fix(tools.func): upgrade Node.js minor/patch on same major version

In setup_nodejs() Scenario 1 (major version already matches), only npm was refreshed - apt never upgraded the nodejs package itself. This left existing LXCs stuck on older minor releases (e.g. 22.13.1) even though NodeSource ships newer ones (e.g. 22.19+). Fix: add pt-get install -y --only-upgrade nodejs before the npm pin so the latest minor/patch from the already-configured NodeSource repo is always installed. Fixes: seerr update failing with ERR_PNPM_UNSUPPORTED_ENGINE because seerr 3.2.0 requires Node >=22.19.0 but installed was v22.13.1 (#13955)
2026-04-28 13:20:40 +00:00 · 2026-04-23 12:14:25 +02:00
59 changed files with 437 additions and 1995 deletions
@@ -1,143 +1,3 @@
-## 2026-04-25
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - VictoriaMetrics: Stop vmagent/vmalert before update [@irishpadres](https://github.com/irishpadres) ([#14016](https://github.com/community-scripts/ProxmoxVE/pull/14016))
-    - Domain-Monitor: start apache2 after stop instead of reload [@omertahaoztop](https://github.com/omertahaoztop) ([#14019](https://github.com/community-scripts/ProxmoxVE/pull/14019))
-    - Transmute: Fix ffmpeg detection [@tremor021](https://github.com/tremor021) ([#14008](https://github.com/community-scripts/ProxmoxVE/pull/14008))
-
-  - #### 🔧 Refactor
-
-    - Refactor: Technitium DNS [@tremor021](https://github.com/tremor021) ([#14013](https://github.com/community-scripts/ProxmoxVE/pull/14013))
-
-## 2026-04-24
-
-### 🆕 New Scripts
-
-  - Apprise-API ([#13934](https://github.com/community-scripts/ProxmoxVE/pull/13934))
- fireshare ([#13995](https://github.com/community-scripts/ProxmoxVE/pull/13995))
- Transmute ([#13935](https://github.com/community-scripts/ProxmoxVE/pull/13935))
- Jitsi-Meet ([#13897](https://github.com/community-scripts/ProxmoxVE/pull/13897))
-
-### 🚀 Updated Scripts
-
-  - Update wger.sh [@Soppster1029](https://github.com/Soppster1029) ([#13977](https://github.com/community-scripts/ProxmoxVE/pull/13977))
-
-  - #### 🔧 Refactor
-
-    - Refactor: Ghostfolio [@MickLesk](https://github.com/MickLesk) ([#13990](https://github.com/community-scripts/ProxmoxVE/pull/13990))
-
-## 2026-04-23
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - mealie: start.sh missing after failed update [@MickLesk](https://github.com/MickLesk) ([#13958](https://github.com/community-scripts/ProxmoxVE/pull/13958))
-    - twingate-connector: perform real apt upgrade during update flow [@MickLesk](https://github.com/MickLesk) ([#13959](https://github.com/community-scripts/ProxmoxVE/pull/13959))
-
-  - #### ✨ New Features
-
-    - core: auto-size NODE_OPTIONS heap [@MickLesk](https://github.com/MickLesk) ([#13960](https://github.com/community-scripts/ProxmoxVE/pull/13960))
-
-  - #### 🔧 Refactor
-
-    - Update scripts to match standard [@tremor021](https://github.com/tremor021) ([#13956](https://github.com/community-scripts/ProxmoxVE/pull/13956))
-
-### 💾 Core
-
-  - #### 🐞 Bug Fixes
-
-    - tools.func: upgrade Node.js minor/patch on same major version [@MickLesk](https://github.com/MickLesk) ([#13957](https://github.com/community-scripts/ProxmoxVE/pull/13957))
-    - core: hotfix - prefer silent mode on PHS env conflict [@MickLesk](https://github.com/MickLesk) ([#13951](https://github.com/community-scripts/ProxmoxVE/pull/13951))
-
-  - #### 🔧 Refactor
-
-    - core: improve system update information / lxc stack upgrade [@MickLesk](https://github.com/MickLesk) ([#13970](https://github.com/community-scripts/ProxmoxVE/pull/13970))
-
-## 2026-04-22
-
-### 🆕 New Scripts
-
-  - Dashy ([#13817](https://github.com/community-scripts/ProxmoxVE/pull/13817))
- Mini-QR ([#13902](https://github.com/community-scripts/ProxmoxVE/pull/13902))
- ownfoil ([#13904](https://github.com/community-scripts/ProxmoxVE/pull/13904))
- ERPNext ([#13921](https://github.com/community-scripts/ProxmoxVE/pull/13921))
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - add --clear to uv venv in update_script() to prevent interactive prompt [@MickLesk](https://github.com/MickLesk) ([#13926](https://github.com/community-scripts/ProxmoxVE/pull/13926))
-
-### 💾 Core
-
-  - #### ✨ New Features
-
-    - core: Add PHS_VERBOSE env var to skip verbose mode prompts [@gormanity](https://github.com/gormanity) ([#13797](https://github.com/community-scripts/ProxmoxVE/pull/13797))
-
-## 2026-04-21
-
-### 🆕 New Scripts
-
-  - gogs ([#13896](https://github.com/community-scripts/ProxmoxVE/pull/13896))
- anchor ([#13895](https://github.com/community-scripts/ProxmoxVE/pull/13895))
- minthcm ([#13903](https://github.com/community-scripts/ProxmoxVE/pull/13903))
- foldergram ([#13900](https://github.com/community-scripts/ProxmoxVE/pull/13900))
-
-### 🚀 Updated Scripts
-
-  - OpenCloud: Pin version to 6.1.0 [@vhsdream](https://github.com/vhsdream) ([#13890](https://github.com/community-scripts/ProxmoxVE/pull/13890))
-
-  - #### 🐞 Bug Fixes
-
-    - Domain-Locker: Update dependencies [@tremor021](https://github.com/tremor021) ([#13901](https://github.com/community-scripts/ProxmoxVE/pull/13901))
-    - homelable: fix install failure by correcting password-reset chmod target [@Copilot](https://github.com/Copilot) ([#13894](https://github.com/community-scripts/ProxmoxVE/pull/13894))
-
-  - #### ✨ New Features
-
-    - FileFlows: Update dependencies [@tremor021](https://github.com/tremor021) ([#13917](https://github.com/community-scripts/ProxmoxVE/pull/13917))
-
-## 2026-04-20
-
-### 🆕 New Scripts
-
-  - WhoDB ([#13880](https://github.com/community-scripts/ProxmoxVE/pull/13880))
-
-### 🚀 Updated Scripts
-
-  - pangolin: create migration tables before data transfer to prevent role loss [@MickLesk](https://github.com/MickLesk) ([#13874](https://github.com/community-scripts/ProxmoxVE/pull/13874))
-
-  - #### 🐞 Bug Fixes
-
-    - Pangolin: pre-apply schema migrations to prevent data loss [@MickLesk](https://github.com/MickLesk) ([#13861](https://github.com/community-scripts/ProxmoxVE/pull/13861))
-    - ActualBudget: change migration messages to warnings [@MickLesk](https://github.com/MickLesk) ([#13860](https://github.com/community-scripts/ProxmoxVE/pull/13860))
-    - slskd: migrate config keys for 0.25.0 breaking change [@MickLesk](https://github.com/MickLesk) ([#13862](https://github.com/community-scripts/ProxmoxVE/pull/13862))
-
-  - #### ✨ New Features
-
-    - Wanderer: add pocketbase CLI wrapper with env [@MickLesk](https://github.com/MickLesk) ([#13863](https://github.com/community-scripts/ProxmoxVE/pull/13863))
-    - feat(homelable): add password reset utility script [@davidsoncabista](https://github.com/davidsoncabista) ([#13798](https://github.com/community-scripts/ProxmoxVE/pull/13798))
-
-  - #### 🔧 Refactor
-
-    - Several Scripts: Bump NodeJS to align Node.js versions with upstream for 5 scripts [@MickLesk](https://github.com/MickLesk) ([#13875](https://github.com/community-scripts/ProxmoxVE/pull/13875))
-    - Refactor: PMG Post Install [@MickLesk](https://github.com/MickLesk) ([#13693](https://github.com/community-scripts/ProxmoxVE/pull/13693))
-
-### 💾 Core
-
-  - #### 🐞 Bug Fixes
-
-    - core: detect Perl breakage after LXC stack upgrade and improve storage validation [@MickLesk](https://github.com/MickLesk) ([#13879](https://github.com/community-scripts/ProxmoxVE/pull/13879))
-
-## 2026-04-19
-
-### 🆕 New Scripts
-
-  - nametag ([#13849](https://github.com/community-scripts/ProxmoxVE/pull/13849))
-
 ## 2026-04-18

 ### 🆕 New Scripts
@@ -7,7 +7,7 @@ on:
 permissions:
  issues: write
  pull-requests: write
-  contents: write
+  contents: read

 jobs:
  pocketbase-bot:
@@ -95,149 +95,6 @@ jobs:
              return request('https://api.github.com' + path, { method: method || 'GET', headers, body: bodyStr });
            }

-            function encodeContentPath(filePath) {
-              return filePath.split('/').map(encodeURIComponent).join('/');
-            }
-
-            function decodeGitHubContent(content) {
-              return Buffer.from((content || '').replace(/\n/g, ''), 'base64').toString('utf8');
-            }
-
-            function sanitizeBranchPart(value) {
-              return (value || '')
-                .toLowerCase()
-                .replace(/[^a-z0-9._/-]+/g, '-')
-                .replace(/\/+/g, '/')
-                .replace(/^-+|-+$/g, '');
-            }
-
-            function applyCtDefaultChanges(scriptText, varChanges) {
-              let nextText = scriptText;
-              const updatedVars = [];
-              const unchangedVars = [];
-              for (const [varName, rawValue] of Object.entries(varChanges)) {
-                const newValue = String(rawValue);
-                const pattern = new RegExp('(^\\s*' + varName + '="\\$\\{' + varName + ':-)([^"}]*)(\\}"\\s*$)', 'm');
-                const match = nextText.match(pattern);
-                if (!match) continue;
-                if (match[2] === newValue) {
-                  unchangedVars.push(varName);
-                  continue;
-                }
-                nextText = nextText.replace(pattern, '$1' + newValue + '$3');
-                updatedVars.push(varName);
-              }
-              return { nextText, updatedVars, unchangedVars };
-            }
-
-            async function ensureBranch(defaultBranch, branchName) {
-              const branchRefRes = await ghRequest('/repos/' + owner + '/' + repo + '/git/ref/heads/' + encodeURIComponent(branchName));
-              if (branchRefRes.ok) return;
-
-              const defaultRefRes = await ghRequest('/repos/' + owner + '/' + repo + '/git/ref/heads/' + encodeURIComponent(defaultBranch));
-              if (!defaultRefRes.ok) {
-                throw new Error('Could not read default branch ref: ' + defaultRefRes.body);
-              }
-              const defaultRef = JSON.parse(defaultRefRes.body);
-              const createBranchRes = await ghRequest('/repos/' + owner + '/' + repo + '/git/refs', 'POST', {
-                ref: 'refs/heads/' + branchName,
-                sha: defaultRef.object.sha
-              });
-              if (!createBranchRes.ok) {
-                throw new Error('Could not create branch: ' + createBranchRes.body);
-              }
-            }
-
-            async function upsertCtDefaultsPr(slugValue, varChanges) {
-              const wantedEntries = Object.entries(varChanges || {}).filter(function ([, v]) {
-                return v !== undefined && v !== null && String(v) !== '';
-              });
-              if (wantedEntries.length === 0) {
-                return { status: 'skipped', reason: 'No mapped CT defaults changed.' };
-              }
-
-              const repoRes = await ghRequest('/repos/' + owner + '/' + repo);
-              if (!repoRes.ok) {
-                throw new Error('Could not read repository metadata: ' + repoRes.body);
-              }
-              const repoInfo = JSON.parse(repoRes.body);
-              const defaultBranch = repoInfo.default_branch;
-
-              const ctPath = 'ct/' + slugValue + '.sh';
-              const encodedCtPath = encodeContentPath(ctPath);
-              const defaultFileRes = await ghRequest('/repos/' + owner + '/' + repo + '/contents/' + encodedCtPath + '?ref=' + encodeURIComponent(defaultBranch));
-              if (defaultFileRes.statusCode === 404) {
-                return { status: 'skipped', reason: 'No matching CT file found at `' + ctPath + '`.' };
-              }
-              if (!defaultFileRes.ok) {
-                throw new Error('Could not read CT file from default branch: ' + defaultFileRes.body);
-              }
-
-              const branchName = 'pocketbase-sync/' + sanitizeBranchPart(slugValue || 'unknown');
-              await ensureBranch(defaultBranch, branchName);
-
-              const branchFileRes = await ghRequest('/repos/' + owner + '/' + repo + '/contents/' + encodedCtPath + '?ref=' + encodeURIComponent(branchName));
-              if (!branchFileRes.ok) {
-                throw new Error('Could not read CT file from sync branch: ' + branchFileRes.body);
-              }
-              const branchFile = JSON.parse(branchFileRes.body);
-              const currentBranchText = decodeGitHubContent(branchFile.content);
-
-              const updateResult = applyCtDefaultChanges(currentBranchText, Object.fromEntries(wantedEntries));
-              if (updateResult.updatedVars.length === 0) {
-                return { status: 'skipped', reason: 'CT defaults already up to date.', unchangedVars: updateResult.unchangedVars };
-              }
-
-              const commitMessage = 'chore(ct): sync ' + slugValue + ' defaults from PocketBase';
-              const putRes = await ghRequest('/repos/' + owner + '/' + repo + '/contents/' + encodedCtPath, 'PUT', {
-                message: commitMessage,
-                content: Buffer.from(updateResult.nextText, 'utf8').toString('base64'),
-                sha: branchFile.sha,
-                branch: branchName
-              });
-              if (!putRes.ok) {
-                throw new Error('Could not update CT file: ' + putRes.body);
-              }
-
-              const openPrRes = await ghRequest(
-                '/repos/' + owner + '/' + repo + '/pulls?state=open&head=' + encodeURIComponent(owner + ':' + branchName) + '&base=' + encodeURIComponent(defaultBranch)
-              );
-              if (!openPrRes.ok) {
-                throw new Error('Could not query existing PRs: ' + openPrRes.body);
-              }
-              const openPrs = JSON.parse(openPrRes.body);
-              if (openPrs.length > 0) {
-                return { status: 'updated', prUrl: openPrs[0].html_url, updatedVars: updateResult.updatedVars };
-              }
-
-              const prTitle = 'chore(ct): sync ' + slugValue + ' defaults with PocketBase';
-              const prBody =
-                '## Summary\n' +
-                '- Sync default CT variables for `' + slugValue + '` after `/pocketbase` update.\n' +
-                '- Updated vars: `' + updateResult.updatedVars.join('`, `') + '`.\n\n' +
-                '## Source\n' +
-                '- Triggered by @' + actor + ' via PocketBase bot.\n';
-              const createPrRes = await ghRequest('/repos/' + owner + '/' + repo + '/pulls', 'POST', {
-                title: prTitle,
-                body: prBody,
-                head: branchName,
-                base: defaultBranch
-              });
-              if (!createPrRes.ok) {
-                throw new Error('Could not create PR: ' + createPrRes.body);
-              }
-              const pr = JSON.parse(createPrRes.body);
-              return { status: 'created', prUrl: pr.html_url, updatedVars: updateResult.updatedVars };
-            }
-
-            function formatCtSyncResult(syncResult) {
-              if (!syncResult) return '';
-              if (syncResult.status === 'created') return '\n\n**CT sync PR:** ' + syncResult.prUrl;
-              if (syncResult.status === 'updated') return '\n\n**CT sync PR updated:** ' + syncResult.prUrl;
-              if (syncResult.status === 'skipped') return '\n\n**CT sync skipped:** ' + syncResult.reason;
-              return '';
-            }
-
            async function addReaction(content) {
              try {
                await ghRequest(
@@ -653,7 +510,6 @@ jobs:
              const RESOURCE_KEYS = { cpu: 'number', ram: 'number', hdd: 'number', os: 'string', version: 'string' };
              const METHOD_KEYS   = { config_path: 'string', script: 'string' };
              const ALL_METHOD_KEYS = Object.assign({}, RESOURCE_KEYS, METHOD_KEYS);
-              const RESOURCE_TO_CT_VAR = { cpu: 'var_cpu', ram: 'var_ram', hdd: 'var_disk', os: 'var_os', version: 'var_version' };

