Warn when host CA inheritance is disabled

Changes the log level from info to warning when host CA inheritance is skipped by configuration, and includes the number of host certificates detected. This makes intentional skips more visible while still showing useful context.

CHANGELOG.md

@@ -505,73 +505,12 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
-## 2026-07-21
-
-### 🚀 Updated Scripts
-
-  - #### ✨ New Features
-
-    - Pangolin: Bump Version to 1.21.0 [@MickLesk](https://github.com/MickLesk) ([#15938](https://github.com/community-scripts/ProxmoxVE/pull/15938))
-
-  - #### 🔧 Refactor
-
-    - Standardize CT update backup handling [@MickLesk](https://github.com/MickLesk) ([#15937](https://github.com/community-scripts/ProxmoxVE/pull/15937))
-
-## 2026-07-20
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - RomM: use backup helpers in update / clear folder [@MickLesk](https://github.com/MickLesk) ([#15915](https://github.com/community-scripts/ProxmoxVE/pull/15915))
-    - fix: vikunja: asset selection [@CrazyWolf13](https://github.com/CrazyWolf13) ([#15929](https://github.com/community-scripts/ProxmoxVE/pull/15929))
-    - Zammad : bind Elasticsearch to 127.0.0.1 [@MickLesk](https://github.com/MickLesk) ([#15909](https://github.com/community-scripts/ProxmoxVE/pull/15909))
-    - Omada: fix package version extraction [@MickLesk](https://github.com/MickLesk) ([#15908](https://github.com/community-scripts/ProxmoxVE/pull/15908))
-    - fix(wanderer): use PocketBase-relative plugin symlink in unprivileged LXC [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15911](https://github.com/community-scripts/ProxmoxVE/pull/15911))
-
-  - #### ✨ New Features
-
-    - AFFiNE: Bump version to v0.27.2 [@MickLesk](https://github.com/MickLesk) ([#15930](https://github.com/community-scripts/ProxmoxVE/pull/15930))
-
-  - #### 💥 Breaking Changes
-
-    - Gotify: Migration to v3 [@MickLesk](https://github.com/MickLesk) ([#15912](https://github.com/community-scripts/ProxmoxVE/pull/15912))
-
-### 💾 Core
-
-  - #### ✨ New Features
-
-    - core: refactor to single-reporter telemetry and better error_handling [@MickLesk](https://github.com/MickLesk) ([#15933](https://github.com/community-scripts/ProxmoxVE/pull/15933))
-    - tools.func: add support for extracting 7z archives [@MickLesk](https://github.com/MickLesk) ([#15919](https://github.com/community-scripts/ProxmoxVE/pull/15919))
-    - Meilisearch : use dumpless Meilisearch upgrades [@MickLesk](https://github.com/MickLesk) ([#15921](https://github.com/community-scripts/ProxmoxVE/pull/15921))
-
-  - #### 🔧 Refactor
-
-    - core: Improve GPU detection and mapping logic [@MickLesk](https://github.com/MickLesk) ([#15918](https://github.com/community-scripts/ProxmoxVE/pull/15918))
-
 ## 2026-07-19
 
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - change trek repo to liketrek/TREK [@asylumexp](https://github.com/asylumexp) ([#15893](https://github.com/community-scripts/ProxmoxVE/pull/15893))
-    - update authentik to 2026.5.5 [@thieneret](https://github.com/thieneret) ([#15855](https://github.com/community-scripts/ProxmoxVE/pull/15855))
-    - [FIX] BookOrbit: add missing `restore_backup` during update [@vhsdream](https://github.com/vhsdream) ([#15881](https://github.com/community-scripts/ProxmoxVE/pull/15881))
-
-  - #### ✨ New Features
-
-    - tools.func: centralize deploy tail + trap-based tmpdir cleanup [@MickLesk](https://github.com/MickLesk) ([#15872](https://github.com/community-scripts/ProxmoxVE/pull/15872))
-    - Update OPNsense from 26.1 to 26.7 [@tdn131](https://github.com/tdn131) ([#15895](https://github.com/community-scripts/ProxmoxVE/pull/15895))
-
 ### 💾 Core
 
   - Revert "core: add configurable host CA inheritance during bootstrap" [@MickLesk](https://github.com/MickLesk) ([#15886](https://github.com/community-scripts/ProxmoxVE/pull/15886))
 
-  - #### 🐞 Bug Fixes
-
-    - fix(build.func): expand glob in SSH key "Scan Folder/Glob" so it can find keys [@TowyTowy](https://github.com/TowyTowy) ([#15873](https://github.com/community-scripts/ProxmoxVE/pull/15873))
-
 ## 2026-07-18
 
 ### 💾 Core

ct/affine.sh

@@ -30,7 +30,7 @@ function update_script() {
     exit
   fi
 
-  RELEASE="v0.27.2"
+  RELEASE="v0.27.0"
   if check_for_gh_release "affine_app" "toeverything/AFFiNE" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
     msg_info "Stopping Services"
     systemctl stop affine-web affine-worker
@@ -38,17 +38,10 @@ function update_script() {
 
     ensure_dependencies cmake
 
-    create_backup /opt/affine/.env /root/.affine/config /root/.affine/storage
+    create_backup /root/.affine/config /root/.affine/storage
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "${RELEASE}" "/opt/affine"
 
-    restore_backup
-
-    if [[ ! -f /opt/affine/.env ]]; then
-      msg_error "/opt/affine/.env is missing (lost by an earlier update). Recreate it before retrying — see the AFFiNE install script for the expected variables."
-      exit 1
-    fi
-
     msg_info "Rebuilding Application (Patience ~25 mins, don't close the console!)"
     cd /opt/affine
     source /root/.profile
@@ -118,6 +111,8 @@ TURBO
     set -a && source /opt/affine/.env && set +a
     $STD node ./scripts/self-host-predeploy.js
 
+    restore_backup
+
     msg_info "Starting Services"
     systemctl start affine-web affine-worker
     msg_ok "Started Services"

ct/alpine-cinny.sh

@@ -30,11 +30,16 @@ function update_script() {
   fi
 
   if check_for_gh_release "cinny" "cinnyapp/cinny"; then
-    create_backup /opt/cinny/config.json
+    msg_info "Backing up Configuration"
+    cp /opt/cinny/config.json /opt/cinny_config.json.bak
+    msg_ok "Backed up Configuration"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "cinny" "cinnyapp/cinny" "prebuild" "latest" "/opt/cinny" "cinny-*.tar.gz"
 
-    restore_backup
+    msg_info "Restoring Configuration"
+    cp /opt/cinny_config.json.bak /opt/cinny/config.json
+    rm -f /opt/cinny_config.json.bak
+    msg_ok "Restored Configuration"
 
     msg_info "Restarting nginx"
     $STD rc-service nginx restart

ct/authentik.sh

@@ -38,14 +38,13 @@ function update_script() {
 
   NODE_VERSION="24" setup_nodejs
   setup_go
-  $STD uv cache clean
-  UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.6" setup_uv
+  UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.3" setup_uv
   RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
   setup_yq
 
-  AUTHENTIK_VERSION="version/2026.5.5"
+  AUTHENTIK_VERSION="version/2026.5.3"
   # Source: https://github.com/goauthentik/fips/blob/main/Makefile#L26
-  XMLSEC_VERSION="1.3.12"
+  XMLSEC_VERSION="1.3.11"
 
   if check_for_gh_release "geoipupdate" "maxmind/geoipupdate"; then
     fetch_and_deploy_gh_release "geoipupdate" "maxmind/geoipupdate" "binary"

ct/bookorbit.sh

@@ -53,7 +53,6 @@ function update_script() {
     mkdir -p /opt/bookorbit/server/migrations
     cp -r /opt/bookorbit/server/src/db/migrations/. /opt/bookorbit/server/migrations/
     chmod +x /opt/bookorbit/server/bin/kepubify/*
-    restore_backup
     APP_VER=$(cat ~/.bookorbit)
     sed -i "s/^APP_VERSION=.*/APP_VERSION=v$APP_VER/" /opt/bookorbit/.env
     msg_ok "Rebuilt Application"

ct/dispatcharr.sh

@@ -116,10 +116,21 @@ EOF
 
     msg_info "Creating Backup"
     BACKUP_FILE="/opt/dispatcharr_backup_$(date +%F_%H-%M-%S).tar.gz"
+    if [[ -f /opt/dispatcharr/.env ]]; then
+      cp /opt/dispatcharr/.env /tmp/dispatcharr.env.backup
+    fi
     if [[ -f /opt/dispatcharr/start-gunicorn.sh ]]; then
       rm -f /opt/dispatcharr/start-gunicorn.sh
     fi
-    create_backup /opt/dispatcharr/.env /opt/dispatcharr/start-celery.sh /opt/dispatcharr/start-celerybeat.sh /opt/dispatcharr/start-daphne.sh
+    if [[ -f /opt/dispatcharr/start-celery.sh ]]; then
+      cp /opt/dispatcharr/start-celery.sh /tmp/start-celery.sh.backup
+    fi
+    if [[ -f /opt/dispatcharr/start-celerybeat.sh ]]; then
+      cp /opt/dispatcharr/start-celerybeat.sh /tmp/start-celerybeat.sh.backup
+    fi
+    if [[ -f /opt/dispatcharr/start-daphne.sh ]]; then
+      cp /opt/dispatcharr/start-daphne.sh /tmp/start-daphne.sh.backup
+    fi
     if [[ -f /opt/dispatcharr/.env ]]; then
       set -o allexport
       source /opt/dispatcharr/.env
@@ -134,9 +145,20 @@ EOF
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "dispatcharr" "Dispatcharr/Dispatcharr" "tarball"
 
-    restore_backup
-
     msg_info "Updating Dispatcharr Backend"
+    if [[ -f /tmp/dispatcharr.env.backup ]]; then
+      mv /tmp/dispatcharr.env.backup /opt/dispatcharr/.env
+    fi
+    if [[ -f /tmp/start-celery.sh.backup ]]; then
+      mv /tmp/start-celery.sh.backup /opt/dispatcharr/start-celery.sh
+    fi
+    if [[ -f /tmp/start-celerybeat.sh.backup ]]; then
+      mv /tmp/start-celerybeat.sh.backup /opt/dispatcharr/start-celerybeat.sh
+    fi
+    if [[ -f /tmp/start-daphne.sh.backup ]]; then
+      mv /tmp/start-daphne.sh.backup /opt/dispatcharr/start-daphne.sh
+    fi
+
     if ! grep -q "DJANGO_SECRET_KEY" /opt/dispatcharr/.env; then
       DJANGO_SECRET=$(openssl rand -base64 48 | tr -dc 'a-zA-Z0-9' | cut -c1-50)
       echo "DJANGO_SECRET_KEY=$DJANGO_SECRET" >>/opt/dispatcharr/.env

ct/fladder.sh

@@ -35,11 +35,21 @@ function update_script() {
     systemctl stop nginx
     msg_ok "Stopped Service"
 
-    create_backup /opt/fladder/assets/config/config.json
+    if [[ -f /opt/fladder/assets/config/config.json ]]; then
+      msg_info "Backing up configuration"
+      cp /opt/fladder/assets/config/config.json /tmp/fladder_config.json.bak
+      msg_ok "Configuration backed up"
+    fi
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Fladder" "DonutWare/Fladder" "prebuild" "latest" "/opt/fladder" "Fladder-Web-*.zip"
 
-    restore_backup
+    if [[ -f /tmp/fladder_config.json.bak ]]; then
+      msg_info "Restoring configuration"
+      mkdir -p /opt/fladder/assets/config
+      cp /tmp/fladder_config.json.bak /opt/fladder/assets/config/config.json
+      rm -f /tmp/fladder_config.json.bak
+      msg_ok "Configuration restored"
+    fi
 
     msg_info "Starting Service"
     systemctl start nginx

ct/flatnotes.sh

@@ -34,11 +34,12 @@ function update_script() {
     systemctl stop flatnotes
     msg_ok "Stopped Service"
 
-    create_backup /opt/flatnotes/.env /opt/flatnotes/data
+    msg_info "Backing up Configuration and Data"
+    cp /opt/flatnotes/.env /opt/flatnotes.env
+    cp -r /opt/flatnotes/data /opt/flatnotes_data_backup
+    msg_ok "Backed up Configuration and Data"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "flatnotes" "dullage/flatnotes" "tarball"
-
-    restore_backup
+    fetch_and_deploy_gh_release "flatnotes" "dullage/flatnotes" "tarball"
 
     msg_info "Updating Flatnotes"
     cd /opt/flatnotes/client
@@ -51,6 +52,13 @@ function update_script() {
     $STD /usr/local/bin/uv sync
     msg_ok "Updated Flatnotes"
 
+    msg_info "Restoring Configuration and Data"
+    cp /opt/flatnotes.env /opt/flatnotes/.env
+    cp -r /opt/flatnotes_data_backup/. /opt/flatnotes/data
+    rm -f /opt/flatnotes.env
+    rm -r /opt/flatnotes_data_backup
+    msg_ok "Restored Configuration and Data"
+
     msg_info "Starting Service"
     systemctl start flatnotes
     msg_ok "Started Service"

ct/fluid-calendar.sh

@@ -38,9 +38,9 @@ function update_script() {
     systemctl stop fluid-calendar
     msg_info "Stopped Service"
 
-    create_backup /opt/fluid-calendar/.env
+    cp /opt/fluid-calendar/.env /opt/fluid.env
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "fluid-calendar" "dotnetfactory/fluid-calendar" "tarball"
-    restore_backup
+    mv /opt/fluid.env /opt/fluid-calendar/.env
 
     msg_info "Updating Fluid Calendar"
     cd /opt/fluid-calendar

ct/ghostfolio.sh

@@ -41,15 +41,13 @@ function update_script() {
       --exclude="ghostfolio/node_modules" \
       --exclude="ghostfolio/dist" \
       ghostfolio
+    mv /opt/ghostfolio/.env /opt/env.backup
     msg_ok "Backup Created"
 
-    create_backup /opt/ghostfolio/.env
-
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "ghostfolio" "ghostfolio/ghostfolio" "tarball" "latest" "/opt/ghostfolio"
 
-    restore_backup
-
     msg_info "Updating Ghostfolio"
+    mv /opt/env.backup /opt/ghostfolio/.env
     sed -i -E '/^DATABASE_URL=/ s/[?&]sslmode=prefer//g' /opt/ghostfolio/.env
     cd /opt/ghostfolio
     $STD npm ci

ct/gogs.sh

@@ -35,11 +35,18 @@ function update_script() {
     systemctl stop gogs
     msg_ok "Stopped Service"
 
-    create_backup /opt/gogs/custom /opt/gogs/data
+    msg_info "Backing up Data"
+    cp -r /opt/gogs/custom /opt/gogs_custom_backup
+    cp -r /opt/gogs/data /opt/gogs_data_backup
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "gogs" "gogs/gogs" "prebuild" "latest" "/opt/gogs" "gogs_*_linux_$(arch_resolve).tar.gz"
 
-    restore_backup
+    msg_info "Restoring Data"
+    cp -r /opt/gogs_custom_backup/. /opt/gogs/custom
+    cp -r /opt/gogs_data_backup/. /opt/gogs/data
+    rm -rf /opt/gogs_custom_backup /opt/gogs_data_backup
+    msg_ok "Restored Data"
 
     msg_info "Starting Service"
     systemctl start gogs

ct/gotify.sh

@@ -36,30 +36,6 @@ function update_script() {
     fetch_and_deploy_gh_release "gotify" "gotify/server" "prebuild" "latest" "/opt/gotify" "gotify-linux-$(arch_resolve).zip"
     chmod +x /opt/gotify/gotify-linux-$(arch_resolve)
 
-    if [[ ! -f /opt/gotify/gotify-server.env ]]; then
-      gotify_old_config=""
-      for f in /opt/gotify/config.yml /etc/gotify/config.yml; do
-        [[ -f "$f" ]] && gotify_old_config="$f" && break
-      done
-      if [[ -n "$gotify_old_config" ]]; then
-        msg_info "Migrating ${gotify_old_config} to env format (Gotify 3.x)"
-        if /opt/gotify/gotify-linux-$(arch_resolve) migrate-config "$gotify_old_config" >/opt/gotify/gotify-server.env 2>/dev/null; then
-          mv "$gotify_old_config" "${gotify_old_config}.bak"
-          msg_ok "Migrated config to /opt/gotify/gotify-server.env (backup: ${gotify_old_config}.bak)"
-        else
-          rm -f /opt/gotify/gotify-server.env
-          msg_warn "Config migration failed — left ${gotify_old_config} in place, review manually"
-        fi
-      fi
-    fi
-
-    if ! grep -qE '^ExecStart=.* serve' /etc/systemd/system/gotify.service 2>/dev/null; then
-      msg_info "Migrating service to serve subcommand (Gotify 3.x)"
-      sed -i -E 's|^(ExecStart=/opt/gotify/.*gotify-linux-[^ ]+)$|\1 serve|' /etc/systemd/system/gotify.service
-      systemctl daemon-reload
-      msg_ok "Migrated service to serve subcommand"
-    fi
-
     msg_info "Starting Service"
     systemctl start gotify
     msg_ok "Started Service"

ct/grist.sh

@@ -37,14 +37,21 @@ function update_script() {
     systemctl stop grist
     msg_ok "Stopped Service"
 
