Update CHANGELOG.md (#18545)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

CHANGELOG.md

@@ -583,6 +583,30 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ## 2026-11-08
 
+### 🆕 New Scripts
+
+  - Chatto ([#18521](https://github.com/community-scripts/ProxmoxVE/pull/18521))
+- Firefox-Syncserver ([#18520](https://github.com/community-scripts/ProxmoxVE/pull/18520))
+
+### 🚀 Updated Scripts
+
+  - #### 🔧 Refactor
+
+    - Immich: do not clone libjxl's testdata [@MickLesk](https://github.com/MickLesk) ([#18539](https://github.com/community-scripts/ProxmoxVE/pull/18539))
+    - Databasus: build 3.65 and ship the verification agent [@MickLesk](https://github.com/MickLesk) ([#18500](https://github.com/community-scripts/ProxmoxVE/pull/18500))
+
+### 💾 Core
+
+  - fix: a closed console no longer ends a running setup | ERR trap fixes | check VM ID before creating [@MickLesk](https://github.com/MickLesk) ([core#219](https://github.com/community-scripts/core/pull/219))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - update-apps: keep the backup alive on a closed console, stop before restoring [@MickLesk](https://github.com/MickLesk) ([#18540](https://github.com/community-scripts/ProxmoxVE/pull/18540))
+    - clean-lxcs: run with sh and keep going when one container fails [@MickLesk](https://github.com/MickLesk) ([#18538](https://github.com/community-scripts/ProxmoxVE/pull/18538))
+    - update-lxcs: keep going when one container fails [@MickLesk](https://github.com/MickLesk) ([#18541](https://github.com/community-scripts/ProxmoxVE/pull/18541))
+
 ## 2026-11-07
 
 ### 🆕 New Scripts

ct/chatto.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/chattocorp/chatto
+
+APP="Chatto"
+var_tags="${var_tags:-chat;messaging}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/chatto ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "chatto" "chattocorp/chatto"; then
+    msg_info "Stopping Service"
+    systemctl stop chatto
+    msg_ok "Stopped Service"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "chatto" "chattocorp/chatto" "prebuild" "latest" "/opt/chatto" "chatto_Linux_$(arch_resolve x86_64 arm64).tar.gz"
+    chmod +x /opt/chatto/chatto
+
+    msg_info "Starting Service"
+    systemctl start chatto
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:4000${CL}"

ct/databasus.sh

@@ -38,57 +38,29 @@ function update_script() {
     $STD systemctl stop databasus
     msg_ok "Stopped Databasus"
 
-    create_backup /opt/databasus/.env
-
-    msg_info "Ensuring Database Clients"
-    # Create PostgreSQL version symlinks for compatibility
-    for v in 12 13 14 15 16 18; do
-      ln -sf /usr/lib/postgresql/17 /usr/lib/postgresql/$v
-    done
-    # Install MongoDB Database Tools via direct .deb (no APT repo for Debian 13)
-    if ! command -v mongodump &>/dev/null; then
-      [[ "$(get_os_info id)" == "ubuntu" ]] && MONGO_DIST="ubuntu2204" || MONGO_DIST="debian12"
-      MONGO_ARCH=$(arch_resolve "x86_64" "arm64")
-      # MongoDB only publishes arm64 builds for Ubuntu
-      [[ "$MONGO_ARCH" == "arm64" ]] && MONGO_DIST="ubuntu2204"
-      fetch_and_deploy_from_url "https://fastdl.mongodb.org/tools/db/mongodb-database-tools-${MONGO_DIST}-${MONGO_ARCH}-100.16.1.deb"
-    fi
-    ensure_dependencies mariadb-client
-    mkdir -p /usr/local/mariadb-{10.6,12.1}/bin /usr/local/mysql-{5.7,8.0,8.4,9}/bin /usr/local/mongodb-database-tools/bin
-    [[ -f /usr/bin/mongodump ]] && ln -sf /usr/bin/mongodump /usr/local/mongodb-database-tools/bin/mongodump
-    [[ -f /usr/bin/mongorestore ]] && ln -sf /usr/bin/mongorestore /usr/local/mongodb-database-tools/bin/mongorestore
-    # Create MariaDB and MySQL client symlinks for compatibility
-    for dir in /usr/local/mariadb-{10.6,12.1}/bin; do
-      ln -sf /usr/bin/mariadb-dump "$dir/mariadb-dump"
-      ln -sf /usr/bin/mariadb "$dir/mariadb"
-    done
-    for dir in /usr/local/mysql-{5.7,8.0,8.4,9}/bin; do
-      ln -sf /usr/bin/mariadb-dump "$dir/mysqldump"
-      ln -sf /usr/bin/mariadb "$dir/mysql"
-    done
-    msg_ok "Ensured Database Clients"
-
+    ensure_dependencies libedit2 libgssapi-krb5-2 libncurses6 libreadline8t64
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "databasus" "databasus/databasus" "tarball" "latest" "/opt/databasus"
     GO_VERSION="$(grep -m1 '^go ' /opt/databasus/backend/go.mod | awk '{print $2}')" setup_go
 
