Update CHANGELOG.md (#16334)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

.github/workflows/pocketbase-ai-bot.yml

@@ -314,12 +314,17 @@ jobs:
             // ── Allow-lists (mirror the slash bot) ─────────────────────────────
             const ALLOWED_FIELDS = {
               name: 'string', description: 'string', logo: 'string', documentation: 'string',
-              website: 'string', project_url: 'string', github: 'string', config_path: 'string',
+              website: 'string', project_url: 'string', repository: 'string', config_path: 'string',
               tags: 'string', port: 'number', default_user: 'nullable_string', default_passwd: 'nullable_string',
-              unprivileged: 'number', updateable: 'boolean', privileged: 'boolean', has_arm: 'boolean',
+              unprivileged: 'number', updateable: 'boolean', privileged: 'boolean',
+              architectures: 'select_list', platforms: 'select_list',
               is_dev: 'boolean', is_disabled: 'boolean', disable_message: 'string',
               is_deleted: 'boolean', deleted_message: 'string'
             };
+            const SELECT_VALUES = {
+              architectures: ['amd64', 'arm64'],
+              platforms: ['pve', 'incus'],
+            };
             const FIELD_TO_CT_VAR = { tags: 'var_tags', unprivileged: 'var_unprivileged' };
             const RESOURCE_KEYS = { cpu: 'number', ram: 'number', hdd: 'number', os: 'string', version: 'string' };
             const METHOD_KEYS = { config_path: 'string', script: 'string' };
@@ -339,6 +344,17 @@ jobs:
                 if (isNaN(n)) return { error: '`' + key + '` must be a number' };
                 return { value: n };
               }
+              if (type === 'select_list') {
+                // architectures/platforms are multi-selects over a closed set,
+                // so an unknown value is rejected rather than stored. The model
+                // may hand back an array or a comma-separated string.
+                const allowed = SELECT_VALUES[key] || [];
+                const raw = Array.isArray(rawVal) ? rawVal : String(rawVal == null ? '' : rawVal).split(',');
+                const values = raw.map(function (v) { return String(v).trim(); }).filter(Boolean);
+                const bad = values.filter(function (v) { return allowed.indexOf(v) === -1; });
+                if (bad.length > 0) return { error: '`' + key + '` accepts ' + allowed.join(', ') + ' — got: ' + bad.join(', ') };
+                return { value: values };
+              }
               if (type === 'nullable_string') return { value: rawVal === '' || rawVal == null ? null : String(rawVal) };
               return { value: String(rawVal) };
             }

.github/workflows/pocketbase-bot.yml

@@ -323,9 +323,10 @@ jobs:
               '/pocketbase <slug> method remove <type>\n' +
               '```\n' +
               'Method fields: `cpu` `ram` `hdd` `os` `version` `config_path` `script`\n\n' +
-              '**Editable fields:** `name` `description` `logo` `documentation` `website` `project_url` `github` ' +
+              '**Editable fields:** `name` `description` `logo` `documentation` `website` `project_url` `repository` ' +
               '`config_path` `port` `default_user` `default_passwd` ' +
-              '`updateable` `privileged` `has_arm` `is_dev` ' +
+              '`updateable` `privileged` `is_dev` ' +
+              '`architectures` (amd64,arm64) `platforms` (pve,incus) ' +
               '`is_disabled` `disable_message` `is_deleted` `deleted_message`';
 
