Update CHANGELOG.md (#18328)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

.github/workflows/pocketbase-bot.yml

@@ -343,6 +343,7 @@ jobs:
               '`cpu` `ram` `hdd` `os` `version` also work without `method` — they go to the\n' +
               'default install method, e.g. `/pocketbase <slug> hdd=25`\n\n' +
               '**Editable fields:** `name` `description` `logo` `documentation` `website` `project_url` `repository` ' +
+              '`oidc_url` `license` ' +
               '`config_path` `port` `default_user` `default_passwd` ' +
               '`updateable` `privileged` `is_dev` `has_arm` ' +
               '`architectures` (amd64,arm64) `platforms` (pve,incus) ' +
@@ -544,6 +545,7 @@ jobs:
               out.push('- **Port:** ' + (record.port != null ? '`' + record.port + '`' : '—'));
               out.push('- **Updateable:** ' + (record.updateable ? 'Yes' : 'No'));
               out.push('- **Privileged:** ' + (record.privileged ? 'Yes' : 'No'));
+              out.push('- **License:** ' + (record.license || '—'));
               out.push('- **Architectures:** ' + ((record.architectures || []).join(', ') || 'amd64'));
               out.push('- **Platforms:** ' + ((record.platforms || []).join(', ') || 'pve'));
               if (record.is_dev) out.push('- **Dev:** Yes');
@@ -554,6 +556,7 @@ jobs:
               out.push('**Links:**');
               out.push('- **Website:** ' + (record.website || '—'));
               out.push('- **Docs:** ' + (record.documentation || '—'));
+              out.push('- **OIDC docs:** ' + (record.oidc_url || '—'));
               out.push('- **Logo:** ' + (record.logo ? '[link](' + record.logo + ')' : '—'));
               out.push('- **GitHub:** ' + (record.github || '—'));
               if (record.config_path) out.push('- **Config:** `' + record.config_path + '`');
@@ -985,6 +988,8 @@ jobs:
                 logo:             'string',
                 documentation:    'string',
                 website:          'string',
+                oidc_url:         'string',
+                license:          'string',
                 project_url:      'string',
                 repository:       'string',
                 config_path:      'string',

CHANGELOG.md

@@ -568,6 +568,38 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-10-30
+
+### 🆕 New Scripts
+
+  - Reconya ([#18325](https://github.com/community-scripts/ProxmoxVE/pull/18325))
+- Blinko ([#18324](https://github.com/community-scripts/ProxmoxVE/pull/18324))
+- ChartDB ([#18323](https://github.com/community-scripts/ProxmoxVE/pull/18323))
+
+## 2026-10-29
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Karakeep: fix monolith release asset pattern [@MohamedBassem](https://github.com/MohamedBassem) ([#18317](https://github.com/community-scripts/ProxmoxVE/pull/18317))
+    - Vikunja: fold the package's service block into the config's service section [@MickLesk](https://github.com/MickLesk) ([#18311](https://github.com/community-scripts/ProxmoxVE/pull/18311))
+    - Stirling-PDF: size JVM heap from container memory, not host RAM [@aashishvanand](https://github.com/aashishvanand) ([#18292](https://github.com/community-scripts/ProxmoxVE/pull/18292))
+    - fix(authentik): migrate systemd units when still on pre-2026.8 paths [@CervezaStallone](https://github.com/CervezaStallone) ([#18307](https://github.com/community-scripts/ProxmoxVE/pull/18307))
+    - fix(dawarich): serve .mjs MapLibre modules as JavaScript [@ricbaral](https://github.com/ricbaral) ([#18304](https://github.com/community-scripts/ProxmoxVE/pull/18304))
+
+  - #### ✨ New Features
+
+    - VictoriaLogs: enable syslog ingestion on TCP/UDP 514 [@opastorello](https://github.com/opastorello) ([#18300](https://github.com/community-scripts/ProxmoxVE/pull/18300))
+
+### 💾 Core
+
+  - feat: Performance - load host data in the background and stop reporting failed pre-checks [@MickLesk](https://github.com/MickLesk) ([core#179](https://github.com/community-scripts/core/pull/179))
+
+### 📚 Documentation
+
+  - gh: let the bot set oidc_url and license [@MickLesk](https://github.com/MickLesk) ([#18313](https://github.com/community-scripts/ProxmoxVE/pull/18313))
+
 ## 2026-10-28
 
