fix(heimdall): migrate PHP to 8.4 on update (#15767 )

Legacy Debian 12 containers still had PHP 8.2 while Heimdall v2.8.1 requires PHP ^8.4. Run setup_php during update and use shared backup helpers for database and public data.
2026-07-21 05:15:07 +02:00 · 2026-07-14 12:41:43 +02:00
66 changed files with 307 additions and 2364 deletions
@@ -12,17 +12,13 @@ body:
        Requests may be closed if the application is out of scope, abandoned, too new, not publicly verifiable, or not suitable for a reliable Proxmox VE Helper-Scripts integration.
        General requirements:
-        - The application must be self-hosted.
+        - The application should be self-hosted.
-        - The project must have an official public source repository.
+        - The project should have an official public source repository.
-        - The project must provide official releases, tags, or release tarballs.
+        - The project should provide official releases, tags, or release tarballs.
-        - The project must be actively maintained.
+        - The project should be actively maintained.
-        - The official source repository must have at least 1,000 stars.
+        - The project should generally have at least 1,000 stars or a comparable public adoption signal.
-        - The latest official release or tag must not be older than 6 months.
+        - The latest official release or tag should not be older than 6 months.
-        - The project itself must be at least 6 months old.
+        - The project itself should be at least 6 months old.
        Projects that do not meet these requirements may be closed without further evaluation.
        Exceptions to the 1,000-star requirement are rare and require a clearly verifiable, significant public adoption signal.
  - type: input
    id: application-name
@@ -51,35 +47,6 @@ body:
    validations:
      required: true
  - type: markdown
    attributes:
      value: |
        ## ⚠️ Project Eligibility
        Before continuing, verify that the requested project meets the minimum requirements below.
        **Projects with fewer than 1,000 stars are generally not eligible for a script request.**
        Exceptions are only considered where there is a clearly verifiable, significant public adoption signal.
  - type: input
    id: repository-stars
    attributes:
      label: Repository Stars
      description: Enter the current number of stars of the official source repository.
      placeholder: "e.g., 15,000"
    validations:
      required: true
  - type: checkboxes
    id: minimum-stars
    attributes:
      label: Minimum Adoption Requirement
      description: Confirm that you have verified the project's public adoption.
      options:
        - label: The official source repository has at least 1,000 stars.
          required: true
  - type: textarea
    id: app-description
    attributes:
@@ -1,173 +1,3 @@
 ## 2026-07-18
 ### 💾 Core
  - #### ✨ New Features
    - core: add configurable host CA inheritance during bootstrap [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15840](https://github.com/community-scripts/ProxmoxVE/pull/15840))
  - #### 🔧 Refactor
    - tools.func: Safe Delete Directorys & Update PYTHON_VERSION with setup_uv [@MickLesk](https://github.com/MickLesk) ([#15870](https://github.com/community-scripts/ProxmoxVE/pull/15870))
 ### 🧰 Tools
  - #### ✨ New Features
    - [tools.update-lxcs] feat: optional reporting success/failures to heathchecks.io (or others) [@sir106](https://github.com/sir106) ([#15701](https://github.com/community-scripts/ProxmoxVE/pull/15701))
 ## 2026-07-17
 ### 🆕 New Scripts
  - Invidious ([#15824](https://github.com/community-scripts/ProxmoxVE/pull/15824))
 - OxiCloud ([#15823](https://github.com/community-scripts/ProxmoxVE/pull/15823))
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - webtrees: initialize database schema before admin user creation [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15837](https://github.com/community-scripts/ProxmoxVE/pull/15837))
    - Fix DocuSeal missing Leptonica deps on install and update [@Copilot](https://github.com/Copilot) ([#15858](https://github.com/community-scripts/ProxmoxVE/pull/15858))
    - apache-guacamole: detect installed extensions during update [@TowyTowy](https://github.com/TowyTowy) ([#15841](https://github.com/community-scripts/ProxmoxVE/pull/15841))
    - CLIProxyAPI: fix update deleting config.yaml [@austinpilz](https://github.com/austinpilz) ([#15834](https://github.com/community-scripts/ProxmoxVE/pull/15834))
    - esphome: install libusb-1.0-0 for ESP-IDF native builds [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15838](https://github.com/community-scripts/ProxmoxVE/pull/15838))
  - #### ✨ New Features
    - AFFiNE: Bump to 0.27.0 [@MickLesk](https://github.com/MickLesk) ([#15848](https://github.com/community-scripts/ProxmoxVE/pull/15848))
    - n8n: unpin / use latest release [@MickLesk](https://github.com/MickLesk) ([#15817](https://github.com/community-scripts/ProxmoxVE/pull/15817))
    - Pin Opencloud to v7.3.0 [@vhsdream](https://github.com/vhsdream) ([#15826](https://github.com/community-scripts/ProxmoxVE/pull/15826))
  - #### 🔧 Refactor
    - SFTPGo: Update APT Repo & Re-Enable Script [@MickLesk](https://github.com/MickLesk) ([#15829](https://github.com/community-scripts/ProxmoxVE/pull/15829))
 ### 💾 Core
  - #### ✨ New Features
    - tools.func: enhance rbenv with profile updates / bundle in bashrc [@MickLesk](https://github.com/MickLesk) ([#15822](https://github.com/community-scripts/ProxmoxVE/pull/15822))
    - feat(build.func): notify users when already on a pinned script version [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15819](https://github.com/community-scripts/ProxmoxVE/pull/15819))
  - #### 💥 Breaking Changes
    - MongoDB: Implement kernel version check and patch [@MickLesk](https://github.com/MickLesk) ([#15821](https://github.com/community-scripts/ProxmoxVE/pull/15821))
 ### 🧰 Tools
  - #### ✨ New Features
    - update-lxc: autoremove and autoclean after apt full-upgrade [@soupy-boy](https://github.com/soupy-boy) ([#15831](https://github.com/community-scripts/ProxmoxVE/pull/15831))
 ## 2026-07-16
 ### 🆕 New Scripts
  - Sync-In ([#15812](https://github.com/community-scripts/ProxmoxVE/pull/15812))
 - Beaverhabits ([#15813](https://github.com/community-scripts/ProxmoxVE/pull/15813))
 - Notediscovery ([#15811](https://github.com/community-scripts/ProxmoxVE/pull/15811))
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - Pin Immich to v3.0.3 [@vhsdream](https://github.com/vhsdream) ([#15790](https://github.com/community-scripts/ProxmoxVE/pull/15790))
 ## 2026-07-15
 ### 🆕 New Scripts
  - Nexterm ([#15688](https://github.com/community-scripts/ProxmoxVE/pull/15688))
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - 2fauth: minor fixes for 8.0.0 [@MickLesk](https://github.com/MickLesk) ([#15795](https://github.com/community-scripts/ProxmoxVE/pull/15795))
    - SnapOtter: refactor update process to prebuild [@MickLesk](https://github.com/MickLesk) ([#15797](https://github.com/community-scripts/ProxmoxVE/pull/15797))
 ### 💾 Core
  - #### 🔧 Refactor
    - tools.func: default Docker setup to official repo [@MickLesk](https://github.com/MickLesk) ([#15794](https://github.com/community-scripts/ProxmoxVE/pull/15794))
 ## 2026-07-14
 ### 🆕 New Scripts
  - Grav ([#15773](https://github.com/community-scripts/ProxmoxVE/pull/15773))
 - Yuvomi ([#15772](https://github.com/community-scripts/ProxmoxVE/pull/15772))
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - Lychee: Preserve uploads and ownership during update [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15768](https://github.com/community-scripts/ProxmoxVE/pull/15768))
    - Wanderer: Clean deploy and install plugins for v0.20.0 update [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15759](https://github.com/community-scripts/ProxmoxVE/pull/15759))
    - FileFlows: Handle update API 401, force update, and Node install [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15766](https://github.com/community-scripts/ProxmoxVE/pull/15766))
    - BirdNET-Go: Match new upstream release asset naming [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15758](https://github.com/community-scripts/ProxmoxVE/pull/15758))
    - [Upstream Fix] Immich: Fix loader priority [@vhsdream](https://github.com/vhsdream) ([#15755](https://github.com/community-scripts/ProxmoxVE/pull/15755))
  - #### ✨ New Features
    - Bump OpenCloud version to v7.2.2 [@MickLesk](https://github.com/MickLesk) ([#15769](https://github.com/community-scripts/ProxmoxVE/pull/15769))
    - Silverbullet: Add optional Runtime API install via Chromium [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15761](https://github.com/community-scripts/ProxmoxVE/pull/15761))
  - #### 💥 Breaking Changes
    - Pangolin: Bump to 1.20.0 | BREAKING: Switch to PostgreSQL [@MickLesk](https://github.com/MickLesk) ([#15682](https://github.com/community-scripts/ProxmoxVE/pull/15682))
  - #### 🔧 Refactor
    - AFFiNE: Pin to v0.26.3 [@MickLesk](https://github.com/MickLesk) ([#15782](https://github.com/community-scripts/ProxmoxVE/pull/15782))
 ## 2026-07-13
 ### 🆕 New Scripts
  - LeafWiki ([#15748](https://github.com/community-scripts/ProxmoxVE/pull/15748))
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - fix(hyperion): keep service running after container reboot [@TowyTowy](https://github.com/TowyTowy) ([#15653](https://github.com/community-scripts/ProxmoxVE/pull/15653))
    - Change sign-in URL to admin URL in affine.sh [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15741](https://github.com/community-scripts/ProxmoxVE/pull/15741))
    - immich: use actual PostgreSQL version for VectorChord package lookup [@mnavon](https://github.com/mnavon) ([#15705](https://github.com/community-scripts/ProxmoxVE/pull/15705))
    - fix storyteller release selection for stable web tags [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15736](https://github.com/community-scripts/ProxmoxVE/pull/15736))
    - Docmost: Fix update procedure [@MickLesk](https://github.com/MickLesk) ([#15732](https://github.com/community-scripts/ProxmoxVE/pull/15732))
    - fix(shinobi): remove obsolete --unsafe-perm npm flag [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15730](https://github.com/community-scripts/ProxmoxVE/pull/15730))
  - #### 💥 Breaking Changes
    - reitti: update to v5 [@CrazyWolf13](https://github.com/CrazyWolf13) ([#15635](https://github.com/community-scripts/ProxmoxVE/pull/15635))
 ### 💾 Core
  - #### 🐞 Bug Fixes
    - fix(build.func): parse script status without jq dependency [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15729](https://github.com/community-scripts/ProxmoxVE/pull/15729))
  - #### 🔧 Refactor
    - tools.func: some improvements (sql injection / command injection / guard) [@MickLesk](https://github.com/MickLesk) ([#15661](https://github.com/community-scripts/ProxmoxVE/pull/15661))
 ## 2026-07-12
 ### 🆕 New Scripts
  - AFFiNE ([#15690](https://github.com/community-scripts/ProxmoxVE/pull/15690))
 ### 🚀 Updated Scripts
  - Immich: Bump version to 3.0.2 [@vhsdream](https://github.com/vhsdream) ([#15668](https://github.com/community-scripts/ProxmoxVE/pull/15668))
 ### ❔ Uncategorized
  - fix(immich): correct Python indentation error in ct/immich.sh heredoc patch [@Copilot](https://github.com/Copilot) ([#15723](https://github.com/community-scripts/ProxmoxVE/pull/15723))
 ## 2026-07-11
 ### 🆕 New Scripts
@@ -1,163 +0,0 @@
 name: Close PRs Missing Template
 on:
  pull_request_target:
    branches: ["main"]
    types: [opened, edited, reopened, synchronize, labeled]
 jobs:
  validate-pr-template:
    if: github.repository == 'community-scripts/ProxmoxVE'
    runs-on: ubuntu-latest
    permissions:
      pull-requests: write
      issues: write
      contents: read
    steps:
      - name: Close PR if it does not follow the PR template
        uses: actions/github-script@v7
        with:
          script: |
            const pr = context.payload.pull_request;
            const prNumber = pr.number;
            const author = pr.user.login;
            const owner = context.repo.owner;
            const repo = context.repo.repo;
            const allowedBots = [
              "push-app-to-main[bot]",
              "push-app-to-main",
              "community-scripts-pr-app",
              "github-actions[bot]",
              "dependabot[bot]",
            ];
            if (allowedBots.includes(author) || author.endsWith("[bot]")) {
              core.info(`PR #${prNumber} by bot "${author}" — skipping template validation.`);
              return;
            }
            const association = pr.author_association;
            const exemptAssociations = ["OWNER", "MEMBER", "COLLABORATOR"];
            if (exemptAssociations.includes(association)) {
              core.info(`PR #${prNumber} by ${association} "${author}" — skipping template validation.`);
              return;
            }
            const labels = pr.labels.map((label) => label.name);
            const skipLabels = ["automated pr", "keep open"];
            if (skipLabels.some((label) => labels.includes(label))) {
              core.info(`PR #${prNumber} has a skip label (${labels.join(", ")}) — skipping template validation.`);
              return;
            }
            if (pr.draft) {
              core.info(`PR #${prNumber} is a draft — skipping template validation.`);
              return;
            }
            const body = pr.body || "";
            const failures = [];
            const requiredSections = [
              "## ✍️ Description",
              "## ✅ Prerequisites",
              "## 🛠️ Type of Change",
            ];
            for (const section of requiredSections) {
              if (!body.includes(section)) {
                failures.push(`Missing required section: \`${section}\``);
              }
            }
            const descriptionMatch = body.match(
              /## ✍️ Description\s*\n+([\s\S]*?)(?=\n## )/i
            );
            const description = (descriptionMatch?.[1] || "").trim();
            if (!description) {
              failures.push("The **Description** section is empty.");
            }
            const prerequisiteCheckboxes = [
              "**Self-review completed**",
              "**Tested thoroughly**",
              "**No security risks**",
            ];
            for (const checkbox of prerequisiteCheckboxes) {
              const escaped = checkbox.replace(/([.*+?^=!:${}()|[\]\/\\])/g, "\\$1");
              const regex = new RegExp(`- \\[(x|X)\\]\\s*${escaped}`, "i");
              if (!regex.test(body)) {
                failures.push(`Prerequisite not checked: ${checkbox}`);
              }
            }
            const typeOfChangeCheckboxes = [
              "🐞 **Bug fix**",
              "✨ **New feature**",
              "💥 **Breaking change**",
              "🆕 **New script**",
              "🌍 **Website update**",
              "🔧 **Refactoring / Code Cleanup**",
              "📝 **Documentation update**",
            ];
            const hasTypeChecked = typeOfChangeCheckboxes.some((checkbox) => {
              const escaped = checkbox.replace(/([.*+?^=!:${}()|[\]\/\\])/g, "\\$1");
              const regex = new RegExp(`- \\[(x|X)\\]\\s*${escaped}`, "i");
              return regex.test(body);
            });
            if (!hasTypeChecked) {
              failures.push("At least one **Type of Change** checkbox must be checked.");
            }
            if (failures.length === 0) {
              core.info(`PR #${prNumber} follows the PR template.`);
              return;
            }
            core.info(`Closing PR #${prNumber} — template validation failed.`);
            const templateUrl =
              "https://github.com/community-scripts/ProxmoxVE/blob/main/.github/pull_request_template.md";
            const failureList = failures.map((item) => `- ${item}`).join("\n");
            const comment = [
              `👋 Hi @${author},`,
              ``,
              `This pull request was closed because it does not follow the [PR template](${templateUrl}).`,
              ``,
              `Please fix the following and open a new PR (or reopen this one after updating the description):`,
              ``,
              failureList,
              ``,
              `> Use the template sections, fill in the description, check all prerequisite boxes, and select at least one type of change.`,
              ``,
              `Maintainers can add the \`keep open\` label to exempt a PR from this check.`,
              ``,
              `Thank you for contributing! 🙏`,
            ].join("\n");
            await github.rest.issues.createComment({
              owner,
              repo,
              issue_number: prNumber,
              body: comment,
            });
            await github.rest.pulls.update({
              owner,
              repo,
              pull_number: prNumber,
              state: "closed",
            });
            await github.rest.issues.addLabels({
              owner,
              repo,
              issue_number: prNumber,
              labels: ["missing pr template"],
            });
@@ -91,30 +91,6 @@ jobs:
            let skipped = 0;
            for (const branch of candidates) {
              // A branch name can be reused after an earlier PR was merged. Never delete a
              // branch while it is the head of a current open PR, even if it is also a
              // candidate from an older merged PR.
              try {
                const { data: openPrs } = await github.rest.pulls.list({
                  owner,
                  repo,
                  state: "open",
                  head: `${owner}:${branch}`,
                  per_page: 1,
                });
                if (openPrs.length > 0) {
                  console.log(`Skipped "${branch}" (head of open PR #${openPrs[0].number})`);
                  skipped++;
                  continue;
                }
              } catch (error) {
                // Do not risk deleting a branch if GitHub cannot confirm it has no open PR.
                console.log(`Failed to check open PRs for "${branch}": ${error.message}`);
                skipped++;
                continue;
              }
              // Confirm the branch still exists and isn't protected.