              function applyMethodChanges(method, parsed) {
                if (!method.resources) method.resources = {};
@@ -694,7 +550,6 @@ jobs:
                if (addMatch) {
                  // ── METHOD ADD ───────────────────────────────────────────────
                  const newType = addMatch[1];
-                  const parsed = addMatch[2] ? parseKVPairs(addMatch[2]) : {};
                  if (methodsArr.some(function (im) { return (im.type || '').toLowerCase() === newType.toLowerCase(); })) {
                    await addReaction('-1');
                    await postComment('❌ **PocketBase Bot**: Install method `' + newType + '` already exists for `' + slug + '`.\n\nUse `/pocketbase ' + slug + ' method list` to see all methods.');
@@ -702,6 +557,7 @@ jobs:
                  }
                  const newMethod = { type: newType, resources: { cpu: 1, ram: 512, hdd: 4, os: 'debian', version: '13' } };
                  if (addMatch[2]) {
+                    const parsed = parseKVPairs(addMatch[2]);
                    const unknown = Object.keys(parsed).filter(function (k) { return !ALL_METHOD_KEYS[k]; });
                    if (unknown.length > 0) {
                      await addReaction('-1');
@@ -713,21 +569,10 @@ jobs:
                  methodsArr.push(newMethod);
                  await patchMethods(methodsArr);
                  await revalidate(slug);
-                  const addCtChanges = {};
-                  for (const [k, v] of Object.entries(parsed)) {
-                    if (RESOURCE_TO_CT_VAR[k]) addCtChanges[RESOURCE_TO_CT_VAR[k]] = v;
-                  }
-                  let addCtSync = null;
-                  try {
-                    addCtSync = await upsertCtDefaultsPr(slug, addCtChanges);
-                  } catch (e) {
-                    addCtSync = { status: 'skipped', reason: 'CT sync failed: ' + e.message };
-                  }
                  await addReaction('+1');
                  await postComment(
                    '✅ **PocketBase Bot**: Added install method **`' + newType + '`** to **`' + slug + '`**\n\n' +
                    formatMethodsList([newMethod]) + '\n\n' +
-                    formatCtSyncResult(addCtSync) + '\n\n' +
                    '*Executed by @' + actor + '*'
                  );

@@ -795,16 +640,6 @@ jobs:
                  applyMethodChanges(methodsArr[idx], parsed);
                  await patchMethods(methodsArr);
                  await revalidate(slug);
-                  const editCtChanges = {};
-                  for (const [k, v] of Object.entries(parsed)) {
-                    if (RESOURCE_TO_CT_VAR[k]) editCtChanges[RESOURCE_TO_CT_VAR[k]] = v;
-                  }
-                  let editCtSync = null;
-                  try {
-                    editCtSync = await upsertCtDefaultsPr(slug, editCtChanges);
-                  } catch (e) {
-                    editCtSync = { status: 'skipped', reason: 'CT sync failed: ' + e.message };
-                  }

                  const changesLines = Object.entries(parsed)
                    .map(function ([k, v]) {
@@ -815,7 +650,6 @@ jobs:
                  await postComment(
                    '✅ **PocketBase Bot**: Updated install method **`' + methodsArr[idx].type + '`** for **`' + slug + '`**\n\n' +
                    '**Changes applied:**\n' + changesLines + '\n\n' +
-                    formatCtSyncResult(editCtSync) + '\n\n' +
                    '*Executed by @' + actor + '*'
                  );
                }
@@ -878,11 +712,9 @@ jobs:
                project_url:      'string',
                github:           'string',
                config_path:      'string',
-                tags:             'string',
                port:             'number',
                default_user:     'nullable_string',
                default_passwd:   'nullable_string',
-                unprivileged:     'number',
                updateable:       'boolean',
                privileged:       'boolean',
                has_arm:          'boolean',
@@ -949,17 +781,6 @@ jobs:
                process.exit(1);
              }
              await revalidate(slug);
-              const FIELD_TO_CT_VAR = { tags: 'var_tags', unprivileged: 'var_unprivileged' };
-              const fieldCtChanges = {};
-              for (const [k, v] of Object.entries(payload)) {
-                if (FIELD_TO_CT_VAR[k]) fieldCtChanges[FIELD_TO_CT_VAR[k]] = v;
-              }
-              let fieldCtSync = null;
-              try {
-                fieldCtSync = await upsertCtDefaultsPr(slug, fieldCtChanges);
-              } catch (e) {
-                fieldCtSync = { status: 'skipped', reason: 'CT sync failed: ' + e.message };
-              }
              await addReaction('+1');
              const changesLines = Object.entries(payload)
                .map(function ([k, v]) { return '- `' + k + '` → `' + JSON.stringify(v) + '`'; })
@@ -967,7 +788,6 @@ jobs:
              await postComment(
                '✅ **PocketBase Bot**: Updated **`' + slug + '`** successfully!\n\n' +
                '**Changes applied:**\n' + changesLines + '\n\n' +
-                formatCtSyncResult(fieldCtSync) + '\n\n' +
                '*Executed by @' + actor + '*'
              );
            }
@@ -41,9 +41,6 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit



-
-
-



@@ -57,7 +54,7 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit


 <details>
-<summary><h4>April (25 entries)</h4></summary>
+<summary><h4>April (18 entries)</h4></summary>

 [View April 2026 Changelog](.github/changelogs/2026/04.md)

@@ -448,128 +445,14 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

 </details>

-## 2026-04-28
-
-### 🆕 New Scripts
-
-  - StoryBook ([#14081](https://github.com/community-scripts/ProxmoxVE/pull/14081))
- CoreDNS ([#14082](https://github.com/community-scripts/ProxmoxVE/pull/14082))
-
-### 🚀 Updated Scripts
-
-  - Fix Dawarich Install/Update [@Jerry1098](https://github.com/Jerry1098) ([#14078](https://github.com/community-scripts/ProxmoxVE/pull/14078))
-
-## 2026-04-27
-
-### 🚀 Updated Scripts
-
-  - Add pamUsername column to userOrgs table [@JVKeller](https://github.com/JVKeller) ([#14075](https://github.com/community-scripts/ProxmoxVE/pull/14075))
-
-  - #### 🐞 Bug Fixes
-
-    - Dawarich: run db:migrate before assets:precompile [@MickLesk](https://github.com/MickLesk) ([#14051](https://github.com/community-scripts/ProxmoxVE/pull/14051))
-    - TechnitiumDNS: always install .NET 10 if not already present [@MickLesk](https://github.com/MickLesk) ([#14049](https://github.com/community-scripts/ProxmoxVE/pull/14049))
-
-  - #### 💥 Breaking Changes
-
-    - PatchMon: v2.0.0 migration [@vhsdream](https://github.com/vhsdream) ([#14015](https://github.com/community-scripts/ProxmoxVE/pull/14015))
-
-### 💾 Core
-
-  - #### 🔧 Refactor
-
-    - Update build.func - fixed spelling mistake [@m1ckywill](https://github.com/m1ckywill) ([#14047](https://github.com/community-scripts/ProxmoxVE/pull/14047))
-
-### 🧰 Tools
-
-  - #### 🐞 Bug Fixes
-
-    - update-lxcs/apps: avoid pct exec on containers mid-shutdown [@MickLesk](https://github.com/MickLesk) ([#14050](https://github.com/community-scripts/ProxmoxVE/pull/14050))
-
-  - #### ✨ New Features
-
-    - Add patchmon-agent report execution in update script [@heinemannj](https://github.com/heinemannj) ([#14054](https://github.com/community-scripts/ProxmoxVE/pull/14054))
-
-## 2026-04-26
-
-### 🆕 New Scripts
-
-  - TREK ([#14017](https://github.com/community-scripts/ProxmoxVE/pull/14017))
-
-### 🚀 Updated Scripts
-
-  - fix(2fauth): handle stale backup directory on update [@omertahaoztop](https://github.com/omertahaoztop) ([#14018](https://github.com/community-scripts/ProxmoxVE/pull/14018))
-
-  - #### 🐞 Bug Fixes
-
-    -  Increase Frigate default CPU cores from 4 to 8 [@MickLesk](https://github.com/MickLesk) ([#14039](https://github.com/community-scripts/ProxmoxVE/pull/14039))
-    - Technitium DNS: Ensure directories exist before running service [@tremor021](https://github.com/tremor021) ([#14030](https://github.com/community-scripts/ProxmoxVE/pull/14030))
-
-### 💾 Core
-
-  - #### 🐞 Bug Fixes
-
-    - core: Correct deb822 repository flat path detection [@MickLesk](https://github.com/MickLesk) ([#14037](https://github.com/community-scripts/ProxmoxVE/pull/14037))
-
-## 2026-04-25
-
-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - VictoriaMetrics: Stop vmagent/vmalert before update [@irishpadres](https://github.com/irishpadres) ([#14016](https://github.com/community-scripts/ProxmoxVE/pull/14016))
-    - Domain-Monitor: start apache2 after stop instead of reload [@omertahaoztop](https://github.com/omertahaoztop) ([#14019](https://github.com/community-scripts/ProxmoxVE/pull/14019))
-    - Transmute: Fix ffmpeg detection [@tremor021](https://github.com/tremor021) ([#14008](https://github.com/community-scripts/ProxmoxVE/pull/14008))
-
-  - #### 🔧 Refactor
-
-    - Refactor: Technitium DNS [@tremor021](https://github.com/tremor021) ([#14013](https://github.com/community-scripts/ProxmoxVE/pull/14013))
-
-## 2026-04-24
-
-### 🆕 New Scripts
-
-  - Apprise-API ([#13934](https://github.com/community-scripts/ProxmoxVE/pull/13934))
- fireshare ([#13995](https://github.com/community-scripts/ProxmoxVE/pull/13995))
- Transmute ([#13935](https://github.com/community-scripts/ProxmoxVE/pull/13935))
- Jitsi-Meet ([#13897](https://github.com/community-scripts/ProxmoxVE/pull/13897))
-
-### 🚀 Updated Scripts
-
-  - Update wger.sh [@Soppster1029](https://github.com/Soppster1029) ([#13977](https://github.com/community-scripts/ProxmoxVE/pull/13977))
-
-  - #### 🔧 Refactor
-
-    - Refactor: Ghostfolio [@MickLesk](https://github.com/MickLesk) ([#13990](https://github.com/community-scripts/ProxmoxVE/pull/13990))
-
 ## 2026-04-23

-### 🚀 Updated Scripts
-
-  - #### 🐞 Bug Fixes
-
-    - mealie: start.sh missing after failed update [@MickLesk](https://github.com/MickLesk) ([#13958](https://github.com/community-scripts/ProxmoxVE/pull/13958))
-    - twingate-connector: perform real apt upgrade during update flow [@MickLesk](https://github.com/MickLesk) ([#13959](https://github.com/community-scripts/ProxmoxVE/pull/13959))
-
-  - #### ✨ New Features
-
-    - core: auto-size NODE_OPTIONS heap [@MickLesk](https://github.com/MickLesk) ([#13960](https://github.com/community-scripts/ProxmoxVE/pull/13960))
-
-  - #### 🔧 Refactor
-
-    - Update scripts to match standard [@tremor021](https://github.com/tremor021) ([#13956](https://github.com/community-scripts/ProxmoxVE/pull/13956))
-
 ### 💾 Core

  - #### 🐞 Bug Fixes

-    - tools.func: upgrade Node.js minor/patch on same major version [@MickLesk](https://github.com/MickLesk) ([#13957](https://github.com/community-scripts/ProxmoxVE/pull/13957))
    - core: hotfix - prefer silent mode on PHS env conflict [@MickLesk](https://github.com/MickLesk) ([#13951](https://github.com/community-scripts/ProxmoxVE/pull/13951))

-  - #### 🔧 Refactor
-
-    - core: improve system update information / lxc stack upgrade [@MickLesk](https://github.com/MickLesk) ([#13970](https://github.com/community-scripts/ProxmoxVE/pull/13970))
-
 ## 2026-04-22

