Harden code-server addon install script

Refactor the code-server installer to be more robust: introduce a config_path variable and preexisting_config flag, use quoted ${HOME} paths, and only write a default config.yaml when none exists. Move systemctl enable after config creation and add an active check that errors out if the code-server service fails to start. Also tidy up variable quoting and cleanup steps for safer execution.

CHANGELOG.md

@@ -423,18 +423,42 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-03-20
+
+### 🆕 New Scripts
+
+  - teleport ([#13086](https://github.com/community-scripts/ProxmoxVE/pull/13086))
+
 ## 2026-03-19
 
 ### 🚀 Updated Scripts
 
+  - Owncast: increase default disk size from 2GB to 10GB [@Copilot](https://github.com/Copilot) ([#13079](https://github.com/community-scripts/ProxmoxVE/pull/13079))
+
   - #### 🐞 Bug Fixes
 
+    - fix: remove extra backslash to match single quoted here-doc [@Zelnes](https://github.com/Zelnes) ([#13108](https://github.com/community-scripts/ProxmoxVE/pull/13108))
+    - Reactive-Resume: Upgrade Node to 24 and enable Corepack [@MickLesk](https://github.com/MickLesk) ([#13093](https://github.com/community-scripts/ProxmoxVE/pull/13093))
+    - Increase Tracearr RAM; derive APP_VERSION [@MickLesk](https://github.com/MickLesk) ([#13087](https://github.com/community-scripts/ProxmoxVE/pull/13087))
+    - ProjectSend: Update application access URL [@tremor021](https://github.com/tremor021) ([#13078](https://github.com/community-scripts/ProxmoxVE/pull/13078))
     - Dispatcharr: use npm install --no-audit --progress=false [@MickLesk](https://github.com/MickLesk) ([#13074](https://github.com/community-scripts/ProxmoxVE/pull/13074))
     - core: reorder hwaccel setup and adjust GPU group usermod [@MickLesk](https://github.com/MickLesk) ([#13072](https://github.com/community-scripts/ProxmoxVE/pull/13072))
 
+  - #### ✨ New Features
+
+    - tools.func: display pin reason in release-check messages [@MickLesk](https://github.com/MickLesk) ([#13095](https://github.com/community-scripts/ProxmoxVE/pull/13095))
+    - NocoDB: Unpin Version to latest [@MickLesk](https://github.com/MickLesk) ([#13094](https://github.com/community-scripts/ProxmoxVE/pull/13094))
+
+### 💾 Core
+
+  - #### 🐞 Bug Fixes
+
+    - tools.func: use dpkg-query for reliable JDK version detection [@MickLesk](https://github.com/MickLesk) ([#13101](https://github.com/community-scripts/ProxmoxVE/pull/13101))
+
 ### 📚 Documentation
 
-  - github: add PocketBase bot workflow [@MickLesk](https://github.com/MickLesk) ([#13075](https://github.com/community-scripts/ProxmoxVE/pull/13075))
+  - Update link from helper-scripts.com to community-scripts.org [@adnanvaldes](https://github.com/adnanvaldes) ([#13098](https://github.com/community-scripts/ProxmoxVE/pull/13098))
+- github: add PocketBase bot workflow [@MickLesk](https://github.com/MickLesk) ([#13075](https://github.com/community-scripts/ProxmoxVE/pull/13075))
 
 ## 2026-03-18
 

README.md

@@ -130,7 +130,7 @@ Choose your preferred installation method:
 
 The fastest way to get started:
 
-1. Visit **[helper-scripts.com](https://helper-scripts.com/)** 🌐
+1. Visit **[community-scripts.org](https://community-scripts.org/)** 🌐
 2. Search for your desired script (e.g., "Home Assistant", "Docker")
 3. Copy the bash command displayed on the script page
 4. Open your **Proxmox Shell** and paste the command

ct/dispatcharr.sh

@@ -110,6 +110,8 @@ function update_script() {
 
     msg_info "Building Frontend"
     cd /opt/dispatcharr/frontend
+    node -e "const p=require('./package.json');p.overrides=p.overrides||{};p.overrides['webworkify-webpack']='2.1.3';require('fs').writeFileSync('package.json',JSON.stringify(p,null,2));"
+    rm -f package-lock.json
     $STD npm install --no-audit --progress=false
     $STD npm run build
     msg_ok "Built Frontend"

ct/headers/teleport

@@ -0,0 +1,6 @@
+  ______     __                      __ 
+ /_  __/__  / /__  ____  ____  _____/ /_
+  / / / _ \/ / _ \/ __ \/ __ \/ ___/ __/
+ / / /  __/ /  __/ /_/ / /_/ / /  / /_  
+/_/  \___/_/\___/ .___/\____/_/   \__/  
+               /_/                      

