reitti: update to v5

CHANGELOG.md

@@ -499,27 +499,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
-## 2026-07-09
-
-### 🚀 Updated Scripts
-
-  - fix(pihole): repair Unbound DNS-over-TLS (DoT) forwarding config [@TowyTowy](https://github.com/TowyTowy) ([#15654](https://github.com/community-scripts/ProxmoxVE/pull/15654))
-
-## 2026-07-08
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Opencloud: Bump version to 7.2.1 [@vhsdream](https://github.com/vhsdream) ([#15655](https://github.com/community-scripts/ProxmoxVE/pull/15655))
-    - BabyBuddy: Harden update script [@MickLesk](https://github.com/MickLesk) ([#15642](https://github.com/community-scripts/ProxmoxVE/pull/15642))
-
-## 2026-07-07
-
-### 🆕 New Scripts
-
-  - Forgejo-Runner ([#15046](https://github.com/community-scripts/ProxmoxVE/pull/15046))
-
 ## 2026-07-06
 
 ### 🚀 Updated Scripts
@@ -529,7 +508,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
   - #### 🐞 Bug Fixes
 
-    - Wizarr: Build JS and CSS static assets [@vhsdream](https://github.com/vhsdream) ([#15634](https://github.com/community-scripts/ProxmoxVE/pull/15634))
     - RustDesk Server: Update URL format in rustdeskserver.sh [@tremor021](https://github.com/tremor021) ([#15626](https://github.com/community-scripts/ProxmoxVE/pull/15626))
     - attempt to port docker-vm to support arm64 [@asylumexp](https://github.com/asylumexp) ([#15611](https://github.com/community-scripts/ProxmoxVE/pull/15611))
     - fix(plane): don't clobber global app var, breaking /usr/bin/update [@asylumexp](https://github.com/asylumexp) ([#15612](https://github.com/community-scripts/ProxmoxVE/pull/15612))
@@ -538,10 +516,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
     - cliproxyapi: point setup message at /management.html [@austinpilz](https://github.com/austinpilz) ([#15628](https://github.com/community-scripts/ProxmoxVE/pull/15628))
 
-### 🗑️ Deleted Scripts
-
-  - Remove: FlowiseAI [@MickLesk](https://github.com/MickLesk) ([#15624](https://github.com/community-scripts/ProxmoxVE/pull/15624))
-
 ## 2026-07-05
 
 ### 🆕 New Scripts

ct/babybuddy.sh

@@ -40,8 +40,7 @@ function update_script() {
     create_backup /opt/babybuddy/babybuddy/settings/production.py
 
     msg_info "Cleaning old files"
-    cd /opt/babybuddy || exit
-    find . -mindepth 1 -maxdepth 1 ! -name '.venv' -exec rm -rf -- {} +
+    find . -mindepth 1 -maxdepth 1 ! -name '.venv' -exec rm -rf {} +
     msg_ok "Cleaned old files"
 
     fetch_and_deploy_gh_release "babybuddy" "babybuddy/babybuddy" "tarball"
@@ -52,7 +51,6 @@ function update_script() {
     source .venv/bin/activate
     $STD uv pip install -r requirements.txt
     export DJANGO_SETTINGS_MODULE=babybuddy.settings.production
-    $STD python manage.py makemigrations
     $STD python manage.py migrate
     msg_ok "Updated ${APP}"
 

ct/flowiseai.sh

@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 tteck
+# Author: tteck (tteckster)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://flowiseai.com/ | Github: https://github.com/FlowiseAI/Flowise
+
+APP="FlowiseAI"
+var_tags="${var_tags:-low-code}"
+var_disk="${var_disk:-10}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-4096}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_arm64="${var_arm64:-yes}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+  if [[ ! -f /etc/systemd/system/flowise.service ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  NODE_VERSION="22" NODE_MODULE="pnpm" setup_nodejs
+
+  msg_info "Updating FlowiseAI (this may take some time)"
+  systemctl stop flowise
+  $STD pnpm add -g flowise
+  if grep -q 'ExecStart=npx flowise start' /etc/systemd/system/flowise.service; then
+    sed -i 's|ExecStart=npx flowise start|ExecStart=flowise start|' /etc/systemd/system/flowise.service
+    systemctl daemon-reload
+  fi
+  systemctl start flowise
+  msg_ok "Updated FlowiseAI"
+  msg_ok "Updated successfully!"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW}Access it using the following URL:${CL}"
+echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"

ct/forgejo-runner.sh

@@ -1,79 +0,0 @@
-#!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: Simon Friedrich (lengschder97)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://forgejo.org/
-
-APP="Forgejo-Runner"
-var_tags="${var_tags:-ci}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
-var_disk="${var_disk:-8}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
-var_unprivileged="${var_unprivileged:-1}"
-var_nesting="${var_nesting:-1}"
-var_keyctl="${var_keyctl:-1}"
-
-export var_forgejo_instance="${var_forgejo_instance:-}"
-export var_forgejo_runner_token="${var_forgejo_runner_token:-}"
-export var_runner_labels="${var_runner_labels:-}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -f /usr/local/bin/forgejo-runner ]]; then
-    msg_error "No ${APP} installation found!"
-    exit 1
-  fi
-
-  RELEASE=$(curl -fsSL https://data.forgejo.org/api/v1/repos/forgejo/runner/releases/latest | grep -oP '"tag_name":\s*"\K[^"]+' | sed 's/^v//')
-  if [[ "${RELEASE}" == "$(cat ~/.forgejo-runner 2>/dev/null)" ]]; then
-    msg_ok "No update required. ${APP} is already at v${RELEASE}"
-    exit
-  fi
-
-  msg_info "Stopping Services"
-  systemctl stop forgejo-runner
-  msg_ok "Stopped Services"
-
-  msg_info "Updating Forgejo Runner to v${RELEASE}"
-  curl -fsSL "https://code.forgejo.org/forgejo/runner/releases/download/v${RELEASE}/forgejo-runner-${RELEASE}-linux-$(arch_resolve)" -o /usr/local/bin/forgejo-runner
-  chmod +x /usr/local/bin/forgejo-runner
-  echo "${RELEASE}" >~/.forgejo-runner
-  msg_ok "Updated Forgejo Runner"
-
-  msg_info "Starting Services"
-  systemctl start forgejo-runner
-  msg_ok "Started Services"
-  msg_ok "Updated successfully!"
-  exit
-}
-
-if [[ -n "${mode:-}" ]]; then
-  if [[ -z "${var_forgejo_instance:-}" ]]; then
-    msg_error "var_forgejo_instance is required for unattended installs."
-    exit 1
-  fi
-  if [[ -z "${var_forgejo_runner_token:-}" ]]; then
-    msg_error "var_forgejo_runner_token is required for unattended installs."
-    exit 1
-  fi
-fi
-
-start
-build_container
-description
-
-msg_ok "Completed successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} After first boot, check your Forgejo Instance for the new Runner.${CL}"

