Update misc/tools.func

Co-authored-by: Slaviša Arežina <58952836+tremor021@users.noreply.github.com>

.github/changelogs/2026/04.md

@@ -1,110 +1,3 @@
-## 2026-04-30
-
-### 🆕 New Scripts
-
-  - Nagios ([#14126](https://github.com/community-scripts/ProxmoxVE/pull/14126))
-- Neko ([#14121](https://github.com/community-scripts/ProxmoxVE/pull/14121))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - alpine-docker: install openssl as core dependency | alpine-komodo: check & install openssl if missing [@MickLesk](https://github.com/MickLesk) ([#14134](https://github.com/community-scripts/ProxmoxVE/pull/14134))
-    - endurain: update source references to Codeberg [@MickLesk](https://github.com/MickLesk) ([#14128](https://github.com/community-scripts/ProxmoxVE/pull/14128))
-
-### 💾 Core
-
-  - #### 🔧 Refactor
-
-    - tools.func: Manage minor versions for MongoDB 8.x [@tremor021](https://github.com/tremor021) ([#14131](https://github.com/community-scripts/ProxmoxVE/pull/14131))
-
-## 2026-04-29
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - GrayLog: MongoDB update to 8.2.x [@tremor021](https://github.com/tremor021) ([#14114](https://github.com/community-scripts/ProxmoxVE/pull/14114))
-    - Graylog: Better information in the log file [@tremor021](https://github.com/tremor021) ([#14110](https://github.com/community-scripts/ProxmoxVE/pull/14110))
-
-  - #### 🔧 Refactor
-
-    - Refactor: checkMK [@MickLesk](https://github.com/MickLesk) ([#14105](https://github.com/community-scripts/ProxmoxVE/pull/14105))
-    - PatchMon: Unpin release [@tremor021](https://github.com/tremor021) ([#14097](https://github.com/community-scripts/ProxmoxVE/pull/14097))
-
-### 💾 Core
-
-  - #### 🔧 Refactor
-
-    - core: add guidance when storage lacks rootdir support [@MickLesk](https://github.com/MickLesk) ([#14108](https://github.com/community-scripts/ProxmoxVE/pull/14108))
-
-## 2026-04-28
-
-### 🆕 New Scripts
-
-  - StoryBook ([#14081](https://github.com/community-scripts/ProxmoxVE/pull/14081))
-- CoreDNS ([#14082](https://github.com/community-scripts/ProxmoxVE/pull/14082))
-
-### 🚀 Updated Scripts
-
-  - Fix Dawarich Install/Update [@Jerry1098](https://github.com/Jerry1098) ([#14078](https://github.com/community-scripts/ProxmoxVE/pull/14078))
-
-  - #### ✨ New Features
-
-    - PatchMon Version 2.0.2 Script update [@9technologygroup](https://github.com/9technologygroup) ([#14095](https://github.com/community-scripts/ProxmoxVE/pull/14095))
-
-## 2026-04-27
-
-### 🚀 Updated Scripts
-
-  - Add pamUsername column to userOrgs table [@JVKeller](https://github.com/JVKeller) ([#14075](https://github.com/community-scripts/ProxmoxVE/pull/14075))
-
-  - #### 🐞 Bug Fixes
-
-    - Dawarich: run db:migrate before assets:precompile [@MickLesk](https://github.com/MickLesk) ([#14051](https://github.com/community-scripts/ProxmoxVE/pull/14051))
-    - TechnitiumDNS: always install .NET 10 if not already present [@MickLesk](https://github.com/MickLesk) ([#14049](https://github.com/community-scripts/ProxmoxVE/pull/14049))
-
-  - #### 💥 Breaking Changes
-
-    - PatchMon: v2.0.0 migration [@vhsdream](https://github.com/vhsdream) ([#14015](https://github.com/community-scripts/ProxmoxVE/pull/14015))
-
-### 💾 Core
-
-  - #### 🔧 Refactor
-
-    - Update build.func - fixed spelling mistake [@m1ckywill](https://github.com/m1ckywill) ([#14047](https://github.com/community-scripts/ProxmoxVE/pull/14047))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - update-lxcs/apps: avoid pct exec on containers mid-shutdown [@MickLesk](https://github.com/MickLesk) ([#14050](https://github.com/community-scripts/ProxmoxVE/pull/14050))
-
-  - #### ✨ New Features
-
-    - Add patchmon-agent report execution in update script [@heinemannj](https://github.com/heinemannj) ([#14054](https://github.com/community-scripts/ProxmoxVE/pull/14054))
-
-## 2026-04-26
-
-### 🆕 New Scripts
-
-  - TREK ([#14017](https://github.com/community-scripts/ProxmoxVE/pull/14017))
-
-### 🚀 Updated Scripts
-
-  - fix(2fauth): handle stale backup directory on update [@omertahaoztop](https://github.com/omertahaoztop) ([#14018](https://github.com/community-scripts/ProxmoxVE/pull/14018))
-
-  - #### 🐞 Bug Fixes
-
-    -  Increase Frigate default CPU cores from 4 to 8 [@MickLesk](https://github.com/MickLesk) ([#14039](https://github.com/community-scripts/ProxmoxVE/pull/14039))
-    - Technitium DNS: Ensure directories exist before running service [@tremor021](https://github.com/tremor021) ([#14030](https://github.com/community-scripts/ProxmoxVE/pull/14030))
-
-### 💾 Core
-
-  - #### 🐞 Bug Fixes
-
-    - core: Correct deb822 repository flat path detection [@MickLesk](https://github.com/MickLesk) ([#14037](https://github.com/community-scripts/ProxmoxVE/pull/14037))
-
 ## 2026-04-25
 
 ### 🚀 Updated Scripts

.github/changelogs/2026/05.md

@@ -1,42 +0,0 @@
-## 2026-05-02
-
-### 🆕 New Scripts
-
-  - protonmail-bridge ([#14136](https://github.com/community-scripts/ProxmoxVE/pull/14136))
-- Tube Archivist ([#14123](https://github.com/community-scripts/ProxmoxVE/pull/14123))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Nagios: Ping fix [@tremor021](https://github.com/tremor021) ([#14186](https://github.com/community-scripts/ProxmoxVE/pull/14186))
-    - opnsense-vm: retry pvesm alloc on transient zfs 'got timeout' errors [@MickLesk](https://github.com/MickLesk) ([#14157](https://github.com/community-scripts/ProxmoxVE/pull/14157))
-    - ImmichFrame: fix update by reinstalling dotnet-sdk before publish [@MickLesk](https://github.com/MickLesk) ([#14158](https://github.com/community-scripts/ProxmoxVE/pull/14158))
-    - [FIX]ShelfMark: Use UV sync for shelfmark backend build; update to Python 3.14 [@vhsdream](https://github.com/vhsdream) ([#14170](https://github.com/community-scripts/ProxmoxVE/pull/14170))
-    - alpine: remove deb/ubuntu-only resource & storage checks from update-script [@MickLesk](https://github.com/MickLesk) ([#14166](https://github.com/community-scripts/ProxmoxVE/pull/14166))
-    - Threadfin: use 'threadfin-app' as app name to avoid version-file clash  [@MickLesk](https://github.com/MickLesk) ([#14159](https://github.com/community-scripts/ProxmoxVE/pull/14159))
-
-### 💾 Core
-
-  - #### ✨ New Features
-
-    - core: prompt to also run installed addon update scripts (…/bin/update_*) after update_script [@MickLesk](https://github.com/MickLesk) ([#14162](https://github.com/community-scripts/ProxmoxVE/pull/14162))
-
-## 2026-05-01
-
-### 🆕 New Scripts
-
-  - SoulSync ([#14124](https://github.com/community-scripts/ProxmoxVE/pull/14124))
-- Teable ([#14125](https://github.com/community-scripts/ProxmoxVE/pull/14125))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Step ca update [@heinemannj](https://github.com/heinemannj) ([#14058](https://github.com/community-scripts/ProxmoxVE/pull/14058))
-    - paperless-ngx: refresh NLTK data on update [@kurtislanderson](https://github.com/kurtislanderson) ([#14144](https://github.com/community-scripts/ProxmoxVE/pull/14144))
-    - [Pelican Panel] stop deleting the public storage [@LetterN](https://github.com/LetterN) ([#14145](https://github.com/community-scripts/ProxmoxVE/pull/14145))
-
-  - #### 🔧 Refactor
-
-    - Mail-Archiver: update dependencies [@tremor021](https://github.com/tremor021) ([#14152](https://github.com/community-scripts/ProxmoxVE/pull/14152))

CHANGELOG.md

@@ -44,9 +44,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 
 
-
-
-
 
 
 
@@ -60,14 +57,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 
 <details>
-<summary><h4>May (2 entries)</h4></summary>
+<summary><h4>April (25 entries)</h4></summary>
-
-[View May 2026 Changelog](.github/changelogs/2026/05.md)
-
-</details>
-
-<details>
-<summary><h4>April (30 entries)</h4></summary>
 
 [View April 2026 Changelog](.github/changelogs/2026/04.md)
 
@@ -458,62 +448,11 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 </details>
 
-## 2026-05-02
-
-### 🆕 New Scripts
-
-  - protonmail-bridge ([#14136](https://github.com/community-scripts/ProxmoxVE/pull/14136))
-- Tube Archivist ([#14123](https://github.com/community-scripts/ProxmoxVE/pull/14123))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Nagios: Ping fix [@tremor021](https://github.com/tremor021) ([#14186](https://github.com/community-scripts/ProxmoxVE/pull/14186))
-    - opnsense-vm: retry pvesm alloc on transient zfs 'got timeout' errors [@MickLesk](https://github.com/MickLesk) ([#14157](https://github.com/community-scripts/ProxmoxVE/pull/14157))
-    - ImmichFrame: fix update by reinstalling dotnet-sdk before publish [@MickLesk](https://github.com/MickLesk) ([#14158](https://github.com/community-scripts/ProxmoxVE/pull/14158))
-    - [FIX]ShelfMark: Use UV sync for shelfmark backend build; update to Python 3.14 [@vhsdream](https://github.com/vhsdream) ([#14170](https://github.com/community-scripts/ProxmoxVE/pull/14170))
-    - alpine: remove deb/ubuntu-only resource & storage checks from update-script [@MickLesk](https://github.com/MickLesk) ([#14166](https://github.com/community-scripts/ProxmoxVE/pull/14166))
-    - Threadfin: use 'threadfin-app' as app name to avoid version-file clash  [@MickLesk](https://github.com/MickLesk) ([#14159](https://github.com/community-scripts/ProxmoxVE/pull/14159))
-
-### 💾 Core
-
-  - #### ✨ New Features
-
-    - core: prompt to also run installed addon update scripts (…/bin/update_*) after update_script [@MickLesk](https://github.com/MickLesk) ([#14162](https://github.com/community-scripts/ProxmoxVE/pull/14162))
-
-## 2026-05-01
-
-### 🆕 New Scripts
-
-  - SoulSync ([#14124](https://github.com/community-scripts/ProxmoxVE/pull/14124))
-- Teable ([#14125](https://github.com/community-scripts/ProxmoxVE/pull/14125))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - Step ca update [@heinemannj](https://github.com/heinemannj) ([#14058](https://github.com/community-scripts/ProxmoxVE/pull/14058))
-    - paperless-ngx: refresh NLTK data on update [@kurtislanderson](https://github.com/kurtislanderson) ([#14144](https://github.com/community-scripts/ProxmoxVE/pull/14144))
-    - [Pelican Panel] stop deleting the public storage [@LetterN](https://github.com/LetterN) ([#14145](https://github.com/community-scripts/ProxmoxVE/pull/14145))
-
-  - #### 🔧 Refactor
-
-    - Mail-Archiver: update dependencies [@tremor021](https://github.com/tremor021) ([#14152](https://github.com/community-scripts/ProxmoxVE/pull/14152))
-
 ## 2026-04-30
 
 ### 🆕 New Scripts
 
-  - Nagios ([#14126](https://github.com/community-scripts/ProxmoxVE/pull/14126))
+  - Neko ([#14121](https://github.com/community-scripts/ProxmoxVE/pull/14121))
-- Neko ([#14121](https://github.com/community-scripts/ProxmoxVE/pull/14121))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - alpine-docker: install openssl as core dependency | alpine-komodo: check & install openssl if missing [@MickLesk](https://github.com/MickLesk) ([#14134](https://github.com/community-scripts/ProxmoxVE/pull/14134))
-    - endurain: update source references to Codeberg [@MickLesk](https://github.com/MickLesk) ([#14128](https://github.com/community-scripts/ProxmoxVE/pull/14128))
 
 ### 💾 Core
 
@@ -1064,3 +1003,110 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
   - #### 🐞 Bug Fixes
 
     - PVE LXC-Updater: pipe apt list through cat to prevent pager hang [@MickLesk](https://github.com/MickLesk) ([#13501](https://github.com/community-scripts/ProxmoxVE/pull/13501))
+
+## 2026-04-02
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Grist: Guard backup restore for empty docs/db files [@MickLesk](https://github.com/MickLesk) ([#13472](https://github.com/community-scripts/ProxmoxVE/pull/13472))
+    - fix(zigbee2mqtt): suppress grep error when pnpm-workspace.yaml is absent on update [@Copilot](https://github.com/Copilot) ([#13476](https://github.com/community-scripts/ProxmoxVE/pull/13476))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - Cron LXC Updater: Add full PATH for cron environment [@MickLesk](https://github.com/MickLesk) ([#13473](https://github.com/community-scripts/ProxmoxVE/pull/13473))
+
+## 2026-04-01
+
+### 🆕 New Scripts
+
+  - DrawDB ([#13454](https://github.com/community-scripts/ProxmoxVE/pull/13454))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - Filebrowser: make noauth setup use correct database [@MickLesk](https://github.com/MickLesk) ([#13457](https://github.com/community-scripts/ProxmoxVE/pull/13457))
+
+## 2026-03-31
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Graylog: set vm.max_map_count on host for OpenSearch [@MickLesk](https://github.com/MickLesk) ([#13441](https://github.com/community-scripts/ProxmoxVE/pull/13441))
+    - Koillection: ensure newline before appending to .env.local [@MickLesk](https://github.com/MickLesk) ([#13440](https://github.com/community-scripts/ProxmoxVE/pull/13440))
+
+### 💾 Core
+
+  - #### 🔧 Refactor
+
+    - core: skip empty gateway value in network config [@MickLesk](https://github.com/MickLesk) ([#13442](https://github.com/community-scripts/ProxmoxVE/pull/13442))
+
+## 2026-03-30
+
+### 🆕 New Scripts
+
+  - Bambuddy ([#13411](https://github.com/community-scripts/ProxmoxVE/pull/13411))
+
+### 🚀 Updated Scripts
+
+  - #### 💥 Breaking Changes
+
+    - Rename: BirdNET > BirdNET-Go [@MickLesk](https://github.com/MickLesk) ([#13410](https://github.com/community-scripts/ProxmoxVE/pull/13410))
+
+## 2026-03-29
+
+### 🆕 New Scripts
+
+  - YOURLS ([#13379](https://github.com/community-scripts/ProxmoxVE/pull/13379))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - fix(victoriametrics): use jq to filter releases [@Joery-M](https://github.com/Joery-M) ([#13393](https://github.com/community-scripts/ProxmoxVE/pull/13393))
+    - Ollama: add error handling for Intel GPG key imports [@MickLesk](https://github.com/MickLesk) ([#13397](https://github.com/community-scripts/ProxmoxVE/pull/13397))
+    - Immich: ignore Redis connection error on maintenance mode disable [@MickLesk](https://github.com/MickLesk) ([#13398](https://github.com/community-scripts/ProxmoxVE/pull/13398))
+    - NPM: unmask openresty after migration from package [@MickLesk](https://github.com/MickLesk) ([#13399](https://github.com/community-scripts/ProxmoxVE/pull/13399))
+
+## 2026-03-28
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Fix: Update gokapi binary name for v2.2.4+ and add migration step [@krazos](https://github.com/krazos) ([#13377](https://github.com/community-scripts/ProxmoxVE/pull/13377))
+    - Fix: update gokapi asset matching for v2.2.4+ naming convention [@krazos](https://github.com/krazos) ([#13369](https://github.com/community-scripts/ProxmoxVE/pull/13369))
+    - Tandoor Recipes: Add missing env variable [@tremor021](https://github.com/tremor021) ([#13365](https://github.com/community-scripts/ProxmoxVE/pull/13365))
+
+  - #### ✨ New Features
+
+    - FileFlows: add option to install Node [@tremor021](https://github.com/tremor021) ([#13368](https://github.com/community-scripts/ProxmoxVE/pull/13368))
+
+## 2026-03-27
+
+### 🆕 New Scripts
+
+  - Matter-Server ([#13355](https://github.com/community-scripts/ProxmoxVE/pull/13355))
+- GeoPulse ([#13320](https://github.com/community-scripts/ProxmoxVE/pull/13320))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - RevealJS: Switch from gulp to vite [@tremor021](https://github.com/tremor021) ([#13336](https://github.com/community-scripts/ProxmoxVE/pull/13336))
+
+  - #### ✨ New Features
+
+    - Dispatcharr add custom Postgres port support for upgrade [@MickLesk](https://github.com/MickLesk) ([#13347](https://github.com/community-scripts/ProxmoxVE/pull/13347))
+    - Immich: bump to v2.6.3 [@MickLesk](https://github.com/MickLesk) ([#13324](https://github.com/community-scripts/ProxmoxVE/pull/13324))
+
+### 🧰 Tools
+
+  - #### ✨ New Features
+
+    - Refactor/Feature-Bump/Security: Update-Cron-LXCs (Now Local Mode!) [@MickLesk](https://github.com/MickLesk) ([#13339](https://github.com/community-scripts/ProxmoxVE/pull/13339))

ct/alpine-ironclaw.sh

@@ -21,6 +21,8 @@ catch_errors
 
 function update_script() {
   header_info
+  check_container_storage
+  check_container_resources
 
   if [[ ! -f /usr/local/bin/ironclaw ]]; then
     msg_error "No ${APP} Installation Found!"

