Compare commits

..

1 Commits

Author SHA1 Message Date
MickLesk 5f375d7b30 Preserve default mongod.conf when configuring Anytype replica set
Overwriting /etc/mongod.conf with only the replication block wiped
out storage.dbPath from the mongodb-org package default, so mongod
fell back to its compiled-in /data/db path, which was never created.
Append the replication section instead of replacing the file.
2026-07-21 22:52:14 +02:00
7 changed files with 26 additions and 216 deletions
-20
View File
@@ -505,26 +505,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
</details>
## 2026-07-22
### 🚀 Updated Scripts
- #### 🐞 Bug Fixes
- InvoiceNinja: preserve and Re-download snappdf Chromium [@MickLesk](https://github.com/MickLesk) ([#15956](https://github.com/community-scripts/ProxmoxVE/pull/15956))
- Anytype: preserve default mongod.conf when configuring Anytype replica set [@MickLesk](https://github.com/MickLesk) ([#15954](https://github.com/community-scripts/ProxmoxVE/pull/15954))
- Nametag: fix missing tailwindcss module [@MickLesk](https://github.com/MickLesk) ([#15955](https://github.com/community-scripts/ProxmoxVE/pull/15955))
- #### ✨ New Features
- OPNSense: Bump FreeBSD to 15 and OPNSense to 26.7 [@MickLesk](https://github.com/MickLesk) ([#15943](https://github.com/community-scripts/ProxmoxVE/pull/15943))
### 💾 Core
- #### ✨ New Features
- core: add OS mismatch guard for container updates [@MickLesk](https://github.com/MickLesk) ([#15948](https://github.com/community-scripts/ProxmoxVE/pull/15948))
## 2026-07-21
### 🚀 Updated Scripts
+1 -7
View File
@@ -35,18 +35,12 @@ function update_script() {
systemctl stop supervisor nginx php8.4-fpm
msg_ok "Stopped Services"
create_backup /opt/invoiceninja/.env /opt/invoiceninja/storage /opt/invoiceninja/public/storage /opt/invoiceninja/vendor/beganovich/snappdf/versions
create_backup /opt/invoiceninja/.env /opt/invoiceninja/storage /opt/invoiceninja/public/storage
CLEAN_INSTALL=1 fetch_and_deploy_gh_release "invoiceninja" "invoiceninja/invoiceninja" "prebuild" "latest" "/opt/invoiceninja" "invoiceninja.tar.gz"
restore_backup
msg_info "Verifying Chromium for PDF Generation"
cd /opt/invoiceninja
$STD ./vendor/bin/snappdf download
chown -R www-data:www-data /opt/invoiceninja/vendor/beganovich/snappdf/versions
msg_ok "Verified Chromium for PDF Generation"
msg_info "Running Migrations"
cd /opt/invoiceninja
$STD php artisan migrate --force
+1 -1
View File
@@ -43,7 +43,7 @@ function update_script() {
msg_info "Rebuilding Application"
cd /opt/nametag
$STD npm ci --include=dev
$STD npm ci
set -a
source /opt/nametag/.env
set +a
+1 -1
View File
@@ -20,7 +20,7 @@ fetch_and_deploy_gh_release "nametag" "mattogodoy/nametag" "tarball" "latest" "/
msg_info "Setting up Application"
cd /opt/nametag
$STD npm ci --include=dev
$STD npm ci
DATABASE_URL="postgresql://${PG_DB_USER}:${PG_DB_PASS}@127.0.0.1:5432/${PG_DB_NAME}" $STD npx prisma generate
DATABASE_URL="postgresql://${PG_DB_USER}:${PG_DB_PASS}@127.0.0.1:5432/${PG_DB_NAME}" $STD npx prisma migrate deploy
msg_ok "Set up Application"
+2 -87
View File
@@ -3831,78 +3831,6 @@ runtime_script_status_guard() {
return 0
}
# ------------------------------------------------------------------------------
# check_container_os_guard()
#
# - Compares the container OS (/etc/os-release) with the script's recommended
# var_os/var_version before running update_script
# - On mismatch: interactive runs ask whether to continue (default: no);
# headless runs (PHS_SILENT=1 / no tty) abort instead of updating on an
# unsupported base and leaving the app broken mid-update
# - Bypass via var_ignore_os_mismatch=1|yes|true|on (still warns, but continues)
# ------------------------------------------------------------------------------
check_container_os_guard() {
