Radicale: enable the extras only once the code defines them

argon2 is an extra since v3.5.4 and uv refuses unknown extras, so patching before the release update broke older installs. Patch after it instead, and only when pyproject.toml defines the extra.
Radicale: install the bcrypt and argon2 extras
2026-10-11 15:42:49 +02:00 · 2026-10-09 20:44:46 +02:00 · 2026-10-09 20:40:41 +02:00
35 changed files with 336 additions and 1060 deletions
@@ -1,190 +1,3 @@
-## 2026-10-10
-
-### 🆕 New Scripts
-
-  - Weblate ([#17837](https://github.com/community-scripts/ProxmoxVE/pull/17837))
- CertMate ([#17803](https://github.com/community-scripts/ProxmoxVE/pull/17803))
- AnythingLLM ([#17802](https://github.com/community-scripts/ProxmoxVE/pull/17802))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - update endurain repo from codeberg to gh [@johanngrobe](https://github.com/johanngrobe) ([#17831](https://github.com/community-scripts/ProxmoxVE/pull/17831))
-    - Immich: download countryInfo.txt into the geodata directory on update [@claytonfaria](https://github.com/claytonfaria) ([#17823](https://github.com/community-scripts/ProxmoxVE/pull/17823))
-    - paperclip: keep root and skip /opt/paperclip-data chown when PAPERCLIP_HOME is custom [@austinpilz](https://github.com/austinpilz) ([#17825](https://github.com/community-scripts/ProxmoxVE/pull/17825))
-
-## 2026-10-09
-
-### 🆕 New Scripts
-
-  - FoldingAtHome ([#17799](https://github.com/community-scripts/ProxmoxVE/pull/17799))
- LocalAI ([#17801](https://github.com/community-scripts/ProxmoxVE/pull/17801))
- Tvheadend ([#17800](https://github.com/community-scripts/ProxmoxVE/pull/17800))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - OpenCloud: fix Collabora embedding with Collabora 26.04.4 [@SimKaiLong](https://github.com/SimKaiLong) ([#17810](https://github.com/community-scripts/ProxmoxVE/pull/17810))
-
-  - #### 🔧 Refactor
-
-    - Immich: survive an interrupted update and a failing ML build [@MickLesk](https://github.com/MickLesk) ([#17798](https://github.com/community-scripts/ProxmoxVE/pull/17798))
-
-### 💾 Core
-
-  - check_for_release: compare against the release marked as latest [@MickLesk](https://github.com/MickLesk) ([core#125](https://github.com/community-scripts/core/pull/125))
-
-### 🧰 Tools
-
-  - #### ✨ New Features
-
-    - FileBrowser Quantum: migrate the config and database to v2 [@MickLesk](https://github.com/MickLesk) ([#17815](https://github.com/community-scripts/ProxmoxVE/pull/17815))
-
-## 2026-10-08
-
-### 🆕 New Scripts
-
-  - Unifi-OS-Server VM ([#17752](https://github.com/community-scripts/ProxmoxVE/pull/17752))
- ZimaOS VM ([#17778](https://github.com/community-scripts/ProxmoxVE/pull/17778))
-
-### 🚀 Updated Scripts
-
-  - Revert "Immich: Pin to v3.3.0" [@MickLesk](https://github.com/MickLesk) ([#17767](https://github.com/community-scripts/ProxmoxVE/pull/17767))
-
-  - #### 🐞 Bug Fixes
-
-    - Homarr: replace the musl better-sqlite3 that v2.3.0 ships for Debian [@MickLesk](https://github.com/MickLesk) ([#17789](https://github.com/community-scripts/ProxmoxVE/pull/17789))
-    - CLIProxyAPI: keep plugins and data across updates [@MickLesk](https://github.com/MickLesk) ([#17790](https://github.com/community-scripts/ProxmoxVE/pull/17790))
-    - Kima-Hub: install the Python services into a uv venv [@MickLesk](https://github.com/MickLesk) ([#17791](https://github.com/community-scripts/ProxmoxVE/pull/17791))
-
-  - #### ✨ New Features
-
-    - Immich: Pin to 3.3.0 / Update ML Python to 3.13 [@MickLesk](https://github.com/MickLesk) ([#17770](https://github.com/community-scripts/ProxmoxVE/pull/17770))
-
-  - #### 🔧 Refactor
-
-    - Refactor: OPNsense VM [@MickLesk](https://github.com/MickLesk) ([#17785](https://github.com/community-scripts/ProxmoxVE/pull/17785))
-    - Refactor: Nextcloud VM (Turnkey) [@MickLesk](https://github.com/MickLesk) ([#17787](https://github.com/community-scripts/ProxmoxVE/pull/17787))
-    - Refactor: OpenWrt VM [@MickLesk](https://github.com/MickLesk) ([#17774](https://github.com/community-scripts/ProxmoxVE/pull/17774))
-    - Refactor: Ubuntu VM [@MickLesk](https://github.com/MickLesk) ([#17776](https://github.com/community-scripts/ProxmoxVE/pull/17776))
-
-### 💾 Core
-
-  - Tolerate a missing datacenter.cfg in vm_keyboard_default [@MickLesk](https://github.com/MickLesk) ([core#124](https://github.com/community-scripts/core/pull/124))
- Take the ISO storage from the disk pool when it can hold ISOs [@MickLesk](https://github.com/MickLesk) ([core#122](https://github.com/community-scripts/core/pull/122))
- Shared VM helpers: disk import, releases, checksums, first boot, IP by MAC [@MickLesk](https://github.com/MickLesk) ([core#117](https://github.com/community-scripts/core/pull/117))
- tools: forge truncated release list [@MickLesk](https://github.com/MickLesk) ([core#118](https://github.com/community-scripts/core/pull/118))
- Remember a kept cached image until the upstream changes [@MickLesk](https://github.com/MickLesk) ([core#119](https://github.com/community-scripts/core/pull/119))
- Choose the VM keyboard layout and carry the host's timezone into prepared images [@MickLesk](https://github.com/MickLesk) ([core#120](https://github.com/community-scripts/core/pull/120))
- VM's: run first-boot units without debconf dialogs [@MickLesk](https://github.com/MickLesk) ([core#121](https://github.com/community-scripts/core/pull/121))
-
-## 2026-10-07
-
-### 🆕 New Scripts
-
-  - Fedora VM ([#17747](https://github.com/community-scripts/ProxmoxVE/pull/17747))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - AudioMuse-AI: replace the venv on update without asking [@MickLesk](https://github.com/MickLesk) ([#17738](https://github.com/community-scripts/ProxmoxVE/pull/17738))
-    - paperclip: run as a dedicated non-root user so Claude Code can skip permissions [@samvandenbossche](https://github.com/samvandenbossche) ([#17707](https://github.com/community-scripts/ProxmoxVE/pull/17707))
-    - Thingsboard: update Java version from 17 to 25 [@CerberusStyle](https://github.com/CerberusStyle) ([#17733](https://github.com/community-scripts/ProxmoxVE/pull/17733))
-
-  - #### ✨ New Features
-
-    - Immich: Pin to v3.3.0 [@vhsdream](https://github.com/vhsdream) ([#17759](https://github.com/community-scripts/ProxmoxVE/pull/17759))
-
-  - #### 💥 Breaking Changes
-
-    - OpenCloud: bump to v8.1.0, rebuild search index on upgrade [@SimKaiLong](https://github.com/SimKaiLong) ([#17710](https://github.com/community-scripts/ProxmoxVE/pull/17710))
-
-  - #### 🔧 Refactor
-
-    - Pangolin: Unpin Release, stable enough, Bump to latest [@MickLesk](https://github.com/MickLesk) ([#17740](https://github.com/community-scripts/ProxmoxVE/pull/17740))
-    - Refactor: Archlinux-VM [@MickLesk](https://github.com/MickLesk) ([#17741](https://github.com/community-scripts/ProxmoxVE/pull/17741))
-    - Refactor: MikroTik RouterOS [@MickLesk](https://github.com/MickLesk) ([#17748](https://github.com/community-scripts/ProxmoxVE/pull/17748))
-
-### 💾 Core
-
-  - Fix Fedora and BLS cloud image console setup [@MickLesk](https://github.com/MickLesk) ([core#116](https://github.com/community-scripts/core/pull/116))
- Keep setup_nodejs alive when the caller's directory is gone [@MickLesk](https://github.com/MickLesk) ([core#114](https://github.com/community-scripts/core/pull/114))
-
-## 2026-10-06
-
-### 🆕 New Scripts
-
-  - Pricebuddy ([#17708](https://github.com/community-scripts/ProxmoxVE/pull/17708))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Webtrees: stop serving data/ and the source folders directly [@MickLesk](https://github.com/MickLesk) ([#17724](https://github.com/community-scripts/ProxmoxVE/pull/17724))
-
-### 💾 Core
-
-  - Incus: check the architecture on Incus hosts too [@MickLesk](https://github.com/MickLesk) ([core#113](https://github.com/community-scripts/core/pull/113))
- Incus: Pass the app's var_* settings into Incus containers  [@MickLesk](https://github.com/MickLesk) ([core#112](https://github.com/community-scripts/core/pull/112))
- Incus: stub storage_content_check on Incus [@MickLesk](https://github.com/MickLesk) ([core#104](https://github.com/community-scripts/core/pull/104))
- Incus: map Proxmox template versions to Incus image names [@MickLesk](https://github.com/MickLesk) ([core#111](https://github.com/community-scripts/core/pull/111))
- Incus: read storage names from .vars files  [@MickLesk](https://github.com/MickLesk) ([core#110](https://github.com/community-scripts/core/pull/110))
- Incus: show the spinner inside containers again [@MickLesk](https://github.com/MickLesk) ([core#109](https://github.com/community-scripts/core/pull/109))
- Incus: set the hostname with sh, so it works before bash is installed [@MickLesk](https://github.com/MickLesk) ([core#102](https://github.com/community-scripts/core/pull/102))
- Incus: reserve a plain address on Incus, leave the gateway to the network [@MickLesk](https://github.com/MickLesk) ([core#101](https://github.com/community-scripts/core/pull/101))
- Incus: Wait for the network on Alpine OS too [@MickLesk](https://github.com/MickLesk) ([core#105](https://github.com/community-scripts/core/pull/105))
- Incus: do not fail the build when hostname -I is missing [@MickLesk](https://github.com/MickLesk) ([core#103](https://github.com/community-scripts/core/pull/103))
- Incus: Fuse always in unprivileged Containers, attach TUN only when container lacks it [@MickLesk](https://github.com/MickLesk) ([core#108](https://github.com/community-scripts/core/pull/108))
- Incus: accept mode=generated [@MickLesk](https://github.com/MickLesk) ([core#106](https://github.com/community-scripts/core/pull/106))
- Incus: pass the full install environment into Incus containers (quoted) [@MickLesk](https://github.com/MickLesk) ([core#107](https://github.com/community-scripts/core/pull/107))
-
-## 2026-10-05
-
-### 🚀 Updated Scripts
-
-  - Point to DevScripts, the renamed ProxmoxVED [@MickLesk](https://github.com/MickLesk) ([#17694](https://github.com/community-scripts/ProxmoxVE/pull/17694))
-
-  - #### 🐞 Bug Fixes
-
-    - wanderer: set the proxy secret and install plugins in their own directories [@MickLesk](https://github.com/MickLesk) ([#17698](https://github.com/community-scripts/ProxmoxVE/pull/17698))
-    - discourse: serve stylesheets and repair the update [@MickLesk](https://github.com/MickLesk) ([#17697](https://github.com/community-scripts/ProxmoxVE/pull/17697))
-    - wikijs: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17689](https://github.com/community-scripts/ProxmoxVE/pull/17689))
-    - jotty: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17688](https://github.com/community-scripts/ProxmoxVE/pull/17688))
-
-### 💾 Core
-
-  - Read releases from github.com when the API is rate limited, resume stalled downloads [@MickLesk](https://github.com/MickLesk) ([core#99](https://github.com/community-scripts/core/pull/99))
- Check for template and container storage before the settings menu [@MickLesk](https://github.com/MickLesk) ([core#98](https://github.com/community-scripts/core/pull/98))
- Check /etc/pve before the settings menu [@MickLesk](https://github.com/MickLesk) ([core#97](https://github.com/community-scripts/core/pull/97))
- Check container settings before pct create rejects them [@MickLesk](https://github.com/MickLesk) ([core#96](https://github.com/community-scripts/core/pull/96))
- PVE: Smart Diagnosis - say why a container would not start [@MickLesk](https://github.com/MickLesk) ([core#95](https://github.com/community-scripts/core/pull/95))
- Retry template downloads that pveam reports as done but are not [@MickLesk](https://github.com/MickLesk) ([core#94](https://github.com/community-scripts/core/pull/94))
- Check the OS release against pve-container before creating anything [@MickLesk](https://github.com/MickLesk) ([core#93](https://github.com/community-scripts/core/pull/93))
- Rename "ProxmoxVED"-Links to "DevScripts" [@MickLesk](https://github.com/MickLesk) ([core#91](https://github.com/community-scripts/core/pull/91))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - monitor-all: read container IPs from the host side [@jasonobrien](https://github.com/jasonobrien) ([#17686](https://github.com/community-scripts/ProxmoxVE/pull/17686))
-
-## 2026-10-04
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - immich: read the Intel runtime from the pinned release [@MickLesk](https://github.com/MickLesk) ([#17677](https://github.com/community-scripts/ProxmoxVE/pull/17677))
-
-### 💾 Core
-
-  - better explain unsupported version & upgrade path for pve [@MickLesk](https://github.com/MickLesk) ([core#86](https://github.com/community-scripts/core/pull/86))
- Quote PostgreSQL identifiers and drop spaces from the creds file name [@MickLesk](https://github.com/MickLesk) ([core#89](https://github.com/community-scripts/core/pull/89))
- Find the default Rust toolchain in current rustup output [@MickLesk](https://github.com/MickLesk) ([core#88](https://github.com/community-scripts/core/pull/88))
-
 ## 2026-10-03

