Add temporal (ct)

Warpgate answers 401 on its root, a login wall, and the check failed it
(DevScripts issue 2537). Any answer now counts as the app being up,
except no answer, 404/410, a 5xx or a redirect loop. Same rule for VMs.

.github/workflows/pr-script-test.yml

@@ -657,6 +657,15 @@ jobs:
             // and a log that does not fit loses its beginning: the end is where
             // a failure shows.
             const budget = Math.floor(52000 / rows.length);
+            // A check run summary holds 65535 BYTES, not characters, and log
+            // emoji take 3-4 bytes each. Cut at a character boundary and close
+            // a ~~~~ block left open.
+            const fitBytes = (text, max) => {
+              if (Buffer.byteLength(text) <= max) return text;
+              let cut = Buffer.from(text).subarray(0, max - 300).toString('utf8').replace(/�+$/, '');
+              if ((cut.match(/^~~~~/gm) || []).length % 2) cut += '\n~~~~';
+              return `${cut}\n\n… cut to fit GitHub's size limit; the full report is in the PR comment and the logs in the run artifacts.`;
+            };
             const tail = (text, max) => {
               text = fence(text).trimEnd();
               if (text.length <= max) return text;
@@ -739,7 +748,7 @@ jobs:
                   title: armOnly
                     ? `ARM64 ${armPassed}/${armRows.length} passed (information only)`
                     : `${passed}/${coreRows.length} passed${armRows.length ? ` (+ ARM ${armPassed}/${armRows.length}, not counted)` : ''}`,
-                  summary: summary.slice(0, 65000),
+                  summary: fitBytes(summary, 65000),
                 },
               });
             }

.github/workflows/scripts/pve-run-script.sh

@@ -373,6 +373,20 @@ setup_error() {
   exit 1
 }
 
+# Any answer means the app is up, unless it says it isn't: nothing at all,
+# 404/410 (the printed URL leads nowhere), 5xx (server error, proxy without
+# backend), or a 3xx left after 5 redirects (a loop). 401/403 are a login
+# wall (warpgate answers 401), 400 a quirk of the app: both pass.
+url_ok() { [[ "$1" =~ ^[1-4][0-9][0-9]$ && ! "$1" =~ ^(3[0-9][0-9]|404|410)$ ]]; }
+url_why() {
+  case "$1" in
+  404 | 410) echo "the printed URL leads nowhere" ;;
+  5??) echo "server error" ;;
+  3??) echo "still redirecting after 5 hops" ;;
+  *) echo "the app never answered" ;;
+  esac
+}
+
 # --- Reserve a container ID ---------------------------------------------------
 # A lock file per ID, not just "first free one", because the engine only creates
 # the container minutes later and two jobs would otherwise pick the same ID.
@@ -615,8 +629,8 @@ take_screenshot() {
 }
 
 # Is the app up? No failed services, and the URL the script tells the user to
-# open, e.g. http://${IP}:1337/admin, answers 200 (after redirects, so a jump
-# to /login is fine). A script that prints no URL has no web UI to check.
+# open, e.g. http://${IP}:1337/admin, answers without an error (see url_ok;
+# redirects are followed, so a jump to /login is fine). A script that prints no URL has no web UI to check.
 # Run after the install and again after the update. Sets health_problem.
 app_url() { # the URL the script at $1 tells the user to open
   local pattern
@@ -639,13 +653,13 @@ check_health() {
   local waited
   for ((waited = 0; waited < URL_WAIT; waited += 5)); do
     http_code=$(curl -sk -L --max-redirs 5 -o /dev/null -w '%{http_code}' --max-time 10 "$url" || true)
-    [[ "$http_code" =~ ^2[0-9][0-9]$ ]] && break
+    url_ok "$http_code" && break
     sleep 5
   done
   # Also when the check fails: an error page explains more than a status code.
   [[ "$http_code" =~ ^[1-5][0-9][0-9]$ ]] && take_screenshot "$1"
-  [[ "$http_code" =~ ^2[0-9][0-9]$ ]] ||
-    { health_problem="${url} answered ${http_code/#000/nothing} instead of 200 within ${URL_WAIT}s"; return 1; }
+  url_ok "$http_code" ||
+    { health_problem="${url} answered ${http_code/#000/nothing} within ${URL_WAIT}s ($(url_why "$http_code"))"; return 1; }
 }
 