              let branchData;
              try {
@@ -77,9 +77,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
@@ -93,7 +90,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 <details>
-<summary><h4>July (18 entries)</h4></summary>
+<summary><h4>July (11 entries)</h4></summary>
 [View July 2026 Changelog](.github/changelogs/2026/07.md)
@@ -505,137 +502,17 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 </details>
 ## 2026-07-19
 ### 💾 Core
  - Revert "core: add configurable host CA inheritance during bootstrap" [@MickLesk](https://github.com/MickLesk) ([#15886](https://github.com/community-scripts/ProxmoxVE/pull/15886))
 ## 2026-07-18
 ### 💾 Core
  - #### ✨ New Features
    - core: add configurable host CA inheritance during bootstrap [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15840](https://github.com/community-scripts/ProxmoxVE/pull/15840))
  - #### 🔧 Refactor
    - tools.func: Safe Delete Directorys & Update PYTHON_VERSION with setup_uv [@MickLesk](https://github.com/MickLesk) ([#15870](https://github.com/community-scripts/ProxmoxVE/pull/15870))
 ### 🧰 Tools
  - #### ✨ New Features
    - [tools.update-lxcs] feat: optional reporting success/failures to heathchecks.io (or others) [@sir106](https://github.com/sir106) ([#15701](https://github.com/community-scripts/ProxmoxVE/pull/15701))
 ## 2026-07-17
 ### 🆕 New Scripts
  - Invidious ([#15824](https://github.com/community-scripts/ProxmoxVE/pull/15824))
 - OxiCloud ([#15823](https://github.com/community-scripts/ProxmoxVE/pull/15823))
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - webtrees: initialize database schema before admin user creation [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15837](https://github.com/community-scripts/ProxmoxVE/pull/15837))
    - Fix DocuSeal missing Leptonica deps on install and update [@Copilot](https://github.com/Copilot) ([#15858](https://github.com/community-scripts/ProxmoxVE/pull/15858))
    - apache-guacamole: detect installed extensions during update [@TowyTowy](https://github.com/TowyTowy) ([#15841](https://github.com/community-scripts/ProxmoxVE/pull/15841))
    - CLIProxyAPI: fix update deleting config.yaml [@austinpilz](https://github.com/austinpilz) ([#15834](https://github.com/community-scripts/ProxmoxVE/pull/15834))
    - esphome: install libusb-1.0-0 for ESP-IDF native builds [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15838](https://github.com/community-scripts/ProxmoxVE/pull/15838))
  - #### ✨ New Features
    - AFFiNE: Bump to 0.27.0 [@MickLesk](https://github.com/MickLesk) ([#15848](https://github.com/community-scripts/ProxmoxVE/pull/15848))
    - n8n: unpin / use latest release [@MickLesk](https://github.com/MickLesk) ([#15817](https://github.com/community-scripts/ProxmoxVE/pull/15817))
    - Pin Opencloud to v7.3.0 [@vhsdream](https://github.com/vhsdream) ([#15826](https://github.com/community-scripts/ProxmoxVE/pull/15826))
  - #### 🔧 Refactor
    - SFTPGo: Update APT Repo & Re-Enable Script [@MickLesk](https://github.com/MickLesk) ([#15829](https://github.com/community-scripts/ProxmoxVE/pull/15829))
 ### 💾 Core
  - #### ✨ New Features
    - tools.func: enhance rbenv with profile updates / bundle in bashrc [@MickLesk](https://github.com/MickLesk) ([#15822](https://github.com/community-scripts/ProxmoxVE/pull/15822))
    - feat(build.func): notify users when already on a pinned script version [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15819](https://github.com/community-scripts/ProxmoxVE/pull/15819))
  - #### 💥 Breaking Changes
    - MongoDB: Implement kernel version check and patch [@MickLesk](https://github.com/MickLesk) ([#15821](https://github.com/community-scripts/ProxmoxVE/pull/15821))
 ### 🧰 Tools
  - #### ✨ New Features
    - update-lxc: autoremove and autoclean after apt full-upgrade [@soupy-boy](https://github.com/soupy-boy) ([#15831](https://github.com/community-scripts/ProxmoxVE/pull/15831))
 ## 2026-07-16
 ### 🆕 New Scripts
  - Sync-In ([#15812](https://github.com/community-scripts/ProxmoxVE/pull/15812))
 - Beaverhabits ([#15813](https://github.com/community-scripts/ProxmoxVE/pull/15813))
 - Notediscovery ([#15811](https://github.com/community-scripts/ProxmoxVE/pull/15811))
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - Pin Immich to v3.0.3 [@vhsdream](https://github.com/vhsdream) ([#15790](https://github.com/community-scripts/ProxmoxVE/pull/15790))
 ## 2026-07-15
 ### 🆕 New Scripts
  - Nexterm ([#15688](https://github.com/community-scripts/ProxmoxVE/pull/15688))
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - 2fauth: minor fixes for 8.0.0 [@MickLesk](https://github.com/MickLesk) ([#15795](https://github.com/community-scripts/ProxmoxVE/pull/15795))
    - SnapOtter: refactor update process to prebuild [@MickLesk](https://github.com/MickLesk) ([#15797](https://github.com/community-scripts/ProxmoxVE/pull/15797))
 ### 💾 Core
  - #### 🔧 Refactor
    - tools.func: default Docker setup to official repo [@MickLesk](https://github.com/MickLesk) ([#15794](https://github.com/community-scripts/ProxmoxVE/pull/15794))
 ## 2026-07-14
 ### 🆕 New Scripts
  - Grav ([#15773](https://github.com/community-scripts/ProxmoxVE/pull/15773))
 - Yuvomi ([#15772](https://github.com/community-scripts/ProxmoxVE/pull/15772))
 ### 🚀 Updated Scripts
  - Revert "fix(fileflows): handle update API 401, force update, and Node install" [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15764](https://github.com/community-scripts/ProxmoxVE/pull/15764))
  - #### 🐞 Bug Fixes
-    - Lychee: Preserve uploads and ownership during update [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15768](https://github.com/community-scripts/ProxmoxVE/pull/15768))
+    - fix(fileflows): handle update API 401, force update, and Node install [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#14858](https://github.com/community-scripts/ProxmoxVE/pull/14858))
    - Wanderer: Clean deploy and install plugins for v0.20.0 update [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15759](https://github.com/community-scripts/ProxmoxVE/pull/15759))
    - FileFlows: Handle update API 401, force update, and Node install [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15766](https://github.com/community-scripts/ProxmoxVE/pull/15766))
    - BirdNET-Go: Match new upstream release asset naming [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15758](https://github.com/community-scripts/ProxmoxVE/pull/15758))
    - [Upstream Fix] Immich: Fix loader priority [@vhsdream](https://github.com/vhsdream) ([#15755](https://github.com/community-scripts/ProxmoxVE/pull/15755))
  - #### ✨ New Features
    - Bump OpenCloud version to v7.2.2 [@MickLesk](https://github.com/MickLesk) ([#15769](https://github.com/community-scripts/ProxmoxVE/pull/15769))
    - Silverbullet: Add optional Runtime API install via Chromium [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15761](https://github.com/community-scripts/ProxmoxVE/pull/15761))
  - #### 💥 Breaking Changes
    - Pangolin: Bump to 1.20.0 | BREAKING: Switch to PostgreSQL [@MickLesk](https://github.com/MickLesk) ([#15682](https://github.com/community-scripts/ProxmoxVE/pull/15682))
  - #### 🔧 Refactor
    - AFFiNE: Pin to v0.26.3 [@MickLesk](https://github.com/MickLesk) ([#15782](https://github.com/community-scripts/ProxmoxVE/pull/15782))
 ## 2026-07-13
 ### 🆕 New Scripts
@@ -1162,4 +1039,128 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
  - chore(ct): sync coredns defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#15182](https://github.com/community-scripts/ProxmoxVE/pull/15182))
 - chore(ct): sync gatus defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#15184](https://github.com/community-scripts/ProxmoxVE/pull/15184))
- chore(ct): sync bitmagnet defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#15183](https://github.com/community-scripts/ProxmoxVE/pull/15183))
+- chore(ct): sync bitmagnet defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#15183](https://github.com/community-scripts/ProxmoxVE/pull/15183))
 ## 2026-06-18
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - flowise: add deps / uv / python 3.11 [@MickLesk](https://github.com/MickLesk) ([#15177](https://github.com/community-scripts/ProxmoxVE/pull/15177))
  - #### 💥 Breaking Changes
    - refactor: crafty-controller [@CrazyWolf13](https://github.com/CrazyWolf13) ([#15178](https://github.com/community-scripts/ProxmoxVE/pull/15178))
 ## 2026-06-17
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - kasm: fix release detection [@CrazyWolf13](https://github.com/CrazyWolf13) ([#15151](https://github.com/community-scripts/ProxmoxVE/pull/15151))
  - #### ✨ New Features
    - trek: update install and upgrade workflow for v3.1.0 [@MickLesk](https://github.com/MickLesk) ([#15165](https://github.com/community-scripts/ProxmoxVE/pull/15165))
  - #### 💥 Breaking Changes
    - TREK: Pin version [@tremor021](https://github.com/tremor021) ([#15156](https://github.com/community-scripts/ProxmoxVE/pull/15156))
  - #### 🔧 Refactor
    - chore(paperless-ngx): pin version to prevent v3 update [@tomfrenzel](https://github.com/tomfrenzel) ([#15171](https://github.com/community-scripts/ProxmoxVE/pull/15171))
 ### 🧰 Tools
  - #### 🐞 Bug Fixes
    - immich public proxy: replace npm install with npm ci for consistent dependency installation [@MickLesk](https://github.com/MickLesk) ([#15166](https://github.com/community-scripts/ProxmoxVE/pull/15166))
 ## 2026-06-16
 ### 🆕 New Scripts
  - Feishin ([#15130](https://github.com/community-scripts/ProxmoxVE/pull/15130))
 - Kiwix ([#15131](https://github.com/community-scripts/ProxmoxVE/pull/15131))
 - Add runtime status guard and deleted script stubs [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15125](https://github.com/community-scripts/ProxmoxVE/pull/15125))
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - fix(degoog): use localhost for valkey url [@ethan-hgwr](https://github.com/ethan-hgwr) ([#15149](https://github.com/community-scripts/ProxmoxVE/pull/15149))
    - Fix InvoiceShelf install/update Yarn package manager mismatch [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15141](https://github.com/community-scripts/ProxmoxVE/pull/15141))
    - fix storyteller install failure with yarn 4 corepack [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15140](https://github.com/community-scripts/ProxmoxVE/pull/15140))
    - fix: generate policy-compliant OpenObserve root password [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15137](https://github.com/community-scripts/ProxmoxVE/pull/15137))
 ## 2026-06-15
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - Watcharr: Clean install on update [@tremor021](https://github.com/tremor021) ([#15119](https://github.com/community-scripts/ProxmoxVE/pull/15119))
    - Vaultwarden: extend version check for VaultWarden update [@MickLesk](https://github.com/MickLesk) ([#15105](https://github.com/community-scripts/ProxmoxVE/pull/15105))
  - #### ✨ New Features
    - degoog: add curl-impersonate to script [@MickLesk](https://github.com/MickLesk) ([#15117](https://github.com/community-scripts/ProxmoxVE/pull/15117))
 ### 💾 Core
  - #### ✨ New Features
    - tools.func: extend mesa-vulkan-drivers and vulkan-tools to installation for ARC GPU's [@MickLesk](https://github.com/MickLesk) ([#15106](https://github.com/community-scripts/ProxmoxVE/pull/15106))
  - #### 🔧 Refactor
    - core: improve mirror selection and error handling [@MickLesk](https://github.com/MickLesk) ([#15108](https://github.com/community-scripts/ProxmoxVE/pull/15108))
    - core: implement gateway validation for DHCP and static networks [@MickLesk](https://github.com/MickLesk) ([#15107](https://github.com/community-scripts/ProxmoxVE/pull/15107))
 ## 2026-06-14
 ### 🚀 Updated Scripts
  - #### 🐞 Bug Fixes
    - Iinvoiceninja: fix nginx setup assets port [@MickLesk](https://github.com/MickLesk) ([#15090](https://github.com/community-scripts/ProxmoxVE/pull/15090))
    - CheckMK: remove stale backup site before creating new backup during update [@MickLesk](https://github.com/MickLesk) ([#15088](https://github.com/community-scripts/ProxmoxVE/pull/15088))
  - #### 🔧 Refactor
    - Refactor: Implement backup functions for scripts C-D [@tremor021](https://github.com/tremor021) ([#15096](https://github.com/community-scripts/ProxmoxVE/pull/15096))
 ## 2026-06-13
 ### 🆕 New Scripts
  - BookOrbit ([#15080](https://github.com/community-scripts/ProxmoxVE/pull/15080))
 ### 🚀 Updated Scripts
  - Update authentik version to 2026.5.3 [@thieneret](https://github.com/thieneret) ([#15093](https://github.com/community-scripts/ProxmoxVE/pull/15093))
  - #### 🐞 Bug Fixes
    - Immich: Update image-processing libraries [@vhsdream](https://github.com/vhsdream) ([#15082](https://github.com/community-scripts/ProxmoxVE/pull/15082))
    - HomeBox: Support v0.26.0 [@tomfrenzel](https://github.com/tomfrenzel) ([#15086](https://github.com/community-scripts/ProxmoxVE/pull/15086))
  - #### 🔧 Refactor
    - Refactor: Implement backup functions for scripts A-B [@tremor021](https://github.com/tremor021) ([#15075](https://github.com/community-scripts/ProxmoxVE/pull/15075))
 ## 2026-06-12
 ### 🆕 New Scripts
  - Twenty ([#15047](https://github.com/community-scripts/ProxmoxVE/pull/15047))
 - Alpine-Cinny ([#15044](https://github.com/community-scripts/ProxmoxVE/pull/15044))
 ### 💾 Core
  - #### ✨ New Features
    - [core] Implement backup and restore functions [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15067](https://github.com/community-scripts/ProxmoxVE/pull/15067))
@@ -60,7 +60,6 @@ function update_script() {
    php artisan 2fauth:install
    chown -R www-data: /opt/2fauth
    chmod -R 755 /opt/2fauth
    $STD php artisan 2fauth:fix-passport-key-permissions
    $STD systemctl restart php8.4-fpm
    $STD systemctl restart nginx
    msg_ok "Configured 2FAuth"
@@ -30,19 +30,16 @@ function update_script() {
    exit
  fi
-  RELEASE="v0.27.0"
+  if check_for_gh_release "affine_app" "toeverything/AFFiNE"; then
  if check_for_gh_release "affine_app" "toeverything/AFFiNE" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
    msg_info "Stopping Services"
    systemctl stop affine-web affine-worker
    msg_ok "Stopped Services"
    ensure_dependencies cmake
    create_backup /root/.affine/config /root/.affine/storage
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "${RELEASE}" "/opt/affine"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "latest" "/opt/affine"
-    msg_info "Rebuilding Application (Patience ~25 mins, don't close the console!)"
+    msg_info "Rebuilding Application (Patience)"
    cd /opt/affine
    source /root/.profile
    export PATH="/root/.cargo/bin:/root/.rbenv/shims:$PATH"
@@ -53,12 +50,11 @@ function update_script() {
    export VITE_CORE_COMMIT_SHA=$(cat ~/.affine_app)
    # Initialize git repo (required for build process)
    export HUSKY=0
    $STD git init -q
    $STD git config user.email "build@local"
    $STD git config user.name "Build"
    $STD git add -A
-    $STD git commit -q -m "update" --no-verify --allow-empty
+    $STD git commit -q -m "update"
    # Force Turbo to run sequentially
    mkdir -p /opt/affine/.turbo
@@ -69,7 +65,7 @@ function update_script() {
 TURBO
    $STD corepack enable
-    $STD corepack prepare yarn@4.13.0 --activate
+    $STD corepack prepare yarn@4.12.0 --activate
    $STD yarn config set enableTelemetry 0
    export NODE_OPTIONS="--max-old-space-size=2048"
@@ -146,7 +146,7 @@ function update_script() {
  # Check and upgrade optional extensions
  # TOTP Extension
-  if compgen -G "/etc/guacamole/extensions/guacamole-auth-totp-*.jar" >/dev/null; then
+  if [[ -f /etc/guacamole/extensions/guacamole-auth-totp-*.jar ]]; then
    msg_info "Updating TOTP Extension"
    rm -f /etc/guacamole/extensions/guacamole-auth-totp-*.jar
    curl_download "/tmp/guacamole-auth-totp.tar.gz" "https://downloads.apache.org/guacamole/${LATEST_SERVER}/binary/guacamole-auth-totp-${LATEST_SERVER}.tar.gz"
@@ -158,7 +158,7 @@ function update_script() {
  fi
  # DUO Extension
-  if compgen -G "/etc/guacamole/extensions/guacamole-auth-duo-*.jar" >/dev/null; then
+  if [[ -f /etc/guacamole/extensions/guacamole-auth-duo-*.jar ]]; then
    msg_info "Updating DUO Extension"
    rm -f /etc/guacamole/extensions/guacamole-auth-duo-*.jar
    curl_download "/tmp/guacamole-auth-duo.tar.gz" "https://downloads.apache.org/guacamole/${LATEST_SERVER}/binary/guacamole-auth-duo-${LATEST_SERVER}.tar.gz"
@@ -170,7 +170,7 @@ function update_script() {
  fi
  # LDAP Extension
-  if compgen -G "/etc/guacamole/extensions/guacamole-auth-ldap-*.jar" >/dev/null; then
+  if [[ -f /etc/guacamole/extensions/guacamole-auth-ldap-*.jar ]]; then
    msg_info "Updating LDAP Extension"
    rm -f /etc/guacamole/extensions/guacamole-auth-ldap-*.jar
    curl_download "/tmp/guacamole-auth-ldap.tar.gz" "https://downloads.apache.org/guacamole/${LATEST_SERVER}/binary/guacamole-auth-ldap-${LATEST_SERVER}.tar.gz"
@@ -182,7 +182,7 @@ function update_script() {
  fi
  # Quick Connect Extension
-  if compgen -G "/etc/guacamole/extensions/guacamole-auth-quickconnect-*.jar" >/dev/null; then
+  if [[ -f /etc/guacamole/extensions/guacamole-auth-quickconnect-*.jar ]]; then
    msg_info "Updating Quick Connect Extension"
    rm -f /etc/guacamole/extensions/guacamole-auth-quickconnect-*.jar
    curl_download "/tmp/guacamole-auth-quickconnect.tar.gz" "https://downloads.apache.org/guacamole/${LATEST_SERVER}/binary/guacamole-auth-quickconnect-${LATEST_SERVER}.tar.gz"
@@ -194,7 +194,7 @@ function update_script() {
  fi
  # History Recording Storage Extension
-  if compgen -G "/etc/guacamole/extensions/guacamole-history-recording-storage-*.jar" >/dev/null; then
+  if [[ -f /etc/guacamole/extensions/guacamole-history-recording-storage-*.jar ]]; then
    msg_info "Updating History Recording Storage Extension"
    rm -f /etc/guacamole/extensions/guacamole-history-recording-storage-*.jar
    curl_download "/tmp/guacamole-history-recording-storage.tar.gz" "https://downloads.apache.org/guacamole/${LATEST_SERVER}/binary/guacamole-history-recording-storage-${LATEST_SERVER}.tar.gz"
@@ -1,64 +0,0 @@
 #!/usr/bin/env bash
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://github.com/daya0576/beaverhabits
 APP="BeaverHabits"
 var_tags="${var_tags:-habits;tracking;productivity}"
 var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-1024}"
 var_disk="${var_disk:-4}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 header_info "$APP"
 variables
 color
 catch_errors
 function update_script() {
  header_info
  check_container_storage
  check_container_resources
  if [[ ! -d /opt/beaverhabits ]]; then
    msg_error "No ${APP} Installation Found!"
    exit
  fi
  if check_for_gh_release "beaverhabits" "daya0576/beaverhabits"; then
    msg_info "Stopping Service"
    systemctl stop beaverhabits
    msg_ok "Stopped Service"
    create_backup /opt/beaverhabits/.user
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "beaverhabits" "daya0576/beaverhabits" "tarball"
    msg_info "Syncing Dependencies"
    cd /opt/beaverhabits
    $STD uv sync --no-dev
    msg_ok "Synced Dependencies"
    restore_backup
    msg_info "Starting Service"
    systemctl start beaverhabits
    msg_ok "Started Service"
    msg_ok "Updated successfully!"
