Update CHANGELOG.md

* fix(pocketbase): install and update from the new host

PocketBase moved from GitHub to ganigeorgiev.com in October 2026; the GitHub repo is archived at v0.40.6 and gets no new releases. Install and update now read the latest stable tag from the new release API and download the zip from its fixed download path. The update no longer runs pocketbase update, which older binaries point at GitHub.

* fix(pocketbase): query the release API with curl_with_retry

.github/workflows/pr-script-test.yml

@@ -0,0 +1,680 @@
+name: PR script test
+
+# Builds the ct/ and vm/ scripts a pull request touches on real Proxmox and Incus hosts and
+# reports the outcome on the PR, as a check run and as one comment kept up to
+# date.
+#
+# A self-hosted runner that executes pull request code as root is only
+# acceptable if a human decides what runs on it. So it starts on a push only
+# for trusted PRs: those the push-app-to-main app opens on a branch of this
+# repository when a script moves over from DevScripts (already reviewed and
+# tested there; only writers can push to such a branch). Those are built
+# automatically and approved when every script passes. Everything else waits
+# for someone with write access to comment `/test` (optionally followed by a
+# full SHA to pin, and the ct/ paths to build). Only a commit that existed when
+# the comment was written gets built: a push after it is never covered, not
+# even one that lands in the seconds before this job runs.
+#
+#   gate    ubuntu-latest   who asked, which scripts, which commit
+#   test    proxmox-test /  build + checks, one matrix job per script, platform
+#           incus-test      (pve or incus) and OS
+#   report  ubuntu-latest   check run + PR comment
+#
+# The test job gets a read-only token and never sees a secret: the host it runs
+# on executes untrusted code and has to be treated as compromised.
+#
+# This file is identical in DevScripts and ProxmoxVE; github.repository decides
+# which URLs get rewritten and which container ID range is used.
+
+on:
+  issue_comment:
+    types: [created]
+  # Trusted PRs only, see above. pull_request_target runs this file from main,
+  # never the PR's copy of it.
+  pull_request_target:
+    types: [opened, reopened, synchronize, ready_for_review]
+    paths:
+      - "ct/**"
+      - "install/**"
+  workflow_dispatch:
+    inputs:
+      pr:
+        description: "Pull request number"
+        required: true
+        type: number
+      sha:
+        description: "Pin a commit (full 40-character SHA); empty = the latest, if nothing was pushed since"
+        required: false
+        type: string
+      scripts:
+        description: "Space-separated ct/ or vm/ paths (empty = everything the PR touches)"
+        required: false
+        type: string
+
+permissions: {}
+
+jobs:
+  gate:
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'issue_comment' && startsWith(github.event.comment.body, '/test')) ||
+      (github.event_name == 'pull_request_target' && !github.event.pull_request.draft &&
+       github.event.pull_request.user.login == 'push-app-to-main[bot]' &&
+       github.event.pull_request.head.repo.full_name == github.repository)
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read # when the run was dispatched, for a /test without SHA
+      checks: write
+      contents: read
+      issues: write
+      pull-requests: write
+    outputs:
+      matrix: ${{ steps.plan.outputs.matrix }}
+      pr: ${{ steps.plan.outputs.pr }}
+      repo: ${{ steps.plan.outputs.repo }}
+      sha: ${{ steps.plan.outputs.sha }}
+      check_id: ${{ steps.plan.outputs.check_id }}
+      actor: ${{ steps.plan.outputs.actor }}
+      not_built: ${{ steps.plan.outputs.not_built }}
+      trusted: ${{ steps.plan.outputs.trusted }}
+      kind: ${{ steps.plan.outputs.kind }}
+    steps:
+      - id: plan
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const { owner, repo } = context.repo;
+            const MAX = 10;
+            core.setOutput('matrix', '[]');
+
+            // Trusted: a PR the push-app-to-main app opened on a branch of this
+            // repository, i.e. a script moving over from DevScripts.
+            const TRUSTED_AUTHOR = 'push-app-to-main[bot]';
+            const isTrusted = p => !!p && p.user && p.user.login === TRUSTED_AUTHOR && p.user.type === 'Bot' &&
+              !!p.head.repo && p.head.repo.full_name === `${owner}/${repo}`;
+
+            let prNumber, requested = '';
+            if (context.eventName === 'pull_request_target') {
+              const p = context.payload.pull_request;
+              if (!isTrusted(p)) return;
+              prNumber = p.number;
+              // Exactly the pushed commit; a later push starts its own run.
+              requested = p.head.sha;
+            } else if (context.eventName === 'workflow_dispatch') {
+              prNumber = Number(context.payload.inputs.pr);
+              requested = `${context.payload.inputs.sha || ''} ${context.payload.inputs.scripts || ''}`;
+            } else {
+              prNumber = context.payload.issue.number;
+              const body = context.payload.comment.body.trim();
+              if (!/^\/test(\s|$)/.test(body)) return;
+              // author_association hides private org members, so ask for the permission itself.
+              const user = context.payload.comment.user.login;
+              const { data: perm } = await github.rest.repos.getCollaboratorPermissionLevel({ owner, repo, username: user });
+              if (!['admin', 'maintain', 'write'].includes(perm.permission)) {
+                core.notice(`${user} has ${perm.permission} access; /test needs write`);
+                return;
+              }
+              await github.rest.reactions.createForIssueComment({
+                owner, repo, comment_id: context.payload.comment.id, content: 'rocket',
+              });
+              requested = body.split('\n')[0].slice('/test'.length);
+            }
+
+            // `/test <app>` in an issue (not a PR) builds that app from the
+            // default branch as it is right now, e.g. to see whether a reported
+            // error reproduces. No PR, so no check run, no review, no approval.
+            const isIssue = context.eventName === 'issue_comment' && !context.payload.issue.pull_request;
+            let pr = null, head, headSha;
+            if (isIssue) {
+              const { data: info } = await github.rest.repos.get({ owner, repo });
+              const { data: branch } = await github.rest.repos.getBranch({ owner, repo, branch: info.default_branch });
+              headSha = branch.commit.sha;
+              head = { owner: { login: owner }, name: repo, full_name: `${owner}/${repo}` };
+            } else {
+              ({ data: pr } = await github.rest.pulls.get({ owner, repo, pull_number: prNumber }));
+              if (pr.state !== 'open' || !pr.head.repo) { core.notice('PR is closed or its fork is gone'); return; }
+              head = pr.head.repo;
+              headSha = pr.head.sha;
+              if (context.eventName === 'pull_request_target' && headSha !== requested) {
+                core.notice('Pushed to again since; the newer push has its own run');
+                return;
+              }
+            }
+            core.setOutput('kind', isIssue ? 'issue' : 'pr');
+            core.setOutput('trusted', !isIssue && isTrusted(pr) ? 'true' : 'false');
+            const MARK = '<!-- pr-script-test -->';
+            const sticky = async body => {
+              const comments = await github.paginate(github.rest.issues.listComments, { owner, repo, issue_number: prNumber });
+              // Only our own comment: anyone can paste the marker into theirs.
+              const mine = comments.find(c => c.body.includes(MARK) && c.user.type === 'Bot');
+              if (mine) await github.rest.issues.updateComment({ owner, repo, comment_id: mine.id, body });
+              else await github.rest.issues.createComment({ owner, repo, issue_number: prNumber, body });
+            };
+
+            // Which commit the approval covers. Reading pr.head.sha alone would
+            // build whatever was pushed between the comment and this job
+            // starting, i.e. code nobody looked at. Two ways to be sure:
+            //
+            //   /test <sha>  that exact commit, and only while it is the head. A
+            //                full SHA: the author writes both commits, so a short
+            //                prefix is a quick birthday collision away.
+            //   /test        the latest commit, if nothing reached the fork after
+            //                the comment. pushed_at is set by GitHub on every push
+            //                and read after the PR, so a push in between shows up.
+            //                Branches of this repository belong to people with
+            //                write access, who could build anything anyway.
+            const tokens = requested.split(/\s+/).filter(Boolean);
+            const isSha = t => /^[0-9a-f]{7,40}$/.test(t);
+            const approved = isIssue ? [] : tokens.filter(isSha);
+            let entries = isIssue ? [] : tokens.filter(t => !isSha(t));
+            const refuse = async (why, retry) => {
+              await sticky([MARK, '### Proxmox script test', '', `⚠️ ${why} Nothing was built.`, '', retry].join('\n'));
+              core.notice(why);
+            };
+            if (isIssue) {
+              // App names (bark-server) or ct/ and vm/ paths; the default branch
+              // is trusted. A name without a ct/ script falls back to vm/ below.
+              entries = tokens.map(t => /^(ct|vm)\/[A-Za-z0-9._-]+\.sh$/.test(t) ? t
+                : /^[A-Za-z0-9._-]+$/.test(t) ? `ct/${t.replace(/\.sh$/, '')}.sh` : t);
+              if (entries.length === 0) {
+                await refuse('In an issue, `/test` needs to know which app.', 'Comment `/test <app>`, for example `/test bark-server` (the name of its `ct/` script).');
+                return;
+              }
+            } else if (approved.length > 1) {
+              await refuse('`/test` takes at most one commit.', 'Comment `/test` to build the latest commit.');
+              return;
+            }
+            if (approved.length === 1 && approved[0] !== headSha) {
+              await refuse(
+                approved[0].length !== 40 && headSha.startsWith(approved[0])
+                  ? 'A short SHA is not enough, it has to be all 40 characters.'
+                  : `\`${approved[0]}\` is not the head of this PR (any more).`,
+                'Comment `/test` to build the latest commit.');
+              return;
+            }
+            if (!isIssue && approved.length === 0 && head.full_name !== `${owner}/${repo}`) {
+              const askedAt = context.eventName === 'workflow_dispatch'
+                ? (await github.rest.actions.getWorkflowRun({ owner, repo, run_id: context.runId })).data.created_at
+                : context.payload.comment.created_at;
+              const { data: fork } = await github.rest.repos.get({ owner: head.owner.login, repo: head.name });
+              if (new Date(fork.pushed_at) >= new Date(askedAt)) {
+                await refuse(
+                  `Something was pushed to ${head.full_name} after the \`/test\`, so it is not certain which commit was meant.`,
+                  'Comment `/test` again once you have looked at the latest commit.');
+                return;
+              }
+            }
+            if (entries.some(e => !/^(ct|vm)\/[A-Za-z0-9._-]+\.sh$/.test(e))) {
+              await refuse(
+                isIssue ? 'Only app names (as in `ct/<app>.sh` or `vm/<name>.sh`) can be tested.' : 'Only `ct/<name>.sh` and `vm/<name>.sh` paths can be requested.',
+                isIssue ? 'For example: `/test bark-server` or `/test debian-vm`' : 'For example: `/test ct/bark-server.sh`, or just `/test`.');
+              return;
+            }
+            // Everything the PR changes that this test cannot build is named in
+            // the comment, so a /test never ends in silence.
+            const notBuilt = [];
+            const code = s => '`' + String(s).replace(/[`\r\n]/g, '') + '`';
+            if (entries.length === 0) {
+              const files = await github.paginate(github.rest.pulls.listFiles, { owner, repo, pull_number: prNumber });
+              const set = new Set();
+              for (const f of files) {
+                if (f.status === 'removed') continue;
+                let m;
+                if ((m = f.filename.match(/^install\/([A-Za-z0-9._-]+)-install\.sh$/))) set.add(`ct/${m[1]}.sh`);
+                else if (/^(ct|vm)\/[A-Za-z0-9._-]+\.sh$/.test(f.filename)) set.add(f.filename);
+                else if (/^(tools|turnkey)\/.*\.sh$/.test(f.filename)) notBuilt.push(`${code(f.filename)}: only \`ct/\` and \`vm/\` scripts are built`);
+              }
+              entries = [...set].sort();
+            }
+
+            const include = [];
+            const fetchScript = async p => {
+              try {
+                const res = await github.rest.repos.getContent({ owner: head.owner.login, repo: head.name, path: p, ref: headSha });
+                return Buffer.from(res.data.content || '', 'base64').toString('utf8');
+              } catch (e) { return null; }
+            };
+            for (let script of entries.slice(0, MAX)) {
+              let text = await fetchScript(script);
+              // /test debian-vm in an issue: there is no ct/debian-vm.sh, but a vm/ one.
+              if (text === null && isIssue && script.startsWith('ct/')) {
+                const vm = `vm/${script.slice(3)}`;
+                if ((text = await fetchScript(vm)) !== null) script = vm;
+              }
+              if (text === null) {
+                notBuilt.push(isIssue
+                  ? (script.startsWith('ct/') ? `${code(script.slice(3, -3))}: neither \`ct/\` nor \`vm/\` has it on the default branch` : `${code(script)} does not exist on the default branch`)
+                  : `\`${script}\` does not exist in this PR (an \`install/\` script is built through the \`ct/\` script of the same name)`);
+                continue;
+              }
+              const isVm = script.startsWith('vm/');
+              // The test hosts are amd64; an ARM-only VM script refuses to run there.
+              if (isVm && /^\s*vm_require_arch\s+arm64\b/m.test(text)) {
+                notBuilt.push(`${code(script)}: ARM64 only, the test hosts are amd64`);
+                continue;
+              }
+              // Scripts that ask for the OS get built once per OS.
+              const oses = !isVm && /msg_menu\s+"Choose the container OS"/.test(text) ? ['debian', 'alpine'] : [''];
+              const name = isVm ? `vm-${script.slice(3, -3)}` : script.slice(3, -3);
+              // Every ct/ script on every platform: the same files run on Proxmox
+              // and, through community-scripts/core's Incus backend, on Incus.
+              // VMs are Proxmox only.
+              const platforms = isVm ? ['pve'] : ['pve', 'incus'];
+              for (const platform of platforms) {
+                for (const os of oses) include.push({ script, os, platform, name: `${os ? `${name}-${os}` : name}-${platform}` });
+              }
+            }
+            for (const script of entries.slice(MAX)) notBuilt.push(`\`${script}\`: at most ${MAX} scripts per run, name it with \`/test ${script}\``);
+            if (include.length === 0) {
+              await sticky([
+                MARK, '### Proxmox script test', '',
+                isIssue
+                  ? 'ℹ️ Nothing to build:'
+                  : 'ℹ️ Nothing to build: this test builds `ct/` and `vm/` scripts (and changed `install/` scripts through their `ct/` script).', '',
+                ...(notBuilt.length ? notBuilt.map(n => `- ${n}`) : ['- this PR changes no `ct/`, `vm/` or `install/` script']),
+              ].join('\n'));
+              core.notice('No ct/ or vm/ script to build');
+              return;
+            }
+
+            const runUrl = `${context.serverUrl}/${owner}/${repo}/actions/runs/${context.runId}`;
+            // A check run belongs to a PR's commit; an issue has none.
+            let checkId = '';
+            if (!isIssue) {
+              const { data: check } = await github.rest.checks.create({
+                owner, repo, name: 'Proxmox script test', head_sha: headSha, status: 'in_progress',
+                details_url: runUrl,
+                output: { title: `Building ${include.length}`, summary: include.map(i => `- \`${i.script}\` ${[i.platform, i.os].filter(Boolean).join(' · ')}`).join('\n') },
+              });
+              checkId = String(check.id);
+            }
+
+            core.setOutput('matrix', JSON.stringify(include));
+            core.setOutput('pr', String(prNumber));
+            core.setOutput('repo', head.full_name);
+            core.setOutput('sha', headSha);
+            core.setOutput('check_id', checkId);
+            core.setOutput('not_built', JSON.stringify(notBuilt));
+            // Who asked: the /test commenter, or whoever dispatched the run.
+            core.setOutput('actor', context.actor);
+
+            await sticky([
+              MARK, '### Proxmox script test', '',
+              `⏳ Building ${include.length} at ${headSha.slice(0, 7)}${isIssue ? ' (default branch)' : ''} — [watch it live](${runUrl}) (open the \`test\` job)`, '',
+              ...include.map(i => `- \`${i.script}\` (${[i.platform, i.os].filter(Boolean).join(' · ')})`),
+              ...(notBuilt.length ? ['', '**Not built:**', ...notBuilt.map(n => `- ${n}`)] : []),
+            ].join('\n'));
+
+  test:
+    needs: gate
+    if: needs.gate.outputs.matrix != '[]' && needs.gate.outputs.matrix != ''
+    # Only `proxmox-test`, never `self-hosted`: the runner is registered without
+    # default labels so that no other workflow can be scheduled onto it.
+    runs-on: ${{ matrix.platform == 'incus' && 'incus-test' || 'proxmox-test' }}
+    permissions:
+      contents: read
+    timeout-minutes: 90 # install (45) + update (30) + checks
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJSON(needs.gate.outputs.matrix) }}
+    name: test (${{ matrix.name }})
+    steps:
+      # The default branch, never the PR: the harness itself must be trusted.
+      - uses: actions/checkout@v5
+        with:
+          sparse-checkout: .github/workflows/scripts
+          persist-credentials: false
+
+      - name: Build and check ${{ matrix.script }}
+        env:
+          PR_REPO: ${{ needs.gate.outputs.repo }}
+          PR_SHA: ${{ needs.gate.outputs.sha }}
+          SCRIPT: ${{ matrix.script }}
+          OS: ${{ matrix.os }}
+          PLATFORM: ${{ matrix.platform }}
+          UPSTREAM: ${{ github.repository }}
+          CTID_BASE: ${{ github.repository == 'community-scripts/ProxmoxVE' && '9050' || '9000' }}
+          # Only so release lookups are not rate limited: unauthenticated, all
+          # test containers share the lab's one public IP and 60 calls an hour.
+          # This job's token can read public contents and expires with the job.
+          GH_API_TOKEN: ${{ github.token }}
+          OUT_DIR: ${{ runner.temp }}/result
+        run: bash .github/workflows/scripts/pve-run-script.sh
+
+      - if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: result-${{ matrix.name }}
+          path: ${{ runner.temp }}/result
+          if-no-files-found: ignore
+          retention-days: 14
+
+  report:
+    needs: [gate, test]
+    if: always() && needs.gate.result == 'success' && needs.gate.outputs.matrix != '[]' && needs.gate.outputs.matrix != ''
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      checks: write
+      contents: write # the ci-screenshots branch only; main is protected
+      issues: write
+      pull-requests: write
+    steps:
+      - uses: actions/download-artifact@v5
+        with:
+          pattern: result-*
+          path: results
+
+      - uses: actions/github-script@v8
+        env:
+          MATRIX: ${{ needs.gate.outputs.matrix }}
+          PR: ${{ needs.gate.outputs.pr }}
+          SHA: ${{ needs.gate.outputs.sha }}
+          CHECK_ID: ${{ needs.gate.outputs.check_id }}
+          TEST_RESULT: ${{ needs.test.result }}
+          ACTOR: ${{ needs.gate.outputs.actor }}
+          NOT_BUILT: ${{ needs.gate.outputs.not_built }}
+          TRUSTED: ${{ needs.gate.outputs.trusted }}
+          KIND: ${{ needs.gate.outputs.kind }}
+        with:
+          script: |
+            const fs = require('fs');
+            const { owner, repo } = context.repo;
+            const runUrl = `${context.serverUrl}/${owner}/${repo}/actions/runs/${context.runId}`;
+            const matrix = JSON.parse(process.env.MATRIX);
+
+            // download-artifact unpacks a single artifact straight into results/
+            // and several into results/<name>/, so look for every result.json
+            // and match it by what it says it is.
+            const path = require('path');
+            const found = new Map();
+            const walk = dir => {
+              if (!fs.existsSync(dir)) return;
+              for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+                const p = path.join(dir, e.name);
+                if (e.isDirectory()) walk(p);
+                else if (e.name === 'result.json') {
+                  try {
+                    const r = JSON.parse(fs.readFileSync(p, 'utf8'));
+                    // Written on the host that ran the PR's code: anything but a
+                    // known status is an error, never something new.
+                    if (!['pass', 'fail', 'unsupported', 'error'].includes(r.status)) r.status = 'error';
+                    const log = path.join(dir, 'install.log');
+                    r.install_log = fs.existsSync(log) ? fs.readFileSync(log, 'utf8') : '';
+                    const shot = path.join(dir, 'screenshot.png');
+                    r.shot_file = fs.existsSync(shot) ? shot : '';
+                    if (!['updated', 'no-update', 'fail', 'error', ''].includes(r.update_status || '')) r.update_status = '';
+                    // Installed fine, but the update could not be tested (e.g. a
+                    // GitHub rate limit): not a pass, and not the PR's fault.
+                    if (r.status === 'pass' && r.update_status === 'error') { r.status = 'error'; r.step = `update ${r.update_step}`; }
+                    const ulog = path.join(dir, 'update.log');
+                    r.update_log = fs.existsSync(ulog) ? fs.readFileSync(ulog, 'utf8') : '';
+                    const ushot = path.join(dir, 'screenshot-update.png');
+                    r.shot_update_file = fs.existsSync(ushot) ? ushot : '';
+                    // Only the two platforms this workflow knows; an unknown one would
+                    // never match a matrix row anyway.
+                    if (!['pve', 'incus'].includes(r.platform)) r.platform = 'pve';
+                    found.set(`${r.script}|${r.platform}|${r.os}`, r);
+                  } catch (err) { core.warning(`unreadable ${p}: ${err.message}`); }
+                }
+              }
+            };
+            walk('results');
+
+            // A job that died before writing result.json still gets a row.
+            const rows = matrix.map(m => ({ ...(found.get(`${m.script}|${m.platform || 'pve'}|${m.os || 'default'}`) || {
+              script: m.script, os: m.os || 'default', platform: m.platform || 'pve',
+              status: process.env.TEST_RESULT === 'cancelled' ? 'cancelled' : 'error',
+              step: 'no result (runner or job failure)', duration: 0, log_tail: '', install_log: '', shot_file: '',
+              update_status: '', update_log: '', shot_update_file: '',
+            }), name: m.name }));
+            // Where a row ran: "pve", "incus · alpine", or "VM" (Proxmox only).
+            const isVm = r => r.script.startsWith('vm/');
+            const where = r => isVm(r) ? 'VM' : r.os && r.os !== 'default' ? `${r.platform} · ${r.os}` : r.platform;
+
+            // Screenshots go to an orphan branch, because a comment can only show
+            // an image that has a URL. One file per PR and script, overwritten on
+            // every run; the link names the commit, so no cache shows an old one.
+            // The PNG comes from the host that ran the PR's code: check it again.
+            const BRANCH = 'ci-screenshots';
+            const prNum = Number(process.env.PR);
+            const isPng = buf => buf.length > 8 && buf.length < 3000000 &&
+              buf.subarray(0, 8).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]));
+            const ensureBranch = async () => {
+              try { await github.rest.git.getRef({ owner, repo, ref: `heads/${BRANCH}` }); return; }
+              catch (e) { if (e.status !== 404) throw e; }
+              const { data: blob } = await github.rest.git.createBlob({ owner, repo, encoding: 'utf-8',
+                content: 'Screenshots taken by pr-script-test.yml for the PR comments. Not code; never merge this branch.\n' });
+              const { data: tree } = await github.rest.git.createTree({ owner, repo, tree: [{ path: 'README.md', mode: '100644', type: 'blob', sha: blob.sha }] });
+              const { data: commit } = await github.rest.git.createCommit({ owner, repo, message: 'Start ci-screenshots', tree: tree.sha, parents: [] });
+              await github.rest.git.createRef({ owner, repo, ref: `refs/heads/${BRANCH}`, sha: commit.sha });
+            };
+            const uploadShot = async (r, local, suffix) => {
+              const buf = fs.readFileSync(local);
+              if (!isPng(buf)) { core.warning(`${r.script}: screenshot is not a plausible PNG, skipped`); return ''; }
+              const file = `${process.env.KIND === 'issue' ? 'issue' : 'pr'}-${prNum}/${r.name}${suffix}.png`;
+              for (let attempt = 1; attempt <= 3; attempt++) {
+                try {
+                  await ensureBranch();
+                  let sha;
+                  try { sha = (await github.rest.repos.getContent({ owner, repo, path: file, ref: BRANCH })).data.sha; }
+                  catch (e) { if (e.status !== 404) throw e; }
+                  const { data } = await github.rest.repos.createOrUpdateFileContents({
+                    owner, repo, branch: BRANCH, path: file, sha, content: buf.toString('base64'),
+                    message: `Screenshot: ${r.script} (${where(r)})${suffix} for #${prNum} at ${process.env.SHA.slice(0, 7)}`,
+                  });
+                  return `https://raw.githubusercontent.com/${owner}/${repo}/${data.commit.sha}/${file}`;
+                } catch (e) {
+                  // Two reports at once race on the branch head; try again.
+                  core.warning(`${r.script}: screenshot upload attempt ${attempt} failed: ${e.message}`);
+                  await new Promise(res => setTimeout(res, 2000 * attempt));
+                }
+              }
+              return '';
+            };
+            for (const r of rows) {
+              if (r.shot_file) r.shot_url = await uploadShot(r, r.shot_file, '');
+              if (r.shot_update_file) r.shot_update_url = await uploadShot(r, r.shot_update_file, '-after-update');
+            }
+
+            // unsupported: the script needs a CPU feature the test host lacks
+            // (AVX2 and the like). Not the PR's fault, so not a failure.
+            const icon = { pass: '✅', fail: '❌', error: '⚠️', cancelled: '⏹️', unsupported: '🖥️' };
+            const dur = s => `${Math.floor(s / 60)}m${String(s % 60).padStart(2, '0')}s`;
+            // Text from the build lands outside code blocks here: no table breaks,
+            // no code spans, and no @mention of a stranger (zero-width space).
+            const clean = s => String(s || '').replace(/[|\r\n]/g, ' ').replace(/`/g, "'").replace(/@/g, '@​').slice(0, 200);
+            const fence = s => String(s || '').replace(/~~~~/g, '~~~');
+
+            // fail: the app broke, the PR's business. error/cancelled: our test
+            // setup did, not the PR's. unsupported: the host's CPU is too old.
+            const count = s => rows.filter(r => r.status === s).length;
+            const passed = count('pass');
+            const untestable = count('unsupported');
+            const broken = count('fail');
+            const setupTrouble = count('error') + count('cancelled');
+            const allPass = passed === rows.length;
+            const cancelled = rows.every(r => r.status === 'cancelled');
+            const of = `**${passed}/${rows.length} passed**`;
+            const headline = broken
+              ? `❌ ${of}`
+              : setupTrouble
+                ? `⚠️ ${of}, ${setupTrouble} could not be tested because of a problem with the test setup (not the PR)`
+                : untestable
+                  ? `🖥️ ${of}, ${untestable} need${untestable === 1 ? 's' : ''} a newer CPU than the test host has (nothing failed)`
+                  : `✅ ${of}`;
+
+            // Update: the installed app is set back a version and updated with
+            // the PR's update_script. ➖ = it ran but had nothing to update.
+            const updateIcon = { updated: '✅', 'no-update': '➖', fail: '❌', error: '⚠️' };
+            const detail = r => {
+              if (r.status !== 'pass') return clean(r.step);
+              const ip = /^[0-9.]{7,15}$/.test(r.ip || '') ? r.ip : '';
+              if (isVm(r) && !r.url) return ip ? `booted, got ${ip}` : 'booted, no DHCP lease (an installer ISO, or no network)';
+              const reach = r.url ? `${clean(r.url)} → ${r.http_code}` : 'no URL to check';
+              return r.update_status === 'no-update' ? `${reach}; update: nothing to update${r.update_step ? ` (${clean(r.update_step)})` : ''}` : reach;
+            };
+            const table = [
+              '| Script | Platform | Install | Update | Duration | Detail |',
+              '|---|---|---|---|---|---|',
+              ...rows.map(r => `| \`${r.script}\` | ${where(r)} | ${r.update_status ? '✅' : icon[r.status] || '❔'} | ${updateIcon[r.update_status] || '–'} | ${dur(r.duration || 0)} | ${detail(r)} |`),
+            ].join('\n');
+
+            // A comment holds 65536 characters. Each script gets an equal share
+            // and a log that does not fit loses its beginning: the end is where
+            // a failure shows.
+            const budget = Math.floor(52000 / rows.length);
+            const tail = (text, max) => {
+              text = fence(text).trimEnd();
+              if (text.length <= max) return text;
+              const kept = text.slice(text.length - max);
+              const cut = text.slice(0, text.length - max).split('\n').length;
+              return `… ${cut} earlier lines cut, the full log is in the run artifacts\n${kept.slice(kept.indexOf('\n') + 1)}`;
+            };
+            const details = (summaryLine, text, max) => [
+              `<details><summary>${summaryLine}</summary>`, '',
+              '~~~~text', tail(text, max), '~~~~', '</details>',
+            ].join('\n');
+
+            const logs = rows.map(r => {
+              const parts = [];
+              const failed = r.status !== 'pass';
+              // A VM script's own output is all there is: no install log inside.
+              const buildShare = (failed || isVm(r)) && r.log_tail ? Math.min(r.log_tail.length, Math.floor(budget / 3)) : 0;
+              if (buildShare) parts.push(details(`${icon[r.status] || '❔'} ${r.script} (${where(r)}) — build log`, r.log_tail, buildShare));
+              if (isVm(r)) return parts.join('\n\n');
+              // The update log gets up to a third of what is left, the install log the rest.
+              const updateShare = r.update_log ? Math.min(r.update_log.length, Math.floor((budget - buildShare) / 3)) : 0;
+              if (r.install_log) {
+                const lines = r.install_log.trimEnd().split('\n').length;
+                parts.push(details(`📄 ${r.script} (${where(r)}) — install log (${lines} lines)`, r.install_log, budget - buildShare - updateShare - 400));
+              } else if (!buildShare) {
+                parts.push(`<sub>${r.script} (${where(r)}): no install log was captured</sub>`);
+              }
+              if (updateShare) {
+                const lines = r.update_log.trimEnd().split('\n').length;
+                parts.push(details(`🔄 ${r.script} (${where(r)}) — update log (${lines} lines)`, r.update_log, updateShare));
+              }
+              return parts.join('\n\n');
+            });
+
+            const shots = rows.filter(r => r.shot_url || r.shot_update_url).map(r => [
+              `<details open><summary>📸 ${r.script} (${where(r)}) — ${r.url ? clean(r.url) : 'console'}${r.shot_url && r.shot_update_url ? ': after install / after update' : r.shot_update_url ? ': after update' : ''}</summary>`, '',
+              [r.shot_url, r.shot_update_url].filter(Boolean)
+                .map((u, i, all) => `<img src="${u}" width="${all.length > 1 ? 420 : 640}" alt="Screenshot of ${r.script}">`).join(' '),
+              '', '</details>',
+            ].join('\n'));
+
+            const summary = [
+              `${headline} at \`${process.env.SHA.slice(0, 7)}\``, '',
+              table, '',
+              ...shots, '',
+              ...(() => { try { const n = JSON.parse(process.env.NOT_BUILT || '[]'); return n.length ? ['**Not built:**', ...n.map(x => `- ${x}`), ''] : []; } catch (e) { return []; } })(),
+              ...logs, '',
+              `Full logs: [workflow run](${runUrl}) (artifacts \`result-*\`). Comment \`/test${process.env.KIND === 'issue' ? ' ' + [...new Set(rows.map(r => r.script.slice(3, -3)))].join(' ') : ''}\` to build again.`,
+            ].join('\n');
+
+            // Issues have no check run (there is no PR commit to attach it to).
+            if (process.env.CHECK_ID) {
+              await github.rest.checks.update({
+                owner, repo, check_run_id: Number(process.env.CHECK_ID), status: 'completed',
+                // Untestable here is "test it by hand", not a pass: action_required,
+                // because a required check would count neutral as passed.
+                conclusion: cancelled ? 'cancelled' : allPass ? 'success' : broken ? 'failure' : 'action_required',
+                output: { title: `${passed}/${rows.length} passed`, summary: summary.slice(0, 65000) },
+              });
+            }
+
+            // The result pings whoever started the test. A mention added by
+            // editing a comment does not reliably notify, so the old comment
+            // goes and the result is posted as a new one, at the end of the
+            // thread where it is looked for.
+            // Whoever started the test and the PR's author, once each; no bots.
+            const pr = Number(process.env.PR);
+            const isIssue = process.env.KIND === 'issue';
+            const { data: prInfo } = isIssue
+              ? await github.rest.issues.get({ owner, repo, issue_number: pr })
+              : await github.rest.pulls.get({ owner, repo, pull_number: pr });
+            const author = prInfo.user && prInfo.user.type === 'User' ? prInfo.user.login : '';
+            const login = /^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/;
+            const ping = [...new Set([process.env.ACTOR || '', author])].filter(l => login.test(l)).map(l => `@${l} `).join('');
+            const MARK = '<!-- pr-script-test -->';
+            const body = `${MARK}\n### Proxmox script test\n\n${ping}${summary}`.slice(0, 65000);
+            const comments = await github.paginate(github.rest.issues.listComments, { owner, repo, issue_number: pr });
+            for (const c of comments.filter(c => c.body.includes(MARK) && c.user.type === 'Bot')) {
+              await github.rest.issues.deleteComment({ owner, repo, comment_id: c.id });
+            }
+            const { data: posted } = await github.rest.issues.createComment({ owner, repo, issue_number: pr, body });
+            // An issue has nothing to review or approve: the comment is all.
+            if (isIssue) return;
+
+            // A real failure requests changes on the tested commit. Untestable
+            // (CPU), runner errors and cancelled runs are not the PR's fault and
+            // leave the review state alone. Our previous "changes requested" is
+            // always dismissed first: a pass lifts it, a new failure replaces it.
+            const REVIEW_MARK = '<!-- pr-script-test-review -->';
+            const failedRows = cancelled ? [] : rows.filter(r => r.status === 'fail');
+            const sha7 = process.env.SHA.slice(0, 7);
+            // Trusted PRs (scripts moving over from DevScripts) are approved when
+            // every script passes -- not on untestable or setup trouble, which
+            // means "not tested", not "good". That approval counts toward the
+            // ruleset's required review; a push dismisses it as stale, and a
+            // later run that does not fully pass withdraws it.
+            // Anyone with write access can push to a migration branch, and the
+            // approval counts toward the required review. So it only covers
+            // what a migration contains: ct/ and install/ scripts. A PR that
+            // also changes anything else (workflows, misc/, ...) is tested but
+            // never approved.
+            let approve = process.env.TRUSTED === 'true' && allPass;
+            let noApproveWhy = '';
+            if (approve) {
+              const changed = await github.paginate(github.rest.pulls.listFiles, { owner, repo, pull_number: pr });
+              const other = changed.map(f => f.filename).filter(n => !/^(ct|install)\/[A-Za-z0-9._-]+\.sh$/.test(n));
+              if (other.length) {
+                approve = false;
+                noApproveWhy = `Not approved automatically: besides \`ct/\` and \`install/\` scripts this PR changes ${other.slice(0, 5).map(n => '`' + n.replace(/[`\r\n]/g, '') + '`').join(', ')}${other.length > 5 ? ', …' : ''}. That needs a human review.`;
+              }
+            }
+            if (noApproveWhy) {
+              await github.rest.issues.updateComment({ owner, repo, comment_id: posted.id, body: `${body}\n\n> ${noApproveWhy}`.slice(0, 65000) });
+            }
+            try {
+              const reviews = await github.paginate(github.rest.pulls.listReviews, { owner, repo, pull_number: pr });
+              const ours = state => reviews.filter(v => v.user && v.user.type === 'Bot' && v.state === state && (v.body || '').includes(REVIEW_MARK));
+              for (const v of ours('CHANGES_REQUESTED')) {
+                await github.rest.pulls.dismissReview({
+                  owner, repo, pull_number: pr, review_id: v.id,
+                  message: failedRows.length ? 'Replaced by a newer Proxmox script test.' : `Proxmox script test passed at ${sha7}.`,
+                });
+              }
+              if (!approve && !cancelled) {
+                for (const v of ours('APPROVED')) {
+                  await github.rest.pulls.dismissReview({
+                    owner, repo, pull_number: pr, review_id: v.id,
+                    message: `Withdrawn: the Proxmox script test at ${sha7} did not fully pass.`,
+                  });
+                }
+              }
+              if (approve && !ours('APPROVED').some(v => v.commit_id === process.env.SHA)) {
+                await github.rest.pulls.createReview({
+                  owner, repo, pull_number: pr, commit_id: process.env.SHA, event: 'APPROVE',
+                  body: [
+                    REVIEW_MARK, `**Proxmox script test passed** at \`${sha7}\`: ${rows.map(r => `\`${r.script}\``).join(', ')}.`, '',
+                    `Script moved over from DevScripts, built and checked on a real Proxmox host. [Test result](${posted.html_url}).`,
+                  ].join('\n'),
+                });
+              }
+              if (failedRows.length) {
+                await github.rest.pulls.createReview({
+                  owner, repo, pull_number: pr, commit_id: process.env.SHA, event: 'REQUEST_CHANGES',
+                  body: [
+                    REVIEW_MARK, `**Proxmox script test failed** at \`${sha7}\`:`, '',
+                    ...failedRows.map(r => `- \`${r.script}\` (${where(r)}): ${clean(r.step)}`), '',
+                    `Logs and details: [test result](${posted.html_url}). Push a fix, then ask for \`/test\` again.`,
+                  ].join('\n'),
+                });
+              }
+            } catch (e) {
+              core.warning(`Could not update the review state: ${e.message}`);
+            }

