Zitadel: run init and setup in the foreground

start-from-init ran in the background with its output thrown away, and the PID to kill was guessed from lsof after 60 seconds; when the process had already ended, kill got no PID and failed with exit 2. init and setup finish on their own, report their errors, and the service only starts once its user exists.

CHANGELOG.md

@@ -565,8 +565,47 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-10-19
+
+### 🆕 New Scripts
+
+  - Calagopus ([#18012](https://github.com/community-scripts/ProxmoxVE/pull/18012))
+- Netronome ([#18011](https://github.com/community-scripts/ProxmoxVE/pull/18011))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - immich: record library revisions when the line is missing [@mazelado](https://github.com/mazelado) ([#17990](https://github.com/community-scripts/ProxmoxVE/pull/17990))
+    - Update authentik 2026.8.4 [@thieneret](https://github.com/thieneret) ([#18004](https://github.com/community-scripts/ProxmoxVE/pull/18004))
+
+  - #### ✨ New Features
+
+    - feat(mealie): add reverse proxy auth settings to mealie.env [@bferd](https://github.com/bferd) ([#18006](https://github.com/community-scripts/ProxmoxVE/pull/18006))
+
 ## 2026-10-18
 
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Donetick: create selfhosted.yaml from the example [@MickLesk](https://github.com/MickLesk) ([#17992](https://github.com/community-scripts/ProxmoxVE/pull/17992))
+    - Wiki.js: only back up db.sqlite on SQLite installs [@MickLesk](https://github.com/MickLesk) ([#17993](https://github.com/community-scripts/ProxmoxVE/pull/17993))
+    - FlareSolverr: pass Chrome an en-US Accept-Language [@MickLesk](https://github.com/MickLesk) ([#17995](https://github.com/community-scripts/ProxmoxVE/pull/17995))
+    - 2FAuth: install the locked dependencies [@MickLesk](https://github.com/MickLesk) ([#17996](https://github.com/community-scripts/ProxmoxVE/pull/17996))
+    - Tracearr: drop the pnpm store after the update build [@gioxx](https://github.com/gioxx) ([#17869](https://github.com/community-scripts/ProxmoxVE/pull/17869))
+    - vaultwarden: build before stopping the service [@mazelado](https://github.com/mazelado) ([#17983](https://github.com/community-scripts/ProxmoxVE/pull/17983))
+
+  - #### 💥 Breaking Changes
+
+    - fix: geopulse 2.0.0 upgrade support (nginx .mjs, pg18, jwt cleanup) [@CrazyWolf13](https://github.com/CrazyWolf13) ([#17978](https://github.com/community-scripts/ProxmoxVE/pull/17978))
+
+### 💾 Core
+
+  - Let get_current_ip reach its IPv6 fallback [@MickLesk](https://github.com/MickLesk) ([core#151](https://github.com/community-scripts/core/pull/151))
+- Drop apt autoclean before apt clean [@MickLesk](https://github.com/MickLesk) ([core#152](https://github.com/community-scripts/core/pull/152))
+- Silence apt's script warning in $STD [@MickLesk](https://github.com/MickLesk) ([core#150](https://github.com/community-scripts/core/pull/150))
+
 ## 2026-10-17
 
 ### 🆕 New Scripts

ct/authentik.sh

@@ -47,7 +47,7 @@ function update_script() {
   RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
   setup_yq
 
-  AUTHENTIK_VERSION="version/2026.8.3"
+  AUTHENTIK_VERSION="version/2026.8.4"
   # Source: https://github.com/goauthentik/fips/blob/main/Makefile#L26
   XMLSEC_VERSION="1.3.12"
 