-    create_backup /opt/grist/.env /opt/grist/docs /opt/grist/grist-sessions.db /opt/grist/landing.db
+    msg_info "Creating backup"
+    rm -rf /opt/grist_bak
+    mv /opt/grist /opt/grist_bak
+    msg_ok "Backup created"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "grist" "gristlabs/grist-core" "tarball"
-
-    restore_backup
+    fetch_and_deploy_gh_release "grist" "gristlabs/grist-core" "tarball"
 
     msg_info "Updating Grist"
     mkdir -p /opt/grist/docs
+    cp -n /opt/grist_bak/.env /opt/grist/.env
+    if ls /opt/grist_bak/docs/* &>/dev/null; then
+      cp -r /opt/grist_bak/docs/* /opt/grist/docs/
+    fi
+    [[ -f /opt/grist_bak/grist-sessions.db ]] && cp /opt/grist_bak/grist-sessions.db /opt/grist/grist-sessions.db
+    [[ -f /opt/grist_bak/landing.db ]] && cp /opt/grist_bak/landing.db /opt/grist/landing.db
     cd /opt/grist
     $STD yarn install
     $STD yarn run build:prod

ct/homebox.sh

@@ -39,12 +39,8 @@ function update_script() {
     systemctl stop homebox
     msg_ok "Stopped Service"
 
-    create_backup /opt/homebox/.env /opt/homebox/.data
-
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "homebox" "sysadminsmedia/homebox" "prebuild" "latest" "/opt/homebox" "homebox_Linux_$(arch_resolve "x86_64" "arm64").tar.gz"
     chmod +x /opt/homebox/homebox
-
-    restore_backup
     [ -f /opt/.env ] && mv /opt/.env /opt/homebox/.env
     [ -d /opt/.data ] && mv /opt/.data /opt/homebox/.data
 

ct/homelable.sh

@@ -35,12 +35,16 @@ function update_script() {
     systemctl stop homelable
     msg_ok "Stopped Service"
 
-    create_backup /opt/homelable/backend/.env /opt/homelable/data /opt/homelable/mcp/.env
+    msg_info "Backing up Configuration and Data"
+    cp /opt/homelable/backend/.env /opt/homelable.env.bak
+    cp -r /opt/homelable/data /opt/homelable_data_bak
+    if [[ -f /opt/homelable/mcp/.env ]]; then
+      cp -a /opt/homelable/mcp/.env /opt/homelable-mcp.env.bak
+    fi
+    msg_ok "Backed up Configuration and Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "homelable" "Pouzor/homelable" "tarball" "latest" "/opt/homelable"
 
-    restore_backup
-
     msg_info "Updating Python Dependencies"
     cd /opt/homelable/backend
     $STD uv venv --clear /opt/homelable/backend/.venv
@@ -53,8 +57,17 @@ function update_script() {
     $STD npm run build
     msg_ok "Rebuilt Frontend"
 
-    if [[ -f /opt/homelable/mcp/.env ]]; then
+    msg_info "Restoring Configuration and Data"
+    cp /opt/homelable.env.bak /opt/homelable/backend/.env
+    cp -r /opt/homelable_data_bak/. /opt/homelable/data/
+    rm -f /opt/homelable.env.bak
+    rm -rf /opt/homelable_data_bak
+    msg_ok "Restored Configuration and Data"
+
+    if [[ -f /opt/homelable-mcp.env.bak ]]; then
       msg_info "Restoring MCP Server"
+      cp -a /opt/homelable-mcp.env.bak /opt/homelable/mcp/.env
+      rm -f /opt/homelable-mcp.env.bak
       MCP_OWNER=$(stat -c '%U' /opt/homelable/mcp/.env)
       cd /opt/homelable/mcp
       $STD uv venv --clear /opt/homelable/mcp/.venv

ct/homepage.sh

@@ -37,12 +37,20 @@ function update_script() {
     systemctl stop homepage
     msg_ok "Stopped service"
 
-    create_backup /opt/homepage/.env /opt/homepage/config
-    BACKUP_DIR=/opt/homepage-assets.backup create_backup /opt/homepage/public/images /opt/homepage/public/icons
+    msg_info "Creating Backup"
+    cp /opt/homepage/.env /opt/homepage.env
+    cp -r /opt/homepage/config /opt/homepage_config_backup
+    [[ -d /opt/homepage/public/images ]] && cp -r /opt/homepage/public/images /opt/homepage_images_backup
+    [[ -d /opt/homepage/public/icons ]] && cp -r /opt/homepage/public/icons /opt/homepage_icons_backup
+    msg_ok "Created Backup"
     
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "homepage" "gethomepage/homepage" "tarball"
     
-    restore_backup
+    msg_info "Restoring Backup"
+    mv /opt/homepage.env /opt/homepage
+    rm -rf /opt/homepage/config
+    mv /opt/homepage_config_backup /opt/homepage/config
+    msg_ok "Restored Backup"
 
     msg_info "Updating Homepage (Patience)"
     RELEASE=$(get_latest_github_release "gethomepage/homepage")
@@ -55,7 +63,8 @@ function update_script() {
     export NEXT_PUBLIC_BUILDTIME=$(curl -fsSL https://api.github.com/repos/gethomepage/homepage/releases/latest | jq -r '.published_at')
     export NEXT_TELEMETRY_DISABLED=1
     $STD pnpm build
-    BACKUP_DIR=/opt/homepage-assets.backup restore_backup
+    [[ -d /opt/homepage_images_backup ]] && mv /opt/homepage_images_backup /opt/homepage/public/images
+    [[ -d /opt/homepage_icons_backup ]] && mv /opt/homepage_icons_backup /opt/homepage/public/icons
     msg_ok "Updated Homepage"
 
     msg_info "Starting service"

ct/hoodik.sh

@@ -36,11 +36,16 @@ function update_script() {
     systemctl stop hoodik
     msg_ok "Stopped Service"
 
-    create_backup /opt/hoodik/.env
+    msg_info "Backing up Configuration"
+    cp /opt/hoodik/.env /opt/hoodik.env.bak
+    msg_ok "Backed up Configuration"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "hoodik" "hudikhq/hoodik" "prebuild" "latest" "/opt/hoodik" "*$(arch_resolve "x86_64" "arm64").tar.gz"
 
-    restore_backup
+    msg_info "Restoring Configuration"
+    cp /opt/hoodik.env.bak /opt/hoodik/.env
+    rm -f /opt/hoodik.env.bak
+    msg_ok "Restored Configuration"
 
     msg_info "Starting Service"
     systemctl start hoodik

ct/igotify.sh

@@ -35,11 +35,16 @@ function update_script() {
     systemctl stop igotify
     msg_ok "Stopped Service"
 
-    create_backup /opt/igotify/.env
+    msg_info "Backing up Configuration"
+    cp /opt/igotify/.env /opt/igotify.env.bak
+    msg_ok "Backed up Configuration"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "igotify" "androidseb25/iGotify-Notification-Assistent" "prebuild" "latest" "/opt/igotify" "iGotify-Notification-Service-$(arch_resolve)-v*.zip"
 
-    restore_backup
+    msg_info "Restoring Configuration"
+    cp /opt/igotify.env.bak /opt/igotify/.env
+    rm -f /opt/igotify.env.bak
+    msg_ok "Restored Configuration"
 
     msg_info "Starting Service"
     systemctl start igotify

ct/immichframe.sh

@@ -35,7 +35,9 @@ function update_script() {
     systemctl stop immichframe
     msg_ok "Stopped Service"
 
-    create_backup /opt/immichframe/Config
+    msg_info "Backing up Configuration"
+    cp -r /opt/immichframe/Config /tmp/immichframe_config.bak
+    msg_ok "Backed up Configuration"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "immichframe" "immichFrame/ImmichFrame" "tarball" "latest" "/tmp/immichframe"
 
@@ -55,8 +57,11 @@ function update_script() {
     rm -rf /tmp/immichframe
     msg_ok "Setup ImmichFrame"
 
-    restore_backup
+    msg_info "Restoring Configuration"
+    cp -r /tmp/immichframe_config.bak/* /opt/immichframe/Config/
+    rm -rf /tmp/immichframe_config.bak
     chown -R immichframe:immichframe /opt/immichframe
+    msg_ok "Restored Configuration"
 
 
     msg_info "Starting Service"

ct/investbrain.sh

@@ -41,14 +41,20 @@ function update_script() {
     NODE_VERSION="22" setup_nodejs
     PG_VERSION="17" setup_postgresql
 
-    create_backup /opt/investbrain/.env /opt/investbrain/storage
+    msg_info "Creating Backup"
+    rm -f /opt/.env.backup
+    rm -rf /opt/investbrain_backup
+    cp /opt/investbrain/.env /opt/.env.backup
+    cp -r /opt/investbrain/storage /opt/investbrain_backup
+    msg_ok "Created Backup"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Investbrain" "investbrainapp/investbrain" "tarball" "latest" "/opt/investbrain"
-
-    restore_backup
+    fetch_and_deploy_gh_release "Investbrain" "investbrainapp/investbrain" "tarball" "latest" "/opt/investbrain"
 
     msg_info "Updating Investbrain"
     cd /opt/investbrain
+    rm -rf /opt/investbrain/storage
+    cp /opt/.env.backup /opt/investbrain/.env
+    cp -r /opt/investbrain_backup/ /opt/investbrain/storage
     export COMPOSER_ALLOW_SUPERUSER=1
     $STD /usr/local/bin/composer install --no-interaction --no-dev --optimize-autoloader
     $STD npm install
@@ -63,6 +69,7 @@ function update_script() {
     $STD php artisan event:cache
     chown -R www-data:www-data /opt/investbrain
     chmod -R 775 /opt/investbrain/storage /opt/investbrain/bootstrap/cache
+    rm -rf /opt/.env.backup /opt/investbrain_backup
     msg_ok "Updated Investbrain"
 
     msg_info "Starting Services"

ct/invoiceninja.sh

@@ -35,11 +35,21 @@ function update_script() {
     systemctl stop supervisor nginx php8.4-fpm
     msg_ok "Stopped Services"
 
-    create_backup /opt/invoiceninja/.env /opt/invoiceninja/storage /opt/invoiceninja/public/storage
+    msg_info "Creating Backup"
+    mkdir -p /tmp/invoiceninja_backup
+    cp /opt/invoiceninja/.env /tmp/invoiceninja_backup/
+    cp -r /opt/invoiceninja/storage /tmp/invoiceninja_backup/ 2>/dev/null || true
+    cp -r /opt/invoiceninja/public/storage /tmp/invoiceninja_backup/public_storage 2>/dev/null || true
+    msg_ok "Created Backup"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "invoiceninja" "invoiceninja/invoiceninja" "prebuild" "latest" "/opt/invoiceninja" "invoiceninja.tar.gz"
 
-    restore_backup
+    msg_info "Restoring Data"
+    cp /tmp/invoiceninja_backup/.env /opt/invoiceninja/
+    cp -r /tmp/invoiceninja_backup/storage/* /opt/invoiceninja/storage/ 2>/dev/null || true
+    cp -r /tmp/invoiceninja_backup/public_storage/* /opt/invoiceninja/public/storage/ 2>/dev/null || true
+    rm -rf /tmp/invoiceninja_backup
+    msg_ok "Restored Data"
 
     msg_info "Running Migrations"
     cd /opt/invoiceninja 

ct/invoiceshelf.sh

@@ -35,11 +35,19 @@ function update_script() {
     systemctl stop caddy
     msg_ok "Stopped Services"
 
-    create_backup /opt/invoiceshelf/.env /opt/invoiceshelf/storage
+    msg_info "Backing up Data"
+    cp /opt/invoiceshelf/.env /opt/invoiceshelf.env.bak
+    cp -r /opt/invoiceshelf/storage /opt/invoiceshelf_storage_backup
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "invoiceshelf" "InvoiceShelf/InvoiceShelf" "tarball"
 
-    restore_backup
+    msg_info "Restoring Data"
+    cp /opt/invoiceshelf.env.bak /opt/invoiceshelf/.env
+    rm -f /opt/invoiceshelf.env.bak
+    cp -r /opt/invoiceshelf_storage_backup/. /opt/invoiceshelf/storage
+    rm -rf /opt/invoiceshelf_storage_backup
+    msg_ok "Restored Data"
 
     msg_info "Updating Application"
     cd /opt/invoiceshelf

ct/joplin-server.sh

@@ -36,9 +36,9 @@ function update_script() {
     systemctl stop joplin-server
     msg_ok "Stopped Services"
 
-    create_backup /opt/joplin-server/.env
+    cp /opt/joplin-server/.env /opt
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "joplin-server" "laurent22/joplin" "tarball"
-    restore_backup
+    mv /opt/.env /opt/joplin-server
 
     msg_info "Updating Joplin-Server"
     cd /opt/joplin-server

ct/jotty.sh

@@ -35,12 +35,20 @@ function update_script() {
     systemctl stop jotty
     msg_ok "Stopped Service"
 
-    create_backup /opt/jotty/.env /opt/jotty/data /opt/jotty/config
+    msg_info "Backing up configuration & data"
+    cp /opt/jotty/.env /opt/app.env
+    [[ -d /opt/jotty/data ]] && mv /opt/jotty/data /opt/data
+    [[ -d /opt/jotty/config ]] && mv /opt/jotty/config /opt/config
+    msg_ok "Backed up configuration & data"
 
     NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "jotty" "fccview/jotty" "prebuild" "latest" "/opt/jotty" "jotty_*_prebuild.tar.gz"
 
-    restore_backup
+    msg_info "Restoring configuration & data"
+    mv /opt/app.env /opt/jotty/.env
+    [[ -d /opt/data ]] && mv /opt/data /opt/jotty/data
+    [[ -d /opt/config ]] && cp -a /opt/config/* /opt/jotty/config && rm -rf /opt/config
+    msg_ok "Restored configuration & data"
 
     msg_info "Starting Service"
     systemctl start jotty

ct/kan.sh

@@ -35,11 +35,16 @@ function update_script() {
     systemctl stop kan
     msg_ok "Stopped Service"
 
-    create_backup /opt/kan/.env
+    msg_info "Backing up Data"
+    cp /opt/kan/.env /opt/kan.env.bak
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_tag "kan" "kanbn/kan" "latest"
 
-    restore_backup
+    msg_info "Restoring Configuration"
+    cp /opt/kan.env.bak /opt/kan/.env
+    rm -f /opt/kan.env.bak
+    msg_ok "Restored Configuration"
 
     msg_info "Building Application"
     cd /opt/kan

ct/kima-hub.sh

@@ -37,11 +37,18 @@ function update_script() {
     systemctl stop kima-frontend kima-backend kima-analyzer kima-analyzer-clap
     msg_ok "Stopped Services"
 
-    create_backup /opt/kima-hub/backend/.env /opt/kima-hub/frontend/.env
+    msg_info "Backing up Data"
+    cp /opt/kima-hub/backend/.env /opt/kima-hub-backend-env.bak
+    cp /opt/kima-hub/frontend/.env /opt/kima-hub-frontend-env.bak
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "kima-hub" "Chevron7Locked/kima-hub" "tarball"
 
-    restore_backup
+    msg_info "Restoring Data"
+    cp /opt/kima-hub-backend-env.bak /opt/kima-hub/backend/.env
+    cp /opt/kima-hub-frontend-env.bak /opt/kima-hub/frontend/.env
+    rm -f /opt/kima-hub-backend-env.bak /opt/kima-hub-frontend-env.bak
+    msg_ok "Restored Data"
 
     msg_info "Rebuilding Backend"
     cd /opt/kima-hub/backend

ct/kitchenowl.sh

@@ -35,14 +35,22 @@ function update_script() {
     systemctl stop kitchenowl
     msg_ok "Stopped Service"
 
-    create_backup /opt/kitchenowl/data /opt/kitchenowl/kitchenowl.env
+    msg_info "Creating Backup"
+    mkdir -p /opt/kitchenowl_backup
+    cp -r /opt/kitchenowl/data /opt/kitchenowl_backup/
+    cp -f /opt/kitchenowl/kitchenowl.env /opt/kitchenowl_backup/
+    msg_ok "Created Backup"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "kitchenowl" "TomBursch/kitchenowl" "tarball" "latest" "/opt/kitchenowl"
     rm -rf /opt/kitchenowl/web
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "kitchenowl-web" "TomBursch/kitchenowl" "prebuild" "latest" "/opt/kitchenowl/web" "kitchenowl_Web.tar.gz"
 