.github/workflows/scripts/incus-ci-host-setup.sh

@@ -0,0 +1,193 @@
+#!/usr/bin/env bash
+# One-time setup of an Incus test host behind pr-script-test.yml: the same
+# ct/ scripts as on Proxmox, built through community-scripts/core's Incus
+# backend. Safe to re-run. Run as root on a disposable Debian 13 machine (it
+# builds pull request code as root).
+#
+#   incus-ci-host-setup.sh                       host only
+#   incus-ci-host-setup.sh <owner/repo> <token>  host + a runner for that repo
+#
+# The token is a runner *registration* token (valid one hour):
+#   gh api -X POST repos/<owner/repo>/actions/runners/registration-token --jq .token
+
+set -euo pipefail
+
+RUNNER_VERSION="${RUNNER_VERSION:-2.338.2}"
+SERVE_ROOT=/srv/ci
+SERVE_PORT=18080
+NET_ADDR=10.98.0.1
+NET_CIDR=10.98.0.0/24
+
+export DEBIAN_FRONTEND=noninteractive
+apt-get update -qq
+apt-get install -y -qq incus jq curl python3 iptables chromium fonts-dejavu fonts-noto-color-emoji >/dev/null
+
+# Containers get a NATed bridge of their own (Incus runs DHCP and DNS on it)
+# and a plain directory pool on the root disk.
+if ! incus storage show default &>/dev/null; then
+  incus admin init --preseed <<EOF
+networks:
+- name: incusbr0
+  type: bridge
+  config:
+    ipv4.address: ${NET_ADDR}/24
+    ipv4.nat: "true"
+    ipv6.address: none
+storage_pools:
+- name: default
+  driver: dir
+profiles:
+- name: default
+  devices:
+    root:
+      path: /
+      pool: default
+      type: disk
+    eth0:
+      name: eth0
+      network: incusbr0
+      type: nic
+EOF
+fi
+
+# Screenshots of the app under test are taken as this user, never as root.
+id ci-shot &>/dev/null || useradd --system --create-home --shell /usr/sbin/nologin ci-shot
+
+# Same rules as on the Proxmox hosts: the screenshot browser may reach the
+# test containers, DNS and the public internet, nothing private, and not this
+# host's own address on the container network (the PR tree server).
+cat >/usr/local/sbin/ci-shot-firewall <<EOF
+#!/usr/bin/env bash
+set -euo pipefail
+uid=\$(id -u ci-shot)
+for fw in iptables ip6tables; do
+  \$fw -w -N CI_SHOT 2>/dev/null || \$fw -w -F CI_SHOT
+  \$fw -w -C OUTPUT -m owner --uid-owner "\$uid" -j CI_SHOT 2>/dev/null ||
+    \$fw -w -I OUTPUT -m owner --uid-owner "\$uid" -j CI_SHOT
+done
+iptables -w -A CI_SHOT -d ${NET_ADDR} -j REJECT
+iptables -w -A CI_SHOT -d ${NET_CIDR} -j ACCEPT
+# systemd-resolved's stub; it forwards to the lab resolver itself.
+iptables -w -A CI_SHOT -d 127.0.0.53 -p udp --dport 53 -j ACCEPT
+iptables -w -A CI_SHOT -d 127.0.0.53 -p tcp --dport 53 -j ACCEPT
+for ns in \$(awk '/^nameserver/ && \$2 !~ /:/ {print \$2}' /etc/resolv.conf /run/systemd/resolve/resolv.conf 2>/dev/null); do
+  iptables -w -A CI_SHOT -d "\$ns" -p udp --dport 53 -j ACCEPT
+  iptables -w -A CI_SHOT -d "\$ns" -p tcp --dport 53 -j ACCEPT
+done
+for net in 0.0.0.0/8 10.0.0.0/8 100.64.0.0/10 127.0.0.0/8 169.254.0.0/16 172.16.0.0/12 192.168.0.0/16 224.0.0.0/3; do
+  iptables -w -A CI_SHOT -d "\$net" -j REJECT
+done
+for net in ::1/128 fc00::/7 fe80::/10 ff00::/8; do
+  ip6tables -w -A CI_SHOT -d "\$net" -j REJECT
+done
+EOF
+chmod +x /usr/local/sbin/ci-shot-firewall
+cat >/etc/systemd/system/ci-shot-firewall.service <<'EOF'
+[Unit]
+Description=Keep the screenshot browser away from this host and the lab network
+After=network-online.target incus.service
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/local/sbin/ci-shot-firewall
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+[[ -s /etc/timezone ]] || {
+  timedatectl set-timezone Europe/Vienna
+  echo Europe/Vienna >/etc/timezone
+}
+
+# The rewritten PR trees, served to the engine and to the containers. Waits
+# for incusbr0, which only exists once Incus is up.
+mkdir -p "$SERVE_ROOT"
+cat >/etc/systemd/system/ci-serve.service <<EOF
+[Unit]
+Description=Serve pull request trees to script builds
+After=incus.service network-online.target
+Wants=incus.service
+
+[Service]
+ExecStartPre=/bin/sh -c 'for i in \$(seq 1 60); do ip -4 addr show dev incusbr0 | grep -q ${NET_ADDR} && exit 0; incus network list >/dev/null 2>&1; sleep 1; done; exit 1'
+ExecStart=/usr/bin/python3 -m http.server ${SERVE_PORT} --bind ${NET_ADDR} --directory ${SERVE_ROOT}
+DynamicUser=yes
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+# Leftovers of a job that was killed before its cleanup trap ran.
+cat >/usr/local/sbin/ci-sweep <<'EOF'
+#!/usr/bin/env bash
+# Delete CI containers (ci-9000 .. ci-9099) that no running job holds, and stale trees.
+# A job holds its guest with /run/ci-jobs/<id>. A job killed outright (runner
+# restart, timeout) never removes it, so a lock older than any job can run
+# (90 minutes) holds nothing.
+held() { [[ -e "/run/ci-jobs/$1" && -z "$(find "/run/ci-jobs/$1" -mmin +180)" ]]; }
+for name in $(incus list -c n -f csv 2>/dev/null | grep -E '^ci-9[0-9]{3}$'); do
+  held "$name" && continue
+  incus delete "$name" --force &>/dev/null && echo "swept $name"
+done
+find /run/ci-jobs -maxdepth 1 -type f ! -name ".*" -mmin +180 -delete 2>/dev/null
+find /srv/ci -mindepth 1 -maxdepth 1 -type d -mmin +180 -exec rm -rf {} +
+find /usr/local/community-scripts/logs /var/log/community-scripts -type f -mtime +2 -delete 2>/dev/null
+find /opt/actions-runner/*/_diag -type f -mtime +14 -delete 2>/dev/null
+true
+EOF
+chmod +x /usr/local/sbin/ci-sweep
+cat >/etc/systemd/system/ci-sweep.service <<'EOF'
+[Unit]
+Description=Remove leftover CI containers
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/ci-sweep
+EOF
+cat >/etc/systemd/system/ci-sweep.timer <<'EOF'
+[Unit]
+Description=Remove leftover CI containers every 3 hours
+
+[Timer]
+OnCalendar=0/3:30
+Persistent=true
+
+[Install]
+WantedBy=timers.target
+EOF
+
+systemctl daemon-reload
+systemctl enable --now ci-serve.service ci-sweep.timer ci-shot-firewall.service >/dev/null
+systemctl restart ci-serve.service ci-shot-firewall.service
+
+# --- Runner (one per repository) ----------------------------------------------
+if [[ $# -eq 2 ]]; then
+  repo="$1"
+  token="$2"
+  [[ "$repo" =~ ^[A-Za-z0-9._-]+/[A-Za-z0-9._-]+$ ]] || { echo "bad repo" >&2; exit 2; }
+  dir="/opt/actions-runner/${repo#*/}"
+  mkdir -p "$dir"
+  cd "$dir"
+  if [[ ! -x ./config.sh ]]; then
+    curl -fsSL "https://github.com/actions/runner/releases/download/v${RUNNER_VERSION}/actions-runner-linux-x64-${RUNNER_VERSION}.tar.gz" | tar -xz
+    ./bin/installdependencies.sh >/dev/null
+  fi
+  if [[ -f .runner ]]; then
+    ./svc.sh stop >/dev/null 2>&1 || true
+    ./svc.sh uninstall >/dev/null 2>&1 || true
+    RUNNER_ALLOW_RUNASROOT=1 ./config.sh remove --token "$token" >/dev/null 2>&1 || true
+  fi
+  # Only `incus-test`: see pve-ci-host-setup.sh for why there are no default labels.
+  RUNNER_ALLOW_RUNASROOT=1 ./config.sh --unattended --replace --no-default-labels \
+    --url "https://github.com/${repo}" --token "$token" \
+    --name "$(hostname -s)-${repo#*/}" --labels incus-test --work _work
+  ./svc.sh install root >/dev/null
+  ./svc.sh start >/dev/null
+  echo "runner for ${repo} registered"
+fi
+
+echo "incus test host ready: ${SERVE_ROOT} on ${NET_ADDR}:${SERVE_PORT}, sweeper every 3h"