ct/immich.sh

@@ -110,7 +110,7 @@ EOF
   fi
 
   RELEASE="v2.5.6"
-  if check_for_gh_release "Immich" "immich-app/immich" "${RELEASE}"; then
+  if check_for_gh_release "Immich" "immich-app/immich" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
     if [[ $(cat ~/.immich) > "2.5.1" ]]; then
       msg_info "Enabling Maintenance Mode"
       cd /opt/immich/app/bin
@@ -125,7 +125,7 @@ EOF
     msg_ok "Stopped Services"
     VCHORD_RELEASE="0.5.3"
     [[ -f ~/.vchord_version ]] && mv ~/.vchord_version ~/.vectorchord
-    if check_for_gh_release "VectorChord" "tensorchord/VectorChord" "${VCHORD_RELEASE}"; then
+    if check_for_gh_release "VectorChord" "tensorchord/VectorChord" "${VCHORD_RELEASE}" "updated together with Immich after testing"; then
       fetch_and_deploy_gh_release "VectorChord" "tensorchord/VectorChord" "binary" "${VCHORD_RELEASE}" "/tmp" "postgresql-16-vchord_*_amd64.deb"
       systemctl restart postgresql
       $STD sudo -u postgres psql -d immich -c "ALTER EXTENSION vector UPDATE;"

ct/nocodb.sh

@@ -23,17 +23,18 @@ function update_script() {
   header_info
   check_container_storage
   check_container_resources
-  RELEASE="0.301.1"
+  #RELEASE="0.301.1"
   if [[ ! -f /etc/systemd/system/nocodb.service ]]; then
     msg_error "No ${APP} Installation Found!"
     exit
   fi
-  if check_for_gh_release "nocodb" "nocodb/nocodb" "${RELEASE}"; then
+  #if check_for_gh_release "nocodb" "nocodb/nocodb" "${RELEASE}"; then
+  if check_for_gh_release "nocodb" "nocodb/nocodb"; then
     msg_info "Stopping Service"
     systemctl stop nocodb
     msg_ok "Stopped Service"
 
-    fetch_and_deploy_gh_release "nocodb" "nocodb/nocodb" "singlefile" "${RELEASE}" "/opt/nocodb/" "Noco-linux-x64"
+    fetch_and_deploy_gh_release "nocodb" "nocodb/nocodb" "singlefile" "latest" "/opt/nocodb/" "Noco-linux-x64"
 
     msg_info "Starting Service"
     systemctl start nocodb

ct/opencloud.sh

@@ -30,7 +30,7 @@ function update_script() {
   fi
 
   RELEASE="v5.2.0"
-  if check_for_gh_release "OpenCloud" "opencloud-eu/opencloud" "${RELEASE}"; then
+  if check_for_gh_release "OpenCloud" "opencloud-eu/opencloud" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
     msg_info "Stopping services"
     systemctl stop opencloud opencloud-wopi
     msg_ok "Stopped services"

ct/owncast.sh

@@ -9,7 +9,7 @@ APP="Owncast"
 var_tags="${var_tags:-broadcasting}"
 var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-2048}"
-var_disk="${var_disk:-2}"
+var_disk="${var_disk:-10}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
 var_unprivileged="${var_unprivileged:-1}"

ct/plant-it.sh

@@ -29,7 +29,7 @@ function update_script() {
     exit
   fi
   setup_mariadb
-  if check_for_gh_release "plant-it" "MDeLuise/plant-it" "${RELEASE}"; then
+  if check_for_gh_release "plant-it" "MDeLuise/plant-it" "${RELEASE}" "last version that includes the web frontend"; then
     msg_info "Stopping Service"
     systemctl stop plant-it
     msg_info "Stopped Service"

ct/reactive-resume.sh

@@ -34,10 +34,14 @@ function update_script() {
     msg_ok "Stopped services"
 
     cp /opt/reactive-resume/.env /opt/reactive-resume.env.bak
+    NODE_VERSION="24" setup_nodejs
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "reactive-resume" "amruthpillai/reactive-resume" "tarball" "latest" "/opt/reactive-resume"
 
     msg_info "Updating Reactive Resume (Patience)"
     cd /opt/reactive-resume
+    export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+    corepack enable
+    corepack prepare --activate
     export CI="true"
     export NODE_ENV="production"
     $STD pnpm install --frozen-lockfile

ct/teleport.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Slaviša Arežina (tremor021)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://goteleport.com/
+
+APP="Teleport"
+var_tags="${var_tags:-zero-trust}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-1024}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+  if [[ ! -f /etc/teleport.yaml ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  msg_info "Updating Teleport"
+  $STD apt update
+  $STD apt upgrade -y
+  msg_ok "Updated successfully!"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}https://${IP}:3080${CL}"