-    restore_backup
+    msg_info "Restoring data"
     sed -i 's/default=True/default=False/' /opt/kitchenowl/backend/wsgi.py
+    cp -r /opt/kitchenowl_backup/data /opt/kitchenowl/
+    cp -f /opt/kitchenowl_backup/kitchenowl.env /opt/kitchenowl/
+    rm -rf /opt/kitchenowl_backup
+    msg_ok "Restored data"
 
     msg_info "Updating KitchenOwl"
     cd /opt/kitchenowl/backend

ct/koel.sh

@@ -35,11 +35,21 @@ function update_script() {
     systemctl stop nginx php8.4-fpm
     msg_ok "Stopped Services"
 
-    create_backup /opt/koel/.env /opt/koel/storage /opt/koel/public/img
+    msg_info "Creating Backup"
+    mkdir -p /tmp/koel_backup
+    cp /opt/koel/.env /tmp/koel_backup/
+    cp -r /opt/koel/storage /tmp/koel_backup/ 2>/dev/null || true
+    cp -r /opt/koel/public/img /tmp/koel_backup/ 2>/dev/null || true
+    msg_ok "Created Backup"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "koel" "koel/koel" "prebuild" "latest" "/opt/koel" "koel-*.tar.gz"
 
-    restore_backup
+    msg_info "Restoring Data"
+    cp /tmp/koel_backup/.env /opt/koel/
+    cp -r /tmp/koel_backup/storage/* /opt/koel/storage/ 2>/dev/null || true
+    cp -r /tmp/koel_backup/img/* /opt/koel/public/img/ 2>/dev/null || true
+    rm -rf /tmp/koel_backup
+    msg_ok "Restored Data"
 
     msg_info "Running Migrations"
     cd /opt/koel 

ct/leantime.sh

@@ -34,18 +34,20 @@ function update_script() {
     msg_info "Creating Backup"
     mariadb-dump leantime >"/opt/leantime_db_backup_$(date +%F).sql"
     tar -czf "/opt/leantime_backup_$(date +%F).tar.gz" "/opt/leantime"
+    mv /opt/leantime /opt/leantime_bak
     msg_ok "Backup Created"
 
-    create_backup /opt/leantime/config/.env
+    fetch_and_deploy_gh_release "leantime" "Leantime/leantime" "prebuild" "latest" "/opt/leantime" Leantime*.tar.gz
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "leantime" "Leantime/leantime" "prebuild" "latest" "/opt/leantime" Leantime*.tar.gz
-
-    restore_backup
-
-    msg_info "Setting Permissions"
+    msg_info "Restoring Config & Permissions"
+    mv /opt/leantime_bak/config/.env /opt/leantime/config/.env
     chown -R www-data:www-data "/opt/leantime"
     chmod -R 750 "/opt/leantime"
-    msg_ok "Set Permissions"
+    msg_ok "Restored Config & Permissions"
+
+    msg_info "Removing Backup"
+    rm -rf /opt/leantime_bak
+    msg_ok "Removed Backup"
     msg_ok "Updated successfully!"
   fi
   exit

ct/librechat.sh

@@ -35,12 +35,12 @@ function update_script() {
     systemctl stop librechat rag-api
     msg_ok "Stopped Services"
 
-    create_backup /opt/librechat/.env
+    msg_info "Backing up Configuration"
+    cp /opt/librechat/.env /opt/librechat.env.bak
+    msg_ok "Backed up Configuration"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_tag "librechat" "danny-avila/LibreChat"
 
-    restore_backup
-
     msg_info "Installing Dependencies"
     cd /opt/librechat
     $STD npm ci
@@ -52,6 +52,11 @@ function update_script() {
     $STD npm cache clean --force
     msg_ok "Built Frontend"
 
+    msg_info "Restoring Configuration"
+    cp /opt/librechat.env.bak /opt/librechat/.env
+    rm -f /opt/librechat.env.bak
+    msg_ok "Restored Configuration"
+
     msg_info "Starting Services"
     systemctl start rag-api librechat
     msg_ok "Started Services"
@@ -63,17 +68,22 @@ function update_script() {
     systemctl stop rag-api
     msg_ok "Stopped RAG API"
 
-    create_backup /opt/rag-api/.env
+    msg_info "Backing up RAG API Configuration"
+    cp /opt/rag-api/.env /opt/rag-api.env.bak
+    msg_ok "Backed up RAG API Configuration"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "rag-api" "danny-avila/rag_api" "tarball"
 
-    restore_backup
-
     msg_info "Updating RAG API Dependencies"
     cd /opt/rag-api
     $STD .venv/bin/pip install -r requirements.lite.txt
     msg_ok "Updated RAG API Dependencies"
 
+    msg_info "Restoring RAG API Configuration"
+    cp /opt/rag-api.env.bak /opt/rag-api/.env
+    rm -f /opt/rag-api.env.bak
+    msg_ok "Restored RAG API Configuration"
+
     msg_info "Starting RAG API"
     systemctl start rag-api
     msg_ok "Started RAG API"

ct/linkding.sh

@@ -35,12 +35,19 @@ function update_script() {
     systemctl stop nginx linkding linkding-tasks
     msg_ok "Stopped Services"
 
-    create_backup /opt/linkding/data /opt/linkding/.env
+    msg_info "Backing up Data"
+    cp -r /opt/linkding/data /opt/linkding_data_backup
+    cp /opt/linkding/.env /opt/linkding_env_backup
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "linkding" "sissbruecker/linkding" "tarball"
 
-    restore_backup
+    msg_info "Restoring Data"
+    cp -r /opt/linkding_data_backup/. /opt/linkding/data
+    cp /opt/linkding_env_backup /opt/linkding/.env
+    rm -rf /opt/linkding_data_backup /opt/linkding_env_backup
     ln -sf /usr/lib/$(arch_resolve "x86_64-linux-gnu" "aarch64-linux-gnu")/mod_icu.so /opt/linkding/libicu.so
+    msg_ok "Restored Data"
 
     msg_info "Updating LinkDing"
     cd /opt/linkding

ct/linkwarden.sh

@@ -35,11 +35,13 @@ function update_script() {
 
     RUST_CRATES="monolith" setup_rust
 
-    create_backup /opt/linkwarden/.env /opt/linkwarden/data
+    msg_info "Backing up data"
+    mv /opt/linkwarden/.env /opt/.env
+    [ -d /opt/linkwarden/data ] && mv /opt/linkwarden/data /opt/data.bak
+    rm -rf /opt/linkwarden
+    msg_ok "Backed up data"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "linkwarden" "linkwarden/linkwarden" "tarball"
-
-    restore_backup
+    fetch_and_deploy_gh_release "linkwarden" "linkwarden/linkwarden" "tarball"
 
     msg_info "Updating Linkwarden"
     cd /opt/linkwarden
@@ -58,9 +60,11 @@ function update_script() {
     $STD yarn
     $STD npx playwright install-deps
     $STD npx playwright install
+    mv /opt/.env /opt/linkwarden/.env
     $STD yarn prisma:generate
     $STD yarn web:build
     $STD yarn prisma:deploy
+    [ -d /opt/data.bak ] && mv /opt/data.bak /opt/linkwarden/data
     rm -rf ~/.cargo/registry ~/.cargo/git ~/.cargo/.package-cache
     rm -rf /root/.cache/yarn
     rm -rf /opt/linkwarden/.next/cache

ct/lobehub.sh

@@ -35,11 +35,16 @@ function update_script() {
     systemctl stop lobehub
     msg_ok "Stopped Services"
 
-    create_backup /opt/lobehub/.env
+    msg_info "Backing up Data"
+    cp /opt/lobehub/.env /opt/lobehub.env.bak
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "lobehub" "lobehub/lobehub" "tarball"
 
-    restore_backup
+    msg_info "Restoring Configuration"
+    cp /opt/lobehub.env.bak /opt/lobehub/.env
+    rm -f /opt/lobehub.env.bak
+    msg_ok "Restored Configuration"
 
     msg_info "Building Application"
     cd /opt/lobehub

ct/mail-archiver.sh

@@ -36,7 +36,10 @@ function update_script() {
     systemctl stop mail-archiver
     msg_ok "Stopped Mail-Archiver"
 
-    create_backup /opt/mail-archiver/appsettings.json /opt/mail-archiver/.env /opt/mail-archiver/DataProtection-Keys
+    msg_info "Creating Backup"
+    cp /opt/mail-archiver/appsettings.json /opt/mail-archiver/.env /opt/
+    [[ -d /opt/mail-archiver/DataProtection-Keys ]] && cp -r /opt/mail-archiver/DataProtection-Keys /opt
+    msg_ok "Created Backup"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "mail-archiver" "s1t5/mail-archiver" "tarball"
 
@@ -48,7 +51,10 @@ function update_script() {
     rm -rf /opt/mail-archiver-build
     msg_ok "Updated Mail-Archiver"
 
-    restore_backup
+    msg_info "Restoring Backup"
+    cp /opt/appsettings.json /opt/.env /opt/mail-archiver
+    [[ -d /opt/DataProtection-Keys ]] && cp -r /opt/DataProtection-Keys /opt/mail-archiver/
+    msg_ok "Restored Backup"
 
     msg_info "Starting Mail-Archiver"
     systemctl start mail-archiver

ct/manyfold.sh

@@ -39,15 +39,13 @@ function update_script() {
 
     msg_info "Backing up Data"
     CURRENT_VERSION=$(grep -oP 'APP_VERSION=\K[^ ]+' /opt/manyfold/.env || echo "unknown")
+    cp -r /opt/manyfold/app/storage /opt/manyfold_storage_backup 2>/dev/null || true
+    cp -r /opt/manyfold/app/tmp /opt/manyfold_tmp_backup 2>/dev/null || true
     $STD tar -czf "/opt/manyfold_${CURRENT_VERSION}_backup.tar.gz" -C /opt/manyfold app
     msg_ok "Backed up Data"
 
-    create_backup /opt/manyfold/app/storage /opt/manyfold/app/tmp
-
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "manyfold" "manyfold3d/manyfold" "tarball" "latest" "/opt/manyfold/app"
 
-    restore_backup
-
     msg_info "Configuring Manyfold"
     RUBY_INSTALL_VERSION=$(cat /opt/manyfold/app/.ruby-version)
     YARN_VERSION=$(grep '"packageManager":' /opt/manyfold/app/package.json | sed -E 's/.*"(yarn@[0-9\.]+)".*/\1/')
@@ -57,9 +55,14 @@ function update_script() {
 
     RUBY_VERSION=${RUBY_INSTALL_VERSION} RUBY_INSTALL_RAILS="true" HOME=/home/manyfold setup_ruby
 
-    msg_info "Setting Permissions"
+    msg_info "Restoring Data"
+    rm -rf /opt/manyfold/app/{storage,tmp}
+    cp -r /opt/manyfold_storage_backup /opt/manyfold/app/storage 2>/dev/null || true
+    cp -r /opt/manyfold_tmp_backup /opt/manyfold/app/tmp 2>/dev/null || true
     chown -R manyfold:manyfold {/home/manyfold,/opt/manyfold}
-    msg_ok "Set Permissions"
+    chown -R manyfold:manyfold /opt/manyfold/app/storage /opt/manyfold/app/tmp /opt/manyfold/app/config
+    rm -rf /opt/manyfold_storage_backup /opt/manyfold_tmp_backup
+    msg_ok "Restored Data"
 
     msg_info "Installing Manyfold"
 

ct/matomo.sh

@@ -35,7 +35,11 @@ function update_script() {
     systemctl stop caddy
     msg_ok "Stopped Services"
 
-    create_backup /opt/matomo/config/config.ini.php /opt/matomo/misc/user /root/matomo.creds
+    msg_info "Backing up Data"
+    [[ -f /opt/matomo/config/config.ini.php ]] && cp /opt/matomo/config/config.ini.php /opt/matomo_config.bak
+    [[ -d /opt/matomo/misc/user ]] && cp -r /opt/matomo/misc/user /opt/matomo_user_backup
+    [[ -f /root/matomo.creds ]] && cp /root/matomo.creds /opt/matomo_db_creds.bak
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "matomo" "matomo-org/matomo" "prebuild" "latest" "/opt/matomo" "matomo-*.zip"
 
@@ -49,8 +53,20 @@ function update_script() {
     chmod -R 755 /opt/matomo/tmp
     msg_ok "Set up Matomo"
 
-    restore_backup
+    msg_info "Restoring Data"
+    if [[ -f /opt/matomo_config.bak ]]; then
+      mkdir -p /opt/matomo/config
+      cp /opt/matomo_config.bak /opt/matomo/config/config.ini.php
+    fi
+    if [[ -d /opt/matomo_user_backup ]]; then
+      mkdir -p /opt/matomo/misc/user
+      cp -r /opt/matomo_user_backup/. /opt/matomo/misc/user
+    fi
+    [[ -f /opt/matomo_db_creds.bak ]] && cp /opt/matomo_db_creds.bak /root/matomo.creds
+    rm -f /opt/matomo_config.bak /opt/matomo_db_creds.bak
+    rm -rf /opt/matomo_user_backup
     chown -R www-data:www-data /opt/matomo
+    msg_ok "Restored Data"
 
     if [[ -f /opt/matomo/console ]]; then
       msg_info "Running Matomo database upgrade"

ct/meilisearch.sh

@@ -33,13 +33,14 @@ function update_script() {
       systemctl stop meilisearch-ui
       msg_ok "Stopped Meilisearch-UI"
 
-      create_backup /opt/meilisearch-ui/.env.local
-      CLEAN_INSTALL=1 fetch_and_deploy_gh_release "meilisearch-ui" "riccox/meilisearch-ui" "tarball"
-      restore_backup
+      cp /opt/meilisearch-ui/.env.local /tmp/.env.local.bak
+      rm -rf /opt/meilisearch-ui
+      fetch_and_deploy_gh_release "meilisearch-ui" "riccox/meilisearch-ui" "tarball"
 
       msg_info "Configuring Meilisearch-UI"
       cd /opt/meilisearch-ui
       sed -i 's|const hash = execSync("git rev-parse HEAD").toString().trim();|const hash = "unknown";|' /opt/meilisearch-ui/vite.config.ts
+      mv /tmp/.env.local.bak /opt/meilisearch-ui/.env.local
       $STD pnpm install
       msg_ok "Configured Meilisearch-UI"
 

ct/metube.sh

@@ -48,11 +48,14 @@ function update_script() {
     systemctl stop metube
     msg_ok "Stopped Service"
 
-    create_backup /opt/metube/.env
+    msg_info "Backing up Old Installation"
+    if [[ -d /opt/metube_bak ]]; then
+      rm -rf /opt/metube_bak
+    fi
+    mv /opt/metube /opt/metube_bak
+    msg_ok "Backup created"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "metube" "alexta69/metube" "tarball" "latest"
-
-    restore_backup
+    fetch_and_deploy_gh_release "metube" "alexta69/metube" "tarball" "latest"
 
     msg_info "Building Frontend"
     cd /opt/metube/ui
@@ -72,6 +75,13 @@ function update_script() {
     $STD uv sync
     msg_ok "Installed Backend"
 
+    msg_info "Restoring .env"
+    if [[ -f /opt/metube_bak/.env ]]; then
+      cp /opt/metube_bak/.env /opt/metube/.env
+    fi
+    rm -rf /opt/metube_bak
+    msg_ok "Restored .env"
+
     if grep -q 'pipenv' /etc/systemd/system/metube.service; then
       msg_info "Patching systemd Service"
       cat <<EOF >/etc/systemd/system/metube.service

ct/nametag.sh

@@ -35,12 +35,13 @@ function update_script() {
     systemctl stop nametag
     msg_ok "Stopped Service"
 
-    create_backup /opt/nametag/.env /opt/nametag/data
+    msg_info "Backing up Data"
+    cp /opt/nametag/.env /opt/nametag.env.bak
+    cp -r /opt/nametag/data /opt/nametag_data_bak
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "nametag" "mattogodoy/nametag" "tarball" "latest" "/opt/nametag"
 
-    restore_backup
-
     msg_info "Rebuilding Application"
     cd /opt/nametag
     $STD npm ci
@@ -53,6 +54,13 @@ function update_script() {
     cp -r /opt/nametag/public /opt/nametag/.next/standalone/public
     msg_ok "Rebuilt Application"
 