             if (!withoutCmd) {
@@ -504,7 +505,8 @@ jobs:
               out.push('- **Port:** ' + (record.port != null ? '`' + record.port + '`' : '—'));
               out.push('- **Updateable:** ' + (record.updateable ? 'Yes' : 'No'));
               out.push('- **Privileged:** ' + (record.privileged ? 'Yes' : 'No'));
-              out.push('- **ARM:** ' + (record.has_arm ? 'Yes' : 'No'));
+              out.push('- **Architectures:** ' + ((record.architectures || []).join(', ') || 'amd64'));
+              out.push('- **Platforms:** ' + ((record.platforms || []).join(', ') || 'pve'));
               if (record.is_dev) out.push('- **Dev:** Yes');
               if (record.is_disabled) out.push('- **Disabled:** Yes' + (record.disable_message ? ' — ' + record.disable_message : ''));
               if (record.is_deleted) out.push('- **Deleted:** Yes' + (record.deleted_message ? ' — ' + record.deleted_message : ''));
@@ -838,7 +840,7 @@ jobs:
               const fieldName = setMatch[1].toLowerCase();
               const SET_ALLOWED = {
                 name: 'string', description: 'string', logo: 'string',
-                documentation: 'string', website: 'string', project_url: 'string', github: 'string',
+                documentation: 'string', website: 'string', project_url: 'string', repository: 'string',
                 config_path: 'string', disable_message: 'string', deleted_message: 'string'
               };
               if (!SET_ALLOWED[fieldName]) {
@@ -888,7 +890,7 @@ jobs:
                 documentation:    'string',
                 website:          'string',
                 project_url:      'string',
-                github:           'string',
+                repository:       'string',
                 config_path:      'string',
                 tags:             'string',
                 port:             'number',
@@ -897,7 +899,8 @@ jobs:
                 unprivileged:     'number',
                 updateable:       'boolean',
                 privileged:       'boolean',
-                has_arm:          'boolean',
+                architectures:    'select_list',
+                platforms:        'select_list',
                 is_dev:           'boolean',
                 is_disabled:      'boolean',
                 disable_message:  'string',
@@ -924,6 +927,10 @@ jobs:
               }
 
               // Cast values to correct types
+              const SELECT_VALUES = {
+                architectures: ['amd64', 'arm64'],
+                platforms: ['pve', 'incus'],
+              };
               const payload = {};
               for (const [key, rawVal] of Object.entries(parsedFields)) {
                 const type = ALLOWED_FIELDS[key];
@@ -943,6 +950,18 @@ jobs:
                     process.exit(0);
                   }
                   payload[key] = n;
+                } else if (type === 'select_list') {
+                  // architectures/platforms are multi-selects over a closed set,
+                  // so an unknown value is rejected rather than stored.
+                  const allowed = SELECT_VALUES[key] || [];
+                  const values = rawVal.split(',').map(function (v) { return v.trim(); }).filter(Boolean);
+                  const bad = values.filter(function (v) { return allowed.indexOf(v) === -1; });
+                  if (bad.length > 0) {
+                    await addReaction('-1');
+                    await postComment('❌ **PocketBase Bot**: `' + key + '` accepts ' + allowed.join(', ') + ' — got: `' + bad.join(', ') + '`');
+                    process.exit(0);
+                  }
+                  payload[key] = values;
                 } else if (type === 'nullable_string') {
                   payload[key] = rawVal === '' ? null : rawVal;
                 } else {

.github/workflows/push-json-to-pocketbase.yml

@@ -179,7 +179,19 @@ jobs:
             if (resolvedType) payload.type = resolvedType;
             var resolvedCats = (data.categories || []).map(function(n) { return categoryNameToPbId[categoryIdToName[n]]; }).filter(Boolean);
             if (resolvedCats.length) payload.categories = resolvedCats;
-            if (data.has_arm !== undefined) payload.has_arm = data.has_arm === true || data.has_arm === 'true';
+            // architectures replaces has_arm: a boolean could say "also ARM" but
+            // not "ARM only" or "amd64 only". A record written before the field
+            // existed is read through the old key so nothing silently drops.
+            if (Array.isArray(data.architectures)) {
+              payload.architectures = data.architectures.filter(function (a) { return a === 'amd64' || a === 'arm64'; });
+            } else if (data.has_arm !== undefined) {
+              payload.architectures = (data.has_arm === true || data.has_arm === 'true') ? ['amd64', 'arm64'] : ['amd64'];
+            }
+            if (Array.isArray(data.platforms)) {
+              payload.platforms = data.platforms.filter(function (p) { return p === 'pve' || p === 'incus'; });
+            }
+            if (Array.isArray(data.app_vars)) payload.app_vars = data.app_vars;
+            if (data.repository !== undefined) payload.repository = data.repository;
             if (data.version !== undefined) payload.version = data.version;
             if (data.changelog !== undefined) payload.changelog = data.changelog;
             if (data.screenshots !== undefined) payload.screenshots = data.screenshots;

