ReadMeABook: start the scheduler with the service

Only GET /api/init creates the scheduled jobs and starts the scheduler; upstream's image calls it after every start, the LXC never did (#17945). An ExecStartPost hook now waits for the app and Redis like app-start.sh, and update adds it to existing installs.

.github/changelogs/2026/10.md

@@ -1,3 +1,190 @@
+## 2026-10-10
+
+### 🆕 New Scripts
+
+  - Weblate ([#17837](https://github.com/community-scripts/ProxmoxVE/pull/17837))
+- CertMate ([#17803](https://github.com/community-scripts/ProxmoxVE/pull/17803))
+- AnythingLLM ([#17802](https://github.com/community-scripts/ProxmoxVE/pull/17802))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - update endurain repo from codeberg to gh [@johanngrobe](https://github.com/johanngrobe) ([#17831](https://github.com/community-scripts/ProxmoxVE/pull/17831))
+    - Immich: download countryInfo.txt into the geodata directory on update [@claytonfaria](https://github.com/claytonfaria) ([#17823](https://github.com/community-scripts/ProxmoxVE/pull/17823))
+    - paperclip: keep root and skip /opt/paperclip-data chown when PAPERCLIP_HOME is custom [@austinpilz](https://github.com/austinpilz) ([#17825](https://github.com/community-scripts/ProxmoxVE/pull/17825))
+
+## 2026-10-09
+
+### 🆕 New Scripts
+
+  - FoldingAtHome ([#17799](https://github.com/community-scripts/ProxmoxVE/pull/17799))
+- LocalAI ([#17801](https://github.com/community-scripts/ProxmoxVE/pull/17801))
+- Tvheadend ([#17800](https://github.com/community-scripts/ProxmoxVE/pull/17800))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - OpenCloud: fix Collabora embedding with Collabora 26.04.4 [@SimKaiLong](https://github.com/SimKaiLong) ([#17810](https://github.com/community-scripts/ProxmoxVE/pull/17810))
+
+  - #### 🔧 Refactor
+
+    - Immich: survive an interrupted update and a failing ML build [@MickLesk](https://github.com/MickLesk) ([#17798](https://github.com/community-scripts/ProxmoxVE/pull/17798))
+
+### 💾 Core
+
+  - check_for_release: compare against the release marked as latest [@MickLesk](https://github.com/MickLesk) ([core#125](https://github.com/community-scripts/core/pull/125))
+
+### 🧰 Tools
+
+  - #### ✨ New Features
+
+    - FileBrowser Quantum: migrate the config and database to v2 [@MickLesk](https://github.com/MickLesk) ([#17815](https://github.com/community-scripts/ProxmoxVE/pull/17815))
+
+## 2026-10-08
+
+### 🆕 New Scripts
+
+  - Unifi-OS-Server VM ([#17752](https://github.com/community-scripts/ProxmoxVE/pull/17752))
+- ZimaOS VM ([#17778](https://github.com/community-scripts/ProxmoxVE/pull/17778))
+
+### 🚀 Updated Scripts
+
+  - Revert "Immich: Pin to v3.3.0" [@MickLesk](https://github.com/MickLesk) ([#17767](https://github.com/community-scripts/ProxmoxVE/pull/17767))
+
+  - #### 🐞 Bug Fixes
+
+    - Homarr: replace the musl better-sqlite3 that v2.3.0 ships for Debian [@MickLesk](https://github.com/MickLesk) ([#17789](https://github.com/community-scripts/ProxmoxVE/pull/17789))
+    - CLIProxyAPI: keep plugins and data across updates [@MickLesk](https://github.com/MickLesk) ([#17790](https://github.com/community-scripts/ProxmoxVE/pull/17790))
+    - Kima-Hub: install the Python services into a uv venv [@MickLesk](https://github.com/MickLesk) ([#17791](https://github.com/community-scripts/ProxmoxVE/pull/17791))
+
+  - #### ✨ New Features
+
+    - Immich: Pin to 3.3.0 / Update ML Python to 3.13 [@MickLesk](https://github.com/MickLesk) ([#17770](https://github.com/community-scripts/ProxmoxVE/pull/17770))
+
+  - #### 🔧 Refactor
+
+    - Refactor: OPNsense VM [@MickLesk](https://github.com/MickLesk) ([#17785](https://github.com/community-scripts/ProxmoxVE/pull/17785))
+    - Refactor: Nextcloud VM (Turnkey) [@MickLesk](https://github.com/MickLesk) ([#17787](https://github.com/community-scripts/ProxmoxVE/pull/17787))
+    - Refactor: OpenWrt VM [@MickLesk](https://github.com/MickLesk) ([#17774](https://github.com/community-scripts/ProxmoxVE/pull/17774))
+    - Refactor: Ubuntu VM [@MickLesk](https://github.com/MickLesk) ([#17776](https://github.com/community-scripts/ProxmoxVE/pull/17776))
+
+### 💾 Core
+
+  - Tolerate a missing datacenter.cfg in vm_keyboard_default [@MickLesk](https://github.com/MickLesk) ([core#124](https://github.com/community-scripts/core/pull/124))
+- Take the ISO storage from the disk pool when it can hold ISOs [@MickLesk](https://github.com/MickLesk) ([core#122](https://github.com/community-scripts/core/pull/122))
+- Shared VM helpers: disk import, releases, checksums, first boot, IP by MAC [@MickLesk](https://github.com/MickLesk) ([core#117](https://github.com/community-scripts/core/pull/117))
+- tools: forge truncated release list [@MickLesk](https://github.com/MickLesk) ([core#118](https://github.com/community-scripts/core/pull/118))
+- Remember a kept cached image until the upstream changes [@MickLesk](https://github.com/MickLesk) ([core#119](https://github.com/community-scripts/core/pull/119))
+- Choose the VM keyboard layout and carry the host's timezone into prepared images [@MickLesk](https://github.com/MickLesk) ([core#120](https://github.com/community-scripts/core/pull/120))
+- VM's: run first-boot units without debconf dialogs [@MickLesk](https://github.com/MickLesk) ([core#121](https://github.com/community-scripts/core/pull/121))
+
+## 2026-10-07
+
+### 🆕 New Scripts
+
+  - Fedora VM ([#17747](https://github.com/community-scripts/ProxmoxVE/pull/17747))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - AudioMuse-AI: replace the venv on update without asking [@MickLesk](https://github.com/MickLesk) ([#17738](https://github.com/community-scripts/ProxmoxVE/pull/17738))
+    - paperclip: run as a dedicated non-root user so Claude Code can skip permissions [@samvandenbossche](https://github.com/samvandenbossche) ([#17707](https://github.com/community-scripts/ProxmoxVE/pull/17707))
+    - Thingsboard: update Java version from 17 to 25 [@CerberusStyle](https://github.com/CerberusStyle) ([#17733](https://github.com/community-scripts/ProxmoxVE/pull/17733))
+
+  - #### ✨ New Features
+
+    - Immich: Pin to v3.3.0 [@vhsdream](https://github.com/vhsdream) ([#17759](https://github.com/community-scripts/ProxmoxVE/pull/17759))
+
+  - #### 💥 Breaking Changes
+
+    - OpenCloud: bump to v8.1.0, rebuild search index on upgrade [@SimKaiLong](https://github.com/SimKaiLong) ([#17710](https://github.com/community-scripts/ProxmoxVE/pull/17710))
+
+  - #### 🔧 Refactor
+
+    - Pangolin: Unpin Release, stable enough, Bump to latest [@MickLesk](https://github.com/MickLesk) ([#17740](https://github.com/community-scripts/ProxmoxVE/pull/17740))
+    - Refactor: Archlinux-VM [@MickLesk](https://github.com/MickLesk) ([#17741](https://github.com/community-scripts/ProxmoxVE/pull/17741))
+    - Refactor: MikroTik RouterOS [@MickLesk](https://github.com/MickLesk) ([#17748](https://github.com/community-scripts/ProxmoxVE/pull/17748))
+
+### 💾 Core
+
+  - Fix Fedora and BLS cloud image console setup [@MickLesk](https://github.com/MickLesk) ([core#116](https://github.com/community-scripts/core/pull/116))
+- Keep setup_nodejs alive when the caller's directory is gone [@MickLesk](https://github.com/MickLesk) ([core#114](https://github.com/community-scripts/core/pull/114))
+
+## 2026-10-06
+
+### 🆕 New Scripts
+
+  - Pricebuddy ([#17708](https://github.com/community-scripts/ProxmoxVE/pull/17708))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Webtrees: stop serving data/ and the source folders directly [@MickLesk](https://github.com/MickLesk) ([#17724](https://github.com/community-scripts/ProxmoxVE/pull/17724))
+
+### 💾 Core
+
+  - Incus: check the architecture on Incus hosts too [@MickLesk](https://github.com/MickLesk) ([core#113](https://github.com/community-scripts/core/pull/113))
+- Incus: Pass the app's var_* settings into Incus containers  [@MickLesk](https://github.com/MickLesk) ([core#112](https://github.com/community-scripts/core/pull/112))
+- Incus: stub storage_content_check on Incus [@MickLesk](https://github.com/MickLesk) ([core#104](https://github.com/community-scripts/core/pull/104))
+- Incus: map Proxmox template versions to Incus image names [@MickLesk](https://github.com/MickLesk) ([core#111](https://github.com/community-scripts/core/pull/111))
+- Incus: read storage names from .vars files  [@MickLesk](https://github.com/MickLesk) ([core#110](https://github.com/community-scripts/core/pull/110))
+- Incus: show the spinner inside containers again [@MickLesk](https://github.com/MickLesk) ([core#109](https://github.com/community-scripts/core/pull/109))
+- Incus: set the hostname with sh, so it works before bash is installed [@MickLesk](https://github.com/MickLesk) ([core#102](https://github.com/community-scripts/core/pull/102))
+- Incus: reserve a plain address on Incus, leave the gateway to the network [@MickLesk](https://github.com/MickLesk) ([core#101](https://github.com/community-scripts/core/pull/101))
+- Incus: Wait for the network on Alpine OS too [@MickLesk](https://github.com/MickLesk) ([core#105](https://github.com/community-scripts/core/pull/105))
+- Incus: do not fail the build when hostname -I is missing [@MickLesk](https://github.com/MickLesk) ([core#103](https://github.com/community-scripts/core/pull/103))
+- Incus: Fuse always in unprivileged Containers, attach TUN only when container lacks it [@MickLesk](https://github.com/MickLesk) ([core#108](https://github.com/community-scripts/core/pull/108))
+- Incus: accept mode=generated [@MickLesk](https://github.com/MickLesk) ([core#106](https://github.com/community-scripts/core/pull/106))
+- Incus: pass the full install environment into Incus containers (quoted) [@MickLesk](https://github.com/MickLesk) ([core#107](https://github.com/community-scripts/core/pull/107))
+
+## 2026-10-05
+
+### 🚀 Updated Scripts
+
+  - Point to DevScripts, the renamed ProxmoxVED [@MickLesk](https://github.com/MickLesk) ([#17694](https://github.com/community-scripts/ProxmoxVE/pull/17694))
+
+  - #### 🐞 Bug Fixes
+
+    - wanderer: set the proxy secret and install plugins in their own directories [@MickLesk](https://github.com/MickLesk) ([#17698](https://github.com/community-scripts/ProxmoxVE/pull/17698))
+    - discourse: serve stylesheets and repair the update [@MickLesk](https://github.com/MickLesk) ([#17697](https://github.com/community-scripts/ProxmoxVE/pull/17697))
+    - wikijs: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17689](https://github.com/community-scripts/ProxmoxVE/pull/17689))
+    - jotty: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17688](https://github.com/community-scripts/ProxmoxVE/pull/17688))
+
+### 💾 Core
+
+  - Read releases from github.com when the API is rate limited, resume stalled downloads [@MickLesk](https://github.com/MickLesk) ([core#99](https://github.com/community-scripts/core/pull/99))
+- Check for template and container storage before the settings menu [@MickLesk](https://github.com/MickLesk) ([core#98](https://github.com/community-scripts/core/pull/98))
+- Check /etc/pve before the settings menu [@MickLesk](https://github.com/MickLesk) ([core#97](https://github.com/community-scripts/core/pull/97))
+- Check container settings before pct create rejects them [@MickLesk](https://github.com/MickLesk) ([core#96](https://github.com/community-scripts/core/pull/96))
+- PVE: Smart Diagnosis - say why a container would not start [@MickLesk](https://github.com/MickLesk) ([core#95](https://github.com/community-scripts/core/pull/95))
+- Retry template downloads that pveam reports as done but are not [@MickLesk](https://github.com/MickLesk) ([core#94](https://github.com/community-scripts/core/pull/94))
+- Check the OS release against pve-container before creating anything [@MickLesk](https://github.com/MickLesk) ([core#93](https://github.com/community-scripts/core/pull/93))
+- Rename "ProxmoxVED"-Links to "DevScripts" [@MickLesk](https://github.com/MickLesk) ([core#91](https://github.com/community-scripts/core/pull/91))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - monitor-all: read container IPs from the host side [@jasonobrien](https://github.com/jasonobrien) ([#17686](https://github.com/community-scripts/ProxmoxVE/pull/17686))
+
+## 2026-10-04
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - immich: read the Intel runtime from the pinned release [@MickLesk](https://github.com/MickLesk) ([#17677](https://github.com/community-scripts/ProxmoxVE/pull/17677))
+
+### 💾 Core
+
+  - better explain unsupported version & upgrade path for pve [@MickLesk](https://github.com/MickLesk) ([core#86](https://github.com/community-scripts/core/pull/86))
+- Quote PostgreSQL identifiers and drop spaces from the creds file name [@MickLesk](https://github.com/MickLesk) ([core#89](https://github.com/community-scripts/core/pull/89))
+- Find the default Rust toolchain in current rustup output [@MickLesk](https://github.com/MickLesk) ([core#88](https://github.com/community-scripts/core/pull/88))
+
 ## 2026-10-03
 
 ### 🆕 New Scripts

.github/dependabot.yml

@@ -1,17 +1,14 @@
-# Keeps the GitHub Actions referenced in .github/workflows up to date.
-# https://docs.github.com/code-security/dependabot/working-with-dependabot/dependabot-options-reference
 version: 2
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
+    labels: []
     schedule:
       interval: "weekly"
-      day: "monday"
-    open-pull-requests-limit: 5
-    labels:
-      - "dependencies"
-    # One PR per week for all action bumps instead of one PR per action.
+    target-branch: "main"
+    cooldown:
+      default-days: 7
     groups:
-      github-actions:
+      actions:
         patterns:
           - "*"

CHANGELOG.md

@@ -113,6 +113,9 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 
 
+
+
+
 
 
 
@@ -126,7 +129,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 
 <details>
-<summary><h4>October (3 entries)</h4></summary>
+<summary><h4>October (10 entries)</h4></summary>
 
 [View October 2026 Changelog](.github/changelogs/2026/10.md)
 
@@ -559,6 +562,205 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-10-15
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(apprise-api): copy static assets into the served directory [@brokentokin](https://github.com/brokentokin) ([#17940](https://github.com/community-scripts/ProxmoxVE/pull/17940))
+    - Bytestash: modify backup process | Update Resources [@MickLesk](https://github.com/MickLesk) ([#17935](https://github.com/community-scripts/ProxmoxVE/pull/17935))
+    - Zabbix: Add '-y' flag to apt install commands [@MickLesk](https://github.com/MickLesk) ([#17933](https://github.com/community-scripts/ProxmoxVE/pull/17933))
+    - karakeep: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17087](https://github.com/community-scripts/ProxmoxVE/pull/17087))
+
+### 💾 Core
+
+  - Keep VM release lookups working without system.func [@MickLesk](https://github.com/MickLesk) ([core#144](https://github.com/community-scripts/core/pull/144))
+- Stop calling exit 1 "Operation not permitted" at several steps [@MickLesk](https://github.com/MickLesk) ([core#140](https://github.com/community-scripts/core/pull/140))
+
+## 2026-10-14
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Paperclip: fall back to a non-frozen install when the release lockfile is stale [@MickLesk](https://github.com/MickLesk) ([#17922](https://github.com/community-scripts/ProxmoxVE/pull/17922))
+
+  - #### 🔧 Refactor
+
+    - Immich: rebuild the image libraries when the revision record is missing [@MickLesk](https://github.com/MickLesk) ([#17919](https://github.com/community-scripts/ProxmoxVE/pull/17919))
+
+### 💾 Core
+
+  - Show what the failing command printed, and keep verbose output in the log [@MickLesk](https://github.com/MickLesk) ([core#139](https://github.com/community-scripts/core/pull/139))
+- Install jq before the release lookup and show what a non-JSON answer was [@MickLesk](https://github.com/MickLesk) ([core#138](https://github.com/community-scripts/core/pull/138))
+- Refresh the NodeSource key before a same-major Node.js update [@MickLesk](https://github.com/MickLesk) ([core#137](https://github.com/community-scripts/core/pull/137))
+- github: say why a forge could not be reached instead of 'connection failed' [@MickLesk](https://github.com/MickLesk) ([core#136](https://github.com/community-scripts/core/pull/136))
+
+## 2026-10-13
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Fix URL for downloading OneDev latest release [@ryansully](https://github.com/ryansully) ([#17915](https://github.com/community-scripts/ProxmoxVE/pull/17915))
+    - LocalAI: pin the CPU backends when the container has no GPU runtime [@MickLesk](https://github.com/MickLesk) ([#17909](https://github.com/community-scripts/ProxmoxVE/pull/17909))
+    - [Gluetun] Update GitHub repository source install and update. [@CerberusStyle](https://github.com/CerberusStyle) ([#17899](https://github.com/community-scripts/ProxmoxVE/pull/17899))
+    - Immich: Bump to 3.3.1 and restore (failed) geodata/countryInfo.txt on update  [@MickLesk](https://github.com/MickLesk) ([#17894](https://github.com/community-scripts/ProxmoxVE/pull/17894))
+    - WikiJS: use v2 Repo until v3 is stable [@MickLesk](https://github.com/MickLesk) ([#17895](https://github.com/community-scripts/ProxmoxVE/pull/17895))
+
+  - #### 💥 Breaking Changes
+
+    - zammad: Debian 13, new apt repo, Elasticsearch 8 [@durzo](https://github.com/durzo) ([#17836](https://github.com/community-scripts/ProxmoxVE/pull/17836))
+
+### 💾 Core
+
+  - Keep the version key parseable by jq 1.6 [@MickLesk](https://github.com/MickLesk) ([core#134](https://github.com/community-scripts/core/pull/134))
+
+## 2026-10-12
+
+### 🆕 New Scripts
+
+  - WatchState ([#17881](https://github.com/community-scripts/ProxmoxVE/pull/17881))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - chore(ct): sync wazuh defaults with PocketBase [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17889](https://github.com/community-scripts/ProxmoxVE/pull/17889))
+    - Wanderer: bring back the wanderer-pb wrapper [@MickLesk](https://github.com/MickLesk) ([#17874](https://github.com/community-scripts/ProxmoxVE/pull/17874))
+    - Tracearr: install only the server's production dependencies [@MickLesk](https://github.com/MickLesk) ([#17873](https://github.com/community-scripts/ProxmoxVE/pull/17873))
+    - Paperless-ngx: QoL restart crashed services | patch regex [@MickLesk](https://github.com/MickLesk) ([#17812](https://github.com/community-scripts/ProxmoxVE/pull/17812))
+    - Splunk Enterprise: start the service as the splunk user [@rcastley](https://github.com/rcastley) ([#17816](https://github.com/community-scripts/ProxmoxVE/pull/17816))
+
+### 💾 Core
+
+  - Draw a Community Scripts banner while a script has no header of its own [@MickLesk](https://github.com/MickLesk) ([core#133](https://github.com/community-scripts/core/pull/133))
+- Order pre-release labels when comparing versions [@MickLesk](https://github.com/MickLesk) ([core#132](https://github.com/community-scripts/core/pull/132))
+- gh: curl_download: wait between attempts [@MickLesk](https://github.com/MickLesk) ([core#131](https://github.com/community-scripts/core/pull/131))
+
+### 🧰 Tools
+
+  - #### ✨ New Features
+
+    - Immich Public Proxy: optional visitor upload service (v4 Release) [@MickLesk](https://github.com/MickLesk) ([#17875](https://github.com/community-scripts/ProxmoxVE/pull/17875))
+
+## 2026-10-11
+
+### 🆕 New Scripts
+
+  - Cinephage ([#17852](https://github.com/community-scripts/ProxmoxVE/pull/17852))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Immich: build libvips with JPEG 2000 support [@MickLesk](https://github.com/MickLesk) ([#17864](https://github.com/community-scripts/ProxmoxVE/pull/17864))
+    - hermesagent: match the relaunched root gateway regardless of interpreter [@MickLesk](https://github.com/MickLesk) ([#17847](https://github.com/community-scripts/ProxmoxVE/pull/17847))
+    - Radicale: install the bcrypt and argon2 extras [@MickLesk](https://github.com/MickLesk) ([#17813](https://github.com/community-scripts/ProxmoxVE/pull/17813))
+    - fix(zigbee2mqtt): preserve backup stream and prevent filename collisions [@petermnt](https://github.com/petermnt) ([#17751](https://github.com/community-scripts/ProxmoxVE/pull/17751))
+
+  - #### ✨ New Features
+
+    - QoL: let var_* answer the optional add-on prompts [@MickLesk](https://github.com/MickLesk) ([#17858](https://github.com/community-scripts/ProxmoxVE/pull/17858))
+    - QoL: Confirm third-party installers through confirm_external_installer [@MickLesk](https://github.com/MickLesk) ([#17857](https://github.com/community-scripts/ProxmoxVE/pull/17857))
+    - docker: take the lxcfs toggle, TCP socket and Compose choice from app variables [@MickLesk](https://github.com/MickLesk) ([#17850](https://github.com/community-scripts/ProxmoxVE/pull/17850))
+
+  - #### 🔧 Refactor
+
+    - RustDesk Server: run the official server, make the web UI optional [@MickLesk](https://github.com/MickLesk) ([#17854](https://github.com/community-scripts/ProxmoxVE/pull/17854))
+    - Caddy: install the .deb from GitHub instead of the Cloudsmith repo [@MickLesk](https://github.com/MickLesk) ([#17862](https://github.com/community-scripts/ProxmoxVE/pull/17862))
+
+### 💾 Core
+
+  - Add confirm_external_installer [@MickLesk](https://github.com/MickLesk) ([core#130](https://github.com/community-scripts/core/pull/130))
+- setup_docker: make LXC resource limits visible to nested containers [@andrebrait](https://github.com/andrebrait) ([core#9](https://github.com/community-scripts/core/pull/9))
+- Incus: fix ENABLE_FUSE / TUN vars [@MickLesk](https://github.com/MickLesk) ([core#127](https://github.com/community-scripts/core/pull/127))
+- Resolve a uv required-version range to the newest release inside it [@MickLesk](https://github.com/MickLesk) ([core#126](https://github.com/community-scripts/core/pull/126))
+- Upgrade MongoDB in place when an app package depends on it [@MickLesk](https://github.com/MickLesk) ([core#128](https://github.com/community-scripts/core/pull/128))
+
+## 2026-10-10
+
+### 🆕 New Scripts
+
+  - Weblate ([#17837](https://github.com/community-scripts/ProxmoxVE/pull/17837))
+- CertMate ([#17803](https://github.com/community-scripts/ProxmoxVE/pull/17803))
+- AnythingLLM ([#17802](https://github.com/community-scripts/ProxmoxVE/pull/17802))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - update endurain repo from codeberg to gh [@johanngrobe](https://github.com/johanngrobe) ([#17831](https://github.com/community-scripts/ProxmoxVE/pull/17831))
+    - Immich: download countryInfo.txt into the geodata directory on update [@claytonfaria](https://github.com/claytonfaria) ([#17823](https://github.com/community-scripts/ProxmoxVE/pull/17823))
+    - paperclip: keep root and skip /opt/paperclip-data chown when PAPERCLIP_HOME is custom [@austinpilz](https://github.com/austinpilz) ([#17825](https://github.com/community-scripts/ProxmoxVE/pull/17825))
+
+## 2026-10-09
+
+### 🆕 New Scripts
+
+  - FoldingAtHome ([#17799](https://github.com/community-scripts/ProxmoxVE/pull/17799))
+- LocalAI ([#17801](https://github.com/community-scripts/ProxmoxVE/pull/17801))
+- Tvheadend ([#17800](https://github.com/community-scripts/ProxmoxVE/pull/17800))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - OpenCloud: fix Collabora embedding with Collabora 26.04.4 [@SimKaiLong](https://github.com/SimKaiLong) ([#17810](https://github.com/community-scripts/ProxmoxVE/pull/17810))
+
+  - #### 🔧 Refactor
+
+    - Immich: survive an interrupted update and a failing ML build [@MickLesk](https://github.com/MickLesk) ([#17798](https://github.com/community-scripts/ProxmoxVE/pull/17798))
+
+### 💾 Core
+
+  - check_for_release: compare against the release marked as latest [@MickLesk](https://github.com/MickLesk) ([core#125](https://github.com/community-scripts/core/pull/125))
+
+### 🧰 Tools
+
+  - #### ✨ New Features
+
+    - FileBrowser Quantum: migrate the config and database to v2 [@MickLesk](https://github.com/MickLesk) ([#17815](https://github.com/community-scripts/ProxmoxVE/pull/17815))
+
+## 2026-10-08
+
+### 🆕 New Scripts
+
+  - Unifi-OS-Server VM ([#17752](https://github.com/community-scripts/ProxmoxVE/pull/17752))
+- ZimaOS VM ([#17778](https://github.com/community-scripts/ProxmoxVE/pull/17778))
+
+### 🚀 Updated Scripts
+
+  - Revert "Immich: Pin to v3.3.0" [@MickLesk](https://github.com/MickLesk) ([#17767](https://github.com/community-scripts/ProxmoxVE/pull/17767))
+
+  - #### 🐞 Bug Fixes
+
+    - Homarr: replace the musl better-sqlite3 that v2.3.0 ships for Debian [@MickLesk](https://github.com/MickLesk) ([#17789](https://github.com/community-scripts/ProxmoxVE/pull/17789))
+    - CLIProxyAPI: keep plugins and data across updates [@MickLesk](https://github.com/MickLesk) ([#17790](https://github.com/community-scripts/ProxmoxVE/pull/17790))
+    - Kima-Hub: install the Python services into a uv venv [@MickLesk](https://github.com/MickLesk) ([#17791](https://github.com/community-scripts/ProxmoxVE/pull/17791))
+
+  - #### ✨ New Features
+
+    - Immich: Pin to 3.3.0 / Update ML Python to 3.13 [@MickLesk](https://github.com/MickLesk) ([#17770](https://github.com/community-scripts/ProxmoxVE/pull/17770))
+
+  - #### 🔧 Refactor
+
+    - Refactor: OPNsense VM [@MickLesk](https://github.com/MickLesk) ([#17785](https://github.com/community-scripts/ProxmoxVE/pull/17785))
+    - Refactor: Nextcloud VM (Turnkey) [@MickLesk](https://github.com/MickLesk) ([#17787](https://github.com/community-scripts/ProxmoxVE/pull/17787))
+    - Refactor: OpenWrt VM [@MickLesk](https://github.com/MickLesk) ([#17774](https://github.com/community-scripts/ProxmoxVE/pull/17774))
+    - Refactor: Ubuntu VM [@MickLesk](https://github.com/MickLesk) ([#17776](https://github.com/community-scripts/ProxmoxVE/pull/17776))
+
+### 💾 Core
+
+  - Tolerate a missing datacenter.cfg in vm_keyboard_default [@MickLesk](https://github.com/MickLesk) ([core#124](https://github.com/community-scripts/core/pull/124))
+- Take the ISO storage from the disk pool when it can hold ISOs [@MickLesk](https://github.com/MickLesk) ([core#122](https://github.com/community-scripts/core/pull/122))
+- Shared VM helpers: disk import, releases, checksums, first boot, IP by MAC [@MickLesk](https://github.com/MickLesk) ([core#117](https://github.com/community-scripts/core/pull/117))
+- tools: forge truncated release list [@MickLesk](https://github.com/MickLesk) ([core#118](https://github.com/community-scripts/core/pull/118))
+- Remember a kept cached image until the upstream changes [@MickLesk](https://github.com/MickLesk) ([core#119](https://github.com/community-scripts/core/pull/119))
+- Choose the VM keyboard layout and carry the host's timezone into prepared images [@MickLesk](https://github.com/MickLesk) ([core#120](https://github.com/community-scripts/core/pull/120))
+- VM's: run first-boot units without debconf dialogs [@MickLesk](https://github.com/MickLesk) ([core#121](https://github.com/community-scripts/core/pull/121))
+
 ## 2026-10-07
 