 ### 🆕 New Scripts
@@ -113,9 +113,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit



-
-
-



@@ -129,7 +126,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit


 <details>
-<summary><h4>October (10 entries)</h4></summary>
+<summary><h4>October (3 entries)</h4></summary>

 [View October 2026 Changelog](.github/changelogs/2026/10.md)

@@ -562,49 +559,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 </details>

-## 2026-10-11
-
-### 🆕 New Scripts
-
-  - Cinephage ([#17852](https://github.com/community-scripts/ProxmoxVE/pull/17852))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - hermesagent: match the relaunched root gateway regardless of interpreter [@MickLesk](https://github.com/MickLesk) ([#17847](https://github.com/community-scripts/ProxmoxVE/pull/17847))
-    - Radicale: install the bcrypt and argon2 extras [@MickLesk](https://github.com/MickLesk) ([#17813](https://github.com/community-scripts/ProxmoxVE/pull/17813))
-    - fix(zigbee2mqtt): preserve backup stream and prevent filename collisions [@petermnt](https://github.com/petermnt) ([#17751](https://github.com/community-scripts/ProxmoxVE/pull/17751))
-
-  - #### ✨ New Features
-
-    - QoL: Confirm third-party installers through confirm_external_installer [@MickLesk](https://github.com/MickLesk) ([#17857](https://github.com/community-scripts/ProxmoxVE/pull/17857))
-    - docker: take the lxcfs toggle, TCP socket and Compose choice from app variables [@MickLesk](https://github.com/MickLesk) ([#17850](https://github.com/community-scripts/ProxmoxVE/pull/17850))
-
-### 💾 Core
-
-  - Add confirm_external_installer [@MickLesk](https://github.com/MickLesk) ([core#130](https://github.com/community-scripts/core/pull/130))
- setup_docker: make LXC resource limits visible to nested containers [@andrebrait](https://github.com/andrebrait) ([core#9](https://github.com/community-scripts/core/pull/9))
- Incus: fix ENABLE_FUSE / TUN vars [@MickLesk](https://github.com/MickLesk) ([core#127](https://github.com/community-scripts/core/pull/127))
- Resolve a uv required-version range to the newest release inside it [@MickLesk](https://github.com/MickLesk) ([core#126](https://github.com/community-scripts/core/pull/126))
- Upgrade MongoDB in place when an app package depends on it [@MickLesk](https://github.com/MickLesk) ([core#128](https://github.com/community-scripts/core/pull/128))
-
-## 2026-10-10
-
-### 🆕 New Scripts
-
-  - Weblate ([#17837](https://github.com/community-scripts/ProxmoxVE/pull/17837))
- CertMate ([#17803](https://github.com/community-scripts/ProxmoxVE/pull/17803))
- AnythingLLM ([#17802](https://github.com/community-scripts/ProxmoxVE/pull/17802))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - update endurain repo from codeberg to gh [@johanngrobe](https://github.com/johanngrobe) ([#17831](https://github.com/community-scripts/ProxmoxVE/pull/17831))
-    - Immich: download countryInfo.txt into the geodata directory on update [@claytonfaria](https://github.com/claytonfaria) ([#17823](https://github.com/community-scripts/ProxmoxVE/pull/17823))
-    - paperclip: keep root and skip /opt/paperclip-data chown when PAPERCLIP_HOME is custom [@austinpilz](https://github.com/austinpilz) ([#17825](https://github.com/community-scripts/ProxmoxVE/pull/17825))
-
 ## 2026-10-09

 ### 🆕 New Scripts
@@ -615,24 +569,10 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 ### 🚀 Updated Scripts

-  - #### 🐞 Bug Fixes
-
-    - OpenCloud: fix Collabora embedding with Collabora 26.04.4 [@SimKaiLong](https://github.com/SimKaiLong) ([#17810](https://github.com/community-scripts/ProxmoxVE/pull/17810))
-
  - #### 🔧 Refactor

    - Immich: survive an interrupted update and a failing ML build [@MickLesk](https://github.com/MickLesk) ([#17798](https://github.com/community-scripts/ProxmoxVE/pull/17798))

-### 💾 Core
-
-  - check_for_release: compare against the release marked as latest [@MickLesk](https://github.com/MickLesk) ([core#125](https://github.com/community-scripts/core/pull/125))
-
-### 🧰 Tools
-
-  - #### ✨ New Features
-
-    - FileBrowser Quantum: migrate the config and database to v2 [@MickLesk](https://github.com/MickLesk) ([#17815](https://github.com/community-scripts/ProxmoxVE/pull/17815))
-
 ## 2026-10-08