+    msg_info "Restoring Data"
+    cp /opt/nametag.env.bak /opt/nametag/.env
+    cp -r /opt/nametag_data_bak/. /opt/nametag/data/
+    rm -f /opt/nametag.env.bak
+    rm -rf /opt/nametag_data_bak
+    msg_ok "Restored Data"
+
     msg_info "Running Migrations"
     cd /opt/nametag
     $STD npx prisma migrate deploy

ct/omada.sh

@@ -43,7 +43,7 @@ function update_script() {
     grep -o 'https://static\.tp-link\.com/upload/software/[^"]*linux_x64[^"]*\.deb' |
     head -n1)
   OMADA_PKG=$(basename "${OMADA_URL}")
-  VERSION=$(sed -n 's/.*_v\([0-9.]*\)_linux.*/\1/p' <<<"${OMADA_PKG}")
+  VERSION=$(sed -n 's/.*_v\([0-9.]*\)_.*_\([0-9]\{14\}\)\.deb$/\1-\2/p' <<<"${OMADA_PKG}")
 
   CURRENT_VERSION=$(cat $HOME/.omada 2>/dev/null || echo "0")
 

ct/overseerr.sh

@@ -61,16 +61,18 @@ EOF
     systemctl stop overseerr
     msg_ok "Service stopped"
 
-    create_backup /opt/overseerr/config
+    msg_info "Creating backup"
+    mv /opt/overseerr/config /opt/config_backup
+    msg_ok "Backup created"
 
     fetch_and_deploy_gh_release "overseerr" "sct/overseerr" "tarball"
-
-    restore_backup
+    rm -rf /opt/overseerr/config
 
     msg_info "Configuring ${APP} (Patience)"
     cd /opt/overseerr
     $STD yarn install
     $STD yarn build
+    mv /opt/config_backup /opt/overseerr/config
     msg_ok "Configured ${APP}"
 
     msg_info "Starting Service"

ct/ownfoil.sh

@@ -35,18 +35,23 @@ function update_script() {
     systemctl stop ownfoil
     msg_ok "Stopped Service"
 
-    create_backup /opt/ownfoil/app/config
+    msg_info "Backing up Data"
+    cp -r /opt/ownfoil/app/config /opt/ownfoil_data_backup
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "ownfoil" "a1ex4/ownfoil" "tarball"
 
-    restore_backup
-
     msg_info "Installing Dependencies"
     cd /opt/ownfoil
     $STD source .venv/bin/activate
     $STD uv pip install -r requirements.txt
     msg_ok "Installed Dependencies"
 
+    msg_info "Restoring Data"
+    cp -r /opt/ownfoil_data_backup /opt/ownfoil/app/config
+    rm -rf /opt/ownfoil_data_backup
+    msg_ok "Restored Data"
+
     msg_info "Starting Service"
     systemctl start ownfoil
     msg_ok "Started Service"

ct/pangolin.sh

@@ -6,7 +6,7 @@ source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxV
 # Source: https://pangolin.net/ | Github: https://github.com/fosrl/pangolin
 
 APP="Pangolin"
-PANGOLIN_VERSION="${PANGOLIN_VERSION:-1.21.0}"
+PANGOLIN_VERSION="${PANGOLIN_VERSION:-1.20.0}"
 var_tags="${var_tags:-proxy}"
 var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-4096}"

ct/paperclip.sh

@@ -35,11 +35,15 @@ function update_script() {
     systemctl stop paperclip
     msg_ok "Stopped Service"
 
-    create_backup /opt/paperclip-ai/.env
+    msg_info "Backing up Configuration"
+    cp /opt/paperclip-ai/.env /opt/paperclip.env.bak
+    msg_ok "Backed up Configuration"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "paperclip-ai" "paperclipai/paperclip" "tarball"
 
-    restore_backup
+    msg_info "Restoring Configuration"
+    mv /opt/paperclip.env.bak /opt/paperclip-ai/.env
+    msg_ok "Restored Configuration"
 
     msg_info "Rebuilding Paperclip"
     cd /opt/paperclip-ai

ct/papra.sh

@@ -35,18 +35,22 @@ function update_script() {
     systemctl stop papra
     msg_ok "Stopped Service"
 
-    create_backup /opt/papra/apps/papra-server/.env
+    msg_info "Backing up Configuration"
+    if [[ -f /opt/papra/apps/papra-server/.env ]]; then
+      cp /opt/papra/apps/papra-server/.env /opt/papra_env.bak
+    fi
+    msg_ok "Backed up Configuration"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "papra" "papra-hq/papra" "tarball"
 
-    restore_backup
-
     pnpm_version=$(grep -oP '"packageManager":\s*"pnpm@\K[^"]+' /opt/papra/package.json)
     NODE_VERSION="26" NODE_MODULE="pnpm@$pnpm_version" setup_nodejs
 
     msg_info "Building Application"
     cd /opt/papra
-    if [[ ! -f /opt/papra/apps/papra-server/.env ]]; then
+    if [[ -f /opt/papra_env.bak ]]; then
+      cp /opt/papra_env.bak /opt/papra/apps/papra-server/.env
+    else
       msg_warn ".env missing, regenerating from defaults"
       LOCAL_IP=$(hostname -I | awk '{print $1}')
       cat <<EOF >/opt/papra/apps/papra-server/.env
@@ -70,6 +74,7 @@ EOF
     $STD pnpm --filter "@papra/app-client..." run build
     $STD pnpm --filter "@papra/app-server..." run build
     ln -sf /opt/papra/apps/papra-client/dist /opt/papra/apps/papra-server/public
+    rm -f /opt/papra_env.bak
     msg_ok "Built Application"
 
     msg_info "Starting Service"

ct/patchmon.sh

@@ -72,13 +72,9 @@ EOF
       msg_ok "Migration complete!"
     fi
 
-    create_backup /opt/patchmon/.env
-
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "PatchMon" "PatchMon/PatchMon" "singlefile" "latest" "/opt/patchmon" "patchmon-server-linux-$(arch_resolve)"
     mv /opt/patchmon/PatchMon /opt/patchmon/patchmon-server
 
-    restore_backup
-
     msg_info "Fetching PatchMon agent binaries"
     RELEASE=$(get_latest_github_release "PatchMon/PatchMon")
     [[ ! -d /opt/patchmon/agents ]] && mkdir -p /opt/patchmon/agents

ct/postiz.sh

@@ -41,10 +41,9 @@ function update_script() {
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "postiz" "gitroomhq/postiz-app" "tarball"
 
-    restore_backup
-
     msg_info "Building Application"
     cd /opt/postiz
+    cp /opt/postiz_env.bak /opt/postiz/.env
     set -a && source /opt/postiz/.env && set +a
     export NODE_OPTIONS="--max-old-space-size=4096"
     $STD pnpm install
@@ -58,6 +57,7 @@ function update_script() {
     msg_ok "Ran Database Migrations"
 
     mkdir -p /opt/postiz/uploads
+    restore_backup
 
     msg_info "Starting Services"
     systemctl start postiz-backend postiz-frontend postiz-orchestrator

ct/powerdns.sh

@@ -36,14 +36,18 @@ function update_script() {
   msg_ok "Updated PowerDNS"
 
   if check_for_gh_release "poweradmin" "poweradmin/poweradmin"; then
-    create_backup /opt/poweradmin/config/settings.php /opt/poweradmin/powerdns.db
+    msg_info "Backing up Configuration"
+    cp /opt/poweradmin/config/settings.php /opt/poweradmin_settings.php.bak
+    cp /opt/poweradmin/powerdns.db /opt/poweradmin_powerdns.db.bak
+    msg_ok "Backed up Configuration"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "poweradmin" "poweradmin/poweradmin" "tarball"
 
-    restore_backup
-
     msg_info "Updating Poweradmin"
+    cp /opt/poweradmin_settings.php.bak /opt/poweradmin/config/settings.php
+    cp /opt/poweradmin_powerdns.db.bak /opt/poweradmin/powerdns.db
     rm -rf /opt/poweradmin/install
+    rm -f /opt/poweradmin_settings.php.bak /opt/poweradmin_powerdns.db.bak
     chown -R www-data:pdns /opt/poweradmin
     chmod 775 /opt/poweradmin
     chown pdns:pdns /opt/poweradmin/powerdns.db

ct/radicale.sh

@@ -34,12 +34,17 @@ function update_script() {
     systemctl stop radicale
     msg_ok "Stopped service"
 
-    create_backup /opt/radicale/users
+    msg_info "Backing up users file"
+    cp /opt/radicale/users /opt/radicale_users_backup
+    msg_ok "Backed up users file"
 
     PYTHON_VERSION="3.13" setup_uv
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Radicale" "Kozea/Radicale" "tarball" "latest" "/opt/radicale"
 
-    restore_backup
+    msg_info "Restoring users file"
+    rm -f /opt/radicale/users
+    mv /opt/radicale_users_backup /opt/radicale/users
+    msg_ok "Restored users file"
 
     if grep -q 'start.sh' /etc/systemd/system/radicale.service; then
       sed -i -e '/^Description/i[Unit]' \

ct/reactive-resume.sh

@@ -36,12 +36,10 @@ function update_script() {
 
     ensure_dependencies git
 
-    create_backup /opt/reactive-resume/.env
+    cp /opt/reactive-resume/.env /opt/reactive-resume.env.bak
     NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "reactive-resume" "amruthpillai/reactive-resume" "tarball" "latest" "/opt/reactive-resume"
 
-    restore_backup
-
     msg_info "Updating Reactive Resume (Patience)"
     cd /opt/reactive-resume
     export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
@@ -51,6 +49,7 @@ function update_script() {
     export NODE_ENV="production"
     $STD pnpm install --frozen-lockfile
     $STD pnpm run build
+    mv /opt/reactive-resume.env.bak /opt/reactive-resume/.env
     msg_ok "Updated Reactive Resume"
 
     msg_info "Updating Service"

ct/romm.sh

@@ -37,29 +37,18 @@ function update_script() {
     systemctl stop romm-backend romm-worker romm-scheduler romm-watcher
     msg_ok "Stopped Services"
 
-    create_backup /opt/romm/.env
-    BACKUP_DIR=/opt/romm-players.backup create_backup \
-      /opt/romm/frontend/dist/assets/emulatorjs \
-      /opt/romm/frontend/dist/assets/ruffle
+    msg_info "Backing up configuration"
+    cp /opt/romm/.env /opt/romm/.env.backup
+    msg_ok "Backed up configuration"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "romm" "rommapp/romm" "tarball" "latest" "/opt/romm"
-
-    restore_backup
+    fetch_and_deploy_gh_release "romm" "rommapp/romm" "tarball" "latest" "/opt/romm"
 
     msg_info "Updating ROMM"
+    cp /opt/romm/.env.backup /opt/romm/.env
     cd /opt/romm
     $STD uv sync --all-extras
     cd /opt/romm/backend
     $STD uv run alembic upgrade head
-    if [[ -f /opt/romm/backend/utils/rom_patcher/package.json ]]; then
-      cd /opt/romm/backend/utils/rom_patcher
-      $STD npm install --ignore-scripts --no-audit --no-fund
-      if [[ -d node_modules/rom-patcher/rom-patcher-js ]]; then
-        rm -rf rom-patcher-js
-        cp -r node_modules/rom-patcher/rom-patcher-js ./rom-patcher-js
-      fi
-      rm -rf node_modules
-    fi
     cd /opt/romm/frontend
     $STD npm install
     $STD npm run build
@@ -84,12 +73,6 @@ function update_script() {
     msg_ok "Started Services"
     msg_ok "Updated successfully"
   fi
-
-  if check_for_gh_release "EmulatorJS" "EmulatorJS/EmulatorJS" "v4.2.3"; then
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "EmulatorJS" "EmulatorJS/EmulatorJS" "prebuild" "v4.2.3" "/opt/romm/frontend/dist/assets/emulatorjs" "4.2.3.7z"
-    systemctl restart romm-backend romm-worker romm-scheduler romm-watcher
-    msg_ok "Updated EmulatorJS successfully"
-  fi
   exit
 }
 

ct/rustypaste.sh

@@ -35,11 +35,18 @@ function update_script() {
     systemctl stop rustypaste
     msg_ok "Stopped Services"
 
-    create_backup /opt/rustypaste/upload /opt/rustypaste/config.toml
+    msg_info "Creating Backup"
+    tar -czf "/opt/rustypaste_backup_$(date +%F).tar.gz" /opt/rustypaste/upload 2>/dev/null || true
+    cp /opt/rustypaste/config.toml /tmp/rustypaste_config.toml.bak
+    msg_ok "Backup Created"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "rustypaste" "orhun/rustypaste" "prebuild" "latest" "/opt/rustypaste" "*x86_64-unknown-linux-gnu.tar.gz"
 
-    restore_backup
+    msg_info "Restoring Data"
+    mv /tmp/rustypaste_config.toml.bak /opt/rustypaste/config.toml
+    tar -xzf "/opt/rustypaste_backup_$(date +%F).tar.gz" -C /opt/rustypaste/upload 2>/dev/null || true
+    rm -rf /opt/rustypaste_backup_$(date +%F).tar.gz
+    msg_ok "Restored Data"
 
     msg_info "Starting Services"
     systemctl start rustypaste

ct/scanopy.sh

@@ -36,16 +36,19 @@ function update_script() {
     [[ -f /etc/systemd/system/scanopy-daemon.service ]] && systemctl stop scanopy-daemon
     msg_ok "Stopped services"
 
-    create_backup /opt/scanopy/.env /opt/scanopy/oidc.toml
+    msg_info "Backing up configurations"
+    cp /opt/scanopy/.env /opt/scanopy.env
+    [[ -f /opt/scanopy/oidc.toml ]] && cp /opt/scanopy/oidc.toml /opt/scanopy.oidc.toml
+    msg_ok "Backed up configurations"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Scanopy" "scanopy/scanopy" "tarball" "latest" "/opt/scanopy"
 
-    restore_backup
-
     ensure_dependencies pkg-config libssl-dev
     TOOLCHAIN="$(grep "channel" /opt/scanopy/backend/rust-toolchain.toml | awk -F\" '{print $2}')"
     RUST_TOOLCHAIN=$TOOLCHAIN setup_rust
 
+    [[ -f /opt/scanopy.env ]] && mv /opt/scanopy.env /opt/scanopy/.env
+    [[ -f /opt/scanopy.oidc.toml ]] && mv /opt/scanopy.oidc.toml /opt/scanopy/oidc.toml
     if ! grep -q "PUBLIC_URL" /opt/scanopy/.env; then
       sed -i "\|_PATH=|a\\scanopy_PUBLIC_URL=http://${LOCAL_IP}:60072" /opt/scanopy/.env
     fi

ct/shelfmark.sh

@@ -52,12 +52,11 @@ function update_script() {
       msg_ok "Updated FlareSolverr"
     fi
 
-    create_backup /opt/shelfmark/start.sh
+    cp /opt/shelfmark/start.sh /opt/start.sh.bak
     if command -v chromedriver &>/dev/null; then
       $STD apt remove -y chromium-driver
     fi
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "shelfmark" "calibrain/shelfmark" "tarball" "latest" "/opt/shelfmark"
-    restore_backup
     RELEASE_VERSION=$(cat "$HOME/.shelfmark")
 
     msg_info "Updating Shelfmark"
@@ -75,6 +74,7 @@ function update_script() {
     else
       $STD uv sync --active --locked --no-default-groups
     fi
+    mv /opt/start.sh.bak /opt/shelfmark/start.sh
     msg_ok "Updated Shelfmark"
 
     msg_info "Starting Service(s)"

ct/shlink.sh

@@ -35,11 +35,19 @@ function update_script() {
     systemctl stop shlink
     msg_ok "Stopped Service"
 
-    create_backup /opt/shlink/.env /opt/shlink/data
+    msg_info "Backing up Data"
+    cp /opt/shlink/.env /opt/shlink.env.bak
+    cp -r /opt/shlink/data /opt/shlink_data_backup
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "shlink" "shlinkio/shlink" "prebuild" "latest" "/opt/shlink" "shlink*_php8.5_dist.zip"
 
-    restore_backup
+    msg_info "Restoring Data"
+    cp /opt/shlink.env.bak /opt/shlink/.env
+    rm -f /opt/shlink.env.bak
+    cp -r /opt/shlink_data_backup/. /opt/shlink/data
+    rm -rf /opt/shlink_data_backup
+    msg_ok "Restored Data"
 
     msg_info "Updating Application"
     cd /opt/shlink

ct/slskd.sh

@@ -36,17 +36,19 @@ function update_script() {
     [[ -f /etc/systemd/system/soularr.service ]] && systemctl stop soularr.timer soularr.service
     msg_ok "Stopped Service(s)"
 