ct/alpine-ntfy.sh

@@ -22,6 +22,8 @@ catch_errors
 
 function update_script() {
   header_info
+  check_container_storage
+  check_container_resources
   if [[ ! -d /etc/ntfy ]]; then
     msg_error "No ${APP} Installation Found!"
     exit

ct/alpine-redlib.sh

@@ -21,6 +21,7 @@ catch_errors
 
 function update_script() {
   header_info
+  check_container_resources
 
   if [[ ! -d /opt/redlib ]]; then
     msg_error "No ${APP} Installation Found!"

ct/alpine-rustypaste.sh

@@ -21,6 +21,8 @@ catch_errors
 
 function update_script() {
   header_info
+  check_container_storage
+  check_container_resources
 
   if ! apk info -e rustypaste >/dev/null 2>&1; then
     msg_error "No ${APP} Installation Found!"

ct/endurain.sh

@@ -3,7 +3,7 @@ source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxV
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: johanngrobe
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://codeberg.org/endurain-project/endurain
+# Source: https://github.com/joaovitoriasilva/endurain
 
 APP="Endurain"
 var_tags="${var_tags:-sport;social-media}"
@@ -28,7 +28,7 @@ function update_script() {
     msg_error "No ${APP} installation found!"
     exit 233
   fi
-  if check_for_codeberg_release "endurain" "endurain-project/endurain"; then
+  if check_for_gh_release "endurain" "endurain-project/endurain"; then
     msg_info "Stopping Service"
     systemctl stop endurain
     msg_ok "Stopped Service"
@@ -38,7 +38,7 @@ function update_script() {
     cp /opt/endurain/frontend/app/dist/env.js /opt/endurain.env.js
     msg_ok "Created Backup"
 
-    CLEAN_INSTALL=1 fetch_and_deploy_codeberg_release "endurain" "endurain-project/endurain" "tarball" "latest" "/opt/endurain"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "endurain" "endurain-project/endurain" "tarball" "latest" "/opt/endurain"
 
     msg_info "Preparing Update"
     cd /opt/endurain

ct/headers/nagios

@@ -1,6 +0,0 @@
-    _   __            _           
-   / | / /___ _____ _(_)___  _____
-  /  |/ / __ `/ __ `/ / __ \/ ___/
- / /|  / /_/ / /_/ / / /_/ (__  ) 
-/_/ |_/\__,_/\__, /_/\____/____/  
-            /____/                

ct/headers/protonmail-bridge

@@ -1,6 +0,0 @@
-    ____             __              __  ___      _ __      ____       _     __         
-   / __ \_________  / /_____  ____  /  |/  /___ _(_) /     / __ )_____(_)___/ /___ ____ 
-  / /_/ / ___/ __ \/ __/ __ \/ __ \/ /|_/ / __ `/ / /_____/ __  / ___/ / __  / __ `/ _ \
- / ____/ /  / /_/ / /_/ /_/ / / / / /  / / /_/ / / /_____/ /_/ / /  / / /_/ / /_/ /  __/
-/_/   /_/   \____/\__/\____/_/ /_/_/  /_/\__,_/_/_/     /_____/_/  /_/\__,_/\__, /\___/ 
-                                                                           /____/       

ct/headers/soulsync

@@ -1,6 +0,0 @@
-   _____             _______                 
-  / ___/____  __  __/ / ___/__  ______  _____
-  \__ \/ __ \/ / / / /\__ \/ / / / __ \/ ___/
- ___/ / /_/ / /_/ / /___/ / /_/ / / / / /__  
-/____/\____/\__,_/_//____/\__, /_/ /_/\___/  
-                         /____/              

ct/headers/teable

@@ -1,6 +0,0 @@
-  ______           __    __   
- /_  __/__  ____ _/ /_  / /__ 
-  / / / _ \/ __ `/ __ \/ / _ \
- / / /  __/ /_/ / /_/ / /  __/
-/_/  \___/\__,_/_.___/_/\___/ 
-                              

ct/headers/tubearchivist

@@ -1,6 +0,0 @@
-  ______      __            ___              __    _       _      __ 
- /_  __/_  __/ /_  ___     /   |  __________/ /_  (_)   __(_)____/ /_
-  / / / / / / __ \/ _ \   / /| | / ___/ ___/ __ \/ / | / / / ___/ __/
- / / / /_/ / /_/ /  __/  / ___ |/ /  / /__/ / / / /| |/ / (__  ) /_  
-/_/  \__,_/_.___/\___/  /_/  |_/_/   \___/_/ /_/_/ |___/_/____/\__/  
-                                                                     

ct/mail-archiver.sh

@@ -28,8 +28,6 @@ function update_script() {
     exit
   fi
 
-  ensure_dependencies libgssapi-krb5-2
-
   if check_for_gh_release "mail-archiver" "s1t5/mail-archiver"; then
     msg_info "Stopping Mail-Archiver"
     systemctl stop mail-archiver

ct/nagios.sh

@@ -1,91 +0,0 @@
-#!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: CanbiZ (MickLesk)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/NagiosEnterprises/nagioscore
-
-APP="Nagios"
-var_tags="${var_tags:-monitoring;alerts;infrastructure}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
-var_disk="${var_disk:-20}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -f /usr/local/nagios/etc/nagios.cfg ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  msg_info "Backing up Configuration"
-  cp -a /usr/local/nagios/etc /opt/nagios-etc-backup
-  msg_ok "Backed up Configuration"
-
-  if check_for_gh_release "nagios" "NagiosEnterprises/nagioscore"; then
-    msg_info "Stopping Nagios"
-    systemctl stop nagios
-    msg_ok "Stopped Nagios"
-
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "nagios" "NagiosEnterprises/nagioscore" "tarball"
-
-    msg_info "Building Nagios Core"
-    cd /opt/nagios
-    $STD ./configure --with-httpd-conf=/etc/apache2/sites-enabled
-    $STD make all
-    $STD make install-groups-users
-    usermod -a -G nagios www-data
-    $STD make install
-    $STD make install-daemoninit
-    $STD make install-commandmode
-    $STD make install-webconf
-    $STD a2enmod rewrite
-    $STD a2enmod cgi
-    setcap cap_net_raw+p /bin/ping
-    msg_ok "Built Nagios Core"
-
-    msg_info "Starting Nagios"
-    systemctl restart apache2
-    systemctl start nagios
-    msg_ok "Started Nagios"
-  fi
-
-  if check_for_gh_release "nagios-plugins" "nagios-plugins/nagios-plugins"; then
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "nagios-plugins" "nagios-plugins/nagios-plugins" "tarball"
-    msg_info "Building Nagios Plugins"
-    cd /opt/nagios-plugins
-    $STD ./tools/setup
-    $STD ./configure
-    $STD make
-    $STD make install
-    msg_ok "Built Nagios Plugins"
-  fi
-
-  msg_info "Restoring Configuration"
-  rm -rf /usr/local/nagios/etc
-  cp -a /opt/nagios-etc-backup /usr/local/nagios/etc
-  rm -rf /opt/nagios-etc-backup
-  msg_ok "Restored Configuration"
-  msg_ok "Updated successfully!"
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}/nagios${CL}"

ct/paperless-ngx.sh

@@ -164,14 +164,6 @@ function update_script() {
       fi
     fi
 
-    msg_info "Updating NLTK Data"
-    cd /opt/paperless
-    $STD uv run python -m nltk.downloader -d /usr/share/nltk_data snowball_data
-    $STD uv run python -m nltk.downloader -d /usr/share/nltk_data stopwords
-    $STD uv run python -m nltk.downloader -d /usr/share/nltk_data punkt_tab ||
-      $STD uv run python -m nltk.downloader -d /usr/share/nltk_data punkt
-    msg_ok "Updated NLTK Data"
-
     msg_info "Starting all Paperless-ngx Services"
     systemctl start paperless-consumer paperless-webserver paperless-scheduler paperless-task-queue
     sleep 1

ct/pelican-panel.sh

@@ -45,21 +45,15 @@ function update_script() {
     $STD php artisan down
     msg_ok "Stopped Service"
 
-    cp -a /opt/pelican-panel/.env /opt/backup
+    cp -r /opt/pelican-panel/.env /opt/
-    cp -a /opt/pelican-panel/storage/app/public /opt/backup/storage/app/
-    
     SQLITE_INSTALL=$(ls /opt/pelican-panel/database/*.sqlite 1>/dev/null 2>&1 && echo "true" || echo "false")
-    $SQLITE_INSTALL && cp -r /opt/pelican-panel/database/*.sqlite /opt/backup
+    $SQLITE_INSTALL && cp -r /opt/pelican-panel/database/*.sqlite /opt/
-    
+    rm -rf * .*
-    find /opt/pelican-panel -mindepth 1 -maxdepth 1 ! -name 'backup' ! -name 'plugins' -exec rm -rf {} +
-    
     fetch_and_deploy_gh_release "pelican-panel" "pelican-dev/panel" "prebuild" "latest" "/opt/pelican-panel" "panel.tar.gz"
 
     msg_info "Updating Pelican Panel"
-    cp -a /opt/backup/.env /opt/pelican-panel/
+    mv /opt/.env /opt/pelican-panel/
-    $SQLITE_INSTALL && mv /opt/backup/*.sqlite /opt/pelican-panel/database/
+    $SQLITE_INSTALL && mv /opt/*.sqlite /opt/pelican-panel/database/
-    cp -a /opt/backup/storage/app/public /opt/pelican-panel/storage/app/
-
     $STD composer install --no-dev --optimize-autoloader --no-interaction
     $STD php artisan p:environment:setup
     $STD php artisan view:clear

ct/protonmail-bridge.sh

@@ -1,79 +0,0 @@
-#!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: Stephen Chin (steveonjava)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/ProtonMail/proton-bridge
-
-APP="ProtonMail-Bridge"
-var_tags="${var_tags:-mail;proton}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-1024}"
-var_disk="${var_disk:-8}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -x /usr/bin/protonmail-bridge ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit 1
-  fi
-
-  if check_for_gh_release "protonmail-bridge" "ProtonMail/proton-bridge"; then
-    local -a bridge_units=(
-      protonmail-bridge
-      protonmail-bridge-imap.socket
-      protonmail-bridge-smtp.socket
-      protonmail-bridge-imap-proxy
-      protonmail-bridge-smtp-proxy
-    )
-    local unit
-    declare -A was_active
-    for unit in "${bridge_units[@]}"; do
-      if systemctl is-active --quiet "$unit" 2>/dev/null; then
-        was_active["$unit"]=1
-      else
-        was_active["$unit"]=0
-      fi
-    done
-
-    msg_info "Stopping Services"
-    systemctl stop protonmail-bridge-imap.socket protonmail-bridge-smtp.socket protonmail-bridge-imap-proxy protonmail-bridge-smtp-proxy protonmail-bridge
-    msg_ok "Stopped Services"
-
-    fetch_and_deploy_gh_release "protonmail-bridge" "ProtonMail/proton-bridge" "binary"
-
-    if [[ -f /home/protonbridge/.protonmailbridge-initialized ]]; then
-      msg_info "Starting Services"
-      for unit in "${bridge_units[@]}"; do
-        if [[ "${was_active[$unit]:-0}" == "1" ]]; then
-          systemctl start "$unit"
-        fi
-      done
-      msg_ok "Started Services"
-    else
-      msg_ok "Initialization not completed. Services remain disabled."
-    fi
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW}One-time configuration is required before Bridge services are enabled.${CL}"
-echo -e "${INFO}${YW}Run this command in the container: protonmailbridge-configure${CL}"

ct/shelfmark.sh

@@ -30,7 +30,7 @@ function update_script() {
   fi
 
   NODE_VERSION="24" setup_nodejs
-  PYTHON_VERSION="3.14" setup_uv
+  PYTHON_VERSION="3.12" setup_uv
 
   if check_for_gh_release "shelfmark" "calibrain/shelfmark"; then
     msg_info "Stopping Service(s)"
@@ -59,7 +59,6 @@ function update_script() {
     RELEASE_VERSION=$(cat "$HOME/.shelfmark")
 
     msg_info "Updating Shelfmark"
-    export VIRTUAL_ENV=/opt/shelfmark/venv
     sed -i "s/^RELEASE_VERSION=.*/RELEASE_VERSION=$RELEASE_VERSION/" /etc/shelfmark/.env
     cd /opt/shelfmark/src/frontend
     $STD npm ci
@@ -68,10 +67,9 @@ function update_script() {
     cd /opt/shelfmark
     $STD uv venv -c ./venv
     $STD source ./venv/bin/activate
+    $STD uv pip install -r ./requirements-base.txt
     if [[ $(sed -n '/_BYPASS=/s/[^=]*=//p' /etc/shelfmark/.env) == "true" ]] && [[ $(sed -n '/BYPASSER=/s/[^=]*=//p' /etc/shelfmark/.env) == "false" ]]; then
-      $STD uv sync --active --locked --no-default-groups --extra browser
+      $STD uv pip install -r ./requirements-shelfmark.txt
-    else
-      $STD uv sync --active --locked --no-default-groups
     fi
     mv /opt/start.sh.bak /opt/shelfmark/start.sh
     msg_ok "Updated Shelfmark"