 ### 🆕 New Scripts
@@ -1073,4 +956,158 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit

  - #### ✨ New Features

-    - Refactor/Feature-Bump/Security: Update-Cron-LXCs (Now Local Mode!) [@MickLesk](https://github.com/MickLesk) ([#13339](https://github.com/community-scripts/ProxmoxVE/pull/13339))
+    - Refactor/Feature-Bump/Security: Update-Cron-LXCs (Now Local Mode!) [@MickLesk](https://github.com/MickLesk) ([#13339](https://github.com/community-scripts/ProxmoxVE/pull/13339))
+
+## 2026-03-26
+
+### 🆕 New Scripts
+
+  - BirdNET ([#13313](https://github.com/community-scripts/ProxmoxVE/pull/13313))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Immich: Bump to 2.6.2 | use start.sh in service, ensure DB_HOSTNAME in .env | Fix Rights Issue with ZFS Shares [@MickLesk](https://github.com/MickLesk) ([#13199](https://github.com/community-scripts/ProxmoxVE/pull/13199))
+
+  - #### ✨ New Features
+
+    - SparkyFitness: add garmin microservice as addon [@tomfrenzel](https://github.com/tomfrenzel) ([#12642](https://github.com/community-scripts/ProxmoxVE/pull/12642))
+    - Frigate: bump to v0.17.1 & change build order [@MickLesk](https://github.com/MickLesk) ([#13304](https://github.com/community-scripts/ProxmoxVE/pull/13304))
+
+### 💾 Core
+
+  - #### 🐞 Bug Fixes
+
+    - tools.func: pin npm to 11.11.0 to work around Node.js 22.22.2 regression [@MickLesk](https://github.com/MickLesk) ([#13296](https://github.com/community-scripts/ProxmoxVE/pull/13296))
+
+  - #### ✨ New Features
+
+    - core: APT/APK Mirror Fallback for CDN Failures [@MickLesk](https://github.com/MickLesk) ([#13316](https://github.com/community-scripts/ProxmoxVE/pull/13316))
+    - core/tools: replace generic return 1 exit_codes with more specific exit_codes [@MickLesk](https://github.com/MickLesk) ([#13311](https://github.com/community-scripts/ProxmoxVE/pull/13311))
+
+  - #### 🔧 Refactor
+
+    - core: use /usr/bin/install to prevent function shadowing [@MickLesk](https://github.com/MickLesk) ([#13299](https://github.com/community-scripts/ProxmoxVE/pull/13299))
+
+### 🧰 Tools
+
+  - #### 🐞 Bug Fixes
+
+    - SparkyFitness-Garmin: fix app name [@tomfrenzel](https://github.com/tomfrenzel) ([#13325](https://github.com/community-scripts/ProxmoxVE/pull/13325))
+
+## 2026-03-25
+
+### 🚀 Updated Scripts
+
+  - #### ✨ New Features
+
+    - Komodo v2: migrate env vars to v2 and update source [@MickLesk](https://github.com/MickLesk) ([#13262](https://github.com/community-scripts/ProxmoxVE/pull/13262))
+
+### 💾 Core
+
+  - #### 🔧 Refactor
+
+    - core: make shell command substitutions safe with || true [@MickLesk](https://github.com/MickLesk) ([#13279](https://github.com/community-scripts/ProxmoxVE/pull/13279))
+
+## 2026-03-24
+
+### 🆕 New Scripts
+
+  - Homebrew (Addon) ([#13249](https://github.com/community-scripts/ProxmoxVE/pull/13249))
+- NextExplorer ([#13252](https://github.com/community-scripts/ProxmoxVE/pull/13252))
+
+### 🚀 Updated Scripts
+
+  - #### ✨ New Features
+
+    - Turnkey: modernize turnkey.sh with shared libraries  [@MickLesk](https://github.com/MickLesk) ([#13242](https://github.com/community-scripts/ProxmoxVE/pull/13242))
+
+  - #### 🔧 Refactor
+
+    - chore: replace helper-scripts.com with community-scripts.com [@MickLesk](https://github.com/MickLesk) ([#13244](https://github.com/community-scripts/ProxmoxVE/pull/13244))
+
+### 🗑️ Deleted Scripts
+
+  - Remove: Booklore [@MickLesk](https://github.com/MickLesk) ([#13265](https://github.com/community-scripts/ProxmoxVE/pull/13265))
+
+## 2026-03-23
+
+### 🚀 Updated Scripts
+
+  - #### 🔧 Refactor
+
+    - core: harden shell scripts against injection and insecure permissions [@MickLesk](https://github.com/MickLesk) ([#13239](https://github.com/community-scripts/ProxmoxVE/pull/13239))
+
+## 2026-03-22
+
+### 🆕 New Scripts
+
+  - versitygw ([#13180](https://github.com/community-scripts/ProxmoxVE/pull/13180))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Adventurelog: pin DRF <3.15 to fix coreapi module removal [@MickLesk](https://github.com/MickLesk) ([#13194](https://github.com/community-scripts/ProxmoxVE/pull/13194))
+
+  - #### ✨ New Features
+
+    - ConvertX: add libreoffice-writer for ODT/document conversions [@MickLesk](https://github.com/MickLesk) ([#13196](https://github.com/community-scripts/ProxmoxVE/pull/13196))
+
+  - #### 🔧 Refactor
+
+    - iSponsorblockTV: add AVX CPU check before installation [@MickLesk](https://github.com/MickLesk) ([#13197](https://github.com/community-scripts/ProxmoxVE/pull/13197))
+
+### 💾 Core
+
+  - #### 🐞 Bug Fixes
+
+    - core: guard against empty IPv6 address in static mode [@MickLesk](https://github.com/MickLesk) ([#13195](https://github.com/community-scripts/ProxmoxVE/pull/13195))
+
+## 2026-03-21
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Anytype-server: wait for MongoDB readiness before rs.initiate() [@MickLesk](https://github.com/MickLesk) ([#13165](https://github.com/community-scripts/ProxmoxVE/pull/13165))
+    - Frigate: use correct CPU model fallback path [@MickLesk](https://github.com/MickLesk) ([#13164](https://github.com/community-scripts/ProxmoxVE/pull/13164))
+    - iSponsorBlockTV: Fix release fetching  [@tremor021](https://github.com/tremor021) ([#13157](https://github.com/community-scripts/ProxmoxVE/pull/13157))
+    - Isponsorblocktv: use quoted heredoc to prevent unbound variable error during CLI wrapper creation [@Copilot](https://github.com/Copilot) ([#13146](https://github.com/community-scripts/ProxmoxVE/pull/13146))
+
+  - #### ✨ New Features
+
+    - Headscale: Enable TUN [@tremor021](https://github.com/tremor021) ([#13158](https://github.com/community-scripts/ProxmoxVE/pull/13158))
+
+### 💾 Core
+
+  - #### 🐞 Bug Fixes
+
+    - core: add missing -searchdomain/-nameserver prefix in base_settings [@MickLesk](https://github.com/MickLesk) ([#13166](https://github.com/community-scripts/ProxmoxVE/pull/13166))
+
+## 2026-03-20
+
+### 🆕 New Scripts
+
+  - iSponsorBlockTV ([#13123](https://github.com/community-scripts/ProxmoxVE/pull/13123))
+- Alpine-Wakapi ([#13119](https://github.com/community-scripts/ProxmoxVE/pull/13119))
+- teleport ([#13086](https://github.com/community-scripts/ProxmoxVE/pull/13086))
+
+### 🚀 Updated Scripts
+
+  - #### 🐞 Bug Fixes
+
+    - Reactive-Resume: add git dependency for v5.0.13+ [@MickLesk](https://github.com/MickLesk) ([#13133](https://github.com/community-scripts/ProxmoxVE/pull/13133))
+    - Scanopy: increase default CPU, RAM, and HDD to prevent OOM during Rust build [@Copilot](https://github.com/Copilot) ([#13130](https://github.com/community-scripts/ProxmoxVE/pull/13130))
+
+  - #### ✨ New Features
+
+    - Immich: v2.6.1 [@vhsdream](https://github.com/vhsdream) ([#13111](https://github.com/community-scripts/ProxmoxVE/pull/13111))
+    - VM's: add input validation and hostname sanitization to all VM scripts [@MickLesk](https://github.com/MickLesk) ([#12973](https://github.com/community-scripts/ProxmoxVE/pull/12973))
+
+### 🧰 Tools
+
+  - #### 🔧 Refactor
+
+    - Harden code-server addon install script [@MickLesk](https://github.com/MickLesk) ([#13116](https://github.com/community-scripts/ProxmoxVE/pull/13116))
@@ -24,7 +24,7 @@ function update_script() {
  check_container_storage
  check_container_resources

-  if [[ ! -d /opt/2fauth ]]; then
+  if [[ ! -d "/opt/2fauth" ]]; then
    msg_error "No ${APP} Installation Found!"
    exit
  fi
@@ -34,8 +34,7 @@ function update_script() {
    $STD apt -y upgrade

    msg_info "Creating Backup"
-    rm -rf /opt/2fauth-backup
-    mv /opt/2fauth /opt/2fauth-backup
+    mv "/opt/2fauth" "/opt/2fauth-backup"
    if ! dpkg -l | grep -q 'php8.4'; then
      cp /etc/nginx/conf.d/2fauth.conf /etc/nginx/conf.d/2fauth.conf.bak
    fi
@@ -47,17 +46,15 @@ function update_script() {
    fi
    fetch_and_deploy_gh_release "2fauth" "Bubka/2FAuth" "tarball"
    setup_composer
-    cp /opt/2fauth-backup/.env /opt/2fauth/.env
-    cp -r /opt/2fauth-backup/storage /opt/2fauth/storage
-    cd /opt/2fauth || return
+    mv "/opt/2fauth-backup/.env" "/opt/2fauth/.env"
+    mv "/opt/2fauth-backup/storage" "/opt/2fauth/storage"
+    cd "/opt/2fauth" || return
+    chown -R www-data: "/opt/2fauth"
+    chmod -R 755 "/opt/2fauth"
    export COMPOSER_ALLOW_SUPERUSER=1
    $STD composer install --no-dev --prefer-dist
    php artisan 2fauth:install
-    chown -R www-data: /opt/2fauth
-    chmod -R 755 /opt/2fauth
-    $STD systemctl restart php8.4-fpm
    $STD systemctl restart nginx
-    rm -rf /opt/2fauth-backup
    msg_ok "Updated successfully!"
  fi
  exit
@@ -1,75 +0,0 @@
-#!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: SystemIdleProcess
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/caronc/apprise-api
-
-APP="Apprise-API"
-var_tags="${var_tags:-notification}"
-var_cpu="${var_cpu:-1}"
-var_ram="${var_ram:-512}"
-var_disk="${var_disk:-2}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d "/opt/apprise" ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-  if check_for_gh_release "apprise" "caronc/apprise-api"; then
-    msg_info "Stopping Service"
-    systemctl stop apprise-api
-    msg_ok "Stopped Service"
-
-    PYTHON_VERSION="3.12" setup_uv
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "apprise" "caronc/apprise-api" "tarball"
-
-    msg_info "Updating Apprise-API"
-    cd /opt/apprise
-    cp ./requirements.txt /etc/requirements.txt
-    $STD apt install -y nginx git
-    $STD uv pip install -r requirements.txt gunicorn supervisor --system
-    cp -fr apprise_api/static /usr/share/nginx/html/s/
-    mv apprise_api/ webapp
-    touch /etc/nginx/server-override.conf
-    touch /etc/nginx/location-override.conf
-    mkdir -p /config/store /attach /plugin /tmp/apprise /opt/apprise/logs
-    chmod 1777 /tmp/apprise && chmod 777 /config /config/store /attach /plugin /opt/apprise/logs
-    sed -i \
-      -e '/[[]program:nginx]/,/^[[]/ s|stdout_logfile=/dev/stdout|stdout_logfile=/opt/apprise/logs/nginx.log|' \
-      -e '/[[]program:nginx]/,/^[[]/ s|stderr_logfile=/dev/stderr|stderr_logfile=/opt/apprise/logs/nginx_error.log|' \
-      -e '/[[]program:gunicorn]/,/^[[]/ s|stdout_logfile=/dev/stdout|stdout_logfile=/opt/apprise/logs/gunicorn.log|' \
-      -e '/[[]program:gunicorn]/,/^[[]/ s|stderr_logfile=/dev/stderr|stderr_logfile=/opt/apprise/logs/gunicorn_error.log|' \
-      -e '/[[]supervisord]/,/^[[]/ s|logfile=/dev/null|logfile=/opt/apprise/logs/supervisor.log|' \
-      -e 's|_maxbytes=0|_maxbytes=10485760|g' \
-      /opt/apprise/webapp/etc/supervisord.conf
-    msg_ok "Updated Apprise-API"
-
-    msg_info "Starting Service"
-    systemctl start apprise-api
-    msg_ok "Started Service"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:8000${CL}"
@@ -39,7 +39,7 @@ function update_script() {
    [ -f /opt/checkmate/client/.env.local ] && cp /opt/checkmate/client/.env.local /opt/checkmate_client.env.local.bak
    msg_ok "Backed up Data"

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "checkmate" "bluewave-labs/Checkmate" "tarball"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "checkmate" "bluewave-labs/Checkmate"

    msg_info "Updating Checkmate Server"
    cd /opt/checkmate/server
@@ -1,56 +0,0 @@
-#!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/coredns/coredns
-
-APP="CoreDNS"
-var_tags="${var_tags:-dns;network}"
-var_cpu="${var_cpu:-1}"
-var_ram="${var_ram:-256}"
-var_disk="${var_disk:-1}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -f /usr/local/bin/coredns ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "coredns" "coredns/coredns"; then
-    msg_info "Stopping Service"
-    systemctl stop coredns
-    msg_ok "Stopped Service"
-
-    fetch_and_deploy_gh_release "coredns" "coredns/coredns" "prebuild" "latest" "/usr/local/bin" \
-      "coredns_*_linux_$(dpkg --print-architecture).tgz"
-    chmod +x /usr/local/bin/coredns
-
-    msg_info "Starting Service"
-    systemctl start coredns
-    msg_ok "Started Service"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} CoreDNS is listening on port 53 (DNS)${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}dns://${IP}${CL}"
@@ -53,18 +53,6 @@ function update_script() {
    export PATH="/root/.rbenv/shims:/root/.rbenv/bin:$PATH"
    eval "$(/root/.rbenv/bin/rbenv init - bash)"

-    if ! grep -q "OTP_ENCRYPTION_PRIMARY_KEY" /opt/dawarich/.env; then
-      echo "OTP_ENCRYPTION_PRIMARY_KEY=$(openssl rand -hex 64)" >>/opt/dawarich/.env
-    fi
-
-    if ! grep -q "OTP_ENCRYPTION_DETERMINISTIC_KEY" /opt/dawarich/.env; then
-      echo "OTP_ENCRYPTION_DETERMINISTIC_KEY=$(openssl rand -hex 64)" >>/opt/dawarich/.env
-    fi
-
-    if ! grep -q "OTP_ENCRYPTION_KEY_DERIVATION_SALT" /opt/dawarich/.env; then
-      echo "OTP_ENCRYPTION_KEY_DERIVATION_SALT=$(openssl rand -hex 64)" >>/opt/dawarich/.env
-    fi
-
    set -a && source /opt/dawarich/.env && set +a

    $STD bundle config set --local deployment 'true'
@@ -79,8 +67,8 @@ function update_script() {
      $STD npm install
    fi

-    $STD bundle exec rails db:migrate
    $STD bundle exec rake assets:precompile
+    $STD bundle exec rails db:migrate
    $STD bundle exec rake data:migrate
    msg_ok "Ran Migrations"

@@ -7,11 +7,11 @@ source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxV

 APP="Debian"
 var_tags="${var_tags:-os}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
-var_disk="${var_disk:-8}"
-var_os="${var_os:-ubuntu}"
-var_version="${var_version:-22}"
+var_cpu="${var_cpu:-1}"
+var_ram="${var_ram:-512}"
+var_disk="${var_disk:-2}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
 var_unprivileged="${var_unprivileged:-1}"

 header_info "$APP"
@@ -60,7 +60,7 @@ function update_script() {
    msg_ok "Restored backup"

    msg_info "Restarting Services"
-    systemctl start apache2
+    systemctl reload apache2
    msg_ok "Restarted Services"
    msg_ok "Updated successfully!"
  fi
@@ -1,74 +0,0 @@
-#!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: Slaviša Arežina (tremor021)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/ShaneIsrael/fireshare
-
-APP="Fireshare"
-var_tags="${var_tags:-sharing;video}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
-var_disk="${var_disk:-10}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-  if [[ ! -d /opt/fireshare ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "fireshare" "ShaneIsrael/fireshare"; then
-    msg_info "Stopping Service"
-    systemctl stop fireshare
-    msg_ok "Stopped Service"
-
-    mv /opt/fireshare/fireshare.env /opt
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "fireshare" "ShaneIsrael/fireshare" "tarball"
-    mv /opt/fireshare.env /opt/fireshare
-    rm -f /usr/local/bin/fireshare
-
-    msg_info "Updating Fireshare"
-    cd /opt/fireshare
-    $STD uv venv --clear
-    $STD .venv/bin/python -m ensurepip --upgrade
-    $STD .venv/bin/python -m pip install --upgrade --break-system-packages pip
-    $STD .venv/bin/python -m pip install --no-cache-dir --break-system-packages --ignore-installed app/server
-    cp .venv/bin/fireshare /usr/local/bin/fireshare
-    export FLASK_APP="/opt/fireshare/app/server/fireshare:create_app()"
-    export DATA_DIRECTORY=/opt/fireshare-data
-    export IMAGE_DIRECTORY=/opt/fireshare-images
-    export VIDEO_DIRECTORY=/opt/fireshare-videos
-    export PROCESSED_DIRECTORY=/opt/fireshare-processed
-    $STD uv run flask db upgrade
-    msg_ok "Updated Fireshare"
-
-    msg_info "Starting Service"
-    systemctl start fireshare
-    msg_ok "Started Service"
-    msg_ok "Updated successfully!"
-  fi
-  cleanup_lxc
-
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}${CL}"
@@ -38,7 +38,7 @@ function update_script() {
    cp -r /opt/flatnotes/data /opt/flatnotes_data_backup
    msg_ok "Backed up Configuration and Data"

-    fetch_and_deploy_gh_release "flatnotes" "dullage/flatnotes" "tarball"
+    fetch_and_deploy_gh_release "flatnotes" "dullage/flatnotes"

    msg_info "Updating Flatnotes"
    cd /opt/flatnotes/client
@@ -7,7 +7,7 @@ source <(curl -fsSL https://git.community-scripts.org/community-scripts/ProxmoxV