CHANGELOG.md

@@ -518,6 +518,26 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-08-07
+
+### 🆕 New Scripts
+
+  - NetworkOptimizer ([#16328](https://github.com/community-scripts/ProxmoxVE/pull/16328))
+- Orb ([#16329](https://github.com/community-scripts/ProxmoxVE/pull/16329))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - HortusFox: start applying db migrations [@tomfrenzel](https://github.com/tomfrenzel) ([#16324](https://github.com/community-scripts/ProxmoxVE/pull/16324))
+    - Docker: report container updates instead of prompting, stop auto-updating Portainer Agent, fix addon detection of legacy Portainer [@MickLesk](https://github.com/MickLesk) ([#16298](https://github.com/community-scripts/ProxmoxVE/pull/16298))
+    - Immich: retry mise install on transient npm download failures [@MickLesk](https://github.com/MickLesk) ([#16301](https://github.com/community-scripts/ProxmoxVE/pull/16301))
+    - changedetection: remove msttcorefonts to fix install hang [@austinpilz](https://github.com/austinpilz) ([#16319](https://github.com/community-scripts/ProxmoxVE/pull/16319))
+
+  - #### 🔧 Refactor
+
+    - core: extend new vars and pocketbase values [@MickLesk](https://github.com/MickLesk) ([#16313](https://github.com/community-scripts/ProxmoxVE/pull/16313))
+
 ## 2026-08-06
 
 ### 🚀 Updated Scripts

CONTRIBUTING.md

@@ -103,6 +103,55 @@ Key rules at a glance:
 - Quote all variables: `"$VAR"` not `$VAR`
 - Use lowercase variable names
 - Do not hardcode credentials or sensitive values
+- Never prompt without an escape hatch — see below
+
+### Answering a prompt up front
+
+An install script that only asks cannot be deployed unattended. Read the
+variable first and prompt only when it is unset:
+
+```bash
+if [[ -z "${var_admin_user:-}" ]]; then
+  read -r -p "${TAB3}Admin username: " var_admin_user
+fi
+var_admin_user="${var_admin_user:-admin}"
+```
+
+Name them `var_<something>`, the same namespace the container variables use.
+`install/forgejo-runner-install.sh`, `install/pangolin-install.sh`, and `install/docker-install.sh` all
+follow this.
+
+The variable also has to be exported from `ct/<app>.sh`, or it never reaches
+the container — `lxc-attach` carries the caller's environment, but only for
+what was actually exported:
+
+```bash
+export var_admin_user="${var_admin_user:-}"
+```
+
+Declare them on the script's PocketBase record in `app_vars` so the website's
+generator can offer them as fields:
+
+```json
+"app_vars": [
+  {
+    "name": "var_admin_user",
+    "label": "Admin Username",
+    "type": "text",
+    "default": "admin"
+  },
+  {
+    "name": "var_admin_pass",
+    "label": "Admin Password",
+    "type": "password",
+    "secret": true
+  }
+]
+```
+
+`type` is one of `text`, `password`, `number`, `boolean` (`yes`/`no`) or
+`select` (with `options`). Mark anything credential-like `secret` — the
+generator keeps those out of shareable links and out of the on-screen summary.
 