 ### 🆕 New Scripts

ct/authentik.sh

@@ -155,7 +155,8 @@ function update_script() {
     rm -r /opt/authentik/blueprints
     $STD find /opt/authentik-data -path '*/lost+found' -prune -o -exec chown authentik:authentik {} +
 
-    if [[ $MAJOR == 2026 && $MINOR -lt 8 ]]; then
+    # Also catch installs whose version marker already reads 2026.8.x but whose units were never migrated
+    if [[ $MAJOR == 2026 && $MINOR -lt 8 ]] || grep -q "ExecStart=/opt/authentik/authentik-server" /etc/systemd/system/authentik-server.service; then
 	    msg_info "Updating Worker and Server config (from $MAJOR.$MINOR)"
       cat <<EOF >>/etc/default/authentik-server
 RUST_BACKTRACE=full

ct/blinko.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/blinkospace/blinko
+
+APP="Blinko"
+var_tags="${var_tags:-notes;ai;knowledge}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-6144}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/blinko ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "blinko" "blinkospace/blinko"; then
+    msg_info "Stopping Blinko"
+    systemctl stop blinko
+    msg_ok "Stopped Blinko"
+
+    NODE_VERSION="24" NODE_MODULE="bun" setup_nodejs
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "blinko" "blinkospace/blinko" "tarball"
+
+    msg_info "Building Blinko"
+    cd /opt/blinko
+    $STD bun install
+    $STD bunx prisma generate
+    $STD bun run build:web
+    $STD bun run build:seed
+    mv dist/public server/public
+    cp -r server/lute.min.js server/vditor dist/
+    ln -s /opt/blinko_data/storage /opt/blinko/.blinko
+    msg_ok "Built Blinko"
+
+    msg_info "Starting Blinko"
+    systemctl start blinko
+    msg_ok "Started Blinko"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:1111${CL}"

ct/chartdb.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/chartdb/chartdb
+
+APP="ChartDB"
+var_tags="${var_tags:-database;diagram;dev-tools}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-6144}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/chartdb ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "chartdb" "chartdb/chartdb"; then
+    msg_info "Stopping ChartDB"
+    systemctl stop nginx
+    msg_ok "Stopped ChartDB"
+
+    NODE_VERSION="24" setup_nodejs
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "chartdb" "chartdb/chartdb" "tarball"
+
+    msg_info "Building ChartDB"
+    cd /opt/chartdb
+    $STD npm ci
+    NODE_OPTIONS="--max-old-space-size=4096" $STD npm run build
+    rm -rf /opt/chartdb/node_modules
+    msg_ok "Built ChartDB"
+
+    msg_info "Starting ChartDB"
+    systemctl start nginx
+    msg_ok "Started ChartDB"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}https://${IP}${CL}"

ct/dawarich.sh

@@ -33,6 +33,13 @@ function update_script() {
 
   ensure_dependencies libgeos++-dev libxml2-dev libxslt-dev libjemalloc-dev
 
+  if [[ -f /etc/nginx/sites-available/dawarich.conf ]] && ! grep -q '\.mjs\$' /etc/nginx/sites-available/dawarich.conf; then
+    msg_info "Fixing MapLibre delivery in Nginx"
+    sed -i '/location ~ \^\/(assets|packs)\/ {/i\    location ~ \\.mjs$ {\n        types { }\n        default_type text/javascript;\n        try_files $uri @rails;\n    }\n' /etc/nginx/sites-available/dawarich.conf
+    nginx_enable_site dawarich.conf
+    msg_ok "Fixed MapLibre delivery in Nginx"
+  fi
+
   if check_for_gh_release "dawarich" "Freika/dawarich"; then
     msg_info "Stopping Services"
     systemctl stop dawarich-web dawarich-worker

ct/reconya.sh

@@ -0,0 +1,56 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Dyneteq/reconya
+
+APP="Reconya"
+var_tags="${var_tags:-network;discovery;security}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-512}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/reconya ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "reconya" "Dyneteq/reconya"; then
+    msg_info "Stopping Reconya"
+    systemctl stop reconya
+    msg_ok "Stopped Reconya"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "reconya" "Dyneteq/reconya" "prebuild" "latest" "/opt/reconya" "reconya-linux-$(arch_resolve "amd64" "arm64").tar.gz"
+
+    msg_info "Starting Reconya"
+    systemctl start reconya
+    msg_ok "Started Reconya"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3008${CL}"

ct/stirling-pdf.sh

@@ -60,6 +60,15 @@ function update_script() {
     systemctl stop stirlingpdf unoserver
     msg_ok "Stopped Services"
 