ct/calagopus.sh

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Jelcoo
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://calagopus.com/
+
+APP="Calagopus"
+var_tags="${var_tags:-panel;game-server}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-40}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /usr/local/bin/calagopus-panel ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "calagopus-panel" "calagopus/panel"; then
+    msg_info "Stopping Service"
+    systemctl stop calagopus-panel
+    msg_ok "Stopped Service"
+
+    create_backup /etc/calagopus/.env /var/lib/calagopus
+
+    fetch_and_deploy_gh_release "calagopus-panel" "calagopus/panel" "singlefile" "latest" "/usr/local/bin" "panel-rs-aio-$(arch_resolve x86_64 aarch64)-linux"
+
+    restore_backup
+
+    msg_info "Starting Service"
+    systemctl start calagopus-panel
+    msg_ok "Started Service"
+    msg_ok "Updated Successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:8000${CL}"

ct/flaresolverr.sh

@@ -35,6 +35,12 @@ function update_script() {
     msg_error "You must upgrade your LXC to Debian Trixie before updating."
     exit
   fi
+  # FlareSolverr hands LANG to Chrome as Accept-Language, which needs a tag like en-US, not a locale (#17987)
+  if ! grep -q '^Environment="LANG=' /etc/systemd/system/flaresolverr.service; then
+    sed -i '/^Environment="CAPTCHA_SOLVER=/a Environment="LANG=en-US"' /etc/systemd/system/flaresolverr.service
+    systemctl daemon-reload
+    systemctl restart flaresolverr
+  fi
   if check_for_gh_release "flaresolverr" "FlareSolverr/FlareSolverr"; then
     msg_info "Stopping service"
     systemctl stop flaresolverr

ct/geopulse.sh

@@ -10,7 +10,7 @@ APP="GeoPulse"
 var_tags="${var_tags:-location;tracking;gps}"
 var_cpu="${var_cpu:-2}"
 var_ram="${var_ram:-1024}"
-var_disk="${var_disk:-8}"
+var_disk="${var_disk:-12}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
 var_arm64="${var_arm64:-yes}"
@@ -32,6 +32,16 @@ function update_script() {
   fi
 
   if check_for_gh_release "geopulse-backend" "tess1o/geopulse"; then
+    msg_info "Backing Up Database"
+    mkdir -p /var/lib/geopulse/dumps
+    DB_NAME="$(grep -oP '^GEOPULSE_POSTGRES_DB=\K.*' /etc/geopulse/geopulse.env 2>/dev/null)"
+    DB_NAME="${DB_NAME:-geopulse}"
+    if sudo -u postgres pg_dump -Fc "${DB_NAME}" >"/var/lib/geopulse/dumps/${DB_NAME}-pre-update-$(date +%Y%m%d%H%M%S).dump" 2>/dev/null; then
+      msg_ok "Backed Up Database"
+    else
+      msg_warn "Database backup failed, continuing anyway"
+    fi
+
     msg_info "Stopping Service"
     systemctl stop geopulse-backend
     msg_ok "Stopped Service"
@@ -51,7 +61,48 @@ function update_script() {
     fi
 
