Refactor the workflow to prefer back-references stamped in PR bodies over fuzzy title/slug matching. Add safety guard refusing to close more than 3 issues per PR. Restrict issue search to migration-labelled issues only. Use exact slug matching instead of substring matching. Add permissions block, env var for DEV_REPO, and skip already-closed issues.
Same bug as build.func's install-recovery menu: this "Remove broken
container?" prompt treated a hard read failure (broken/closed stdin,
I/O error) identically to a real 60s timeout, defaulting to pct
destroy either way. Only auto-remove on an actual timeout (read_rc >
128); on a genuine read failure, keep the container instead of
guessing and destroying it.
read -t returns >128 on a real timeout, but a lower/plain error code
on a genuine read failure (e.g. broken/closed stdin, I/O error) -
these were treated identically as "no response", so a user whose
keystroke failed to be captured (e.g. a transient stdin I/O error)
got their container silently destroyed instead of kept. Only
auto-remove on an actual timeout; on a hard read failure, keep the
container (reversible) and tell the user how to remove it manually.
Updates temp-file and temp-dir cleanup traps in `misc/tools.func` to unset the `RETURN` trap after running cleanup. This prevents stale RETURN traps from leaking into later function returns and avoids repeated or unintended cleanup behavior in nested helper flows.
CLEAN_INSTALL now removes dotfiles (e.g. .env) along with other files, using `find -mindepth 1 -delete` instead of `rm -rf *`. Update scripts for affine, nametag, and postiz are updated to explicitly back up and restore .env (via create_backup/restore_backup or cp) BEFORE the build step that sources it, rather than relying on the wipe preserving dotfiles.
Define `path.data` and `path.logs` in the Zammad install script's Elasticsearch config so the service uses the expected data and log directories when running in the single-node local setup.
Replace the destructive multi-select container update block with a
proper per-container Y/N workflow:
- Unattended / non-interactive (DOCKER_NONINTERACTIVE=1 or no tty):
skip silently -- no docker pulls, no prompts.
- Interactive: stop_spinner() before any prompt to keep the terminal
clean, then for each container with a newer image:
Compose-managed → prompt Y/N (auto-no after 60 s)
→ on Y: docker compose pull <service> &&
docker compose up -d <service>
Standalone run → prompt Y/N (auto-no after 60 s)
→ on Y: docker pull only; no stop/rm;
user is told to recreate manually
- portainer / portainer_agent are excluded (handled earlier in
setup_docker)
The old code always stopped and removed the container without
recreating it, leaving users with a destroyed service. Standalone
containers without a Compose project can never be auto-recreated
safely, so only the image is pulled.
Fixes#15601
The 'Interactive Container Update Check' block scanned ALL running
Docker containers, pulled their images, then stopped and removed them
with only a message asking the user to manually recreate them. This
is destructive and outside the scope of the Docker LXC update script,
which is responsible for updating the Docker engine itself and the
Portainer / Portainer-Agent containers that this script originally
installed.
Removes the entire block. Updates now cover:
- OS packages (apt)
- Docker engine (via setup_docker / repo)
- Portainer CE (if installed by this script)
- Portainer Agent (if installed by this script)
Self-hosted / user-managed containers are intentionally left alone.
Fixes#15601
Add a fallback retry using `npm install -g --force` when the initial install fails. This handles EEXIST errors caused by corepack-provided shims for pnpm/yarn that ship with recent Node.js versions and block installation to /usr/bin/<tool>.
Wrap the extension identifier in double quotes in the CREATE EXTENSION SQL call within setup_postgresql_db. This ensures extension names containing hyphens, mixed case, or other characters that require quoting are handled correctly and avoids syntax errors when creating extensions.
When running in certain LXC environments (e.g. systems with desktop
packages or non-en locales), the HOME variable may resolve to '/'
instead of '/root'. rbenv installs to $HOME/.rbenv, so if HOME is
wrong it ends up in /.rbenv while all service files and PATH exports
hardcode /root/.rbenv, causing 'env: ruby: No such file or directory'.
Explicitly set HOME=/root for all setup_ruby calls that run as root,
and replace all $HOME/.rbenv references in PATH exports and install
steps with /root/.rbenv literals.
Affected scripts:
- ct/sure.sh + install/sure-install.sh (fixes#14479)
- ct/dawarich.sh + install/dawarich-install.sh
- ct/docuseal.sh + install/docuseal-install.sh
Also add TimeoutStartSec=300 to sure.service so db:prepare on first
start does not get killed by the default 90s systemd timeout.
After building OpenResty, the script does cd /opt/openresty followed by
rm -rf /opt/openresty, leaving $PWD pointing to a deleted directory.
When pip runs in the certbot block, the subprocess inherits the invalid
PWD and fails with OSError: No such file or directory.
Add cd /root before the certbot block to reset to a valid directory.
Closes#13240
The previous logic using 'file | grep PGP' was inverted — both
ASCII-armored and binary GPG keys matched the pattern, causing
ASCII-armored keys to be copied directly instead of being
dearmored. This resulted in APT failing with NO_PUBKEY errors
on Debian 12 (bookworm).
Use 'grep BEGIN PGP' to reliably detect ASCII-armored keys and
dearmor them, otherwise copy binary keys directly.
gpg --dearmor creates files with restrictive permissions (600),
which prevents Debian 13's sqv signature verifier from reading
the keyring files. This causes apt update to fail with
'Permission denied' errors for all repositories using custom
GPG keys (adoptium, pgdg, pdm, etc.).
Set chmod 644 after creating .gpg files in both setup_deb822_repo()
and the MongoDB GPG key import in manage_tool_repository().
- Remove Docker-specific 'master_process' and 'pid' directives from nginx.conf
- These directives conflict when used with systemd nginx in LXC environment
- Keep complete upstream nginx.conf configuration otherwise intact
- Add PORT variable replacement to use port 80
- Add nginx -t validation before reload
- Fix ((gpu_count++)) returning exit code 1 when count=0
- Fix ((failed_modules++)) same issue in setup_nodejs
- Add || true to all arithmetic increments starting from 0
- Export ENABLE_GPU from build.func to container
- Check ENABLE_GPU instead of var_gpu in setup_hwaccel
The bash arithmetic expansion ((0)) and ((x++)) when x=0
returns exit code 1, which causes immediate script abort
when set -e is active.
MickLesk