     msg_info "Updating Databasus"
+    RELEASE=$(cat ~/.databasus)
     export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
     cd /opt/databasus/frontend
-
     $STD corepack prepare pnpm@latest --activate
     $STD pnpm install --frozen-lockfile
-    $STD pnpm run build
+    $STD env VITE_APP_VERSION="${RELEASE}" pnpm run build
     cd /opt/databasus/backend
-    $STD go mod download
-    $STD /root/go/bin/swag init -g cmd/main.go -o swagger
-    $STD env CGO_ENABLED=0 GOOS=linux GOARCH=$(arch_resolve) go build -o databasus ./cmd
-    mv /opt/databasus/backend/databasus /opt/databasus/databasus
+    $STD env CGO_ENABLED=0 GOOS=linux GOARCH="$(arch_resolve)" go build -o /opt/databasus/databasus ./cmd/databasus
+    mkdir -p /opt/databasus/agent-binaries
+    for arch in amd64 arm64; do
+      $STD env CGO_ENABLED=0 GOOS=linux GOARCH=$arch go build -ldflags "-X main.Version=${RELEASE}" -o /opt/databasus/agent-binaries/databasus-verification-agent-linux-$arch ./cmd/verification-agent
+    done
     mkdir -p /opt/databasus/ui/build
     cp -r /opt/databasus/frontend/dist/* /opt/databasus/ui/build/
-    cp -r /opt/databasus/backend/migrations /opt/databasus/
+    sed -i '/^APP_VERSION=/d' /.env
+    echo "APP_VERSION=${RELEASE}" >>/.env
     msg_ok "Updated Databasus"
 
-    restore_backup
     chown -R postgres:postgres /opt/databasus
 
     if ! grep -q "EnvironmentFile=/.env" /etc/systemd/system/databasus.service; then

ct/firefox-syncserver.sh

@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/mozilla-services/syncstorage-rs
+
+APP="Firefox-Syncserver"
+var_tags="${var_tags:-sync;firefox}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-3072}"
+var_disk="${var_disk:-10}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+#var_arm64="${var_arm64:-yes}" # built from source, nothing x86-only, but not yet run on arm64
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /usr/local/bin/syncserver ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "firefox-syncserver" "mozilla-services/syncstorage-rs"; then
+    msg_info "Stopping Firefox Syncserver"
+    systemctl stop firefox-syncserver
+    msg_ok "Stopped Firefox Syncserver"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "firefox-syncserver" "mozilla-services/syncstorage-rs" "tarball"
+    setup_rust
+
+    msg_info "Building Firefox Syncserver (Patience)"
+    cd /opt/firefox-syncserver
+    $STD cargo build --release --locked --no-default-features --features=syncstorage-db/postgres --features=tokenserver-db/postgres --features=py_verifier
+    cp target/release/syncserver /usr/local/bin/syncserver
+    rm -rf target
+    $STD uv venv --python /usr/bin/python3 /opt/firefox-syncserver/.venv
+    $STD uv pip install --python /opt/firefox-syncserver/.venv/bin/python pyfxa tokenlib cryptography
+    msg_ok "Built Firefox Syncserver"
+
+    msg_info "Starting Firefox Syncserver"
+    systemctl start firefox-syncserver
+    msg_ok "Started Firefox Syncserver"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}In Firefox, set identity.sync.tokenserver.uri in about:config to:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:8000/1.0/sync/1.5${CL}"