 APP="Frigate"
 var_tags="${var_tags:-nvr}"
-var_cpu="${var_cpu:-8}"
+var_cpu="${var_cpu:-4}"
 var_ram="${var_ram:-4096}"
 var_disk="${var_disk:-20}"
 var_os="${var_os:-debian}"
@@ -47,7 +47,6 @@ function update_script() {

    msg_info "Updating Ghostfolio"
    mv /opt/env.backup /opt/ghostfolio/.env
-    sed -i -E '/^DATABASE_URL=/ s/[?&]sslmode=prefer//g' /opt/ghostfolio/.env
    cd /opt/ghostfolio
    $STD npm ci
    $STD npm run build:production
@@ -1,6 +0,0 @@
-    ___                     _                 ___    ____  ____
-   /   |  ____  ____  _____(_)_______        /   |  / __ \/  _/
-  / /| | / __ \/ __ \/ ___/ / ___/ _ \______/ /| | / /_/ // /  
- / ___ |/ /_/ / /_/ / /  / (__  )  __/_____/ ___ |/ ____// /   
-/_/  |_/ .___/ .___/_/  /_/____/\___/     /_/  |_/_/   /___/   
-      /_/   /_/                                                
@@ -1,6 +0,0 @@
-   ______                ____  _   _______
-  / ____/___  ________  / __ \/ | / / ___/
- / /   / __ \/ ___/ _ \/ / / /  |/ /\__ \ 
-/ /___/ /_/ / /  /  __/ /_/ / /|  /___/ / 
-\____/\____/_/   \___/_____/_/ |_//____/  
-                                          
@@ -1,6 +0,0 @@
-    _______                __                  
-   / ____(_)_______  _____/ /_  ____ _________ 
-  / /_  / / ___/ _ \/ ___/ __ \/ __ `/ ___/ _ \
- / __/ / / /  /  __(__  ) / / / /_/ / /  /  __/
-/_/   /_/_/   \___/____/_/ /_/\__,_/_/   \___/ 
-                                               
@@ -1,6 +0,0 @@
-       ___ __       _       __  ___          __ 
-      / (_) /______(_)     /  |/  /__  ___  / /_
- __  / / / __/ ___/ /_____/ /|_/ / _ \/ _ \/ __/
-/ /_/ / / /_(__  ) /_____/ /  / /  __/  __/ /_  
-\____/_/\__/____/_/     /_/  /_/\___/\___/\__/  
-                                                
@@ -1,6 +0,0 @@
-   _____ __                   __                __  
-  / ___// /_____  _______  __/ /_  ____  ____  / /__
-  \__ \/ __/ __ \/ ___/ / / / __ \/ __ \/ __ \/ //_/
- ___/ / /_/ /_/ / /  / /_/ / /_/ / /_/ / /_/ / ,<   
-/____/\__/\____/_/   \__, /_.___/\____/\____/_/|_|  
-                    /____/                          
@@ -1,6 +0,0 @@
-  ______                                      __     
- /_  __/________ _____  _________ ___  __  __/ /____ 
-  / / / ___/ __ `/ __ \/ ___/ __ `__ \/ / / / __/ _ \
- / / / /  / /_/ / / / (__  ) / / / / / /_/ / /_/  __/
-/_/ /_/   \__,_/_/ /_/____/_/ /_/ /_/\__,_/\__/\___/ 
-                                                     
@@ -1,6 +0,0 @@
-  __________  ________ __
- /_  __/ __ \/ ____/ //_/
-  / / / /_/ / __/ / ,<   
- / / / _, _/ /___/ /| |  
-/_/ /_/ |_/_____/_/ |_|  
-                         
@@ -1,50 +0,0 @@
-#!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://jitsi.org/
-
-APP="Jitsi-Meet"
-var_tags="${var_tags:-video;conference;communication}"
-var_cpu="${var_cpu:-4}"
-var_ram="${var_ram:-4096}"
-var_disk="${var_disk:-12}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-12}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /etc/jitsi ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  msg_info "Updating Jitsi Meet"
-  $STD apt update
-  $STD apt install -y --only-upgrade \
-    jitsi-meet \
-    jicofo \
-    jitsi-videobridge2 \
-    prosody
-  msg_ok "Updated Jitsi Meet"
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}https://${IP}${CL}"
@@ -39,7 +39,7 @@ function update_script() {
    cp /opt/linkding/.env /opt/linkding_env_backup
    msg_ok "Backed up Data"

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "linkding" "sissbruecker/linkding" "tarball"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "linkding" "sissbruecker/linkding"

    msg_info "Restoring Data"
    cp -r /opt/linkding_data_backup/. /opt/linkding/data
@@ -38,27 +38,10 @@ function update_script() {

    msg_info "Backing up Configuration"
    cp -f /opt/mealie/mealie.env /opt/mealie.env
-    [[ -f /opt/mealie/start.sh ]] && cp -f /opt/mealie/start.sh /opt/mealie.start.sh
    msg_ok "Backup completed"

    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "mealie" "mealie-recipes/mealie" "tarball"

-    msg_info "Restoring Configuration"
-    mv -f /opt/mealie.env /opt/mealie/mealie.env
-    if [[ -f /opt/mealie.start.sh ]]; then
-      mv -f /opt/mealie.start.sh /opt/mealie/start.sh
-    else
-      cat <<'STARTEOF' >/opt/mealie/start.sh
-#!/bin/bash
-set -a
-source /opt/mealie/mealie.env
-set +a
-exec uv run mealie
-STARTEOF
-    fi
-    chmod +x /opt/mealie/start.sh
-    msg_ok "Configuration restored"
-
    msg_info "Installing Python Dependencies with uv"
    cd /opt/mealie
    $STD uv sync --frozen --extra pgsql
@@ -87,6 +70,18 @@ STARTEOF
    $STD uv run python -m nltk.downloader -d /nltk_data averaged_perceptron_tagger_eng
    msg_ok "Updated NLTK Data"

+    msg_info "Restoring Configuration"
+    mv -f /opt/mealie.env /opt/mealie/mealie.env
+    cat <<'STARTEOF' >/opt/mealie/start.sh
+#!/bin/bash
+set -a
+source /opt/mealie/mealie.env
+set +a
+exec uv run mealie
+STARTEOF
+    chmod +x /opt/mealie/start.sh
+    msg_ok "Configuration restored"
+
    msg_info "Starting Service"
    systemctl start mealie
    msg_ok "Started Service"
@@ -34,7 +34,7 @@ function update_script() {
    systemctl stop nodecast-tv
    msg_ok "Stopped Service"

-    fetch_and_deploy_gh_release "nodecast-tv" "technomancer702/nodecast-tv" "tarball"
+    fetch_and_deploy_gh_release "nodecast-tv" "technomancer702/nodecast-tv"

    msg_info "Updating Modules"
    cd /opt/nodecast-tv
@@ -76,7 +76,6 @@ function update_script() {
    if [[ -f "$DB" ]]; then
      sqlite3 "$DB" "ALTER TABLE 'orgs' ADD COLUMN 'settingsLogRetentionDaysConnection' integer DEFAULT 0 NOT NULL;" 2>/dev/null || true
      sqlite3 "$DB" "ALTER TABLE 'clientSitesAssociationsCache' ADD COLUMN 'isJitMode' integer DEFAULT 0 NOT NULL;" 2>/dev/null || true
-      sqlite3 "$DB" "ALTER TABLE 'userOrgs' ADD COLUMN 'pamUsername' text;" 2>/dev/null || true

      # Create new role-mapping tables and migrate data before drizzle-kit
      # drops the roleId columns from userOrgs and userInvites.
@@ -29,75 +29,63 @@ function update_script() {
    exit
  fi

-  RELEASE="v2.0.1"
+  if ! grep -q "PORT=3001" /opt/patchmon/backend/.env; then
+    msg_warn "⚠️ The next PatchMon update will include breaking changes (port changes)."
+    msg_warn "See details here: https://github.com/community-scripts/ProxmoxVE/pull/11888"
+    msg_warn "Press Enter to continue with the update, or Ctrl+C to abort..."
+    read -r
+  fi
+
+  RELEASE="v1.4.2"
+  NODE_VERSION="24" setup_nodejs
  if check_for_gh_release "PatchMon" "PatchMon/PatchMon" "${RELEASE}"; then
    msg_info "Stopping Service"
    systemctl stop patchmon-server
    msg_ok "Stopped Service"

-    if [[ -d /opt/patchmon/backend ]]; then
-      msg_info "Legacy install detected - creating full backup, please wait..."
-      $STD tar czf ~/patchmon_legacy.tar.gz /opt/patchmon
-      cp /opt/patchmon/backend/.env /opt/legacy.env
-      msg_ok "Full backup saved in /root"
-      msg_info "Starting migration to PatchMon v2.x.x"
-      systemctl disable -q --now nginx
-      $STD npm cache clean --force
-      $STD apt autoremove --purge -y {nginx,nodejs}
-      if [[ -f /etc/apt/sources.list.d/nodesource.sources ]]; then
-        cp /etc/apt/sources.list.d/nodesource.sources /etc/apt/sources.list.d/nodesource.sources.bak
-        rm -f /etc/apt/sources.list.d/nodesource.sources
-      elif [[ -f /etc/apt/sources.list.d/nodesource.list ]]; then
-        cp /etc/apt/sources.list.d/nodesource.list /etc/apt/sources.list.d/nodesource.list.bak
-        rm -f /etc/apt/sources.list.d/nodesource.list
-      fi
-      rm -rf /opt/patchmon
-      mkdir -p /opt/patchmon/agents
-      cp /opt/legacy.env /opt/patchmon/.env
-      sed -i -e 's/^PORT=.*/PORT=3000/' \
-        -e 's/^NODE_/APP_/' \
-        -e '/^SERVER_*/d' \
-        -e '/^# API*/,+2d' /opt/patchmon/.env
-      {
-        echo ""
-        echo "SESSION_SECRET=$(openssl rand -hex 64)"
-        echo "AI_ENCRYPTION_KEY=$(openssl rand -hex 64)"
-        echo "AGENT_BINARIES_DIR=/opt/patchmon/agents"
-      } >>/opt/patchmon/.env
-      sed -i -e '\|Directory|s|/backend||' \
-        -e 's|^ExecStart=.*|ExecStart=/opt/patchmon/patchmon-server|' \
-        -e 's|^Environment=NODE_.*|EnvironmentFile=/opt/patchmon/.env|' \
-        /etc/systemd/system/patchmon-server.service
-      systemctl daemon-reload
-      rm /opt/legacy.env
-      msg_ok "Migration complete!"
+    msg_info "Creating Backup"
+    cp /opt/patchmon/backend/.env /opt/backend.env
+    cp /opt/patchmon/frontend/.env /opt/frontend.env
+    msg_ok "Backup Created"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "PatchMon" "PatchMon/PatchMon" "tarball" "${RELEASE}" "/opt/patchmon"
+
+    msg_info "Updating PatchMon"
+    VERSION=$(get_latest_github_release "PatchMon/PatchMon")
+    SERVER_PORT="$(sed -n '/SERVER_PORT/s/[^=]*=//p' /opt/backend.env)"
+    sed -i 's/PORT=3399/PORT=3001/' /opt/backend.env
+    sed -i -e "s/VERSION=.*/VERSION=$VERSION/" \
+      -e '/^VITE_API_URL/d' /opt/frontend.env
+    export NODE_ENV=production
+    cd /opt/patchmon
+    $STD npm install --no-audit --no-fund --no-save --ignore-scripts
+    cd /opt/patchmon/frontend
+    mv /opt/frontend.env /opt/patchmon/frontend/.env
+    $STD npm install --no-audit --no-fund --no-save --ignore-scripts --include=dev
+    $STD npm run build
+    cd /opt/patchmon/backend
+    mv /opt/backend.env /opt/patchmon/backend/.env
+    $STD npm run db:generate
+    $STD npx prisma migrate deploy
+    cp /opt/patchmon/docker/nginx.conf.template /etc/nginx/sites-available/patchmon.conf
+    sed -i -e 's|proxy_pass .*|proxy_pass http://127.0.0.1:3001;|' \
+      -e '\|try_files |i\        root /opt/patchmon/frontend/dist;' \
+      -e 's|alias.*|alias /opt/patchmon/frontend/dist/assets;|' \
+      -e '\|expires 1y|i\        root /opt/patchmon/frontend/dist;' /etc/nginx/sites-available/patchmon.conf
+    if [[ -n "$SERVER_PORT" ]] && [[ "$SERVER_PORT" != "443" ]]; then
+      sed -i "s/listen [[:digit:]].*/listen ${SERVER_PORT};/" /etc/nginx/sites-available/patchmon.conf
    fi
-
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "PatchMon" "PatchMon/PatchMon" "singlefile" "${RELEASE}" "/opt/patchmon" "patchmon-server-linux-amd64"
-    mv /opt/patchmon/PatchMon /opt/patchmon/patchmon-server
-
-    msg_info "Fetching PatchMon agent binaries"
-    [[ ! -d /opt/patchmon/agents ]] && mkdir -p /opt/patchmon/agents
-    FILE_URL="https://github.com/PatchMon/PatchMon/releases/download/${RELEASE}/patchmon-agent-"
-    AGENT_NAME=(
-      "linux-amd64"
-      "linux-arm64"
-      "linux-arm"
-      "linux-386"
-      "freebsd-amd64"
-      "freebsd-arm64"
-      "freebsd-arm"
-      "freebsd-386"
-      "windows-amd64.exe"
-      "windows-arm64.exe"
-    )
-    for arch in "${AGENT_NAME[@]}"; do
-      curl_with_retry "${FILE_URL}${arch}" "/opt/patchmon/agents/patchmon-agent-${arch}"
-      [[ "${arch}" != *.exe ]] && chmod 755 "/opt/patchmon/agents/patchmon-agent-${arch}"
-    done
-    msg_ok "Fetched PatchMon agent binaries"
+    ln -sf /etc/nginx/sites-available/patchmon.conf /etc/nginx/sites-enabled/
+    rm -f /etc/nginx/sites-enabled/default
+    $STD nginx -t
+    systemctl restart nginx
+    msg_ok "Updated PatchMon"

    msg_info "Starting Service"
+    if grep -q '/usr/bin/node' /etc/systemd/system/patchmon-server.service; then
+      sed -i 's|ExecStart=.*|ExecStart=/usr/bin/npm run start|' /etc/systemd/system/patchmon-server.service
+      systemctl daemon-reload
+    fi
    systemctl start patchmon-server
    msg_ok "Started Service"
    msg_ok "Updated successfully!"
@@ -1,54 +0,0 @@
-#!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/storybookjs/storybook
-
-APP="Storybook"
-var_tags="${var_tags:-dev-tools;frontend;ui}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
-var_disk="${var_disk:-8}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -f /opt/storybook/.projectpath ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  PROJECT_PATH=$(cat /opt/storybook/.projectpath)
-
-  if [[ ! -d "$PROJECT_PATH" ]]; then
-    msg_error "Project directory not found: $PROJECT_PATH"
-    exit
-  fi
-
-  msg_info "Updating Storybook"
-  cd "$PROJECT_PATH"
-  $STD npx storybook@latest upgrade --yes
-  msg_ok "Updated Storybook"
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:6006${CL}"
@@ -32,8 +32,8 @@ function update_script() {
    systemctl daemon-reload
    systemctl enable -q --now technitium
  fi
-  if ! is_package_installed "aspnetcore-runtime-10.0"; then
-    $STD apt remove -y aspnetcore-runtime-8.0 aspnetcore-runtime-9.0 2>/dev/null || true
+  if is_package_installed "aspnetcore-runtime-8.0"; then
+    $STD apt remove -y aspnetcore-runtime-8.0
    [ -f /etc/apt/sources.list.d/microsoft-prod.list ] && rm -f /etc/apt/sources.list.d/microsoft-prod.list
    [ -f /usr/share/keyrings/microsoft-prod.gpg ] && rm -f /usr/share/keyrings/microsoft-prod.gpg
    setup_deb822_repo \
@@ -42,15 +42,18 @@ function update_script() {
      "https://packages.microsoft.com/debian/13/prod/" \
      "trixie" \
      "main"
-    $STD apt install -y aspnetcore-runtime-10.0
+    $STD apt install -y aspnetcore-runtime-9.0
  fi

  RELEASE=$(curl -fsSL https://technitium.com/dns/ | grep -oP 'Version \K[\d.]+')
-  if [[ ! -f ~/.technitium || ${RELEASE} != "$(cat ~/.technitium 2>/dev/null)" ]]; then
-    systemctl stop technitium
-    fetch_and_deploy_from_url "https://download.technitium.com/dns/DnsServerPortable.tar.gz" /opt/technitium/dns
+  if [[ ! -f ~/.technitium || ${RELEASE} != "$(cat ~/.technitium)" ]]; then
+    msg_info "Updating Technitium DNS"
+    curl -fsSL "https://download.technitium.com/dns/DnsServerPortable.tar.gz" -o /opt/DnsServerPortable.tar.gz
+    $STD tar zxvf /opt/DnsServerPortable.tar.gz -C /opt/technitium/dns/
+    rm -f /opt/DnsServerPortable.tar.gz
    echo "${RELEASE}" >~/.technitium
-    systemctl start technitium
+    systemctl restart technitium
+    msg_ok "Updated Technitium DNS"
    msg_ok "Updated successfully!"
  else
    msg_ok "No update required.  Technitium DNS is already at v${RELEASE}."
@@ -145,7 +145,7 @@ EOF
    cp -r /opt/termix/uploads /opt/termix_uploads_backup
    msg_ok "Backed up Data"

-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "termix" "Termix-SSH/Termix" "tarball"
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "termix" "Termix-SSH/Termix"

    msg_info "Recreating Directories"
    mkdir -p /opt/termix/html \
@@ -155,8 +155,6 @@ EOF
      /opt/termix/nginx/client_body
    msg_ok "Recreated Directories"

