Update CHANGELOG.md (#14168)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

CHANGELOG.md

@@ -448,14 +448,65 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
+## 2026-05-01
+
+### 🆕 New Scripts
+
+  - SoulSync ([#14124](https://github.com/community-scripts/ProxmoxVE/pull/14124))
+- Teable ([#14125](https://github.com/community-scripts/ProxmoxVE/pull/14125))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Step ca update [@heinemannj](https://github.com/heinemannj) ([#14058](https://github.com/community-scripts/ProxmoxVE/pull/14058))
+    - paperless-ngx: refresh NLTK data on update [@kurtislanderson](https://github.com/kurtislanderson) ([#14144](https://github.com/community-scripts/ProxmoxVE/pull/14144))
+    - [Pelican Panel] stop deleting the public storage [@LetterN](https://github.com/LetterN) ([#14145](https://github.com/community-scripts/ProxmoxVE/pull/14145))
+
+  - #### 🔧 Refactor
+
+    - Mail-Archiver: update dependencies [@tremor021](https://github.com/tremor021) ([#14152](https://github.com/community-scripts/ProxmoxVE/pull/14152))
+
+## 2026-04-30
+
+### 🆕 New Scripts
+
+  - Nagios ([#14126](https://github.com/community-scripts/ProxmoxVE/pull/14126))
+- Neko ([#14121](https://github.com/community-scripts/ProxmoxVE/pull/14121))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - alpine-docker: install openssl as core dependency | alpine-komodo: check & install openssl if missing [@MickLesk](https://github.com/MickLesk) ([#14134](https://github.com/community-scripts/ProxmoxVE/pull/14134))
+    - endurain: update source references to Codeberg [@MickLesk](https://github.com/MickLesk) ([#14128](https://github.com/community-scripts/ProxmoxVE/pull/14128))
+
+### 💾 Core
+
+  - #### 🔧 Refactor
+
+    - tools.func: Manage minor versions for MongoDB 8.x [@tremor021](https://github.com/tremor021) ([#14131](https://github.com/community-scripts/ProxmoxVE/pull/14131))
+
 ## 2026-04-29
 
 ### 🚀 Updated Scripts
 
+  - #### 🐞 Bug Fixes
+
+    - GrayLog: MongoDB update to 8.2.x [@tremor021](https://github.com/tremor021) ([#14114](https://github.com/community-scripts/ProxmoxVE/pull/14114))
+    - Graylog: Better information in the log file [@tremor021](https://github.com/tremor021) ([#14110](https://github.com/community-scripts/ProxmoxVE/pull/14110))
+
   - #### 🔧 Refactor
 
+    - Refactor: checkMK [@MickLesk](https://github.com/MickLesk) ([#14105](https://github.com/community-scripts/ProxmoxVE/pull/14105))
     - PatchMon: Unpin release [@tremor021](https://github.com/tremor021) ([#14097](https://github.com/community-scripts/ProxmoxVE/pull/14097))
 
+### 💾 Core
+
+  - #### 🔧 Refactor
+
+    - core: add guidance when storage lacks rootdir support [@MickLesk](https://github.com/MickLesk) ([#14108](https://github.com/community-scripts/ProxmoxVE/pull/14108))
+
 ## 2026-04-28
 
 ### 🆕 New Scripts

ct/checkmk.sh

@@ -23,26 +23,25 @@ function update_script() {
   header_info
   check_container_storage
   check_container_resources
-  if [[ ! -f /opt/checkmk_version.txt ]]; then
+  if ! command -v omd &>/dev/null; then
     msg_error "No ${APP} Installation Found!"
     exit
   fi
 
-  RELEASE=$(curl -fsSL https://api.github.com/repos/checkmk/checkmk/tags | grep "name" | awk '{print substr($2, 3, length($2)-4) }' | tr ' ' '\n' | grep -Ev 'rc|b' | sort -V | tail -n 1)
+  RELEASE=$(curl_with_retry "https://api.github.com/repos/checkmk/checkmk/tags" "-" | grep "name" | awk '{print substr($2, 3, length($2)-4) }' | tr ' ' '\n' | grep -Ev 'rc|b' | sort -V | tail -n 1)
   RELEASE="${RELEASE%%+*}"
-  msg_info "Updating ${APP} to v${RELEASE}"
+  msg_info "Updating checkmk"
   $STD omd stop monitoring
   $STD omd cp monitoring monitoringbackup
-  curl -fsSL "https://download.checkmk.com/checkmk/${RELEASE}/check-mk-raw-${RELEASE}_0.$(get_os_info codename)_amd64.deb" -o "/opt/checkmk.deb"
-  $STD apt-get install -y /opt/checkmk.deb
+  curl_with_retry "https://download.checkmk.com/checkmk/${RELEASE}/check-mk-community-${RELEASE}_0.$(get_os_info codename)_amd64.deb" "/opt/checkmk.deb"
+  $STD apt install -y /opt/checkmk.deb
   $STD omd --force -V ${RELEASE}.cre update --conflict=install monitoring
   $STD omd start monitoring
   $STD omd -f rm monitoringbackup
   $STD omd cleanup
   rm -rf /opt/checkmk.deb
-  msg_ok "Updated ${APP}"
+  msg_ok "Updated checkmk"
   msg_ok "Updated successfully!"
-
   exit
 }
 

ct/endurain.sh

@@ -3,7 +3,7 @@ source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxV
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: johanngrobe
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/joaovitoriasilva/endurain
+# Source: https://codeberg.org/endurain-project/endurain
 
 APP="Endurain"
 var_tags="${var_tags:-sport;social-media}"
@@ -28,7 +28,7 @@ function update_script() {
     msg_error "No ${APP} installation found!"
     exit 233
   fi
-  if check_for_gh_release "endurain" "endurain-project/endurain"; then
+  if check_for_codeberg_release "endurain" "endurain-project/endurain"; then
     msg_info "Stopping Service"
     systemctl stop endurain
     msg_ok "Stopped Service"
@@ -38,7 +38,7 @@ function update_script() {
     cp /opt/endurain/frontend/app/dist/env.js /opt/endurain.env.js
     msg_ok "Created Backup"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "endurain" "endurain-project/endurain" "tarball" "latest" "/opt/endurain"
+    CLEAN_INSTALL=1 fetch_and_deploy_codeberg_release "endurain" "endurain-project/endurain" "tarball" "latest" "/opt/endurain"
 
     msg_info "Preparing Update"
     cd /opt/endurain

ct/graylog.sh

@@ -37,7 +37,7 @@ function update_script() {
   CURRENT_VERSION=$(apt list --installed 2>/dev/null | grep graylog-server | grep -oP '\d+\.\d+\.\d+')
 
   if dpkg --compare-versions "$CURRENT_VERSION" lt "6.3"; then
-    MONGO_VERSION="8.0" setup_mongodb
+    MONGO_VERSION="8.2" setup_mongodb
 
     msg_info "Updating Graylog"
     $STD apt update

ct/headers/nagios

@@ -0,0 +1,6 @@
+    _   __            _           
+   / | / /___ _____ _(_)___  _____
+  /  |/ / __ `/ __ `/ / __ \/ ___/
+ / /|  / /_/ / /_/ / / /_/ (__  ) 
+/_/ |_/\__,_/\__, /_/\____/____/  
+            /____/                

ct/headers/neko

@@ -0,0 +1,6 @@
+    _   __     __       
+   / | / /__  / /______ 
+  /  |/ / _ \/ //_/ __ \
+ / /|  /  __/ ,< / /_/ /
+/_/ |_/\___/_/|_|\____/ 
+                        

ct/headers/soulsync

@@ -0,0 +1,6 @@
+   _____             _______                 
+  / ___/____  __  __/ / ___/__  ______  _____
+  \__ \/ __ \/ / / / /\__ \/ / / / __ \/ ___/
+ ___/ / /_/ / /_/ / /___/ / /_/ / / / / /__  
+/____/\____/\__,_/_//____/\__, /_/ /_/\___/  
+                         /____/              

ct/headers/teable

@@ -0,0 +1,6 @@
+  ______           __    __   
+ /_  __/__  ____ _/ /_  / /__ 
+  / / / _ \/ __ `/ __ \/ / _ \
+ / / /  __/ /_/ / /_/ / /  __/
+/_/  \___/\__,_/_.___/_/\___/ 
+                              

ct/mail-archiver.sh

@@ -28,6 +28,8 @@ function update_script() {
     exit
   fi
 
+  ensure_dependencies libgssapi-krb5-2
+
   if check_for_gh_release "mail-archiver" "s1t5/mail-archiver"; then
     msg_info "Stopping Mail-Archiver"
     systemctl stop mail-archiver