ct/immich.sh

@@ -419,7 +419,7 @@ function compile_libjxl() {
     $STD git clone https://github.com/libjxl/libjxl.git "$SOURCE"
     cd "$SOURCE"
     $STD git reset --hard "$LIBJXL_REVISION"
-    $STD git submodule update --init --recursive --depth 1 --recommend-shallow
+    $STD git submodule update --init --recursive --depth 1 --recommend-shallow -- third_party
     mkdir build
     cd build
     $STD cmake \

install/chatto-install.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/chattocorp/chatto
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+fetch_and_deploy_gh_release "chatto" "chattocorp/chatto" "prebuild" "latest" "/opt/chatto" "chatto_Linux_$(arch_resolve x86_64 arm64).tar.gz"
+chmod +x /opt/chatto/chatto
+
+msg_info "Configuring Chatto"
+mkdir -p /opt/chatto_data
+cd /opt/chatto
+$STD ./chatto init
+mv /opt/chatto/chatto.toml /opt/chatto_data/chatto.toml
+sed -i \
+  -e "/^\[webserver\]/,/^\[/ s|^url = .*|url = 'http://${LOCAL_IP}:4000'|" \
+  -e "/^\[nats.embedded\]/,/^\[/ s|^data_dir = .*|data_dir = '/opt/chatto_data/data'|" \
+  -e '/^# \[operator_api\]$/,/^$/ { s|^# \[operator_api\]$|[operator_api]|; s|^# enabled = false$|enabled = true| }' \
+  /opt/chatto_data/chatto.toml
+msg_ok "Configured Chatto"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/chatto.service
+[Unit]
+Description=Chatto
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/chatto
+ExecStart=/opt/chatto/chatto run -c /opt/chatto_data/chatto.toml
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now chatto
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/databasus-install.sh

@@ -16,119 +16,47 @@ update_os
 msg_info "Installing Dependencies"
 $STD apt install -y \
   nginx \
-  valkey \
-  mariadb-client \
-  rclone
+  libedit2 \
+  libgssapi-krb5-2 \
+  libncurses6 \
+  libreadline8t64
 msg_ok "Installed Dependencies"
 
 PG_VERSION="17" setup_postgresql
 NODE_VERSION="24" NODE_MODULE="corepack" setup_nodejs
 
-msg_info "Installing Database Clients"
-# Create PostgreSQL version symlinks for compatibility
-for v in 12 13 14 15 16 18; do
-  ln -sf /usr/lib/postgresql/17 /usr/lib/postgresql/$v
-done
-# Install MongoDB Database Tools via direct .deb (no APT repo for Debian 13)
-[[ "$(get_os_info id)" == "ubuntu" ]] && MONGO_DIST="ubuntu2204" || MONGO_DIST="debian12"
-# MongoDB only publishes arm64 builds for Ubuntu
-[[ "$(arch_resolve "x86_64" "arm64")" == "arm64" ]] && MONGO_DIST="ubuntu2204"
-MONGO_VERSION=$(get_latest_gh_tag "mongodb/mongo-tools" "100." || echo "100.16.1")
-fetch_and_deploy_from_url "https://fastdl.mongodb.org/tools/db/mongodb-database-tools-${MONGO_DIST}-$(arch_resolve "x86_64" "arm64")-${MONGO_VERSION}.deb" ""
-mkdir -p /usr/local/mongodb-database-tools/bin
-[[ -f /usr/bin/mongodump ]] && ln -sf /usr/bin/mongodump /usr/local/mongodb-database-tools/bin/mongodump
-[[ -f /usr/bin/mongorestore ]] && ln -sf /usr/bin/mongorestore /usr/local/mongodb-database-tools/bin/mongorestore
-# Create MariaDB and MySQL client symlinks for compatibility
-mkdir -p /usr/local/mariadb-{10.6,12.1}/bin /usr/local/mysql-{5.7,8.0,8.4,9}/bin
-for dir in /usr/local/mariadb-{10.6,12.1}/bin; do
-  ln -sf /usr/bin/mariadb-dump "$dir/mariadb-dump"
-  ln -sf /usr/bin/mariadb "$dir/mariadb"
-done
-for dir in /usr/local/mysql-{5.7,8.0,8.4,9}/bin; do
-  ln -sf /usr/bin/mariadb-dump "$dir/mysqldump"
-  ln -sf /usr/bin/mariadb "$dir/mysql"
-done
-msg_ok "Installed Database Clients"
-
 fetch_and_deploy_gh_release "databasus" "databasus/databasus" "tarball" "latest" "/opt/databasus"
 GO_VERSION="$(grep -m1 '^go ' /opt/databasus/backend/go.mod | awk '{print $2}')" setup_go
 
