}" >/dev/null 2>&1; then
-    msg_ok "iSCSI storage '${storage_id}' added"
-  else
-    msg_error "Failed to add iSCSI storage '${storage_id}'"
-  fi
-
-  pause
-}
-
-add_lvm_on_base_storage() {
-  header_info
-  local storage_id base_storage vgname content shared
-
-  storage_id=$(read_input "Add LVM Storage" "LVM Storage ID (unique, e.g. lvm-iscsi01)") || return
-  base_storage=$(read_input "Add LVM Storage" "Base storage ID (usually iSCSI storage ID)") || return
-  vgname=$(read_input "Add LVM Storage" "Volume Group name on target") || return
-  content=$(read_input "Add LVM Storage" "Content types (comma separated)" "images,rootdir") || return
-  shared=$(read_input "Add LVM Storage" "Shared across nodes? 1=yes, 0=no" "1") || return
-
-  local cmd=(pvesm add lvm "$storage_id" --base "$base_storage" --vgname "$vgname" --content "$content" --shared "$shared")
-  if "${cmd[@]}" >/dev/null 2>&1; then
-    msg_ok "LVM storage '${storage_id}' added"
-  else
-    msg_error "Failed to add LVM storage '${storage_id}'"
-  fi
-
-  pause
-}
-
-remove_storage() {
-  header_info
-  local selection storage_id
-  local -a results=()
-
-  selection=$(pick_storages_multi "Remove Storage") || return
-  if [[ -z "$selection" ]]; then
-    msg_warn "No storage selected."
-    pause
-    return
-  fi
-
-  # Confirm each selected storage separately (defaults to No).
-  for storage_id in $selection; do
-    storage_id="${storage_id//\"/}"
-    [[ -z "$storage_id" ]] && continue
-
-    if confirm_danger "Remove Storage" \
-      "Really remove storage '${storage_id}' from the Proxmox config?
-
-This removes the storage definition only.
-Data on the underlying share/target is NOT deleted."; then
-      if pvesm remove "$storage_id" >/dev/null 2>&1; then
-        results+=("removed  ${storage_id}")
-      else
-        results+=("FAILED   ${storage_id}")
-      fi
-    else
-      results+=("skipped  ${storage_id}")
-    fi
-  done
-
-  header_info
-  echo -e "${BL}Remove storage — result${CL}\n"
-  printf '  %s\n' "${results[@]}"
-  echo
-  pause
-}
-
-find_next_mp_slot() {
-  local ctid="$1"
-  local used
-
-  used=$(pct config "$ctid" | awk -F: '/^mp[0-9]+:/ {gsub("mp", "", $1); print $1}')
-  for i in $(seq 0 255); do
-    if ! grep -qx "$i" <<<"$used"; then
-      echo "$i"
-      return
-    fi
-  done
-
-  echo ""
-}
-
-add_lxc_mountpoint() {
-  header_info
-  local ctid host_path ct_path mp_slot
-
-  ctid=$(pick_container "LXC: add mountpoint") || return
-  host_path=$(read_input "LXC Mountpoint" "Host path (must exist, e.g. /mnt/pve/smb-media)") || return
-  ct_path=$(read_input "LXC Mountpoint" "Container path (e.g. /mnt/media)") || return
-
-  if [[ ! -d "$host_path" ]]; then
-    msg_error "Host path does not exist: ${host_path}"
-    pause
-    return
-  fi
-
-  mp_slot=$(find_next_mp_slot "$ctid")
-  if [[ -z "$mp_slot" ]]; then
-    msg_error "No free mp slot available for container ${ctid}"
-    pause
-    return
-  fi
-
-  confirm_yes_no "LXC: add mountpoint" \
-    "Add mp${mp_slot} to CT ${ctid}?
-
-  ${host_path}  ->  ${ct_path}" 13 100 || return
-
-  if pct set "$ctid" -mp"$mp_slot" "$host_path",mp="$ct_path" >/dev/null 2>&1; then
-    msg_ok "Added mp${mp_slot}: ${host_path} -> ${ct_path} on CT ${ctid}"
-    msg_warn "If CT is unprivileged, ensure UID/GID mapping and filesystem permissions fit your workload."
-  else
-    msg_error "Failed to add mountpoint to CT ${ctid}"
-  fi
-
-  pause
-}
-
-remove_lxc_mountpoint() {
-  header_info
-  local selection entry ctid mp_key mp_def
-  local -a results=()
-
-  selection=$(pick_all_mountpoints_multi "LXC: remove mountpoint") || return
-  if [[ -z "$selection" ]]; then
-    msg_warn "No mountpoint selected."