+    if grep -q '^ExecStart=/usr/bin/java -jar Stirling-PDF.jar$' /etc/systemd/system/stirlingpdf.service; then
+      msg_info "Limiting Java Heap to Container Memory"
+      sed -i '/^ExecStop=\/bin\/kill -15 %n$/d' /etc/systemd/system/stirlingpdf.service
+      sed -i "s|^ExecStart=/usr/bin/java -jar Stirling-PDF.jar$|ExecStart=/bin/bash -c 'exec /usr/bin/java -XX:MaxRAM=\$\$(grep -m1 -o \"[0-9][0-9]*\" /proc/meminfo)k \$\$JAVA_BASE_OPTS \$\$JAVA_CUSTOM_OPTS -jar Stirling-PDF.jar'|" /etc/systemd/system/stirlingpdf.service
+      sed -i 's/-XX:MaxRAMPercentage=75/-XX:MaxRAMPercentage=50/' /opt/Stirling-PDF/.env
+      systemctl daemon-reload
+      msg_ok "Limited Java Heap to Container Memory"
+    fi
+
     if [[ -f ~/.Stirling-PDF-login ]]; then
       USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "stirling-pdf" "Stirling-Tools/Stirling-PDF" "singlefile" "latest" "/opt/Stirling-PDF" "Stirling-PDF-with-login.jar"
       mv /opt/Stirling-PDF/Stirling-PDF-with-login.jar /opt/Stirling-PDF/Stirling-PDF.jar

ct/victorialogs.sh

@@ -32,6 +32,14 @@ function update_script() {
     exit
   fi
 
+  if ! grep -q -- '-syslog.listenAddr' /etc/systemd/system/victorialogs.service; then
+    msg_info "Enabling Syslog Ingestion"
+    sed -i '/^ExecStart=/ s|$| -syslog.listenAddr.tcp=:514 -syslog.listenAddr.udp=:514|' /etc/systemd/system/victorialogs.service
+    systemctl daemon-reload
+    systemctl restart victorialogs
+    msg_ok "Enabled Syslog Ingestion (TCP/UDP 514)"
+  fi
+
   if check_for_gh_release "victorialogs" "VictoriaMetrics/VictoriaLogs"; then
     msg_info "Stopping Service"
     systemctl stop victorialogs
@@ -56,3 +64,5 @@ msg_ok "Completed Successfully!\n"
 echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
 echo -e "${INFO}${YW}Access it using the following URL:${CL}"
 echo -e "${GATEWAY}${BGN}http://${IP}:9428${CL}"
+echo -e "${INFO}${YW}Syslog ingestion (TCP/UDP):${CL}"
+echo -e "${GATEWAY}${BGN}${IP}:514${CL}"

ct/vikunja.sh

@@ -47,6 +47,13 @@ function update_script() {
     [[ "$CONFIRM2" =~ ^[yY]$ ]] || exit 0
   fi
 
+  if [[ $(grep -c '^service:' /etc/vikunja/config.yml || true) -gt 1 ]]; then
+    msg_info "Merging duplicate service section in config.yml"
+    sed -i '0,/^service:/!{/^service:/d}' /etc/vikunja/config.yml
+    systemctl restart vikunja
+    msg_ok "Merged duplicate service section in config.yml"
+  fi
+
   if check_for_gh_release "vikunja" "go-vikunja/vikunja"; then
     echo
     msg_warn "The package update may include config file changes."