local rec_os="${var_os:-}" rec_ver="${var_version:-}"
rec_os="${rec_os,,}"
[[ -z "$rec_os" || -z "$rec_ver" ]] && return 0
[[ -r /etc/os-release ]] || return 0
local cur_os cur_ver
cur_os="$(. /etc/os-release 2>/dev/null; echo "${ID:-}")"
cur_ver="$(. /etc/os-release 2>/dev/null; echo "${VERSION_ID:-}")"
cur_os="${cur_os,,}"
[[ -z "$cur_os" || -z "$cur_ver" ]] && return 0
# Exact version or prefix on a dot boundary (e.g. alpine 3.22 matches 3.22.1)
if [[ "$cur_os" == "$rec_os" ]] && [[ "$cur_ver" == "$rec_ver" || "$cur_ver" == "$rec_ver".* ]]; then
return 0
fi
case "${var_ignore_os_mismatch:-}" in
1 | yes | true | on)
msg_warn "Container OS is ${cur_os} ${cur_ver} but the script recommends ${rec_os} ${rec_ver} — continuing via var_ignore_os_mismatch (may break, no support)."
return 0
;;
esac
# Persistent opt-out: stores the ignored target version, so the question
# comes back once the script targets a newer OS again
local ignore_file="/usr/local/community-scripts/ignore-os-mismatch"
if [[ -f "$ignore_file" && "$(cat "$ignore_file" 2>/dev/null)" == "${rec_os} ${rec_ver}" ]]; then
msg_warn "Container OS is ${cur_os} ${cur_ver} but the script recommends ${rec_os} ${rec_ver} — continuing (previously ignored via ${ignore_file}, may break, no support)."
return 0
fi
if [[ "${PHS_SILENT:-0}" != "1" ]] && command -v whiptail &>/dev/null && [ -t 0 ] && [[ "$TERM" != "dumb" ]]; then
local choice
choice=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "OS VERSION MISMATCH" --menu \
"This container runs ${cur_os} ${cur_ver}, but this script now targets ${rec_os} ${rec_ver}.\n\nUpdating on the older base OS may fail or leave ${APP:-the application} broken (e.g. required runtime versions are not available).\n\nRecommended: upgrade the container OS to ${rec_os} ${rec_ver} first, then run this update again.\n\nIf you continue anyway, it may break — no support is provided in that case.\n\nContinue anyway?" \
20 70 3 \
"1" "No (cancel update)" \
"2" "Yes (continue this time)" \
"3" "Yes (continue and don't ask again)" \
--nocancel --default-item "1" 3>&1 1>&2 2>&3)
case "$choice" in
2)
msg_warn "Continuing update on ${cur_os} ${cur_ver} despite recommended ${rec_os} ${rec_ver} — may break, no support."
return 0
;;
3)
mkdir -p "${ignore_file%/*}"
echo "${rec_os} ${rec_ver}" >"$ignore_file"
msg_warn "Continuing update on ${cur_os} ${cur_ver}; OS check for ${rec_os} ${rec_ver} disabled via ${ignore_file} — may break, no support."
return 0
;;
esac
msg_error "Update cancelled: container OS ${cur_os} ${cur_ver} does not match the recommended ${rec_os} ${rec_ver}."
return 1
fi
msg_error "Container OS ${cur_os} ${cur_ver} does not match the recommended ${rec_os} ${rec_ver} — skipping update."
msg_error "Upgrade the container OS to ${rec_os} ${rec_ver} first, then run this update again — or bypass this check (may break, no support) with: echo \"${rec_os} ${rec_ver}\" > ${ignore_file}"
return 1
}
# ------------------------------------------------------------------------------
# start()
#
@@ -3924,7 +3852,6 @@ start() {
ensure_profile_loaded
get_lxc_ip
runtime_script_status_guard update || return 0
check_container_os_guard || return 0
update_script
run_addon_updates
update_motd_ip
@@ -3936,7 +3863,6 @@ start() {
ensure_profile_loaded
get_lxc_ip
runtime_script_status_guard update || return 0
check_container_os_guard || return 0
update_script
run_addon_updates
update_motd_ip
@@ -3967,7 +3893,6 @@ start() {
ensure_profile_loaded
get_lxc_ip
runtime_script_status_guard update || return 0
check_container_os_guard || return 0
update_script
run_addon_updates
update_motd_ip
@@ -5215,10 +5140,7 @@ EOF
echo -en "${YW}Select option [1-${max_option}] (default: 1, auto-remove in 60s): ${CL}"
local response=""
local read_rc
read -t 60 -r response
read_rc=$?