ct/nagios.sh

@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: CanbiZ (MickLesk)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/NagiosEnterprises/nagioscore
+
+APP="Nagios"
+var_tags="${var_tags:-monitoring;alerts;infrastructure}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-20}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f /usr/local/nagios/etc/nagios.cfg ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  msg_info "Backing up Configuration"
+  cp -a /usr/local/nagios/etc /opt/nagios-etc-backup
+  msg_ok "Backed up Configuration"
+
+  if check_for_gh_release "nagios" "NagiosEnterprises/nagioscore"; then
+    msg_info "Stopping Nagios"
+    systemctl stop nagios
+    msg_ok "Stopped Nagios"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "nagios" "NagiosEnterprises/nagioscore" "tarball"
+
+    msg_info "Building Nagios Core"
+    cd /opt/nagios
+    $STD ./configure --with-httpd-conf=/etc/apache2/sites-enabled
+    $STD make all
+    $STD make install-groups-users
+    usermod -a -G nagios www-data
+    $STD make install
+    $STD make install-daemoninit
+    $STD make install-commandmode
+    $STD make install-webconf
+    $STD a2enmod rewrite
+    $STD a2enmod cgi
+    msg_ok "Built Nagios Core"
+
+    msg_info "Starting Nagios"
+    systemctl restart apache2
+    systemctl start nagios
+    msg_ok "Started Nagios"
+  fi
+
+  if check_for_gh_release "nagios-plugins" "nagios-plugins/nagios-plugins"; then
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "nagios-plugins" "nagios-plugins/nagios-plugins" "tarball"
+    msg_info "Building Nagios Plugins"
+    cd /opt/nagios-plugins
+    $STD ./tools/setup
+    $STD ./configure
+    $STD make
+    $STD make install
+    msg_ok "Built Nagios Plugins"
+  fi
+
+  msg_info "Restoring Configuration"
+  rm -rf /usr/local/nagios/etc
+  cp -a /opt/nagios-etc-backup /usr/local/nagios/etc
+  rm -rf /opt/nagios-etc-backup
+  msg_ok "Restored Configuration"
+  msg_ok "Updated successfully!"
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}/nagios${CL}"

ct/neko.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: CanbiZ (MickLesk)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://neko.m1k1o.net/
+
+APP="Neko"
+var_tags="${var_tags:-virtual-browser;webrtc;streaming}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-4096}"
+var_disk="${var_disk:-12}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-12}"
+var_unprivileged="${var_unprivileged:-1}"
+var_gpu="${var_gpu:-yes}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/neko ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "neko" "m1k1o/neko"; then
+    msg_info "Stopping Service"
+    systemctl stop neko
+    msg_ok "Stopped Service"
+
+    msg_info "Backing up Data"
+    cp /etc/neko/neko.yaml /opt/neko.yaml.bak
+    msg_ok "Backed up Data"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "neko" "m1k1o/neko" "tarball"
+
+    msg_info "Building Client"
+    cd /opt/neko/client
+    $STD npm install
+    $STD npm run build
+    cp -r /opt/neko/client/dist/* /var/www/
+    msg_ok "Built Client"
+
+    msg_info "Building Server"
+    cd /opt/neko/server
+    $STD ./build
+    cp /opt/neko/server/bin/neko /usr/bin/neko
+    cp -r /opt/neko/server/bin/plugins/* /etc/neko/plugins/ 2>/dev/null || true
+    msg_ok "Built Server"
+
+    msg_info "Restoring Data"
+    cp /opt/neko.yaml.bak /etc/neko/neko.yaml
+    rm -f /opt/neko.yaml.bak
+    msg_ok "Restored Data"
+
+    msg_info "Starting Service"
+    systemctl start neko
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:8080${CL}"

ct/paperless-ngx.sh

@@ -164,6 +164,14 @@ function update_script() {
       fi
     fi
 
+    msg_info "Updating NLTK Data"
+    cd /opt/paperless
+    $STD uv run python -m nltk.downloader -d /usr/share/nltk_data snowball_data
+    $STD uv run python -m nltk.downloader -d /usr/share/nltk_data stopwords
+    $STD uv run python -m nltk.downloader -d /usr/share/nltk_data punkt_tab ||
+      $STD uv run python -m nltk.downloader -d /usr/share/nltk_data punkt
+    msg_ok "Updated NLTK Data"
+
     msg_info "Starting all Paperless-ngx Services"
     systemctl start paperless-consumer paperless-webserver paperless-scheduler paperless-task-queue
     sleep 1

ct/pelican-panel.sh

@@ -45,15 +45,21 @@ function update_script() {
     $STD php artisan down
     msg_ok "Stopped Service"
 
-    cp -r /opt/pelican-panel/.env /opt/
+    cp -a /opt/pelican-panel/.env /opt/backup
+    cp -a /opt/pelican-panel/storage/app/public /opt/backup/storage/app/
+    
     SQLITE_INSTALL=$(ls /opt/pelican-panel/database/*.sqlite 1>/dev/null 2>&1 && echo "true" || echo "false")
-    $SQLITE_INSTALL && cp -r /opt/pelican-panel/database/*.sqlite /opt/
-    rm -rf * .*
+    $SQLITE_INSTALL && cp -r /opt/pelican-panel/database/*.sqlite /opt/backup
+    
+    find /opt/pelican-panel -mindepth 1 -maxdepth 1 ! -name 'backup' ! -name 'plugins' -exec rm -rf {} +
+    
     fetch_and_deploy_gh_release "pelican-panel" "pelican-dev/panel" "prebuild" "latest" "/opt/pelican-panel" "panel.tar.gz"
 
     msg_info "Updating Pelican Panel"
-    mv /opt/.env /opt/pelican-panel/
-    $SQLITE_INSTALL && mv /opt/*.sqlite /opt/pelican-panel/database/
+    cp -a /opt/backup/.env /opt/pelican-panel/
+    $SQLITE_INSTALL && mv /opt/backup/*.sqlite /opt/pelican-panel/database/
+    cp -a /opt/backup/storage/app/public /opt/pelican-panel/storage/app/
+
     $STD composer install --no-dev --optimize-autoloader --no-interaction
     $STD php artisan p:environment:setup
     $STD php artisan view:clear

ct/soulsync.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Nezreka/SoulSync
+
+APP="SoulSync"
+var_tags="${var_tags:-music;automation;media}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-8}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -f ~/.soulsync ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "soulsync" "Nezreka/SoulSync"; then
+    msg_info "Stopping Service"
+    systemctl stop soulsync
+    msg_ok "Stopped Service"
+
+    msg_info "Backing up Data"
+    mv /opt/soulsync/config /opt/soulsync-config.bak
+    mv /opt/soulsync/data /opt/soulsync-data.bak
+    msg_ok "Backed up Data"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "soulsync" "Nezreka/SoulSync" "tarball"
+
+    msg_info "Updating Python Dependencies"
+    cd /opt/soulsync
+    $STD uv venv --clear /opt/soulsync/.venv --python 3.11
+    $STD /opt/soulsync/.venv/bin/pip install -r requirements.txt
+    msg_ok "Updated Python Dependencies"
+
+    mv /opt/soulsync-config.bak /opt/soulsync/config
+    mv /opt/soulsync-data.bak /opt/soulsync/data
+
+    msg_info "Starting Service"
+    systemctl start soulsync
+    msg_ok "Started Service"
+    msg_ok "Updated ${APP}"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:8008${CL}"

ct/step-ca.sh

@@ -30,6 +30,12 @@ function update_script() {
   msg_info "Updating step-ca and step-cli"
   $STD apt update
   $STD apt upgrade -y step-ca step-cli
+
+  # Patch for making $STD happy (/usr/bin/step is a symlink to /usr/bin/step-cli)
+  STEPBIN="$(which step)"
+  rm -f "$STEPBIN"
+  cp -f "$(which step-cli)" "$STEPBIN"
+
   $STD systemctl restart step-ca
   msg_ok "Updated step-ca and step-cli"
 