 ### 🆕 New Scripts
@@ -1188,145 +1390,4 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ### 📚 Documentation
 
-  - issue template: add PVE release, execution context and phase; refresh distro list / pve versions [@MickLesk](https://github.com/MickLesk) ([#17160](https://github.com/community-scripts/ProxmoxVE/pull/17160))
-
-## 2026-09-10
-
-### 🆕 New Scripts
-
-  - Chevereto ([#17131](https://github.com/community-scripts/ProxmoxVE/pull/17131))
-- Portabase ([#17111](https://github.com/community-scripts/ProxmoxVE/pull/17111))
-- Logseq ([#17112](https://github.com/community-scripts/ProxmoxVE/pull/17112))
-- Safebucket ([#17096](https://github.com/community-scripts/ProxmoxVE/pull/17096))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Immich v3.2.0 [@vhsdream](https://github.com/vhsdream) ([#17137](https://github.com/community-scripts/ProxmoxVE/pull/17137))
-    - fix(solidtime): prevent composer install from hanging on root prompt [@supersoju](https://github.com/supersoju) ([#17146](https://github.com/community-scripts/ProxmoxVE/pull/17146))
-    - fix(hermesagent): wait for root gateway cleanup [@steveonjava](https://github.com/steveonjava) ([#17147](https://github.com/community-scripts/ProxmoxVE/pull/17147))
-
-### 💾 Core
-
-  - Keep the script name when regenerating the entrypoint [@MickLesk](https://github.com/MickLesk) ([core#35](https://github.com/community-scripts/core/pull/35))
-- Rewrite the dead Gitea base onto GitHub instead of failing the update [@MickLesk](https://github.com/MickLesk) ([core#33](https://github.com/community-scripts/core/pull/33))
-- core.func: fall back to a usable HOME when the shell has none [@MickLesk](https://github.com/MickLesk) ([core#32](https://github.com/community-scripts/core/pull/32))
-
-## 2026-09-09
-
-### 🆕 New Scripts
-
-  - Lingarr ([#17130](https://github.com/community-scripts/ProxmoxVE/pull/17130))
-
-### 🚀 Updated Scripts
-
-  - vm: drop the discussions link from the summary [@MickLesk](https://github.com/MickLesk) ([#17117](https://github.com/community-scripts/ProxmoxVE/pull/17117))
-
-  - #### 🐞 Bug Fixes
-
-    - fix(hermesagent): stop spurious root gateway after update [@steveonjava](https://github.com/steveonjava) ([#17126](https://github.com/community-scripts/ProxmoxVE/pull/17126))
-
-## 2026-09-08
-
-### 🆕 New Scripts
-
-  - Decypharr ([#17108](https://github.com/community-scripts/ProxmoxVE/pull/17108))
-- Stash ([#17106](https://github.com/community-scripts/ProxmoxVE/pull/17106))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Update Jellyfin FFmpeg dependency to version 8 [@MickLesk](https://github.com/MickLesk) ([#17109](https://github.com/community-scripts/ProxmoxVE/pull/17109))
-
-### 💾 Core
-
-  - Treat a cut-short forge response as a failure, not as HTTP 200 [@MickLesk](https://github.com/MickLesk) ([core#31](https://github.com/community-scripts/core/pull/31))
-- Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#28](https://github.com/community-scripts/core/pull/28))
-- cloud-init: drop the "configure in Proxmox UI" hint [@MickLesk](https://github.com/MickLesk) ([core#30](https://github.com/community-scripts/core/pull/30))
-- Survive an empty /usr/bin/update instead of aborting the run [@MickLesk](https://github.com/MickLesk) ([core#29](https://github.com/community-scripts/core/pull/29))
-
-## 2026-09-07
-
-### 🆕 New Scripts
-
-  - Chatwoot ([#17095](https://github.com/community-scripts/ProxmoxVE/pull/17095))
-- whisparr-eros ([#17094](https://github.com/community-scripts/ProxmoxVE/pull/17094))
-- Matter-Hub ([#17093](https://github.com/community-scripts/ProxmoxVE/pull/17093))
-- Journiv ([#17092](https://github.com/community-scripts/ProxmoxVE/pull/17092))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - kaneo: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17086](https://github.com/community-scripts/ProxmoxVE/pull/17086))
-    - iobroker: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17085](https://github.com/community-scripts/ProxmoxVE/pull/17085))
-    - reactive-resume: repair any wrong WorkingDirectory on update [@MickLesk](https://github.com/MickLesk) ([#17068](https://github.com/community-scripts/ProxmoxVE/pull/17068))
-    - mediamtx: keep mediamtx.yml across updates [@MickLesk](https://github.com/MickLesk) ([#17069](https://github.com/community-scripts/ProxmoxVE/pull/17069))
-    - omnitools: allow remote action while npm ci [@MickLesk](https://github.com/MickLesk) ([#17070](https://github.com/community-scripts/ProxmoxVE/pull/17070))
-
-  - #### ✨ New Features
-
-    - netboot-xyz: add Secure Boot and Legacy assets [@MickLesk](https://github.com/MickLesk) ([#17066](https://github.com/community-scripts/ProxmoxVE/pull/17066))
-
-  - #### 🔧 Refactor
-
-    - flatnotes: follow upstream move to uv and Python 3.13 [@MickLesk](https://github.com/MickLesk) ([#17090](https://github.com/community-scripts/ProxmoxVE/pull/17090))
-    - heimdall: set up PHP 8.4 on update, keep only the database, run migrations [@MickLesk](https://github.com/MickLesk) ([#17067](https://github.com/community-scripts/ProxmoxVE/pull/17067))
-
-### 📂 Github
-
-  - github: Open per-script Node bump PRs [@MickLesk](https://github.com/MickLesk) ([#17065](https://github.com/community-scripts/ProxmoxVE/pull/17065))
-
-## 2026-09-06
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Fix Sonarqube update script to add +x on sonar.sh [@jarihu](https://github.com/jarihu) ([#17056](https://github.com/community-scripts/ProxmoxVE/pull/17056))
-
-## 2026-09-05
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - authentik: scope blueprints chown to avoid recursing into the mp0 bind mount [@MickLesk](https://github.com/MickLesk) ([#17008](https://github.com/community-scripts/ProxmoxVE/pull/17008))
-    - iventoy: run iventoy.sh with bash instead of dash [@MickLesk](https://github.com/MickLesk) ([#17034](https://github.com/community-scripts/ProxmoxVE/pull/17034))
-    - frigate: restart go2rtc.service before frigate starts [@MickLesk](https://github.com/MickLesk) ([#17035](https://github.com/community-scripts/ProxmoxVE/pull/17035))
-    - snapotter: seed AI venv base packages on arm64, warn amd64 has no working CPU bundle [@MickLesk](https://github.com/MickLesk) ([#16903](https://github.com/community-scripts/ProxmoxVE/pull/16903))
-    - tolgee: bump required JDK from 21 to 25 [@MickLesk](https://github.com/MickLesk) ([#17005](https://github.com/community-scripts/ProxmoxVE/pull/17005))
-    - romm: write real version into backend/__version__.py placeholder [@MickLesk](https://github.com/MickLesk) ([#17009](https://github.com/community-scripts/ProxmoxVE/pull/17009))
-
-  - #### 🔧 Refactor
-
-    - Refactor FileFlows: Stop Spinner before read -rp / Switch from "Node" to "Agent"  [@MickLesk](https://github.com/MickLesk) ([#17007](https://github.com/community-scripts/ProxmoxVE/pull/17007))
-
-### 💾 Core
-
-  - update helper: follow renamed ct/ scripts instead of curling a 404 [@MickLesk](https://github.com/MickLesk) ([core#22](https://github.com/community-scripts/core/pull/22))
-- Use Proxmox for a template before reaching for linuxcontainers.org [@MickLesk](https://github.com/MickLesk) ([core#23](https://github.com/community-scripts/core/pull/23))
-- implement exponential backoff for curl retries in _cs_curl_retry function [@MickLesk](https://github.com/MickLesk) ([core#26](https://github.com/community-scripts/core/pull/26))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - update-apps: follow renamed ct/ scripts instead of erroring out [@MickLesk](https://github.com/MickLesk) ([#16991](https://github.com/community-scripts/ProxmoxVE/pull/16991))
-
-## 2026-09-04
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - fix(shlink): preserve servers.json across web-client updates [@Corgei](https://github.com/Corgei) ([#17023](https://github.com/community-scripts/ProxmoxVE/pull/17023))
-    - fix-update-authentik-2026.8.1 [@thieneret](https://github.com/thieneret) ([#16999](https://github.com/community-scripts/ProxmoxVE/pull/16999))
-    - Fix npm v12 allow-git/allow-remote restrictions across affected scripts [@MickLesk](https://github.com/MickLesk) ([#17014](https://github.com/community-scripts/ProxmoxVE/pull/17014))
-    - Fix/poznote - 1st party Docker parity [@lucas-at-3x-eye](https://github.com/lucas-at-3x-eye) ([#17011](https://github.com/community-scripts/ProxmoxVE/pull/17011))
-
-### 💾 Core
-
-  - setup_go: resolve bare major.minor versions to the latest patch release [@MickLesk](https://github.com/MickLesk) ([core#24](https://github.com/community-scripts/core/pull/24))
+  - issue template: add PVE release, execution context and phase; refresh distro list / pve versions [@MickLesk](https://github.com/MickLesk) ([#17160](https://github.com/community-scripts/ProxmoxVE/pull/17160))

ct/anythingllm.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# Engine comes from community-scripts/core; this repo only ships the scripts.
+# A local core checkout wins (COMMUNITY_SCRIPTS_CORE_DIR, else a sibling ../core),
+# so a fork or branch of core can be tested without editing this file.
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Mintplex-Labs/anything-llm
+
+APP="AnythingLLM"
+var_tags="${var_tags:-ai;rag}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-6144}"
+var_disk="${var_disk:-20}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_gpu="${var_gpu:-yes}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/anythingllm ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "anythingllm" "Mintplex-Labs/anything-llm"; then
+    msg_info "Stopping Services"
+    systemctl stop anythingllm anythingllm-collector
+    msg_ok "Stopped Services"
+
+    create_backup /opt/anythingllm/server/.env /opt/anythingllm/collector/.env /opt/anythingllm/frontend/.env
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "anythingllm" "Mintplex-Labs/anything-llm" "tarball"
+
+    restore_backup
+
+    msg_info "Building AnythingLLM (Patience)"
+    cd /opt/anythingllm
+    export PUPPETEER_SKIP_DOWNLOAD=true
+    export NODE_OPTIONS="--max-old-space-size=3072"
+    $STD yarn setup
+    cd /opt/anythingllm/frontend
+    $STD yarn build
+    rm -rf /opt/anythingllm/server/public
+    cp -R /opt/anythingllm/frontend/dist /opt/anythingllm/server/public
+    cd /opt/anythingllm/server
+    $STD npx prisma generate --schema=./prisma/schema.prisma
+    $STD npx prisma migrate deploy --schema=./prisma/schema.prisma
+    msg_ok "Built AnythingLLM"
+
+    msg_info "Starting Services"
+    systemctl start anythingllm anythingllm-collector
+    msg_ok "Started Services"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3001${CL}"

ct/apprise-api.sh

@@ -46,7 +46,7 @@ function update_script() {
     $STD uv venv /opt/apprise/.venv
     $STD uv pip install -r requirements.txt gunicorn supervisor -p /opt/apprise/.venv/bin/python
     ln -sf /opt/apprise/.venv/bin/supervisord /opt/apprise/.venv/bin/gunicorn /usr/local/bin/
-    cp -fr apprise_api/static /usr/share/nginx/html/s/
+    cp -fr apprise_api/static/. /usr/share/nginx/html/s/
     mv apprise_api/ webapp
     touch /etc/nginx/server-override.conf
     touch /etc/nginx/location-override.conf

ct/bookorbit.sh

@@ -48,7 +48,12 @@ function update_script() {
 
     $STD corepack prepare "pnpm@${PNPM_VERSION}" --activate
     $STD pnpm install --frozen-lockfile
-    $STD pnpm --filter client run build-only
+    # vite's bundler (rolldown) crashes at random on some builds, rolldown#10860.
+    for attempt in 1 2 3; do
+      $STD pnpm --filter client run build-only && break
+      [[ $attempt -eq 3 ]] && { msg_error "Client build failed three times"; exit 1; }
+      msg_warn "Client build failed (attempt $attempt), retrying"
+    done
     $STD pnpm --filter server run build
     cp -r /opt/bookorbit/client/dist /opt/bookorbit/server/public
     mkdir -p /opt/bookorbit/server/migrations

ct/bytestash.sh

@@ -9,8 +9,8 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 APP="ByteStash"
 var_tags="${var_tags:-code}"
 var_disk="${var_disk:-4}"
-var_cpu="${var_cpu:-1}"
-var_ram="${var_ram:-1024}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
@@ -35,9 +35,8 @@ function update_script() {
     systemctl stop bytestash-backend bytestash-frontend
     msg_ok "Services Stopped"
 
-    [[ -d /opt/bytestash/data ]] && create_backup /opt/bytestash/data
     [[ -d /opt/data ]] && create_backup /opt/data
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "bytestash" "jordan-dalby/ByteStash" "tarball"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="data" fetch_and_deploy_gh_release "bytestash" "jordan-dalby/ByteStash" "tarball"
     restore_backup
 
     msg_info "Configuring ByteStash"
@@ -50,7 +49,6 @@ function update_script() {
     msg_info "Starting Services"
     systemctl start bytestash-backend bytestash-frontend
     msg_ok "Started Services"
-
     msg_ok "Updated successfully!"
   fi
   exit

ct/caddy.sh

@@ -38,11 +38,18 @@ update_deb_based() {
     exit
   fi
 
+  cleanup_old_repo_files "caddy"
   msg_info "Updating Caddy LXC"
   apt_update_safe
   $STD apt upgrade -y
   msg_ok "Updated Caddy LXC"
 
+  [[ -f ~/.caddy ]] || dpkg-query -W -f='${Version}' caddy >~/.caddy 2>/dev/null || true
+  if check_for_gh_release "caddy" "caddyserver/caddy"; then
+    DPKG_FORCE_CONFOLD=1 fetch_and_deploy_gh_release "caddy" "caddyserver/caddy" "binary" "latest" "/opt/caddy" "caddy_*_linux_$(arch_resolve).deb"
+    systemctl restart caddy
+  fi
+
   if command -v xcaddy >/dev/null 2>&1; then
     if check_for_gh_release "xcaddy" "caddyserver/xcaddy"; then
       setup_go

ct/certmate.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: fabriziosalmi
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/fabriziosalmi/certmate
+
+APP="CertMate"
+var_tags="${var_tags:-ssl;certificates;acme}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/certmate ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "certmate" "fabriziosalmi/certmate"; then
+    msg_info "Stopping CertMate"
+    systemctl stop certmate
+    msg_ok "Stopped CertMate"
+
+    PYTHON_VERSION="3.12" setup_uv
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "certmate" "fabriziosalmi/certmate" "tarball"
+
+    msg_info "Installing CertMate Dependencies"
+    cd /opt/certmate
+    $STD uv venv --python 3.12 /opt/certmate/.venv
+    $STD uv pip sync --python /opt/certmate/.venv/bin/python requirements.lock
+    $STD /opt/certmate/.venv/bin/certbot --version
+    msg_ok "Installed CertMate Dependencies"
+
+    msg_info "Starting CertMate"
+    systemctl start certmate
+    msg_ok "Started CertMate"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8000${CL}"
+echo -e "${INFO}${YW}The first page creates the admin account and asks for the API token: grep API_BEARER_TOKEN /opt/certmate_data/.env${CL}"

ct/cinephage.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/MoldyTaint/Cinephage
+
+APP="Cinephage"
+var_tags="${var_tags:-arr;media;torrent;usenet}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/cinephage ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "cinephage" "MoldyTaint/Cinephage"; then
+    msg_info "Stopping Cinephage"
+    systemctl stop cinephage
+    msg_ok "Stopped Cinephage"
+
+    NODE_VERSION="24" setup_nodejs
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "cinephage" "MoldyTaint/Cinephage" "tarball"
+
+    msg_info "Building Cinephage"
+    cd /opt/cinephage
+    $STD npm ci
+    $STD npm run build
+    $STD npm prune --omit=dev
+    sed -i "s/^APP_VERSION=.*/APP_VERSION=$(cat ~/.cinephage)/" /opt/cinephage_data/.env
+    msg_ok "Built Cinephage"
+
+    msg_info "Updating Camoufox"
+    $STD /opt/cinephage/node_modules/.bin/camoufox-js fetch
+    msg_ok "Updated Camoufox"
+
+    msg_info "Starting Cinephage"
+    systemctl start cinephage
+    msg_ok "Started Cinephage"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"

ct/cliproxyapi.sh

@@ -39,7 +39,7 @@ function update_script() {
 
     create_backup /opt/cliproxyapi/config.yaml
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "cliproxyapi" "router-for-me/CLIProxyAPI" "prebuild" "latest" "/opt/cliproxyapi" "CLIProxyAPI_*_linux_$(arch_resolve "amd64" "aarch64").tar.gz"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="plugins data" fetch_and_deploy_gh_release "cliproxyapi" "router-for-me/CLIProxyAPI" "prebuild" "latest" "/opt/cliproxyapi" "CLIProxyAPI_*_linux_$(arch_resolve "amd64" "aarch64").tar.gz"
 
     restore_backup
 

ct/docker.sh

@@ -27,6 +27,10 @@ else
   var_disk="${var_disk:-4}"
   var_version="${var_version:-13}"
 fi
+# Only exported variables reach the install through lxc-attach.
+export var_docker_socket="${var_docker_socket:-}"
+export var_docker_compose="${var_docker_compose:-}"
+export var_docker_lxcfs="${var_docker_lxcfs:-}"
 
 header_info "$APP"
 variables

ct/endurain.sh

@@ -30,14 +30,14 @@ function update_script() {
     msg_error "No ${APP} installation found!"
     exit 233
   fi
-  if check_for_codeberg_release "endurain" "endurain-project/endurain"; then
+  if check_for_gh_release "endurain" "endurain-project/endurain"; then
     msg_info "Stopping Service"
     systemctl stop endurain
     msg_ok "Stopped Service"
 