-    NODE_VERSION="24" setup_nodejs
-
    msg_info "Building Frontend"
    cd /opt/termix
    export COREPACK_ENABLE_DOWNLOAD_PROMPT=0
@@ -1,83 +0,0 @@
-#!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/transmute-app/transmute
-
-APP="Transmute"
-var_tags="${var_tags:-files;converter}"
-var_cpu="${var_cpu:-4}"
-var_ram="${var_ram:-4096}"
-var_disk="${var_disk:-16}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/transmute ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  fetch_and_deploy_gh_release "calibre" "kovidgoyal/calibre" "prebuild" "latest" "/opt/calibre" "calibre-*-x86_64.txz"
-  ln -sf /opt/calibre/ebook-convert /usr/bin/ebook-convert
-  fetch_and_deploy_gh_release "drawio" "jgraph/drawio-desktop" "binary" "latest" "" "drawio-amd64-*.deb"
-  fetch_and_deploy_gh_release "pandoc" "jgm/pandoc" "binary" "latest" "" "pandoc-*-amd64.deb"
-
-  if check_for_gh_release "transmute" "transmute-app/transmute"; then
-    msg_info "Stopping Service"
-    systemctl stop transmute
-    msg_ok "Stopped Service"
-
-    msg_info "Backing up Data"
-    cp /opt/transmute/backend/.env /opt/transmute.env.bak
-    cp -r /opt/transmute/data /opt/transmute_data_bak
-    msg_ok "Backed up Data"
-
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "transmute" "transmute-app/transmute" "tarball"
-
-    msg_info "Updating Python Dependencies"
-    cd /opt/transmute
-    $STD uv venv --clear /opt/transmute/.venv
-    $STD uv pip install --python /opt/transmute/.venv/bin/python -r requirements.txt
-    msg_ok "Updated Python Dependencies"
-
-    msg_info "Rebuilding Frontend"
-    cd /opt/transmute/frontend
-    $STD npm ci
-    $STD npm run build
-    msg_ok "Rebuilt Frontend"
-
-    msg_info "Restoring Data"
-    cp /opt/transmute.env.bak /opt/transmute/backend/.env
-    cp -r /opt/transmute_data_bak/. /opt/transmute/data/
-    rm -f /opt/transmute.env.bak
-    rm -rf /opt/transmute_data_bak
-    msg_ok "Restored Data"
-
-    msg_info "Starting Service"
-    systemctl start transmute
-    msg_ok "Started Service"
-    msg_ok "Updated successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:3313${CL}"
@@ -1,84 +0,0 @@
-#!/usr/bin/env bash
-source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/mauriceboe/TREK
-
-APP="TREK"
-var_tags="${var_tags:-travel;planning;collaboration}"
-var_cpu="${var_cpu:-2}"
-var_ram="${var_ram:-2048}"
-var_disk="${var_disk:-8}"
-var_os="${var_os:-debian}"
-var_version="${var_version:-13}"
-var_unprivileged="${var_unprivileged:-1}"
-
-header_info "$APP"
-variables
-color
-catch_errors
-
-function update_script() {
-  header_info
-  check_container_storage
-  check_container_resources
-
-  if [[ ! -d /opt/trek ]]; then
-    msg_error "No ${APP} Installation Found!"
-    exit
-  fi
-
-  if check_for_gh_release "trek" "mauriceboe/TREK"; then
-    msg_info "Stopping Service"
-    systemctl stop trek
-    msg_ok "Stopped Service"
-
-    msg_info "Backing up Data"
-    cp /opt/trek/server/.env /opt/trek.env.bak
-    mv /opt/trek/data /opt/trek-data.bak
-    mv /opt/trek/uploads /opt/trek-uploads.bak
-    msg_ok "Backed up Data"
-
-    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "trek" "mauriceboe/TREK" "tarball"
-
-    msg_info "Building Client"
-    cd /opt/trek/client
-    $STD npm ci
-    $STD npm run build
-    mkdir -p /opt/trek/server/public
-    cp -r /opt/trek/client/dist/* /opt/trek/server/public/
-    cp -r /opt/trek/client/public/fonts /opt/trek/server/public/fonts 2>/dev/null || true
-    msg_ok "Built Client"
-
-    msg_info "Installing Server Dependencies"
-    cd /opt/trek/server
-    $STD npm ci
-    msg_ok "Installed Server Dependencies"
-
-    msg_info "Restoring Data"
-    mv /opt/trek-data.bak /opt/trek/data
-    mv /opt/trek-uploads.bak /opt/trek/uploads
-    rm -rf /opt/trek/server/data /opt/trek/server/uploads
-    ln -s /opt/trek/data /opt/trek/server/data
-    ln -s /opt/trek/uploads /opt/trek/server/uploads
-    cp /opt/trek.env.bak /opt/trek/server/.env
-    rm -f /opt/trek.env.bak
-    msg_ok "Restored Data"
-
-    msg_info "Starting Service"
-    systemctl start trek
-    msg_ok "Started Service"
-    msg_ok "Updated Successfully!"
-  fi
-  exit
-}
-
-start
-build_container
-description
-
-msg_ok "Completed Successfully!\n"
-echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
-echo -e "${INFO}${YW} Access it using the following URL:${CL}"
-echo -e "${TAB}${GATEWAY}${BGN}http://${IP}:3000${CL}"
@@ -29,9 +29,8 @@ function update_script() {
    exit
  fi

-  msg_info "Updating Twingate Connector"
-  $STD apt update
-  $STD apt install -y --only-upgrade twingate-connector
+  msg_info "Updating ${APP}"
+  ensure_dependencies twingate-connector
  $STD systemctl restart twingate-connector
  msg_ok "Updated successfully!"
  exit
@@ -32,8 +32,6 @@ function update_script() {
    msg_info "Stopping Service"
    systemctl stop victoriametrics
    [[ -f /etc/systemd/system/victoriametrics-logs.service ]] && systemctl stop victoriametrics-logs
-    [[ -f /etc/systemd/system/vmagent.service ]] && systemctl stop vmagent
-    [[ -f /etc/systemd/system/vmalert.service ]] && systemctl stop vmalert
    msg_ok "Stopped Service"

    victoriametrics_release=$(curl -fsSL "https://api.github.com/repos/VictoriaMetrics/VictoriaMetrics/releases" |
@@ -64,8 +62,6 @@ function update_script() {
    msg_info "Starting Service"
    systemctl start victoriametrics
    [[ -f /etc/systemd/system/victoriametrics-logs.service ]] && systemctl start victoriametrics-logs
-    [[ -f /etc/systemd/system/vmagent.service ]] && systemctl start vmagent
-    [[ -f /etc/systemd/system/vmalert.service ]] && systemctl start vmalert
    msg_ok "Started Service"
    msg_ok "Updated successfully!"
  fi
@@ -53,8 +53,6 @@ function update_script() {
    set -a && source /opt/wger/.env && set +a
    export DJANGO_SETTINGS_MODULE=settings.main
    $STD uv pip install .
-    $STD npm install
-    $STD npm run build:css:sass
    $STD uv run python manage.py migrate
    $STD uv run python manage.py collectstatic --no-input
    msg_ok "Updated wger"
@@ -1,66 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: SystemIdleProcess
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/caronc/apprise-api
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-msg_info "Installing Dependencies"
-$STD apt install -y \
-  nginx \
-  git
-msg_ok "Installed Dependencies" 
-
-PYTHON_VERSION="3.12" setup_uv
-fetch_and_deploy_gh_release "apprise" "caronc/apprise-api" "tarball"
-
-msg_info "Setup Apprise-API"
-cd /opt/apprise
-cp ./requirements.txt /etc/requirements.txt
-$STD uv pip install -r requirements.txt gunicorn supervisor --system
-cp -fr apprise_api/static /usr/share/nginx/html/s/
-mv apprise_api/ webapp
-touch /etc/nginx/server-override.conf
-touch /etc/nginx/location-override.conf
-mkdir -p /config/store /attach /plugin /tmp/apprise /opt/apprise/logs
-chmod 1777 /tmp/apprise && chmod 777 /config /config/store /attach /plugin /opt/apprise/logs
-sed -i \
-  -e '/[[]program:nginx]/,/^[[]/ s|stdout_logfile=/dev/stdout|stdout_logfile=/opt/apprise/logs/nginx.log|' \
-  -e '/[[]program:nginx]/,/^[[]/ s|stderr_logfile=/dev/stderr|stderr_logfile=/opt/apprise/logs/nginx_error.log|' \
-  -e '/[[]program:gunicorn]/,/^[[]/ s|stdout_logfile=/dev/stdout|stdout_logfile=/opt/apprise/logs/gunicorn.log|' \
-  -e '/[[]program:gunicorn]/,/^[[]/ s|stderr_logfile=/dev/stderr|stderr_logfile=/opt/apprise/logs/gunicorn_error.log|' \
-  -e '/[[]supervisord]/,/^[[]/ s|logfile=/dev/null|logfile=/opt/apprise/logs/supervisor.log|' \
-  -e 's|_maxbytes=0|_maxbytes=10485760|g' \
-  /opt/apprise/webapp/etc/supervisord.conf
-msg_ok "Setup Apprise-API"
-
-msg_info "Creating Service"
-cat <<EOF >/etc/systemd/system/apprise-api.service
-[Unit]
-Description=Apprise-API Service
-After=network-online.target
-
-[Service]
-Type=simple
-WorkingDirectory=/opt/apprise
-ExecStart=/opt/apprise/webapp/supervisord-startup
-Restart=always
-RestartSec=30
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now apprise-api
-msg_ok "Created Service"
-
-motd_ssh
-customize
-cleanup_lxc
@@ -22,7 +22,7 @@ msg_ok "Installed Dependencies"

 MONGO_VERSION="8.0" setup_mongodb
 NODE_VERSION="22" setup_nodejs
-fetch_and_deploy_gh_release "checkmate" "bluewave-labs/Checkmate" "tarball"
+fetch_and_deploy_gh_release "checkmate" "bluewave-labs/Checkmate"

 msg_info "Configuring Checkmate"
 JWT_SECRET="$(openssl rand -hex 32)"
@@ -1,55 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/coredns/coredns
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-fetch_and_deploy_gh_release "coredns" "coredns/coredns" "prebuild" "latest" "/usr/local/bin" \
-  "coredns_*_linux_$(dpkg --print-architecture).tgz"
-chmod +x /usr/local/bin/coredns
-
-msg_info "Configuring CoreDNS"
-mkdir -p /etc/coredns
-cat <<EOF >/etc/coredns/Corefile
-. {
-    forward . 1.1.1.1 1.0.0.1
-    cache 30
-    log
-    errors
-    health :8080
-    ready :8181
-}
-EOF
-msg_ok "Configured CoreDNS"
-
-msg_info "Creating Service"
-cat <<EOF >/etc/systemd/system/coredns.service
-[Unit]
-Description=CoreDNS DNS Server
-After=network.target
-
-[Service]
-Type=simple
-ExecStart=/usr/local/bin/coredns -conf /etc/coredns/Corefile
-Restart=on-failure
-RestartSec=5
-LimitNOFILE=1048576
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now coredns
-msg_ok "Created Service"
-
-motd_ssh
-customize
-cleanup_lxc
@@ -46,16 +46,10 @@ msg_ok "Set up Directories"

 msg_info "Configuring Environment"
 SECRET_KEY_BASE=$(openssl rand -hex 64)
-OTP_ENCRYPTION_PRIMARY_KEY=$(openssl rand -hex 64)
-OTP_ENCRYPTION_DETERMINISTIC_KEY=$(openssl rand -hex 64)
-OTP_ENCRYPTION_KEY_DERIVATION_SALT=$(openssl rand -hex 64)
 RELEASE=$(get_latest_github_release "Freika/dawarich")
 cat <<EOF >/opt/dawarich/.env
 RAILS_ENV=production
 SECRET_KEY_BASE=${SECRET_KEY_BASE}
-OTP_ENCRYPTION_PRIMARY_KEY=${OTP_ENCRYPTION_PRIMARY_KEY}
-OTP_ENCRYPTION_DETERMINISTIC_KEY=${OTP_ENCRYPTION_DETERMINISTIC_KEY}
-OTP_ENCRYPTION_KEY_DERIVATION_SALT=${OTP_ENCRYPTION_KEY_DERIVATION_SALT}
 DATABASE_HOST=localhost
 DATABASE_USERNAME=${PG_DB_USER}
 DATABASE_PASSWORD=${PG_DB_PASS}
@@ -1,174 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: Slaviša Arežina (tremor021)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/ShaneIsrael/fireshare
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-setup_hwaccel
-
-msg_info "Installing Dependencies"
-$STD apt install -y \
-  git \
-  build-essential \
-  cmake \
-  pkg-config \
-  yasm \
-  nasm \
-  libx264-dev \
-  libx265-dev \
-  libvpx-dev \
-  libaom-dev \
-  libopus-dev \
-  libvorbis-dev \
-  libass-dev \
-  libfreetype6-dev \
-  libmp3lame-dev \
-  nginx-extras \
-  supervisor \
-  libldap2-dev \
-  libsasl2-dev \
-  libssl-dev \
-  libffi-dev \
-  libc-dev
-msg_ok "Installed Dependencies"
-
-NODE_VERSION=24 setup_nodejs
-PYTHON_VERSION=3.14 setup_uv
-
-fetch_and_deploy_gh_release "fireshare" "ShaneIsrael/fireshare" "tarball"
-
-msg_info "Compiling SVT-AV1 (Patience)"
-cd /tmp
-$STD git clone --depth 1 --branch v1.8.0 https://gitlab.com/AOMediaCodec/SVT-AV1.git
-cd SVT-AV1/Build
-$STD cmake .. -G "Unix Makefiles" -DCMAKE_BUILD_TYPE=Release
-$STD make -j$(nproc)
-$STD make install
-msg_ok "Compiled SVT-AV1"
-
-msg_info "Installing NVDEC headers"
-cd /tmp
-$STD git clone --depth 1 --branch n12.1.14.0 https://github.com/FFmpeg/nv-codec-headers.git
-cd nv-codec-headers
-$STD make install
-$STD ldconfig
-msg_ok "Installed NVDEC headers"
-
-msg_info "Compiling ffmpeg (Patience)"
-cd /tmp
-curl -fsSL https://ffmpeg.org/releases/ffmpeg-6.1.tar.xz -o "ffmpeg-6.1.tar.xz"
-$STD tar -xf ffmpeg-6.1.tar.xz
-cd ffmpeg-6.1
-$STD ./configure \
-  --prefix=/usr/local \
-  --enable-gpl \
-  --enable-version3 \
-  --enable-nonfree \
-  --enable-ffnvcodec \
-  --enable-libx264 \
-  --enable-libx265 \
-  --enable-libvpx \
-  --enable-libaom \
-  --enable-libopus \
-  --enable-libvorbis \
-  --enable-libmp3lame \
-  --enable-libass \
-  --enable-libfreetype \
-  --enable-libsvtav1 \
-  --disable-debug \
-  --disable-doc
-$STD make -j$(nproc)
-$STD make install
-$STD ldconfig
-msg_ok "Compiled ffmpeg"
-
-msg_info "Configuring Fireshare (Patience)"
-ADMIN_PASSWORD=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
-SECRET=$(openssl rand -base64 48)
-mkdir -p /opt/fireshare-{data,videos,images,processed}
-cd /opt/fireshare
-$STD uv venv
-$STD .venv/bin/python -m ensurepip --upgrade
-$STD .venv/bin/python -m pip install --upgrade --break-system-packages pip
-ln -sf /usr/local/bin/ffmpeg /usr/bin/ffmpeg
-ln -sf /usr/local/bin/ffprobe /usr/bin/ffprobe
-echo "/usr/local/lib" >/etc/ld.so.conf.d/usr-local.conf
-echo "/usr/local/cuda/lib64" >>/etc/ld.so.conf.d/usr-local.conf
-echo "/usr/local/nvidia/lib" >>/etc/ld.so.conf.d/nvidia.conf
-echo "/usr/local/nvidia/lib64" >>/etc/ld.so.conf.d/nvidia.conf
-ldconfig
-$STD .venv/bin/python -m pip install --no-cache-dir --break-system-packages --ignore-installed app/server
-cp .venv/bin/fireshare /usr/local/bin/fireshare
-export FLASK_APP="/opt/fireshare/app/server/fireshare:create_app()"
-export DATA_DIRECTORY=/opt/fireshare-data
-export IMAGE_DIRECTORY=/opt/fireshare-images
-export VIDEO_DIRECTORY=/opt/fireshare-videos
-export PROCESSED_DIRECTORY=/opt/fireshare-processed
-$STD uv run flask db upgrade
-
-cat <<EOF >/opt/fireshare/fireshare.env
-FLASK_APP="/opt/fireshare/app/server/fireshare:create_app()"
-DOMAIN=
-ENVIRONMENT=production
-DATA_DIRECTORY=/opt/fireshare-data
-IMAGE_DIRECTORY=/opt/fireshare-images
-VIDEO_DIRECTORY=/opt/fireshare-videos
-PROCESSED_DIRECTORY=/opt/fireshare-processed
-TEMPLATE_PATH=/opt/fireshare/app/server/fireshare/templates
-SECRET_KEY=${SECRET}
-ADMIN_PASSWORD=${ADMIN_PASSWORD}
-TZ=UTC
-LD_LIBRARY_PATH=/usr/local/nvidia/lib:/usr/local/nvidia/lib64:/usr/local/lib:/usr/local/cuda/lib64:\$LD_LIBRARY_PATH
-PATH=/usr/local/bin:$PATH
-ENABLE_TRANSCODING=
-TRANSCODE_GPU=
-NVIDIA_DRIVER_CAPABILITIES=
-EOF
-
-cd /opt/fireshare/app/client
-$STD npm install
-$STD npm run build
-systemctl stop nginx
-cp /opt/fireshare/app/nginx/prod.conf /etc/nginx/nginx.conf
-sed -i 's|root /processed/|root /opt/fireshare-processed/|g' /etc/nginx/nginx.conf
-sed -i 's/^user[[:space:]]\+nginx;/user  root;/' /etc/nginx/nginx.conf
-sed -i 's|root[[:space:]]\+/app/build;|root /opt/fireshare/app/client/build;|' /etc/nginx/nginx.conf
-systemctl start nginx
-
-cat <<EOF >~/fireshare.creds
-Fireshare Admin Credentials
-========================
-Username: admin
-Password: ${ADMIN_PASSWORD}
-EOF
-msg_ok "Configured Fireshare"
-
-msg_info "Creating services"
-cat <<EOF >/etc/systemd/system/fireshare.service
-[Unit]
-Description=Fireshare Service
-After=network.target
-
-[Service]
-WorkingDirectory=/opt/fireshare/app/server
-ExecStart=/opt/fireshare/.venv/bin/gunicorn --bind=127.0.0.1:5000 "fireshare:create_app(init_schedule=True)" --workers 3 --threads 3 --preload
-Restart=always
-EnvironmentFile=/opt/fireshare/fireshare.env
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now fireshare
-msg_ok "Created services"
-
-motd_ssh
-customize
-cleanup_lxc
@@ -25,12 +25,25 @@ PG_VERSION="17" setup_postgresql
 NODE_VERSION="24" setup_nodejs