 Full standards and examples: **[community-scripts.org/docs/contribution](https://community-scripts.org/docs/contribution)**
 

ct/docker.sh

@@ -42,20 +42,6 @@ function update_script() {
     echo -e "${TAB}${TAB}${GN}bash -c \"\$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/portainer.sh)\"${CL}"
   fi
 
-  if docker ps -a --format '{{.Names}}' | grep -q '^portainer_agent$'; then
-    msg_info "Updating Portainer Agent"
-    $STD docker pull portainer/agent:latest
-    $STD docker stop portainer_agent
-    $STD docker rm portainer_agent
-    $STD docker run -d \
-      -p 9001:9001 \
-      --name=portainer_agent \
-      --restart=always \
-      -v /var/run/docker.sock:/var/run/docker.sock \
-      -v /var/lib/docker/volumes:/var/lib/docker/volumes \
-      portainer/agent
-    msg_ok "Updated Portainer Agent"
-  fi
   msg_ok "Updated successfully!"
   exit
 }

ct/forgejo-runner.sh

@@ -18,6 +18,7 @@ var_nesting="${var_nesting:-1}"
 var_keyctl="${var_keyctl:-1}"
 
 export var_forgejo_instance="${var_forgejo_instance:-}"
+export var_forgejo_runner_uuid="${var_forgejo_runner_uuid:-}"
 export var_forgejo_runner_token="${var_forgejo_runner_token:-}"
 export var_runner_labels="${var_runner_labels:-}"
 
@@ -64,6 +65,10 @@ if [[ -n "${mode:-}" ]]; then
     msg_error "var_forgejo_instance is required for unattended installs."
     exit 1
   fi
+  if [[ -z "${var_forgejo_runner_uuid:-}" ]]; then
+    msg_error "var_forgejo_runner_uuid is required for unattended installs."
+    exit 1
+  fi
   if [[ -z "${var_forgejo_runner_token:-}" ]]; then
     msg_error "var_forgejo_runner_token is required for unattended installs."
     exit 1

ct/headers/networkoptimizer

@@ -0,0 +1,6 @@
+    _   __     __                      __   ____        __  _           _                
+   / | / /__  / /__      ______  _____/ /__/ __ \____  / /_(_)___ ___  (_)___  ___  _____
+  /  |/ / _ \/ __/ | /| / / __ \/ ___/ //_/ / / / __ \/ __/ / __ `__ \/ /_  / / _ \/ ___/
+ / /|  /  __/ /_ | |/ |/ / /_/ / /  / ,< / /_/ / /_/ / /_/ / / / / / / / / /_/  __/ /    
+/_/ |_/\___/\__/ |__/|__/\____/_/  /_/|_|\____/ .___/\__/_/_/ /_/ /_/_/ /___/\___/_/     
+                                             /_/                                         

ct/headers/orb

@@ -0,0 +1,6 @@
+   ____       __  
+  / __ \_____/ /_ 
+ / / / / ___/ __ \
+/ /_/ / /  / /_/ /
+\____/_/  /_.___/ 
+                  

ct/hortusfox.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
 # Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
+# Author: MickLesk (CanbiZ) | Co-Author: Tom Frenzel (tomfrenzel)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://github.com/danielbrendel/hortusfox-web
 
@@ -34,29 +34,56 @@ function update_script() {
     systemctl stop apache2
     msg_ok "Stopped Service"
 
-    msg_info "Backing up current HortusFox installation"
-    cd /opt
-    mv /opt/hortusfox/ /opt/hortusfox-backup
-    msg_ok "Backed up current HortusFox installation"
+    cd /opt/hortusfox
+    if [[ ! -s app/migrations/migrations.list ]]; then
+      msg_info "Rebuilding HortusFox migration history"
+      local database_tables
+      database_tables="$(mariadb -u root -D hortusfox -NBe "SELECT TABLE_NAME FROM information_schema.TABLES WHERE TABLE_SCHEMA = DATABASE();")"
+      : >app/migrations/migrations.list
+      local migration migration_file table_name
+      for migration in app/migrations/*.php; do
+        migration_file="${migration##*/}"
+        table_name="${migration_file%.php}"
+        if [[ "$migration_file" == "VersionModel.php" ]] || grep -Fxq "$table_name" <<<"$database_tables"; then
+          php -r 'echo hash("sha512", $argv[1]), PHP_EOL;' -- "$migration_file" >>app/migrations/migrations.list
+        fi
+      done
+      msg_ok "Rebuilt HortusFox migration history"
+    fi
+    if [[ ! -f app/migrations/verhist.json && -f ~/.hortusfox ]]; then
+      printf '["%s"]\n' "$(<~/.hortusfox)" >app/migrations/verhist.json
+    fi
+
+    create_backup \
+      /opt/hortusfox/.env \
+      /opt/hortusfox/app/migrations/migrations.list \
+      /opt/hortusfox/app/migrations/verhist.json \
+      /opt/hortusfox/public/img \
+      /opt/hortusfox/public/attachments \
+      /opt/hortusfox/public/backup \
+      /opt/hortusfox/public/exports \
+      /opt/hortusfox/public/snd \
+      /opt/hortusfox/public/themes
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "hortusfox" "danielbrendel/hortusfox-web" "tarball"
+    restore_backup
 