-    pause
-    return
-  fi
-
-  # Confirm each selected mountpoint separately (defaults to No).
-  for entry in $selection; do
-    entry="${entry//\"/}"
-    [[ -z "$entry" ]] && continue
-    ctid="${entry%%:*}"
-    mp_key="${entry#*:}"
-    mp_def=$(pct config "$ctid" | awk -F': ' -v k="$mp_key" '$1==k{print $2}')
-
-    if confirm_danger "LXC: remove mountpoint" \
-      "Remove ${mp_key} from CT ${ctid}?
-
-  ${mp_key}: ${mp_def}
-
-This only detaches the mountpoint from the container.
-Data on the host is NOT deleted."; then
-      if pct set "$ctid" -delete "$mp_key" >/dev/null 2>&1; then
-        results+=("removed  CT ${ctid}  ${mp_key}")
-      else
-        results+=("FAILED   CT ${ctid}  ${mp_key}")
-      fi
-    else
-      results+=("skipped  CT ${ctid}  ${mp_key}")
-    fi
-  done
-
-  header_info
-  echo -e "${BL}Remove mountpoint — result${CL}\n"
-  printf '  %s\n' "${results[@]}"
-  echo
-  pause
-}
-
-list_lxc_mountpoints() {
-  header_info
-  local selection ctid mps
-
-  selection=$(pick_containers_multi "LXC: list mountpoints") || return
-  if [[ -z "$selection" ]]; then
-    msg_warn "No container selected."
-    pause
-    return
-  fi
-
-  for ctid in $selection; do
-    ctid="${ctid//\"/}"
-    [[ -z "$ctid" ]] && continue
-    echo -e "${BL}Mountpoints for CT ${ctid}${CL}"
-    mps=$(pct config "$ctid" | awk '/^mp[0-9]+:/{print}')
-    if [[ -n "$mps" ]]; then
-      echo "$mps"
-    else
-      echo "  (no mountpoints configured)"
-    fi
-    echo
-  done
-
-  pause
-}
-
-host_create_samba_share() {
-  header_info
-  local share_name share_path user_name user_pass
-
-  share_name=$(read_input "Host Samba Share" "Share name (e.g. data)") || return
-  share_path=$(read_input "Host Samba Share" "Share path on host (e.g. /srv/samba/data)" "/srv/samba/${share_name}") || return
-  user_name=$(read_input "Host Samba Share" "Linux/Samba username") || return
-  user_pass=$(read_password "Host Samba Share" "Password for ${user_name}") || return
-
-  msg_info "Installing Samba on host if needed"
-  apt update >/dev/null 2>&1
-  apt install -y samba >/dev/null 2>&1
-
-  mkdir -p "$share_path"
-  getent group sambashare >/dev/null 2>&1 || groupadd sambashare
-  id "$user_name" >/dev/null 2>&1 || useradd -M -s /usr/sbin/nologin -G sambashare "$user_name"
-  usermod -aG sambashare "$user_name"
-  chown -R root:sambashare "$share_path"
-  chmod 2775 "$share_path"
-
-  if ! (
-    echo "$user_pass"
-    echo "$user_pass"
-  ) | smbpasswd -s -a "$user_name" >/dev/null 2>&1; then
-    msg_error "Failed to set Samba password for ${user_name}"
-    pause
-    return
-  fi
-
-  if ! grep -q "^\[${share_name}\]" /etc/samba/smb.conf; then
-    cat <<EOF >>/etc/samba/smb.conf
-
-[${share_name}]
-   comment = Proxmox Host Share (${share_name})
-   path = ${share_path}
-   browseable = yes
-   read only = no
-   guest ok = no
-   create mask = 0664
-   directory mask = 2775
-   valid users = @sambashare
-EOF
-  fi
-
-  testparm -s >/dev/null 2>&1 || {
-    msg_error "Samba config validation failed (testparm). Check /etc/samba/smb.conf"
-    pause
-    return
-  }
-
-  systemctl enable --now smbd nmbd >/dev/null 2>&1
-  systemctl restart smbd nmbd >/dev/null 2>&1
-
-  msg_ok "Host SMB share created: //$(hostname -I | awk '{print $1}')/${share_name}"
-  msg_warn "Best practice: prefer running Samba in a dedicated LXC/VM for cleaner host separation."