     NODE_VERSION="24" setup_nodejs
     create_backup /opt/endurain/.env /opt/endurain/frontend/dist/env.js
-    CLEAN_INSTALL=1 fetch_and_deploy_codeberg_release "endurain" "endurain-project/endurain" "tarball" "latest" "/opt/endurain"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "endurain" "endurain-project/endurain"
 
     msg_info "Updating Endurain Frontend"
     cd /opt/endurain

ct/foldingathome.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ) | Co-Author: 007hacky007
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/FoldingAtHome/fah-client-bastet
+
+APP="FoldingAtHome"
+var_tags="${var_tags:-science;distributed-computing}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_gpu="${var_gpu:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+export var_fah_token="${var_fah_token:-}"
+export var_fah_machine_name="${var_fah_machine_name:-}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /usr/bin/fah-client ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  fetch_and_deploy_from_url "https://download.foldingathome.org/releases/public/fah-client/$(arch_resolve "debian-10-64bit" "debian-stable-arm64")/release/latest.deb"
+  msg_ok "Folding@home is at $(dpkg-query -W -f='${Version}' fah-client)"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Manage it from the Folding@home Web Control:${CL}"
+echo -e "${GATEWAY}${BGN}https://app.foldingathome.org/${CL}"
+echo -e "${INFO}${YW}The client starts paused - press Fold once the machine shows up in your account${CL}"
+echo -e "${INFO}${YW}Account token and machine name are in /etc/fah-client/config.xml${CL}"

ct/gluetun.sh

@@ -32,7 +32,7 @@ function update_script() {
     exit
   fi
 
-  if check_for_gh_release "gluetun" "qdm12/gluetun"; then
+  if check_for_gh_release "gluetun" "passteque/gluetun"; then
     msg_info "Stopping Service"
     systemctl stop gluetun
     msg_ok "Stopped Service"

ct/hermesagent.sh

@@ -31,16 +31,7 @@ function update_script() {
     exit
   fi
 
-  msg_warn "WARNING: This script will run an external installer from a third-party source (https://hermes-agent.nousresearch.com/)."
-  msg_warn "The following code is NOT maintained or audited by our repository."
-  msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
-  msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  hermes update (https://hermes-agent.nousresearch.com/)"
-  echo
-  read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
-  if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
-    msg_error "Aborted by user. No changes have been made."
-    exit 10
-  fi
+  confirm_external_installer "https://hermes-agent.nousresearch.com/" "hermes update (https://hermes-agent.nousresearch.com/)"
 
   msg_info "Stopping Services"
   systemctl stop hermes-dashboard
@@ -51,8 +42,7 @@ function update_script() {
     set -a; source /etc/default/hermes; set +a
     /home/hermes/.local/bin/hermes update --yes
   '
-  # See https://github.com/community-scripts/ProxmoxVE/issues/17123
-  mapfile -t root_gateway_pids < <(ps -eo user=,pid=,args= | awk '$1 == "root" && $0 ~ /\/home\/hermes\/\.hermes\/hermes-agent\/venv\/bin\/python -m hermes_cli\.main gateway run --replace$/ { print $2 }')
+  mapfile -t root_gateway_pids < <(ps -eo user=,pid=,args= | awk '$1 == "root" && /\/home\/hermes\/\.hermes\// && /hermes_cli[.]main/ && / gateway run --replace$/ { print $2 }')
   if ((${#root_gateway_pids[@]})); then
     kill -TERM "${root_gateway_pids[@]}"
     for pid in "${root_gateway_pids[@]}"; do
@@ -61,7 +51,14 @@ function update_script() {
       done
     done
   fi
-  chown -R hermes:hermes /home/hermes
+  if ps -eo user=,args= | awk '$1 == "root" && /\/home\/hermes\/\.hermes\// { found = 1 } END { exit !found }'; then
+    msg_warn "A root-owned Hermes process is still running; it may keep writing root-owned files"
+  fi
+  # A writer racing chown makes files vanish between readdir and chown; one retry covers it.
+  if ! chown -R hermes:hermes /home/hermes 2>/dev/null; then
+    sleep 1
+    chown -R hermes:hermes /home/hermes || msg_warn "Could not take ownership of everything under /home/hermes"
+  fi
   msg_ok "Updated Hermes Agent"
 
   msg_info "Starting Services"

ct/homarr.sh

@@ -85,6 +85,18 @@ EOF
     msg_ok "Started Services"
     msg_ok "Updated successfully!"
   fi
+  # v2.3.0's Debian build ships a musl better-sqlite3 (homarr-labs/homarr#7097).
+  mapfile -t MUSL_MODULES < <(find /opt/homarr -name better_sqlite3.node -exec grep -aqE "ld-musl|libc\.musl" {} \; -print)
+  if ((${#MUSL_MODULES[@]})); then
+    msg_info "Replacing musl better-sqlite3 build"
+    BSQ_VERSION=$(jq -r .version /opt/homarr/node_modules/better-sqlite3/package.json)
+    curl_with_retry "https://github.com/WiseLibs/better-sqlite3/releases/download/v${BSQ_VERSION}/better-sqlite3-v${BSQ_VERSION}-node-v$(node -p process.versions.modules)-linux-$(arch_resolve "x64" "arm64").tar.gz" /tmp/better-sqlite3.tar.gz
+    tar -xzf /tmp/better-sqlite3.tar.gz -C /tmp build/Release/better_sqlite3.node
+    for module in "${MUSL_MODULES[@]}"; do cp /tmp/build/Release/better_sqlite3.node "$module"; done
+    rm -rf /tmp/better-sqlite3.tar.gz /tmp/build
+    systemctl restart homarr
+    msg_ok "Replaced musl better-sqlite3 build"
+  fi
   exit
 }
 

ct/immich.sh

@@ -77,7 +77,7 @@ EOF
   BASE_DIR=${STAGING_DIR}/base-images
   SOURCE_DIR=${STAGING_DIR}/image-source
   cd /tmp
-  RELEASE="v3.3.0"
+  RELEASE="v3.3.1"
   if [[ -f ~/.intel_version ]]; then
     INTEL_SRC="https://raw.githubusercontent.com/immich-app/immich/${RELEASE}/machine-learning"
     curl -fsSL "${INTEL_SRC}/scripts/install-intel-runtime.sh" -o ./intel-runtime 2>/dev/null ||
@@ -102,20 +102,40 @@ EOF
       msg_ok "Updated Intel OpenVINO dependencies"
     fi
   fi
-  if [[ -f ~/.immich_library_revisions ]]; then
-    libraries=("libjxl" "jpegli" "libheif" "libraw" "imagemagick" "libvips")
-    cd "$BASE_DIR"
-    msg_warn "Checking for updates to custom image-processing libraries (recompile time: 2-15min per library)"
-    ensure_dependencies liblcms2-dev libjpeg62-turbo-dev libspng-dev libexif-dev
-    $STD git pull
-    for library in "${libraries[@]}"; do
-      compile_"$library"
-    done
-    msg_ok "Image-processing libraries up to date"
+  # Without the revision file the refresh was skipped and sharp failed on an old libvips (#17914).
+  if [[ ! -f ~/.immich_library_revisions ]]; then
+    msg_warn "No record of the compiled image-processing libraries, rebuilding all of them"
+    printf '%s: unknown\n' imagemagick jpegli libheif libjxl libraw libvips >~/.immich_library_revisions
+  fi
+  [[ -d "$BASE_DIR/.git" ]] || $STD git clone -b main https://github.com/immich-app/base-images "$BASE_DIR"
+  libraries=("libjxl" "jpegli" "libheif" "libraw" "imagemagick" "libvips")
+  cd "$BASE_DIR"
+  msg_warn "Checking for updates to custom image-processing libraries (recompile time: 2-15min per library)"
+  ensure_dependencies liblcms2-dev libjpeg62-turbo-dev libspng-dev libexif-dev libopenjp2-7-dev
+  $STD git pull
+  for library in "${libraries[@]}"; do
+    compile_"$library"
+  done
+  msg_ok "Image-processing libraries up to date"
+
+  # 3.3.0 reads geodata/countryInfo.txt; the update before #17823 saved it into app/ instead.
+  if [[ -d /opt/immich/geodata && ! -s /opt/immich/geodata/countryInfo.txt ]]; then
+    msg_info "Restoring geodata/countryInfo.txt"
+    if [[ -s /opt/immich/app/countryInfo.txt ]]; then
+      mv /opt/immich/app/countryInfo.txt /opt/immich/geodata/countryInfo.txt
+    else
+      curl_with_retry "https://download.geonames.org/export/dump/countryInfo.txt" /opt/immich/geodata/countryInfo.txt
+    fi
+    chown immich:immich /opt/immich/geodata/countryInfo.txt
+    systemctl restart immich-web
+    msg_ok "Restored geodata/countryInfo.txt"
   fi
 
   if check_for_gh_release "Immich" "immich-app/immich" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
-    if [[ $(cat ~/.immich) > "2.5.1" ]]; then
+    msg_warn "The update takes 5-15 minutes, do not interrupt it"
+    PREV_IMMICH="$(cat ~/.immich)"
+    # An interrupted update leaves app/ empty, so there may be no immich-admin to call.
+    if [[ "$PREV_IMMICH" > "2.5.1" && -x /opt/immich/app/bin/immich-admin ]]; then
       msg_info "Enabling Maintenance Mode"
       cd /opt/immich/app/bin
       $STD ./immich-admin enable-maintenance-mode || true
@@ -273,13 +293,16 @@ EOF
       msg_ok "Pre-installed Python ${ML_PYTHON}"
       msg_info "Updating Intel OpenVINO machine-learning"
       for attempt in $(seq 1 3); do
-        $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT -Pnu immich uv sync --extra openvino --no-dev --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
-        [[ $attempt -lt 3 ]] && msg_warn "uv sync attempt $attempt failed, retrying..." && sleep 10
+        $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT,UV_CONCURRENT_DOWNLOADS,UV_CONCURRENT_BUILDS,UV_CONCURRENT_INSTALLS -Pnu immich uv sync --extra openvino --no-dev --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
+        [[ $attempt -eq 3 ]] && { ML_FAILED=1; break; }
+        # Parallel fetches can trip DNS rate limits (AdGuard, Pi-hole); retry one at a time.
+        export UV_CONCURRENT_DOWNLOADS=1 UV_CONCURRENT_BUILDS=1 UV_CONCURRENT_INSTALLS=1
+        msg_warn "uv sync attempt $attempt failed, retrying one download at a time..." && sleep 10
       done
-      patchelf --clear-execstack "${VIRTUAL_ENV}/lib/python3.13/site-packages/onnxruntime/capi/onnxruntime_pybind11_state.cpython-313-$(arch_resolve "x86_64" "aarch64")-linux-gnu.so"
-      msg_ok "Updated Intel OpenVINO machine-learning"
+      [[ "${ML_FAILED:-0}" == 1 ]] || patchelf --clear-execstack "${VIRTUAL_ENV}/lib/python3.13/site-packages/onnxruntime/capi/onnxruntime_pybind11_state.cpython-313-$(arch_resolve "x86_64" "aarch64")-linux-gnu.so"
+      [[ "${ML_FAILED:-0}" == 1 ]] || msg_ok "Updated Intel OpenVINO machine-learning"
     else
-      ML_PYTHON="python3.11"
+      ML_PYTHON="python3.13"
       msg_info "Pre-installing Python ${ML_PYTHON} for machine-learning"
       for attempt in $(seq 1 3); do
         $STD sudo --preserve-env=VIRTUAL_ENV -Pnu immich uv python install "${ML_PYTHON}" && break
@@ -288,11 +311,15 @@ EOF
       msg_ok "Pre-installed Python ${ML_PYTHON}"
       msg_info "Updating machine-learning"
       for attempt in $(seq 1 3); do
-        $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT -Pnu immich uv sync --extra cpu --no-dev --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
-        [[ $attempt -lt 3 ]] && msg_warn "uv sync attempt $attempt failed, retrying..." && sleep 10
+        $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT,UV_CONCURRENT_DOWNLOADS,UV_CONCURRENT_BUILDS,UV_CONCURRENT_INSTALLS -Pnu immich uv sync --extra cpu --no-dev --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
+        [[ $attempt -eq 3 ]] && { ML_FAILED=1; break; }
+        # Parallel fetches can trip DNS rate limits (AdGuard, Pi-hole); retry one at a time.
+        export UV_CONCURRENT_DOWNLOADS=1 UV_CONCURRENT_BUILDS=1 UV_CONCURRENT_INSTALLS=1
+        msg_warn "uv sync attempt $attempt failed, retrying one download at a time..." && sleep 10
       done
-      msg_ok "Updated machine-learning"
+      [[ "${ML_FAILED:-0}" == 1 ]] || msg_ok "Updated machine-learning"
     fi
+    [[ "${ML_FAILED:-0}" == 1 ]] && msg_warn "uv sync failed three times, machine learning was not updated"
     cd "$SRC_DIR"
     cp -a machine-learning/{ann,immich_ml} "$ML_DIR"
     [[ -f "$INSTALL_DIR"/ml_start.sh ]] && mv "$INSTALL_DIR"/ml_start.sh "$ML_DIR"
@@ -319,7 +346,7 @@ EOF
     grep -rl /usr/src | xargs -n1 sed -i "s|\/usr/src|$INSTALL_DIR|g"
     grep -rlE "'/build'" | xargs -n1 sed -i "s|'/build'|'$APP_DIR'|g"
     sed -i "s@\"/cache\"@\"$INSTALL_DIR/cache\"@g" "$ML_DIR"/immich_ml/config.py
-    [[ ! -f "$GEO_DIR/countryInfo.txt" ]] && curl_with_retry "https://download.geonames.org/export/dump/countryInfo.txt" "countryInfo.txt"
+    [[ ! -f "$GEO_DIR/countryInfo.txt" ]] && curl_with_retry "https://download.geonames.org/export/dump/countryInfo.txt" "$GEO_DIR/countryInfo.txt"
     ln -s "${UPLOAD_DIR:-/opt/immich/upload}" "$APP_DIR"/upload
     ln -s "${UPLOAD_DIR:-/opt/immich/upload}" "$ML_DIR"/upload
     ln -sfn "$GEO_DIR" "$APP_DIR/geodata"
@@ -343,27 +370,18 @@ EOF
       sed -i "s|^ExecStart=.*|ExecStart=${APP_DIR}/bin/start.sh|" /etc/systemd/system/immich-web.service
       systemctl daemon-reload
     fi
+    if grep -q "^ExecStart=${INSTALL_DIR}/ml_start.sh" /etc/systemd/system/immich-ml.service; then
+      sed -i "s|^ExecStart=.*|ExecStart=${ML_DIR}/ml_start.sh|" /etc/systemd/system/immich-ml.service
+      systemctl daemon-reload
+    fi
 
     # MickLesk temporary patch for HEIC thumbnail gen
-    msg_info "Patching media.repository.js"
     MEDIA_REPO_JS="/opt/immich/app/dist/repositories/media.repository.js"
-    if [[ -f "$MEDIA_REPO_JS" ]]; then
-      python3 - <<'PY'
-from pathlib import Path
-p = Path('/opt/immich/app/dist/repositories/media.repository.js')
-s = p.read_text()
-old = "(0, sharp_1.default)(input).metadata()"
-new = "(0, sharp_1.default)(input, { unlimited: true, limitInputPixels: false }).metadata()"
-if new in s:
-    print('hotfix already there')
-elif old in s:
-    p.write_text(s.replace(old, new, 1))
-    print('hotfix applied')
-else:
-    print('pattern not found, skipped')
-PY
+    if grep -qF "(0, sharp_1.default)(input).metadata()" "$MEDIA_REPO_JS" 2>/dev/null; then
+      msg_info "Patching media.repository.js"
+      sed -i '0,/(0, sharp_1\.default)(input)\.metadata()/s//(0, sharp_1.default)(input, { unlimited: true, limitInputPixels: false }).metadata()/' "$MEDIA_REPO_JS"
+      msg_ok "Patched media.repository.js"
     fi
-    msg_ok "Patched media.repository.js"
 
     # chown excluding upload dir contents (may be a mount with restricted permissions)
     chown immich:immich "$INSTALL_DIR"
@@ -377,6 +395,15 @@ PY
       $STD cd -
       msg_ok "Disabled Maintenance Mode"
     fi
+    # A crash loop before the update leaves the units rate-limited, and restart would refuse.
+    systemctl reset-failed immich-ml immich-web 2>/dev/null || true
+    if [[ "${ML_FAILED:-0}" == 1 ]]; then
+      systemctl restart immich-web || true
+      [[ -f /etc/systemd/system/immich-proxy.service ]] && systemctl restart immich-proxy
+      echo "$PREV_IMMICH" >~/.immich
+      msg_error "Immich runs, but without machine learning (see the uv output above). Run update again to retry."
+      exit 1
+    fi
     systemctl restart immich-ml immich-web
     [[ -f /etc/systemd/system/immich-proxy.service ]] && systemctl restart immich-proxy
     msg_ok "Updated successfully!"
@@ -479,8 +506,7 @@ function compile_jpegli() {
 function compile_libheif() {
   SOURCE=${SOURCE_DIR}/libheif
   ensure_dependencies libaom-dev
-  LIBHEIF_REVISION="ac1cb05c39008f01525c991ff8b88f84ddf70fd2"
-  # : "${LIBHEIF_REVISION:=$(jq -cr '.revision' "$BASE_DIR"/server/sources/libheif.json)}"
+  LIBHEIF_REVISION="$(jq -cr '.revision' "$BASE_DIR"/server/sources/libheif.json)"
   if [[ "${update:-}" ]] || [[ "$LIBHEIF_REVISION" != "$(grep 'libheif' ~/.immich_library_revisions | awk '{print $2}')" ]]; then
     msg_info "Recompiling libheif"
     [[ -d "$SOURCE" ]] && rm -rf "$SOURCE"
@@ -555,7 +581,8 @@ function compile_imagemagick() {
 function compile_libvips() {
   SOURCE=$SOURCE_DIR/libvips
   LIBVIPS_REVISION="$(jq -cr '.revision' "$BASE_DIR"/server/sources/libvips.json)"
-  if [[ "$LIBVIPS_REVISION" != "$(grep 'libvips' ~/.immich_library_revisions | awk '{print $2}')" ]]; then
+  if [[ "$LIBVIPS_REVISION" != "$(grep 'libvips' ~/.immich_library_revisions | awk '{print $2}')" ]] ||
+    [[ "$(vips -l foreign 2>/dev/null)" != *jp2kload* ]]; then
     msg_info "Recompiling libvips"
     [[ -d "$SOURCE" ]] && rm -rf "$SOURCE"
     $STD git clone https://github.com/libvips/libvips.git "$SOURCE"

ct/karakeep.sh

@@ -91,7 +91,7 @@ EOF
     sed -i "s/^SERVER_VERSION=.*$/SERVER_VERSION=${CHECK_UPDATE_RELEASE#v}/" /etc/karakeep/karakeep.env
     # Node 24.19.x crashes better-sqlite3 on cleanup (karakeep-app/karakeep#2989); stay on 22 LTS until upstream reverts.
     MODULE_VERSION="$(jq -r '.packageManager | split("@")[1]' /opt/karakeep/package.json)"
-    NODE_VERSION="22" NODE_MODULE="corepack,pnpm@${MODULE_VERSION}" setup_nodejs
+    NODE_VERSION="24" NODE_MODULE="corepack,pnpm@${MODULE_VERSION}" setup_nodejs
     setup_meilisearch
 
     msg_info "Updating Karakeep"

ct/kasm.sh

@@ -62,16 +62,7 @@ function update_script() {
     msg_info "Updating Kasm"
     cd /tmp
 
-    msg_warn "WARNING: This script will run an external installer from a third-party source (https://www.kasmweb.com/)."
-    msg_warn "The following code is NOT maintained or audited by our repository."
-    msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
-    msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  upgrade.sh inside tar.gz $KASM_URL"
-    echo
-    read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
-    if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
-      msg_error "Aborted by user. No changes have been made."
-      exit 10
-    fi
+    confirm_external_installer "https://www.kasmweb.com/" "upgrade.sh inside tar.gz $KASM_URL"
     curl_download "/tmp/kasm_release_${KASM_VERSION}.tar.gz" "$KASM_URL"
     tar -xf "kasm_release_${KASM_VERSION}.tar.gz"
     chmod +x /tmp/kasm_release/install.sh

ct/localai.sh

@@ -0,0 +1,72 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Bryan Lieberman (BryanCLieberman)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://localai.io
+
+APP="LocalAI"
+var_tags="${var_tags:-ai;llm;api}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-8192}"
+var_disk="${var_disk:-30}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_gpu="${var_gpu:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+# Values the install script accepts up front
+export var_auth="${var_auth:-no}"
+export var_api_key="${var_api_key:-}"
+export var_port="${var_port:-8080}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/localai ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  # Older installs have no CPU pin; on a host with a GPU but no driver in the
+  # container every model then ends in "backend not found".
+  if ! grep -q '^LOCALAI_FORCE_META_BACKEND_CAPABILITY=' /opt/localai.env 2>/dev/null &&
+    ! ldconfig -p 2>/dev/null | grep -qE 'libcuda[.]so|libamdhip64[.]so|libze_intel_gpu[.]so|libze_loader[.]so'; then
+    echo "LOCALAI_FORCE_META_BACKEND_CAPABILITY=default" >>/opt/localai.env
+    systemctl restart localai
+    msg_ok "Pinned LocalAI to the CPU backends (no GPU runtime in the container)"
+  fi
+
+  if check_for_gh_release "localai" "mudler/LocalAI"; then
+    msg_info "Stopping Service"
+    systemctl stop localai
+    msg_ok "Stopped Service"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "localai" "mudler/LocalAI" "singlefile" "latest" "/opt/localai" "local-ai-v*-linux-$(arch_resolve amd64 arm64)"
+
+    msg_info "Starting Service"
+    systemctl start localai
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8080${CL}"
+echo -e "${INFO}${YW}Install models from the gallery in the web UI or place GGUF files in /opt/localai_data/models${CL}"

ct/onedev.sh

@@ -39,7 +39,7 @@ function update_script() {
 
     msg_info "Updating OneDev"
     cd /opt
-    curl -fsSL "https://code.onedev.io/onedev/server/~site/onedev-latest.tar.gz" -o onedev-latest.tar.gz
+    curl -fsSL "https://code.onedev.io/onedev/server/~sites/public/onedev-latest.tar.gz" -o onedev-latest.tar.gz
     tar -xzf onedev-latest.tar.gz
     $STD /opt/onedev-latest/bin/upgrade.sh /opt/onedev
     rm -rf /opt/onedev-latest

ct/opencloud.sh

@@ -31,6 +31,15 @@ function update_script() {
     exit
   fi
 
+  # Collabora 26.04.4 ignores frame-ancestors in content_security_policy; outside the release
+  # check so installs already on the current release get it too
+  if [[ -f /etc/coolwsd/coolwsd.xml ]] && ! grep -q '<frame_ancestors[^>]*>[^<[:space:]]' /etc/coolwsd/coolwsd.xml; then
+    msg_info "Allowing OpenCloud to embed Collabora"
+    $STD sudo -u cool coolconfig set net.frame_ancestors "$(sed -n 's/^OC_URL=//p' /etc/opencloud/opencloud.env)"
+    systemctl restart coolwsd
+    msg_ok "Allowed OpenCloud to embed Collabora"
+  fi
+
   RELEASE="v8.1.0"
   if check_for_gh_release "OpenCloud" "opencloud-eu/opencloud" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
     OLD_VERSION="$(cat ~/.opencloud 2>/dev/null)"

ct/paperclip.sh

@@ -50,7 +50,10 @@ function update_script() {
     cd /opt/paperclip-ai
     export HUSKY=0
     export NODE_OPTIONS="--max-old-space-size=8192"
-    $STD pnpm install --frozen-lockfile
+    $STD pnpm install --frozen-lockfile || {
+      msg_warn "The lockfile of this release is out of date, resolving dependencies without it"
+      $STD pnpm install --no-frozen-lockfile
+    }
     $STD pnpm build
     unset NODE_OPTIONS
     msg_ok "Rebuilt Paperclip"
@@ -63,7 +66,13 @@ function update_script() {
 