     fetch_and_deploy_gh_release "geopulse-backend" "tess1o/geopulse" "singlefile" "latest" "/opt/geopulse/backend" "${BINARY_PATTERN}"
-    fetch_and_deploy_gh_release "geopulse-frontend" "tess1o/geopulse" "prebuild" "latest" "/var/www/geopulse" "geopulse-frontend-*.tar.gz"
+    CLEAN_INSTALL=1 CLEAN_INSTALL_KEEP="avatars" fetch_and_deploy_gh_release "geopulse-frontend" "tess1o/geopulse" "prebuild" "latest" "/var/www/geopulse" "geopulse-frontend-*.tar.gz"
+
+    if [[ -f /etc/geopulse/geopulse.env ]] && grep -q "GEOPULSE_JWT_" /etc/geopulse/geopulse.env 2>/dev/null; then
+      msg_info "Removing Unused JWT Keys"
+      sed -i '/^GEOPULSE_JWT_PRIVATE_KEY_LOCATION=/d;/^GEOPULSE_JWT_PUBLIC_KEY_LOCATION=/d' /etc/geopulse/geopulse.env
+      rm -f /opt/geopulse/keys/jwt-private-key.pem /opt/geopulse/keys/jwt-public-key.pem
+      msg_ok "Removed Unused JWT Keys"
+    fi
+
+    if [[ -f /etc/nginx/sites-available/geopulse.conf ]] && ! grep -q '\.mjs\$' /etc/nginx/sites-available/geopulse.conf; then
+      msg_info "Configuring Nginx for .mjs Assets"
+      cp /etc/nginx/sites-available/geopulse.conf /etc/nginx/sites-available/geopulse.conf.pre-mjs.bak
+
+      ANCHOR_LINE="$(grep -n '    add_header Cache-Control "public, max-age=31536000";' /etc/nginx/sites-available/geopulse.conf.pre-mjs.bak | head -1 | cut -d: -f1)"
+
+      if [[ -n "$ANCHOR_LINE" ]]; then
+        INSERT_LINE=$((ANCHOR_LINE + 1))
+        {
+          head -n "$INSERT_LINE" /etc/nginx/sites-available/geopulse.conf.pre-mjs.bak
+          cat <<'MJSBLOCK'
+
+    location ~* ^/(?!osm/).*\.mjs$ {
+        types {
+            application/javascript mjs;
+        }
+        expires 1y;
+        add_header Cache-Control "public, max-age=31536000";
+    }
+MJSBLOCK
+          tail -n "+$((INSERT_LINE + 1))" /etc/nginx/sites-available/geopulse.conf.pre-mjs.bak
+        } >/etc/nginx/sites-available/geopulse.conf
+      fi
+
+      if [[ -n "$ANCHOR_LINE" ]] && grep -q '\.mjs\$' /etc/nginx/sites-available/geopulse.conf && nginx -t >/dev/null 2>&1; then
+        systemctl reload nginx
+        msg_ok "Configured Nginx for .mjs Assets"
+      else
+        cp /etc/nginx/sites-available/geopulse.conf.pre-mjs.bak /etc/nginx/sites-available/geopulse.conf
+        nginx -t >/dev/null 2>&1 && systemctl reload nginx
+        msg_warn "Could not automatically add the .mjs nginx block (customized config?) - add it manually, see the GeoPulse 2.0.0 upgrade notes"
+      fi
+    fi
 
     msg_info "Starting Service"
     systemctl start geopulse-backend

ct/immich.sh

@@ -103,10 +103,10 @@ EOF
     fi
   fi
   # Without the revision file the refresh was skipped and sharp failed on an old libvips (#17914).
-  if [[ ! -f ~/.immich_library_revisions ]]; then
-    msg_warn "No record of the compiled image-processing libraries, rebuilding all of them"
-    printf '%s: unknown\n' imagemagick jpegli libheif libjxl libraw libvips >~/.immich_library_revisions
-  fi
+  [[ -f ~/.immich_library_revisions ]] || msg_warn "No record of the compiled image-processing libraries, rebuilding all of them"
+  for lib in imagemagick jpegli libheif libjxl libraw libvips; do
+    grep -q "^${lib}:" ~/.immich_library_revisions 2>/dev/null || echo "${lib}: unknown" >>~/.immich_library_revisions
+  done
   [[ -d "$BASE_DIR/.git" ]] || $STD git clone -b main https://github.com/immich-app/base-images "$BASE_DIR"
   libraries=("libjxl" "jpegli" "libheif" "libraw" "imagemagick" "libvips")
   cd "$BASE_DIR"

ct/mealie.sh

@@ -58,6 +58,18 @@ exec uv run mealie
 STARTEOF
     fi
     chmod +x /opt/mealie/start.sh
+    if ! grep -q "REVERSE_PROXY_AUTH_ENABLED" /opt/mealie/mealie.env; then
+      cat <<EOF >>/opt/mealie/mealie.env
+
+# Reverse proxy auth (Mealie v3.29.0+). Disabled by default.
+# To enable: set REVERSE_PROXY_AUTH_ENABLED=true, set a secret, then restart mealie.
+# REVERSE_PROXY_AUTH_ENABLED=false
+# REVERSE_PROXY_AUTH_HEADER=X-Forwarded-User
+# REVERSE_PROXY_AUTH_SIGNUP_ENABLED=false
+# REVERSE_PROXY_AUTH_SECRET=
+# REVERSE_PROXY_AUTH_SECRET_HEADER=X-Mealie-Reverse-Proxy-Secret
+EOF
+    fi
     msg_ok "Configuration restored"
 