 msg_info "Building Databasus (Patience)"
+RELEASE=$(cat ~/.databasus)
 export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
 cd /opt/databasus/frontend
-
 $STD corepack prepare pnpm@latest --activate
 $STD pnpm install --frozen-lockfile
-$STD pnpm run build
+$STD env VITE_APP_VERSION="${RELEASE}" pnpm run build
 cd /opt/databasus/backend
-$STD go mod tidy
-$STD go mod download
-$STD go install github.com/swaggo/swag/cmd/swag@latest
-$STD /root/go/bin/swag init -g cmd/main.go -o swagger
-$STD env CGO_ENABLED=0 GOOS=linux GOARCH=$(arch_resolve) go build -o databasus ./cmd
-mv /opt/databasus/backend/databasus /opt/databasus/databasus
+$STD env CGO_ENABLED=0 GOOS=linux GOARCH="$(arch_resolve)" go build -o /opt/databasus/databasus ./cmd/databasus
+mkdir -p /opt/databasus/agent-binaries
+for arch in amd64 arm64; do
+  $STD env CGO_ENABLED=0 GOOS=linux GOARCH=$arch go build -ldflags "-X main.Version=${RELEASE}" -o /opt/databasus/agent-binaries/databasus-verification-agent-linux-$arch ./cmd/verification-agent
+done
 mkdir -p /databasus-data/{pgdata,temp,backups,data,logs}
 mkdir -p /opt/databasus/ui/build
-mkdir -p /opt/databasus/migrations
 cp -r /opt/databasus/frontend/dist/* /opt/databasus/ui/build/
-cp -r /opt/databasus/backend/migrations/* /opt/databasus/migrations/
 chown -R postgres:postgres /databasus-data
 msg_ok "Built Databasus"
 
 msg_info "Configuring Databasus"
-JWT_SECRET=$(openssl rand -hex 32)
-ENCRYPTION_KEY=$(openssl rand -hex 32)
-# Install goose for migrations
-$STD go install github.com/pressly/goose/v3/cmd/goose@latest
-ln -sf /root/go/bin/goose /usr/local/bin/goose
 cat <<EOF >/.env
-# Environment
 ENV_MODE=production
-
-# Server
-SERVER_PORT=4005
-SERVER_HOST=0.0.0.0
-
-# Database
+APP_VERSION=${RELEASE}
 DATABASE_DSN=host=localhost user=postgres password=postgres dbname=databasus port=5432 sslmode=disable
-DATABASE_URL=postgres://postgres:postgres@localhost:5432/databasus?sslmode=disable
-
-# Migrations
-GOOSE_DRIVER=postgres
-GOOSE_DBSTRING=postgres://postgres:postgres@localhost:5432/databasus?sslmode=disable
-GOOSE_MIGRATION_DIR=/opt/databasus/migrations
-
-# Valkey (Redis-compatible cache)
-VALKEY_HOST=localhost
-VALKEY_PORT=6379
-
-# Security
-JWT_SECRET=${JWT_SECRET}
-ENCRYPTION_KEY=${ENCRYPTION_KEY}
-
-# Paths
-DATA_DIR=/databasus-data/data
-BACKUP_DIR=/databasus-data/backups
-LOG_DIR=/databasus-data/logs
 EOF
 chmod 600 /.env
 msg_ok "Configured Databasus"
 
-msg_info "Configuring Valkey"
-cat <<EOF >/etc/valkey/valkey.conf
-port 6379
-bind 127.0.0.1
-protected-mode yes
-save ""
-maxmemory 256mb
-maxmemory-policy allkeys-lru
-EOF
-systemctl enable -q --now valkey-server
-systemctl restart valkey-server
-msg_ok "Configured Valkey"
-
 msg_info "Creating Database"
-# Configure PostgreSQL to allow local password auth for databasus
 PG_HBA="/etc/postgresql/17/main/pg_hba.conf"
 if ! grep -q "databasus" "$PG_HBA"; then
   sed -i '/^local\s*all\s*all/i local   databasus   postgres                                trust' "$PG_HBA"
@@ -143,8 +71,8 @@ msg_info "Creating Databasus Service"
 cat <<EOF >/etc/systemd/system/databasus.service
 [Unit]
 Description=Databasus - Database Backup Management
-After=network.target postgresql.service valkey.service
-Requires=postgresql.service valkey.service
+After=network.target postgresql.service
+Requires=postgresql.service
 