 check_health screenshot.png || fail "$health_problem"
@@ -654,10 +668,10 @@ check_health screenshot.png || fail "$health_problem"
 # A fresh install is already on the latest release, so a plain `update` would
 # only say "No update available" and never run update_script's real path. The
 # version files the install wrote (~/.<app>, one per fetch_and_deploy_gh_release)
-# that update_script checks are set back to 0.0.0-ci first; check_for_gh_release then sees an update and
-# runs it all. Apps deployed from a branch (fetch_and_deploy_gh_branch, checked
-# with check_for_gh_branch) store a commit hash instead of a version; the
-# engine compares both as plain strings, so 0.0.0-ci works for them too. `update` is the /usr/bin/update the install generated: it pulls
+# that update_script checks are set back first (see below); check_for_gh_release
+# then sees an update and runs it all. Apps deployed from a branch
+# (fetch_and_deploy_gh_branch, checked with check_for_gh_branch) store a commit
+# hash instead of a version. `update` is the /usr/bin/update the install generated: it pulls
 # ct/<app>.sh from the URL this container was built from, i.e. the PR's tree.
 UPDATE_FAKE="0.0.0-ci"
 update_fail() {
@@ -681,11 +695,23 @@ tracked=$(grep -oE 'check_for_[a-z]*_?release[[:space:]]+("[^"]*"|[^[:space:]]+)
 if [[ -n "$tracked" && "$tracked" != *'$'* ]]; then
   version_files=$(grep -xF -f <(sed 's|^|/root/.|' <<<"$tracked") <<<"$version_files" || true)
 fi
+# A version keeps its digits and gets "-dev" (6.7.16.0 -> 6.7.16.0-dev): the
+# engine ranks that below the release, so the update runs, and an
+# update_script that reads the installed series (shopware: composer
+# "~6.7.0" from ~/.shopware) still gets the real one. 0.0.0-ci broke that.
+# A commit hash (or a bare number) has no series and gets 0.0.0-ci.
+declare -A update_fake=()
 for f in $version_files; do
-  guest_exec sh -c "echo '$UPDATE_FAKE' > '$f'; rm -f '$f.pending'" ||
+  cur=$(guest_exec cat "$f" 2>/dev/null | tr -d '\r\n')
+  if [[ "$cur" =~ ^v?[0-9]+(\.[0-9A-Za-z_+-]+)+$ ]]; then
+    update_fake[$f]="${cur}-dev"
+  else
+    update_fake[$f]="$UPDATE_FAKE"
+  fi
+  guest_exec sh -c "echo '${update_fake[$f]}' > '$f'; rm -f '$f.pending'" ||
     update_fail "could not reset $f"
+  echo "Update test: set back $f from ${cur} to ${update_fake[$f]}"
 done
-[[ -n "$version_files" ]] && echo "Update test: set back $(tr '\n' ' ' <<<"$version_files")to ${UPDATE_FAKE}"
 
 phase="update"
 # Upgrade test: the container pulls its update from where it was installed
@@ -746,8 +772,8 @@ fi
 if strip_ansi <"$UPDATE_RAW" | grep -qi 'updated successfully'; then
   update_status="updated"
   for f in $version_files; do
-    [[ "$(guest_exec cat "$f" 2>/dev/null)" != "$UPDATE_FAKE" ]] ||
-      update_fail "reported success, but $f is still ${UPDATE_FAKE}"
+    [[ "$(guest_exec cat "$f" 2>/dev/null)" != "${update_fake[$f]}" ]] ||
+      update_fail "reported success, but $f is still ${update_fake[$f]}"
   done
 else
   # Ran cleanly without updating anything: no version file to fake (apt/npm