     msg_info "Updating HortusFox"
     cd /opt/hortusfox
-    cp /opt/hortusfox-backup/.env /opt/hortusfox/.env
-    cp -a /opt/hortusfox-backup/public/img/. /opt/hortusfox/public/img/
     export COMPOSER_ALLOW_SUPERUSER=1
     $STD composer install --no-dev --optimize-autoloader
+    $STD php asatru migrate:list
     $STD php asatru migrate:upgrade
-    $STD php asatru plants:attributes
     $STD php asatru calendar:classes
+    $STD php asatru plants:attributes
+    $STD php asatru aquashell:config
     chown -R www-data:www-data /opt/hortusfox
-    rm -r /opt/hortusfox-backup
     msg_ok "Updated HortusFox"
 
     msg_info "Starting Service"
     systemctl start apache2
     msg_ok "Started Service"
+
     msg_ok "Updated successfully!"
   fi
   exit

ct/immich.sh

@@ -214,7 +214,16 @@ EOF
     cd "$SRC_DIR"
     export MISE_TRUSTED_CONFIG_PATHS="$SRC_DIR"/mise.toml
     export MISE_DISABLE_TOOLS=github:jellyfin/jellyfin-ffmpeg
-    $STD mise install
+    mise_ok=0
+    for i in 1 2 3; do
+      $STD mise install && {
+        mise_ok=1
+        break
+      }
+      msg_warn "mise install failed (attempt $i/3) - retrying"
+      sleep 5
+    done
+    [[ "$mise_ok" -eq 1 ]] || exit 1
     export PATH="$(mise bin-paths 2>/dev/null | tr '\n' ':')$PATH"
     if ! command -v extism-js >/dev/null 2>&1; then
       # extism-js ships as a bare gzip-compressed single binary (.gz) that

ct/networkoptimizer.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Ozark-Connect/NetworkOptimizer
+
+APP="NetworkOptimizer"
+var_tags="${var_tags:-network;monitoring;unifi}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-12}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/networkoptimizer ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "networkoptimizer" "Ozark-Connect/NetworkOptimizer"; then
+    msg_info "Stopping Service"
+    systemctl stop networkoptimizer
+    msg_ok "Stopped Service"
+
+    create_backup /opt/networkoptimizer/networkoptimizer.env
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "networkoptimizer" "Ozark-Connect/NetworkOptimizer" "tarball"
+
+    msg_info "Rebuilding NetworkOptimizer"
+    RID="linux-x64"
+    [[ "$(dpkg --print-architecture)" == "arm64" ]] && RID="linux-arm64"
+    cd /opt/networkoptimizer
+    $STD dotnet publish src/NetworkOptimizer.Web -c Release -r "$RID" --self-contained -o /opt/networkoptimizer/publish
+    chmod +x /opt/networkoptimizer/publish/NetworkOptimizer.Web
+    mkdir -p /opt/networkoptimizer/publish/tools
+    cd /opt/networkoptimizer/src/uwnspeedtest
+    CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $STD go build -trimpath -ldflags "-s -w" -o /opt/networkoptimizer/publish/tools/uwnspeedtest-linux-arm64 .
+    msg_ok "Rebuilt NetworkOptimizer"
+
+    restore_backup
+
+    msg_info "Starting Service"
+    systemctl start networkoptimizer
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8042${CL}"

ct/orb.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: angusmaul
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://orb.net/
+
+APP="Orb"
+var_tags="${var_tags:-network;monitoring}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-512}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if ! dpkg -s orb >/dev/null 2>&1; then
+    msg_error "No ${APP} Installation Found!"
+    exit 233
+  fi
+
+  msg_info "Updating Orb"
+  $STD apt update
+  $STD apt install -y --only-upgrade orb
+  msg_ok "Updated successfully!"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}To link the sensor to your orb account run:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}pct exec ${CTID} -- runuser -u orb -- orb link${CL}"

ct/pangolin.sh

@@ -17,6 +17,9 @@ var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 var_tun="${var_tun:-1}"
 