install/blinko-install.sh

@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/blinkospace/blinko
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+NODE_VERSION="24" NODE_MODULE="bun" setup_nodejs
+PG_VERSION="17" setup_postgresql
+PG_DB_NAME="blinko" PG_DB_USER="blinko" setup_postgresql_db
+
+fetch_and_deploy_gh_release "blinko" "blinkospace/blinko" "tarball"
+
+msg_info "Building Blinko"
+cd /opt/blinko
+$STD bun install
+$STD bunx prisma generate
+$STD bun run build:web
+$STD bun run build:seed
+# The server resolves its web root as ../server/public and lute/vditor next to its own bundle
+mv dist/public server/public
+cp -r server/lute.min.js server/vditor dist/
+msg_ok "Built Blinko"
+
+msg_info "Configuring Blinko"
+mkdir -p /opt/blinko_data/storage
+# Blinko keeps uploads, the vector index and backups in .blinko under its working directory
+ln -s /opt/blinko_data/storage /opt/blinko/.blinko
+cat <<EOF >/opt/blinko_data/.env
+NODE_ENV=production
+DATABASE_URL=postgresql://blinko:${PG_DB_PASS}@localhost:5432/blinko
+TRUST_PROXY=1
+EOF
+chmod 600 /opt/blinko_data/.env
+msg_ok "Configured Blinko"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/blinko.service
+[Unit]
+Description=Blinko
+After=network.target postgresql.service
+Requires=postgresql.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/blinko
+EnvironmentFile=/opt/blinko_data/.env
+ExecStartPre=/opt/blinko/node_modules/.bin/prisma migrate deploy
+ExecStartPre=/usr/bin/node /opt/blinko/dist/seed.js
+ExecStart=/usr/bin/node /opt/blinko/dist/index.js
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now blinko
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/chartdb-install.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/chartdb/chartdb
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y nginx
+msg_ok "Installed Dependencies"
+
+NODE_VERSION="24" setup_nodejs
+fetch_and_deploy_gh_release "chartdb" "chartdb/chartdb" "tarball"
+
+msg_info "Building ChartDB"
+cd /opt/chartdb
+$STD npm ci
+NODE_OPTIONS="--max-old-space-size=4096" $STD npm run build
+rm -rf /opt/chartdb/node_modules
+msg_ok "Built ChartDB"
+
+msg_info "Configuring ChartDB"
+mkdir -p /opt/chartdb_data
+cat <<'EOF' >/opt/chartdb_data/config.js
+window.env = {
+    DISABLE_ANALYTICS: "true",
+    // OPENAI_API_KEY: "",
+    // OPENAI_API_ENDPOINT: "https://ollama.example.com/v1",
+    // LLM_MODEL_NAME: "qwen2.5-coder:7b",
+};
+EOF
+create_self_signed_cert "chartdb"
+# HTTPS because the AI export (crypto.subtle) and the copy buttons need a secure context
+cat <<'EOF' >/etc/nginx/sites-available/chartdb
+server {
+    listen 80 default_server;
+    server_name _;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl default_server;
+    http2 on;
+    server_name _;
+
+    ssl_certificate /etc/ssl/chartdb/chartdb.crt;
+    ssl_certificate_key /etc/ssl/chartdb/chartdb.key;
+
+    root /opt/chartdb/dist;
+    index index.html;
+
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+
+    location = /config.js {
+        alias /opt/chartdb_data/config.js;
+        add_header Cache-Control "no-cache";
+    }
+}
+EOF
+nginx_enable_site "chartdb"
+msg_ok "Configured ChartDB"
+
+motd_ssh
+customize
+cleanup_lxc

install/dawarich-install.sh

@@ -150,6 +150,12 @@ server {
     root /opt/dawarich/app/public;
     client_max_body_size 100M;
 
+    location ~ \.mjs\$ {
+        types { }
+        default_type text/javascript;
+        try_files \$uri @rails;
+    }
+
     location ~ ^/(assets|packs)/ {
         expires max;
         add_header Cache-Control "public, immutable";

install/karakeep-install.sh

@@ -24,7 +24,7 @@ $STD apt install -y \
   ffmpeg
 msg_ok "Installed Dependencies"
 
-fetch_and_deploy_gh_release "monolith" "Y2Z/monolith" "singlefile" "latest" "/usr/bin" "monolith-gnu-linux-$(arch_resolve "x86_64" "aarch64")"
+fetch_and_deploy_gh_release "monolith" "Y2Z/monolith" "singlefile" "latest" "/usr/bin" "monolith-cli-linux-$(arch_resolve "x86_64" "aarch64")"
 fetch_and_deploy_gh_release "yt-dlp" "yt-dlp/yt-dlp-nightly-builds" "singlefile" "latest" "/usr/bin" "yt-dlp_linux"
 fetch_and_deploy_gh_release "deno" "denoland/deno" "prebuild" "latest" "/usr/local/bin" "deno-$(uname -m)-unknown-linux-gnu.zip"
 setup_meilisearch