ct/soulsync.sh

@@ -1,68 +0,0 @@
-#!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/Nezreka/SoulSync
-
-APP="SoulSync"
-var_tags="${var_tags:-music;automation;media}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
-var_disk="${var_disk:-8}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -f ~/.soulsync ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "soulsync" "Nezreka/SoulSync"; then
-    msg_info "Stopping Service"
-    systemctl stop soulsync
-    msg_ok "Stopped Service"
-
-    msg_info "Backing up Data"
-    mv /opt/soulsync/config /opt/soulsync-config.bak
-    mv /opt/soulsync/data /opt/soulsync-data.bak
-    msg_ok "Backed up Data"
-
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "soulsync" "Nezreka/SoulSync" "tarball"
-
-    msg_info "Updating Python Dependencies"
-    cd /opt/soulsync
-    $STD uv venv --clear /opt/soulsync/.venv --python 3.11
-    $STD /opt/soulsync/.venv/bin/pip install -r requirements.txt
-    msg_ok "Updated Python Dependencies"
-
-    mv /opt/soulsync-config.bak /opt/soulsync/config
-    mv /opt/soulsync-data.bak /opt/soulsync/data
-
-    msg_info "Starting Service"
-    systemctl start soulsync
-    msg_ok "Started Service"
-    msg_ok "Updated ${APP}"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:8008${CL}"

ct/step-ca.sh

@@ -30,12 +30,6 @@ function update_script() {
   msg_info "Updating step-ca and step-cli"
   $STD apt update
   $STD apt upgrade -y step-ca step-cli
-
-  # Patch for making $STD happy (/usr/bin/step is a symlink to /usr/bin/step-cli)
-  STEPBIN="$(which step)"
-  rm -f "$STEPBIN"
-  cp -f "$(which step-cli)" "$STEPBIN"
-
   $STD systemctl restart step-ca
   msg_ok "Updated step-ca and step-cli"
 

ct/teable.sh

@@ -1,82 +0,0 @@
-#!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/teableio/teable
-
-APP="Teable"
-var_tags="${var_tags:-database;no-code;spreadsheet}"
-var_cpu="${var_cpu:-4}"
-var_ram="${var_ram:-10240}"
-var_disk="${var_disk:-25}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/teable ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "teable" "teableio/teable"; then
-    msg_info "Stopping Service"
-    systemctl stop teable
-    msg_ok "Stopped Service"
-
-    msg_info "Backing up Configuration"
-    cp /opt/teable/.env /opt/teable.env.bak
-    msg_ok "Backed up Configuration"
-
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "teable" "teableio/teable" "tarball"
-
-    msg_info "Restoring Configuration"
-    mv /opt/teable.env.bak /opt/teable/.env
-    msg_ok "Restored Configuration"
-
-    msg_info "Rebuilding Teable"
-    cd /opt/teable
-    TEABLE_VERSION=$(cat ~/.teable)
-    echo "NEXT_PUBLIC_BUILD_VERSION=\"${TEABLE_VERSION}\"" >>apps/nextjs-app/.env
-    export HUSKY=0
-    export NODE_OPTIONS="--max-old-space-size=8192"
-    $STD pnpm install --frozen-lockfile
-    $STD pnpm -F @teable/db-main-prisma prisma-generate --schema ./prisma/postgres/schema.prisma
-    NODE_ENV=production NEXT_BUILD_ENV_TYPECHECK=false \
-      $STD pnpm -r --filter '!playground' run build
-    msg_ok "Rebuilt Teable"
-
-    msg_info "Running Database Migrations"
-    source /opt/teable/.env
-    $STD pnpm -F @teable/db-main-prisma prisma-migrate deploy --schema ./prisma/postgres/schema.prisma
-    msg_ok "Ran Database Migrations"
-
-    msg_info "Starting Service"
-    systemctl start teable
-    msg_ok "Started Service"
-    msg_ok "Updated successfully!"
-  else
-    msg_ok "No update available."
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:3000${CL}"

ct/threadfin.sh

@@ -29,12 +29,12 @@ function update_script() {
     exit
   fi
 
-  if check_for_gh_release "threadfin-app" "threadfin/threadfin"; then
+  if check_for_gh_release "threadfin" "threadfin/threadfin"; then
     msg_info "Stopping Service"
     systemctl stop threadfin
     msg_ok "Stopped Service"
 
-    fetch_and_deploy_gh_release "threadfin-app" "threadfin/threadfin" "singlefile" "latest" "/opt/threadfin" "Threadfin_linux_amd64"
+    fetch_and_deploy_gh_release "threadfin" "threadfin/threadfin" "singlefile" "latest" "/opt/threadfin" "Threadfin_linux_amd64"
 
     msg_info "Starting Service"
     systemctl start threadfin

ct/tubearchivist.sh

@@ -1,83 +0,0 @@
-#!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/tubearchivist/tubearchivist
-
-APP="Tube Archivist"
-var_tags="${var_tags:-media;youtube;archiving}"
-var_cpu="${var_cpu:-4}"
-var_ram="${var_ram:-6144}"
-var_disk="${var_disk:-30}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/tubearchivist ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "tubearchivist" "tubearchivist/tubearchivist"; then
-    msg_info "Stopping Services"
-    systemctl stop tubearchivist tubearchivist-celery tubearchivist-beat
-    msg_ok "Stopped Services"
-
-    msg_info "Backing up Data"
-    cp /opt/tubearchivist/.env /opt/tubearchivist_env.bak
-    msg_ok "Backed up Data"
-
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "tubearchivist" "tubearchivist/tubearchivist" "tarball"
-
-    msg_info "Rebuilding Tube Archivist"
-    cd /opt/tubearchivist/frontend
-    $STD npm install
-    $STD npm run build:deploy
-    mkdir -p /opt/tubearchivist/backend/static
-    cp -r /opt/tubearchivist/frontend/dist/* /opt/tubearchivist/backend/static/
-    cp /opt/tubearchivist/docker_assets/backend_start.py /opt/tubearchivist/backend/
-    $STD uv pip install --python /opt/tubearchivist/.venv/bin/python -r /opt/tubearchivist/backend/requirements.txt
-    if [[ -f /opt/tubearchivist/backend/requirements.plugins.txt ]]; then
-      mkdir -p /opt/yt_plugins/bgutil
-      $STD uv pip install --python /opt/tubearchivist/.venv/bin/python --target /opt/yt_plugins/bgutil -r /opt/tubearchivist/backend/requirements.plugins.txt
-    fi
-    msg_ok "Rebuilt Tube Archivist"
-
-    msg_info "Restoring Configuration"
-    mv /opt/tubearchivist_env.bak /opt/tubearchivist/.env
-    sed -i 's|^TA_APP_DIR=/opt/tubearchivist$|TA_APP_DIR=/opt/tubearchivist/backend|' /opt/tubearchivist/.env
-    sed -i 's|^TA_CACHE_DIR=/opt/tubearchivist/cache$|TA_CACHE_DIR=/cache|' /opt/tubearchivist/.env
-    sed -i 's|^TA_MEDIA_DIR=/opt/tubearchivist/media$|TA_MEDIA_DIR=/youtube|' /opt/tubearchivist/.env
-    ln -sf /opt/tubearchivist/cache /cache
-    ln -sf /opt/tubearchivist/media /youtube
-    ln -sf /opt/tubearchivist/.env /opt/tubearchivist/backend/.env
-    msg_ok "Restored Configuration"
-
-    msg_info "Starting Services"
-    systemctl start tubearchivist tubearchivist-celery tubearchivist-beat
-    systemctl reload nginx
-    msg_ok "Started Services"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:8000${CL}"

install/alpine-docker-install.sh

@@ -14,7 +14,7 @@ network_check
 update_os
 
 msg_info "Installing Dependencies"
-$STD apk add tzdata openssl
+$STD apk add tzdata
 msg_ok "Installed Dependencies"
 
 msg_info "Installing Docker"

install/endurain-install.sh

@@ -3,7 +3,7 @@
 # Copyright (c) 2021-2026 community-scripts ORG
 # Author: johanngrobe
 # License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://codeberg.org/endurain-project/endurain
+# Source: https://github.com/joaovitoriasilva/endurain
 
 source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
 color
@@ -21,7 +21,7 @@ PYTHON_VERSION="3.13" setup_uv
 NODE_VERSION="24" setup_nodejs
 PG_VERSION="17" PG_MODULES="postgis" setup_postgresql
 PG_DB_NAME="enduraindb" PG_DB_USER="endurain" setup_postgresql_db
-fetch_and_deploy_codeberg_release "endurain" "endurain-project/endurain" "tarball" "latest" "/opt/endurain"
+fetch_and_deploy_gh_release "endurain" "endurain-project/endurain" "tarball" "latest" "/opt/endurain"
 
 msg_info "Setting up Endurain"
 cd /opt/endurain

install/immichframe-install.sh

@@ -43,6 +43,8 @@ cd /tmp/immichframe/immichFrame.Web
 $STD npm ci
 $STD npm run build
 cp -r build/* /opt/immichframe/wwwroot
+$STD apt remove -y dotnet-sdk-8.0
+$STD apt autoremove -y
 rm -rf /tmp/immichframe
 mkdir -p /opt/immichframe/Config
 curl -fsSL "https://raw.githubusercontent.com/immichFrame/ImmichFrame/main/docker/Settings.example.yml" -o /opt/immichframe/Config/Settings.yml

install/mail-archiver-install.sh

@@ -22,8 +22,7 @@ setup_deb822_repo \
   "main"
 $STD apt install -y \
   dotnet-sdk-10.0 \
-  aspnetcore-runtime-8.0 \
+  aspnetcore-runtime-8.0
-  libgssapi-krb5-2
 msg_ok "Installed Dependencies"
 
 PG_VERSION="17" setup_postgresql

install/nagios-install.sh

@@ -1,79 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: CanbiZ (MickLesk)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/NagiosEnterprises/nagioscore
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-msg_info "Installing Dependencies"
-$STD apt install -y \
-  autoconf \
-  automake \
-  build-essential \
-  bc \
-  dc \
-  gawk \
-  gettext \
-  gperf \
-  libgd-dev \
-  libmcrypt-dev \
-  libnet-snmp-perl \
-  libssl-dev \
-  snmp \
-  apache2 \
-  apache2-utils
-msg_ok "Installed Dependencies"
-
-PHP_APACHE="YES" setup_php
-
-fetch_and_deploy_gh_release "nagios" "NagiosEnterprises/nagioscore" "tarball"
-
-msg_info "Building Nagios Core"
-cd /opt/nagios
-$STD ./configure --with-httpd-conf=/etc/apache2/sites-enabled
-$STD make all
-$STD make install-groups-users
-usermod -a -G nagios www-data
-$STD make install
-$STD make install-daemoninit
-$STD make install-commandmode
-$STD make install-config
-$STD make install-webconf
-$STD a2enmod rewrite
-$STD a2enmod cgi
-msg_ok "Built Nagios Core"
-
-fetch_and_deploy_gh_release "nagios-plugins" "nagios-plugins/nagios-plugins" "tarball"
-
-msg_info "Building Nagios Plugins"
-cd /opt/nagios-plugins
-$STD ./tools/setup
-$STD ./configure
-$STD make
-$STD make install
-setcap cap_net_raw+p /bin/ping
-msg_ok "Built Nagios Plugins"
-
-msg_info "Configuring Web Authentication"
-$STD htpasswd -bc /usr/local/nagios/etc/htpasswd.users nagiosadmin nagiosadmin
-chown root:www-data /usr/local/nagios/etc/htpasswd.users
-chmod 640 /usr/local/nagios/etc/htpasswd.users
-msg_ok "Configured Web Authentication"
-
-msg_info "Starting Services"
-systemctl enable -q apache2
-systemctl restart apache2
-systemctl enable -q --now nagios
-msg_ok "Started Services"
-
-motd_ssh
-customize
-cleanup_lxc

install/protonmail-bridge-install.sh

@@ -1,192 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: Stephen Chin (steveonjava)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/ProtonMail/proton-bridge
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-msg_info "Installing Dependencies"
-$STD apt install -y pass
-msg_ok "Installed Dependencies"
-
-msg_info "Creating Service User"
-useradd -r -m -d /home/protonbridge -s /usr/sbin/nologin protonbridge
-install -d -m 0750 -o protonbridge -g protonbridge /home/protonbridge
-msg_ok "Created Service User"
-
-fetch_and_deploy_gh_release "protonmail-bridge" "ProtonMail/proton-bridge" "binary"
-
-msg_info "Creating Services"
-cat <<EOF >/etc/systemd/system/protonmail-bridge.service
-[Unit]
-Description=Proton Mail Bridge (noninteractive)
-After=network-online.target
-Wants=network-online.target
-ConditionPathExists=/home/protonbridge/.protonmailbridge-initialized
-
-[Service]
-Type=simple
-User=protonbridge
-Group=protonbridge
-WorkingDirectory=/home/protonbridge
-Environment=HOME=/home/protonbridge
-ExecStart=/usr/bin/protonmail-bridge --noninteractive
-Restart=always
-RestartSec=3
-NoNewPrivileges=yes
-PrivateTmp=yes
-ProtectSystem=full
-ProtectKernelTunables=yes
-ProtectKernelModules=yes
-ProtectControlGroups=yes
-
-[Install]
-WantedBy=multi-user.target
-EOF
-cat <<'EOF' >/etc/systemd/system/protonmail-bridge-imap.socket
-[Unit]
-Description=Proton Mail Bridge IMAP Socket (143)
-ConditionPathExists=/home/protonbridge/.protonmailbridge-initialized
-
-[Socket]
-ListenStream=143
-Accept=no
-Service=protonmail-bridge-imap-proxy.service
-
-[Install]
-WantedBy=sockets.target
-EOF
-cat <<'EOF' >/etc/systemd/system/protonmail-bridge-imap-proxy.service
-[Unit]
-Description=Proton Mail Bridge IMAP Proxy (143 -> 127.0.0.1:1143)
-After=protonmail-bridge.service
-Requires=protonmail-bridge.service
-ConditionPathExists=/home/protonbridge/.protonmailbridge-initialized
-
-[Service]
-Type=simple
-Sockets=protonmail-bridge-imap.socket
-ExecStart=/usr/lib/systemd/systemd-socket-proxyd 127.0.0.1:1143
-NoNewPrivileges=yes
-PrivateTmp=yes
-EOF
-cat <<'EOF' >/etc/systemd/system/protonmail-bridge-smtp.socket
-[Unit]
-Description=Proton Mail Bridge SMTP Socket (587)
-ConditionPathExists=/home/protonbridge/.protonmailbridge-initialized
-
-[Socket]
-ListenStream=587
-Accept=no
-Service=protonmail-bridge-smtp-proxy.service
-
-[Install]
-WantedBy=sockets.target
-EOF
-cat <<'EOF' >/etc/systemd/system/protonmail-bridge-smtp-proxy.service
-[Unit]
-Description=Proton Mail Bridge SMTP Proxy (587 -> 127.0.0.1:1025)
-After=protonmail-bridge.service
-Requires=protonmail-bridge.service
-ConditionPathExists=/home/protonbridge/.protonmailbridge-initialized
-
-[Service]
-Type=simple
-Sockets=protonmail-bridge-smtp.socket
-ExecStart=/usr/lib/systemd/systemd-socket-proxyd 127.0.0.1:1025
-NoNewPrivileges=yes
-PrivateTmp=yes
-EOF
-msg_ok "Created Services"
-
-msg_info "Creating Helper Commands"
-
-cat <<'EOF' >/usr/local/bin/protonmailbridge-configure
-#!/usr/bin/env bash
-set -euo pipefail
-
-BRIDGE_USER="protonbridge"
-BRIDGE_HOME="/home/${BRIDGE_USER}"
-GNUPG_HOME="${BRIDGE_HOME}/.gnupg"
-MARKER="${BRIDGE_HOME}/.protonmailbridge-initialized"
-
-FIRST_TIME=0
-if [[ ! -f "${MARKER}" ]]; then
-  FIRST_TIME=1
-fi
-
-# Stop sockets/proxies/bridge daemon before configuration
-systemctl stop protonmail-bridge-imap.socket protonmail-bridge-smtp.socket
-systemctl stop protonmail-bridge-imap-proxy protonmail-bridge-smtp-proxy protonmail-bridge
-
-if [[ "${FIRST_TIME}" == "1" ]]; then
-  echo "First-time setup: initializing pass keychain for ${BRIDGE_USER} (required by Proton Mail Bridge on Linux)."
-
-  install -d -m 0700 -o "${BRIDGE_USER}" -g "${BRIDGE_USER}" "${GNUPG_HOME}"
-
-  FPR="$(runuser -u "${BRIDGE_USER}" -- env HOME="${BRIDGE_HOME}" GNUPGHOME="${GNUPG_HOME}" \
-    gpg --list-secret-keys --with-colons 2>/dev/null | awk -F: '$1=="fpr"{print $10; exit}')"
-
-  if [[ -z "${FPR}" ]]; then
-    runuser -u "${BRIDGE_USER}" -- env HOME="${BRIDGE_HOME}" GNUPGHOME="${GNUPG_HOME}" \
-      gpg --batch --pinentry-mode loopback --passphrase '' \
-      --quick-gen-key 'ProtonMail Bridge' default default never
-
-    FPR="$(runuser -u "${BRIDGE_USER}" -- env HOME="${BRIDGE_HOME}" GNUPGHOME="${GNUPG_HOME}" \
-      gpg --list-secret-keys --with-colons 2>/dev/null | awk -F: '$1=="fpr"{print $10; exit}')"
-  fi
-
-  if [[ -z "${FPR}" ]]; then
-    echo "Failed to detect a GPG key fingerprint for ${BRIDGE_USER}." >&2
-    exit 1
-  fi
-
-  runuser -u "${BRIDGE_USER}" -- env HOME="${BRIDGE_HOME}" GNUPGHOME="${GNUPG_HOME}" \
-    pass init "${FPR}"
-
-  echo
-  echo "To do initial configuration of the Proton Mail Bridge:"
-  echo "Run: login"
-  echo "Run: info"
-  echo "Run: exit"
-  echo
-else
-  echo
-  echo "Launching Proton Mail Bridge CLI for configuration."
-  echo "External access is disabled until you exit."
-  echo "Run: exit"
-  echo
-fi
-
-runuser -u "${BRIDGE_USER}" -- env HOME="${BRIDGE_HOME}" \
-  protonmail-bridge -c
-
-if [[ "${FIRST_TIME}" == "1" ]]; then
-  touch "${MARKER}"
-  chown "${BRIDGE_USER}:${BRIDGE_USER}" "${MARKER}"
-  chmod 0644 "${MARKER}"
-fi
-
-systemctl enable -q --now protonmail-bridge.service protonmail-bridge-imap.socket protonmail-bridge-smtp.socket
-
-if [[ "${FIRST_TIME}" == "1" ]]; then
-  echo "Initialization complete. Services enabled and started."
-else
-  echo "Configuration complete. Services enabled and started."
-fi
-EOF
-chmod +x /usr/local/bin/protonmailbridge-configure
-ln -sf /usr/local/bin/protonmailbridge-configure /usr/bin/protonmailbridge-configure
-msg_ok "Created Helper Commands"
-
-motd_ssh
-customize
-cleanup_lxc