.github/workflows/scripts/pve-run-vm.sh

@@ -121,7 +121,7 @@ vm_build_and_check() {
     for ((waited = 0; waited < VM_URL_WAIT; waited += 10)); do
       vm_running || fail "VM ${ctid} stopped by itself while its web UI was awaited"
       http_code=$(curl -sk -L --max-redirs 5 -o /dev/null -w '%{http_code}' --max-time 10 "$url" || true)
-      [[ "$http_code" =~ ^2[0-9][0-9]$ ]] && break
+      url_ok "$http_code" && break
       sleep 10
     done
     [[ "$http_code" =~ ^[1-5][0-9][0-9]$ ]] && take_screenshot screenshot.png
@@ -130,8 +130,8 @@ vm_build_and_check() {
     sleep 20
   fi
   [[ -s "$OUT_DIR/screenshot.png" ]] || vm_console_shot
-  if [[ -n "$url" && ! "$http_code" =~ ^2[0-9][0-9]$ ]]; then
-    fail "${url} answered ${http_code/#000/nothing} instead of 200 within ${VM_URL_WAIT}s"
+  if [[ -n "$url" ]] && ! url_ok "$http_code"; then
+    fail "${url} answered ${http_code/#000/nothing} within ${VM_URL_WAIT}s"
   fi
   vm_running || fail "VM ${ctid} stopped by itself"
 

CHANGELOG.md

@@ -581,6 +581,15 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-11-13
+
+### 💾 Core
+
+  - fetch the install script before the container is created [@MickLesk](https://github.com/MickLesk) ([core#236](https://github.com/community-scripts/core/pull/236))
+- Download a corrupt local template again instead of keeping it [@MickLesk](https://github.com/MickLesk) ([core#235](https://github.com/community-scripts/core/pull/235))
+- core: say why a container stopped by itself during its setup [@MickLesk](https://github.com/MickLesk) ([core#234](https://github.com/community-scripts/core/pull/234))
+- Shield pct start and the template check from a closed console [@MickLesk](https://github.com/MickLesk) ([core#239](https://github.com/community-scripts/core/pull/239))
+
 ## 2026-11-12
 
 ### 🆕 New Scripts
@@ -591,6 +600,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
+    - OnlyOffice: change ct port to 8083 [@MickLesk](https://github.com/MickLesk) ([#18642](https://github.com/community-scripts/ProxmoxVE/pull/18642))
     - dotnetaspwebapi: start the service only once an app is deployed [@MickLesk](https://github.com/MickLesk) ([#18639](https://github.com/community-scripts/ProxmoxVE/pull/18639))
     - Whisparr-eros: set the first login and save it [@MickLesk](https://github.com/MickLesk) ([#18617](https://github.com/community-scripts/ProxmoxVE/pull/18617))
 
@@ -598,6 +608,18 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
     - Updated ASP.NET Web App script to Debian and adds a .Net selection [@kris701](https://github.com/kris701) ([#18628](https://github.com/community-scripts/ProxmoxVE/pull/18628))
 
+### 💾 Core
+
+  - github: bump workflow actions to their current majors [@MickLesk](https://github.com/MickLesk) ([core#240](https://github.com/community-scripts/core/pull/240))
+- Say what the host sees when a container gets no address [@MickLesk](https://github.com/MickLesk) ([core#230](https://github.com/community-scripts/core/pull/230))
+- Fall back to public DNS for Alpine containers too [@MickLesk](https://github.com/MickLesk) ([core#231](https://github.com/community-scripts/core/pull/231))
+- Do not fail a finished install over the monitoring service [@MickLesk](https://github.com/MickLesk) ([core#232](https://github.com/community-scripts/core/pull/232))
+- Deploy a release by moving it, and stop on a full disk² [@MickLesk](https://github.com/MickLesk) ([core#233](https://github.com/community-scripts/core/pull/233))
+- core: say when pct create fails because timedatectl does not answer [@MickLesk](https://github.com/MickLesk) ([core#237](https://github.com/community-scripts/core/pull/237))
+- ref: stop calling every exit 255 a dpkg error [@MickLesk](https://github.com/MickLesk) ([core#238](https://github.com/community-scripts/core/pull/238))
+- Write uv's shell completions without STD [@MickLesk](https://github.com/MickLesk) ([core#241](https://github.com/community-scripts/core/pull/241))
+- Generate database passwords with random_password / Keep the database helpers' credentials files private [@MickLesk](https://github.com/MickLesk) ([core#242](https://github.com/community-scripts/core/pull/242))
+
 ### 📚 Documentation
 