  fi
  exit
 }
 start
 build_container
 description
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
 echo -e "${GATEWAY}${BGN}http://${IP}:8080/register{CL}"
@@ -37,7 +37,7 @@ function update_script() {
    systemctl stop birdnet
    msg_ok "Stopped Service"
-    fetch_and_deploy_gh_release "birdnet" "tphakala/birdnet-go" "prebuild" "latest" "/opt/birdnet" "birdnet-go-linux-$(arch_resolve)*.tar.gz"
+    fetch_and_deploy_gh_release "birdnet" "tphakala/birdnet-go" "prebuild" "latest" "/opt/birdnet" "birdnet-go-linux-$(arch_resolve).tar.gz"
    msg_info "Deploying Binary"
    cp /opt/birdnet/birdnet-go /usr/local/bin/birdnet-go
@@ -36,12 +36,8 @@ function update_script() {
    systemctl stop cliproxyapi
    msg_ok "Stopped CLIProxyAPI"
    create_backup /opt/cliproxyapi/config.yaml
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "cliproxyapi" "router-for-me/CLIProxyAPI" "prebuild" "latest" "/opt/cliproxyapi" "CLIProxyAPI_*_linux_$(arch_resolve "amd64" "aarch64").tar.gz"
    restore_backup
    msg_info "Starting CLIProxyAPI"
    systemctl start cliproxyapi
    msg_ok "Started CLIProxyAPI"
@@ -35,8 +35,6 @@ function update_script() {
    systemctl stop docuseal docuseal-sidekiq
    msg_ok "Stopped Services"
    ensure_dependencies libleptonica-dev libleptonica6
    create_backup /opt/docuseal/.env \
      /opt/docuseal/data
@@ -28,7 +28,6 @@ function update_script() {
    msg_error "No ${APP} Installation Found!"
    exit
  fi
  ensure_dependencies libusb-1.0-0
  msg_info "Stopping Service"
  systemctl stop esphome-device-builder 2>/dev/null || true
@@ -31,83 +31,50 @@ function update_script() {
    exit
  fi
-  local proceed=false
+  update_available=$(curl -fsSL -X 'GET' "http://localhost:19200/api/status/update-available" -H 'accept: application/json' | jq .UpdateAvailable)
  if [[ "${update_available}" == "true" ]]; then
    msg_info "Stopping Service"
    systemctl --all stop 'fileflows*'
    msg_info "Stopped Service"
-  if systemctl list-unit-files 'fileflows.service' --no-legend 2>/dev/null | grep -q '^fileflows\.service'; then
+    msg_info "Creating Backup"
-    tmp=$(mktemp)
+    ls /opt/*.tar.gz &>/dev/null && rm -f /opt/*.tar.gz
-    http_code=$(curl -sSL -X 'GET' "http://localhost:19200/api/status/update-available" -H 'accept: application/json' -o "$tmp" -w '%{http_code}' 2>/dev/null) || http_code="000"
+    backup_filename="/opt/${APP}_backup_$(date +%F).tar.gz"
-    if [[ "$http_code" == "200" ]]; then
+    tar -czf "$backup_filename" -C /opt/fileflows Data
-      update_available=$(jq -r '.UpdateAvailable // false' "$tmp" 2>/dev/null)
+    msg_ok "Backup Created"
-      rm -f "$tmp"
+
-      if [[ "${update_available}" == "true" ]]; then
+    # FileFlows tracks the latest release, whose .NET target can move (e.g. 8 -> 10);
-        proceed=true
+    # ensure the current ASP.NET Core Runtime so an existing install doesn't fail to
-      else
+    # start after updating to a newer .NET major version.
-        msg_ok "No update required. ${APP} is already at latest version"
+    msg_info "Ensuring ASP.NET Core Runtime"
-        exit
+    if [[ "$(arch_resolve)" == "arm64" ]]; then
-      fi
+      if [[ ! -x /usr/lib/dotnet10/dotnet ]]; then
-    else
+        curl -fsSL https://dot.net/v1/dotnet-install.sh -o /tmp/dotnet-install.sh
-      rm -f "$tmp"
+        $STD bash /tmp/dotnet-install.sh --channel 10.0 --runtime aspnetcore --install-dir /usr/lib/dotnet10
-      if [[ "$http_code" == "401" ]]; then
+        ln -sf /usr/lib/dotnet10/dotnet /usr/bin/dotnet
-        msg_warn "Could not check for updates: API returned 401 (security may be enabled)."
+        rm -f /tmp/dotnet-install.sh
      else
        msg_warn "Could not check for updates: API unreachable (HTTP ${http_code})."
      fi
      if [[ "${FORCE_UPDATE:-}" == "1" ]]; then
        proceed=true
      else
        read -r -p "${TAB3}Force update without version check? [y/N]: " CONFIRM
        if [[ "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
          proceed=true
        else
          msg_error "Update aborted."
          exit
        fi
      fi
    elif ! is_package_installed "aspnetcore-runtime-10.0"; then
      $STD apt remove -y aspnetcore-runtime-8.0 aspnetcore-runtime-9.0 2>/dev/null || true
      setup_deb822_repo \
        "microsoft" \
        "https://packages.microsoft.com/keys/microsoft-2025.asc" \
        "https://packages.microsoft.com/debian/13/prod/" \
        "trixie"
      $STD apt install -y aspnetcore-runtime-10.0
    fi
    msg_ok "Ensured ASP.NET Core Runtime"
    fetch_and_deploy_from_url "https://fileflows.com/downloads/zip" "/opt/fileflows"
    msg_info "Starting Service"
    systemctl --all start 'fileflows*'
    msg_ok "Started Service"
    msg_ok "Updated successfully!"
  else
-    proceed=true
+    msg_ok "No update required. ${APP} is already at latest version"
  fi
  if [[ "$proceed" != "true" ]]; then
    exit
  fi
  msg_info "Stopping Service"
  systemctl --all stop 'fileflows*'
  msg_ok "Stopped Service"
  msg_info "Creating Backup"
  ls /opt/*.tar.gz &>/dev/null && rm -f /opt/*.tar.gz
  backup_filename="/opt/${APP}_backup_$(date +%F).tar.gz"
  tar -czf "$backup_filename" -C /opt/fileflows Data
  msg_ok "Backup Created"
  msg_info "Ensuring ASP.NET Core Runtime"
  if [[ "$(arch_resolve)" == "arm64" ]]; then
    if [[ ! -x /usr/lib/dotnet10/dotnet ]]; then
      curl -fsSL https://dot.net/v1/dotnet-install.sh -o /tmp/dotnet-install.sh
      $STD bash /tmp/dotnet-install.sh --channel 10.0 --runtime aspnetcore --install-dir /usr/lib/dotnet10
      ln -sf /usr/lib/dotnet10/dotnet /usr/bin/dotnet
      rm -f /tmp/dotnet-install.sh
    fi
  elif ! is_package_installed "aspnetcore-runtime-10.0"; then
    $STD apt remove -y aspnetcore-runtime-8.0 aspnetcore-runtime-9.0 2>/dev/null || true
    setup_deb822_repo \
      "microsoft" \
      "https://packages.microsoft.com/keys/microsoft-2025.asc" \
      "https://packages.microsoft.com/debian/13/prod/" \
      "trixie"
    $STD apt install -y aspnetcore-runtime-10.0
  fi
  msg_ok "Ensured ASP.NET Core Runtime"
  fetch_and_deploy_from_url "https://fileflows.com/downloads/zip" "/opt/fileflows"
  msg_info "Starting Service"
  systemctl --all start 'fileflows*'
  msg_ok "Started Service"
  msg_ok "Updated successfully!"
  exit
 }
@@ -1,54 +0,0 @@
 #!/usr/bin/env bash
 source <(curl -s https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: Raffaele (rafspiny)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://getgrav.org/
 APP="Grav"
 var_tags="${var_tags:-cms}"
 var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-8}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
 var_arm64="${var_arm64:-no}"
 var_unprivileged="${var_unprivileged:-1}"
 header_info "$APP"
 variables
 color
 catch_errors
 function update_script() {
    header_info
    check_container_storage
    check_container_resources
    if [[ ! -d "/opt/grav" ]]; then
        msg_error "No ${APP} Installation Found!"
        exit
    fi
    if check_for_gh_release "grav" "getgrav/grav"; then
        msg_info "Creating Backup"
        cd /opt/grav
        bin/grav backup -nq
        msg_ok "Backup Created"
        bin/gpm self-upgrade -y
        cd -
        chown -R www-data:www-data /opt/grav
        msg_ok "Update Successful"
    fi
    exit
 }
 start
 build_container
 description
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
 echo -e "${GATEWAY}${BGN}http://${IP}:80${CL}"
@@ -1,6 +0,0 @@
    ____                             __  __      __    _ __      
   / __ )___  ____ __   _____  _____/ / / /___ _/ /_  (_) /______
  / __  / _ \/ __ `/ | / / _ \/ ___/ /_/ / __ `/ __ \/ / __/ ___/
 / /_/ /  __/ /_/ /| |/ /  __/ /  / __  / /_/ / /_/ / / /_(__  ) 
 /_____/\___/\__,_/ |___/\___/_/  /_/ /_/\__,_/_.___/_/\__/____/  
@@ -1,6 +0,0 @@
   ______                
  / ____/________ __   __
 / / __/ ___/ __ `/ | / /
 / /_/ / /  / /_/ /| |/ / 
 \____/_/   \__,_/ |___/  
@@ -1,6 +0,0 @@
    ____           _     ___                 
   /  _/___ _   __(_)___/ (_)___  __  _______
   / // __ \ | / / / __  / / __ \/ / / / ___/
 _/ // / / / |/ / / /_/ / / /_/ / /_/ (__  ) 
 /___/_/ /_/|___/_/\__,_/_/\____/\__,_/____/  
@@ -1,6 +0,0 @@
    _   __          __                    
   / | / /__  _  __/ /____  _________ ___ 
  /  |/ / _ \| |/_/ __/ _ \/ ___/ __ `__ \
 / /|  /  __/>  </ /_/  __/ /  / / / / / /
 /_/ |_/\___/_/|_|\__/\___/_/  /_/ /_/ /_/ 
@@ -1,6 +0,0 @@
    _   __      __       ____  _                                     
   / | / /___  / /____  / __ \(_)_____________ _   _____  _______  __
  /  |/ / __ \/ __/ _ \/ / / / / ___/ ___/ __ \ | / / _ \/ ___/ / / /
 / /|  / /_/ / /_/  __/ /_/ / (__  ) /__/ /_/ / |/ /  __/ /  / /_/ / 
 /_/ |_/\____/\__/\___/_____/_/____/\___/\____/|___/\___/_/   \__, /  
                                                            /____/   
@@ -1,6 +0,0 @@
   ____       _ ________                __
  / __ \_  __(_) ____/ /___  __  ______/ /
 / / / / |/_/ / /   / / __ \/ / / / __  / 
 / /_/ />  </ / /___/ / /_/ / /_/ / /_/ /  
 \____/_/|_/_/\____/_/\____/\__,_/\__,_/   
@@ -1,6 +0,0 @@
   _____                        _     
  / ___/__  ______  _____      (_)___ 
  \__ \/ / / / __ \/ ___/_____/ / __ \
 ___/ / /_/ / / / / /__/_____/ / / / /
 /____/\__, /_/ /_/\___/     /_/_/ /_/ 
     /____/                           
@@ -1,6 +0,0 @@
 __  __                            _ 
 \ \/ /_  ___   ______  ____ ___  (_)
 \  / / / / | / / __ \/ __ `__ \/ / 
 / / /_/ /| |/ / /_/ / / / / / / /  
 /_/\__,_/ |___/\____/_/ /_/ /_/_/   
@@ -35,14 +35,12 @@ function update_script() {
    sleep 1
    msg_ok "Stopped Service"
-    msg_info "Backing up Data"
+    create_backup /opt/Heimdall/database \
-    cp -R /opt/Heimdall/database database-backup
+                  /opt/Heimdall/public
-    cp -R /opt/Heimdall/public public-backup
+    PHP_VERSION="8.4" PHP_FPM="YES" setup_php
    sleep 1
    msg_ok "Backed up Data"
    setup_composer
    fetch_and_deploy_gh_release "Heimdall" "linuxserver/Heimdall" "tarball"
    restore_backup
    msg_info "Updating Heimdall-Dashboard"
    cd /opt/Heimdall
@@ -50,18 +48,6 @@ function update_script() {
    $STD composer dump-autoload
    msg_ok "Updated Heimdall-Dashboard"
    msg_info "Restoring Data"
    cd ~
    cp -R database-backup/* /opt/Heimdall/database
    cp -R public-backup/* /opt/Heimdall/public
    sleep 1
    msg_ok "Restored Data"
    msg_info "Cleaning Up"
    rm -rf {public-backup,database-backup}
    sleep 1
    msg_ok "Cleaned Up"
    msg_info "Starting Service"
    systemctl start heimdall.service
    sleep 2
@@ -110,7 +110,7 @@ EOF
    msg_ok "Image-processing libraries up to date"
  fi
-  RELEASE="v3.0.3"
+  RELEASE="v3.0.2"
  if check_for_gh_release "Immich" "immich-app/immich" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
    if [[ $(cat ~/.immich) > "2.5.1" ]]; then
      msg_info "Enabling Maintenance Mode"
@@ -1,77 +0,0 @@
 #!/usr/bin/env bash
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: vhsdream
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://github.com/iv-org/invidious
 APP="Invidious"
 var_tags="${var_tags:-streaming}"
 var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-4096}"
 var_disk="${var_disk:-20}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 header_info "$APP"
 variables
 color
 catch_errors
 function update_script() {
  header_info
  check_container_storage
  check_container_resources
  if [[ ! -d /opt/invidious ]]; then
    msg_error "No ${APP} Installation Found!"
    exit
  fi
  if check_for_gh_release "Invidious" "iv-org/invidious"; then
    msg_info "Stopping services"
    $STD systemctl stop invidious-companion invidious
    msg_ok "Stopped services"
    create_backup /opt/invidious/config/config.yml
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Invidious" "iv-org/invidious" "tarball" "latest" "/opt/invidious"
    if check_for_gh_release "Invidious-Companion" "iv-org/invidious-companion"; then
      CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Invidious-Companion" "iv-org/invidious-companion" "prebuild" "latest" "/opt/invidious-companion" "invidious_companion-$(arch_resolve x86_64 aarch64)-unknown-linux-gnu.tar.gz"
    fi
    msg_info "Rebuilding Invidious"
    cd /opt/invidious
    INVIDIOUS_VERSION="$(cat ~/.invidious 2>/dev/null || echo "unknown")"
    INVIDIOUS_VERSION="${INVIDIOUS_VERSION#v}"
    sed -i \
      -e "s~^\(\s*CURRENT_BRANCH\s*=\).*~\1 \"master\"~" \
      -e "s~^\(\s*CURRENT_COMMIT\s*=\).*~\1 \"\"~" \
      -e "s~^\(\s*CURRENT_VERSION\s*=\).*~\1 \"${INVIDIOUS_VERSION}\"~" \
      -e "s~^\(\s*CURRENT_TAG\s*=\).*~\1 \"${INVIDIOUS_VERSION}\"~" \
      -e "s~^\(\s*ASSET_COMMIT\s*=\).*~\1 \"\"~" \
      src/invidious.cr
    $STD make
    msg_ok "Rebuilt Invidious"
    restore_backup
    msg_info "Starting services"
    $STD systemctl start invidious invidious-companion
    msg_ok "Started services"
    msg_ok "Updated successfully!"
  fi
  exit
 }
 start
 build_container
 description
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
 echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"
@@ -31,38 +31,33 @@ function update_script() {
  fi
  if check_for_gh_release "lychee" "LycheeOrg/Lychee"; then
    PHP_VER=$(php -r 'echo PHP_MAJOR_VERSION . "." . PHP_MINOR_VERSION;')
    msg_info "Stopping Services"
-    systemctl stop caddy php${PHP_VER}-fpm
+    systemctl stop caddy
    msg_ok "Stopped Services"
-    create_backup /opt/lychee/.env \
+    msg_info "Backing up Data"
-      /opt/lychee/storage \
+    cp /opt/lychee/.env /opt/lychee.env.bak
-      /opt/lychee/public/uploads \
+    cp -r /opt/lychee/storage /opt/lychee_storage_backup
-      /opt/lychee/public/dist
+    msg_ok "Backed up Data"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "lychee" "LycheeOrg/Lychee" "prebuild" "latest" "/opt/lychee" "Lychee.zip"
-    restore_backup
+    msg_info "Restoring Data"
    cp /opt/lychee.env.bak /opt/lychee/.env
    rm -f /opt/lychee.env.bak
    cp -r /opt/lychee_storage_backup/. /opt/lychee/storage
    rm -rf /opt/lychee_storage_backup
    msg_ok "Restored Data"
    msg_info "Updating Application"
    cd /opt/lychee
    $STD php artisan migrate --force
    $STD php artisan config:clear
    $STD php artisan cache:clear
    $STD php artisan optimize:clear
-    $STD php artisan optimize
+    chmod -R 775 /opt/lychee/storage /opt/lychee/bootstrap/cache
    chown -R www-data:www-data /opt/lychee
    chmod -R 775 /opt/lychee/storage /opt/lychee/bootstrap/cache \
      /opt/lychee/public/dist /opt/lychee/public/uploads
    if [[ "${VERBOSE:-no}" = "yes" ]]; then
      php artisan lychee:diagnostics || true
    fi
    msg_ok "Updated Application"
    msg_info "Starting Services"
-    systemctl start caddy php${PHP_VER}-fpm
+    systemctl start caddy
    msg_ok "Started Services"
    msg_ok "Updated successfully!"
  fi
@@ -45,7 +45,7 @@ EOF
    systemctl daemon-reload
  fi
-  $STD npm install -g n8n@latest
+  $STD npm install -g n8n@2.27.5
  systemctl restart n8n
  msg_ok "Updated n8n"
  msg_ok "Updated successfully!"