.github/workflows/scripts/pve-ci-host-setup.sh

@@ -0,0 +1,220 @@
+#!/usr/bin/env bash
+# One-time setup of the Proxmox test host behind pr-script-test.yml.
+# Safe to re-run. Run as root on the test host (a disposable PVE, never a
+# production node: it builds pull request code as root).
+#
+#   pve-ci-host-setup.sh                       host only
+#   pve-ci-host-setup.sh <owner/repo> <token>  host + a runner for that repo
+#
+# The token is a runner *registration* token (valid one hour):
+#   gh api -X POST repos/<owner/repo>/actions/runners/registration-token --jq .token
+
+set -euo pipefail
+
+RUNNER_VERSION="${RUNNER_VERSION:-2.338.2}"
+SERVE_ROOT=/srv/ci
+SERVE_PORT=18080
+UPLINK="${UPLINK:-vmbr0}"
+
+export DEBIAN_FRONTEND=noninteractive
+apt-get update -qq
+apt-get install -y -qq jq curl python3 dnsmasq iptables chromium fonts-dejavu fonts-noto-color-emoji >/dev/null
+
+# Screenshots of the app under test are taken as this user, never as root.
+id ci-shot &>/dev/null || useradd --system --create-home --shell /usr/sbin/nologin ci-shot
+
+# The page Chromium renders is served by code under test, and a redirect or an
+# <img> could point it at this host (the PVE UI on :8006) or the lab network;
+# the screenshot would then publish that on the PR. So ci-shot may reach the
+# test containers, DNS and the public internet (apps load fonts and scripts
+# from CDNs), and nothing private.
+cat >/usr/local/sbin/ci-shot-firewall <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+uid=$(id -u ci-shot)
+for fw in iptables ip6tables; do
+  $fw -w -N CI_SHOT 2>/dev/null || $fw -w -F CI_SHOT
+  $fw -w -C OUTPUT -m owner --uid-owner "$uid" -j CI_SHOT 2>/dev/null ||
+    $fw -w -I OUTPUT -m owner --uid-owner "$uid" -j CI_SHOT
+done
+iptables -w -A CI_SHOT -d 10.99.0.1 -j REJECT
+iptables -w -A CI_SHOT -d 10.99.0.0/24 -j ACCEPT
+for ns in $(awk '/^nameserver/ && $2 !~ /:/ {print $2}' /etc/resolv.conf); do
+  iptables -w -A CI_SHOT -d "$ns" -p udp --dport 53 -j ACCEPT
+  iptables -w -A CI_SHOT -d "$ns" -p tcp --dport 53 -j ACCEPT
+done
+for net in 0.0.0.0/8 10.0.0.0/8 100.64.0.0/10 127.0.0.0/8 169.254.0.0/16 172.16.0.0/12 192.168.0.0/16 224.0.0.0/3; do
+  iptables -w -A CI_SHOT -d "$net" -j REJECT
+done
+for net in ::1/128 fc00::/7 fe80::/10 ff00::/8; do
+  ip6tables -w -A CI_SHOT -d "$net" -j REJECT
+done
+EOF
+chmod +x /usr/local/sbin/ci-shot-firewall
+cat >/etc/systemd/system/ci-shot-firewall.service <<'EOF'
+[Unit]
+Description=Keep the screenshot browser away from this host and the lab network
+After=network-online.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/local/sbin/ci-shot-firewall
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+# Containers get their own NATed bridge instead of the lab network: no DHCP
+# lease surprises (a lab lease once handed a container the host's own address),
+# and an app listening on 8080 can never be confused with this host.
+cat >/etc/network/interfaces.d/ci-nat <<EOF
+auto vmbr1
+iface vmbr1 inet static
+	address 10.99.0.1/24
+	bridge-ports none
+	bridge-stp off
+	bridge-fd 0
+	post-up sysctl -qw net.ipv4.ip_forward=1
+	post-up iptables -t nat -C POSTROUTING -s 10.99.0.0/24 -o ${UPLINK} -j MASQUERADE 2>/dev/null || iptables -t nat -A POSTROUTING -s 10.99.0.0/24 -o ${UPLINK} -j MASQUERADE
+	post-down iptables -t nat -D POSTROUTING -s 10.99.0.0/24 -o ${UPLINK} -j MASQUERADE || true
+EOF
+ifreload -a
+cat >/etc/dnsmasq.d/ci.conf <<'EOF'
+interface=vmbr1
+bind-interfaces
+except-interface=lo
+dhcp-range=10.99.0.100,10.99.0.250,255.255.255.0,2h
+dhcp-option=option:router,10.99.0.1
+dhcp-option=option:dns-server,10.99.0.1
+no-resolv
+EOF
+# Upstream = whatever this host resolves with. Debian's dnsmasq would otherwise
+# ask resolvconf, which has nothing to offer on a PVE host.
+awk '/^nameserver/ {print "server=" $2}' /etc/resolv.conf >>/etc/dnsmasq.d/ci.conf
+systemctl enable dnsmasq >/dev/null
+systemctl restart dnsmasq
+
+# A PVE ISO install writes /etc/timezone; a cloud-image install does not, and
+# the engine's pct_timezone aborts without it.
+[[ -s /etc/timezone ]] || {
+  timedatectl set-timezone Europe/Vienna
+  echo Europe/Vienna >/etc/timezone
+}
+
+# Containers and VM disks live on the root filesystem; there is no LVM in a
+# cloud-image PVE. Snippets hold the Cloud-Init configs some vm/ scripts write.
+pvesm set local --content iso,vztmpl,backup,rootdir,images,snippets
+
+# Templates are fetched once here rather than on every first build.
+pveam update >/dev/null
+for t in $(pveam available --section system | awk '/_amd64\./ && /debian-13-standard|alpine-3\.2[0-9]-default|ubuntu-24\.04-standard/ {print $2}'); do
+  pveam list local | grep -q "$t" || pveam download local "$t" >/dev/null
+done
+
+# The rewritten PR trees, served to the engine and to the containers.
+mkdir -p "$SERVE_ROOT"
+cat >/etc/systemd/system/ci-serve.service <<EOF
+[Unit]
+Description=Serve pull request trees to script builds
+After=network-online.target
+
+[Service]
+ExecStart=/usr/bin/python3 -m http.server ${SERVE_PORT} --bind 10.99.0.1 --directory ${SERVE_ROOT}
+DynamicUser=yes
+Restart=always
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+# Leftovers of a job that was killed before its cleanup trap ran.
+cat >/usr/local/sbin/ci-sweep <<'EOF'
+#!/usr/bin/env bash
+# Destroy CI containers (9000-9099) and VMs (9100-9199) that no running job
+# holds, and stale trees.
+# A job holds its guest with /run/ci-jobs/<id>. A job killed outright (runner
+# restart, timeout) never removes it, so a lock older than any job can run
+# (90 minutes) holds nothing.
+held() { [[ -e "/run/ci-jobs/$1" && -z "$(find "/run/ci-jobs/$1" -mmin +180)" ]]; }
+for id in $(pct list | awk 'NR>1 && $1>=9000 && $1<=9099 {print $1}'); do
+  held "$id" && continue
+  pct stop "$id" --skiplock 1 &>/dev/null || true
+  pct destroy "$id" --purge 1 --force 1 &>/dev/null && echo "swept CT $id"
+done
+for id in $(qm list | awk 'NR>1 && $1>=9100 && $1<=9199 {print $1}'); do
+  held "$id" && continue
+  qm stop "$id" --skiplock 1 --timeout 30 &>/dev/null || true
+  qm destroy "$id" --purge 1 --destroy-unreferenced-disks 1 --skiplock 1 &>/dev/null && echo "swept VM $id"
+done
+# VM images and ISOs are cached between builds; drop the ones no build used
+# for a week. Container templates (*.tar.*) stay.
+find /var/lib/vz/template/cache /var/lib/vz/template/iso -maxdepth 1 -type f ! -name '*.tar.*' -atime +7 -delete 2>/dev/null
+find /run/ci-jobs -maxdepth 1 -type f ! -name ".*" -mmin +180 -delete 2>/dev/null
+find /srv/ci -mindepth 1 -maxdepth 1 -type d -mmin +180 -exec rm -rf {} +
+# Engine logs that a killed job never got to remove.
+find /tmp -maxdepth 1 -type f \( -name 'create-lxc-*.log' -o -name 'pct_create_*.log' \
+  -o -regex '/tmp/.*-9[0-9][0-9][0-9]-[0-9a-f]+\.log' \) -mmin +180 -delete
+find /var/log/community-scripts -type f -mtime +2 -delete 2>/dev/null
+find /opt/actions-runner/*/_diag -type f -mtime +14 -delete 2>/dev/null
+true
+EOF
+chmod +x /usr/local/sbin/ci-sweep
+cat >/etc/systemd/system/ci-sweep.service <<'EOF'
+[Unit]
+Description=Remove leftover CI containers
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/ci-sweep
+EOF
+cat >/etc/systemd/system/ci-sweep.timer <<'EOF'
+[Unit]
+Description=Remove leftover CI containers every 3 hours
+
+[Timer]
+OnCalendar=0/3:30
+Persistent=true
+
+[Install]
+WantedBy=timers.target
+EOF
+
+systemctl daemon-reload
+systemctl enable --now ci-serve.service ci-sweep.timer ci-shot-firewall.service >/dev/null
+systemctl restart ci-serve.service ci-shot-firewall.service
+
+# --- Runner (one per repository) ----------------------------------------------
+if [[ $# -eq 2 ]]; then
+  repo="$1"
+  token="$2"
+  [[ "$repo" =~ ^[A-Za-z0-9._-]+/[A-Za-z0-9._-]+$ ]] || { echo "bad repo" >&2; exit 2; }
+  dir="/opt/actions-runner/${repo#*/}"
+  mkdir -p "$dir"
+  cd "$dir"
+  if [[ ! -x ./config.sh ]]; then
+    curl -fsSL "https://github.com/actions/runner/releases/download/v${RUNNER_VERSION}/actions-runner-linux-x64-${RUNNER_VERSION}.tar.gz" | tar -xz
+    ./bin/installdependencies.sh >/dev/null
+  fi
+  # A registered runner is reconfigured from scratch: stop and remove the old
+  # registration (the token works for removal too).
+  if [[ -f .runner ]]; then
+    ./svc.sh stop >/dev/null 2>&1 || true
+    ./svc.sh uninstall >/dev/null 2>&1 || true
+    RUNNER_ALLOW_RUNASROOT=1 ./config.sh remove --token "$token" >/dev/null 2>&1 || true
+  fi
+  # Root, because pct needs it; the host is disposable by design.
+  # --no-default-labels: without it the runner also answers to `self-hosted`,
+  # and any other workflow with `runs-on: self-hosted` (and its secrets) could
+  # land on this host.
+  # Named after this host: with --replace, a fixed name would make a second
+  # test host take over the first one's registration instead of adding to it.
+  RUNNER_ALLOW_RUNASROOT=1 ./config.sh --unattended --replace --no-default-labels \
+    --url "https://github.com/${repo}" --token "$token" \
+    --name "$(hostname -s)-${repo#*/}" --labels proxmox-test --work _work
+  ./svc.sh install root >/dev/null
+  ./svc.sh start >/dev/null
+  echo "runner for ${repo} registered"
+fi
+
+echo "test host ready: ${SERVE_ROOT} on :${SERVE_PORT}, sweeper every 3h"