-    create_backup /opt/slskd/config/slskd.yml
+    msg_info "Backing up config"
+    cp /opt/slskd/config/slskd.yml /opt/slskd.yml.bak
+    msg_ok "Backed up config"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Slskd" "slskd/slskd" "prebuild" "latest" "/opt/slskd" "slskd-*-linux-$(arch_resolve "x64" "arm64").zip"
 
-    restore_backup
+    msg_info "Restoring config"
+    mv /opt/slskd.yml.bak /opt/slskd/config/slskd.yml
 
-    msg_info "Migrating config"
     # Migrate 0.25.0 breaking config key renames
     sed -i 's/^global:/transfers:/' /opt/slskd/config/slskd.yml
     sed -i 's/^integration:/integrations:/' /opt/slskd/config/slskd.yml
-    msg_ok "Migrated config"
+    msg_ok "Restored config"
 
     msg_info "Starting Service(s)"
     systemctl start slskd
@@ -61,11 +63,13 @@ function update_script() {
       msg_ok "Stopped Timer and Service"
     fi
 
-    create_backup /opt/soularr/config.ini /opt/soularr/run.sh
+    msg_info "Backing up Soularr config"
+    cp /opt/soularr/config.ini /opt/soularr_config.ini.bak
+    cp /opt/soularr/run.sh /opt/soularr_run.sh.bak
+    msg_ok "Backed up Soularr config"
 
     PYTHON_VERSION="3.11" setup_uv
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Soularr" "mrusse/soularr" "tarball" "latest" "/opt/soularr"
-    restore_backup
     msg_info "Updating Soularr"
     cd /opt/soularr
     $STD uv venv -c venv
@@ -74,6 +78,11 @@ function update_script() {
     deactivate
     msg_ok "Updated Soularr"
 
+    msg_info "Restoring Soularr config"
+    mv /opt/soularr_config.ini.bak /opt/soularr/config.ini
+    mv /opt/soularr_run.sh.bak /opt/soularr/run.sh
+    msg_ok "Restored Soularr config"
+
     msg_info "Starting Soularr Timer"
     systemctl restart soularr.timer
     msg_ok "Started Soularr Timer"

ct/solidtime.sh

@@ -35,11 +35,19 @@ function update_script() {
     systemctl stop caddy
     msg_ok "Stopped Services"
 
-    create_backup /opt/solidtime/.env /opt/solidtime/storage
+    msg_info "Backing up Data"
+    cp /opt/solidtime/.env /opt/solidtime.env.bak
+    cp -r /opt/solidtime/storage /opt/solidtime_storage_backup
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "solidtime" "solidtime-io/solidtime" "tarball"
 
-    restore_backup
+    msg_info "Restoring Data"
+    cp /opt/solidtime.env.bak /opt/solidtime/.env
+    rm -f /opt/solidtime.env.bak
+    cp -r /opt/solidtime_storage_backup/. /opt/solidtime/storage
+    rm -rf /opt/solidtime_storage_backup
+    msg_ok "Restored Data"
 
     msg_info "Updating Application"
     cd /opt/solidtime

ct/soulsync.sh

@@ -37,12 +37,13 @@ function update_script() {
     systemctl stop soulsync
     msg_ok "Stopped Service"
 
-    create_backup /opt/soulsync/config /opt/soulsync/data
+    msg_info "Backing up Data"
+    mv /opt/soulsync/config /opt/soulsync-config.bak
+    mv /opt/soulsync/data /opt/soulsync-data.bak
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "soulsync" "Nezreka/SoulSync" "tarball"
 
-    restore_backup
-
     msg_info "Updating Python Dependencies"
     cd /opt/soulsync
     $STD uv venv --clear /opt/soulsync/.venv --python 3.11
@@ -55,6 +56,9 @@ function update_script() {
     $STD npm run build
     msg_ok "Built WebUI"
 
+    mv /opt/soulsync-config.bak /opt/soulsync/config
+    mv /opt/soulsync-data.bak /opt/soulsync/data
+
     msg_info "Starting Service"
     systemctl start soulsync
     msg_ok "Started Service"

ct/sparkyfitness.sh

@@ -35,12 +35,18 @@ function update_script() {
     systemctl stop sparkyfitness-server nginx
     msg_ok "Stopped Services"
 
-    create_backup /opt/sparkyfitness/SparkyFitnessServer/uploads /opt/sparkyfitness/SparkyFitnessServer/backup
+    msg_info "Backing up data"
+    mkdir -p /opt/sparkyfitness_backup
+    if [[ -d /opt/sparkyfitness/SparkyFitnessServer/uploads ]]; then
+      cp -r /opt/sparkyfitness/SparkyFitnessServer/uploads /opt/sparkyfitness_backup/
+    fi
+    if [[ -d /opt/sparkyfitness/SparkyFitnessServer/backup ]]; then
+      cp -r /opt/sparkyfitness/SparkyFitnessServer/backup /opt/sparkyfitness_backup/
+    fi
+    msg_ok "Backed up data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "sparkyfitness" "CodeWithCJ/SparkyFitness" "tarball"
 
-    restore_backup
-
     PNPM_VERSION="$(jq -r '.packageManager | split("@")[1]' /opt/sparkyfitness/package.json)"
     NODE_VERSION="25" NODE_MODULE="pnpm@${PNPM_VERSION}" setup_nodejs
 
@@ -90,6 +96,11 @@ EOF
     systemctl daemon-reload
     msg_ok "Refreshed SparkyFitness Service"
 
+    msg_info "Restoring data"
+    cp -r /opt/sparkyfitness_backup/. /opt/sparkyfitness/SparkyFitnessServer/
+    rm -rf /opt/sparkyfitness_backup
+    msg_ok "Restored data"
+
     msg_info "Starting Services"
     $STD systemctl start sparkyfitness-server nginx
     msg_ok "Started Services"

ct/spliit.sh

@@ -35,11 +35,16 @@ function update_script() {
     systemctl stop spliit
     msg_ok "Stopped Service"
 
-    create_backup /opt/spliit/.env
+    msg_info "Backing up Configuration"
+    rm -f /opt/spliit.env.bak
+    cp /opt/spliit/.env /opt/spliit.env.bak
+    msg_ok "Backed up Configuration"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "spliit" "spliit-app/spliit" "tarball"
 
-    restore_backup
+    msg_info "Restoring Configuration"
+    cp /opt/spliit.env.bak /opt/spliit/.env
+    msg_ok "Restored Configuration"
 
     msg_info "Building Application"
     cd /opt/spliit

ct/spoolman.sh

@@ -36,16 +36,18 @@ function update_script() {
     systemctl stop spoolman
     msg_ok "Stopped Service"
 
-    create_backup /opt/spoolman/.env
+    msg_info "Creating Backup"
+    [ -d /opt/spoolman_bak ] && rm -rf /opt/spoolman_bak
+    mv /opt/spoolman /opt/spoolman_bak
+    msg_ok "Created Backup"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "spoolman" "Donkie/Spoolman" "prebuild" "latest" "/opt/spoolman" "spoolman.zip"
-
-    restore_backup
+    fetch_and_deploy_gh_release "spoolman" "Donkie/Spoolman" "prebuild" "latest" "/opt/spoolman" "spoolman.zip"
 
     msg_info "Updating Spoolman"
     cd /opt/spoolman
     $STD uv sync --locked --no-install-project
     $STD uv sync --locked
+    cp /opt/spoolman_bak/.env /opt/spoolman
     sed -i 's|^ExecStart=.*|ExecStart=/usr/bin/bash /opt/spoolman/scripts/start.sh|' /etc/systemd/system/spoolman.service
     msg_ok "Updated Spoolman"
 

ct/storyteller.sh

@@ -37,11 +37,15 @@ function update_script() {
     systemctl stop storyteller
     msg_ok "Stopped Service"
 
-    create_backup /opt/storyteller/.env
+    msg_info "Backing up Data"
+    cp /opt/storyteller/.env /opt/storyteller_env.bak
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gl_release "storyteller" "storyteller-platform/storyteller" "tarball" "latest" "/opt/storyteller" "" "web-v2"
 
-    restore_backup
+    msg_info "Restoring Configuration"
+    mv /opt/storyteller_env.bak /opt/storyteller/.env
+    msg_ok "Restored Configuration"
 
     msg_info "Rebuilding Storyteller"
     cd /opt/storyteller

ct/tandoor.sh

@@ -43,15 +43,17 @@ function update_script() {
     systemctl stop tandoor
     msg_ok "Stopped Service"
 
-    create_backup /opt/tandoor/config /opt/tandoor/api /opt/tandoor/mediafiles /opt/tandoor/staticfiles /opt/tandoor/.env
+    msg_info "Creating Backup"
+    mv /opt/tandoor /opt/tandoor.bak
+    msg_ok "Backup Created"
 
     NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
     PYTHON_VERSION="3.13" setup_uv
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "tandoor" "TandoorRecipes/recipes" "tarball" "latest" "/opt/tandoor"
-
-    restore_backup
+    fetch_and_deploy_gh_release "tandoor" "TandoorRecipes/recipes" "tarball" "latest" "/opt/tandoor"
 
     msg_info "Updating Tandoor"
+    cp -r /opt/tandoor.bak/{config,api,mediafiles,staticfiles} /opt/tandoor/
+    mv /opt/tandoor.bak/.env /opt/tandoor/.env
     cd /opt/tandoor
     $STD uv venv --clear .venv --python=python3
     $STD uv pip install -r requirements.txt --python .venv/bin/python
@@ -67,6 +69,7 @@ EOF
     cd /opt/tandoor
     $STD /opt/tandoor/.venv/bin/python manage.py migrate
     $STD /opt/tandoor/.venv/bin/python manage.py collectstatic --no-input
+    rm -rf /opt/tandoor.bak
     msg_ok "Updated Tandoor"
 
     msg_info "Starting Service"

ct/tautulli.sh

@@ -36,12 +36,13 @@ function update_script() {
     systemctl stop tautulli
     msg_ok "Stopped Service"
 
-    create_backup /opt/Tautulli/config.ini /opt/Tautulli/tautulli.db
+    msg_info "Backing up config and database"
+    cp /opt/Tautulli/config.ini /opt/tautulli_config.ini.backup
+    cp /opt/Tautulli/tautulli.db /opt/tautulli.db.backup
+    msg_ok "Backed up config and database"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Tautulli" "Tautulli/Tautulli" "tarball"
 
-    restore_backup
-
     msg_info "Updating Tautulli"
     cd /opt/Tautulli
     TAUTULLI_VERSION=$(get_latest_github_release "Tautulli/Tautulli" "false")
@@ -54,6 +55,12 @@ function update_script() {
     $STD uv pip install "setuptools<81"
     msg_ok "Updated Tautulli"
 
+    msg_info "Restoring config and database"
+    cp /opt/tautulli_config.ini.backup /opt/Tautulli/config.ini
+    cp /opt/tautulli.db.backup /opt/Tautulli/tautulli.db
+    rm -f /opt/{tautulli_config.ini.backup,tautulli.db.backup}
+    msg_ok "Restored config and database"
+
     msg_info "Starting Service"
     systemctl start tautulli
     msg_ok "Started Service"

ct/teable.sh

@@ -36,11 +36,15 @@ function update_script() {
     systemctl stop teable
     msg_ok "Stopped Service"
 
-    create_backup /opt/teable/.env
+    msg_info "Backing up Configuration"
+    cp /opt/teable/.env /opt/teable.env.bak
+    msg_ok "Backed up Configuration"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "teable" "teableio/teable" "tarball"
 
-    restore_backup
+    msg_info "Restoring Configuration"
+    mv /opt/teable.env.bak /opt/teable/.env
+    msg_ok "Restored Configuration"
 
     msg_info "Rebuilding Teable"
     cd /opt/teable

ct/teddycloud.sh

@@ -34,11 +34,16 @@ function update_script() {
     systemctl stop teddycloud
     msg_ok "Stopped Service"
 
-    create_backup /opt/teddycloud/certs /opt/teddycloud/config /opt/teddycloud/data
+    msg_info "Creating backup"
+    mv /opt/teddycloud /opt/teddycloud_bak
+    msg_ok "Backup created"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "teddycloud" "toniebox-reverse-engineering/teddycloud" "prebuild" "latest" "/opt/teddycloud" "teddycloud.amd64.release*.zip"
 
-    restore_backup
+    msg_info "Restoring data"
+    cp -R /opt/teddycloud_bak/certs /opt/teddycloud_bak/config /opt/teddycloud_bak/data /opt/teddycloud
+    rm -rf /opt/teddycloud_bak
+    msg_ok "Data restored"
 
     msg_info "Starting Service"
     systemctl start teddycloud

ct/termix.sh

@@ -143,12 +143,13 @@ EOF
     fi
     msg_ok "Migrated Configuration"
 
-    create_backup /opt/termix/data /opt/termix/uploads
+    msg_info "Backing up Data"
+    cp -r /opt/termix/data /opt/termix_data_backup
+    cp -r /opt/termix/uploads /opt/termix_uploads_backup
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "termix" "Termix-SSH/Termix" "tarball"
 
-    restore_backup
-
     msg_info "Recreating Directories"
     mkdir -p /opt/termix/html \
       /opt/termix/nginx \
@@ -176,6 +177,12 @@ EOF
     $STD npm cache clean --force
     msg_ok "Set up Production Dependencies"
 
+    msg_info "Restoring Data"
+    cp -r /opt/termix_data_backup /opt/termix/data
+    cp -r /opt/termix_uploads_backup /opt/termix/uploads
+    rm -rf /opt/termix_data_backup /opt/termix_uploads_backup
+    msg_ok "Restored Data"
+
     msg_info "Updating Frontend Files"
     rm -rf /opt/termix/html/*
     cp -r /opt/termix/dist/* /opt/termix/html/ 2>/dev/null || true

ct/tianji.sh

@@ -36,11 +36,12 @@ function update_script() {
     systemctl stop tianji
     msg_ok "Stopped Service"
 
-    create_backup /opt/tianji/src/server/.env
+    msg_info "Backing up data"
+    cp /opt/tianji/src/server/.env /opt/.env
+    mv /opt/tianji /opt/tianji_bak
+    msg_ok "Backed up data"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "tianji" "msgbyte/tianji" "tarball"
-
-    restore_backup
+    fetch_and_deploy_gh_release "tianji" "msgbyte/tianji" "tarball"
 
     msg_info "Updating Tianji"
     cd /opt/tianji
@@ -51,8 +52,10 @@ function update_script() {
     mkdir -p ./src/server/public
     cp -r ./geo ./src/server/public
     $STD pnpm build:server
+    mv /opt/.env /opt/tianji/src/server/.env
     cd src/server
     $STD pnpm db:migrate:apply
+    rm -rf /opt/tianji_bak
     rm -rf /opt/tianji/src/client
     rm -rf /opt/tianji/website
     rm -rf /opt/tianji/reporter

ct/transmute.sh

@@ -40,12 +40,13 @@ function update_script() {
     systemctl stop transmute
     msg_ok "Stopped Service"
 
-    create_backup /opt/transmute/backend/.env /opt/transmute/data
+    msg_info "Backing up Data"
+    cp /opt/transmute/backend/.env /opt/transmute.env.bak
+    cp -r /opt/transmute/data /opt/transmute_data_bak
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "transmute" "transmute-app/transmute" "tarball"
 
-    restore_backup
-
     msg_info "Updating Python Dependencies"
     cd /opt/transmute
     $STD uv venv --clear /opt/transmute/.venv
@@ -58,6 +59,12 @@ function update_script() {
     $STD npm run build
     msg_ok "Rebuilt Frontend"
 
+    msg_info "Restoring Data"
+    cp /opt/transmute.env.bak /opt/transmute/backend/.env
+    cp -r /opt/transmute_data_bak/. /opt/transmute/data/
+    rm -f /opt/transmute.env.bak
+    rm -rf /opt/transmute_data_bak
+    msg_ok "Restored Data"
 
     msg_info "Starting Service"
     systemctl start transmute

ct/trek.sh

@@ -3,7 +3,7 @@ source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxV
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/liketrek/TREK
+# Source: https://github.com/mauriceboe/TREK
 
 APP="TREK"
 var_tags="${var_tags:-travel;planning;collaboration}"
@@ -32,7 +32,7 @@ function update_script() {
 
   NODE_VERSION="24" setup_nodejs
 
-  if check_for_gh_release "trek" "liketrek/TREK"; then
+  if check_for_gh_release "trek" "mauriceboe/TREK"; then
     MIGRATION=0
     grep -qF "ExecStart=/usr/bin/node --import tsx src/index.ts" \
       /etc/systemd/system/trek.service && MIGRATION=1
@@ -47,7 +47,7 @@ function update_script() {
       /opt/trek/data \
       /opt/trek/uploads
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "trek" "liketrek/TREK" "tarball"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "trek" "mauriceboe/TREK" "tarball"
 
     msg_info "Building TREK"
     cd /opt/trek
@@ -79,7 +79,7 @@ function update_script() {
       cat <<EOF >/etc/systemd/system/trek.service
 [Unit]
 Description=TREK Travel Planner
-Documentation=https://github.com/liketrek/TREK
+Documentation=https://github.com/mauriceboe/TREK
 After=network-online.target
 Wants=network-online.target
 

ct/tubearchivist.sh

@@ -35,12 +35,12 @@ function update_script() {
     systemctl stop tubearchivist tubearchivist-celery tubearchivist-beat
     msg_ok "Stopped Services"
 