     # Claude Code refuses --dangerously-skip-permissions as root; migrate existing installs to a dedicated user
     PAPERCLIP_USER=$(sed -n 's/^User=//p' /etc/systemd/system/paperclip.service)
-    if [[ -z "$PAPERCLIP_USER" || "$PAPERCLIP_USER" == "root" ]]; then
+    PAPERCLIP_HOME=$(sed -n 's/^PAPERCLIP_HOME=//p' /opt/paperclip-ai/.env)
+    PAPERCLIP_HOME="${PAPERCLIP_HOME:-/opt/paperclip-data}"
+    if [[ -z "$PAPERCLIP_USER" || "$PAPERCLIP_USER" == "root" ]] && [[ "$PAPERCLIP_HOME" != "/opt/paperclip-data" ]]; then
+      # A custom data dir (e.g. an NFS bind mount) may only be reachable by root; don't move the service off root
+      msg_warn "PAPERCLIP_HOME is ${PAPERCLIP_HOME}; keeping the service user as root"
+      PAPERCLIP_USER=root
+    elif [[ -z "$PAPERCLIP_USER" || "$PAPERCLIP_USER" == "root" ]]; then
       PAPERCLIP_USER="${var_paperclip_user:-paperclip}"
       if [[ "$PAPERCLIP_USER" == "root" || ! "$PAPERCLIP_USER" =~ ^[a-z_][a-z0-9_-]{0,31}$ ]]; then
         msg_error "Invalid var_paperclip_user '${PAPERCLIP_USER}' (must be a non-root lowercase Linux username)"
@@ -85,7 +94,10 @@ function update_script() {
     fi
     PAPERCLIP_USER_HOME=$(getent passwd "$PAPERCLIP_USER" | cut -d: -f6)
     chmod 600 /opt/paperclip-ai/.env
-    chown -R "${PAPERCLIP_USER}:${PAPERCLIP_USER}" /opt/paperclip-ai /opt/paperclip-data "$PAPERCLIP_USER_HOME"
+    chown -R "${PAPERCLIP_USER}:${PAPERCLIP_USER}" /opt/paperclip-ai "$PAPERCLIP_USER_HOME"
+    if [[ "$PAPERCLIP_HOME" == "/opt/paperclip-data" && -d /opt/paperclip-data ]]; then
+      chown -R "${PAPERCLIP_USER}:${PAPERCLIP_USER}" /opt/paperclip-data
+    fi
 
     msg_info "Running Database Migrations"
     set -a && source /opt/paperclip-ai/.env && set +a

ct/paperless-ngx.sh

@@ -157,8 +157,6 @@ function update_script() {
             sed -i '$a\PAPERLESS_ARCHIVE_FILE_GENERATION=never' "$PAPERLESS_CONF"
           fi
         fi
-        [[ -n "$(sed -n '/^PAPERLESS_CONSUMER_IGNORE_PATTERNS=/p' "$PAPERLESS_CONF")" ]] &&
-          msg_warn "PAPERLESS_CONSUMER_IGNORE_PATTERNS now uses regex patterns; please verify custom values."
         [[ -n "$(sed -n '/^PAPERLESS_PRE_CONSUME_SCRIPT=/p;/^PAPERLESS_POST_CONSUME_SCRIPT=/p' "$PAPERLESS_CONF")" ]] &&
           msg_warn "Pre/post consume scripts no longer receive positional arguments in v3; please verify custom scripts."
         msg_ok "Migrated Paperless-ngx configuration"
@@ -172,7 +170,9 @@ function update_script() {
       fi
       for svc in consumer scheduler task-queue webserver; do
         unit="/etc/systemd/system/paperless-${svc}.service"
-        [[ -f "$unit" ]] && sed -i 's|uv run -- |uv run --no-sync -- |g' "$unit"
+        [[ -f "$unit" ]] || continue
+        sed -i 's|uv run -- |uv run --no-sync -- |g' "$unit"
+        grep -q '^Restart=' "$unit" || sed -i '/^\[Service\]/a Restart=on-failure\nRestartSec=5' "$unit"
       done
       $STD systemctl daemon-reload
       cd /opt/paperless
@@ -181,6 +181,34 @@ function update_script() {
       $STD uv run -- python manage.py migrate
       msg_ok "Updated Paperless-ngx"
 
+      if ((BRIDGE_UPDATE == 0)); then
+        IGNORE_FIXED="$(
+          /opt/paperless/.venv/bin/python - /opt/paperless/paperless.conf <<'EOF'
+import json, re, sys
+key = "PAPERLESS_CONSUMER_IGNORE_PATTERNS="
+lines = open(sys.argv[1]).read().splitlines(True)
+
+def is_glob(p):
+    if p.startswith("^") or p.endswith("$"):
+        return False
+    try:
+        return bool(re.search(p, "scan.pdf"))
+    except re.error:
+        return True
+
+for i, line in enumerate(lines):
+    if line.startswith(key):
+        patterns = json.loads(line[len(key):].strip().strip("'"))
+        fixed = ["^" + re.escape(p).replace(r"\*", ".*").replace(r"\?", ".") + "$" if is_glob(p) else p for p in patterns]
+        if fixed != patterns:
+            lines[i] = key + json.dumps(fixed) + "\n"
+            print(json.dumps(fixed))
+open(sys.argv[1], "w").writelines(lines)
+EOF
+        )" || IGNORE_FIXED=""
+        [[ -n "$IGNORE_FIXED" ]] && msg_warn "Converted glob PAPERLESS_CONSUMER_IGNORE_PATTERNS to regex (required since v3): ${IGNORE_FIXED}"
+      fi
+
       if ((BRIDGE_UPDATE == 0)) && [[ "$PAPERLESS_INSTALLED_VERSION" == "2.20.15" ]]; then
         $STD apt -y purge libzbar0t64 libzbar0 2>/dev/null || true
         $STD apt -y autoremove 2>/dev/null || true

ct/radicale.sh

@@ -41,7 +41,7 @@ function update_script() {
     if grep -q 'start.sh' /etc/systemd/system/radicale.service; then
       sed -i -e '/^Description/i[Unit]' \
         -e '\|^ExecStart|iWorkingDirectory=/opt/radicale' \
-        -e 's|^ExecStart=.*|ExecStart=/usr/local/bin/uv run -m radicale --config /etc/radicale/config|' /etc/systemd/system/radicale.service
+        -e 's|^ExecStart=.*|ExecStart=/usr/local/bin/uv run --extra bcrypt --extra argon2 -m radicale --config /etc/radicale/config|' /etc/systemd/system/radicale.service
       systemctl daemon-reload
     fi
     if [[ ! -f /etc/radicale/config ]]; then
@@ -70,6 +70,14 @@ EOF
     msg_ok "Started service"
     msg_ok "Updated Successfully!"
   fi
+
+  if grep -q 'uv run -m radicale' /etc/systemd/system/radicale.service && grep -q '^argon2 *=' /opt/radicale/pyproject.toml; then
+    msg_info "Enabling bcrypt/argon2 support"
+    sed -i 's|uv run -m radicale|uv run --extra bcrypt --extra argon2 -m radicale|' /etc/systemd/system/radicale.service
+    systemctl daemon-reload
+    systemctl restart radicale
+    msg_ok "Enabled bcrypt/argon2 support"
+  fi
   exit
 }
 

ct/readmeabook.sh

@@ -31,6 +31,28 @@ function update_script() {
     exit
   fi
 
+  if ! grep -q '^ExecStartPost=-/usr/local/bin/readmeabook-init$' /etc/systemd/system/readmeabook.service; then
+    msg_info "Starting the scheduler with the service"
+    cat <<'EOF' >/usr/local/bin/readmeabook-init
+#!/usr/bin/env bash
+# Upstream's image calls /api/init after every start: it creates the scheduled jobs and starts the scheduler
+url="http://127.0.0.1:${PORT:-3030}"
+for _ in $(seq 1 60); do curl -sf -o /dev/null "$url/api/health" && break; sleep 1; done
+for _ in $(seq 1 30); do [[ "$(redis-cli ping 2>/dev/null)" == PONG ]] && break; sleep 1; done
+for attempt in 1 2 3 4 5; do
+  curl -sf -o /dev/null "$url/api/init" && exit 0
+  sleep "$attempt"
+done
+echo "ReadMeABook did not answer /api/init, scheduled jobs will not run" >&2
+exit 1
+EOF
+    chmod +x /usr/local/bin/readmeabook-init
+    sed -i '/^ExecStart=/a ExecStartPost=-/usr/local/bin/readmeabook-init\nTimeoutStartSec=180' /etc/systemd/system/readmeabook.service
+    systemctl daemon-reload
+    systemctl restart readmeabook
+    msg_ok "Started the scheduler with the service"
+  fi
+
   if check_for_gh_release "readmeabook" "kikootwo/ReadMeABook"; then
     msg_info "Stopping Service"
     systemctl stop readmeabook

ct/rustdeskserver.sh

@@ -11,6 +11,7 @@ var_tags="${var_tags:-remote-desktop}"
 var_cpu="${var_cpu:-1}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
+export var_rustdesk_api="${var_rustdesk_api:-}"
 if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
   var_os=$(msg_menu "Choose the container OS" \
     "debian" "Debian 13" \
@@ -38,25 +39,32 @@ update_deb_based() {
     exit
   fi
 
-  if check_for_gh_release "rustdesk-hbbs" "lejianwen/rustdesk-server"; then
-    msg_info "Stopping Service"
-    systemctl stop rustdesk-hbbr
-    systemctl stop rustdesk-hbbs
-    if [[ -f /lib/systemd/system/rustdesk-api.service ]]; then
-      systemctl stop rustdesk-api
-    fi
-    msg_ok "Stopped Service"
+  if check_for_gh_release "rustdesk-hbbs" "rustdesk/rustdesk-server"; then
+    msg_info "Stopping RustDesk Server"
+    systemctl stop rustdesk-hbbr rustdesk-hbbs
+    msg_ok "Stopped RustDesk Server"
+
+    fetch_and_deploy_gh_release "rustdesk-hbbr" "rustdesk/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-hbbr*$(arch_resolve).deb"
+    fetch_and_deploy_gh_release "rustdesk-hbbs" "rustdesk/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-hbbs*$(arch_resolve).deb"
+    fetch_and_deploy_gh_release "rustdesk-utils" "rustdesk/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-utils*$(arch_resolve).deb"
+
+    msg_info "Starting RustDesk Server"
+    systemctl start rustdesk-hbbs rustdesk-hbbr
+    msg_ok "Started RustDesk Server"
+    msg_ok "Updated RustDesk Server"
+  fi
+
+  if [[ -f /lib/systemd/system/rustdesk-api.service ]] && check_for_gh_release "rustdesk-api" "lejianwen/rustdesk-api"; then
+    msg_info "Stopping RustDesk API"
+    systemctl stop rustdesk-api
+    msg_ok "Stopped RustDesk API"
 
-    fetch_and_deploy_gh_release "rustdesk-hbbr" "lejianwen/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-hbbr*$(arch_resolve).deb"
-    fetch_and_deploy_gh_release "rustdesk-hbbs" "lejianwen/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-hbbs*$(arch_resolve).deb"
-    fetch_and_deploy_gh_release "rustdesk-utils" "lejianwen/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-utils*$(arch_resolve).deb"
     fetch_and_deploy_gh_release "rustdesk-api" "lejianwen/rustdesk-api" "binary" "latest" "/opt/rustdesk" "rustdesk-api-server*$(arch_resolve).deb"
 
-    msg_info "Starting services"
-    systemctl start -q rustdesk-*
-    msg_ok "Services started"
-
-    msg_ok "Updated successfully!"
+    msg_info "Starting RustDesk API"
+    systemctl start rustdesk-api
+    msg_ok "Started RustDesk API"
+    msg_ok "Updated RustDesk API"
   fi
 }
 
@@ -66,21 +74,26 @@ update_alpine() {
     exit
   fi
 
-  if check_for_gh_release "rustdesk-server" "lejianwen/rustdesk-server"; then
+  msg_info "Updating Alpine Packages"
+  $STD apk -U upgrade
+  msg_ok "Updated Alpine Packages"
+
+  if check_for_gh_release "rustdesk-server" "rustdesk/rustdesk-server"; then
     msg_info "Stopping RustDesk Server"
-    $STD apk -U upgrade
     $STD service rustdesk-server-hbbs stop
     $STD service rustdesk-server-hbbr stop
     msg_ok "Stopped RustDesk Server"
 
-    fetch_and_deploy_gh_release "rustdesk-server" "lejianwen/rustdesk-server" "prebuild" "latest" "/opt/rustdesk-server" "rustdesk-server-linux-$(arch_resolve "amd64" "arm64v8").zip"
+    fetch_and_deploy_gh_release "rustdesk-server" "rustdesk/rustdesk-server" "prebuild" "latest" "/opt/rustdesk-server" "rustdesk-server-linux-$(arch_resolve "amd64" "arm64v8").zip"
 
     msg_info "Starting RustDesk Server"
     $STD service rustdesk-server-hbbs start
     $STD service rustdesk-server-hbbr start
     msg_ok "Started RustDesk Server"
+    msg_ok "Updated RustDesk Server"
   fi
-  if check_for_gh_release "rustdesk-api" "lejianwen/rustdesk-api"; then
+
+  if [[ -x /opt/rustdesk-api/apimain ]] && check_for_gh_release "rustdesk-api" "lejianwen/rustdesk-api"; then
     msg_info "Stopping RustDesk API"
     $STD service rustdesk-api stop
     msg_ok "Stopped RustDesk API"
@@ -90,8 +103,8 @@ update_alpine() {
     msg_info "Starting RustDesk API"
     $STD service rustdesk-api start
     msg_ok "Started RustDesk API"
+    msg_ok "Updated RustDesk API"
   fi
-  msg_ok "Updated successfully!"
 }
 
 function update_script() {
@@ -107,5 +120,7 @@ description
 
 msg_ok "Completed successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:21114${CL}"
+echo -e "${INFO}${YW}Set this as ID server in the RustDesk client, the key is in ~/rustdesk.creds:${CL}"
+echo -e "${GATEWAY}${BGN}${IP}${CL}"
+echo -e "${INFO}${YW}Web UI, if selected during setup:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:21114/_admin/${CL}"

ct/tracearr.sh

@@ -125,7 +125,7 @@ EOF
     $STD ./scripts/fetch-basemap.sh || msg_warn "Basemap download failed, keeping the existing map"
     [[ -d /opt/tracearr/data ]] && mv /opt/tracearr/data /opt/tracearr.data
     rm -rf /opt/tracearr
-    mkdir -p /opt/tracearr/{packages/shared,packages/emails,apps/server,apps/web,apps/server/src/db}
+    mkdir -p /opt/tracearr/{packages/shared,packages/emails,apps/server,apps/web,apps/server/src/db,assets}
     cp -rf package.json /opt/tracearr/
     cp -rf pnpm-workspace.yaml /opt/tracearr/
     cp -rf pnpm-lock.yaml /opt/tracearr/
@@ -138,13 +138,14 @@ EOF
     cp -rf packages/emails/package.json /opt/tracearr/packages/emails/
     cp -rf packages/emails/dist /opt/tracearr/packages/emails/dist
     cp -rf apps/server/src/db/migrations /opt/tracearr/apps/server/src/db/migrations
+    cp -f assets/logo.png /opt/tracearr/assets/
     [[ -d /opt/tracearr.data ]] && mv /opt/tracearr.data /opt/tracearr/data
     mkdir -p /opt/tracearr/data
     cp -rf data/. /opt/tracearr/data/
     mkdir -p /opt/tracearr/data/image-cache
     rm -rf /opt/tracearr.build
     cd /opt/tracearr
-    $STD pnpm install --prod --frozen-lockfile --ignore-scripts
+    $STD pnpm install --prod --frozen-lockfile --ignore-scripts --filter @tracearr/server...
     $STD chown -R tracearr:tracearr /opt/tracearr
     msg_ok "Built Tracearr"
 

ct/tvheadend.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Nicolas Pastorello (opastorello)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://tvheadend.org/ | Github: https://github.com/tvheadend/tvheadend
+
+APP="Tvheadend"
+var_tags="${var_tags:-media;pvr;tv;dvr}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+export var_admin_user="${var_admin_user:-admin}"
+export var_admin_pass="${var_admin_pass:-$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-13)}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /var/lib/tvheadend ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  msg_info "Updating Tvheadend"
+  $STD apt update
+  $STD apt install -y tvheadend
+  msg_ok "Updated Tvheadend"
+
+  msg_info "Restarting Service"
+  systemctl restart tvheadend
+  msg_ok "Restarted Service"
+  msg_ok "Updated successfully!"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:9981${CL}"
+echo -e "${INFO}${YW}Admin Username: ${var_admin_user}${CL}"
+echo -e "${INFO}${YW}Admin Password: ${var_admin_pass}${CL}"

ct/wanderer.sh

@@ -100,7 +100,6 @@ EOF
       -e "s|^MEILI_DB_PATH=.*|MEILI_DB_PATH=/opt/wanderer_data/meili_data|" \
       /opt/wanderer/.env
     sed -i "s|^db_path =.*|db_path = \"/opt/wanderer_data/meili_data\"|" /etc/meilisearch.toml
-    rm -f /usr/local/bin/wanderer-pb
 
     cat <<EOF >/etc/systemd/system/wanderer-pocketbase.service
 [Unit]
@@ -155,6 +154,16 @@ EOF
     msg_ok "Added POCKETBASE_PROXY_SECRET"
   fi
 
+  cat <<'EOF' >/usr/local/bin/wanderer-pb
+#!/usr/bin/env bash
+set -a
+source /opt/wanderer/.env
+set +a
+cd /opt/wanderer/db
+exec ./pocketbase "$@" --dir="$PB_DB_LOCATION"
+EOF
+  chmod +x /usr/local/bin/wanderer-pb
+
   if [[ -f /opt/wanderer_data/plugins/plugin.json ]]; then
     msg_info "Reinstalling wanderer plugins, one directory each"
     find /opt/wanderer_data/plugins -maxdepth 1 -type f -delete

ct/watchstate.sh

@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/arabcoders/watchstate
+
+APP="WatchState"
+var_tags="${var_tags:-media;plex;jellyfin;emby}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-6}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/watchstate ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "watchstate" "arabcoders/watchstate" "" "" "v"; then
+    msg_info "Stopping WatchState"
+    systemctl stop watchstate-worker php8.5-fpm
+    msg_ok "Stopped WatchState"
+
+    create_backup /opt/watchstate/.env
+    setup_composer
+    NODE_VERSION="24" NODE_MODULE="bun" setup_nodejs
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "watchstate" "arabcoders/watchstate" "tarball" "latest" "/opt/watchstate" "" "v"
+    restore_backup
+
+    msg_info "Building WatchState"
+    cd /opt/watchstate
+    sed -i "s/'version' => 'dev-master'/'version' => 'v$(cat ~/.watchstate)'/" config/config.php
+    $STD composer install --no-dev --optimize-autoloader --no-interaction
+    cd /opt/watchstate/frontend
+    $STD bun install --frozen-lockfile --production
+    NODE_ENV=production $STD bun run generate
+    mv /opt/watchstate/frontend/exported /opt/watchstate/public/exported
+    rm -rf /opt/watchstate/frontend/node_modules /opt/watchstate/frontend/.nuxt
+    msg_ok "Built WatchState"
+
+    msg_info "Migrating WatchState Database"
+    $STD php /opt/watchstate/bin/console db:migrate --execute
+    $STD php /opt/watchstate/bin/console db:index
+    chown -R www-data:www-data /opt/watchstate_data
+    msg_ok "Migrated WatchState Database"
+
+    msg_info "Starting WatchState"
+    systemctl start php8.5-fpm watchstate-worker
+    msg_ok "Started WatchState"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8080${CL}"

ct/wazuh.sh

@@ -10,7 +10,7 @@ APP="Wazuh"
 var_tags="${var_tags:-security;monitoring}"
 var_cpu="${var_cpu:-4}"
 var_ram="${var_ram:-4096}"
-var_disk="${var_disk:-25}"
+var_disk="${var_disk:-35}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"

ct/weblate.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/WeblateOrg/weblate
+
+APP="Weblate"
+var_tags="${var_tags:-translation;localization}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-3072}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/weblate ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "weblate" "WeblateOrg/weblate"; then
+    msg_info "Stopping Weblate"
+    systemctl stop weblate weblate-celery
+    msg_ok "Stopped Weblate"
+
+    PYTHON_VERSION="3.14" setup_uv
+    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "weblate" "WeblateOrg/weblate" "singlefile" "latest" "/opt/weblate" "weblate-*-py3-none-any.whl"
+
+    msg_info "Updating Weblate"
+    $STD uv pip install --python /opt/weblate/.venv/bin/python --compile-bytecode /opt/weblate/weblate-*.whl "weblate[all,wsgi]"
+    rm -f /opt/weblate/weblate-*.whl
+    set -a
+    source /opt/weblate_data/weblate.env
+    set +a
+    $STD /opt/weblate/.venv/bin/weblate migrate --noinput
+    $STD /opt/weblate/.venv/bin/weblate collectstatic --noinput
+    msg_ok "Updated Weblate"
+
+    msg_info "Starting Weblate"
+    systemctl start weblate-celery weblate
+    msg_ok "Started Weblate"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}${CL}"

ct/wikijs.sh

@@ -32,14 +32,14 @@ function update_script() {
 
   NODE_VERSION="26" NODE_MODULE="yarn,node-gyp" setup_nodejs
 
-  if check_for_gh_release "wikijs" "requarks/wiki"; then
-    msg_info "Verifying whether ${APP}' new release is v3.x+ and current install uses SQLite."
-    SQLITE_INSTALL=$([ -f /opt/wikijs/db.sqlite ] && echo "true" || echo "false")
-    if [[ "${SQLITE_INSTALL}" == "true" && "${CHECK_UPDATE_RELEASE}" =~ ^3.* ]]; then
-      echo "SQLite is not supported in v3.x+, currently there is no update path availble."
-      exit
-    fi
-    msg_ok "There is an update path available for ${APP}"
+  if check_for_gh_release "wikijs" "requarks/wiki-v2"; then
+    #msg_info "Verifying whether ${APP}' new release is v3.x+ and current install uses SQLite."
+    #SQLITE_INSTALL=$([ -f /opt/wikijs/db.sqlite ] && echo "true" || echo "false")
+    #if [[ "${SQLITE_INSTALL}" == "true" && "${CHECK_UPDATE_RELEASE}" =~ ^3.* ]]; then
+    #  echo "SQLite is not supported in v3.x+, currently there is no update path availble."
+    #  exit
+    #fi
+    #msg_ok "There is an update path available for ${APP}"
 
     msg_info "Stopping Service"
     systemctl stop wikijs
@@ -47,15 +47,17 @@ function update_script() {
 
     msg_info "Backing up Data"
     mkdir /opt/wikijs-backup
-    $SQLITE_INSTALL && cp /opt/wikijs/db.sqlite /opt/wikijs-backup
+    #$SQLITE_INSTALL && 
+    cp /opt/wikijs/db.sqlite /opt/wikijs-backup
     cp -R /opt/wikijs/{config.yml,/data} /opt/wikijs-backup
     msg_ok "Backed up Data"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "wikijs" "requarks/wiki" "prebuild" "latest" "/opt/wikijs" "wiki-js.tar.gz"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "wikijs" "requarks/wiki-v2" "prebuild" "latest" "/opt/wikijs" "wiki-js.tar.gz"
 
     msg_info "Restoring Data"
     cp -R /opt/wikijs-backup/* /opt/wikijs
-    $SQLITE_INSTALL && $STD npm rebuild sqlite3
+    #$SQLITE_INSTALL && 
+    $STD npm rebuild sqlite3
     rm -rf /opt/wikijs-backup
     msg_ok "Restored Data"
 

ct/zabbix.sh

@@ -86,16 +86,16 @@ function update_script() {
   rm -rf /tmp/zabbix-release_*.deb
   apt_update_safe
 