   - github: bump workflow actions to their current majors [@MickLesk](https://github.com/MickLesk) ([#18637](https://github.com/community-scripts/ProxmoxVE/pull/18637))

ct/onlyoffice.sh

@@ -52,4 +52,4 @@ description
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8083${CL}"

ct/temporal.sh

@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Renan Bastos (renanbastos93)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/temporalio/temporal
+
+APP="Temporal"
+var_tags="${var_tags:-workflow;automation}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-no}" # unset = ask the user; server, UI and CLI all ship linux_arm64 assets, but not yet run on arm64
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/temporal ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "temporal" "temporalio/temporal"; then
+    msg_info "Stopping Temporal"
+    systemctl stop temporal-ui temporal
+    msg_ok "Stopped Temporal"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "temporal" "temporalio/temporal" "prebuild" "latest" "/opt/temporal" "temporal_*_linux_$(arch_resolve).tar.gz"
+
+    msg_info "Migrating Temporal Database"
+    set -a && source /etc/temporal/temporal.env && set +a
+    $STD /opt/temporal/temporal-sql-tool --db temporal update-schema --schema-name postgresql/v12/temporal
+    $STD /opt/temporal/temporal-sql-tool --db temporal_visibility update-schema --schema-name postgresql/v12/visibility
+    msg_ok "Migrated Temporal Database"
+
+    msg_info "Starting Temporal"
+    systemctl start temporal temporal-ui
+    msg_ok "Started Temporal"
+    msg_ok "Updated Temporal successfully!"
+  fi
+
+  if check_for_gh_release "temporal-ui" "temporalio/ui-server"; then
+    msg_info "Stopping Temporal UI"
+    systemctl stop temporal-ui
+    msg_ok "Stopped Temporal UI"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "temporal-ui" "temporalio/ui-server" "prebuild" "latest" "/opt/temporal-ui" "ui-server_*_linux_$(arch_resolve).tar.gz"
+
+    msg_info "Starting Temporal UI"
+    systemctl start temporal-ui
+    msg_ok "Started Temporal UI"
+    msg_ok "Updated Temporal UI successfully!"
+  fi
+
+  if check_for_gh_release "temporal-cli" "temporalio/cli"; then
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "temporal-cli" "temporalio/cli" "prebuild" "latest" "/opt/temporal-cli" "temporal_cli_*_linux_$(arch_resolve).tar.gz"
+    msg_ok "Updated Temporal CLI successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8080${CL}"
+echo -e "${INFO}${YW}gRPC endpoint for workers and SDKs: ${IP}:7233${CL}"

