Fix formatting issues in rockylinux.sh

On a merged PR labelled "breaking change", POST the PR number to the site's
/api/breaking-changes/ingest endpoint so it can show a temporary advisory on
the affected scripts. Uses pull_request_target (secrets available for fork
PRs) and never checks out PR code — it only forwards the number after merge.
The `labeled` trigger also covers labelling a PR after it has merged.

Requires repo secret BREAKING_CHANGE_INGEST_SECRET (matching the site) and an
optional SITE_URL variable (defaults to https://community-scripts.org).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TFBuZEp142Ei2PAfWqbMXT

.github/changelogs/2026/08.md

@@ -1,3 +1,132 @@
+## 2026-08-22
+
+### 🆕 New Scripts
+
+  - pve-ups ([#16670](https://github.com/community-scripts/ProxmoxVE/pull/16670))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - docuseal: use DocuSeal's patched PDFium build to fix service start [@MickLesk](https://github.com/MickLesk) ([#16673](https://github.com/community-scripts/ProxmoxVE/pull/16673))
+
+  - #### ✨ New Features
+
+    - update authentik to 2026.8.0 [@thieneret](https://github.com/thieneret) ([#16674](https://github.com/community-scripts/ProxmoxVE/pull/16674))
+
+## 2026-08-21
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - wallos: fix: migrations [@CrazyWolf13](https://github.com/CrazyWolf13) ([#16666](https://github.com/community-scripts/ProxmoxVE/pull/16666))
+    - barassistant: fix: compatibility with v6 [@CrazyWolf13](https://github.com/CrazyWolf13) ([#16665](https://github.com/community-scripts/ProxmoxVE/pull/16665))
+    - Immichframe: remove settings.yaml UUID placeholder [@MickLesk](https://github.com/MickLesk) ([#16660](https://github.com/community-scripts/ProxmoxVE/pull/16660))
+    - openziti-controller: redirect stdin from /dev/null to skip postinst's interactive bootstrap prompt [@MickLesk](https://github.com/MickLesk) ([#16650](https://github.com/community-scripts/ProxmoxVE/pull/16650))
+    - bookorbit: bump default RAM to prevent tsc OOM segfault during nest build [@MickLesk](https://github.com/MickLesk) ([#16649](https://github.com/community-scripts/ProxmoxVE/pull/16649))
+    - immich: split jpegli into its own build step, resolve library revisions dynamically [@MickLesk](https://github.com/MickLesk) ([#16656](https://github.com/community-scripts/ProxmoxVE/pull/16656))
+    - tdarr: make unzip non-interactive to prevent hang [@MickLesk](https://github.com/MickLesk) ([#16648](https://github.com/community-scripts/ProxmoxVE/pull/16648))
+    - immich: fix jpegli patch path after upstream base-images split jpegli from libjxl [@MickLesk](https://github.com/MickLesk) ([#16647](https://github.com/community-scripts/ProxmoxVE/pull/16647))
+
+## 2026-08-20
+
+### 🆕 New Scripts
+
+  - Umbraco ([#16621](https://github.com/community-scripts/ProxmoxVE/pull/16621))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - storyteller: fix build paths for upstream applications/web/ monorepo restructure [@MickLesk](https://github.com/MickLesk) ([#16627](https://github.com/community-scripts/ProxmoxVE/pull/16627))
+    - tubearchivist: add bgutil POT provider and update yt-dlp to nightly [@CrazyWolf13](https://github.com/CrazyWolf13) ([#16622](https://github.com/community-scripts/ProxmoxVE/pull/16622))
+    - networkoptimizer: preseed iperf3 debconf question to prevent hang install  [@MickLesk](https://github.com/MickLesk) ([#16626](https://github.com/community-scripts/ProxmoxVE/pull/16626))
+    - scanopy: limit cargo build parallelism to prevent OOM kill [@MickLesk](https://github.com/MickLesk) ([#16623](https://github.com/community-scripts/ProxmoxVE/pull/16623))
+    - baikal: fall back to composer update when lock doesn't match [@MickLesk](https://github.com/MickLesk) ([#16625](https://github.com/community-scripts/ProxmoxVE/pull/16625))
+
+  - #### 💥 Breaking Changes
+
+    - update: various script to debian 13 [@CrazyWolf13](https://github.com/CrazyWolf13) ([#16525](https://github.com/community-scripts/ProxmoxVE/pull/16525))
+
+### 🧰 Tools
+
+  - #### 🔧 Refactor
+
+    - copyparty: use fetch_and_deploy_gh_release for version tracking [@MickLesk](https://github.com/MickLesk) ([#16624](https://github.com/community-scripts/ProxmoxVE/pull/16624))
+
+## 2026-08-19
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix: clean yarn cache after mealie frontend build to prevent disk growth [@bferd](https://github.com/bferd) ([#16609](https://github.com/community-scripts/ProxmoxVE/pull/16609))
+    - VictoriaMetrics: use github_api_call for release lookups so GITHUB_TOKEN is honored [@angusmaul](https://github.com/angusmaul) ([#16607](https://github.com/community-scripts/ProxmoxVE/pull/16607))
+    - Increase default RAM allocation for Gatus [@rmpratt1](https://github.com/rmpratt1) ([#16601](https://github.com/community-scripts/ProxmoxVE/pull/16601))
+
+## 2026-08-18
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - romm: add missing /decode and /cache Angie locations for multi-file downloads [@MickLesk](https://github.com/MickLesk) ([#16589](https://github.com/community-scripts/ProxmoxVE/pull/16589))
+    - odoo: use patched wkhtmltopdf build [@MickLesk](https://github.com/MickLesk) ([#16590](https://github.com/community-scripts/ProxmoxVE/pull/16590))
+
+  - #### 💥 Breaking Changes
+
+    - Breaking Change: Migrate all "Alpine" Scripts to Normal CT's  [@MickLesk](https://github.com/MickLesk) ([#16587](https://github.com/community-scripts/ProxmoxVE/pull/16587))
+
+## 2026-08-17
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - keycloak: remove invalid ExecStop, kc.sh has no stop subcommand [@MickLesk](https://github.com/MickLesk) ([#16563](https://github.com/community-scripts/ProxmoxVE/pull/16563))
+    - Pin ownfoil release to version 2.3.0 [@MickLesk](https://github.com/MickLesk) ([#16574](https://github.com/community-scripts/ProxmoxVE/pull/16574))
+    - kometa: add git, needed by requirements.txt's git dependency [@MickLesk](https://github.com/MickLesk) ([#16562](https://github.com/community-scripts/ProxmoxVE/pull/16562))
+    - fix romm: deploy EmulatorJS and Ruffle after the frontend build [@angusmaul](https://github.com/angusmaul) ([#16571](https://github.com/community-scripts/ProxmoxVE/pull/16571))
+
+  - #### 🔧 Refactor
+
+    - patchmon: fetch only SCAP datastream XMLs [@MickLesk](https://github.com/MickLesk) ([#16565](https://github.com/community-scripts/ProxmoxVE/pull/16565))
+    - teslamate: use precompiled Elixir [@MickLesk](https://github.com/MickLesk) ([#16561](https://github.com/community-scripts/ProxmoxVE/pull/16561))
+
+## 2026-08-16
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - [FIX] Shelfmark: internal bypasser never starts under the gevent worker [@robbiet480](https://github.com/robbiet480) ([#16495](https://github.com/community-scripts/ProxmoxVE/pull/16495))
+    - tubearchivist: fix: enhance update script [@CrazyWolf13](https://github.com/CrazyWolf13) ([#16521](https://github.com/community-scripts/ProxmoxVE/pull/16521))
+    - tracktor: build with pnpm using upstream's frozen lockfile [@MickLesk](https://github.com/MickLesk) ([#16530](https://github.com/community-scripts/ProxmoxVE/pull/16530))
+    - wallos: run db migration after apache reload on update [@MickLesk](https://github.com/MickLesk) ([#16528](https://github.com/community-scripts/ProxmoxVE/pull/16528))
+
+  - #### 🔧 Refactor
+
+    - networkoptimizer: also build uwnspeedtest binary for server arch [@MickLesk](https://github.com/MickLesk) ([#16531](https://github.com/community-scripts/ProxmoxVE/pull/16531))
+
+### 🗑️ Deleted Scripts
+
+  - Remove: Jeedom [@MickLesk](https://github.com/MickLesk) ([#16536](https://github.com/community-scripts/ProxmoxVE/pull/16536))
+- Remove: Swizzin [@MickLesk](https://github.com/MickLesk) ([#16535](https://github.com/community-scripts/ProxmoxVE/pull/16535))
+- Remove: NocoDB [@MickLesk](https://github.com/MickLesk) ([#16533](https://github.com/community-scripts/ProxmoxVE/pull/16533))
+
+### 💾 Core
+
+  - #### 🔧 Refactor
+
+    - core: skip mount points during backup and clean installs [@MickLesk](https://github.com/MickLesk) ([#16532](https://github.com/community-scripts/ProxmoxVE/pull/16532))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - cronmaster: back up scripts, data and snippets folders on update [@MickLesk](https://github.com/MickLesk) ([#16529](https://github.com/community-scripts/ProxmoxVE/pull/16529))
+
 ## 2026-08-15
 