.github/workflows/scripts/pve-run-script.sh

@@ -0,0 +1,627 @@
+#!/usr/bin/env bash
+# Build one ct/ or vm/ script from a pull request on this test host, check
+# that the container or VM really works, destroy it, and leave a result.json
+# behind. The vm/ part lives in pve-run-vm.sh, sourced from here.
+#
+# PLATFORM says what this host is: pve (Proxmox VE, pct) or incus. The ct/
+# scripts are the same for both; community-scripts/core picks its Incus
+# backend by itself when it finds incus instead of pveversion. Only the way
+# this harness reaches into the container differs (guest_* below).
+#
+# Runs on the self-hosted runner, which *is* the disposable test host. The
+# harness comes from the default branch; only the script under test comes from
+# the pull request, pinned to the commit a maintainer approved.
+#
+# The engine hardcodes raw.githubusercontent.com/<upstream>/main for every fetch
+# (ct -> build.func -> install script -> install.func -> tools.func). Pointing it
+# at a fork branch therefore means rewriting those URLs: the PR tree is unpacked
+# under SERVE_ROOT, every upstream main URL in it is replaced by this host's own
+# HTTP server, and the containers fetch from there. Engine changes in the PR are
+# tested along with the script, which is what a reviewer wants anyway.
+
+set -uo pipefail
+
+: "${PR_REPO:?}" "${PR_SHA:?}" "${SCRIPT:?}" "${UPSTREAM:?}" "${CTID_BASE:?}" "${OUT_DIR:?}"
+OS="${OS:-}"
+PLATFORM="${PLATFORM:-pve}"
+CTID_COUNT="${CTID_COUNT:-50}"
+SERVE_ROOT="${SERVE_ROOT:-/srv/ci}"
+# The containers' own network: vmbr1 + dnsmasq on Proxmox, incusbr0 on Incus.
+if [[ "$PLATFORM" == "incus" ]]; then
+  SERVE_URL="${SERVE_URL:-http://10.98.0.1:18080}"
+  BRIDGE="${BRIDGE:-incusbr0}"
+else
+  SERVE_URL="${SERVE_URL:-http://10.99.0.1:18080}"
+  BRIDGE="${BRIDGE:-vmbr1}"
+fi
+BUILD_TIMEOUT="${BUILD_TIMEOUT:-45m}"
+URL_WAIT="${URL_WAIT:-120}"
+
+# Every value below reaches a path, a URL or a command line.
+[[ "$PR_REPO" =~ ^[A-Za-z0-9._-]+/[A-Za-z0-9._-]+$ ]] || { echo "bad PR_REPO" >&2; exit 2; }
+[[ "$UPSTREAM" =~ ^[A-Za-z0-9._-]+/[A-Za-z0-9._-]+$ ]] || { echo "bad UPSTREAM" >&2; exit 2; }
+[[ "$PR_SHA" =~ ^[0-9a-f]{40}$ ]] || { echo "bad PR_SHA" >&2; exit 2; }
+[[ "$SCRIPT" =~ ^(ct|vm)/[A-Za-z0-9._-]+\.sh$ ]] || { echo "bad SCRIPT" >&2; exit 2; }
+[[ -z "$OS" || "$OS" =~ ^(debian|ubuntu|alpine)$ ]] || { echo "bad OS" >&2; exit 2; }
+[[ "$PLATFORM" =~ ^(pve|incus)$ ]] || { echo "bad PLATFORM" >&2; exit 2; }
+[[ "$PLATFORM" == "pve" || "$SCRIPT" == ct/* ]] || { echo "vm/ scripts run on pve only" >&2; exit 2; }
+[[ "$CTID_BASE" =~ ^[0-9]+$ ]] || { echo "bad CTID_BASE" >&2; exit 2; }
+
+mkdir -p "$OUT_DIR"
+RAW_LOG="$OUT_DIR/build.raw.log"
+LOG="$OUT_DIR/build.log"
+RESULT="$OUT_DIR/result.json"
+INSTALL_LOG_OUT="$OUT_DIR/install.log"
+UPDATE_RAW="$OUT_DIR/update.raw.log"
+UPDATE_LOG="$OUT_DIR/update.log"
+UPDATE_TIMEOUT="${UPDATE_TIMEOUT:-30m}"
+
+kind="${SCRIPT%%/*}" # ct or vm
+app=$(basename "$SCRIPT" .sh)
+job="${GITHUB_RUN_ID:-local}-${GITHUB_RUN_ATTEMPT:-1}-${PLATFORM}-${kind}-${app}-${OS:-default}"
+tree="$SERVE_ROOT/$job"
+base="$SERVE_URL/$job"
+started=$(date +%s)
+
+status="fail"
+step=""
+exit_code=""
+ctid="" # the guest's ID (pve: 9000, incus: ci-9000), container or VM
+
+# The container, whatever the platform. ctid is set once a slot is reserved.
+guest_exec() {
+  if [[ "$PLATFORM" == "incus" ]]; then incus exec "$ctid" -- "$@"; else pct exec "$ctid" -- "$@"; fi
+}
+guest_exists() {
+  if [[ "$PLATFORM" == "incus" ]]; then incus info "$ctid" &>/dev/null; else pct status "$ctid" &>/dev/null; fi
+}
+guest_running() {
+  if [[ "$PLATFORM" == "incus" ]]; then
+    [[ "$(incus list "^${ctid}\$" -c s -f csv 2>/dev/null)" == "RUNNING" ]]
+  else
+    pct status "$ctid" 2>/dev/null | grep -q running
+  fi
+}
+guest_destroy() {
+  if [[ "$PLATFORM" == "incus" ]]; then
+    incus delete "$ctid" --force &>/dev/null || true
+  else
+    pct stop "$ctid" --skiplock 1 &>/dev/null || true
+    pct destroy "$ctid" --purge 1 --force 1 &>/dev/null || true
+  fi
+}
+ct_ip=""
+url=""
+http_code=""
+failed_units=""
+# updated: a real update ran; no-update: update ran, nothing to update;
+# fail: the update broke; empty: not attempted (the install failed).
+update_status=""
+update_step=""
+
+# Spinner frames: the engine redraws "⠋ Starting VM" a few times a second
+# without a tty too. An alternation, not a bracket: these are multibyte and
+# the runner's locale may be C.
+SPINNER_RE='^\s*(⠋|⠙|⠹|⠸|⠼|⠴|⠦|⠧|⠇|⠏)'
+
+strip_ansi() {
+  sed -E 's/\x1B\[[0-9;?]*[A-Za-z]//g; s/\x1B[()][A-Z0-9]//g; s/\r/\n/g' | grep -vE '^\s*$' | grep -vE "$SPINNER_RE"
+}
+
+# The install script's own output: everything $STD hides from the build log.
+# Both engines write it inside the container as /root/.install-<session>.log;
+# dev_mode=keep makes sure a failed container is still there to read it from.
+# If it is gone anyway, the copy the engine leaves on the host is the fallback.
+collect_install_log() {
+  [[ -n "$ctid" ]] || return 0
+  # Exactly one build ran in this container, so the newest install log is ours.
+  if guest_exists &&
+    guest_exec sh -c 'cat "$(ls -t /root/.install-*.log 2>/dev/null | head -n1)"' 2>/dev/null |
+    strip_ansi >"$INSTALL_LOG_OUT" && [[ -s "$INSTALL_LOG_OUT" ]]; then
+    return 0
+  fi
+  [[ "$PLATFORM" == "pve" ]] || { rm -f "$INSTALL_LOG_OUT"; return 0; }
+  # The engine names its host-side files after the session: pct_create_<ctid>_<date>_<session>.log
+  local sid f
+  sid=$(find /tmp -maxdepth 1 -name "pct_create_${ctid}_*.log" -newer "$RAW_LOG.start" -printf '%f\n' 2>/dev/null |
+    sed -E 's/.*_([0-9a-f]+)\.log$/\1/' | head -n1)
+  [[ -n "$sid" ]] || { rm -f "$INSTALL_LOG_OUT"; return 0; }
+  for f in /tmp/*-"${ctid}"-"${sid}".log /var/log/community-scripts/install-"${sid}"-combined-*.log; do
+    [[ -s "$f" ]] && { strip_ansi <"$f" >"$INSTALL_LOG_OUT"; return 0; }
+  done
+  rm -f "$INSTALL_LOG_OUT"
+}
+
+# "Requires AVX2" and friends: the script may be fine, the test host's CPU is
+# not (Xeon E5-2650, Sandy Bridge: AVX, no AVX2). Shown as untestable rather
+# than as a failure of the PR -- but the log is written by the code under test,
+# so its word is not enough. Only the engine's error lines count, only when the
+# build or install itself failed, and the feature they name must really be
+# missing from this host's /proc/cpuinfo. Claiming a feature the host has
+# changes nothing.
+CPU_RE='(requir|need)[a-z]*[^.]{0,60}(AVX(2|-?512)?|SSE4[._]?2|x86-64-v[234])\b|\b(AVX(2|-?512)?|x86-64-v[234])\b[^.]{0,60}(not (supported|available)|does not have|is missing|unsupported)'
+
+classify_cpu_failure() {
+  local line feature flags
+  line=$(strip_ansi <"$RAW_LOG" | grep -E '✖|\[ERROR\]' | grep -m1 -iE "$CPU_RE" |
+    sed -E 's/^\s*(✖️?|\[[^]]*\]|\s)*//' | cut -c1-200)
+  [[ -n "$line" ]] || return 0
+  # The CPU flag that would have to be missing for the message to be true.
+  case "${line,,}" in
+  *avx-512* | *avx512* | *x86-64-v4*) feature=avx512f ;;
+  *avx2* | *x86-64-v3*) feature=avx2 ;;
+  *sse4.2* | *sse4_2* | *x86-64-v2*) feature=sse4_2 ;;
+  *) return 0 ;;
+  esac
+  flags=" $(grep -m1 '^flags' /proc/cpuinfo | cut -d: -f2) "
+  [[ "$flags" == *" ${feature} "* ]] && return 0
+  status="unsupported"
+  step="needs a newer CPU than the test host has (no ${feature}): ${line}"
+}
+
+finish() {
+  [[ -f "$RAW_LOG" ]] && strip_ansi <"$RAW_LOG" >"$LOG"
+  [[ -f "$RAW_LOG" ]] && collect_install_log
+  [[ -f "$UPDATE_RAW" ]] && strip_ansi <"$UPDATE_RAW" >"$UPDATE_LOG"
+  rm -f "$UPDATE_RAW"
+  jq -n \
+    --arg script "$SCRIPT" --arg kind "$kind" --arg platform "$PLATFORM" --arg os "${OS:-default}" --arg status "$status" \
+    --arg step "$step" --arg exit_code "$exit_code" --arg sha "$PR_SHA" \
+    --arg ctid "$ctid" --arg url "$url" --arg http_code "$http_code" \
+    --arg failed_units "$failed_units" --arg ip "$ct_ip" \
+    --arg update_status "$update_status" --arg update_step "$update_step" \
+    --argjson duration "$(($(date +%s) - started))" \
+    --arg tail "$([[ -f "$LOG" ]] && tail -n 60 "$LOG")" \
+    '{script: $script, kind: $kind, platform: $platform, os: $os, status: $status, step: $step, exit_code: $exit_code,
+      sha: $sha, ctid: $ctid, ip: $ip, url: $url, http_code: $http_code,
+      failed_units: $failed_units, update_status: $update_status, update_step: $update_step,
+      duration: $duration, log_tail: $tail}' >"$RESULT"
+  echo "::group::result"
+  jq 'del(.log_tail)' "$RESULT"
+  echo "::endgroup::"
+}
+
+# --- Live output ------------------------------------------------------------------
+# The job log on GitHub streams while the job runs, so mirroring the build there
+# is all "live" takes. Two streams: the engine's own output, and the install
+# log inside the container, which holds everything $STD hides (apt, npm, ...).
+#
+# Both are written by the code under test. A line starting with `::` would be
+# read by the runner as a workflow command, so command processing is switched
+# off for as long as they run, with a token the build cannot know.
+stream_token=""
+log_pid=""
+install_pid=""
+
+# Colours stay, cursor movement and spinner redraws go.
+live_filter() {
+  sed -u -E 's/\r/\n/g; s/\x1B\[[0-9;?]*[ABCDEFGHJKSTfhilnsu]//g' | sed -u -E "/^\s*\$/d; /${SPINNER_RE}/d"
+}
+
+start_streams() {
+  stream_token=$(head -c 16 /dev/urandom | od -An -tx1 | tr -d ' \n')
+  echo "::stop-commands::${stream_token}"
+  tail -n +1 -F --pid="$build_pid" "$RAW_LOG" 2>/dev/null > >(live_filter) &
+  log_pid=$!
+  # A VM has no install log to follow: its script runs on this host only.
+  [[ "$kind" == "ct" ]] || return 0
+  # setsid: its own process group, so stop_streams can take down the
+  # pct/incus exec + tail pair inside it in one go.
+  setsid bash -c '
+    gx() { if [ "$2" = incus ]; then incus exec "$1" -- "${@:3}"; else pct exec "$1" -- "${@:3}"; fi; }
+    for _ in $(seq 1 900); do
+      f=$(gx "$1" "$2" sh -c "ls -t /root/.install-*.log 2>/dev/null | head -n1" 2>/dev/null)
+      if [ -n "$f" ]; then
+        echo "──────── install log of CT $1 (live) ────────"
+        if [ "$2" = incus ]; then exec incus exec "$1" -- tail -n +1 -F "$f"; fi
+        exec pct exec "$1" -- tail -n +1 -F "$f"
+      fi
+      sleep 2
+    done' _ "$ctid" "$PLATFORM" 2>/dev/null > >(live_filter | sed -u 's/^/  │ /') &
+  install_pid=$!
+}
+
+stop_streams() {
+  [[ -n "$stream_token" ]] || return 0
+  [[ -n "$install_pid" ]] && kill -TERM -- "-$install_pid" &>/dev/null
+  [[ -n "$log_pid" ]] && kill -TERM "$log_pid" &>/dev/null
+  wait "$log_pid" "$install_pid" &>/dev/null
+  sleep 1 # let the filters flush
+  install_pid=""
+  log_pid=""
+  echo "::${stream_token}::"
+  stream_token=""
+}
+
+build_pid=""
+update_pid=""
+cleanup() {
+  stop_streams
+  local pid
+  for pid in "$build_pid" "$update_pid"; do
+    [[ -n "$pid" ]] || continue
+    pkill -TERM -P "$pid" &>/dev/null || true
+    kill -TERM "$pid" &>/dev/null || true
+    sleep 2
+  done
+  if [[ -n "$ctid" && "$kind" == "vm" ]]; then
+    vm_cleanup
+  elif [[ -n "$ctid" ]]; then
+    guest_exists && guest_destroy
+    rm -f "/run/ci-jobs/$ctid"
+    # What the engine leaves on the host for this container and its session.
+    local f sid
+    [[ "$PLATFORM" == "pve" ]] && for f in /tmp/pct_create_"${ctid}"_*.log; do
+      [[ -f "$f" && "$f" -nt "$RAW_LOG.start" ]] || continue
+      sid=$(sed -E 's/.*_([0-9a-f]+)\.log$/\1/' <<<"$f")
+      rm -f -- "$f" /tmp/create-lxc-"${sid}".log /tmp/*-"${ctid}"-"${sid}".log
+    done
+  fi
+  rm -f "$RAW_LOG.start"
+  rm -rf -- "$tree"
+}
+trap cleanup EXIT
+# A cancelled job sends TERM; without this the EXIT trap would not run.
+trap 'exit 143' TERM
+trap 'exit 130' INT
+
+# fail <reason> [fail|unsupported]: only the build/install branches pass the
+# second argument, after classify_cpu_failure has checked the host.
+#
+# The exit code says whether *this job* worked, not whether the app did. A
+# script that fails to build is a result: it is written down, reported on the
+# PR (check, comment, review) and the job exits 0 -- a red run per broken app
+# would only be notification noise. Only trouble with the test setup itself
+# (setup_error) fails the job, because that is ours to look at.
+fail() {
+  step="$1"
+  status="${2:-fail}"
+  [[ "$status" == "unsupported" ]] || status="fail"
+  finish
+  echo "::warning title=${SCRIPT}::${step}"
+  exit 0
+}
+
+setup_error() {
+  step="$1"
+  status="error"
+  finish
+  echo "::error title=${SCRIPT}::test setup: ${step}"
+  exit 1
+}
+
+# --- Reserve a container ID ---------------------------------------------------
+# A lock file per ID, not just "first free one", because the engine only creates
+# the container minutes later and two jobs would otherwise pick the same ID.
+# VMs take the range 100 above the containers' (DevScripts 9100-9149,
+# ProxmoxVE 9150-9199).
+mkdir -p /run/ci-jobs
+if [[ "$kind" == "vm" ]]; then
+  source "$(dirname "$0")/pve-run-vm.sh"
+  CTID_BASE=$((CTID_BASE + 100))
+  vm_wait_turn
+fi
+exec 9>/run/ci-jobs/.lock
+flock 9
+# On Incus the ID is an instance name: var_ctid=ci-9000 names the container.
+for ((id = CTID_BASE; id < CTID_BASE + CTID_COUNT; id++)); do
+  name=$id
+  [[ "$PLATFORM" == "incus" ]] && name="ci-$id"
+  [[ -e "/run/ci-jobs/$name" ]] && continue
+  if [[ "$PLATFORM" == "incus" ]]; then
+    incus info "$name" &>/dev/null && continue
+  else
+    pvesh get /cluster/nextid --vmid "$id" &>/dev/null || continue
+  fi
+  echo "$job" >"/run/ci-jobs/$name"
+  ctid=$name
+  break
+done
+flock -u 9
+exec 9>&-
+[[ -n "$ctid" ]] || setup_error "no free ${kind} ID in ${CTID_BASE}-$((CTID_BASE + CTID_COUNT - 1))"
+
+# --- Fetch the approved commit and point it at ourselves ------------------------
+mkdir -p "$tree"
+curl -fsSL --retry 3 "https://codeload.github.com/${PR_REPO}/tar.gz/${PR_SHA}" |
+  tar -xz -C "$tree" --strip-components=1 || setup_error "could not download ${PR_REPO}@${PR_SHA:0:7}"
+[[ -f "$tree/$SCRIPT" ]] || fail "${SCRIPT} does not exist at ${PR_SHA:0:7}"
+
+upstream_re="https://raw\.githubusercontent\.com/${UPSTREAM//./\\.}/(refs/heads/)?main"
+grep -rlE "$upstream_re" "$tree" --include='*.sh' --include='*.func' |
+  xargs -r sed -i -E "s#${upstream_re}#${base}#g"
+
+if [[ "$kind" == "vm" ]]; then
+  vm_build_and_check
+  exit 0
+fi
+
+# --- Build ----------------------------------------------------------------------
+echo "Building ${SCRIPT} (${OS:-default OS}) on ${PLATFORM} as CT ${ctid} from ${PR_REPO}@${PR_SHA:0:7}"
+hostname_safe="ci-$(tr -c 'a-z0-9-\n' '-' <<<"${app,,}" | cut -c1-50)"
+build_env=(
+  PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+  HOME=/root TERM=dumb LANG=C.UTF-8
+  mode=default MODE=default PHS_SILENT=1 DIAGNOSTICS=no
+  var_ctid="$ctid" var_hostname="$hostname_safe" var_brg="$BRIDGE"
+  "dev_mode=timing,keep" COMMUNITY_SCRIPTS_URL="$base"
+)
+if [[ "$PLATFORM" == "incus" ]]; then
+  build_env+=(var_container_storage=default)
+else
+  build_env+=(var_container_storage=local var_template_storage=local)
+fi
+touch "$RAW_LOG.start"
+[[ -n "$OS" ]] && build_env+=(var_os="$OS")
+# Both engines turn var_github_token into GITHUB_TOKEN inside the container.
+[[ -n "${GH_API_TOKEN:-}" ]] && build_env+=(var_github_token="$GH_API_TOKEN")
+
+# --- Answers for the script's questions ------------------------------------------
+# Nobody types into CI, so anything the install asks has to be answered up front.
+# AGENTS.md rule 24: a script reads var_<x> first and prompts only when it is
+# unset (or uses prompt_input_required ... "var_x"). Every such variable gets a
+# CI value here. The names come from json/<app>.json app_vars (DevScripts) and
+# from the read/prompt_ lines of the install script (both repos). A bare `read`
+# that ignores its variable still fails, and the report says why.
+ENGINE_VARS=" var_ctid var_hostname var_os var_version var_cpu var_ram var_disk var_brg var_net var_container_storage var_template_storage var_unprivileged var_tags var_arm64 var_testurl var_verbose var_timezone var_http_proxy var_http_no_proxy var_appversion var_github_token "
+host_app=$(tr -c 'a-z0-9-\n' '-' <<<"${app,,}")
+ci_value() {
+  case "${1,,}" in
+  *pass* | *secret* | *token* | *key*) head -c 32 /dev/urandom | base64 | tr -dc 'A-Za-z0-9' | cut -c1-20 ;;
+  *email* | *mail*) echo "ci@example.test" ;;
+  *url* | *endpoint*) echo "https://ci-${host_app}.example.test" ;;
+  # One name per variable: var_opencloud_collabora_fqdn ->
+  # ci-opencloud-collabora.example.test, so several of them cannot collide.
+  *host* | *domain* | *fqdn*)
+    local part="${1#var_}"
+    part=$(sed -E 's/_?(fqdn|hostname|host|domain)$//' <<<"${part,,}" | tr '_' '-')
+    echo "ci-${part:-$host_app}.example.test"
+    ;;
+  *user*) echo "ciadmin" ;;
+  *) echo "ci-test" ;;
+  esac
+}
+declare -A answers=()
+json="$tree/json/${app}.json"
+if [[ -f "$json" ]]; then
+  while IFS=$'\t' read -r name default; do
+    answers[$name]="$default"
+  done < <(jq -r '(if type == "array" then .[0] else . end).app_vars // [] | .[] |
+    select(.name | test("^var_[a-z0-9_]{1,40}$")) | [.name, (.default // "" | tostring)] | @tsv' "$json" 2>/dev/null)
+fi
+# Names built at run time from a loop, e.g. OpenCloud:
+#   servers=("opencloud" "collabora" "wopi")
+#   for server in "${servers[@]}"; do fqdn_var="var_opencloud_${server}_fqdn"
+# Each var_...${x}... template is expanded with the words of `for x in ...`
+# (or of the array that loop walks). Nothing is executed, only read.
+expand_templates() {
+  local tpl x pre suf words arr w
+  while read -r tpl; do
+    x=$(sed -E 's/^[^$]*\$\{?([A-Za-z_][A-Za-z0-9_]*)\}?.*$/\1/' <<<"$tpl")
+    pre="${tpl%%\$*}"
+    suf=$(sed -E 's/^[^$]*\$\{?[A-Za-z_][A-Za-z0-9_]*\}?//' <<<"$tpl")
+    words=$(grep -m1 -oE "for ${x} in [^;]*" "$1" | sed -E "s/^for ${x} in //")
+    if [[ "$words" =~ \$\{([A-Za-z_][A-Za-z0-9_]*)\[@\]\} ]]; then
+      arr="${BASH_REMATCH[1]}"
+      words=$(grep -m1 -oE "^\s*${arr}=\([^)]*\)" "$1" | sed -E "s/^\s*${arr}=\(//; s/\)$//")
+    fi
+    for w in $words; do
+      w="${w//[\"\']/}"
+      [[ "${pre}${w}${suf}" =~ ^var_[a-z0-9_]{1,40}$ ]] && echo "${pre}${w}${suf}"
+    done
+  done < <(grep -oE 'var_[a-z0-9_]*\$\{?[A-Za-z_][A-Za-z0-9_]*\}?[a-z0-9_]*' "$1" | sort -u)
+}
+
+# The engine names the install script after APP (lower case, no spaces), which
+# need not match the ct/ file name: ct/bluesky-pds.sh -> blueskypds-install.sh.
+nsapp=$(grep -m1 -oE '^APP="[^"]+"' "$tree/$SCRIPT" | cut -d'"' -f2 | tr -d ' ' | tr '[:upper:]' '[:lower:]')
+for f in "$tree/install/${app}-install.sh" "$tree/install/${nsapp}-install.sh" "$tree/$SCRIPT"; do
+  [[ -f "$f" ]] || continue
+  while read -r name; do
+    [[ -v "answers[$name]" ]] || answers[$name]=""
+  done < <({
+    grep -E '\bread\b|prompt_(input|input_required|confirm|select|password)\b' "$f" | grep -oE '\bvar_[a-z0-9_]{1,40}\b'
+    expand_templates "$f"
+  } | sort -u)
+done
+for name in "${!answers[@]}"; do
+  [[ "$ENGINE_VARS" == *" $name "* ]] && continue
+  value="${answers[$name]}"
+  [[ -n "$value" ]] || value=$(ci_value "$name")
+  build_env+=("$name=$value")
+  case "${name,,}" in
+  *pass* | *secret* | *token* | *key*) echo "Pre-answered ${name}=(random)" ;;
+  *) echo "Pre-answered ${name}=${value}" ;;
+  esac
+done
+
+# In the background so that a TERM from a cancelled job is handled at once:
+# bash defers traps until a foreground command returns.
+env -i "${build_env[@]}" timeout --kill-after=1m "$BUILD_TIMEOUT" \
+  bash -c 'bash -c "$(curl -fsSL "$1")"' _ "$base/$SCRIPT" </dev/null >"$RAW_LOG" 2>&1 &
+build_pid=$!
+start_streams
+wait "$build_pid"
+exit_code=$?
+build_pid=""
+stop_streams
+
+if ((exit_code == 124 || exit_code == 137)); then
+  fail "build timed out after ${BUILD_TIMEOUT}"
+fi
+# The engine marks the step that broke with a cross. Its closing "Installation
+# failed in container" line is generic, so the cross before it is the useful one.
+failure_line() {
+  local line
+  line=$(strip_ansi <"$RAW_LOG" | grep -E '✖|\[ERROR\]|error:' | grep -v 'Installation failed in container' |
+    tail -n 1 | sed -E 's/^\s*(✖️?|\s)*//' | cut -c1-200)
+  # A prompt nobody can answer: say what to do instead.
+  # First, because the report keeps 200 characters.
+  if [[ "$line" == *"read exited with status"* || "$line" == *"executing command read "* ]]; then
+    local asked
+    asked=$(grep -oE '\bvar_[a-z0-9_]{1,40}\b' <<<"$line" | tail -n 1)
+    line="unanswerable prompt (AGENTS.md rule 24): ask only when ${asked:-var_<x>} is unset, or use prompt_input_required. ${line}"
+  fi
+  echo "$line"
+}
+if ((exit_code != 0)); then
+  last=$(failure_line)
+  step="build exited ${exit_code}${last:+: $last}"
+  status="fail"
+  classify_cpu_failure
+  fail "$step" "$status"
+fi
+# With dev_mode=keep (needed to read the install log) the engine carries on
+# after a failed install and still prints "Completed Successfully", exit 0.
+install_exit=$(strip_ansi <"$RAW_LOG" | grep -oE 'Installation failed in container [0-9]+ \(exit code: [0-9]+\)' |
+  grep -oE '[0-9]+\)$' | tr -d ')' | tail -n 1)
+if [[ -n "$install_exit" ]]; then
+  last=$(failure_line)
+  step="install script exited ${install_exit}${last:+: $last}"
+  status="fail"
+  classify_cpu_failure
+  fail "$step" "$status"
+fi
+grep -qi 'completed successfully' "$RAW_LOG" || fail "build exited 0 but never reported success"
+
+# --- Checks ---------------------------------------------------------------------
+guest_running || fail "container ${ctid} is not running"
+
+ct_ip=$(guest_exec sh -c "ip -4 -o addr show dev eth0 | awk '{print \$4}' | cut -d/ -f1" 2>/dev/null | head -n1)
+
+# What the app's page looks like, for the PR comment. Chromium runs as its own
+# unprivileged user with its sandbox on: the page is served by code under test.
+# ci-shot-firewall (pve-ci-host-setup.sh) keeps that user off this host and the
+# lab network; without it there is no screenshot rather than an unguarded one.
+# $1: file name in OUT_DIR (screenshot.png after install, -update after update).
+take_screenshot() {
+  command -v chromium >/dev/null && id ci-shot &>/dev/null || return 0
+  iptables -w -S CI_SHOT 2>/dev/null | grep -q -- '-d 10.0.0.0/8 .*REJECT' || return 0
+  local dir
+  dir=$(mktemp -d)
+  chown ci-shot "$dir"
+  runuser -u ci-shot -- timeout 60 chromium --headless=new --disable-gpu --hide-scrollbars \
+    --ignore-certificate-errors --no-first-run --window-size=1280,800 --virtual-time-budget=10000 \
+    --user-data-dir="$dir/profile" --screenshot="$dir/shot.png" "$url" &>/dev/null
+  # Only a plausible PNG leaves this function.
+  if [[ -s "$dir/shot.png" && $(stat -c %s "$dir/shot.png") -lt 3000000 ]] &&
+    [[ "$(head -c 8 "$dir/shot.png" | od -An -tx1 | tr -d ' \n')" == "89504e470d0a1a0a" ]]; then
+    cp "$dir/shot.png" "$OUT_DIR/${1:-screenshot.png}"
+  fi
+  rm -rf -- "$dir"
+}
+
+# Is the app up? No failed services, and the URL the script tells the user to
+# open, e.g. http://${IP}:1337/admin, answers 200 (after redirects, so a jump
+# to /login is fine). A script that prints no URL has no web UI to check.
+# Run after the install and again after the update. Sets health_problem.
+pattern=$(grep -oE 'https?://\$\{IP\}(:[0-9]+)?(/[A-Za-z0-9._~/?=&%-]*)?' "$tree/$SCRIPT" | head -n1)
+[[ -n "$pattern" && -n "$ct_ip" ]] && url="${pattern/\$\{IP\}/$ct_ip}"
+health_problem=""
+check_health() {
+  health_problem=""
+  failed_units=""
+  if guest_exec sh -c 'command -v systemctl' &>/dev/null; then
+    sleep 10
+    failed_units=$(guest_exec systemctl --failed --no-legend --plain 2>/dev/null | awk '{print $1}' | paste -sd, -)
+  elif guest_exec sh -c 'command -v rc-status' &>/dev/null; then
+    failed_units=$(guest_exec rc-status --crashed 2>/dev/null | awk '{print $1}' | paste -sd, -)
+  fi
+  [[ -z "$failed_units" ]] || { health_problem="failed services: ${failed_units}"; return 1; }
+  [[ -n "$url" ]] || return 0
+  local waited
+  for ((waited = 0; waited < URL_WAIT; waited += 5)); do
+    http_code=$(curl -sk -L --max-redirs 5 -o /dev/null -w '%{http_code}' --max-time 10 "$url" || true)
+    [[ "$http_code" =~ ^2[0-9][0-9]$ ]] && break
+    sleep 5
+  done
+  # Also when the check fails: an error page explains more than a status code.
+  [[ "$http_code" =~ ^[1-5][0-9][0-9]$ ]] && take_screenshot "$1"
+  [[ "$http_code" =~ ^2[0-9][0-9]$ ]] ||
+    { health_problem="${url} answered ${http_code/#000/nothing} instead of 200 within ${URL_WAIT}s"; return 1; }
+}
+
+check_health screenshot.png || fail "$health_problem"
+
+# --- Update -------------------------------------------------------------------------
+# A fresh install is already on the latest release, so a plain `update` would
+# only say "No update available" and never run update_script's real path. The
+# version files the install wrote (~/.<app>, one per fetch_and_deploy_gh_release)
+# are set back to 0.0.0-ci first; check_for_gh_release then sees an update and
+# runs it all. `update` is the /usr/bin/update the install generated: it pulls
+# ct/<app>.sh from the URL this container was built from, i.e. the PR's tree.
+UPDATE_FAKE="0.0.0-ci"
+update_fail() {
+  update_status="fail"
+  update_step="$1"
+  fail "update: $1"
+}
+
+version_files=$(guest_exec sh -c '
+  for f in /root/.*; do
+    [ -f "$f" ] || continue
+    case "$f" in */.install-* | *.pending | *.bak | */.bash* | */.profile | */.hushlogin | */.viminfo | */.lesshst | */.wget-hsts | */.selected_editor) continue ;; esac
+    [ "$(wc -l <"$f")" -le 1 ] && grep -qE "^v?[0-9]+(\.[0-9A-Za-z_+-]+)+$" "$f" && echo "$f"
+  done' 2>/dev/null | grep -E '^/root/\.[A-Za-z0-9._-]+$')
+for f in $version_files; do
+  guest_exec sh -c "echo '$UPDATE_FAKE' > '$f'; rm -f '$f.pending'" ||
+    update_fail "could not reset $f"
+done
+[[ -n "$version_files" ]] && echo "Update test: set back $(tr '\n' ' ' <<<"$version_files")to ${UPDATE_FAKE}"
+
+: >"$UPDATE_RAW"
+update_token=$(head -c 16 /dev/urandom | od -An -tx1 | tr -d ' \n')
+echo "──────── update test (live) ────────"
+echo "::stop-commands::${update_token}"
+# timeout runs a program, not a shell function, so spell out the exec here.
+if [[ "$PLATFORM" == "incus" ]]; then guest_cmd=(incus exec "$ctid" --); else guest_cmd=(pct exec "$ctid" --); fi
+timeout --kill-after=1m "$UPDATE_TIMEOUT" "${guest_cmd[@]}" env PHS_SILENT=1 mode=default MODE=default \
+  TERM=dumb DIAGNOSTICS=no var_ignore_breaking_changes=yes ${GH_API_TOKEN:+GITHUB_TOKEN="$GH_API_TOKEN"} update </dev/null \
+  > >(tee "$UPDATE_RAW" | live_filter) 2>&1 &
+update_pid=$!
+wait "$update_pid"
+update_rc=$?
+update_pid=""
+sleep 1
+echo "::${update_token}::"
+
+update_failure_line() {
+  strip_ansi <"$UPDATE_RAW" | grep -E '✖|\[ERROR\]|error:' | tail -n 1 | sed -E 's/^\s*(✖️?|\s)*//' | cut -c1-180
+}
+if ((update_rc == 124 || update_rc == 137)); then
+  update_fail "timed out after ${UPDATE_TIMEOUT}"
+elif ((update_rc != 0)); then
+  last=$(update_failure_line)
+  update_fail "exited ${update_rc}${last:+: $last}"
+fi
+# The engine can report an error and still exit 0 (bark-server: "github: rate
+# limit reached", then "Cleaned"). A rate limit is ours, not the PR's: the
+# update could not be tested. Any other error line is a failed update.
+update_error=$(strip_ansi <"$UPDATE_RAW" | grep -E '✖|\[ERROR\]' | tail -n 1 | sed -E 's/^\s*(✖️?|\s)*//' | cut -c1-180)
+if [[ -n "$update_error" ]]; then
+  if [[ "${update_error,,}" == *"rate limit"* ]]; then
+    update_status="error"
+    update_step="could not be tested: ${update_error}"
+    status="pass"
+    finish
+    exit 0
+  fi
+  update_fail "$update_error"
+fi
+if strip_ansi <"$UPDATE_RAW" | grep -qi 'updated successfully'; then
+  update_status="updated"
+  for f in $version_files; do
+    [[ "$(guest_exec cat "$f" 2>/dev/null)" != "$UPDATE_FAKE" ]] ||
+      update_fail "reported success, but $f is still ${UPDATE_FAKE}"
+  done
+else
+  # Ran cleanly without updating anything: no version file to fake (apt/npm
+  # based), or an update_script that decides differently. Not a failure.
+  update_status="no-update"
+  update_step=$(strip_ansi <"$UPDATE_RAW" | grep -iE 'no update|up to date|up-to-date|already' | tail -n 1 | sed -E 's/^\s*(✔️?|ℹ️?|\s)*//' | cut -c1-160)
+fi
+
+check_health screenshot-update.png || update_fail "after the update: $health_problem"
+
+status="pass"
+finish