if [[ $read_rc -eq 0 ]]; then
if read -t 60 -r response; then
case "${response:-1}" in
1)
# Remove container
@@ -5437,20 +5359,13 @@ EOF
fi
;;
esac
elif [[ $read_rc -gt 128 ]]; then
else
# Timeout - auto-remove
echo ""
msg_info "No response - removing container ${CTID}"
pct stop "$CTID" &>/dev/null || true
pct destroy "$CTID" &>/dev/null || true
msg_ok "Container ${CTID} removed"
else
# read itself failed (e.g. broken/closed stdin, I/O error) rather than
# timing out - don't guess and destroy the container on a read we
# couldn't actually capture; keep it since that's the reversible choice.
echo ""
msg_error "Could not read your response (stdin error) - keeping container ${CTID} for safety."
msg_error "Remove it manually if not needed: pct destroy ${CTID}"
fi
# Force one final status update attempt after cleanup
+2 -17
View File
@@ -497,10 +497,7 @@ error_handler() {
fi
local response=""
local read_rc
read -t 60 -r response
read_rc=$?
if [[ $read_rc -eq 0 ]]; then
if read -t 60 -r response; then
if [[ -z "$response" || "$response" =~ ^[Yy]$ ]]; then
echo ""
if declare -f msg_info >/dev/null 2>&1; then
@@ -523,7 +520,7 @@ error_handler() {
echo -e "${YW}Container ${CTID} kept for debugging${CL}"
fi
fi
elif [[ $read_rc -gt 128 ]]; then
else
# Timeout - auto-remove
echo ""
if declare -f msg_info >/dev/null 2>&1; then
@@ -538,18 +535,6 @@ error_handler() {
else
echo -e "${GN}${CL} Container ${CTID} removed"
fi
else
# read itself failed (e.g. broken/closed stdin, I/O error) rather than
# timing out - don't guess and destroy the container on a read we
# couldn't actually capture; keep it since that's the reversible choice.
echo ""
if declare -f msg_error >/dev/null 2>&1; then
msg_error "Could not read your response (stdin error) - keeping container ${CTID} for safety."
msg_error "Remove it manually if not needed: pct destroy ${CTID}"
else
echo -e "${YW}Could not read your response (stdin error) - keeping container ${CTID} for safety.${CL}"
echo -e "${YW}Remove it manually if not needed: pct destroy ${CTID}${CL}"
fi
fi
fi
fi
+19 -83
View File
@@ -25,7 +25,6 @@ METHOD=""
NSAPP="opnsense-vm"
var_os="opnsense"
var_version="26.7"
FREEBSD_MAJOR="15"
#
GEN_MAC=02:$(openssl rand -hex 5 | awk '{print toupper($0)}' | sed 's/\(..\)/\1:/g; s/.$//')
GEN_MAC_LAN=02:$(openssl rand -hex 5 | awk '{print toupper($0)}' | sed 's/\(..\)/\1:/g; s/.$//')
@@ -491,7 +490,7 @@ function advanced_settings() {
fi
echo -e "${DGN}Using LAN GATEWAY ADDRESS: ${BGN}$LAN_GW${CL}"
fi
if NETMASK=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a LAN netmask (24 for example)" 8 58 $NETMASK --title "LAN NETMASK" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
if NETMASK=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a LAN netmmask (24 for example)" 8 58 $NETMASK --title "LAN NETMASK" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
if [ -z $NETMASK ]; then
echo -e "${DGN}Netmask needs to be set if ip is not dhcp${CL}"
fi
@@ -559,7 +558,7 @@ function advanced_settings() {
else
exit-script
fi
if WAN_NETMASK=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a WAN netmask (24 for example)" 8 58 $WAN_NETMASK --title "WAN NETMASK" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