ct/tracearr.sh

@@ -8,7 +8,7 @@ source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxV
 APP="Tracearr"
 var_tags="${var_tags:-media}"
 var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
+var_ram="${var_ram:-4096}"
 var_disk="${var_disk:-10}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
@@ -140,7 +140,7 @@ EOF
     msg_ok "Built Tracearr"
 
     msg_info "Configuring Tracearr"
-    sed -i "s/^APP_VERSION=.*/APP_VERSION=$(cat /root/.tracearr)/" /data/tracearr/.env
+    sed -i "s|^APP_VERSION=.*|APP_VERSION=${CHECK_UPDATE_RELEASE#v}|" /data/tracearr/.env
     chmod 600 /data/tracearr/.env
     chown -R tracearr:tracearr /data/tracearr
     mkdir -p /data/backup

install/dispatcharr-install.sh

@@ -66,6 +66,8 @@ CELERY_BROKER_URL=redis://localhost:6379/0
 DJANGO_SECRET_KEY=$DJANGO_SECRET
 EOF
 cd /opt/dispatcharr/frontend
+node -e "const p=require('./package.json');p.overrides=p.overrides||{};p.overrides['webworkify-webpack']='2.1.3';require('fs').writeFileSync('package.json',JSON.stringify(p,null,2));"
+rm -f package-lock.json
 $STD npm install --no-audit --progress=false
 $STD npm run build
 msg_ok "Configured Dispatcharr"

install/nocodb-install.sh

@@ -13,11 +13,11 @@ setting_up_container
 network_check
 update_os
 
-fetch_and_deploy_gh_release "nocodb" "nocodb/nocodb" "singlefile" "0.301.1" "/opt/nocodb/" "Noco-linux-x64"
+fetch_and_deploy_gh_release "nocodb" "nocodb/nocodb" "singlefile" "latest" "/opt/nocodb/" "Noco-linux-x64"
 
 msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/nocodb.service
-echo "[Unit]
+[Unit]
 Description=nocodb
 
 [Service]

install/prometheus-install.sh

@@ -36,7 +36,7 @@ ExecStart=/usr/local/bin/prometheus \
     --config.file=/etc/prometheus/prometheus.yml \
     --storage.tsdb.path=/var/lib/prometheus/ \
     --web.listen-address=0.0.0.0:9090
-ExecReload=/bin/kill -HUP \$MAINPID
+ExecReload=/bin/kill -HUP $MAINPID
 
 [Install]
 WantedBy=multi-user.target

install/reactive-resume-install.sh

@@ -15,7 +15,7 @@ update_os
 
 PG_VERSION="16" setup_postgresql
 PG_DB_NAME="reactive_resume" PG_DB_USER="reactive_resume" setup_postgresql_db
-NODE_VERSION="22" NODE_MODULE="pnpm@latest" setup_nodejs
+NODE_VERSION="24" setup_nodejs
 
 msg_info "Installing Dependencies"
 $STD apt install -y chromium
@@ -25,6 +25,9 @@ fetch_and_deploy_gh_release "reactive-resume" "amruthpillai/reactive-resume" "ta
 
 msg_info "Building Reactive Resume (Patience)"
 cd /opt/reactive-resume
+export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+corepack enable
+corepack prepare --activate
 export NODE_ENV="production"
 export CI="true"
 $STD pnpm install --frozen-lockfile

install/teleport-install.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Slaviša Arežina (tremor021)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://goteleport.com/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+setup_deb822_repo \
+  "teleport" \
+  "https://deb.releases.teleport.dev/teleport-pubkey.asc" \
+  "https://apt.releases.teleport.dev/debian" \
+  "trixie" \
+  "stable/v18"
+
+msg_info "Configuring Teleport"
+$STD apt install -y teleport
+$STD teleport configure -o /etc/teleport.yaml
+systemctl enable -q --now teleport
+sleep 10
+tctl users add teleport-admin --roles=editor,access --logins=root >~/teleportadmin.txt
+sed -i "s|https://[^:]*:3080|https://${LOCAL_IP}:3080|g" ~/teleportadmin.txt
+msg_ok "Configured Teleport"
+
+motd_ssh
+customize
+cleanup_lxc

misc/tools.func

@@ -2271,6 +2271,7 @@ check_for_gh_release() {
   local app="$1"
   local source="$2"
   local pinned_version_in="${3:-}" # optional
+  local pin_reason="${4:-}"        # optional reason shown to user
   local app_lc=""
   app_lc="$(echo "${app,,}" | tr -d ' ')"
   local current_file="$HOME/.${app_lc}"
@@ -2444,7 +2445,11 @@ check_for_gh_release() {
       return 0
     fi
 