ct/teable.sh

@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/teableio/teable
+
+APP="Teable"
+var_tags="${var_tags:-database;no-code;spreadsheet}"
+var_cpu="${var_cpu:-4}"
+var_ram="${var_ram:-10240}"
+var_disk="${var_disk:-25}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/teable ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  if check_for_gh_release "teable" "teableio/teable"; then
+    msg_info "Stopping Service"
+    systemctl stop teable
+    msg_ok "Stopped Service"
+
+    msg_info "Backing up Configuration"
+    cp /opt/teable/.env /opt/teable.env.bak
+    msg_ok "Backed up Configuration"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "teable" "teableio/teable" "tarball"
+
+    msg_info "Restoring Configuration"
+    mv /opt/teable.env.bak /opt/teable/.env
+    msg_ok "Restored Configuration"
+
+    msg_info "Rebuilding Teable"
+    cd /opt/teable
+    TEABLE_VERSION=$(cat ~/.teable)
+    echo "NEXT_PUBLIC_BUILD_VERSION=\"${TEABLE_VERSION}\"" >>apps/nextjs-app/.env
+    export HUSKY=0
+    export NODE_OPTIONS="--max-old-space-size=8192"
+    $STD pnpm install --frozen-lockfile
+    $STD pnpm -F @teable/db-main-prisma prisma-generate --schema ./prisma/postgres/schema.prisma
+    NODE_ENV=production NEXT_BUILD_ENV_TYPECHECK=false \
+      $STD pnpm -r --filter '!playground' run build
+    msg_ok "Rebuilt Teable"
+
+    msg_info "Running Database Migrations"
+    source /opt/teable/.env
+    $STD pnpm -F @teable/db-main-prisma prisma-migrate deploy --schema ./prisma/postgres/schema.prisma
+    msg_ok "Ran Database Migrations"
+
+    msg_info "Starting Service"
+    systemctl start teable
+    msg_ok "Started Service"
+    msg_ok "Updated successfully!"
+  else
+    msg_ok "No update available."
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed Successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:3000${CL}"

install/alpine-docker-install.sh

@@ -14,7 +14,7 @@ network_check
 update_os
 
 msg_info "Installing Dependencies"
-$STD apk add tzdata
+$STD apk add tzdata openssl
 msg_ok "Installed Dependencies"
 
 msg_info "Installing Docker"

install/checkmk-install.sh

@@ -14,10 +14,10 @@ network_check
 update_os
 
 msg_info "Install Checkmk"
-RELEASE=$(curl -fsSL https://api.github.com/repos/checkmk/checkmk/tags | grep "name" | awk '{print substr($2, 3, length($2)-4) }' | tr ' ' '\n' | grep -Ev 'rc|b' | sort -V | tail -n 1)
+RELEASE=$(curl_with_retry "https://api.github.com/repos/checkmk/checkmk/tags" "-" | grep "name" | awk '{print substr($2, 3, length($2)-4) }' | tr ' ' '\n' | grep -Ev 'rc|b' | sort -V | tail -n 1)
 RELEASE="${RELEASE%%+*}"
-curl -fsSL "https://download.checkmk.com/checkmk/${RELEASE}/check-mk-raw-${RELEASE}_0.$(get_os_info codename)_amd64.deb" -o "/opt/checkmk.deb"
-$STD apt-get install -y /opt/checkmk.deb
+curl_with_retry "https://download.checkmk.com/checkmk/${RELEASE}/check-mk-community-${RELEASE}_0.$(get_os_info codename)_amd64.deb" "/opt/checkmk.deb"
+$STD apt install -y /opt/checkmk.deb
 rm -rf /opt/checkmk.deb
 echo "${RELEASE}" >"/opt/checkmk_version.txt"
 msg_ok "Installed Checkmk"
@@ -29,14 +29,12 @@ MKPASSWORD=$(openssl rand -base64 18 | tr -d '/+=' | cut -c1-16)
 
 echo -e "$MKPASSWORD\n$MKPASSWORD" | su - "$SITE_NAME" -c "cmk-passwd cmkadmin --stdin"
 $STD omd start "$SITE_NAME"
-
 {
   echo "Application-Credentials"
   echo "Username: cmkadmin"
   echo "Password: $MKPASSWORD"
   echo "Site: $SITE_NAME"
 } >>~/checkmk.creds
-
 msg_ok "Created Service"
 
 cleanup_lxc

install/endurain-install.sh

@@ -3,7 +3,7 @@
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: johanngrobe
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/joaovitoriasilva/endurain
+# Source: https://codeberg.org/endurain-project/endurain
 
 source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
 color
@@ -21,7 +21,7 @@ PYTHON_VERSION="3.13" setup_uv
 NODE_VERSION="24" setup_nodejs
 PG_VERSION="17" PG_MODULES="postgis" setup_postgresql
 PG_DB_NAME="enduraindb" PG_DB_USER="endurain" setup_postgresql_db
-fetch_and_deploy_gh_release "endurain" "endurain-project/endurain" "tarball" "latest" "/opt/endurain"
+fetch_and_deploy_codeberg_release "endurain" "endurain-project/endurain" "tarball" "latest" "/opt/endurain"
 
 msg_info "Setting up Endurain"
 cd /opt/endurain

install/graylog-install.sh

@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os
 
-MONGO_VERSION="8.0" setup_mongodb
+MONGO_VERSION="8.2" setup_mongodb
 
 msg_info "Setup Graylog Data Node"
 PASSWORD_SECRET=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c16)
@@ -38,6 +38,8 @@ sed -i "s/password_secret =/password_secret = $PASSWORD_SECRET/g" /etc/graylog/s
 sed -i "s/root_password_sha2 =/root_password_sha2 = $ROOT_PASSWORD/g" /etc/graylog/server/server.conf
 sed -i 's/#http_bind_address = 127.0.0.1.*/http_bind_address = 0.0.0.0:9000/g' /etc/graylog/server/server.conf
 systemctl enable -q --now graylog-server
+sleep 5
+sed -i "s/0\.0\.0\.0:9000/$LOCAL_IP:9000/g" /var/log/graylog-server/server.log
 msg_ok "Setup ${APPLICATION}"
 
 motd_ssh

install/mail-archiver-install.sh

@@ -22,7 +22,8 @@ setup_deb822_repo \
   "main"
 $STD apt install -y \
   dotnet-sdk-10.0 \
-  aspnetcore-runtime-8.0
+  aspnetcore-runtime-8.0 \
+  libgssapi-krb5-2
 msg_ok "Installed Dependencies"
 
 PG_VERSION="17" setup_postgresql

install/nagios-install.sh

@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: CanbiZ (MickLesk)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/NagiosEnterprises/nagioscore
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  autoconf \
+  automake \
+  build-essential \
+  bc \
+  dc \
+  gawk \
+  gettext \
+  gperf \
+  libgd-dev \
+  libmcrypt-dev \
+  libnet-snmp-perl \
+  libssl-dev \
+  snmp \
+  apache2 \
+  apache2-utils
+msg_ok "Installed Dependencies"
+
+PHP_APACHE="YES" setup_php
+
+fetch_and_deploy_gh_release "nagios" "NagiosEnterprises/nagioscore" "tarball"
+
+msg_info "Building Nagios Core"
+cd /opt/nagios
+$STD ./configure --with-httpd-conf=/etc/apache2/sites-enabled
+$STD make all
+$STD make install-groups-users
+usermod -a -G nagios www-data
+$STD make install
+$STD make install-daemoninit
+$STD make install-commandmode
+$STD make install-config
+$STD make install-webconf
+$STD a2enmod rewrite
+$STD a2enmod cgi
+msg_ok "Built Nagios Core"
+
+fetch_and_deploy_gh_release "nagios-plugins" "nagios-plugins/nagios-plugins" "tarball"
+
+msg_info "Building Nagios Plugins"
+cd /opt/nagios-plugins
+$STD ./tools/setup
+$STD ./configure
+$STD make
+$STD make install
+msg_ok "Built Nagios Plugins"
+
+msg_info "Configuring Web Authentication"
+$STD htpasswd -bc /usr/local/nagios/etc/htpasswd.users nagiosadmin nagiosadmin
+chown root:www-data /usr/local/nagios/etc/htpasswd.users
+chmod 640 /usr/local/nagios/etc/htpasswd.users
+msg_ok "Configured Web Authentication"
+
+msg_info "Starting Services"
+systemctl enable -q apache2
+systemctl restart apache2
+systemctl enable -q --now nagios
+msg_ok "Started Services"
+
+motd_ssh
+customize
+cleanup_lxc