ct/headers/flowiseai

@@ -0,0 +1,6 @@
+    ________              _           ___    ____
+   / ____/ /___ _      __(_)_______  /   |  /  _/
+  / /_  / / __ \ | /| / / / ___/ _ \/ /| |  / /  
+ / __/ / / /_/ / |/ |/ / (__  )  __/ ___ |_/ /   
+/_/   /_/\____/|__/|__/_/____/\___/_/  |_/___/   
+                                                 

ct/headers/forgejo-runner

@@ -1,6 +0,0 @@
-    ______                        _             ____                             
-   / ____/___  _________ ____    (_)___        / __ \__  ______  ____  ___  _____
-  / /_  / __ \/ ___/ __ `/ _ \  / / __ \______/ /_/ / / / / __ \/ __ \/ _ \/ ___/
- / __/ / /_/ / /  / /_/ /  __/ / / /_/ /_____/ _, _/ /_/ / / / / / / /  __/ /    
-/_/    \____/_/   \__, /\___/_/ /\____/     /_/ |_|\__,_/_/ /_/_/ /_/\___/_/     
-                 /____/    /___/                                                 

ct/opencloud.sh

@@ -30,7 +30,7 @@ function update_script() {
     exit
   fi
 
-  RELEASE="v7.2.1"
+  RELEASE="v7.2.0"
   if check_for_gh_release "OpenCloud" "opencloud-eu/opencloud" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
     msg_info "Stopping services"
     systemctl stop opencloud opencloud-wopi

ct/reitti.sh

@@ -106,13 +106,6 @@ spring.servlet.multipart.max-file-size=5GB
 spring.servlet.multipart.max-request-size=5GB
 server.tomcat.max-part-count=100
 
-# Rqueue configuration
-rqueue.web.enable=false
-rqueue.job.enabled=false
-rqueue.message.durability.in-terminal-state=0
-rqueue.key.prefix=\${spring.cache.redis.key-prefix}
-rqueue.message.converter.provider.class=com.dedicatedcode.reitti.config.RQueueCustomMessageConverter
-
 # Application-specific settings
 reitti.server.advertise-uri=
 
@@ -168,6 +161,81 @@ PROPEOF
     msg_ok "Rewrote application.properties (backup: application.properties.bak)"
   fi
 
+  # Migrate v4 -> v5: Remove Rqueue configuration (replaced by Quartz Scheduler)
+  if grep -q "^rqueue\." /opt/reitti/application.properties 2>/dev/null; then
+    msg_info "Migrating to v5: Removing Rqueue configuration"
+    sed -i '/^# Rqueue configuration$/d; /^rqueue\./d' /opt/reitti/application.properties
+    msg_ok "Removed Rqueue configuration"
+  fi
+
+  # Migrate v4 -> v5: Update application.properties and nginx tile cache for v5 compatibility
+  if grep -q "^reitti\.process-data\.schedule=" /opt/reitti/application.properties 2>/dev/null; then
+    msg_info "Migrating to v5: Updating application.properties"
+    sed -i '/^reitti\.process-data\.schedule=/d' /opt/reitti/application.properties
+    sed -i 's/^reitti\.import\.processing-idle-start-time=.*/reitti.import.grace-time-seconds=30/' /opt/reitti/application.properties
+    sed -i 's/^spring\.datasource\.hikari\.maximum-pool-size=20$/spring.datasource.hikari.maximum-pool-size=30/' /opt/reitti/application.properties
+    grep -q "devices" /opt/reitti/application.properties || \
+      sed -i 's/^spring\.cache\.cache-names=\(.*\)$/spring.cache.cache-names=\1,devices,mapStyles,mapStyleJson/' /opt/reitti/application.properties
+    grep -q "org.quartz.core.ErrorLogger" /opt/reitti/application.properties || \
+      sed -i '/^logging\.level\.com\.dedicatedcode\.reitti=/a logging.level.org.quartz.core.ErrorLogger=FATAL' /opt/reitti/application.properties
+    grep -q "^spring.servlet.multipart.resolve-lazily=" /opt/reitti/application.properties || \
+      sed -i '/^spring\.servlet\.multipart\.max-request-size=/a spring.servlet.multipart.resolve-lazily=true' /opt/reitti/application.properties
+    grep -q "^spring.mvc.async.request-timeout=" /opt/reitti/application.properties || \
+      echo "spring.mvc.async.request-timeout=600000" >>/opt/reitti/application.properties
+    if ! grep -q "^spring.quartz" /opt/reitti/application.properties; then
+      cat >>/opt/reitti/application.properties <<'QUARTZEOF'
+
+# Quartz Scheduler configuration
+spring.quartz.job-store-type=jdbc
+spring.quartz.jdbc.initialize-schema=never
+spring.quartz.properties.org.quartz.jobStore.driverDelegateClass=org.quartz.impl.jdbcjobstore.PostgreSQLDelegate
+spring.quartz.properties.org.quartz.jobStore.isClustered=false
+spring.quartz.properties.org.quartz.jobStore.tablePrefix=qrtz_
+spring.quartz.properties.org.quartz.threadPool.threadCount=5
+QUARTZEOF
+    fi
+    grep -q "^reitti.import.staging.cleanup.cron=" /opt/reitti/application.properties || \
+      echo "reitti.import.staging.cleanup.cron=0 0 4 * * *" >>/opt/reitti/application.properties
+    grep -q "^reitti.batching.max-batch-size=" /opt/reitti/application.properties || \
+      printf "reitti.batching.max-batch-size=100\nreitti.batching.max-wait-time=5\n" >>/opt/reitti/application.properties
+    grep -q "^reitti.jobs.cleanup.cron=" /opt/reitti/application.properties || \
+      printf "reitti.jobs.cleanup.cron=0 0 4 * * ?\nreitti.jobs.cleanup.max-age-hours=24\n" >>/opt/reitti/application.properties
+    grep -q "^reitti.db-janitor.schedule=" /opt/reitti/application.properties || \
+      echo "reitti.db-janitor.schedule=0 0 4 * * ?" >>/opt/reitti/application.properties
+    msg_ok "Updated application.properties for v5"
+
+    if [[ -f /etc/nginx/nginx.conf ]]; then
+      msg_info "Migrating to v5: Updating nginx tile cache configuration"
+      cp /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bak.v5
+      cat >/etc/nginx/nginx.conf <<'NGINXEOF'
+user www-data;
+
+events {
+  worker_connections 1024;
+}
+http {
+  resolver 1.1.1.1 8.8.8.8 valid=30s ipv6=off;
+  proxy_cache_path /var/cache/nginx/tiles levels=1:2 keys_zone=tiles:10m max_size=1g inactive=30d use_temp_path=off;
+  server {
+    listen 80;
+    location /custom/ {
+      set $upstream_url $http_x_reitti_upstream_url;
+      proxy_pass $upstream_url;
+      proxy_set_header Host $proxy_host;
+      proxy_set_header User-Agent "Reitti/1.0";
+      proxy_cache tiles;
+      proxy_cache_key $upstream_url;
+      proxy_cache_valid 200 30d;
+      proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
+    }
+  }
+}
+NGINXEOF
+      systemctl reload nginx
+      msg_ok "Updated nginx tile cache configuration"
+    fi
+  fi
+
   if check_for_gh_release "reitti" "dedicatedcode/reitti"; then
     msg_info "Stopping Service"
     systemctl stop reitti
@@ -179,10 +247,12 @@ PROPEOF
     USE_ORIGINAL_FILENAME="true" fetch_and_deploy_gh_release "reitti" "dedicatedcode/reitti" "singlefile" "latest" "/opt/reitti" "reitti-app.jar"
     mv /opt/reitti/reitti-*.jar /opt/reitti/reitti.jar
 