 ### 🆕 New Scripts

.github/workflows/notify-breaking-change.yml

@@ -0,0 +1,58 @@
+name: Notify breaking change
+
+# When a PR labelled "breaking change" is merged, tell the Helper-Scripts site
+# so it can show a temporary advisory on the affected scripts. The site pulls
+# the PR itself and re-verifies it is merged + labelled, so this workflow only
+# has to hand over the PR number.
+#
+# Requires one repo secret:
+#   BREAKING_CHANGE_INGEST_SECRET  — must match the value the site runs with.
+# Site URL is taken from the existing FRONTEND_URL secret, then an optional
+# SITE_URL variable, then a hard default.
+#
+# pull_request_target (not pull_request) so the run has access to the secret
+# even for fork PRs. It is safe here: the job never checks out or runs PR code —
+# it only forwards the number after the PR has merged.
+
+on:
+  pull_request_target:
+    # closed  -> fires on the merge itself
+    # labeled -> fires if the label is added to an already-merged PR
+    types: [closed, labeled]
+
+concurrency:
+  group: notify-breaking-change-${{ github.event.pull_request.number }}
+  cancel-in-progress: false
+
+jobs:
+  notify:
+    if: >-
+      github.event.pull_request.merged == true &&
+      contains(github.event.pull_request.labels.*.name, 'breaking change')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Notify site of breaking change
+        env:
+          INGEST_SECRET: ${{ secrets.BREAKING_CHANGE_INGEST_SECRET }}
+          SITE_URL: ${{ secrets.FRONTEND_URL || vars.SITE_URL || 'https://community-scripts.org' }}
+          PR: ${{ github.event.pull_request.number }}
+        run: |
+          set -euo pipefail
+          if [ -z "${INGEST_SECRET:-}" ]; then
+            echo "::error::BREAKING_CHANGE_INGEST_SECRET secret is not set."
+            exit 1
+          fi
+          url="${SITE_URL%/}/api/breaking-changes/ingest"
+          echo "Notifying $url for PR #${PR}"
+          status="$(curl -sS -o response.json -w '%{http_code}' \
+            -X POST "$url" \
+            -H "Authorization: Bearer ${INGEST_SECRET}" \
+            -H "Content-Type: application/json" \
+            -d "{\"pr\": ${PR}}")"
+          echo "HTTP $status"
+          cat response.json || true
+          echo
+          if [ "$status" != "200" ]; then
+            echo "::error::ingest endpoint returned HTTP $status"
+            exit 1
+          fi

CHANGELOG.md

@@ -92,6 +92,9 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 
 
+
+
+
 
 
 
@@ -105,7 +108,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 
 <details>
-<summary><h4>August (15 entries)</h4></summary>
+<summary><h4>August (22 entries)</h4></summary>
 
 [View August 2026 Changelog](.github/changelogs/2026/08.md)
 
@@ -524,12 +527,40 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-08-24
+
+## 2026-08-23
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Set default ProxmoxVE raw URL in PVE-UPS & fix var_cpu sorting  [@MickLesk](https://github.com/MickLesk) ([#16689](https://github.com/community-scripts/ProxmoxVE/pull/16689))
+
+## 2026-08-22
+
+### 🆕 New Scripts
+
+  - pve-ups ([#16670](https://github.com/community-scripts/ProxmoxVE/pull/16670))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - docuseal: use DocuSeal's patched PDFium build to fix service start [@MickLesk](https://github.com/MickLesk) ([#16673](https://github.com/community-scripts/ProxmoxVE/pull/16673))
+
+  - #### ✨ New Features
+
+    - update authentik to 2026.8.0 [@thieneret](https://github.com/thieneret) ([#16674](https://github.com/community-scripts/ProxmoxVE/pull/16674))
+
 ## 2026-08-21
 
 ### 🚀 Updated Scripts
 
   - #### 🐞 Bug Fixes
 
+    - wallos: fix: migrations [@CrazyWolf13](https://github.com/CrazyWolf13) ([#16666](https://github.com/community-scripts/ProxmoxVE/pull/16666))
+    - barassistant: fix: compatibility with v6 [@CrazyWolf13](https://github.com/CrazyWolf13) ([#16665](https://github.com/community-scripts/ProxmoxVE/pull/16665))
     - Immichframe: remove settings.yaml UUID placeholder [@MickLesk](https://github.com/MickLesk) ([#16660](https://github.com/community-scripts/ProxmoxVE/pull/16660))
     - openziti-controller: redirect stdin from /dev/null to skip postinst's interactive bootstrap prompt [@MickLesk](https://github.com/MickLesk) ([#16650](https://github.com/community-scripts/ProxmoxVE/pull/16650))
     - bookorbit: bump default RAM to prevent tsc OOM segfault during nest build [@MickLesk](https://github.com/MickLesk) ([#16649](https://github.com/community-scripts/ProxmoxVE/pull/16649))
@@ -1126,171 +1157,4 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### ✨ New Features
 