install/neko-install.sh

@@ -0,0 +1,255 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: CanbiZ (MickLesk)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://neko.m1k1o.net/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  supervisor \
+  pulseaudio \
+  dbus-x11 \
+  xserver-xorg-video-dummy \
+  xdotool \
+  xclip \
+  libgtk-3-0 \
+  gstreamer1.0-plugins-base \
+  gstreamer1.0-plugins-good \
+  gstreamer1.0-plugins-bad \
+  gstreamer1.0-plugins-ugly \
+  gstreamer1.0-pulseaudio \
+  openbox \
+  firefox-esr \
+  fonts-noto-color-emoji \
+  fonts-wqy-zenhei
+msg_ok "Installed Dependencies"
+systemctl disable -q --now supervisor
+
+msg_info "Installing Build Dependencies"
+$STD apt install -y \
+  build-essential \
+  pkg-config \
+  libx11-dev \
+  libxrandr-dev \
+  libxtst-dev \
+  libgtk-3-dev \
+  libxcvt-dev \
+  libgstreamer1.0-dev \
+  libgstreamer-plugins-base1.0-dev
+msg_ok "Installed Build Dependencies"
+
+NODE_VERSION="22" setup_nodejs
+setup_go
+
+fetch_and_deploy_gh_release "neko" "m1k1o/neko" "tarball"
+
+msg_info "Building Client"
+cd /opt/neko/client
+$STD npm install
+$STD npm run build
+mkdir -p /var/www
+cp -r /opt/neko/client/dist/* /var/www/
+msg_ok "Built Client"
+
+msg_info "Building Server"
+cd /opt/neko/server
+$STD ./build
+cp /opt/neko/server/bin/neko /usr/bin/neko
+mkdir -p /etc/neko/plugins
+cp -r /opt/neko/server/bin/plugins/* /etc/neko/plugins/ 2>/dev/null || true
+msg_ok "Built Server"
+
+msg_info "Setting up Runtime"
+useradd -m -s /bin/bash neko
+usermod -aG audio,video neko
+
+mkdir -p /etc/neko/supervisord /var/www /var/log/neko /tmp/.X11-unix /tmp/runtime-neko /home/neko/.config/pulse /home/neko/.local/share/xorg
+chmod 1777 /tmp/.X11-unix
+chmod 1777 /var/log/neko
+chmod 0700 /tmp/runtime-neko
+chown neko /tmp/.X11-unix /var/log/neko /tmp/runtime-neko
+chown -R neko:neko /home/neko
+
+cp /opt/neko/runtime/xorg.conf /etc/neko/xorg.conf
+# Remove the dummy_touchscreen InputDevice section (requires custom "neko" Xorg driver not available bare-metal)
+sed -i '/Section "InputDevice"/{N;/dummy_touchscreen/{:l;N;/EndSection/!bl;d}}' /etc/neko/xorg.conf
+sed -i '/dummy_touchscreen/d' /etc/neko/xorg.conf
+sed -i 's/InputDevice  "dummy_mouse"/InputDevice  "dummy_mouse" "CorePointer"/' /etc/neko/xorg.conf
+cp /opt/neko/runtime/default.pa /etc/pulse/default.pa
+
+cat <<EOF >/etc/neko/supervisord.conf
+[supervisord]
+nodaemon=true
+user=root
+pidfile=/var/run/supervisord.pid
+logfile=/dev/null
+logfile_maxbytes=0
+loglevel=debug
+
+[include]
+files=/etc/neko/supervisord/*.conf
+
+[program:x-server]
+environment=HOME="/home/neko",USER="neko"
+command=/usr/bin/X :99.0 -config /etc/neko/xorg.conf -noreset -nolisten tcp
+autorestart=true
+priority=300
+user=neko
+stdout_logfile=/var/log/neko/xorg.log
+stdout_logfile_maxbytes=100MB
+stdout_logfile_backups=10
+redirect_stderr=true
+
+[program:pulseaudio]
+environment=HOME="/home/neko",USER="neko",DISPLAY=":99.0"
+command=/usr/bin/pulseaudio --log-level=error --disallow-module-loading --disallow-exit --exit-idle-time=-1
+autorestart=true
+priority=300
+user=neko
+stdout_logfile=/var/log/neko/pulseaudio.log
+stdout_logfile_maxbytes=100MB
+stdout_logfile_backups=10
+redirect_stderr=true
+
+[program:neko]
+environment=HOME="/home/neko",USER="neko",DISPLAY=":99.0"
+command=/usr/bin/neko serve --server.static "/var/www"
+stopsignal=INT
+stopwaitsecs=3
+autorestart=true
+priority=800
+user=neko
+stdout_logfile=/var/log/neko/neko.log
+stdout_logfile_maxbytes=100MB
+stdout_logfile_backups=10
+redirect_stderr=true
+
+[unix_http_server]
+file=/var/run/supervisor.sock
+chmod=0770
+chown=root:neko
+
+[supervisorctl]
+serverurl=unix:///var/run/supervisor.sock
+
+[rpcinterface:supervisor]
+supervisor.rpcinterface_factory = supervisor.rpcinterface:make_main_rpcinterface
+EOF
+
+cat <<EOF >/etc/neko/supervisord/firefox.conf
+[program:firefox]
+environment=HOME="/home/neko",USER="neko",DISPLAY=":99.0"
+command=/usr/bin/firefox-esr --no-remote --display=:99.0 -width 1280 -height 720
+stopsignal=INT
+autorestart=true
+priority=800
+user=neko
+stdout_logfile=/var/log/neko/firefox.log
+stdout_logfile_maxbytes=100MB
+stdout_logfile_backups=10
+redirect_stderr=true
+
+[program:openbox]
+environment=HOME="/home/neko",USER="neko",DISPLAY=":99.0"
+command=/usr/bin/openbox --config-file /etc/neko/openbox.xml
+autorestart=true
+priority=300
+user=neko
+stdout_logfile=/var/log/neko/openbox.log
+stdout_logfile_maxbytes=100MB
+stdout_logfile_backups=10
+redirect_stderr=true
+EOF
+
+cat <<'EOF' >/etc/neko/openbox.xml
+<?xml version="1.0" encoding="UTF-8"?>
+<openbox_config xmlns="http://openbox.org/3.4/rc" xmlns:xi="http://www.w3.org/2001/XInclude">
+<applications>
+    <application class="firefox" name="Navigator" role="browser">
+      <decor>no</decor>
+      <maximized>true</maximized>
+      <focus>yes</focus>
+      <layer>normal</layer>
+    </application>
+</applications>
+<focus>
+  <focusNew>yes</focusNew>
+  <followMouse>no</followMouse>
+  <focusLast>yes</focusLast>
+  <underMouse>no</underMouse>
+  <focusDelay>200</focusDelay>
+  <raiseOnFocus>no</raiseOnFocus>
+</focus>
+<placement>
+  <policy>Smart</policy>
+  <center>yes</center>
+</placement>
+<desktops>
+  <number>1</number>
+  <firstdesk>1</firstdesk>
+  <popupTime>0</popupTime>
+</desktops>
+</openbox_config>
+EOF
+
+cat <<EOF >/etc/neko/neko.yaml
+server:
+  bind: "0.0.0.0:8080"
+  static: "/var/www"
+session:
+  cookie:
+    enabled: false
+webrtc:
+  icelite: true
+  nat1to1:
+    - "${LOCAL_IP}"
+  epr: "59000-59100"
+desktop:
+  input:
+    enabled: false
+member:
+  provider: "multiuser"
+  multiuser:
+    admin_password: "admin"
+    user_password: "neko"
+EOF
+msg_ok "Set up Runtime"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/neko.service
+[Unit]
+Description=Neko Virtual Browser
+After=network.target
+
+[Service]
+Type=simple
+User=root
+Environment=USER=neko
+Environment=DISPLAY=:99.0
+Environment=PULSE_SERVER=unix:/tmp/pulseaudio.socket
+Environment=XDG_RUNTIME_DIR=/tmp/runtime-neko
+Environment=NEKO_PLUGINS_ENABLED=true
+Environment=NEKO_PLUGINS_DIR=/etc/neko/plugins/
+Environment=NEKO_CONFIG=/etc/neko/neko.yaml
+ExecStart=/usr/bin/supervisord -c /etc/neko/supervisord.conf -n
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now neko
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/soulsync-install.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/Nezreka/SoulSync
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  gcc \
+  libffi-dev \
+  libssl-dev \
+  libchromaprint-tools \
+  ffmpeg
+msg_ok "Installed Dependencies"
+
+UV_PYTHON="3.11" setup_uv
+
+fetch_and_deploy_gh_release "soulsync" "Nezreka/SoulSync" "tarball"
+
+msg_info "Setting up Application"
+cd /opt/soulsync
+$STD uv venv /opt/soulsync/.venv --python 3.11
+$STD uv pip install -r requirements.txt --python /opt/soulsync/.venv/bin/python
+mkdir -p /opt/soulsync/{config,data,logs}
+msg_ok "Set up Application"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/soulsync.service
+[Unit]
+Description=SoulSync Music Discovery
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/soulsync
+ExecStart=/opt/soulsync/.venv/bin/python web_server.py
+Environment=PYTHONPATH=/opt/soulsync PYTHONUNBUFFERED=1 DATABASE_PATH=/opt/soulsync/data/music_library.db
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now soulsync
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

install/step-ca-install.sh

@@ -23,21 +23,34 @@ setup_deb822_repo \
 msg_info "Installing step-ca and step-cli"
 $STD apt install -y step-ca step-cli
 
-STEPHOME="/root/.step"
-export STEPPATH=/etc/step-ca
+STEPPATH="/etc/step-ca"
+STEPHOME="/etc/step"
+
+export STEPPATH=$STEPPATH
+echo "export STEPPATH=${STEPPATH}" >> /etc/profile
 export STEPHOME=$STEPHOME
+echo "export STEPHOME=${STEPHOME}" >> /etc/profile
 