install/temporal-install.sh

@@ -0,0 +1,206 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Renan Bastos (renanbastos93)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/temporalio/temporal
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+PG_VERSION="17" setup_postgresql
+PG_DB_NAME="temporal" PG_DB_USER="temporal" PG_DB_SCHEMA_PERMS="true" setup_postgresql_db
+
+fetch_and_deploy_gh_release "temporal" "temporalio/temporal" "prebuild" "latest" "/opt/temporal" "temporal_*_linux_$(arch_resolve).tar.gz"
+fetch_and_deploy_gh_release "temporal-ui" "temporalio/ui-server" "prebuild" "latest" "/opt/temporal-ui" "ui-server_*_linux_$(arch_resolve).tar.gz"
+fetch_and_deploy_gh_release "temporal-cli" "temporalio/cli" "prebuild" "latest" "/opt/temporal-cli" "temporal_cli_*_linux_$(arch_resolve).tar.gz"
+
+msg_info "Configuring Temporal"
+mkdir -p /etc/temporal/config/dynamicconfig /etc/temporal/ui
+ln -sf /opt/temporal-cli/temporal /usr/bin/temporal
+cat <<EOF >/etc/temporal/temporal.env
+SQL_PLUGIN=postgres12
+SQL_HOST=127.0.0.1
+SQL_PORT=5432
+SQL_USER=temporal
+SQL_PASSWORD=${PG_DB_PASS}
+EOF
+chmod 600 /etc/temporal/temporal.env
+cat <<'EOF' >/etc/temporal/config/production.yaml
+# enable-template
+log:
+  stdout: true
+  level: info
+
+persistence:
+  defaultStore: postgres-default
+  visibilityStore: postgres-visibility
+  numHistoryShards: 4
+  datastores:
+    postgres-default:
+      sql:
+        pluginName: {{ env "SQL_PLUGIN" | quote }}
+        databaseName: "temporal"
+        connectAddr: {{ printf "%s:%s" (env "SQL_HOST") (env "SQL_PORT") | quote }}
+        connectProtocol: "tcp"
+        user: {{ env "SQL_USER" | quote }}
+        password: {{ env "SQL_PASSWORD" | quote }}
+        maxConns: 20
+        maxIdleConns: 20
+        maxConnLifetime: "1h"
+    postgres-visibility:
+      sql:
+        pluginName: {{ env "SQL_PLUGIN" | quote }}
+        databaseName: "temporal_visibility"
+        connectAddr: {{ printf "%s:%s" (env "SQL_HOST") (env "SQL_PORT") | quote }}
+        connectProtocol: "tcp"
+        user: {{ env "SQL_USER" | quote }}
+        password: {{ env "SQL_PASSWORD" | quote }}
+        maxConns: 10
+        maxIdleConns: 10
+        maxConnLifetime: "1h"
+
+global:
+  membership:
+    maxJoinDuration: 30s
+    broadcastAddress: "127.0.0.1"
+
+services:
+  frontend:
+    rpc:
+      grpcPort: 7233
+      membershipPort: 6933
+      bindOnIP: "0.0.0.0"
+
+  matching:
+    rpc:
+      grpcPort: 7235
+      membershipPort: 6935
+      bindOnLocalHost: true
+
+  history:
+    rpc:
+      grpcPort: 7234
+      membershipPort: 6934
+      bindOnLocalHost: true
+
+  worker:
+    rpc:
+      grpcPort: 7239
+      membershipPort: 6939
+      bindOnLocalHost: true
+
+clusterMetadata:
+  enableGlobalNamespace: false
+  failoverVersionIncrement: 10
+  masterClusterName: "active"
+  currentClusterName: "active"
+  clusterInformation:
+    active:
+      enabled: true
+      initialFailoverVersion: 1
+      rpcName: "frontend"
+      rpcAddress: "127.0.0.1:7233"
+
+dcRedirectionPolicy:
+  policy: "noop"
+
+archival:
+  history:
+    state: "disabled"
+  visibility:
+    state: "disabled"
+
+namespaceDefaults:
+  archival:
+    history:
+      state: "disabled"
+    visibility:
+      state: "disabled"
+
+dynamicConfigClient:
+  filepath: "/etc/temporal/config/dynamicconfig/production.yaml"
+  pollInterval: "60s"
+EOF
+cat <<EOF >/etc/temporal/config/dynamicconfig/production.yaml
+limit.maxIDLength:
+  - value: 255
+    constraints: {}
+EOF
+cat <<EOF >/etc/temporal/ui/production.yaml
+temporalGrpcAddress: 127.0.0.1:7233
+port: 8080
+enableUi: true
+defaultNamespace: default
+cors:
+  cookieInsecure: true
+  allowOrigins:
+    - http://${LOCAL_IP}:8080
+EOF
+msg_ok "Configured Temporal"
+
+msg_info "Initializing Temporal Database"
+set -a && source /etc/temporal/temporal.env && set +a
+$STD /opt/temporal/temporal-sql-tool --db temporal_visibility create-database
+$STD /opt/temporal/temporal-sql-tool --db temporal setup-schema -v 0.0
+$STD /opt/temporal/temporal-sql-tool --db temporal update-schema --schema-name postgresql/v12/temporal
+$STD /opt/temporal/temporal-sql-tool --db temporal_visibility setup-schema -v 0.0
+$STD /opt/temporal/temporal-sql-tool --db temporal_visibility update-schema --schema-name postgresql/v12/visibility
+msg_ok "Initialized Temporal Database"
+
+msg_info "Creating Services"
+cat <<EOF >/etc/systemd/system/temporal.service
+[Unit]
+Description=Temporal Server
+After=network.target postgresql.service
+Requires=postgresql.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/temporal
+EnvironmentFile=/etc/temporal/temporal.env
+ExecStart=/opt/temporal/temporal-server --root /etc/temporal --env production --allow-no-auth start
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+cat <<EOF >/etc/systemd/system/temporal-ui.service
+[Unit]
+Description=Temporal UI
+After=network.target temporal.service
+Wants=temporal.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/temporal-ui
+ExecStart=/opt/temporal-ui/ui-server --root /etc/temporal --config ui --env production start
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now temporal temporal-ui
+msg_ok "Created Services"
+
+msg_info "Creating Default Namespace"
+for _ in {1..60}; do
+  temporal operator cluster health &>/dev/null && break
+  sleep 1
+done
+$STD temporal operator namespace create --namespace default
+msg_ok "Created Default Namespace"
+
+motd_ssh
+customize
+cleanup_lxc