-    - Bump all Alpine scripts to 3.24 [@asylumexp](https://github.com/asylumexp) ([#15994](https://github.com/community-scripts/ProxmoxVE/pull/15994))
+    - Bump all Alpine scripts to 3.24 [@asylumexp](https://github.com/asylumexp) ([#15994](https://github.com/community-scripts/ProxmoxVE/pull/15994))
-
-## 2026-07-23
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - IronClaw: pin to v0.29.1, 1.0 Reborn CLI/config is incompatible [@MickLesk](https://github.com/MickLesk) ([#15982](https://github.com/community-scripts/ProxmoxVE/pull/15982))
-    - update authentik to 2026.5.6 [@thieneret](https://github.com/thieneret) ([#15973](https://github.com/community-scripts/ProxmoxVE/pull/15973))
-
-  - #### ✨ New Features
-
-    - Cockpit: default to Debian 13, 45Drives now ships Trixie packages | little refactor [@MickLesk](https://github.com/MickLesk) ([#15984](https://github.com/community-scripts/ProxmoxVE/pull/15984))
-    - Paperless-ngx: Support v3 [@tomfrenzel](https://github.com/tomfrenzel) ([#15221](https://github.com/community-scripts/ProxmoxVE/pull/15221))
-
-## 2026-07-22
-
-### 🆕 New Scripts
-
-  - pve-tool: storage share helper script for Proxmox [@MickLesk](https://github.com/MickLesk) ([#15869](https://github.com/community-scripts/ProxmoxVE/pull/15869))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - InvoiceNinja: preserve and Re-download snappdf Chromium [@MickLesk](https://github.com/MickLesk) ([#15956](https://github.com/community-scripts/ProxmoxVE/pull/15956))
-    - Anytype: preserve default mongod.conf when configuring Anytype replica set [@MickLesk](https://github.com/MickLesk) ([#15954](https://github.com/community-scripts/ProxmoxVE/pull/15954))
-    - Nametag: fix missing tailwindcss module [@MickLesk](https://github.com/MickLesk) ([#15955](https://github.com/community-scripts/ProxmoxVE/pull/15955))
-
-  - #### ✨ New Features
-
-    - OPNSense: Bump FreeBSD to 15 and OPNSense to 26.7 [@MickLesk](https://github.com/MickLesk) ([#15943](https://github.com/community-scripts/ProxmoxVE/pull/15943))
-
-### 💾 Core
-
-  - #### ✨ New Features
-
-    - core: add OS mismatch guard for container updates [@MickLesk](https://github.com/MickLesk) ([#15948](https://github.com/community-scripts/ProxmoxVE/pull/15948))
-
-## 2026-07-21
-
-### 🚀 Updated Scripts
-
-  - #### ✨ New Features
-
-    - Pangolin: Bump Version to 1.21.0 [@MickLesk](https://github.com/MickLesk) ([#15938](https://github.com/community-scripts/ProxmoxVE/pull/15938))
-
-  - #### 🔧 Refactor
-
-    - Standardize CT update backup handling [@MickLesk](https://github.com/MickLesk) ([#15937](https://github.com/community-scripts/ProxmoxVE/pull/15937))
-
-## 2026-07-20
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - RomM: use backup helpers in update / clear folder [@MickLesk](https://github.com/MickLesk) ([#15915](https://github.com/community-scripts/ProxmoxVE/pull/15915))
-    - fix: vikunja: asset selection [@CrazyWolf13](https://github.com/CrazyWolf13) ([#15929](https://github.com/community-scripts/ProxmoxVE/pull/15929))
-    - Zammad : bind Elasticsearch to 127.0.0.1 [@MickLesk](https://github.com/MickLesk) ([#15909](https://github.com/community-scripts/ProxmoxVE/pull/15909))
-    - Omada: fix package version extraction [@MickLesk](https://github.com/MickLesk) ([#15908](https://github.com/community-scripts/ProxmoxVE/pull/15908))
-    - fix(wanderer): use PocketBase-relative plugin symlink in unprivileged LXC [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15911](https://github.com/community-scripts/ProxmoxVE/pull/15911))
-
-  - #### ✨ New Features
-
-    - AFFiNE: Bump version to v0.27.2 [@MickLesk](https://github.com/MickLesk) ([#15930](https://github.com/community-scripts/ProxmoxVE/pull/15930))
-
-  - #### 💥 Breaking Changes
-
-    - Gotify: Migration to v3 [@MickLesk](https://github.com/MickLesk) ([#15912](https://github.com/community-scripts/ProxmoxVE/pull/15912))
-
-### 💾 Core
-
-  - #### ✨ New Features
-
-    - core: refactor to single-reporter telemetry and better error_handling [@MickLesk](https://github.com/MickLesk) ([#15933](https://github.com/community-scripts/ProxmoxVE/pull/15933))
-    - tools.func: add support for extracting 7z archives [@MickLesk](https://github.com/MickLesk) ([#15919](https://github.com/community-scripts/ProxmoxVE/pull/15919))
-    - Meilisearch : use dumpless Meilisearch upgrades [@MickLesk](https://github.com/MickLesk) ([#15921](https://github.com/community-scripts/ProxmoxVE/pull/15921))
-
-  - #### 🔧 Refactor
-
-    - core: Improve GPU detection and mapping logic [@MickLesk](https://github.com/MickLesk) ([#15918](https://github.com/community-scripts/ProxmoxVE/pull/15918))
-
-## 2026-07-19
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - change trek repo to liketrek/TREK [@asylumexp](https://github.com/asylumexp) ([#15893](https://github.com/community-scripts/ProxmoxVE/pull/15893))
-    - update authentik to 2026.5.5 [@thieneret](https://github.com/thieneret) ([#15855](https://github.com/community-scripts/ProxmoxVE/pull/15855))
-    - [FIX] BookOrbit: add missing `restore_backup` during update [@vhsdream](https://github.com/vhsdream) ([#15881](https://github.com/community-scripts/ProxmoxVE/pull/15881))
-
-  - #### ✨ New Features
-
-    - tools.func: centralize deploy tail + trap-based tmpdir cleanup [@MickLesk](https://github.com/MickLesk) ([#15872](https://github.com/community-scripts/ProxmoxVE/pull/15872))
-    - Update OPNsense from 26.1 to 26.7 [@tdn131](https://github.com/tdn131) ([#15895](https://github.com/community-scripts/ProxmoxVE/pull/15895))
-
-### 💾 Core
-
-  - Revert "core: add configurable host CA inheritance during bootstrap" [@MickLesk](https://github.com/MickLesk) ([#15886](https://github.com/community-scripts/ProxmoxVE/pull/15886))
-
-  - #### 🐞 Bug Fixes
-
-    - fix(build.func): expand glob in SSH key "Scan Folder/Glob" so it can find keys [@TowyTowy](https://github.com/TowyTowy) ([#15873](https://github.com/community-scripts/ProxmoxVE/pull/15873))
-
-## 2026-07-18
-
-### 💾 Core
-
-  - #### ✨ New Features
-
-    - core: add configurable host CA inheritance during bootstrap [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15840](https://github.com/community-scripts/ProxmoxVE/pull/15840))
-
-  - #### 🔧 Refactor
-
-    - tools.func: Safe Delete Directorys & Update PYTHON_VERSION with setup_uv [@MickLesk](https://github.com/MickLesk) ([#15870](https://github.com/community-scripts/ProxmoxVE/pull/15870))
-
-### 🧰 Tools
-
-  - #### ✨ New Features
-
-    - [tools.update-lxcs] feat: optional reporting success/failures to heathchecks.io (or others) [@sir106](https://github.com/sir106) ([#15701](https://github.com/community-scripts/ProxmoxVE/pull/15701))
-
-## 2026-07-17
-
-### 🆕 New Scripts
-
-  - Invidious ([#15824](https://github.com/community-scripts/ProxmoxVE/pull/15824))
-- OxiCloud ([#15823](https://github.com/community-scripts/ProxmoxVE/pull/15823))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - webtrees: initialize database schema before admin user creation [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15837](https://github.com/community-scripts/ProxmoxVE/pull/15837))
-    - Fix DocuSeal missing Leptonica deps on install and update [@Copilot](https://github.com/Copilot) ([#15858](https://github.com/community-scripts/ProxmoxVE/pull/15858))
-    - apache-guacamole: detect installed extensions during update [@TowyTowy](https://github.com/TowyTowy) ([#15841](https://github.com/community-scripts/ProxmoxVE/pull/15841))
-    - CLIProxyAPI: fix update deleting config.yaml [@austinpilz](https://github.com/austinpilz) ([#15834](https://github.com/community-scripts/ProxmoxVE/pull/15834))
-    - esphome: install libusb-1.0-0 for ESP-IDF native builds [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15838](https://github.com/community-scripts/ProxmoxVE/pull/15838))
-
-  - #### ✨ New Features
-
-    - AFFiNE: Bump to 0.27.0 [@MickLesk](https://github.com/MickLesk) ([#15848](https://github.com/community-scripts/ProxmoxVE/pull/15848))
-    - n8n: unpin / use latest release [@MickLesk](https://github.com/MickLesk) ([#15817](https://github.com/community-scripts/ProxmoxVE/pull/15817))
-    - Pin Opencloud to v7.3.0 [@vhsdream](https://github.com/vhsdream) ([#15826](https://github.com/community-scripts/ProxmoxVE/pull/15826))
-
-  - #### 🔧 Refactor
-
-    - SFTPGo: Update APT Repo & Re-Enable Script [@MickLesk](https://github.com/MickLesk) ([#15829](https://github.com/community-scripts/ProxmoxVE/pull/15829))
-
-### 💾 Core
-
-  - #### ✨ New Features
-
-    - tools.func: enhance rbenv with profile updates / bundle in bashrc [@MickLesk](https://github.com/MickLesk) ([#15822](https://github.com/community-scripts/ProxmoxVE/pull/15822))
-    - feat(build.func): notify users when already on a pinned script version [@michelroegl-brunner](https://github.com/michelroegl-brunner) ([#15819](https://github.com/community-scripts/ProxmoxVE/pull/15819))
-
-  - #### 💥 Breaking Changes
-
-    - MongoDB: Implement kernel version check and patch [@MickLesk](https://github.com/MickLesk) ([#15821](https://github.com/community-scripts/ProxmoxVE/pull/15821))
-
-### 🧰 Tools
-
-  - #### ✨ New Features
-
-    - update-lxc: autoremove and autoclean after apt full-upgrade [@soupy-boy](https://github.com/soupy-boy) ([#15831](https://github.com/community-scripts/ProxmoxVE/pull/15831))