 msg_info "Setting up Database"
-PG_DB_NAME="ghostfolio" PG_DB_USER="ghostfolio" PG_DB_SCHEMA_PERMS="true" setup_postgresql_db
+DB_NAME=ghostfolio
+DB_USER=ghostfolio
+DB_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
 REDIS_PASS=$(openssl rand -base64 18 | tr -dc 'a-zA-Z0-9' | head -c13)
 ACCESS_TOKEN_SALT=$(openssl rand -base64 32)
 JWT_SECRET_KEY=$(openssl rand -base64 32)
+$STD sudo -u postgres psql -c "CREATE DATABASE $DB_NAME;"
+$STD sudo -u postgres psql -c "CREATE USER $DB_USER WITH ENCRYPTED PASSWORD '$DB_PASS';"
+$STD sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE $DB_NAME TO $DB_USER;"
+$STD sudo -u postgres psql -c "ALTER USER $DB_USER CREATEDB;"
+$STD sudo -u postgres psql -d $DB_NAME -c "GRANT ALL ON SCHEMA public TO $DB_USER;"
+$STD sudo -u postgres psql -d $DB_NAME -c "GRANT CREATE ON SCHEMA public TO $DB_USER;"
+$STD sudo -u postgres psql -d $DB_NAME -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO $DB_USER;"
+$STD sudo -u postgres psql -d $DB_NAME -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO $DB_USER;"
 {
  echo "Ghostfolio Credentials"
+  echo "Database User: $DB_USER"
+  echo "Database Password: $DB_PASS"
+  echo "Database Name: $DB_NAME"
  echo "Redis Password: $REDIS_PASS"
  echo "Access Token Salt: $ACCESS_TOKEN_SALT"
  echo "JWT Secret Key: $JWT_SECRET_KEY"
@@ -56,7 +69,7 @@ read -rp "${TAB3}CoinGecko Pro API key (press Enter to skip): " COINGECKO_PRO_KE

 msg_info "Setting up Environment"
 cat <<EOF >/opt/ghostfolio/.env
-DATABASE_URL=postgresql://$PG_DB_USER:$PG_DB_PASS@localhost:5432/$PG_DB_NAME?connect_timeout=300
+DATABASE_URL=postgresql://$DB_USER:$DB_PASS@localhost:5432/$DB_NAME?connect_timeout=300&sslmode=prefer
 REDIS_HOST=localhost
 REDIS_PORT=6379
 REDIS_PASSWORD=$REDIS_PASS
@@ -1,35 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://jitsi.org/
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-msg_info "Installing Dependencies"
-$STD apt install -y nginx
-msg_ok "Installed Dependencies"
-
-source /etc/os-release
-setup_deb822_repo "jitsi" \
-  "https://download.jitsi.org/jitsi-key.gpg.key" \
-  "https://download.jitsi.org" \
-  "stable/" \
-  ""
-
-msg_info "Installing Jitsi Meet"
-echo "jitsi-videobridge2 jitsi-videobridge/jvb-hostname string ${LOCAL_IP}" | debconf-set-selections
-echo "jitsi-meet-web-config jitsi-meet/cert-choice select Generate a new self-signed certificate" | debconf-set-selections
-DEBIAN_FRONTEND=noninteractive $STD apt install -y jitsi-meet
-msg_ok "Installed Jitsi Meet"
-
-motd_ssh
-customize
-cleanup_lxc
@@ -27,7 +27,7 @@ msg_ok "Installed Dependencies"

 NODE_VERSION="22" setup_nodejs
 setup_uv
-fetch_and_deploy_gh_release "linkding" "sissbruecker/linkding" "tarball"
+fetch_and_deploy_gh_release "linkding" "sissbruecker/linkding"

 msg_info "Building Frontend"
 cd /opt/linkding
@@ -13,7 +13,7 @@ setting_up_container
 network_check
 update_os

-fetch_and_deploy_gh_release "nodecast-tv" "technomancer702/nodecast-tv" "tarball"
+fetch_and_deploy_gh_release "nodecast-tv" "technomancer702/nodecast-tv"
 NODE_VERSION="20" setup_nodejs

 msg_info "Installing Dependencies"
@@ -14,90 +14,74 @@ network_check
 update_os

 msg_info "Installing Dependencies"
-$STD apt install -y redis-server
+$STD apt install -y \
+  build-essential \
+  nginx \
+  redis-server
 msg_ok "Installed Dependencies"

+NODE_VERSION="24" setup_nodejs
 PG_VERSION="17" setup_postgresql
 PG_DB_NAME="patchmon_db" PG_DB_USER="patchmon_usr" setup_postgresql_db

-RELEASE="v2.0.1"
-fetch_and_deploy_gh_release "PatchMon" "PatchMon/PatchMon" "singlefile" "$RELEASE" "/opt/patchmon" "patchmon-server-linux-amd64"
-mv /opt/patchmon/PatchMon /opt/patchmon/patchmon-server
+fetch_and_deploy_gh_release "PatchMon" "PatchMon/PatchMon" "tarball" "v1.4.2" "/opt/patchmon"

 msg_info "Configuring PatchMon"
-cat <<EOF >/opt/patchmon/.env
-DATABASE_URL="postgresql://$PG_DB_USER:$PG_DB_PASS@localhost:5432/$PG_DB_NAME"
-JWT_SECRET="$(openssl rand -hex 64)"
-SESSION_SECRET="$(openssl rand -hex 64)"
-AI_ENCRYPTION_KEY="$(openssl rand -hex 64)"
-CORS_ORIGIN=http://${LOCAL_IP}:3000
-PORT=3000
-APP_ENV=production
+VERSION=$(get_latest_github_release "PatchMon/PatchMon")
+export NODE_ENV=production
+cd /opt/patchmon
+$STD npm install --no-audit --no-fund --no-save --ignore-scripts

-# Redis
-REDIS_HOST=localhost
-REDIS_PORT=6379
-
-## OIDC / SSO (when OIDC_ENABLED=true, issuer/client/secret/redirect required)
-# OIDC_ENABLED=false
-# OIDC_ISSUER_URL=
-# OIDC_CLIENT_ID=
-# OIDC_CLIENT_SECRET=
-# OIDC_REDIRECT_URI=
-# OIDC_SCOPES=openid email profile groups
-# OIDC_AUTO_CREATE_USERS=false
-# OIDC_DEFAULT_ROLE=user
-# OIDC_DISABLE_LOCAL_AUTH=false
-# OIDC_BUTTON_TEXT=Login with SSO
-# OIDC_SESSION_TTL=600
-# OIDC_POST_LOGOUT_URI=
-# OIDC_SYNC_ROLES=false
-# OIDC_ADMIN_GROUP=
-# OIDC_SUPERADMIN_GROUP=
-# OIDC_HOST_MANAGER_GROUP=
-# OIDC_READONLY_GROUP=
-# OIDC_USER_GROUP=
-# OIDC_ENFORCE_HTTPS=true
-
-AGENT_BINARIES_DIR=/opt/patchmon/agents
+cd /opt/patchmon/frontend
+cat <<EOF >./.env
+VITE_APP_NAME=PatchMon
+VITE_APP_VERSION=${VERSION}
 EOF
+$STD npm install --no-audit --no-fund --no-save --ignore-scripts --include=dev
+$STD npm run build
+
+JWT_SECRET="$(openssl rand -hex 64)"
+mv /opt/patchmon/backend/env.example /opt/patchmon/backend/.env
+sed -i -e "s|DATABASE_URL=.*|DATABASE_URL=\"postgresql://$PG_DB_USER:$PG_DB_PASS@localhost:5432/$PG_DB_NAME\"|" \
+  -e "/JWT_SECRET/s/[=$].*/=$JWT_SECRET/" \
+  -e "\|CORS_ORIGIN|s|localhost|$LOCAL_IP|" \
+  -e "/PORT=3001/aSERVER_PROTOCOL=http \\
+  SERVER_HOST=$LOCAL_IP \\
+  SERVER_PORT=3000" \
+  -e '/_ENV=production/aTRUST_PROXY=1' \
+  -e '/REDIS_USER=.*/,+1d' /opt/patchmon/backend/.env
+
+cd /opt/patchmon/backend
+$STD npm run db:generate
+$STD npx prisma migrate deploy
 msg_ok "Configured PatchMon"

-msg_info "Fetching PatchMon agent binaries"
-mkdir -p /opt/patchmon/agents
-FILE_URL="https://github.com/PatchMon/PatchMon/releases/download/${RELEASE}/patchmon-agent-"
-AGENT_NAME=(
-  "linux-amd64"
-  "linux-arm64"
-  "linux-arm"
-  "linux-386"
-  "freebsd-amd64"
-  "freebsd-arm64"
-  "freebsd-arm"
-  "freebsd-386"
-  "windows-amd64.exe"
-  "windows-arm64.exe"
-)
-for arch in "${AGENT_NAME[@]}"; do
-  curl_with_retry "${FILE_URL}${arch}" "/opt/patchmon/agents/patchmon-agent-${arch}"
-  [[ "${arch}" != *.exe ]] && chmod 755 "/opt/patchmon/agents/patchmon-agent-${arch}"
-done
-msg_ok "Fetched PatchMon agent binaries"
+msg_info "Configuring Nginx"
+cp /opt/patchmon/docker/nginx.conf.template /etc/nginx/sites-available/patchmon.conf
+sed -i -e 's|proxy_pass .*|proxy_pass http://127.0.0.1:3001;|' \
+  -e '\|try_files |i\        root /opt/patchmon/frontend/dist;' \
+  -e 's|alias.*|alias /opt/patchmon/frontend/dist/assets;|' \
+  -e '\|expires 1y|i\        root /opt/patchmon/frontend/dist;' /etc/nginx/sites-available/patchmon.conf
+ln -sf /etc/nginx/sites-available/patchmon.conf /etc/nginx/sites-enabled/
+rm -f /etc/nginx/sites-enabled/default
+$STD nginx -t
+systemctl restart nginx
+msg_ok "Configured Nginx"

 msg_info "Creating service"
 cat <<EOF >/etc/systemd/system/patchmon-server.service
 [Unit]
-Description=PatchMon Server
+Description=PatchMon Service
 After=network.target postgresql.service

 [Service]
 Type=simple
-WorkingDirectory=/opt/patchmon
-ExecStart=/opt/patchmon/patchmon-server
+WorkingDirectory=/opt/patchmon/backend
+ExecStart=/usr/bin/npm run start
 Restart=always
 RestartSec=10
+Environment=NODE_ENV=production
 Environment=PATH=/usr/bin:/usr/local/bin
-EnvironmentFile=/opt/patchmon/.env
 NoNewPrivileges=true
 PrivateTmp=true
 ProtectSystem=strict
@@ -120,7 +120,7 @@ fetch_and_deploy_gh_release "RAHasher" "RetroAchievements/RALibretro" "prebuild"
 cp /opt/RALibretro/RAHasher /usr/bin/RAHasher
 chmod +x /usr/bin/RAHasher

-fetch_and_deploy_gh_release "romm" "rommapp/romm" "tarball"
+fetch_and_deploy_gh_release "romm" "rommapp/romm"

 msg_info "Creating environment file"
 sed -i 's/^supervised no/supervised systemd/' /etc/redis/redis.conf
@@ -1,55 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/storybookjs/storybook
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-NODE_VERSION="24" NODE_MODULE="pnpm" setup_nodejs
-
-msg_info "Preparing Storybook"
-mkdir -p /opt/storybook
-cd /opt/storybook
-msg_ok "Important: Interactive configuration will start now."
-
-npx -y storybook@latest init --yes --no-dev
-PROJECT_PATH=$(find /opt/storybook -maxdepth 2 -name ".storybook" -type d 2>/dev/null | head -n1 | xargs dirname)
-
-if [[ -z "$PROJECT_PATH" ]]; then
-  PROJECT_PATH="/opt/storybook"
-fi
-
-cd "$PROJECT_PATH"
-echo "$PROJECT_PATH" >/opt/storybook/.projectpath
-
-msg_info "Creating Service"
-cat <<EOF >/etc/systemd/system/storybook.service
-[Unit]
-Description=Storybook Dev Server
-After=network.target
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=${PROJECT_PATH}
-ExecStart=/usr/bin/npx storybook dev --host 0.0.0.0 --port 6006 --no-open
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now storybook
-msg_ok "Created Service"
-
-motd_ssh
-customize
-cleanup_lxc
@@ -20,18 +20,21 @@ setup_deb822_repo \
  "https://packages.microsoft.com/debian/13/prod/" \
  "trixie" \
  "main"
-$STD apt install -y aspnetcore-runtime-10.0
+$STD apt install -y aspnetcore-runtime-9.0
 msg_ok "Installed Dependencies"