-    create_backup /opt/tubearchivist/.env
+    msg_info "Backing up Data"
+    cp /opt/tubearchivist/.env /opt/tubearchivist_env.bak
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "tubearchivist" "tubearchivist/tubearchivist" "tarball"
 
-    restore_backup
-
     msg_info "Rebuilding Tube Archivist"
     cd /opt/tubearchivist/frontend
     $STD npm install
@@ -56,6 +56,7 @@ function update_script() {
     msg_ok "Rebuilt Tube Archivist"
 
     msg_info "Restoring Configuration"
+    mv /opt/tubearchivist_env.bak /opt/tubearchivist/.env
     sed -i 's|^TA_APP_DIR=/opt/tubearchivist$|TA_APP_DIR=/opt/tubearchivist/backend|' /opt/tubearchivist/.env
     sed -i 's|^TA_CACHE_DIR=/opt/tubearchivist/cache$|TA_CACHE_DIR=/cache|' /opt/tubearchivist/.env
     sed -i 's|^TA_MEDIA_DIR=/opt/tubearchivist/media$|TA_MEDIA_DIR=/youtube|' /opt/tubearchivist/.env

ct/umami.sh

@@ -34,9 +34,9 @@ function update_script() {
     systemctl stop umami
     msg_ok "Stopped Service"
 
-    create_backup /opt/umami/.env
+    mv /opt/umami/.env /opt/.env.bak
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "umami" "umami-software/umami" "tarball"
-    restore_backup
+    mv /opt/.env.bak /opt/umami/.env
 
     msg_info "Updating Umami"
     cd /opt/umami

ct/umlautadaptarr.sh

@@ -34,9 +34,9 @@ function update_script() {
     systemctl stop umlautadaptarr
     msg_ok "Stopped Service"
 
-    create_backup /opt/UmlautAdaptarr/appsettings.json
+    cp /opt/UmlautAdaptarr/appsettings.json /opt/UmlautAdaptarr/appsettings.json.bak
     fetch_and_deploy_gh_release "UmlautAdaptarr" "PCJones/Umlautadaptarr" "prebuild" "latest" "/opt/UmlautAdaptarr" "linux-x64.zip"
-    restore_backup
+    cp /opt/UmlautAdaptarr/appsettings.json.bak /opt/UmlautAdaptarr/appsettings.json
 
     msg_info "Starting Service"
     systemctl start umlautadaptarr

ct/vikunja.sh

@@ -65,7 +65,7 @@ function update_script() {
     systemctl stop vikunja
     msg_ok "Stopped Service"
 
-    fetch_and_deploy_gh_release "vikunja" "go-vikunja/vikunja" "binary" "latest" "" "vikunja-*-$(arch_resolve "x86_64" "aarch64").deb"
+    fetch_and_deploy_gh_release "vikunja" "go-vikunja/vikunja" "binary"
     $STD systemctl daemon-reload
 
     msg_info "Starting Service"

ct/wallabag.sh

@@ -38,11 +38,16 @@ function update_script() {
     systemctl stop nginx php8.3-fpm
     msg_ok "Stopped Services"
 
-    create_backup /opt/wallabag/app/config/parameters.yml
+    msg_info "Creating Backup"
+    cp /opt/wallabag/app/config/parameters.yml /tmp/wallabag_parameters.yml.bak
+    msg_ok "Created Backup"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "wallabag" "wallabag/wallabag" "prebuild" "latest" "/opt/wallabag" "wallabag-*.tar.gz"
 
-    restore_backup
+    msg_info "Restoring Configuration"
+    cp /tmp/wallabag_parameters.yml.bak /opt/wallabag/app/config/parameters.yml
+    rm -f /tmp/wallabag_parameters.yml.bak
+    msg_ok "Restored Configuration"
 
     msg_info "Running Migrations"
     cd /opt/wallabag

ct/wanderer.sh

@@ -46,8 +46,8 @@ function update_script() {
     cd /opt/wanderer/source/web
     $STD npm ci
     $STD npm run build
-    mkdir -p /opt/wanderer/data/plugins /opt/wanderer/source/db/data
-    [[ -e /opt/wanderer/source/db/data/plugins ]] || ln -sfn /opt/wanderer/data/plugins /opt/wanderer/source/db/data/plugins
+    mkdir -p /opt/wanderer/data/plugins
+    [[ -e /data/plugins ]] || ln -sfn /opt/wanderer/data/plugins /data/plugins
     msg_info "Installing wanderer plugins"
     for plugin in hammerhead komoot strava; do
       fetch_and_deploy_gh_release "wanderer-plugin-${plugin}" "open-wanderer/wanderer" "prebuild" "${CHECK_UPDATE_RELEASE:-latest}" "/opt/wanderer/data/plugins" "wanderer-plugin-${plugin}.tar.gz" || msg_warn "Failed to install wanderer plugin: ${plugin}"

ct/wealthfolio.sh

@@ -39,13 +39,20 @@ function update_script() {
     systemctl stop wealthfolio
     msg_ok "Stopped Service"
 
-    create_backup /opt/wealthfolio_data /opt/wealthfolio/.env
+    msg_info "Backing up Data"
+    cp -r /opt/wealthfolio_data /opt/wealthfolio_data_backup
+    cp /opt/wealthfolio/.env /opt/wealthfolio_env_backup
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "wealthfolio" "wealthfolio/wealthfolio" "prebuild" "latest" "/opt/wealthfolio" "wealthfolio-server-*-linux-amd64.tar.gz"
-
-    restore_backup
     install -m 755 /opt/wealthfolio/wealthfolio-server /usr/local/bin/wealthfolio-server
 
+    msg_info "Restoring Data"
+    cp -r /opt/wealthfolio_data_backup/. /opt/wealthfolio_data
+    cp /opt/wealthfolio_env_backup /opt/wealthfolio/.env
+    rm -rf /opt/wealthfolio_data_backup /opt/wealthfolio_env_backup
+    msg_ok "Restored Data"
+
     msg_info "Starting Service"
     systemctl start wealthfolio
     msg_ok "Started Service"

ct/web-check.sh

@@ -34,12 +34,16 @@ function update_script() {
     systemctl stop web-check
     msg_ok "Stopped Service"
 
-    create_backup /opt/web-check/.env
+    msg_info "Creating backup"
+    mv /opt/web-check/.env /opt
+    msg_ok "Created backup"
 
     NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "web-check" "Lissy93/web-check" "tarball"
 
-    restore_backup
+    msg_info "Restoring backup"
+    mv /opt/.env /opt/web-check
+    msg_ok "Restored backup"
 
     msg_info "Building Web-Check"
     cd /opt/web-check 

ct/webtrees.sh

@@ -36,12 +36,17 @@ function update_script() {
     systemctl stop caddy php${PHP_VER}-fpm
     msg_ok "Stopped Service"
 
-    create_backup /opt/webtrees/data
+    msg_info "Backing up Data"
+    cp -r /opt/webtrees/data /opt/webtrees_data_backup
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "webtrees" "fisharebest/webtrees" "prebuild" "latest" "/opt/webtrees" "webtrees-*.zip"
 
-    restore_backup
+    msg_info "Restoring Data"
+    cp -r /opt/webtrees_data_backup/. /opt/webtrees/data
+    rm -rf /opt/webtrees_data_backup
     chown -R www-data:www-data /opt/webtrees
+    msg_ok "Restored Data"
 
     msg_info "Starting Service"
     systemctl start caddy php${PHP_VER}-fpm

ct/wishlist.sh

@@ -35,13 +35,16 @@ function update_script() {
     systemctl stop wishlist
     msg_ok "Stopped Service"
 
-    create_backup /opt/wishlist/.env /opt/wishlist/uploads /opt/wishlist/data
+    msg_info "Creating Backup"
+    mkdir -p /opt/wishlist-backup
+    cp /opt/wishlist/.env /opt/wishlist-backup/.env
+    cp -a /opt/wishlist/uploads /opt/wishlist-backup
+    cp -a /opt/wishlist/data /opt/wishlist-backup
+    msg_ok "Created Backup"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "wishlist" "cmintey/wishlist" "tarball"
     LATEST_APP_VERSION=$(get_latest_github_release "cmintey/wishlist")
 
-    restore_backup
-
     msg_info "Updating Wishlist"
     cd /opt/wishlist
     $STD pnpm install --frozen-lockfile
@@ -53,6 +56,13 @@ function update_script() {
     $STD pnpm run build
     $STD pnpm prune --prod
     chmod +x /opt/wishlist/entrypoint.sh
+
+    msg_info "Restoring Backup"
+    cp /opt/wishlist-backup/.env /opt/wishlist/.env
+    cp -a /opt/wishlist-backup/uploads /opt/wishlist
+    cp -a /opt/wishlist-backup/data /opt/wishlist
+    rm -rf /opt/wishlist-backup
+    msg_ok "Restored Backup"
     
     msg_ok "Updated Wishlist"
     msg_info "Starting Service"

ct/writefreely.sh

@@ -35,11 +35,19 @@ function update_script() {
     systemctl stop writefreely
     msg_ok "Stopped Services"
 
-    create_backup /opt/writefreely/keys /opt/writefreely/config.ini
+    msg_info "Creating Backup"
+    mkdir -p /tmp/writefreely_backup
+    cp /opt/writefreely/keys /tmp/writefreely_backup/ 2>/dev/null
+    cp /opt/writefreely/config.ini /tmp/writefreely_backup/ 2>/dev/null
+    msg_ok "Created Backup"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "writefreely" "writefreely/writefreely" "prebuild" "latest" "/opt/writefreely" "writefreely_*_linux_$(arch_resolve).tar.gz"
 
-    restore_backup
+    msg_info "Restoring Data"
+    cp /tmp/writefreely_backup/config.ini /opt/writefreely/ 2>/dev/null
+    cp /tmp/writefreely_backup/keys/* /opt/writefreely/keys/ 2>/dev/null
+    rm -rf /tmp/writefreely_backup
+    msg_ok "Restored Data"
 
     msg_info "Running Post-Update Tasks"
     cd /opt/writefreely

ct/xyops.sh

@@ -35,12 +35,13 @@ function update_script() {
     systemctl stop xyops
     msg_ok "Stopped Service"
 
-    create_backup /opt/xyops/data /opt/xyops/conf
+    msg_info "Backing up Data"
+    cp -r /opt/xyops/data /opt/xyops_data_backup
+    cp -r /opt/xyops/conf /opt/xyops_conf_backup
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "xyops" "pixlcore/xyops" "tarball"
 
-    restore_backup
-
     msg_info "Rebuilding Application"
     cd /opt/xyops
     $STD npm install
@@ -48,6 +49,12 @@ function update_script() {
     chmod 644 /opt/xyops/node_modules/useragent-ng/lib/regexps.js
     msg_ok "Rebuilt Application"
 
+    msg_info "Restoring Data"
+    cp -r /opt/xyops_data_backup/. /opt/xyops/data
+    cp -r /opt/xyops_conf_backup/. /opt/xyops/conf
+    rm -rf /opt/xyops_data_backup /opt/xyops_conf_backup
+    msg_ok "Restored Data"
+
     msg_info "Starting Service"
     systemctl start xyops
     msg_ok "Started Service"

ct/yamtrack.sh

@@ -36,17 +36,22 @@ function update_script() {
     systemctl stop yamtrack yamtrack-celery
     msg_ok "Stopped Services"
 
-    create_backup /opt/yamtrack/src/.env
+    msg_info "Backing up Data"
+    cp /opt/yamtrack/src/.env /opt/yamtrack_env.bak
+    msg_ok "Backed up Data"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "yamtrack" "FuzzyGrim/Yamtrack" "tarball"
 
-    restore_backup
-
     msg_info "Installing Python Dependencies"
     cd /opt/yamtrack
     $STD uv sync --locked
     msg_ok "Installed Python Dependencies"
 
+    msg_info "Restoring Data"
+    cp /opt/yamtrack_env.bak /opt/yamtrack/src/.env
+    rm -f /opt/yamtrack_env.bak
+    msg_ok "Restored Data"
+
     msg_info "Updating Yamtrack"
     cd /opt/yamtrack/src
     $STD /opt/yamtrack/.venv/bin/python manage.py migrate

ct/yourls.sh

@@ -35,13 +35,18 @@ function update_script() {
     systemctl stop nginx
     msg_ok "Stopped Service"
 
-    create_backup /opt/yourls/user
+    msg_info "Backing up Configuration"
+    cp -r /opt/yourls/user /opt/yourls_user.bak
+    msg_ok "Backed up Configuration"
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "yourls" "YOURLS/YOURLS" "tarball"
-
-    restore_backup
     chown -R www-data:www-data /opt/yourls
 
+    msg_info "Restoring Configuration"
+    cp -r /opt/yourls_user.bak/. /opt/yourls/user/
+    rm -rf /opt/yourls_user.bak
+    msg_ok "Restored Configuration"
+
     msg_info "Starting Service"
     systemctl start nginx
     msg_ok "Started Service"

ct/zerobyte.sh

@@ -35,14 +35,14 @@ function update_script() {
     systemctl stop zerobyte
     msg_ok "Stopped Service"
 
-    create_backup /opt/zerobyte/.env
+    msg_info "Backing up Configuration"
+    cp /opt/zerobyte/.env /opt/zerobyte.env.bak
+    msg_ok "Backed up Configuration"
     
     ensure_dependencies git
     NODE_VERSION="24" setup_nodejs
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "zerobyte" "nicotsx/zerobyte" "tarball"
 
-    restore_backup
-
     msg_info "Building Zerobyte"
     export NODE_OPTIONS="--max-old-space-size=3072"
     cd /opt/zerobyte
@@ -50,6 +50,11 @@ function update_script() {
     $STD node ./node_modules/vite/bin/vite.js build
     msg_ok "Built Zerobyte"
 
+    msg_info "Restoring Configuration"
+    cp /opt/zerobyte.env.bak /opt/zerobyte/.env
+    rm -f /opt/zerobyte.env.bak
+    msg_ok "Restored Configuration"
+
     msg_info "Starting Service"
     systemctl start zerobyte
     msg_ok "Started Service"

ct/zigbee2mqtt.sh

@@ -37,24 +37,24 @@ function update_script() {
 
     msg_info "Creating Backup"
     ensure_dependencies zstd
-    mkdir -p /opt/backups
+    mkdir -p /opt/{backups,z2m_backup}
     BACKUP_VERSION="$(<"$HOME/.zigbee2mqtt")"
     BACKUP_FILE="/opt/backups/${APP}_backup_${BACKUP_VERSION}.tar.zst"
     $STD tar -cf - -C /opt zigbee2mqtt | zstd -q -o "$BACKUP_FILE"
     ls -t /opt/backups/${APP}_backup_*.tar.zst 2>/dev/null | tail -n +6 | xargs -r rm -f
+    mv /opt/zigbee2mqtt/data /opt/z2m_backup/data
     msg_ok "Backup Created (${BACKUP_VERSION})"
 
-    create_backup /opt/zigbee2mqtt/data
-
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Zigbee2MQTT" "Koenkk/zigbee2mqtt" "tarball" "latest" "/opt/zigbee2mqtt"
 
-    restore_backup
-
     msg_info "Updating Zigbee2MQTT"
+    rm -rf /opt/zigbee2mqtt/data
+    mv /opt/z2m_backup/data /opt/zigbee2mqtt
     cd /opt/zigbee2mqtt
     grep -q "^packageImportMethod" ./pnpm-workspace.yaml 2>/dev/null || echo "packageImportMethod: hardlink" >>./pnpm-workspace.yaml
     $STD pnpm install --frozen-lockfile
     $STD pnpm build
+    rm -rf /opt/z2m_backup
     msg_ok "Updated Zigbee2MQTT"
 
     msg_info "Starting Service"

install/affine-install.sh

@@ -31,7 +31,7 @@ PG_DB_NAME="affine" PG_DB_USER="affine" setup_postgresql_db
 NODE_VERSION="22" setup_nodejs
 setup_rust
 
-fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "v0.27.2" "/opt/affine"
+fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "v0.27.0" "/opt/affine"
 
 msg_info "Setting up Directories"
 rm -rf /root/.affine

install/authentik-install.sh

@@ -54,12 +54,12 @@ NODE_VERSION="24" setup_nodejs
 setup_yq
 setup_go
 RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
-UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.6" setup_uv
+UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.3" setup_uv
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db
 