.github/workflows/scripts/pve-run-vm.sh

@@ -0,0 +1,140 @@
+# shellcheck shell=bash
+# The vm/ half of pve-run-script.sh, sourced from it: same inputs, same
+# result.json, same live output. Only building and checking differ.
+#
+# A VM script runs entirely on this host (there is no install script inside
+# the guest to follow), unattended through the core engine's VM_UNATTENDED=1:
+# the script's defaults, with ID, name, bridge and storage set from here. The
+# guest then boots on vmbr1 like the containers do, so its address is whatever
+# this host's dnsmasq leased to its MAC; no guest agent needed.
+#
+# What passes: the script exits 0 and says "Completed successfully", the VM is
+# running and keeps running through the boot wait, and where the script prints
+# a URL built from the VM's address (http://${VM_IP}:9000) that URL answers 200.
+# An installer ISO or an image without DHCP gets no address; that is reported,
+# not failed. There is no update test: a VM has no `update`.
+
+VM_BOOT_WAIT="${VM_BOOT_WAIT:-300}"
+VM_URL_WAIT="${VM_URL_WAIT:-600}"
+LEASES="${LEASES:-/var/lib/misc/dnsmasq.leases}"
+
+# One VM build per host at a time: a VM takes 2-8 GB of RAM and a disk image,
+# where a container takes a fraction. Held until the job exits; the build is
+# started with this descriptor closed, so a QEMU process can never inherit it.
+vm_wait_turn() {
+  exec 7>/run/ci-jobs/.vm-turn
+  flock -n 7 && return 0
+  echo "Another VM build is running on this host; waiting for it (one VM at a time)"
+  flock -w 3600 7 || setup_error "waited an hour for this host's VM slot"
+}
+
+vm_cleanup() {
+  if qm status "$ctid" &>/dev/null; then
+    qm stop "$ctid" --skiplock 1 --timeout 30 &>/dev/null || true
+    qm destroy "$ctid" --purge 1 --destroy-unreferenced-disks 1 --skiplock 1 &>/dev/null || true
+  fi
+  rm -f "/run/ci-jobs/$ctid" "/run/ci-jobs/console-${ctid}.png"
+  # Cloud-Init network snippets the script wrote for this VM.
+  [[ -f "$RAW_LOG.start" ]] &&
+    find /var/lib/vz/snippets -maxdepth 1 -type f -name "*${ctid}*" -newer "$RAW_LOG.start" -delete 2>/dev/null
+  true
+}
+
+# The VM's screen, straight from QEMU. Pixels only, but they come from the
+# guest, so the same checks as for a browser screenshot apply.
+vm_console_shot() {
+  local f="/run/ci-jobs/console-${ctid}.png"
+  rm -f "$f"
+  printf 'screendump %s -f png\n' "$f" | timeout 30 qm monitor "$ctid" &>/dev/null
+  if [[ -s "$f" && $(stat -c %s "$f") -lt 3000000 ]] &&
+    [[ "$(head -c 8 "$f" | od -An -tx1 | tr -d ' \n')" == "89504e470d0a1a0a" ]]; then
+    cp "$f" "$OUT_DIR/screenshot.png"
+  fi
+  rm -f "$f"
+}
+
+vm_running() {
+  qm status "$ctid" 2>/dev/null | grep -q 'status: running'
+}
+
+vm_build_and_check() {
+  local hn mac pattern waited last
+  hn="ci-$(tr -c 'a-z0-9-\n' '-' <<<"${app,,}" | cut -c1-40)-${ctid}"
+  echo "Building ${SCRIPT} as VM ${ctid} from ${PR_REPO}@${PR_SHA:0:7}"
+  local vm_env=(
+    PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+    HOME=/root TERM=dumb LANG=C.UTF-8 DIAGNOSTICS=no
+    VM_UNATTENDED=1 VM_VMID="$ctid" VM_HOSTNAME="$hn" VM_BRIDGE="$BRIDGE"
+    VM_STORAGE=local VM_ISO_STORAGE=local VM_START=yes
+    COMMUNITY_SCRIPTS_URL="$base"
+  )
+  # Release lookups (vm_latest_from_github and the like).
+  [[ -n "${GH_API_TOKEN:-}" ]] && vm_env+=(GITHUB_TOKEN="$GH_API_TOKEN")
+  touch "$RAW_LOG.start"
+
+  env -i "${vm_env[@]}" timeout --kill-after=1m "$BUILD_TIMEOUT" \
+    bash -c 'bash -c "$(curl -fsSL "$1")"' _ "$base/$SCRIPT" </dev/null >"$RAW_LOG" 2>&1 7>&- &
+  build_pid=$!
+  start_streams
+  wait "$build_pid"
+  exit_code=$?
+  build_pid=""
+  stop_streams
+
+  ((exit_code == 124 || exit_code == 137)) && fail "build timed out after ${BUILD_TIMEOUT}"
+  if ((exit_code != 0)); then
+    last=$(failure_line)
+    step="script exited ${exit_code}${last:+: $last}"
+    status="fail"
+    classify_cpu_failure
+    fail "$step" "$status"
+  fi
+  # vm_finish ends on a msg_ok of the script's choosing ("VM created. ..."),
+  # older scripts on "Completed successfully". exit_script and friends leave
+  # with 0 too, but on a cross.
+  last=$(strip_ansi <"$RAW_LOG" | tail -n 1 | cut -c1-200)
+  if ! grep -qi 'completed successfully' "$RAW_LOG" && ! [[ "$last" =~ ^[[:space:]]*✔ ]]; then
+    fail "script exited 0 but never reported success${last:+ (last line: ${last})}"
+  fi
+  vm_running || fail "VM ${ctid} is not running after the script finished"
+
+  # The address dnsmasq handed to this VM's MAC. The VM must stay up while it
+  # boots: one that powers itself off or crashes is a failure.
+  mac=$(qm config "$ctid" 2>/dev/null | sed -nE 's/^net0:[^=]*=([0-9A-Fa-f:]{17}).*/\1/p' | tr 'A-F' 'a-f')
+  echo "Waiting up to ${VM_BOOT_WAIT}s for VM ${ctid} (${mac:-no NIC}) to boot and get an address"
+  for ((waited = 0; waited < VM_BOOT_WAIT; waited += 5)); do
+    vm_running || fail "VM ${ctid} stopped by itself while booting"
+    [[ -n "$mac" ]] && ct_ip=$(awk -v m="$mac" '$2 == m {print $3}' "$LEASES" 2>/dev/null | tail -n 1)
+    [[ -n "$ct_ip" ]] && break
+    sleep 5
+  done
+  [[ -n "$ct_ip" ]] && echo "VM ${ctid} got ${ct_ip}" || echo "VM ${ctid} got no DHCP lease within ${VM_BOOT_WAIT}s"
+
+  # Only a URL the script builds from the address it found; <VM-IP> in a
+  # summary is a hint for later (after an installer ran), not a promise.
+  # ${VM_IP}, $VM_IP and ${VM_IP:-<VM-IP>} all count.
+  local ip_re='\$\{?VM_IP(:-[^}]*)?\}?'
+  pattern=$(grep -oE "https?://${ip_re}(:[0-9]+)?(/[A-Za-z0-9._~/?=&%-]*)?" "$tree/$SCRIPT" | head -n1)
+  if [[ -n "$pattern" ]]; then
+    [[ -n "$ct_ip" ]] || fail "no IP address within ${VM_BOOT_WAIT}s, so ${pattern} could not be checked"
+    url=$(sed -E "s#${ip_re}#${ct_ip}#" <<<"$pattern")
+    for ((waited = 0; waited < VM_URL_WAIT; waited += 10)); do
+      vm_running || fail "VM ${ctid} stopped by itself while its web UI was awaited"
+      http_code=$(curl -sk -L --max-redirs 5 -o /dev/null -w '%{http_code}' --max-time 10 "$url" || true)
+      [[ "$http_code" =~ ^2[0-9][0-9]$ ]] && break
+      sleep 10
+    done
+    [[ "$http_code" =~ ^[1-5][0-9][0-9]$ ]] && take_screenshot screenshot.png
+  else
+    # Let the console settle on a login prompt rather than a boot message.
+    sleep 20
+  fi
+  [[ -s "$OUT_DIR/screenshot.png" ]] || vm_console_shot
+  if [[ -n "$url" && ! "$http_code" =~ ^2[0-9][0-9]$ ]]; then
+    fail "${url} answered ${http_code/#000/nothing} instead of 200 within ${VM_URL_WAIT}s"
+  fi
+  vm_running || fail "VM ${ctid} stopped by itself"
+
+  status="pass"
+  finish
+}

CHANGELOG.md

@@ -581,6 +581,78 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-11-11
+
+### 🚀 Updated Scripts
+
+  - #### ✨ New Features
+
+    - Immich: bump to 3.4.0 [@MickLesk](https://github.com/MickLesk) ([#18600](https://github.com/community-scripts/ProxmoxVE/pull/18600))
+
+  - #### 💥 Breaking Changes
+
+    - Pocketbase: install and update from the new host (removed in github) [@MickLesk](https://github.com/MickLesk) ([#18609](https://github.com/community-scripts/ProxmoxVE/pull/18609))
+
+### 💾 Core
+
+  - core: drop the SUDO_ variables an update through sudo carries [@MickLesk](https://github.com/MickLesk) ([core#229](https://github.com/community-scripts/core/pull/229))
+- feat: let setup_deb822_repo use a keyring already on the system [@MickLesk](https://github.com/MickLesk) ([core#227](https://github.com/community-scripts/core/pull/227))
+
+## 2026-11-10
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - writefreely: Force symbolic link update [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#18588](https://github.com/community-scripts/ProxmoxVE/pull/18588))
+    - openproject: start memcached when IPv6 is disabled [@MickLesk](https://github.com/MickLesk) ([#18584](https://github.com/community-scripts/ProxmoxVE/pull/18584))
+    - homeassistant.sh: Update pip install command for runlike [@Zajsoft](https://github.com/Zajsoft) ([#18583](https://github.com/community-scripts/ProxmoxVE/pull/18583))
+    - Tunarr: fix install and update for the new release layout and latest ErsatzTV-ffmpeg [@chrisbenincasa](https://github.com/chrisbenincasa) ([#18577](https://github.com/community-scripts/ProxmoxVE/pull/18577))
+
+### 💾 Core
+
+  - fix: keep a script's config file when a package installs it [@MickLesk](https://github.com/MickLesk) ([core#226](https://github.com/community-scripts/core/pull/226))
+- fix: flush the image before importing a VM disk [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([core#223](https://github.com/community-scripts/core/pull/223))
+
+### 📂 Github
+
+  - pr-script-test: pre-answer prompt variables built in a loop [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#18596](https://github.com/community-scripts/ProxmoxVE/pull/18596))
+- Build PR scripts on a Proxmox test host via /test [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#18594](https://github.com/community-scripts/ProxmoxVE/pull/18594))
+
+## 2026-11-09
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - zipline: Update RAM to 3GB [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18569](https://github.com/community-scripts/ProxmoxVE/pull/18569))
+    - OpenObserve: record installed version, drop killall ExecStop [@BadFlo](https://github.com/BadFlo) ([#18566](https://github.com/community-scripts/ProxmoxVE/pull/18566))
+    - OpenObserve: extract release tarball with --no-same-owner [@BadFlo](https://github.com/BadFlo) ([#18564](https://github.com/community-scripts/ProxmoxVE/pull/18564))
+    - Immich: download before stopping, and clear maintenance mode after an interrupted update [@angusmaul](https://github.com/angusmaul) ([#18553](https://github.com/community-scripts/ProxmoxVE/pull/18553))
+    - cinephage: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18374](https://github.com/community-scripts/ProxmoxVE/pull/18374))
+    - kan: bump Node.js from 20 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18549](https://github.com/community-scripts/ProxmoxVE/pull/18549))
+    - myip: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#18550](https://github.com/community-scripts/ProxmoxVE/pull/18550))
+
+  - #### 🔧 Refactor
+
+    - security: remove hardcoded credentials in several scripts [@MickLesk](https://github.com/MickLesk) ([#18572](https://github.com/community-scripts/ProxmoxVE/pull/18572))
+    - yuvomi: install from the attested release asset [@ulsklyc](https://github.com/ulsklyc) ([#18554](https://github.com/community-scripts/ProxmoxVE/pull/18554))
+
+### 🗑️ Deleted Scripts
+
+  - coolify: delete old ct / its an addon [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#18562](https://github.com/community-scripts/ProxmoxVE/pull/18562))
+
+### 💾 Core
+
+  - core: detect GPUs by their PCI class, not by text anywhere in the line [@MickLesk](https://github.com/MickLesk) ([core#221](https://github.com/community-scripts/core/pull/221))
+- core: load an app's own settings from its .vars file [@MickLesk](https://github.com/MickLesk) ([core#216](https://github.com/community-scripts/core/pull/216))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - IP-Tag: filter guest-agent IPs by CIDR before limiting to 3 [@mazelado](https://github.com/mazelado) ([#18537](https://github.com/community-scripts/ProxmoxVE/pull/18537))
+
 ## 2026-11-08
 