-  $STD apt install --only-upgrade zabbix-server-pgsql zabbix-frontend-php php8.4-pgsql
+  $STD apt install --only-upgrade -y zabbix-server-pgsql zabbix-frontend-php php8.4-pgsql
 
   if [[ "$AGENT_SERVICE" == "zabbix-agent2" ]]; then
-    $STD apt install --only-upgrade zabbix-agent2 zabbix-agent2-plugin-postgresql
+    $STD apt install --only-upgrade -y zabbix-agent2 zabbix-agent2-plugin-postgresql
     if [ -f /etc/zabbix/zabbix_agent2.d/plugins.d/nvidia.conf ]; then
       sed -i 's|^Plugins.NVIDIA.System.Path=.*|# Plugins.NVIDIA.System.Path=/usr/libexec/zabbix/zabbix-agent2-plugin-nvidia-gpu|' \
         /etc/zabbix/zabbix_agent2.d/plugins.d/nvidia.conf
     fi
   elif [[ "$AGENT_SERVICE" == "zabbix-agent" ]]; then
-    $STD apt install --only-upgrade zabbix-agent
+    $STD apt install --only-upgrade -y zabbix-agent
   fi
 
   if command -v fping >/dev/null 2>&1; then

ct/zammad.sh

@@ -12,7 +12,7 @@ var_disk="${var_disk:-8}"
 var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-4096}"
 var_os="${var_os:-debian}"
-var_version="${var_version:-12}"
+var_version="${var_version:-13}"
 var_arm64="${var_arm64:-no}"
 var_unprivileged="${var_unprivileged:-1}"
 
@@ -34,6 +34,64 @@ function update_script() {
   systemctl stop zammad
   msg_ok "Stopped Service"
 
+  if grep -qs "dl.packager.io" /etc/apt/sources.list.d/zammad*; then
+    msg_info "Migrating Zammad Repository"
+    rm -f /etc/apt/keyrings/pkgr-zammad.gpg
+    setup_deb822_repo \
+      "zammad" \
+      "https://go.packager.io/srv/deb/zammad/zammad/gpg-key.asc" \
+      "https://go.packager.io/srv/deb/zammad/zammad/stable/debian" \
+      "$(get_os_info version_id)" \
+      "main"
+    msg_ok "Migrated Zammad Repository"
+  fi
+
+  REBUILD_INDEX=false
+  if [[ "$(dpkg-query -W -f='${Version}' elasticsearch 2>/dev/null)" == 7.* ]]; then
+    msg_info "Upgrading Elasticsearch to 8.x"
+    systemctl stop elasticsearch
+    if /usr/share/elasticsearch/bin/elasticsearch-plugin list 2>/dev/null | grep -q "ingest-attachment"; then
+      $STD /usr/share/elasticsearch/bin/elasticsearch-plugin remove ingest-attachment
+    fi
+    rm -f /etc/apt/sources.list.d/elastic-7.x.list /usr/share/keyrings/elasticsearch-keyring.gpg
+    setup_deb822_repo \
+      "elasticsearch" \
+      "https://artifacts.elastic.co/GPG-KEY-elasticsearch" \
+      "https://artifacts.elastic.co/packages/8.x/apt" \
+      "stable" \
+      "main"
+    ES_JAVA_OPTS="-Xms1g -Xmx1g" $STD apt install -y elasticsearch
+    if [[ -f /etc/elasticsearch/jvm.options.dpkg-dist ]]; then
+      mv /etc/elasticsearch/jvm.options.dpkg-dist /etc/elasticsearch/jvm.options
+    fi
+    rm -f /etc/elasticsearch/elasticsearch.yml.dpkg-dist
+    rm -rf /var/lib/elasticsearch/*
+    cat <<EOF >/etc/elasticsearch/jvm.options.d/heap.options
+-Xms2g
+-Xmx2g
+EOF
+    cat <<EOF >/etc/elasticsearch/elasticsearch.yml
+path.data: /var/lib/elasticsearch
+path.logs: /var/log/elasticsearch
+discovery.type: single-node
+network.host: 127.0.0.1
+xpack.security.enabled: false
+xpack.security.transport.ssl.enabled: false
+xpack.security.http.ssl.enabled: false
+bootstrap.memory_lock: false
+EOF
+    systemctl daemon-reload
+    systemctl restart -q elasticsearch
+    for i in $(seq 1 30); do
+      if curl -s http://127.0.0.1:9200 >/dev/null 2>&1; then
+        break
+      fi
+      sleep 2
+    done
+    REBUILD_INDEX=true
+    msg_ok "Upgraded Elasticsearch to 8.x"
+  fi
+
   msg_info "Updating Zammad"
   apt_update_safe
   $STD apt-mark hold zammad
@@ -42,6 +100,12 @@ function update_script() {
   $STD apt upgrade -y
   msg_ok "Updated Zammad"
 
+  if [[ "$REBUILD_INDEX" == true ]]; then
+    msg_info "Rebuilding Search Index"
+    $STD zammad run rake zammad:searchindex:rebuild
+    msg_ok "Rebuilt Search Index"
+  fi
+
   msg_info "Starting Service"
   systemctl start zammad
   msg_ok "Started Service"

ct/zigbee2mqtt.sh

@@ -49,8 +49,12 @@ update_deb_based() {
     ensure_dependencies zstd
     mkdir -p /opt/backups
     BACKUP_VERSION="$(<"$HOME/.zigbee2mqtt")"
-    BACKUP_FILE="/opt/backups/${APP}_backup_${BACKUP_VERSION}.tar.zst"
-    $STD tar -cf - -C /opt zigbee2mqtt | zstd -q -o "$BACKUP_FILE"
+    BACKUP_FILE="$(mktemp "/opt/backups/${APP}_backup_${BACKUP_VERSION}_XXXXXX.tar.zst")"
+    tar -cf - -C /opt zigbee2mqtt | $STD zstd -q -f -o "$BACKUP_FILE" || {
+      local backup_exit_code=$?
+      rm -f "$BACKUP_FILE"
+      return "$backup_exit_code"
+    }
     ls -t /opt/backups/${APP}_backup_*.tar.zst 2>/dev/null | tail -n +6 | xargs -r rm -f
     msg_ok "Backup Created (${BACKUP_VERSION})"
 

install/anythingllm-install.sh

@@ -0,0 +1,107 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Mintplex-Labs/anything-llm
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  build-essential \
+  python3-dev \
+  libgomp1 \
+  git \
+  chromium
+msg_ok "Installed Dependencies"
+
+NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
+
+fetch_and_deploy_gh_release "anythingllm" "Mintplex-Labs/anything-llm" "tarball"
+
+msg_info "Configuring AnythingLLM"
+mkdir -p /opt/anythingllm_data/storage
+cp -RTn /opt/anythingllm/server/storage /opt/anythingllm_data/storage 2>/dev/null || true
+rm -rf /opt/anythingllm/server/storage
+ln -sfn /opt/anythingllm_data/storage /opt/anythingllm/server/storage
+cat <<EOF >/opt/anythingllm/server/.env
+SERVER_PORT=3001
+STORAGE_DIR="/opt/anythingllm/server/storage"
+JWT_SECRET="$(openssl rand -hex 32)"
+SIG_KEY="$(openssl rand -hex 32)"
+SIG_SALT="$(openssl rand -hex 32)"
+VECTOR_DB="lancedb"
+EOF
+cat <<EOF >/opt/anythingllm/collector/.env
+STORAGE_DIR="/opt/anythingllm/server/storage"
+EOF
+cat <<EOF >/opt/anythingllm/frontend/.env
+VITE_API_BASE='/api'
+EOF
+msg_ok "Configured AnythingLLM"
+
+msg_info "Building AnythingLLM (Patience)"
+cd /opt/anythingllm
+export PUPPETEER_SKIP_DOWNLOAD=true
+export NODE_OPTIONS="--max-old-space-size=3072"
+$STD yarn setup
+cd /opt/anythingllm/frontend
+$STD yarn build
+cp -R /opt/anythingllm/frontend/dist /opt/anythingllm/server/public
+cd /opt/anythingllm/server
+$STD npx prisma generate --schema=./prisma/schema.prisma
+$STD npx prisma migrate deploy --schema=./prisma/schema.prisma
+msg_ok "Built AnythingLLM"
+
+msg_info "Creating Services"
+cat <<EOF >/etc/systemd/system/anythingllm.service
+[Unit]
+Description=AnythingLLM Server
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/anythingllm/server
+Environment=NODE_ENV=production
+ExecStart=/usr/bin/node index.js
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+cat <<EOF >/etc/systemd/system/anythingllm-collector.service
+[Unit]
+Description=AnythingLLM Collector
+Wants=network-online.target
+After=network-online.target anythingllm.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/anythingllm/collector
+Environment=NODE_ENV=production
+Environment=PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium
+ExecStart=/usr/bin/node index.js
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now anythingllm anythingllm-collector
+msg_ok "Created Services"
+
+motd_ssh
+customize
+cleanup_lxc

install/apprise-api-install.sh

@@ -29,7 +29,7 @@ cp ./requirements.txt /etc/requirements.txt
 $STD uv venv /opt/apprise/.venv
 $STD uv pip install -r requirements.txt gunicorn supervisor -p /opt/apprise/.venv/bin/python
 ln -sf /opt/apprise/.venv/bin/supervisord /opt/apprise/.venv/bin/gunicorn /usr/local/bin/
-cp -fr apprise_api/static /usr/share/nginx/html/s/
+cp -fr apprise_api/static/. /usr/share/nginx/html/s/
 mv apprise_api/ webapp
 touch /etc/nginx/server-override.conf
 touch /etc/nginx/location-override.conf

install/aria2-install.sh

@@ -17,7 +17,8 @@ msg_info "Installing Aria2"
 $STD apt install -y aria2
 msg_ok "Installed Aria2"
 
-read -r -p "${TAB3}Would you like to add AriaNG? <y/N> " prompt
+prompt="${var_aria2_ariang:-}"
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add AriaNG? <y/N> " prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
   msg_info "Installing Dependencies"
   $STD apt install -y nginx

install/bookorbit-install.sh

@@ -33,7 +33,12 @@ PNPM_VERSION=$(jq -r '.packageManager | ltrimstr("pnpm@")' /opt/bookorbit/packag
 
 $STD corepack prepare "pnpm@${PNPM_VERSION}" --activate
 $STD pnpm install --frozen-lockfile
-$STD pnpm --filter client run build-only
+# vite's bundler (rolldown) crashes at random on some builds, rolldown#10860.
+for attempt in 1 2 3; do
+  $STD pnpm --filter client run build-only && break
+  [[ $attempt -eq 3 ]] && { msg_error "Client build failed three times"; exit 1; }
+  msg_warn "Client build failed (attempt $attempt), retrying"
+done
 $STD pnpm --filter server run build
 cp -r /opt/bookorbit/client/dist /opt/bookorbit/server/public
 mkdir -p /opt/bookorbit/server/migrations

install/bunkerweb-install.sh

@@ -20,16 +20,7 @@ $STD apt install -y \
 msg_ok "Installed Dependencies"
 
 RELEASE=$(get_latest_github_release "bunkerity/bunkerweb")
-msg_warn "WARNING: This script will run an external installer from a third-party source (install-bunkerweb.sh)."
-msg_warn "The following code is NOT maintained or audited by our repository."
-msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
-msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://github.com/bunkerity/bunkerweb/raw/v${RELEASE}/misc/install-bunkerweb.sh"
-echo
-read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
-if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
-  msg_error "Aborted by user. No changes have been made."
-  exit 10
-fi
+confirm_external_installer "install-bunkerweb.sh" "https://github.com/bunkerity/bunkerweb/raw/v${RELEASE}/misc/install-bunkerweb.sh"
 msg_info "Installing BunkerWeb (Patience)"
 curl -fsSL -o install-bunkerweb.sh "https://github.com/bunkerity/bunkerweb/raw/v${RELEASE}/misc/install-bunkerweb.sh"
 chmod +x install-bunkerweb.sh

install/bytestash-install.sh

@@ -24,7 +24,8 @@ cd /opt/bytestash/client
 $STD npm install
 msg_ok "Installed ByteStash"
 
-read -rp "${TAB3}Do you want to allow registration of multiple accounts? [y/n]: " allowreg
+allowreg="${var_bytestash_registration:-}"
+[[ -n "$allowreg" ]] || read -rp "${TAB3}Do you want to allow registration of multiple accounts? [y/n]: " allowreg
 
 msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/bytestash-backend.service
@@ -42,7 +43,7 @@ Environment=JWT_SECRET=$JWT_SECRET
 WantedBy=multi-user.target
 EOF
 
-if [[ "$allowreg" =~ ^[Yy]$ ]]; then
+if [[ "${allowreg,,}" =~ ^(y|yes)$ ]]; then
   sed -i '8i\Environment=ALLOW_NEW_ACCOUNTS=true' /etc/systemd/system/bytestash-backend.service
 fi
 

install/caddy-install.sh

@@ -14,23 +14,11 @@ network_check
 update_os
 
 setup_deb_based() {
-  msg_info "Installing Dependencies"
-  $STD apt install -y \
-    debian-keyring \
-    debian-archive-keyring \
-    apt-transport-https
-  msg_ok "Installed Dependencies"
+  fetch_and_deploy_gh_release "caddy" "caddyserver/caddy" "binary" "latest" "/opt/caddy" "caddy_*_linux_$(arch_resolve).deb"
+  systemctl enable -q --now caddy
 
-  msg_info "Installing Caddy"
-  setup_deb822_repo \
-    "caddy" \
-    "https://dl.cloudsmith.io/public/caddy/stable/gpg.key" \
-    "https://dl.cloudsmith.io/public/caddy/stable/deb/debian" \
-    "any-version"
-  $STD apt install -y caddy
-  msg_ok "Installed Caddy"
-
-  read -r -p "${TAB3}Would you like to install xCaddy Addon? <y/N> " prompt
+  prompt="${var_caddy_xcaddy:-}"
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install xCaddy Addon? <y/N> " prompt
   if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
     setup_go
     fetch_and_deploy_gh_release "xcaddy" "caddyserver/xcaddy" "binary"
@@ -75,7 +63,8 @@ EOF
 EOF
   msg_ok "Installed Caddy"
 
-  read -r -p "${TAB3}Would you like to install xCaddy Addon? <y/N> " prompt
+  prompt="${var_caddy_xcaddy:-}"
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install xCaddy Addon? <y/N> " prompt
   if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
     GO_VERSION="$(curl -fsSL https://go.dev/VERSION?m=text | head -1 | cut -c3-)" setup_go
     fetch_and_deploy_gh_release "xcaddy" "caddyserver/xcaddy" "prebuild" "latest" "/opt/xcaddy" "xcaddy_*_linux_$(arch_resolve).tar.gz"

install/casaos-install.sh

@@ -13,16 +13,7 @@ setting_up_container
 network_check
 update_os
 
-msg_warn "WARNING: This script will run an external installer from a third-party source (https://casaos.zimaspace.com/)."
-msg_warn "The following code is NOT maintained or audited by our repository."
-msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
-msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://get.casaos.io/"
-echo
-read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
-if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
-  msg_error "Aborted by user. No changes have been made."
-  exit 10
-fi
+confirm_external_installer "https://casaos.zimaspace.com/" "https://get.casaos.io/"
 msg_info "Installing CasaOS (Patience)"
 DOCKER_CONFIG_PATH='/etc/docker/daemon.json'
 mkdir -p $(dirname $DOCKER_CONFIG_PATH)

install/certmate-install.sh

@@ -0,0 +1,69 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: fabriziosalmi
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/fabriziosalmi/certmate
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+PYTHON_VERSION="3.12" setup_uv
+fetch_and_deploy_gh_release "certmate" "fabriziosalmi/certmate" "tarball"
+
+msg_info "Installing CertMate Dependencies"
+cd /opt/certmate
+$STD uv venv --python 3.12 /opt/certmate/.venv
+# requirements.lock is the fully pinned set the official image is built from
+$STD uv pip sync --python /opt/certmate/.venv/bin/python requirements.lock
+$STD /opt/certmate/.venv/bin/certbot --version
+msg_ok "Installed CertMate Dependencies"
+
+msg_info "Configuring CertMate"
+mkdir -p /opt/certmate_data/{certificates,data,backups,logs}
+cat <<EOF >/opt/certmate_data/.env
+API_BEARER_TOKEN=$(openssl rand -hex 32)
+SECRET_KEY=$(openssl rand -hex 32)
+CERTMATE_BACKUP_PASSPHRASE=$(openssl rand -hex 32)
+BEHIND_PROXY=false
+EOF
+chmod 600 /opt/certmate_data/.env
+msg_ok "Configured CertMate"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/certmate.service
+[Unit]
+Description=CertMate SSL Certificate Manager
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/certmate
+Environment=PATH=/opt/certmate/.venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+Environment=CERTMATE_CERT_DIR=/opt/certmate_data/certificates
+Environment=CERTMATE_DATA_DIR=/opt/certmate_data/data
+Environment=CERTMATE_BACKUP_DIR=/opt/certmate_data/backups
+Environment=CERTMATE_LOGS_DIR=/opt/certmate_data/logs
+Environment=ACME_CHALLENGES_DIR=/opt/certmate_data/data/acme-challenges
+EnvironmentFile=/opt/certmate_data/.env
+# One worker: the renewal scheduler, sessions and rate limits live in-process
+ExecStart=/opt/certmate/.venv/bin/gunicorn --bind 0.0.0.0:8000 --workers 1 --threads 8 --timeout 300 --no-control-socket app:app
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now certmate
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/channels-install.sh

@@ -19,16 +19,7 @@ $STD apt install -y \
   xvfb
 msg_ok "Installed Dependencies"
 
-msg_warn "WARNING: This script will run an external installer from a third-party source (https://getchannels.com)."
-msg_warn "The following code is NOT maintained or audited by our repository."
-msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
-msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://getchannels.com/dvr/setup.sh"
-echo
-read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
-if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
-  msg_error "Aborted by user. No changes have been made."
-  exit 10
-fi
+confirm_external_installer "https://getchannels.com" "https://getchannels.com/dvr/setup.sh"
 
 setup_hwaccel
 

install/cinephage-install.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/MoldyTaint/Cinephage
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  build-essential \
+  python3 \
+  libasound2t64 \
+  libgtk-3-0t64 \
+  libx11-xcb1 \
+  xvfb
+msg_ok "Installed Dependencies"
+
+setup_ffmpeg
+NODE_VERSION="24" setup_nodejs
+fetch_and_deploy_gh_release "cinephage" "MoldyTaint/Cinephage" "tarball"
+
+msg_info "Building Cinephage"
+cd /opt/cinephage
+$STD npm ci
+$STD npm run build
+$STD npm prune --omit=dev
+msg_ok "Built Cinephage"
+
+msg_info "Installing Camoufox"
+$STD /opt/cinephage/node_modules/.bin/camoufox-js fetch
+msg_ok "Installed Camoufox"
+
+msg_info "Configuring Cinephage"
+mkdir -p /opt/cinephage_data/indexers/custom /opt/cinephage_data/external-lists/custom
+cat <<EOF >/opt/cinephage_data/.env
+NODE_ENV=production
+HOST=0.0.0.0
+PORT=3000
+APP_VERSION=$(cat ~/.cinephage)
+BETTER_AUTH_SECRET=$(openssl rand -base64 32)
+DATA_DIR=/opt/cinephage_data
+INDEXER_DEFINITIONS_PATH=/opt/cinephage/data/indexers/definitions
+INDEXER_CUSTOM_DEFINITIONS_PATH=/opt/cinephage_data/indexers/custom
+EXTERNAL_LISTS_PRESETS_PATH=/opt/cinephage/data/external-lists/presets
+EXTERNAL_LISTS_CUSTOM_PRESETS_PATH=/opt/cinephage_data/external-lists/custom
+CAPTCHA_ADDON_PATH=/opt/cinephage/src/lib/server/captcha/browser/addon
+FFPROBE_PATH=/usr/bin/ffprobe
+EOF
+chmod 600 /opt/cinephage_data/.env
+msg_ok "Configured Cinephage"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/cinephage.service
+[Unit]
+Description=Cinephage
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/cinephage
+EnvironmentFile=/opt/cinephage_data/.env
+Environment=NODE_OPTIONS=--max-old-space-size=2048
+ExecStart=/usr/bin/node server.js
+Restart=on-failure
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now cinephage
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/cockpit-install.sh

@@ -31,7 +31,10 @@ sed -i "s/root//g" /etc/cockpit/disallowed-users
 msg_ok "Installed Cockpit"
 
 # 45Drives only publishes amd64 packages
-[[ "$(arch_resolve)" == "arm64" ]] || read -r -p "Would you like to install 45Drives' cockpit-file-sharing, cockpit-identities, and cockpit-navigator  <y/N> " prompt
+if [[ "$(arch_resolve)" != "arm64" ]]; then
+  prompt="${var_cockpit_45drives:-}"
+  [[ -n "$prompt" ]] || read -r -p "Would you like to install 45Drives' cockpit-file-sharing, cockpit-identities, and cockpit-navigator  <y/N> " prompt
+fi
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
   msg_info "Installing 45Drives' cockpit extensions"
   setup_deb822_repo "45drives" \

install/cryptpad-install.sh

@@ -19,14 +19,15 @@ msg_ok "Installed Dependencies"
 
 NODE_VERSION="22" setup_nodejs
 
-read -rp "${TAB3}Install OnlyOffice components instead of CKEditor? (Y/N): " onlyoffice
+onlyoffice="${var_cryptpad_onlyoffice:-}"
+[[ -n "$onlyoffice" ]] || read -rp "${TAB3}Install OnlyOffice components instead of CKEditor? (Y/N): " onlyoffice
 fetch_and_deploy_gh_release "cryptpad" "cryptpad/cryptpad" "tarball"
 
 msg_info "Setup CryptPad"
 cd /opt/cryptpad
 $STD npm ci --allow-git=all
 $STD npm run install:components
-if [[ "$onlyoffice" =~ ^[Yy]$ ]]; then
+if [[ "${onlyoffice,,}" =~ ^(y|yes)$ ]]; then
   $STD bash -c "./install-onlyoffice.sh --accept-license"
 fi
 cp config/config.example.js config/config.js

install/docker-install.sh

@@ -15,12 +15,16 @@ update_os
 
 setup_deb_based() {
   setup_docker
-  read -r -p "${TAB3}Expose Docker TCP socket (insecure) ? [n = No, l = Local only (127.0.0.1), a = All interfaces (0.0.0.0)] <n/l/a>: " socket_choice
+  if [[ -n "${var_docker_socket:-}" ]]; then
+    socket_choice="$var_docker_socket"
+  else
+    read -r -p "${TAB3}Expose Docker TCP socket (insecure) ? [n = No, l = Local only (127.0.0.1), a = All interfaces (0.0.0.0)] <n/l/a>: " socket_choice
+  fi
   case "${socket_choice,,}" in
-  l)
+  l | local)
     socket="tcp://127.0.0.1:2375"
     ;;
-  a)
+  a | all)
     socket="tcp://0.0.0.0:2375"
     ;;
   *)
@@ -66,8 +70,12 @@ setup_alpine() {
   msg_ok "Installed Docker"
 