 ### 🆕 New Scripts
@@ -1300,4 +1240,145 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 ### 📚 Documentation

-  - issue template: add PVE release, execution context and phase; refresh distro list / pve versions [@MickLesk](https://github.com/MickLesk) ([#17160](https://github.com/community-scripts/ProxmoxVE/pull/17160))
+  - issue template: add PVE release, execution context and phase; refresh distro list / pve versions [@MickLesk](https://github.com/MickLesk) ([#17160](https://github.com/community-scripts/ProxmoxVE/pull/17160))
+
+## 2026-09-10
+
+### 🆕 New Scripts
+
+  - Chevereto ([#17131](https://github.com/community-scripts/ProxmoxVE/pull/17131))
+- Portabase ([#17111](https://github.com/community-scripts/ProxmoxVE/pull/17111))
+- Logseq ([#17112](https://github.com/community-scripts/ProxmoxVE/pull/17112))
+- Safebucket ([#17096](https://github.com/community-scripts/ProxmoxVE/pull/17096))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Immich v3.2.0 [@vhsdream](https://github.com/vhsdream) ([#17137](https://github.com/community-scripts/ProxmoxVE/pull/17137))
+    - fix(solidtime): prevent composer install from hanging on root prompt [@supersoju](https://github.com/supersoju) ([#17146](https://github.com/community-scripts/ProxmoxVE/pull/17146))
+    - fix(hermesagent): wait for root gateway cleanup [@steveonjava](https://github.com/steveonjava) ([#17147](https://github.com/community-scripts/ProxmoxVE/pull/17147))
+
+### 💾 Core
+
+  - Keep the script name when regenerating the entrypoint [@MickLesk](https://github.com/MickLesk) ([core#35](https://github.com/community-scripts/core/pull/35))
+- Rewrite the dead Gitea base onto GitHub instead of failing the update [@MickLesk](https://github.com/MickLesk) ([core#33](https://github.com/community-scripts/core/pull/33))
+- core.func: fall back to a usable HOME when the shell has none [@MickLesk](https://github.com/MickLesk) ([core#32](https://github.com/community-scripts/core/pull/32))
+
+## 2026-09-09
+
+### 🆕 New Scripts
+
+  - Lingarr ([#17130](https://github.com/community-scripts/ProxmoxVE/pull/17130))
+
+### 🚀 Updated Scripts
+
+  - vm: drop the discussions link from the summary [@MickLesk](https://github.com/MickLesk) ([#17117](https://github.com/community-scripts/ProxmoxVE/pull/17117))
+
+  - #### 🐞 Bug Fixes
+
+    - fix(hermesagent): stop spurious root gateway after update [@steveonjava](https://github.com/steveonjava) ([#17126](https://github.com/community-scripts/ProxmoxVE/pull/17126))
+
+## 2026-09-08
+
+### 🆕 New Scripts
+
+  - Decypharr ([#17108](https://github.com/community-scripts/ProxmoxVE/pull/17108))
+- Stash ([#17106](https://github.com/community-scripts/ProxmoxVE/pull/17106))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Update Jellyfin FFmpeg dependency to version 8 [@MickLesk](https://github.com/MickLesk) ([#17109](https://github.com/community-scripts/ProxmoxVE/pull/17109))
+
+### 💾 Core
+
+  - Treat a cut-short forge response as a failure, not as HTTP 200 [@MickLesk](https://github.com/MickLesk) ([core#31](https://github.com/community-scripts/core/pull/31))
+- Generate app headers [@github-actions[bot]](https://github.com/github-actions[bot]) ([core#28](https://github.com/community-scripts/core/pull/28))
+- cloud-init: drop the "configure in Proxmox UI" hint [@MickLesk](https://github.com/MickLesk) ([core#30](https://github.com/community-scripts/core/pull/30))
+- Survive an empty /usr/bin/update instead of aborting the run [@MickLesk](https://github.com/MickLesk) ([core#29](https://github.com/community-scripts/core/pull/29))
+
+## 2026-09-07
+
+### 🆕 New Scripts
+
+  - Chatwoot ([#17095](https://github.com/community-scripts/ProxmoxVE/pull/17095))
+- whisparr-eros ([#17094](https://github.com/community-scripts/ProxmoxVE/pull/17094))
+- Matter-Hub ([#17093](https://github.com/community-scripts/ProxmoxVE/pull/17093))
+- Journiv ([#17092](https://github.com/community-scripts/ProxmoxVE/pull/17092))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - kaneo: bump Node.js from 22 to 24 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17086](https://github.com/community-scripts/ProxmoxVE/pull/17086))
+    - iobroker: bump Node.js from 24 to 26 [@github-actions[bot]](https://github.com/github-actions[bot]) ([#17085](https://github.com/community-scripts/ProxmoxVE/pull/17085))
+    - reactive-resume: repair any wrong WorkingDirectory on update [@MickLesk](https://github.com/MickLesk) ([#17068](https://github.com/community-scripts/ProxmoxVE/pull/17068))
+    - mediamtx: keep mediamtx.yml across updates [@MickLesk](https://github.com/MickLesk) ([#17069](https://github.com/community-scripts/ProxmoxVE/pull/17069))
+    - omnitools: allow remote action while npm ci [@MickLesk](https://github.com/MickLesk) ([#17070](https://github.com/community-scripts/ProxmoxVE/pull/17070))
+
+  - #### ✨ New Features
+
+    - netboot-xyz: add Secure Boot and Legacy assets [@MickLesk](https://github.com/MickLesk) ([#17066](https://github.com/community-scripts/ProxmoxVE/pull/17066))
+
+  - #### 🔧 Refactor
+
+    - flatnotes: follow upstream move to uv and Python 3.13 [@MickLesk](https://github.com/MickLesk) ([#17090](https://github.com/community-scripts/ProxmoxVE/pull/17090))
+    - heimdall: set up PHP 8.4 on update, keep only the database, run migrations [@MickLesk](https://github.com/MickLesk) ([#17067](https://github.com/community-scripts/ProxmoxVE/pull/17067))
+
+### 📂 Github
+
+  - github: Open per-script Node bump PRs [@MickLesk](https://github.com/MickLesk) ([#17065](https://github.com/community-scripts/ProxmoxVE/pull/17065))
+
+## 2026-09-06
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Fix Sonarqube update script to add +x on sonar.sh [@jarihu](https://github.com/jarihu) ([#17056](https://github.com/community-scripts/ProxmoxVE/pull/17056))
+
+## 2026-09-05
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - authentik: scope blueprints chown to avoid recursing into the mp0 bind mount [@MickLesk](https://github.com/MickLesk) ([#17008](https://github.com/community-scripts/ProxmoxVE/pull/17008))
+    - iventoy: run iventoy.sh with bash instead of dash [@MickLesk](https://github.com/MickLesk) ([#17034](https://github.com/community-scripts/ProxmoxVE/pull/17034))
+    - frigate: restart go2rtc.service before frigate starts [@MickLesk](https://github.com/MickLesk) ([#17035](https://github.com/community-scripts/ProxmoxVE/pull/17035))
+    - snapotter: seed AI venv base packages on arm64, warn amd64 has no working CPU bundle [@MickLesk](https://github.com/MickLesk) ([#16903](https://github.com/community-scripts/ProxmoxVE/pull/16903))
+    - tolgee: bump required JDK from 21 to 25 [@MickLesk](https://github.com/MickLesk) ([#17005](https://github.com/community-scripts/ProxmoxVE/pull/17005))
+    - romm: write real version into backend/__version__.py placeholder [@MickLesk](https://github.com/MickLesk) ([#17009](https://github.com/community-scripts/ProxmoxVE/pull/17009))
+
+  - #### 🔧 Refactor
+
+    - Refactor FileFlows: Stop Spinner before read -rp / Switch from "Node" to "Agent"  [@MickLesk](https://github.com/MickLesk) ([#17007](https://github.com/community-scripts/ProxmoxVE/pull/17007))
+
+### 💾 Core
+
+  - update helper: follow renamed ct/ scripts instead of curling a 404 [@MickLesk](https://github.com/MickLesk) ([core#22](https://github.com/community-scripts/core/pull/22))
+- Use Proxmox for a template before reaching for linuxcontainers.org [@MickLesk](https://github.com/MickLesk) ([core#23](https://github.com/community-scripts/core/pull/23))
+- implement exponential backoff for curl retries in _cs_curl_retry function [@MickLesk](https://github.com/MickLesk) ([core#26](https://github.com/community-scripts/core/pull/26))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - update-apps: follow renamed ct/ scripts instead of erroring out [@MickLesk](https://github.com/MickLesk) ([#16991](https://github.com/community-scripts/ProxmoxVE/pull/16991))
+
+## 2026-09-04
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(shlink): preserve servers.json across web-client updates [@Corgei](https://github.com/Corgei) ([#17023](https://github.com/community-scripts/ProxmoxVE/pull/17023))
+    - fix-update-authentik-2026.8.1 [@thieneret](https://github.com/thieneret) ([#16999](https://github.com/community-scripts/ProxmoxVE/pull/16999))
+    - Fix npm v12 allow-git/allow-remote restrictions across affected scripts [@MickLesk](https://github.com/MickLesk) ([#17014](https://github.com/community-scripts/ProxmoxVE/pull/17014))
+    - Fix/poznote - 1st party Docker parity [@lucas-at-3x-eye](https://github.com/lucas-at-3x-eye) ([#17011](https://github.com/community-scripts/ProxmoxVE/pull/17011))
+
+### 💾 Core
+
+  - setup_go: resolve bare major.minor versions to the latest patch release [@MickLesk](https://github.com/MickLesk) ([core#24](https://github.com/community-scripts/core/pull/24))
@@ -1,78 +0,0 @@
-#!/usr/bin/env bash
-# Engine comes from community-scripts/core; this repo only ships the scripts.
-# A local core checkout wins (COMMUNITY_SCRIPTS_CORE_DIR, else a sibling ../core),
-# so a fork or branch of core can be tested without editing this file.
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/Mintplex-Labs/anything-llm
-
-APP="AnythingLLM"
-var_tags="${var_tags:-ai;rag}"
-var_cpu="${var_cpu:-4}"
-var_ram="${var_ram:-6144}"
-var_disk="${var_disk:-20}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_gpu="${var_gpu:-yes}"
-#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/anythingllm ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "anythingllm" "Mintplex-Labs/anything-llm"; then
-    msg_info "Stopping Services"
-    systemctl stop anythingllm anythingllm-collector
-    msg_ok "Stopped Services"
-
-    create_backup /opt/anythingllm/server/.env /opt/anythingllm/collector/.env /opt/anythingllm/frontend/.env
-
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "anythingllm" "Mintplex-Labs/anything-llm" "tarball"
-
-    restore_backup
-
-    msg_info "Building AnythingLLM (Patience)"
-    cd /opt/anythingllm
-    export PUPPETEER_SKIP_DOWNLOAD=true
-    export NODE_OPTIONS="--max-old-space-size=3072"
-    $STD yarn setup
-    cd /opt/anythingllm/frontend
-    $STD yarn build
-    rm -rf /opt/anythingllm/server/public
-    cp -R /opt/anythingllm/frontend/dist /opt/anythingllm/server/public
-    cd /opt/anythingllm/server
-    $STD npx prisma generate --schema=./prisma/schema.prisma
-    $STD npx prisma migrate deploy --schema=./prisma/schema.prisma
-    msg_ok "Built AnythingLLM"
-
-    msg_info "Starting Services"
-    systemctl start anythingllm anythingllm-collector
-    msg_ok "Started Services"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:3001${CL}"
@@ -1,65 +0,0 @@
-#!/usr/bin/env bash
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: fabriziosalmi
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/fabriziosalmi/certmate
-
-APP="CertMate"
-var_tags="${var_tags:-ssl;certificates;acme}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
-var_disk="${var_disk:-8}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-#var_arm64="${var_arm64:-no}" # unset = ask the user; set yes/no only when verified
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/certmate ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "certmate" "fabriziosalmi/certmate"; then
-    msg_info "Stopping CertMate"
-    systemctl stop certmate
-    msg_ok "Stopped CertMate"
-
-    PYTHON_VERSION="3.12" setup_uv
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "certmate" "fabriziosalmi/certmate" "tarball"
-
-    msg_info "Installing CertMate Dependencies"
-    cd /opt/certmate
-    $STD uv venv --python 3.12 /opt/certmate/.venv
-    $STD uv pip sync --python /opt/certmate/.venv/bin/python requirements.lock
-    $STD /opt/certmate/.venv/bin/certbot --version
-    msg_ok "Installed CertMate Dependencies"
-
-    msg_info "Starting CertMate"
-    systemctl start certmate
-    msg_ok "Started CertMate"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:8000${CL}"
-echo -e "${INFO}${YW}The first page creates the admin account and asks for the API token: grep API_BEARER_TOKEN /opt/certmate_data/.env${CL}"
@@ -1,69 +0,0 @@
-#!/usr/bin/env bash
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/MoldyTaint/Cinephage
-
-APP="Cinephage"
-var_tags="${var_tags:-arr;media;torrent;usenet}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-4096}"
-var_disk="${var_disk:-10}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/cinephage ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "cinephage" "MoldyTaint/Cinephage"; then
-    msg_info "Stopping Cinephage"
-    systemctl stop cinephage
-    msg_ok "Stopped Cinephage"
-
-    NODE_VERSION="24" setup_nodejs
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "cinephage" "MoldyTaint/Cinephage" "tarball"
-
-    msg_info "Building Cinephage"
-    cd /opt/cinephage
-    $STD npm ci
-    $STD npm run build
-    $STD npm prune --omit=dev
-    sed -i "s/^APP_VERSION=.*/APP_VERSION=$(cat ~/.cinephage)/" /opt/cinephage_data/.env
-    msg_ok "Built Cinephage"
-
-    msg_info "Updating Camoufox"
-    $STD /opt/cinephage/node_modules/.bin/camoufox-js fetch
-    msg_ok "Updated Camoufox"
-
-    msg_info "Starting Cinephage"
-    systemctl start cinephage
-    msg_ok "Started Cinephage"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}:3000${CL}"
@@ -27,10 +27,6 @@ else
  var_disk="${var_disk:-4}"
  var_version="${var_version:-13}"
 fi
-# Only exported variables reach the install through lxc-attach.
-export var_docker_socket="${var_docker_socket:-}"
-export var_docker_compose="${var_docker_compose:-}"
-export var_docker_lxcfs="${var_docker_lxcfs:-}"