     msg_info "Installing Python Dependencies with uv"

ct/netronome.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/autobrr/netronome
+
+APP="Netronome"
+var_tags="${var_tags:-network;monitoring;speedtest}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-512}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /usr/bin/netronome ]]; then
+    msg_error "No Netronome Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "netronome" "autobrr/netronome" "" "" "v"; then
+    msg_info "Stopping Netronome"
+    systemctl stop netronome
+    msg_ok "Stopped Netronome"
+
+    fetch_and_deploy_gh_release "netronome" "autobrr/netronome" "binary" "latest" "" "netronome_*_linux_$(arch_resolve).deb" "v"
+
+    msg_info "Starting Netronome"
+    systemctl start netronome
+    msg_ok "Started Netronome"
+    msg_ok "Updated successfully!"
+  fi
+
+  if check_for_gh_release "librespeed-cli" "librespeed/speedtest-cli"; then
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "librespeed-cli" "librespeed/speedtest-cli" "prebuild" "latest" "/opt/librespeed-cli" "librespeed-cli_*_linux_$(arch_resolve).tar.gz"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:7575${CL}"
+echo -e "${INFO}${YW}Register your account right away: the registration page accepts only the first account, and until then anyone who reaches the port can claim it.${CL}"

ct/tracearr.sh

@@ -146,6 +146,7 @@ EOF
     rm -rf /opt/tracearr.build
     cd /opt/tracearr
     $STD pnpm install --prod --frozen-lockfile --ignore-scripts --filter @tracearr/server...
+    rm -rf "$(pnpm store path)"
     $STD chown -R tracearr:tracearr /opt/tracearr
     msg_ok "Built Tracearr"
 

ct/vaultwarden.sh

@@ -53,10 +53,6 @@ update_deb_based() {
       printf '%s\n' "$INSTALLED_VERSION" >"$HOME/.vaultwarden"
     fi
     if check_for_gh_release "vaultwarden" "dani-garcia/vaultwarden"; then
-      msg_info "Stopping Service"
-      systemctl stop vaultwarden
-      msg_ok "Stopped Service"
-
       fetch_and_deploy_gh_release "vaultwarden" "dani-garcia/vaultwarden" "tarball" "latest" "/tmp/vaultwarden-src"
 
       msg_info "Updating VaultWarden to $VAULT (Patience)"
@@ -64,6 +60,12 @@ update_deb_based() {
       VW_VERSION="$VAULT"
       export VW_VERSION
       CARGO_BUILD_JOBS="$(get_parallel_jobs)" CARGO_PROFILE_RELEASE_LTO=false CARGO_PROFILE_RELEASE_CODEGEN_UNITS=16 $STD cargo build --features "sqlite,mysql,postgresql" --release
+      msg_ok "Built VaultWarden ${VAULT}"
+
+      msg_info "Stopping Service"
+      systemctl stop vaultwarden
+      msg_ok "Stopped Service"
+
       if [[ -f /usr/bin/vaultwarden ]]; then
         cp target/release/vaultwarden /usr/bin/
       else

ct/wikijs.sh

@@ -33,22 +33,18 @@ function update_script() {
   NODE_VERSION="26" NODE_MODULE="yarn,node-gyp" setup_nodejs
 
   if check_for_gh_release "wikijs" "requarks/wiki-v2"; then
-    #msg_info "Verifying whether ${APP}' new release is v3.x+ and current install uses SQLite."
-    #SQLITE_INSTALL=$([ -f /opt/wikijs/db.sqlite ] && echo "true" || echo "false")
-    #if [[ "${SQLITE_INSTALL}" == "true" && "${CHECK_UPDATE_RELEASE}" =~ ^3.* ]]; then
-    #  echo "SQLite is not supported in v3.x+, currently there is no update path availble."
-    #  exit
-    #fi
-    #msg_ok "There is an update path available for ${APP}"
+    # Installs before February 2025 use SQLite, newer ones PostgreSQL
+    SQLITE_INSTALL=$([[ -f /opt/wikijs/db.sqlite ]] && echo "true" || echo "false")
 