+    msg_warn "v5 runs a one-time database migration on first start (GPS points → device table). This may take several minutes on large datasets — do not interrupt the container."
     msg_info "Starting Service"
     systemctl start reitti
     msg_ok "Started Service"
     msg_ok "Updated successfully!"
+    msg_warn "Post-upgrade: Verify each API token has a Device assigned in Settings → API Tokens. Tokens without a device cannot ingest location data in v5."
   fi
   exit
 }

ct/wizarr.sh

@@ -50,38 +50,20 @@ function update_script() {
     $STD /usr/local/bin/uv sync --frozen
     $STD /usr/local/bin/uv run --frozen pybabel compile -d app/translations
     $STD npm --prefix app/static install
-    $STD npm --prefix app/static run build
+    $STD npm --prefix app/static run build:css
     mkdir -p ./.cache
     $STD tar -xf "$BACKUP_FILE" --directory=/
-    if grep -q 'bind' /opt/wizarr/start.sh; then
-      WIZARR_PORT=$(awk -F: '{print $2}' /opt/wizarr/start.sh | awk -F' ' '{print $1}' | tr -d '[:space:]')
+    if grep -q 'workers' /opt/wizarr/start.sh; then
+      sed -i 's/--workers 4//' /opt/wizarr/start.sh
     fi
-    sed -i -E -e 's/[[:space:]]+/ /g' \
-      -e 's/--workers 4//' \
-      -e 's/--bind 0.0.0.0:[0-9]+//' /opt/wizarr/start.sh
-    KEYS=("FLASK" "WORKERS" "HOST" "PORT")
-    for key in "${KEYS[@]}"; do
-      if ! grep -q "$key" /opt/wizarr/.env; then
-        cat <<EOF >/opt/wizarr/.env
-APP_URL=http://${LOCAL_IP}
-DISABLE_BUILTIN_AUTH=false
+    if ! grep -qE 'FLASK|WORKERS|VERSION' /opt/wizarr/.env; then
+      cat <<EOF >/opt/wizarr/.env
 FLASK_ENV=production
 GUNICORN_WORKERS=4
-HOST=0.0.0.0
-PORT=${WIZARR_PORT:-5690}
-LOG_LEVEL=info
-APP_VERSION=$(cat ~/.wizarr)
+APP_VERSION=$(sed 's/^20/v&/' ~/.wizarr)
 EOF
-      fi
-      continue
-    done
-    sed -i "s/_VERSION=.*$/_VERSION=$(cat ~/.wizarr)/" /opt/wizarr/.env
-    if grep -q 'abnormal' /etc/systemd/system/wizarr.service; then
-      sed -i 's/on-abnormal/always \
-RestartSec=10 \
-KillMode=mixed \
-TimeoutStopSec=10/' /etc/systemd/system/wizarr.service
-      systemctl daemon-reload
+    else
+      sed -i "s/_VERSION=v.*$/_VERSION=v$(cat ~/.wizarr)/" /opt/wizarr/.env
     fi
     rm -rf "$BACKUP_FILE"
     export FLASK_SKIP_SCHEDULER=true

install/flowiseai-install.sh

@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 tteck
+# Author: tteck (tteckster)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://flowiseai.com/ | Github: https://github.com/FlowiseAI/Flowise
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  build-essential \
+  pkg-config
+msg_ok "Installed Dependencies"
+
+PYTHON_VERSION="3.11" setup_uv
+NODE_VERSION="22" NODE_MODULE="pnpm" setup_nodejs
+
+msg_info "Installing FlowiseAI (Patience)"
+PYTHON_BIN="$(uv python find 3.11)"
+export npm_config_python="$PYTHON_BIN"
+$STD pnpm add -g flowise
+mkdir -p /opt/flowiseai
+curl -fsSL "https://raw.githubusercontent.com/FlowiseAI/Flowise/main/packages/server/.env.example" -o "/opt/flowiseai/.env"
+msg_ok "Installed FlowiseAI"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/flowise.service
+[Unit]
+Description=FlowiseAI
+After=network.target
+
+[Service]
+EnvironmentFile=/opt/flowiseai/.env
+ExecStart=flowise start
+Restart=always
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now flowise
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/forgejo-runner-install.sh