 header_info "$APP"
 variables
@@ -30,14 +30,14 @@ function update_script() {
    msg_error "No ${APP} installation found!"
    exit 233
  fi
-  if check_for_gh_release "endurain" "endurain-project/endurain"; then
+  if check_for_codeberg_release "endurain" "endurain-project/endurain"; then
    msg_info "Stopping Service"
    systemctl stop endurain
    msg_ok "Stopped Service"

    NODE_VERSION="24" setup_nodejs
    create_backup /opt/endurain/.env /opt/endurain/frontend/dist/env.js
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "endurain" "endurain-project/endurain"
+    CLEAN_INSTALL=1 fetch_and_deploy_codeberg_release "endurain" "endurain-project/endurain" "tarball" "latest" "/opt/endurain"

    msg_info "Updating Endurain Frontend"
    cd /opt/endurain
@@ -31,7 +31,16 @@ function update_script() {
    exit
  fi

-  confirm_external_installer "https://hermes-agent.nousresearch.com/" "hermes update (https://hermes-agent.nousresearch.com/)"
+  msg_warn "WARNING: This script will run an external installer from a third-party source (https://hermes-agent.nousresearch.com/)."
+  msg_warn "The following code is NOT maintained or audited by our repository."
+  msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+  msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  hermes update (https://hermes-agent.nousresearch.com/)"
+  echo
+  read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+  if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+    msg_error "Aborted by user. No changes have been made."
+    exit 10
+  fi

  msg_info "Stopping Services"
  systemctl stop hermes-dashboard
@@ -42,7 +51,8 @@ function update_script() {
    set -a; source /etc/default/hermes; set +a
    /home/hermes/.local/bin/hermes update --yes
  '
-  mapfile -t root_gateway_pids < <(ps -eo user=,pid=,args= | awk '$1 == "root" && /\/home\/hermes\/\.hermes\// && /hermes_cli[.]main/ && / gateway run --replace$/ { print $2 }')
+  # See https://github.com/community-scripts/ProxmoxVE/issues/17123
+  mapfile -t root_gateway_pids < <(ps -eo user=,pid=,args= | awk '$1 == "root" && $0 ~ /\/home\/hermes\/\.hermes\/hermes-agent\/venv\/bin\/python -m hermes_cli\.main gateway run --replace$/ { print $2 }')
  if ((${#root_gateway_pids[@]})); then
    kill -TERM "${root_gateway_pids[@]}"
    for pid in "${root_gateway_pids[@]}"; do
@@ -51,14 +61,7 @@ function update_script() {
      done
    done
  fi
-  if ps -eo user=,args= | awk '$1 == "root" && /\/home\/hermes\/\.hermes\// { found = 1 } END { exit !found }'; then
-    msg_warn "A root-owned Hermes process is still running; it may keep writing root-owned files"
-  fi
-  # A writer racing chown makes files vanish between readdir and chown; one retry covers it.
-  if ! chown -R hermes:hermes /home/hermes 2>/dev/null; then
-    sleep 1
-    chown -R hermes:hermes /home/hermes || msg_warn "Could not take ownership of everything under /home/hermes"
-  fi
+  chown -R hermes:hermes /home/hermes
  msg_ok "Updated Hermes Agent"

  msg_info "Starting Services"
@@ -329,7 +329,7 @@ EOF
    grep -rl /usr/src | xargs -n1 sed -i "s|\/usr/src|$INSTALL_DIR|g"
    grep -rlE "'/build'" | xargs -n1 sed -i "s|'/build'|'$APP_DIR'|g"
    sed -i "s@\"/cache\"@\"$INSTALL_DIR/cache\"@g" "$ML_DIR"/immich_ml/config.py
-    [[ ! -f "$GEO_DIR/countryInfo.txt" ]] && curl_with_retry "https://download.geonames.org/export/dump/countryInfo.txt" "$GEO_DIR/countryInfo.txt"
+    [[ ! -f "$GEO_DIR/countryInfo.txt" ]] && curl_with_retry "https://download.geonames.org/export/dump/countryInfo.txt" "countryInfo.txt"
    ln -s "${UPLOAD_DIR:-/opt/immich/upload}" "$APP_DIR"/upload
    ln -s "${UPLOAD_DIR:-/opt/immich/upload}" "$ML_DIR"/upload
    ln -sfn "$GEO_DIR" "$APP_DIR/geodata"
@@ -62,7 +62,16 @@ function update_script() {
    msg_info "Updating Kasm"
    cd /tmp