 ### 🆕 New Scripts

ct/cinephage.sh

@@ -36,7 +36,7 @@ function update_script() {
     systemctl stop cinephage
     msg_ok "Stopped Cinephage"
 
-    NODE_VERSION="24" setup_nodejs
+    NODE_VERSION="26" setup_nodejs
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "cinephage" "MoldyTaint/Cinephage" "tarball"
 
     msg_info "Building Cinephage"

ct/coolify.sh

@@ -1,73 +0,0 @@
-#!/usr/bin/env bash
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://coolify.io/
-
-APP="Coolify"
-var_tags="${var_tags:-docker;paas}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-4096}"
-var_disk="${var_disk:-30}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-ADDON_SCRIPT="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/coolify.sh"
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /data/coolify ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  msg_warn "⚠️  ${APP} has been migrated to an addon script."
-  echo ""
-  echo -e "${INFO}${YW}This is a one-time migration. After this, you can update ${APP} anytime with:${CL}"
-  echo -e "${TAB}${TAB}${GN}update_coolify${CL}  or  ${GN}bash <(curl -fsSL ${ADDON_SCRIPT})${CL}"
-  echo ""
-  read -r -p "${TAB}Migrate update function now? [y/N]: " CONFIRM
-  if [[ ! "${CONFIRM,,}" =~ ^(y|yes)$ ]]; then
-    msg_warn "Migration skipped. The old update will continue to work for now."
-    msg_info "Updating ${APP} (legacy)"
-    $STD bash <(curl -fsSL https://cdn.coollabs.io/coolify/install.sh)
-    msg_ok "Updated ${APP}"
-    exit
-  fi
-
-  msg_info "Migrating update function"
-  TMP_UPDATE=$(mktemp)
-  cat <<'MIGRATION_EOF' >"$TMP_UPDATE"
-bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/coolify.sh)"
-MIGRATION_EOF
-  mv "$TMP_UPDATE" /usr/bin/update
-  chmod +x /usr/bin/update
-
-  ln -sf /usr/bin/update /usr/bin/update_coolify 2>/dev/null || true
-  msg_ok "Migration complete"
-
-  echo -e "${INFO}${YW}Running addon update${CL}"
-  type=update bash <(curl -fsSL "${ADDON_SCRIPT}")
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:8000${CL}"

ct/cross-seed.sh

@@ -26,7 +26,7 @@ function update_script() {
   check_container_storage
   check_container_resources
 
-  NODE_VERSION="24" setup_nodejs
+  NODE_VERSION="26" setup_nodejs
   ensure_dependencies build-essential
 
   if command -v cross-seed &>/dev/null; then

ct/homeassistant.sh

@@ -44,7 +44,7 @@ function update_script() {
       docker pull "${CONTAINER_IMAGE}"
       LATEST_IMAGE="$(docker inspect --format "{{.Id}}" --type image "${CONTAINER_IMAGE}")"
       if [[ "${RUNNING_IMAGE}" != "${LATEST_IMAGE}" ]]; then
-        pip install -U runlike
+        pip install -U runlike --break-system-packages
         echo "Updating ${container} image ${CONTAINER_IMAGE}"
         DOCKER_COMMAND="$(runlike --use-volume-id "${container}")"
         docker rm --force "${container}"
@@ -70,32 +70,7 @@ function update_script() {
     exit
   fi
   if [ "$UPD" == "4" ]; then
-    msg_info "Installing FileBrowser"
-    RELEASE=$(curl -fsSL https://api.github.com/repos/filebrowser/filebrowser/releases/latest | grep -o '"tag_name": ".*"' | sed 's/"//g' | sed 's/tag_name: //g')
-    $STD curl -fsSL https://github.com/filebrowser/filebrowser/releases/download/v2.23.0/linux-$(arch_resolve)-filebrowser.tar.gz | tar -xzv -C /usr/local/bin
-    $STD filebrowser config init -a '0.0.0.0'
-    $STD filebrowser config set -a '0.0.0.0'
-    $STD filebrowser users add admin community-scripts.org --perm.admin
-    msg_ok "Installed FileBrowser"
-
-    msg_info "Creating Service"
-    service_path="/etc/systemd/system/filebrowser.service"
-    echo "[Unit]
-Description=Filebrowser
-After=network-online.target
-[Service]
-User=root
-WorkingDirectory=/root/
-ExecStart=/usr/local/bin/filebrowser -r /
-[Install]
-WantedBy=default.target" >$service_path
-
-    $STD systemctl enable --now filebrowser
-    msg_ok "Created Service"
-
-    msg_ok "Completed successfully!\n"
-    echo -e "FileBrowser should be reachable by going to the following URL.
-         ${BL}http://$LOCAL_IP:8080${CL}   admin|community-scripts.org\n"
+    bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/filebrowser.sh)"
     exit
   fi
 }

ct/immich.sh

@@ -75,7 +75,7 @@ EOF
   BASE_DIR=${STAGING_DIR}/base-images
   SOURCE_DIR=${STAGING_DIR}/image-source
   cd /tmp
-  RELEASE="v3.3.6"
+  RELEASE="v3.4.0"
   if [[ -f ~/.intel_version ]]; then
     INTEL_SRC="https://raw.githubusercontent.com/immich-app/immich/${RELEASE}/machine-learning"
     curl -fsSL "${INTEL_SRC}/scripts/install-intel-runtime.sh" -o ./intel-runtime 2>/dev/null ||
@@ -109,7 +109,7 @@ EOF
   libraries=("libjxl" "jpegli" "libheif" "libraw" "imagemagick" "libvips")
   cd "$BASE_DIR"
   msg_warn "Checking for updates to custom image-processing libraries (recompile time: 2-15min per library)"
-  ensure_dependencies liblcms2-dev libjpeg62-turbo-dev libspng-dev libexif-dev libopenjp2-7-dev
+  ensure_dependencies liblcms2-dev libjpeg62-turbo-dev libspng-dev libexif-dev libopenjp2-7-dev pigz
   $STD git pull
   for library in "${libraries[@]}"; do
     compile_"$library"
@@ -131,7 +131,18 @@ EOF
 
   if check_for_gh_release "Immich" "immich-app/immich" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
     msg_warn "The update takes 5-15 minutes, do not interrupt it"
-    PREV_IMMICH="$(cat ~/.immich)"
+    PREV_IMMICH="${CS_PREVIOUS_VERSION:-$(cat ~/.immich)}"
+    INSTALL_DIR="/opt/${APP}"
+    UPLOAD_DIR="$(sed -n '/^IMMICH_MEDIA_LOCATION/s/[^=]*=//p' /opt/immich/.env)"
+    SRC_DIR="${INSTALL_DIR}/source"
+    APP_DIR="${INSTALL_DIR}/app"
+    PLUGIN_DIR="${APP_DIR}/plugins/immich-plugin-core"
+    ML_DIR="${APP_DIR}/machine-learning"
+    GEO_DIR="${INSTALL_DIR}/geodata"
+
+    setup_uv
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Immich" "immich-app/immich" "tarball" "${RELEASE}" "$SRC_DIR"
+
     # An interrupted update leaves app/ empty, so there may be no immich-admin to call.
     if [[ "$PREV_IMMICH" > "2.5.1" && -x /opt/immich/app/bin/immich-admin ]]; then
       msg_info "Enabling Maintenance Mode"
@@ -141,6 +152,7 @@ EOF
       $STD cd -
       msg_ok "Enabled Maintenance Mode"
     fi
+    [[ -x /opt/immich/app/bin/immich-admin ]] || export MAINT_MODE=1
     msg_info "Stopping Services"
     systemctl stop immich-web
     systemctl stop immich-ml
@@ -164,14 +176,6 @@ EOF
     fi
     ensure_dependencies ccache gcc-13 g++-13
 
-    INSTALL_DIR="/opt/${APP}"
-    UPLOAD_DIR="$(sed -n '/^IMMICH_MEDIA_LOCATION/s/[^=]*=//p' /opt/immich/.env)"
-    SRC_DIR="${INSTALL_DIR}/source"
-    APP_DIR="${INSTALL_DIR}/app"
-    PLUGIN_DIR="${APP_DIR}/plugins/immich-plugin-core"
-    ML_DIR="${APP_DIR}/machine-learning"
-    GEO_DIR="${INSTALL_DIR}/geodata"
-
     [[ -f "$ML_DIR"/ml_start.sh ]] && cp "$ML_DIR"/ml_start.sh "$INSTALL_DIR"
     if grep -qs "set -a" "$APP_DIR"/bin/start.sh && grep -qs "warnings" "$APP_DIR"/bin/start.sh; then
       cp "$APP_DIR"/bin/start.sh "$INSTALL_DIR"
@@ -193,8 +197,6 @@ EOF
       rm -rf "${APP_DIR:?}"/*
     )
 
-    setup_uv
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "Immich" "immich-app/immich" "tarball" "${RELEASE}" "$SRC_DIR"
     PNPM_VERSION="$(jq -r '.packageManager | split("@")[1] | split("+")[0]' ${SRC_DIR}/package.json)"
     export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
     export CI=1
@@ -232,7 +234,7 @@ EOF
     # plugins
     cd "$SRC_DIR"
     export MISE_TRUSTED_CONFIG_PATHS="$SRC_DIR"/mise.toml
-    export MISE_DISABLE_TOOLS=github:jellyfin/jellyfin-ffmpeg,java,terragrunt,opentofu,npm:@openapitools/openapi-generator-cli
+    export MISE_DISABLE_TOOLS=github:jellyfin/jellyfin-ffmpeg,java,terragrunt,opentofu,restic,npm:@openapitools/openapi-generator-cli
     export MISE_LOCKFILE_MODE=merge MISE_LOCKFILE_PLATFORMS="linux-$(arch_resolve x64 arm64)"
     mise_ok=0
     for i in 1 2 3; do
@@ -249,7 +251,8 @@ EOF
       # extism-js ships as a bare gzip-compressed single binary (.gz) that
       # fetch_and_deploy_gh_release cannot deploy; fetch + gunzip it directly.
       EXTISM_ARCH="$(arch_resolve x86_64 aarch64)"
-      curl_download /tmp/extism-js.gz "https://github.com/extism/js-pdk/releases/download/v1.6.0/extism-js-${EXTISM_ARCH}-linux-v1.6.0.gz"
+      EXTISM_VERSION="$(grep -oP '"github:extism/js-pdk"\s*=\s*"\K[^"]+' "$SRC_DIR"/mise.toml)"
+      curl_download /tmp/extism-js.gz "https://github.com/extism/js-pdk/releases/download/${EXTISM_VERSION}/extism-js-${EXTISM_ARCH}-linux-${EXTISM_VERSION}.gz"
       gunzip -f /tmp/extism-js.gz
       install -m 0755 /tmp/extism-js /usr/local/bin/extism-js
       rm -f /tmp/extism-js
@@ -274,6 +277,27 @@ EOF
     cp ./packages/plugin-core/manifest.json "$PLUGIN_DIR"
     msg_ok "Updated Immich server, web, cli and plugins"
 
+    RESTIC_REF="$(grep -oP 'futo-org/restic:sha-\K[0-9a-f]+' "$SRC_DIR"/server/Dockerfile)"
+    RESTIC_PROXY_REF="$(grep -oP 'futo-org/backups/restic-proxy:\K[^@]+' "$SRC_DIR"/server/Dockerfile)"
+    if [[ "$(cat ~/.immich_restic 2>/dev/null)" != "${RESTIC_REF} ${RESTIC_PROXY_REF}" || ! -x /usr/local/bin/restic ]]; then
+      FUTO_DIR=/opt/staging/futo
+      rm -rf "$FUTO_DIR"
+      $STD git clone --filter=blob:none --no-checkout https://github.com/futo-org/restic "$FUTO_DIR"/restic
+      $STD git -C "$FUTO_DIR"/restic checkout "$RESTIC_REF"
+      $STD git clone --depth 1 --filter=blob:none --sparse -b "$RESTIC_PROXY_REF" https://github.com/futo-org/backups "$FUTO_DIR"/backups
+      $STD git -C "$FUTO_DIR"/backups sparse-checkout set packages/restic-proxy
+      GO_VERSION="$(awk '/^go /{print $2}' "$FUTO_DIR"/backups/packages/restic-proxy/go.mod)" setup_go
+      msg_info "Building restic for FUTO Backups"
+      cd "$FUTO_DIR"/restic
+      $STD env CGO_ENABLED=0 go build -o /usr/local/bin/restic ./cmd/restic
+      cd "$FUTO_DIR"/backups/packages/restic-proxy
+      $STD env CGO_ENABLED=0 go build -o /usr/local/bin/restic-proxy .
+      cd "$SRC_DIR"
+      rm -rf "$FUTO_DIR"
+      echo "${RESTIC_REF} ${RESTIC_PROXY_REF}" >~/.immich_restic
+      msg_ok "Built restic for FUTO Backups"
+    fi
+
     cd "$SRC_DIR"/machine-learning
     mkdir -p "$ML_DIR"
     # chown excluding upload dir contents (may be a mount with restricted permissions)

ct/kan.sh

@@ -32,14 +32,14 @@ function update_script() {
   fi
 
   if check_for_gh_tag "kan" "kanbn/kan"; then
+    NODE_VERSION="24" NODE_MODULE="pnpm" setup_nodejs
+    
     msg_info "Stopping Service"
     systemctl stop kan
     msg_ok "Stopped Service"
 
     create_backup /opt/kan/.env
-
     CLEAN_INSTALL=1 fetch_and_deploy_gh_tag "kan" "kanbn/kan" "latest"
-
     restore_backup
 
     msg_info "Building Application"

ct/myip.sh

@@ -9,7 +9,7 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 APP="MyIP"
 var_tags="${var_tags:-network}"
 var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-1024}"
+var_ram="${var_ram:-2048}"
 var_disk="${var_disk:-4}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"
@@ -30,7 +30,7 @@ function update_script() {
     exit
   fi
 
-  NODE_VERSION="24" setup_nodejs
+  NODE_VERSION="26" setup_nodejs
 
   if check_for_gh_release "myip" "jason5ng32/MyIP"; then
     msg_info "Stopping Services"

ct/openobserve.sh

@@ -32,9 +32,14 @@ function update_script() {
 
   if check_for_gh_release "openobserve" "openobserve/openobserve"; then
     msg_info "Updating OpenObserve"
+    if grep -q "^ExecStop=killall" /etc/systemd/system/openobserve.service; then
+      sed -i "/^ExecStop=killall/d" /etc/systemd/system/openobserve.service
+      systemctl daemon-reload
+    fi
     systemctl stop openobserve
     RELEASE=$(get_latest_github_release "openobserve/openobserve")
-    tar zxf <(curl -fsSL https://downloads.openobserve.ai/releases/openobserve/v$RELEASE/openobserve-v$RELEASE-linux-$(arch_resolve).tar.gz) -C /opt/openobserve
+    tar zxf <(curl -fsSL https://downloads.openobserve.ai/releases/openobserve/v$RELEASE/openobserve-v$RELEASE-linux-$(arch_resolve).tar.gz) -C /opt/openobserve --no-same-owner
+    echo "${RELEASE}" >~/.openobserve
     systemctl start openobserve
     msg_ok "Updated OpenObserve"
     msg_ok "Updated successfully!"

ct/pocketbase.sh

@@ -4,7 +4,7 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 # Copyright (c) 2021-2026 tteck
 # Author: tteck (tteckster)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://pocketbase.io/ | Github: https://github.com/pocketbase/pocketbase
+# Source: https://pocketbase.io/ | Repo: https://ganigeorgiev.com/pocketbase/pocketbase
 
 APP="Pocketbase"
 var_tags="${var_tags:-database}"
@@ -29,20 +29,21 @@ function update_script() {
     msg_error "No ${APP} Installation Found!"
     exit
   fi
-  if check_for_gh_release "pocketbase" "pocketbase/pocketbase"; then
+  RELEASE=$(curl_with_retry "https://ganigeorgiev.com/api/collections/releases/records?filter=channel.repository.name%3D%22pocketbase%22%20%26%26%20channel.name%3D%22default%22&sort=-semver&skipTotal=1&perPage=1" "-" | jq -r '.items[0].tag' | sed 's/^v//')
+  if [[ -n "$RELEASE" && "$RELEASE" != "$(cat ~/.pocketbase 2>/dev/null)" ]]; then
     msg_info "Stopping Service"
     systemctl stop pocketbase
     msg_ok "Stopped Service"
 
-    msg_info "Updating ${APP}"
-    /opt/pocketbase/pocketbase update
-    echo "${CHECK_UPDATE_RELEASE}" >~/.pocketbase
-    msg_ok "Updated ${APP}"
+    fetch_and_deploy_from_url "https://ganigeorgiev.com/meta/pocketbase/pocketbase/download/v${RELEASE}/pocketbase_${RELEASE}_linux_$(arch_resolve).zip" "/opt/pocketbase"
+    echo "${RELEASE}" >~/.pocketbase
 
     msg_info "Starting Service"
     systemctl start pocketbase
     msg_ok "Started Service"
     msg_ok "Updated successfully!"
+  else
+    msg_ok "No update required. ${APP} is already at v${RELEASE}"
   fi
   exit
 }

ct/podman-homeassistant.sh

@@ -66,33 +66,7 @@ function update_script() {
     exit
   fi
   if [ "$UPD" == "3" ]; then
-    msg_info "Installing FileBrowser"
-    $STD curl -fsSL https://raw.githubusercontent.com/filebrowser/get/master/get.sh | bash
-    $STD filebrowser config init -a '0.0.0.0'
-    $STD filebrowser config set -a '0.0.0.0'
-    $STD filebrowser users add admin community-scripts.org --perm.admin
-    msg_ok "Installed FileBrowser"
-
-    msg_info "Creating Service"
-    cat <<EOF >/etc/systemd/system/filebrowser.service
-[Unit]
-Description=Filebrowser
-After=network-online.target
-
-[Service]
-User=root
-WorkingDirectory=/root/
-ExecStart=/usr/local/bin/filebrowser -r /
-
-[Install]
-WantedBy=default.target
-EOF
-    systemctl enable -q --now filebrowser
-    msg_ok "Created Service"
-
-    msg_ok "Completed successfully!\n"
-    echo -e "FileBrowser should be reachable by going to the following URL.
-         ${BL}http://$LOCAL_IP:8080${CL}   admin|community-scripts.org\n"
+    bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/tools/addon/filebrowser.sh)"
     exit
   fi
   if [ "$UPD" == "4" ]; then

ct/tunarr.sh

@@ -37,8 +37,6 @@ function update_script() {
     create_backup /root/.local/share/tunarr
 
     CLEAN_INSTALL=1 fetch_and_deploy_gh_release "tunarr" "chrisbenincasa/tunarr" "prebuild" "latest" "/opt/tunarr" "*linux-$(arch_resolve "x64" "arm64").tar.gz"
-    cd /opt/tunarr
-    mv tunarr* tunarr
     restore_backup
 
     msg_info "Starting Service"
@@ -52,13 +50,12 @@ function update_script() {
     systemctl stop tunarr
     msg_ok "Stopped Service"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "ersatztv-ffmpeg" "ErsatzTV/ErsatzTV-ffmpeg" "prebuild" "latest" "/opt/ErsatzTV-ffmpeg" "*-linux$(arch_resolve "64" "arm64")-gpl-7.1.tar.xz"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "ersatztv-ffmpeg" "ErsatzTV/ErsatzTV-ffmpeg" "prebuild" "latest" "/opt/ErsatzTV-ffmpeg" "*-linux$(arch_resolve "64" "arm64")-gpl-*.tar.xz"
 
     msg_info "Set ErsatzTV-ffmpeg links"
     chmod +x /opt/ErsatzTV-ffmpeg/bin/*
-    ln -sf /opt/ErsatzTV-ffmpeg/bin/ffmpeg /usr/local/bin/ffmpeg
-    ln -sf /opt/ErsatzTV-ffmpeg/bin/ffplay /usr/local/bin/ffplay
-    ln -sf /opt/ErsatzTV-ffmpeg/bin/ffprobe /usr/local/bin/ffprobe
+    ln -sf /opt/ErsatzTV-ffmpeg/bin/ffmpeg /usr/bin/ffmpeg
+    ln -sf /opt/ErsatzTV-ffmpeg/bin/ffprobe /usr/bin/ffprobe
     msg_ok "ffmpeg links set"
 
     msg_info "Starting Service"

ct/writefreely.sh

@@ -45,7 +45,7 @@ function update_script() {
     msg_info "Running Post-Update Tasks"
     cd /opt/writefreely
     $STD ./writefreely db migrate
-    ln -s /opt/writefreely/writefreely /usr/local/bin/writefreely
+    ln -sf /opt/writefreely/writefreely /usr/local/bin/writefreely
     msg_ok "Ran Post-Update Tasks"
 
     msg_info "Starting Services"

ct/yuvomi.sh

@@ -38,7 +38,7 @@ function update_script() {
 
     create_backup /opt/yuvomi/data /opt/yuvomi/.env
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "yuvomi" "ulsklyc/yuvomi" "tarball"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "yuvomi" "ulsklyc/yuvomi" "prebuild" "latest" "/opt/yuvomi" "yuvomi-*-dist.tar.gz"
     NODE_VERSION="24" setup_nodejs
 
     msg_info "Installing Node.js Dependencies"

ct/zipline.sh

@@ -9,7 +9,7 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 APP="Zipline"
 var_tags="${var_tags:-file;sharing}"
 var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
+var_ram="${var_ram:-3072}"
 var_disk="${var_disk:-5}"
 var_os="${var_os:-debian}"
 var_version="${var_version:-13}"

install/adventurelog-install.sh

@@ -20,6 +20,9 @@ $STD apt install -y \
   git \
   memcached \
   libmemcached-tools
+# Debian's memcached also listens on ::1 and does not start when IPv6 is disabled
+sed -i '/^-l ::1$/d' /etc/memcached.conf
+systemctl restart memcached
 msg_ok "Installed Dependencies"
 