install/shelfmark-install.sh

@@ -116,7 +116,7 @@ else
 fi
 
 NODE_VERSION="24" setup_nodejs
-PYTHON_VERSION="3.14" setup_uv
+PYTHON_VERSION="3.12" setup_uv
 
 fetch_and_deploy_gh_release "shelfmark" "calibrain/shelfmark" "tarball" "latest" "/opt/shelfmark"
 RELEASE_VERSION=$(cat "$HOME/.shelfmark")
@@ -130,15 +130,11 @@ mv /opt/shelfmark/src/frontend/dist /opt/shelfmark/frontend-dist
 msg_ok "Built Shelfmark frontend"
 
 msg_info "Configuring Shelfmark"
-export VIRTUAL_ENV=/opt/shelfmark/venv
 cd /opt/shelfmark
 $STD uv venv --clear ./venv
 $STD source ./venv/bin/activate
-if [[ "$DEPLOYMENT_TYPE" == "1" ]]; then
+$STD uv pip install -r ./requirements-base.txt
-  $STD uv sync --active --locked --no-default-groups --extra browser
+[[ "$DEPLOYMENT_TYPE" == "1" ]] && $STD uv pip install -r ./requirements-shelfmark.txt
-else
-  $STD uv sync --active --locked --no-default-groups
-fi
 mkdir -p {/var/log/shelfmark,/tmp/shelfmark}
 msg_ok "Configured Shelfmark"
 

install/soulsync-install.sh

@@ -1,59 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/Nezreka/SoulSync
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-msg_info "Installing Dependencies"
-$STD apt install -y \
-  gcc \
-  libffi-dev \
-  libssl-dev \
-  libchromaprint-tools \
-  ffmpeg
-msg_ok "Installed Dependencies"
-
-UV_PYTHON="3.11" setup_uv
-
-fetch_and_deploy_gh_release "soulsync" "Nezreka/SoulSync" "tarball"
-
-msg_info "Setting up Application"
-cd /opt/soulsync
-$STD uv venv /opt/soulsync/.venv --python 3.11
-$STD uv pip install -r requirements.txt --python /opt/soulsync/.venv/bin/python
-mkdir -p /opt/soulsync/{config,data,logs}
-msg_ok "Set up Application"
-
-msg_info "Creating Service"
-cat <<EOF >/etc/systemd/system/soulsync.service
-[Unit]
-Description=SoulSync Music Discovery
-After=network.target
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=/opt/soulsync
-ExecStart=/opt/soulsync/.venv/bin/python web_server.py
-Environment=PYTHONPATH=/opt/soulsync PYTHONUNBUFFERED=1 DATABASE_PATH=/opt/soulsync/data/music_library.db
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now soulsync
-msg_ok "Created Service"
-
-motd_ssh
-customize
-cleanup_lxc

install/step-ca-install.sh

@@ -23,34 +23,21 @@ setup_deb822_repo \
 msg_info "Installing step-ca and step-cli"
 $STD apt install -y step-ca step-cli
 
-STEPPATH="/etc/step-ca"
+STEPHOME="/root/.step"
-STEPHOME="/etc/step"
+export STEPPATH=/etc/step-ca
-
-export STEPPATH=$STEPPATH
-echo "export STEPPATH=${STEPPATH}" >> /etc/profile
 export STEPHOME=$STEPHOME
-echo "export STEPHOME=${STEPHOME}" >> /etc/profile
 
-mkdir -p "$STEPHOME"
+sed  -i '1i export STEPPATH=/etc/step-ca' /etc/profile
+sed  -i '1i export STEPHOME=/root/.step' /etc/profile
 
-# Patch for making $STD happy (/usr/bin/step is a symlink to /usr/bin/step-cli)
+setcap CAP_NET_BIND_SERVICE=+eip $(which step-ca)
-STEPBIN="$(which step)"
-rm -f "$STEPBIN"
-cp -f "$(which step-cli)" "$STEPBIN"
 
-# Low port-binding capabilities (ports < 1024)
+$STD useradd --user-group --system --home $(step path) --shell /bin/false step
-# - Default step-ca listener port: 443
-setcap CAP_NET_BIND_SERVICE=+eip "$(which step-ca)"
-
-# Service User used by systemd step-ca.service
-$STD useradd --user-group --system --home "$(step path)" --shell /bin/false step
 msg_ok "Installed step-ca and step-cli"
 
 DomainName="$(hostname -d)"
 
 PKIName="$(prompt_input "Enter PKIName" "MyHomePKI" 30)"
-PKICountry="$(prompt_input "Enter PKICountry" "DE" 30)"
-PKIOrganizationalUnit="$(prompt_input "Enter PKIOrganizationalUnit" "MyHomeLab" 30)"
 PKIProvisioner="$(prompt_input "Enter PKIProvisioner" "pki@$DomainName" 30)"
 AcmeProvisioner="$(prompt_input "Enter AcmeProvisioner" "acme@$DomainName" 30)"
 X509MinDur="$(prompt_input "Enter X509MinDur" "48h" 30)"
@@ -58,15 +45,11 @@ X509MaxDur="$(prompt_input "Enter X509MaxDur" "87600h" 30)"
 X509DefaultDur="$(prompt_input "Enter X509DefaultDur" "168h" 30)"
 
 msg_info "Initializing step-ca"
-
-# Initialize step-ca
 DeploymentType="standalone"
 FQDN="$(hostname -f)"
 IP="${LOCAL_IP}"
 LISTENER=":443"
-LISTENER_INSECURE=":80"
 
-# Set different signing CA and Provisioner Passwords
 EncryptionPwdDir="$(step path)/encryption"
 PwdFile="$EncryptionPwdDir/ca.pwd"
 ProvisionerPwdFile="$EncryptionPwdDir/provisioner.pwd"
@@ -74,208 +57,19 @@ mkdir -p "$EncryptionPwdDir"
 gpg -q --gen-random --armor 2 32 >"$PwdFile"
 gpg -q --gen-random --armor 2 32 >"$ProvisionerPwdFile"
 
-# Used by systemd step-ca.service
+$STD step ca init --deployment-type="$DeploymentType" --ssh --name="$PKIName" --dns="$FQDN" --dns="$IP" --address="$LISTENER" --provisioner="$PKIProvisioner" --password-file="$PwdFile" --provisioner-password-file="$ProvisionerPwdFile"
+
 ln -s "$PwdFile" "$(step path)/password.txt"
-
+chown -R step:step $(step path)
-# Usage of:
+chmod -R 700 $(step path)
-# - SSH feature of step-ca
+$STD step ca provisioner add "$AcmeProvisioner" --type ACME --admin-name "$AcmeProvisioner"
-# - BadgerDB (badgerv2) => Default DB backend of step-ca
+$STD step ca provisioner update "$PKIProvisioner" --x509-min-dur="$X509MinDur" --x509-max-dur="$X509MaxDur" --x509-default-dur="$X509DefaultDur" --allow-renewal-after-expiry
-# - badgerFileLoadingMode: FileIO (instead of MemoryMap) for LXC with low RAM
+$STD step ca provisioner update "$AcmeProvisioner" --x509-min-dur="$X509MinDur" --x509-max-dur="$X509MaxDur" --x509-default-dur="$X509DefaultDur" --allow-renewal-after-expiry
-$STD step ca init \
+$STD step certificate install --all $(step path)/certs/root_ca.crt
-  --deployment-type="$DeploymentType" \
-  --ssh \
-  --name="$PKIName" \
-  --dns="$FQDN" \
-  --dns="$IP" \
-  --address="$LISTENER" \
-  --provisioner="$PKIProvisioner" \
-  --password-file="$PwdFile" \
-  --provisioner-password-file="$ProvisionerPwdFile"
-
-# Define enhanced x509 CA and Certificate Templates
-mkdir -p "$(step path)/templates/ca"
-mkdir -p "$(step path)/templates/x509"
-
-CARootTemplate="$(step path)/templates/ca/root.tpl"
-CAIntermediateTemplate="$(step path)/templates/ca/intermediate.tpl"
-X509LeafTemplate="$(step path)/templates/x509/leaf.tpl"
-X509LeafTemplateData="$(step path)/templates/x509/leaf_data.tpl"
-
-cat <<'EOF' >"$CARootTemplate"
-{
-	"subject": {
-		"country": {{ toJson .Insecure.User.country }},
-		"organization": {{ toJson .Insecure.User.organization }},
-		"organizationalUnit": {{ toJson .Insecure.User.organizationalUnit }},
-		"commonName": {{ toJson .Subject.CommonName }}
-	},
-  "issuer": {{ toJson .Subject }},
-	"keyUsage": ["certSign", "crlSign"],
-	"basicConstraints": {
-		"isCA": true,
-		"maxPathLen": 1
-	},
-	"issuingCertificateURL": [{{ toJson .Insecure.User.issuingCertificateURL }}],
-	"crlDistributionPoints": [{{ toJson .Insecure.User.crlDistributionPoints }}]
-}
-EOF
-
-cat <<'EOF' >"$CAIntermediateTemplate"
-{
-	"subject": {
-		"country": {{ toJson .Insecure.User.country }},
-		"organization": {{ toJson .Insecure.User.organization }},
-		"organizationalUnit": {{ toJson .Insecure.User.organizationalUnit }},
-		"commonName": {{ toJson .Subject.CommonName }}
-	},
-	"keyUsage": ["certSign", "crlSign"],
-	"basicConstraints": {
-		"isCA": true,
-		"maxPathLen": 0
-	},
-	"issuingCertificateURL": [{{ toJson .Insecure.User.issuingCertificateURL }}],
-	"crlDistributionPoints": [{{ toJson .Insecure.User.crlDistributionPoints }}]
-}
-EOF
-
-cat <<'EOF' >"$X509LeafTemplate"
-{
-	"subject": {
-{{- if .Insecure.User.Country }}
-		"country": {{ toJson .Insecure.User.country }},
-{{- else }}
-		"country": {{ toJson .country }},
-{{- end }}
-{{- if .Insecure.User.organization }}
-		"organization": {{ toJson .Insecure.User.organization }},
-{{- else }}
-		"organization": {{ toJson .organization }},
-{{- end }}
-{{- if .Insecure.User.organizationalUnit }}
-		"organizationalUnit": {{ toJson .Insecure.User.organizationalUnit }},
-{{- else }}
-		"organizationalUnit": {{ toJson .organizationalUnit }},
-{{- end }}
-		"commonName": {{ toJson .Subject.CommonName }}
-	},
-	"sans": {{ toJson .SANs }},
-{{- if typeIs "*rsa.PublicKey" .Insecure.CR.PublicKey }}
-	"keyUsage": ["keyEncipherment", "digitalSignature"],
-{{- else }}
-	"keyUsage": ["digitalSignature"],
-{{- end }}
-	"extKeyUsage": ["serverAuth", "clientAuth"],
-{{- if .Insecure.User.issuingCertificateURL }}
-	"issuingCertificateURL": [{{ toJson .Insecure.User.issuingCertificateURL }}],
-{{- else }}
-	"issuingCertificateURL": [{{ toJson .issuingCertificateURL }}],
-{{- end }}
-{{- if .Insecure.User.crlDistributionPoints }}
-	"crlDistributionPoints": [{{ toJson .Insecure.User.crlDistributionPoints }}]
-{{- else }}
-	"crlDistributionPoints": [{{ toJson .crlDistributionPoints }}]
-{{- end }}
-}
-EOF
-
-cat <<EOF >"$X509LeafTemplateData"
-{
-	"country": "${PKICountry}",
-	"organization": "${PKIName}",
-	"organizationalUnit": "${PKIOrganizationalUnit}",
-	"issuingCertificateURL": ["https://${FQDN}${LISTENER}/intermediates.pem"],
-	"crlDistributionPoints": ["https://${FQDN}${LISTENER}/crl"]
-}
-EOF
-
-# Configure CA Provisioners, DB and CRL settings
-$STD step ca provisioner add "$AcmeProvisioner" \
-  --type ACME \
-  --admin-name "$AcmeProvisioner"
-
-$STD step ca provisioner update "$PKIProvisioner" \
-  --x509-min-dur="$X509MinDur" \
-  --x509-max-dur="$X509MaxDur" \
-  --x509-default-dur="$X509DefaultDur" \
-  --x509-template="$X509LeafTemplate" \
-  --x509-template-data="$X509LeafTemplateData" \
-  --allow-renewal-after-expiry
-
-$STD step ca provisioner update "$AcmeProvisioner" \
-  --x509-min-dur="$X509MinDur" \
-  --x509-max-dur="$X509MaxDur" \
-  --x509-default-dur="$X509DefaultDur" \
-  --x509-template="$X509LeafTemplate" \
-  --x509-template-data="$X509LeafTemplateData" \
-  --allow-renewal-after-expiry
-
-CAConfig="$(step path)/config/ca.json"
-jq --arg a "${PKICountry}" '.country = $a' "${CAConfig}" > "${CAConfig}_tmp" && mv "${CAConfig}_tmp" "${CAConfig}"
-jq --arg a "${PKIName}" '.organization = $a' "${CAConfig}" > "${CAConfig}_tmp" && mv "${CAConfig}_tmp" "${CAConfig}"
-jq --arg a "${PKIOrganizationalUnit}" '.organizationalUnit = $a' "${CAConfig}" > "${CAConfig}_tmp" && mv "${CAConfig}_tmp" "${CAConfig}"
-jq --arg a "${PKIName} Online CA" '.commonName = $a' "${CAConfig}" > "${CAConfig}_tmp" && mv "${CAConfig}_tmp" "${CAConfig}"
-jq '.db.badgerFileLoadingMode = "FileIO"' "${CAConfig}" > "${CAConfig}_tmp" && mv "${CAConfig}_tmp" "${CAConfig}"
-jq '.crl.enabled = true' "${CAConfig}" > "${CAConfig}_tmp" && mv "${CAConfig}_tmp" "${CAConfig}"
-jq '.crl.generateOnRevoke = true' "${CAConfig}" > "${CAConfig}_tmp" && mv "${CAConfig}_tmp" "${CAConfig}"
-jq '.crl.cacheDuration = "24h0m0s"' "${CAConfig}" > "${CAConfig}_tmp" && mv "${CAConfig}_tmp" "${CAConfig}"
-jq '.crl.renewPeriod = "16h0m0s"' "${CAConfig}" > "${CAConfig}_tmp" && mv "${CAConfig}_tmp" "${CAConfig}"
-jq --arg a "https://${FQDN}${LISTENER}/crl" '.crl.idpURL = $a' "${CAConfig}" > "${CAConfig}_tmp" && mv "${CAConfig}_tmp" "${CAConfig}"
-jq --arg a "$LISTENER_INSECURE" '.insecureAddress = $a' "${CAConfig}" > "${CAConfig}_tmp" && mv "${CAConfig}_tmp" "${CAConfig}"
-
-# Generate Root CA Certificate and Key
-# - Validity: 219168h (~25 Years)
-# - maxPathLen: 1 (Root -> Intermediate -> Leaf) => Only one Intermediate CA allowed below Root CA
-# - Active revocation on Intermediate CA and Leaf Certificates by the usage of build-in Certificate Revocation List (CRL)
-FLAGS=(--force
-  --template="${CARootTemplate}"
-  --not-after="219168h"
-  --password-file="${PwdFile}"
-  --set country="${PKICountry}"
-  --set organization="${PKIName}"
-  --set organizationalUnit="${PKIOrganizationalUnit}"
-  --set issuingCertificateURL="https://${FQDN}${LISTENER}/roots.pem"
-  --set crlDistributionPoints="https://${FQDN}${LISTENER}/crl")
-
-$STD step certificate create "${PKIName} Root CA" \
-  "$(step path)/certs/root_ca.crt" \
-  "$(step path)/secrets/root_ca_key" \
-  "${FLAGS[@]}"
-
-# Generate Intermediate CA Certificate Bundle and Key
-# - Validity: 175368h (~20 Years)
-# - maxPathLen: 0 (Root -> Intermediate -> Leaf) => Intermediate CA is only allowed to issue Leaf Certificates
-# - Active revocation on Leaf Certificates by the usage of build-in Certificate Revocation List (CRL)
-# - Bundle: Certificate Chain (including Root CA Certificate)
-FLAGS=(--force
-  --template="${CAIntermediateTemplate}"
-  --ca="$(step path)/certs/root_ca.crt"
-  --ca-key="$(step path)/secrets/root_ca_key"
-  --not-after="175368h"
-  --ca-password-file="${PwdFile}"
-  --password-file="${PwdFile}"
-  --bundle
-  --set country="${PKICountry}"
-  --set organization="${PKIName}"
-  --set organizationalUnit="${PKIOrganizationalUnit}"
-  --set issuingCertificateURL="https://${FQDN}${LISTENER}/roots.pem"
-  --set crlDistributionPoints="https://${FQDN}${LISTENER}/crl")
-
-$STD step certificate create "${PKIName} Intermediate CA" \
-  "$(step path)/certs/intermediate_ca.crt" \
-  "$(step path)/secrets/intermediate_ca_key" \
-  "${FLAGS[@]}"
-
-# Install Root CA Certificate to System Trust Store
-$STD step certificate install --all "$(step path)/certs/root_ca.crt"
 $STD update-ca-certificates
-
-chown -R step:step "$(step path)"
-chmod -R 700 "$(step path)"
 msg_ok "Initialized step-ca"
 