-
-  pause
-}
-
-host_create_nfs_export() {
-  header_info
-  local export_path subnet options
-
-  export_path=$(read_input "Host NFS Export" "Export path on host (e.g. /srv/proxmox-nfs)" "/srv/proxmox-nfs") || return
-  subnet=$(read_input "Host NFS Export" "Allowed subnet/CIDR (e.g. 10.0.0.0/16)") || return
-  options=$(read_input "Host NFS Export" "Export options" "rw,sync,no_subtree_check,no_root_squash") || return
-
-  msg_info "Installing NFS server on host if needed"
-  apt update >/dev/null 2>&1
-  apt install -y nfs-kernel-server >/dev/null 2>&1
-
-  mkdir -p "$export_path"
-  chmod 0770 "$export_path"
-
-  if ! grep -qE "^${export_path//\//\/}[[:space:]]+${subnet//\//\/}\(" /etc/exports; then
-    echo "${export_path} ${subnet}(${options})" >>/etc/exports
-  fi
-
-  exportfs -ra >/dev/null 2>&1
-  systemctl enable --now nfs-kernel-server >/dev/null 2>&1
-
-  msg_ok "Host NFS export created: ${export_path} ${subnet}(${options})"
-  msg_warn "Best practice: use host exports carefully; dedicated storage VM/LXC is often cleaner."
-  pause
-}
-
-show_status() {
-  header_info
-  echo -e "${BL}pvesm status${CL}"
-  pvesm status || true
-  echo
-  echo -e "${BL}Mounted /mnt/pve paths${CL}"
-  mount | grep /mnt/pve || true
-  echo
-  echo -e "${BL}Mounted CIFS/NFS/iSCSI related paths${CL}"
-  mount | grep -E ' type (cifs|nfs|nfs4)' || true
-  echo
-  echo -e "${BL}iSCSI sessions${CL}"
-  iscsiadm -m session 2>/dev/null || true
-  echo
-  pause
-}
-
-main_menu() {
-  while true; do
-    local choice
-    choice=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "Storage Share Allrounder" \
-      --menu "Select action  (read-only actions are safe; write/remove actions ask for confirmation):" 30 116 22 \
-      " " "──────────  READ-ONLY (safe, no changes)  ──────────" \
-      "1" "Test   | SMB: manual mount test" \
-      "2" "Test   | NFS: manual mount test" \
-      "3" "Test   | iSCSI: discovery test" \
-      "4" "Read   | LXC: list mountpoints" \
-      "5" "Read   | Show storage/mount/iSCSI status" \
-      "  " "──────────  WRITE (modifies config / host)  ──────────" \
-      "6" "Write  | Proxmox: add SMB/CIFS storage" \
-      "7" "Write  | Proxmox: add NFS storage" \
-      "8" "Write  | Proxmox: add iSCSI storage" \
-      "9" "Write  | Proxmox: add LVM on base storage (e.g. iSCSI)" \
-      "10" "Write  | LXC: add bind mountpoint (pct set -mpX)" \
-      "11" "Write  | Host: install Samba + create SMB share" \
-      "12" "Write  | Host: install NFS server + create export" \
-      "   " "──────────  REMOVE (destructive, defaults to No)  ──────────" \
-      "13" "Remove | Proxmox: remove storage definition" \
-      "14" "Remove | LXC: remove mountpoint (pct set -delete mpX)" \
-      "0" "Exit" 3>&1 1>&2 2>&3) || break
-
-    # '|| true' so a cancelled sub-dialog (whiptail returns non-zero) returns to the
-    # menu instead of tripping 'set -e' and exiting the whole script.
-    case "$choice" in
-    1) manual_smb_test || true ;;
-    2) manual_nfs_test || true ;;
-    3) manual_iscsi_discovery || true ;;
-    4) list_lxc_mountpoints || true ;;
-    5) show_status || true ;;
-    6) add_smb_storage || true ;;
-    7) add_nfs_storage || true ;;
-    8) add_iscsi_storage || true ;;
-    9) add_lvm_on_base_storage || true ;;
-    10) add_lxc_mountpoint || true ;;
-    11) host_create_samba_share || true ;;
-    12) host_create_nfs_export || true ;;
-    13) remove_storage || true ;;
-    14) remove_lxc_mountpoint || true ;;
-    0) break ;;
-    *) ;;
-    esac
-  done
-}
-
-header_info
-root_check
-pve_check
-require_pve
-ensure_packages
-confirm_start || exit 0
-main_menu
-
-header_info
-msg_ok "Finished."