-sed  -i '1i export STEPPATH=/etc/step-ca' /etc/profile
-sed  -i '1i export STEPHOME=/root/.step' /etc/profile
+mkdir -p "$STEPHOME"
 
-setcap CAP_NET_BIND_SERVICE=+eip $(which step-ca)
+# Patch for making $STD happy (/usr/bin/step is a symlink to /usr/bin/step-cli)
+STEPBIN="$(which step)"
+rm -f "$STEPBIN"
+cp -f "$(which step-cli)" "$STEPBIN"
 
-$STD useradd --user-group --system --home $(step path) --shell /bin/false step
+# Low port-binding capabilities (ports < 1024)
+# - Default step-ca listener port: 443
+setcap CAP_NET_BIND_SERVICE=+eip "$(which step-ca)"
+
+# Service User used by systemd step-ca.service
+$STD useradd --user-group --system --home "$(step path)" --shell /bin/false step
 msg_ok "Installed step-ca and step-cli"
 
 DomainName="$(hostname -d)"
 
 PKIName="$(prompt_input "Enter PKIName" "MyHomePKI" 30)"
+PKICountry="$(prompt_input "Enter PKICountry" "DE" 30)"
+PKIOrganizationalUnit="$(prompt_input "Enter PKIOrganizationalUnit" "MyHomeLab" 30)"
 PKIProvisioner="$(prompt_input "Enter PKIProvisioner" "pki@$DomainName" 30)"
 AcmeProvisioner="$(prompt_input "Enter AcmeProvisioner" "acme@$DomainName" 30)"
 X509MinDur="$(prompt_input "Enter X509MinDur" "48h" 30)"
@@ -45,11 +58,15 @@ X509MaxDur="$(prompt_input "Enter X509MaxDur" "87600h" 30)"
 X509DefaultDur="$(prompt_input "Enter X509DefaultDur" "168h" 30)"
 
 msg_info "Initializing step-ca"
+
+# Initialize step-ca
 DeploymentType="standalone"
 FQDN="$(hostname -f)"
 IP="${LOCAL_IP}"
 LISTENER=":443"
+LISTENER_INSECURE=":80"
 
+# Set different signing CA and Provisioner Passwords
 EncryptionPwdDir="$(step path)/encryption"
 PwdFile="$EncryptionPwdDir/ca.pwd"
 ProvisionerPwdFile="$EncryptionPwdDir/provisioner.pwd"
@@ -57,19 +74,208 @@ mkdir -p "$EncryptionPwdDir"
 gpg -q --gen-random --armor 2 32 >"$PwdFile"
 gpg -q --gen-random --armor 2 32 >"$ProvisionerPwdFile"
 
-$STD step ca init --deployment-type="$DeploymentType" --ssh --name="$PKIName" --dns="$FQDN" --dns="$IP" --address="$LISTENER" --provisioner="$PKIProvisioner" --password-file="$PwdFile" --provisioner-password-file="$ProvisionerPwdFile"
-
+# Used by systemd step-ca.service
 ln -s "$PwdFile" "$(step path)/password.txt"
-chown -R step:step $(step path)
-chmod -R 700 $(step path)
-$STD step ca provisioner add "$AcmeProvisioner" --type ACME --admin-name "$AcmeProvisioner"
-$STD step ca provisioner update "$PKIProvisioner" --x509-min-dur="$X509MinDur" --x509-max-dur="$X509MaxDur" --x509-default-dur="$X509DefaultDur" --allow-renewal-after-expiry
-$STD step ca provisioner update "$AcmeProvisioner" --x509-min-dur="$X509MinDur" --x509-max-dur="$X509MaxDur" --x509-default-dur="$X509DefaultDur" --allow-renewal-after-expiry
-$STD step certificate install --all $(step path)/certs/root_ca.crt
+
+# Usage of:
+# - SSH feature of step-ca
+# - BadgerDB (badgerv2) => Default DB backend of step-ca
+# - badgerFileLoadingMode: FileIO (instead of MemoryMap) for LXC with low RAM
+$STD step ca init \
+  --deployment-type="$DeploymentType" \
+  --ssh \
+  --name="$PKIName" \
+  --dns="$FQDN" \
+  --dns="$IP" \
+  --address="$LISTENER" \
+  --provisioner="$PKIProvisioner" \
+  --password-file="$PwdFile" \
+  --provisioner-password-file="$ProvisionerPwdFile"
+
+# Define enhanced x509 CA and Certificate Templates
+mkdir -p "$(step path)/templates/ca"
+mkdir -p "$(step path)/templates/x509"
+
+CARootTemplate="$(step path)/templates/ca/root.tpl"
+CAIntermediateTemplate="$(step path)/templates/ca/intermediate.tpl"
+X509LeafTemplate="$(step path)/templates/x509/leaf.tpl"
+X509LeafTemplateData="$(step path)/templates/x509/leaf_data.tpl"
+
+cat <<'EOF' >"$CARootTemplate"
+{
+	"subject": {
+		"country": {{ toJson .Insecure.User.country }},
+		"organization": {{ toJson .Insecure.User.organization }},
+		"organizationalUnit": {{ toJson .Insecure.User.organizationalUnit }},
+		"commonName": {{ toJson .Subject.CommonName }}
+	},
+  "issuer": {{ toJson .Subject }},
+	"keyUsage": ["certSign", "crlSign"],
+	"basicConstraints": {
+		"isCA": true,
+		"maxPathLen": 1
+	},
+	"issuingCertificateURL": [{{ toJson .Insecure.User.issuingCertificateURL }}],
+	"crlDistributionPoints": [{{ toJson .Insecure.User.crlDistributionPoints }}]
+}
+EOF
+
+cat <<'EOF' >"$CAIntermediateTemplate"
+{
+	"subject": {
+		"country": {{ toJson .Insecure.User.country }},
+		"organization": {{ toJson .Insecure.User.organization }},
+		"organizationalUnit": {{ toJson .Insecure.User.organizationalUnit }},
+		"commonName": {{ toJson .Subject.CommonName }}
+	},
+	"keyUsage": ["certSign", "crlSign"],
+	"basicConstraints": {
+		"isCA": true,
+		"maxPathLen": 0
+	},
+	"issuingCertificateURL": [{{ toJson .Insecure.User.issuingCertificateURL }}],
+	"crlDistributionPoints": [{{ toJson .Insecure.User.crlDistributionPoints }}]
+}
+EOF
+
+cat <<'EOF' >"$X509LeafTemplate"
+{
+	"subject": {
+{{- if .Insecure.User.Country }}
+		"country": {{ toJson .Insecure.User.country }},
+{{- else }}
+		"country": {{ toJson .country }},
+{{- end }}
+{{- if .Insecure.User.organization }}
+		"organization": {{ toJson .Insecure.User.organization }},
+{{- else }}
+		"organization": {{ toJson .organization }},
+{{- end }}
+{{- if .Insecure.User.organizationalUnit }}
+		"organizationalUnit": {{ toJson .Insecure.User.organizationalUnit }},
+{{- else }}