@@ -1,66 +0,0 @@
 #!/usr/bin/env bash
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: Mathias Wagner (gnmyt)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://nexterm.dev/
 APP="Nexterm"
 var_tags="${var_tags:-server-management}"
 var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-6}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 header_info "$APP"
 variables
 color
 catch_errors
 function update_script() {
  header_info
  check_container_storage
  check_container_resources
  if [[ ! -f /opt/nexterm/server/nexterm-server ]]; then
    msg_error "No ${APP} Installation Found!"
    exit
  fi
  if check_for_gh_release "nexterm-engine" "gnmyt/Nexterm"; then
    msg_info "Stopping nexterm-engine"
    systemctl stop nexterm-engine
    msg_ok "Stopped nexterm-engine"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "nexterm-engine" "gnmyt/Nexterm" "prebuild" "latest" "/opt/nexterm/engine" "nexterm-engine-linux-$(arch_resolve "x64" "arm64").tar.gz"
    msg_info "Starting nexterm-engine"
    systemctl start nexterm-engine
    msg_ok "Started nexterm-engine"
  fi
  if check_for_gh_release "nexterm-server" "gnmyt/Nexterm"; then
    msg_info "Stopping nexterm-server"
    systemctl stop nexterm-server
    msg_ok "Stopped nexterm-server"
    fetch_and_deploy_gh_release "nexterm-server" "gnmyt/Nexterm" "singlefile" "latest" "/opt/nexterm/server" "nexterm-server-linux-$(arch_resolve "x64" "arm64")"
    msg_info "Starting nexterm-server"
    systemctl start nexterm-server
    msg_ok "Started nexterm-server"
  fi
  exit
 }
 start
 build_container
 description
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
 echo -e "${GATEWAY}${BGN}http://${IP}:6989${CL}"
@@ -1,64 +0,0 @@
 #!/usr/bin/env bash
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://github.com/gamosoft/NoteDiscovery
 APP="NoteDiscovery"
 var_tags="${var_tags:-notes;wiki;knowledge-base}"
 var_cpu="${var_cpu:-1}"
 var_ram="${var_ram:-512}"
 var_disk="${var_disk:-4}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 header_info "$APP"
 variables
 color
 catch_errors
 function update_script() {
  header_info
  check_container_storage
  check_container_resources
  if [[ ! -d /opt/notediscovery ]]; then
    msg_error "No ${APP} Installation Found!"
    exit
  fi
  if check_for_gh_release "notediscovery" "gamosoft/NoteDiscovery"; then
    msg_info "Stopping Service"
    systemctl stop notediscovery
    msg_ok "Stopped Service"
    create_backup /opt/notediscovery/data /opt/notediscovery/config.yaml
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "notediscovery" "gamosoft/NoteDiscovery" "tarball"
    msg_info "Syncing Dependencies"
    cd /opt/notediscovery
    $STD uv sync --no-dev
    msg_ok "Synced Dependencies"
    restore_backup
    msg_info "Starting Service"
    systemctl start notediscovery
    msg_ok "Started Service"
    msg_ok "Updated successfully!"
  fi
  exit
 }
 start
 build_container
 description
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
 echo -e "${GATEWAY}${BGN}http://${IP}:8000${CL}"
@@ -30,7 +30,7 @@ function update_script() {
    exit
  fi
-  RELEASE="v7.3.0"
+  RELEASE="v7.2.1"
  if check_for_gh_release "OpenCloud" "opencloud-eu/opencloud" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
    msg_info "Stopping services"
    systemctl stop opencloud opencloud-wopi
@@ -1,85 +0,0 @@
 #!/usr/bin/env bash
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: vhsdream
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://github.com/DioCrafts/OxiCloud
 APP="OxiCloud"
 var_tags="${var_tags:-files;documents}"
 var_cpu="${var_cpu:-4}"
 var_ram="${var_ram:-6144}"
 var_disk="${var_disk:-20}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 header_info "$APP"
 variables
 color
 catch_errors
 function update_script() {
  header_info
  check_container_storage
  check_container_resources
  if [[ ! -d /opt/oxicloud ]]; then
    msg_error "No ${APP} Installation Found!"
    exit
  fi
  if check_for_gh_release "OxiCloud" "DioCrafts/OxiCloud"; then
    msg_info "Stopping OxiCloud"
    systemctl stop oxicloud
    msg_ok "Stopped OxiCloud"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "OxiCloud" "DioCrafts/OxiCloud" "tarball" "latest" "/opt/oxicloud"
    TOOLCHAIN="$(grep -oP 'FROM\s+rust:\K[0-9]+\.[0-9]+(\.[0-9]+)?' /opt/oxicloud/Dockerfile | head -1)"
    RUST_TOOLCHAIN="${TOOLCHAIN:-stable}" setup_rust
    msg_info "Building Frontend SPA"
    cd /opt/oxicloud/frontend
    $STD npm ci
    $STD npm run build
    msg_ok "Built Frontend SPA"
    msg_info "Updating OxiCloud (Patience)"
    set -a
    source /etc/oxicloud/.env
    set +a
    cd /opt/oxicloud
    export DATABASE_URL
    export RUSTFLAGS="-C target-cpu=native"
    RAM_MB=$(awk '/MemTotal/ {print int($2/1024)}' /proc/meminfo)
    CARGO_JOBS=$((RAM_MB / 2560))
    [[ $CARGO_JOBS -lt 1 ]] && CARGO_JOBS=1
    [[ $CARGO_JOBS -gt $(nproc) ]] && CARGO_JOBS=$(nproc)
    $STD cargo build --release -j "$CARGO_JOBS" --bin oxicloud --bin migrate-nfc-filenames
    mv target/release/oxicloud /usr/local/bin/oxicloud
    mv target/release/migrate-nfc-filenames /usr/local/bin/migrate-nfc-filenames
    chmod +x /usr/local/bin/oxicloud /usr/local/bin/migrate-nfc-filenames
    rm -f /usr/bin/oxicloud
    rm -rf /opt/oxicloud/static
    mv /opt/oxicloud/static-dist /opt/oxicloud/static
    rm -rf /opt/oxicloud/target /opt/oxicloud/frontend/node_modules
    msg_ok "Updated OxiCloud"
    msg_info "Starting OxiCloud"
    systemctl start oxicloud
    msg_ok "Started OxiCloud"
    msg_ok "Updated successfully!"
  fi
  exit
 }
 start
 build_container
 description
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
 echo -e "${GATEWAY}${BGN}http://${IP}:8086${CL}"
@@ -6,7 +6,7 @@ source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxV
 # Source: https://pangolin.net/ | Github: https://github.com/fosrl/pangolin
 APP="Pangolin"
-PANGOLIN_VERSION="${PANGOLIN_VERSION:-1.20.0}"
+PANGOLIN_VERSION="${PANGOLIN_VERSION:-1.18.4}"
 var_tags="${var_tags:-proxy}"
 var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-4096}"
@@ -33,15 +33,6 @@ function update_script() {
  ensure_dependencies build-essential python3
  if ! command -v psql &>/dev/null; then
    msg_error "This installation uses SQLite and cannot be upgraded to Pangolin ${PANGOLIN_VERSION}."
    echo -e "${INFO}${YW}Starting with Pangolin 1.20.0, PostgreSQL is required as the database backend.${CL}"
    echo -e "${INFO}${YW}An automatic migration of your existing SQLite data is not supported.${CL}"
    echo -e "${INFO}${YW}Please create a new LXC with the Pangolin install script, which sets up PostgreSQL automatically.${CL}"
    echo -e "${INFO}${YW}Your current data is preserved in this container and can be manually migrated if needed.${CL}"
    exit 1
  fi
  NODE_VERSION="24" setup_nodejs
  if check_for_gh_release "pangolin" "fosrl/pangolin" "$PANGOLIN_VERSION" "Pinned to a tested release because Pangolin's schema changes have repeatedly broken unattended updates. To try a newer version at your own risk, run: 'export PANGOLIN_VERSION=<tag>' and re-run update. If it breaks, please open an issue at https://github.com/community-scripts/ProxmoxVE/issues with the error log."; then
@@ -50,8 +41,13 @@ function update_script() {
    systemctl stop gerbil
    msg_info "Service stopped"
-    DB_URL=$(sed -n 's/.*connection_string: "\(.*\)".*/\1/p' /opt/pangolin/config/config.yml)
+    msg_info "Creating backup"
-    create_backup /opt/pangolin/config
+    tar -czf /opt/pangolin_config_backup.tar.gz -C /opt/pangolin config
    if [[ -f /opt/pangolin/config/db/db.sqlite ]]; then
      cp -a /opt/pangolin/config/db/db.sqlite \
        "/opt/pangolin/config/db/db.sqlite.pre-${PANGOLIN_VERSION}-$(date +%Y%m%d-%H%M%S).bak"
    fi
    msg_ok "Created backup"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "pangolin" "fosrl/pangolin" "tarball" "$PANGOLIN_VERSION"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "gerbil" "fosrl/gerbil" "singlefile" "latest" "/usr/bin" "gerbil_linux_$(arch_resolve)"
@@ -59,21 +55,23 @@ function update_script() {
    msg_info "Updating Pangolin"
    cd /opt/pangolin
    $STD npm ci
-    $STD npm run set:pg
+    $STD npm run set:sqlite
    $STD npm run set:oss
    rm -rf server/private
-    DATABASE_URL="$DB_URL" $STD npm run db:generate
+    $STD npm run db:generate
    $STD npm run build
    $STD npm run build:cli
    cp -R .next/standalone ./
    cp -r server/migrations ./dist/init
    chmod +x ./dist/cli.mjs
    cp server/db/names.json ./dist/names.json
    cp server/db/ios_models.json ./dist/ios_models.json
    cp server/db/mac_models.json ./dist/mac_models.json
    msg_ok "Updated Pangolin"
-    restore_backup
+    msg_info "Restoring config"
    tar -xzf /opt/pangolin_config_backup.tar.gz -C /opt/pangolin --overwrite
    rm -f /opt/pangolin_config_backup.tar.gz
    msg_ok "Restored config"
    if ! grep -q '^ExecStartPre=/usr/bin/node dist/migrations.mjs' /etc/systemd/system/pangolin.service 2>/dev/null; then
      msg_info "Adding migration step to pangolin.service"
@@ -84,8 +82,13 @@ function update_script() {
    msg_info "Running database migrations"
    cd /opt/pangolin
    SQLITE_DB="/opt/pangolin/config/db/db.sqlite"
    if [[ -f "$SQLITE_DB" ]]; then
      if ! sqlite3 "$SQLITE_DB" ".tables" 2>/dev/null | tr ' ' '\n' | grep -qx "statusHistory"; then
        sqlite3 "$SQLITE_DB" "DELETE FROM versionMigrations;" 2>/dev/null || true
      fi
    fi
    ENVIRONMENT=prod $STD node dist/migrations.mjs
    msg_ok "Ran database migrations"
    msg_info "Updating Badger plugin version"
@@ -109,4 +112,4 @@ description
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}https://<YOUR_PANGOLIN_URL> or http://${IP}:3002${CL}"
+echo -e "${GATEWAY}${BGN}https://<YOUR_PANGOLIN_URL>${CL}"
@@ -28,12 +28,6 @@ function update_script() {
    msg_error "No ${APP} Installation Found!"
    exit
  fi
  setup_deb822_repo \
  "sftpgo" \
  "https://oss.sftpgo.com/apt/gpg.key" \
  "https://oss.sftpgo.com/apt" \
  "trixie"
  msg_info "Updating SFTPGo"
  $STD apt update
@@ -30,63 +30,19 @@ function update_script() {
    exit
  fi
-  NEEDS_V2_MIGRATION=false
+  if check_for_gh_release "snapotter" "snapotter-hq/SnapOtter"; then
  grep -q '^DB_PATH=' /opt/snapotter_data/.env 2>/dev/null && NEEDS_V2_MIGRATION=true
  UPDATE_AVAILABLE=false
  check_for_gh_release "snapotter" "snapotter-hq/SnapOtter" && UPDATE_AVAILABLE=true
  if [[ "$NEEDS_V2_MIGRATION" == true || "$UPDATE_AVAILABLE" == true ]]; then
    msg_info "Stopping Service"
    systemctl stop snapotter
    msg_ok "Stopped Service"
-    PG_VERSION="17" setup_postgresql
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "snapotter" "snapotter-hq/SnapOtter" "tarball"
    if ! sudo -u postgres psql -tAc "SELECT 1 FROM pg_database WHERE datname = 'snapotter'" | grep -qx '1'; then
      PG_DB_NAME="snapotter" PG_DB_USER="snapotter" setup_postgresql_db
    else
      PG_DB_NAME="snapotter"
      PG_DB_USER="snapotter"
      PG_DB_PASS=$(sed -n 's|^DATABASE_URL=postgres://snapotter:\([^@]*\)@.*|\1|p' /opt/snapotter_data/.env | head -n1)
      if [[ -z "$PG_DB_PASS" ]]; then
        msg_error "SnapOtter's PostgreSQL database exists, but its password is not available in /opt/snapotter_data/.env"
        exit 1
      fi
    fi
    msg_info "Installing Redis"
    $STD apt install -y redis-server
    if grep -q '^appendonly ' /etc/redis/redis.conf; then
      sed -i 's/^appendonly .*/appendonly yes/' /etc/redis/redis.conf
    else
      echo 'appendonly yes' >>/etc/redis/redis.conf
    fi
    $STD systemctl enable --now redis-server
    msg_ok "Installed Redis"
    msg_info "Migrating SnapOtter Configuration"
    sed -i '/^DB_PATH=/d; /^DATABASE_URL=/d; /^REDIS_URL=/d; /^SQLITE_MIGRATE_PATH=/d' /opt/snapotter_data/.env
    cat <<EOF >>/opt/snapotter_data/.env
 DATABASE_URL=postgres://${PG_DB_USER}:${PG_DB_PASS}@127.0.0.1:5432/${PG_DB_NAME}
 REDIS_URL=redis://127.0.0.1:6379
 EOF
    if [[ -f /opt/snapotter_data/snapotter.db ]]; then
      echo 'SQLITE_MIGRATE_PATH=/opt/snapotter_data/snapotter.db' >>/opt/snapotter_data/.env
    fi
    if ! grep -q '^Requires=postgresql.service redis-server.service$' /etc/systemd/system/snapotter.service; then
      sed -i '/^After=/c\After=network-online.target postgresql.service redis-server.service' /etc/systemd/system/snapotter.service
      sed -i '/^\[Unit\]/a Wants=network-online.target\nRequires=postgresql.service redis-server.service' /etc/systemd/system/snapotter.service
    fi
    systemctl daemon-reload
    msg_ok "Migrated SnapOtter Configuration"
    if [[ "$UPDATE_AVAILABLE" == true ]]; then
      CLEAN_INSTALL=1 fetch_and_deploy_gh_release "snapotter" "snapotter-hq/SnapOtter" "prebuild" "latest" "/opt/snapotter" "snapotter-*-linux-amd64.tar.gz"
    fi
    msg_info "Updating SnapOtter"
-    $STD uv python install 3.11
+    cd /opt/snapotter
-    $STD uv venv --seed --python 3.11 /opt/snapotter_data/ai/venv
+    $STD npm pkg delete scripts.prepare
-    ln -sfn /opt/snapotter /app
+    $STD pnpm install --frozen-lockfile
    $STD pnpm --filter @snapotter/web build
    sed -i 's/mediapipe==0.10.21/mediapipe>=0.10.21/' /opt/snapotter/docker/feature-manifest.json
    msg_ok "Updated SnapOtter"
    msg_info "Starting Service"
@@ -1,65 +0,0 @@
 #!/usr/bin/env bash
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://github.com/Sync-in/server
 APP="Sync-in"
 var_tags="${var_tags:-files;sync;collaboration}"
 var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-20}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 header_info "$APP"
 variables
 color
 catch_errors
 function update_script() {
  header_info
  check_container_storage
  check_container_resources
  if [[ ! -d /opt/sync-in/node_modules/@sync-in ]]; then
    msg_error "No ${APP} Installation Found!"
    exit
  fi
  if check_for_gh_release "sync-in" "Sync-in/server"; then
    msg_info "Stopping Service"
    systemctl stop sync-in
    msg_ok "Stopped Service"
    msg_info "Updating Sync-in"
    $STD npm install --prefix /opt/sync-in "@sync-in/server@${CHECK_UPDATE_RELEASE#v}"
    msg_ok "Updated Sync-in"
    msg_info "Running Database Migrations"
    cd /opt/sync-in
    $STD npx sync-in-server migrate-db
    msg_ok "Ran Database Migrations"
    VERSION=$(node -pe "require('/opt/sync-in/node_modules/@sync-in/server/package.json').version" 2>/dev/null || echo "")
    [[ -n "$VERSION" ]] && echo "$VERSION" >~/.sync-in
    msg_info "Starting Service"
    systemctl start sync-in
    msg_ok "Started Service"
    msg_ok "Updated successfully!"
  fi
  exit
 }
 start
 build_container
 description
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
 echo -e "${GATEWAY}${BGN}http://${IP}:8080${CL}"
@@ -30,14 +30,12 @@ function update_script() {
    exit
  fi
-  if check_for_gh_release "wanderer" "open-wanderer/wanderer"; then
+  if check_for_gh_release "wanderer" "Flomp/wanderer"; then
    msg_info "Stopping service"
    systemctl stop wanderer-web
    msg_ok "Stopped service"
-    create_backup /opt/wanderer/source/search
+    fetch_and_deploy_gh_release "wanderer" "open-wanderer/wanderer" "tarball" "latest" "/opt/wanderer/source"
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "wanderer" "open-wanderer/wanderer" "tarball" "latest" "/opt/wanderer/source"
    restore_backup
    msg_info "Updating wanderer"
    cd /opt/wanderer/source/db
@@ -46,13 +44,6 @@ function update_script() {
    cd /opt/wanderer/source/web
    $STD npm ci
    $STD npm run build
    mkdir -p /opt/wanderer/data/plugins
    [[ -e /data/plugins ]] || ln -sfn /opt/wanderer/data/plugins /data/plugins
    msg_info "Installing wanderer plugins"
    for plugin in hammerhead komoot strava; do
      fetch_and_deploy_gh_release "wanderer-plugin-${plugin}" "open-wanderer/wanderer" "prebuild" "${CHECK_UPDATE_RELEASE:-latest}" "/opt/wanderer/data/plugins" "wanderer-plugin-${plugin}.tar.gz" || msg_warn "Failed to install wanderer plugin: ${plugin}"
    done
    msg_ok "Installed wanderer plugins"
    msg_ok "Updated wanderer"
    msg_info "Starting service"
@@ -1,64 +0,0 @@
 #!/usr/bin/env bash
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://github.com/ulsklyc/yuvomi
 APP="Yuvomi"
 var_tags="${var_tags:-family;planner;calendar}"
 var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-1024}"
 var_disk="${var_disk:-8}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 header_info "$APP"
 variables
 color
 catch_errors
 function update_script() {
  header_info
  check_container_storage
  check_container_resources
  if [[ ! -d /opt/yuvomi ]]; then
    msg_error "No ${APP} Installation Found!"
    exit
  fi
  if check_for_gh_release "yuvomi" "ulsklyc/yuvomi"; then
    msg_info "Stopping Service"
    systemctl stop yuvomi
    msg_ok "Stopped Service"
    create_backup /opt/yuvomi/data /opt/yuvomi/.env
    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "yuvomi" "ulsklyc/yuvomi" "tarball"
    msg_info "Installing Node.js Dependencies"
    cd /opt/yuvomi
    $STD npm ci --omit=dev
    msg_ok "Installed Node.js Dependencies"
    restore_backup
    msg_info "Starting Service"
    systemctl start yuvomi
    msg_ok "Started Service"
    msg_ok "Updated successfully!"