+export var_pangolin_url="${var_pangolin_url:-}"
+export var_pangolin_email="${var_pangolin_email:-}"
+
 header_info "$APP"
 variables
 color

install/changedetection-install.sh

@@ -83,7 +83,6 @@ $STD apt-get install -y \
   fonts-kacst fonts-liberation \
   fonts-noto-cjk \
   fonts-noto-color-emoji \
-  msttcorefonts \
   fonts-roboto \
   fonts-thai-tlwg \
   fonts-wqy-zenhei

install/hortusfox-install.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 
 # Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
+# Author: MickLesk (CanbiZ) | Co-Author: Tom Frenzel (tomfrenzel)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
 # Source: https://github.com/danielbrendel/hortusfox-web
 
@@ -36,12 +36,15 @@ msg_ok "Composer dependencies installed"
 
 msg_info "Running DB migration"
 $STD php asatru migrate:fresh
+HORTUSFOX_VERSION="$(<~/.hortusfox)"
+printf '["%s"]\n' "$HORTUSFOX_VERSION" >/opt/hortusfox/app/migrations/verhist.json
 msg_ok "Migration finished"
 
 msg_info "Setting up HortusFox"
 $STD mariadb -u root -D $MARIADB_DB_NAME -e "INSERT IGNORE INTO AppModel (workspace, language, created_at) VALUES ('Default Workspace', 'en', NOW());"
-$STD php asatru plants:attributes
 $STD php asatru calendar:classes
+$STD php asatru plants:attributes
+$STD php asatru aquashell:config
 ADMIN_EMAIL="admin@example.com"
 ADMIN_PASS="$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)"
 ADMIN_HASH=$(php -r "echo password_hash('$ADMIN_PASS', PASSWORD_BCRYPT);")

install/immich-install.sh

@@ -355,7 +355,16 @@ cp LICENSE "$APP_DIR"
 cd "$SRC_DIR"
 export MISE_TRUSTED_CONFIG_PATHS="$SRC_DIR"/mise.toml
 export MISE_DISABLE_TOOLS=github:jellyfin/jellyfin-ffmpeg
-$STD mise install
+mise_ok=0
+for i in 1 2 3; do
+  $STD mise install && {
+    mise_ok=1
+    break
+  }
+  msg_warn "mise install failed (attempt $i/3) - retrying"
+  sleep 5
+done
+[[ "$mise_ok" -eq 1 ]] || exit 1
 export PATH="$(mise bin-paths 2>/dev/null | tr '\n' ':')$PATH"
 if ! command -v extism-js >/dev/null 2>&1; then
   # extism-js is published as a bare gzip-compressed single binary (.gz), which