@@ -1,114 +0,0 @@
-#!/usr/bin/env bash
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: Simon Friedrich (lengschder97)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://forgejo.org/
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-setup_yq
-
-if [[ -z "${var_forgejo_instance:-}" ]]; then
-  read -r -p "${TAB3}Forgejo Instance URL (e.g. https://codeberg.org): " var_forgejo_instance
-  var_forgejo_instance="${var_forgejo_instance:-https://codeberg.org}"
-fi
-
-if [[ -z "${var_forgejo_runner_uuid:-}" ]]; then
-  read -r -p "${TAB3}Forgejo Runner UUID: " var_forgejo_runner_uuid
-fi
-
-if [[ -z "${var_forgejo_runner_uuid:-}" ]]; then
-  msg_error "No runner UUID provided. Cannot continue."
-  exit 1
-fi
-
-if [[ -z "${var_forgejo_runner_token:-}" ]]; then
-  read -r -p "${TAB3}Forgejo Runner Token: " var_forgejo_runner_token
-fi
-
-if [[ -z "${var_forgejo_runner_token:-}" ]]; then
-  msg_error "No runner registration token provided. Cannot continue."
-  exit 1
-fi
-
-DEFAULT_RUNNER_LABELS="linux-amd64:docker://node:22-bookworm"
-if [[ -z "${var_runner_labels:-}" ]]; then
-  read -r -p "${TAB3}Additional runner labels (comma-separated, or leave blank for default only): " var_runner_labels
-fi
-if [[ -n "${var_runner_labels:-}" ]]; then
-  RUNNER_LABELS="${DEFAULT_RUNNER_LABELS},${var_runner_labels}"
-else
-  RUNNER_LABELS="${DEFAULT_RUNNER_LABELS}"
-fi
-
-export FORGEJO_INSTANCE="$var_forgejo_instance"
-export FORGEJO_RUNNER_TOKEN="$var_forgejo_runner_token"
-export FORGEJO_RUNNER_UUID="$var_forgejo_runner_uuid"
-export RUNNER_LABELS
-
-msg_info "Installing dependencies"
-$STD apt install -y \
-  git \
-  podman podman-docker
-msg_ok "Installed dependencies"
-
-msg_info "Enabling Podman socket"
-systemctl enable --now podman.socket
-msg_ok "Enabled Podman socket"
-
-msg_info "Installing Forgejo Runner"
-RUNNER_VERSION=$(curl -fsSL https://data.forgejo.org/api/v1/repos/forgejo/runner/releases/latest | jq -r .name | sed 's/^v//')
-curl -fsSL "https://code.forgejo.org/forgejo/runner/releases/download/v${RUNNER_VERSION}/forgejo-runner-${RUNNER_VERSION}-linux-$(arch_resolve)" -o /usr/local/bin/forgejo-runner
-chmod +x /usr/local/bin/forgejo-runner
-echo "${RUNNER_VERSION}" >~/.forgejo-runner
-msg_ok "Installed Forgejo Runner"
-
-msg_info "Registering Forgejo Runner"
-export DOCKER_HOST="unix:///run/podman/podman.sock"
-
-msg_info "Generating Forgejo Runner Configuration"
-mkdir -p /etc/forgejo-runner
-CONFIG_FILE="/etc/forgejo-runner/config.yaml"
-forgejo-runner generate-config > $CONFIG_FILE
-yq -i '
-  .container.docker_host = strenv(DOCKER_HOST) |
-  .server.connections.forgejo.url = strenv(FORGEJO_INSTANCE) |
-  .server.connections.forgejo.uuid = strenv(FORGEJO_RUNNER_UUID) |
-  .server.connections.forgejo.token = strenv(FORGEJO_RUNNER_TOKEN) |
-  .server.connections.forgejo.labels = (strenv(RUNNER_LABELS) | split(",") | map(select(length > 0)))
-  ' $CONFIG_FILE
-msg_ok "Generated Forgejo Runner Configuration"
-
-
-msg_info "Creating Services"
-cat <<EOF >/etc/systemd/system/forgejo-runner.service
-[Unit]
-Description=Forgejo Runner
-Documentation=https://forgejo.org/docs/latest/admin/actions/
-After=podman.socket
-Requires=podman.socket
-
-[Service]
-User=root
-WorkingDirectory=/root
-Environment=DOCKER_HOST=unix:///run/podman/podman.sock
-ExecStart=/usr/local/bin/forgejo-runner daemon -c $CONFIG_FILE
-Restart=on-failure
-RestartSec=10
-TimeoutSec=0
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now forgejo-runner
-msg_ok "Created Services"
-
-motd_ssh
-customize
-cleanup_lxc

install/opencloud-install.sh

@@ -64,7 +64,7 @@ $STD sudo -u cool coolconfig set-admin-password --user=admin --password="$COOLPA
 echo "$COOLPASS" >~/.coolpass
 msg_ok "Installed Collabora Online"
 
-fetch_and_deploy_gh_release "OpenCloud" "opencloud-eu/opencloud" "singlefile" "v7.2.1" "/usr/bin" "opencloud-*-linux-$(arch_resolve)"
+fetch_and_deploy_gh_release "OpenCloud" "opencloud-eu/opencloud" "singlefile" "v7.2.0" "/usr/bin" "opencloud-*-linux-$(arch_resolve)"
 mv /usr/bin/OpenCloud /usr/bin/opencloud
 
 msg_info "Configuring OpenCloud"

install/pihole-install.sh

@@ -119,8 +119,7 @@ edns-packet-max=1232
 EOF
 
   if [[ ${prompt,,} =~ ^(y|yes)$ ]]; then
-    cat <<EOF >>/etc/unbound/unbound.conf.d/pi-hole.conf
-server:
+    cat <<EOF >/etc/unbound/unbound.conf.d/pi-hole.conf
   tls-cert-bundle: "/etc/ssl/certs/ca-certificates.crt"
 forward-zone:
   name: "."

install/reitti-install.sh

@@ -30,27 +30,30 @@ mv /opt/reitti/reitti-*.jar /opt/reitti/reitti.jar
 
 msg_info "Installing Nginx Tile Cache"
 mkdir -p /var/cache/nginx/tiles
-cat <<EOF >/etc/nginx/nginx.conf
+cat <<'NGINXEOF' >/etc/nginx/nginx.conf
 user www-data;
 
 events {
   worker_connections 1024;
 }
 http {
+  resolver 1.1.1.1 8.8.8.8 valid=30s ipv6=off;
   proxy_cache_path /var/cache/nginx/tiles levels=1:2 keys_zone=tiles:10m max_size=1g inactive=30d use_temp_path=off;
   server {
     listen 80;
-    location / {
-      proxy_pass https://tile.openstreetmap.org/;
-      proxy_set_header Host tile.openstreetmap.org;
+    location /custom/ {
+      set $upstream_url $http_x_reitti_upstream_url;
+      proxy_pass $upstream_url;
+      proxy_set_header Host $proxy_host;
       proxy_set_header User-Agent "Reitti/1.0";
       proxy_cache tiles;
+      proxy_cache_key $upstream_url;
       proxy_cache_valid 200 30d;
       proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
     }
   }
 }
-EOF
+NGINXEOF
 chown -R www-data:www-data /var/cache/nginx
 chmod -R 750 /var/cache/nginx
 systemctl restart nginx
@@ -71,6 +74,7 @@ server.compression.mime-types=text/plain,application/json
 logging.level.root=INFO
 logging.level.org.hibernate.engine.jdbc.spi.SqlExceptionHelper=FATAL
 logging.level.com.dedicatedcode.reitti=INFO
+logging.level.org.quartz.core.ErrorLogger=FATAL
 
 # Internationalization
 spring.messages.basename=messages
@@ -82,7 +86,7 @@ spring.messages.fallback-to-system-locale=false
 spring.datasource.url=jdbc:postgresql://127.0.0.1:5432/$PG_DB_NAME
 spring.datasource.username=$PG_DB_USER
 spring.datasource.password=$PG_DB_PASS
-spring.datasource.hikari.maximum-pool-size=20
+spring.datasource.hikari.maximum-pool-size=30
 