   DOCKER_COMPOSE_LATEST_VERSION=$(get_latest_github_release "docker/compose" false)
-  read -r -p "${TAB3}Would you like to add Docker Compose? <y/N> " prompt
-  if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
+  if [[ -n "${var_docker_compose:-}" ]]; then
+    prompt="$var_docker_compose"
+  else
+    read -r -p "${TAB3}Would you like to add Docker Compose? <y/N> " prompt
+  fi
+  if [[ "${prompt,,}" =~ ^(y|yes|true)$ ]]; then
     msg_info "Installing Docker Compose $DOCKER_COMPOSE_LATEST_VERSION"
     DOCKER_CONFIG=${DOCKER_CONFIG:-$HOME/.docker}
     mkdir -p "$DOCKER_CONFIG"/cli-plugins
@@ -75,13 +83,23 @@ setup_alpine() {
     chmod +x "$DOCKER_CONFIG"/cli-plugins/docker-compose
     msg_ok "Installed Docker Compose $DOCKER_COMPOSE_LATEST_VERSION"
   fi
-  read -r -p "${TAB3}Would you like to expose the Docker TCP socket? <y/N> " prompt
-  if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
-    msg_info "Exposing Docker TCP socket"
-    $STD mkdir -p /etc/docker
-    $STD echo '{ "hosts": ["unix:///var/run/docker.sock", "tcp://0.0.0.0:2375"] }' >/etc/docker/daemon.json
+  if [[ -n "${var_docker_socket:-}" ]]; then
+    prompt="$var_docker_socket"
+  else
+    read -r -p "${TAB3}Would you like to expose the Docker TCP socket? <y/N> " prompt
+  fi
+  case "${prompt,,}" in
+  y | yes | a | all) socket="tcp://0.0.0.0:2375" ;;
+  l | local) socket="tcp://127.0.0.1:2375" ;;
+  *) socket="" ;;
+  esac
+  if [[ -n "$socket" ]]; then
+    msg_info "Exposing Docker TCP socket on $socket"
+    mkdir -p /etc/docker
+    # No $STD here: silent() captures stdout, which left daemon.json empty.
+    printf '{ "hosts": ["unix:///var/run/docker.sock", "%s"] }\n' "$socket" >/etc/docker/daemon.json
     $STD rc-service docker restart
-    msg_ok "Exposed Docker TCP socket at tcp://+:2375"
+    msg_ok "Exposed Docker TCP socket on $socket"
   fi
 }
 

install/emqx-install.sh

@@ -38,7 +38,8 @@ rm -f "$DEB_FILE"
 echo "$LATEST_VERSION" >~/.emqx
 msg_ok "Installed EMQX"
 
-read -r -p "${TAB3}Would you like to disable the EMQX MQ feature? (reduces disk/CPU usage) <y/N> " prompt
+prompt="${var_emqx_disable_mq:-}"
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to disable the EMQX MQ feature? (reduces disk/CPU usage) <y/N> " prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
   msg_info "Disabling EMQX MQ feature"
   mkdir -p /etc/emqx

install/endurain-install.sh

@@ -21,7 +21,7 @@ PYTHON_VERSION="3.13" setup_uv
 NODE_VERSION="24" setup_nodejs
 PG_VERSION="17" PG_MODULES="postgis" setup_postgresql
 PG_DB_NAME="enduraindb" PG_DB_USER="endurain" setup_postgresql_db
-fetch_and_deploy_codeberg_release "endurain" "endurain-project/endurain" "tarball" "latest" "/opt/endurain"
+fetch_and_deploy_gh_release "endurain" "endurain-project/endurain"
 
 msg_info "Setting up Endurain"
 cd /opt/endurain

install/foldingathome-install.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ) | Co-Author: 007hacky007
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/FoldingAtHome/fah-client-bastet
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+if [[ -z "${var_fah_token:-}" ]]; then
+  var_fah_token=$(prompt_password "Folding@home account token (Enter to skip):" "" 120)
+fi
+if [[ -z "${var_fah_machine_name:-}" ]]; then
+  var_fah_machine_name=$(prompt_input "Folding@home machine name:" "$(hostname)" 60)
+fi
+if [[ ${#var_fah_machine_name} -gt 64 || "$var_fah_machine_name" == *[\<\>\;\&\'\"]* ]]; then
+  msg_warn "Machine name must be 1-64 characters without <>;&'\" - using $(hostname)"
+  var_fah_machine_name=$(hostname)
+fi
+
+msg_info "Configuring Folding@home"
+mkdir -p /etc/fah-client
+cat <<EOF >/etc/fah-client/config.xml
+<config>
+  <account-token v="${var_fah_token}"/>
+  <machine-name v="${var_fah_machine_name}"/>
+</config>
+EOF
+msg_ok "Configured Folding@home"
+
+fetch_and_deploy_from_url "https://download.foldingathome.org/releases/public/fah-client/$(arch_resolve "debian-10-64bit" "debian-stable-arm64")/release/latest.deb"
+
+setup_hwaccel "fah-client"
+
+# The client detects GPUs only at startup, so restart it after setup_hwaccel.
+msg_info "Starting Folding@home"
+systemctl enable -q fah-client
+safe_service_restart fah-client
+msg_ok "Started Folding@home"
+
+motd_ssh
+customize
+cleanup_lxc

install/gluetun-install.sh

@@ -27,7 +27,7 @@ ln -sf /usr/sbin/openvpn /usr/sbin/openvpn2.6
 msg_ok "Configured iptables"
 
 
-fetch_and_deploy_gh_release "gluetun" "qdm12/gluetun" "tarball"
+fetch_and_deploy_gh_release "gluetun" "passteque/gluetun" "tarball"
 GO_VERSION="$(grep -m1 '^go ' /opt/gluetun/go.mod | awk '{print $2}')" setup_go
 
 msg_info "Building Gluetun"

install/headscale-install.sh

@@ -15,7 +15,8 @@ update_os
 
 fetch_and_deploy_gh_release "headscale" "juanfont/headscale" "binary"
 
-read -r -p "${TAB3}Would you like to add headscale-admin UI? <y/N> " prompt
+prompt="${var_headscale_admin:-}"
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add headscale-admin UI? <y/N> " prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
   fetch_and_deploy_gh_release "headscale-admin" "GoodiesHQ/headscale-admin" "prebuild" "latest" "/opt/headscale-admin" "admin.zip"
 

install/hermesagent-install.sh

@@ -33,16 +33,7 @@ NODE_OPTIONS=${NODE_OPTIONS}
 EOF
 msg_ok "Configured Service Environment"
 
-msg_warn "WARNING: This script will run an external installer from a third-party source (https://hermes-agent.nousresearch.com/)."
-msg_warn "The following code is NOT maintained or audited by our repository."
-msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
-msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://hermes-agent.nousresearch.com/install.sh"
-echo
-read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
-if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
-  msg_error "Aborted by user. No changes have been made."
-  exit 10
-fi
+confirm_external_installer "https://hermes-agent.nousresearch.com/" "https://hermes-agent.nousresearch.com/install.sh"
 
 msg_info "Installing Hermes Agent"
 curl -fsSL https://hermes-agent.nousresearch.com/install.sh -o /tmp/hermes-install.sh

install/homarr-install.sh

@@ -25,6 +25,18 @@ NODE_VERSION=$(curl -s https://raw.githubusercontent.com/homarr-labs/homarr/dev/
 setup_nodejs
 fetch_and_deploy_gh_release "homarr" "homarr-labs/homarr" "prebuild" "latest" "/opt/homarr" "build-debian-$(arch_resolve).tar.gz"
 
+# v2.3.0's Debian build ships a musl better-sqlite3 (homarr-labs/homarr#7097).
+mapfile -t MUSL_MODULES < <(find /opt/homarr -name better_sqlite3.node -exec grep -aqE "ld-musl|libc\.musl" {} \; -print)
+if ((${#MUSL_MODULES[@]})); then
+  msg_info "Replacing musl better-sqlite3 build"
+  BSQ_VERSION=$(jq -r .version /opt/homarr/node_modules/better-sqlite3/package.json)
+  curl_with_retry "https://github.com/WiseLibs/better-sqlite3/releases/download/v${BSQ_VERSION}/better-sqlite3-v${BSQ_VERSION}-node-v$(node -p process.versions.modules)-linux-$(arch_resolve "x64" "arm64").tar.gz" /tmp/better-sqlite3.tar.gz
+  tar -xzf /tmp/better-sqlite3.tar.gz -C /tmp build/Release/better_sqlite3.node
+  for module in "${MUSL_MODULES[@]}"; do cp /tmp/build/Release/better_sqlite3.node "$module"; done
+  rm -rf /tmp/better-sqlite3.tar.gz /tmp/build
+  msg_ok "Replaced musl better-sqlite3 build"
+fi
+
 msg_info "Installing Homarr"
 mkdir -p /opt/homarr_db
 touch /opt/homarr_db/db.sqlite

install/immich-install.sh

@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os
 
-RELEASE="v3.3.0"
+RELEASE="v3.3.1"
 if lscpu | grep -q 'GenuineIntel'; then
   echo ""
   echo ""
@@ -84,6 +84,7 @@ $STD apt install --no-install-recommends -y \
   liblqr-1-0 \
   libltdl7 \
   libopenjp2-7 \
+  libopenjp2-7-dev \
   meson \
   ninja-build \
   pkg-config \
@@ -267,8 +268,7 @@ msg_ok "(2/6) Compiled jpegli"
 
 msg_info "(3/6) Compiling libheif"
 SOURCE=${SOURCE_DIR}/libheif
-LIBHEIF_REVISION="ac1cb05c39008f01525c991ff8b88f84ddf70fd2"
-# : "${LIBHEIF_REVISION:=$(jq -cr '.revision' $BASE_DIR/server/sources/libheif.json)}"
+LIBHEIF_REVISION="$(jq -cr '.revision' "$BASE_DIR"/server/sources/libheif.json)"
 $STD git clone https://github.com/strukturag/libheif.git "$SOURCE"
 cd "$SOURCE"
 $STD git reset --hard "$LIBHEIF_REVISION"
@@ -441,13 +441,16 @@ if [[ -f ~/.openvino ]]; then
   msg_ok "Pre-installed Python ${ML_PYTHON}"
   msg_info "Installing Intel OpenVINO machine-learning"
   for attempt in $(seq 1 3); do
-    $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT -Pnu immich uv sync --extra openvino --no-dev --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
-    [[ $attempt -lt 3 ]] && msg_warn "uv sync attempt $attempt failed, retrying..." && sleep 10
+    $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT,UV_CONCURRENT_DOWNLOADS,UV_CONCURRENT_BUILDS,UV_CONCURRENT_INSTALLS -Pnu immich uv sync --extra openvino --no-dev --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
+    [[ $attempt -eq 3 ]] && { msg_error "uv sync failed three times, the machine-learning environment was not built"; exit 1; }
+    # Parallel fetches can trip DNS rate limits (AdGuard, Pi-hole); retry one at a time.
+    export UV_CONCURRENT_DOWNLOADS=1 UV_CONCURRENT_BUILDS=1 UV_CONCURRENT_INSTALLS=1
+    msg_warn "uv sync attempt $attempt failed, retrying one download at a time..." && sleep 10
   done
   patchelf --clear-execstack "${VIRTUAL_ENV}/lib/python3.13/site-packages/onnxruntime/capi/onnxruntime_pybind11_state.cpython-313-$(arch_resolve "x86_64" "aarch64")-linux-gnu.so"
   msg_ok "Installed Intel OpenVINO machine-learning"
 else
-  ML_PYTHON="python3.11"
+  ML_PYTHON="python3.13"
   msg_info "Pre-installing Python ${ML_PYTHON} for machine-learning"
   for attempt in $(seq 1 3); do
     $STD sudo --preserve-env=VIRTUAL_ENV -Pnu immich uv python install "${ML_PYTHON}" && break
@@ -456,8 +459,11 @@ else
   msg_ok "Pre-installed Python ${ML_PYTHON}"
   msg_info "Installing machine-learning"
   for attempt in $(seq 1 3); do
-    $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT -Pnu immich uv sync --extra cpu --no-dev --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
-    [[ $attempt -lt 3 ]] && msg_warn "uv sync attempt $attempt failed, retrying..." && sleep 10
+    $STD sudo --preserve-env=VIRTUAL_ENV,UV_HTTP_TIMEOUT,UV_CONCURRENT_DOWNLOADS,UV_CONCURRENT_BUILDS,UV_CONCURRENT_INSTALLS -Pnu immich uv sync --extra cpu --no-dev --active --link-mode copy -n -p "${ML_PYTHON}" --managed-python && break
+    [[ $attempt -eq 3 ]] && { msg_error "uv sync failed three times, the machine-learning environment was not built"; exit 1; }
+    # Parallel fetches can trip DNS rate limits (AdGuard, Pi-hole); retry one at a time.
+    export UV_CONCURRENT_DOWNLOADS=1 UV_CONCURRENT_BUILDS=1 UV_CONCURRENT_INSTALLS=1
+    msg_warn "uv sync attempt $attempt failed, retrying one download at a time..." && sleep 10
   done
   msg_ok "Installed machine-learning"
 fi
@@ -488,25 +494,12 @@ ln -s "$GEO_DIR" "$APP_DIR"
 msg_ok "Installed GeoNames data"
 
 # MickLesk temporary patch for HEIC thumbnail gen
-msg_info "Patching media.repository.js"
 MEDIA_REPO_JS="/opt/immich/app/dist/repositories/media.repository.js"
-if [[ -f "$MEDIA_REPO_JS" ]]; then
-  python3 - <<'PY'
-from pathlib import Path
-p = Path('/opt/immich/app/dist/repositories/media.repository.js')
-s = p.read_text()
-old = "(0, sharp_1.default)(input).metadata()"
-new = "(0, sharp_1.default)(input, { unlimited: true, limitInputPixels: false }).metadata()"
-if new in s:
-    print('hotfix already there')
-elif old in s:
-    p.write_text(s.replace(old, new, 1))
-    print('hotfix applied')
-else:
-    print('pattern not found, skipped')
-PY
+if grep -qF "(0, sharp_1.default)(input).metadata()" "$MEDIA_REPO_JS" 2>/dev/null; then
+  msg_info "Patching media.repository.js"
+  sed -i '0,/(0, sharp_1\.default)(input)\.metadata()/s//(0, sharp_1.default)(input, { unlimited: true, limitInputPixels: false }).metadata()/' "$MEDIA_REPO_JS"
+  msg_ok "Patched media.repository.js"
 fi
-msg_ok "Patched media.repository.js"
 
 mkdir -p /var/log/immich
 touch /var/log/immich/{web.log,ml.log}

install/influxdb-install.sh

@@ -50,7 +50,8 @@ else
 fi
 msg_ok "Installed InfluxDB"
 
-read -r -p "${TAB3}Would you like to add Telegraf? <y/N> " prompt
+prompt="${var_influxdb_telegraf:-}"
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Telegraf? <y/N> " prompt
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
   msg_info "Installing Telegraf"
   $STD apt install -y telegraf

install/iobroker-install.sh

@@ -17,16 +17,7 @@ msg_info "Installing Dependencies"
 $STD apt install -y ca-certificates
 msg_ok "Installed Dependencies"
 
-msg_warn "WARNING: This script will run an external installer from a third-party source (https://iobroker.net/)."
-msg_warn "The following code is NOT maintained or audited by our repository."
-msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
-msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://iobroker.net/install.sh"
-echo
-read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
-if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
-  msg_error "Aborted by user. No changes have been made."
-  exit 10
-fi
+confirm_external_installer "https://iobroker.net/" "https://iobroker.net/install.sh"
 
 NODE_VERSION="24" NPM_VERSION="11" setup_nodejs
 

install/karakeep-install.sh

@@ -33,7 +33,7 @@ fetch_and_deploy_gh_release "karakeep" "karakeep-app/karakeep" "tarball"
 cd /opt/karakeep
 # Node 24.19.x crashes better-sqlite3 on cleanup (karakeep-app/karakeep#2989); stay on 22 LTS until upstream reverts.
 MODULE_VERSION="$(jq -r '.packageManager | split("@")[1]' /opt/karakeep/package.json)"
-NODE_VERSION="22" NODE_MODULE="pnpm@${MODULE_VERSION}" setup_nodejs
+NODE_VERSION="24" NODE_MODULE="pnpm@${MODULE_VERSION}" setup_nodejs
 
 msg_info "Installing external JavaScript Extension for yt-dlp"
 $STD pip install -U yt-dlp-ejs --break-system-packages

install/kasm-install.sh

@@ -56,16 +56,7 @@ if [[ -z "$KASM_VERSION" ]] || [[ -z "$KASM_URL" ]]; then
 fi
 msg_ok "Detected Kasm Workspaces version $KASM_VERSION"
 
-msg_warn "WARNING: This script will run an external installer from a third-party source (https://www.kasmweb.com/)."
-msg_warn "The following code is NOT maintained or audited by our repository."
-msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
-msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  install.sh inside tar.gz $KASM_URL"
-echo
-read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
-if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
-  msg_error "Aborted by user. No changes have been made."
-  exit 10
-fi
+confirm_external_installer "https://www.kasmweb.com/" "install.sh inside tar.gz $KASM_URL"
 
 msg_info "Installing Kasm Workspaces"
 curl_download "/opt/kasm_release_${KASM_VERSION}.tar.gz" "$KASM_URL"

install/kima-hub-install.sh

@@ -20,15 +20,14 @@ $STD apt install -y \
   openssl \
   ffmpeg \
   python3 \
-  python3-pip \
   python3-dev \
-  python3-numpy \
   redis-server
 msg_ok "Installed Dependencies"
 
 PG_VERSION="16" PG_MODULES="pgvector" setup_postgresql
 PG_DB_NAME="kima" PG_DB_USER="kima" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db
 NODE_VERSION="24" setup_nodejs
+PYTHON_VERSION="3.13" setup_uv
 
 msg_info "Configuring Redis"
 systemctl enable -q --now redis-server
@@ -37,8 +36,8 @@ msg_ok "Configured Redis"
 fetch_and_deploy_gh_release "kima-hub" "Chevron7Locked/kima-hub" "tarball"
 
 msg_info "Installing Python Dependencies"
-export PIP_BREAK_SYSTEM_PACKAGES=1
-$STD pip3 install --no-cache-dir \
+$STD uv venv --python 3.13 /opt/kima-hub/venv
+$STD uv pip install --no-cache --python /opt/kima-hub/venv \
   tensorflow \
   essentia-tensorflow \
   redis \
@@ -174,7 +173,7 @@ Environment=BATCH_SIZE=10
 Environment=SLEEP_INTERVAL=5
 Environment=NUM_WORKERS=2
 Environment=THREADS_PER_WORKER=1
-ExecStart=/usr/bin/python3 /opt/kima-hub/services/audio-analyzer/analyzer.py
+ExecStart=/opt/kima-hub/venv/bin/python /opt/kima-hub/services/audio-analyzer/analyzer.py
 Restart=on-failure
 RestartSec=10
 
@@ -197,7 +196,7 @@ Environment=BACKEND_URL=http://localhost:3006
 Environment=MUSIC_PATH=/music
 Environment=SLEEP_INTERVAL=5
 Environment=NUM_WORKERS=1
-ExecStart=/usr/bin/python3 /opt/kima-hub/services/audio-analyzer-clap/analyzer.py
+ExecStart=/opt/kima-hub/venv/bin/python /opt/kima-hub/services/audio-analyzer-clap/analyzer.py
 Restart=on-failure
 RestartSec=10
 

install/linkwarden-install.sh

@@ -24,7 +24,8 @@ PG_VERSION="16" setup_postgresql
 RUST_CRATES="monolith" setup_rust
 PG_DB_NAME="linkwardendb" PG_DB_USER="linkwarden" setup_postgresql_db
 
-read -r -p "${TAB3}Would you like to add Adminer? <y/N> " prompt
+prompt="${var_linkwarden_adminer:-}"
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Adminer? <y/N> " prompt
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
   setup_adminer
 fi

install/livebook-install.sh

@@ -28,16 +28,7 @@ export HOME=/opt/livebook
 $STD adduser --system --group --home /opt/livebook --shell /bin/bash livebook
 msg_ok "Created livebook user"
 
-msg_warn "WARNING: This script will run an external installer from a third-party source (https://elixir-lang.org)."
-msg_warn "The following code is NOT maintained or audited by our repository."
-msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
-msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://elixir-lang.org/install.sh"
-echo
-read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
-if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
-  msg_error "Aborted by user. No changes have been made."
-  exit 10
-fi
+confirm_external_installer "https://elixir-lang.org" "https://elixir-lang.org/install.sh"
 curl -fsSO https://elixir-lang.org/install.sh
 $STD sh install.sh elixir@latest otp@latest
 

install/localai-install.sh

@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Bryan Lieberman (BryanCLieberman)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://localai.io
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  libgomp1 \
+  libopenblas0
+msg_ok "Installed Dependencies"
+
+setup_hwaccel
+var_port="${var_port:-8080}"
+var_auth="${var_auth:-no}"
+var_api_key="${var_api_key:-}"
+if [[ "$var_auth" == "yes" ]]; then
+  setup_postgresql
+  PG_DB_NAME="localai" PG_DB_USER="localai" setup_postgresql_db
+fi
+
+fetch_and_deploy_gh_release "localai" "mudler/LocalAI" "singlefile" "latest" "/opt/localai" "local-ai-v*-linux-$(arch_resolve amd64 arm64)"
+
+msg_info "Configuring LocalAI"
+mkdir -p /opt/localai_data/models /opt/localai_data/backends
+cat <<EOF >/opt/localai.env
+LOCALAI_ADDRESS=0.0.0.0:${var_port}
+LOCALAI_DATA_PATH=/opt/localai_data
+LOCALAI_MODELS_PATH=/opt/localai_data/models
+LOCALAI_BACKENDS_PATH=/opt/localai_data/backends
+LOCALAI_LOG_LEVEL=info
+EOF
+# LocalAI picks the backend variant from the GPU it sees in sysfs, which is the
+# host's card even when no driver was installed in here, and a CUDA/ROCm/SYCL
+# backend then never starts. Pin the CPU variants unless a runtime is present.
+if ! ldconfig -p 2>/dev/null | grep -qE 'libcuda[.]so|libamdhip64[.]so|libze_intel_gpu[.]so|libze_loader[.]so'; then
+  echo "LOCALAI_FORCE_META_BACKEND_CAPABILITY=default" >>/opt/localai.env
+fi
+# LocalAI refuses to start on a wildcard bind with nothing to identify callers,
+# and binding the wildcard is what makes the container reachable at all.
+if [[ "$var_auth" == "yes" ]]; then
+  cat <<EOF >>/opt/localai.env
+LOCALAI_AUTH=true
+LOCALAI_AUTH_DATABASE_URL=postgres://${PG_DB_USER}:${PG_DB_PASS}@localhost/${PG_DB_NAME}
+LOCALAI_REGISTRATION_MODE=approval
+EOF
+fi
+# A static key grants admin access on its own, so when it is the only thing
+# guarding the API, generate one rather than leaving the server open.
+if [[ -z "$var_api_key" && "$var_auth" != "yes" ]]; then
+  var_api_key="sk-$(openssl rand -hex 24)"
+  {
+    echo "LocalAI Credentials"
+    echo "API Key: ${var_api_key}"
+  } >>~/localai.creds
+fi
+if [[ -n "$var_api_key" ]]; then
+  echo "LOCALAI_API_KEY=${var_api_key}" >>/opt/localai.env
+else
+  echo "#LOCALAI_API_KEY=" >>/opt/localai.env
+fi
+chmod 600 /opt/localai.env
+msg_ok "Configured LocalAI"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/localai.service
+[Unit]
+Description=LocalAI Server
+Wants=network-online.target
+After=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/localai
+EnvironmentFile=/opt/localai.env
+ExecStart=/opt/localai/localai run
+Restart=on-failure
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now localai
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/mariadb-install.sh