-    confirm_external_installer "https://www.kasmweb.com/" "upgrade.sh inside tar.gz $KASM_URL"
+    msg_warn "WARNING: This script will run an external installer from a third-party source (https://www.kasmweb.com/)."
+    msg_warn "The following code is NOT maintained or audited by our repository."
+    msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+    msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  upgrade.sh inside tar.gz $KASM_URL"
+    echo
+    read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+    if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+      msg_error "Aborted by user. No changes have been made."
+      exit 10
+    fi
    curl_download "/tmp/kasm_release_${KASM_VERSION}.tar.gz" "$KASM_URL"
    tar -xf "kasm_release_${KASM_VERSION}.tar.gz"
    chmod +x /tmp/kasm_release/install.sh
@@ -31,15 +31,6 @@ function update_script() {
    exit
  fi

-  # Collabora 26.04.4 ignores frame-ancestors in content_security_policy; outside the release
-  # check so installs already on the current release get it too
-  if [[ -f /etc/coolwsd/coolwsd.xml ]] && ! grep -q '<frame_ancestors[^>]*>[^<[:space:]]' /etc/coolwsd/coolwsd.xml; then
-    msg_info "Allowing OpenCloud to embed Collabora"
-    $STD sudo -u cool coolconfig set net.frame_ancestors "$(sed -n 's/^OC_URL=//p' /etc/opencloud/opencloud.env)"
-    systemctl restart coolwsd
-    msg_ok "Allowed OpenCloud to embed Collabora"
-  fi
-
  RELEASE="v8.1.0"
  if check_for_gh_release "OpenCloud" "opencloud-eu/opencloud" "${RELEASE}" "each release is tested individually before the version is updated. Please do not open issues for this"; then
    OLD_VERSION="$(cat ~/.opencloud 2>/dev/null)"
@@ -63,13 +63,7 @@ function update_script() {

    # Claude Code refuses --dangerously-skip-permissions as root; migrate existing installs to a dedicated user
    PAPERCLIP_USER=$(sed -n 's/^User=//p' /etc/systemd/system/paperclip.service)
-    PAPERCLIP_HOME=$(sed -n 's/^PAPERCLIP_HOME=//p' /opt/paperclip-ai/.env)
-    PAPERCLIP_HOME="${PAPERCLIP_HOME:-/opt/paperclip-data}"
-    if [[ -z "$PAPERCLIP_USER" || "$PAPERCLIP_USER" == "root" ]] && [[ "$PAPERCLIP_HOME" != "/opt/paperclip-data" ]]; then
-      # A custom data dir (e.g. an NFS bind mount) may only be reachable by root; don't move the service off root
-      msg_warn "PAPERCLIP_HOME is ${PAPERCLIP_HOME}; keeping the service user as root"
-      PAPERCLIP_USER=root
-    elif [[ -z "$PAPERCLIP_USER" || "$PAPERCLIP_USER" == "root" ]]; then
+    if [[ -z "$PAPERCLIP_USER" || "$PAPERCLIP_USER" == "root" ]]; then
      PAPERCLIP_USER="${var_paperclip_user:-paperclip}"
      if [[ "$PAPERCLIP_USER" == "root" || ! "$PAPERCLIP_USER" =~ ^[a-z_][a-z0-9_-]{0,31}$ ]]; then
        msg_error "Invalid var_paperclip_user '${PAPERCLIP_USER}' (must be a non-root lowercase Linux username)"
@@ -91,10 +85,7 @@ function update_script() {
    fi
    PAPERCLIP_USER_HOME=$(getent passwd "$PAPERCLIP_USER" | cut -d: -f6)
    chmod 600 /opt/paperclip-ai/.env
-    chown -R "${PAPERCLIP_USER}:${PAPERCLIP_USER}" /opt/paperclip-ai "$PAPERCLIP_USER_HOME"
-    if [[ "$PAPERCLIP_HOME" == "/opt/paperclip-data" && -d /opt/paperclip-data ]]; then
-      chown -R "${PAPERCLIP_USER}:${PAPERCLIP_USER}" /opt/paperclip-data
-    fi
+    chown -R "${PAPERCLIP_USER}:${PAPERCLIP_USER}" /opt/paperclip-ai /opt/paperclip-data "$PAPERCLIP_USER_HOME"

    msg_info "Running Database Migrations"
    set -a && source /opt/paperclip-ai/.env && set +a
@@ -1,67 +0,0 @@
-#!/usr/bin/env bash
-_cs_boot="${COMMUNITY_SCRIPTS_CORE_DIR:-$(dirname "${BASH_SOURCE[0]}")/../../core}/core/build.func"
-source "$_cs_boot" 2>/dev/null || source <(curl -fsSL "${COMMUNITY_SCRIPTS_CORE_URL:-https://raw.githubusercontent.com/community-scripts/core/main}/core/build.func")
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/WeblateOrg/weblate
-
-APP="Weblate"
-var_tags="${var_tags:-translation;localization}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-3072}"
-var_disk="${var_disk:-10}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_arm64="${var_arm64:-yes}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/weblate ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "weblate" "WeblateOrg/weblate"; then
-    msg_info "Stopping Weblate"
-    systemctl stop weblate weblate-celery
-    msg_ok "Stopped Weblate"
-
-    PYTHON_VERSION="3.14" setup_uv
-    USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "weblate" "WeblateOrg/weblate" "singlefile" "latest" "/opt/weblate" "weblate-*-py3-none-any.whl"
-
-    msg_info "Updating Weblate"
-    $STD uv pip install --python /opt/weblate/.venv/bin/python --compile-bytecode /opt/weblate/weblate-*.whl "weblate[all,wsgi]"
-    rm -f /opt/weblate/weblate-*.whl
-    set -a
-    source /opt/weblate_data/weblate.env
-    set +a
-    $STD /opt/weblate/.venv/bin/weblate migrate --noinput
-    $STD /opt/weblate/.venv/bin/weblate collectstatic --noinput
-    msg_ok "Updated Weblate"
-
-    msg_info "Starting Weblate"
-    systemctl start weblate-celery weblate
-    msg_ok "Started Weblate"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}Access it using the following URL:${CL}"
-echo -e "${GATEWAY}${BGN}http://${IP}${CL}"
@@ -49,12 +49,8 @@ update_deb_based() {
    ensure_dependencies zstd
    mkdir -p /opt/backups
    BACKUP_VERSION="$(<"$HOME/.zigbee2mqtt")"
-    BACKUP_FILE="$(mktemp "/opt/backups/${APP}_backup_${BACKUP_VERSION}_XXXXXX.tar.zst")"
-    tar -cf - -C /opt zigbee2mqtt | $STD zstd -q -f -o "$BACKUP_FILE" || {
-      local backup_exit_code=$?
-      rm -f "$BACKUP_FILE"
-      return "$backup_exit_code"
-    }
+    BACKUP_FILE="/opt/backups/${APP}_backup_${BACKUP_VERSION}.tar.zst"
+    $STD tar -cf - -C /opt zigbee2mqtt | zstd -q -o "$BACKUP_FILE"
    ls -t /opt/backups/${APP}_backup_*.tar.zst 2>/dev/null | tail -n +6 | xargs -r rm -f
    msg_ok "Backup Created (${BACKUP_VERSION})"