-XMLSEC_VERSION="1.3.12"
-AUTHENTIK_VERSION="version/2026.5.5"
+XMLSEC_VERSION="1.3.11"
+AUTHENTIK_VERSION="version/2026.5.3"
 fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec"
 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
 fetch_and_deploy_gh_release "geoipupdate" "maxmind/geoipupdate" "binary"

install/gotify-install.sh

@@ -27,7 +27,7 @@ After=network.target
 Type=simple
 User=root
 WorkingDirectory=/opt/gotify
-ExecStart=/opt/gotify/gotify-linux-$(arch_resolve) serve
+ExecStart=/opt/gotify/./gotify-linux-$(arch_resolve)
 Restart=always
 RestartSec=3
 

install/manyfold-install.sh

@@ -31,14 +31,13 @@ NODE_VERSION="24" NODE_MODULE="corepack,yarn" setup_nodejs
 
 fetch_and_deploy_gh_release "manyfold" "manyfold3d/manyfold" "tarball" "latest" "/opt/manyfold/app"
 
-useradd -m -s /usr/bin/bash manyfold
-
 RUBY_INSTALL_VERSION=$(cat /opt/manyfold/app/.ruby-version)
 RUBY_VERSION=${RUBY_INSTALL_VERSION} RUBY_INSTALL_RAILS="true" HOME=/home/manyfold setup_ruby
 
 msg_info "Configuring Manyfold"
 YARN_VERSION=$(grep '"packageManager":' /opt/manyfold/app/package.json | sed -E 's/.*"(yarn@[0-9\.]+)".*/\1/')
 RELEASE=$(get_latest_github_release "manyfold3d/manyfold")
+useradd -m -s /usr/bin/bash manyfold
 cat <<EOF >/opt/manyfold/.env
 export APP_VERSION=${RELEASE}
 export GUID=1002

install/omada-install.sh

@@ -42,7 +42,7 @@ OMADA_PKG=$(basename "${OMADA_URL}")
 curl_download "${OMADA_PKG}" "${OMADA_URL}"
 $STD dpkg -i "${OMADA_PKG}"
 rm -rf "${OMADA_PKG}"
-VERSION=$(sed -n 's/.*_v\([0-9.]*\)_linux.*/\1/p' <<<"${OMADA_PKG}")
+VERSION=$(sed -n 's/.*_v\([0-9.]*\)_.*_\([0-9]\{14\}\)\.deb$/\1-\2/p' <<<"${OMADA_PKG}")
 echo "${VERSION}" >$HOME/.omada
 msg_ok "Installed Omada Controller"
 

install/pangolin-install.sh

@@ -22,7 +22,7 @@ msg_ok "Installed Dependencies"
 NODE_VERSION="24" setup_nodejs
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="pangolin" PG_DB_USER="pangolin" setup_postgresql_db
-PANGOLIN_VERSION="${PANGOLIN_VERSION:-1.21.0}"
+PANGOLIN_VERSION="${PANGOLIN_VERSION:-1.20.0}"
 fetch_and_deploy_gh_release "pangolin" "fosrl/pangolin" "tarball" "$PANGOLIN_VERSION"
 fetch_and_deploy_gh_release "gerbil" "fosrl/gerbil" "singlefile" "latest" "/usr/bin" "gerbil_linux_$(arch_resolve)"
 fetch_and_deploy_gh_release "traefik" "traefik/traefik" "prebuild" "latest" "/usr/bin" "traefik_v*_linux_$(arch_resolve).tar.gz"

install/romm-install.sh

@@ -134,8 +134,6 @@ else
 fi
 
 fetch_and_deploy_gh_release "romm" "rommapp/romm" "tarball"
-fetch_and_deploy_gh_release "ruffle" "ruffle-rs/ruffle" "prebuild" "latest" "/opt/romm/frontend/dist/assets/ruffle" "ruffle-*-web-selfhosted.zip"
-fetch_and_deploy_gh_release "EmulatorJS" "EmulatorJS/EmulatorJS" "prebuild" "v4.2.3" "/opt/romm/frontend/dist/assets/emulatorjs" "4.2.3.7z"
 
 msg_info "Creating environment file"
 sed -i 's/^supervised no/supervised systemd/' /etc/redis/redis.conf
@@ -161,9 +159,6 @@ ROMM_AUTH_SECRET_KEY=$AUTH_SECRET_KEY
 DISABLE_DOWNLOAD_ENDPOINT_AUTH=false
 DISABLE_CSRF_PROTECTION=false
 
-SCREENSCRAPER_DEV_ID=
-SCREENSCRAPER_DEV_PASSWORD=
-
 ENABLE_RESCAN_ON_FILESYSTEM_CHANGE=true
 RESCAN_ON_FILESYSTEM_CHANGE_DELAY=5
 
@@ -186,18 +181,6 @@ cd /opt/romm/backend
 $STD uv run alembic upgrade head
 msg_ok "Set up RomM Backend"
 
-if [[ -f /opt/romm/backend/utils/rom_patcher/package.json ]]; then
-  msg_info "Building ROM Patcher helper"
-  cd /opt/romm/backend/utils/rom_patcher
-  $STD npm install --ignore-scripts --no-audit --no-fund
-  if [[ -d node_modules/rom-patcher/rom-patcher-js ]]; then
-    rm -rf rom-patcher-js
-    cp -r node_modules/rom-patcher/rom-patcher-js ./rom-patcher-js
-  fi
-  rm -rf node_modules
-  msg_ok "Built ROM Patcher helper"
-fi
-
 msg_info "Setting up RomM Frontend"
 cd /opt/romm/frontend
 $STD npm install

install/trek-install.sh

@@ -3,7 +3,7 @@
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/liketrek/TREK
+# Source: https://github.com/mauriceboe/TREK
 
 source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
 color
@@ -20,7 +20,7 @@ $STD apt install -y \
 msg_ok "Installed Dependencies"
 
 NODE_VERSION="24" setup_nodejs
-fetch_and_deploy_gh_release "trek" "liketrek/TREK" "tarball"
+fetch_and_deploy_gh_release "trek" "mauriceboe/TREK" "tarball"
 
 msg_info "Setup TREK"
 cd /opt/trek
@@ -78,7 +78,7 @@ msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/trek.service
 [Unit]
 Description=TREK Travel Planner
-Documentation=https://github.com/liketrek/TREK
+Documentation=https://github.com/mauriceboe/TREK
 After=network-online.target
 Wants=network-online.target
 

install/vikunja-install.sh

@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os
 
-fetch_and_deploy_gh_release "vikunja" "go-vikunja/vikunja" "binary" "latest" "" "vikunja-*-$(arch_resolve "x86_64" "aarch64").deb"
+fetch_and_deploy_gh_release "vikunja" "go-vikunja/vikunja" "binary"
 
 msg_info "Setting up Vikunja"
 sed -i 's|^# \(service:\)|\1|' /etc/vikunja/config.yml

install/wanderer-install.sh

@@ -21,9 +21,8 @@ else
   fetch_and_deploy_gh_release "meilisearch" "meilisearch/meilisearch" "binary" "latest" "/opt/wanderer/source/search"
 fi
 mkdir -p /opt/wanderer/{source,data/pb_data,data/meili_data,data/plugins}
+[[ -e /data/plugins ]] || ln -sfn /opt/wanderer/data/plugins /data/plugins
 fetch_and_deploy_gh_release "wanderer" "open-wanderer/wanderer" "tarball" "latest" "/opt/wanderer/source"
-mkdir -p /opt/wanderer/source/db/data
-[[ -e /opt/wanderer/source/db/data/plugins ]] || ln -sfn /opt/wanderer/data/plugins /opt/wanderer/source/db/data/plugins
 
 msg_info "Installing wanderer (patience)"
 cd /opt/wanderer/source/db

install/zammad-install.sh

@@ -31,10 +31,7 @@ $STD apt install -y elasticsearch
 sed -i 's/^#\{0,2\} *-Xms[0-9]*g.*/-Xms2g/' /etc/elasticsearch/jvm.options
 sed -i 's/^#\{0,2\} *-Xmx[0-9]*g.*/-Xmx2g/' /etc/elasticsearch/jvm.options
 cat <<EOF >/etc/elasticsearch/elasticsearch.yml
-path.data: /var/lib/elasticsearch
-path.logs: /var/log/elasticsearch
 discovery.type: single-node
-network.host: 127.0.0.1
 xpack.security.enabled: false
 bootstrap.memory_lock: false
 EOF
@@ -43,7 +40,7 @@ systemctl daemon-reload
 systemctl enable -q elasticsearch
 systemctl restart -q elasticsearch
 for i in $(seq 1 30); do
-  if curl -s http://127.0.0.1:9200 >/dev/null 2>&1; then
+  if curl -s http://localhost:9200 >/dev/null 2>&1; then
     break
   fi
   sleep 2
@@ -58,7 +55,7 @@ setup_deb822_repo \
   "$(get_os_info version_id)" \
   "main"
 $STD apt install -y zammad
-$STD zammad run rails r "Setting.set('es_url', 'http://127.0.0.1:9200')"
+$STD zammad run rails r "Setting.set('es_url', 'http://localhost:9200')"
 $STD zammad run rake zammad:searchindex:rebuild
 msg_ok "Installed Zammad"
 

misc/alpine-install.func

@@ -6,10 +6,6 @@
 if ! command -v curl >/dev/null 2>&1; then
   apk update && apk add curl >/dev/null 2>&1
 fi
-# Mark container context BEFORE error handling starts: error_handler/on_exit
-# must write local failure artifacts instead of talking to the telemetry API
-# (the host is the single telemetry reporter).
-export TELEMETRY_CONTEXT="container"
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/core.func)
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/error_handler.func)
 load_functions
@@ -45,7 +41,7 @@ post_progress_to_api() {
 
   curl -fsS -m 5 -X POST "https://telemetry.community-scripts.org/telemetry" \
     -H "Content-Type: application/json" \
-    -d "{\"random_id\":\"${RANDOM_UUID}\",\"execution_id\":\"${EXECUTION_ID:-${RANDOM_UUID}}\",\"type\":\"lxc\",\"nsapp\":\"${app:-unknown}\",\"status\":\"${progress_status}\",\"platform\":\"${TELEMETRY_PLATFORM:-}\",\"repo_source\":\"${REPO_SOURCE:-}\",\"repo_slug\":\"${REPO_SLUG:-}\"}" &>/dev/null || true
+    -d "{\"random_id\":\"${RANDOM_UUID}\",\"execution_id\":\"${EXECUTION_ID:-${RANDOM_UUID}}\",\"type\":\"lxc\",\"nsapp\":\"${app:-unknown}\",\"status\":\"${progress_status}\"}" &>/dev/null || true
 }
 
 # This function enables IPv6 if it's not disabled and sets verbose mode

misc/build.func

@@ -1009,6 +1009,7 @@ base_settings() {
 
   APT_CACHER=${var_apt_cacher:-""}
   APT_CACHER_IP=${var_apt_cacher_ip:-""}
+  INHERIT_HOST_CA="${var_inherit_host_ca:-auto}"
 
   # Runtime check: Verify APT cacher is reachable if configured
   if [[ -n "$APT_CACHER_IP" && "$APT_CACHER" == "yes" ]]; then
@@ -1088,7 +1089,7 @@ load_vars_file() {
 
   # Allowed var_* keys
   local VAR_WHITELIST=(
-    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_keyctl
+    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_inherit_host_ca var_keyctl
     var_gateway var_hostname var_ipv6_method var_mac var_mknod var_mount_fs var_mtu
     var_net var_nesting var_ns var_os var_protection var_pw var_ram var_tags var_timezone var_tun var_unprivileged
     var_verbose var_version var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage var_searchdomain
@@ -1285,6 +1286,12 @@ load_vars_file() {
             continue
           fi
           ;;
+        var_inherit_host_ca)
+          if [[ "$var_val" != "yes" && "$var_val" != "no" && "$var_val" != "auto" ]]; then
+            msg_warn "Invalid host CA inheritance value '$var_val' in $file (must be yes/no/auto), ignoring"
+            continue
+          fi
+          ;;
         var_container_storage | var_template_storage)
           # Validate that the storage exists and is active on the current node
           local _storage_status
@@ -1324,7 +1331,7 @@ default_var_settings() {
   # Allowed var_* keys (alphabetically sorted)
   # Note: Removed var_ctid (can only exist once), var_ipv6_static (static IPs are unique)
   local VAR_WHITELIST=(
-    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_keyctl
+    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_inherit_host_ca var_keyctl
     var_gateway var_hostname var_ipv6_method var_mac var_mknod var_mount_fs var_mtu
     var_net var_nesting var_ns var_os var_protection var_pw var_ram var_tags var_timezone var_tun var_unprivileged
     var_verbose var_version var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage
@@ -1407,6 +1414,7 @@ var_ssh=no
 # HTTP/HTTPS proxy (optional - for networks requiring a proxy)
 # var_http_proxy=http://proxy.local:8080
 # var_http_no_proxy=localhost,127.0.0.1,.local
+# var_inherit_host_ca=auto
 
 # Features/Tags/verbosity
 var_fuse=no
@@ -1507,7 +1515,7 @@ get_app_defaults_path() {
 if ! declare -p VAR_WHITELIST >/dev/null 2>&1; then
   # Note: Removed var_ctid (can only exist once), var_ipv6_static (static IPs are unique)
   declare -ag VAR_WHITELIST=(
-    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_keyctl
+    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_inherit_host_ca var_keyctl
     var_gateway var_hostname var_ipv6_method var_mac var_mknod var_mount_fs var_mtu
     var_net var_nesting var_ns var_os var_protection var_pw var_ram var_tags var_timezone var_tun var_unprivileged
     var_verbose var_version var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage var_searchdomain
@@ -1657,6 +1665,7 @@ _build_current_app_vars_tmp() {
   _apt_cacher_ip="${APT_CACHER_IP:-}"
   _http_proxy="${HTTP_PROXY:-${var_http_proxy:-}}"
   _http_no_proxy="${HTTP_NO_PROXY:-${var_http_no_proxy:-}}"
+  _inherit_host_ca="${INHERIT_HOST_CA:-${var_inherit_host_ca:-auto}}"
   _fuse="${ENABLE_FUSE:-no}"
   _tun="${ENABLE_TUN:-no}"
   _gpu="${ENABLE_GPU:-no}"
@@ -1710,6 +1719,7 @@ _build_current_app_vars_tmp() {
     [ -n "$_apt_cacher_ip" ] && echo "var_apt_cacher_ip=$(_sanitize_value "$_apt_cacher_ip")"
     [ -n "$_http_proxy" ] && echo "var_http_proxy=$(_sanitize_value "$_http_proxy")"
     [ -n "$_http_no_proxy" ] && echo "var_http_no_proxy=$(_sanitize_value "$_http_no_proxy")"
+    [ -n "$_inherit_host_ca" ] && echo "var_inherit_host_ca=$(_sanitize_value "$_inherit_host_ca")"
 
     [ -n "$_fuse" ] && echo "var_fuse=$(_sanitize_value "$_fuse")"
     [ -n "$_tun" ] && echo "var_tun=$(_sanitize_value "$_tun")"
@@ -1874,7 +1884,7 @@ advanced_settings() {
     TAGS="community-script${var_tags:+;${var_tags}}"
   fi
   local STEP=1
-  local MAX_STEP=30
+  local MAX_STEP=31
 
   # Store values for back navigation - inherit from var_* app defaults
   local _ct_type="${var_unprivileged:-1}"
@@ -1896,6 +1906,7 @@ advanced_settings() {
   local _apt_cacher_ip="${var_apt_cacher_ip:-}"
   local _http_proxy="${var_http_proxy:-}"
   local _http_no_proxy="${var_http_no_proxy:-}"
+  local _inherit_host_ca="${var_inherit_host_ca:-auto}"
   local _mtu="${var_mtu:-}"
   local _sd="${var_searchdomain:-}"
   local _ns="${var_ns:-}"
@@ -2725,9 +2736,47 @@ advanced_settings() {
       ;;
 