 RELEASE=$(curl -fsSL https://technitium.com/dns/ | grep -oP 'Version \K[\d.]+')
-fetch_and_deploy_from_url "https://download.technitium.com/dns/DnsServerPortable.tar.gz" /opt/technitium/dns
+msg_info "Installing Technitium DNS"
+mkdir -p /opt/technitium/dns
+curl -fsSL "https://download.technitium.com/dns/DnsServerPortable.tar.gz" -o /opt/DnsServerPortable.tar.gz
+$STD tar zxvf /opt/DnsServerPortable.tar.gz -C /opt/technitium/dns/
+rm -f /opt/DnsServerPortable.tar.gz
 echo "${RELEASE}" >~/.technitium
+msg_ok "Installed Technitium DNS"

 msg_info "Creating service"
-mkdir -p /etc/dns /var/log/technitium/dns
-sed -i '/^User=/d;/^Group=/d' /opt/technitium/dns/systemd.service
 cp /opt/technitium/dns/systemd.service /etc/systemd/system/technitium.service
-systemctl enable -q --now technitium
+systemctl enable -q --now technitium 
 msg_ok "Service created"

 motd_ssh
@@ -55,7 +55,7 @@ rm -rf /opt/guacamole-server
 msg_ok "Built Guacamole Server (guacd)"

 NODE_VERSION="22" setup_nodejs
-fetch_and_deploy_gh_release "termix" "Termix-SSH/Termix" "tarball"
+fetch_and_deploy_gh_release "termix" "Termix-SSH/Termix"

 msg_info "Building Frontend"
 cd /opt/termix
@@ -1,100 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/transmute-app/transmute
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-UV_PYTHON="3.13" setup_uv
-NODE_VERSION="25" setup_nodejs
-setup_ffmpeg
-setup_gs
-
-msg_info "Installing Dependencies"
-$STD apt install -y \
-  inkscape \
-  tesseract-ocr \
-  libreoffice-impress \
-  libreoffice-common \
-  libmagic1 \
-  xvfb \
-  libsm6 \
-  libxext6 \
-  libpango-1.0-0 \
-  libopengl0 \
-  libpangocairo-1.0-0 \
-  libgdk-pixbuf-2.0-0 \
-  libffi-dev \
-  libcairo2 \
-  librsvg2-bin \
-  unrar-free \
-  python3-numpy \
-  python3-lxml \
-  python3-tinycss2 \
-  python3-cssselect
-msg_ok "Installed Dependencies"
-
-fetch_and_deploy_gh_release "pandoc" "jgm/pandoc" "binary" "latest" "" "pandoc-*-amd64.deb"
-fetch_and_deploy_gh_release "calibre" "kovidgoyal/calibre" "prebuild" "latest" "/opt/calibre" "calibre-*-x86_64.txz"
-ln -sf /opt/calibre/ebook-convert /usr/bin/ebook-convert
-ln -sf /usr/local/bin/ffmpeg /usr/bin/ffmpeg
-fetch_and_deploy_gh_release "drawio" "jgraph/drawio-desktop" "binary" "latest" "" "drawio-amd64-*.deb"
-fetch_and_deploy_gh_release "transmute" "transmute-app/transmute" "tarball"
-
-msg_info "Setting up Python Backend"
-cd /opt/transmute
-$STD uv venv --clear /opt/transmute/.venv
-$STD uv pip install --python /opt/transmute/.venv/bin/python -r requirements.txt
-ln -sf /opt/transmute/.venv/bin/weasyprint /usr/bin/weasyprint
-msg_ok "Set up Python Backend"
-
-msg_info "Configuring Transmute"
-SECRET_KEY=$(openssl rand -hex 64)
-cat <<EOF >/opt/transmute/backend/.env
-AUTH_SECRET_KEY=${SECRET_KEY}
-HOST=0.0.0.0
-PORT=3313
-DATA_DIR=/opt/transmute/data
-WEB_DIR=/opt/transmute/frontend/dist
-QT_QPA_PLATFORM=offscreen
-EOF
-mkdir -p /opt/transmute/data
-msg_ok "Configured Transmute"
-
-msg_info "Building Frontend"
-cd /opt/transmute/frontend
-$STD npm ci
-$STD npm run build
-msg_ok "Built Frontend"
-
-msg_info "Creating Service"
-cat <<EOF >/etc/systemd/system/transmute.service
-[Unit]
-Description=Transmute File Converter
-After=network.target
-
-[Service]
-Type=simple
-WorkingDirectory=/opt/transmute
-EnvironmentFile=/opt/transmute/backend/.env
-ExecStart=/usr/bin/xvfb-run -a -s "-screen 0 1024x768x24 -nolisten tcp" /opt/transmute/.venv/bin/python backend/main.py
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now transmute
-msg_ok "Created Service"
-
-motd_ssh
-customize
-cleanup_lxc
@@ -1,79 +0,0 @@
-#!/usr/bin/env bash
-
-# Copyright (c) 2021-2026 community-scripts ORG
-# Author: MickLesk (CanbiZ)
-# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
-# Source: https://github.com/mauriceboe/TREK
-
-source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
-color
-verb_ip6
-catch_errors
-setting_up_container
-network_check
-update_os
-
-msg_info "Installing Dependencies"
-$STD apt install -y build-essential
-msg_ok "Installed Dependencies"
-
-NODE_VERSION="22" setup_nodejs
-fetch_and_deploy_gh_release "trek" "mauriceboe/TREK" "tarball"
-
-msg_info "Building Client"
-cd /opt/trek/client
-$STD npm ci
-$STD npm run build
-msg_ok "Built Client"
-
-msg_info "Setting up Server"
-cd /opt/trek/server
-$STD npm ci
-mkdir -p /opt/trek/server/public
-cp -r /opt/trek/client/dist/* /opt/trek/server/public/
-cp -r /opt/trek/client/public/fonts /opt/trek/server/public/fonts 2>/dev/null || true
-mkdir -p /opt/trek/{data/logs,uploads/{files,covers,avatars,photos}}
-rm -rf /opt/trek/server/data /opt/trek/server/uploads
-ln -s /opt/trek/data /opt/trek/server/data
-ln -s /opt/trek/uploads /opt/trek/server/uploads
-ENCRYPTION_KEY=$(openssl rand -hex 32)
-ADMIN_EMAIL="admin@trek.local"
-ADMIN_PASSWORD=$(openssl rand -base64 18 | tr -dc 'A-Za-z0-9' | head -c 16)
-cat <<EOF >/opt/trek/server/.env
-NODE_ENV=production
-PORT=3000
-ENCRYPTION_KEY=${ENCRYPTION_KEY}
-ADMIN_EMAIL=${ADMIN_EMAIL}
-ADMIN_PASSWORD=${ADMIN_PASSWORD}
-COOKIE_SECURE=false
-FORCE_HTTPS=false
-LOG_LEVEL=info
-TZ=UTC
-EOF
-chmod 600 /opt/trek/server/.env
-msg_ok "Set up Server"
-
-msg_info "Creating Service"
-cat <<EOF >/etc/systemd/system/trek.service
-[Unit]
-Description=TREK Travel Planner
-After=network.target
-
-[Service]
-Type=simple
-User=root
-WorkingDirectory=/opt/trek/server
-EnvironmentFile=/opt/trek/server/.env
-ExecStart=/usr/bin/node --import tsx src/index.ts
-Restart=on-failure
-RestartSec=5
-
-[Install]
-WantedBy=multi-user.target
-EOF
-systemctl enable -q --now trek
-msg_ok "Created Service"
-
-motd_ssh
-customize
-cleanup_lxc
@@ -2702,16 +2702,21 @@ advanced_settings() {
    # STEP 28: Verbose Mode & Confirmation
    # ═══════════════════════════════════════════════════════════════════════════
    28)
-      local verbose_default_flag="--defaultno"
-      [[ "$_verbose" == "yes" ]] && verbose_default_flag=""
-
-      if whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
-        --title "VERBOSE MODE" \
-        $verbose_default_flag \
-        --yesno "\nEnable Verbose Mode?\n\nShows detailed output during installation." 12 58; then
+      # PHS_VERBOSE forces verbose mode and skips the prompt
+      if [[ "$PHS_MODE" == "verbose" ]]; then
        _verbose="yes"
      else
-        _verbose="no"
+        local verbose_default_flag="--defaultno"
+        [[ "$_verbose" == "yes" ]] && verbose_default_flag=""
+
+        if whiptail --backtitle "Proxmox VE Helper Scripts [Step $STEP/$MAX_STEP]" \
+          --title "VERBOSE MODE" \
+          $verbose_default_flag \
+          --yesno "\nEnable Verbose Mode?\n\nShows detailed output during installation." 12 58; then
+          _verbose="yes"
+        else
+          _verbose="no"
+        fi
      fi
      # Build summary
      local ct_type_desc="Unprivileged"
@@ -3444,7 +3449,7 @@ configure_ssh_settings() {
 # msg_menu()
 #
 # - Displays a numbered menu for update_script() functions
-# - In silent mode (PHS_SILENT=1): auto-selects the default option
+# - In silent mode (PHS_MODE=silent): auto-selects the default option
 # - In interactive mode: shows menu via read with 10s timeout + default fallback
 # - Usage: CHOICE=$(msg_menu "Title" "tag1" "Description 1" "tag2" "Desc 2" ...)
 # - The first item is always the default
@@ -3468,7 +3473,7 @@ msg_menu() {
  local count=${#tags[@]}

  # Silent mode: return default immediately
-  if [[ -n "${PHS_SILENT+x}" ]] && [[ "${PHS_SILENT}" == "1" ]]; then
+  if [[ "$PHS_MODE" == "silent" ]]; then
    echo "$default_tag"
    return 0
  fi
@@ -3504,6 +3509,34 @@ msg_menu() {
  return 0
 }

+# ------------------------------------------------------------------------------
+# resolve_phs_mode()
+#
+# - Resolves PHS_SILENT/PHS_VERBOSE env vars into a single PHS_MODE enum
+# - Values: "silent", "verbose", "interactive"
+# - If both PHS_SILENT=1 and PHS_VERBOSE=1, shows a conflict warning
+#   and defaults to "interactive"
+# - Should be called once early, before any mode-dependent logic
+# ------------------------------------------------------------------------------
+resolve_phs_mode() {
+  if [[ -n "${PHS_SILENT+x}" ]] && [[ "${PHS_SILENT}" == "1" ]] && [[ -n "${PHS_VERBOSE+x}" ]] && [[ "${PHS_VERBOSE}" == "1" ]]; then
+    # Conflict handling must never block unattended/non-TTY updates.
+    # Prefer silent mode to keep automation safe.
+    if [[ -t 0 ]] && [[ -t 1 ]] && command -v whiptail >/dev/null 2>&1; then
+      whiptail --backtitle "Proxmox VE Helper Scripts" \
+        --title "Configuration Conflict Warning" \
+        --msgbox "PHS_SILENT and PHS_VERBOSE are both set.\n\nFalling back to silent mode." 10 58 || true
+    fi
+    PHS_MODE="silent"
+  elif [[ -n "${PHS_SILENT+x}" ]] && [[ "${PHS_SILENT}" == "1" ]]; then
+    PHS_MODE="silent"
+  elif [[ -n "${PHS_VERBOSE+x}" ]] && [[ "${PHS_VERBOSE}" == "1" ]]; then
+    PHS_MODE="verbose"
+  else
+    PHS_MODE="interactive"
+  fi
+}
+
 # ------------------------------------------------------------------------------
 # start()
 #
@@ -3514,17 +3547,16 @@ msg_menu() {
 # ------------------------------------------------------------------------------
 start() {
  source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/tools.func)
+  resolve_phs_mode
  if command -v pveversion >/dev/null 2>&1; then
    install_script || return 0
    return 0
-  elif [ ! -z ${PHS_SILENT+x} ] && [[ "${PHS_SILENT}" == "1" ]]; then
+  elif [[ "$PHS_MODE" == "silent" ]]; then
    VERBOSE="no"
    set_std_mode
-    ensure_profile_loaded
-    get_lxc_ip
-    update_script
-    update_motd_ip
-    cleanup_lxc
+  elif [[ "$PHS_MODE" == "verbose" ]]; then
+    VERBOSE="yes"
+    set_std_mode
  else
    CHOICE=$(whiptail --backtitle "Proxmox VE Helper Scripts" --title "${APP} LXC Update/Setting" --menu \
      "Support/Update functions for ${APP} LXC. Choose an option:" \
@@ -3548,12 +3580,12 @@ start() {
      exit 0
      ;;
    esac
-    ensure_profile_loaded
-    get_lxc_ip
-    update_script
-    update_motd_ip
-    cleanup_lxc
  fi
+  ensure_profile_loaded
+  get_lxc_ip
+  update_script
+  update_motd_ip
+  cleanup_lxc
 }

 # ==============================================================================
@@ -5376,59 +5408,13 @@ create_lxc_container() {

  # Offer upgrade for pve-container/lxc-pve if candidate > installed; optional auto-retry pct create
  # Returns:
-  #   0 = no upgrade needed / container created after upgrade or explicit fallback
+  #   0 = no upgrade needed / container created after upgrade or fallback
  #   1 = upgraded (and if do_retry=yes and retry succeeded, creation done)
-  #   2 = user chose ignore
+  #   2 = user declined
  #   3 = upgrade attempted but failed OR retry failed
-  #   4 = user cancelled
  offer_lxc_stack_upgrade_and_maybe_retry() {
    local do_retry="${1:-no}" # yes|no
    local _pvec_i _pvec_c _lxcp_i _lxcp_c need=0
-    local _ans
-
-    has_previous_os_version_template() {
-      local os_type="${PCT_OSTYPE:-}"
-      local current_ver="${PCT_OSVERSION:-}"
-      local tpl_pattern="${TEMPLATE_PATTERN:-${TEMPLATE:-}}"
-      local -a all_versions=()
-
-      [[ -n "$os_type" && -n "$current_ver" ]] || return 1
-
-      mapfile -t _local_vers < <(
-        pveam list "$TEMPLATE_STORAGE" 2>/dev/null |
-          awk '{print $1}' |
-          sed 's|.*/||' |
-          grep -E "^${os_type}-[0-9]" |
-          { [[ -n "$tpl_pattern" ]] && grep "$tpl_pattern" || cat; } |
-          sed -E "s/^${os_type}-([0-9]+(\.[0-9]+)?).*/\1/" |
-          sort -u -V
-      )
-      all_versions+=("${_local_vers[@]}")
-
-      if command -v timeout &>/dev/null; then
-        timeout 30 pveam update >/dev/null 2>&1 || true
-      else
-        pveam update >/dev/null 2>&1 || true
-      fi
-      mapfile -t _online_vers < <(
-        pveam available -section system 2>/dev/null |
-          awk '{print $2}' |
-          grep -E "^${os_type}-[0-9]" |
-          { [[ -n "$tpl_pattern" ]] && grep "$tpl_pattern" || cat; } |
-          sed -E "s/^${os_type}-([0-9]+(\.[0-9]+)?).*/\1/" |
-          sort -u -V 2>/dev/null || true
-      )
-      all_versions+=("${_online_vers[@]}")
-
-      printf '%s\n' "${all_versions[@]}" | sort -u -V | awk -v cur="$current_ver" '
-        {
-          split($0, a, ".")
-          split(cur, b, ".")
-          if (a[1]+0 < b[1]+0) found=1
-        }
-        END { exit found ? 0 : 1 }
-      '
-    }

    _pvec_i="$(pkg_ver pve-container)"
    _lxcp_i="$(pkg_ver lxc-pve)"
@@ -5449,25 +5435,19 @@ create_lxc_container() {
    msg_warn "An update for the Proxmox LXC stack is available"
    echo "  pve-container: installed=${_pvec_i:-n/a}  candidate=${_pvec_c:-n/a}"
    echo "  lxc-pve     : installed=${_lxcp_i:-n/a}  candidate=${_lxcp_c:-n/a}"
-    echo "  note        : option 1 runs host apt update + apt upgrade"
    echo