@@ -21,7 +21,8 @@ setup_deb_based() {
   sed -i 's/^bind-address/#bind-address/g' /etc/mysql/mariadb.conf.d/50-server.cnf
   msg_ok "Setup MariaDB"
 
-  read -r -p "${TAB3}Would you like to add PhpMyAdmin? <y/N> " prompt
+  prompt="${var_mariadb_phpmyadmin:-}"
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add PhpMyAdmin? <y/N> " prompt
   if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
     msg_info "Installing phpMyAdmin"
     $STD apt install -y \
@@ -58,7 +59,8 @@ setup_alpine() {
   $STD rc-service mariadb start
   msg_ok "MariaDB Configured"
 
-  read -r -p "${TAB3}Would you like to install Adminer with lighttpd? <y/N>: " prompt
+  prompt="${var_mariadb_adminer:-}"
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install Adminer with lighttpd? <y/N>: " prompt
   if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
     msg_info "Installing Adminer and dependencies"
     $STD apk add --no-cache \

install/mattermost-install.sh

@@ -13,16 +13,7 @@ setting_up_container
 network_check
 update_os
 
-msg_warn "WARNING: This script will run an external installer from a third-party source (https://mattermost.com/)."
-msg_warn "The following code is NOT maintained or audited by our repository."
-msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
-msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://deb.packages.mattermost.com/repo-setup.sh"
-echo
-read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
-if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
-  msg_error "Aborted by user. No changes have been made."
-  exit 10
-fi
+confirm_external_installer "https://mattermost.com/" "https://deb.packages.mattermost.com/repo-setup.sh"
 
 PG_VERSION="16" setup_postgresql
 

install/meilisearch-install.sh

@@ -15,7 +15,8 @@ update_os
 
 MEILISEARCH_BIND="0.0.0.0:7700" setup_meilisearch
 
-read -r -p "${TAB3}Do you want add meilisearch-ui? [y/n]: " prompt
+prompt="${var_meilisearch_ui:-}"
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Do you want add meilisearch-ui? [y/n]: " prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
   NODE_VERSION="22" NODE_MODULE="pnpm@latest" setup_nodejs
   fetch_and_deploy_gh_release "meilisearch-ui" "riccox/meilisearch-ui" "tarball"

install/nextcloudpi-install.sh

@@ -13,16 +13,7 @@ setting_up_container
 network_check
 update_os
 
-msg_warn "WARNING: This script will run an external installer from a third-party source (https://nextcloudpi.com/)."
-msg_warn "The following code is NOT maintained or audited by our repository."
-msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
-msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://raw.githubusercontent.com/nextcloud/nextcloudpi/master/install.sh"
-echo
-read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
-if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
-  msg_error "Aborted by user. No changes have been made."
-  exit 10
-fi
+confirm_external_installer "https://nextcloudpi.com/" "https://raw.githubusercontent.com/nextcloud/nextcloudpi/master/install.sh"
 
 msg_info "Making ssh.service reloads behave like restarts"
 mkdir -p /etc/systemd/system/ssh.service.d

install/onedev-install.sh

@@ -24,7 +24,7 @@ JAVA_VERSION="21" setup_java
 msg_info "Installing OneDev"
 RELEASE=$(get_latest_github_release "theonedev/onedev" false)
 cd /opt
-curl -fsSL "https://code.onedev.io/onedev/server/~site/onedev-latest.tar.gz" -o onedev-latest.tar.gz
+curl -fsSL "https://code.onedev.io/onedev/server/~sites/public/onedev-latest.tar.gz" -o onedev-latest.tar.gz
 tar -xzf onedev-latest.tar.gz
 mv /opt/onedev-latest /opt/onedev
 $STD /opt/onedev/bin/server.sh install

install/opencloud-install.sh

@@ -207,7 +207,7 @@ EOF
 $STD sudo -u cool coolconfig set ssl.enable false
 $STD sudo -u cool coolconfig set ssl.termination true
 $STD sudo -u cool coolconfig set ssl.ssl_verification true
-sed -i "s|-Policy\">|&frame-ancestors https://${OPENCLOUD_FQDN}|" /etc/coolwsd/coolwsd.xml
+$STD sudo -u cool coolconfig set net.frame_ancestors "https://${OPENCLOUD_FQDN}"
 useradd -r -M -s /usr/sbin/nologin opencloud
 chown -R opencloud:opencloud "$CONFIG_DIR" "$DATA_DIR"
 sudo -u opencloud opencloud init --config-path "$CONFIG_DIR" --insecure no

install/openwebui-install.sh

@@ -26,7 +26,8 @@ setup_hwaccel
 PYTHON_VERSION="3.12" setup_uv
 
 OTEL_ARGS=()
-read -r -p "${TAB3}Would you like to install OpenTelemetry instrumentation packages (requires manual .env configuration)? <y/N> " prompt
+prompt="${var_openwebui_otel:-}"
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install OpenTelemetry instrumentation packages (requires manual .env configuration)? <y/N> " prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
   for pkg in \
     opentelemetry-api \
@@ -52,7 +53,8 @@ for attempt in $(seq 1 3); do
 done
 msg_ok "Installed Open WebUI"
 
-read -r -p "${TAB3}Would you like to add Ollama? <y/N> " prompt
+prompt="${var_openwebui_ollama:-}"
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Ollama? <y/N> " prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
   if [[ "$(arch_resolve)" == "amd64" ]]; then
   msg_info "Setting up Intel® Repositories"

install/paperclip-install.sh

@@ -31,7 +31,11 @@ msg_info "Building Paperclip"
 cd /opt/paperclip-ai
 export HUSKY=0
 export NODE_OPTIONS="--max-old-space-size=8192"
-$STD pnpm install --frozen-lockfile
+# Upstream tags ship with a stale pnpm-lock.yaml now and then (paperclipai/paperclip#13923).
+$STD pnpm install --frozen-lockfile || {
+  msg_warn "The lockfile of this release is out of date, resolving dependencies without it"
+  $STD pnpm install --no-frozen-lockfile
+}
 $STD pnpm build
 unset NODE_OPTIONS
 msg_ok "Built Paperclip"

install/paperless-ngx-install.sh

@@ -109,6 +109,8 @@ Requires=redis.service
 [Service]
 WorkingDirectory=/opt/paperless/src
 ExecStart=uv run --no-sync -- celery --app paperless beat --loglevel INFO
+Restart=on-failure
+RestartSec=5
 
 [Install]
 WantedBy=multi-user.target
@@ -123,6 +125,8 @@ After=postgresql.service
 [Service]
 WorkingDirectory=/opt/paperless/src
 ExecStart=uv run --no-sync -- celery --app paperless worker --loglevel INFO
+Restart=on-failure
+RestartSec=5
 
 [Install]
 WantedBy=multi-user.target
@@ -137,6 +141,8 @@ Requires=redis.service
 WorkingDirectory=/opt/paperless/src
 ExecStartPre=/bin/sleep 2
 ExecStart=uv run --no-sync -- python manage.py document_consumer
+Restart=on-failure
+RestartSec=5
 
 [Install]
 WantedBy=multi-user.target
@@ -153,6 +159,8 @@ Requires=redis.service
 WorkingDirectory=/opt/paperless/src
 #ExecStartPre=uv run --no-sync -- python manage.py document_index reindex --if-needed --no-progress-bar
 ExecStart=uv run --no-sync -- granian --interface asginl --ws --loop uvloop "paperless.asgi:application"
+Restart=on-failure
+RestartSec=5
 Environment=GRANIAN_HOST=::
 Environment=GRANIAN_PORT=8000
 Environment=GRANIAN_WORKERS=1
@@ -163,7 +171,8 @@ EOF
 systemctl enable -q --now paperless-webserver paperless-scheduler paperless-task-queue paperless-consumer
 msg_ok "Created Services"
 
-read -r -p "${TAB3}Would you like to add Adminer? <y/N> " prompt
+prompt="${var_paperless_ngx_adminer:-}"
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Adminer? <y/N> " prompt
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
   setup_adminer
 fi

install/pihole-install.sh

@@ -13,16 +13,7 @@ setting_up_container
 network_check
 update_os
 
-msg_warn "WARNING: This script will run an external installer from a third-party source (https://pi-hole.net/)."
-msg_warn "The following code is NOT maintained or audited by our repository."
-msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
-msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://install.pi-hole.net"
-echo
-read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
-if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
-  msg_error "Aborted by user. No changes have been made."
-  exit 10
-fi
+confirm_external_installer "https://pi-hole.net/" "https://install.pi-hole.net"
 
 msg_info "Installing Dependencies"
 $STD apt install -y ufw
@@ -65,9 +56,11 @@ $STD pihole-FTL --config ntp.sync.interval 0
 systemctl restart pihole-FTL.service
 msg_ok "Installed Pi-hole"
 
-read -r -p "${TAB3}Would you like to add Unbound? <y/N> " prompt
+prompt="${var_pihole_unbound:-}"
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Unbound? <y/N> " prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
-  read -r -p "${TAB3}Unbound is configured as a recursive DNS server by default, would you like it to be configured as a forwarding DNS server (using DNS-over-TLS (DoT)) instead? <y/N> " prompt
+  prompt="${var_pihole_unbound_dot:-}"
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Unbound is configured as a recursive DNS server by default, would you like it to be configured as a forwarding DNS server (using DNS-over-TLS (DoT)) instead? <y/N> " prompt
   msg_info "Installing Unbound"
   mkdir -p /etc/unbound/unbound.conf.d
   cat <<EOF >/etc/unbound/unbound.conf.d/pi-hole.conf

install/podman-homeassistant-install.sh

@@ -48,7 +48,8 @@ msg_ok "Installed Podman"
 
 mkdir -p /etc/containers/systemd
 
-read -r -p "${TAB3}Would you like to add Portainer? <y/N> " prompt
+prompt="${var_podman_homeassistant_portainer:-}"
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Portainer? <y/N> " prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
   msg_info "Installing Portainer $PORTAINER_LATEST_VERSION"
   podman volume create portainer_data >/dev/null
@@ -75,7 +76,8 @@ EOF
   $STD systemctl start portainer
   msg_ok "Installed Portainer $PORTAINER_LATEST_VERSION"
 else
-  read -r -p "${TAB3}Would you like to add the Portainer Agent? <y/N> " prompt
+  prompt="${var_podman_homeassistant_portainer_agent:-}"
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add the Portainer Agent? <y/N> " prompt
   if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
     msg_info "Installing Portainer agent $PORTAINER_AGENT_LATEST_VERSION"
     cat <<EOF >/etc/containers/systemd/portainer-agent.container

install/podman-install.sh

@@ -48,7 +48,8 @@ msg_ok "Installed Podman"
 
 mkdir -p /etc/containers/systemd
 
-read -r -p "${TAB3}Would you like to add Portainer? <y/N> " prompt
+prompt="${var_podman_portainer:-}"
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Portainer? <y/N> " prompt
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
   msg_info "Installing Portainer $PORTAINER_LATEST_VERSION"
   podman volume create portainer_data >/dev/null
@@ -76,7 +77,8 @@ EOF
   $STD systemctl start portainer
   msg_ok "Installed Portainer $PORTAINER_LATEST_VERSION"
 else
-  read -r -p "${TAB3}Would you like to add the Portainer Agent? <y/N> " prompt
+  prompt="${var_podman_portainer_agent:-}"
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add the Portainer Agent? <y/N> " prompt
   if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
     msg_info "Installing Portainer agent $PORTAINER_AGENT_LATEST_VERSION"
     $STD podman pull docker.io/portainer/agent:latest

install/postgresql-install.sh

@@ -124,7 +124,8 @@ EOF
   systemctl restart postgresql
   msg_ok "Installed PostgreSQL"
 
-  read -r -p "${TAB3}Would you like to add Adminer? <y/N> " prompt
+  prompt="${var_postgresql_adminer:-}"
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add Adminer? <y/N> " prompt
   if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
     msg_info "Installing Adminer"
     $STD apt install -y adminer
@@ -158,7 +159,8 @@ setup_alpine() {
   $STD rc-service postgresql restart
   msg_ok "Configured and Restarted PostgreSQL"
 
-  read -r -p "${TAB3}Would you like to install Adminer with lighttpd? <y/N>: " prompt
+  prompt="${var_postgresql_adminer:-}"
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to install Adminer with lighttpd? <y/N>: " prompt
   if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
     msg_info "Installing Adminer and dependencies"
     $STD apk add --no-cache \

install/radicale-install.sh

@@ -58,7 +58,7 @@ Requires=network.target
 
 [Service]
 WorkingDirectory=/opt/radicale
-ExecStart=/usr/local/bin/uv run -m radicale --config /etc/radicale/config
+ExecStart=/usr/local/bin/uv run --extra bcrypt --extra argon2 -m radicale --config /etc/radicale/config
 Restart=on-failure
 # User=radicale
 # Deny other users access to the calendar data

install/readmeabook-install.sh

@@ -63,6 +63,20 @@ fi
 msg_ok "Built ReadMeABook"
 
 msg_info "Creating Service"
+cat <<'EOF' >/usr/local/bin/readmeabook-init
+#!/usr/bin/env bash
+# Upstream's image calls /api/init after every start: it creates the scheduled jobs and starts the scheduler
+url="http://127.0.0.1:${PORT:-3030}"
+for _ in $(seq 1 60); do curl -sf -o /dev/null "$url/api/health" && break; sleep 1; done
+for _ in $(seq 1 30); do [[ "$(redis-cli ping 2>/dev/null)" == PONG ]] && break; sleep 1; done
+for attempt in 1 2 3 4 5; do
+  curl -sf -o /dev/null "$url/api/init" && exit 0
+  sleep "$attempt"
+done
+echo "ReadMeABook did not answer /api/init, scheduled jobs will not run" >&2
+exit 1
+EOF
+chmod +x /usr/local/bin/readmeabook-init
 cat <<EOF >/etc/systemd/system/readmeabook.service
 [Unit]
 Description=ReadMeABook
@@ -75,6 +89,8 @@ User=root
 WorkingDirectory=/opt/readmeabook
 EnvironmentFile=/opt/readmeabook/.env
 ExecStart=${START_CMD}
+ExecStartPost=-/usr/local/bin/readmeabook-init
+TimeoutStartSec=180
 Restart=on-failure
 RestartSec=10
 

install/rustdeskserver-install.sh

@@ -13,108 +13,126 @@ setting_up_container
 network_check
 update_os
 
+if [[ -n "${var_rustdesk_api:-}" ]]; then
+  prompt="$var_rustdesk_api"
+else
+  read -r -p "${TAB3}Would you like to add the RustDesk API web UI (lejianwen/rustdesk-api, unmaintained since 09/2025)? <y/N> " prompt
+fi
+INSTALL_API=0
+[[ "${prompt,,}" =~ ^(y|yes|true)$ ]] && INSTALL_API=1
+API_PASS="$(random_password 16)"
+
+# rustdesk-api hands these to clients; its shipped defaults point at 192.168.1.66
+api_env() {
+  printf '%s\n' \
+    "RUSTDESK_API_RUSTDESK_ID_SERVER=${LOCAL_IP}:21116" \
+    "RUSTDESK_API_RUSTDESK_RELAY_SERVER=${LOCAL_IP}:21117" \
+    "RUSTDESK_API_RUSTDESK_API_SERVER=http://${LOCAL_IP}:21114" \
+    "RUSTDESK_API_RUSTDESK_KEY_FILE=$1"
+}
+
+# hbbs creates its key pair in its working directory on first start
+write_creds() {
+  local key_file="$1"
+  for _ in $(seq 1 30); do
+    [[ -s "$key_file" ]] && break
+    sleep 1
+  done
+  if [[ ! -s "$key_file" ]]; then
+    msg_error "hbbs did not create ${key_file}"
+    exit 1
+  fi
+  cat <<EOF >~/rustdesk.creds
+RustDesk Server
+ID Server: ${LOCAL_IP}
+Key: $(<"$key_file")
+EOF
+  if ((INSTALL_API)); then
+    cat <<EOF >>~/rustdesk.creds
+
+RustDesk API Web UI: http://${LOCAL_IP}:21114/_admin/
+Username: admin
+Password: ${API_PASS}
+EOF
+  fi
+}
+
 setup_deb_based() {
-  fetch_and_deploy_gh_release "rustdesk-hbbr" "lejianwen/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-hbbr*$(arch_resolve).deb"
-  fetch_and_deploy_gh_release "rustdesk-hbbs" "lejianwen/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-hbbs*$(arch_resolve).deb"
-  fetch_and_deploy_gh_release "rustdesk-utils" "lejianwen/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-utils*$(arch_resolve).deb"
-  fetch_and_deploy_gh_release "rustdesk-api" "lejianwen/rustdesk-api" "binary" "latest" "/opt/rustdesk" "rustdesk-api-server*$(arch_resolve).deb"
-  systemctl enable -q --now rustdesk-hbbr
-  systemctl enable -q --now rustdesk-hbbs
-  systemctl enable -q --now rustdesk-api
+  fetch_and_deploy_gh_release "rustdesk-hbbr" "rustdesk/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-hbbr*$(arch_resolve).deb"
+  fetch_and_deploy_gh_release "rustdesk-hbbs" "rustdesk/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-hbbs*$(arch_resolve).deb"
+  fetch_and_deploy_gh_release "rustdesk-utils" "rustdesk/rustdesk-server" "binary" "latest" "/opt/rustdesk" "rustdesk-server-utils*$(arch_resolve).deb"
+  systemctl enable -q --now rustdesk-hbbs rustdesk-hbbr
+  write_creds /var/lib/rustdesk-server/id_ed25519.pub
+
+  if ((INSTALL_API)); then
+    fetch_and_deploy_gh_release "rustdesk-api" "lejianwen/rustdesk-api" "binary" "latest" "/opt/rustdesk" "rustdesk-api-server*$(arch_resolve).deb"
+    msg_info "Configuring RustDesk API"
+    mkdir -p /etc/systemd/system/rustdesk-api.service.d
+    {
+      echo "[Service]"
+      api_env /var/lib/rustdesk-server/id_ed25519.pub | sed 's/^/Environment=/'
+    } >/etc/systemd/system/rustdesk-api.service.d/override.conf
+    systemctl daemon-reload
+    systemctl stop rustdesk-api
+    cd /var/lib/rustdesk-api
+    $STD rustdesk-api reset-admin-pwd "$API_PASS"
+    systemctl enable -q --now rustdesk-api
+    msg_ok "Configured RustDesk API"
+  fi
 }
 
 setup_alpine() {
-  fetch_and_deploy_gh_release "rustdesk-server" "lejianwen/rustdesk-server" "prebuild" "latest" "/opt/rustdesk-server" "rustdesk-server-linux-$(arch_resolve "amd64" "arm64v8").zip"
+  fetch_and_deploy_gh_release "rustdesk-server" "rustdesk/rustdesk-server" "prebuild" "latest" "/opt/rustdesk-server" "rustdesk-server-linux-$(arch_resolve "amd64" "arm64v8").zip"
 
-  msg_info "Configuring RustDesk Server"
-  mkdir -p /root/.config/rustdesk
-  cd /opt/rustdesk-server
-  ./rustdesk-utils genkeypair >/tmp/rustdesk_keys.txt
-  grep "Public Key" /tmp/rustdesk_keys.txt | awk '{print $3}' >/root/.config/rustdesk/id_ed25519.pub
-  grep "Secret Key" /tmp/rustdesk_keys.txt | awk '{print $3}' >/root/.config/rustdesk/id_ed25519
-  chmod 600 /root/.config/rustdesk/id_ed25519
-  chmod 644 /root/.config/rustdesk/id_ed25519.pub
-  rm /tmp/rustdesk_keys.txt
-  msg_ok "Configured RustDesk Server"
-
-  fetch_and_deploy_gh_release "rustdesk-api" "lejianwen/rustdesk-api" "prebuild" "latest" "/opt/rustdesk-api" "linux-$(arch_resolve).tar.gz"
-
-  msg_info "Configuring RustDesk API"
-  cd /opt/rustdesk-api
-  ADMINPASS=$(head -c 16 /dev/urandom | xxd -p -c 16)
-  $STD ./apimain reset-admin-pwd "$ADMINPASS"
-  cat <<EOF >~/rustdesk.creds
-RustDesk WebUI
-
-Username: admin
-Password: $ADMINPASS
-EOF
-  msg_ok "Configured RustDesk API"
-
-  msg_info "Enabling RustDesk Server Services"
-  cat <<EOF >/etc/init.d/rustdesk-server-hbbs
+  msg_info "Creating RustDesk Server Services"
+  for svc in hbbs hbbr; do
+    cat <<EOF >"/etc/init.d/rustdesk-server-${svc}"
 #!/sbin/openrc-run
-description="RustDesk HBBS Service"
+description="RustDesk ${svc^^} Service"
 directory="/opt/rustdesk-server"
-command="/opt/rustdesk-server/hbbs"
-command_args=""
+command="/opt/rustdesk-server/${svc}"
 command_background="true"
-command_user="root"
-pidfile="/var/run/rustdesk-server-hbbs.pid"
-output_log="/var/log/rustdesk-hbbs.log"
-error_log="/var/log/rustdesk-hbbs.err"
+pidfile="/var/run/rustdesk-server-${svc}.pid"
+output_log="/var/log/rustdesk-${svc}.log"
+error_log="/var/log/rustdesk-${svc}.err"
 
 depend() {
     use net
 }
 EOF
+    chmod +x "/etc/init.d/rustdesk-server-${svc}"
+    $STD rc-update add "rustdesk-server-${svc}" default
+    $STD service "rustdesk-server-${svc}" start
+  done
+  msg_ok "Created RustDesk Server Services"
+  write_creds /opt/rustdesk-server/id_ed25519.pub
 