 msg_info "Start step-ca as a Daemon"
-
-# https://smallstep.com/docs/step-ca/certificate-authority-server-production/#running-step-ca-as-a-daemon
 cat <<'EOF' >/etc/systemd/system/step-ca.service
 [Unit]
 Description=step-ca service
@@ -336,6 +130,271 @@ msg_ok "Started step-ca as a Daemon"
 fetch_and_deploy_gh_release "step-badger" "lukasz-lobocki/step-badger" "prebuild" "latest" "/opt/step-badger" "step-badger_Linux_x86_64.tar.gz"
 ln -s /opt/step-badger/step-badger /usr/local/bin/step-badger
 
+msg_info "Install step-ca Admin script"
+mkdir -p "$STEPHOME"
+cat <<'ADDON_EOF' >"$STEPHOME/step-ca-admin.sh"
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Joerg Heinemann (heinemannj)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+
+function header_info() {
+  clear
+  cat <<"EOF"
+         __                                 ___       __          _     
+   _____/ /____  ____        _________ _   /   | ____/ /___ ___  (_)___ 
+  / ___/ __/ _ \/ __ \______/ ___/ __ `/  / /| |/ __  / __ `__ \/ / __ \
+ (__  ) /_/  __/ /_/ /_____/ /__/ /_/ /  / ___ / /_/ / / / / / / / / / /
+/____/\__/\___/ .___/      \___/\__,_/  /_/  |_\__,_/_/ /_/ /_/_/_/ /_/ 
+             /_/                                                            
+
+EOF
+}
+
+function die() {
+  echo -e "\n${BL}[ERROR]${GN} ${RD}${1}${CL}\n"
+  exit
+}
+
+function success() {
+  echo -e "${BL}[SUCCESS]${GN} ${1}${CL}\n"
+  exit
+}
+
+function whiptail_menu() {
+  MENU_ARRAY=()
+  MSG_MAX_LENGTH=0
+  while read -r TAG ITEM; do
+    OFFSET=2
+    ((${#ITEM} + OFFSET > MSG_MAX_LENGTH)) && MSG_MAX_LENGTH=${#ITEM}+OFFSET
+    MENU_ARRAY+=("$TAG" "$ITEM " "OFF")
+  done < <(echo "$1")
+}
+
+function x509_list() {
+  CERT_LIST=""
+  cp --recursive --force "$(step path)/db/"* "$STEPHOME/db-copy/"
+  cp --recursive --force "$(step path)/certs/"* "$STEPHOME/certs/ca/"
+  if [[ $(step-badger x509Certs "${STEPHOME}/db-copy" 2>/dev/null) ]]; then
+    CERT_LIST=$(step-badger x509Certs ${STEPHOME}/db-copy 2>/dev/null)
+  fi
+}
+
+function ssh_list() {
+  CERT_LIST=""
+  cp --recursive --force "$(step path)/db/"* "$STEPHOME/db-copy/"
+  cp --recursive --force "$(step path)/certs/"* "$STEPHOME/certs/ca/"
+  if [[ $(step-badger sshCerts "${STEPHOME}/db-copy" 2>/dev/null) ]]; then
+    CERT_LIST=$(step-badgersshCerts ${STEPHOME}/db-copy 2>/dev/null)
+  fi
+}
+
+function x509_serial_to_cn() {
+  x509_list
+  CN="$(echo "${CERT_LIST}" | grep "${SERIAL_NUMBER}" | awk '{print $2}' | sed 's/CN=//g')"
+  CRT="$STEPHOME/certs/x509/$CN.crt"
+  KEY="$STEPHOME/certs/x509/$CN.key"
+  if ! [[ -f ${CRT} ]]; then
+    die "Certificate ${CRT} not found!"
+  elif ! [[ -f ${KEY} ]]; then
+    die "Private Key ${KEY} not found!"
+  fi
+}
+
+function x509_revoke() {
+  # shellcheck disable=SC2206
+  SERIAL_NUMBER_ARRAY=(${CERT_SERIAL_NUMBERS})
+  for SERIAL_NUMBER in "${SERIAL_NUMBER_ARRAY[@]}"; do
+    echo -e "${BL}[Info]${GN} Revoke x509 Certificate with Serial Number ${BL}${SERIAL_NUMBER}${GN}:${CL}"
+    echo
+    TOKEN=$(step ca token --provisioner="$PROVISIONER" --provisioner-password-file="$PROVISIONER_PASSWORD" --revoke "${SERIAL_NUMBER}")
+    step ca revoke --token "$TOKEN" "${SERIAL_NUMBER}" || die "Failed to revoke certificate!"
+    echo
+  done
+  success "Finished."
+}
+
+function x509_renew() {
+  # shellcheck disable=SC2206
+  SERIAL_NUMBER_ARRAY=(${CERT_SERIAL_NUMBERS})
+  for SERIAL_NUMBER in "${SERIAL_NUMBER_ARRAY[@]}"; do
+    echo -e "${BL}[Info]${GN} Renew x509 Certificate with Serial Number ${BL}${SERIAL_NUMBER}${GN}:${CL}"
+    echo
+    x509_serial_to_cn
+    step ca renew "${CRT}" "${KEY}" --force || die "Failed to renew certificate!"
+    echo
+  done
+  success "Finished."
+}
+
+function x509_inspect() {
+  # shellcheck disable=SC2206
+  SERIAL_NUMBER_ARRAY=(${CERT_SERIAL_NUMBERS})
+  for SERIAL_NUMBER in "${SERIAL_NUMBER_ARRAY[@]}"; do
+    echo -e "${BL}[Info]${GN} Inspect x509 Certificate with Serial Number ${BL}${SERIAL_NUMBER}${GN}:${CL}\n"
+    x509_serial_to_cn
+    step certificate inspect "${CRT}" || die "Failed to inspect certificate!"
+    if ! [[ $(step certificate inspect "${CRT}" | grep "${SERIAL_NUMBER}") ]]; then
+      die "Serial Number ${SERIAL_NUMBER} mismatch!"
+    fi
+    echo -e "\n${BL}[Info]${GN} Public Key:${CL}\n"
+    cat "${CRT}"
+    echo -e "\n${BL}[Info]${GN} Private Key:${CL}\n"
+    cat "${KEY}"
+    echo
+  done
+  success "Finished."
+}
+
+function x509_request() {
+  FQDN=""
+  SAN=""
+
+  while true; do
+    FQDN=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "Certificate Signing Request (CSR)" --inputbox '\nFQDN (e.g. MyLXC.example.com)' 10 50 "$FQDN" 3>&1 1>&2 2>&3)
+    IP=$(dig +short "$FQDN")
+    if [[ -z "$IP" ]]; then
+      die "Resolution failed for $FQDN!"
+    fi
+    HOST=$(echo "$FQDN" | awk -F'.' '{print $1}')
+    IP=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "Certificate Signing Request (CSR)" --inputbox '\nIP Address (e.g. x.x.x.x)' 10 50 "$IP" 3>&1 1>&2 2>&3)
+    HOST=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "Certificate Signing Request (CSR)" --inputbox '\nHostname (e.g. MyHostName)' 10 50 "$HOST" 3>&1 1>&2 2>&3)
+    SAN=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "Certificate Signing Request (CSR)" --inputbox '\nSubject Alternative Name(s) (SAN) (e.g. myapp-1.example.com, myapp-2.example.com)' 10 50 "$SAN" 3>&1 1>&2 2>&3)
+    VALID_TO=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "Certificate Signing Request (CSR)" --inputbox '\nValidity (e.g. 2034-01-31T00:00:00Z)' 10 50 "2034-01-31T00:00:00Z" 3>&1 1>&2 2>&3)
+
+    # shellcheck disable=SC2034
+    if whiptail_yesno=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "Certificate Signing Request (CSR)" --yesno "Continue with below?\n
+      FQDN: $FQDN
+      Hostname: $HOST
+      IP Address: $IP
+      Subject Alternative Name(s) (SAN): $SAN
+      Validity: $VALID_TO" --no-button "Change" --yes-button "Continue" 15 70 3>&1 1>&2 2>&3); then
+      break
+    fi
+  done
+
+  echo -e "${BL}[Info]${GN} Request x509 Certificate with subject ${BL}${FQDN}${GN}:${CL}"
+  echo
+  CRT="$STEPHOME/certs/x509/$FQDN.crt"
+  KEY="$STEPHOME/certs/x509/$FQDN.key"
+
+  SAN="$FQDN, $HOST, $IP, $SAN"
+
+  IFS=', ' read -r -a array <<< "$SAN"
+  for element in "${array[@]}"
+  do
+    SAN_ARRAY+=(--san "$element")
+  done
+
+  step ca certificate "$FQDN" "$CRT" "$KEY" \
+    --provisioner="$PROVISIONER" \
+    --provisioner-password-file="$PROVISIONER_PASSWORD" \
+    --not-after="$VALID_TO" \
+    "${SAN_ARRAY[@]}" \
+  || die "Failed to request certificate!"
+
+  echo -e "\n${BL}[Info]${GN} Inspect Certificate:${CL}\n"
+  step certificate inspect "${CRT}" || die "Failed to inspect certificate!"
+  echo -e "\n${BL}[Info]${GN} Public Key:${CL}\n"
+  cat "${CRT}"
+  echo -e "\n${BL}[Info]${GN} Private Key:${CL}\n"
+  cat "${KEY}"
+  echo
+  success "Finished."
+}
+
+set -eEuo pipefail
+# shellcheck disable=SC2034
+# shellcheck disable=SC2116
+# shellcheck disable=SC2028
+YW=$(echo "\033[33m")
+# shellcheck disable=SC2116
+# shellcheck disable=SC2028
+BL=$(echo "\033[36m")
+# shellcheck disable=SC2116
+# shellcheck disable=SC2028
+RD=$(echo "\033[01;31m")
+# shellcheck disable=SC2034
+CM='\xE2\x9C\x94\033'
+# shellcheck disable=SC2116
+# shellcheck disable=SC2028
+GN=$(echo "\033[1;92m")
+# shellcheck disable=SC2116
+# shellcheck disable=SC2028
+CL=$(echo "\033[m")
+
+# Telemetry
+# shellcheck disable=SC1090
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/api.func) 2>/dev/null || true
+declare -f init_tool_telemetry &>/dev/null && init_tool_telemetry "step-ca-admin" "step-ca"
+
+header_info
+
+mkdir --parents "$STEPHOME/db-copy/"
+mkdir --parents "$STEPHOME/certs/ca/_archive/"
+mkdir --parents "$STEPHOME/certs/ssh/_archive/"
+mkdir --parents "$STEPHOME/certs/x509/_archive/"
+
+PROVISIONER=$(jq '.authority.provisioners.[] | select(.type=="JWK") | .name' "$(step path)"/config/ca.json)
+PROVISIONER="${PROVISIONER#\"}"
+PROVISIONER="${PROVISIONER%\"}"
+PROVISIONER_PASSWORD=$(step path)/encryption/provisioner.pwd
+
+whiptail --backtitle "Proxmox VE Helper Scripts" --title "step-ca Admin" --yesno "This will maintain step-ca issued x509 and ssh Certificates. Proceed?" 10 58
+
+MENU_ARRAY=("x509" "Maintain x509 Certificates." "ON")
+MENU_ARRAY+=("ssh" "Maintain ssh Certificates." "OFF")
+CERT_TYPE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "step-ca Admin" --radiolist "\nSelect Certificate Type:" 16 48 6 "${MENU_ARRAY[@]}" 3>&1 1>&2 2>&3 | tr -d '"')
+
+[[ -z ${CERT_TYPE} ]] && die "No Certificate Type selected!"
+
+case ${CERT_TYPE} in
+("x509")
+  x509_list
+  CERT_LIST=$(echo "$CERT_LIST" | awk 'NR>1 {print $1 " " $2 "|" $3 "|" $4 "|" $5}')
+  if [[ $CERT_LIST ]]; then
+    whiptail_menu "$CERT_LIST"
+  else
+    MENU_ARRAY=()
+    MSG_MAX_LENGTH=2
+  fi
+  MENU_ARRAY+=("" "Create a new Certificate" "OFF")
+  CERT_SERIAL_NUMBERS=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "Certificates on $(hostname)" --checklist "\nSelect Certificate(s) to maintain:\n" 16 $((MSG_MAX_LENGTH + 55)) 6 "${MENU_ARRAY[@]}" 3>&1 1>&2 2>&3 | tr -d '"')
+
+  [[ -z ${CERT_SERIAL_NUMBERS} ]] && x509_request
+  
+  MENU_ARRAY=("Renew" "Renew x509 Certificates." "ON")
+  MENU_ARRAY+=("Revoke" "Revoke x509 Certificates." "OFF")
+  MENU_ARRAY+=("Inspect" "Inspect x509 Certificates." "OFF")
+  CERT_MAINTENANCE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "step-ca Admin" --radiolist "\nSelect Maintenance Type:" 16 48 6 "${MENU_ARRAY[@]}" 3>&1 1>&2 2>&3 | tr -d '"')
+
+  case ${CERT_MAINTENANCE} in
+  ("Renew")
+    x509_renew "${CERT_SERIAL_NUMBERS[@]}"
+    ;;
+  ("Revoke")
+    x509_revoke "${CERT_SERIAL_NUMBERS[@]}"
+    ;;
+  ("Inspect")
+    x509_inspect "${CERT_SERIAL_NUMBERS[@]}"
+    ;;
+  *)
+    die "Unsupported CERT_MAINTENANCE Option!"
+    ;;
+  esac
+  ;;
+("ssh")
+  die "Maintain ssh Certificates - To be implemented in future"
+  ;;
+*)
+  die "Unsupported CERT_TYPE Option!"
+  ;;
+esac
+ADDON_EOF
+chmod 700 "$STEPHOME/step-ca-admin.sh"
+msg_ok "Installed step-ca Admin script"
+
 motd_ssh
 customize
 cleanup_lxc