     # ═══════════════════════════════════════════════════════════════════════════
-    # STEP 25: Container Timezone
+    # STEP 25: Host CA Inheritance
     # ═══════════════════════════════════════════════════════════════════════════
     25)
+      local host_ca_count=0
+      local host_ca_dir="/usr/local/share/ca-certificates"
+      local cert
+      shopt -s nullglob
+      for cert in "$host_ca_dir"/*.crt; do
+        host_ca_count=$((host_ca_count + 1))
+      done
+      shopt -u nullglob
+
+      if [[ $host_ca_count -eq 0 ]]; then
+        _inherit_host_ca="auto"
+        ((STEP++))
+        continue
+      fi
+
+      local host_ca_default_flag=""
+      [[ "$_inherit_host_ca" == "no" ]] && host_ca_default_flag="--defaultno"
+      if whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
+        --title "HOST CA INHERITANCE" \
+        --ok-button "Next" --cancel-button "Back" \
+        $host_ca_default_flag \
+        --yesno "\nInherit host CA certificates into this container?\n\nDetected on host: ${host_ca_count} certificate(s) in:\n${host_ca_dir}\n\nRecommended for private PKI / TLS-inspection environments.\n\n(App default: ${var_inherit_host_ca:-auto})" 16 72; then
+        _inherit_host_ca="yes"
+      else
+        if [ $? -eq 1 ]; then
+          _inherit_host_ca="no"
+        else
+          ((STEP--))
+          continue
+        fi
+      fi
+      ((STEP++))
+      ;;
+
+    # ═══════════════════════════════════════════════════════════════════════════
+    # STEP 26: Container Timezone
+    # ═══════════════════════════════════════════════════════════════════════════
+    26)
       local tz_hint="$_ct_timezone"
       [[ -z "$tz_hint" ]] && tz_hint="(empty - will use host timezone)"
 
@@ -2750,9 +2799,9 @@ advanced_settings() {
       ;;
 
     # ═══════════════════════════════════════════════════════════════════════════
-    # STEP 26: Container Protection
+    # STEP 27: Container Protection
     # ═══════════════════════════════════════════════════════════════════════════
-    26)
+    27)
       local protect_default_flag="--defaultno"
       [[ "$_protect_ct" == "yes" || "$_protect_ct" == "1" ]] && protect_default_flag=""
 
@@ -2774,9 +2823,9 @@ advanced_settings() {
       ;;
 
     # ═══════════════════════════════════════════════════════════════════════════
-    # STEP 27: Device Node Creation (mknod)
+    # STEP 28: Device Node Creation (mknod)
     # ═══════════════════════════════════════════════════════════════════════════
-    27)
+    28)
       local mknod_default_flag="--defaultno"
       [[ "$_enable_mknod" == "1" ]] && mknod_default_flag=""
 
@@ -2798,9 +2847,9 @@ advanced_settings() {
       ;;
 
     # ═══════════════════════════════════════════════════════════════════════════
-    # STEP 28: Mount Filesystems
+    # STEP 29: Mount Filesystems
     # ═══════════════════════════════════════════════════════════════════════════
-    28)
+    29)
       local mount_hint=""
       [[ -n "$_mount_fs" ]] && mount_hint="$_mount_fs" || mount_hint="(none)"
 
@@ -2821,9 +2870,9 @@ advanced_settings() {
       ;;
 
     # ═══════════════════════════════════════════════════════════════════════════
-    # STEP 29: Optional host-side post-install hook (path on the Proxmox HOST)
+    # STEP 30: Optional host-side post-install hook (path on the Proxmox HOST)
     # ═══════════════════════════════════════════════════════════════════════════
-    29)
+    30)
       local _hook_prompt="Optional: absolute path to a *.sh file ON THE PROXMOX HOST.
 
 It runs as root on the HOST (NOT in the LXC) after the container
@@ -2873,9 +2922,9 @@ Leave empty to skip."
       ;;
 
     # ═══════════════════════════════════════════════════════════════════════════
-    # STEP 30: Verbose Mode & Confirmation
+    # STEP 31: Verbose Mode & Confirmation
     # ═══════════════════════════════════════════════════════════════════════════
-    30)
+    31)
       local verbose_default_flag="--defaultno"
       [[ "$_verbose" == "yes" ]] && verbose_default_flag=""
 
@@ -2904,6 +2953,7 @@ Leave empty to skip."
       local apt_display="${_apt_cacher:-no}"
       [[ "$_apt_cacher" == "yes" && -n "$_apt_cacher_ip" ]] && apt_display="$_apt_cacher_ip"
       local http_proxy_display="${_http_proxy:-(none)}"
+      local inherit_ca_display="${_inherit_host_ca:-auto}"
 
       local post_install_display="${_post_install:-(none)}"
       local post_install_warn=""
@@ -2934,6 +2984,7 @@ Advanced:
   Timezone: $tz_display
   APT Cacher: $apt_display
   HTTP Proxy: $http_proxy_display
+  Inherit Host CAs: $inherit_ca_display
   Verbose: $_verbose
   Post-Install Script: ${post_install_display}${post_install_warn}"
 
@@ -2979,6 +3030,7 @@ Advanced:
   APT_CACHER_IP="$_apt_cacher_ip"
   HTTP_PROXY="$_http_proxy"
   HTTP_NO_PROXY="$_http_no_proxy"
+  INHERIT_HOST_CA="$_inherit_host_ca"
   VERBOSE="$_verbose"
   var_post_install="$_post_install"
 
@@ -2997,6 +3049,7 @@ Advanced:
   var_sdn_vnet="$_sdn_vnet"
   var_http_proxy="$_http_proxy"
   var_http_no_proxy="$_http_no_proxy"
+  var_inherit_host_ca="$_inherit_host_ca"
 
   # Format optional values
   [[ -n "$_mtu" ]] && MTU=",mtu=$_mtu" || MTU=""
@@ -3600,9 +3653,9 @@ configure_ssh_settings() {
     glob_path=$(whiptail --backtitle "$backtitle" \
       --inputbox "Enter a folder or glob to scan (e.g. /root/.ssh/*.pub)" 10 72 --title "Scan Folder/Glob" 3>&1 1>&2 2>&3)
     if [[ -n "$glob_path" ]]; then
-      [[ -d "$glob_path" ]] && glob_path="${glob_path%/}/*"
-      local -a _scan_files
-      mapfile -t _scan_files < <(compgen -G "$glob_path")
+      shopt -s nullglob
+      read -r -a _scan_files <<<"$glob_path"
+      shopt -u nullglob
       if [[ "${#_scan_files[@]}" -gt 0 ]]; then
         ssh_build_choices_from_files "${_scan_files[@]}"
         if [[ "$COUNT" -gt 0 ]]; then
@@ -3945,6 +3998,81 @@ EOF
   msg_ok "Applied HTTP proxy in container"
 }
 
+# ------------------------------------------------------------------------------
+# _apply_host_ca_certs_in_container()
+#
+# - Copies administrator-provided CA certificates from the Proxmox host into the
+#   container before base package bootstrap
+# - Source: /usr/local/share/ca-certificates/*.crt (Debian convention)
+# - Refreshes the container trust store when update-ca-certificates is available
+# - No-op when no host certificates are present; failures are non-fatal
+# ------------------------------------------------------------------------------
+_apply_host_ca_certs_in_container() {
+  local host_ca_dir="/usr/local/share/ca-certificates"
+  [[ -z "${CTID:-}" ]] && return 0
+  local inherit_host_ca="${INHERIT_HOST_CA:-${var_inherit_host_ca:-auto}}"
+
+  local -a host_certs=()
+  local cert
+  shopt -s nullglob
+  for cert in "$host_ca_dir"/*.crt; do
+    host_certs+=("$cert")
+  done
+  shopt -u nullglob
+
+  [[ ${#host_certs[@]} -eq 0 ]] && return 0
+
+  case "${inherit_host_ca,,}" in
+  no | false | 0 | off)
+    msg_warn "Skipping host CA inheritance by configuration (${#host_certs[@]} host certificate(s) available)"
+    return 0
+    ;;
+  esac
+
+  msg_info "Inheriting host CA certificates into container"
+
+  local found=${#host_certs[@]}
+  local copied=0
+  local skipped=0
+  local cert_name
+
+  pct exec "$CTID" -- mkdir -p /usr/local/share/ca-certificates >/dev/null 2>&1 || {
+    msg_warn "Failed to create CA certificate directory in container"
+    return 0
+  }
+
+  for cert in "${host_certs[@]}"; do
+    cert_name="$(basename "$cert")"
+    if [[ ! -r "$cert" || "$cert_name" != *.crt ]]; then
+      msg_warn "Skipping invalid or unreadable host CA certificate: ${cert_name}"
+      skipped=$((skipped + 1))
+      continue
+    fi
+
+    if pct push "$CTID" "$cert" "/usr/local/share/ca-certificates/${cert_name}" >/dev/null 2>&1; then
+      pct exec "$CTID" -- chmod 644 "/usr/local/share/ca-certificates/${cert_name}" >/dev/null 2>&1 || true
+      copied=$((copied + 1))
+    else
+      msg_warn "Failed to push host CA certificate: ${cert_name}"
+      skipped=$((skipped + 1))
+    fi
+  done
+
+  if [[ $copied -eq 0 ]]; then
+    msg_warn "No host CA certificates were copied (${found} found, ${skipped} skipped)"
+    return 0
+  fi
+
+  local refresh_shell="bash"
+  [[ "$var_os" == "alpine" ]] && refresh_shell="ash"
+
+  if pct exec "$CTID" -- "$refresh_shell" -c 'command -v update-ca-certificates >/dev/null 2>&1 && update-ca-certificates' >/dev/null 2>&1; then
+    msg_ok "Inherited ${copied} host CA certificate(s) and updated trust store (${skipped} skipped)"
+  else
+    msg_warn "Copied ${copied} host CA certificate(s), but trust store update failed or update-ca-certificates is unavailable (${skipped} skipped)"
+  fi
+}
+
 # ------------------------------------------------------------------------------
 # build_container()
 #
@@ -4072,11 +4200,6 @@ build_container() {
   export RANDOM_UUID="$RANDOM_UUID"
   export EXECUTION_ID="$EXECUTION_ID"
   export SESSION_ID="$SESSION_ID"
-  # Repo attribution + platform for container-side progress pings (the
-  # container inherits the host's detection instead of re-detecting)
-  export REPO_SOURCE="${REPO_SOURCE:-}"
-  export REPO_SLUG="${REPO_SLUG:-}"
-  export TELEMETRY_PLATFORM="pve"
   export CACHER="$APT_CACHER"
   export CACHER_IP="$APT_CACHER_IP"
   if [[ -n "${HTTP_PROXY:-}" ]]; then
@@ -4238,31 +4361,27 @@ $PCT_OPTIONS_STRING"
       return 0
     fi
 
-    # Map each DRI render/card node to its owning GPU via the PCI vendor ID
-    # exposed in sysfs (/sys/class/drm/<node>/device/vendor). This is required
-    # on multi-GPU hosts: globbing every /dev/dri node onto the first detected
-    # vendor would pass through *both* GPUs and skip the selection prompt.
-    if [[ -d /dev/dri ]]; then
-      for d in /dev/dri/renderD* /dev/dri/card*; do
-        [[ -e "$d" ]] || continue
-        local node vendor
-        node=$(basename "$d")
-        vendor=$(cat "/sys/class/drm/${node}/device/vendor" 2>/dev/null || true)
-        case "$vendor" in
-        0x8086) INTEL_DEVICES+=("$d") ;;        # Intel
-        0x1002 | 0x1022) AMD_DEVICES+=("$d") ;; # AMD/ATI
-        0x10de) ;;                              # NVIDIA - handled via /dev/nvidia* below
-        *) msg_debug "Unmapped GPU vendor '${vendor:-unknown}' for $d" ;;
-        esac
-      done
+    # Check for Intel GPU - look for Intel vendor ID [8086]
+    if grep -q "\[8086:" <<<"$pci_vga_info"; then
+      msg_custom "🎮" "${BL}" "Detected Intel GPU"
+      if [[ -d /dev/dri ]]; then
+        for d in /dev/dri/renderD* /dev/dri/card*; do
+          [[ -e "$d" ]] && INTEL_DEVICES+=("$d")
+        done
+      fi
     fi
 
-    [[ ${#INTEL_DEVICES[@]} -gt 0 ]] && msg_custom "🎮" "${BL}" "Detected Intel GPU"
-    [[ ${#AMD_DEVICES[@]} -gt 0 ]] && msg_custom "🎮" "${RD}" "Detected AMD GPU"
-
-    # AMD compute (ROCm) additionally needs /dev/kfd alongside the render nodes
-    if [[ ${#AMD_DEVICES[@]} -gt 0 && -e /dev/kfd ]]; then
-      AMD_DEVICES+=("/dev/kfd")
+    # Check for AMD GPU - look for AMD vendor IDs [1002] (AMD/ATI) or [1022] (AMD)
+    if grep -qE "\[1002:|\[1022:" <<<"$pci_vga_info"; then
+      msg_custom "🎮" "${RD}" "Detected AMD GPU"
+      if [[ -d /dev/dri ]]; then
+        # Only add if not already claimed by Intel
+        if [[ ${#INTEL_DEVICES[@]} -eq 0 ]]; then
+          for d in /dev/dri/renderD* /dev/dri/card* /dev/kfd; do
+            [[ -e "$d" ]] && AMD_DEVICES+=("$d")
+          done
+        fi
+      fi
     fi
 
     # Check for NVIDIA GPU - look for NVIDIA vendor ID [10de]
@@ -4574,6 +4693,7 @@ EOF
   local install_exit_code=0
 
   _apply_http_proxy_in_container
+  _apply_host_ca_certs_in_container
 
   # Continue with standard container setup
   if [ "$var_os" == "alpine" ]; then
@@ -4900,16 +5020,6 @@ EOF
         # Point INSTALL_LOG to combined log so get_full_log() finds it
         INSTALL_LOG="$combined_log"
       fi
-
-      # Pull the structured error capture (.errinfo) from the container.
-      # It contains EXACTLY the output of the command that failed (written by
-      # silent()/error_handler inside the container) and is the primary source
-      # for the telemetry error trace - instead of a generic log tail.
-      local host_errinfo="/tmp/.errinfo-${SESSION_ID}"
-      if timeout 8 pct pull "$CTID" "/root/.install-${SESSION_ID}.log.errinfo" "$host_errinfo" 2>/dev/null && [[ -s "$host_errinfo" ]]; then
-        TELEMETRY_ERRINFO="$host_errinfo"
-        export TELEMETRY_ERRINFO
-      fi
     fi
 
     # Defense-in-depth: Ensure error handling stays disabled during recovery.
@@ -5185,8 +5295,6 @@ EOF
         echo -e "  Verbose: ${GN}enabled${CL}"
         echo ""
         msg_info "Restarting installation..."
-        # New telemetry execution for the retry (previous one keeps its "failed")
-        declare -f telemetry_new_attempt &>/dev/null && telemetry_new_attempt
         # Re-run build_container
         build_container
         return $?
@@ -5226,10 +5334,6 @@ EOF
           echo ""
           msg_info "Re-running installation script..."
 
-          # New telemetry execution for the in-place retry
-          declare -f telemetry_new_attempt &>/dev/null && telemetry_new_attempt
-          declare -f post_to_api &>/dev/null && post_to_api 2>/dev/null || true
-
           # Re-run install script in existing container (don't destroy/recreate)
           set +Eeuo pipefail
           trap - ERR
@@ -5293,7 +5397,6 @@ EOF
           echo -e "  Verbose: ${GN}enabled${CL}"
           echo ""
           msg_info "Restarting installation..."
-          declare -f telemetry_new_attempt &>/dev/null && telemetry_new_attempt
           build_container
           return $?
         fi
@@ -5323,7 +5426,6 @@ EOF
           echo -e "  Verbose: ${GN}enabled${CL}"
           echo ""
           msg_info "Restarting installation..."
-          declare -f telemetry_new_attempt &>/dev/null && telemetry_new_attempt
           build_container
           return $?
         fi
@@ -5348,7 +5450,6 @@ EOF
           echo -e "  Verbose: ${GN}enabled${CL}"
           echo ""
           msg_info "Restarting installation..."
-          declare -f telemetry_new_attempt &>/dev/null && telemetry_new_attempt
           build_container
           return $?
         fi
@@ -7023,16 +7124,6 @@ ensure_log_on_host() {
         rm -f "$temp_log"
       fi
     fi
-    # Also pull the structured error capture (.errinfo) so the telemetry error
-    # trace shows the failing command's exact output (signal-exit paths reach
-    # this via on_exit before/instead of the recovery flow)
-    if [[ -z "${TELEMETRY_ERRINFO:-}" || ! -s "${TELEMETRY_ERRINFO:-}" ]]; then
-      local host_errinfo="/tmp/.errinfo-${SESSION_ID}"
-      if timeout 8 pct pull "$CTID" "/root/.install-${SESSION_ID}.log.errinfo" "$host_errinfo" 2>/dev/null && [[ -s "$host_errinfo" ]]; then
-        TELEMETRY_ERRINFO="$host_errinfo"
-        export TELEMETRY_ERRINFO
-      fi
-    fi
     if [[ -s "$combined_log" ]]; then
       INSTALL_LOG="$combined_log"
     fi