  fi
  exit
 }
 start
 build_container
 description
 msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
 echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"
@@ -43,7 +43,6 @@ $STD php artisan migrate:refresh
 $STD php artisan passport:install -q -n
 $STD php artisan storage:link
 $STD php artisan config:cache
 $STD php artisan 2fauth:fix-passport-key-permissions
 chown -R www-data: /opt/2fauth
 chmod -R 755 /opt/2fauth
 msg_ok "Setup 2fauth"
@@ -22,8 +22,7 @@ $STD apt install -y \
  libssl-dev \
  libjemalloc2 \
  redis-server \
-  nginx \
+  nginx
  cmake
 msg_ok "Installed Dependencies"
 PG_VERSION="16" PG_MODULES="pgvector" setup_postgresql
@@ -31,7 +30,7 @@ PG_DB_NAME="affine" PG_DB_USER="affine" setup_postgresql_db
 NODE_VERSION="22" setup_nodejs
 setup_rust
-fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "v0.27.0" "/opt/affine"
+fetch_and_deploy_gh_release "affine_app" "toeverything/AFFiNE" "tarball" "latest" "/opt/affine"
 msg_info "Setting up Directories"
 rm -rf /root/.affine
@@ -60,12 +59,11 @@ export PATH="/root/.cargo/bin:$PATH"
 export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
 export VITE_CORE_COMMIT_SHA=$(cat ~/.affine_app)
 # # Initialize git repo (required for build process)
 export HUSKY=0
 $STD git init -q
 $STD git config user.email "build@local"
 $STD git config user.name "Build"
 $STD git add -A
-$STD git commit -q -m "update" --no-verify --allow-empty
+$STD git commit -q -m "initial"
 mkdir -p /opt/affine/.turbo
 cat <<TURBO >/opt/affine/.turbo/config.json
 {
@@ -73,7 +71,7 @@ cat <<TURBO >/opt/affine/.turbo/config.json
 }
 TURBO
 $STD corepack enable
-$STD corepack prepare yarn@4.13.0 --activate
+$STD corepack prepare yarn@4.12.0 --activate
 $STD yarn config set enableTelemetry 0
 export NODE_OPTIONS="--max-old-space-size=4096"
 export TSC_COMPILE_ON_ERROR=true
@@ -1,53 +0,0 @@
 #!/usr/bin/env bash
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://github.com/daya0576/beaverhabits
 source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
 color
 verb_ip6
 catch_errors
 setting_up_container
 network_check
 update_os
 PYTHON_VERSION="3.14" setup_uv
 fetch_and_deploy_gh_release "beaverhabits" "daya0576/beaverhabits" "tarball"
 msg_info "Installing Dependencies"
 cd /opt/beaverhabits
 $STD uv sync --no-dev
 msg_ok "Installed Dependencies"
 msg_info "Configuring BeaverHabits"
 mkdir -p /opt/beaverhabits/.user
 msg_ok "Configured BeaverHabits"
 msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/beaverhabits.service
 [Unit]
 Description=BeaverHabits Habit Tracker
 After=network.target
 [Service]
 Type=simple
 User=root
 WorkingDirectory=/opt/beaverhabits
 Environment=HABITS_STORAGE=USER_DISK
 Environment=NICEGUI_STORAGE_PATH=/opt/beaverhabits/.user/.nicegui
 ExecStart=/opt/beaverhabits/.venv/bin/gunicorn beaverhabits.main:app --bind 0.0.0.0:8080 -w 1 -k uvicorn_worker.UvicornWorker --max-requests 10000 --log-level info
 Restart=on-failure
 RestartSec=5
 [Install]
 WantedBy=multi-user.target
 EOF
 systemctl enable -q --now beaverhabits
 msg_ok "Created Service"
 motd_ssh
 customize
 cleanup_lxc
@@ -21,7 +21,7 @@ $STD apt install -y \
  ffmpeg
 msg_ok "Installed Dependencies"
-fetch_and_deploy_gh_release "birdnet" "tphakala/birdnet-go" "prebuild" "latest" "/opt/birdnet" "birdnet-go-linux-$(arch_resolve)*.tar.gz"
+fetch_and_deploy_gh_release "birdnet" "tphakala/birdnet-go" "prebuild" "latest" "/opt/birdnet" "birdnet-go-linux-$(arch_resolve).tar.gz"
 msg_info "Setting up BirdNET-Go"
 cp /opt/birdnet/birdnet-go /usr/local/bin/birdnet-go
@@ -23,8 +23,6 @@ $STD apt install -y \
  libreadline-dev \
  zlib1g-dev \
  libffi-dev \
  libleptonica-dev \
  libleptonica6 \
  libvips42 \
  libvips-dev \
  libheif1 \
@@ -14,8 +14,7 @@ network_check
 update_os
 msg_info "Installing Dependencies"
-$STD apt install -y git \
+$STD apt install -y git
  libusb-1.0-0
 msg_ok "Installed Dependencies"
 PYTHON_VERSION="3.12" setup_uv
@@ -55,12 +55,9 @@ if [[ "$install_server" =~ ^[Ss]$ ]]; then
  msg_ok "Installed FileFlows Server"
 else
  msg_info "Installing FileFlows Node"
  read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url
  while [[ -z "${server_url// /}" ]]; do
    read -r -p "${TAB3}Enter FileFlows Server URL (e.g. http://192.168.1.10:19200): " server_url
  done
  cd /opt/fileflows/Node
-  $STD dotnet FileFlows.Node.dll --server "$server_url" --systemd install --root true
+  $STD dotnet FileFlows.Node.dll
  $STD dotnet FileFlows.Node.dll --systemd install --root true
  systemctl enable -q --now fileflows-node
  msg_ok "Installed FileFlows Node"
 fi
@@ -1,111 +0,0 @@
 #!/usr/bin/env bash
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: Raffaele (rafspiny)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://getgrav.org/
 source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
 color
 verb_ip6
 catch_errors
 setting_up_container
 network_check
 update_os
 msg_info "Installing Dependencies"
 $STD apt install -y \
  nginx \
  logrotate
 msg_ok "Installed Dependencies"
 PHP_FPM="YES" setup_php
 fetch_and_deploy_gh_release "grav" "getgrav/grav" "prebuild" "latest" "/opt/grav" "grav-admin-v*zip"
 chown -R www-data:www-data /opt/grav
 msg_info "Configuring Nginx"
 PHP_VER=$(php -r 'echo PHP_MAJOR_VERSION . "." . PHP_MINOR_VERSION;')
 PHP_FPM_SOCK=$(find /run/php -maxdepth 1 -name "php*-fpm.sock" -type s | sort -V | tail -1)
 unlink /etc/nginx/sites-enabled/default
 rm -f /etc/nginx/sites-available/default
 cat <<EOF >/etc/nginx/sites-available/grav
 server {
    listen 80;
    server_name _;
    root /opt/grav;
    index index.html index.htm index.php;
    location / {
        try_files \$uri \$uri/ /index.html /index.htm /index.php\$is_args\$args;
    }
    ## Begin - Security
    location ~* /(\.git|cache|bin|logs|backup|tests)/.*$ { return 403; }
    location ~* /(system|vendor)/.*\.(txt|xml|md|html|json|yaml|yml|php|pl|py|cgi|twig|sh|bat)$ { return 403; }
    location ~* /user/.*\.(txt|md|json|yaml|yml|php|pl|py|cgi|twig|sh|bat)$ { return 403; }
    location ~ /(LICENSE\.txt|composer\.lock|composer\.json|nginx\.conf|web\.config|htaccess\.txt|\.htaccess) { return 403; }
    ## End - Security
    ## Begin - API
    location ^~ /api/ {
        try_files \$uri \$uri/ /index.php\$is_args\$args;
    }
    ## End - API
    # deny all direct access to these sensitive user folders, whatever the file type
    location ~* /user/(accounts|config|env)/.*$ { return 403; }
    # allow public media uploads under user/data to be served directly;
    # this must come before the user/data deny so it wins the match
    location ~* /user/data/.*\.(jpe?g|png|gif|webp|avif|bmp|ico|mp4|webm|ogg|ogv|mov|mp3|wav|m4a|flac|pdf)$ { try_files \$uri =404; }
    # deny everything else under user/data
    location ~* /user/data/.*$ { return 403; }
    ## Begin - Caching
    location ~* ^/forms-basic-captcha-image.jpg$ {
        try_files \$uri \$uri/ /index.php\$is_args\$args;
    }
    location ~* \.(?:ico|css|js|gif|jpe?g|png)$ {
        expires 30d;
        add_header Vary Accept-Encoding;
        log_not_found off;
    }
    location ~* ^.+\.(?:css|cur|js|jpe?g|gif|htc|ico|png|html|xml|otf|ttf|eot|woff|woff2|svg)$ {
        access_log off;
        expires 30d;
        add_header Cache-Control public;
        tcp_nodelay off;
        open_file_cache max=3000 inactive=120s;
        open_file_cache_valid 45s;
        open_file_cache_min_uses 2;
        open_file_cache_errors off;
    }
    ## End - Caching
    location ~ ^(.+\.php)(.*)$ {
        fastcgi_split_path_info ^(.+\.php)(.*)$;
        if (!-f \$document_root\$fastcgi_script_name) { return 404; }
        fastcgi_pass unix:${PHP_FPM_SOCK};
        fastcgi_index index.php;
        include /etc/nginx/fastcgi_params;
        fastcgi_param SCRIPT_FILENAME \$document_root\$fastcgi_script_name;
    }
    location ~ /\.ht {
        deny all;
    }
 }
 EOF
 ln -sf /etc/nginx/sites-available/grav /etc/nginx/sites-enabled/grav
 systemctl enable -q --now php${PHP_VER}-fpm
 $STD nginx -t
 systemctl enable -q --now nginx
 $STD nginx -s reload
 msg_ok "Configured Nginx"
 motd_ssh
 customize
 cleanup_lxc
@@ -312,7 +312,7 @@ ML_DIR="${APP_DIR}/machine-learning"
 GEO_DIR="${INSTALL_DIR}/geodata"
 mkdir -p {"${APP_DIR}","${UPLOAD_DIR}","${GEO_DIR}","${INSTALL_DIR}"/cache}
-fetch_and_deploy_gh_release "Immich" "immich-app/immich" "tarball" "v3.0.3" "$SRC_DIR"
+fetch_and_deploy_gh_release "Immich" "immich-app/immich" "tarball" "v3.0.2" "$SRC_DIR"
 PNPM_VERSION="$(jq -r '.packageManager | split("@")[1] | split("+")[0]' ${SRC_DIR}/package.json)"
 export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
 NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs
@@ -1,121 +0,0 @@
 #!/usr/bin/env bash
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: vhsdream
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://github.com/iv-org/invidious
 source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
 color
 verb_ip6
 catch_errors
 setting_up_container
 network_check
 update_os
 msg_info "Installing Dependencies"
 $STD apt install -y \
  build-essential \
  git \
  pkg-config \
  libssl-dev \
  libxml2-dev \
  libyaml-dev \
  libgmp-dev \
  libreadline-dev \
  librsvg2-bin \
  libsqlite3-dev \
  zlib1g-dev \
  libpcre2-dev \
  libevent-dev \
  fonts-open-sans
 msg_ok "Installed Dependencies"
 if [[ "$(arch_resolve amd64 arm64)" == "amd64" ]]; then
  setup_deb822_repo "crystal" "https://download.opensuse.org/repositories/devel:/languages:/crystal/Debian_13/Release.key" "https://download.opensuse.org/repositories/devel:/languages:/crystal/Debian_13/" "./"
  $STD apt install -y crystal
 else
  fetch_and_deploy_gh_release "Crystal" "crystal-lang/crystal" "prebuild" "latest" "/opt/crystal" "crystal-*-linux-aarch64-bundled.tar.gz"
  ln -sf /opt/crystal/bin/crystal /usr/local/bin/crystal
  ln -sf /opt/crystal/bin/shards /usr/local/bin/shards
 fi
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="invidious" PG_DB_USER="invidious" setup_postgresql_db
 fetch_and_deploy_gh_release "Invidious" "iv-org/invidious" "tarball" "latest" "/opt/invidious"
 fetch_and_deploy_gh_release "Invidious Companion" "iv-org/invidious-companion" "prebuild" "latest" "/opt/invidious-companion" "invidious_companion-$(arch_resolve x86_64 aarch64)-unknown-linux-gnu.tar.gz"
 msg_info "Building Invidious"
 cd /opt/invidious
 INVIDIOUS_VERSION="$(cat ~/.invidious 2>/dev/null || echo "unknown")"
 INVIDIOUS_VERSION="${INVIDIOUS_VERSION#v}"
 sed -i \
  -e "s~^\(\s*CURRENT_BRANCH\s*=\).*~\1 \"master\"~" \
  -e "s~^\(\s*CURRENT_COMMIT\s*=\).*~\1 \"\"~" \
  -e "s~^\(\s*CURRENT_VERSION\s*=\).*~\1 \"${INVIDIOUS_VERSION}\"~" \
  -e "s~^\(\s*CURRENT_TAG\s*=\).*~\1 \"${INVIDIOUS_VERSION}\"~" \
  -e "s~^\(\s*ASSET_COMMIT\s*=\).*~\1 \"\"~" \
  src/invidious.cr
 $STD make
 msg_ok "Built Invidious"
 msg_info "Configuring Invidious"
 SECRET_KEY="$(openssl rand -hex 8)"
 HMAC_KEY="$(openssl rand -hex 32)"
 sed -e '\~^db:~,\~dbname:~d' \
  -e "s~^#database_.*~database_url: postgres://${PG_DB_USER}:${PG_DB_PASS}@localhost:5432/${PG_DB_NAME}~" \
  -e 's~^#check_tables.*~check_tables: true~' \
  -e 's~^#invidious_companion:~invidious_companion:~' \
  -e 's~^#  - private_~  - private_~' \
  -e "s~^#invidious_companion_key:.*~invidious_companion_key: \"${SECRET_KEY}\"~" \
  -e "s~^hmac_key:.*~hmac_key: \"${HMAC_KEY}\"~" \
  /opt/invidious/config/config.example.yml >/opt/invidious/config/config.yml
 chmod 600 /opt/invidious/config/config.yml
 cat <<EOF >/etc/logrotate.d/invidious.logrotate
 /opt/invidious/invidious.log {
  rotate 4
  weekly
  notifempty
  missingok
  compress
  minsize 1048576
 }
 EOF
 chmod 0644 /etc/logrotate.d/invidious.logrotate
 msg_ok "Configured Invidious"
 msg_info "Migrating database"
 $STD ./invidious --migrate
 msg_ok "Migrated database"
 msg_info "Configuring services"
 sed -e 's|^User=invidious|User=root|' \
  -e 's|^Group=invidious|Group=root|' \
  -e 's|/home/invidious/invidious|/opt/invidious|g' \
  /opt/invidious/invidious.service >/etc/systemd/system/invidious.service
 mkdir -p /var/tmp/youtubei.js
 cat <<EOF >/etc/systemd/system/invidious-companion.service
 [Unit]
 Description=Invidious Companion
 After=network.target
 [Service]
 Type=simple
 User=root
 WorkingDirectory=/opt/invidious-companion
 Environment=SERVER_SECRET_KEY=${SECRET_KEY}
 Environment=CACHE_DIRECTORY=/var/tmp/youtubei.js
 ExecStart=/opt/invidious-companion/invidious_companion
 Restart=always
 RestartSec=2s
 [Install]
 WantedBy=multi-user.target
 EOF
 systemctl -q enable --now invidious invidious-companion
 msg_ok "Configured services"
 motd_ssh
 customize
 cleanup_lxc
@@ -16,6 +16,7 @@ update_os
 msg_info "Installing Dependencies"
 $STD apt install -y \
  build-essential \
  python3 \
  python3-setuptools \
  graphicsmagick
 msg_ok "Installed Dependencies"
@@ -23,7 +24,7 @@ msg_ok "Installed Dependencies"
 NODE_VERSION="24" setup_nodejs
 msg_info "Installing n8n (Patience)"
-$STD npm install -g n8n@latest
+$STD npm install -g n8n@2.27.5
 msg_ok "Installed n8n"
 msg_info "Creating Service"
@@ -1,85 +0,0 @@
 #!/usr/bin/env bash
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: Mathias Wagner (gnmyt)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://nexterm.dev/
 source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
 color
 verb_ip6
 catch_errors
 setting_up_container
 network_check
 update_os
 fetch_and_deploy_gh_release "nexterm-engine" "gnmyt/Nexterm" "prebuild" "latest" "/opt/nexterm/engine" "nexterm-engine-linux-$(arch_resolve "x64" "arm64").tar.gz"
 fetch_and_deploy_gh_release "nexterm-server" "gnmyt/Nexterm" "singlefile" "latest" "/opt/nexterm/server" "nexterm-server-linux-$(arch_resolve "x64" "arm64")"
 msg_info "Configuring Nexterm"
 LOCAL_ENGINE_TOKEN=$(tr -d '-' </proc/sys/kernel/random/uuid)$(tr -d '-' </proc/sys/kernel/random/uuid)
 ENCRYPTION_KEY=$(tr -d '-' </proc/sys/kernel/random/uuid)$(tr -d '-' </proc/sys/kernel/random/uuid)
 mkdir -p /etc/nexterm-engine /etc/nexterm-server /opt/nexterm/data
 cat <<EOF >/etc/nexterm-engine/config.yaml
 server_host: "127.0.0.1"
 server_port: 7800
 registration_token: "${LOCAL_ENGINE_TOKEN}"
 tls: false
 EOF
 cat <<EOF >/etc/nexterm-server/server.env
 NODE_ENV=production
 SERVER_PORT=6989
 LOCAL_ENGINE_TOKEN=${LOCAL_ENGINE_TOKEN}
 ENCRYPTION_KEY=${ENCRYPTION_KEY}
 EOF
 chmod 0640 /etc/nexterm-engine/config.yaml /etc/nexterm-server/server.env
 msg_ok "Configured Nexterm"
 msg_info "Creating Services"
 cat <<EOF >/etc/systemd/system/nexterm-server.service
 [Unit]
 Description=Nexterm Server
 Documentation=https://docs.nexterm.dev/