     msg_info "Stopping Service"
     systemctl stop wikijs
     msg_ok "Stopped Service"
 
     msg_info "Backing up Data"
-    mkdir /opt/wikijs-backup
-    #$SQLITE_INSTALL && 
-    cp /opt/wikijs/db.sqlite /opt/wikijs-backup
+    mkdir -p /opt/wikijs-backup
+    if [[ "$SQLITE_INSTALL" == "true" ]]; then
+      cp /opt/wikijs/db.sqlite /opt/wikijs-backup
+    fi
     cp -R /opt/wikijs/{config.yml,/data} /opt/wikijs-backup
     msg_ok "Backed up Data"
 
@@ -56,8 +52,9 @@ function update_script() {
 
     msg_info "Restoring Data"
     cp -R /opt/wikijs-backup/* /opt/wikijs
-    #$SQLITE_INSTALL && 
-    $STD npm rebuild sqlite3
+    if [[ "$SQLITE_INSTALL" == "true" ]]; then
+      $STD npm rebuild sqlite3
+    fi
     rm -rf /opt/wikijs-backup
     msg_ok "Restored Data"
 

install/2fauth-install.sh

@@ -36,7 +36,6 @@ sed -i -e "s|^APP_URL=.*|APP_URL=http://$LOCAL_IP|" \
   -e "s|^DB_USERNAME=$|DB_USERNAME=$MARIADB_DB_USER|" \
   -e "s|^DB_PASSWORD=$|DB_PASSWORD=$MARIADB_DB_PASS|" .env
 export COMPOSER_ALLOW_SUPERUSER=1
-$STD composer update --no-plugins --no-scripts
 $STD composer install --no-dev --prefer-dist --no-plugins --no-scripts
 $STD php artisan key:generate --force
 $STD php artisan migrate:refresh

install/authentik-install.sh

@@ -57,7 +57,7 @@ PG_VERSION="17" setup_postgresql
 PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db
 
 XMLSEC_VERSION="1.3.12"
-AUTHENTIK_VERSION="version/2026.8.3"
+AUTHENTIK_VERSION="version/2026.8.4"
 fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec"
 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
 GO_VERSION="$(grep -m1 '^go ' /opt/authentik/go.mod | awk '{print $2}')" setup_go

install/calagopus-install.sh

@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Jelcoo
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://calagopus.com/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y valkey
+systemctl enable -q --now valkey-server
+msg_ok "Installed Dependencies"
+
+PG_VERSION="18" setup_postgresql
+PG_DB_NAME="panel" PG_DB_USER="calagopus" setup_postgresql_db
+
+setup_docker
+
+fetch_and_deploy_gh_release "calagopus-panel" "calagopus/panel" "singlefile" "latest" "/usr/local/bin" "panel-rs-aio-$(arch_resolve x86_64 aarch64)-linux"
+
+msg_info "Configuring Calagopus"
+mkdir -p /etc/calagopus /var/lib/calagopus /var/log/calagopus
+mkdir -p /etc/calagopus-wings /var/lib/calagopus-wings /var/log/calagopus-wings /tmp/calagopus-wings
+
+APP_ENCRYPTION_KEY=$(openssl rand -hex 16)
+cat <<EOF >/etc/calagopus/.env
+DATABASE_URL=postgresql://${PG_DB_USER}:${PG_DB_PASS}@localhost:5432/${PG_DB_NAME}
+DATABASE_MIGRATE=true
+REDIS_URL=redis://localhost
+PORT=8000
+APP_ENCRYPTION_KEY=${APP_ENCRYPTION_KEY}
+APP_LOG_DIRECTORY=/var/log/calagopus
+APP_PRIMARY=true
+APP_ENABLE_WINGS_PROXY=true
+APP_USE_DECRYPTION_CACHE=true
+APP_USE_INTERNAL_CACHE=true
+AIO_BASE_WINGS_CONFIGURATION=/etc/calagopus/wings-config.yml
+EOF
+chmod 600 /etc/calagopus/.env
+
+cat <<EOF >/etc/calagopus/wings-config.yml
+app_name: Calagopus
+EOF
+msg_ok "Configured Calagopus"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/calagopus-panel.service
+[Unit]
+Description=Calagopus Panel
+After=network.target postgresql.service valkey-server.service docker.service
+Requires=postgresql.service valkey-server.service docker.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/etc/calagopus
+EnvironmentFile=/etc/calagopus/.env
+ExecStart=/usr/local/bin/calagopus-panel
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now calagopus-panel
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/donetick-install.sh