if WAN_NETMASK=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a WAN netmmask (24 for example)" 8 58 $WAN_NETMASK --title "WAN NETMASK" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
if [ -z $WAN_NETMASK ]; then
echo -e "${DGN}WAN Netmask needs to be set if ip is not dhcp${CL}"
fi
@@ -575,7 +574,7 @@ function advanced_settings() {
else
exit-script
fi
if MAC1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a LAN MAC Address" 8 58 $GEN_MAC --title "LAN MAC ADDRESS" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
if MAC1=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a WAN MAC Address" 8 58 $GEN_MAC --title "WAN MAC ADDRESS" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
if [ -z $MAC1 ]; then
MAC="$GEN_MAC"
else
@@ -586,7 +585,7 @@ function advanced_settings() {
exit-script
fi
if MAC2=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a WAN MAC Address" 8 58 $GEN_MAC_LAN --title "WAN MAC ADDRESS" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
if MAC2=$(whiptail --backtitle "Proxmox VE Helper Scripts" --inputbox "Set a LAN MAC Address" 8 58 $GEN_MAC_LAN --title "LAN MAC ADDRESS" --cancel-button Exit-Script 3>&1 1>&2 2>&3); then
if [ -z $MAC2 ]; then
WAN_MAC="$GEN_MAC_LAN"
else
@@ -653,26 +652,23 @@ fi
msg_ok "Using ${CL}${BL}$STORAGE${CL} ${GN}for Storage Location."
msg_ok "Virtual Machine ID is ${CL}${BL}$VMID${CL}."
msg_info "Retrieving the URL for the OPNsense Qcow2 Disk Image"
# Use latest stable FreeBSD amd64 qcow2 VM image matching FREEBSD_MAJOR
# Use latest stable FreeBSD amd64 qcow2 VM image (generic, not UFS/ZFS)
RELEASE_LIST="$(curl -s https://download.freebsd.org/releases/VM-IMAGES/ |
grep -Eo "${FREEBSD_MAJOR}\.[0-9]+-RELEASE" |
grep -Eo '[0-9]+\.[0-9]+-RELEASE' |
sort -Vr |
uniq)"
URL=""
FREEBSD_VER=""
for ver in $RELEASE_LIST; do
# FreeBSD 15+ publishes separate -ufs/-zfs images instead of a generic one
for variant in "" "-ufs" "-zfs"; do
candidate="https://download.freebsd.org/releases/VM-IMAGES/${ver}/amd64/Latest/FreeBSD-${ver}-amd64${variant}.qcow2.xz"
if curl -fsI "$candidate" >/dev/null 2>&1; then
FREEBSD_VER="$ver"
URL="$candidate"
break 2
fi
done
candidate="https://download.freebsd.org/releases/VM-IMAGES/${ver}/amd64/Latest/FreeBSD-${ver}-amd64.qcow2.xz"
if curl -fsI "$candidate" >/dev/null 2>&1; then
FREEBSD_VER="$ver"
URL="$candidate"
break
fi
done
if [ -z "$URL" ]; then
msg_error "Could not find a FreeBSD ${FREEBSD_MAJOR}.x amd64 qcow2 image."
msg_error "Could not find generic FreeBSD amd64 qcow2 image (non-UFS/ZFS)."
exit 115
fi
msg_ok "Download URL: ${CL}${BL}${URL}${CL}"
@@ -772,7 +768,7 @@ DESCRIPTION=$(
cat <<EOF
<div align='center'>
<a href='https://community-scripts.org' target='_blank' rel='noopener noreferrer'>
<img src='https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/images/logo-81x112.png' alt='Logo' style='width:81px;height:112px;'/>
<img src='https://raw.githubusercontent.com/michelroegl-brunner/ProxmoxVE/refs/heads/develop/misc/images/logo-81x112.png' alt='Logo' style='width:81px;height:112px;'/>
</a>
<h2 style='font-size: 24px; margin: 20px 0;'>OPNsense VM</h2>
@@ -818,70 +814,10 @@ if [ -n "$WAN_BRG" ]; then
msg_ok "WAN interface added"