    # Offer older OS version fallback when template version might be too new for LXC stack
    local _has_fallback_option=false
-    if [[ "$do_retry" == "yes" ]] && has_previous_os_version_template; then
+    if [[ -n "${PCT_OSTYPE:-}" && -n "${PCT_OSVERSION:-}" ]]; then
      _has_fallback_option=true
-      echo "  [1] Run host upgrade now (recommended). WARNING: this runs apt upgrade and updates all Packages on your host!"
+      echo "  [1] Upgrade LXC stack now (recommended)"
      echo "  [2] Use an older ${PCT_OSTYPE} template instead (may not work with all scripts)"
-      echo "  [3] Ignore"
-      echo "  [4] Cancel"
-      echo
-      read -rp "Select option [1/2/3/4]: " _ans </dev/tty
-    else
-      echo "  [1] Run host upgrade now (recommended). WARNING: this runs apt upgrade and updates all Packages on your host!"
-      echo "  [2] Ignore"
      echo "  [3] Cancel"
      echo
      read -rp "Select option [1/2/3]: " _ans </dev/tty
+    else
+      read -rp "Do you want to upgrade now? [y/N] " _ans </dev/tty
    fi

    if [[ "$_has_fallback_option" == true ]]; then
@@ -5476,48 +5456,35 @@ create_lxc_container() {
        _ans="y"
        ;;
      2)
-        if fallback_to_previous_os_version; then
-          return 0
+        if [[ "$do_retry" == "yes" ]]; then
+          if fallback_to_previous_os_version; then
+            return 0
+          else
+            return 3
+          fi
        else
-          return 3
+          msg_custom "ℹ️" "${YW}" "OS version fallback is only available during container creation."
+          return 2
        fi
        ;;
-      3)
-        return 2
-        ;;
-      4)
-        return 4
-        ;;
      *)
-        return 4
-        ;;
-      esac
-    else
-      case "$_ans" in
-      1)
-        _ans="y"
-        ;;
-      2)
        return 2
        ;;
-      *)
-        return 4
-        ;;
      esac
    fi

    case "${_ans,,}" in
    y | yes)
-      msg_info "Running host upgrade for LXC stack compatibility"
+      msg_info "Upgrading Proxmox LXC stack (pve-container, lxc-pve)"
      apt_update_safe
-      if $STD apt-get upgrade -y; then
+      if $STD apt-get install -y --only-upgrade pve-container lxc-pve; then
        msg_ok "LXC stack upgraded."
        # Verify pct binary still works after upgrade (partial upgrades can break Perl modules)
        if ! pct list &>/dev/null; then
          msg_error "LXC stack upgrade caused PVE tool breakage (likely Perl module incompatibility)."
          msg_custom "⚠️" "${YW}" "A partial package upgrade has left the PVE stack in an inconsistent state."
          msg_custom "🔧" "${YW}" "Please run the following on the Proxmox host, then retry:"
-          echo -e "${TAB}  apt update && apt upgrade -y"
+          echo -e "${TAB}  apt update && apt dist-upgrade -y"
          echo -e "${TAB}  reboot"
          return 3
        fi
@@ -6126,20 +6093,16 @@ create_lxc_container() {
              rc=$?
              case $rc in
              0) : ;; # success - container created, continue
-              2)
-                msg_error "LXC stack upgrade ignored. Please inspect: $LOGFILE"
-                _flush_pct_log
-                exit 231
-                ;;
-              3)
-                msg_error "LXC stack upgrade failed. Please inspect: $LOGFILE"
-                _flush_pct_log
-                exit 231
-                ;;
-              4)
-                msg_error "Cancelled by user."
-                _flush_pct_log
-                exit 231
+              2 | 3)
+                # Upgrade declined or failed — try older OS version as last resort
+                msg_warn "Attempting older ${PCT_OSTYPE:-} version as last resort"
+                if fallback_to_previous_os_version; then
+                  : # success
+                else
+                  msg_error "All recovery options exhausted. Please inspect: $LOGFILE"
+                  _flush_pct_log
+                  exit 231
+                fi
                ;;
              esac
            else
@@ -6163,20 +6126,16 @@ create_lxc_container() {
            rc=$?
            case $rc in
            0) : ;; # success - container created, continue
-            2)
-              msg_error "LXC stack upgrade ignored. Please inspect: $LOGFILE"
-              _flush_pct_log
-              exit 231
-              ;;
-            3)
-              msg_error "LXC stack upgrade failed. Please inspect: $LOGFILE"
-              _flush_pct_log
-              exit 231
-              ;;
-            4)
-              msg_error "Cancelled by user."
-              _flush_pct_log
-              exit 231
+            2 | 3)
+              # Upgrade declined or failed — try older OS version as last resort
+              msg_warn "Attempting older ${PCT_OSTYPE:-} version as last resort"
+              if fallback_to_previous_os_version; then
+                : # success
+              else
+                msg_error "All recovery options exhausted. Please inspect: $LOGFILE"
+                _flush_pct_log
+                exit 231
+              fi
              ;;
            esac
          else
@@ -940,7 +940,7 @@ is_verbose_mode() {
 #
 # - Detects if script is running in unattended/non-interactive mode
 # - Checks MODE variable first (primary method)
-# - Falls back to legacy flags (PHS_SILENT, var_unattended)
+# - Falls back to legacy flags (PHS_MODE, var_unattended)
 # - Returns 0 (true) if unattended, 1 (false) otherwise
 # - Used by prompt functions to auto-apply defaults
 #
@@ -984,7 +984,7 @@ is_unattended() {
  esac

  # Legacy fallbacks for compatibility
-  [[ "${PHS_SILENT:-0}" == "1" ]] && return 0
+  [[ "${PHS_MODE:-}" == "silent" ]] && return 0
  [[ "${var_unattended:-}" =~ ^(yes|true|1)$ ]] && return 0
  [[ "${UNATTENDED:-}" =~ ^(yes|true|1)$ ]] && return 0

@@ -313,51 +313,6 @@ error_handler() {
    echo -e "${TAB}-----------------------------------\n"
  fi

-  # Detect probable Node.js heap OOM and print actionable guidance.
-  # This avoids generic SIGABRT/SIGKILL confusion for frontend build failures.
-  local node_oom_detected="false"
-  local node_build_context="false"
-  if [[ "$command" =~ (npm|pnpm|yarn|node|vite|turbo) ]]; then
-    node_build_context="true"
-  fi
-  if [[ "$exit_code" == "243" ]]; then
-    node_oom_detected="true"
-  elif [[ -n "$active_log" && -s "$active_log" ]]; then
-    if tail -n 200 "$active_log" 2>/dev/null | grep -Eqi 'Reached heap limit|JavaScript heap out of memory|Allocation failed - JavaScript heap out of memory|FATAL ERROR: Reached heap limit'; then
-      node_oom_detected="true"
-    fi
-  fi
-
-  if [[ "$node_oom_detected" == "true" ]] || { [[ "$node_build_context" == "true" ]] && [[ "$exit_code" =~ ^(134|137)$ ]]; }; then
-    local heap_hint_mb=""
-
-    # If explicitly configured, prefer the current value for troubleshooting output.
-    if [[ -n "${NODE_OPTIONS:-}" ]] && [[ "${NODE_OPTIONS}" =~ max-old-space-size=([0-9]+) ]]; then
-      heap_hint_mb="${BASH_REMATCH[1]}"
-    elif [[ -n "${var_ram:-}" ]] && [[ "${var_ram}" =~ ^[0-9]+$ ]]; then
-      heap_hint_mb=$((var_ram * 75 / 100))
-    else
-      local mem_kb=""
-      mem_kb=$(awk '/^MemTotal:/ {print $2; exit}' /proc/meminfo 2>/dev/null || echo "")
-      if [[ "$mem_kb" =~ ^[0-9]+$ ]]; then
-        local mem_mb=$((mem_kb / 1024))
-        heap_hint_mb=$((mem_mb * 75 / 100))
-      fi
-    fi
-
-    if [[ -z "$heap_hint_mb" ]] || ((heap_hint_mb < 1024)); then
-      heap_hint_mb=1024
-    elif ((heap_hint_mb > 12288)); then
-      heap_hint_mb=12288
-    fi
-
-    if declare -f msg_warn >/dev/null 2>&1; then
-      msg_warn "Possible Node.js heap OOM. Try: export NODE_OPTIONS=\"--max-old-space-size=${heap_hint_mb}\" and rerun the build."
-    else
-      echo -e "${YW}Possible Node.js heap OOM. Try: export NODE_OPTIONS=\"--max-old-space-size=${heap_hint_mb}\" and rerun the build.${CL}"
-    fi
-  fi
-
  # Detect context: Container (INSTALL_LOG set + inside container /root) vs Host
  if [[ -n "${INSTALL_LOG:-}" && -f "${INSTALL_LOG:-}" && -d /root ]]; then
    # CONTAINER CONTEXT: Copy log and create flag file for host
@@ -1924,8 +1924,8 @@ setup_deb822_repo() {
    echo "Types: deb"
    echo "URIs: $repo_url"
    echo "Suites: $suite"
-    # Flat repositories (suite ending with "/" or "./") must not have Components
-    if [[ "$suite" != *"/" && -n "$component" ]]; then
+    # Flat repositories (suite="./" or absolute path) must not have Components
+    if [[ "$suite" != "./" && -n "$component" ]]; then
      echo "Components: $component"
    fi
    [[ -n "$architectures" ]] && echo "Architectures: $architectures"
@@ -4011,14 +4011,9 @@ function setup_ffmpeg() {
    DEPS+=(
      libx264-dev libx265-dev libvpx-dev libmp3lame-dev
      libfreetype6-dev libass-dev libopus-dev libvorbis-dev
-      libdav1d-dev zlib1g-dev libnuma-dev
+      libdav1d-dev libsvtav1-dev zlib1g-dev libnuma-dev
      libva-dev libdrm-dev
    )
-    if apt-cache show libsvtav1enc-dev &>/dev/null; then
-      DEPS+=(libsvtav1enc-dev)
-    elif apt-cache show libsvtav1-dev &>/dev/null; then
-      DEPS+=(libsvtav1-dev)
-    fi
    ;;
  *)
    msg_error "Invalid FFMPEG_TYPE: $TYPE"
@@ -6428,37 +6423,7 @@ function setup_nodejs() {
    msg_ok "Setup Node.js $NODE_VERSION"
  fi

-  # Set a safe default heap limit for Node.js builds if not explicitly provided.
-  # Priority:
-  #   1) NODE_OPTIONS (caller/user override)
-  #   2) NODE_MAX_OLD_SPACE_SIZE (explicit MB override)
-  #   3) var_ram (LXC memory setting, MB)
-  #   4) /proc/meminfo (runtime memory detection)
-  # Auto value is clamped to 1024..12288 MB.
-  if [[ -z "${NODE_OPTIONS:-}" ]]; then
-    local node_heap_mb=""
-
-    if [[ -n "${NODE_MAX_OLD_SPACE_SIZE:-}" ]] && [[ "${NODE_MAX_OLD_SPACE_SIZE}" =~ ^[0-9]+$ ]]; then
-      node_heap_mb="${NODE_MAX_OLD_SPACE_SIZE}"
-    elif [[ -n "${var_ram:-}" ]] && [[ "${var_ram}" =~ ^[0-9]+$ ]]; then
-      node_heap_mb=$((var_ram * 75 / 100))
-    else
-      local total_mem_kb=""
-      total_mem_kb=$(awk '/^MemTotal:/ {print $2; exit}' /proc/meminfo 2>/dev/null || echo "")
-      if [[ "$total_mem_kb" =~ ^[0-9]+$ ]]; then
-        local total_mem_mb=$((total_mem_kb / 1024))
-        node_heap_mb=$((total_mem_mb * 75 / 100))
-      fi
-    fi
-
-    if [[ -z "$node_heap_mb" ]] || ((node_heap_mb < 1024)); then
-      node_heap_mb=1024
-    elif ((node_heap_mb > 12288)); then
-      node_heap_mb=12288
-    fi
-
-    export NODE_OPTIONS="--max-old-space-size=${node_heap_mb}"
-  fi
+  export NODE_OPTIONS="--max-old-space-size=4096"

  # Ensure valid working directory for npm (avoids uv_cwd error)
  if [[ ! -d /opt ]]; then
@@ -65,14 +65,6 @@ component_exists_in_sources() {
  grep -h -E "^[^#]*Components:[^#]*\b${component}\b" /etc/apt/sources.list.d/*.sources 2>/dev/null | grep -q .
 }

-require_whiptail() {
-  if ! command -v whiptail >/dev/null 2>&1; then
-    msg_error "Missing dependency: whiptail"
-    echo -e "Install it first (e.g. apt update && apt install -y whiptail), then re-run this script."
-    exit 127
-  fi
-}
-
 # ---- main ----
 main() {
  header_info
@@ -98,14 +90,8 @@ main() {
  CODENAME="$(get_pbs_codename)"

  case "$CODENAME" in
-  bookworm)
-    require_whiptail
-    start_routines_3
-    ;;
-  trixie)
-    require_whiptail
-    start_routines_4
-    ;;
+  bookworm) start_routines_3 ;;
+  trixie) start_routines_4 ;;
  *)
    msg_error "Unsupported Debian codename: $CODENAME"
    echo -e "Supported: bookworm (PBS 3.x) and trixie (PBS 4.x)"
@@ -405,6 +405,11 @@ for container in $CHOICE; do
  esac
  exit_code=$?

+  if [ "$template" == "false" ] && [ "$status" == "status: stopped" ]; then
+    echo -e "${BL}[Info]${GN} Shutting down${BL} $container ${CL} \n"
+    pct shutdown $container &
+  fi
+
  #5) if build resources are different than run resources, then:
  if [ "$UPDATE_BUILD_RESOURCES" -eq "1" ]; then
    pct set "$container" --cores "$run_cpu" --memory "$run_ram"
@@ -416,11 +421,6 @@ for container in $CHOICE; do
    containers_needing_reboot+=("$container ($container_hostname)")
  fi

-  if [ "$template" == "false" ] && [ "$status" == "status: stopped" ]; then
-    echo -e "${BL}[Info]${GN} Shutting down${BL} $container ${CL} \n"
-    pct shutdown $container &>/dev/null &
-  fi
-
  if [ $exit_code -eq 0 ]; then
    msg_ok "Updated container $container"
  elif [ $exit_code -eq 75 ]; then
@@ -66,20 +66,10 @@ for container in $(pct list | awk '{if(NR>1) print $1}'); do
      pct start "$container"
      sleep 5
      update_container "$container" || echo " [Error] Update failed for $container"
-      # check if patchmon agent is present in container and run a report if found
-      if pct exec "$container" -- [ -e "/usr/local/bin/patchmon-agent" ]; then
-        echo -e "${BL}[Info]${GN} patchmon-agent found in ${BL} $container ${CL}, triggering report. \n"
-        pct exec "$container" -- "/usr/local/bin/patchmon-agent" "report"
-      fi
      echo -e "[Info] Shutting down $container"
      pct shutdown "$container" --timeout 60 &
    elif [ "$status" == "status: running" ]; then
      update_container "$container" || echo " [Error] Update failed for $container"
-      # check if patchmon agent is present in container and run a report if found
-      if pct exec "$container" -- [ -e "/usr/local/bin/patchmon-agent" ]; then
-        echo -e "${BL}[Info]${GN} patchmon-agent found in ${BL} $container ${CL}, triggering report. \n"
-        pct exec "$container" -- "/usr/local/bin/patchmon-agent" "report"
-      fi
    fi
  fi
 done
@@ -110,17 +110,15 @@ for container in $(pct list | awk '{if(NR>1) print $1}'); do
    elif [ "$status" == "status: running" ]; then
      update_container $container
    fi
-    if [ "$status" == "status: running" ]; then
-      if pct exec "$container" -- [ -e "/var/run/reboot-required" ]; then
-        # Get the container's hostname and add it to the list
-        container_hostname=$(pct exec "$container" hostname)
-        containers_needing_reboot+=("$container ($container_hostname)")
-      fi
-      # check if patchmon agent is present in container and run a report if found
-      if pct exec "$container" -- [ -e "/usr/local/bin/patchmon-agent" ]; then
-        echo -e "${BL}[Info]${GN} patchmon-agent found in ${BL} $container ${CL}, triggering report. \n"
-        pct exec "$container" -- "/usr/local/bin/patchmon-agent" "report"
-      fi
+    if pct exec "$container" -- [ -e "/var/run/reboot-required" ]; then
+      # Get the container's hostname and add it to the list
+      container_hostname=$(pct exec "$container" hostname)
+      containers_needing_reboot+=("$container ($container_hostname)")
+    fi
+    # check if patchmon agent is present in container and run a report if found
+    if pct exec "$container" -- [ -e "/usr/local/bin/patchmon-agent" ]; then
+      echo -e "${BL}[Info]${GN} patchmon-agent found in ${BL} $container ${CL}, triggering report. \n"
+      pct exec "$container" -- "/usr/local/bin/patchmon-agent" "report"
    fi
  fi
 done