ct/authentik.sh

@@ -32,18 +32,23 @@ function update_script() {
 
   read -r MAJOR MINOR PATCH <<<"$(sed 's/^version\///; s/\./ /g' "$HOME/.authentik")"
 
+  if [[ $MAJOR == 2026 && $MINOR -lt 5 ]]; then
+	msg_error "Updating from version ${MAJOR}.${MINOR}.${PATCH} is not supported. A minimum version of 2026.5.x is required to update. See: https://docs.goauthentik.io/releases/2026.8/"
+	exit
+  fi
+
   msg_info "Update dependencies"
   ensure_dependencies crossbuild-essential-$(arch_resolve) gcc-$(arch_resolve "x86-64" "aarch64")-linux-gnu cmake clang libunwind-18-dev
   msg_ok "Update dependencies"
 
-  NODE_VERSION="24" setup_nodejs
+  NODE_VERSION="26" NODE_MODULE=pnpm@11 setup_nodejs
   setup_go
   $STD uv cache clean
-  UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.6" setup_uv
+  UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.7" setup_uv
   RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
   setup_yq
 
-  AUTHENTIK_VERSION="version/2026.5.6"
+  AUTHENTIK_VERSION="version/2026.8.0"
   # Source: https://github.com/goauthentik/fips/blob/main/Makefile#L26
   XMLSEC_VERSION="1.3.12"
 
@@ -87,30 +92,32 @@ function update_script() {
     msg_ok "Configured rust"
 
     msg_info "Updating web"
-    cd /opt/authentik/web
     export NODE_ENV="production"
-    $STD npm install
+	  cd /opt/authentik
-    $STD npm run build
+	  $STD node ./scripts/node/lint-runtime.mjs ./web
-    $STD npm run build:sfe
+	  cd /opt/authentik/web
+	  $STD pnpm install --frozen-lockfile
+	  $STD pnpm run build
+	  $STD pnpm run build:sfe
     msg_ok "Updated web"
 
-    msg_info "Updating go proxy"
+    msg_info "Updating outposts"
     cd /opt/authentik
+	  mkdir -p /opt/authentik/bin
     export CGO_ENABLED="1"
     export CC="$(arch_resolve "x86_64" "aarch64")-linux-gnu-gcc"
     $STD go mod download
-    $STD go build -o /opt/authentik/authentik-server ./cmd/server
+    $STD go build -o /opt/authentik/bin/ldap ./cmd/ldap
-    $STD go build -o /opt/authentik/ldap ./cmd/ldap
+    $STD go build -o /opt/authentik/bin/rac ./cmd/rac
-    $STD go build -o /opt/authentik/rac ./cmd/rac
+    $STD go build -o /opt/authentik/bin/radius ./cmd/radius
-    $STD go build -o /opt/authentik/radius ./cmd/radius
+    msg_ok "Updated outposts"
-    msg_ok "Updated go proxy"
 
-    msg_info "Building worker. It may take more than 10 minutes, please be patient."
+    msg_info "Building binary. It may take more than 10 minutes, please be patient."
-    export AWS_LC_FIPS_SYS_CC="clang"
+	  export AWS_LC_FIPS_SYS_CC="clang"
-    cd /opt/authentik
+	  cd /opt/authentik
-    $STD cargo build --package authentik --no-default-features --features core --locked --release --jobs 1
+	  $STD cargo build --package authentik --no-default-features --features core --locked --release
-    cp ./target/release/authentik /opt/authentik/authentik-worker
+	  cp ./target/release/authentik /opt/authentik/bin/
-    rm -r ./target
+	  rm -r ./target
     msg_ok "Built worker"
 
     msg_info "Updating python server"
@@ -124,126 +131,47 @@ function update_script() {
     cd /opt/authentik
     for attempt in 1 2 3; do
       if [[ $attempt -eq 3 ]]; then
-        $STD uv sync --frozen --no-install-project --no-dev
+        $STD uv sync --locked --no-install-project --no-dev
         break
       fi
-      $STD uv sync --frozen --no-install-project --no-dev && break
+      $STD uv sync --locked --no-install-project --no-dev && break
       msg_warn "uv sync attempt $attempt failed, retrying..."
       sleep $((attempt * 15))
     done
     chown -R authentik:authentik /opt/authentik
     msg_ok "Updated python server"
 