 [Service]
 Type=simple

install/firefox-syncserver-install.sh

@@ -0,0 +1,99 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/mozilla-services/syncstorage-rs
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  build-essential \
+  pkg-config \
+  libssl-dev \
+  libpq-dev \
+  python3-dev
+msg_ok "Installed Dependencies"
+
+PG_VERSION="18" setup_postgresql
+PG_DB_NAME="syncserver" PG_DB_USER="syncserver" setup_postgresql_db
+setup_rust
+setup_uv
+
+fetch_and_deploy_gh_release "firefox-syncserver" "mozilla-services/syncstorage-rs" "tarball"
+
+msg_info "Building Firefox Syncserver (Patience)"
+cd /opt/firefox-syncserver
+$STD cargo build --release --locked --no-default-features --features=syncstorage-db/postgres --features=tokenserver-db/postgres --features=py_verifier
+cp target/release/syncserver /usr/local/bin/syncserver
+rm -rf target
+$STD uv venv --python /usr/bin/python3 /opt/firefox-syncserver/.venv
+$STD uv pip install --python /opt/firefox-syncserver/.venv/bin/python pyfxa tokenlib cryptography
+msg_ok "Built Firefox Syncserver"
+
+msg_info "Configuring Firefox Syncserver"
+mkdir -p /opt/firefox-syncserver_data
+cat <<EOF >/opt/firefox-syncserver_data/.env
+SYNC_HOST=0.0.0.0
+SYNC_PORT=8000
+SYNC_MASTER_SECRET=$(openssl rand -hex 32)
+SYNC_HUMAN_LOGS=true
+RUST_LOG=info
+SYNC_SYNCSTORAGE__DATABASE_URL=postgres://syncserver:${PG_DB_PASS}@127.0.0.1:5432/syncserver
+SYNC_SYNCSTORAGE__GLEAN_ENABLED=false
+SYNC_TOKENSERVER__ENABLED=true
+SYNC_TOKENSERVER__RUN_MIGRATIONS=true
+SYNC_TOKENSERVER__DATABASE_URL=postgres://syncserver:${PG_DB_PASS}@127.0.0.1:5432/syncserver
+SYNC_TOKENSERVER__NODE_TYPE=postgres
+SYNC_TOKENSERVER__FXA_EMAIL_DOMAIN=api.accounts.firefox.com
+SYNC_TOKENSERVER__FXA_OAUTH_SERVER_URL=https://oauth.accounts.firefox.com
+SYNC_TOKENSERVER__INIT_NODE_URL=http://${LOCAL_IP}:8000
+EOF
+chmod 600 /opt/firefox-syncserver_data/.env
+cat <<'EOF' >/opt/firefox-syncserver_data/nodes.sql
+SELECT to_regclass('nodes') IS NOT NULL AS ready \gset
+\if :ready
+UPDATE nodes SET node = :'url'
+ WHERE id = (SELECT min(id) FROM nodes)
+   AND NOT EXISTS (SELECT 1 FROM nodes WHERE node = :'url');
+UPDATE users SET nodeid = (SELECT id FROM nodes WHERE node = :'url')
+ WHERE nodeid <> (SELECT id FROM nodes WHERE node = :'url');
+DELETE FROM nodes WHERE node <> :'url';
+\endif
+EOF
+msg_ok "Configured Firefox Syncserver"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/firefox-syncserver.service
+[Unit]
+Description=Firefox Syncserver
+After=network.target postgresql.service
+Wants=postgresql.service
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/firefox-syncserver
+EnvironmentFile=/opt/firefox-syncserver_data/.env
+Environment=PYTHONPATH=/opt/firefox-syncserver/.venv/lib/python3.13/site-packages
+ExecStartPre=/usr/bin/psql -1 -q -v ON_ERROR_STOP=1 -v url=\${SYNC_TOKENSERVER__INIT_NODE_URL} -f /opt/firefox-syncserver_data/nodes.sql \${SYNC_TOKENSERVER__DATABASE_URL}
+ExecStart=/usr/local/bin/syncserver
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now firefox-syncserver
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/immich-install.sh