 # Redis configuration
 spring.data.redis.host=127.0.0.1
@@ -92,20 +96,23 @@ spring.data.redis.password=
 spring.data.redis.database=0
 spring.cache.redis.key-prefix=
 
-spring.cache.cache-names=processed-visits,significant-places,users,magic-links,configurations,transport-mode-configs,avatarThumbnails,avatarData,user-settings
+spring.cache.cache-names=processed-visits,significant-places,users,magic-links,configurations,transport-mode-configs,avatarThumbnails,avatarData,user-settings,devices,mapStyles,mapStyleJson
 spring.cache.redis.time-to-live=1d
 
 # Upload configuration
 spring.servlet.multipart.max-file-size=5GB
 spring.servlet.multipart.max-request-size=5GB
+spring.servlet.multipart.resolve-lazily=true
 server.tomcat.max-part-count=100
+spring.mvc.async.request-timeout=600000
 
-# Rqueue configuration
-rqueue.web.enable=false
-rqueue.job.enabled=false
-rqueue.message.durability.in-terminal-state=0
-rqueue.key.prefix=\${spring.cache.redis.key-prefix}
-rqueue.message.converter.provider.class=com.dedicatedcode.reitti.config.RQueueCustomMessageConverter
+# Quartz Scheduler configuration
+spring.quartz.job-store-type=jdbc
+spring.quartz.jdbc.initialize-schema=never
+spring.quartz.properties.org.quartz.jobStore.driverDelegateClass=org.quartz.impl.jdbcjobstore.PostgreSQLDelegate
+spring.quartz.properties.org.quartz.jobStore.isClustered=false
+spring.quartz.properties.org.quartz.jobStore.tablePrefix=qrtz_
+spring.quartz.properties.org.quartz.threadPool.threadCount=5
 
 # Application-specific settings
 reitti.server.advertise-uri=
@@ -117,18 +124,25 @@ reitti.security.oidc.enabled=false
 reitti.security.oidc.registration.enabled=false
 
 reitti.import.batch-size=10000
-reitti.import.processing-idle-start-time=10
+reitti.import.grace-time-seconds=30
+reitti.import.staging.cleanup.cron=0 0 4 * * *
+
+reitti.batching.max-batch-size=100
+reitti.batching.max-wait-time=5
 
 reitti.geo-point-filter.max-speed-kmh=1000
 reitti.geo-point-filter.max-accuracy-meters=100
 reitti.geo-point-filter.history-lookback-hours=24
 reitti.geo-point-filter.window-size=50
 
-reitti.process-data.schedule=0 */10 * * * *
 reitti.process-data.refresh-views.schedule=0 0 4 * * *
 reitti.imports.schedule=0 5/10 * * * *
 reitti.imports.owntracks-recorder.schedule=\${reitti.imports.schedule}
 
+reitti.jobs.cleanup.cron=0 0 4 * * ?
+reitti.jobs.cleanup.max-age-hours=24
+reitti.db-janitor.schedule=0 0 4 * * ?
+
 # Geocoding service configuration
 reitti.geocoding.max-errors=10
 reitti.geocoding.photon.base-url=

install/wizarr-install.sh

@@ -27,17 +27,15 @@ cd /opt/wizarr
 $STD /usr/local/bin/uv sync --frozen
 $STD /usr/local/bin/uv run --frozen pybabel compile -d app/translations
 $STD npm --prefix app/static install
-$STD npm --prefix app/static run build
+$STD npm --prefix app/static run build:css
 mkdir -p ./.cache
 cat <<EOF >/opt/wizarr/.env
 FLASK_ENV=production
 GUNICORN_WORKERS=4
 APP_URL=http://${LOCAL_IP}
-HOST=0.0.0.0
-PORT=5690
 DISABLE_BUILTIN_AUTH=false
 LOG_LEVEL=INFO
-APP_VERSION=$(get_latest_github_release "wizarrrr/wizarr")
+APP_VERSION=v$(get_latest_github_release "wizarrrr/wizarr")
 EOF
 
 cat <<EOF >/opt/wizarr/start.sh
@@ -46,6 +44,7 @@ cat <<EOF >/opt/wizarr/start.sh
 uv run --frozen gunicorn \
     --config gunicorn.conf.py \
     --preload \
+    --bind 0.0.0.0:5690 \
     --umask 007 \
     run:app
 EOF
@@ -63,10 +62,7 @@ Type=simple
 WorkingDirectory=/opt/wizarr
 EnvironmentFile=/opt/wizarr/.env
 ExecStart=/opt/wizarr/start.sh
-Restart=always
-RestartSec=10
-KillMode=mixed
-TimeoutStopSec=10
+Restart=on-abnormal
 
 [Install]
 WantedBy=multi-user.target

misc/tools.func

@@ -125,6 +125,67 @@ curl_with_retry() {
   fi
 }
 
+# ------------------------------------------------------------------------------
+# Robust curl wrapper for API calls (returns HTTP code + body)
+#
+# Usage:
+#   response=$(curl_api_with_retry "https://api.github.com/repos/owner/repo/releases/latest")
+#   http_code=$(curl_api_with_retry "https://api.github.com/..." "/tmp/body.json")
+#
+# Parameters:
+#   $1 - URL to call
+#   $2 - (optional) Output file for body (default: stdout)
+#   $3 - (optional) Additional curl options as string
+#
+# Returns: HTTP status code, body in file or stdout
+# ------------------------------------------------------------------------------
+curl_api_with_retry() {
+  local url="$1"
+  local body_file="${2:-}"
+  local extra_opts="${3:-}"
+  local retries="${CURL_RETRIES:-3}"
+  local timeout="${CURL_TIMEOUT:-60}"
+  local connect_timeout="${CURL_CONNECT_TO:-10}"
+
+  local attempt=1
+  local http_code=""
+
+  while [[ $attempt -le $retries ]]; do
+    debug_log "curl API attempt $attempt/$retries: $url"
+
+    local curl_cmd="curl -fsSL --connect-timeout $connect_timeout --max-time $timeout -w '%{http_code}'"
+    [[ -n "$extra_opts" ]] && curl_cmd="$curl_cmd $extra_opts"
+
+    if [[ -n "$body_file" ]]; then
+      http_code=$($curl_cmd -o "$body_file" "$url" 2>/dev/null) || true
+    else
+      # Capture body and http_code separately
+      local tmp_body="/tmp/curl_api_body_$$"
+      http_code=$($curl_cmd -o "$tmp_body" "$url" 2>/dev/null) || true
+      if [[ -f "$tmp_body" ]]; then
+        cat "$tmp_body"
+        rm -f "$tmp_body"
+      fi
+    fi
+
+    # Success on 2xx codes
+    if [[ "$http_code" =~ ^2[0-9]{2}$ ]]; then
+      debug_log "curl API successful: $url (HTTP $http_code)"
+      echo "$http_code"
+      return 0
+    fi
+
+    debug_log "curl API attempt $attempt failed (HTTP $http_code, timeout=${timeout}s), waiting ${attempt}s..."
+    sleep "$attempt"
+    # Double --max-time on each retry so slow connections can finish
+    timeout=$((timeout * 2))
+    ((attempt++))
+  done
+
+  debug_log "curl API FAILED after $retries attempts: $url"
+  echo "$http_code"
+  return 7
+}
 