 After=network-online.target
 Wants=network-online.target
 [Service]
 Type=simple
 User=root
 WorkingDirectory=/opt/nexterm/data
 EnvironmentFile=/etc/nexterm-server/server.env
 ExecStart=/opt/nexterm/server/nexterm-server
 Restart=on-failure
 RestartSec=5
 [Install]
 WantedBy=multi-user.target
 EOF
 cat <<EOF >/etc/systemd/system/nexterm-engine.service
 [Unit]
 Description=Nexterm Engine
 Documentation=https://docs.nexterm.dev/
 After=network-online.target nexterm-server.service
 Wants=network-online.target
 [Service]
 Type=simple
 User=root
 WorkingDirectory=/etc/nexterm-engine
 Environment=FREERDP_EXTENSION_PATH=/opt/nexterm/engine/lib/freerdp2
 Environment=LD_LIBRARY_PATH=/opt/nexterm/engine/lib
 ExecStart=/opt/nexterm/engine/nexterm-engine
 Restart=on-failure
 RestartSec=5
 [Install]
 WantedBy=multi-user.target
 EOF
 systemctl enable -q --now nexterm-server
 sleep 5
 systemctl enable -q --now nexterm-engine
 msg_ok "Created Services"
 motd_ssh
 customize
 cleanup_lxc
@@ -1,51 +0,0 @@
 #!/usr/bin/env bash
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://github.com/gamosoft/NoteDiscovery
 source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
 color
 verb_ip6
 catch_errors
 setting_up_container
 network_check
 update_os
 setup_uv
 fetch_and_deploy_gh_release "notediscovery" "gamosoft/NoteDiscovery" "tarball"
 msg_info "Installing Dependencies"
 cd /opt/notediscovery
 $STD uv sync --no-dev
 msg_ok "Installed Dependencies"
 msg_info "Configuring NoteDiscovery"
 mkdir -p /opt/notediscovery/data
 msg_ok "Configured NoteDiscovery"
 msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/notediscovery.service
 [Unit]
 Description=NoteDiscovery Knowledge Base
 After=network.target
 [Service]
 Type=simple
 User=root
 WorkingDirectory=/opt/notediscovery
 ExecStart=/opt/notediscovery/.venv/bin/python /opt/notediscovery/run.py
 Restart=on-failure
 RestartSec=5
 [Install]
 WantedBy=multi-user.target
 EOF
 systemctl enable -q --now notediscovery
 msg_ok "Created Service"
 motd_ssh
 customize
 cleanup_lxc
@@ -64,7 +64,7 @@ $STD sudo -u cool coolconfig set-admin-password --user=admin --password="$COOLPA
 echo "$COOLPASS" >~/.coolpass
 msg_ok "Installed Collabora Online"
-fetch_and_deploy_gh_release "OpenCloud" "opencloud-eu/opencloud" "singlefile" "v7.3.0" "/usr/bin" "opencloud-*-linux-$(arch_resolve)"
+fetch_and_deploy_gh_release "OpenCloud" "opencloud-eu/opencloud" "singlefile" "v7.2.1" "/usr/bin" "opencloud-*-linux-$(arch_resolve)"
 mv /usr/bin/OpenCloud /usr/bin/opencloud
 msg_info "Configuring OpenCloud"
@@ -1,88 +0,0 @@
 #!/usr/bin/env bash
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: vhsdream
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://github.com/DioCrafts/OxiCloud
 source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
 color
 verb_ip6
 catch_errors
 setting_up_container
 network_check
 update_os
 msg_info "Installing Dependencies"
 $STD apt install -y build-essential
 msg_ok "Installed Dependencies"
 NODE_VERSION="24" setup_nodejs
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="oxicloud" PG_DB_USER="oxicloud" setup_postgresql_db
 fetch_and_deploy_gh_release "OxiCloud" "DioCrafts/OxiCloud" "tarball" "latest" "/opt/oxicloud"
 TOOLCHAIN="$(grep -oP 'FROM\s+rust:\K[0-9]+\.[0-9]+(\.[0-9]+)?' /opt/oxicloud/Dockerfile | head -1)"
 RUST_TOOLCHAIN="${TOOLCHAIN:-stable}" setup_rust
 msg_info "Building Frontend SPA"
 cd /opt/oxicloud/frontend
 $STD npm ci
 $STD npm run build
 msg_ok "Built Frontend SPA"
 msg_info "Building OxiCloud (Patience)"
 cd /opt/oxicloud
 export DATABASE_URL="postgres://${PG_DB_USER}:${PG_DB_PASS}@localhost/${PG_DB_NAME}"
 export RUSTFLAGS="-C target-cpu=native"
 RAM_MB=$(awk '/MemTotal/ {print int($2/1024)}' /proc/meminfo)
 CARGO_JOBS=$((RAM_MB / 2560))
 [[ $CARGO_JOBS -lt 1 ]] && CARGO_JOBS=1
 [[ $CARGO_JOBS -gt $(nproc) ]] && CARGO_JOBS=$(nproc)
 $STD cargo build --release -j "$CARGO_JOBS" --bin oxicloud --bin migrate-nfc-filenames
 mv target/release/oxicloud /usr/local/bin/oxicloud
 mv target/release/migrate-nfc-filenames /usr/local/bin/migrate-nfc-filenames
 rm -rf /opt/oxicloud/static
 mv /opt/oxicloud/static-dist /opt/oxicloud/static
 rm -rf /opt/oxicloud/target /opt/oxicloud/frontend/node_modules
 msg_ok "Built OxiCloud"
 msg_info "Configuring OxiCloud"
 mkdir -p {/mnt/oxicloud,/etc/oxicloud}
 sed -e 's|OXICLOUD_STORAGE_PATH=.*|OXICLOUD_STORAGE_PATH=/mnt/oxicloud|' \
  -e 's|OXICLOUD_SERVER_HOST=.*|OXICLOUD_SERVER_HOST=0.0.0.0|' \
  -e 's|OXICLOUD_STATIC_PATH=.*|OXICLOUD_STATIC_PATH=/opt/oxicloud/static|' \
  -e "s|^#OXICLOUD_BASE_URL=.*|OXICLOUD_BASE_URL=http://${LOCAL_IP}:8086|" \
  -e "s|OXICLOUD_DB_CONNECTION_STRING=.*|OXICLOUD_DB_CONNECTION_STRING=${DATABASE_URL}|" \
  -e "s|^DATABASE_URL=.*|DATABASE_URL=${DATABASE_URL}|" \
  -e "s|^#OXICLOUD_JWT_SECRET=.*|OXICLOUD_JWT_SECRET=$(openssl rand -hex 32)|" \
  /opt/oxicloud/example.env >/etc/oxicloud/.env
 chmod 600 /etc/oxicloud/.env
 msg_ok "Configured OxiCloud"
 msg_info "Creating OxiCloud Service"
 cat <<EOF >/etc/systemd/system/oxicloud.service
 [Unit]
 Description=OxiCloud Service
 After=network.target postgresql.service
 Requires=postgresql.service
 [Service]
 Type=simple
 User=root
 WorkingDirectory=/opt/oxicloud
 EnvironmentFile=/etc/oxicloud/.env
 ExecStart=/usr/local/bin/oxicloud
 Restart=always
 RestartSec=5
 StandardOutput=journal
 StandardError=journal
 [Install]
 WantedBy=multi-user.target
 EOF
 systemctl enable -q --now oxicloud
 msg_ok "Created OxiCloud Service"
 motd_ssh
 customize
 cleanup_lxc
@@ -16,19 +16,18 @@ update_os
 msg_info "Installing Dependencies"
 $STD apt install -y \
  build-essential \
  python3 \
  sqlite3 \
  iptables
 msg_ok "Installed Dependencies"
 NODE_VERSION="24" setup_nodejs
-PG_VERSION="17" setup_postgresql
+PANGOLIN_VERSION="${PANGOLIN_VERSION:-1.18.4}"
 PG_DB_NAME="pangolin" PG_DB_USER="pangolin" setup_postgresql_db
 PANGOLIN_VERSION="${PANGOLIN_VERSION:-1.20.0}"
 fetch_and_deploy_gh_release "pangolin" "fosrl/pangolin" "tarball" "$PANGOLIN_VERSION"
 fetch_and_deploy_gh_release "gerbil" "fosrl/gerbil" "singlefile" "latest" "/usr/bin" "gerbil_linux_$(arch_resolve)"
 fetch_and_deploy_gh_release "traefik" "traefik/traefik" "prebuild" "latest" "/usr/bin" "traefik_v*_linux_$(arch_resolve).tar.gz"
 read -rp "${TAB3}Enter your Pangolin URL (ex: https://pangolin.example.com): " pango_url
 [[ "$pango_url" != https://* && "$pango_url" != http://* ]] && pango_url="https://${pango_url}"
 read -rp "${TAB3}Enter your email address: " pango_email
 msg_info "Setup Pangolin"
@@ -37,14 +36,13 @@ BADGER_VERSION=$(get_latest_github_release "fosrl/badger" "false")
 cd /opt/pangolin
 mkdir -p /opt/pangolin/config/{traefik,db,letsencrypt,logs}
 $STD npm ci
-$STD npm run set:pg
+$STD npm run set:sqlite
 $STD npm run set:oss
 rm -rf server/private
-DATABASE_URL="postgresql://pangolin:${PG_DB_PASS}@localhost:5432/pangolin" $STD npm run db:generate
+$STD npm run db:generate
 $STD npm run build
 $STD npm run build:cli
 cp -R .next/standalone ./
 cp -r server/migrations ./dist/init
 cat <<EOF >/usr/local/bin/pangctl
 #!/bin/sh
@@ -76,9 +74,6 @@ flags:
  require_email_verification: false
  disable_signup_without_invite: false
  disable_user_create_org: false
 postgres:
  connection_string: "postgresql://pangolin:${PG_DB_PASS}@localhost:5432/pangolin"
 EOF
 cat <<EOF >/opt/pangolin/config/traefik/traefik_config.yml
@@ -186,8 +181,7 @@ http:
        servers:
          - url: "http://$LOCAL_IP:3000"
 EOF
-export ENVIRONMENT=prod
+$STD npm run db:push
 $STD node dist/migrations.mjs
 . /etc/os-release
 if [ "$VERSION_CODENAME" = "trixie" ]; then
@@ -203,8 +197,7 @@ msg_info "Creating Services"
 cat <<EOF >/etc/systemd/system/pangolin.service
 [Unit]
 Description=Pangolin Service
-After=network.target postgresql.service
+After=network.target
 Wants=postgresql.service
 [Service]
 Type=simple
@@ -19,8 +19,8 @@ msg_ok "Installed Dependencies"
 setup_deb822_repo \
  "sftpgo" \
-  "https://oss.sftpgo.com/apt/gpg.key" \
+  "https://ftp.osuosl.org/pub/sftpgo/apt/gpg.key" \
-  "https://oss.sftpgo.com/apt" \
+  "https://ftp.osuosl.org/pub/sftpgo/apt" \
  "trixie"
 msg_info "Installing SFTPGo"
@@ -16,17 +16,6 @@ update_os
 fetch_and_deploy_gh_release "silverbullet" "silverbulletmd/silverbullet" "prebuild" "latest" "/opt/silverbullet/bin" "silverbullet-server-linux-$(arch_resolve "x86_64" "aarch64").zip"
 mkdir -p /opt/silverbullet/space
 RUNTIME_API_ENV=""
 read -rp "${TAB3}Enable Silverbullet Runtime API? Requires Chromium (~700MB). Uses ~200MB extra RAM. (y/N): " runtime_api_prompt
 if [[ "${runtime_api_prompt,,}" =~ ^(y|yes)$ ]]; then
  msg_info "Installing Chromium for Runtime API"
  $STD apt install -y chromium
  msg_ok "Installed Chromium for Runtime API"
  RUNTIME_API_ENV=$'Environment=SB_CHROME_PATH=/usr/bin/chromium\nEnvironment=SB_CHROME_DATA_DIR=/opt/silverbullet/space/.chrome-data\n'
  touch /opt/silverbullet/.runtime-api-enabled
  msg_ok "Runtime API will be enabled"
 fi
 msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/silverbullet.service
 [Unit]
@@ -36,7 +25,6 @@ After=syslog.target network.target
 [Service]
 User=root
 Type=simple
 ${RUNTIME_API_ENV}
 ExecStart=/opt/silverbullet/bin/silverbullet --hostname 0.0.0.0 --port 3000 /opt/silverbullet/space
 WorkingDirectory=/opt/silverbullet
 Restart=on-failure
@@ -39,19 +39,6 @@ msg_ok "Installed Dependencies"
 PYTHON_VERSION="3.11" setup_uv
 NODE_VERSION="22" NODE_MODULE="pnpm" setup_nodejs
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="snapotter" PG_DB_USER="snapotter" setup_postgresql_db
 msg_info "Installing Redis"
 $STD apt install -y redis-server
 if grep -q '^appendonly ' /etc/redis/redis.conf; then
  sed -i 's/^appendonly .*/appendonly yes/' /etc/redis/redis.conf
 else
  echo 'appendonly yes' >>/etc/redis/redis.conf
 fi
 $STD systemctl enable --now redis-server
 msg_ok "Installed Redis"
 fetch_and_deploy_gh_release "caire" "esimov/caire" "prebuild" "latest" "/usr/local/bin" "caire-*-linux-amd64.tar.gz"
 fetch_and_deploy_gh_release "snapotter" "snapotter-hq/SnapOtter" "prebuild" "latest" "/opt/snapotter" "snapotter-*-linux-amd64.tar.gz"
@@ -74,8 +61,7 @@ mkdir -p /tmp/snapotter-workspace
 cat <<EOF >/opt/snapotter_data/.env
 PORT=1349
 NODE_ENV=production
-DATABASE_URL=postgres://${PG_DB_USER}:${PG_DB_PASS}@127.0.0.1:5432/${PG_DB_NAME}
+DB_PATH=/opt/snapotter_data/snapotter.db
 REDIS_URL=redis://127.0.0.1:6379
 WORKSPACE_PATH=/tmp/snapotter-workspace
 FILES_STORAGE_PATH=/opt/snapotter_data/files
 PYTHON_VENV_PATH=/opt/snapotter_data/ai/venv
@@ -99,9 +85,7 @@ PNPM_BIN="$(command -v pnpm)"
 cat <<EOF >/etc/systemd/system/snapotter.service
 [Unit]
 Description=SnapOtter Service
-Wants=network-online.target
+After=network.target
 After=network-online.target postgresql.service redis-server.service
 Requires=postgresql.service redis-server.service
 [Service]
 Type=simple
@@ -115,7 +99,6 @@ RestartSec=5
 [Install]
 WantedBy=multi-user.target
 EOF
 systemctl daemon-reload
 systemctl enable -q --now snapotter
 msg_ok "Created Service"
@@ -1,82 +0,0 @@
 #!/usr/bin/env bash
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://github.com/Sync-in/server
 source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
 color
 verb_ip6
 catch_errors
 setting_up_container
 network_check
 update_os
 NODE_VERSION="22" setup_nodejs
 setup_mariadb
 MARIADB_DB_NAME="sync_in" MARIADB_DB_USER="sync_in" setup_mariadb_db
 msg_info "Installing Sync-in"
 mkdir -p /opt/sync-in/data
 $STD npm install --prefix /opt/sync-in @sync-in/server
 msg_ok "Installed Sync-in"
 msg_info "Configuring Sync-in"
 ENCRYPT_KEY=$(openssl rand -hex 32)
 ACCESS_SECRET=$(openssl rand -hex 32)
 REFRESH_SECRET=$(openssl rand -hex 32)
 cat <<EOF >/opt/sync-in/environment.yaml
 server:
  port: 8080
 mysql:
  url: 'mysql://${MARIADB_DB_USER}:${MARIADB_DB_PASS}@localhost:3306/${MARIADB_DB_NAME}'
 auth:
  encryptionKey: '${ENCRYPT_KEY}'
  token:
    access:
      secret: '${ACCESS_SECRET}'
    refresh:
      secret: '${REFRESH_SECRET}'
 applications:
  files:
    dataPath: '/opt/sync-in/data'
 EOF
 msg_ok "Configured Sync-in"
 msg_info "Running Database Migrations"
 cd /opt/sync-in
 $STD npx sync-in-server migrate-db
 msg_ok "Ran Database Migrations"
 msg_info "Creating Admin User"
 cd /opt/sync-in
 $STD npx sync-in-server create-user
 msg_ok "Created Admin User"
 VERSION=$(node -pe "require('/opt/sync-in/node_modules/@sync-in/server/package.json').version" 2>/dev/null || echo "")
 [[ -n "$VERSION" ]] && echo "$VERSION" >~/.sync-in
 msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/sync-in.service
 [Unit]
 Description=Sync-in Server
 After=network.target mariadb.service
 [Service]
 Type=simple
 User=root
 WorkingDirectory=/opt/sync-in
 ExecStart=/opt/sync-in/node_modules/.bin/sync-in-server start
 Restart=on-failure
 RestartSec=5
 [Install]
 WantedBy=multi-user.target
 EOF
 systemctl enable -q --now sync-in
 msg_ok "Created Service"
 motd_ssh
 customize
 cleanup_lxc
@@ -20,8 +20,7 @@ if [[ "$(arch_resolve)" == "arm64" ]]; then
 else
  fetch_and_deploy_gh_release "meilisearch" "meilisearch/meilisearch" "binary" "latest" "/opt/wanderer/source/search"
 fi
-mkdir -p /opt/wanderer/{source,data/pb_data,data/meili_data,data/plugins}
+mkdir -p /opt/wanderer/{source,data/pb_data,data/meili_data}
 [[ -e /data/plugins ]] || ln -sfn /opt/wanderer/data/plugins /data/plugins
 fetch_and_deploy_gh_release "wanderer" "open-wanderer/wanderer" "tarball" "latest" "/opt/wanderer/source"
 msg_info "Installing wanderer (patience)"
@@ -33,12 +32,6 @@ $STD npm ci
 $STD npm run build
 msg_ok "Installed wanderer"
 msg_info "Installing wanderer plugins"
 for plugin in hammerhead komoot strava; do
  fetch_and_deploy_gh_release "wanderer-plugin-${plugin}" "open-wanderer/wanderer" "prebuild" "latest" "/opt/wanderer/data/plugins" "wanderer-plugin-${plugin}.tar.gz" || msg_warn "Failed to install wanderer plugin: ${plugin}"
 done
 msg_ok "Installed wanderer plugins"
 msg_info "Creating Service"
 MEILI_KEY=$(openssl rand -hex 32)
 POCKETBASE_KEY=$(openssl rand -hex 16)
@@ -47,8 +47,6 @@ msg_ok "Configured Caddy"
 msg_info "Automating Webtrees Setup"
 cd /opt/webtrees
 mkdir -p /opt/webtrees/data
 chown -R www-data:www-data /opt/webtrees/data
 WT_ADMIN_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c15)
 $STD sudo -u www-data php /opt/webtrees/index.php config-ini \
  --dbhost=127.0.0.1 \
@@ -58,15 +56,6 @@ $STD sudo -u www-data php /opt/webtrees/index.php config-ini \
  --dbname=webtrees \
  --tblpfx=wt_ \
  --base-url="http://${LOCAL_IP}"
 msg_info "Initializing Webtrees database schema"
 for i in {1..15}; do