install/networkoptimizer-install.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Ozark-Connect/NetworkOptimizer
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  git \
+  sshpass \
+  iperf3
+setup_deb822_repo \
+  "microsoft" \
+  "https://packages.microsoft.com/keys/microsoft-2025.asc" \
+  "https://packages.microsoft.com/debian/13/prod/" \
+  "trixie"
+$STD apt install -y dotnet-sdk-10.0
+msg_ok "Installed Dependencies"
+
+setup_go
+
+fetch_and_deploy_gh_release "networkoptimizer" "Ozark-Connect/NetworkOptimizer" "tarball"
+
+msg_info "Building NetworkOptimizer"
+RID="linux-x64"
+[[ "$(dpkg --print-architecture)" == "arm64" ]] && RID="linux-arm64"
+cd /opt/networkoptimizer
+export MinVerVersionOverride="$(cat ~/.networkoptimizer)"
+$STD dotnet publish src/NetworkOptimizer.Web -c Release -r "$RID" --self-contained -o /opt/networkoptimizer/publish
+chmod +x /opt/networkoptimizer/publish/NetworkOptimizer.Web
+msg_ok "Built NetworkOptimizer"
+
+msg_info "Building Gateway Speed Test Binary"
+mkdir -p /opt/networkoptimizer/publish/tools
+cd /opt/networkoptimizer/src/uwnspeedtest
+CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $STD go build -trimpath -ldflags "-s -w" -o /opt/networkoptimizer/publish/tools/uwnspeedtest-linux-arm64 .
+msg_ok "Built Gateway Speed Test Binary"
+
+msg_info "Configuring NetworkOptimizer"
+cat <<EOF >/opt/networkoptimizer/networkoptimizer.env
+ASPNETCORE_URLS=http://*:8042
+HOST_IP=${LOCAL_IP}
+Iperf3Server__Enabled=true
+EOF
+msg_ok "Configured NetworkOptimizer"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/networkoptimizer.service
+[Unit]
+Description=NetworkOptimizer
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/networkoptimizer/publish
+EnvironmentFile=/opt/networkoptimizer/networkoptimizer.env
+ExecStart=/opt/networkoptimizer/publish/NetworkOptimizer.Web
+Restart=always
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now networkoptimizer
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/orb-install.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: angusmaul
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://orb.net/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+setup_deb822_repo \
+  "orb" \
+  "https://pkgs.orb.net/stable/debian/orbforge.noarmor.gpg" \
+  "https://pkgs.orb.net/stable/debian" \
+  "orb" \
+  "main"
+
+msg_info "Installing Orb"
+$STD apt install -y orb
+msg_ok "Installed Orb"
+
+msg_info "Enabling Service"
+systemctl enable -q --now orb
+msg_ok "Enabled Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/pangolin-install.sh

@@ -27,9 +27,18 @@ fetch_and_deploy_gh_release "pangolin" "fosrl/pangolin" "tarball" "$PANGOLIN_VER
 fetch_and_deploy_gh_release "gerbil" "fosrl/gerbil" "singlefile" "latest" "/usr/bin" "gerbil_linux_$(arch_resolve)"
 fetch_and_deploy_gh_release "traefik" "traefik/traefik" "prebuild" "latest" "/usr/bin" "traefik_v*_linux_$(arch_resolve).tar.gz"
 
-read -rp "${TAB3}Enter your Pangolin URL (ex: https://pangolin.example.com): " pango_url
+# Read the variable first and prompt only when it is unset, so the install can
+# be supplied up front. Same convention as install/forgejo-runner-install.sh.
+pango_url="${var_pangolin_url:-}"
+if [[ -z "$pango_url" ]]; then
+  read -rp "${TAB3}Enter your Pangolin URL (ex: https://pangolin.example.com): " pango_url
+fi
 [[ "$pango_url" != https://* && "$pango_url" != http://* ]] && pango_url="https://${pango_url}"
-read -rp "${TAB3}Enter your email address: " pango_email
+
+pango_email="${var_pangolin_email:-}"
+if [[ -z "$pango_email" ]]; then
+  read -rp "${TAB3}Enter your email address: " pango_email
+fi
 
 msg_info "Setup Pangolin"
 SECRET_KEY=$(openssl rand -base64 48 | tr -dc 'A-Za-z0-9' | head -c 32)

misc/tools.func

@@ -4802,8 +4802,8 @@ EOF
 
   # Container Update Check
   # - Skipped entirely when running unattended / non-interactive
-  # - Compose-managed containers: offered via Y/N → docker compose pull + up -d
-  # - Standalone containers: offered via Y/N → image pull only (no stop/rm)
+  # - Lists containers with a newer image available and the command to update
+  #   them; does not pull/recreate anything itself
   if [ "$docker_installed" = true ] && ! _docker_is_noninteractive; then
     msg_info "Checking for container updates"
 