install/teable-install.sh

@@ -1,94 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/teableio/teable
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-msg_info "Installing Dependencies"
-$STD apt install -y \
-  build-essential \
-  python3 \
-  git
-msg_ok "Installed Dependencies"
-
-NODE_VERSION="24" NODE_MODULE="pnpm" setup_nodejs
-PG_VERSION="16" setup_postgresql
-PG_DB_NAME="teable" PG_DB_USER="teable" setup_postgresql_db
-
-fetch_and_deploy_gh_release "teable" "teableio/teable" "tarball"
-
-msg_info "Setting up Teable"
-cd /opt/teable
-TEABLE_VERSION=$(cat ~/.teable)
-echo "NEXT_PUBLIC_BUILD_VERSION=\"${TEABLE_VERSION}\"" >>apps/nextjs-app/.env
-export HUSKY=0
-export NODE_OPTIONS="--max-old-space-size=8192"
-$STD pnpm install --frozen-lockfile
-$STD pnpm -F @teable/db-main-prisma prisma-generate --schema ./prisma/postgres/schema.prisma
-msg_ok "Set up Teable"
-
-msg_info "Building Teable"
-NODE_ENV=production NEXT_BUILD_ENV_TYPECHECK=false \
-  $STD pnpm -r --filter '!playground' run build
-msg_ok "Built Teable"
-
-msg_info "Running Database Migrations"
-PRISMA_DATABASE_URL="postgresql://teable:${PG_DB_PASS}@localhost:5432/teable?schema=public" \
-  $STD pnpm -F @teable/db-main-prisma prisma-migrate deploy --schema ./prisma/postgres/schema.prisma
-msg_ok "Ran Database Migrations"
-
-msg_info "Configuring Teable"
-mkdir -p /opt/teable/.assets /opt/teable/.temporary
-SECRET_KEY=$(openssl rand -base64 32)
-cat <<EOF >/opt/teable/.env
-PRISMA_DATABASE_URL=postgresql://teable:${PG_DB_PASS}@localhost:5432/teable?schema=public&statement_cache_size=1
-PUBLIC_ORIGIN=http://${LOCAL_IP}:3000
-SECRET_KEY=${SECRET_KEY}
-PORT=3000
-NODE_ENV=production
-NEXT_TELEMETRY_DISABLED=1
-BACKEND_CACHE_PROVIDER=sqlite
-BACKEND_CACHE_SQLITE_URI=sqlite:///opt/teable/.assets/.cache.db
-NEXTJS_DIR=apps/nextjs-app
-EOF
-ln -sf /opt/teable /app
-rm -rf /opt/teable/static
-if [ -d "/opt/teable/apps/nestjs-backend/static/static" ]; then
-  ln -sf /opt/teable/apps/nestjs-backend/static/static /opt/teable/static
-else
-  ln -sf /opt/teable/apps/nestjs-backend/static /opt/teable/static
-fi
-msg_ok "Configured Teable"
-
-msg_info "Creating Service"
-cat <<EOF >/etc/systemd/system/teable.service
-[Unit]
-Description=Teable
-After=network.target postgresql.service
-
-[Service]
-Type=simple
-WorkingDirectory=/opt/teable
-EnvironmentFile=/opt/teable/.env
-ExecStart=/usr/bin/node apps/nestjs-backend/dist/index.js
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now teable
-msg_ok "Created Service"
-
-motd_ssh
-customize
-cleanup_lxc

install/threadfin-install.sh

@@ -20,7 +20,9 @@ $STD apt install -y \
   vlc
 msg_ok "Installed Dependencies"
 
-fetch_and_deploy_gh_release "threadfin-app" "threadfin/threadfin" "singlefile" "latest" "/opt/threadfin" "Threadfin_linux_amd64"
+fetch_and_deploy_gh_release "threadfin" "threadfin/threadfin" "singlefile" "latest" "/opt/threadfin" "Threadfin_linux_amd64"
+mv /root/.threadfin /root/.threadfin_version
+mkdir -p /root/.threadfin
 
 msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/threadfin.service

install/tubearchivist-install.sh

@@ -1,294 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/tubearchivist/tubearchivist
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-msg_info "Installing Dependencies"
-$STD apt install -y \
-  build-essential \
-  git \
-  nginx \
-  redis-server \
-  atomicparsley \
-  python3-dev \
-  libldap2-dev \
-  libsasl2-dev \
-  libssl-dev \
-  sqlite3 \
-  ffmpeg
-msg_ok "Installed Dependencies"
-
-UV_PYTHON="3.13" setup_uv
-NODE_VERSION="24" setup_nodejs
-
-fetch_and_deploy_gh_release "deno" "denoland/deno" "prebuild" "latest" "/usr/local/bin" "deno-x86_64-unknown-linux-gnu.zip"
-
-msg_info "Installing ElasticSearch"
-setup_deb822_repo \
-  "elastic-8.x" \
-  "https://artifacts.elastic.co/GPG-KEY-elasticsearch" \
-  "https://artifacts.elastic.co/packages/8.x/apt" \
-  "stable" \
-  "main"
-ES_JAVA_OPTS="-Xms1g -Xmx1g" $STD apt install -y elasticsearch
-msg_ok "Installed ElasticSearch"
-
-msg_info "Configuring ElasticSearch"
-cat <<EOF >/etc/elasticsearch/elasticsearch.yml
-cluster.name: tubearchivist
-path.data: /var/lib/elasticsearch
-path.logs: /var/log/elasticsearch
-path.repo: ["/var/lib/elasticsearch/snapshot"]
-network.host: 127.0.0.1
-xpack.security.enabled: false
-xpack.security.transport.ssl.enabled: false
-xpack.security.http.ssl.enabled: false
-EOF
-mkdir -p /var/lib/elasticsearch/snapshot
-chown -R elasticsearch:elasticsearch /var/lib/elasticsearch/snapshot
-cat <<EOF >/etc/elasticsearch/jvm.options.d/heap.options
--Xms1g
--Xmx1g
-EOF
-sysctl -w vm.max_map_count=262144 2>/dev/null || true
-cat <<EOF >/etc/sysctl.d/99-elasticsearch.conf
-vm.max_map_count=262144
-EOF
-systemctl enable -q --now elasticsearch
-msg_ok "Configured ElasticSearch"
-
-fetch_and_deploy_gh_release "tubearchivist" "tubearchivist/tubearchivist" "tarball"
-
-msg_info "Building Frontend"
-cd /opt/tubearchivist/frontend
-$STD npm install
-$STD npm run build:deploy
-mkdir -p /opt/tubearchivist/backend/static
-cp -r /opt/tubearchivist/frontend/dist/* /opt/tubearchivist/backend/static/
-msg_ok "Built Frontend"
-
-msg_info "Setting up Tube Archivist"
-cp /opt/tubearchivist/docker_assets/backend_start.py /opt/tubearchivist/backend/
-$STD uv venv /opt/tubearchivist/.venv
-$STD uv pip install --python /opt/tubearchivist/.venv/bin/python -r /opt/tubearchivist/backend/requirements.txt
-if [[ -f /opt/tubearchivist/backend/requirements.plugins.txt ]]; then
-  mkdir -p /opt/yt_plugins/bgutil
-  $STD uv pip install --python /opt/tubearchivist/.venv/bin/python --target /opt/yt_plugins/bgutil -r /opt/tubearchivist/backend/requirements.plugins.txt
-fi
-TA_PASSWORD=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
-ES_PASSWORD=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
-mkdir -p /opt/tubearchivist/{cache,media}
-ln -sf /opt/tubearchivist/cache /cache
-ln -sf /opt/tubearchivist/media /youtube
-cat <<EOF >/opt/tubearchivist/.env
-TA_HOST=http://${LOCAL_IP}:8000
-TA_USERNAME=admin
-TA_PASSWORD=${TA_PASSWORD}
-TA_BACKEND_PORT=8080
-TA_APP_DIR=/opt/tubearchivist/backend
-TA_CACHE_DIR=/cache
-TA_MEDIA_DIR=/youtube
-ES_SNAPSHOT_DIR=/var/lib/elasticsearch/snapshot
-ELASTIC_PASSWORD=${ES_PASSWORD}
-REDIS_CON=redis://localhost:6379
-ES_URL=http://localhost:9200
-TZ=UTC
-PYTHONUNBUFFERED=1
-YTDLP_PLUGIN_DIRS=/opt/yt_plugins
-EOF
-{
-  echo "Tube Archivist Credentials"
-  echo "=========================="
-  echo "Username: admin"
-  echo "Password: ${TA_PASSWORD}"
-  echo "Elasticsearch Password: ${ES_PASSWORD}"
-} >~/tubearchivist.creds
-systemctl enable -q --now redis-server
-msg_ok "Set up Tube Archivist"
-
-msg_info "Configuring Nginx"
-sed -i 's/^user www-data;$/user root;/' /etc/nginx/nginx.conf
-cat <<'EOF' >/etc/nginx/sites-available/default
-server {
-    listen 8000;
-
-    location = /_auth {
-        internal;
-        proxy_pass http://localhost:8080/api/ping/;
-        proxy_pass_request_body off;
-        proxy_set_header Content-Length "";
-        proxy_set_header Host $http_host;
-        proxy_set_header Cookie $http_cookie;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    }
-
-    location /cache/videos/ {
-        auth_request /_auth;
-        alias /cache/videos/;
-    }
-
-    location /cache/channels/ {
-        auth_request /_auth;
-        alias /cache/channels/;
-    }
-
-    location /cache/playlists/ {
-        auth_request /_auth;
-        alias /cache/playlists/;
-    }
-
-    location /media/ {
-        auth_request /_auth;
-        alias /youtube/;
-        types {
-            text/vtt vtt;
-        }
-    }
-
-    location /youtube/ {
-        auth_request /_auth;
-        alias /youtube/;
-        types {
-            video/mp4 mp4;
-        }
-    }
-
-    location /api {
-        include proxy_params;
-        proxy_pass http://localhost:8080;
-    }
-
-    location /admin {
-        include proxy_params;
-        proxy_pass http://localhost:8080;
-    }
-
-    location /static/ {
-        alias /opt/tubearchivist/backend/staticfiles/;
-    }
-
-    root /opt/tubearchivist/backend/static;
-    index index.html;
-
-    location ~* ^/(?!static/|cache/).*\.(?:css|js|png|jpg|jpeg|gif|ico|svg|woff2?)$ {
-        try_files $uri $uri/ /index.html =404;
-    }
-
-    location = /index.html {
-        add_header Cache-Control "no-store, no-cache, must-revalidate";
-        add_header Pragma "no-cache";
-        expires 0;
-    }
-
-    location / {
-        add_header Cache-Control "no-store, no-cache, must-revalidate";
-        add_header Pragma "no-cache";
-        expires 0;
-        try_files $uri $uri/ /index.html =404;
-    }
-}
-EOF
-systemctl enable -q nginx
-systemctl restart nginx
-msg_ok "Configured Nginx"
-
-msg_info "Creating Services"
-cat <<'RUNEOF' >/opt/tubearchivist/backend/run.sh
-#!/bin/bash
-set -e
-cd /opt/tubearchivist/backend
-set -a
-source /opt/tubearchivist/.env
-set +a
-PYTHON=/opt/tubearchivist/.venv/bin/python
-
-echo "Waiting for ElasticSearch..."
-for i in $(seq 1 30); do
-  if curl -sf http://localhost:9200/_cluster/health >/dev/null 2>&1; then
-    break
-  fi
-  sleep 2
-done
-
-$PYTHON manage.py migrate
-$PYTHON manage.py collectstatic --noinput -c
-$PYTHON manage.py ta_envcheck
-$PYTHON manage.py ta_connection
-$PYTHON manage.py ta_startup
-
-exec $PYTHON backend_start.py
-RUNEOF
-chmod +x /opt/tubearchivist/backend/run.sh
-ln -sf /opt/tubearchivist/.env /opt/tubearchivist/backend/.env
-cat <<EOF >/etc/systemd/system/tubearchivist.service
-[Unit]
-Description=Tube Archivist Backend
-After=network.target elasticsearch.service redis-server.service
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=/opt/tubearchivist/backend
-EnvironmentFile=/opt/tubearchivist/.env
-Environment=PATH=/opt/tubearchivist/.venv/bin:/usr/local/bin:/usr/bin:/bin
-ExecStart=/opt/tubearchivist/backend/run.sh
-Restart=on-failure
-RestartSec=10
-
-[Install]
-WantedBy=multi-user.target
-EOF
-cat <<EOF >/etc/systemd/system/tubearchivist-celery.service
-[Unit]
-Description=Tube Archivist Celery Worker
-After=tubearchivist.service redis-server.service elasticsearch.service
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=/opt/tubearchivist/backend
-EnvironmentFile=/opt/tubearchivist/.env
-Environment=PATH=/opt/tubearchivist/.venv/bin:/usr/local/bin:/usr/bin:/bin
-ExecStart=/opt/tubearchivist/.venv/bin/celery -A task worker --loglevel=error --concurrency=4 --max-tasks-per-child=5 --max-memory-per-child=150000
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-cat <<EOF >/etc/systemd/system/tubearchivist-beat.service
-[Unit]
-Description=Tube Archivist Celery Beat
-After=tubearchivist.service redis-server.service
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=/opt/tubearchivist/backend
-EnvironmentFile=/opt/tubearchivist/.env
-Environment=PATH=/opt/tubearchivist/.venv/bin:/usr/local/bin:/usr/bin:/bin
-ExecStartPre=/bin/bash -c 'for i in \$(seq 1 60); do sqlite3 /cache/db.sqlite3 "SELECT 1 FROM django_celery_beat_crontabschedule LIMIT 1" 2>/dev/null && exit 0; sleep 2; done; exit 1'
-ExecStart=/opt/tubearchivist/.venv/bin/celery -A task beat --loglevel=error --scheduler django_celery_beat.schedulers:DatabaseScheduler
-Restart=always
-RestartSec=5
-RuntimeMaxSec=3600
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now tubearchivist tubearchivist-celery tubearchivist-beat
-msg_ok "Created Services"
-
-motd_ssh
-customize
-cleanup_lxc