@@ -21,6 +21,7 @@ fetch_and_deploy_gh_release "donetick" "donetick/donetick" "prebuild" "latest" "
 
 msg_info "Setup Donetick"
 cd /opt/donetick
+[[ -f config/selfhosted.yaml ]] || cp config/selfhosted.yaml.example config/selfhosted.yaml
 TOKEN=$(openssl rand -hex 16)
 sed -i -e "s/change_this_to_a_secure_random_string_32_characters_long/${TOKEN}/g" config/selfhosted.yaml
 msg_ok "Setup Donetick"

install/flaresolverr-install.sh

@@ -48,6 +48,7 @@ RestartSec=5
 Type=simple
 Environment="LOG_LEVEL=info"
 Environment="CAPTCHA_SOLVER=none"
+Environment="LANG=en-US"
 WorkingDirectory=/opt/flaresolverr
 ExecStart=/opt/flaresolverr/flaresolverr
 TimeoutStopSec=30

install/geopulse-install.sh

@@ -19,17 +19,15 @@ $STD apt install -y \
   nginx
 msg_ok "Installed Dependencies"
 
-PG_VERSION="17" PG_MODULES="postgis" setup_postgresql
+PG_VERSION="18" PG_MODULES="postgis" setup_postgresql
 PG_DB_NAME="geopulse" PG_DB_USER="geopulse" PG_DB_EXTENSIONS="postgis,postgis_topology" setup_postgresql_db
 
 msg_info "Generating Security Keys"
 mkdir -p /opt/geopulse/{backend,keys}
 mkdir -p /etc/geopulse /var/www/geopulse /var/lib/geopulse/dumps
 mkdir -p /var/log/geopulse/{backend,nginx}
-openssl genpkey -algorithm RSA -out /opt/geopulse/keys/jwt-private-key.pem 2>/dev/null
-openssl rsa -pubout -in /opt/geopulse/keys/jwt-private-key.pem -out /opt/geopulse/keys/jwt-public-key.pem 2>/dev/null
 openssl rand -base64 32 >/opt/geopulse/keys/ai-encryption-key.txt
-chmod 640 /opt/geopulse/keys/jwt-private-key.pem /opt/geopulse/keys/jwt-public-key.pem /opt/geopulse/keys/ai-encryption-key.txt
+chmod 640 /opt/geopulse/keys/ai-encryption-key.txt
 msg_ok "Generated Security Keys"
 
 if [[ "$(uname -m)" == "aarch64" ]]; then
@@ -62,8 +60,6 @@ GEOPULSE_POSTGRES_PORT=5432
 GEOPULSE_POSTGRES_DB=${PG_DB_NAME}
 GEOPULSE_POSTGRES_USERNAME=${PG_DB_USER}
 GEOPULSE_POSTGRES_PASSWORD=${PG_DB_PASS}
-GEOPULSE_JWT_PRIVATE_KEY_LOCATION=file:/opt/geopulse/keys/jwt-private-key.pem
-GEOPULSE_JWT_PUBLIC_KEY_LOCATION=file:/opt/geopulse/keys/jwt-public-key.pem
 GEOPULSE_AI_ENCRYPTION_KEY_LOCATION=file:/opt/geopulse/keys/ai-encryption-key.txt
 QUARKUS_LOG_FILE_ENABLE=true
 QUARKUS_LOG_FILE_PATH=/var/log/geopulse/backend/geopulse.log
@@ -128,6 +124,14 @@ server {
         add_header Cache-Control "public, max-age=31536000";
     }
 