@@ -1,107 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/Mintplex-Labs/anything-llm
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-msg_info "Installing Dependencies"
-$STD apt install -y \
-  build-essential \
-  python3-dev \
-  libgomp1 \
-  git \
-  chromium
-msg_ok "Installed Dependencies"
-
-NODE_VERSION="22" NODE_MODULE="yarn" setup_nodejs
-
-fetch_and_deploy_gh_release "anythingllm" "Mintplex-Labs/anything-llm" "tarball"
-
-msg_info "Configuring AnythingLLM"
-mkdir -p /opt/anythingllm_data/storage
-cp -RTn /opt/anythingllm/server/storage /opt/anythingllm_data/storage 2>/dev/null || true
-rm -rf /opt/anythingllm/server/storage
-ln -sfn /opt/anythingllm_data/storage /opt/anythingllm/server/storage
-cat <<EOF >/opt/anythingllm/server/.env
-SERVER_PORT=3001
-STORAGE_DIR="/opt/anythingllm/server/storage"
-JWT_SECRET="$(openssl rand -hex 32)"
-SIG_KEY="$(openssl rand -hex 32)"
-SIG_SALT="$(openssl rand -hex 32)"
-VECTOR_DB="lancedb"
-EOF
-cat <<EOF >/opt/anythingllm/collector/.env
-STORAGE_DIR="/opt/anythingllm/server/storage"
-EOF
-cat <<EOF >/opt/anythingllm/frontend/.env
-VITE_API_BASE='/api'
-EOF
-msg_ok "Configured AnythingLLM"
-
-msg_info "Building AnythingLLM (Patience)"
-cd /opt/anythingllm
-export PUPPETEER_SKIP_DOWNLOAD=true
-export NODE_OPTIONS="--max-old-space-size=3072"
-$STD yarn setup
-cd /opt/anythingllm/frontend
-$STD yarn build
-cp -R /opt/anythingllm/frontend/dist /opt/anythingllm/server/public
-cd /opt/anythingllm/server
-$STD npx prisma generate --schema=./prisma/schema.prisma
-$STD npx prisma migrate deploy --schema=./prisma/schema.prisma
-msg_ok "Built AnythingLLM"
-
-msg_info "Creating Services"
-cat <<EOF >/etc/systemd/system/anythingllm.service
-[Unit]
-Description=AnythingLLM Server
-Wants=network-online.target
-After=network-online.target
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=/opt/anythingllm/server
-Environment=NODE_ENV=production
-ExecStart=/usr/bin/node index.js
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-
-cat <<EOF >/etc/systemd/system/anythingllm-collector.service
-[Unit]
-Description=AnythingLLM Collector
-Wants=network-online.target
-After=network-online.target anythingllm.service
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=/opt/anythingllm/collector
-Environment=NODE_ENV=production
-Environment=PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium
-ExecStart=/usr/bin/node index.js
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now anythingllm anythingllm-collector
-msg_ok "Created Services"
-
-motd_ssh
-customize
-cleanup_lxc
@@ -20,7 +20,16 @@ $STD apt install -y \
 msg_ok "Installed Dependencies"

 RELEASE=$(get_latest_github_release "bunkerity/bunkerweb")
-confirm_external_installer "install-bunkerweb.sh" "https://github.com/bunkerity/bunkerweb/raw/v${RELEASE}/misc/install-bunkerweb.sh"
+msg_warn "WARNING: This script will run an external installer from a third-party source (install-bunkerweb.sh)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://github.com/bunkerity/bunkerweb/raw/v${RELEASE}/misc/install-bunkerweb.sh"
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi
 msg_info "Installing BunkerWeb (Patience)"
 curl -fsSL -o install-bunkerweb.sh "https://github.com/bunkerity/bunkerweb/raw/v${RELEASE}/misc/install-bunkerweb.sh"
 chmod +x install-bunkerweb.sh
@@ -13,7 +13,16 @@ setting_up_container
 network_check
 update_os

-confirm_external_installer "https://casaos.zimaspace.com/" "https://get.casaos.io/"
+msg_warn "WARNING: This script will run an external installer from a third-party source (https://casaos.zimaspace.com/)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://get.casaos.io/"
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi
 msg_info "Installing CasaOS (Patience)"
 DOCKER_CONFIG_PATH='/etc/docker/daemon.json'
 mkdir -p $(dirname $DOCKER_CONFIG_PATH)
@@ -1,69 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: fabriziosalmi
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/fabriziosalmi/certmate
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-PYTHON_VERSION="3.12" setup_uv
-fetch_and_deploy_gh_release "certmate" "fabriziosalmi/certmate" "tarball"
-
-msg_info "Installing CertMate Dependencies"
-cd /opt/certmate
-$STD uv venv --python 3.12 /opt/certmate/.venv
-# requirements.lock is the fully pinned set the official image is built from
-$STD uv pip sync --python /opt/certmate/.venv/bin/python requirements.lock
-$STD /opt/certmate/.venv/bin/certbot --version
-msg_ok "Installed CertMate Dependencies"
-
-msg_info "Configuring CertMate"
-mkdir -p /opt/certmate_data/{certificates,data,backups,logs}
-cat <<EOF >/opt/certmate_data/.env
-API_BEARER_TOKEN=$(openssl rand -hex 32)
-SECRET_KEY=$(openssl rand -hex 32)
-CERTMATE_BACKUP_PASSPHRASE=$(openssl rand -hex 32)
-BEHIND_PROXY=false
-EOF
-chmod 600 /opt/certmate_data/.env
-msg_ok "Configured CertMate"
-
-msg_info "Creating Service"
-cat <<EOF >/etc/systemd/system/certmate.service
-[Unit]
-Description=CertMate SSL Certificate Manager
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=/opt/certmate
-Environment=PATH=/opt/certmate/.venv/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
-Environment=CERTMATE_CERT_DIR=/opt/certmate_data/certificates
-Environment=CERTMATE_DATA_DIR=/opt/certmate_data/data
-Environment=CERTMATE_BACKUP_DIR=/opt/certmate_data/backups
-Environment=CERTMATE_LOGS_DIR=/opt/certmate_data/logs
-Environment=ACME_CHALLENGES_DIR=/opt/certmate_data/data/acme-challenges
-EnvironmentFile=/opt/certmate_data/.env
-# One worker: the renewal scheduler, sessions and rate limits live in-process
-ExecStart=/opt/certmate/.venv/bin/gunicorn --bind 0.0.0.0:8000 --workers 1 --threads 8 --timeout 300 --no-control-socket app:app
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now certmate
-msg_ok "Created Service"
-
-motd_ssh
-customize
-cleanup_lxc
@@ -19,7 +19,16 @@ $STD apt install -y \
  xvfb
 msg_ok "Installed Dependencies"

-confirm_external_installer "https://getchannels.com" "https://getchannels.com/dvr/setup.sh"
+msg_warn "WARNING: This script will run an external installer from a third-party source (https://getchannels.com)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://getchannels.com/dvr/setup.sh"
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi

 setup_hwaccel

@@ -1,84 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/MoldyTaint/Cinephage
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-msg_info "Installing Dependencies"
-$STD apt install -y \
-  build-essential \
-  python3 \
-  libasound2t64 \
-  libgtk-3-0t64 \
-  libx11-xcb1 \
-  xvfb
-msg_ok "Installed Dependencies"
-
-setup_ffmpeg
-NODE_VERSION="24" setup_nodejs
-fetch_and_deploy_gh_release "cinephage" "MoldyTaint/Cinephage" "tarball"
-
-msg_info "Building Cinephage"
-cd /opt/cinephage
-$STD npm ci
-$STD npm run build
-$STD npm prune --omit=dev
-msg_ok "Built Cinephage"
-
-msg_info "Installing Camoufox"
-$STD /opt/cinephage/node_modules/.bin/camoufox-js fetch
-msg_ok "Installed Camoufox"
-
-msg_info "Configuring Cinephage"
-mkdir -p /opt/cinephage_data/indexers/custom /opt/cinephage_data/external-lists/custom
-cat <<EOF >/opt/cinephage_data/.env
-NODE_ENV=production
-HOST=0.0.0.0
-PORT=3000
-APP_VERSION=$(cat ~/.cinephage)
-BETTER_AUTH_SECRET=$(openssl rand -base64 32)
-DATA_DIR=/opt/cinephage_data
-INDEXER_DEFINITIONS_PATH=/opt/cinephage/data/indexers/definitions
-INDEXER_CUSTOM_DEFINITIONS_PATH=/opt/cinephage_data/indexers/custom
-EXTERNAL_LISTS_PRESETS_PATH=/opt/cinephage/data/external-lists/presets
-EXTERNAL_LISTS_CUSTOM_PRESETS_PATH=/opt/cinephage_data/external-lists/custom
-CAPTCHA_ADDON_PATH=/opt/cinephage/src/lib/server/captcha/browser/addon
-FFPROBE_PATH=/usr/bin/ffprobe
-EOF
-chmod 600 /opt/cinephage_data/.env
-msg_ok "Configured Cinephage"
-
-msg_info "Creating Service"
-cat <<EOF >/etc/systemd/system/cinephage.service
-[Unit]
-Description=Cinephage
-After=network.target
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=/opt/cinephage
-EnvironmentFile=/opt/cinephage_data/.env
-Environment=NODE_OPTIONS=--max-old-space-size=2048
-ExecStart=/usr/bin/node server.js
-Restart=on-failure
-RestartSec=10
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now cinephage
-msg_ok "Created Service"
-
-motd_ssh
-customize
-cleanup_lxc
@@ -15,16 +15,12 @@ update_os

 setup_deb_based() {
  setup_docker
-  if [[ -n "${var_docker_socket:-}" ]]; then
-    socket_choice="$var_docker_socket"
-  else
-    read -r -p "${TAB3}Expose Docker TCP socket (insecure) ? [n = No, l = Local only (127.0.0.1), a = All interfaces (0.0.0.0)] <n/l/a>: " socket_choice
-  fi
+  read -r -p "${TAB3}Expose Docker TCP socket (insecure) ? [n = No, l = Local only (127.0.0.1), a = All interfaces (0.0.0.0)] <n/l/a>: " socket_choice
  case "${socket_choice,,}" in
-  l | local)
+  l)
    socket="tcp://127.0.0.1:2375"
    ;;
-  a | all)
+  a)
    socket="tcp://0.0.0.0:2375"
    ;;
  *)
@@ -70,12 +66,8 @@ setup_alpine() {
  msg_ok "Installed Docker"