 PYTHON_VERSION="3.13" setup_uv

install/archivebox-install.sh

@@ -48,6 +48,7 @@ chown -R archivebox:archivebox /opt/archivebox/{data,.npm,.cache,.local}
 chmod -R 755 /opt/archivebox/data
 $STD uv pip install archivebox --system --break-system-packages
 cd /opt/archivebox/data
+ADMIN_PASS=$(random_password 20)
 expect <<EOF
 set timeout -1
 log_user 0
@@ -62,13 +63,18 @@ expect "Email address"
 send "\r"
 
 expect "Password"
-send "community-scripts.org\r"
+send "${ADMIN_PASS}\r"
 
 expect "Password (again)"
-send "community-scripts.org\r"
+send "${ADMIN_PASS}\r"
 
 expect eof
 EOF
+{
+  echo "ArchiveBox Credentials"
+  echo "Username: archivebox"
+  echo "Password: ${ADMIN_PASS}"
+} >~/archivebox.creds
 msg_ok "Installed ArchiveBox"
 
 msg_info "Creating Service"

install/authelia-install.sh

@@ -63,12 +63,19 @@ else
 fi
 echo "$AUTHELIA_URL" >/etc/authelia/.authelia_url
 
+AUTHELIA_PASS=$(random_password 20)
+AUTHELIA_HASH=$(authelia crypto hash generate argon2 --password "$AUTHELIA_PASS" | awk '/Digest:/{print $2}')
+{
+  echo "Authelia Credentials"
+  echo "Username: authelia"
+  echo "Password: ${AUTHELIA_PASS}"
+} >~/authelia.creds
 cat <<EOF >/etc/authelia/users.yml
 users:
   authelia:
     disabled: false
     displayname: "Authelia Admin"
-    password: "\$argon2id\$v=19\$m=65536,t=3,p=4\$ZBopMzXrzhHXPEZxRDVT2w\$SxWm96DwhOsZyn34DLocwQEIb4kCDsk632PuiMdZnig"
+    password: "${AUTHELIA_HASH}"
     groups: []
 EOF
 cat <<EOF >/etc/authelia/configuration.yml

install/cinephage-install.sh

@@ -24,7 +24,7 @@ $STD apt install -y \
 msg_ok "Installed Dependencies"
 
 setup_ffmpeg
-NODE_VERSION="24" setup_nodejs
+NODE_VERSION="26" setup_nodejs
 fetch_and_deploy_gh_release "cinephage" "MoldyTaint/Cinephage" "tarball"
 
 msg_info "Building Cinephage"

install/cross-seed-install.sh

@@ -17,7 +17,7 @@ msg_info "Installing Dependencies"
 $STD apt install -y build-essential
 msg_ok "Installed Dependencies"
 
-NODE_VERSION="24" setup_nodejs
+NODE_VERSION="26" setup_nodejs
 
 msg_info "Setup Cross-Seed"
 $STD npm install cross-seed@latest -g

install/firefly-install.sh

@@ -26,6 +26,7 @@ chown -R www-data:www-data /opt/firefly
 chmod -R 775 /opt/firefly/storage
 cd /opt/firefly
 cp .env.example .env
+sed -i -e "s|^APP_KEY=.*|APP_KEY=$(random_password 32)|" -e "s|^STATIC_CRON_TOKEN=.*|STATIC_CRON_TOKEN=$(random_password 32)|" /opt/firefly/.env
 sed -i "s/DB_HOST=.*/DB_HOST=localhost/" /opt/firefly/.env
 sed -i "s/DB_PASSWORD=.*/DB_PASSWORD=$MARIADB_DB_PASS/" /opt/firefly/.env
 $STD composer install --no-dev --no-plugins --no-interaction

install/homelable-install.sh

@@ -33,7 +33,13 @@ msg_ok "Set up Python Backend"
 msg_info "Configuring Homelable"
 mkdir -p /opt/homelable/data
 SECRET_KEY=$(openssl rand -hex 32)
-BCRYPT_HASH=$(/opt/homelable/backend/.venv/bin/python -c "import bcrypt; print(bcrypt.hashpw(b'admin', bcrypt.gensalt()).decode())")
+HOMELABLE_PASS=$(random_password 20)
+BCRYPT_HASH=$(/opt/homelable/backend/.venv/bin/python -c "import bcrypt,sys; print(bcrypt.hashpw(sys.argv[1].encode(), bcrypt.gensalt()).decode())" "$HOMELABLE_PASS")
+{
+  echo "Homelable Credentials"
+  echo "Username: admin"
+  echo "Password: ${HOMELABLE_PASS}"
+} >~/homelable.creds
 cat <<EOF >/opt/homelable/backend/.env
 SECRET_KEY=${SECRET_KEY}
 SQLITE_PATH=/opt/homelable/data/homelab.db

install/immich-install.sh

@@ -23,7 +23,7 @@ if [[ "$(arch_resolve)" == "amd64" ]] && ! grep -qm1 sse4_2 /proc/cpuinfo; then
   exit 236
 fi
 
-RELEASE="v3.3.6"
+RELEASE="v3.4.0"
 if lscpu | grep -q 'GenuineIntel'; then
   echo ""
   echo ""
@@ -68,6 +68,7 @@ msg_info "Installing dependencies"
 $STD apt install --no-install-recommends -y \
   git \
   redis \
+  pigz \
   autoconf \
   build-essential \
   python3-dev \
@@ -415,7 +416,7 @@ cp -a web/build "$APP_DIR"/www
 cp LICENSE "$APP_DIR"
 cd "$SRC_DIR"
 export MISE_TRUSTED_CONFIG_PATHS="$SRC_DIR"/mise.toml
-export MISE_DISABLE_TOOLS=github:jellyfin/jellyfin-ffmpeg,java,terragrunt,opentofu,npm:@openapitools/openapi-generator-cli
+export MISE_DISABLE_TOOLS=github:jellyfin/jellyfin-ffmpeg,java,terragrunt,opentofu,restic,npm:@openapitools/openapi-generator-cli
 export MISE_LOCKFILE_MODE=merge MISE_LOCKFILE_PLATFORMS="linux-$(arch_resolve x64 arm64)"
 mise_ok=0
 for i in 1 2 3; do
@@ -433,7 +434,8 @@ if ! command -v extism-js >/dev/null 2>&1; then
   # fetch_and_deploy_gh_release cannot deploy (singlefile leaves it compressed,
   # prebuild only handles zip/tar). Fetch + gunzip it directly.
   EXTISM_ARCH="$(arch_resolve x86_64 aarch64)"
-  curl_download /tmp/extism-js.gz "https://github.com/extism/js-pdk/releases/download/v1.6.0/extism-js-${EXTISM_ARCH}-linux-v1.6.0.gz"
+  EXTISM_VERSION="$(grep -oP '"github:extism/js-pdk"\s*=\s*"\K[^"]+' "$SRC_DIR"/mise.toml)"
+  curl_download /tmp/extism-js.gz "https://github.com/extism/js-pdk/releases/download/${EXTISM_VERSION}/extism-js-${EXTISM_ARCH}-linux-${EXTISM_VERSION}.gz"
   gunzip -f /tmp/extism-js.gz
   install -m 0755 /tmp/extism-js /usr/local/bin/extism-js
   rm -f /tmp/extism-js
@@ -445,6 +447,25 @@ cp -r ./packages/plugin-core/dist "$PLUGIN_DIR"/dist
 cp ./packages/plugin-core/manifest.json "$PLUGIN_DIR"
 msg_ok "Installed Immich Server, Web and Plugin Components"
 
+RESTIC_REF="$(grep -oP 'futo-org/restic:sha-\K[0-9a-f]+' "$SRC_DIR"/server/Dockerfile)"
+RESTIC_PROXY_REF="$(grep -oP 'futo-org/backups/restic-proxy:\K[^@]+' "$SRC_DIR"/server/Dockerfile)"
+FUTO_DIR=/opt/staging/futo
+rm -rf "$FUTO_DIR"
+$STD git clone --filter=blob:none --no-checkout https://github.com/futo-org/restic "$FUTO_DIR"/restic
+$STD git -C "$FUTO_DIR"/restic checkout "$RESTIC_REF"
+$STD git clone --depth 1 --filter=blob:none --sparse -b "$RESTIC_PROXY_REF" https://github.com/futo-org/backups "$FUTO_DIR"/backups
+$STD git -C "$FUTO_DIR"/backups sparse-checkout set packages/restic-proxy
+GO_VERSION="$(awk '/^go /{print $2}' "$FUTO_DIR"/backups/packages/restic-proxy/go.mod)" setup_go
+msg_info "Building restic for FUTO Backups"
+cd "$FUTO_DIR"/restic
+$STD env CGO_ENABLED=0 go build -o /usr/local/bin/restic ./cmd/restic
+cd "$FUTO_DIR"/backups/packages/restic-proxy
+$STD env CGO_ENABLED=0 go build -o /usr/local/bin/restic-proxy .
+cd "$SRC_DIR"
+rm -rf "$FUTO_DIR"
+echo "${RESTIC_REF} ${RESTIC_PROXY_REF}" >~/.immich_restic
+msg_ok "Built restic for FUTO Backups"
+
 cd "$SRC_DIR"/machine-learning
 $STD useradd -U -s /usr/sbin/nologin -r -M -d "$INSTALL_DIR" immich
 mkdir -p "$ML_DIR"

install/kan-install.sh

@@ -21,7 +21,7 @@ msg_ok "Installed Dependencies"
 
 PG_VERSION="16" setup_postgresql
 PG_DB_NAME="kan" PG_DB_USER="kan" setup_postgresql_db
-NODE_VERSION="20" NODE_MODULE="pnpm" setup_nodejs
+NODE_VERSION="24" NODE_MODULE="pnpm" setup_nodejs
 
 fetch_and_deploy_gh_tag "kan" "kanbn/kan" "latest"
 

install/keycloak-install.sh

@@ -21,6 +21,7 @@ PG_DB_NAME="keycloak" PG_DB_USER="keycloak" setup_postgresql_db
 fetch_and_deploy_gh_release "keycloak_app" "keycloak/keycloak" "prebuild" "latest" "/opt/keycloak" "keycloak-*.tar.gz"
 
 msg_info "Creating Service"
+ADMIN_PASS=$(random_password 20)
 cat <<EOF >/etc/systemd/system/keycloak.service
 [Unit]
 Description=Keycloak Service
@@ -40,7 +41,7 @@ Environment="KC_DB_USERNAME=keycloak"
 Environment="KC_DB_PASSWORD=$PG_DB_PASS"
 Environment="KC_HTTP_ENABLED=true"
 Environment="KC_BOOTSTRAP_ADMIN_USERNAME=tmpadm"
-Environment="KC_BOOTSTRAP_ADMIN_PASSWORD=admin123"
+Environment="KC_BOOTSTRAP_ADMIN_PASSWORD=${ADMIN_PASS}"
 # Comment following line and uncomment the next 2 if working behind a reverse proxy
 Environment="KC_HOSTNAME_STRICT=false"
 #Environment="KC_HOSTNAME=keycloak.example.com"
@@ -48,6 +49,13 @@ Environment="KC_HOSTNAME_STRICT=false"
 [Install]
 WantedBy=multi-user.target
 EOF
+chmod 600 /etc/systemd/system/keycloak.service
+{
+  echo "Keycloak Credentials"
+  echo "Temporary admin, replace it with a permanent one"
+  echo "Username: tmpadm"
+  echo "Password: ${ADMIN_PASS}"
+} >~/keycloak.creds
 systemctl enable -q --now keycloak
 msg_ok "Created Service"
 

install/kimai-install.sh

@@ -40,6 +40,7 @@ cp .env.dist .env
 sed -i "/^DATABASE_URL=.*/c\DATABASE_URL=mysql://kimai:$MARIADB_DB_PASS@127.0.0.1:3306/kimai_db?charset=utf8mb4&serverVersion=mariadb-$MYSQL_VERSION" /opt/kimai/.env
 sed -i "s|^APP_SECRET=.*|APP_SECRET=$APP_SECRET|" /opt/kimai/.env
 $STD bin/console kimai:install -n
+ADMIN_PASS=$(random_password 20)
 $STD expect <<EOF
 set timeout -1
 log_user 0
@@ -47,10 +48,16 @@ log_user 0
 spawn bin/console kimai:user:create admin admin@community-scripts.org ROLE_SUPER_ADMIN
 
 expect "Please enter the password:"
-send "community-scripts.org\r"
+send "${ADMIN_PASS}\r"
 
 expect eof
 EOF
+{
+  echo "Kimai Credentials"
+  echo "Username: admin"
+  echo "Email: admin@community-scripts.org"
+  echo "Password: ${ADMIN_PASS}"
+} >~/kimai.creds
 $STD composer update --no-interaction
 cat <<EOF >/opt/kimai/config/packages/local.yaml
 kimai:

install/monica-install.sh

@@ -33,7 +33,13 @@ $STD yarn config set ignore-engines true
 $STD yarn install
 $STD yarn run production
 $STD php artisan key:generate
-$STD php artisan setup:production --email=admin@community-scripts.org --password=community-scripts.org --force
+ADMIN_PASS=$(random_password 20)
+$STD php artisan setup:production --email=admin@community-scripts.org --password="${ADMIN_PASS}" --force
+{
+  echo "Monica Credentials"
+  echo "Email: admin@community-scripts.org"
+  echo "Password: ${ADMIN_PASS}"
+} >~/monica.creds
 chown -R www-data:www-data /opt/monica
 chmod -R 775 /opt/monica/storage
 echo "* * * * * root php /opt/monica/artisan schedule:run >> /dev/null 2>&1" >>/etc/crontab

install/myip-install.sh

@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os
 
-NODE_VERSION="24" setup_nodejs
+NODE_VERSION="26" setup_nodejs
 fetch_and_deploy_gh_release "myip" "jason5ng32/MyIP" "tarball"
 
 msg_info "Configuring MyIP"

install/nagios-install.sh

@@ -63,7 +63,13 @@ setcap cap_net_raw+p /bin/ping
 msg_ok "Built Nagios Plugins"
 
 msg_info "Configuring Web Authentication"
-$STD htpasswd -bc /usr/local/nagios/etc/htpasswd.users nagiosadmin nagiosadmin
+NAGIOS_PASS=$(random_password 20)
+$STD htpasswd -bc /usr/local/nagios/etc/htpasswd.users nagiosadmin "$NAGIOS_PASS"
+{
+  echo "Nagios Credentials"
+  echo "Username: nagiosadmin"
+  echo "Password: ${NAGIOS_PASS}"
+} >~/nagios.creds
 chown root:www-data /usr/local/nagios/etc/htpasswd.users
 chmod 640 /usr/local/nagios/etc/htpasswd.users
 msg_ok "Configured Web Authentication"

install/neko-install.sh

@@ -201,6 +201,13 @@ cat <<'EOF' >/etc/neko/openbox.xml
 </openbox_config>
 EOF
 
+NEKO_ADMIN_PASS=$(random_password 20)
+NEKO_USER_PASS=$(random_password 20)
+{
+  echo "Neko Credentials"
+  echo "Admin password: ${NEKO_ADMIN_PASS}"
+  echo "User password: ${NEKO_USER_PASS}"
+} >~/neko.creds
 cat <<EOF >/etc/neko/neko.yaml
 server:
   bind: "0.0.0.0:8080"
@@ -219,8 +226,8 @@ desktop:
 member:
   provider: "multiuser"
   multiuser:
-    admin_password: "admin"
-    user_password: "neko"
+    admin_password: "${NEKO_ADMIN_PASS}"
+    user_password: "${NEKO_USER_PASS}"
 EOF
 msg_ok "Set up Runtime"
 

install/nodebb-install.sh

@@ -31,6 +31,7 @@ NODEBB_USER="nodebb"
 NODEBB_PWD="$(random_password 13)"
 MONGO_CONNECTION_STRING="mongodb://${NODEBB_USER}:${NODEBB_PWD}@localhost:27017/nodebb"
 NODEBB_SECRET=$(uuidgen)
+NODEBB_ADMIN_PASS="$(random_password 20)"
 cat <<EOF >~/nodebb.creds
 NodeBB-Credentials
 Mongo Database User: $MONGO_ADMIN_USER
@@ -38,6 +39,8 @@ Mongo Database Password: $MONGO_ADMIN_PWD
 NodeBB User: $NODEBB_USER
 NodeBB Password: $NODEBB_PWD
 NodeBB Secret: $NODEBB_SECRET
+NodeBB Admin User: community-scripts
+NodeBB Admin Password: $NODEBB_ADMIN_PASS
 EOF
 
 $STD mongosh <<EOF
@@ -97,10 +100,10 @@ expect "Administrator email address" {
     send "admin@community-scripts.org\r"
 }
 expect "Password" {
-    send "community-scripts\r"
+    send "$NODEBB_ADMIN_PASS\r"
 }
 expect "Confirm Password" {
-    send "community-scripts\r"
+    send "$NODEBB_ADMIN_PASS\r"
 }
 expect eof
 EOF

install/npmplus-install.sh

@@ -57,11 +57,17 @@ done
 ACME_EMAIL_INPUT="${var_npmplus_acme_email:-}"
 [[ -n "$ACME_EMAIL_INPUT" ]] || read -r -p "${TAB3}Enter your ACME Email (optional, press ENTER to skip): " ACME_EMAIL_INPUT || true
 
+ADMIN_PASS=$(random_password 20)
 yq -i "
   .services.npmplus.environment |=
     (map(select(. != \"TZ=*\" and . != \"ACME_EMAIL=*\" and . != \"INITIAL_ADMIN_EMAIL=*\" and . != \"INITIAL_ADMIN_PASSWORD=*\")) +
-    [\"TZ=$TZ_INPUT\", \"ACME_EMAIL=$ACME_EMAIL_INPUT\", \"INITIAL_ADMIN_EMAIL=admin@local.com\", \"INITIAL_ADMIN_PASSWORD=community-scripts.org\"])
+    [\"TZ=$TZ_INPUT\", \"ACME_EMAIL=$ACME_EMAIL_INPUT\", \"INITIAL_ADMIN_EMAIL=admin@local.com\", \"INITIAL_ADMIN_PASSWORD=${ADMIN_PASS}\"])
 " /opt/compose.yaml
+{
+  echo "NPMplus Credentials"
+  echo "Email: admin@local.com"
+  echo "Password: ${ADMIN_PASS}"
+} >~/npmplus.creds
 
 msg_info "Building and Starting NPMplus (Patience)"
 $STD docker compose up -d

install/octoprint-install.sh

@@ -30,7 +30,13 @@ rm -rf /usr/lib/python3.*/EXTERNALLY-MANAGED
 msg_ok "Setup Python3"
 
 msg_info "Creating user octoprint"
-useradd -m -s /bin/bash -p $(openssl passwd -1 octoprint) octoprint
+OCTOPRINT_PASS=$(random_password 20)
+useradd -m -s /bin/bash -p "$(openssl passwd -6 "$OCTOPRINT_PASS")" octoprint
+{
+  echo "OctoPrint Linux user Credentials"
+  echo "Username: octoprint"
+  echo "Password: ${OCTOPRINT_PASS}"
+} >~/octoprint.creds
 usermod -aG sudo,tty,dialout octoprint
 chown -R octoprint:octoprint /opt
 echo "octoprint ALL=NOPASSWD: $(command -v systemctl) restart octoprint, $(command -v reboot), $(command -v poweroff)" >/etc/sudoers.d/octoprint

install/openobserve-install.sh

@@ -16,7 +16,7 @@ update_os
 msg_info "Installing OpenObserve"
 mkdir -p /opt/openobserve/data
 RELEASE=$(get_latest_github_release "openobserve/openobserve")
-tar zxf <(curl -fsSL https://downloads.openobserve.ai/releases/openobserve/v$RELEASE/openobserve-v$RELEASE-linux-$(arch_resolve).tar.gz) -C /opt/openobserve
+tar zxf <(curl -fsSL https://downloads.openobserve.ai/releases/openobserve/v$RELEASE/openobserve-v$RELEASE-linux-$(arch_resolve).tar.gz) -C /opt/openobserve --no-same-owner
 ROOT_PASS="$(random_password 9)Aa1!"
 