-    if [[ $MAJOR == 2026 && $MINOR -lt 5 ]]; then
+	  msg_info "Updating Worker and Server config"
-      msg_info "Updating Worker and Server config"
+    cat <<EOF >>/etc/default/authentik-server
-      cp /etc/authentik/config.yml /etc/authentik/config.bak
+RUST_BACKTRACE=full
-      yq -i ".postgresql.conn_max_age = 0" /etc/authentik/config.yml
-      yq -i ".postgresql.conn_health_checks = false" /etc/authentik/config.yml
-      yq -i '.listen.debug_tokio = "[::]:6669"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.console_subscriber = "info"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.h2 = "info"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.hyper_util = "warn"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.mio = "info"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.notify = "info"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.reqwest = "info"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.runtime = "info"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.rustls = "info"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.sqlx = "info"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.sqlx_postgres = "info"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.tokio = "info"' /etc/authentik/config.yml
-      yq -i '.log.rust_log.tungstenite = "info"' /etc/authentik/config.yml
-      yq -i ".web.workers = 2" /etc/authentik/config.yml
-      mv /etc/default/authentik /etc/default/authentik.bak
-      cat <<EOF >/etc/default/authentik-server
-TMPDIR=/dev/shm/
-UV_LINK_MODE=copy
-UV_PYTHON_DOWNLOADS=0
-UV_NATIVE_TLS=1
-VENV_PATH=/opt/authentik/.venv
-PYTHONDONTWRITEBYTECODE=1
-PYTHONUNBUFFERED=1
-PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
-DJANGO_SETTINGS_MODULE=authentik.root.settings
-PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
-AUTHENTIK_LISTEN__HTTP="[::]:9000"
-AUTHENTIK_LISTEN__HTTPS="[::]:9443"
-AUTHENTIK_LISTEN__METRICS="[::]:9300"
 EOF
-      cat <<EOF >/etc/default/authentik-worker
+    cat <<EOF >>/etc/default/authentik-worker
-TMPDIR=/dev/shm/
+RUST_BACKTRACE=full
-UV_LINK_MODE=copy
-UV_PYTHON_DOWNLOADS=0
-UV_NATIVE_TLS=1
-VENV_PATH=/opt/authentik/.venv
-PYTHONDONTWRITEBYTECODE=1
-PYTHONUNBUFFERED=1
-PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
-DJANGO_SETTINGS_MODULE=authentik.root.settings
-PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
-AUTHENTIK_LISTEN__HTTP="[::]:8000"
-AUTHENTIK_LISTEN__HTTPS="[::]:8443"
-AUTHENTIK_LISTEN__METRICS="[::]:8300"
 EOF
-      msg_ok "Updated Worker and Server config!"
+    msg_ok "Updated Worker and Server config!"
-      msg_warn "Please check /etc/default/authentik-worker and /etc/default/authentik-server config files for port configurations!"
 
-      msg_info "Updating services"
+    msg_info "Updating services"
-      cat <<EOF >/etc/systemd/system/authentik-server.service
+	  sed -i "s|ExecStart=/opt/authentik/authentik-server|ExecStart=/opt/authentik/bin/authentik server|g" /etc/systemd/system/authentik-server.service
-[Unit]
+	  sed -i "s|ExecStart=/opt/authentik/authentik-worker worker|ExecStart=/opt/authentik/bin/authentik worker|g" /etc/systemd/system/authentik-worker.service
-Description=authentik Go Server (API Gateway)
+	  sed -i "s|ExecStart=/opt/authentik/ldap|ExecStart=/opt/authentik/bin/ldap|g" /etc/systemd/system/authentik-ldap.service
-After=network.target
+	  sed -i "s|ExecStart=/opt/authentik/radius|ExecStart=/opt/authentik/bin/radius|g" /etc/systemd/system/authentik-radius.service
-Wants=postgresql.service
+	  sed -i "s|ExecStart=/opt/authentik/rac|ExecStart=/opt/authentik/bin/rac|g" /etc/systemd/system/authentik-rac.service
+    systemctl daemon-reload
+    msg_ok "Updated services"
 
-[Service]
+  	msg_info "Starting Services"
-User=authentik
+  	systemctl start authentik-server authentik-worker
-Group=authentik
+  	if [[ $(systemctl is-enabled authentik-ldap) == enabled ]]; then
-ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
+	    systemctl start authentik-ldap
-ExecStart=/opt/authentik/authentik-server
+  	fi
-WorkingDirectory=/opt/authentik/
+  	if [[ $(systemctl is-enabled authentik-rac) == enabled ]]; then
-Restart=always
+	    systemctl start authentik-rac
-RestartSec=5
+  	fi
-EnvironmentFile=/etc/default/authentik-server
+  	if [[ $(systemctl is-enabled authentik-radius) == enabled ]]; then
-
+	    systemctl start authentik-radius
-[Install]
+  	fi
-WantedBy=multi-user.target
+  	msg_ok "Started Services"
-EOF
-
-      cat <<EOF >/etc/systemd/system/authentik-worker.service
-[Unit]
-Description=authentik Worker
-After=network.target postgresql.service
-
-[Service]
-User=authentik
-Group=authentik
-Type=simple
-EnvironmentFile=/etc/default/authentik-worker
-ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
-ExecStart=/opt/authentik/authentik-worker worker
-WorkingDirectory=/opt/authentik
-Restart=always
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-      systemctl daemon-reload
-      msg_ok "Updated services"
-    fi
   fi
-
-  msg_info "Starting Services"
-  systemctl start authentik-server authentik-worker
-  if [[ $(systemctl is-enabled authentik-ldap) == enabled ]]; then
-    systemctl start authentik-ldap
-  fi
-  if [[ $(systemctl is-enabled authentik-rac) == enabled ]]; then
-    systemctl start authentik-rac
-  fi
-  if [[ $(systemctl is-enabled authentik-radius) == enabled ]]; then
-    systemctl start authentik-radius
-  fi
-  msg_ok "Started Services"
   msg_ok "Updated successfully!"
   exit
 }

ct/bar-assistant.sh

@@ -71,13 +71,15 @@ function update_script() {
     systemctl stop nginx
     msg_ok "Stopped nginx"
 
-    fetch_and_deploy_gh_release "vue-salt-rim" "karlomikus/vue-salt-rim" "tarball" "latest" "/opt/vue-salt-rim"
+    NODE_VERSION="22" NODE_MODULE="bun" setup_nodejs
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "vue-salt-rim" "karlomikus/vue-salt-rim" "tarball" "latest" "/opt/vue-salt-rim"
     restore_backup
 
     msg_info "Configuring Vue Salt Rim"
     cd /opt/vue-salt-rim
-    $STD npm install
+    $STD bun install
-    $STD npm run build
+    $STD bun run build
     msg_ok "Configured Vue Salt Rim"
 
     msg_info "Starting nginx"

ct/docker.sh

@@ -9,7 +9,6 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 
 APP="Docker"
 var_tags="${var_tags:-docker}"
-var_cpu="${var_cpu:-2}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
@@ -19,10 +18,12 @@ if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
 fi
 
 if [[ "${var_os:-}" == "alpine" ]]; then
+  var_cpu="${var_cpu:-1}"
   var_ram="${var_ram:-1024}"
   var_disk="${var_disk:-2}"
   var_version="${var_version:-3.24}"
 else
+  var_cpu="${var_cpu:-2}"
   var_ram="${var_ram:-2048}"
   var_disk="${var_disk:-4}"
   var_version="${var_version:-13}"

ct/docuseal.sh

@@ -30,17 +30,15 @@ function update_script() {
     exit
   fi
 
-  # DocuSeal moved to its own patched PDFium build (FPDFPage_GetAnnotCountRaw & co.),
-  # which is only published as a musl binary, so existing installs need it swapped in.
   ensure_dependencies musl
   [[ -f /opt/pdfium/lib/libpdfium.so ]] || rm -f "$HOME/.pdfium"
-  fetch_and_deploy_gh_release "pdfium" "docusealco/pdfium-binaries" "prebuild" "latest" "/opt/pdfium" "pdfium-musl-$(uname -m).zip"
+  fetch_and_deploy_gh_release "pdfium" "docusealco/pdfium-binaries" "prebuild" "latest" "/opt/pdfium" "pdfium-musl-$(arch_resolve "x86_64" "aarch64").zip"
   if ! cmp -s /opt/pdfium/lib/libpdfium.so /usr/lib/libpdfium.so; then
     msg_info "Updating PDFium"
     install -m 644 /opt/pdfium/lib/libpdfium.so /usr/lib/libpdfium.so
-    echo "/usr/lib/$(uname -m)-linux-musl" >/etc/ld.so.conf.d/musl.conf
+    echo "/usr/lib/$(arch_resolve "x86_64" "aarch64")-linux-musl" >/etc/ld.so.conf.d/musl.conf
-    $STD ldconfig
+    ldconfig
-    systemctl restart docuseal docuseal-sidekiq 2>/dev/null || true
+    systemctl restart docuseal docuseal-sidekiq
     msg_ok "Updated PDFium"
   fi
 