 # ------------------------------------------------------------------------------
 # Download and install GPG key with retry logic and validation
@@ -256,6 +317,15 @@ cache_installed_version() {
   echo "$version" >"/var/cache/app-versions/${app}_version.txt"
 }
 
+get_cached_version() {
+  local app="$1"
+  mkdir -p /var/cache/app-versions
+  if [[ -f "/var/cache/app-versions/${app}_version.txt" ]]; then
+    cat "/var/cache/app-versions/${app}_version.txt"
+    return 0
+  fi
+  return 1
+}
 
 # ------------------------------------------------------------------------------
 # Clean up ALL keyring locations for a tool (unified helper)
@@ -1572,6 +1642,14 @@ codeberg_api_call() {
   return 22
 }
 
+should_upgrade() {
+  local current="$1"
+  local target="$2"
+
+  [[ -z "$current" ]] && return 0
+  version_gt "$target" "$current" && return 0
+  return 1
+}
 
 # ------------------------------------------------------------------------------
 # Get OS information (cached for performance)
@@ -1724,6 +1802,200 @@ get_fallback_suite() {
   return 0
 }
 
+# ------------------------------------------------------------------------------
+# Verify package source and version
+# ------------------------------------------------------------------------------
+verify_package_source() {
+  local package="$1"
+  local expected_version="$2"
+
+  if apt-cache policy "$package" 2>/dev/null | grep -q "$expected_version"; then
+    return 0
+  fi
+  return 1
+}
+
+# ------------------------------------------------------------------------------
+# Check if running on LTS version
+# ------------------------------------------------------------------------------
+is_lts_version() {
+  local os_id=$(get_os_info id)
+  local codename=$(get_os_info codename)
+
+  if [[ "$os_id" == "ubuntu" ]]; then
+    case "$codename" in
+    focal | jammy | noble) return 0 ;; # 20.04, 22.04, 24.04
+    *) return 1 ;;
+    esac
+  elif [[ "$os_id" == "debian" ]]; then
+    # Debian releases are all "stable"
+    case "$codename" in
+    bullseye | bookworm | trixie) return 0 ;;
+    *) return 1 ;;
+    esac
+  fi
+
+  return 1
+}
+
+# ------------------------------------------------------------------------------
+# Get optimal number of parallel jobs (cached)
+# Features:
+#   - CPU count detection
+#   - Memory-based limiting (1.5GB per job for safety)
+#   - Current load awareness
+#   - Container/VM detection for conservative limits
+# ------------------------------------------------------------------------------
+get_parallel_jobs() {
+  if [[ -z "${_PARALLEL_JOBS:-}" ]]; then
+    local cpu_count
+    cpu_count=$(nproc 2>/dev/null || grep -c ^processor /proc/cpuinfo 2>/dev/null || echo 1)
+
+    local mem_mb
+    mem_mb=$(free -m 2>/dev/null | awk '/^Mem:/{print $2}' || echo 1024)
+
+    # Assume 1.5GB per compilation job for safety margin
+    local max_by_mem=$((mem_mb / 1536))
+    ((max_by_mem < 1)) && max_by_mem=1
+
+    # Check current system load - reduce jobs if already loaded
+    local load_1m
+    load_1m=$(awk '{print int($1)}' /proc/loadavg 2>/dev/null || echo 0)
+    local available_cpus=$((cpu_count - load_1m))
+    ((available_cpus < 1)) && available_cpus=1
+
+    # Take minimum of: available CPUs, memory-limited, and total CPUs
+    local max_jobs=$cpu_count
+    ((max_by_mem < max_jobs)) && max_jobs=$max_by_mem
+    ((available_cpus < max_jobs)) && max_jobs=$available_cpus
+
+    # Container detection - be more conservative in containers
+    if [[ -f /.dockerenv ]] || grep -q 'lxc\|docker\|container' /proc/1/cgroup 2>/dev/null; then
+      # Reduce by 25% in containers to leave headroom
+      max_jobs=$((max_jobs * 3 / 4))
+      ((max_jobs < 1)) && max_jobs=1
+    fi
+
+    # Final bounds check
+    ((max_jobs < 1)) && max_jobs=1
+    ((max_jobs > cpu_count)) && max_jobs=$cpu_count
+
+    export _PARALLEL_JOBS=$max_jobs
+    debug_log "Parallel jobs: $_PARALLEL_JOBS (CPUs: $cpu_count, mem-limit: $max_by_mem, load: $load_1m)"
+  fi
+  echo "$_PARALLEL_JOBS"
+}
+
+# ------------------------------------------------------------------------------
+# Get default PHP version for OS
+# Updated for latest distro releases
+# ------------------------------------------------------------------------------
+get_default_php_version() {
+  local os_id
+  os_id=$(get_os_info id)
+  local os_version
+  os_version=$(get_os_version_major)
+
+  case "$os_id" in
+  debian)
+    case "$os_version" in
+    14) echo "8.4" ;; # Debian 14 (Forky) - future
+    13) echo "8.3" ;; # Debian 13 (Trixie)
+    12) echo "8.2" ;; # Debian 12 (Bookworm)
+    11) echo "7.4" ;; # Debian 11 (Bullseye)
+    *) echo "8.3" ;;  # Default to latest stable
+    esac
+    ;;
+  ubuntu)
+    case "$os_version" in
+    26) echo "8.4" ;; # Ubuntu 26.04 - future
+    24) echo "8.3" ;; # Ubuntu 24.04 LTS (Noble)
+    22) echo "8.1" ;; # Ubuntu 22.04 LTS (Jammy)
+    20) echo "7.4" ;; # Ubuntu 20.04 LTS (Focal)
+    *) echo "8.3" ;;  # Default to latest stable
+    esac
+    ;;
+  *)
+    echo "8.3"
+    ;;
+  esac
+}
+
+# ------------------------------------------------------------------------------
+# Get default Python version for OS
+# Updated for latest distro releases
+# ------------------------------------------------------------------------------
+get_default_python_version() {
+  local os_id
+  os_id=$(get_os_info id)
+  local os_version
+  os_version=$(get_os_version_major)
+
+  case "$os_id" in
+  debian)
+    case "$os_version" in
+    14) echo "3.13" ;; # Debian 14 (Forky) - future
+    13) echo "3.12" ;; # Debian 13 (Trixie)
+    12) echo "3.11" ;; # Debian 12 (Bookworm)
+    11) echo "3.9" ;;  # Debian 11 (Bullseye)
+    *) echo "3.12" ;;  # Default to latest stable
+    esac
+    ;;
+  ubuntu)
+    case "$os_version" in
+    26) echo "3.13" ;; # Ubuntu 26.04 - future
+    24) echo "3.12" ;; # Ubuntu 24.04 LTS
+    22) echo "3.10" ;; # Ubuntu 22.04 LTS
+    20) echo "3.8" ;;  # Ubuntu 20.04 LTS
+    *) echo "3.12" ;;  # Default to latest stable
+    esac
+    ;;
+  *)
+    echo "3.12"
+    ;;
+  esac
+}
+
+# ------------------------------------------------------------------------------
+# Get default Node.js LTS version
+# ------------------------------------------------------------------------------
+get_default_nodejs_version() {
+  # Current LTS as of January 2026 (Node.js 24 LTS)
+  echo "24"
+}
+
+# ------------------------------------------------------------------------------
+# Check if package manager is locked
+# ------------------------------------------------------------------------------
+is_apt_locked() {
+  if fuser /var/lib/dpkg/lock-frontend &>/dev/null ||
+    fuser /var/lib/apt/lists/lock &>/dev/null ||
+    fuser /var/cache/apt/archives/lock &>/dev/null; then
+    return 0
+  fi
+  return 1
+}
+
+# ------------------------------------------------------------------------------
+# Wait for apt to be available
+# ------------------------------------------------------------------------------
+wait_for_apt() {
+  local max_wait="${1:-300}" # 5 minutes default
+  local waited=0
+
+  while is_apt_locked; do
+    if [[ $waited -ge $max_wait ]]; then
+      msg_error "Timeout waiting for apt to be available"
+      msg_error "Hint: Another process (apt, dpkg, unattended-upgrades) may hold a lock. Check: ps aux | grep -E 'apt|dpkg'"
+      return 100
+    fi
+
+    sleep 5
+    waited=$((waited + 5))
+  done
+
+  return 0
+}
 