@@ -222,7 +222,7 @@ LIBJXL_REVISION="$(jq -cr '.revision' "$BASE_DIR"/server/sources/libjxl.json)"
 $STD git clone https://github.com/libjxl/libjxl.git "$SOURCE"
 cd "$SOURCE"
 $STD git reset --hard "$LIBJXL_REVISION"
-$STD git submodule update --init --recursive --depth 1 --recommend-shallow
+$STD git submodule update --init --recursive --depth 1 --recommend-shallow -- third_party
 mkdir build
 cd build
 $STD cmake \

tools/pve/clean-lxcs.sh

@@ -54,35 +54,35 @@ function run_lxc_clean() {
   header_info
   name=$(pct exec "$container" -- hostname)
 
-  pct exec "$container" -- bash -c '
+  pct exec "$container" -- sh -c '
     BL="\033[36m"; GN="\033[1;92m"; CL="\033[m"
     name=$(hostname)
     if [ -e /etc/alpine-release ]; then
-      echo -e "${BL}[Info]${GN} Cleaning $name (Alpine)${CL}\n"
+      printf "%b\n\n" "${BL}[Info]${GN} Cleaning $name (Alpine)${CL}"
       apk cache clean
       find /var/log -type f -delete 2>/dev/null
       find /tmp -mindepth 1 -delete 2>/dev/null
       apk update
     elif [ -e /etc/redhat-release ]; then
-      echo -e "${BL}[Info]${GN} Cleaning $name (CentOS)${CL}\n"
+      printf "%b\n\n" "${BL}[Info]${GN} Cleaning $name (CentOS)${CL}"
       yum clean all
       find /var/log -type f -delete 2>/dev/null
       find /tmp -mindepth 1 -delete 2>/dev/null
       yum update
       yum upgrade -y
     else
-      echo -e "${BL}[Info]${GN} Cleaning $name (Debian/Ubuntu)${CL}\n"
+      printf "%b\n\n" "${BL}[Info]${GN} Cleaning $name (Debian/Ubuntu)${CL}"
       find /var/cache -type f -delete 2>/dev/null
       find /var/log -type f -delete 2>/dev/null
       find /tmp -mindepth 1 -delete 2>/dev/null
       apt -y --purge autoremove
       apt -y autoclean
-      rm -rf /var/lib/apt/lists/*
       apt update
     fi
   '
 }
 
+failed_containers=()
 for container in $(pct list | awk '{if(NR>1) print $1}'); do
   excluded=0
   for ex in $excluded_containers; do
@@ -112,17 +112,25 @@ for container in $(pct list | awk '{if(NR>1) print $1}'); do
 
   if [ "$template" == "false" ] && [ "$status" == "status: stopped" ]; then
     echo -e "${BL}[Info]${GN} Starting${BL} $container ${CL} \n"
-    pct start "$container"
+    if ! pct start "$container"; then
+      failed_containers+=("$container (start)")
+      continue
+    fi
     echo -e "${BL}[Info]${GN} Waiting For${BL} $container${CL}${GN} To Start ${CL} \n"
     sleep 5
-    run_lxc_clean "$container"
+    run_lxc_clean "$container" || failed_containers+=("$container")
     echo -e "${BL}[Info]${GN} Shutting down${BL} $container ${CL} \n"
     pct shutdown "$container" &
   elif [ "$status" == "status: running" ]; then
-    run_lxc_clean "$container"
+    run_lxc_clean "$container" || failed_containers+=("$container")
   fi
 done
 
 wait
 header_info
+if [ "${#failed_containers[@]}" -gt 0 ]; then
+  echo -e "${RD}Cleaning failed in these containers:${CL}"
+  printf '%s\n' "${failed_containers[@]}"
+  exit 1
+fi
 echo -e "${GN} Finished, Selected Containers Cleaned. ${CL} \n"