  if curl -sf "http://127.0.0.1/" >/dev/null 2>&1; then
    break
  fi
  sleep 2
 done
 $STD mariadb -u webtrees -p"${MARIADB_DB_PASS}" -h 127.0.0.1 webtrees -e "SHOW TABLES LIKE 'wt_user';" | grep -q wt_user
 msg_ok "Initialized Webtrees database schema"
 $STD sudo -u www-data php /opt/webtrees/index.php user Admin \
  --create \
  --real-name="Administrator" \
@@ -1,72 +0,0 @@
 #!/usr/bin/env bash
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: MickLesk (CanbiZ)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://github.com/ulsklyc/yuvomi
 source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
 color
 verb_ip6
 catch_errors
 setting_up_container
 network_check
 update_os
 msg_info "Installing Dependencies"
 $STD apt install -y \
  python3 \
  make \
  g++ \
  libsqlcipher-dev
 msg_ok "Installed Dependencies"
 NODE_VERSION="22" setup_nodejs
 fetch_and_deploy_gh_release "yuvomi" "ulsklyc/yuvomi" "tarball"
 msg_info "Installing Node.js Dependencies"
 cd /opt/yuvomi
 $STD npm ci --omit=dev
 msg_ok "Installed Node.js Dependencies"
 msg_info "Configuring Yuvomi"
 mkdir -p /opt/yuvomi/data /opt/yuvomi/backups
 SESSION_SECRET=$(openssl rand -hex 32)
 DB_ENCRYPT_KEY=$(openssl rand -hex 32)
 cat <<EOF >/opt/yuvomi/.env
 PORT=3000
 NODE_ENV=production
 DB_PATH=/opt/yuvomi/data/yuvomi.db
 DB_ENCRYPTION_KEY=${DB_ENCRYPT_KEY}
 SESSION_SECRET=${SESSION_SECRET}
 RATE_LIMIT_WINDOW_MS=60000
 RATE_LIMIT_MAX_ATTEMPTS=5
 RATE_LIMIT_BLOCK_DURATION_MS=900000
 EOF
 msg_ok "Configured Yuvomi"
 msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/yuvomi.service
 [Unit]
 Description=Yuvomi Family Planner
 After=network.target
 [Service]
 Type=simple
 User=root
 WorkingDirectory=/opt/yuvomi
 EnvironmentFile=/opt/yuvomi/.env
 ExecStart=/usr/bin/node server/index.js
 Restart=on-failure
 RestartSec=5
 [Install]
 WantedBy=multi-user.target
 EOF
 systemctl enable -q --now yuvomi
 msg_ok "Created Service"
 motd_ssh
 customize
 cleanup_lxc
@@ -1009,7 +1009,6 @@ base_settings() {
  APT_CACHER=${var_apt_cacher:-""}
  APT_CACHER_IP=${var_apt_cacher_ip:-""}
  INHERIT_HOST_CA="${var_inherit_host_ca:-auto}"
  # Runtime check: Verify APT cacher is reachable if configured
  if [[ -n "$APT_CACHER_IP" && "$APT_CACHER" == "yes" ]]; then
@@ -1089,7 +1088,7 @@ load_vars_file() {
  # Allowed var_* keys
  local VAR_WHITELIST=(
-    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_inherit_host_ca var_keyctl
+    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_keyctl
    var_gateway var_hostname var_ipv6_method var_mac var_mknod var_mount_fs var_mtu
    var_net var_nesting var_ns var_os var_protection var_pw var_ram var_tags var_timezone var_tun var_unprivileged
    var_verbose var_version var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage var_searchdomain
@@ -1286,12 +1285,6 @@ load_vars_file() {
            continue
          fi
          ;;
        var_inherit_host_ca)
          if [[ "$var_val" != "yes" && "$var_val" != "no" && "$var_val" != "auto" ]]; then
            msg_warn "Invalid host CA inheritance value '$var_val' in $file (must be yes/no/auto), ignoring"
            continue
          fi
          ;;
        var_container_storage | var_template_storage)
          # Validate that the storage exists and is active on the current node
          local _storage_status
@@ -1331,7 +1324,7 @@ default_var_settings() {
  # Allowed var_* keys (alphabetically sorted)
  # Note: Removed var_ctid (can only exist once), var_ipv6_static (static IPs are unique)
  local VAR_WHITELIST=(
-    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_inherit_host_ca var_keyctl
+    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_keyctl
    var_gateway var_hostname var_ipv6_method var_mac var_mknod var_mount_fs var_mtu
    var_net var_nesting var_ns var_os var_protection var_pw var_ram var_tags var_timezone var_tun var_unprivileged
    var_verbose var_version var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage
@@ -1414,7 +1407,6 @@ var_ssh=no
 # HTTP/HTTPS proxy (optional - for networks requiring a proxy)
 # var_http_proxy=http://proxy.local:8080
 # var_http_no_proxy=localhost,127.0.0.1,.local
 # var_inherit_host_ca=auto
 # Features/Tags/verbosity
 var_fuse=no
@@ -1515,7 +1507,7 @@ get_app_defaults_path() {
 if ! declare -p VAR_WHITELIST >/dev/null 2>&1; then
  # Note: Removed var_ctid (can only exist once), var_ipv6_static (static IPs are unique)
  declare -ag VAR_WHITELIST=(
-    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_inherit_host_ca var_keyctl
+    var_apt_cacher var_apt_cacher_ip var_brg var_cpu var_disk var_fuse var_github_token var_gpu var_http_no_proxy var_http_proxy var_keyctl
    var_gateway var_hostname var_ipv6_method var_mac var_mknod var_mount_fs var_mtu
    var_net var_nesting var_ns var_os var_protection var_pw var_ram var_tags var_timezone var_tun var_unprivileged
    var_verbose var_version var_vlan var_ssh var_ssh_authorized_key var_container_storage var_template_storage var_searchdomain
@@ -1665,7 +1657,6 @@ _build_current_app_vars_tmp() {
  _apt_cacher_ip="${APT_CACHER_IP:-}"
  _http_proxy="${HTTP_PROXY:-${var_http_proxy:-}}"
  _http_no_proxy="${HTTP_NO_PROXY:-${var_http_no_proxy:-}}"
  _inherit_host_ca="${INHERIT_HOST_CA:-${var_inherit_host_ca:-auto}}"
  _fuse="${ENABLE_FUSE:-no}"
  _tun="${ENABLE_TUN:-no}"
  _gpu="${ENABLE_GPU:-no}"
@@ -1719,7 +1710,6 @@ _build_current_app_vars_tmp() {
    [ -n "$_apt_cacher_ip" ] && echo "var_apt_cacher_ip=$(_sanitize_value "$_apt_cacher_ip")"
    [ -n "$_http_proxy" ] && echo "var_http_proxy=$(_sanitize_value "$_http_proxy")"
    [ -n "$_http_no_proxy" ] && echo "var_http_no_proxy=$(_sanitize_value "$_http_no_proxy")"
    [ -n "$_inherit_host_ca" ] && echo "var_inherit_host_ca=$(_sanitize_value "$_inherit_host_ca")"
    [ -n "$_fuse" ] && echo "var_fuse=$(_sanitize_value "$_fuse")"
    [ -n "$_tun" ] && echo "var_tun=$(_sanitize_value "$_tun")"
@@ -1884,7 +1874,7 @@ advanced_settings() {
    TAGS="community-script${var_tags:+;${var_tags}}"
  fi
  local STEP=1
-  local MAX_STEP=31
+  local MAX_STEP=30
  # Store values for back navigation - inherit from var_* app defaults
  local _ct_type="${var_unprivileged:-1}"
@@ -1906,7 +1896,6 @@ advanced_settings() {
  local _apt_cacher_ip="${var_apt_cacher_ip:-}"
  local _http_proxy="${var_http_proxy:-}"
  local _http_no_proxy="${var_http_no_proxy:-}"
  local _inherit_host_ca="${var_inherit_host_ca:-auto}"
  local _mtu="${var_mtu:-}"
  local _sd="${var_searchdomain:-}"
  local _ns="${var_ns:-}"
@@ -2736,47 +2725,9 @@ advanced_settings() {
      ;;
    # ═══════════════════════════════════════════════════════════════════════════
-    # STEP 25: Host CA Inheritance
+    # STEP 25: Container Timezone
    # ═══════════════════════════════════════════════════════════════════════════
    25)
      local host_ca_count=0
      local host_ca_dir="/usr/local/share/ca-certificates"
      local cert
      shopt -s nullglob
      for cert in "$host_ca_dir"/*.crt; do
        host_ca_count=$((host_ca_count + 1))
      done
      shopt -u nullglob
      if [[ $host_ca_count -eq 0 ]]; then
        _inherit_host_ca="auto"
        ((STEP++))
        continue
      fi
      local host_ca_default_flag=""
      [[ "$_inherit_host_ca" == "no" ]] && host_ca_default_flag="--defaultno"
      if whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
        --title "HOST CA INHERITANCE" \
        --ok-button "Next" --cancel-button "Back" \
        $host_ca_default_flag \
        --yesno "\nInherit host CA certificates into this container?\n\nDetected on host: ${host_ca_count} certificate(s) in:\n${host_ca_dir}\n\nRecommended for private PKI / TLS-inspection environments.\n\n(App default: ${var_inherit_host_ca:-auto})" 16 72; then
        _inherit_host_ca="yes"
      else
        if [ $? -eq 1 ]; then
          _inherit_host_ca="no"
        else
          ((STEP--))
          continue
        fi
      fi
      ((STEP++))
      ;;
    # ═══════════════════════════════════════════════════════════════════════════
    # STEP 26: Container Timezone
    # ═══════════════════════════════════════════════════════════════════════════
    26)
      local tz_hint="$_ct_timezone"
      [[ -z "$tz_hint" ]] && tz_hint="(empty - will use host timezone)"
@@ -2799,9 +2750,9 @@ advanced_settings() {
      ;;
    # ═══════════════════════════════════════════════════════════════════════════
-    # STEP 27: Container Protection
+    # STEP 26: Container Protection
    # ═══════════════════════════════════════════════════════════════════════════
-    27)
+    26)
      local protect_default_flag="--defaultno"
      [[ "$_protect_ct" == "yes" || "$_protect_ct" == "1" ]] && protect_default_flag=""
@@ -2823,9 +2774,9 @@ advanced_settings() {
      ;;
    # ═══════════════════════════════════════════════════════════════════════════
-    # STEP 28: Device Node Creation (mknod)
+    # STEP 27: Device Node Creation (mknod)
    # ═══════════════════════════════════════════════════════════════════════════
-    28)
+    27)
      local mknod_default_flag="--defaultno"
      [[ "$_enable_mknod" == "1" ]] && mknod_default_flag=""
@@ -2847,9 +2798,9 @@ advanced_settings() {
      ;;
    # ═══════════════════════════════════════════════════════════════════════════
-    # STEP 29: Mount Filesystems
+    # STEP 28: Mount Filesystems
    # ═══════════════════════════════════════════════════════════════════════════
-    29)
+    28)
      local mount_hint=""
      [[ -n "$_mount_fs" ]] && mount_hint="$_mount_fs" || mount_hint="(none)"
@@ -2870,9 +2821,9 @@ advanced_settings() {
      ;;
    # ═══════════════════════════════════════════════════════════════════════════
-    # STEP 30: Optional host-side post-install hook (path on the Proxmox HOST)
+    # STEP 29: Optional host-side post-install hook (path on the Proxmox HOST)
    # ═══════════════════════════════════════════════════════════════════════════
-    30)
+    29)
      local _hook_prompt="Optional: absolute path to a *.sh file ON THE PROXMOX HOST.
 It runs as root on the HOST (NOT in the LXC) after the container
@@ -2922,9 +2873,9 @@ Leave empty to skip."
      ;;
    # ═══════════════════════════════════════════════════════════════════════════
-    # STEP 31: Verbose Mode & Confirmation
+    # STEP 30: Verbose Mode & Confirmation
    # ═══════════════════════════════════════════════════════════════════════════
-    31)
+    30)
      local verbose_default_flag="--defaultno"
      [[ "$_verbose" == "yes" ]] && verbose_default_flag=""
@@ -2953,7 +2904,6 @@ Leave empty to skip."
      local apt_display="${_apt_cacher:-no}"
      [[ "$_apt_cacher" == "yes" && -n "$_apt_cacher_ip" ]] && apt_display="$_apt_cacher_ip"
      local http_proxy_display="${_http_proxy:-(none)}"
      local inherit_ca_display="${_inherit_host_ca:-auto}"
      local post_install_display="${_post_install:-(none)}"
      local post_install_warn=""
@@ -2984,7 +2934,6 @@ Advanced:
  Timezone: $tz_display
  APT Cacher: $apt_display
  HTTP Proxy: $http_proxy_display
  Inherit Host CAs: $inherit_ca_display
  Verbose: $_verbose
  Post-Install Script: ${post_install_display}${post_install_warn}"
@@ -3030,7 +2979,6 @@ Advanced:
  APT_CACHER_IP="$_apt_cacher_ip"
  HTTP_PROXY="$_http_proxy"
  HTTP_NO_PROXY="$_http_no_proxy"
  INHERIT_HOST_CA="$_inherit_host_ca"
  VERBOSE="$_verbose"
  var_post_install="$_post_install"
@@ -3049,7 +2997,6 @@ Advanced:
  var_sdn_vnet="$_sdn_vnet"
  var_http_proxy="$_http_proxy"
  var_http_no_proxy="$_http_no_proxy"
  var_inherit_host_ca="$_inherit_host_ca"
  # Format optional values
  [[ -n "$_mtu" ]] && MTU=",mtu=$_mtu" || MTU=""
@@ -3806,19 +3753,18 @@ run_addon_updates() {
 }
 runtime_script_status_guard() {
  local mode="${1:-}"
  local script_slug="${SCRIPT_SLUG:-${NSAPP:-}}"
  script_slug="$(echo "$script_slug" | tr '[:upper:]' '[:lower:]' | tr ' ' '-')"
  [[ -z "$script_slug" ]] && return 0
-  local api_url="https://db.community-scripts.org/api/collections/script_scripts/records?filter=(slug='${script_slug}')&perPage=1&fields=slug,is_disabled,is_deleted,disable_message,deleted_message,pinned_version,pin_reason"
+  local api_url="https://db.community-scripts.org/api/collections/script_scripts/records?filter=(slug='${script_slug}')&perPage=1&fields=slug,is_disabled,is_deleted,disable_message,deleted_message"
  local response
  if ! response=$(curl -fsSL --connect-timeout 2 --max-time 3 "$api_url" 2>/dev/null); then
    msg_warn "Script status check is unavailable. Continuing without status verification."
    return 0
  fi
-  local is_deleted is_disabled deleted_message disable_message pinned_version pin_reason info_url
+  local is_deleted is_disabled deleted_message disable_message info_url
  if printf '%s' "$response" | grep -qE '"items":[[:space:]]*\[[[:space:]]*\]'; then
    return 0
  fi
@@ -3828,8 +3774,6 @@ runtime_script_status_guard() {
  is_disabled=$(printf '%s' "$response" | sed -n 's/.*"is_disabled"[[:space:]]*:[[:space:]]*\(true\|false\).*/\1/p' | head -1)
  deleted_message=$(printf '%s' "$response" | sed -n 's/.*"deleted_message"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -1)
  disable_message=$(printf '%s' "$response" | sed -n 's/.*"disable_message"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -1)
  pinned_version=$(printf '%s' "$response" | sed -n 's/.*"pinned_version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -1)
  pin_reason=$(printf '%s' "$response" | sed -n 's/.*"pin_reason"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -1)
  is_deleted=${is_deleted:-false}
  is_disabled=${is_disabled:-false}
  info_url="https://community-scripts.org/scripts/${script_slug}"
@@ -3861,26 +3805,6 @@ runtime_script_status_guard() {
    return 1
  fi
  if [[ "$mode" == "update" && -n "$pinned_version" && -n "${NSAPP:-}" ]]; then
    local current_file="$HOME/.${NSAPP}"
    if [[ -f "$current_file" ]]; then
      local installed pinned_clean installed_clean
      installed="$(<"$current_file")"
      pinned_clean="$pinned_version"
      installed_clean="$installed"
      [[ "$pinned_clean" =~ ^v[0-9] ]] && pinned_clean="${pinned_clean:1}"
      [[ "$installed_clean" =~ ^v[0-9] ]] && installed_clean="${installed_clean:1}"
      if [[ "$installed_clean" == "$pinned_clean" ]]; then
        if [[ -n "$pin_reason" ]]; then
          msg_info "You are already on the pinned version (${pinned_version}). ${pin_reason}"
        else
          msg_info "You are already on the pinned version (${pinned_version}). No newer update is offered intentionally — please do not open an issue unless you see an actual error."