sleep 5 # Brief pause after adding network interface
fi
# FreeBSD 15+ VM images ship the base system as pkgbase packages; the bootstrap's
# "delete all packages" step would remove the running base system (/bin/rm etc.)
# and brick the VM. Deregister them from the pkg db first - the files stay in
# place and OPNsense replaces base and kernel with its own sets afterwards.
send_line_to_vm "echo \"PRAGMA foreign_keys=ON; DELETE FROM packages WHERE name LIKE 'FreeBSD-%';\" | pkg shell"
sleep 5
send_line_to_vm "sh ./opnsense-bootstrap.sh.in -y -f -r ${var_version}"
send_line_to_vm "sh ./opnsense-bootstrap.sh.in -y -f -r 26.7"
msg_ok "OPNsense VM is being installed, do not close the terminal, or the installation will fail."
# The bootstrap ends with an automatic reboot into OPNsense. While it runs the
# console keeps changing (download progress, package installs); once the VM has
# settled at the login prompt the screen stays static. Poll a screendump hash
# and continue after 3 minutes without change, bounded by a floor (the build
# never finishes faster) and a ceiling for slow machines. If no screendump can
# be captured at all, fall back to a fixed wait.
SCREEN_PPM="${TEMP_DIR}/screen-${VMID}.ppm"
function screen_hash() {
# Remove the previous dump first: a stale file from an earlier successful
# dump must not simulate a static screen when later dumps start failing.
# Note: "qm monitor" is unusable here - its readline attaches to /dev/tty
# even with piped stdin and captures the terminal, so use the API instead.
rm -f "$SCREEN_PPM"
timeout 10 pvesh create /nodes/$(hostname -s)/qemu/$VMID/monitor --command "screendump ${SCREEN_PPM}" >/dev/null 2>&1 || true
md5sum "$SCREEN_PPM" 2>/dev/null | cut -d' ' -f1 || true
}
build_elapsed=300
build_stable=0
screen_ok=0
hash_a=""
hash_b=""
sleep 300
while [ $build_stable -lt 6 ] && [ $build_elapsed -lt 2400 ]; do
sleep 30
build_elapsed=$((build_elapsed + 30))
new_hash=$(screen_hash)
if [ -n "$new_hash" ]; then
screen_ok=1
# The login prompt cursor may blink: a screen alternating between the same
# two frames (A/B/A/B) counts as stable, anything new resets the counter
if [ "$new_hash" = "$hash_a" ] || [ "$new_hash" = "$hash_b" ]; then
build_stable=$((build_stable + 1))
else
build_stable=0
fi
else
build_stable=0
fi
hash_b="$hash_a"
hash_a="$new_hash"
if [ -n "$new_hash" ]; then
echo -e "${DGN}Waiting for OPNsense build: ${YW}$((build_elapsed / 60))min elapsed, screen ${new_hash:0:8}, stable ${build_stable}/6${CL}"
else
echo -e "${DGN}Waiting for OPNsense build: ${YW}$((build_elapsed / 60))min elapsed, screendump failed${CL}"
fi
# No working screendump after several attempts: fixed wait instead
if [ $screen_ok -eq 0 ] && [ $build_elapsed -ge 480 ]; then
msg_error "Console screendump not available on this system - falling back to a fixed wait (12 minutes)."
sleep 720
build_elapsed=$((build_elapsed + 720))
break
fi
done
msg_ok "OPNsense build finished after $((build_elapsed / 60)) minutes"
#We need to wait for the OPNsense build proccess to finish, this takes a few minutes
sleep 1000
send_line_to_vm "root"
send_line_to_vm "opnsense"
send_line_to_vm "2"
@@ -919,8 +855,8 @@ if [ -n "$WAN_BRG" ] && [ "$WAN_IP_ADDR" != "" ]; then
send_line_to_vm "2"
send_line_to_vm "n"
send_line_to_vm "${WAN_IP_ADDR}"
send_line_to_vm "${WAN_NETMASK}"
send_line_to_vm "${WAN_GW}"
send_line_to_vm "${NETMASK}"
send_line_to_vm "${LAN_GW}"
send_line_to_vm "n"
send_line_to_vm " "
send_line_to_vm "n"