ct/forgejo.sh

@@ -9,7 +9,6 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 
 APP="Forgejo"
 var_tags="${var_tags:-git}"
-var_cpu="${var_cpu:-2}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
@@ -19,10 +18,12 @@ if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
 fi
 
 if [[ "${var_os:-}" == "alpine" ]]; then
+  var_cpu="${var_cpu:-1}"
   var_ram="${var_ram:-256}"
   var_disk="${var_disk:-1}"
   var_version="${var_version:-3.24}"
 else
+  var_cpu="${var_cpu:-2}"
   var_ram="${var_ram:-2048}"
   var_disk="${var_disk:-10}"
   var_version="${var_version:-13}"

ct/headers/pve-ups

@@ -0,0 +1,6 @@
+    ____ _    ________     __  ______  _____
+   / __ \ |  / / ____/    / / / / __ \/ ___/
+  / /_/ / | / / __/______/ / / / /_/ /\__ \ 
+ / ____/| |/ / /__/_____/ /_/ / ____/___/ / 
+/_/     |___/_____/     \____/_/    /____/  
+                                            

ct/headers/rockylinux

@@ -0,0 +1,6 @@
+    ____             __            __    _                 
+   / __ \____  _____/ /____  __   / /   (_)___  __  ___  __
+  / /_/ / __ \/ ___/ //_/ / / /  / /   / / __ \/ / / / |/_/
+ / _, _/ /_/ / /__/ ,< / /_/ /  / /___/ / / / / /_/ />  <  
+/_/ |_|\____/\___/_/|_|\__, /  /_____/_/_/ /_/\__,_/_/|_|  
+                      /____/                               

ct/ironclaw.sh

@@ -9,7 +9,6 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 
 APP="IronClaw"
 var_tags="${var_tags:-ai;agent;security}"
-var_cpu="${var_cpu:-2}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
@@ -19,10 +18,12 @@ if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
 fi
 
 if [[ "${var_os:-}" == "alpine" ]]; then
+  var_cpu="${var_cpu:-1}"
   var_ram="${var_ram:-1024}"
   var_disk="${var_disk:-8}"
   var_version="${var_version:-3.24}"
 else
+  var_cpu="${var_cpu:-2}"
   var_ram="${var_ram:-2048}"
   var_disk="${var_disk:-8}"
   var_version="${var_version:-13}"

ct/pve-ups.sh

@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: CrazyWolf13
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/ffind-dev/pve-ups
+
+APP="PVE-UPS"
+var_tags="${var_tags:-proxmox;ups;monitoring;network}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-512}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-no}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/pve-usv ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "pve-usv" "ffind-dev/pve-ups"; then
+    msg_info "Stopping Services"
+    systemctl stop pve-usv pve-usv-agent.path pve-usv-agent.timer
+    msg_ok "Stopped Services"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "pve-usv" "ffind-dev/pve-ups" "tarball"
+
+    msg_info "Updating Application"
+    cd /opt/pve-usv
+    $STD uv venv --clear venv
+    $STD uv pip install --python venv/bin/python .
+    chown -R pveusv:pveusv /opt/pve-usv
+    chmod 0755 deploy/pve-usv-agent.sh
+    install -m 0644 deploy/pve-usv.service /etc/systemd/system/pve-usv.service
+    install -m 0644 deploy/pve-usv-agent.service /etc/systemd/system/pve-usv-agent.service
+    install -m 0644 deploy/pve-usv-agent.path /etc/systemd/system/pve-usv-agent.path
+    install -m 0644 deploy/pve-usv-agent.timer /etc/systemd/system/pve-usv-agent.timer
+    systemctl daemon-reload
+    msg_ok "Updated Application"
+
+    msg_info "Starting Services"
+    systemctl start pve-usv pve-usv-agent.path pve-usv-agent.timer
+    msg_ok "Started Services"
+    msg_ok "Updated ${APP}"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:8080${CL}"

ct/rockylinux.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+_CS_DEFAULT_URL="https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main"
+_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
+source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://rockylinux.org/
+
+APP="Rocky Linux"
+var_tags="${var_tags:-os}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-512}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-rockylinux}"
+var_version="${var_version:-10}"
+#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+  if [[ ! -d /var ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+  msg_info "Updating Rocky Linux LXC"
+  $STD dnf -y upgrade
+  msg_ok "Updated Rocky Linux LXC"
+  msg_ok "Completed successfully!"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!\n"
+msg_custom "🚀" "${GN}" "${APP} setup has been successfully initialized!"

ct/syncthing.sh

@@ -9,7 +9,6 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 
 APP="Syncthing"
 var_tags="${var_tags:-sync}"
-var_cpu="${var_cpu:-2}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
@@ -19,10 +18,12 @@ if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
 fi
 
 if [[ "${var_os:-}" == "alpine" ]]; then
+  var_cpu="${var_cpu:-1}"
   var_ram="${var_ram:-256}"
   var_disk="${var_disk:-1}"
   var_version="${var_version:-3.24}"
 else
+  var_cpu="${var_cpu:-2}"
   var_ram="${var_ram:-2048}"
   var_disk="${var_disk:-8}"
   var_version="${var_version:-13}"

ct/transmission.sh

@@ -9,7 +9,6 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 
 APP="Transmission"
 var_tags="${var_tags:-torrent}"
-var_cpu="${var_cpu:-2}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
@@ -19,10 +18,12 @@ if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
 fi
 
 if [[ "${var_os:-}" == "alpine" ]]; then
+  var_cpu="${var_cpu:-1}"
   var_ram="${var_ram:-256}"
   var_disk="${var_disk:-1}"
   var_version="${var_version:-3.24}"
 else
+  var_cpu="${var_cpu:-2}"
   var_ram="${var_ram:-2048}"
   var_disk="${var_disk:-8}"
   var_version="${var_version:-13}"

ct/vaultwarden.sh

@@ -9,7 +9,6 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 
 APP="Vaultwarden"
 var_tags="${var_tags:-password-manager}"
-var_cpu="${var_cpu:-4}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-1}"
 if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
@@ -19,10 +18,12 @@ if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
 fi
 
 if [[ "${var_os:-}" == "alpine" ]]; then
+  var_cpu="${var_cpu:-1}"
   var_ram="${var_ram:-256}"
   var_disk="${var_disk:-1}"
   var_version="${var_version:-3.24}"
 else
+  var_cpu="${var_cpu:-4}"
   var_ram="${var_ram:-6144}"
   var_disk="${var_disk:-20}"
   var_version="${var_version:-13}"

ct/wallos.sh

@@ -55,7 +55,8 @@ function update_script() {
     msg_ok "Apache2 Reloaded"
 
     msg_info "Running Database Migration"
-    $STD curl http://localhost/endpoints/db/migrate.php
+    cd /opt/wallos
+    $STD sudo -u www-data php /opt/wallos/endpoints/db/migrate.php
     msg_ok "Ran Database Migration"
     msg_ok "Updated successfully!"
   fi

ct/zigbee2mqtt.sh

@@ -9,7 +9,6 @@ source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_
 
 APP="Zigbee2MQTT"
 var_tags="${var_tags:-smarthome;zigbee;mqtt}"
-var_cpu="${var_cpu:-2}"
 var_arm64="${var_arm64:-yes}"
 var_unprivileged="${var_unprivileged:-0}"
 if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
@@ -19,10 +18,12 @@ if [[ -z "${var_os:-}" ]] && command -v pveversion >/dev/null 2>&1; then
 fi
 
 if [[ "${var_os:-}" == "alpine" ]]; then
+  var_cpu="${var_cpu:-1}"
   var_ram="${var_ram:-256}"
   var_disk="${var_disk:-1}"
   var_version="${var_version:-3.24}"
 else
+  var_cpu="${var_cpu:-2}"
   var_ram="${var_ram:-1024}"
   var_disk="${var_disk:-5}"
   var_version="${var_version:-13}"

install/authentik-install.sh

@@ -50,16 +50,16 @@ $STD apt install -y \
   git
 msg_ok "Installed Dependencies"
 