 # ------------------------------------------------------------------------------
 # Cleanup old repository files (migration helper)
@@ -1926,6 +2198,22 @@ setup_deb822_repo() {
   fi
 }
 
+# ------------------------------------------------------------------------------
+# Package version hold/unhold helpers
+# ------------------------------------------------------------------------------
+hold_package_version() {
+  local package="$1"
+  $STD apt-mark hold "$package" || {
+    msg_warn "Failed to hold package version: ${package}"
+  }
+}
+
+unhold_package_version() {
+  local package="$1"
+  $STD apt-mark unhold "$package" || {
+    msg_warn "Failed to unhold package version: ${package}"
+  }
+}
 
 # ------------------------------------------------------------------------------
 # Safe service restart with verification
@@ -1971,6 +2259,41 @@ safe_service_restart() {
   return 150
 }
 
+# ------------------------------------------------------------------------------
+# Enable and start service (with error handling)
+# ------------------------------------------------------------------------------
+enable_and_start_service() {
+  local service="$1"
+
+  if ! systemctl enable "$service" &>/dev/null; then
+    msg_error "Failed to enable service: $service"
+    return 150
+  fi
+
+  if ! systemctl start "$service" &>/dev/null; then
+    msg_error "Failed to start $service"
+    systemctl status "$service" --no-pager
+    return 150
+  fi
+
+  return 0
+}
+
+# ------------------------------------------------------------------------------
+# Check if service is enabled
+# ------------------------------------------------------------------------------
+is_service_enabled() {
+  local service="$1"
+  systemctl is-enabled --quiet "$service" 2>/dev/null
+}
+
+# ------------------------------------------------------------------------------
+# Check if service is running
+# ------------------------------------------------------------------------------
+is_service_running() {
+  local service="$1"
+  systemctl is-active --quiet "$service" 2>/dev/null
+}
 
 # ------------------------------------------------------------------------------
 # Extract version from JSON (GitHub releases)
@@ -2116,6 +2439,42 @@ get_latest_codeberg_release() {
   echo "$version"
 }
 
+# ------------------------------------------------------------------------------
+# Debug logging - using main debug_log function (line 40)
+# Supports both TOOLS_DEBUG and DEBUG environment variables
+# ------------------------------------------------------------------------------
+
+# ------------------------------------------------------------------------------
+# Performance timing helper
+# ------------------------------------------------------------------------------
+start_timer() {
+  echo $(date +%s)
+}
+
+end_timer() {
+  local start_time="$1"
+  local label="${2:-Operation}"
+  local end_time=$(date +%s)
+  local duration=$((end_time - start_time))
+}
+
+# ------------------------------------------------------------------------------
+# GPG key fingerprint verification
+# ------------------------------------------------------------------------------
+verify_gpg_fingerprint() {
+  local key_file="$1"
+  local expected_fingerprint="$2"
+
+  local actual_fingerprint
+  actual_fingerprint=$(gpg --show-keys --with-fingerprint --with-colons "$key_file" 2>&1 | grep -m1 '^fpr:' | cut -d: -f10)
+
+  if [[ "$actual_fingerprint" == "$expected_fingerprint" ]]; then
+    return 0
+  fi
+
+  msg_error "GPG fingerprint mismatch! Expected: $expected_fingerprint, Got: $actual_fingerprint"
+  return 65
+}
 
 # ------------------------------------------------------------------------------
 # Fetches and deploys a GitHub tag-based source tarball.
@@ -2642,6 +3001,38 @@ create_self_signed_cert() {
   chmod 644 "$CERT_CRT"
 }
 
+# ------------------------------------------------------------------------------
+# Downloads file with optional progress indicator using pv.
+#
+# Arguments:
+#   $1 - URL
+#   $2 - Destination path
+# ------------------------------------------------------------------------------
+
+download_with_progress() {
+  local url="$1"
+  local output="$2"
+  if [ -n "$SPINNER_PID" ] && ps -p "$SPINNER_PID" >/dev/null; then kill "$SPINNER_PID" >/dev/null; fi
+
+  ensure_dependencies pv
+  set -o pipefail
+
+  # Content-Length aus HTTP-Header holen
+  local content_length
+  content_length=$(curl -fsSLI "$url" | awk '/Content-Length/ {print $2}' | tr -d '\r' || true)
+
+  if [[ -z "$content_length" ]]; then
+    if ! curl -fL# -o "$output" "$url"; then
+      msg_error "Download failed: $url"
+      return 7
+    fi
+  else
+    if ! curl -fsSL "$url" | pv -s "$content_length" >"$output"; then
+      msg_error "Download failed: $url"
+      return 7
+    fi
+  fi
+}
 