+		"organizationalUnit": {{ toJson .organizationalUnit }},
+{{- end }}
+		"commonName": {{ toJson .Subject.CommonName }}
+	},
+	"sans": {{ toJson .SANs }},
+{{- if typeIs "*rsa.PublicKey" .Insecure.CR.PublicKey }}
+	"keyUsage": ["keyEncipherment", "digitalSignature"],
+{{- else }}
+	"keyUsage": ["digitalSignature"],
+{{- end }}
+	"extKeyUsage": ["serverAuth", "clientAuth"],
+{{- if .Insecure.User.issuingCertificateURL }}
+	"issuingCertificateURL": [{{ toJson .Insecure.User.issuingCertificateURL }}],
+{{- else }}
+	"issuingCertificateURL": [{{ toJson .issuingCertificateURL }}],
+{{- end }}
+{{- if .Insecure.User.crlDistributionPoints }}
+	"crlDistributionPoints": [{{ toJson .Insecure.User.crlDistributionPoints }}]
+{{- else }}
+	"crlDistributionPoints": [{{ toJson .crlDistributionPoints }}]
+{{- end }}
+}
+EOF
+
+cat <<EOF >"$X509LeafTemplateData"
+{
+	"country": "${PKICountry}",
+	"organization": "${PKIName}",
+	"organizationalUnit": "${PKIOrganizationalUnit}",
+	"issuingCertificateURL": ["https://${FQDN}${LISTENER}/intermediates.pem"],
+	"crlDistributionPoints": ["https://${FQDN}${LISTENER}/crl"]
+}
+EOF
+
+# Configure CA Provisioners, DB and CRL settings
+$STD step ca provisioner add "$AcmeProvisioner" \
+  --type ACME \
+  --admin-name "$AcmeProvisioner"
+
+$STD step ca provisioner update "$PKIProvisioner" \
+  --x509-min-dur="$X509MinDur" \
+  --x509-max-dur="$X509MaxDur" \
+  --x509-default-dur="$X509DefaultDur" \
+  --x509-template="$X509LeafTemplate" \
+  --x509-template-data="$X509LeafTemplateData" \
+  --allow-renewal-after-expiry
+
+$STD step ca provisioner update "$AcmeProvisioner" \
+  --x509-min-dur="$X509MinDur" \
+  --x509-max-dur="$X509MaxDur" \
+  --x509-default-dur="$X509DefaultDur" \
+  --x509-template="$X509LeafTemplate" \
+  --x509-template-data="$X509LeafTemplateData" \
+  --allow-renewal-after-expiry
+
+CAConfig="$(step path)/config/ca.json"
+jq --arg a "${PKICountry}" '.country = $a' "${CAConfig}" > "${CAConfig}_tmp" && mv "${CAConfig}_tmp" "${CAConfig}"
+jq --arg a "${PKIName}" '.organization = $a' "${CAConfig}" > "${CAConfig}_tmp" && mv "${CAConfig}_tmp" "${CAConfig}"
+jq --arg a "${PKIOrganizationalUnit}" '.organizationalUnit = $a' "${CAConfig}" > "${CAConfig}_tmp" && mv "${CAConfig}_tmp" "${CAConfig}"
+jq --arg a "${PKIName} Online CA" '.commonName = $a' "${CAConfig}" > "${CAConfig}_tmp" && mv "${CAConfig}_tmp" "${CAConfig}"
+jq '.db.badgerFileLoadingMode = "FileIO"' "${CAConfig}" > "${CAConfig}_tmp" && mv "${CAConfig}_tmp" "${CAConfig}"
+jq '.crl.enabled = true' "${CAConfig}" > "${CAConfig}_tmp" && mv "${CAConfig}_tmp" "${CAConfig}"
+jq '.crl.generateOnRevoke = true' "${CAConfig}" > "${CAConfig}_tmp" && mv "${CAConfig}_tmp" "${CAConfig}"
+jq '.crl.cacheDuration = "24h0m0s"' "${CAConfig}" > "${CAConfig}_tmp" && mv "${CAConfig}_tmp" "${CAConfig}"
+jq '.crl.renewPeriod = "16h0m0s"' "${CAConfig}" > "${CAConfig}_tmp" && mv "${CAConfig}_tmp" "${CAConfig}"
+jq --arg a "https://${FQDN}${LISTENER}/crl" '.crl.idpURL = $a' "${CAConfig}" > "${CAConfig}_tmp" && mv "${CAConfig}_tmp" "${CAConfig}"
+jq --arg a "$LISTENER_INSECURE" '.insecureAddress = $a' "${CAConfig}" > "${CAConfig}_tmp" && mv "${CAConfig}_tmp" "${CAConfig}"
+
+# Generate Root CA Certificate and Key
+# - Validity: 219168h (~25 Years)
+# - maxPathLen: 1 (Root -> Intermediate -> Leaf) => Only one Intermediate CA allowed below Root CA
+# - Active revocation on Intermediate CA and Leaf Certificates by the usage of build-in Certificate Revocation List (CRL)
+FLAGS=(--force
+  --template="${CARootTemplate}"
+  --not-after="219168h"
+  --password-file="${PwdFile}"
+  --set country="${PKICountry}"
+  --set organization="${PKIName}"
+  --set organizationalUnit="${PKIOrganizationalUnit}"
+  --set issuingCertificateURL="https://${FQDN}${LISTENER}/roots.pem"
+  --set crlDistributionPoints="https://${FQDN}${LISTENER}/crl")
+
+$STD step certificate create "${PKIName} Root CA" \
+  "$(step path)/certs/root_ca.crt" \
+  "$(step path)/secrets/root_ca_key" \
+  "${FLAGS[@]}"
+
+# Generate Intermediate CA Certificate Bundle and Key
+# - Validity: 175368h (~20 Years)
+# - maxPathLen: 0 (Root -> Intermediate -> Leaf) => Intermediate CA is only allowed to issue Leaf Certificates
+# - Active revocation on Leaf Certificates by the usage of build-in Certificate Revocation List (CRL)
+# - Bundle: Certificate Chain (including Root CA Certificate)
+FLAGS=(--force
+  --template="${CAIntermediateTemplate}"
+  --ca="$(step path)/certs/root_ca.crt"
+  --ca-key="$(step path)/secrets/root_ca_key"
+  --not-after="175368h"
+  --ca-password-file="${PwdFile}"
+  --password-file="${PwdFile}"
+  --bundle
+  --set country="${PKICountry}"
+  --set organization="${PKIName}"
+  --set organizationalUnit="${PKIOrganizationalUnit}"
+  --set issuingCertificateURL="https://${FQDN}${LISTENER}/roots.pem"
+  --set crlDistributionPoints="https://${FQDN}${LISTENER}/crl")
+
+$STD step certificate create "${PKIName} Intermediate CA" \
+  "$(step path)/certs/intermediate_ca.crt" \
+  "$(step path)/secrets/intermediate_ca_key" \
+  "${FLAGS[@]}"
+
+# Install Root CA Certificate to System Trust Store
+$STD step certificate install --all "$(step path)/certs/root_ca.crt"
 $STD update-ca-certificates
+
+chown -R step:step "$(step path)"
+chmod -R 700 "$(step path)"
 msg_ok "Initialized step-ca"
 