-NODE_VERSION="24" setup_nodejs
+NODE_VERSION="26" NODE_MODULE=pnpm@11 setup_nodejs
 setup_yq
 setup_go
 RUST_PROFILE="minimal" RUST_TOOLCHAIN="stable" setup_rust
-UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.6" setup_uv
+UV_PYTHON_INSTALL_DIR="/usr/local/bin" PYTHON_VERSION="3.14.7" setup_uv
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="authentik" PG_DB_USER="authentik" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db
 
 XMLSEC_VERSION="1.3.12"
-AUTHENTIK_VERSION="version/2026.5.6"
+AUTHENTIK_VERSION="version/2026.8.0"
 fetch_and_deploy_gh_release "xmlsec" "lsh123/xmlsec" "tarball" "${XMLSEC_VERSION}" "/opt/xmlsec"
 fetch_and_deploy_gh_release "authentik" "goauthentik/authentik" "tarball" "${AUTHENTIK_VERSION}" "/opt/authentik"
 fetch_and_deploy_gh_release "geoipupdate" "maxmind/geoipupdate" "binary"
@@ -80,23 +80,25 @@ $STD rustup default "$(sed -n 's/channel = "\(.*\)"/\1/p' rust-toolchain.toml)"
 msg_ok "Configured rust"
 
 msg_info "Setting up web"
-cd /opt/authentik/web
 export NODE_ENV="production"
-$STD npm install
+cd /opt/authentik
-$STD npm run build
+$STD node ./scripts/node/lint-runtime.mjs ./web
-$STD npm run build:sfe
+cd /opt/authentik/web
+$STD pnpm install --frozen-lockfile
+$STD pnpm run build
+$STD pnpm run build:sfe
 msg_ok "Setup web"
 
-msg_info "Setting up go proxy"
+msg_info "Building outposts"
 cd /opt/authentik
+mkdir -p /opt/authentik/bin
 export CGO_ENABLED="1"
 export CC="$(arch_resolve "x86_64" "aarch64")-linux-gnu-gcc"
 $STD go mod download
-$STD go build -o /opt/authentik/authentik-server ./cmd/server
+$STD go build -o /opt/authentik/bin/ldap ./cmd/ldap
-$STD go build -o /opt/authentik/ldap ./cmd/ldap
+$STD go build -o /opt/authentik/bin/rac ./cmd/rac
-$STD go build -o /opt/authentik/rac ./cmd/rac
+$STD go build -o /opt/authentik/bin/radius ./cmd/radius
-$STD go build -o /opt/authentik/radius ./cmd/radius
+msg_ok "Built outposts"
-msg_ok "Setup go proxy"
 
 cat <<EOF >/usr/local/etc/GeoIP.conf
 AccountID ChangeME
@@ -109,13 +111,13 @@ EOF
 
 echo "#39 19 * * 6,4 /usr/bin/geoipupdate -f /usr/local/etc/GeoIP.conf" | crontab -
 
-msg_info "Building worker. It may take more than 10 minutes, please be patient."
+msg_info "Building binary. It may take more than 10 minutes, please be patient."
 export AWS_LC_FIPS_SYS_CC="clang"
 cd /opt/authentik
-$STD cargo build --package authentik --no-default-features --features core --locked --release --jobs 1
+$STD cargo build --package authentik --no-default-features --features core --locked --release
-cp ./target/release/authentik /opt/authentik/authentik-worker
+cp ./target/release/authentik /opt/authentik/bin/
 rm -r ./target
-msg_ok "Built worker"
+msg_ok "Built binary"
 
 msg_info "Setting up python server"
 export UV_NO_BINARY_PACKAGE="cryptography lxml python-kadmin-rs xmlsec"
@@ -127,10 +129,10 @@ export UV_PYTHON_INSTALL_DIR="/usr/local/bin"
 cd /opt/authentik
 for attempt in 1 2 3; do
   if [[ $attempt -eq 3 ]]; then
-    $STD uv sync --frozen --no-install-project --no-dev
+    $STD uv sync --locked --no-install-project --no-dev
     break
   fi
-  $STD uv sync --frozen --no-install-project --no-dev && break
+  $STD uv sync --locked --no-install-project --no-dev && break
   msg_warn "uv sync attempt $attempt failed, retrying..."
   sleep $((attempt * 15))
 done
@@ -159,6 +161,7 @@ UV_NATIVE_TLS=1
 VENV_PATH=/opt/authentik/.venv
 PYTHONDONTWRITEBYTECODE=1
 PYTHONUNBUFFERED=1
+RUST_BACKTRACE=full
 PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
 DJANGO_SETTINGS_MODULE=authentik.root.settings
 PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
@@ -174,6 +177,7 @@ UV_NATIVE_TLS=1
 VENV_PATH=/opt/authentik/.venv
 PYTHONDONTWRITEBYTECODE=1
 PYTHONUNBUFFERED=1
+RUST_BACKTRACE=full
 PATH=/opt/authentik/lifecycle:/opt/authentik/.venv/bin:/usr/local/bin:/usr/local/sbin:/usr/sbin:/usr/bin:/sbin:/bin
 DJANGO_SETTINGS_MODULE=authentik.root.settings
 PROMETHEUS_MULTIPROC_DIR="/tmp/authentik_prometheus_tmp"
@@ -201,7 +205,7 @@ msg_ok "Created authentik config"
 msg_info "Creating services"
 cat <<EOF >/etc/systemd/system/authentik-server.service
 [Unit]
-Description=authentik Go Server (API Gateway)
+Description=authentik Server
 After=network.target
 Wants=postgresql.service
 
@@ -210,7 +214,7 @@ User=authentik
 Group=authentik
 EnvironmentFile=/etc/default/authentik-server
 ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
-ExecStart=/opt/authentik/authentik-server
+ExecStart=/opt/authentik/bin/authentik server
 WorkingDirectory=/opt/authentik/
 Restart=always
 RestartSec=5
@@ -230,7 +234,7 @@ Group=authentik
 Type=simple
 EnvironmentFile=/etc/default/authentik-worker
 ExecStartPre=/usr/bin/mkdir -p "\${PROMETHEUS_MULTIPROC_DIR}"
-ExecStart=/opt/authentik/authentik-worker worker
+ExecStart=/opt/authentik/bin/authentik worker
 WorkingDirectory=/opt/authentik
 Restart=always
 RestartSec=5
@@ -248,7 +252,7 @@ Wants=postgresql.service
 [Service]
 User=authentik
 Group=authentik
-ExecStart=/opt/authentik/ldap
+ExecStart=/opt/authentik/bin/ldap
 WorkingDirectory=/opt/authentik/
 Restart=always
 RestartSec=5
@@ -267,7 +271,7 @@ Wants=postgresql.service
 [Service]
 User=authentik
 Group=authentik
-ExecStart=/opt/authentik/rac
+ExecStart=/opt/authentik/bin/rac
 WorkingDirectory=/opt/authentik/
 Restart=always
 RestartSec=5
@@ -286,7 +290,7 @@ Wants=postgresql.service
 [Service]
 User=authentik
 Group=authentik
-ExecStart=/opt/authentik/radius
+ExecStart=/opt/authentik/bin/radius
 WorkingDirectory=/opt/authentik/
 Restart=always
 RestartSec=5

install/bar-assistant-install.sh

@@ -25,7 +25,7 @@ msg_ok "Installed Dependencies"
 