@@ -4841,41 +4841,14 @@ EOF
     if [[ ${#compose_updates[@]} -eq 0 && ${#standalone_updates[@]} -eq 0 ]]; then
       msg_ok "All containers are up-to-date"
     else
-      local reply
+      msg_warn "Updates available (not applied automatically):"
       for entry in "${compose_updates[@]}"; do
         IFS='|' read -r name image compose_workdir compose_service <<<"$entry"
-        reply=""
-        if read -r -t 60 -p "${TAB3}Update ${name} (${image}) via Compose? <y/N> (auto-no in 60s): " reply </dev/tty; then
-          echo ""
-        else
-          echo ""
-        fi
-        if [[ "${reply,,}" =~ ^(y|yes)$ ]]; then
-          msg_info "Updating $name"
-          if (cd "$compose_workdir" && $STD docker compose pull "$compose_service" && $STD docker compose up -d "$compose_service"); then
-            msg_ok "Updated $name"
-          else
-            msg_warn "Could not update $name — try manually in $compose_workdir"
-          fi
-        fi
+        echo -e "${TAB3}${name} (${image}) — update via: cd ${compose_workdir} && docker compose pull ${compose_service} && docker compose up -d ${compose_service}"
       done
-
       for entry in "${standalone_updates[@]}"; do
         IFS='|' read -r name image <<<"$entry"
-        reply=""
-        if read -r -t 60 -p "${TAB3}Pull new image for ${name} (${image})? <y/N> (auto-no in 60s): " reply </dev/tty; then
-          echo ""
-        else
-          echo ""
-        fi
-        if [[ "${reply,,}" =~ ^(y|yes)$ ]]; then
-          msg_info "Pulling new image for $name"
-          if $STD docker pull "$image"; then
-            msg_ok "New image available for $name — recreate the container to apply the update"
-          else
-            msg_warn "Failed to pull image for $name"
-          fi
-        fi
+        echo -e "${TAB3}${name} (${image}) — update via: docker pull ${image} && docker restart ${name}"
       done
     fi
   fi

tools/addon/portainer.sh

@@ -49,6 +49,22 @@ function uninstall() {
   msg_ok "${APP} has been uninstalled"
 }
 
+# ==============================================================================
+# UPDATE SCRIPT HELPER
+# ==============================================================================
+function ensure_update_script() {
+  [[ -f /usr/local/bin/update_portainer ]] && return 0
+
+  msg_info "Creating update script"
+  cat <<'UPDATEEOF' >/usr/local/bin/update_portainer
+#!/usr/bin/env bash
+# Portainer Update Script
+type=update bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/portainer.sh)"
+UPDATEEOF
+  chmod +x /usr/local/bin/update_portainer
+  msg_ok "Created update script (/usr/local/bin/update_portainer)"
+}
+
 # ==============================================================================
 # UPDATE
 # ==============================================================================
@@ -62,6 +78,8 @@ function update() {
   $STD docker compose up -d --remove-orphans
   msg_ok "Restarted ${APP}"
 
+  ensure_update_script
+
   msg_ok "Updated successfully"
   exit
 }
@@ -115,15 +133,7 @@ function install() {
   $STD docker compose up -d
   msg_ok "Started ${APP}"
 
-  # Create update script
-  msg_info "Creating update script"
-  cat <<'UPDATEEOF' >/usr/local/bin/update_portainer
-#!/usr/bin/env bash
-# Portainer Update Script
-type=update bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/portainer.sh)"
-UPDATEEOF
-  chmod +x /usr/local/bin/update_portainer
-  msg_ok "Created update script (/usr/local/bin/update_portainer)"
+  ensure_update_script
 
   echo ""
   msg_ok "${APP} is reachable at: ${BL}https://${LOCAL_IP}:${DEFAULT_PORT}${CL}"
@@ -150,6 +160,9 @@ fi
 header_info
 get_lxc_ip
 
+check_docker
+check_existing_container
+
 # Check if already installed
 if [[ -f "$COMPOSE_FILE" ]]; then
   msg_warn "${APP} is already installed."