        fi
        msg_info "More info: ${info_url}"
      fi
    fi
  fi
  return 0
 }
@@ -3896,7 +3820,7 @@ runtime_script_status_guard() {
 start() {
  source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/tools.func)
  if command -v pveversion >/dev/null 2>&1; then
-    runtime_script_status_guard install || return 0
+    runtime_script_status_guard || return 0
    install_script || return 0
    return 0
  elif [ ! -z ${PHS_SILENT+x} ] && [[ "${PHS_SILENT}" == "1" ]]; then
@@ -3904,7 +3828,7 @@ start() {
    set_std_mode
    ensure_profile_loaded
    get_lxc_ip
-    runtime_script_status_guard update || return 0
+    runtime_script_status_guard || return 0
    update_script
    run_addon_updates
    update_motd_ip
@@ -3915,7 +3839,7 @@ start() {
    set_std_mode
    ensure_profile_loaded
    get_lxc_ip
-    runtime_script_status_guard update || return 0
+    runtime_script_status_guard || return 0
    update_script
    run_addon_updates
    update_motd_ip
@@ -3945,7 +3869,7 @@ start() {
    esac
    ensure_profile_loaded
    get_lxc_ip
-    runtime_script_status_guard update || return 0
+    runtime_script_status_guard || return 0
    update_script
    run_addon_updates
    update_motd_ip
@@ -3998,81 +3922,6 @@ EOF
  msg_ok "Applied HTTP proxy in container"
 }
 # ------------------------------------------------------------------------------
 # _apply_host_ca_certs_in_container()
 #
 # - Copies administrator-provided CA certificates from the Proxmox host into the
 #   container before base package bootstrap
 # - Source: /usr/local/share/ca-certificates/*.crt (Debian convention)
 # - Refreshes the container trust store when update-ca-certificates is available
 # - No-op when no host certificates are present; failures are non-fatal
 # ------------------------------------------------------------------------------
 _apply_host_ca_certs_in_container() {
  local host_ca_dir="/usr/local/share/ca-certificates"
  [[ -z "${CTID:-}" ]] && return 0
  local inherit_host_ca="${INHERIT_HOST_CA:-${var_inherit_host_ca:-auto}}"
  local -a host_certs=()
  local cert
  shopt -s nullglob
  for cert in "$host_ca_dir"/*.crt; do
    host_certs+=("$cert")
  done
  shopt -u nullglob
  [[ ${#host_certs[@]} -eq 0 ]] && return 0
  case "${inherit_host_ca,,}" in
  no | false | 0 | off)
    msg_warn "Skipping host CA inheritance by configuration (${#host_certs[@]} host certificate(s) available)"
    return 0
    ;;
  esac
  msg_info "Inheriting host CA certificates into container"
  local found=${#host_certs[@]}
  local copied=0
  local skipped=0
  local cert_name
  pct exec "$CTID" -- mkdir -p /usr/local/share/ca-certificates >/dev/null 2>&1 || {
    msg_warn "Failed to create CA certificate directory in container"
    return 0
  }
  for cert in "${host_certs[@]}"; do
    cert_name="$(basename "$cert")"
    if [[ ! -r "$cert" || "$cert_name" != *.crt ]]; then
      msg_warn "Skipping invalid or unreadable host CA certificate: ${cert_name}"
      skipped=$((skipped + 1))
      continue
    fi
    if pct push "$CTID" "$cert" "/usr/local/share/ca-certificates/${cert_name}" >/dev/null 2>&1; then
      pct exec "$CTID" -- chmod 644 "/usr/local/share/ca-certificates/${cert_name}" >/dev/null 2>&1 || true
      copied=$((copied + 1))
    else
      msg_warn "Failed to push host CA certificate: ${cert_name}"
      skipped=$((skipped + 1))
    fi
  done
  if [[ $copied -eq 0 ]]; then
    msg_warn "No host CA certificates were copied (${found} found, ${skipped} skipped)"
    return 0
  fi
  local refresh_shell="bash"
  [[ "$var_os" == "alpine" ]] && refresh_shell="ash"
  if pct exec "$CTID" -- "$refresh_shell" -c 'command -v update-ca-certificates >/dev/null 2>&1 && update-ca-certificates' >/dev/null 2>&1; then
    msg_ok "Inherited ${copied} host CA certificate(s) and updated trust store (${skipped} skipped)"
  else
    msg_warn "Copied ${copied} host CA certificate(s), but trust store update failed or update-ca-certificates is unavailable (${skipped} skipped)"
  fi
 }
 # ------------------------------------------------------------------------------
 # build_container()
 #
@@ -4693,7 +4542,6 @@ EOF
  local install_exit_code=0
  _apply_http_proxy_in_container
  _apply_host_ca_certs_in_container
  # Continue with standard container setup
  if [ "$var_os" == "alpine" ]; then
@@ -2544,7 +2544,7 @@ fetch_and_deploy_gh_tag() {
  mkdir -p "$target"
  if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-    find "${target:?}" -mindepth 1 -delete
+    rm -rf "${target:?}/"*
  fi
  tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
@@ -2737,7 +2737,7 @@ fetch_and_deploy_gl_tag() {
  mkdir -p "$target"
  if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-    find "${target:?}" -mindepth 1 -delete
+    rm -rf "${target:?}/"*
  fi
  tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
@@ -3472,7 +3472,7 @@ fetch_and_deploy_codeberg_release() {
    mkdir -p "$target"
    if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-      find "${target:?}" -mindepth 1 -delete
+      rm -rf "${target:?}/"*
    fi
    tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
@@ -3575,7 +3575,7 @@ fetch_and_deploy_codeberg_release() {
    mkdir -p "$target"
    if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-      find "${target:?}" -mindepth 1 -delete
+      rm -rf "${target:?}/"*
    fi
    tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
@@ -3694,7 +3694,7 @@ fetch_and_deploy_codeberg_release() {
    unpack_tmp=$(mktemp -d)
    mkdir -p "$target"
    if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-      find "${target:?}" -mindepth 1 -delete
+      rm -rf "${target:?}/"*
    fi
    if [[ "$filename" == *.zip ]]; then
@@ -4112,7 +4112,7 @@ fetch_and_deploy_gh_release() {
    mkdir -p "$target"
    if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-      find "${target:?}" -mindepth 1 -delete
+      rm -rf "${target:?}/"*
    fi
    tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
@@ -4292,7 +4292,7 @@ fetch_and_deploy_gh_release() {
    unpack_tmp=$(mktemp -d)
    mkdir -p "$target"
    if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-      find "${target:?}" -mindepth 1 -delete
+      rm -rf "${target:?}/"*
    fi
    if [[ "$filename" == *.zip ]]; then
@@ -4663,20 +4663,20 @@ setup_composer() {
 #   - Cleans up legacy repository files
 #
 # Usage:
-#   setup_docker                              # Uses official Docker repo (recommended)
+#   setup_docker                              # Uses distro package (recommended)
-#   USE_DOCKER_REPO=false setup_docker        # Uses distro docker.io package
+#   USE_DOCKER_REPO=true setup_docker         # Uses official Docker repo
 #   DOCKER_PORTAINER="true" setup_docker
 #   DOCKER_LOG_DRIVER="json-file" setup_docker
 #
 # Variables:
-#   USE_DOCKER_REPO        - Set to "false" to use distro docker.io package
+#   USE_DOCKER_REPO        - Set to "true" to use official Docker repository
-#                            (default: true, uses official Docker repository)
+#                            (default: false, uses distro docker.io package)
 #   DOCKER_PORTAINER       - Install Portainer CE (optional, "true" to enable)
 #   DOCKER_LOG_DRIVER      - Log driver (optional, default: "journald")
 #   DOCKER_SKIP_UPDATES    - Skip container update check (optional, "true" to skip)
 #
 # Features:
-#   - Uses official Docker repository by default
+#   - Uses stable distro packages by default
 #   - Migrates from get.docker.com to repository-based installation
 #   - Updates Docker Engine if newer version available
 #   - Interactive per-container update prompt (Y/N, 60 s auto-no)
@@ -4692,7 +4692,7 @@ _docker_is_noninteractive() {
 setup_docker() {
  local docker_installed=false
  local portainer_installed=false
-  local USE_DOCKER_REPO="${USE_DOCKER_REPO:-true}"
+  local USE_DOCKER_REPO="${USE_DOCKER_REPO:-false}"
  # Check if Docker is already installed
  if command -v docker &>/dev/null; then
@@ -4707,7 +4707,7 @@ setup_docker() {
    msg_info "Portainer container detected"
  fi
-  # Scenario 1: Use distro repository (opt-out via USE_DOCKER_REPO=false)
+  # Scenario 1: Use distro repository (default, most stable)
  if [[ "$USE_DOCKER_REPO" != "true" && "$USE_DOCKER_REPO" != "TRUE" && "$USE_DOCKER_REPO" != "1" ]]; then
    # Install or upgrade Docker from distro repo
@@ -7157,7 +7157,7 @@ setup_meilisearch() {
        MEILI_DB_PATH="${MEILI_DB_PATH:-/var/lib/meilisearch/data}"
        msg_info "Removing old MeiliSearch database for migration"
-        find "${MEILI_DB_PATH:?}" -mindepth 1 -delete
+        rm -rf "${MEILI_DB_PATH:?}"/*
        # Import dump using CLI flag (this is the supported method)
        local DUMP_FILE="${MEILI_DUMP_DIR}/${DUMP_UID}.dump"
@@ -7431,18 +7431,6 @@ setup_mongodb() {
  mkdir -p /var/lib/mongodb
  chown -R mongodb:mongodb /var/lib/mongodb
  local KERNEL_VERSION MONGO_MAJOR
  KERNEL_VERSION=$(uname -r | cut -d- -f1)
  MONGO_MAJOR="${MONGO_VERSION%%.*}"
  if ((MONGO_MAJOR >= 8)) && [[ "$(printf '%s\n' "6.19" "$KERNEL_VERSION" | sort -V | head -n1)" == "6.19" ]]; then
    mkdir -p /etc/systemd/system/mongod.service.d
    cat <<EOF >/etc/systemd/system/mongod.service.d/rseq.conf
 [Service]
 Environment=GLIBC_TUNABLES=glibc.pthread.rseq=1
 EOF
    systemctl daemon-reload
  fi
  $STD systemctl enable mongod || {
    msg_warn "Failed to enable mongod service"
  }
@@ -8689,7 +8677,6 @@ setup_postgresql_db() {
  export PG_DB_USER
  export PG_DB_PASS
 }
 # ------------------------------------------------------------------------------
 # Installs rbenv and ruby-build, installs Ruby and optionally Rails.
 #
@@ -8709,26 +8696,8 @@ setup_ruby() {
  local RBENV_DIR="$HOME/.rbenv"
  local RBENV_BIN="$RBENV_DIR/bin/rbenv"
  local PROFILE_FILE="$HOME/.profile"
  local BASH_PROFILE_FILE="$HOME/.bash_profile"
  local BASHRC_FILE="$HOME/.bashrc"
  local TMP_DIR=$(mktemp -d)
  if ! grep -q 'rbenv init' "$PROFILE_FILE" 2>/dev/null; then
    cat <<'EOF' >>"$PROFILE_FILE"
 export PATH="$HOME/.rbenv/bin:$PATH"
 eval "$(rbenv init -)"
 EOF
  fi
  if ! grep -q '.rbenv/shims' "$PROFILE_FILE" 2>/dev/null; then
    echo 'export PATH="$HOME/.rbenv/shims:$HOME/.rbenv/bin:$PATH"' >>"$PROFILE_FILE"
  fi
  if [[ -f "$BASH_PROFILE_FILE" ]] && ! grep -q '.rbenv/shims' "$BASH_PROFILE_FILE"; then
    echo 'export PATH="$HOME/.rbenv/shims:$HOME/.rbenv/bin:$PATH"' >>"$BASH_PROFILE_FILE"
  fi
  if [[ -f "$BASHRC_FILE" ]] && ! grep -q '.rbenv/shims' "$BASHRC_FILE"; then
    echo 'export PATH="$HOME/.rbenv/shims:$HOME/.rbenv/bin:$PATH"' >>"$BASHRC_FILE"
  fi
  # Get currently installed Ruby version
  local CURRENT_RUBY_VERSION=""
  if [[ -x "$RBENV_BIN" ]]; then
@@ -9131,16 +9100,6 @@ setup_uv() {
      msg_ok "uvx wrapper installed"
    fi
    # Install specific Python version if requested (even when uv is already up to date)
    if [[ -n "${PYTHON_VERSION:-}" ]]; then
      msg_info "Installing Python $PYTHON_VERSION via uv"
      $STD uv python install "$PYTHON_VERSION" || {
        msg_error "Failed to install Python $PYTHON_VERSION"
        return 150
      }
      msg_ok "Python $PYTHON_VERSION installed"
    fi
    return 0
  fi
@@ -9400,7 +9359,7 @@ fetch_and_deploy_from_url() {
  mkdir -p "$directory"
  if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-    find "${directory:?}" -mindepth 1 -delete
+    rm -rf "${directory:?}/"*
  fi
  local unpack_tmp
@@ -9976,7 +9935,7 @@ fetch_and_deploy_gl_release() {
    mkdir -p "$target"
    if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-      find "${target:?}" -mindepth 1 -delete
+      rm -rf "${target:?}/"*
    fi
    tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
@@ -10138,7 +10097,7 @@ fetch_and_deploy_gl_release() {
    unpack_tmp=$(mktemp -d)
    mkdir -p "$target"
    if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
-      find "${target:?}" -mindepth 1 -delete
+      rm -rf "${target:?}/"*
    fi
    if [[ "$filename" == *.zip ]]; then
@@ -116,9 +116,6 @@ add() {
 # Add container IDs to exclude from updates (comma-separated):
 # EXCLUDE=100,101,102
 EXCLUDE=
 # Healthchecks.io Ping URL (optional)
 # PING_URL=
 CONF
    ok "Created config ${CONF_FILE}"
  fi
@@ -238,11 +235,9 @@ view_cron_config() {
  fi
  if [[ -f "$CONF_FILE" ]]; then
    echo -e " \e[36mConfig file:\e[0m ${CONF_FILE}"
-    local excludes ping_url
+    local excludes
    excludes=$(grep -oP '^\s*EXCLUDE\s*=\s*\K.*' "$CONF_FILE" 2>/dev/null || true)
    ping_url=$(grep -oP '^\s*PING_URL\s*=\s*\K.*' "$CONF_FILE" 2>/dev/null | tr -d '"' | tr -d "'" || true)
    echo -e " \e[36mExcluded:\e[0m    ${excludes:-(none)}"
    echo -e " \e[36mPing URL:\e[0m    ${ping_url:-(none)}"
    echo ""
    echo -e " \e[90m--- ${CONF_FILE} ---\e[0m"
    cat "$CONF_FILE"
@@ -289,11 +284,9 @@ show_status() {
  fi
  if [[ -f "$CONF_FILE" ]]; then
-    local excludes ping_url
+    local excludes
    excludes=$(grep -oP '^\s*EXCLUDE\s*=\s*\K.*' "$CONF_FILE" 2>/dev/null || echo "(none)")
    ping_url=$(grep -oP '^\s*PING_URL\s*=\s*\K.*' "$CONF_FILE" 2>/dev/null | tr -d '"' | tr -d "'" || echo "(none)")
    echo -e "   \e[36mExcluded:\e[0m  ${excludes:-"(none)"}"
    echo -e "   \e[36mPing URL:\e[0m  ${ping_url:-"(none)"}"
  fi
  if [[ -f "$LOG_FILE" ]]; then
@@ -11,15 +11,14 @@
 export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 CONF_FILE="/etc/update-lxcs.conf"
-LOG_FILE="/var/log/update-lxcs-cron.log"
+
-PING_URL=""
+echo -e "\n $(date)"
 # Collect excluded containers from arguments
 excluded_containers=("$@")
-# Merge exclusions and healthchecks URL from config file if it exists
+# Merge exclusions from config file if it exists
 if [[ -f "$CONF_FILE" ]]; then
  PING_URL=$(grep -oP '^\s*PING_URL\s*=\s*\K.+' "$CONF_FILE" 2>/dev/null | tr -d '"' | tr -d "'" || true)
  conf_exclude=$(grep -oP '^\s*EXCLUDE\s*=\s*\K[0-9,]+' "$CONF_FILE" 2>/dev/null || true)
  IFS=',' read -ra conf_ids <<<"$conf_exclude"
  for id in "${conf_ids[@]}"; do
@@ -28,17 +27,6 @@ if [[ -f "$CONF_FILE" ]]; then
  done
 fi
 # Overwrite logfile on each run when healthchecks is used
 if [[ -n "$PING_URL" ]]; then
  true > "$LOG_FILE"
 fi
 if [[ -n "$PING_URL" ]]; then
  curl -fsS -m 10 --retry 5 "${PING_URL}/start" -o /dev/null 2>/dev/null || true
 fi
 echo -e "\n $(date)"
 function update_container() {
  local container=$1
  local name
@@ -50,36 +38,12 @@ function update_container() {
  alpine) pct exec "$container" -- ash -c "apk -U upgrade" ;;
  archlinux) pct exec "$container" -- bash -c "pacman -Syyu --noconfirm" ;;
  fedora | rocky | centos | alma) pct exec "$container" -- bash -c "dnf -y update && dnf -y upgrade" ;;
-  ubuntu | debian | devuan) pct exec "$container" -- bash -c "apt-get update; DEBIAN_FRONTEND=noninteractive apt-get -o Dpkg::Options::='--force-confold' dist-upgrade -y; status=\$?; rm -rf /usr/lib/python3.*/EXTERNALLY-MANAGED || true; exit \$status" ;;
+  ubuntu | debian | devuan) pct exec "$container" -- bash -c "apt-get update && DEBIAN_FRONTEND=noninteractive apt-get -o Dpkg::Options::='--force-confold' dist-upgrade -y; rm -rf /usr/lib/python3.*/EXTERNALLY-MANAGED" ;;
  opensuse) pct exec "$container" -- bash -c "zypper ref && zypper --non-interactive dup" ;;
  *) echo " [Warn] Unknown OS type '$os' for container $container, skipping" ;;
  esac
 }
 update_status=0
 # Define exit handler to send healthchecks.io status (with logfile on failure/success)
 function exit_handler() {
  local exit_code=$?
  if [[ -n "$PING_URL" ]]; then
    sync
    if [[ $exit_code -ne 0 || $update_status -ne 0 ]]; then
      if [[ -f "$LOG_FILE" ]]; then
        curl -fsS -m 10 --retry 5 --data-binary @"$LOG_FILE" "${PING_URL}/fail" -o /dev/null 2>/dev/null || true
      else
        curl -fsS -m 10 --retry 5 "${PING_URL}/fail" -o /dev/null 2>/dev/null || true
      fi
    else
      if [[ -f "$LOG_FILE" ]]; then
        curl -fsS -m 10 --retry 5 --data-binary @"$LOG_FILE" "$PING_URL" -o /dev/null 2>/dev/null || true
      else
        curl -fsS -m 10 --retry 5 "$PING_URL" -o /dev/null 2>/dev/null || true
      fi
    fi
  fi
 }
 trap exit_handler EXIT
 for container in $(pct list | awk '{if(NR>1) print $1}'); do
  excluded=false
  for excluded_container in "${excluded_containers[@]}"; do
@@ -101,7 +65,7 @@ for container in $(pct list | awk '{if(NR>1) print $1}'); do
      echo -e "[Info] Starting $container"
      pct start "$container"
      sleep 5
-      update_container "$container" || { echo " [Error] Update failed for $container"; update_status=1; }
+      update_container "$container" || echo " [Error] Update failed for $container"
      # check if patchmon agent is present in container and run a report if found
      if pct exec "$container" -- [ -e "/usr/local/bin/patchmon-agent" ]; then
        echo -e "${BL}[Info]${GN} patchmon-agent found in ${BL} $container ${CL}, triggering report. \n"
@@ -110,7 +74,7 @@ for container in $(pct list | awk '{if(NR>1) print $1}'); do
      echo -e "[Info] Shutting down $container"
      pct shutdown "$container" --timeout 60 &
    elif [ "$status" == "status: running" ]; then
-      update_container "$container" || { echo " [Error] Update failed for $container"; update_status=1; }
+      update_container "$container" || echo " [Error] Update failed for $container"
      # check if patchmon agent is present in container and run a report if found
      if pct exec "$container" -- [ -e "/usr/local/bin/patchmon-agent" ]; then
        echo -e "${BL}[Info]${GN} patchmon-agent found in ${BL} $container ${CL}, triggering report. \n"
@@ -78,7 +78,7 @@ function update_container() {
  alpine) pct exec "$container" -- ash -c "apk -U upgrade" ;;
  archlinux) pct exec "$container" -- bash -c "pacman -Syyu --noconfirm" ;;
  fedora | rocky | centos | alma) pct exec "$container" -- bash -c "dnf -y update && dnf -y upgrade" ;;
-  ubuntu | debian | devuan) pct exec "$container" -- bash -c "apt-get update 2>/dev/null | grep 'packages.*upgraded'; apt list --upgradable 2>/dev/null | cat && apt-get -yq dist-upgrade 2>&1; apt-get -yq autoremove 2>&1; apt-get -yq autoclean 2>&1; rm -rf /usr/lib/python3.*/EXTERNALLY-MANAGED || true" ;;
+  ubuntu | debian | devuan) pct exec "$container" -- bash -c "apt-get update 2>/dev/null | grep 'packages.*upgraded'; apt list --upgradable 2>/dev/null | cat && apt-get -yq dist-upgrade 2>&1; rm -rf /usr/lib/python3.*/EXTERNALLY-MANAGED || true" ;;
  opensuse) pct exec "$container" -- bash -c "zypper ref && zypper --non-interactive dup" ;;
  esac
 }