 # ------------------------------------------------------------------------------
 # Ensures /usr/local/bin is permanently in system PATH.
@@ -5941,6 +6332,117 @@ setup_java() {
   msg_ok "Setup Temurin JDK $JAVA_VERSION"
 }
 
+# ------------------------------------------------------------------------------
+# Installs a local IP updater script using networkd-dispatcher.
+#
+# Description:
+#   - Stores current IP in /run/local-ip.env
+#   - Automatically runs on network changes
+# ------------------------------------------------------------------------------
+
+setup_local_ip_helper() {
+  local BASE_DIR="/usr/local/community-scripts/ip-management"
+  local SCRIPT_PATH="$BASE_DIR/update_local_ip.sh"
+  local IP_FILE="/run/local-ip.env"
+  local DISPATCHER_SCRIPT="/etc/networkd-dispatcher/routable.d/10-update-local-ip.sh"
+
+  # Check if already set up
+  if [[ -f "$SCRIPT_PATH" && -f "$DISPATCHER_SCRIPT" ]]; then
+    msg_info "Update Local IP Helper"
+    cache_installed_version "local-ip-helper" "1.0"
+    msg_ok "Update Local IP Helper"
+  else
+    msg_info "Setup Local IP Helper"
+  fi
+
+  mkdir -p "$BASE_DIR"
+
+  # Install networkd-dispatcher if not present
+  if ! dpkg -s networkd-dispatcher >/dev/null 2>&1; then
+    ensure_dependencies networkd-dispatcher || {
+      msg_error "Failed to install networkd-dispatcher"
+      return 100
+    }
+  fi
+
+  # Write update_local_ip.sh
+  cat <<'EOF' >"$SCRIPT_PATH"
+#!/bin/bash
+set -euo pipefail
+
+IP_FILE="/run/local-ip.env"
+mkdir -p "$(dirname "$IP_FILE")"
+
+get_current_ip() {
+    local ip
+
+    # Try IPv4 targets first
+    local ipv4_targets=("8.8.8.8" "1.1.1.1" "192.168.1.1" "10.0.0.1" "172.16.0.1" "default")
+    for target in "${ipv4_targets[@]}"; do
+        if [[ "$target" == "default" ]]; then
+            ip=$(ip route get 1 2>/dev/null | awk '{for(i=1;i<=NF;i++) if ($i=="src") print $(i+1)}')
+        else
+            ip=$(ip route get "$target" 2>/dev/null | awk '{for(i=1;i<=NF;i++) if ($i=="src") print $(i+1)}')
+        fi
+        if [[ -n "$ip" ]]; then
+            echo "$ip"
+            return 0
+        fi
+    done
+
+    # IPv6 fallback: Try direct interface lookup for eth0
+    ip=$(ip -6 addr show eth0 scope global 2>/dev/null | awk '/inet6 / {print $2}' | cut -d/ -f1 | head -n1)
+    if [[ -n "$ip" && "$ip" =~ : ]]; then
+        echo "$ip"
+        return 0
+    fi
+
+    # IPv6 fallback: Use routing table with IPv6 targets (Google DNS, Cloudflare DNS)
+    local ipv6_targets=("2001:4860:4860::8888" "2606:4700:4700::1111")
+    for target in "${ipv6_targets[@]}"; do
+        ip=$(ip -6 route get "$target" 2>/dev/null | awk '{for(i=1;i<=NF;i++) if ($i=="src") print $(i+1)}')
+        if [[ -n "$ip" && "$ip" =~ : ]]; then
+            echo "$ip"
+            return 0
+        fi
+    done
+
+    return 1
+}
+
+current_ip="$(get_current_ip)"
+
+if [[ -z "$current_ip" ]]; then
+    echo "[ERROR] Could not detect local IP" >&2
+    exit 123
+fi
+
+if [[ -f "$IP_FILE" ]]; then
+    source "$IP_FILE"
+    [[ "$LOCAL_IP" == "$current_ip" ]] && exit 0
+fi
+
+echo "LOCAL_IP=$current_ip" > "$IP_FILE"
+echo "[INFO] LOCAL_IP updated to $current_ip"
+EOF
+
+  chmod +x "$SCRIPT_PATH"
+
+  # Install dispatcher hook
+  mkdir -p "$(dirname "$DISPATCHER_SCRIPT")"
+  cat <<EOF >"$DISPATCHER_SCRIPT"
+#!/bin/bash
+$SCRIPT_PATH
+EOF
+
+  chmod +x "$DISPATCHER_SCRIPT"
+  systemctl enable -q --now networkd-dispatcher.service || {
+    msg_warn "Failed to enable networkd-dispatcher service"
+  }
+
+  cache_installed_version "local-ip-helper" "1.0"
+  msg_ok "Setup Local IP Helper"
+}
 
 # ------------------------------------------------------------------------------
 # Installs or updates MariaDB.
@@ -8704,6 +9206,50 @@ EOF
   return 0
 }
 
+# ------------------------------------------------------------------------------
+# Get latest GitLab release version.
+# Usage: get_latest_gitlab_release "owner/repo" [strip_v]
+# ------------------------------------------------------------------------------
+get_latest_gitlab_release() {
+  local repo="$1"
+  local strip_v="${2:-true}"
+
+  local repo_encoded
+  repo_encoded=$(printf '%s' "$repo" | sed 's|/|%2F|g')
+
+  local header=()
+  [[ -n "${GITLAB_TOKEN:-}" ]] && header=(-H "PRIVATE-TOKEN: $GITLAB_TOKEN")
+
+  local temp_file
+  temp_file=$(mktemp)
+
+  local http_code
+  http_code=$(curl --connect-timeout 10 --max-time 30 -sSL \
+    -w "%{http_code}" -o "$temp_file" \
+    "${header[@]}" \
+    "https://gitlab.com/api/v4/projects/$repo_encoded/releases?per_page=1&order_by=released_at&sort=desc" 2>/dev/null) || true
+
+  if [[ "$http_code" != "200" ]]; then
+    rm -f "$temp_file"
+    msg_warn "GitLab API call failed for ${repo} (HTTP ${http_code})"
+    return 22
+  fi
+
+  local version
+  version=$(jq -r '.[0].tag_name // empty' "$temp_file")
+  rm -f "$temp_file"
+
+  if [[ -z "$version" ]]; then
+    msg_error "Could not determine latest version for ${repo}"
+    return 250
+  fi
+
+  if [[ "$strip_v" == "true" ]]; then
+    [[ "$version" =~ ^v[0-9] ]] && version="${version:1}"
+  fi
+
+  echo "$version"
+}
 
 # ------------------------------------------------------------------------------
 # Checks for new GitLab release (latest tag).