 PHP_VERSION="8.4" PHP_FPM="YES" PHP_MODULE="pdo-sqlite" setup_php
 setup_composer
-NODE_VERSION="22" setup_nodejs
+NODE_VERSION="22" NODE_MODULE="bun" setup_nodejs
 setup_meilisearch
 fetch_and_deploy_gh_release "bar-assistant" "karlomikus/bar-assistant" "tarball" "latest" "/opt/bar-assistant"
 fetch_and_deploy_gh_release "vue-salt-rim" "karlomikus/vue-salt-rim" "tarball" "latest" "/opt/vue-salt-rim"
@@ -68,8 +68,8 @@ window.srConfig = {}
 window.srConfig.API_URL = "http://${LOCAL_IP}/bar"
 window.srConfig.MEILISEARCH_URL = "http://${LOCAL_IP}/search"
 EOF
-$STD npm install
+$STD bun install
-$STD npm run build
+$STD bun run build
 msg_ok "Installed Salt Rim"
 
 msg_info "Creating Service"

install/docuseal-install.sh

@@ -50,15 +50,12 @@ ln -sf /opt/fonts/GoNotoKurrent-Bold.ttf /usr/share/fonts/noto/
 $STD fc-cache -f
 msg_ok "Downloaded Fonts"
 
-# DocuSeal calls PDFium functions that only exist in its own patched build
+fetch_and_deploy_gh_release "pdfium" "docusealco/pdfium-binaries" "prebuild" "latest" "/opt/pdfium" "pdfium-musl-$(arch_resolve "x86_64" "aarch64").zip"
-# (FPDFPage_GetAnnotCountRaw & co.), so the upstream binaries are used. They are
-# only published as musl builds, which need the musl runtime to be loadable.
-fetch_and_deploy_gh_release "pdfium" "docusealco/pdfium-binaries" "prebuild" "latest" "/opt/pdfium" "pdfium-musl-$(uname -m).zip"
 
 msg_info "Installing PDFium"
 install -m 644 /opt/pdfium/lib/libpdfium.so /usr/lib/libpdfium.so
-echo "/usr/lib/$(uname -m)-linux-musl" >/etc/ld.so.conf.d/musl.conf
+echo "/usr/lib/$(arch_resolve "x86_64" "aarch64")-linux-musl" >/etc/ld.so.conf.d/musl.conf
-$STD ldconfig
+ldconfig
 msg_ok "Installed PDFium"
 
 fetch_and_deploy_gh_release "docuseal" "docusealco/docuseal" "tarball"

install/pve-ups-install.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: CrazyWolf13
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/ffind-dev/pve-ups
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+setup_uv
+
+fetch_and_deploy_gh_release "pve-usv" "ffind-dev/pve-ups" "tarball"
+
+msg_info "Setting up Application"
+useradd --system --home /opt/pve-usv --shell /usr/sbin/nologin pveusv
+install -d -o pveusv -g pveusv -m 0750 \
+  /etc/pve-usv \
+  /var/lib/pve-usv \
+  /var/lib/pve-usv/agent \
+  /var/lib/pve-usv/agent/queue \
+  /var/lib/pve-usv/updates
+chown -R pveusv:pveusv /opt/pve-usv
+cd /opt/pve-usv
+$STD uv venv --clear venv
+$STD uv pip install --python venv/bin/python .
+chmod 0755 deploy/pve-usv-agent.sh
+msg_ok "Set up Application"
+
+msg_info "Creating Services"
+install -m 0644 /opt/pve-usv/deploy/pve-usv.service /etc/systemd/system/pve-usv.service
+install -m 0644 /opt/pve-usv/deploy/pve-usv-agent.service /etc/systemd/system/pve-usv-agent.service
+install -m 0644 /opt/pve-usv/deploy/pve-usv-agent.path /etc/systemd/system/pve-usv-agent.path
+install -m 0644 /opt/pve-usv/deploy/pve-usv-agent.timer /etc/systemd/system/pve-usv-agent.timer
+systemctl enable -q --now pve-usv pve-usv-agent.path pve-usv-agent.timer
+msg_ok "Created Services"
+
+motd_ssh
+customize
+cleanup_lxc

install/rockylinux-install.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://rockylinux.org/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+motd_ssh
+customize
+cleanup_lxc

install/wallos-install.sh

@@ -40,7 +40,7 @@ EOF
 $STD a2ensite wallos.conf
 $STD a2dissite 000-default.conf
 $STD systemctl restart apache2
-$STD curl http://localhost/endpoints/db/migrate.php
+$STD sudo -u www-data php /opt/wallos/endpoints/db/migrate.php
 msg_ok "Installed Wallos"
 
 msg_info "Setting up Crontabs"

misc/build.func

@@ -1208,10 +1208,12 @@ base_settings() {
 # - Used by default_var_settings and app defaults loading
 # - Only loads whitelisted var_* keys
 # - Optional force parameter to override existing values (for app defaults)
+# - Optional protected list preserves genuinely user-exported var_* values
 # ------------------------------------------------------------------------------
 load_vars_file() {
   local file="$1"
-  local force="${2:-no}" # If "yes", override existing variables
+  local force="${2:-no}"      # If "yes", override existing variables
+  local protected="${3:-}"    # space-separated var_* keys the user genuinely exported before this file loaded; never overwritten
   [ -f "$file" ] || return 0
   msg_info "Loading defaults from ${file}"
 
@@ -1231,6 +1233,13 @@ load_vars_file() {
     return 1
   }
 
+  # Protected check helper (genuinely user-exported vars, see $protected above)
+  _is_protected() {
+    local k="$1" p
+    for p in $protected; do [ "$k" = "$p" ] && return 0; done
+    return 1
+  }
+
   local line key val
   while IFS= read -r line || [ -n "$line" ]; do
     line="${line#"${line%%[![:space:]]*}"}"
@@ -1435,9 +1444,19 @@ load_vars_file() {
         esac
       fi
 
-      # Set variable: force mode overrides existing, otherwise only set if empty
+      # Set variable: force mode overrides existing, otherwise only set if empty.
+      # Exception: var_cpu/var_ram/var_disk are always applied here (unless the
+      # user genuinely exported them beforehand, per $protected) even though the
+      # app script already declared its own baseline for them - base_settings()
+      # reconciles the final floor against APP_DEFAULT_* afterward, so this file
+      # must be allowed to raise them instead of being silently blocked by the
+      # app's own pre-set value.
       if [[ "$force" == "yes" ]]; then
         export "${var_key}=${var_val}"
+      elif _is_protected "$var_key"; then
+        :
+      elif [[ "$var_key" == "var_cpu" || "$var_key" == "var_ram" || "$var_key" == "var_disk" ]]; then
+        export "${var_key}=${var_val}"
       else
         [[ -z "${!var_key+x}" ]] && export "${var_key}=${var_val}"
       fi
@@ -1597,7 +1616,7 @@ EOF
     msg_error "default.vars not found after ensure step"
     return 252
   }
-  load_vars_file "$dv"
+  load_vars_file "$dv" "no" "${!_HARD_ENV[*]}"
 
   # 3) Map var_verbose → VERBOSE
   if [[ -n "${var_verbose:-}" ]]; then