 cat <<EOF >/opt/openobserve/data/.env
@@ -25,7 +25,7 @@ ZO_ROOT_USER_PASSWORD = "${ROOT_PASS}"
 ZO_DATA_DIR = "/opt/openobserve/data"
 ZO_HTTP_PORT = "5080"
 EOF
-echo "${RELEASE}" >>~/.openobserve
+echo "${RELEASE}" >~/.openobserve
 msg_ok "Installed OpenObserve"
 
 msg_info "Creating Service"
@@ -38,7 +38,6 @@ After=network.target
 Type=simple
 EnvironmentFile=/opt/openobserve/data/.env
 ExecStart=/opt/openobserve/openobserve
-ExecStop=killall -QUIT openobserve
 Restart=on-failure
 
 [Install]

install/openproject-install.sh

@@ -70,6 +70,9 @@ memcached/autoinstall install
 openproject/admin_email admin@example.net
 openproject/default_language en
 EOF
+# Debian's memcached also listens on ::1 and does not start when IPv6 is disabled
+$STD apt install -y memcached
+sed -i '/^-l ::1$/d' /etc/memcached.conf
 $STD sudo openproject configure
 systemctl stop openproject-web-1
 if ! grep -qF 'Environment=LD_PRELOAD=/usr/local/lib/libjemalloc.so.2' /etc/systemd/system/openproject-web-1.service; then

install/paymenter-install.sh

@@ -43,7 +43,13 @@ $STD php artisan migrate --force --seed
 msg_ok "Set up database"
 
 msg_info "Creating Admin User"
-$STD php artisan app:user:create paymenter admin admin@paymenter.org paymenter 1 -q
+PAYMENTER_PASS=$(random_password 20)
+$STD php artisan app:user:create paymenter admin admin@paymenter.org "$PAYMENTER_PASS" 1 -q
+{
+  echo "Paymenter Credentials"
+  echo "Email: admin@paymenter.org"
+  echo "Password: ${PAYMENTER_PASS}"
+} >~/paymenter.creds
 msg_ok "Created Admin User"
 
 msg_info "Configuring Nginx"

install/photoprism-install.sh

@@ -46,10 +46,16 @@ tar -xzf /tmp/libheif.tar.gz -C /usr/local
 ldconfig
 echo "${LIBHEIF_URL}" >~/.photoprism_libheif
 chmod -R 755 /opt/photoprism/photos/originals
+ADMIN_PASS=$(random_password 20)
+{
+  echo "PhotoPrism Credentials"
+  echo "Username: admin"
+  echo "Password: ${ADMIN_PASS}"
+} >~/photoprism.creds
 cat <<EOF >/opt/photoprism/config/.env
 # Authentication
 PHOTOPRISM_ADMIN_USER='admin'
-PHOTOPRISM_ADMIN_PASSWORD='changeme'
+PHOTOPRISM_ADMIN_PASSWORD='${ADMIN_PASS}'
 PHOTOPRISM_AUTH_MODE='password'
 PHOTOPRISM_PUBLIC='false'
 
@@ -112,7 +118,7 @@ StoragePath: "/opt/photoprism/storage"
 OriginalsPath: "/opt/photoprism/photos/originals"
 ImportPath: "/media"
 AdminUser: "admin"
-AdminPassword: "changeme"
+AdminPassword: "${ADMIN_PASS}"
 AuthMode: "password"
 DatabaseDriver: "sqlite"
 HttpHost: "0.0.0.0"

install/pocketbase-install.sh

@@ -3,7 +3,7 @@
 # Copyright (c) 2021-2026 tteck
 # Author: tteck (tteckster)
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://pocketbase.io/ | Github: https://github.com/pocketbase/pocketbase
+# Source: https://pocketbase.io/ | Repo: https://ganigeorgiev.com/pocketbase/pocketbase
 
 source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
 color
@@ -13,7 +13,9 @@ setting_up_container
 network_check
 update_os
 
-fetch_and_deploy_gh_release "pocketbase" "pocketbase/pocketbase" "prebuild" "latest" "/opt/pocketbase" "pocketbase*linux_$(arch_resolve).zip"
+RELEASE=$(curl_with_retry "https://ganigeorgiev.com/api/collections/releases/records?filter=channel.repository.name%3D%22pocketbase%22%20%26%26%20channel.name%3D%22default%22&sort=-semver&skipTotal=1&perPage=1" "-" | jq -r '.items[0].tag' | sed 's/^v//')
+fetch_and_deploy_from_url "https://ganigeorgiev.com/meta/pocketbase/pocketbase/download/v${RELEASE}/pocketbase_${RELEASE}_linux_$(arch_resolve).zip" "/opt/pocketbase"
+echo "${RELEASE}" >~/.pocketbase
 
 msg_info "Configuring Pocketbase"
 mkdir -p /opt/pocketbase/{pb_public,pb_migrations,pb_hooks}

install/qbittorrent-install.sh

@@ -18,12 +18,20 @@ fetch_and_deploy_gh_release "qbittorrent" "userdocs/qbittorrent-nox-static" "sin
 msg_info "Setup qBittorrent-nox"
 mv /opt/qbittorrent/qbittorrent /opt/qbittorrent/qbittorrent-nox
 mkdir -p ~/.config/qBittorrent/
+QB_PASS=$(random_password 20)
+QB_SALT=$(random_password 16)
+QB_HASH="$(printf '%s' "$QB_SALT" | base64 -w0):$(openssl kdf -keylen 64 -kdfopt digest:SHA512 -kdfopt pass:"$QB_PASS" -kdfopt salt:"$QB_SALT" -kdfopt iter:100000 -binary PBKDF2 | base64 -w0)"
+{
+  echo "qBittorrent Credentials"
+  echo "Username: admin"
+  echo "Password: ${QB_PASS}"
+} >~/qbittorrent.creds
 cat <<EOF >~/.config/qBittorrent/qBittorrent.conf
 [LegalNotice]
 Accepted=true
 
 [Preferences]
-WebUI\Password_PBKDF2="@ByteArray(amjeuVrF3xRbgzqWQmes5A==:XK3/Ra9jUmqUc4RwzCtrhrkQIcYczBl90DJw2rT8DFVTss4nxpoRhvyxhCf87ahVE3SzD8K9lyPdpyUCfmVsUg==)"
+WebUI\Password_PBKDF2="@ByteArray(${QB_HASH})"
 WebUI\Port=8090
 WebUI\UseUPnP=false
 WebUI\Username=admin

install/rabbitmq-install.sh

@@ -43,9 +43,15 @@ $STD rabbitmqctl enable_feature_flag all
 msg_ok "Enabled RabbitMQ Management Plugin"
 
 msg_info "Creating User"
-$STD rabbitmqctl add_user proxmox proxmox
+RABBITMQ_PASS=$(random_password 20)
+$STD rabbitmqctl add_user proxmox "$RABBITMQ_PASS"
 $STD rabbitmqctl set_user_tags proxmox administrator
 $STD rabbitmqctl set_permissions -p / proxmox ".*" ".*" ".*"
+{
+  echo "RabbitMQ Credentials"
+  echo "Username: proxmox"
+  echo "Password: ${RABBITMQ_PASS}"
+} >~/rabbitmq.creds
 msg_ok "Created User"
 
 motd_ssh

install/signoz-install.sh

@@ -151,7 +151,7 @@ INVITE_EMAIL_TEMPLATE=/opt/signoz/templates/invitation_email_template.html
 SIGNOZ_SQLSTORE_SQLITE_PATH=/var/lib/signoz/signoz.db
 SIGNOZ_WEB_ENABLED=true
 SIGNOZ_WEB_DIRECTORY=/opt/signoz/web
-SIGNOZ_JWT_SECRET=secret
+SIGNOZ_JWT_SECRET=$(openssl rand -hex 32)
 SIGNOZ_ALERTMANAGER_PROVIDER=signoz
 SIGNOZ_TELEMETRYSTORE_PROVIDER=clickhouse
 SIGNOZ_TELEMETRYSTORE_CLICKHOUSE_DSN=tcp://localhost:9000?password=

install/snapotter-install.sh

@@ -78,6 +78,12 @@ msg_info "Configuring SnapOtter"
 mkdir -p /opt/snapotter_data/files
 mkdir -p /tmp/snapotter-workspace
 
+SNAPOTTER_PASS=$(random_password 20)
+{
+  echo "SnapOtter Credentials"
+  echo "Username: admin"
+  echo "Password: ${SNAPOTTER_PASS}"
+} >~/snapotter.creds
 cat <<EOF >/opt/snapotter_data/.env
 PORT=1349
 NODE_ENV=production
@@ -92,7 +98,7 @@ FEATURE_MANIFEST_PATH=/opt/snapotter/docker/feature-manifest.json
 U2NET_HOME=/opt/snapotter_data/ai/models/rembg
 AUTH_ENABLED=true
 DEFAULT_USERNAME=admin
-DEFAULT_PASSWORD=admin
+DEFAULT_PASSWORD=${SNAPOTTER_PASS}
 LOG_LEVEL=info
 TRUST_PROXY=true
 FILE_MAX_AGE_HOURS=72

install/stirling-pdf-install.sh

@@ -116,10 +116,6 @@ if [[ "$login_mode" == "true" ]]; then
 # activate Login
 DISABLE_ADDITIONAL_FEATURES=false
 SECURITY_ENABLELOGIN=true
-
-# login credentials
-SECURITY_INITIALLOGIN_USERNAME=admin
-SECURITY_INITIALLOGIN_PASSWORD=stirling
 EOF
 fi
 msg_ok "Created Environment Variables"

install/tunarr-install.sh

@@ -16,14 +16,11 @@ update_os
 setup_hwaccel
 
 fetch_and_deploy_gh_release "tunarr" "chrisbenincasa/tunarr" "prebuild" "latest" "/opt/tunarr" "*linux-$(arch_resolve "x64" "arm64").tar.gz"
-cd /opt/tunarr
-mv tunarr* tunarr
-fetch_and_deploy_gh_release "ersatztv-ffmpeg" "ErsatzTV/ErsatzTV-ffmpeg" "prebuild" "latest" "/opt/ErsatzTV-ffmpeg" "*-linux$(arch_resolve "64" "arm64")-gpl-7.1.tar.xz"
+fetch_and_deploy_gh_release "ersatztv-ffmpeg" "ErsatzTV/ErsatzTV-ffmpeg" "prebuild" "latest" "/opt/ErsatzTV-ffmpeg" "*-linux$(arch_resolve "64" "arm64")-gpl-*.tar.xz"
 
 msg_info "Set ErsatzTV-ffmpeg links"
 chmod +x /opt/ErsatzTV-ffmpeg/bin/*
 ln -sf /opt/ErsatzTV-ffmpeg/bin/ffmpeg /usr/bin/ffmpeg
-ln -sf /opt/ErsatzTV-ffmpeg/bin/ffplay /usr/bin/ffplay
 ln -sf /opt/ErsatzTV-ffmpeg/bin/ffprobe /usr/bin/ffprobe
 msg_ok "ffmpeg links set"
 

install/yuvomi-install.sh

@@ -23,7 +23,7 @@ msg_ok "Installed Dependencies"
 
 NODE_VERSION="24" setup_nodejs
 
-fetch_and_deploy_gh_release "yuvomi" "ulsklyc/yuvomi" "tarball"
+fetch_and_deploy_gh_release "yuvomi" "ulsklyc/yuvomi" "prebuild" "latest" "/opt/yuvomi" "yuvomi-*-dist.tar.gz"
 
 msg_info "Installing Node.js Dependencies"
 cd /opt/yuvomi

tools/addon/coder-code-server.sh

@@ -85,12 +85,16 @@ function install() {
   mkdir -p "${HOME}/.config/code-server/"
 
   if [ "$preexisting_config" = false ]; then
+    CS_PASS=$(random_password 20)
     cat <<EOF >"$config_path"
 bind-addr: 0.0.0.0:8680
-auth: none
-password: 
+auth: password
+password: ${CS_PASS}
 cert: false
 EOF
+    chmod 600 "$config_path"
+    echo -e "Coder Code Server\nPassword: ${CS_PASS}" >~/coder-code-server.creds
+    chmod 600 ~/coder-code-server.creds
   fi
   systemctl enable -q --now code-server@"$USER"
   systemctl restart code-server@"$USER"
@@ -111,7 +115,7 @@ EOF
   msg_ok "Created update script (/usr/local/bin/update_coder-code-server)"
 
   echo -e "${APP} should be reachable by going to the following URL.
-         ${BL}http://${IP}:8680${CL} \n"
+         ${BL}http://${IP}:8680${CL} (password in ~/coder-code-server.creds)\n"
 }
 
 # ==============================================================================

tools/addon/copyparty.sh

@@ -151,9 +151,9 @@ function install() {
   else
     read -rp "${TAB}Set admin username [admin]: " admin_user
     admin_user=${admin_user:-admin}
-    read -rsp "${TAB}Set admin password [community-scripts.org]: " admin_pass
+    read -rsp "${TAB}Set admin password [random]: " admin_pass
     echo ""
-    admin_pass=${admin_pass:-community-scripts.org}
+    admin_pass=${admin_pass:-$(random_password 20)}
     msg_ok "Configured with admin user: ${admin_user}"
   fi
 
@@ -291,8 +291,10 @@ UPDATEEOF
   msg_ok "Storage: ${BL}${DATA_PATH}${CL}"
   msg_ok "Config: ${BL}${CONF_PATH}${CL}"
   if [[ -n "$admin_user" ]]; then
+    echo -e "Copyparty\nUsername: ${admin_user}\nPassword: ${admin_pass}" >~/copyparty.creds
+    chmod 600 ~/copyparty.creds
     echo ""
-    msg_ok "Login: ${GN}${admin_user}${CL} / ${GN}${admin_pass}${CL}"
+    msg_ok "Login: ${GN}${admin_user}${CL} (password in ~/copyparty.creds)"
   fi
 }
 

tools/addon/filebrowser-quantum.sh

@@ -189,6 +189,8 @@ chown root:root /usr/local/community-scripts
 chmod 755 /usr/local/community-scripts
 msg_ok "Directory prepared"
 
+ADMIN_PASS=$(random_password 20)
+msg_warn "FileBrowser runs as root and shows the whole filesystem. Without authentication, anyone who reaches port ${PORT} can read and change every file."
 echo -n "${TAB}Use No Authentication? (y/N): "
 read -r noauth_prompt
 
@@ -234,9 +236,12 @@ server:
           - neverWatchPath: "/lost+found"
 auth:
   adminUsername: admin
-  adminPassword: community-scripts.org
+  adminPassword: ${ADMIN_PASS}
 EOF
-  msg_ok "Configured with default admin (admin / community-scripts.org)"
+  chmod 600 "$CONFIG_PATH"
+  echo -e "FileBrowser Quantum\nUsername: admin\nPassword: ${ADMIN_PASS}" >~/filebrowser-quantum.creds
+  chmod 600 ~/filebrowser-quantum.creds
+  msg_ok "Configured admin (credentials saved in ~/filebrowser-quantum.creds)"
 fi
 
 msg_info "Creating service"
@@ -276,4 +281,13 @@ EOF
 fi
 
 msg_ok "Service created successfully"
+
+# auth.adminPassword resets the password on every start, so it stays only until the admin exists
+if grep -q '^\s*adminPassword:' "$CONFIG_PATH"; then
+  for _ in {1..30}; do
+    [[ "$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${PORT}/health")" == "200" ]] && break
+    sleep 1
+  done
+  sed -i '/^\s*adminPassword:/d' "$CONFIG_PATH"
+fi
 msg_ok "${APP} is reachable at: ${BL}http://${IP}:${PORT}${CL}"

tools/addon/filebrowser.sh

@@ -122,9 +122,11 @@ if [[ "${install_prompt,,}" =~ ^(y|yes)$ ]]; then
   chmod 755 /usr/local/community-scripts
   touch "$DB_PATH"
   chown root:root "$DB_PATH"
-  chmod 644 "$DB_PATH"
+  chmod 600 "$DB_PATH"
   msg_ok "Directory created successfully"
 
+  ADMIN_PASS=$(random_password 20)
+  msg_warn "FileBrowser runs as root and shows the whole filesystem. Without authentication, anyone who reaches port ${PORT} can read and change every file."
   read -r -p "Would you like to use No Authentication? (y/N): " auth_prompt
   if [[ "${auth_prompt,,}" =~ ^(y|yes)$ ]]; then
     msg_info "Configuring No Authentication"
@@ -133,16 +135,18 @@ if [[ "${install_prompt,,}" =~ ^(y|yes)$ ]]; then
     $STD filebrowser config set -a '0.0.0.0' -p "$PORT" -d "$DB_PATH"
     $STD filebrowser config set --auth.method=noauth --database "$DB_PATH"
     if ! filebrowser users update 1 --perm.admin --database "$DB_PATH" &>/dev/null; then
-      $STD filebrowser users add admin community-scripts.org --perm.admin --database "$DB_PATH"
+      $STD filebrowser users add admin "$ADMIN_PASS" --perm.admin --database "$DB_PATH"
     fi
     msg_ok "No Authentication configured"
   else
-    msg_info "Setting up default authentication"
+    msg_info "Setting up authentication"
     cd /usr/local/community-scripts
     $STD filebrowser config init -a '0.0.0.0' -p "$PORT" -d "$DB_PATH"
     $STD filebrowser config set -a '0.0.0.0' -p "$PORT" -d "$DB_PATH"
-    $STD filebrowser users add admin community-scripts.org --perm.admin --database "$DB_PATH"
-    msg_ok "Default authentication configured (admin:community-scripts.org)"
+    $STD filebrowser users add admin "$ADMIN_PASS" --perm.admin --database "$DB_PATH"
+    echo -e "FileBrowser\nUsername: admin\nPassword: ${ADMIN_PASS}" >~/filebrowser.creds
+    chmod 600 ~/filebrowser.creds
+    msg_ok "Authentication configured (credentials saved in ~/filebrowser.creds)"
   fi
 
   msg_info "Creating service"
@@ -156,7 +160,6 @@ After=network-online.target
 User=root
 WorkingDirectory=/usr/local/community-scripts
 ExecStartPre=/bin/touch /usr/local/community-scripts/filebrowser.db
-ExecStartPre=/usr/local/bin/filebrowser config set -a "0.0.0.0" -p ${PORT} -d /usr/local/community-scripts/filebrowser.db
 ExecStart=/usr/local/bin/filebrowser -r / -d /usr/local/community-scripts/filebrowser.db -p ${PORT}
 Restart=always
 

tools/addon/webmin.sh

@@ -30,6 +30,7 @@ catch_errors
 
 # Initialize all core functions (colors, formatting, icons, STD mode)
 load_functions
+confirm_not_pve_host
 require_debian_like
 
 header_info
@@ -49,9 +50,13 @@ msg_ok "Installed Prerequisites"
 
 msg_info "Installing ${APP}"
 fetch_and_deploy_gh_release "webmin" "webmin/webmin" "binary" "latest" "/opt/webmin" "webmin_*_all.deb"
-/usr/share/webmin/changepass.pl /etc/webmin root root &>/dev/null
+WEBMIN_PASS=$(random_password 20)
+/usr/share/webmin/changepass.pl /etc/webmin root "$WEBMIN_PASS" &>/dev/null
+echo -e "Webmin\nUsername: root\nPassword: ${WEBMIN_PASS}" >~/webmin.creds
+chmod 600 ~/webmin.creds
 msg_ok "Installed ${APP}"
 
 get_lxc_ip
 echo -e "Successfully Installed!! ${APP} should be reachable by going to ${BL}https://${LOCAL_IP}:10000${CL}"
+echo -e "Login: root, password in ~/webmin.creds"
 

tools/pve/add-iptag.sh

@@ -588,11 +588,17 @@ get_vm_ips() {
     fi
     if [[ "$agent_enabled" == "1" ]] && command -v qm >/dev/null 2>&1; then
         debug_log "vm $vmid: querying guest agent"
-        local qm_ips=$(timeout 5 qm guest cmd "$vmid" network-get-interfaces 2>/dev/null | grep -oE '([0-9]{1,3}\.){3}[0-9]{1,3}' | grep -v "127.0.0.1" | head -3)
+        local qm_ips=$(timeout 5 qm guest cmd "$vmid" network-get-interfaces 2>/dev/null | grep -oE '([0-9]{1,3}\.){3}[0-9]{1,3}' | grep -v "127.0.0.1")
+        local qm_kept=0
         for qm_ip in $qm_ips; do
             if [[ "$qm_ip" =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]]; then
-                debug_log "vm $vmid: found IP $qm_ip via qm guest cmd"
-                ips+="$qm_ip "
+                if ip_in_cidrs "$qm_ip" "${CIDR_LIST[*]}"; then
+                    debug_log "vm $vmid: found IP $qm_ip via qm guest cmd"
+                    ips+="$qm_ip "
+                    ((++qm_kept >= 3)) && break
+                else
+                    debug_log "vm $vmid: skipping IP $qm_ip via qm guest cmd (outside CIDR_LIST)"
+                fi
             fi
         done
     else