 msg_info "Start step-ca as a Daemon"
+
+# https://smallstep.com/docs/step-ca/certificate-authority-server-production/#running-step-ca-as-a-daemon
 cat <<'EOF' >/etc/systemd/system/step-ca.service
 [Unit]
 Description=step-ca service
@@ -130,271 +336,6 @@ msg_ok "Started step-ca as a Daemon"
 fetch_and_deploy_gh_release "step-badger" "lukasz-lobocki/step-badger" "prebuild" "latest" "/opt/step-badger" "step-badger_Linux_x86_64.tar.gz"
 ln -s /opt/step-badger/step-badger /usr/local/bin/step-badger
 
-msg_info "Install step-ca Admin script"
-mkdir -p "$STEPHOME"
-cat <<'ADDON_EOF' >"$STEPHOME/step-ca-admin.sh"
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: Joerg Heinemann (heinemannj)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-
-function header_info() {
-  clear
-  cat <<"EOF"
-         __                                 ___       __          _     
-   _____/ /____  ____        _________ _   /   | ____/ /___ ___  (_)___ 
-  / ___/ __/ _ \/ __ \______/ ___/ __ `/  / /| |/ __  / __ `__ \/ / __ \
- (__  ) /_/  __/ /_/ /_____/ /__/ /_/ /  / ___ / /_/ / / / / / / / / / /
-/____/\__/\___/ .___/      \___/\__,_/  /_/  |_\__,_/_/ /_/ /_/_/_/ /_/ 
-             /_/                                                            
-
-EOF
-}
-
-function die() {
-  echo -e "\n${BL}[ERROR]${GN} ${RD}${1}${CL}\n"
-  exit
-}
-
-function success() {
-  echo -e "${BL}[SUCCESS]${GN} ${1}${CL}\n"
-  exit
-}
-
-function whiptail_menu() {
-  MENU_ARRAY=()
-  MSG_MAX_LENGTH=0
-  while read -r TAG ITEM; do
-    OFFSET=2
-    ((${#ITEM} + OFFSET > MSG_MAX_LENGTH)) && MSG_MAX_LENGTH=${#ITEM}+OFFSET
-    MENU_ARRAY+=("$TAG" "$ITEM " "OFF")
-  done < <(echo "$1")
-}
-
-function x509_list() {
-  CERT_LIST=""
-  cp --recursive --force "$(step path)/db/"* "$STEPHOME/db-copy/"
-  cp --recursive --force "$(step path)/certs/"* "$STEPHOME/certs/ca/"
-  if [[ $(step-badger x509Certs "${STEPHOME}/db-copy" 2>/dev/null) ]]; then
-    CERT_LIST=$(step-badger x509Certs ${STEPHOME}/db-copy 2>/dev/null)
-  fi
-}
-
-function ssh_list() {
-  CERT_LIST=""
-  cp --recursive --force "$(step path)/db/"* "$STEPHOME/db-copy/"
-  cp --recursive --force "$(step path)/certs/"* "$STEPHOME/certs/ca/"
-  if [[ $(step-badger sshCerts "${STEPHOME}/db-copy" 2>/dev/null) ]]; then
-    CERT_LIST=$(step-badgersshCerts ${STEPHOME}/db-copy 2>/dev/null)
-  fi
-}
-
-function x509_serial_to_cn() {
-  x509_list
-  CN="$(echo "${CERT_LIST}" | grep "${SERIAL_NUMBER}" | awk '{print $2}' | sed 's/CN=//g')"
-  CRT="$STEPHOME/certs/x509/$CN.crt"
-  KEY="$STEPHOME/certs/x509/$CN.key"
-  if ! [[ -f ${CRT} ]]; then
-    die "Certificate ${CRT} not found!"
-  elif ! [[ -f ${KEY} ]]; then
-    die "Private Key ${KEY} not found!"
-  fi
-}
-
-function x509_revoke() {
-  # shellcheck disable=SC2206
-  SERIAL_NUMBER_ARRAY=(${CERT_SERIAL_NUMBERS})
-  for SERIAL_NUMBER in "${SERIAL_NUMBER_ARRAY[@]}"; do
-    echo -e "${BL}[Info]${GN} Revoke x509 Certificate with Serial Number ${BL}${SERIAL_NUMBER}${GN}:${CL}"
-    echo
-    TOKEN=$(step ca token --provisioner="$PROVISIONER" --provisioner-password-file="$PROVISIONER_PASSWORD" --revoke "${SERIAL_NUMBER}")
-    step ca revoke --token "$TOKEN" "${SERIAL_NUMBER}" || die "Failed to revoke certificate!"
-    echo
-  done
-  success "Finished."
-}
-
-function x509_renew() {
-  # shellcheck disable=SC2206
-  SERIAL_NUMBER_ARRAY=(${CERT_SERIAL_NUMBERS})
-  for SERIAL_NUMBER in "${SERIAL_NUMBER_ARRAY[@]}"; do
-    echo -e "${BL}[Info]${GN} Renew x509 Certificate with Serial Number ${BL}${SERIAL_NUMBER}${GN}:${CL}"
-    echo
-    x509_serial_to_cn
-    step ca renew "${CRT}" "${KEY}" --force || die "Failed to renew certificate!"
-    echo
-  done
-  success "Finished."
-}
-
-function x509_inspect() {
-  # shellcheck disable=SC2206
-  SERIAL_NUMBER_ARRAY=(${CERT_SERIAL_NUMBERS})
-  for SERIAL_NUMBER in "${SERIAL_NUMBER_ARRAY[@]}"; do
-    echo -e "${BL}[Info]${GN} Inspect x509 Certificate with Serial Number ${BL}${SERIAL_NUMBER}${GN}:${CL}\n"
-    x509_serial_to_cn
-    step certificate inspect "${CRT}" || die "Failed to inspect certificate!"
-    if ! [[ $(step certificate inspect "${CRT}" | grep "${SERIAL_NUMBER}") ]]; then
-      die "Serial Number ${SERIAL_NUMBER} mismatch!"
-    fi
-    echo -e "\n${BL}[Info]${GN} Public Key:${CL}\n"
-    cat "${CRT}"
-    echo -e "\n${BL}[Info]${GN} Private Key:${CL}\n"
-    cat "${KEY}"
-    echo
-  done
-  success "Finished."
-}
-
-function x509_request() {
-  FQDN=""
-  SAN=""
-
-  while true; do
-    FQDN=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "Certificate Signing Request (CSR)" --inputbox '\nFQDN (e.g. MyLXC.example.com)' 10 50 "$FQDN" 3>&1 1>&2 2>&3)
-    IP=$(dig +short "$FQDN")
-    if [[ -z "$IP" ]]; then
-      die "Resolution failed for $FQDN!"
-    fi
-    HOST=$(echo "$FQDN" | awk -F'.' '{print $1}')
-    IP=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "Certificate Signing Request (CSR)" --inputbox '\nIP Address (e.g. x.x.x.x)' 10 50 "$IP" 3>&1 1>&2 2>&3)
-    HOST=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "Certificate Signing Request (CSR)" --inputbox '\nHostname (e.g. MyHostName)' 10 50 "$HOST" 3>&1 1>&2 2>&3)
-    SAN=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "Certificate Signing Request (CSR)" --inputbox '\nSubject Alternative Name(s) (SAN) (e.g. myapp-1.example.com, myapp-2.example.com)' 10 50 "$SAN" 3>&1 1>&2 2>&3)
-    VALID_TO=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "Certificate Signing Request (CSR)" --inputbox '\nValidity (e.g. 2034-01-31T00:00:00Z)' 10 50 "2034-01-31T00:00:00Z" 3>&1 1>&2 2>&3)
-
-    # shellcheck disable=SC2034
-    if whiptail_yesno=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "Certificate Signing Request (CSR)" --yesno "Continue with below?\n
-      FQDN: $FQDN
-      Hostname: $HOST
-      IP Address: $IP
-      Subject Alternative Name(s) (SAN): $SAN
-      Validity: $VALID_TO" --no-button "Change" --yes-button "Continue" 15 70 3>&1 1>&2 2>&3); then
-      break
-    fi
-  done
-
-  echo -e "${BL}[Info]${GN} Request x509 Certificate with subject ${BL}${FQDN}${GN}:${CL}"
-  echo
-  CRT="$STEPHOME/certs/x509/$FQDN.crt"
-  KEY="$STEPHOME/certs/x509/$FQDN.key"
-
-  SAN="$FQDN, $HOST, $IP, $SAN"
-
-  IFS=', ' read -r -a array <<< "$SAN"
-  for element in "${array[@]}"
-  do
-    SAN_ARRAY+=(--san "$element")
-  done
-
-  step ca certificate "$FQDN" "$CRT" "$KEY" \
-    --provisioner="$PROVISIONER" \
-    --provisioner-password-file="$PROVISIONER_PASSWORD" \
-    --not-after="$VALID_TO" \
-    "${SAN_ARRAY[@]}" \
-  || die "Failed to request certificate!"
-
-  echo -e "\n${BL}[Info]${GN} Inspect Certificate:${CL}\n"
-  step certificate inspect "${CRT}" || die "Failed to inspect certificate!"
-  echo -e "\n${BL}[Info]${GN} Public Key:${CL}\n"
-  cat "${CRT}"
-  echo -e "\n${BL}[Info]${GN} Private Key:${CL}\n"
-  cat "${KEY}"
-  echo
-  success "Finished."
-}
-
-set -eEuo pipefail
-# shellcheck disable=SC2034
-# shellcheck disable=SC2116
-# shellcheck disable=SC2028
-YW=$(echo "\033[33m")
-# shellcheck disable=SC2116
-# shellcheck disable=SC2028
-BL=$(echo "\033[36m")
-# shellcheck disable=SC2116
-# shellcheck disable=SC2028
-RD=$(echo "\033[01;31m")
-# shellcheck disable=SC2034
-CM='\xE2\x9C\x94\033'
-# shellcheck disable=SC2116
-# shellcheck disable=SC2028
-GN=$(echo "\033[1;92m")
-# shellcheck disable=SC2116
-# shellcheck disable=SC2028
-CL=$(echo "\033[m")
-
-# Telemetry
-# shellcheck disable=SC1090
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/api.func) 2>/dev/null || true
-declare -f init_tool_telemetry &>/dev/null && init_tool_telemetry "step-ca-admin" "step-ca"
-
-header_info
-
-mkdir --parents "$STEPHOME/db-copy/"
-mkdir --parents "$STEPHOME/certs/ca/_archive/"
-mkdir --parents "$STEPHOME/certs/ssh/_archive/"
-mkdir --parents "$STEPHOME/certs/x509/_archive/"
-
-PROVISIONER=$(jq '.authority.provisioners.[] | select(.type=="JWK") | .name' "$(step path)"/config/ca.json)
-PROVISIONER="${PROVISIONER#\"}"
-PROVISIONER="${PROVISIONER%\"}"
-PROVISIONER_PASSWORD=$(step path)/encryption/provisioner.pwd
-
-whiptail --backtitle "Proxmox VE Helper Scripts" --title "step-ca Admin" --yesno "This will maintain step-ca issued x509 and ssh Certificates. Proceed?" 10 58
-
-MENU_ARRAY=("x509" "Maintain x509 Certificates." "ON")
-MENU_ARRAY+=("ssh" "Maintain ssh Certificates." "OFF")
-CERT_TYPE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "step-ca Admin" --radiolist "\nSelect Certificate Type:" 16 48 6 "${MENU_ARRAY[@]}" 3>&1 1>&2 2>&3 | tr -d '"')
-
-[[ -z ${CERT_TYPE} ]] && die "No Certificate Type selected!"
-
-case ${CERT_TYPE} in
-("x509")
-  x509_list
-  CERT_LIST=$(echo "$CERT_LIST" | awk 'NR>1 {print $1 " " $2 "|" $3 "|" $4 "|" $5}')
-  if [[ $CERT_LIST ]]; then
-    whiptail_menu "$CERT_LIST"
-  else
-    MENU_ARRAY=()
-    MSG_MAX_LENGTH=2
-  fi
-  MENU_ARRAY+=("" "Create a new Certificate" "OFF")
-  CERT_SERIAL_NUMBERS=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "Certificates on $(hostname)" --checklist "\nSelect Certificate(s) to maintain:\n" 16 $((MSG_MAX_LENGTH + 55)) 6 "${MENU_ARRAY[@]}" 3>&1 1>&2 2>&3 | tr -d '"')
-
-  [[ -z ${CERT_SERIAL_NUMBERS} ]] && x509_request
-  
-  MENU_ARRAY=("Renew" "Renew x509 Certificates." "ON")
-  MENU_ARRAY+=("Revoke" "Revoke x509 Certificates." "OFF")
-  MENU_ARRAY+=("Inspect" "Inspect x509 Certificates." "OFF")
-  CERT_MAINTENANCE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "step-ca Admin" --radiolist "\nSelect Maintenance Type:" 16 48 6 "${MENU_ARRAY[@]}" 3>&1 1>&2 2>&3 | tr -d '"')
-
-  case ${CERT_MAINTENANCE} in
-  ("Renew")
-    x509_renew "${CERT_SERIAL_NUMBERS[@]}"
-    ;;
-  ("Revoke")
-    x509_revoke "${CERT_SERIAL_NUMBERS[@]}"
-    ;;
-  ("Inspect")
-    x509_inspect "${CERT_SERIAL_NUMBERS[@]}"
-    ;;
-  *)
-    die "Unsupported CERT_MAINTENANCE Option!"
-    ;;
-  esac
-  ;;
-("ssh")
-  die "Maintain ssh Certificates - To be implemented in future"
-  ;;
-*)
-  die "Unsupported CERT_TYPE Option!"
-  ;;
-esac
-ADDON_EOF
-chmod 700 "$STEPHOME/step-ca-admin.sh"
-msg_ok "Installed step-ca Admin script"
-
 motd_ssh
 customize
 cleanup_lxc