  DOCKER_COMPOSE_LATEST_VERSION=$(get_latest_github_release "docker/compose" false)
-  if [[ -n "${var_docker_compose:-}" ]]; then
-    prompt="$var_docker_compose"
-  else
-    read -r -p "${TAB3}Would you like to add Docker Compose? <y/N> " prompt
-  fi
-  if [[ "${prompt,,}" =~ ^(y|yes|true)$ ]]; then
+  read -r -p "${TAB3}Would you like to add Docker Compose? <y/N> " prompt
+  if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
    msg_info "Installing Docker Compose $DOCKER_COMPOSE_LATEST_VERSION"
    DOCKER_CONFIG=${DOCKER_CONFIG:-$HOME/.docker}
    mkdir -p "$DOCKER_CONFIG"/cli-plugins
@@ -83,23 +75,13 @@ setup_alpine() {
    chmod +x "$DOCKER_CONFIG"/cli-plugins/docker-compose
    msg_ok "Installed Docker Compose $DOCKER_COMPOSE_LATEST_VERSION"
  fi
-  if [[ -n "${var_docker_socket:-}" ]]; then
-    prompt="$var_docker_socket"
-  else
-    read -r -p "${TAB3}Would you like to expose the Docker TCP socket? <y/N> " prompt
-  fi
-  case "${prompt,,}" in
-  y | yes | a | all) socket="tcp://0.0.0.0:2375" ;;
-  l | local) socket="tcp://127.0.0.1:2375" ;;
-  *) socket="" ;;
-  esac
-  if [[ -n "$socket" ]]; then
-    msg_info "Exposing Docker TCP socket on $socket"
-    mkdir -p /etc/docker
-    # No $STD here: silent() captures stdout, which left daemon.json empty.
-    printf '{ "hosts": ["unix:///var/run/docker.sock", "%s"] }\n' "$socket" >/etc/docker/daemon.json
+  read -r -p "${TAB3}Would you like to expose the Docker TCP socket? <y/N> " prompt
+  if [[ "${prompt,,}" =~ ^(y|yes)$ ]]; then
+    msg_info "Exposing Docker TCP socket"
+    $STD mkdir -p /etc/docker
+    $STD echo '{ "hosts": ["unix:///var/run/docker.sock", "tcp://0.0.0.0:2375"] }' >/etc/docker/daemon.json
    $STD rc-service docker restart
-    msg_ok "Exposed Docker TCP socket on $socket"
+    msg_ok "Exposed Docker TCP socket at tcp://+:2375"
  fi
 }

@@ -21,7 +21,7 @@ PYTHON_VERSION="3.13" setup_uv
 NODE_VERSION="24" setup_nodejs
 PG_VERSION="17" PG_MODULES="postgis" setup_postgresql
 PG_DB_NAME="enduraindb" PG_DB_USER="endurain" setup_postgresql_db
-fetch_and_deploy_gh_release "endurain" "endurain-project/endurain"
+fetch_and_deploy_codeberg_release "endurain" "endurain-project/endurain" "tarball" "latest" "/opt/endurain"

 msg_info "Setting up Endurain"
 cd /opt/endurain
@@ -33,7 +33,16 @@ NODE_OPTIONS=${NODE_OPTIONS}
 EOF
 msg_ok "Configured Service Environment"

-confirm_external_installer "https://hermes-agent.nousresearch.com/" "https://hermes-agent.nousresearch.com/install.sh"
+msg_warn "WARNING: This script will run an external installer from a third-party source (https://hermes-agent.nousresearch.com/)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://hermes-agent.nousresearch.com/install.sh"
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi

 msg_info "Installing Hermes Agent"
 curl -fsSL https://hermes-agent.nousresearch.com/install.sh -o /tmp/hermes-install.sh
@@ -17,7 +17,16 @@ msg_info "Installing Dependencies"
 $STD apt install -y ca-certificates
 msg_ok "Installed Dependencies"

-confirm_external_installer "https://iobroker.net/" "https://iobroker.net/install.sh"
+msg_warn "WARNING: This script will run an external installer from a third-party source (https://iobroker.net/)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://iobroker.net/install.sh"
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi

 NODE_VERSION="24" NPM_VERSION="11" setup_nodejs

@@ -56,7 +56,16 @@ if [[ -z "$KASM_VERSION" ]] || [[ -z "$KASM_URL" ]]; then
 fi
 msg_ok "Detected Kasm Workspaces version $KASM_VERSION"

-confirm_external_installer "https://www.kasmweb.com/" "install.sh inside tar.gz $KASM_URL"
+msg_warn "WARNING: This script will run an external installer from a third-party source (https://www.kasmweb.com/)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  install.sh inside tar.gz $KASM_URL"
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi

 msg_info "Installing Kasm Workspaces"
 curl_download "/opt/kasm_release_${KASM_VERSION}.tar.gz" "$KASM_URL"
@@ -28,7 +28,16 @@ export HOME=/opt/livebook
 $STD adduser --system --group --home /opt/livebook --shell /bin/bash livebook
 msg_ok "Created livebook user"

-confirm_external_installer "https://elixir-lang.org" "https://elixir-lang.org/install.sh"
+msg_warn "WARNING: This script will run an external installer from a third-party source (https://elixir-lang.org)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://elixir-lang.org/install.sh"
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi
 curl -fsSO https://elixir-lang.org/install.sh
 $STD sh install.sh elixir@latest otp@latest

@@ -13,7 +13,16 @@ setting_up_container
 network_check
 update_os

-confirm_external_installer "https://mattermost.com/" "https://deb.packages.mattermost.com/repo-setup.sh"
+msg_warn "WARNING: This script will run an external installer from a third-party source (https://mattermost.com/)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://deb.packages.mattermost.com/repo-setup.sh"
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi

 PG_VERSION="16" setup_postgresql

@@ -13,7 +13,16 @@ setting_up_container
 network_check
 update_os

-confirm_external_installer "https://nextcloudpi.com/" "https://raw.githubusercontent.com/nextcloud/nextcloudpi/master/install.sh"
+msg_warn "WARNING: This script will run an external installer from a third-party source (https://nextcloudpi.com/)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://raw.githubusercontent.com/nextcloud/nextcloudpi/master/install.sh"
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi

 msg_info "Making ssh.service reloads behave like restarts"
 mkdir -p /etc/systemd/system/ssh.service.d
@@ -207,7 +207,7 @@ EOF
 $STD sudo -u cool coolconfig set ssl.enable false
 $STD sudo -u cool coolconfig set ssl.termination true
 $STD sudo -u cool coolconfig set ssl.ssl_verification true
-$STD sudo -u cool coolconfig set net.frame_ancestors "https://${OPENCLOUD_FQDN}"
+sed -i "s|-Policy\">|&frame-ancestors https://${OPENCLOUD_FQDN}|" /etc/coolwsd/coolwsd.xml
 useradd -r -M -s /usr/sbin/nologin opencloud
 chown -R opencloud:opencloud "$CONFIG_DIR" "$DATA_DIR"
 sudo -u opencloud opencloud init --config-path "$CONFIG_DIR" --insecure no
@@ -13,7 +13,16 @@ setting_up_container
 network_check
 update_os

-confirm_external_installer "https://pi-hole.net/" "https://install.pi-hole.net"
+msg_warn "WARNING: This script will run an external installer from a third-party source (https://pi-hole.net/)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://install.pi-hole.net"
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi

 msg_info "Installing Dependencies"
 $STD apt install -y ufw
@@ -15,7 +15,16 @@ update_os

 RELEASE=$(get_latest_github_release "wazuh/wazuh" | cut -d. -f1,2)

-confirm_external_installer "https://wazuh.com/" "https://packages.wazuh.com/$RELEASE/wazuh-install.sh"
+msg_warn "WARNING: This script will run an external installer from a third-party source (https://wazuh.com/)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://packages.wazuh.com/$RELEASE/wazuh-install.sh "
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi

 msg_info "Setup Wazuh"
 curl -fsSL https://packages.wazuh.com/$RELEASE/wazuh-install.sh -o wazuh-install.sh
@@ -1,144 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/WeblateOrg/weblate
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-msg_info "Installing Dependencies"
-$STD apt install -y \
-  build-essential \
-  pkg-config \
-  libacl1-dev \
-  liblz4-dev \
-  libzstd-dev \
-  libxxhash-dev \
-  libssl-dev \
-  libldap2-dev \
-  libsasl2-dev \
-  git \
-  gettext \
-  nginx \
-  valkey-server
-msg_ok "Installed Dependencies"
-
-PG_VERSION="17" setup_postgresql
-PG_DB_NAME="weblate" PG_DB_USER="weblate" setup_postgresql_db
-PYTHON_VERSION="3.14" setup_uv
-USE_ORIGINAL_FILENAME=true fetch_and_deploy_gh_release "weblate" "WeblateOrg/weblate" "singlefile" "latest" "/opt/weblate" "weblate-*-py3-none-any.whl"
-
-msg_info "Installing Weblate"
-$STD uv venv --python 3.14 /opt/weblate/.venv
-$STD uv pip install --python /opt/weblate/.venv/bin/python --compile-bytecode /opt/weblate/weblate-*.whl "weblate[all,wsgi]"
-rm -f /opt/weblate/weblate-*.whl
-msg_ok "Installed Weblate"
-
-msg_info "Configuring Weblate"
-mkdir -p /opt/weblate_data/python/customize /app
-# weblate.settings_docker is upstream's env-driven settings; it reads the secret and
-# settings-override.py from /app/data and loads the "customize" app from DATA_DIR/python
-ln -sfn /opt/weblate_data /app/data
-touch /opt/weblate_data/python/customize/{__init__,models}.py
-/opt/weblate/.venv/bin/weblate-generate-secret-key >/opt/weblate_data/secret
-cat <<EOF >/opt/weblate_data/weblate.env
-DJANGO_SETTINGS_MODULE=weblate.settings_docker
-PYTHONPATH=/opt/weblate_data/python
-WEBLATE_SITE_DOMAIN=${LOCAL_IP}
-WEBLATE_DATA_DIR=/opt/weblate_data
-WEBLATE_CACHE_DIR=/opt/weblate/cache
-WEBLATE_IP_PROXY_HEADER=HTTP_X_FORWARDED_FOR
-POSTGRES_HOST=127.0.0.1
-POSTGRES_DB=weblate
-POSTGRES_USER=weblate
-POSTGRES_PASSWORD=${PG_DB_PASS}
-REDIS_HOST=127.0.0.1
-# Password set for the "admin" account at install; Weblate does not read it
-WEBLATE_ADMIN_PASSWORD=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c16)
-EOF
-chmod 600 /opt/weblate_data/secret /opt/weblate_data/weblate.env
-set -a
-source /opt/weblate_data/weblate.env
-set +a
-$STD /opt/weblate/.venv/bin/weblate migrate --noinput
-$STD /opt/weblate/.venv/bin/weblate createadmin --password="${WEBLATE_ADMIN_PASSWORD}"
-$STD /opt/weblate/.venv/bin/weblate collectstatic --noinput
-msg_ok "Configured Weblate"
-
-msg_info "Configuring Nginx"
-cat <<EOF >/etc/nginx/sites-available/weblate
-server {
-    listen 80;
-    server_name _;
-    client_max_body_size 1000M;
-
-    location = /favicon.ico {
-        alias /opt/weblate/cache/static/favicon.ico;
-        expires 30d;
-    }
-
-    location /static/ {
-        alias /opt/weblate/cache/static/;
-        expires 30d;
-    }
-
-    location / {
-        proxy_pass http://127.0.0.1:8888;
-        proxy_set_header Host \$http_host;
-        proxy_set_header X-Forwarded-For \$remote_addr;
-        proxy_set_header X-Forwarded-Proto \$scheme;
-        proxy_read_timeout 3600;
-    }
-}
-EOF
-nginx_enable_site "weblate"
-msg_ok "Configured Nginx"
-
-msg_info "Creating Services"
-cat <<EOF >/etc/systemd/system/weblate.service
-[Unit]
-Description=Weblate
-After=network.target postgresql.service valkey-server.service
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=/opt/weblate_data
-EnvironmentFile=/opt/weblate_data/weblate.env
-ExecStart=/opt/weblate/.venv/bin/granian --interface wsgi --host 127.0.0.1 --port 8888 --workers 2 --blocking-threads 8 --backlog 128 --backpressure 16 --runtime-mode mt --workers-max-rss 450 --no-ws weblate.wsgi:application
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-cat <<EOF >/etc/systemd/system/weblate-celery.service
-[Unit]
-Description=Weblate Celery Worker
-After=network.target postgresql.service valkey-server.service
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=/opt/weblate_data
-EnvironmentFile=/opt/weblate_data/weblate.env
-ExecStart=/opt/weblate/.venv/bin/celery --app=weblate.utils worker --beat --loglevel=info --queues=celery,notify,memory,translate,backup --prefetch-multiplier=1 --concurrency=2
-Restart=on-failure
-RestartSec=10
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now weblate weblate-celery
-msg_ok "Created Services"
-
-motd_ssh
-customize
-cleanup_lxc
@@ -20,7 +20,16 @@ $STD apt install -y \
  ca-certificates
 msg_ok "Installed Dependencies"

-confirm_external_installer "https://yunohost.org/" "https://install.yunohost.org"
+msg_warn "WARNING: This script will run an external installer from a third-party source (https://yunohost.org/)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://install.yunohost.org"
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! "$CONFIRM" =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi

 msg_info "Installing YunoHost (Patience)"
 touch /etc/.pve-ignore.resolv.conf
@@ -13,7 +13,16 @@ setting_up_container
 network_check
 update_os

-confirm_external_installer "https://install.zerotier.com" "https://install.zerotier.com"
+msg_warn "WARNING: This script will run an external installer from a third-party source (https://install.zerotier.com)."
+msg_warn "The following code is NOT maintained or audited by our repository."
+msg_warn "If you have any doubts or concerns, please review the installer code before proceeding:"
+msg_custom "${TAB3}${GATEWAY}${BGN}${CL}" "\e[1;34m" "→  https://install.zerotier.com"
+echo
+read -r -p "${TAB3}Do you want to continue? [y/N]: " CONFIRM
+if [[ ! $CONFIRM =~ ^([yY][eE][sS]|[yY])$ ]]; then
+  msg_error "Aborted by user. No changes have been made."
+  exit 10
+fi

 msg_info "Setting up Zerotier-One"
 curl -fsSL https://raw.githubusercontent.com/zerotier/ZeroTierOne/main/doc/contact%40zerotier.com.gpg | gpg --import >/dev/null 2>&1
@@ -96,27 +96,6 @@ if [[ -f "$LEGACY_DB" || -f "$LEGACY_BIN" && ! -f "$CONFIG_PATH" ]]; then
  fi
 fi

-# v2 rejects v1 config keys and imports the BoltDB on its first start
-migrate_v1_config() {
-  local dir="/usr/local/community-scripts" db=0
-  [[ -s "$dir/database.db" && ! -s "$dir/filebrowser.sqlite" ]] && db=1
-  ((db)) || grep -qE 'conditionals:|indexingIntervalMinutes:' "$CONFIG_PATH" || return 0
-  cp "$CONFIG_PATH" "${CONFIG_PATH}.v1.bak"
-  ((db)) && mv "$dir/database.db" "$dir/database.db.old"
-  awk -v db="$db" '
-    { match($0, /^ */); ind = RLENGTH }
-    /^[^ #]/ { top = $1 }
-    cond && ind > ci { print substr($0, 3); next }
-    { cond = 0 }
-    /^[[:space:]]*conditionals:[[:space:]]*$/ { cond = 1; ci = ind; next }
-    /^[[:space:]]*indexingIntervalMinutes:/ { next }
-    top == "server:" && /^  port:/ { port = $2; next }
-    { print }
-    /^server:/ && db { print "  database:"; print "    migrateFrom: \"database.db.old\"" }
-    END { if (port != "") { print "http:"; print "  port: " port } }
-  ' "${CONFIG_PATH}.v1.bak" >"$CONFIG_PATH"
-}
-
 # Existing installation
 if [[ -f "$INSTALL_PATH" ]]; then
  msg_warn "${APP} is already installed."
@@ -147,7 +126,6 @@ if [[ -f "$INSTALL_PATH" ]]; then
      mv -f /usr/local/bin/filebrowser-quantum "$INSTALL_PATH"
      if [[ -f "$CONFIG_PATH" ]]; then
        sed -i '/^\s*disableIndexing:/d' "$CONFIG_PATH"
-        migrate_v1_config
      fi
      if [[ "$OS" == "Debian" ]]; then
        systemctl restart filebrowser.service
@@ -195,21 +173,22 @@ read -r noauth_prompt
 # === YAML CONFIG GENERATION ===
 if [[ "${noauth_prompt,,}" =~ ^(y|yes)$ ]]; then
  cat <<EOF >"$CONFIG_PATH"
-http:
-  port: $PORT
 server:
+  port: $PORT
  sources:
    - path: "$SRC_DIR"
      name: "RootFS"
      config:
        denyByDefault: false
-        rules:
-          - neverWatchPath: "/proc"
-          - neverWatchPath: "/sys"
-          - neverWatchPath: "/dev"
-          - neverWatchPath: "/run"
-          - neverWatchPath: "/tmp"
-          - neverWatchPath: "/lost+found"
+        indexingIntervalMinutes: 240
+        conditionals:
+          rules:
+            - neverWatchPath: "/proc"
+            - neverWatchPath: "/sys"
+            - neverWatchPath: "/dev"
+            - neverWatchPath: "/run"
+            - neverWatchPath: "/tmp"
+            - neverWatchPath: "/lost+found"
 auth:
  methods:
    noauth: true
@@ -217,21 +196,22 @@ EOF
  msg_ok "Configured with no authentication"
 else
  cat <<EOF >"$CONFIG_PATH"
-http:
-  port: $PORT
 server:
+  port: $PORT
  sources:
    - path: "$SRC_DIR"
      name: "RootFS"
      config:
        denyByDefault: false
-        rules:
-          - neverWatchPath: "/proc"
-          - neverWatchPath: "/sys"
-          - neverWatchPath: "/dev"
-          - neverWatchPath: "/run"
-          - neverWatchPath: "/tmp"
-          - neverWatchPath: "/lost+found"
+        indexingIntervalMinutes: 240
+        conditionals:
+          rules:
+            - neverWatchPath: "/proc"
+            - neverWatchPath: "/sys"
+            - neverWatchPath: "/dev"
+            - neverWatchPath: "/run"
+            - neverWatchPath: "/tmp"
+            - neverWatchPath: "/lost+found"
 auth:
  adminUsername: admin
  adminPassword: community-scripts.org