install/reconya-install.sh

@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Dyneteq/reconya
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+fetch_and_deploy_gh_release "reconya" "Dyneteq/reconya" "prebuild" "latest" "/opt/reconya" "reconya-linux-$(arch_resolve "amd64" "arm64").tar.gz"
+
+msg_info "Configuring Reconya"
+mkdir -p /opt/reconya_data
+cat <<EOF >/opt/reconya_data/.env
+PORT=3008
+LOGIN_USERNAME=admin
+LOGIN_PASSWORD=$(random_password)
+DATABASE_NAME=reconya
+SQLITE_PATH=/opt/reconya_data/reconya.db
+PUBLIC_IP_LOOKUP_ENABLED=false
+GEOLOCATION_ENABLED=false
+VENDOR_LOOKUP_ONLINE_ENABLED=false
+OUI_DOWNLOAD_ENABLED=false
+EOF
+chmod 600 /opt/reconya_data/.env
+msg_ok "Configured Reconya"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/reconya.service
+[Unit]
+Description=Reconya
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/reconya_data
+EnvironmentFile=/opt/reconya_data/.env
+ExecStart=/opt/reconya/reconya-linux-$(arch_resolve "amd64" "arm64")
+# Reconya ignores SIGTERM and only shuts down on SIGINT
+KillSignal=SIGINT
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now reconya
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/stirling-pdf-install.sh

@@ -92,7 +92,7 @@ msg_ok "Installed Language Packs"
 msg_info "Creating Environment Variables"
 cat <<EOF >/opt/Stirling-PDF/.env
 # Java tuning
-JAVA_BASE_OPTS="-XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=75 -XX:InitiatingHeapOccupancyPercent=20 -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70"
+JAVA_BASE_OPTS="-XX:+UnlockExperimentalVMOptions -XX:MaxRAMPercentage=50 -XX:InitiatingHeapOccupancyPercent=20 -XX:+G1PeriodicGCInvokesConcurrent -XX:G1PeriodicGCInterval=10000 -XX:+UseStringDeduplication -XX:G1PeriodicGCSystemLoadThreshold=70"
 JAVA_CUSTOM_OPTS=""
 
 # LibreOffice
@@ -135,7 +135,8 @@ msg_ok "Font Cache Updated"
 msg_info "Creating Service"
 # unoserver starts and supervises its own LibreOffice on UNO port 2002, so a separate
 # listener on that port only collides with it. Do not reintroduce one.
-cat <<EOF >/etc/systemd/system/stirlingpdf.service
+# MaxRAM: inside LXC the JVM sizes its heap from host RAM; /proc/meminfo (lxcfs) reports the CT limit
+cat <<'EOF' >/etc/systemd/system/stirlingpdf.service
 [Unit]
 Description=Stirling-PDF service
 After=syslog.target network.target unoserver.service
@@ -147,7 +148,7 @@ User=root
 Group=root
 EnvironmentFile=/opt/Stirling-PDF/.env
 WorkingDirectory=/opt/Stirling-PDF
-ExecStart=/usr/bin/java -jar Stirling-PDF.jar
+ExecStart=/bin/bash -c 'exec /usr/bin/java -XX:MaxRAM=$$(grep -m1 -o "[0-9][0-9]*" /proc/meminfo)k $$JAVA_BASE_OPTS $$JAVA_CUSTOM_OPTS -jar Stirling-PDF.jar'
 Restart=always
 RestartSec=10
 

install/victorialogs-install.sh

@@ -27,7 +27,7 @@ After=network.target
 Type=simple
 User=root
 WorkingDirectory=/opt/victorialogs
-ExecStart=/opt/victorialogs/victoria-logs-prod -storageDataPath=/opt/victorialogs_data -httpListenAddr=:9428
+ExecStart=/opt/victorialogs/victoria-logs-prod -storageDataPath=/opt/victorialogs_data -httpListenAddr=:9428 -syslog.listenAddr.tcp=:514 -syslog.listenAddr.udp=:514
 Restart=on-failure
 RestartSec=5
 

install/vikunja-install.sh

@@ -17,6 +17,7 @@ fetch_and_deploy_gh_release "vikunja" "go-vikunja/vikunja" "binary" "latest" ""
 
 msg_info "Setting up Vikunja"
 sed -i 's|^# \(service:\)|\1|' /etc/vikunja/config.yml
+sed -i '0,/^service:/!{/^service:/d}' /etc/vikunja/config.yml
 sed -i "s|^  # \(publicurl: \).*|  \1\"http://$LOCAL_IP\"|" /etc/vikunja/config.yml
 sed -i "0,/^  # \(timezone: \).*/s||  \1${tz}|" /etc/vikunja/config.yml
 systemctl enable -q --now vikunja