install/teable-install.sh

@@ -0,0 +1,94 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: MickLesk (CanbiZ)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/teableio/teable
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y \
+  build-essential \
+  python3 \
+  git
+msg_ok "Installed Dependencies"
+
+NODE_VERSION="24" NODE_MODULE="pnpm" setup_nodejs
+PG_VERSION="16" setup_postgresql
+PG_DB_NAME="teable" PG_DB_USER="teable" setup_postgresql_db
+
+fetch_and_deploy_gh_release "teable" "teableio/teable" "tarball"
+
+msg_info "Setting up Teable"
+cd /opt/teable
+TEABLE_VERSION=$(cat ~/.teable)
+echo "NEXT_PUBLIC_BUILD_VERSION=\"${TEABLE_VERSION}\"" >>apps/nextjs-app/.env
+export HUSKY=0
+export NODE_OPTIONS="--max-old-space-size=8192"
+$STD pnpm install --frozen-lockfile
+$STD pnpm -F @teable/db-main-prisma prisma-generate --schema ./prisma/postgres/schema.prisma
+msg_ok "Set up Teable"
+
+msg_info "Building Teable"
+NODE_ENV=production NEXT_BUILD_ENV_TYPECHECK=false \
+  $STD pnpm -r --filter '!playground' run build
+msg_ok "Built Teable"
+
+msg_info "Running Database Migrations"
+PRISMA_DATABASE_URL="postgresql://teable:${PG_DB_PASS}@localhost:5432/teable?schema=public" \
+  $STD pnpm -F @teable/db-main-prisma prisma-migrate deploy --schema ./prisma/postgres/schema.prisma
+msg_ok "Ran Database Migrations"
+
+msg_info "Configuring Teable"
+mkdir -p /opt/teable/.assets /opt/teable/.temporary
+SECRET_KEY=$(openssl rand -base64 32)
+cat <<EOF >/opt/teable/.env
+PRISMA_DATABASE_URL=postgresql://teable:${PG_DB_PASS}@localhost:5432/teable?schema=public&statement_cache_size=1
+PUBLIC_ORIGIN=http://${LOCAL_IP}:3000
+SECRET_KEY=${SECRET_KEY}
+PORT=3000
+NODE_ENV=production
+NEXT_TELEMETRY_DISABLED=1
+BACKEND_CACHE_PROVIDER=sqlite
+BACKEND_CACHE_SQLITE_URI=sqlite:///opt/teable/.assets/.cache.db
+NEXTJS_DIR=apps/nextjs-app
+EOF
+ln -sf /opt/teable /app
+rm -rf /opt/teable/static
+if [ -d "/opt/teable/apps/nestjs-backend/static/static" ]; then
+  ln -sf /opt/teable/apps/nestjs-backend/static/static /opt/teable/static
+else
+  ln -sf /opt/teable/apps/nestjs-backend/static /opt/teable/static
+fi
+msg_ok "Configured Teable"
+
+msg_info "Creating Service"
+cat <<EOF >/etc/systemd/system/teable.service
+[Unit]
+Description=Teable
+After=network.target postgresql.service
+
+[Service]
+Type=simple
+WorkingDirectory=/opt/teable
+EnvironmentFile=/opt/teable/.env
+ExecStart=/usr/bin/node apps/nestjs-backend/dist/index.js
+Restart=on-failure
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now teable
+msg_ok "Created Service"
+
+motd_ssh
+customize
+cleanup_lxc

misc/build.func

@@ -5678,6 +5678,10 @@ create_lxc_container() {
 
   if ! pvesm status -content rootdir 2>/dev/null | awk 'NR>1{print $1}' | grep -qx "$CONTAINER_STORAGE"; then
     msg_error "Storage '$CONTAINER_STORAGE' ($STORAGE_TYPE) does not support 'rootdir' content."
+    msg_custom "💡" "${YW}" "Enable 'Disk image' (rootdir) for storage '${CONTAINER_STORAGE}' in:"
+    msg_custom "   " "${YW}" "Datacenter → Storage → ${CONTAINER_STORAGE} → Edit → Content"
+    msg_custom "📖" "${YW}" "See: https://pve.proxmox.com/wiki/Storage"
+    msg_custom "🔗" "${YW}" "Help: https://github.com/community-scripts/ProxmoxVE/discussions"
     exit 213
   fi
   msg_ok "Storage '$CONTAINER_STORAGE' ($STORAGE_TYPE) validated"

misc/tools.func

@@ -5964,14 +5964,14 @@ function setup_mariadb_db() {
 }
 
 # ------------------------------------------------------------------------------
-# Installs or updates MongoDB to specified major version.
+# Installs or updates MongoDB to specified version.
 #
 # Description:
 #   - Preserves data across installations
 #   - Adds official MongoDB repo
 #
 # Variables:
-#   MONGO_VERSION  - MongoDB major version to install (e.g. 7.0, 8.0)
+#   MONGO_VERSION  - MongoDB version to install (e.g. 7.0, 8.2)
 # ------------------------------------------------------------------------------
 
 function setup_mongodb() {
@@ -6044,8 +6044,11 @@ function setup_mongodb() {
   }
 
   # Setup repository
+  # MongoDB 8.x versions beyond 8.0 reuse the server-8.0.asc PGP key
+  local MONGO_KEY_VERSION="${MONGO_VERSION}"
+  [[ "${MONGO_VERSION}" == 8.[1-9]* ]] && MONGO_KEY_VERSION="8.0"
   manage_tool_repository "mongodb" "$MONGO_VERSION" "$MONGO_BASE_URL" \
-    "https://www.mongodb.org/static/pgp/server-${MONGO_VERSION}.asc" || {
+    "https://www.mongodb.org/static/pgp/server-${MONGO_KEY_VERSION}.asc" || {
     msg_error "Failed to setup MongoDB repository"
     return 100
   }

tools/addon/komodo.sh

@@ -151,6 +151,23 @@ function check_proxmox_host() {
 # ==============================================================================
 # CHECK / INSTALL DOCKER
 # ==============================================================================
+function ensure_openssl() {
+  if command -v openssl &>/dev/null; then
+    return
+  fi
+  msg_info "Installing openssl"
+  if [[ -f /etc/alpine-release ]]; then
+    $STD apk add openssl
+  elif command -v apt-get &>/dev/null; then
+    $STD apt-get update
+    $STD apt-get install -y openssl
+  else
+    msg_error "openssl is required but could not be installed automatically."
+    exit 10
+  fi
+  msg_ok "Installed openssl"
+}
+
 function check_or_install_docker() {
   if command -v docker &>/dev/null; then
     msg_ok "Docker $(docker --version | cut -d' ' -f3 | tr -d ',') is available"
@@ -160,6 +177,7 @@ function check_or_install_docker() {
       msg_error "Docker Compose plugin is not available. Please install it."
       exit 10
     fi
+    ensure_openssl
     return
   fi
 
@@ -183,6 +201,8 @@ function check_or_install_docker() {
     $STD sh <(curl -fsSL https://get.docker.com)
   fi
   msg_ok "Installed Docker"
+
+  ensure_openssl
 }
 
 # ==============================================================================