tools/pve/update-apps.sh

@@ -282,7 +282,7 @@ function failure_reason() {
 function backup_container() {
   msg_info "Creating backup for container $1"
   local output
-  if output=$(vzdump $1 --compress zstd --storage $STORAGE_CHOICE -notes-template "{{guestname}} - community-scripts backup updater" 2>&1); then
+  if output=$(_cs_shield_hangup vzdump $1 --compress zstd --storage $STORAGE_CHOICE -notes-template "{{guestname}} - community-scripts backup updater" 2>&1); then
     msg_ok "Backup created"
   else
     log_write "Container $1: vzdump failed:"$'\n'"$output"
@@ -651,7 +651,18 @@ for container in $CHOICE; do
     msg_error "Update failed for container $container ($service, exit code: $exit_code) — attempting restore"
     log_write "Container $container ($service): FAILED (exit $exit_code) — attempting restore"
     msg_info "Restoring LXC $container from backup ($STORAGE_CHOICE)"
-    pct stop $container
+    wait
+    pct stop $container &>/dev/null || true
+    for _ in {1..30}; do
+      [[ "$(pct status $container 2>/dev/null)" == "status: stopped" ]] && break
+      sleep 1
+    done
+    if [[ "$(pct status $container 2>/dev/null)" != "status: stopped" ]]; then
+      msg_error "Container $container did not stop, so it cannot be restored"
+      log_result "$container" "$service" "FAILED" "Update failed (exit $exit_code) — container did not stop for the restore"
+      log_write "Container $container ($service): FAILED — container did not stop for the restore"
+      exit 235
+    fi
     LXC_STORAGE=$(pct config $container | awk -F '[:,]' '/rootfs/ {print $2}')
     BACKUP_ENTRY=$(pvesm list "$STORAGE_CHOICE" 2>/dev/null | awk -v ctid="$container" '$1 ~ "vzdump-lxc-"ctid"-" || $1 ~ "/ct/"ctid"/" {print $1}' | sort -r | head -n1)
     if [ -z "$BACKUP_ENTRY" ]; then

tools/pve/update-lxcs.sh

@@ -84,6 +84,7 @@ function update_container() {
 }
 
 containers_needing_reboot=()
+failed_containers=()
 header_info
 for container in $(pct list | awk '{if(NR>1) print $1}'); do
   if [[ " ${excluded_containers[@]} " =~ " $container " ]]; then
@@ -101,14 +102,17 @@ for container in $(pct list | awk '{if(NR>1) print $1}'); do
     template=$(pct config $container | grep -q "template:" && echo "true" || echo "false")
     if [ "$template" == "false" ] && [ "$status" == "status: stopped" ]; then
       echo -e "${BL}[Info]${GN} Starting${BL} $container ${CL} \n"
-      pct start $container
+      if ! pct start $container; then
+        failed_containers+=("$container (start)")
+        continue
+      fi
       echo -e "${BL}[Info]${GN} Waiting For${BL} $container${CL}${GN} To Start ${CL} \n"
       sleep 5
-      update_container $container
+      update_container $container || failed_containers+=("$container")
       echo -e "${BL}[Info]${GN} Shutting down${BL} $container ${CL} \n"
       pct shutdown $container &
     elif [ "$status" == "status: running" ]; then
-      update_container $container
+      update_container $container || failed_containers+=("$container")
     fi
     if [ "$status" == "status: running" ]; then
       if pct exec "$container" -- [ -e "/var/run/reboot-required" ]; then
@@ -119,14 +123,20 @@ for container in $(pct list | awk '{if(NR>1) print $1}'); do
       # check if patchmon agent is present in container and run a report if found
       if pct exec "$container" -- [ -e "/usr/local/bin/patchmon-agent" ]; then
         echo -e "${BL}[Info]${GN} patchmon-agent found in ${BL} $container ${CL}, triggering report. \n"
-        pct exec "$container" -- "/usr/local/bin/patchmon-agent" "report"
+        pct exec "$container" -- "/usr/local/bin/patchmon-agent" "report" || echo -e "${YW}[Warn]${CL} patchmon-agent report failed in $container\n"
       fi
     fi
   fi
 done
 wait
 header_info
-echo -e "${GN}The process is complete, and the containers have been successfully updated.${CL}\n"
+if [ "${#failed_containers[@]}" -gt 0 ]; then
+  echo -e "${RD}The update failed in these containers:${CL}"
+  printf '%s\n' "${failed_containers[@]}"
+  echo ""
+else
+  echo -e "${GN}The process is complete, and the containers have been successfully updated.${CL}\n"
+fi
 if [ "${#containers_needing_reboot[@]}" -gt 0 ]; then
   echo -e "${RD}The following containers require a reboot:${CL}"
   for container_name in "${containers_needing_reboot[@]}"; do
@@ -134,3 +144,4 @@ if [ "${#containers_needing_reboot[@]}" -gt 0 ]; then
   done
 fi
 echo ""
+[ "${#failed_containers[@]}" -eq 0 ] || exit 1