+    location ~* ^/(?!osm/).*\.mjs$ {
+        types {
+            application/javascript mjs;
+        }
+        expires 1y;
+        add_header Cache-Control "public, max-age=31536000";
+    }
+
     location ^~ /osm/tiles/ {
         resolver 8.8.8.8 valid=300s;
         resolver_timeout 10s;

install/mealie-install.sh

@@ -98,6 +98,14 @@ PRODUCTION=true
 HOST=0.0.0.0
 PORT=9000
 BASE_URL=http://${LOCAL_IP}:9000
+
+# Reverse proxy auth (Mealie v3.29.0+). Disabled by default.
+# To enable: set REVERSE_PROXY_AUTH_ENABLED=true, set a secret, then restart mealie.
+# REVERSE_PROXY_AUTH_ENABLED=false
+# REVERSE_PROXY_AUTH_HEADER=X-Forwarded-User
+# REVERSE_PROXY_AUTH_SIGNUP_ENABLED=false
+# REVERSE_PROXY_AUTH_SECRET=
+# REVERSE_PROXY_AUTH_SECRET_HEADER=X-Mealie-Reverse-Proxy-Secret
 EOF
 msg_ok "Wrote Environment File"
 

install/netronome-install.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/autobrr/netronome
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  iperf3 \
+  iputils-ping \
+  mtr-tiny \
+  traceroute
+msg_ok "Installed Dependencies"
+
+fetch_and_deploy_gh_release "librespeed-cli" "librespeed/speedtest-cli" "prebuild" "latest" "/opt/librespeed-cli" "librespeed-cli_*_linux_$(arch_resolve).tar.gz"
+ln -sf /opt/librespeed-cli/librespeed-cli /usr/local/bin/librespeed-cli
+fetch_and_deploy_gh_release "netronome" "autobrr/netronome" "binary" "latest" "" "netronome_*_linux_$(arch_resolve).deb" "v"
+
+msg_info "Configuring Netronome"
+mkdir -p /opt/netronome_data /root/.config
+$STD netronome generate-config --config /opt/netronome_data/config.toml
+sed -i 's/^host = "127.0.0.1"$/host = "0.0.0.0"/' /opt/netronome_data/config.toml
+chmod 600 /opt/netronome_data/config.toml
+ln -s /opt/netronome_data /root/.config/netronome
+msg_ok "Configured Netronome"
+
+msg_info "Creating Netronome Service"
+cat <<EOF >/etc/systemd/system/netronome.service
+[Unit]
+Description=Netronome
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/netronome_data
+ExecStart=/usr/bin/netronome serve --config /opt/netronome_data/config.toml
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now netronome
+msg_ok "Created Netronome Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/zitadel-install.sh

@@ -14,7 +14,7 @@ network_check
 update_os
 
 msg_info "Installing Dependencies (Patience)"
-$STD apt install -y ca-certificates lsof
+$STD apt install -y ca-certificates
 msg_ok "Installed Dependecies"
 
 PG_VERSION="17" setup_postgresql
@@ -114,13 +114,12 @@ NoNewPrivileges=true
 [Install]
 WantedBy=multi-user.target
 EOF
-systemctl enable -q --now zitadel
+systemctl enable -q zitadel
 msg_ok "Created Services"
 
 msg_info "Zitadel initial setup"
-zitadel start-from-init --masterkeyFile /opt/zitadel/.masterkey --config /opt/zitadel/config.yaml &>/dev/null &
-sleep 60
-kill $(lsof -i | awk '/zitadel/ {print $2}' | head -n1)
+$STD zitadel init --config /opt/zitadel/config.yaml
+$STD zitadel setup --masterkeyFile /opt/zitadel/.masterkey --config /opt/zitadel/config.yaml
 useradd zitadel
 msg_ok "Zitadel initialized"