-  cat <<EOF >/etc/init.d/rustdesk-server-hbbr
-#!/sbin/openrc-run
-description="RustDesk HBBR Service"
-directory="/opt/rustdesk-server"
-command="/opt/rustdesk-server/hbbr"
-command_args=""
-command_background="true"
-command_user="root"
-pidfile="/var/run/rustdesk-server-hbbr.pid"
-output_log="/var/log/rustdesk-hbbr.log"
-error_log="/var/log/rustdesk-hbbr.err"
-
-depend() {
-    use net
-}
-EOF
-
-  cat <<EOF >/etc/init.d/rustdesk-api
+  if ((INSTALL_API)); then
+    fetch_and_deploy_gh_release "rustdesk-api" "lejianwen/rustdesk-api" "prebuild" "latest" "/opt/rustdesk-api" "linux-$(arch_resolve).tar.gz"
+    msg_info "Configuring RustDesk API"
+    api_env /opt/rustdesk-server/id_ed25519.pub | sed 's/^/export /' >/etc/conf.d/rustdesk-api
+    cd /opt/rustdesk-api
+    $STD ./apimain reset-admin-pwd "$API_PASS"
+    cat <<EOF >/etc/init.d/rustdesk-api
 #!/sbin/openrc-run
 description="RustDesk API Service"
 directory="/opt/rustdesk-api"
 command="/opt/rustdesk-api/apimain"
-command_args=""
 command_background="true"
-command_user="root"
 pidfile="/var/run/rustdesk-api.pid"
 output_log="/var/log/rustdesk-api.log"
 error_log="/var/log/rustdesk-api.err"
 
 depend() {
     use net
+    after rustdesk-server-hbbs
 }
 EOF
-  chmod +x /etc/init.d/rustdesk-server-hbbs
-  chmod +x /etc/init.d/rustdesk-server-hbbr
-  chmod +x /etc/init.d/rustdesk-api
-  $STD rc-update add rustdesk-server-hbbs default
-  $STD rc-update add rustdesk-server-hbbr default
-  $STD rc-update add rustdesk-api default
-  msg_ok "Enabled RustDesk Server Services"
-
-  msg_info "Starting RustDesk Server"
-  $STD service rustdesk-server-hbbs start
-  $STD service rustdesk-server-hbbr start
-  $STD service rustdesk-api start
-  msg_ok "Started RustDesk Server"
+    chmod +x /etc/init.d/rustdesk-api
+    $STD rc-update add rustdesk-api default
+    $STD service rustdesk-api start
+    msg_ok "Configured RustDesk API"
+  fi
 }
 
 run_os_setup

install/sabnzbd-install.sh

@@ -40,7 +40,8 @@ $STD uv venv --clear /opt/sabnzbd/venv
 $STD uv pip install -r /opt/sabnzbd/requirements.txt --python=/opt/sabnzbd/venv/bin/python
 msg_ok "Installed SABnzbd"
 
-read -r -p "Would you like to install par2cmdline-turbo? <y/N> " prompt
+prompt="${var_sabnzbd_par2_turbo:-}"
+[[ -n "$prompt" ]] || read -r -p "Would you like to install par2cmdline-turbo? <y/N> " prompt
 if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
   mv /usr/bin/par2 /usr/bin/par2.old
   fetch_and_deploy_gh_release "par2cmdline-turbo" "animetosho/par2cmdline-turbo" "prebuild" "latest" "/usr/bin/" "*-linux-$(arch_resolve).zip"

install/silverbullet-install.sh

@@ -17,7 +17,8 @@ fetch_and_deploy_gh_release "silverbullet" "silverbulletmd/silverbullet" "prebui
 mkdir -p /opt/silverbullet/space
 
 RUNTIME_API_ENV=""
-read -rp "${TAB3}Enable Silverbullet Runtime API? Requires Chromium (~700MB). Uses ~200MB extra RAM. (y/N): " runtime_api_prompt
+runtime_api_prompt="${var_silverbullet_runtime_api:-}"
+[[ -n "$runtime_api_prompt" ]] || read -rp "${TAB3}Enable Silverbullet Runtime API? Requires Chromium (~700MB). Uses ~200MB extra RAM. (y/N): " runtime_api_prompt
 if [[ "${runtime_api_prompt,,}" =~ ^(y|yes)$ ]]; then
   msg_info "Installing Chromium for Runtime API"
   $STD apt install -y chromium

install/slskd-install.sh

@@ -36,7 +36,8 @@ sed -i \
   -e 's/^.*picture/#&/' /opt/slskd/config/slskd.yml
 msg_ok "Configured Slskd"
 
-read -rp "${TAB3}Do you want to install Soularr? y/N " soularr
+soularr="${var_slskd_soularr:-}"
+[[ -n "$soularr" ]] || read -rp "${TAB3}Do you want to install Soularr? y/N " soularr
 if [[ ${soularr,,} =~ ^(y|yes)$ ]]; then
   PYTHON_VERSION="3.11" setup_uv
   fetch_and_deploy_gh_release "Soularr" "mrusse/soularr" "tarball" "latest" "/opt/soularr"

install/splunk-enterprise-install.sh

@@ -51,8 +51,8 @@ $STD curl -fsSL -o "splunk-enterprise.tgz" "$DOWNLOAD_URL" || {
 }
 $STD tar -xzf "splunk-enterprise.tgz" -C /opt
 rm -f "splunk-enterprise.tgz"
-addgroup --system splunk
-adduser --system --home /opt/splunk --shell /bin/bash --ingroup splunk --no-create-home splunk
+$STD addgroup --system splunk
+$STD adduser --system --home /opt/splunk --shell /bin/bash --ingroup splunk --no-create-home splunk
 chown -R splunk:splunk /opt/splunk
 msg_ok "Setup Splunk Enterprise v${RELEASE}"
 
@@ -64,17 +64,35 @@ Splunk-Credentials
 Username: $ADMIN_USER
 Password: $ADMIN_PASS
 EOF
+chmod 600 ~/splunk.creds
 
-cat <<EOF >"/opt/splunk/etc/system/local/user-seed.conf"
+install -d -o splunk -g splunk -m 755 /opt/splunk/etc/system/local
+cat <<EOF >/opt/splunk/etc/system/local/user-seed.conf
 [user_info]
 USERNAME = $ADMIN_USER
 PASSWORD = $ADMIN_PASS
 EOF
+chown splunk:splunk /opt/splunk/etc/system/local/user-seed.conf
+chmod 600 /opt/splunk/etc/system/local/user-seed.conf
+if ! grep -q '^SPLUNK_OS_USER=' /opt/splunk/etc/splunk-launch.conf; then
+    echo 'SPLUNK_OS_USER=splunk' >>/opt/splunk/etc/splunk-launch.conf
+fi
+chown splunk:splunk /opt/splunk/etc/splunk-launch.conf
 msg_ok "Created Splunk admin user"
 
 msg_info "Starting Service"
-$STD sudo -u splunk /opt/splunk/bin/splunk start --accept-license --answer-yes --no-prompt
-$STD /opt/splunk/bin/splunk enable boot-start -user splunk
+$STD sudo -H -u splunk /opt/splunk/bin/splunk start --accept-license --answer-yes --no-prompt
+$STD sudo -H -u splunk /opt/splunk/bin/splunk stop --answer-yes --no-prompt
+$STD /opt/splunk/bin/splunk enable boot-start \
+    -systemd-managed 1 \
+    -user splunk \
+    -group splunk \
+    --accept-license \
+    --answer-yes \
+    --no-prompt
+chown -R splunk:splunk /opt/splunk
+$STD systemctl daemon-reload
+$STD systemctl enable --now Splunkd
 msg_ok "Started Service"
 
 motd_ssh

install/stirling-pdf-install.sh

@@ -34,7 +34,8 @@ msg_ok "Installed Dependencies"
 PYTHON_VERSION="3.12" setup_uv
 JAVA_VERSION="25" setup_java
 
-if ! read -r -p "${TAB3}Do you want to use Stirling-PDF with Login? (no/n = without Login) [Y/n] " response; then
+response="${var_stirling_pdf_login:-}"
+if [[ -z "$response" ]] && ! read -r -p "${TAB3}Do you want to use Stirling-PDF with Login? (no/n = without Login) [Y/n] " response; then
   # No interactive stdin (EOF): fall back to the no-login install instead of
   # silently selecting login, which the -z test below would otherwise do.
   response="n"

install/tracearr-install.sh

@@ -68,7 +68,7 @@ $STD pnpm install --frozen-lockfile --force
 $STD pnpm turbo telemetry disable
 $STD pnpm turbo run build --no-daemon --filter=@tracearr/shared --filter=@tracearr/server --filter=@tracearr/web
 $STD ./scripts/fetch-basemap.sh || msg_warn "Basemap download failed, the map will show without base tiles"
-mkdir -p /opt/tracearr/{packages/shared,packages/emails,apps/server,apps/web,apps/server/src/db}
+mkdir -p /opt/tracearr/{packages/shared,packages/emails,apps/server,apps/web,apps/server/src/db,assets}
 cp -rf package.json /opt/tracearr/
 cp -rf pnpm-workspace.yaml /opt/tracearr/
 cp -rf pnpm-lock.yaml /opt/tracearr/
@@ -81,11 +81,12 @@ cp -rf packages/shared/dist /opt/tracearr/packages/shared/dist
 cp -rf packages/emails/package.json /opt/tracearr/packages/emails/
 cp -rf packages/emails/dist /opt/tracearr/packages/emails/dist
 cp -rf apps/server/src/db/migrations /opt/tracearr/apps/server/src/db/migrations
+cp -f assets/logo.png /opt/tracearr/assets/
 cp -rf data /opt/tracearr/data
 mkdir -p /opt/tracearr/data/image-cache
 rm -rf /opt/tracearr.build
 cd /opt/tracearr
-$STD pnpm install --prod --frozen-lockfile --ignore-scripts
+$STD pnpm install --prod --frozen-lockfile --ignore-scripts --filter @tracearr/server...
 msg_ok "Built Tracearr"
 
 msg_info "Configuring Tracearr"

install/traefik-install.sh

@@ -105,8 +105,9 @@ setup_alpine() {
   $STD apk add traefik --repository=https://dl-cdn.alpinelinux.org/alpine/edge/community
   msg_ok "Installed Traefik"
 
-  read -p "${TAB3}Enable Traefik WebUI (Port 8080)? [y/N]: " enable_webui
-  if [[ "$enable_webui" =~ ^[Yy]$ ]]; then
+  enable_webui="${var_traefik_webui:-}"
+  [[ -n "$enable_webui" ]] || read -p "${TAB3}Enable Traefik WebUI (Port 8080)? [y/N]: " enable_webui
+  if [[ "${enable_webui,,}" =~ ^(y|yes)$ ]]; then
     msg_info "Configuring Traefik WebUI"
     sed -i 's/localhost//g' /etc/traefik/traefik.yaml
     msg_ok "Configured Traefik WebUI"

install/tvheadend-install.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Nicolas Pastorello (opastorello)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://tvheadend.org/ | Github: https://github.com/tvheadend/tvheadend
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+setup_deb822_repo \
+  "tvheadend" \
+  "https://dl.cloudsmith.io/public/tvheadend/tvheadend/gpg.C6CC06BD69B430C6.key" \
+  "https://dl.cloudsmith.io/public/tvheadend/tvheadend/deb/debian" \
+  "$(get_os_info codename)" \
+  "main"
+
+var_admin_user="${var_admin_user:-admin}"
+var_admin_pass="${var_admin_pass:-$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | cut -c1-13)}"
+
+msg_info "Installing Tvheadend"
+echo "tvheadend tvheadend/admin_username string ${var_admin_user}" | debconf-set-selections
+echo "tvheadend tvheadend/admin_password password ${var_admin_pass}" | debconf-set-selections
+$STD apt install -y tvheadend
+msg_ok "Installed Tvheadend"
+
+msg_info "Starting Service"
+systemctl enable -q --now tvheadend
+msg_ok "Started Service"
+
+msg_info "Saving Credentials"
+cat <<EOF >~/tvheadend.creds
+Tvheadend Admin Credentials
+Username: ${var_admin_user}
+Password: ${var_admin_pass}
+EOF
+msg_ok "Saved Credentials"
+
+motd_ssh
+customize
+cleanup_lxc

install/valkey-install.sh

@@ -36,9 +36,11 @@ setup_deb_based() {
   msg_ok "Installed Valkey"
 
   echo
-  read -r -p "${TAB3}Enable TLS for Valkey (Sentinel mode does not supported)? [y/N]: " prompt
+  prompt="${var_valkey_tls:-}"
+  [[ -n "$prompt" ]] || read -r -p "${TAB3}Enable TLS for Valkey (Sentinel mode does not supported)? [y/N]: " prompt
   if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
-      read -r -p "${TAB3}Use TLS-only mode (disable TCP port 6379)? [y/N]: " tls_only
+      tls_only="${var_valkey_tls_only:-}"
+      [[ -n "$tls_only" ]] || read -r -p "${TAB3}Use TLS-only mode (disable TCP port 6379)? [y/N]: " tls_only
       msg_info "Configuring TLS for Valkey..."
 
       create_self_signed_cert "Valkey"

install/versitygw-install.sh

@@ -16,7 +16,8 @@ update_os
 fetch_and_deploy_gh_release "versitygw" "versity/versitygw" "binary"
 
 WEBUI_CONF=""
-read -rp "Would you like to enable the VersityGW WebGUI (Beta)? (y/N): " webui_prompt
+webui_prompt="${var_versitygw_webgui:-}"
+[[ -n "$webui_prompt" ]] || read -rp "Would you like to enable the VersityGW WebGUI (Beta)? (y/N): " webui_prompt
 if [[ "${webui_prompt,,}" =~ ^(y|yes)$ ]]; then
   WEBUI_CONF="\nVGW_WEBUI_PORT=:7071\nVGW_WEBUI_NO_TLS=true"
   msg_ok "WebGUI will be enabled on port 7071"

install/victoriametrics-install.sh

@@ -27,7 +27,8 @@ msg_ok "Got version $victoriametrics_release of VictoriaMetrics"
 fetch_and_deploy_gh_release "victoriametrics" "VictoriaMetrics/VictoriaMetrics" "prebuild" "$victoriametrics_release" "/opt/victoriametrics" "$victoriametrics_filename"
 fetch_and_deploy_gh_release "vmutils" "VictoriaMetrics/VictoriaMetrics" "prebuild" "$victoriametrics_release" "/opt/victoriametrics" "$vmutils_filename"
 
-read -r -p "${TAB3}Would you like to add VictoriaLogs? <y/N> " prompt
+prompt="${var_victoriametrics_logs:-}"
+[[ -n "$prompt" ]] || read -r -p "${TAB3}Would you like to add VictoriaLogs? <y/N> " prompt
 
 if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
   vl_release_json="$(mktemp)"

install/wanderer-install.sh

@@ -54,6 +54,16 @@ PB_DB_LOCATION=/opt/wanderer_data/pb_data
 MEILI_DB_PATH=/opt/wanderer_data/meili_data
 EOF
 
+cat <<'EOF' >/usr/local/bin/wanderer-pb
+#!/usr/bin/env bash
+set -a
+source /opt/wanderer/.env
+set +a
+cd /opt/wanderer/db
+exec ./pocketbase "$@" --dir="$PB_DB_LOCATION"
+EOF
+chmod +x /usr/local/bin/wanderer-pb
+
 cat <<EOF >/etc/systemd/system/wanderer-pocketbase.service
 [Unit]
 Description=wanderer PocketBase

install/watchstate-install.sh

@@ -0,0 +1,99 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/arabcoders/watchstate
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  nginx \
+  redis-server \
+  ripgrep \
+  sqlite3
+msg_ok "Installed Dependencies"
+
+PHP_VERSION="8.5" PHP_FPM="YES" setup_php
+setup_composer
+setup_ffmpeg
+NODE_VERSION="24" NODE_MODULE="bun" setup_nodejs
+fetch_and_deploy_gh_release "watchstate" "arabcoders/watchstate" "tarball" "latest" "/opt/watchstate" "" "v"
+
+msg_info "Building WatchState"
+cd /opt/watchstate
+sed -i "s/'version' => 'dev-master'/'version' => 'v$(cat ~/.watchstate)'/" config/config.php
+$STD composer install --no-dev --optimize-autoloader --no-interaction
+cd /opt/watchstate/frontend
+$STD bun install --frozen-lockfile --production
+NODE_ENV=production $STD bun run generate
+mv /opt/watchstate/frontend/exported /opt/watchstate/public/exported
+rm -rf /opt/watchstate/frontend/node_modules /opt/watchstate/frontend/.nuxt
+msg_ok "Built WatchState"
+
+msg_info "Configuring WatchState"
+# loaded first by CLI, worker and php-fpm alike; the default data dir is /opt/watchstate/var, which every update wipes
+cat <<EOF >/opt/watchstate/.env
+WS_DATA_PATH=/opt/watchstate_data
+EOF
+$STD php /opt/watchstate/bin/console db:migrate --execute
+$STD php /opt/watchstate/bin/console system:apikey
+chown -R www-data:www-data /opt/watchstate_data
+msg_ok "Configured WatchState"
+
+msg_info "Configuring Nginx"
+PHP_SOCK=$(get_php_fpm_socket)
+cat <<EOF >/etc/nginx/sites-available/watchstate
+server {
+    listen 8080;
+    server_name _;
+    root /opt/watchstate/public;
+    index index.php;
+    client_max_body_size 100M;
+
+    location / {
+        try_files \$uri /index.php\$is_args\$args;
+    }
+
+    location ~ \.php\$ {
+        fastcgi_pass unix:${PHP_SOCK};
+        fastcgi_param SCRIPT_FILENAME \$realpath_root\$fastcgi_script_name;
+        include fastcgi_params;
+        fastcgi_read_timeout 600;
+    }
+}
+EOF
+nginx_enable_site "watchstate"
+msg_ok "Configured Nginx"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/watchstate-worker.service
+[Unit]
+Description=WatchState Worker
+After=network.target redis-server.service
+
+[Service]
+Type=simple
+User=www-data
+Group=www-data
+WorkingDirectory=/opt/watchstate
+ExecStart=/usr/bin/php /opt/watchstate/bin/console system:worker -v
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now watchstate-worker
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/wazuh-install.sh

@@ -15,16 +15,7 @@ update_os
 
 RELEASE=$(get_latest_github_release "wazuh/wazuh" | cut -d. -f1,2)
 
-msg_warn "WARNING: This script will run an external installer from a third-party source (https://wazuh.com/)."
-msg_warn "The following code is NOT maintained or audited by our repository."
-msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
-msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://packages.wazuh.com/$RELEASE/wazuh-install.sh "
-echo
-read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
-if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
-  msg_error "Aborted by user. No changes have been made."
-  exit 10
-fi
+confirm_external_installer "https://wazuh.com/" "https://packages.wazuh.com/$RELEASE/wazuh-install.sh"
 
 msg_info "Setup Wazuh"
 curl -fsSL https://packages.wazuh.com/$RELEASE/wazuh-install.sh -o wazuh-install.sh

install/weblate-install.sh

@@ -0,0 +1,144 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/WeblateOrg/weblate
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  build-essential \
+  pkg-config \
+  libacl1-dev \
+  liblz4-dev \
+  libzstd-dev \
+  libxxhash-dev \
+  libssl-dev \
+  libldap2-dev \
+  libsasl2-dev \
+  git \
+  gettext \
+  nginx \
+  valkey-server
+msg_ok "Installed Dependencies"
+
+PG_VERSION="17" setup_postgresql
+PG_DB_NAME="weblate" PG_DB_USER="weblate" setup_postgresql_db
+PYTHON_VERSION="3.14" setup_uv
+USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "weblate" "WeblateOrg/weblate" "singlefile" "latest" "/opt/weblate" "weblate-*-py3-none-any.whl"
+
+msg_info "Installing Weblate"
+$STD uv venv --python 3.14 /opt/weblate/.venv
+$STD uv pip install --python /opt/weblate/.venv/bin/python --compile-bytecode /opt/weblate/weblate-*.whl "weblate[all,wsgi]"
+rm -f /opt/weblate/weblate-*.whl
+msg_ok "Installed Weblate"
+
+msg_info "Configuring Weblate"
+mkdir -p /opt/weblate_data/python/customize /app
+# weblate.settings_docker is upstream's env-driven settings; it reads the secret and
+# settings-override.py from /app/data and loads the "customize" app from DATA_DIR/python
+ln -sfn /opt/weblate_data /app/data
+touch /opt/weblate_data/python/customize/{__init__,models}.py
+/opt/weblate/.venv/bin/weblate-generate-secret-key >/opt/weblate_data/secret
+cat <<EOF >/opt/weblate_data/weblate.env
+DJANGO_SETTINGS_MODULE=weblate.settings_docker
+PYTHONPATH=/opt/weblate_data/python
+WEBLATE_SITE_DOMAIN=${LOCAL_IP}
+WEBLATE_DATA_DIR=/opt/weblate_data
+WEBLATE_CACHE_DIR=/opt/weblate/cache
+WEBLATE_IP_PROXY_HEADER=HTTP_X_FORWARDED_FOR
+POSTGRES_HOST=127.0.0.1
+POSTGRES_DB=weblate
+POSTGRES_USER=weblate
+POSTGRES_PASSWORD=${PG_DB_PASS}
+REDIS_HOST=127.0.0.1
+# Password set for the "admin" account at install; Weblate does not read it
+WEBLATE_ADMIN_PASSWORD=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c16)
+EOF
+chmod 600 /opt/weblate_data/secret /opt/weblate_data/weblate.env
+set -a
+source /opt/weblate_data/weblate.env
+set +a
+$STD /opt/weblate/.venv/bin/weblate migrate --noinput
+$STD /opt/weblate/.venv/bin/weblate createadmin --password="${WEBLATE_ADMIN_PASSWORD}"
+$STD /opt/weblate/.venv/bin/weblate collectstatic --noinput
+msg_ok "Configured Weblate"
+
+msg_info "Configuring Nginx"
+cat <<EOF >/etc/nginx/sites-available/weblate
+server {
+    listen 80;
+    server_name _;
+    client_max_body_size 1000M;
+
+    location = /favicon.ico {
+        alias /opt/weblate/cache/static/favicon.ico;
+        expires 30d;
+    }
+
+    location /static/ {
+        alias /opt/weblate/cache/static/;
+        expires 30d;
+    }
+
+    location / {
+        proxy_pass http://127.0.0.1:8888;
+        proxy_set_header Host \$http_host;
+        proxy_set_header X-Forwarded-For \$remote_addr;
+        proxy_set_header X-Forwarded-Proto \$scheme;
+        proxy_read_timeout 3600;
+    }
+}
+EOF
+nginx_enable_site "weblate"
+msg_ok "Configured Nginx"
+
+msg_info "Creating Services"
+cat <<EOF >/etc/systemd/system/weblate.service
+[Unit]
+Description=Weblate
+After=network.target postgresql.service valkey-server.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/weblate_data
+EnvironmentFile=/opt/weblate_data/weblate.env
+ExecStart=/opt/weblate/.venv/bin/granian --interface wsgi --host 127.0.0.1 --port 8888 --workers 2 --blocking-threads 8 --backlog 128 --backpressure 16 --runtime-mode mt --workers-max-rss 450 --no-ws weblate.wsgi:application
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+cat <<EOF >/etc/systemd/system/weblate-celery.service
+[Unit]
+Description=Weblate Celery Worker
+After=network.target postgresql.service valkey-server.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/weblate_data
+EnvironmentFile=/opt/weblate_data/weblate.env
+ExecStart=/opt/weblate/.venv/bin/celery --app=weblate.utils worker --beat --loglevel=info --queues=celery,notify,memory,translate,backup --prefetch-multiplier=1 --concurrency=2
+Restart=on-failure
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now weblate weblate-celery
+msg_ok "Created Services"
+
+motd_ssh
+customize
+cleanup_lxc

install/wikijs-install.sh

@@ -20,7 +20,7 @@ msg_ok "Installed Dependencies"
 NODE_VERSION="26" NODE_MODULE="yarn,node-gyp" setup_nodejs
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="wiki" PG_DB_USER="wikijs_user" PG_DB_EXTENSIONS="pg_trgm" setup_postgresql_db
-fetch_and_deploy_gh_release "wikijs" "requarks/wiki" "prebuild" "latest" "/opt/wikijs" "wiki-js.tar.gz"
+fetch_and_deploy_gh_release "wikijs" "requarks/wiki-v2" "prebuild" "latest" "/opt/wikijs" "wiki-js.tar.gz"
 
 msg_info "Configuring Wiki.js"
 mv /opt/wikijs/config.sample.yml /opt/wikijs/config.yml