misc/build.func

@@ -3504,52 +3504,6 @@ msg_menu() {
   return 0
 }
 
-# ------------------------------------------------------------------------------
-# run_addon_updates()
-#
-# - Scans /usr/local/bin/update_* for addon update scripts installed alongside
-#   the main application (e.g. by tools/addon/*.sh)
-# - For each found addon, prompts the user (60s timeout, default no) whether
-#   it should be updated as well
-# - Skipped entirely when PHS_SILENT=1 to keep unattended updates predictable
-# ------------------------------------------------------------------------------
-run_addon_updates() {
-  shopt -s nullglob
-  local addons=(/usr/local/bin/update_*)
-  shopt -u nullglob
-
-  ((${#addons[@]} == 0)) && return 0
-
-  if [[ "${PHS_SILENT:-0}" == "1" ]]; then
-    msg_info "Detected ${#addons[@]} addon update script(s) - skipping (PHS_SILENT)"
-    return 0
-  fi
-
-  echo
-  echo -e "${INFO}${YW} Detected installed addon update script(s):${CL}"
-  local a name
-  for a in "${addons[@]}"; do
-    echo -e "${TAB}- ${a##*/update_}"
-  done
-  echo
-
-  local ans
-  for a in "${addons[@]}"; do
-    name="${a##*/update_}"
-    printf 'Do you also want to update addon "%s"? (y/N) [60s]: ' "$name"
-    ans=""
-    if read -r -t 60 ans; then :; else echo; fi
-    case "${ans,,}" in
-    y | yes)
-      bash "$a" || msg_warn "Addon update for $name failed (rc=$?)"
-      ;;
-    *)
-      msg_info "Skipped addon: $name"
-      ;;
-    esac
-  done
-}
-
 # ------------------------------------------------------------------------------
 # start()
 #
@@ -3569,7 +3523,6 @@ start() {
     ensure_profile_loaded
     get_lxc_ip
     update_script
-    run_addon_updates
     update_motd_ip
     cleanup_lxc
   else
@@ -3598,7 +3551,6 @@ start() {
     ensure_profile_loaded
     get_lxc_ip
     update_script
-    run_addon_updates
     update_motd_ip
     cleanup_lxc
   fi