-    msg_ok "No update available: ${app} is already on pinned version (${current})"
+    if [[ -n "$pin_reason" ]]; then
+      msg_ok "No update available: ${app} (${current}) - update held back: ${pin_reason}"
+    else
+      msg_ok "No update available: ${app} (${current}) - update temporarily held back due to issues with newer releases"
+    fi
     return 1
   fi
 
@@ -2483,6 +2488,7 @@ check_for_codeberg_release() {
   local app="$1"
   local source="$2"
   local pinned_version_in="${3:-}" # optional
+  local pin_reason="${4:-}"        # optional reason shown to user
   local app_lc="${app,,}"
   local current_file="$HOME/.${app_lc}"
 
@@ -2562,7 +2568,11 @@ check_for_codeberg_release() {
       return 0
     fi
 
-    msg_ok "No update available: ${app} is already on pinned version (${current})"
+    if [[ -n "$pin_reason" ]]; then
+      msg_ok "No update available: ${app} (${current}) - update held back: ${pin_reason}"
+    else
+      msg_ok "No update available: ${app} (${current}) - update temporarily held back due to issues with newer releases"
+    fi
     return 1
   fi
 
@@ -5353,24 +5363,7 @@ function setup_java() {
 
   # Get currently installed version
   local INSTALLED_VERSION=""
-  if dpkg -l | grep -q "temurin-.*-jdk" 2>/dev/null; then
-    INSTALLED_VERSION=$(dpkg -l 2>/dev/null | awk '/temurin-.*-jdk/{print $2}' | grep -oP 'temurin-\K[0-9]+' | head -n1 || echo "")
-  fi
-
-  # Validate INSTALLED_VERSION is not empty if JDK package found
-  local JDK_COUNT=0
-  JDK_COUNT=$(dpkg -l 2>/dev/null | grep -c "temurin-.*-jdk" || true)
-  if [[ -z "$INSTALLED_VERSION" && "${JDK_COUNT:-0}" -gt 0 ]]; then
-    msg_warn "Found Temurin JDK but cannot determine version - attempting reinstall"
-    # Try to get actual package name for purge
-    local OLD_PACKAGE
-    OLD_PACKAGE=$(dpkg -l 2>/dev/null | awk '/temurin-.*-jdk/{print $2}' | head -n1 || echo "")
-    if [[ -n "$OLD_PACKAGE" ]]; then
-      msg_info "Removing existing package: $OLD_PACKAGE"
-      $STD apt purge -y "$OLD_PACKAGE" || true
-    fi
-    INSTALLED_VERSION="" # Reset to trigger fresh install
-  fi
+  INSTALLED_VERSION=$(dpkg-query -W -f '${Package}\n' 2>/dev/null | grep -oP '^temurin-\K[0-9]+(?=-jdk$)' | head -n1 || echo "")
 
   # Scenario 1: Already at correct version
   if [[ "$INSTALLED_VERSION" == "$JAVA_VERSION" ]]; then

tools/addon/coder-code-server.sh

@@ -89,26 +89,31 @@ VERSION=$(curl -fsSL https://api.github.com/repos/coder/code-server/releases/lat
   awk '{print substr($2, 3, length($2)-4) }')
 
 msg_info "Installing Code-Server v${VERSION}"
+config_path="${HOME}/.config/code-server/config.yaml"
+preexisting_config=false
 
-if [ -f ~/.config/code-server/config.yaml ]; then
-  existing_config=true
+if [ -f "$config_path" ]; then
+  preexisting_config=true
 fi
 
 curl -fOL https://github.com/coder/code-server/releases/download/v"$VERSION"/code-server_"${VERSION}"_amd64.deb &>/dev/null
 dpkg -i code-server_"${VERSION}"_amd64.deb &>/dev/null
 rm -rf code-server_"${VERSION}"_amd64.deb
-mkdir -p ~/.config/code-server/
-systemctl enable -q --now code-server@"$USER"
+mkdir -p "${HOME}/.config/code-server/"
 
-if [ $existing_config = false ]; then
-cat <<EOF >~/.config/code-server/config.yaml
+if [ "$preexisting_config" = false ]; then
+cat <<EOF >"$config_path"
 bind-addr: 0.0.0.0:8680
 auth: none
 password: 
 cert: false
 EOF
 fi
+systemctl enable -q --now code-server@"$USER"
 systemctl restart code-server@"$USER"
+if ! systemctl is-active --quiet code-server@"$USER"; then
+  error_exit "code-server service failed to start."
+fi
 msg_ok "Installed Code-Server v${VERSION} on $hostname"
 
 echo -e "${APP} should be reachable by going to the following URL.