misc/tools.func

@@ -8665,3 +8665,654 @@ EOF
   $STD apt update
   return 0
 }
+
+# ------------------------------------------------------------------------------
+# Get latest GitLab release version.
+# Usage: get_latest_gitlab_release "owner/repo" [strip_v]
+# ------------------------------------------------------------------------------
+get_latest_gitlab_release() {
+  local repo="$1"
+  local strip_v="${2:-true}"
+
+  local repo_encoded
+  repo_encoded=$(printf '%s' "$repo" | sed 's|/|%2F|g')
+
+  local header=()
+  [[ -n "${GITLAB_TOKEN:-}" ]] && header=(-H "PRIVATE-TOKEN: $GITLAB_TOKEN")
+
+  local temp_file
+  temp_file=$(mktemp)
+
+  local http_code
+  http_code=$(curl --connect-timeout 10 --max-time 30 -sSL \
+    -w "%{http_code}" -o "$temp_file" \
+    "${header[@]}" \
+    "https://gitlab.com/api/v4/projects/$repo_encoded/releases?per_page=1&order_by=released_at&sort=desc" 2>/dev/null) || true
+
+  if [[ "$http_code" != "200" ]]; then
+    rm -f "$temp_file"
+    msg_warn "GitLab API call failed for ${repo} (HTTP ${http_code})"
+    return 22
+  fi
+
+  local version
+  version=$(jq -r '.[0].tag_name // empty' "$temp_file")
+  rm -f "$temp_file"
+
+  if [[ -z "$version" ]]; then
+    msg_error "Could not determine latest version for ${repo}"
+    return 250
+  fi
+
+  if [[ "$strip_v" == "true" ]]; then
+    [[ "$version" =~ ^v[0-9] ]] && version="${version:1}"
+  fi
+
+  echo "$version"
+}
+
+# ------------------------------------------------------------------------------
+# Checks for new GitLab release (latest tag).
+#
+# Description:
+#   - Queries the GitLab API for the latest release tag
+#   - Compares it to a local cached version (~/.<app>)
+#   - If newer, sets global CHECK_UPDATE_RELEASE and returns 0
+#
+# Usage:
+#     if check_for_gl_release "myapp" "owner/repo" [optional] "v1.2.3"; then
+#       # trigger update...
+#     fi
+#     exit 0
+#     } (end of update_script not from the function)
+#
+# Notes:
+#   - Requires `jq` (auto-installed if missing)
+#   - Supports GITLAB_TOKEN env var for private/rate-limited repos
+#   - Does not modify anything, only checks version state
+# ------------------------------------------------------------------------------
+check_for_gl_release() {
+  local app="$1"
+  local source="$2"
+  local pinned_version_in="${3:-}" # optional
+  local pin_reason="${4:-}"        # optional reason shown to user
+  local app_lc="${app,,}"
+  local current_file="$HOME/.${app_lc}"
+
+  msg_info "Checking for update: ${app}"
+
+  # DNS check
+  if ! getent hosts gitlab.com >/dev/null 2>&1; then
+    msg_error "Network error: cannot resolve gitlab.com"
+    return 6
+  fi
+
+  ensure_dependencies jq
+
+  local repo_encoded
+  repo_encoded=$(printf '%s' "$repo" | sed 's|/|%2F|g')
+    echo "$source" | sed 's|/|%2F|g')
+
+  local header=()
+  [[ -n "${GITLAB_TOKEN:-}" ]] && header=(-H "PRIVATE-TOKEN: $GITLAB_TOKEN")
+
+  local releases_json="" http_code=""
+
+  # For pinned versions, try to fetch the specific release tag first
+  if [[ -n "$pinned_version_in" ]]; then
+    local pinned_encoded="${pinned_version_in//\//%2F}"
+    http_code=$(curl -sSL --max-time 20 -w "%{http_code}" -o /tmp/gl_check.json \
+      "${header[@]}" \
+      "https://gitlab.com/api/v4/projects/$repo_encoded/releases/$pinned_encoded" 2>/dev/null) || true
+    if [[ "$http_code" == "200" ]] && [[ -s /tmp/gl_check.json ]]; then
+      releases_json="[$(</tmp/gl_check.json)]"
+    fi
+    rm -f /tmp/gl_check.json
+  fi
+
+  # Fetch full releases list if needed
+  if [[ -z "$releases_json" ]]; then
+    http_code=$(curl -sSL --max-time 20 -w "%{http_code}" -o /tmp/gl_check.json \
+      "${header[@]}" \
+      "https://gitlab.com/api/v4/projects/$repo_encoded/releases?per_page=100&order_by=released_at&sort=desc" 2>/dev/null) || true
+
+    if [[ "$http_code" == "200" ]] && [[ -s /tmp/gl_check.json ]]; then
+      releases_json=$(</tmp/gl_check.json)
+    elif [[ "$http_code" == "401" ]]; then
+      msg_error "GitLab API authentication failed (HTTP 401)."
+      if [[ -n "${GITLAB_TOKEN:-}" ]]; then
+        msg_error "Your GITLAB_TOKEN appears to be invalid or expired."
+      else
+        msg_error "The repository may require authentication. Try: export GITLAB_TOKEN=\"glpat-your_token\""
+      fi
+      rm -f /tmp/gl_check.json
+      return 22
+    elif [[ "$http_code" == "404" ]]; then
+      msg_error "GitLab project not found (HTTP 404). Ensure '${source}' is correct and publicly accessible."
+      rm -f /tmp/gl_check.json
+      return 22
+    elif [[ "$http_code" == "429" ]]; then
+      msg_error "GitLab API rate limit exceeded (HTTP 429)."
+      msg_error "To increase the limit, export a GitLab token: export GITLAB_TOKEN=\"glpat-your_token_here\""
+      rm -f /tmp/gl_check.json
+      return 22
+    elif [[ "$http_code" == "000" || -z "$http_code" ]]; then
+      msg_error "GitLab API connection failed (no response)."
+      msg_error "Check your network/DNS: curl -sSL https://gitlab.com/api/v4/version"
+      rm -f /tmp/gl_check.json
+      return 7
+    else
+      msg_error "Unable to fetch releases for ${app} (HTTP ${http_code})"
+      rm -f /tmp/gl_check.json
+      return 22
+    fi
+    rm -f /tmp/gl_check.json
+  fi
+
+  mapfile -t raw_tags < <(jq -r '.[] | .tag_name' <<<"$releases_json")
+  if ((${#raw_tags[@]} == 0)); then
+    msg_error "No releases found for ${app} on GitLab"
+    return 250
+  fi
+
+  local clean_tags=()
+  for t in "${raw_tags[@]}"; do
+    # Only strip leading 'v' when followed by a digit (e.g. v1.2.3)
+    if [[ "$t" =~ ^v[0-9] ]]; then
+      clean_tags+=("${t:1}")
+    else
+      clean_tags+=("$t")
+    fi
+  done
+
+  local latest_raw="${raw_tags[0]}"
+  local latest_clean="${clean_tags[0]}"
+
+  # current installed (stored without v)
+  local current=""
+  if [[ -f "$current_file" ]]; then
+    current="$(<"$current_file")"
+  else
+    # Migration: search for any /opt/*_version.txt
+    local legacy_files
+    mapfile -t legacy_files < <(find /opt -maxdepth 1 -type f -name "*_version.txt" 2>/dev/null)
+    if ((${#legacy_files[@]} == 1)); then
+      current="$(<"${legacy_files[0]}")"
+      echo "${current#v}" >"$current_file"
+      rm -f "${legacy_files[0]}"
+    fi
+  fi
+  if [[ "$current" =~ ^v[0-9] ]]; then
+    current="${current:1}"
+  fi
+
+  # Pinned version handling
+  if [[ -n "$pinned_version_in" ]]; then
+    local pin_clean
+    if [[ "$pinned_version_in" =~ ^v[0-9] ]]; then
+      pin_clean="${pinned_version_in:1}"
+    else
+      pin_clean="$pinned_version_in"
+    fi
+    local match_raw=""
+    for i in "${!clean_tags[@]}"; do
+      if [[ "${clean_tags[$i]}" == "$pin_clean" ]]; then
+        match_raw="${raw_tags[$i]}"
+        break
+      fi
+    done
+
+    if [[ -z "$match_raw" ]]; then
+      msg_error "Pinned version ${pinned_version_in} not found upstream"
+      return 250
+    fi
+
+    if [[ "$current" != "$pin_clean" ]]; then
+      CHECK_UPDATE_RELEASE="$match_raw"
+      msg_ok "Update available: ${app} ${current:-not installed} → ${pin_clean}"
+      return 0
+    fi
+
+    if [[ -n "$pin_reason" ]]; then
+      msg_ok "No update available: ${app} (${current}) - update held back: ${pin_reason}"
+    else
+      msg_ok "No update available: ${app} (${current}) - update temporarily held back due to issues with newer releases"
+    fi
+    return 1
+  fi
+
+  # No pinning → use latest
+  if [[ -z "$current" || "$current" != "$latest_clean" ]]; then
+    CHECK_UPDATE_RELEASE="$latest_raw"
+    msg_ok "Update available: ${app} ${current:-not installed} → ${latest_clean}"
+    return 0
+  fi
+
+  msg_ok "No update available: ${app} (${latest_clean})"
+  return 1
+}
+
+function fetch_and_deploy_gl_release() {
+  local app="$1"
+  local repo="$2"
+  local mode="${3:-tarball}"
+  local version="${var_appversion:-${4:-latest}}"
+  local target="${5:-/opt/$app}"
+  local asset_pattern="${6:-}"
+
+  if [[ -z "$app" ]]; then
+    app="${repo##*/}"
+    if [[ -z "$app" ]]; then
+      msg_error "fetch_and_deploy_gl_release requires app name or valid repo"
+      return 1
+    fi
+  fi
+
+  local app_lc=$(echo "${app,,}" | tr -d ' ')
+  local version_file="$HOME/.${app_lc}"
+
+  local api_timeout="--connect-timeout 10 --max-time 60"
+  local download_timeout="--connect-timeout 15 --max-time 900"
+
+  local current_version=""
+  [[ -f "$version_file" ]] && current_version=$(<"$version_file")
+
+  ensure_dependencies jq
+
+  local repo_encoded
+  repo_encoded=$(printf '%s' "$repo" | sed 's|/|%2F|g')
+    echo "$repo" | sed 's|/|%2F|g')
+
+  local api_base="https://gitlab.com/api/v4/projects/$repo_encoded/releases"
+  local api_url
+  if [[ "$version" != "latest" ]]; then
+    api_url="$api_base/$version"
+  else
+    api_url="$api_base?per_page=1&order_by=released_at&sort=desc"
+  fi
+
+  local header=()
+  [[ -n "${GITLAB_TOKEN:-}" ]] && header=(-H "PRIVATE-TOKEN: $GITLAB_TOKEN")
+
+  local max_retries=3 retry_delay=2 attempt=1 success=false http_code
+
+  while ((attempt <= max_retries)); do
+    http_code=$(curl $api_timeout -sSL -w "%{http_code}" -o /tmp/gl_rel.json "${header[@]}" "$api_url" 2>/dev/null) || true
+    if [[ "$http_code" == "200" ]]; then
+      success=true
+      break
+    elif [[ "$http_code" == "429" ]]; then
+      if ((attempt < max_retries)); then
+        msg_warn "GitLab API rate limit hit, retrying in ${retry_delay}s... (attempt $attempt/$max_retries)"
+        sleep "$retry_delay"
+        retry_delay=$((retry_delay * 2))
+      fi
+    else
+      sleep "$retry_delay"
+    fi
+    ((attempt++))
+  done
+
+  if ! $success; then
+    if [[ "$http_code" == "401" ]]; then
+      msg_error "GitLab API authentication failed (HTTP 401)."
+      if [[ -n "${GITLAB_TOKEN:-}" ]]; then
+        msg_error "Your GITLAB_TOKEN appears to be invalid or expired."
+      else
+        msg_error "The repository may require authentication. Try: export GITLAB_TOKEN=\"glpat-your_token\""
+      fi
+    elif [[ "$http_code" == "404" ]]; then
+      msg_error "GitLab project or release not found (HTTP 404)."
+      msg_error "Ensure '$repo' is correct and the project is accessible."
+    elif [[ "$http_code" == "429" ]]; then
+      msg_error "GitLab API rate limit exceeded (HTTP 429)."
+      msg_error "To increase the limit, export a GitLab token before running the script:"
+      msg_error "  export GITLAB_TOKEN=\"glpat-your_token_here\""
+    elif [[ "$http_code" == "000" || -z "$http_code" ]]; then
+      msg_error "GitLab API connection failed (no response)."
+      msg_error "Check your network/DNS: curl -sSL https://gitlab.com/api/v4/version"
+    else
+      msg_error "Failed to fetch release metadata (HTTP $http_code)"
+    fi
+    return 1
+  fi
+
+  local json tag_name
+  json=$(</tmp/gl_rel.json)
+
+  if [[ "$version" == "latest" ]]; then
+    json=$(echo "$json" | jq '.[0] // empty')
+    if [[ -z "$json" || "$json" == "null" ]]; then
+      msg_error "No releases found for $repo on GitLab"
+      return 1
+    fi
+  fi
+
+  tag_name=$(echo "$json" | jq -r '.tag_name // empty')
+  if [[ -z "$tag_name" ]]; then
+    msg_error "Could not determine tag name from release metadata"
+    return 1
+  fi
+  [[ "$tag_name" =~ ^v[0-9] ]] && version="${tag_name:1}" || version="$tag_name"
+  local version_safe="${version//\//-}"
+
+  if [[ "$current_version" == "$version" ]]; then
+    $STD msg_ok "$app is already up-to-date (v$version)"
+    return 0
+  fi
+
+  local tmpdir
+  tmpdir=$(mktemp -d) || return 1
+  local filename=""
+
+  msg_info "Fetching GitLab release: $app ($version)"
+
+  _gl_asset_urls() {
+    local release_json="$1"
+    echo "$release_json" | jq -r '
+      (.assets.links // [])[] | .direct_asset_url // .url
+    '
+  }
+
+  ### Tarball Mode ###
+  if [[ "$mode" == "tarball" || "$mode" == "source" ]]; then
+    local direct_tarball_url="https://gitlab.com/$repo/-/archive/$tag_name/${app_lc}-${version_safe}.tar.gz"
+    filename="${app_lc}-${version_safe}.tar.gz"
+
+    curl $download_timeout -fsSL "${header[@]}" -o "$tmpdir/$filename" "$direct_tarball_url" || {
+      msg_error "Download failed: $direct_tarball_url"
+      rm -rf "$tmpdir"
+      return 1
+    }
+
+    mkdir -p "$target"
+    if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
+      rm -rf "${target:?}/"*
+    fi
+
+    tar --no-same-owner -xzf "$tmpdir/$filename" -C "$tmpdir" || {
+      msg_error "Failed to extract tarball"
+      rm -rf "$tmpdir"
+      return 1
+    }
+    local unpack_dir
+    unpack_dir=$(find "$tmpdir" -mindepth 1 -maxdepth 1 -type d | head -n1)
+
+    shopt -s dotglob nullglob
+    cp -r "$unpack_dir"/* "$target/"
+    shopt -u dotglob nullglob
+
+  ### Binary Mode ###
+  elif [[ "$mode" == "binary" ]]; then
+    local arch
+    arch=$(dpkg --print-architecture 2>/dev/null || uname -m)
+    [[ "$arch" == "x86_64" ]] && arch="amd64"
+    [[ "$arch" == "aarch64" ]] && arch="arm64"
+
+    local assets url_match=""
+    assets=$(_gl_asset_urls "$json")
+
+    if [[ -n "$asset_pattern" ]]; then
+      for u in $assets; do
+        case "${u##*/}" in
+        $asset_pattern)
+          url_match="$u"
+          break
+          ;;
+        esac
+      done
+    fi
+
+    if [[ -z "$url_match" ]]; then
+      for u in $assets; do
+        if [[ "$u" =~ ($arch|amd64|x86_64|aarch64|arm64).*\.deb$ ]]; then
+          url_match="$u"
+          break
+        fi
+      done
+    fi
+
+    if [[ -z "$url_match" ]]; then
+      for u in $assets; do
+        [[ "$u" =~ \.deb$ ]] && url_match="$u" && break
+      done
+    fi
+
+    if [[ -z "$url_match" ]]; then
+      local fallback_json
+      if fallback_json=$(_gl_scan_older_releases "$repo" "$repo_encoded" "https://gitlab.com" "binary" "$asset_pattern" "$tag_name"); then
+        json="$fallback_json"
+        tag_name=$(echo "$json" | jq -r '.tag_name // empty')
+        [[ "$tag_name" =~ ^v[0-9] ]] && version="${tag_name:1}" || version="$tag_name"
+        msg_info "Fetching GitLab release: $app ($version)"
+        assets=$(_gl_asset_urls "$json")
+        if [[ -n "$asset_pattern" ]]; then
+          for u in $assets; do
+            case "${u##*/}" in $asset_pattern)
+              url_match="$u"
+              break
+              ;;
+            esac
+          done
+        fi
+        if [[ -z "$url_match" ]]; then
+          for u in $assets; do
+            [[ "$u" =~ ($arch|amd64|x86_64|aarch64|arm64).*\.deb$ ]] && url_match="$u" && break
+          done
+        fi
+        if [[ -z "$url_match" ]]; then
+          for u in $assets; do
+            [[ "$u" =~ \.deb$ ]] && url_match="$u" && break
+          done
+        fi
+      fi
+    fi
+
+    if [[ -z "$url_match" ]]; then
+      msg_error "No suitable .deb asset found for $app"
+      rm -rf "$tmpdir"
+      return 1
+    fi
+
+    filename="${url_match##*/}"
+    curl $download_timeout -fsSL "${header[@]}" -o "$tmpdir/$filename" "$url_match" || {
+      msg_error "Download failed: $url_match"
+      rm -rf "$tmpdir"
+      return 1
+    }
+
+    chmod 644 "$tmpdir/$filename"
+    local dpkg_opts=""
+    [[ "${DPKG_FORCE_CONFOLD:-}" == "1" ]] && dpkg_opts="-o Dpkg::Options::=--force-confold"
+    [[ "${DPKG_FORCE_CONFNEW:-}" == "1" ]] && dpkg_opts="-o Dpkg::Options::=--force-confnew"
+    DEBIAN_FRONTEND=noninteractive SYSTEMD_OFFLINE=1 $STD apt install -y $dpkg_opts "$tmpdir/$filename" || {
+      SYSTEMD_OFFLINE=1 $STD dpkg -i "$tmpdir/$filename" || {
+        msg_error "Both apt and dpkg installation failed"
+        rm -rf "$tmpdir"
+        return 1
+      }
+    }
+
+  ### Prebuild Mode ###
+  elif [[ "$mode" == "prebuild" ]]; then
+    local pattern="${6%\"}"
+    pattern="${pattern#\"}"
+    [[ -z "$pattern" ]] && {
+      msg_error "Mode 'prebuild' requires 6th parameter (asset filename pattern)"
+      rm -rf "$tmpdir"
+      return 1
+    }
+
+    local asset_url=""
+    for u in $(_gl_asset_urls "$json"); do
+      filename_candidate="${u##*/}"
+      case "$filename_candidate" in
+      $pattern)
+        asset_url="$u"
+        break
+        ;;
+      esac
+    done
+
+    if [[ -z "$asset_url" ]]; then
+      local fallback_json
+      if fallback_json=$(_gl_scan_older_releases "$repo" "$repo_encoded" "https://gitlab.com" "prebuild" "$pattern" "$tag_name"); then
+        json="$fallback_json"
+        tag_name=$(echo "$json" | jq -r '.tag_name // empty')
+        [[ "$tag_name" =~ ^v[0-9] ]] && version="${tag_name:1}" || version="$tag_name"
+        msg_info "Fetching GitLab release: $app ($version)"
+        for u in $(_gl_asset_urls "$json"); do
+          filename_candidate="${u##*/}"
+          case "$filename_candidate" in $pattern)
+            asset_url="$u"
+            break
+            ;;
+          esac
+        done
+      fi
+    fi
+
+    [[ -z "$asset_url" ]] && {
+      msg_error "No asset matching '$pattern' found"
+      rm -rf "$tmpdir"
+      return 1
+    }
+
+    filename="${asset_url##*/}"
+    curl $download_timeout -fsSL "${header[@]}" -o "$tmpdir/$filename" "$asset_url" || {
+      msg_error "Download failed: $asset_url"
+      rm -rf "$tmpdir"
+      return 1
+    }
+
+    local unpack_tmp
+    unpack_tmp=$(mktemp -d)
+    mkdir -p "$target"
+    if [[ "${CLEAN_INSTALL:-0}" == "1" ]]; then
+      rm -rf "${target:?}/"*
+    fi
+
+    if [[ "$filename" == *.zip ]]; then
+      ensure_dependencies unzip
+      unzip -q "$tmpdir/$filename" -d "$unpack_tmp" || {
+        msg_error "Failed to extract ZIP archive"
+        rm -rf "$tmpdir" "$unpack_tmp"
+        return 1
+      }
+    elif [[ "$filename" == *.tar.* || "$filename" == *.tgz || "$filename" == *.txz ]]; then
+      tar --no-same-owner -xf "$tmpdir/$filename" -C "$unpack_tmp" || {
+        msg_error "Failed to extract TAR archive"
+        rm -rf "$tmpdir" "$unpack_tmp"
+        return 1
+      }
+    else
+      msg_error "Unsupported archive format: $filename"
+      rm -rf "$tmpdir" "$unpack_tmp"
+      return 1
+    fi
+
+    local top_entries inner_dir
+    top_entries=$(find "$unpack_tmp" -mindepth 1 -maxdepth 1)
+    if [[ "$(echo "$top_entries" | wc -l)" -eq 1 && -d "$top_entries" ]]; then
+      inner_dir="$top_entries"
+      shopt -s dotglob nullglob
+      if compgen -G "$inner_dir/*" >/dev/null; then
+        cp -r "$inner_dir"/* "$target/" || {
+          msg_error "Failed to copy contents from $inner_dir to $target"
+          rm -rf "$tmpdir" "$unpack_tmp"
+          return 1
+        }
+      else
+        msg_error "Inner directory is empty: $inner_dir"
+        rm -rf "$tmpdir" "$unpack_tmp"
+        return 1
+      fi
+      shopt -u dotglob nullglob
+    else
+      shopt -s dotglob nullglob
+      if compgen -G "$unpack_tmp/*" >/dev/null; then
+        cp -r "$unpack_tmp"/* "$target/" || {
+          msg_error "Failed to copy contents to $target"
+          rm -rf "$tmpdir" "$unpack_tmp"
+          return 1
+        }
+      else
+        msg_error "Unpacked archive is empty"
+        rm -rf "$tmpdir" "$unpack_tmp"
+        return 1
+      fi
+      shopt -u dotglob nullglob
+    fi
+
+  ### Singlefile Mode ###
+  elif [[ "$mode" == "singlefile" ]]; then
+    local pattern="${6%\"}"
+    pattern="${pattern#\"}"
+    [[ -z "$pattern" ]] && {
+      msg_error "Mode 'singlefile' requires 6th parameter (asset filename pattern)"
+      rm -rf "$tmpdir"
+      return 1
+    }
+
+    local asset_url=""
+    for u in $(_gl_asset_urls "$json"); do
+      filename_candidate="${u##*/}"
+      case "$filename_candidate" in
+      $pattern)
+        asset_url="$u"
+        break
+        ;;
+      esac
+    done
+
+    if [[ -z "$asset_url" ]]; then
+      local fallback_json
+      if fallback_json=$(_gl_scan_older_releases "$repo" "$repo_encoded" "https://gitlab.com" "singlefile" "$pattern" "$tag_name"); then
+        json="$fallback_json"
+        tag_name=$(echo "$json" | jq -r '.tag_name // empty')
+        [[ "$tag_name" =~ ^v[0-9] ]] && version="${tag_name:1}" || version="$tag_name"
+        msg_info "Fetching GitLab release: $app ($version)"
+        for u in $(_gl_asset_urls "$json"); do
+          filename_candidate="${u##*/}"
+          case "$filename_candidate" in $pattern)
+            asset_url="$u"
+            break
+            ;;
+          esac
+        done
+      fi
+    fi
+
+    [[ -z "$asset_url" ]] && {
+      msg_error "No asset matching '$pattern' found"
+      rm -rf "$tmpdir"
+      return 1
+    }
+
+    filename="${asset_url##*/}"
+    mkdir -p "$target"
+
+    local use_filename="${USE_ORIGINAL_FILENAME:-false}"
+    local target_file="$app"
+    [[ "$use_filename" == "true" ]] && target_file="$filename"
+
+    curl $download_timeout -fsSL "${header[@]}" -o "$target/$target_file" "$asset_url" || {
+      msg_error "Download failed: $asset_url"
+      rm -rf "$tmpdir"
+      return 1
+    }
+
+    if [[ "$target_file" != *.jar && -f "$target/$target_file" ]]; then
+      chmod +x "$target/$target_file"
+    fi
+
+  else
+    msg_error "Unknown mode: $mode"
+    rm -rf "$tmpdir"
+    return 1
+  fi
+
+  echo "$version" >"$version_file"
+  msg_ok "Deployed: $app ($version)"
+  rm -rf "$tmpdir"
+}

tools/addon/komodo.sh

@@ -151,23 +151,6 @@ function check_proxmox_host() {
 # ==============================================================================
 # CHECK / INSTALL DOCKER
 # ==============================================================================
-function ensure_openssl() {
-  if command -v openssl &>/dev/null; then
-    return
-  fi
-  msg_info "Installing openssl"
-  if [[ -f /etc/alpine-release ]]; then
-    $STD apk add openssl
-  elif command -v apt-get &>/dev/null; then
-    $STD apt-get update
-    $STD apt-get install -y openssl
-  else
-    msg_error "openssl is required but could not be installed automatically."
-    exit 10
-  fi
-  msg_ok "Installed openssl"
-}
-
 function check_or_install_docker() {
   if command -v docker &>/dev/null; then
     msg_ok "Docker $(docker --version | cut -d' ' -f3 | tr -d ',') is available"
@@ -177,7 +160,6 @@ function check_or_install_docker() {
       msg_error "Docker Compose plugin is not available. Please install it."
       exit 10
     fi
-    ensure_openssl
     return
   fi
 
@@ -201,8 +183,6 @@ function check_or_install_docker() {
     $STD sh <(curl -fsSL https://get.docker.com)
   fi
   msg_ok "Installed Docker"
-
-  ensure_openssl
 }
 
 # ==============================================================================

vm/opnsense-vm.sh

@@ -738,24 +738,7 @@ done
 msg_info "Creating a OPNsense VM"
 qm create $VMID -agent 1${MACHINE} -tablet 0 -localtime 1 -bios ovmf${CPU_TYPE} -cores $CORE_COUNT -memory $RAM_SIZE \
   -name $HN -tags community-script -net0 virtio,bridge=$BRG,macaddr=$MAC$VLAN$MTU -onboot 1 -ostype l26 -scsihw virtio-scsi-pci
-
+pvesm alloc $STORAGE $VMID $DISK0 4M &>/dev/null
-# Retry pvesm alloc on transient zfs_request "got timeout" errors (#14127)
-alloc_attempt=1
-alloc_max=4
-alloc_delay=5
-while :; do
-  alloc_err=$(pvesm alloc $STORAGE $VMID $DISK0 4M 2>&1 >/dev/null) && break
-  if [[ "$alloc_err" == *"got timeout"* && $alloc_attempt -lt $alloc_max ]]; then
-    msg_warn "pvesm alloc hit zfs timeout (attempt $alloc_attempt/$alloc_max), retrying in ${alloc_delay}s..."
-    pvesm free "${DISK0_REF}" &>/dev/null || true
-    sleep "$alloc_delay"
-    alloc_attempt=$((alloc_attempt + 1))
-    alloc_delay=$((alloc_delay * 2))
-    continue
-  fi
-  echo -e "$alloc_err" >&2
-  exit 220
-done
 qm importdisk $VMID ${FILE} $STORAGE ${DISK_IMPORT:-} &>/dev/null
 qm set $VMID \
   -efidisk0 ${DISK0_REF}${FORMAT} \